Contact information or personal characteristics (name; email address; postal address; telephone number; signature)
| You | Service Providers/Sub-processors | Not sold/shared |
| Financial Information |
Payment card data
Bank account information
Credit information
| You | Service Providers/Sub-processors | Not sold/shared |
|
Commercial Information
|
Transaction information
Billing and payment records
Order history
| You | Service Providers/Sub-processors, including accounting firms and auditors | Not sold/shared |
| Internet or Electronic Network Activity Information |
IP address
Device identifier (e.g., MAC)
Advertising identifier (e.g., IDFA, AAID)
Information provided in URL string (e.g., search keywords)
Cookie or tracking pixel information
Information about your interaction with our website, app, email correspondence, or products
Diagnostic information (e.g., crash logs, performance data)
| You; our analytics and advertising partners | Service Providers/Sub-processors, our clients | Not sold/shared |
#### Your rights under the CCPA
* *Opt out of sale or sharing of personal information*: We do not sell or share your personal information. Note that your right to opt out does not apply to our disclosure of personal information to service providers.
* *Know and request access to and correction or deletion of personal information*: You have the right to request access to personal information collected about you and information regarding the source of that personal information, the purposes for which we collect it, and the third parties and service providers to whom we sell, share, or disclose it. You also have the right to request in certain circumstances that we correct personal information that we have collected about you and to delete personal information that we have collected directly from you.
### Your Texas, Colorado, Connecticut, Utah, and Virginia Privacy Rights
Residents of the States of Texas, Colorado, Connecticut, Utah, and Virginia have the following rights:
* *Opt out of “sales” of personal information and use of their personal information for “targeted advertising,”* as those terms are defined under applicable law.
* *Opt out of “profiling”* under certain circumstances, as defined under applicable law. (Residents of Colorado, Connecticut, and Virginia only.)
* *Confirm processing of and access to personal information* under certain circumstances.
* *Correct personal information* under certain circumstances. (Residents of Colorado, Connecticut, and Virginia only.)
* *Delete personal information* under certain circumstances.
Residents of these states can exercise their rights by contacting us at using one of the methods listed below.
### Your Nevada Privacy Rights
Residents of the State of Nevada have the right to opt out of the sale of certain pieces of their information to third parties. Currently, we do not engage in such sales. If you are a Nevada resident and would like more information about our data sharing practices, please contact us.
## Submission Options
Consumers may make a request pursuant to their rights under the applicable privacy laws by contacting us either at or through the support button on the bottom right-hand side of the screen on our website.
We will verify your request using the information associated with your account, including email address. Government identification may be required. Consumers can also designate an authorized agent to exercise these rights on their behalf.
Residents of California, Colorado, Connecticut, and Virginia have the right to appeal a denial of their request by contacting us as described in the notice of denial.
## Use of the Service by Minors
To the extent prohibited by applicable law, Dispel does not allow use of our Services and websites by anyone younger than 16 years old. If you learn that anyone younger than 16 has unlawfully provided us with personal data, please contact us and we will takes steps to delete such information.
## Changes to this Privacy Policy
We may update this privacy policy from time to time, and we will notify you of any such updates by either updating the “Last Updated” legend on this page; sending you some form of communication; or posting a notice on our website when the privacy policy has been updated. Please review the latest privacy policy periodically, especially before providing us with any information. Your continued use of our website, products and services means that you have accepted our latest privacy policy.
## Contacting Us
If you have any questions about this privacy policy, please do not hesitate to contact us at . Because email communications are not always secure, please do not include credit card information or other sensitive information in your emails to us. If you would like to send us a secure message, please ask for our public key and contact us at .
# Logo Usage Policy
## Executive Overview
Dispel embraces a partner-first got-to-market strategy, enabling a more targeted approach to driving value for our customers. To do so, it is important for our partners to be an extension of Dispel to foster a true sense of collaboration and trust with our customers and prospects. This document outlines the policy governing the use of the Dispel logo and other branding assets by our partners. This policy is designed to protect our intellectual property while allowing our partners to represent Dispel in relevant marketing and communications, in alignment with their contractual agreements.
## Scope
This policy applies to all Dispel partners who intend to use Dispel’s logo, trademarks, and branding materials. It defines the requirements and conditions under which these assets can be used, as well as the process for obtaining approval when necessary.
## Dispel Brand Guidelines
{% file src="/files/vCDy5zVNCtZam8dbMnVZ" %}
Download a copy of the Brand Guidelines
{% endfile %}
## Guidelines for Logo Use
### Authorized Use
Partners who have a signed contract with Dispel are authorized to use the Dispel logo and branding in specific contexts, such as:
* On their websites
* In product documentation
* At promotional events, including trade shows, webinars, and conferences
* In marketing and advertising materials directly related to the promotion of Dispel’s products or services
The use of the logo must comply with the following general guidelines:
1. **Proper Context:** The logo must be used only in connection with the promotion and resale of Dispel products and services.
2. **No Modification:** The logo should not be altered, resized, or distorted in any manner.
3. **Respect for Trademarks:** The logo must always be used in a way that respects Dispel’s trademarks, ensuring that our brand is not misrepresented.
### Use Without a Signed Contract
Partners who do not have a signed contract with Dispel are not authorized to use the Dispel logo, trademarks, or branding materials. To gain access, one must agree to the Dispel Logo Use Policy in accordance with Dispel’s Brand Guidelines, attached as an appendix to this document.
Dispel reserves the right to approve or deny or revoke approval at its sole discretion, based on brand strategy, market positioning, and other relevant factors.
If approved, Dispel will provide the partner with the official logo file and any usage guidelines to ensure consistency and adherence to branding standards.
### Logo Use in Marketing Materials
* **Promotional and Marketing Materials:** Partners must include a disclaimer where applicable, indicating that they are a partner of Dispel, and that the use of the logo does not imply an endorsement, joint venture, or any other relationship beyond the contractual partnership.
* **Event Use:** If the logo is being used at an event, such as a trade show, webinar, or conference, partners should ensure that the Dispel logo is displayed in a context where it is clear the partner is representing or showcasing Dispel's products/services.
## Restrictions
* **Non-Endorsement:** Partners are prohibited from using the Dispel logo in any manner that suggests a relationship, endorsement, or affiliation outside the scope of the reseller agreement or contract.
* **No Competing Products:** Partners are not permitted to use the Dispel logo on materials that feature competing products or services, unless approved prior to use.
* **Inappropriate Use:** The logo may not be used in any unlawful, misleading, or offensive manner, nor in connection with any materials that conflict with Dispel's ethical standards or reputation.
## Enforcement
Dispel reserves the right to take corrective actions if the logo is used improperly or without the required authorization, including:
* Requesting the immediate removal of the logo from unauthorized materials.
* Revoking permission to use the logo in the case of continued misuse.
* Pursuing legal remedies if necessary.
***
The Dispel logo and branding assets represent the quality and security of our products. We trust our partners to use these assets responsibly and in accordance with this policy. For any questions regarding the logo use or the approval process, please contact your partner account manager.
By following these guidelines, our partners will help maintain the integrity and consistency of the Dispel brand, ensuring that our reputation for providing secure remote access solutions is upheld across all channels.
# Support Policy - Service Level Agreement
Effective March 31, 2024
{% hint style="success" %}
To review current and historical Uptime, visit [Dispel Status](https://status.dispel.com).
{% endhint %}
## Definitions
1. “**Access Request Forms**” means the form user of VDI Health and VDI Management fill out to request access to an environment. This includes notifications to and approval by administrators.
2. "**Business Hours"** means 9 AM to 5 PM EST, Monday - Friday, excluding U.S. Federal holidays.
3. “**Continuous Monitoring**” means notifications will be received by Dispel twenty-four (24) hours per day, seven (7) days per week, three hundred sixty-five (365) days per year for the purpose of Incident reporting by Customer.
4. “**Device Operations**” means the ability for authorized users to create, read, update, and delete devices.
5. “**Downtime**” means a period of time (as determined by a combination of Dispel's internal and external monitoring systems) during which a large number of Users are unable to log into the service, view their dashboard, and reach any asset they have permission to reach and valid current access to.
6. “**Incident**” means any error, defect, failure, or abnormality in the Software or Services.
7. “**Region Health**” means the remote access network is performing according to the then-current Documentation.
8. “**Resource Operations**” means the ability for authorized Administrators to create, read, update, and delete Region resources including hubs, and entry and exit points.
9. “**Support**” means the support services described in Section 2 of this Schedule A.
10. "**Support Plan Tier**" means the tier of support service the customer has purchased.
11. “**Uptime**” means the percentage of total possible minutes the applicable Service Feature was available in a given calendar quarter during the applicable Order Term.
12. “**VDI Health**” means the functionality of a VDI is performing according to the then-current Documentation.
13. "**VDI Management**" means the ability to create, read, update, and delete VDI stack sizes. This also includes showing VDI usage for authorized users.
14. “**Wicket Health**” means the Wicket is performing according to the then-current Documentation.
### Operating Hours
| Tier | Basic | Premium | Mission Critical |
| --------------- | ----------------------------------------------------------------- | ------- | ---------------- |
| Operating Hours | 9 AM – 5 PM EST, Monday - Friday, excluding U.S. federal holidays | 24 x 7 | 24 x 7 |
## Incidents
1. Customer may report Incidents to Dispel through either the Service via the Dispel messenger system (the “Support Channel”) or by email at . This Support Channel and email inbox are Continuously Monitored. Dispel actively responds to Incident submissions at the customer's Support Plan Tier.
2. Customer will provide information and cooperation to Dispel as reasonably required for Dispel to provide Support. This includes, without limitation, providing the following information to Dispel regarding any reported Incidents: (i) aspects of the Services that are unavailable or not functioning correctly; (ii) the Incident’s impact on Users; (iii) start time of the Incident; (iv) list of steps to reproduce the Incident; (v) relevant log files or data; and (vi) wording of any error message.
3. Dispel's support personnel will assign a severity level (“**Severity Level**”) to each Incident in accordance with the table below and respond within the timeframe set forth:
### Response Times
Severity Level
Description
Response Time
Severity 1 (Urgent)
The Service is completely unaccessible for a large number of users, or numerous major functions are unresponsive or inoperable.
Basic Plan Initial Response: 4 Business Hours Update Frequency: 8 Business Hours
Premium Plan Initial Response: 2 hours Update Frequency: 4 hours
Operation of the Software or Service is critically affected (not responding to requests, serving content, or permitting remote access) for a large number of users; no workaround available.
Basic Plan Initial Response: 6 Business Hours Update Frequency: 12 Business Hours
Premium Plan Initial Response: 4 hours Update Frequency: 8 hours
Software or Service is responding and functional but performance is degraded, and/or Incident has potentially severe impact on operation of the Software or Service for multiple users.
Basic Plan Initial Response: 12 Business Hours Update Frequency: 24 Business Hours
Premium Plan Initial Response: 6 Business Hours Update Frequency: 12 Business Hours
4. Dispel will have no obligation to provide Support to the extent a reported Incident arises from: (a) use of the Software or Service by Customer in a manner not authorized in this Agreement or the applicable Documentation; (b) general Internet problems, force majeure events or other factors outside of Dispel’s reasonable control; (c) Customer's equipment, software, network connections or other infrastructure; or (d) third party systems, acts or omissions. If Customer purchased the subscription to the Software or Service through a reseller, Dispel may have no obligation to provide Support depending on Customer’s agreement with the reseller and Dispel.
## Uptime
1. **Service Level.** The Uptime calculation for each Service Feature that may be included with the applicable Services is described below (“Uptime Calculation”). If Dispel does not meet a Service Level in any calendar quarter during the applicable Order Term, Customer will be entitled to receive service credit on Customer’s next Dispel invoice (“Service Credits”) based on the calculation below (“Service Credits Calculation”).
1. **Basic Plan:** Dispel will maintain at least 99.9% Uptime for Online Service hosted by Dispel and at least 99% Uptime for Network Service hosted by Dispel (“Service Levels”).
2. **Premium Plan:** Dispel will maintain at least 99.9% Uptime for Online Service hosted by Dispel and at least 99% Uptime for Network Service hosted by Dispel (“Service Levels”).
3. **Mission Critical Plan:** Dispel will maintain at least 99.99% Uptime for Online Service hosted by Dispel and at least 99.9% Uptime for Network Service hosted by Dispel (“Service Levels”).
| Service Feature | Uptime Calculation | Service Credits Calculation |
| ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
Online Services
Access Request Forms
VDI Management
Device Operations
Resource Operations
|
(T - D)/T
Where T equals the total minutes in a calendar quarter, and D is Downtime.
|
A Service Credits claim shall be based on either (not both) of the following calculations:
10% of the amount Customer paid for a Service Feature in calendar quarter where the Uptime for that Service Feature was less than 99.9%, but equal to or greater than 99.0%; or,
25% of the amount Customer paid for a Service Feature in a calendar quarter where the Uptime of that Service Feature was less than 99.0%.
|
|
Network Services
Region Health
VDI Health
Wicket Health
| Same as above. |
A Service Credits claim may be based on either (not both) of the following calculations:
10% of the amount Customer paid for a Service Feature in calendar quarter where the Uptime for that Service Feature was less than to 99.0%, but equal to or greater than 98.0%; or,
25% of the amount Customer paid for a Service Feature in a calendar quarter where the Uptime of that Service Feature was less than 98.0%.
|
2. **Exclusions**. Downtime resulting from the following is excluded from the Uptime Calculation:
1. Weekly scheduled upgrades;
2. Emergency maintenance to patch a critical vulnerability or resolve a bug;
3. Any Amazon Web Service or Microsoft Azure downtime or scheduled maintenance;
4. Failure of internet connectivity, power, or other infrastructure between Customer environment and Dispel;
5. Factors outside Dispel's reasonable control, including force majeure events;
6. Customer's equipment, services, or other technology;
7. Customer's acts, omissions, or misuse of the applicable Services, including any violation of this Agreement; or,
8. Customer suspension due to customer’s breach of their agreement.
9. In addition, Dispel shall not be responsible for any Downtime if Customer has specified the location of Region or dashboard deployments, uses their own cloud or on-premises environments, or deploys virtual wickets onto non-Dispel approved hardware.
# Maintenance Windows
Dispel performs regular maintenance to keep our platforms working smoothly.
In the event a planned maintenance window will be accompanied by Downtime[^1] **more than** 10 minutes, we will give you at least 48 hours advanced notice. If you are on a private deployment, we will additionally coordinate with you in advance to find a mutually suitable time. In a year, scheduled Downtime won’t exceed 10 hours.
### Maintenance Windows
{% hint style="success" %}
Dispel's regularly scheduled maintenance windows for our platforms are on the following schedule:\
\
[dashboard.dispel.io](https://dashboard.dispel.io): 10 AM EST - 12 PM (noon) EST **every Tuesday.**
[app.dispel.com](https://app.dispel.com): 10 AM EST - 12 PM (noon) EST **every Wednesday**.
{% endhint %}
### **Customer Impact Scores**
When deploying updates to the Dispel platform, the time and effect on users can vary. We score our deployments to help customers understand how the update window will impact their workflow, to what degree, and what they may see during this time.
The below scoring also includes when we expect to notify our customers prior to the update event. We strive to meet our notification lead times and deploy during [regularly scheduled maintenance windows](#maintenance-windows), but we may not always be able to give lead time notifications in the event of an emergency, bug, or vulnerability fix.
{% hint style="info" %}
Notifications are posted on the Dispel Changelog:
{% endhint %}
Impact Score
Description
Notification Lead Time
1
Deployed items do not impact workflows or present visible dashboard changes.
5 business days
2
Deployed items may introduce visible changes, but they do not impact Dispel’s most common workflows.
5 business days
3
Deployed items represent new features or updates to existing features that will affect standard customer workflows.
15 business days
4
Deployed items will require Downtime and migration tasks performed by the customer.
30 business days
### Vulnerabilities and Critical Bug Fixes
In the event of a vulnerability or critical bug fix, Dispel may enter maintenance mode at any time. We will actively communicate with you with as much reasonable notice as possible.
[^1]: “[**Downtime**](/support/support-policy)” means a period of time (as determined by a combination of Dispel's internal and external monitoring systems) during which a large number of Users are unable to log into the service, view their dashboard, and reach any asset they have permission to reach and valid current access to.
# Product Lifecycle Policy
Learn about your options for getting service for your Dispel product after an end of full support or life of the product.
As Dispel advances our technology and addresses an evolving cybersecurity landscape, we issue new versions of our products and services. Dispel advises customers to install the latest product releases to remain as secure as possible and to take advantage of new features.
### General Availability (GA) Full Support
For one (1) year or longer per Dispel discretion, Dispel will provide Full Support for the version. Full Support includes incident support, troubleshooting, product fixes, security updates, and request to change product design and features.
### Extended Support
After Full Support has ended per the schedule table below, Dispel will provide Extended Support for an additional twelve (12) months. Extended support will be limited to troubleshooting, suggested workarounds, and mitigating critical (CVSS 9+) security vulnerabilities. If the cause of a troubleshooting issue or bug is fixed in a later version, Dispel support will direct customers to upgrade to a Fully Supported version of the product.
### End of Life
After a product has reached its End of Life, no new fixes will be made to the product. To resolve an issue with a product that is past end of life, Dispel support will require that the customer first upgrade to a Fully Supported version of the product.
## Lifecycle Phases for Products Under the Lifecycle Policy
| Type of Support | Full Support | Extended Support | Beyond End of Life |
| ----------------------------------------------------- | ------------ | -------------------------- | ------------------ |
| Ability to request product design and feature changes | Available | Not available | Not available |
| Security updates | Available | Available for CVSS 9+ only | Not available |
| Non-security update | Available | Not available | Not available |
| Self-help support | Available | Available | Available |
| Paid-support | Available | Available | Available |
Self-help support is available through a product's lifecycle and for a minimum of 12 months after the product reaches the end of its full support. Dispel documentation, FAQ, troubleshooting tools, and other resources are provided to help customers resolve common issues. Self-help support may no longer be current or available for versions of the software that are beyond end of life.
## Dispel Zero Trust Engine Schedule
Product Name
Version
Full Support
End of Full Support
End of Life
Console
2.x or earlier
January 2018
January 2019
January 2020
Console
3.x
October 2020
October 2021
October 2022
Dashboard
1.x
February 2020
February 2021
February 2022
Dashboard
2.x
November 2020
November 2021
November 2022
Dashboard
3.x
February 2021
February 2022
February 2023
Dashboard
4.x
August 2022
August 2023
August 2024
Dashboard
5.x
December 2022
December 2023
December 2024
Dashboard
6.x
July 2023
July 2025
July 2026
Dashboard
7.x
July 2025
July 2026
July 2027
The EOL date for the most recent release is only applicable to a fully numbered release if given. As new versions of Dispel Zero Trust Engine are released this table will be updated. All end dates are on the last day of the specified month.
# Data Protection Addendum
## Section 1 - Purpose
This Data Protection Addendum (“Addendum”) is entered into between Company and Dispel, LLC or Dispel Global, Inc as specified on your Order Form (“Dispel”) (each a “Party” and collectively, the “Parties”). This Addendum supplements and forms part of any existing, current, or future agreement between the Parties (any such agreement being individually or together referred to as the “Agreement”). This Addendum will be in effect as of the effective date of the Agreement (“Effective Date”); provided, however, the relevant obligations apply only to the extent that (i) Personal Data is subject to the Applicable Data Privacy Laws; and (ii) an Applicable Data Privacy Law has taken effect.
## Section 2 - Relationship with the Agreement
In the event of a conflict between this Addendum and the Agreement, the Addendum will control to the extent necessary to resolve the conflict. In the event the Parties use an International Data Transfer Mechanism and there is a conflict between the obligations in that International Data Transfer Mechanism and this Addendum, the International Data Transfer Mechanism will control.
## Section 3 - Definitions
Capitalized terms used but not defined have the meanings given in the Agreement.
1. “**Applicable Data Privacy Laws**” means all data protection and privacy laws applicable to the Processing of Personal Data under the Agreement, including the California Consumer Privacy Act (“CCPA”); the Colorado Privacy Act, the Connecticut Act of 2022 Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act of 2022, the Virginia Consumer Data Protection Act, and Regulation 2016/679 (General Data Protection Regulation) (“GDPR”), in each case as amended from time to time and including any regulations promulgated thereunder.
2. “**Consent**” means a Data Subject’s freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the Processing of Personal Data relating to him or her.
3. “**Controller**” means the entity that determines the purposes and means of Processing Personal Data. “Controller” includes equivalent terms in other Applicable Data Privacy Laws, such as the CCPA-defined terms “Business” and “Third Party,” as context requires.
4. “**Data Breach**” means “breach of the security of the system,” “security breach,” “breach of security,” “breach of system security,” and other analogous terms referenced in Applicable Data Privacy Laws.
5. “**Data Exporter**” means the Party that (1) has a corporate presence or other stable arrangement in a jurisdiction that requires an International Data Transfer Mechanism and (2) transfers Personal Data, or makes Personal Data available to, the Data Importer.
6. “**Data Importer**” means the Party that (1) is located in a jurisdiction that is not the same as Data Exporter’s jurisdiction and (2) receives Personal Data from the Data Exporter or is able to access Personal Data made available by the Data Exporter.
7. “**Data Subject**” means an identified or identifiable natural person.
8. “**Personal Data**” means information that is linked or linkable, directly or indirectly, to an identified or identifiable natural person. “Personal Data” includes equivalent terms in Applicable Data Protection Laws, such as the CCPA-defined term “Personal Information,” as context requires.
9. “**Processor**” means an entity that Processes Personal Data on behalf of another entity. “Processor” includes equivalent terms in other Applicable Data Privacy Laws, such as the CCPA-defined term “Service Provider,” as context requires.
10. “**Sensitive Data**” means the following types and categories of data: Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, a mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or immigration status; genetic data; biometric data; government identification numbers; payment card information; unencrypted identifier or username in combination with a password or other access code that would allow access to an account; precise geolocation information; and information from a known child.
11. “**Standard Contractual Clauses**” means the European Union standard contractual clauses for international transfers from the European Economic Area (“EEA”) to third countries, Commission Implementing Decision (EU) 2021/914 of 4 June 2021, available at .
12. “**Subprocessor**” means a Processor engaged by a Party who is acting as a Processor.
13. The following terms have the meanings assigned to them in Applicable Data Privacy Laws: “**Business**,” “**Business** **Purpose**,” “**Cross-Context Behavioral Advertising**,” “**De-identified Data**,” “**Process**” (and its cognates), “**Pseudonymous Data**,” “**Sale**” (and its cognates), “**Service Provider**,” “**Share**” (and its cognates), and “**Third Party**.”
## Section 4 - Description of the Parties’ Personal Data Processing Activities and Status of the Parties
1. Schedule 1 describes the purposes of Parties’ Processing, the types or categories of Personal Data involved in the Processing, and the Categories of Data Subjects affected by the Processing.
2. Schedule 1 lists the Parties’ statuses under Applicable Data Privacy Laws.
## Section 5 - International Data Transfer
1. Some jurisdictions require that an entity transferring Personal Data to a recipient in another jurisdiction take extra measures to ensure that the Personal Data has special protections if the law of the recipient’s jurisdiction does not protect Personal Data in a manner equivalent to the transferring entity’s jurisdiction (an “International Data Transfer Mechanism”). Parties will comply with an International Data Transfer Mechanism, including the Standard Contractual Clauses, that may be required by Applicable Data Privacy Laws.
2. If the International Data Transfer Mechanism on which Parties rely is invalidated or superseded, Parties will work together in good faith to find a suitable alternative.
3. With respect to Personal Data of Data Subjects located in the EEA, Switzerland, or the United Kingdom that Data Exporter transfers to Data Importer, or permits Data Importer to access, the Parties acknowledge that Dispel has been certified under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework.
4. With respect to Personal Data of Data Subjects located in a jurisdiction that requires an International Data Transfer Mechanism (e.g., the EEA, Switzerland, or the United Kingdom) that Data Exporter transfers to Data Importer, or permits Data Importer to access, the Parties agree that by executing this Addendum they also execute the Standard Contractual Clauses, which will be incorporated by reference and form an integral part of the Agreement. Parties agree that, with respect to the elements of the Standard Contractual Clauses that require Parties’ input, Schedules 1-4 contain information relevant to the Standard Contractual Clauses and their Annexes. Parties agree that, for Personal Data of Data Subjects in the United Kingdom, Switzerland, or another country specified in Schedule 4, they adopt the modifications to the Standard Contractual Clauses listed in Schedule 4 to adapt the Standard Contractual Clauses to local law, as applicable.
## Section 6 - General Data Privacy Obligations
1. **Compliance**. The parties will comply with their respective obligations under Applicable Data Protection Laws, including by providing the level of privacy protection that is required of Businesses under theCCPA.
2. Upon request, Dispel will provide reasonably relevant information to Company to enable Company to fulfill its obligations (if any) to conduct data protection assessments or prior consultations with data protection authorities.
3. **Notification**. Dispel will notify Company if it determines that it can no longer meet its obligations under Applicable Data Privacy Laws.
## Section 7 - Dispel’s Obligations as a Processor or Service Provider
1. Dispel will have the obligations set forth in this Section 7 if it Processes the Personal Data of Data Subjects in its capacity as Company’s Processor or Service Provider.
2. Scope of Processing
1. Dispel will Process Personal Data solely for the Business Purposes specified in Schedule 1, to carry out its obligations under the Agreement, and to carry out Company’s documented instructions.
2. Processing any Personal Data outside the scope of the Agreement and this Addendum will require prior written agreement between Dispel and Company.
3. Dispel is prohibited from retaining, using, or disclosing the Personal Data (1) for any purpose other than the Business Purposes specified in Schedule 1, including retaining, using, or disclosing the Personal Data for a commercial purpose other than carrying out Company’s instructions, (2) outside of the Parties’ direct business relationship, unless permitted by Applicable Data Privacy Laws, or (3) by combining Personal Data that Dispel receives from, or on behalf of, Company with Personal Data that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the Data Subject, provided that Dispel may combine Personal Data to perform any Business Purposes permitted by Applicable Data Privacy Law.
4. Dispel will not Sell or Share the Personal Data that it collects or obtains pursuant to the Agreement.
3. **Confidentiality.** Dispel will ensure that each person who Processes Personal Data is subject to a duty of confidentiality with respect to such Personal Data.
4. **Compliance.**
1. Dispel will assist Company in complying with Data Subjects’ requests to delete and correct Personal Data under Applicable Data Protection Law when Company forwards such requests that it receives to Dispel and will make available to Company any Personal Data in its possession that Company needs to respond to Data Subjects’ requests to access their Personal Data.
2. Dispel will make available to Company, upon the Company’s reasonable request, all information in its possession necessary to demonstrate Dispel’s compliance with its obligations under Applicable Data Privacy Laws.
5. **Permitted Activities.** Notwithstanding the foregoing prohibitions, Parties agree that Dispel may, and Company instructs Dispel to, Process Personal Data for the following activities when necessary to support the Business Purposes specified in Schedule 1; detect data security incidents; protect against fraudulent or illegal activity; effectuate repairs; and maintain and improve the quality of the services provided for the Business Purposes specified in Schedule 1.
6. **Subprocessors.**
1. If Dispel discloses Personal Data to a Subprocessor for a Business Purpose, Dispel and Subprocessor will enter into a written contract that prohibits the Subprocessor from (i) Selling or Sharing Personal Data; or (ii) retaining, using, or disclosing Personal Data for any purpose other than for the specific Business Purpose for which the Personal Data was disclosed.
2. Dispel will require any Subprocessor to comply with applicable obligations under Applicable Data Privacy Laws, including providing the same level of privacy protection required of Businesses by the CCPA.
3. Company grants Supplier general authorization to engage Subprocessors if Dispel and those Subprocessors enter into an agreement that requires the subprocessor to meet obligations that are no less protective than this DPA. The Subprocessors currently engaged by Dispel are listed in Schedule 2.
4. Dispel will notify Company of any additions to or replacements of its Subprocessors and make that list available on Company’s request. Dispel will provide Company with 30 days to object to the addition or replacement of Subprocessors in connection with Dispel’s performance under the Agreement, calculated from the date Dispel provides notice to Company. If Company reasonably objects to the addition or replacement of Dispel’s Subprocessor, the parties will enter into good faith negotiations to resolve the matter. If the parties are unable to resolve the matter within 15 days of Company’s reasonable objection (which deadline the parties may extend by written agreement), Company may terminate any statement of work or purchase order that require the continued use of the Subprocessor subject to objection.
5. Dispel will be liable for the acts or omissions of its Subprocessors to the same extent as Supplier would be liable if performing the services of the Subprocessor directly under the DPA.
7. **Duration of Processing, Deletion and Return of Personal Data.** Dispel shall retain Personal Data for a period coterminous with the term of the Agreement. At the expiration or termination of the Agreement, or upon request by Company, Dispel will, without undue delay: (1) upon request return all Personal Data to Company; or (2) upon request by Company, destroy all Personal Data, in each case unless applicable laws expressly require otherwise or the Parties agree otherwise expressly in writing. After deleting or returning Personal Data to Company, copies of such data may remain in Dispel data backups for limited periods of time until the backups are overwritten. For any Personal Data that Dispel retains after expiration or termination of the Agreement, Dispel will continue to comply with this Addendum.
8. **Assessment and Remediation.**
1. Company may take reasonable and appropriate steps, as provided in Applicable Data Privacy Laws, to ensure Dispel Processes the Personal Data in a manner consistent with Company’s obligations under Applicable Data Privacy Laws, including by conducting reasonable assessments or audits, as provided by Applicable Data Privacy Laws. If Company and Dispel agree to an audit or assessment by a qualified and independent third party, Dispel agrees to provide a report of such audit or assessment to Company upon request.
2. If Company discovers unauthorized use of Personal Data by Dispel or Dispel’s Subprocessors, Company may, upon notice, take reasonable and appropriate steps to remediate such unauthorized use.
## Section 8 - Security
1. Dispel will implement appropriate technical and organizational measures to protect Personal Data from a Data Breach and to preserve the security and confidentiality of Personal Data.
2. Upon becoming aware of a Data Breach, Dispel will:
1. Notify Company without delay of the Data Breach, but in any case, no later than 72 hours after becoming aware of, or reasonably suspecting, the Data Breach;
2. Promptly investigate or perform required assistance in the investigation of the Data Breach and provide Company with detailed information about the Data Breach, including a description of the Data Breach, the approximate number of Data Subjects affected, the Data Breach’s current and foreseeable impact, and the measures Dispel is taking to address the Data Breach and mitigate its effects; and
3. Promptly take all commercially reasonable steps to mitigate the effects of the Data Breach or assist Company in doing so.
3. Dispel will comply with this Section 8 at Dispel’s cost, unless the Data Breach arose from Company’s negligent or willful acts.
4. Dispel must obtain Company’s written approval before notifying any governmental entity, individual, the press, or other third party of a Data Breach that affected or reasonably could affect Personal Data that Dispel obtained from, or Processed on behalf of, Company. Notwithstanding anything to the contrary in this Addendum, Dispel may notify a third party about a Data Breach affecting Personal Data if it is under a legal obligation to do so, provided that Dispel must: (1) make every effort to give Company prior notification, as soon as possible, if it intends to disclose the Data Breach to a third party; and (2) if it is not possible to give Company such prior notification, notify Company immediately once it becomes possible to give notification. For any disclosure of a Data Breach to a third party, Dispel will, as part of its notification to Company, disclose the identity of the third party and a copy of the notification (if the notification to the third party has not been sent, Dispel will provide the draft to Company and permit Company to offer edits or updates).
## Section 9 - Miscellaneous
1. **Entire agreement.** This Addendum is the Parties’ entire agreement on this subject and merges and supersedes all related prior and contemporaneous oral understandings, representations, prior discussions, letters of intent, or preliminary agreements.
2. **No further amendment.** Except as modified by this Addendum, the Agreement remains unmodified and in full force and effect.
***
## Schedule 1 - Description of Processing
Processing Activity
Status of the Parties
Categories of Sensitive Data Processed
Categories of Sensitive Data Processed
Status of the Parties as Data Exporter or Importer
Company discloses Personal Data to Dispel in connection with the Business Purpose(s) listed below.
Company is a Controller.
Dispel is a Processor/Service Provider.
Name and email address of end users Company registers with Dispel.
IP addresses of end users Company registers with Dispel.
None
Company is the Data Exporter.
Dispel is the Data Importer.
Module 2
### Business Purposes
\_\_\_\_ Processing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
X Processing related to ensuring security and integrity, to the extent that the information is reasonably necessary for these purposes.
X Debugging to identify and repair errors that impair existing intended functionality.
\_\_\_\_ Short-term, transient use, including but not limited to non-personalized (*i.e.*, contextual) advertising shown as part of a Data Subject’s current interaction with the Business, in the course of which the Data Subject’s Personal Data is not disclosed to a Third Party and is not used to build a profile about the Data Subject or otherwise alter the consumer’s experience outside of the current interaction.
X Performing services on behalf of the Business, such as maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the Business.
\_\_\_\_ Providing advertising and marketing services, not including Cross-Context Behavioral Advertising, to the Data Subject, in the course of which the Service Provider shall not combine the Personal Data of Data Subjects who have opted out of Sales or Sharing of Personal Data that the Service Provider received from or on behalf of the Business with Personal Data that the Service Provider receives from or on behalf of any other person or collects from its own interaction with Data Subjects.
X Undertaking internal research for technological development and demonstration.
X Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured for, or controlled by the Business, and to improve, upgrade, or enhance such a service or device.
***
## Schedule 2 - Dispel Subprocessors
Dispel uses the Subprocessors listed here:
{% content-ref url="/pages/-LsYl7BFEa-Y1ICYyQ0z" %}
[Sub-Processor List](/privacy/sub-processor-list)
{% endcontent-ref %}
***
# Data Subject Consent Form
I am hereby consenting that Dispel can process my personal data for the following purposes:
* To respond to my questions and fulfill my requests.
* To send helpful information to me, such as notifying me of changes to Dispel's terms of use, end user license agreement or privacy policy.
* To complete and fulfill my purchases and provide me with customer service.
* To send me marketing communications.
* To personalize my experience on Dispel's website and use of Dispel's products and services.
* To allow me to participate in Dispel's promotions, which may have their own rules.
* For Dispel's other internal business purposes, such as data analysis, audits, fraud monitoring and prevention, developing new products, enhancing, improving or modifying Dispel's products and services, identifying usage trends, determining the effectiveness of Dispel's promotional campaigns, and operating and expanding Dispel's business activities.
* As Dispel believes to be necessary or appropriate: (a) under applicable law; (b) to comply with legal process, litigation and/or requests from the U.S. or a state Government; (c) to enforce Dispel's Terms and EULA; (d) to protect Dispel's operations or those of any of Dispel's affiliates; (e) to protect Dispel's rights, privacy, safety or property, and/or that of Dispel's affiliates, me or others; and (f) to allow us to pursue available remedies or limit the damages that we may sustain.
* To comply with Dispel's internal policies or legal proceedings in connection with investigations of any violations or suspected violations of Dispel's Terms and/or EULA; we reserve the right to use, release or otherwise share any usage logs or other records concerning me if me violate the Terms or EULA, or intentionally or unintentionally partake (or are reasonably suspected of partaking) in any illegal activity.
I am aware and I was informed that I have a right to ask Dispel to stop using or limit their use of me personal data in certain circumstances—for example, if Dispel has no lawful basis to keep using me data, or if I think my personal data is inaccurate. I may withdraw my consent by contacting Dispel at to do so. I agree that the withdrawal of consent does not affect the lawfulness of the processing activities up to the point it is confirmed by Dispel to have been withdrawn.
# Sub-Processor List
To support Dispel in delivering its Services, Dispel may engage third party service providers to assist Dispel with its data processing activities. When we work with these service providers in our capacity as a data processor, the third-party service provider is a sub-processor of Dispel (“Sub-processor”).
This page identifies our Sub-processors, describes where they are located, and what services they provide to us. Before engaging any Sub-processor, we perform extensive due diligence, including detailed security and legal analysis. We do not engage a Sub-processor unless our quality standards are met.
Dispel currently uses the following Sub-processors:
### External Service Providers
SUB-PROCESSOR
SERVICE PROVIDED
LOCATION OF THE SUB-PROCESSOR
Amazon Web Services
Cloud service provider
United States, European Union, Japan
Microsoft Azure
Cloud service provider
United States, European Union, Japan
Heroku
Cloud management
United States
Intercom
User relationship management
United States
Mailchimp
Marketing
United States
Microsoft
Email, file storage
United States
MaxMind
IP intelligence API
United States
Stripe
Billing
United States
Zapier
Data management
United States
Sentry
Logging
United States
Papertrail
Logging
United States
Google Cloud Platform
Security monitoring & alerting
United States
SentinelOne
Security monitoring & alerting
United States
### Infrastructure
When you deploy infrastructure through Dispel, you may also choose to build your network from the following providers:
SUB-PROCESSOR
SERVICE PROVIDED
Your Function
Amazon Web Services
Cloud service provider
Data Controller
DigitalOcean
Cloud service provider
Data Controller
IBM Cloud
Cloud service provider
Data Controller
Microsoft Azure
Cloud service provider
Data Controller
Rackspace
Cloud service provider
Data Controller
Vultr
Cloud service provider
Data Controller
Google Cloud Platform
Cloud service provider
Data Controller
### Business Systems (generally out of scope)
SUB-PROCESSOR
SERVICE PROVIDED
LOCATION OF THE SUB-PROCESSOR
Box
File storage
United States
Hubspot
Customer relationship management
United States
Dialpad
Phone service
United States
### Proposed Sub-processors
The following Sub-processors are planned for deployment.
SUB-PROCESSOR
SERVICE PROVIDED
LOCATION OF THE SUB-PROCESSOR
This space left intentionally blank
N/A
N/A
## Updates
Our business needs may change from time to time. For example, we may deprecate a Sub-processor to consolidate and minimize our use of Sub-processors. Similarly, we may add a Sub-processor if we believe that doing so will enhance our ability to deliver our Services. We will periodically update this page to reflect additions and removals to our list of Sub-processors.
For more information on Dispel's privacy practices, please consult our [Privacy Policy](/policies/privacy-policy).
# Security & Data Protection
{% hint style="info" %}
Need immediate access to the Dispel Security Team? Email us at .
{% endhint %}
## Our commitment
We build for critical infrastructure. That means your data security, privacy, and uptime are non-negotiable. Dispel’s Zero Trust Engine and operations program are independently audited, mapped to leading frameworks, and designed to help you meet your own compliance obligations.
## Certifications & attestations
* **SOC 2 Type 2** and **ISO 27001**: audited by accredited third parties, with controls spanning security, availability, confidentiality, and integrity.
* **FedRAMP High (pending)** and **export & sector standards** (e.g., EAR, ITAR, EN 301 549 accessibility, VPAT/Section 508) supported by internal controls and documentation.
* **CMMC Level 1**: CMMC, or Cybersecurity Maturity Model Certification, is a U.S. Department of Defense (DoD) program that standardizes cybersecurity for defense contractors
> Need attestation reports and certificates? Visit our [Trust Center](https://app.drata.com/trust/9cbb69e8-0c38-11ee-865f-029d78a187d9).
## Built for compliance alignment
Many customers inherit Dispel’s controls to satisfy portions of their own frameworks. We provide alignment and shared-responsibility guidance for **NIST 800-53/82**, **IEC 62443**, **NERC CIP**, and **NIS2**.
## Privacy by design
We protect personal data and offer transparent controls over collection and processing. Our program supports **EU GDPR** and **U.S. CCPA** requirements, with clear policies and contact paths for questions or concerns.
# Technical and Organizational Measures
Dispel’s TOMs combine zero trust security, encryption, and governance to safeguard sensitive data and meet global compliance standards.
## Introduction and Scope
Dispel is committed to safeguarding personal data and sensitive information by implementing robust technical and organizational measures across all aspects of its operations. These measures are designed to comply with applicable legal and regulatory frameworks, including the GDPR, the Data Privacy Framework (US–EU, US–Swiss, and US–UK), and contractual obligations under our Data Protection Addendum.
This document describes the practices Dispel applies to ensure the confidentiality, integrity, and availability of data. The measures outlined here are not theoretical—they are actively enforced and regularly audited through internal processes, independent third-party assessments, and certifications.
***
## Governance and Accountability
Information security at Dispel is grounded in clear governance. We maintain policies covering information security, acceptable use, data protection, and access control, which are binding on all employees, contractors, and suppliers. Responsibility for oversight rests with senior leadership, and dedicated roles—including security and compliance officers—ensure accountability.
Dispel also subjects itself to regular audits and external certifications. Our current security posture is monitored in our real-time governance risk compliance (GRC) trust management platform, which demonstrates adherence to standards such as SOC 2 Type II and ISO 27001. These attestations, combined with internal policy reviews and continuous monitoring, form the backbone of our compliance and accountability framework.
## Risk Management
Risk management is embedded into Dispel’s operations. We perform periodic risk assessments to identify emerging threats, prioritize mitigations, and ensure that controls remain appropriate to the risk environment. Particular attention is given to vendor and third-party risks, since these can introduce systemic vulnerabilities.
All high and critical-risk suppliers are contractually required to meet the same, or no less stringent, cybersecurity standards that Dispel enforces internally. This alignment guarantees that security obligations extend across the supply chain and that customer data remains protected, regardless of where or by whom it is processed.
## Organizational Measures
Dispel invests in people and processes as much as in technology. All staff undergo mandatory security awareness training at onboarding and receive periodic refresher training. We also maintain a formal incident response process that ensures rapid detection, escalation, and remediation of security events.
Business continuity and disaster recovery capabilities are documented, tested, and updated regularly. These include distributed backups across availability zones, strict recovery point and recovery time objectives, and the ability to isolate systems if needed. In addition, Dispel supports legal hold and eDiscovery processes by capturing and preserving data snapshots in secure environments when required.
Change management is another key component of our organizational controls. System updates, configuration changes, and software deployments follow a formal approval process that includes security review, testing, and documentation.
## Technical Measures
### Access Control
Access control is strictly enforced using role-based access models and the principle of least privilege. Multi-factor authentication is required for privileged accounts, and sessions are automatically terminated after periods of inactivity.
### Data Protection
Data protection is achieved through strong encryption practices. All sensitive data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256. Where possible, personal data is pseudonymized or anonymized to minimize exposure. Data classification schemes ensure that information is handled according to its sensitivity.
### Network and System Security
Network and system security are underpinned by the Dispel Zero Trust Engine. This architecture enforces micro-segmentation, moving target defense, and strict access workflows for operational technology and IT systems. Complementing this, we deploy firewalls, intrusion detection and prevention systems, and distributed denial-of-service protections. Regular vulnerability scanning and penetration testing confirm the resilience of these defenses.
### Monitoring and Logging
Monitoring and logging provide visibility across the environment. Security events are centrally collected, correlated, and analyzed to identify anomalies. Logs are retained in accordance with policy and are available for audit and forensic review.
### Secure Development
Secure development practices are followed in all product engineering following IEC 62443-4-1. Dispel uses modern CI/CD pipelines with automated security checks, GitHub Advanced Security for vulnerability detection, and coding standards aligned to OWASP Top 10 and other industry-standard guidance. Changes undergo peer review and testing prior to release.
### Endpoint Security
Endpoint security is enforced through managed protection tools, full-disk encryption, patch management, and compliance monitoring across devices.
## Physical and Environmental Security
While Dispel primarily operates in cloud environments, physical security remains critical. Data centers used by Dispel employ layered protections, including biometric access controls, CCTV monitoring, redundant power and cooling, and fire suppression systems. Hardware disposal follows NIST 800-88 standards to ensure data is irretrievably destroyed.
## Resilience and Recovery
Dispel’s operations are designed for resilience. Backups are geographically distributed, regularly tested, and protected from unauthorized access. Disaster recovery procedures are rehearsed to validate that recovery objectives are met and that service continuity can be maintained even in adverse scenarios.
## Continuous Improvement
Security is not static. Dispel conducts quarterly reviews of its security posture, annual penetration testing, and ongoing threat modeling. Lessons learned from incidents or near misses feed directly into updates to policies, controls, and technologies. By continuously adapting, we ensure that our measures remain effective against evolving threats.
## Data Protection and Privacy
Dispel’s commitment to data privacy is formalized through its Data Protection Addendum, which governs how personal data is processed, protected, and transferred. We are certified under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Framework, and the UK Extension to the EU-U.S. Framework, ensuring lawful cross-border data flows.
***
## Conclusion
The measures described here represent Dispel’s comprehensive approach to technical and organizational safeguards. They combine strong governance, disciplined operational practices, and advanced technology to ensure that data is protected at all times. These measures are reviewed regularly and refined to meet the expectations of customers, regulators, and the evolving security landscape.
{% hint style="info" %}
Have more questions or want to request copies of our certifications? Contact us at .
{% endhint %}
# Data Privacy Framework
Dispel is certified under the EU–U.S. Data Privacy Framework, UK Extension, and Swiss–U.S. DPF, ensuring secure, compliant, and trusted cross-border data transfers.
At Dispel, protecting sensitive data is not just a feature — it is a commitment. Our solutions are built with security and privacy by design, and we hold certifications that reflect the rigor of our practices.
## Data Privacy Framework Certification
Dispel is certified under the **EU–U.S. Data Privacy Framework (DPF)**, the **UK Extension to the DPF**, and the **Swiss–U.S. DPF**. These frameworks, administered by the U.S. Department of Commerce and recognized by the European Commission, the UK government, and the Swiss government, establish clear standards for how organizations handle personal data transferred from Europe, the United Kingdom, and Switzerland to the United States.
Our certification ensures that:
* Personal data is collected, processed, and retained in compliance with DPF principles.
* Data subjects maintain enforceable rights, including access, correction, and recourse mechanisms.
* Dispel upholds strong accountability and transparency requirements when sharing information with third parties.
This certification demonstrates our dedication to respecting global privacy requirements and enabling our customers to confidently transfer data across jurisdictions.
This certification is built off our legal obligations to you set forth in our [Privacy Policy](/policies/privacy-policy) and [Data Protection Addendum](/privacy/data-protection-addendum).
{% hint style="success" %}
## Download a copy of our DPF certifications
View Dispel's certification at
The DFP website unfortunately does not yet support direct links. Please search "Dispel" to find our record.
{% endhint %}
# HIPAA Compliance
This guide covers HIPAA compliance on Dispel-SaaS instances of the Dispel Zero Trust Engine.
{% hint style="info" %}
This guide is for informational purposes only. Dispel does not intend the information or recommendations in this guide to constitute legal advice. Each customer is responsible for independently evaluating its own particular use of the services as appropriate to support its legal compliance obligations.
{% endhint %}
## Intended Audience
For customers who are subject to the requirements of the Health Insurance Portability and Accountability Act (known as HIPAA, as amended, including by the Health Information Technology for Economic and Clinical Health — HITECH — Act), [Dispel Zero Trust Engine supports HIPAA compliance](https://dispel.com/security). This guide is intended for security officers, compliance officers, IT administrators, and other employees who are responsible for HIPAA implementation and compliance on the Dispel Zero Trust Engine. After reading this guide, you will understand how Dispel Zero Trust Engine is able to support HIPAA compliance as well as understand how to configure Dispel Zero Trust Engine instances to help meet your responsibilities under HIPAA.
## Definitions
Any capitalized terms used but not otherwise defined in this document have the same meaning as in [HIPAA](https://www.hhs.gov/hipaa/for-professionals/index.html). Furthermore, for the purposes of this document, Protected Health Information (PHI) means the PHI Dispel receives from a Covered Entity.
## Overview
**It is important to note that there is no certification recognized by the US HHS for HIPAA compliance and that complying with HIPAA is a shared responsibility between the customer and Dispel.** Specifically, HIPAA demands compliance with the [Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html?language=es), the [Privacy Rule](https://www.hhs.gov/hipaa/for-professionals/privacy/index.html?language=es), and the [Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html?language=es). Dispel Zero Trust Engine supports HIPAA compliance (within the scope of a Business Associate Agreement) but ultimately customers are responsible for evaluating their own HIPAA compliance.
Dispel will enter into Business Associate Agreements with customers as necessary under HIPAA. Specific details on our approach to security and data protection including details on organizational and technical controls regarding how Dispel protects your data, can be found in the [Technical and Organizational Measures](/security-and-data-protection/how-we-protect-you/technical-and-organizational-measures).
In addition to documenting our approach to security and privacy design, Dispel undergoes several independent third party audits on a regular basis to provide customers with external verification (reports and certificates are linked below). This means that an independent auditor has examined the controls present in our data centers, infrastructure and operations. Dispel has annual audits for the following standards:
* **SSAE 18 / ISAE 3000.** Our SOC 2 Type 2 report can be obtained under NDA.
* **ISO 27001.** Dispel-managed instances of the Dispel Zero Trust Engine is certified under ISO 27001. Our ISO 27001 certificate is available on the compliance section of our website.
In addition to ensuring the confidentiality, integrity and availability of Dispel's environment, Dispel's comprehensive third party audit approach is designed to provide assurances of Dispel's commitment to best in class information security. Customers may reference these third party audits reports to assess how Dispel's products can meet their HIPAA compliance needs.
## Customer Responsibilities
One of the key responsibilities for a customer is to determine whether or not they are a Covered Entity (or a Business Associate of a Covered Entity) and, if so, whether they require a Business Associate Agreement with Dispel for the purposes of their interactions.
While Dispel provides a secure and compliant infrastructure (as described above) for the storage and processing of PHI, the customer is responsible for ensuring that the environment and applications that they remotely access and connect over the Dispel Zero Trust Engine are properly configured and secured according to HIPAA requirements. This is often referred to as the shared security model in the cloud.
### Essential best practices:
* Execute a [Dispel BAA](/term/hipaa-business-associate-addendum).
* Disable or otherwise ensure that you do not use Dispel products that are not explicitly covered by the BAA when working with PHI.
### Recommended technical best practices:
* Use [IAM best practices](https://help.dispel.io/en/articles/7915486-creating-a-proper-permissions-hierarchy-for-operational-technology) when configuring who has access to your organization. In particular, because administrator accounts can be used to access facilities and devices, ensure access to those accounts and account credentials is tightly controlled.
* Determine whether your organization has encryption requirements beyond what is required by the HIPAA security rule. Verify that [Dispel encryption](https://help.dispel.io/en/articles/9184540-encryption-tunnel-implementation) meets your standards.
* Configure [audit log export destinations](https://help.dispel.io/en/articles/9657644-configuring-syslog-forwarding-from-dispel-to-log-aggregators). We strongly encourage exporting audit logs to your SIEM/SOAR tool for long term archival as well as any analytical, monitoring, and/or forensic needs. Be sure to configure access control for those destinations appropriate to your organization.
* Configure [access control](https://help.dispel.io/en/articles/5811443-how-to-onboard-a-new-user-admin) for the logs appropriate to your organization. Admin and user activity audit logs can be accessed by users with the Administrator roles and activity audit logs can be accessed by users with the Administrator and Custodian roles.
* Regularly review audit logs to ensure security and compliance with requirements. You may also consider leveraging SIEM platforms from our [third-party integrations](https://dispel.com/resources/integrations) to demonstrate compliance through log analysis.
* When creating or updating users, regions, facilities or devices, be sure to avoid including PHI or security credentials anywhere in your namespaces, including device names, user groups, and users.
* When creating or updating resources, be sure to avoid including PHI or security credentials when specifying a resource’s metadata as that information may be captured in the logs. Audit logs never include the data contents of a resource, but resource metadata may be captured.
* When using Virtual Desktops ("VDI") for remote access, avoid including or storing PHI within VDIs.
* When using Password Vaults, avoid including or storing PHI within the vault.
* When deploying Wickets, customers bear the responsibility for certain security aspects, particularly physical security. To ensure the security of your Dispel deployment, you must understand the security responsibilities outlined on the [Shared Responsibilities](https://help.dispel.io/en/articles/10517167-shared-responsibilities) page.
## Covered Products
{% hint style="warning" %}
Dispel's BAA does not cover [Customer Cloud or On-Premises](https://help.dispel.io/en/articles/10517167-shared-responsibilities#h_9a295af0aa) instances of Covered Products.
{% endhint %}
The Dispel BAA covers Dispel Zero Trust Engines' entire SaaS infrastructure (all regions, all network paths, all points of presence), and the following products:
* Zero Trust Engine
* Engine Identity
* Data Streaming
* Password Vault
* Virtual Desktops
* Browser Connect
* Logs
* Dispel SecOps
This list is updated as new products become available to the HIPAA program.
## Unique Features
Dispel's security practices allow us to have a HIPAA BAA covering Dispel's entire infrastructure, not a set aside portion of our SaaS product. As a result, you are not restricted to a specific region which has scalability, operational and architectural benefits. You can also benefit from multi-regional service redundancy for high-availability.
The security and compliance measures that allow us to support HIPAA compliance are deeply ingrained in our infrastructure, security design, and products. As such, we can offer HIPAA regulated customers the same products at the **same pricing** that is available to all customers, including sustained use discounts. Other providers charge more money for their HIPAA platforms, we do not.
## Conclusion
The Dispel Zero Trust Engine is the industrial access infrastructure where customers can securely access, transfer, and manage connections from health information, without having to worry about the underlying infrastructure.
# Dispel Compliance Offerings
{% hint style="info" %}
You are wholly responsible for ensuring your own compliance with all applicable laws and regulations. Information provided in Dispel online documentation doesn't constitute legal advice, and you should consult your legal advisor for any questions regarding regulatory compliance.
{% endhint %}
### Overview
Dispel is a secure, high-performance remote access and data streaming platform built for industrial and operational technology environments worldwide. Our infrastructure enables customers to deploy and manage zero-trust networks with precision and reliability across multiple regions and industries.
Dispel maintains a comprehensive certification and attestation program, reflecting independent, third-party validation of our information security management and operational controls. These certifications demonstrate our commitment to protecting data, maintaining service availability, and ensuring compliance with globally recognized standards.
To help customers meet their own regulatory and cybersecurity obligations, Dispel provides comprehensive documentation, including attestation reports and audit summaries through our Trust Portal.
Access the Dispel Trust Portal
### Audit documentation
You must have an existing subscription or trial account in [Dispel](mailto:undefined) to download audit documents.
You can access Dispel audit and certification documentation via the [Trust Portal](https://app.drata.com/trust-center/settings). You must sign in or execute the Trust Portal NDA to access audit documentation. You can then download audit certificates, assessment reports, and other applicable documents to help you with your own regulatory requirements.
For access to Dispel Government documentation, contact your Dispel account team.
# EU Cyber Resilience Act
# Essential Cybersecurity Requirements
How Dispel’s products meet the Essential Cybersecurity Requirements set out in Annex I, Parts I and II of Regulation (EU) 2024/2847
This document provides a high-level description of how Dispel meets the **Essential Cybersecurity Requirements** set out in **Annex I, Parts I and II** of Regulation (EU) 2024/2847 (Cyber Resilience Act, or "**CRA**") for the digital elements listed below. Corporate IT systems, internal tooling, and unrelated SaaS components are out of scope except where they directly support the security properties of the listed products.
#### **Digital Elements in Scope**
* Dispel Applications (macOS, iOS, Windows)
* Wicket ESI
## CRA Requirements
### Annex I, Part I: Secure-by-Design and Development
| CRA Requirement | Conformity Statement |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Protection against unauthorized access | The products implement authenticated and authorized access mechanisms appropriate to their operating environments, preventing unauthorized logical access. |
| Confidentiality of data | Data processed, stored, or transmitted by the products is protected using industry-standard cryptographic mechanisms by default. |
| Integrity of data, commands, and code | Integrity protections are applied to product code, configuration, commands, and updates to prevent unauthorized modification. |
| Availability and resilience | The products are designed to remain available and to fail safely under adverse conditions, including resilience to common attack techniques. |
| Secure-by-default configuration | Products are delivered with secure default configurations that do not require additional hardening to achieve baseline security. |
| Minimization of attack surface | Only necessary services, interfaces, and permissions are enabled by default; unnecessary functionality is disabled or excluded. |
| Protection from known vulnerabilities | Known vulnerabilities in product components are identified and addressed prior to release. |
| Secure update mechanisms | Updates are delivered through authenticated and integrity-protected mechanisms to prevent tampering. |
| Secure lifecycle support | Security updates are provided for a defined support period appropriate to the product lifecycle. |
| Logging and monitoring (where appropriate) | Security-relevant events are recorded or surfaced in a manner appropriate to the product’s role and environment. |
| Least privilege | Products operate using the minimum privileges required for their intended functionality. |
| Protection against malicious code execution | Measures are implemented to prevent unauthorized or malicious code execution within the product. |
| Secure interoperability | Interactions with operating systems and external components are designed and implemented securely. |
| Resistance to common attack techniques | Product design considers common attack vectors such as spoofing, replay, tampering, and privilege escalation. |
### Annex I, Part II: Vulnerability Handling and Post-Market Obligations
| CRA Requirement | Conformity Statement |
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
| Vulnerability handling process | A documented vulnerability handling process is maintained for the products in scope. |
| Coordinated Vulnerability Disclosure (CVD) | A public channel exists for the responsible disclosure of security vulnerabilities. |
| Vulnerability intake and triage | Reported vulnerabilities are assessed, prioritized, and tracked based on severity and impact. |
| Timely remediation | Security vulnerabilities are remediated without undue delay. |
| Secure distribution of fixes | Security fixes are distributed using the same secure update mechanisms as standard releases. |
| User and customer communication | Users are informed of relevant security issues when appropriate. |
| Exploitation awareness | Information about known or suspected exploitation is monitored and considered during response activities. |
| Regulatory reporting | Procedures exist to report actively exploited vulnerabilities to relevant EU authorities when required by law. |
| Software Bill of Materials (SBOM) | Software composition information is maintained for the products. |
| Record retention | Records relating to vulnerabilities and remediation actions are retained for regulatory review. |
# Data Residency
Data residency refers to the geographic location where customer data is processed and stored.
### Overview
Data residency refers to the geographic location where customer data is processed and stored. At Dispel, we prioritize transparency and control, allowing customers to manage their data locations based on their specific requirements. This guide explains how data residency works across different Dispel deployment models:
* [Dispel SaaS](#h_d723768bf3)
* [Customer Cloud](#h_c4e8126fb7), and
* [On-Premise deployments](#h_c4e8126fb7)
### Dispel SaaS Data Residency
For customers utilizing Dispel SaaS, all data processing occurs through Dispel-managed infrastructure. Our sub-processors are located in the United States, as listed in our official [Sub-Processor List](/privacy/sub-processor-list). The governance of data protection under Dispel SaaS follows the [Dispel Data Protection Addendum](/privacy/data-subject-consent-form), ensuring compliance with industry standards and security best practices.
Key Points:
* Dispel SaaS leverages U.S.-based sub-processors.
* Data protection is governed by Dispel’s Data Protection Addendum.
* Customers can control their data routing preferences through available geographic deployment options.
### Customer Cloud & On-Premise Deployments
For Customer Cloud and On-Premise deployments, Dispel does not act as a sub-processor. Instead, the customer maintains full responsibility for data storage, processing, and compliance. This means that all data residency decisions, infrastructure management, and legal obligations fall under the customer's direct control.
Key Points:
* Dispel is not a sub-processor in these environments.
* The customer assumes full responsibility for data security and residency.
* Customers manage their own infrastructure, compliance, and access control.
{% hint style="info" %}
Learn more about [Shared Responsibility](/security-and-data-protection/shared-security-model/shared-responsibilities) on the Dispel Zero Trust Engine.
{% endhint %}
***
### Customer-Controlled Data Routing
During daily operations, Dispel allows customers to control where their data routes based on the geographic locations they select for their deployments. Data residency is primarily determined by the following factors:
Region Selection
* Customers choose a primary geographic region for their SD-WAN deployment.
* This decision influences where network services are hosted.
* Data does not reside in the network (with the exception of security information and enforcement rules), but will transit through those geographies.
Virtual Desktop Geolocation
* The Virtual Desktop location is configurable via the Dispel dashboard.
* Users can select from available data center locations to optimize performance and compliance needs.
* Data during the session is stored at these locations.
Wicket Deployment Location
* A Wicket serves as an access gateway and its geographic location affects routing policies.
* Customers determine where to deploy Wickets based on security and latency preferences.
* Data does not reside in the Wicket (with the exception of security information and enforcement rules), but will transit through these locations.
### Managing Data Residency in Dispel
To configure data residency settings:
1. Log into your Dispel Dashboard.
2. Navigate to Regions > Select or modify the Region for your environment.
3. Navigate to Stacks > Configure the Virtual Desktop location as needed.
4. Ensure Wicket deployments align with your data residency and access policies.
By selecting the appropriate geographic regions for these components, customers can effectively manage data residency, latency, and compliance needs.
***
## Summary
* Dispel SaaS deployments use U.S.-based sub-processors and follow Dispel’s Data Protection Addendum.
* Customer Cloud & On-Premise deployments place full data responsibility on the customer, with Dispel not acting as a sub-processor.
* Customers have control over data routing based on Region, Virtual Desktop, and Wicket deployment locations.
* Geolocation settings are configurable via the Dispel Dashboard.
# Complementary User Entity Controls
This page summarizes the customer security responsibilities for Dispel’s SaaS and on-prem deployments.
{% hint style="info" %}
This document speaks to comprehensive security controls for security. For specific technical shared responsibilities, please visit [Shared Responsibilities](/security-and-data-protection/shared-security-model/shared-responsibilities).
{% endhint %}
## Introduction
As part of Dispel’s commitment to security and transparency, we publish this Complementary User Entity Controls (CUECs) document to identify the security responsibilities that rest with our customers. These controls are **complementary** to those implemented by Dispel and are critical to ensuring that the combined security program for your environment—spanning Dispel’s Zero Trust Engine (ZTE), remote access workflows, micro-segmentation, and threat-detection features—operates effectively.
Because Dispel serves organizations operating in highly regulated sectors—including industrial manufacturing, critical infrastructure, utilities, defense contractors, and operators of OT/ICS environments—we align our CUECs with the frameworks **most commonly used by our customers**:
* **IEC 62443-3-3** (System Security Requirements and Security Levels), widely used for OT and industrial control systems; and
* **NIST SP 800-53 Rev. 5 High Baseline**, used across U.S. federal and defense programs and often adopted by enterprises seeking strong cybersecurity controls.
We encourage customers to view Dispel’s controls and their own controls as a shared-responsibility model. Dispel secures the cloud infrastructure, platform features, and connective workflows. Customers secure the assets, identities, networks, and processes they manage.
**The specific division of responsibilities depends heavily on how Dispel is deployed**, and our customers use Dispel in two distinct ways:
1. **Dispel-Hosted SaaS Deployment** — Dispel operates the entire platform infrastructure.
2. **On-Premises / Customer-Cloud Deployment** — The platform is deployed fully inside customer-controlled infrastructure, and the customer assumes operational hosting responsibilities.
This document will help you understand how to fulfill your part of both models.
### Why Dispel Uses IEC 62443-3-3 and NIST SP 800-53 High
Our customers overwhelmingly operate in sectors subject to rigorous regulatory, operational, and safety requirements.\
By grounding CUECs in IEC and NIST:
* Customers can readily map Dispel’s controls into their existing compliance obligations.
* Audit cycles are clearer and faster, as customer-side responsibilities are expressed in a familiar framework.
* The shared responsibility structure aligns with global expectations for critical infrastructure and high-assurance systems.
### Understanding Complementary User Entity Controls
CUECs identify the **security controls the customer must operate** so that Dispel’s platform—whether hosted by us or by you—functions securely.
* In **SaaS deployments**, Dispel handles platform hosting, infrastructure security, and system availability.
* In **On-Prem / Customer-Cloud deployments**, customers assume many of those functions and must perform platform-level operations as well as site-level security.
Each section below highlights what customers must do in each deployment model.
## Customer Responsibilities by Security Domain
### **Identity & Access Management (IAM)**
{% hint style="info" %}
**Mapping:** IEC 62443 SR-1.1–1.5; NIST AC-2, AC-3, AC-5, AC-6, IA-2, IA-5
{% endhint %}
#### **Why this matters**
Attackers commonly target identities. Dispel integrates with your IdP, but you control authentication upstream.
#### **Customer Responsibilities**
**SaaS Deployment**
* Maintain user lifecycle processes for your IdP (provision/de-provision).
* Enforce MFA on your enterprise IdP.
* Maintain least-privilege role assignments.
* Secure customer-managed credentials, API keys, and certificates.
**On-Prem / Customer-Cloud Deployment**
All SaaS responsibilities **plus**:
* You are responsible for securing, maintaining, and hardening the identity systems you integrate with Dispel.
* You must configure, secure, and monitor the authentication infrastructure used by the Dispel instance (e.g., SAML/SCIM endpoints hosted internally).
* You are responsible for access control on all platform servers, VMs, and support systems.
### Asset, Configuration & Change Management
{% hint style="info" %}
**Mapping:** IEC 62443 SR-7.1–7.6; NIST CM-2, CM-3, CM-6, CM-8
{% endhint %}
#### **Why this matters**
Dispel secures connectivity; you control the assets connected behind it (PLCs, firewalls, HMIs, servers).
#### **Customer Responsibilities**
**SaaS Deployment**
* Maintain inventory of assets behind Dispel micro-segments.
* Maintain secure configurations of OT/ICS/IT assets connected to Dispel.
* Validate that only authorized assets reside in Dispel segments.
* Follow change-control processes for systems integrated with Dispel.
**On-Prem / Customer-Cloud Deployment**
All SaaS responsibilities **plus**:
* You operate and patch the virtual machines, servers, storage, networking, and OS layers that host the Dispel platform.
* You maintain configuration baselines and change control for Dispel platform nodes, load balancers, databases, and endpoint services.
* You must ensure secure installation, configuration, and dependency management for all platform components.
### Logging, Monitoring & Incident Response
{% hint style="info" %}
**Mapping:** IEC 62443 SR-6.1–6.3; NIST AU-6, AU-11, IR-4, IR-6, IR-8
{% endhint %}
#### **Why this matters**
Dispel logs platform activity. Customers log their internal environment.
#### **Customer Responsibilities**
**SaaS Deployment**
* Monitor logs for systems not hosted by Dispel (local OT/IT networks).
* Maintain and execute your internal IR plan.
* Maintain an SIEM/SOC if you so choose.
* Designate security contacts for coordination with Dispel.
* Perform local containment (e.g., isolating plant networks).
**On-Prem / Customer-Cloud Deployment**
All SaaS responsibilities **plus**:
* You must collect, store, protect, and monitor logs generated by the Dispel platform infrastructure itself.
* You are responsible for maintaining uptime for monitoring systems (SIEM, log collectors).
* You must integrate platform logs into your IR workflow and perform forensic preservation as needed.
* You own the patching and security lifecycle of monitoring agents on platform nodes.
### Physical & Environmental Security
{% hint style="info" %}
**Mapping:** IEC 62443 SR-2.1–2.4; NIST PE-3, PE-4, PE-13, PE-18
{% endhint %}
#### **Why this matters**
Physical access defeats digital controls.
#### **Customer Responsibilities**
**SaaS Deployment**
* Secure all local OT/ICS assets and workstations.
* Protect engineering laptops used to access Dispel.
* Maintain environmental protections on local systems.
**On-Prem / Customer-Cloud Deployment**
All SaaS responsibilities **plus**:
* You must secure the physical servers, racks, data centers, and cloud resources hosting the Dispel platform.
* You must ensure environmental controls (power, cooling, humidity) for all platform nodes.
* You must physically restrict access to administrative consoles and hardware used by the platform.
### Network Security & Communications Integrity
{% hint style="info" %}
**Mapping:** IEC 62443 SR-5.1, SR-5.2, SR-7.6; NIST SC-3, SC-5, SC-7, SC-13
{% endhint %}
#### **Why this matters**
Dispel provides secure transport and micro-segmentation. Customers control surrounding networks.
#### **Customer Responsibilities**
**SaaS Deployment**
* Maintain segmentation and firewall rules at your network boundary.
* Patch and secure your local networking equipment (firewalls, routers, proxies).
* Harden ICS protocols behind your network.
* Validate contractor access before issuing credentials.
**On-Prem / Customer-Cloud Deployment**
All SaaS responsibilities **plus**:
* You secure and operate the network that hosts the Dispel platform, including VLANs, subnets, cloud VPCs, and routing controls.
* You must configure secure ingress/egress rules for platform components.
* You are responsible for securing local load balancers, API gateways, VPN bridges, and HA pairs used by the platform.
* You must protect and isolate platform management interfaces.
### Data Governance & Recovery
{% hint style="info" %}
**Mapping:** IEC 62443 SR-3.2, SR-4.1, SR-7.4; NIST CP-9, MP-2, SC-12, SC-13
{% endhint %}
#### **Why this matters**
Customers own their data and must maintain governance over how it is stored, transmitted, and backed up.
#### **Customer Responsibilities**
**SaaS Deployment**
* Maintain backups of any data stored outside Dispel’s cloud.
* Classify and handle data according to your internal policies.
* Manage customer-owned materials used in integrations.
**On-Prem / Customer-Cloud Deployment**
All SaaS responsibilities **plus**:
* You must back up and restore the Dispel platform infrastructure (databases, configs, platform nodes, etc.).
* You must ensure secure storage, rotation, and protection of any encryption keys used by the platform.
* You are responsible for backup media protection and disaster recovery processes for the entire deployment.
### Endpoint Security
{% hint style="info" %}
**Mapping:** IEC 62443 SR-3.4, SR-3.5, SR-4.1; NIST SI-2, SI-3, SI-7, SC-3
{% endhint %}
#### **Why this matters**
Compromised endpoints undermine remote access security regardless of platform protections.
#### **Customer Responsibilities**
**SaaS Deployment**
* Harden and monitor endpoints accessing Dispel (antivirus/EDR, secure configuration, patching).
* Secure target jump hosts or HMIs connected to through Dispel.
**On-Prem / Customer-Cloud Deployment**
All SaaS responsibilities **plus**:
* You must secure the endpoints hosting Dispel platform services:
* Admin consoles
* Deployment servers
* Orchestration servers
* Any underlying OSes
* You must maintain patching, vulnerability scanning, and malware protection for all platform nodes.
# Shared Responsibilities
The differences in shared responsibilities in the Dispel Zero Trust Engine
{% hint style="info" %}
This page describes the standard Dispel and Customer shared responsibility model. Please refer to your applicable Purchase Orders for customizations.
{% endhint %}
This document describes the obligations and differences of the shared responsibility model for deploying and maintaining the Dispel Zero Trust Engine. It discusses the challenges and nuances of the shared responsibility model. This document also describes how we partner with our customers to address security challenges.
Understanding the shared responsibility model is important when determining how to best protect your data and environments behind Dispel. The shared responsibility model describes the tasks that you have when it comes to security in remote access and how these tasks are different between on-premises, customer cloud, and SaaS deployments.
## Shared responsibility
You're the expert in knowing the security and regulatory requirements for your business, and knowing the requirements for protecting your confidential data and resources. When you use Dispel, you must identify the security controls that you need to employ around Dispel and during sessions to help protect your confidential data and environments. To decide which security controls to implement, you must consider the following factors:
* Your regulatory compliance obligations
* Your organization's security standards and risk management plan
* Security requirements of your customers and your vendors
***
### Defined by deployment method
Traditionally, responsibilities are defined by the type of deployment method you elect to use, and the Dispel services you require.
| Deployment Method | Text |
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SaaS |
Fully managed, cloud-hosted deployment where Dispel handles infrastructure, security, and maintenance.
Runs in Dispel’s secure cloud environments.
Best for organizations seeking a hands-off, scalable, and fast-to-deploy solution.
|
| Customer Cloud |
Deployed within a customer’s own cloud environment.
Customers maintain direct control over cloud security settings, with Dispel providing platform support.
Best for organizations with strict data sovereignty, compliance, or integration needs.
|
| On-Premises |
Fully contained, on-premise deployment within a customer’s industrial or enterprise network.
Runs on dedicated hardware or virtualized environments within the customer’s facility.
Best for highly regulated industries (e.g., defense, utilities, critical infrastructure) that require air-gapped or offline environments.
|
The following diagram shows the cloud services and defines how responsibilities are shared between Dispel and customer.
***
### Defined by component
#### Central Management Dashboard, Region, & Virtual Desktops
Dispel is responsible for the security of our software components. Responsibility for the underlying infrastructure on which these components are deployed varies by deployment method.
#### Wicket ESI
Dispel is responsible for the security of the Wicket ESI software, including development, security updates, and application security.
The Customer is responsible for maintaining the environment where Wicket ESI is deployed, including hardware, OS updates, network security, and compliance.
| Hardware | Provisioning & Maintenance | N/A | Deploying Wicket ESI on physical/virtual hardware |
| -------------------------- | -------------------------------------- | -------------------------------------------- | --------------------------------------------------------- |
| | Physical Security | N/A | Securing physical access to the device |
| | Performance & Resource Allocation | N/A | Ensuring sufficient CPU, RAM, and storage |
| Operating System | OS Patching & Updates | N/A | Keeping OS up to date with security patches |
| | OS Hardening | N/A | Applying security baselines and CIS benchmarks |
| | User Access Management | N/A | Managing OS admin/user accounts and access policies |
| Network | Firewalls | N/A | Managing network firewalls, VLANs, and routing |
| | Uptime & Availability | N/A | Maintaining Internet connectivity and reliability |
| | Monitoring & Logging | Generates network activity logs | Monitoring and responding to events and incidents |
| Tunnel Security | Encryption | Cipher implementation | N/A |
| | Routing & SD-WAN | Provisioning and connectivity | N/A |
| Software Security | Application-Level Security | Secure coding, security testing, and reviews | N/A |
| | Software Updates & Vulnerability Fixes | Providing Wicket ESI patches and updates | N/A |
| | Software Patching | Available with Support | Applying Wicket ESI patches and updates |
| | Configuration Security Guidance | Offering security best practices for setup | Applying recommended security configurations |
| Backup & Disaster Recovery | Data Protection & Recovery | N/A | Implementing backup and restore procedures for Wicket ESI |
***
### Defined by industry and regulatory framework
Various industries have regulatory frameworks that define the security controls that must be in place for operational technology (OT) and industrial control systems (ICS). When deploying your secure remote access and data streaming within Dispel’s Zero Trust Engine, it is essential to understand:
* Which security controls are your responsibility
* Which security controls are provided as part of the Dispel platform
* Which security controls are inherited from Dispel’s infrastructure
Inherited security controls—such as Dispel’s default encryption, secure development lifecycle, and disaster recovery/business continuity—can be used as evidence of compliance when engaging with auditors and regulators.
When deploying within Dispel, compliance responsibilities are shared between your organization and Dispel. Please see [Complementary User Entity Controls](/security-and-data-protection/shared-security-model/complementary-user-entity-controls) for more details.
Other industries—such as utilities, maritime, and healthcare—have regulations that define how data must be secured, processed, and stored. For more details on how Dispel supports compliance in these sectors, refer to our [Compliance Resource Center](https://dispel.com/security).
***
#### Defined by location
Depending on your industry and operational needs, you may need to evaluate your security responsibilities based on the location of your business, your customers, and your data. Various countries and regions enforce regulatory requirements that dictate how data must be processed, stored, and accessed.
For example, if your organization serves customers in the European Union (EU), you may be required to comply with the General Data Protection Regulation (GDPR) and ensure that customer data remains within EU-based infrastructure. In this case, you are responsible for enforcing data residency policies, ensuring that collected data remains in Dispel's EU cloud regions or within your own EU-based infrastructure if deployed in a private cloud or on-premises environment.
To better understand regional compliance requirements, refer to Dispel’s Compliance Offerings. If your compliance needs are complex—such as cross-border data transfer restrictions, industry-specific mandates, or hybrid deployments—we recommend speaking with Dispel’s [security and compliance team](https://dispel.com/book) or one of our [partners](https://dispel.com/partners/directory) to help you evaluate your responsibilities.
# Ethics & Responsibility
Dispel maintains robust, clear controls around how we operate as a business and contribute to our communities.
{% columns %}
{% column width="50%" %}
### Social
***
{% content-ref url="/pages/sQ48mrYW6mKyfI66J3Z5" %}
[Environment & Sustainability](/ethics-and-responsibility/social/environment-and-sustainability)
{% endcontent-ref %}
{% content-ref url="/pages/0D8ye53bwxVh1TorWYgt" %}
[Opportunity & Merit](/ethics-and-responsibility/social/opportunity-and-merit)
{% endcontent-ref %}
{% endcolumn %}
{% column width="50%" %}
### Legal
***
{% content-ref url="/pages/LAXVKnutGamzlGlgUC67" %}
[Accessibility Statement](/ethics-and-responsibility/legal/accessibility-statement)
{% endcontent-ref %}
{% content-ref url="/pages/C4f69XlyxDXsG8YVWRtq" %}
[Modern Slavery Act Statement](/ethics-and-responsibility/legal/modern-slavery-act)
{% endcontent-ref %}
{% endcolumn %}
{% endcolumns %}
# Environment & Sustainability
Confronting climate change for our generation and beyond
Climate change presents an existential threat to the continued health and wellbeing of our planet and its inhabitants. As an organization, we recognize our responsibility in helping to protect the earth through our business practices and products. We are committed to minimizing our impact on the environment, creating a sustainable business, and helping others reduce their carbon footprint.
Sustainability at Dispel begins with our behavior, suppliers, and technology. We recognize the need for science-based targets to reduce our greenhouse gas (GHG) emissions, while using carbon capture to offset those emissions we cannot yet stop.
Our goal is to avoid the most catastrophic effects of climate change by limiting the increase in global average temperature to at most 1.5°C above preindustrial levels.
### Download a copy of our Environment & Sustainability Statement here:
{% file src="/files/PJWS9xRjsIBlmshDdJaO" %}
Download Dispel's Environment & Sustainability Statement
{% endfile %}
# Opportunity & Merit
Fostering Excellence Through Open and Fair Opportunities
Dispel is committed to continuing to build a workforce that represents the best of us. Every day we take conscious action to foster an open, performance-based culture that invites full and respected participation from every member of our company. In our recruiting we continue to seek out the best people from every background, ensuring fair and transparent pathways for professional growth.
We believe in rewarding ambition, expertise, and dedication, and we continuously refine our policies and practices to support a thriving work environment where the most capable individuals can excel. Our commitment extends to sharing our experiences and successes with the broader community.
{% hint style="info" %}
#### **Interested in joining our team?**
See our open jobs
{% endhint %}
## Our Values
We believe in hiring the smartest, nicest people with the most experience in their fields who get stuff done.
#### **Hire the Best and Empower Excellence**
We prioritize intelligence, skill, and integrity. We seek out and support individuals who demonstrate exceptional capability and a drive to succeed.
#### **Encourage Innovation and Growth**
We embrace an environment where taking calculated risks, learning from mistakes, and fostering innovation are encouraged. We believe that progress comes from pushing boundaries and refining ideas.
#### **Commit to Strong Work Ethic and Collaboration**
Success is achieved through teamwork, discipline, and accountability. We create an environment where people support each other, challenge ideas constructively, and work together toward shared goals.
#### **Foster a Culture of Open Dialogue**
We encourage all team members to voice their insights and listen actively. At Dispel, everyone has a seat at the table, and diverse perspectives drive the evolution of our company and technology.
## Welcoming Talent
Dispel is committed to complying with all federal, state, and local equal employment laws. To that end, the company is dedicated to maintaining a work environment that is free from harassment and discrimination on the basis of age, race, creed, color, national origin (including ancestry), religion, gender or sex, sexual orientation (including transgender status, gender identity or expression), pregnancy (including childbirth, lactation, and related medical conditions), alienage or citizenship status (unless required by law), disability, reproductive health decision making (including, but not limited to, the decision to use or access a particular drug, device, or medical service), marital status, partnership status, caregiver status, domestic violence victim status, familial status, military status, unemployment status, genetic information (including genetic characteristics), or any other protected status under federal, state, or local laws. The company is dedicated to the fulfillment of this policy with respect to all aspects of employment, including, but not limited to, recruiting, hiring, placement, transfer, training, promotion, compensation, termination, and all other terms, conditions, and privileges of employment.
Dispel will conduct a prompt and thorough investigation of all allegations of discrimination, harassment, or retaliation, or any violation of Dispel’s Equal Employment Opportunity Policy (EEO-P) in a confidential manner. The company will take appropriate corrective action, if and where warranted. The company prohibits retaliation against employees who provide information about, complain about, or assist in the investigation of any complaint of discrimination or violation of the EEO-P.
Dispel has a zero-tolerance policy toward discrimination and harassment. For details on how to report discrimination or harassment see the EEO-P in the company handbook.
### Community Alignment
Dispel supports the United Nations’ Sustainable Development Goals.
When we think about programs and policies, these include the goals set forth by the UN for (Goal 5) Gender Equality and (Goal 16) Peace, Justice, and Strong Institutions.
## Opportunity & Merit in Practice
### Fair Hiring and Advancement
Dispel’s hiring philosophy is based on capability, experience, and potential. We implement structured evaluation processes to minimize bias and ensure that decisions are made based on merit. Our hiring pipeline is designed to attract highly skilled individuals from a wide range of sources, ensuring that opportunity is available to all who are qualified.
### Commitment to Professional Development
We invest in the growth of our employees by providing access to continued education, mentorship programs, and leadership development opportunities. By nurturing talent from within, we ensure that individuals who demonstrate skill and initiative have clear paths for career advancement.
### Objective Performance Metrics
Our performance evaluations are based on clear, measurable criteria. Success at Dispel is determined by contributions, problem-solving abilities, and the impact an individual has on our team and mission.
### Maintaining a Respectful and Inclusive Work Environment
Dispel is committed to ensuring a workplace where all employees are treated with dignity and respect. Harassment and discrimination of any kind are not tolerated, and we uphold policies that reinforce a professional and constructive work culture.
## **Community Engagement and Industry Leadership**
### Ethical Business Practices and Supplier Standards
Dispel holds itself and its partners to the highest ethical standards. Our supplier relationships reflect our commitment to quality, reliability, and integrity. We evaluate vendors based on their ability to deliver superior products and services while adhering to our standards of professionalism and fairness.
### Encouraging Civic Participation
We support our employees in exercising their civic rights, including voting and community involvement. Dispel provides paid time off for employees to participate in elections.
# Dispel Code of Conduct
Trust. Accountability. Integrity.
### Our Commitment
Dispel is built on trust.
We protect critical infrastructure, industrial systems, and cyber-physical environments where reliability, security, and integrity are essential. The organizations that rely on us expect disciplined execution, lawful conduct, and principled decision-making. This Code of Conduct reflects the standards we follow in every aspect of our operations.
It applies to all Dispel employees, officers, directors, contractors, and representatives. It defines how we conduct business, how we treat others, and how we uphold the responsibilities entrusted to us.
### Lawful and Ethical Operations
Dispel complies with all applicable laws and regulations in the jurisdictions in which we operate. This includes laws governing anti-corruption, trade compliance, export controls, competition, labor and employment, privacy, and cybersecurity.
We do not engage in bribery, corruption, kickbacks, or improper influence of any kind. We do not offer or accept anything of value intended to secure unfair advantage. Business decisions are made on merit, transparency, and alignment with our legal and ethical obligations.
Where our internal standards exceed the minimum requirements of applicable law, we hold ourselves to the higher standard.
### Integrity in Business Practices
We compete vigorously and fairly. Dispel does not participate in anti-competitive conduct, price fixing, bid manipulation, or improper information sharing.
We avoid conflicts of interest and require disclosure of situations that could compromise objectivity. Decisions must be made in the best interests of Dispel and our customers—not personal gain.
We maintain accurate books, records, and financial reporting in accordance with applicable accounting standards and legal requirements. Transparency and accuracy are foundational to maintaining trust with customers, partners, and regulators.
### Information Security and Confidentiality
As a cybersecurity company serving critical sectors, safeguarding information is central to our mission.
Dispel protects customer data, partner information, and company assets against unauthorized access, disclosure, or misuse. Access to systems and data is granted based on legitimate business need and governed by strong administrative, technical, and physical controls.
Confidential information—whether belonging to Dispel or entrusted to us—must be handled responsibly at all times.
We also respect intellectual property rights and protect our proprietary technologies, trade secrets, and innovations while honoring the rights of others.
### Respect, Human Rights, and Professional Conduct
Dispel is committed to a professional environment grounded in dignity and respect.
We prohibit discrimination, harassment, forced labor, child labor, and human trafficking in any form. Employment decisions are based on merit, qualifications, and legitimate business needs.
Individuals who raise concerns in good faith are protected from retaliation. Accountability requires an environment where concerns can be voiced responsibly and addressed appropriately.
### Responsible Stewardship
We use company assets—including technology systems, intellectual property, and financial resources—solely for legitimate business purposes. We maintain safeguards to protect our infrastructure and support operational resilience.
We are committed to responsible operations and compliance with applicable environmental, health, and safety requirements.
### Speaking Up
Dispel encourages the reporting of suspected violations of this Code, applicable laws, or company policies. Concerns are reviewed in good faith and addressed appropriately. Retaliation against individuals who report concerns in good faith is not tolerated.
### Ongoing Commitment
Ethical conduct is not static. As legal requirements evolve and industry standards advance, Dispel reviews and updates its policies to maintain alignment with best practices and regulatory expectations.
Integrity, accountability, and disciplined security practices are essential to our mission. This Code reflects the standards we follow to earn and maintain the trust placed in us.
# Accessibility Statement
Adherence to Web Content Accessibility Guidelines (WCAG 2.1) and ISO/IEC 40500:2012
Dispel is committed to making its websites and applications accessible, in accordance with Title III of the U.S. Americans with Disabilities Act of 1990 (42 U.S.C. § 12101) and, for our U.S. Government clients, Section 508 of the Rehabilitation Act of 1973 (29 USC § 794d).
To meet this commitment, our websites and applications have been designed to conform to the W3C Web Content Accessibility Guidelines (WCAG) 2.1, Level AA. Our applications use both native operating system (“OS”) elements and brand designs. By using native elements, Dispel leverages the powerful accessibility features provided by the OS manufacturer. If not otherwise covered by the native OS, our brand designs are intended to conform to the WCAG 2.1, Level AA.
{% hint style="info" %}
The information in this document is **not** legal advice. If you have questions about the applicability of the policies to specific situations, please consult legal authorities for the appropriate jurisdiction.
{% endhint %}
### Download a copy of our Accessibility Statement here:
{% file src="/files/atb8x1NPAp2wD12M74vB" %}
Dispel Accessibility Statement
{% endfile %}
## Technical Information About Dispel’s Website and Application Accessibility
Dispel is committed to making its websites and applications accessible, in accordance with the U.S. Americans with Disabilities Act of 1990 (42 U.S.C. § 12101).
### Compliance Status
Information on our compliance status is detailed in our Accessibility Conformance Report (ACR) based on the ITI Voluntary Product Accessibility Template® (VPAT®). Dispel uses the VPAT 2.4 INT, which incorporates [revised Section 508 standards](https://www.access-board.gov/ict/) (the U.S. Federal accessibility standard), [EN 301 549](https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.01.01_60/en_301549v030101p.pdf) (the European Union’s “Accessibility requirements suitable for public procurement of ICT products and services in Europe”), and [WCAG 2.1](https://www.w3.org/TR/WCAG21) and [ISO/IEC 40500](https://www.iso.org/standard/58625.html) (W3C/WAI’s recently updated Web Content Accessibility Guidelines).
{% file src="/files/5tVX2PZVlbzpmwcuwUYh" %}
Accessibility Conformance Report
{% endfile %}
## Feedback and Contact Information
We’re always looking to improve the accessibility of our websites and applications. If you have feedback or concerns related to the accessibility of any content on our websites or applications, have ideas or comments that would help us improve the accessibility and usability of our website, or think we’re not meeting accessibility requirements, please email us at . If applicable, please include the web address or URL and the specific problems you have encountered.
## Enforcement Procedure
The U.S. Department of Justice (DoJ) is responsible for enforcing the American with Disabilities Act (ADA).
Despite our very best efforts to allow anybody to adjust our websites and applications to their needs, there may still be aspects that are not fully accessible, are in the process of becoming accessible, or are lacking an adequate technological solution to make them accessible. Still, we are continually improving our accessibility; adding, updating, and improving its options, and features; and developing and adopting new technologies. All this is meant to reach the optimal level of accessibility, following technological advancements.
If you’re not happy with how we respond to your complaint, you may contact the DoJ Civil Rights Division to file a complaint.
To file an ADA complaint online:
> [Civil Right Division Online Complaint Form](https://civilrights.justice.gov/report/)
To file an ADA complaint by mail, send the completed [ADA complaint form](https://www.ada.gov/t2cmpfrm.htm) to:
> U.S. Department of Justice\
> Civil Rights Division\
> 950 Pennsylvania Avenue, NW\
> 4CON, 9th Floor\
> Washington, DC 20530
To file an ADA complaint by facsimile, fax the completed [ADA complaint form](https://www.ada.gov/t2cmpfrm.htm) to:
> (202) 307-1197
For more information on how to file an ADA complaint with the DoJ, please visit [their website](https://www.ada.gov/filing_complaint.htm).
## About WCAG and What We’re Doing to Improve Accessibility
Industrial control systems touch everyone’s lives, depending upon contributions from individuals all around the world. Dispel designs and builds our tools with accessibility as a central tenant of our ethos.
Our customers are required by law to comply with regulations governing accessibility, such as the U.S. American with Disabilities Act (ADA), European Accessibility Act (EAA), UK Equality Act 2010, Accessible Canada Act (ACA), and Australian Disability Discrimination Act (DDA).
All told, there are currently 40 web accessibility laws and policies in place across 23 countries and political unions. A preponderance of these regulations do not give strict technical guidance on how to make a site or service accessible; leaving the task up to the discretion and liability of the service provider. Many regulations, however, use the Web Content Accessibility Guidelines (“**WCAG**”) as a standard or baseline. This is further recognized as an international standard: ISO/IEC 40500:2012.
### WCAG 2.1 as Our Standard
The WCAG is authored by the World Wide Web Consortium (W3C), who develop international standards. Of relevance here, their accessibility standards are, in turn, reviewed by the Accessible Platform Architectures (“**APA**”) Working Group. As of writing WCAG is in version 2.1, with a 2.2 working draft in review. There is also an incomplete 3.0 working draft. For our purposes when talking about the WCAG going forward in this document, we will be speaking about version 2.1. You can find the current reference to the WCAG 2.1 here:
### **Four Tenants of WCAG**
While the WCAG provides a technical list of requirements to fulfill, it’s good to start with the four tenants around which W3C builds out their specifications.
This section provides a summary of the WCAG principals. For the normative technical specification, see [www.w3.org/TR/WCAG21](http://www.w3.org/TR/WCAG21).
These four basic principles are websites must be:
1. **Perceivable** - Information and user interface components must be presentable to users in ways they can perceive. This means that users must be able to perceive the information being presented (it can't be invisible to all of their senses).
2. **Operable** - User interface components and navigation must be operable. This means that users must be able to operate the interface (the interface cannot require interaction that a user cannot perform).
3. **Understandable** - Information and the operation of user interface must be understandable. This means that users must be able to understand the information as well as the operation of the user interface (the content or operation cannot be beyond their understanding).
4. **Robust** - Content must be robust enough that it can be interpreted reliably by a wide variety of user agents, including assistive technologies. This means that users must be able to access the content as technologies advance (as technologies and user agents evolve, the content should remain accessible).
### **Understanding Conformance**
There are five requirements that must be met for content to be classified as ‘conforming’ to WCAG 2.1.
**Requirements**
| **Requirement** | Details |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Requirement 1: **Conformance Level** | |
|
One of the following levels of conformance is met in full.
Level A: For Level A conformance (the minimum level of conformance), the Web page satisfies all the Level A Success Criteria, or a conforming alternate version is provided.
Level AA: For Level AA conformance, the Web page satisfies all the Level A and Level AA Success Criteria, or a Level AA conforming alternate version is provided.
Level AAA: For Level AAA conformance, the Web page satisfies all the Level A, Level AA and Level AAA Success Criteria, or a Level AAA conforming alternate version is provided.
| |
| Requirement 2: **Full Pages** | Conformance (and conformance level) is for full Web page(s) only, and cannot be achieved if part of a Web page is excluded. |
| Requirement 3: **Complete Processes** | When a Web page is one of a series of Web pages presenting a process (i.e., a sequence of steps that need to be completed in order to accomplish an activity), all Web pages in the process conform at the specified level or better. (Conformance is not possible at a particular level if any page in the process does not conform at that level or better.) |
| Requirement 4: **Only Accessibility-Supported Ways of Using Technologies** | Only accessibility-supported ways of using technologies are relied upon to satisfy the success criteria. Any information or functionality that is provided in a way that is not accessibility supported is also available in a way that is accessibility supported. |
| Requirement 5: **Non-Interference** | |
|
If technologies are used in a way that is not accessibility supported, or if they are used in a non-conforming way, then they do not block the ability of users to access the rest of the page. In addition, the Web page as a whole continues to meet the conformance requirements under each of the following conditions:
1. when any technology that is not relied upon is turned on in a user agent,
2. when any technology that is not relied upon is turned off in a user agent, and
3. when any technology that is not relied upon is not supported by a user agent
In addition, the following success criteria apply to all content on the page, including content that is not otherwise relied upon to meet conformance, because failure to meet them could interfere with any use of the page:
1.4.2 - Audio Control,
2.1.2 - No Keyboard Trap,
2.3.1 - Three Flashes or Below Threshold, and
2.2.2 - Pause, Stop, Hide.
| |
### **Success Criteria**
WCAG 2.1 items contain success criteria, which are written as testable criteria to objectively determine of a certain implementation satisfies the item.
> For example, 1.4.1 Use of Color requires that “color is not used as the only visual means of conveying information, indicating an action, prompting a response, or distinguishing a visual element.” In other words, you can’t just have text change from red to green to signify something to a user. There are sufficient techniques that can be used in conjunction with color to convey meaning to those individuals with partial sight, limited color vision, or monochromatic displays. 1.4.1 provides success criteria techniques to meet compliance. Some are: (G14) Ensuring that information conveyed by color differences is also available in text; (G205) Including a text cue for colored form control labels; (G182) Ensuring that additional visual cues are available when text color differences are used to convey information; and (G183) Using a contrast ratio of 3:1 with surrounding text and providing additional visual cues on hover for links or controls where color alone is used to identify them.\[1]
Conformance with WCAG means that an implementation of an item satisfies the requirements the Success Criteria. Most items have one level of conformance—in other words, you either meet the Success Criteria, or you do not. There are some circumstances when items have three levels of conformance: Level A, AA, and AAA.
One’s natural instinct is to aspire for Level AAA conformance across the board. Unfortunately the WCAG is written so that complete conformance is not possible. Indeed, the authors at W3C themselves note: “It is not recommended that Level AAA conformance be required as a general policy for entire sites because it is not possible to satisfy all Level AAA Success Criteria for some content.”\[2] Our goal then is to maximize accessibility as much as reasonably possible without creating an undue burden.
### Application Accessibility Across Device Platforms
Dispel provides its customers with applications on Apple macOS®, iPadOS®, iOS; and on Microsoft Windows®.
These operation systems come with accessibility features of their own. For example, macOS includes a wide variety of features and assistive technologies that include screen and cursor magnification, a full-featured screen reader, visual flash alerts, closed captioning support, and more.\[3]
Dispel’s applications use native design elements—referred to as “modern design” for UWP Windows apps and “design style” for Apple macOS—when building our products. These UI elements often come with built-in accessibility, providing an accessible user experience by default.
To learn more about Apple’s accessibility features, please visit:
To learn more about Microsoft’s accessibility features, please visit:
In the context of our Compliance Status, OS-derived accessibility features are the responsibility of Apple and Microsoft.
### Preparation of this Accessibility Statement
This statement was prepared on April 8, 2021.
For UK Article 3(1) of Commission Implementing Decision (EU) 2018/1523, this accessibility statement was prepared using Version 2.4 of the ITI Voluntary Product Accessibility Template® (VPAT®) INI edition.
This statement was last reviewed on April 8, 2021.\\
\[1] W3C, “Understanding Success Criterion 1.4.1: Use of Color.” WCAG 2.1. Available: , Accessed April 1, 2021.
\[2] W3C Working Group, “Understanding Conformance.” Understanding WCAG 2.0. October 7, 2016. Accessible: , Accessed April 1, 2021.
\[3] Apple Inc., “macOS.” Accessibility for Developers. Accessible: , Accessed April 8, 2021.
# Modern Slavery Act Statement
Adherence to the UK Modern Slavery Act of 2015
Dispel is committed to ensuring our business, and our supply chains, are free of acts of slavery and human trafficking. The United Kingdom Modern Slavery Act of 2015 requires businesses to publish a statement specifying the efforts taken to prevent slavery and human trafficking anywhere in their own business or their supply chain for each financial year of the organization. This statement constitutes Dispel’s Modern Slavery Act statement.
## What is Modern Slavery?
Modern slavery encompasses all types of slavery, human trafficking, servitude and forced or compulsory labor across a vast number of industries. Modern slavery may affect individuals that are resident within or outside of the UK.
## Our Business
Dispel is an enterprise-level secure remote access platform and data streamer for industrial control systems. With Dispel, people work with their operational technology more effectively, control access for third parties and employees efficiently, and manage device access control lists—all within a secure, compliant environment.
Dispel, LLC is a Delaware corporation headquartered in Brooklyn, New York with personnel located in multiple locations including Texas and Virginia. Any reference to “Dispel” is a reference to all Dispel operations, as we uphold the values set out in this statement regardless of geographic location.
Our procurement team is based in the United States, and the suppliers supporting Dispel core products are headquartered in the United States. Our infrastructure and broader supplier ecosystem are comprised of suppliers with presences in other countries including, but not limited to, the United Kingdom, the United States, various EU countries, South Africa, Australia, and Japan.
Based on the nature of our business, which provides enterprise level software-as-a-service and infrastructure-as-a-service to other businesses and organizations, there is a low risk of slavery and human trafficking taking place. However, Dispel vehemently opposes the trafficking of persons or use of any form of slavery and has taken steps to assess and manage that risk.
If Dispel establishes that modern slavery is taking place in our business or supply chains, we will terminate the relevant relationship, report the activity to law enforcement, and co-operate with any resulting investigation.
## Policies
Dispel complies with all applicable laws and regulations and is committed to preventing any form of modern slavery in our business. As such, our policies set forth our values and explain how those values impact the way we do business worldwide.
### Dispel’s Code of Conduct
Dispel serves customers in many countries around the world with varying laws, regulations, and customers. Dispel’s commitment to conducting business according to the highest standards of ethical conduct applies across national boundaries. Therefore, Dispel’s global Code of Conduct prohibits involuntary labor and human trafficking. Dispel requires its employees, independent contractors, consultants, and others who do business with Dispel to comply with all applicable laws, rules, and regulations when performing work. All employees are trained upon hire and annually thereafter on Dispel’s policies.
## Supplier’s Code of Conduct
We operate in many countries and are subject to different laws, customs, and practices. When doing business with our suppliers and other business partners, we require they act in manners no less stringent than our own. Dispel reserves the contractual right to terminate any supplier relationship for cause if a supplier violates applicable laws. Finally, Dispel conducts regular and at least annual review of its standards for suppliers. If Dispel establishes that modern slavery is taking place in our business or supply chains, we will terminate the relevant relationship, report the activity to law enforcement, and co-operate with any resulting investigation.
{% hint style="info" %}
[Read the Supplier Code of Conduct](/supplier-policies/trust-and-accountability/code-of-conduct).
{% endhint %}
## Dispel’s Due Diligence Actions
* Dispel analyzes and researches all suppliers prior to onboarding and sets clear expectations as to appropriate conduct using its Vendor Policy. Dispel also maps the supply chain and reviews the relevant entities to understand the nature of suppliers and the good and services that are procured and the risk any supplier may pose.
* Dispel reviews the effectiveness of its processes in ensuring that slavery and human trafficking is not taking place, by performing risk assessments to outline and assess any areas of risk in its business or supply chains. Additionally, we have established a reporting and grievance procedure (“Whistleblower Program”) to ensure that where modern slavery is uncovered, it is remediated appropriately. Finally, all procurement related policies and procedures are reviewed annually to ensure an appropriate governance system is in place.
# Vulnerability Disclosure Program
Dispel is committed to maintaining the security, integrity, and availability of our systems, products, and services. We recognize that security researchers and members of the broader cybersecurity community play an important role in identifying vulnerabilities. We welcome responsible, good-faith research conducted in a manner that protects our customers and our operational environments.
### Scope
This program applies to specific publicly accessible systems, services, applications, APIs, and websites owned and operated by Dispel, including dispel.com related subdomains, as well as Dispel-developed software and hosted services.
The specific services in-scope are:
* dashboard.dispel.io
* app.dispel.com
* api.dispel.com
These services are *not* in-scope:
* dispel.com
* status.dispel.com
* docs.dispel.com
* help.dispel.io
Customer-managed environments, third-party systems, social engineering, physical intrusion, denial-of-service activity, automated scanning that degrades performance, and any testing that could disrupt operational or safety-critical systems are not authorized under this program.
### How to Report a Vulnerability
If you believe you have identified a security vulnerability, please report it to:
****
To help us assess the issue efficiently, please include:
* A description of the vulnerability
* The affected system or URL
* Steps to reproduce the issue
* Any supporting evidence or proof-of-concept
* Your contact information
If submitting sensitive information, encrypted communication is encouraged.
### Our Commitment
When a report is submitted in good faith and in accordance with this program, Dispel will:
* Acknowledge receipt within a reasonable timeframe
* Validate and assess the reported issue
* Prioritize remediation based on risk and impact
* Work toward timely resolution
* Coordinate public disclosure when appropriate
Resolution timelines may vary depending on complexity, operational considerations, and safety impacts.
Dispel supports coordinated vulnerability disclosure. We request that researchers refrain from public disclosure until we have had a reasonable opportunity to investigate and remediate the issue. When appropriate, we may coordinate on the timing and content of public communications. In circumstances where there is evidence of active exploitation or material risk, Dispel may act to disclose information in a manner intended to protect customers and affected parties.
Dispel will not initiate legal action against individuals who identify and report vulnerabilities in good faith, comply with this policy, avoid harm, and provide us a reasonable opportunity to address the issue. This safe harbor does not extend to actions that violate applicable law, compromise privacy, disrupt services, or exceed the boundaries of authorized testing described here.
### Researcher Expectations
Researchers must act in good faith and avoid actions that could compromise data confidentiality, system integrity, service availability, or safety. Testing should be limited to what is necessary to demonstrate the presence of a vulnerability. Accessing, modifying, or exfiltrating data that does not belong to you is not authorized. If you inadvertently access sensitive information, you must cease testing immediately and notify Dispel without retaining, copying, or disclosing the data.
Participants in this program must:
* Act in good faith and avoid causing harm
* Test only in-scope systems
* Avoid accessing, modifying, or retaining data that does not belong to them
* Cease testing immediately if unintended sensitive data is accessed and report it promptly
* Refrain from public disclosure until Dispel has had a reasonable opportunity to investigate and remediate
### Safe Harbor
Dispel will not pursue legal action against researchers who comply with this program and conduct testing in good faith. This safe harbor applies only to activities consistent with this policy and does not extend to unlawful conduct, privacy violations, service disruption, or testing outside defined scope.
### Recognition
Dispel does not operate a public bug bounty program. Recognition for responsible disclosures may be provided at our discretion.
***
Security reports should be directed to . For general legal inquiries, please contact .
We appreciate the efforts of the security research community and value responsible collaboration in protecting the cyber-physical systems and environments our customers rely on.
# Export Compliance
## Why this page exists
Dispel builds connectivity infrastructure for critical infrastructure and operational technology. We want to make it easier for companies to access, monitor, and control their facilities and operations globally. We aim for our platform to be as broadly accessible as possible, just like other forms of infrastructure, such as roads or telecommunications networks.
Dispel products, services, and technologies are subject to import, export, and other trade regulations under the laws of the United States and other national governments. Clients are responsible for complying with any local laws in your jurisdiction that may impact their right to import, export, or use Dispel products, services, software, or technologies.
{% hint style="info" %}
Dispel makes the following data available for information purposes only. It may not reflect the most current legal developments, and Dispel does not represent, warrant, or guarantee that it is complete, accurate, or up-to-date. This information is subject to change without notice. The materials on this site are not intended to constitute legal advice from a licensed attorney. You should not act (or refrain from acting) based upon information in this site without obtaining professional advice regarding your particular facts and circumstances.
{% endhint %}
## Export Regulations
Dispel is subject to U.S. export laws, regulations, orders, or other restrictions. These include the Export Administration Regulations (“EAR”) maintained by the U.S. Department of Commerce, trade and economic sanctions maintained by the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”), and the International Traffic in Arms Regulations (“ITAR”) maintained by the U.S. Department of State).
### International Traffic in Arms Regulation (ITAR)
Dispel's Products and Services are designated as not subject to the ITAR.
This assessment is drawn from review of the U.S. Munitions List Category XIII - Materials and Miscellaneous Articles, the U.S. Munitions List (USML) Order of Review Decision Tool, and tge Specially Designed Decision Tool.
### Export Administration Regulations (EAR)
Each Dispel product has an Export Control Classification Number (ECCN) and license information. The table below lists Dispel products ECCNs, license information, and the CCATS number.
## Export Program Details
### Restricted Countries
Clients are prohibited from accessing, using, or exporting Dispel to the following countries:
* Cuba
* Iran
* North Korea
* Sudan, or
* Syria
There may also be local or national restrictions on usage of encryption technology in some countries that restrict usage of Dispel. Clients are responsible for their usage of our services and compliance with laws that may apply to their operations.
### End User License Certificates
Some types of technologies and products require specific certificates. This requirement does not extend to Dispel's class of products, and industry standard is to not collect such certificates on this class.
### For Resellers
Resellers must agree to abide by the same laws, regulations, orders, or other restrictions imposed by the U.S. government that apply to Dispel.
[^1]: macOS, iOS, and Windows
[^2]: The Dispel Zero Trust Engine
# Dispel Partner Program
At Dispel, our partners are at the heart of how we deliver secure, resilient, and innovative solutions to the world. Our channel is not just a route to market—it’s a community of trusted collaborators who share our commitment to protecting critical infrastructure and advancing cybersecurity.
This section contains the agreements that govern our partner program. They outline the expectations, rights, and responsibilities that ensure fairness, transparency, and mutual success in our partnerships.
Beyond legal terms, we believe strong relationships are built on collaboration and support. That’s why we’ve designed our ways of working to empower our partners—whether through training, joint go-to-market initiatives, or dedicated support resources—so that together we can deliver exceptional outcomes for customers.
{% hint style="info" %}
#### Looking for your Dispel Partner Portal?
Sign in
{% endhint %}
# Global & United States
Version 1.0, Published January 8, 2025
This Dispel Partner Program Agreement (this “Agreement”), which consists of this document and the exhibits identified below, is entered into as of the Effective Date by and between Dispel, LLC or Dispel Global, Inc ("Dispel", as specified in the table below) and Partner, as set forth above or through clicking you accept this Agreement when onboarding onto the Dispel partner program dashboard at [partners.dispel.com](https://partners.dispel.com). Capitalized terms not defined in this Agreement have the meanings set forth in the exhibits.
#### Which entity am I signing with?
| Entity | Regions business is conducted in |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Dispel, LLC | United States |
| Dispel Global, Inc | Worldwide (except Japan, see [Japan-specific Partner Agreement](/partner-program/partner-program-agreements/partner-program-agreement-japan)) |
#### 1. Products.
Dispel makes available the Remote Access Services (as defined in Exhibit A; the “Products”), and Partner desires to market and resell the Products in the Territory (as defined in your Partner Portal), in accordance with the terms and conditions of this Agreement. In connection with the resale of the Products, Partner may offer to resell to Customers the Support Services (as defined in Exhibit A).
#### 2. Pricing.
Resale prices for the Products and for Support Services will be established by Partner at its sole discretion. For each such resale, Partner will submit a purchase order to Dispel (“Purchase Order”) via the Partner Portal. The submittal of a Purchase Order will act as authorization for Dispel to proceed with the ordering process.
#### 3. Signatures.
The parties acknowledge that they have read and understand this Agreement, including this document and all exhibits, and agree to all of the terms and conditions of this Agreement by digital signature or checking the acceptance box on the Dispel Partner Portal website. By accessing the Dispel partner portal at [partners.dispel.com](https://partners.dispel.com) and continuing to use the website, you agree to these terms.
## Exhibit A: Terms and Conditions
### 1. Partner’s Rights.
#### 1.1 Marketing and Resale Rights.
Subject to the terms and conditions of this Agreement (including the payment obligations set forth in Section 5.4), Dispel grants to Partner a nonexclusive, nontransferable right and license during the Term within the Territory to:
(a) advertise, market, and promote the Products to Customers in the Territory;
(b) resell directly (i.e., not through distributors or resellers) to Customers in the Territory and to contractors for resale to Customers pursuant to Section 1.6 (i) the right to access and use the Remote Access Services, and (ii) the Support Services; and
(c) access and use the Remote Access Services for the sole purpose of providing the Support Services for Customers in accordance with Section 3.1 and exercising the rights in Section 1.5; provided that Partner shall purchase from Dispel a demo environment to access and use the Remote Access Services.
#### 1.2 Documentation Right.
Dispel grants to Partner a nonexclusive, nontransferable right and license during the Term to reproduce and distribute to Customers in the Territory the Documentation in connection with the resale of the Products pursuant to Section 1.1(b).
#### 1.3 Trademark License.
Dispel grants to Partner a nonexclusive, nontransferable right and license during the Term to use Dispel’s registered or common law trademarks and service marks solely: (a) in connection with Partner’s marketing, resale, advertising, and promotion of the Products in accordance with this Agreement; and (b) in accordance with any usage guidelines that Dispel provides to Partner from time to time. Partner agrees that all goodwill arising out of the use of the Trademarks by Partner will accrue to the sole benefit of Dispel. Partner will not at any time challenge, or assist others in challenging, the Trademarks. Partner will submit all advertising, marketing, branding, and promotional materials related to the Products to Dispel for advance review and approval, such approval not to be unreasonably withheld or delayed. Partner grants to Dispel a nonexclusive, nontransferable, license to use Partner’s registered and/or common law trademarks and service marks (the “Partner Trademarks”) solely in connection with any mutually-agreed upon marketing activities, in accordance with any usage guidelines that Partner provides to Dispel. Dispel agrees that all goodwill arising out of the use of the Partner Trademarks by Dispel will accrue to the sole benefit of Partner.
#### 1.4 Customer Terms of Service.
Prior to or simultaneously with completing the resale of a Product to a Customer, Partner shall ensure that such Customer has expressly agreed to the Customer Terms of Service. If a Customer does not agree to the Customer Terms of Service, that Customer will not be allowed to use the Remote Access Services or receive Support Services, and Dispel shall not be liable to Partner for refunding any Fees paid. For the avoidance of doubt, Dispel shall provide the Products and Support Services to the Customer only in accordance with the Customer Terms of Service.
a) Partner shall obtain Dispel’s prior, written approval (not to be unreasonably withheld) of the manner in which Partner intends to ensure that each Customer expressly agrees to the Customer Terms of Service, and upon Dispel’s request, shall provide documentation evidencing each Customer’s acceptance of the Customer Terms of Service.
b) Partner will immediately advise Dispel if Partner becomes aware of any breach by a Customer of any provision of the Customer Terms of Service.
c) In the event of a conflict between the Customer Terms of Service and any agreement between Partner and Customer, the Customer Terms of Service shall take precedence with respect to Dispel’s obligations and performance.
d) Nothing in this Agreement, the Customer Terms of Service, or any agreement between Partner and Customer obligates or will obligate Dispel to develop or assist in developing any Government-Off-The-Shelf products.
Notwithstanding any other provision of this Agreement or the Customer Terms of Service, when Customer is an agency or instrumentality of the U.S. Government, federal contract clauses requiring mandatory flow-down and application to Dispel as a matter of law shall take precedence over directly conflicting terms set forth herein.
#### 1.5 Partner Internal Use.
Subject to the terms and conditions of this Agreement, Dispel hereby grants to Partner a nonexclusive, nontransferable, royalty-free (except as set forth in Section 5), revocable right to use the Remote Access Services during the Term and in accordance with the Documentation, for the sole purpose of providing demonstrations of the Products to prospective Customers in the Territory and for no other purpose. Partner acknowledges and agrees that it shall purchase from Dispel a demo environment to access and use the Remote Access Services pursuant to this Section 1.5.
#### 1.6 Right of Sublicense.
a) The rights granted pursuant to Sections 1.1, 1.2, 1.3, and 1.5 are nonsublicensable, except to the extent that Partner is engaged in a sales process to Customers involving multiple tiers of sales (i.e., selling to and through multiple tiers of contractors), in which case Partner shall have a limited right to sublicense the rights set forth in Sections 1.1, 1.2, 1.3, and 1.5 to only those third parties directly involved in such resale to Customers.
Any sublicense granted pursuant to this Section 1.6 shall be subject to the following restrictions:
b) such sublicense shall be limited solely to the contractor(s) duly authorized by Partner; provided that Partner shall report its duly authorized contractor(s) to Dispel on a regular basis as designated by Dispel;
c) such sublicense shall be subject to, and subordinate to, this Agreement and, in case of any conflict, the terms of this Agreement shall prevail;
d) Partner shall be responsible for, and shall ensure, any sublicensee’s compliance with this Agreement; and
e) Dispel shall have the right to review any such sublicense agreement upon request.
#### 1.7 Certain Restrictions.
Partner shall not:
a) resell, sublicense or otherwise make available the Products except as permitted by this Agreement;
b) resell, sublicense or otherwise make available the Products to any Dispel Direct Competitor;
c) represent itself as an agent of Dispel for any purpose, nor pledge Dispel's credit or give any condition or warranty or make any representation on Dispel's behalf or commit Dispel to any contracts;
d) copy, decompile, disassemble, design around or otherwise reverse engineer the Products or any portion thereof, or determine or attempt to determine any source code, algorithms, methods, or techniques embodied in the Products or any portion thereof, or extract ideas, algorithms, procedures, workflows, or hierarchies from the Products or otherwise use the Products for the purpose of creating another product or service unless such act is permitted under applicable law (even in the case where such act is permitted under applicable law, Partner shall not use anything learned from such act in a commercial or marketing setting);
e) interfere with, or disrupt the operation of, the servers or networks used to make the Products available, or violate any requirements, procedures, policies, or regulations of such servers or networks or their providers;
f) post, transmit, or otherwise make available through or in connection with the Products any virus, worm, Trojan horse, Easter egg, time bomb, spyware, or other computer code, file, or program that is, or is potentially, harmful or invasive or intended to damage or hijack the operation of, or to monitor the use of, any hardware, software, or equipment;
g) modify, translate, or create any Derivative Works based upon the Products (except to the extent this restriction is expressly prohibited by applicable law);
h) remove or alter any copyright, trademark, trade name, or other proprietary notices, legends, symbols, or labels appearing on or in copies of the Products except as permitted under this Agreement;
i) perform, or release the results of, benchmark tests or other comparisons of the Products with other programs without Dispel’s prior written consent;
j) transfer the Products to any computer other than a computer owned by Partner and used by Partner in Partner’s operations, except as permitted by this Agreement;
k) permit the Products to be used for the benefit of any third party (i.e., in an ASP, outsourcing or service bureau relationship or processing the data of any third party), except as permitted by this Agreement;
l) incorporate the Products or any portion thereof into any other program or product, or use the Products for production purposes;
m) assert, or attempt to assert, any ownership of or other rights to (including, but not limited to, the filing of any applications for patent, trademark, copyright, or any other intellectual property rights), over, or involving the Products;
n) challenge or assist third parties in challenging the ownership, validity, enforceability, or scope of Dispel’s and/or its affiliate’s intellectual property rights or other rights in the Products or Trademarks, or, unless otherwise expressly permitted hereunder, use Dispel’s and/or its affiliate’s intellectual property rights filed and/or registered in the US anywhere in the world as if such intellectual property rights were filed and/or registered worldwide (except to the extent this restriction is prohibited by applicable law);
o) advertise, market, promote, sell, distribute, use, export, or otherwise make available the Products to any entities or person not located in the Territory (including but not limited to any foreign offices, branches, locations, affiliates, or subsidiaries of an Territory entity or person that is located outside of the Territory), without Dispel’s express written prior permission;
p) in connection with the Products and Support Services or in performance of this Agreement (i) defame, threaten, abuse, or harass any person, or otherwise violate the legal rights of any person or entity, including any copyright, trademark, trade secret, right of publicity or privacy, or any other proprietary right; (ii) harvest or collect personally identifiable information from or about any person other than in the ordinary course of business or otherwise in violation of any applicable law; (iii) impersonate any person or entity, or falsely state or otherwise misrepresent Dispel’s affiliation with any person or entity; or (iv) engage in any fraudulent or otherwise tortious or unlawful conductor;
q) violate any laws or regulations, ordinances, and requirements of any governmental authority applicable to Partner’s activities under this Agreement; or
r) engage in any other activity prohibited by this Agreement or that is reasonably deemed by Dispel to be in conflict with the spirit or intent of this Agreement.
#### 1.8 Enablement Training.
Dispel offers training and certifications with respect to the Products and Support Services (“Enablement Training Program”). Through the Enablement Training Program, individuals may be certified by Dispel as Dispel Systems Certified Specialists. Certification information and standards may, at Dispel’s sole discretion, be modified or changed from time to time by Dispel without notice to Partner.
#### 1.9 Tiers.
a) Discounts. Partner will be eligible to receive benefits based upon its achieved tier within the Partner Program, including discounts off the list price for the Products. Tier information is included in the Partner Portal, which Dispel may modify, at its sole discretion, from time to time. Dispel may change eligibility requirements and will notify the Partner of any such updates.
b) No Hardware Discounts. Some implementations of the Dispel Products use hardware to provide integration into the broader system. To the extent that Partner resells any such hardware, Partner does not receive a discount on such connection hardware and any physical asset sold by Dispel (“System Enablement Components” or “Hardware”).
c) Determining Tiers. The tier that a Partner is eligible for is determined by how much revenue Dispel has actually received from Partner under this Agreement in the immediately preceding twelve (12) month period (“Threshold Requirement”). Purchases made for a Partner’s internal consumption count toward the Threshold Requirement for any given tier. Taxes, duties, shipping, and other fees do not count toward Threshold Requirements.
The Threshold Requirement of all prior tiers must be completed in order for the Partner to be eligible for a higher tier. Subject to the preceding sentence, in the event a single sale qualifies a Partner to proceed through more than one tier, the applicable discounts shall be determined on a graduated and sequential basis starting with the discount for the first tier for which the Threshold Requirement is met, followed by the discount for the next tier for which the Threshold Requirement is met, and so forth.
Dispel shall, in its sole discretion, determine the tier a Partner is eligible for provided such determination is consistent with the then-current version of the Tier information available in the Dispel Partner Portal.
#### 1.10 Resale Policy Changes.
From time to time, Dispel may institute new or revised policies and procedures regarding the resale of the Products. Upon Partner’s receipt of notice from Dispel of any such new or revised policies or procedures, Partner will promptly implement such policies and procedures.
### 2. Ownership.
#### 2.1 Generally.
As between Dispel and Partner, Dispel and its licensors own all right, title, and interest in and to the Products and Trademarks (including all copies, modifications, and Derivative Works thereof and all intellectual property and proprietary rights embodied therein), except for the limited right and licenses expressly granted to Partner in this Agreement. For the avoidance of doubt, any modifications, Derivative Works, intellectual property, or proprietary rights created by Partner in contravention of this Agreement shall belong exclusively to Dispel and Partner hereby assigns to Dispel all right, title, and interest in and to all such modifications, Derivative Works, intellectual property, and proprietary rights in any manner and for any purpose.
#### 2.2 Feedback.
If Partner provides Dispel with any suggestions, ideas, feedback, reports, error identifications, or other information related to the Products or Dispel’s other products or services (“Feedback”), Partner hereby assigns to Dispel all rights, titles, and interests in and to all Feedback, including all patent rights, copyrights, trade secrets, and other intellectual property or proprietary rights therein, and agrees to assist Dispel in perfecting such rights and obtaining assignments of such rights from all individuals involved in generating the Feedback.
### 3. Channel Management.
#### 3.1 Maintenance and Support Services.
The list price for each Product may include certain labor hours for Support Services. Any Support Services requested by Customer in excess of the labor hours included in the list price shall be as detailed in the Pricing Guidelines and subject to the execution of a Purchase Order. Partner may describe to each Customer each of the tiers of maintenance and support offered by Dispel prior to the Partner and Customer completing the ordering documentation for the purchase of Products from Partner (“Order Documentation”).
#### 3.2 Problem Resolution.
Partner shall keep Dispel informed on a regular basis regarding any problems encountered with the Products by Partner or Customers, and regarding any resolutions developed for those problems. Partner shall communicate promptly to Dispel any and all modifications, design changes, or improvements to the Products suggested by any entity or person to Partner.
#### 3.3 Exclusivity and Sales Support.
Dispel will not knowingly, directly sell the Products to a government office or company division (“Target”) for sixty (60) calendar days (“Exclusivity Period”) after a meeting with a Target that (a) is sourced by a Partner and registered in the Partner Portal, (b) is attended by an authorized Dispel representative, and (c) Dispel knows is for the purpose of reselling the Products to the Target through Partner; provided, however, that this exclusivity provision shall not apply to any Target who Dispel had any discussion relating to the sale of the Products at any time prior to such meeting. At subsequent meetings, if a Dispel representative is present under the above conditions, the Exclusivity Period shall reset to the full number of days. In situations where (a) the Partner decides to not pursue a sale attempt to the Target, Partner will immediately notify Dispel and; or (b) the Target chooses to not work with the Partner, then Dispel may then pursue a direct sale with the Target within the Exclusivity Period.
Nothing in the foregoing paragraph will prohibit Dispel representatives from attending any meeting requested by any partner even if an Exclusivity Period is in effect. Multiple partners may compete for the same business and Dispel does not require partners share their target lists with Dispel or other Partners.
### 4. Dispel Professional Services.
To the extent that Partner wishes to engage Dispel to provide training, operational, technical, or other professional services to Customer in addition to the Support Services, the terms and conditions governing such professional services will be set forth in a separate professional services agreement entered into between Dispel and Partner. Nothing contained herein shall limit a Customer’s right to directly contact Dispel should such Customer desire to purchase training, operational, technical, or other professional services from Dispel. Partner will assist Customer with any such request for training, operational, technical, or other professional services from Dispel.
### 5. Pricing; Payment Terms.
#### 5.1 Pricing.
Resale prices for the Products and Support Services will be established by Partner at its sole discretion. Partner will purchase the Products and Support Services from Dispel at prices set forth in the pricing guidelines provided by Dispel to Partner, which may be updated by Dispel from time to time with written notice to Partner (“Pricing Guidelines”), subject to any discounts Partner is eligible to receive under the Partner Program. Partner may bundle Dispel products with other services, and Dispel’s pricing in no way affects a Partner’s pricing of those other services. The Pricing Guidelines are Dispel’s Confidential Information.
#### 5.2 Purchase Order.
Partner will submit to Dispel a Purchase Order for each resale of the Products and any Support Services. Dispel may accept or reject any Purchase Order at its discretion. By placing a Purchase Order, Partner: (a) represents and warrants that the applicable Customer has agreed to the Customer Terms of Service; and (b) agrees to pay Dispel the amounts for the ordered Products and Support Services as set forth in the Pricing Guidelines, subject to any applicable discounts and any applicable cash credits under Section 3.1 (collectively, “Fees”).
#### 5.3 Billing.
All Fees for the Products and Support Services will be billed to the Partner when the Products and Support Services are shipped/provided to the Customer. All Fees for items purchased by Dispel for the Customer will be pre-billed to the Partner and will be paid by the Partner in accordance with Section 5.4, notwithstanding Section 5.2. Any adjustments to subscription-based Fees made mid-billing cycle will be calculated and billed to Partner in arrears on the subsequent invoice. All orders made by Partner to Dispel are non-cancelable and all payments made by Partner to Dispel are non-refundable, including but not limited to, if any Customer fails to pay Partner for an order or fails to agree to the Customer Terms of Service and Dispel has terminated such Customer’s access to Services or Products as a result thereof. Other than any applicable cash credits under Section 3.1, under no circumstances will Dispel be obligated to issue a credit to Partner.
#### 5.4 Payment.
Each invoice issued by Dispel will identify the Fees payable by Partner. All amounts payable under this Agreement will be due within thirty (30) days of the receipt of the invoice therefor; unless the parties have agreed to a specific payment schedule in the Purchase Order, in which case the payment schedule in the Purchase shall control for that order. Payments must be remitted to the account identified by Dispel and are due on the date, and in the currency stated, in the invoice. Partner will pay such amounts regardless of whether it has received any payment from Customers. Any amounts not paid when due shall accrue a late fee at the rate of one and a half percent (1.5%) per month or the maximum rate allowed by law, whichever is lower. In the event Partner fails to pay within sixty (60) days the outstanding Fees set forth in an invoice from Dispel or payment schedule in the Purchase Order, Dispel may, in its sole discretion, (a) suspend or terminate the applicable Customer’s access to the Remote Access Services and/or Support Services, and/or (b) terminate this Agreement, upon written notice to Partner.
#### 5.5 Taxes.
Partner will be responsible, as required under applicable law, for identifying and paying all taxes and other governmental fees and charges (and any penalties, interest, and other additions thereto) that are imposed on Partner upon or with respect to the transactions and payments under this Agreement. All fees payable by Partner are exclusive of applicable taxes and duties, including VAT, GST, excise taxes, sales and transactions taxes, and gross tax receipts (“Indirect Taxes”). Dispel may charge, and Partner will pay, all Indirect Taxes that Dispel is legally obligated or allowed to collect from Partner. Partner will provide all information to Dispel as reasonably required to determine whether Dispel is obligated to collect Indirect Taxes from Partner under any applicable law. Dispel will not collect, and Partner will not pay, any Indirect Tax for which Partner furnishes Dispel a properly completed exemption certificate or a direct payment permit certificate for which Partner may claim an available exemption from such Indirect Tax. All payments made by Partner to Dispel under this Agreement will be made free and clear of any withholding or deduction for taxes. If any taxes (for example, international withholding taxes) are required to be withheld on any payment, Partner will pay additional amounts as necessary so that the net amount received by Dispel is equal to the amount then due and payable under this Agreement.
#### 5.6 Duties and Shipping Fees.
Partner is responsible for any foreign exchange, duty, shipping charges, and additional processing fees incurred, including any BIS license fees. If these fees are incurred after the initial invoice was sent, Dispel will invoice the Partner payable under Section 5.4.
#### 5.7 Records and Audit Rights.
During the Term and for a period of at least two (2) years thereafter, Partner will maintain complete and accurate records and accounts relating to this Agreement, including for each resale of the Products and Support Services resold by Partner: (a) the Customer’s name and address; (b) Product components made available to the Customer; and (c) documentation showing that the Customer agreed to the Customer Terms of Service. Dispel may audit such records and accounts of Partner from time to time to verify Partner’s compliance with the terms and conditions of this Agreement. Any such audit will be at Dispel’s expense; provided, however, that if such audit reveals an underpayment of three percent (3%) or more of fees payable to Dispel with respect to any calendar month, or any other material breach of this Agreement by Partner, Partner will promptly reimburse Dispel for all expenses in connection with such audit. Partner will promptly pay Dispel the amount of any underpayment (and correct any other noncompliance) revealed by any such audit.
### 6. Warranty Disclaimer.
#### 6.1 Warranty Disclaimer.
EXCEPT FOR THE WARRANTY SET FORTH IN THE THEN-CURRENT VERSION OF THE CUSTOMER TERMS OF SERVICE, DISPEL MAKES NO WARRANTIES WITH RESPECT TO THE PRODUCTS, THE SUPPORT SERVICES, ANY DOCUMENTATION, OR ANY OTHER PRODUCTS OR SERVICES, AND DISCLAIMS ALL STATUTORY OR IMPLIED WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT, AND ALL WARRANTIES ARISING FROM A COURSE OF DEALING, COURSE OF PERFORMANCE, USAGE, OR TRADE PRACTICE. DISPEL SPECIFICALLY DISCLAIMS ANY WARRANTY THAT THE PRODUCTS, THE SUPPORT SERVICES, OR ANY OPEN SOURCE COMPONENT WILL MEET ANY PARTNER OR CUSTOMER REQUIREMENTS OR THAT THE OPERATION OR USE OF THE PRODUCTS OR ANY OPEN SOURCE COMPONENT WILL BE UNINTERRUPTED OR ERROR-FREE. UNDER NO CIRCUMSTANCES SHALL DISPEL HAVE ANY LIABILITY WHATSOEVER FOR ANY HARDWARE PROVIDED BY DISPEL TO CUSTOMER IN CONNECTION WITH THIS AGREEMENT.
#### 6.2 Restrictions.
Partner will not make: (a) any representation or warranty on behalf of Dispel; (b) any representation concerning the quality, performance, or other characteristics of the Products or the Support Services, other than those which are consistent in all respects with the applicable Documentation; or (c) any commitment to modify any part of the Products or the Support Services.
### 7. Term and Termination.
#### 7.1 Term.
This Agreement will commence on the Effective Date and, unless earlier terminated in accordance with this Agreement, will continue in full force and effect until the end of the Initial Term set forth in the Partner Portal or communicated by Dispel to Partner. Thereafter, this Agreement will automatically renew for successive one (1) year periods (each, a “Renewal Term”), unless either party notifies the other party in writing at least sixty (60) days prior to the end of the then-current term that it does not wish to renew this Agreement, or unless earlier terminated in accordance with this Agreement. The Initial Term and any Renewal Terms are collectively referred to as the “Term.”
#### 7.2 Termination by Dispel.
Dispel may terminate this Agreement immediately upon written notice to Partner if: (a) Partner materially breaches Section 1 (“Partner’s Rights.”), Section 5 (“Pricing; Payment Terms.”) or Section 9 (“Confidentiality.”) and fails to cure such breach within seven (7) days after receipt of written notice of such breach from Dispel; (b) Partner materially breaches any other provision of this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice of such breach from Dispel or (c) Partner challenges or assists third parties in challenging the ownership, validity, enforceability, or scope of Dispel’s and/or its affiliates’ intellectual property rights or other rights in the Products or Trademarks. Dispel may also terminate this Agreement for any reason, with or without cause, at any time upon sixty (60) days’ written notice to Partner.
#### 7.3 Termination by Partner.
Partner may terminate this Agreement immediately upon written notice to Dispel if Dispel materially breaches any provision of this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice of such breach from Partner. Partner may also terminate this Agreement for any reason, with or without cause, at any time upon sixty (60) days’ written notice to Dispel.
#### 7.4 Mutual Termination.
Either party may terminate this Agreement immediately upon written notice to the other party if: (a) any proceeding is commenced by or against the other party seeking relief, reorganization, or arrangement under any laws relating to insolvency or bankruptcy, and such proceeding is not dismissed within sixty (60) days; (b) the other party makes an assignment of its property or assets for the benefit of its creditors; (c) a receiver, liquidator, or trustee is appointed for the other party’s property or assets; or (d) the other party is liquidated, dissolved, or wound up.
#### 7.5 Transition of Existing End Users.
Upon termination or expiration of this Agreement: (a) for each Product component resold by prior to any termination or expiration of this Agreement, each then-current Customer shall continue to have the right to use such Product component for the remainder of its current subscription term (with no right to renew such subscriptions), in accordance with the Customer Terms of Service, governing such subscription, and with the terms of this Agreement, provided that in no event shall such continued right to use the Products extend past twelve (12) months after the termination or expiration of this Agreement (the period that any such rights remain in effect after the termination or expiration of this Agreement, the “Wind-down Period”); (b) the parties shall promptly meet to negotiate in good faith the orderly wind-down of each party’s activities under this Agreement; and (c) each party shall continue to perform its relevant obligations under this Agreement during the Wind-down Period (but only with respect to obligations existing as of the date of termination or expiration and only to the extent that such obligations relate to Customers with active subscriptions to the Remote Access Services).
#### 7.6 Effect of Termination.
Upon termination or expiration of this Agreement: (a) all licenses granted to Partner under this Agreement will terminate immediately; and (b) Partner will immediately: (i) cease use and resale of the Products; (ii) discontinue use of the Trademarks; (iii) discontinue statements from which it might be inferred that any relationship exists between Partner and Dispel; (iv) cease to advertise, market, promote, or solicit or procure orders for, the Products or Support Services; and (v) return the Confidential Information, the Documentation, and all related materials and copies to Dispel.
#### 7.7 Sales to Permitted Government Customers.
If the parties have terminated or are in the process of terminating this Agreement pursuant to this Section 7 and, at such time, Partner is still actively involved in the bidding/sales process to a Permitted Government Customer due to a bid submitted prior to any notice of termination, then this Agreement shall continue to govern and remain in full force and effect only with respect to such outstanding bid/sales to such Permitted Government Customer and any resulting sales by Partner to such Permitted Government Customer. Partner shall be permitted to continue to support any such outstanding bids/sales to such Permitted Government Customer provided Partner is and remains in full compliance with this Agreement. Upon termination or conclusion of the outstanding bids/sales, then this Agreement shall terminate in accordance with this Section 7 unless otherwise agreed to by the parties in writing.
#### 7.8 No Harm upon Termination.
Partner will not be entitled to and, to the fullest extent permitted by law, waives any statutorily prescribed or other compensation, reimbursement, or damages for loss of goodwill, clientele, prospective profits, investments, or anticipated sales, commitments, or business opportunities of any kind arising from the termination of this Agreement.
#### 7.9 Survival of Terms.
The following sections will survive the expiration or termination of this Agreement: (a) Sections 1.7 (“Certain Restrictions.”), 2 (“Ownership.”), 5.7 (“Records and Audit Rights.”), 6 (“Warranty Disclaimer.”), 7 (“Term and Termination.”), 8 (“Relationship of the Parties.”), 9 (“Confidentiality.”), 10 (“Indemnification.”), 11 (“Limitation of Liability.”), 12 (“Miscellaneous.”), and 13 (“Definitions.”); and (b) any payment obligations of either party to the other party arising under this Agreement.
### 8. Relationship of the Parties.
#### 8.1 Independent Contractors.
The relationship of Dispel and Partner is that of independent contractors. Nothing in this Agreement will create, or be construed to create, any partnership, joint venture, agency, franchise, sales representative, employment, or fiduciary relationship between the parties. Except as otherwise provided in this Agreement, neither party will have any right, power, or authority to act or create any obligation, express or implied, on behalf of the other party. Dispel is in no manner associated with or otherwise connected with the actual performance of this Agreement on the part of Partner, nor with Partner’s employment of other persons or incurring of other expenses.
#### 8.2 Partner’s Employees.
It is understood that Partner is solely responsible for all of its employees and agents, its labor costs and expenses arising in connection therewith, and for any and all claims, liabilities, and damages or debts of any type whatsoever that may arise on account of Partner’s activities, or those of its employees or agents, in the performance of this Agreement.
#### 8.3 Nonexclusive Relationship.
Subject to Section 3.3, nothing in this Agreement will be construed as limiting Dispel’s marketing or distribution activities or its appointment of other original equipment manufacturers, dealers, distributors, resellers, licensees, or agents of any kind in any place.
### 9. Confidentiality.
Partner will use the Confidential Information only for purposes of exercising its rights or performing its obligations under this Agreement. Partner will hold the Confidential Information in strict confidence and will use the same degree of care that Partner uses to protect its own like information, but in no event less than a reasonable degree of care, to protect the Confidential Information from unauthorized use or dissemination. Partner will not disclose the Confidential Information to third parties without the prior written consent of Dispel and will only disclose Confidential Information to Partner’s employees who require such Confidential Information in connection with the performance of this Agreement and who are bound in writing by confidentiality obligations no less restrictive than those set forth in this Section 9. Partner agrees that any breach of this Section 9 would cause irreparable harm to Dispel for which monetary damages would not be adequate and, therefore, Partner agrees that, if Partner or its employee breaches this Section 9, Dispel will be entitled to equitable relief in addition to any other remedies it may have hereunder or at law or in equity.
### 10. Indemnification.
Partner will defend (at Dispel’s option), indemnify, and hold harmless Dispel, its licensors, its affiliates, and each of its and their respective members, officers, directors, agents, and employees (collectively, the “Dispel Parties”) against damages, costs, liabilities, expenses (including reasonable attorneys’ fees) and settlement amounts incurred in connection with any suit, claim or action by any third party against a Dispel Party based on: (a) Partner’s modification, use, marketing, resale, or distribution of the Products not in strict accordance with this Agreement; (b) any warranty or representation made by Partner or Partner’s agents which differ from those provided by Dispel; (c) injuries or damage to persons or property caused or claimed to have been caused by the negligent acts, errors, or omissions of Partner or Partner’s agents while in the course of performing under this Agreement; (d) any breach of Section 12.1; or (e) the infringement or misappropriation, or alleged infringement or misappropriation, of any copyright, patent, trade secret, or other intellectual property right by Partner (except to the extent such infringement or misappropriation arises from the distribution or use of the Products in compliance with the terms and conditions of this Agreement and the Customer Terms of Service). For third party claims, Dispel shall have the right to control its defense and select its own legal counsel to represent its interest and that of the Dispel Parties and Partner shall reimburse Dispel for such legal costs and attorneys’ fees promptly upon request for reimbursement. Partner may not settle any such claim without Dispel’s prior, written consent.
### 11. Limitation of Liability.
#### 11.1 Consequential Damages Waiver.
TO THE FULLEST EXTENT ALLOWED UNDER APPLICABLE LAW AND EXCEPT FOR ANY LIABILITY ARISING OUT OF BREACHES OF SECTIONS 1 OR 9 AND PARTNER’S PERFORMANCE OF ITS INDEMNITY OBLIGATIONS UNDER SECTION 10, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ANY THIRD PARTY FOR ANY INDIRECT, SPECIAL, PUNITIVE, INCIDENTAL, CONSEQUENTIAL, OR OTHER INDIRECT DAMAGES, INCLUDING ANY DAMAGES RESULTING FROM LOSS OF USE, LOSS OF DATA, INADVERTENT DISCLOSURE OF DATA, LOSS OF PROFITS, LOSS OF REVENUE, OR LOSS OF BUSINESS, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE PRODUCTS, NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY OF ANY KIND AND WHETHER OR NOT A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
#### 11.2 Limitation of Liability.
TO THE FULLEST EXTENT ALLOWED UNDER APPLICABLE LAW, THE AGGREGATE LIABILITY OF DISPEL ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE SUBJECT MATTER HEREOF, UNDER ANY LEGAL THEORY (WHETHER IN CONTRACT, TORT, INDEMNITY, OR OTHERWISE), SHALL BE LIMITED TO THE AMOUNTS RECEIVED BY DISPEL FROM PARTNER UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTH PERIOD PRIOR TO THE DATE THE CLAIM AROSE.
### 12. Miscellaneous.
#### 12.1 Export Compliance.
Partner will comply with all applicable EU and local foreign trade laws including sanctions laws. The following applies to the extent that it does not violate EU laws, particularly Art. 5 of Council Regulation (EC) No 2271/96. Taking this into account: (i) This Agreement is subject to any export laws, regulations, orders, or other restrictions imposed by the U.S. government (including the Export Administration Regulations (“EAR”) maintained by the U.S. Department of Commerce, trade and economic sanctions maintained by the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”), and the International Traffic in Arms Regulations (“ITAR”) maintained by the U.S. Department of State) or by any other governmental entity on the Products or any related information; (ii) Partner represents, warrants, and covenants that it is: (a) not located in Cuba, Iran, North Korea, Sudan, or Syria; and (b) not a denied party as specified in the regulations listed above; (iii) Partner shall comply with all applicable export and re-export control laws and regulations, including the EAR, trade and economic sanctions maintained by OFAC, and the ITAR; (iv) Notwithstanding any other provision of this Agreement to the contrary, Partner will not import, export or re-export, sell, transfer, divert, or otherwise dispose of, directly or indirectly, the Products or related information to any country, other destination, or person to which such import, export, or re-export is restricted or prohibited, or as to which any such government or any agency thereof requires an export license or other governmental approval at the time of such import, export, or re-export without first obtaining such license or governmental approval.
#### 12.2 Anti-Corruption Compliance.
This Agreement is subject to the U.S. Foreign Corrupt Practices Act (“FCPA”) and all other applicable anti-corruption laws. Prior to and during the term of this Agreement, Partner, on behalf of itself and its directors, officers, employees, reseller representatives, and agents, represents, warrants and covenants that it has complied and will comply with the FCPA and all other applicable anti-corruption laws. Partner will not take any action, or fail to take any action, that would result in Dispel violating any such laws. Partner agrees to execute the Anti-Corruption Certification of Compliance, a copy of which is attached hereto as Exhibit B, at the time of entering into this Agreement.
#### 12.3 Insurance.
Partner will, at its own expense, maintain the following insurance coverage during the Term: (a) worker’s compensation insurance as required by applicable law; (b) employee’s liability insurance with minimum coverage of one million dollars ($1,000,000) per occurrence; (c) commercial general liability insurance covering bodily injury and property damage liability, including contractual liability, with minimum coverage of one million dollars ($1,000,000) per occurrence for bodily injury and property damage combined; and (d) professional liability insurance for errors and omissions with a minimum limit of one million dollars ($1,000,000) per claim. Nothing in this Agreement shall be deemed to preclude Partner from selecting a new insurance carrier or carriers or obtaining new or amended policies at any time, as long as the above insurance coverage is maintained. Partner will provide to Dispel copies of applicable certificates of insurance upon Dispel’s reasonable request.
#### 12.4 Governing Law; Jurisdiction and Venue.
Notwithstanding the observation of non-negotiable rules and regulations, this Agreement is to be construed in accordance with and governed by the internal laws of the State of New York without giving effect to any choice of law rule that would cause the application of the laws of any jurisdiction other than the internal laws of the State of New York to the rights and duties of the parties. Any legal suit, action, or proceeding arising out of or relating to this Agreement shall be commenced exclusively in a federal or state court located in the City of New York, and each party hereto irrevocably submits to the exclusive jurisdiction and venue of any such court in any such suit, action, or proceeding.
#### 12.5 Government Use.
Partner acknowledges that all of the Products were developed entirely at private expense and that no part of the Products was first produced in the performance of a U.S. Government contract. Partner agrees that all of the Products and any derivatives thereof are “commercial items” as defined in 48 C.F.R. § 2.101, and if Partner is a U.S. Government agency or instrumentality or if Partner is providing all or any part of the Products or any derivatives thereof to the U.S. Government, such use, duplication, reproduction, release, modification, disclosure, or transfer of this commercial product and data is restricted in accordance with 48 C.F.R. § 12.211, 48 C.F.R. § 12.212, 48 C.F.R. § 227.7102-2 and 48 C.F.R. § 227.7202, as applicable. Consistent with 48 C.F.R. § 12.211, 48 C.F.R. § 12.212, 48 C.F.R. §§ 227.7102-1 through 227.7102-, and 48 C.F.R. §§ 227.7202-1 through 227.7202-4, as applicable, the Products are licensed to U.S. Government end users (a) only as commercial items and (b) with only those rights as are granted to all other users pursuant to this Agreement and any related agreement(s), as applicable. Accordingly, (x) Partner will have no rights in the Products except as expressly agreed to in writing by Partner and Dispel; (y) the Products may not be sold, sublicensed, or otherwise transferred by Partner to any person, company, or institution whatsoever other than as expressly permitted in this Agreement or as Dispel and Partner may otherwise agree in writing; and (z) Partner shall not remove or alter any proprietary markings on the Products. Because the Products are commercial items, Dispel and Partner agree that (1) only those mandatory Federal Acquisition Regulation (“FAR”) and FAR Supplement clauses made expressly applicable to commercial item agreements by applicable FAR and FAR Supplement prescription clause provisions and that are expressly agreed upon in writing by Dispel shall be flowed-down to Dispel and incorporated into this Agreement or any related purchase order involving shipment of the Products; (2) Dispel shall not be required to comply with the cost accounting standards or contract cost principles; and (3) nothing in this Agreement or any Order or other related purchase order involving shipment of the Products gives Partner any right to audit Dispel’s books and records.
#### 12.6 Assignment.
This Agreement may not be assigned, in whole or part, whether voluntarily, by operation of law, or otherwise, by Partner without the prior written consent of Dispel. Subject to the preceding sentence, the rights and liabilities of the parties hereto shall bind, and inure to the benefit of, their respective assignees and successors. Any attempted assignment other than in accordance with this Section 12.6 shall be null and void.
#### 12.7 Waiver.
The waiver by either party of a breach of or a default under any provision of this Agreement shall be in writing and shall not be construed as a waiver of any subsequent breach of or default under the same or any other provision of this Agreement, nor shall any delay or omission on the part of either party to exercise or avail itself of any right or remedy that it has or may have hereunder operate as a waiver of any right or remedy.
#### 12.8 Attorneys’ Fees.
If any legal action, including an action for injunctive relief, is brought relating to this Agreement or the breach hereof, the prevailing party in any final judgment or arbitration award, or the non-dismissing party in the event of a dismissal without prejudice, shall be entitled to the full amount of all reasonable expenses, including all court costs and actual attorneys’ fees paid or incurred in good faith.
#### 12.9 Severability.
If the application of any provision of this Agreement to any particular facts or circumstances is held invalid or unenforceable by a court of competent jurisdiction, then: (a) the validity and enforceability of such provision as applied to any other particular facts or circumstances and the validity of the other provisions of this Agreement will not in any way be affected or impaired thereby; and (b) such provision will be enforced to the maximum extent possible so as to effect the intent of the parties and reformed without further action by the parties to the extent necessary to make such provision valid and enforceable.
#### 12.10 Force Majeure.
Except for the payment of amounts due under this Agreement, neither party will be liable for any delay or failure to perform to the extent due acts of God, pandemic, earthquake, fire, flood, embargoes, utility or power outages, riots, war, and acts of civil and military authorities and other similar occurrences outside of a party’s reasonable control; provided, however, that such party gives the other party prompt written notice of the delay or failure and the reason for the delay or failure, and uses its reasonable efforts to limit the resulting delay or failure (“Force Majeure Event”). If a party is unable to perform its obligations under this Agreement as a result of a Force Majeure Event for more than thirty (30) consecutive days, the other party may terminate this Agreement upon written notice
#### 12.11 Construction.
The captions and section and paragraph headings used in this Agreement are inserted for convenience only and shall not affect the meaning or interpretation of this Agreement. The words “include” and “including” shall not be construed as terms of limitation and shall therefore mean “including but not limited to” and “including without limitation.”
#### 12.12 Notices.
Any notice, request, demand, or other communication required or permitted hereunder shall be in writing, shall reference this Agreement and shall be deemed to be properly given: (a) when delivered personally; (b) seven (7) days after having been sent by registered or certified mail, return receipt requested, postage prepaid; (c) two (2) business days after deposit with a private industry express courier, with written confirmation of receipt; or (d) when transmitted by email if sent before 5:00 P.M. local time on a business day in the time zone to which it is sent, and otherwise on the next business day. All notices shall be sent to:
If partner: the address set forth in the Partner Portal if to Partner
If Dispel: Dispel, Attn: Legal, 61 Greenpoint Ave, Suite 634, Brooklyn NY 11222 USA
or an email address designated by the receiving party and to the notice of the person executing this Agreement (or to such other (email) address or person as may be designated by a party by giving written notice to the other party pursuant to this Section 12.12).
#### 12.13 Counterparts; Headings.
This Agreement may be executed in two or more counterparts, each of which will be deemed an original and all of which together will constitute one and the same instrument. The headings contained herein are for convenience of reference only and will not be considered as substantive parts of this Agreement.
#### 12.14 Entire Agreement.
This Agreement (including this document and the exhibits to this Agreement, which are incorporated by reference) constitutes the entire agreement between the parties with respect to the subject matter of this Agreement and supersedes all prior agreements, oral or written, regarding such subject matter. This Agreement may be updated from time to time at Dispel's sole discretion, and Partner's continued use of the Partner Portal constitute consent to these changes.
However, to the extent of any conflict or inconsistency between the provisions in this Agreement and any other documents or pages referenced in these Agreements, the following order of precedence will apply: (1) the terms of the separately signed Partner Program Agreement (if any), (2) the terms of this Agreement, and (3) finally, any other documents or pages referenced in the Terms.
In the event a One-Time Agreement ("**OTA**") is executed between Dispel and the Partner, then the terms of that OTA shall apply and not this Agreement for the deal that OTA covers.
Notwithstanding any language to the contrary therein, no terms or conditions stated in a customer purchase order, vendor onboarding process or web portal, or any other customer order documentation will be incorporated into or form any part of this Agreement, and all such terms or conditions will be null and void.
#### 12.15 Use of Other Party’s Name and Logo.
Subject to Section 8.1, each party shall be entitled to use the other party’s name and logo in its marketing materials and on its website in a manner designated by the other party. A party that intends to use the other party’s name and logo pursuant to this Section 12.15 shall give notice to the other party describing how such name and logo will be used, and the other party shall be given an opportunity to propose alterations before such name and logo are used. Dispel gives notice that it will use the partner logo on our website in a list of other partners.
### 13. Definitions.
#### 13.1 “Add-Ons”
means separately licensed hardware or software components used in conjunction with the Dispel Remote Access Services
#### 13.2 “Confidential Information”
means the confidential or proprietary information of Dispel or its affiliates (whether or not marked or identified as confidential or proprietary), including the Pricing Guidelines, inventions (whether or not patentable), trade secrets, ideas, know-how, techniques, processes, formulas, algorithms, schematics, research, development, software design and architecture, testing procedures, design and functional specifications, problem reports and performance information, training materials, marketing materials, marketing and financial plans and data, and the terms and conditions of this Agreement. Confidential Information does not include information (other than personal data) that: (a) is or becomes publicly known through no fault of Partner; (b) is known by or in the possession of Partner prior to its receipt from Dispel as evidenced by Partner’s written records; or (c) is lawfully obtained from a third party that has no obligation of confidentiality with respect to the information.
#### 13.3 “Customer”
means an individual or entity that purchases from Partner Remote Access Services. For the avoidance of doubt, Customer does not include any intermediaries or sublicensees pursuant to Section 1.6 involved in the sales process who are not users of the Products.
#### 13.4 “Customer Terms of Service”
means the terms at (as may be updated by Dispel from time to time).
#### 13.5 “Derivative Work”
means a new or modified work that is based on or derived from a preexisting work, including, without limitation, a work that, in the absence of a license, would infringe the copyright in such preexisting work or that uses trade secrets or other proprietary information with respect to such preexisting work.
#### 13.6 “Dispel Direct Competitor”
means an individual or entity that sells, produces, or otherwise provides access to software defined networks, communications networks and services in virtual private clouds utilizing virtual private network technology, ‘moving target defense’ networks, or remote access products.
#### 13.7 “Documentation”
means Dispel’s current online help resources, guides, and manuals provided by Dispel for use with the Remote Access Services.
#### 13.8 Remote Access Services”
means (a) the provision of access and use of networked infrastructures set up by Dispel on behalf of Customer for the purposes of secure remote access; (b) any web services provided to the Customer by Dispel for account management; (c) Dispel software applications (including any object code or executable files), including any related materials and documentation therefor; and any modifications, error corrections, bug fixes, new releases, enhanced functionality, or other updates thereto that may be provided hereunder by Dispel; and (d) any Add-Ons, as applicable.
#### 13.9 “Support Services”
means Support Tier One and Support Tier Three, together with any additional support services authorized by Dispel and purchased by Customer pursuant to Order Documentation.
#### 13.10 “Support Tier One”
means initial configuration of the Dispel Remote Access Services, assistance with basic administrative functions, diagnosis, and correction of errors.
#### 13.11 “Support Tier Three”
means the creation of custom deployments and assistance with systems engineering requests.
#### 13.12 “Government Customer”
means a specified agency, department, division, branch, or instrumentality of the national and/or federal Government or other national governments of other countries, international agencies of which the national and/or federal Government or another national government is or becomes a member, and any other national and/or federal Government or national government entity authorized to purchase off of government contracts on behalf of the national and/or federal Government or a national government of another country, in each case who purchases directly or indirectly from the Partner Remote Access Services.
#### 13.13 “Local Government Customer”
means a specified agency, department, division, branch, or instrumentality of a local government of the United States or other countries, national agencies of which such local government is or becomes a member, and any other local entity authorized to purchase off of government contracts on behalf of such local government, in each case who purchases directly or indirectly from Partner Remote Access Services.
## Exhibit B Anti-Corruption Certification of Compliance
For the purposes of this Anti-Corruption Certification of Compliance:
1\. “Anything of value” is defined broadly to include monetary and non-monetary payments, such as e.g. cash, a loan, gifts, travel, entertainment, or services.
2\. “Dispel” means Dispel, LLC or Dispel Global, Inc (as specified in the table in Exhibit A).
3\. “Government Official” means any officer, employee, or agent of (i) any government, at any level (national, state, provincial, or local) and any branch (executive, legislative, or judicial), (ii) any state-owned or state-controlled enterprise, (iii) any public international organization, or (iv) any political party, including a candidate for political office or political party official.
4\. “Partner” means the authorized reseller of Dispel’s software and services.
Partner, on behalf of itself and each of its directors, officers, employees, reseller representatives, and agents, hereby certifies that:
a) Partner has complied and will comply with the U.S. Foreign Corrupt Practices Act, the UK Bribery Act 2010, and all other applicable anti-corruption laws.
b) Partner has not requested, accepted, offered, or given, and will not request, accept, offer, or give, directly or indirectly, any bribe, kickback, or other improper or illegal payment of anything of value to any person in connection with the Agreement.
c) Partner has not corruptly taken any action in furtherance of an offer, payment, promise to pay, or authorization of the payment of anything of value, directly or indirectly, to a Government Official or any person for the purpose of:
i. Obtaining or retaining business;
ii. Influencing any act or decision of a Government Official or any person in his or her official capacity;
iii. Inducing the Government Official or any person to do or omit to do any act in violation of his or her lawful duty;
iv. Securing any improper advantage; or
v. Inducing any Government Official or any person to use his or her position improperly to affect any act or decision of a government or government agency, department, or instrumentality.
d) Partner is not aware of (i) any request made by any person, including any Government Official, for any payment of money or anything of value prohibited by provision b. or c. of this Certification; or (ii) any other individual or company making, offering, paying, promising, or authorizing any payment of money or anything of value prohibited by provision b. or c. of this Certification in connection with the reseller agreement between Partner and Dispel.
e) Partner will immediately advise Dispel by e-mail at or in writing, at 61 Greenpoint Ave, 6th Floor, Brooklyn, NY 11222, if it fails to comply with the provisions of this Certification or otherwise becomes aware of any changes to these representations and covenants.
# Japan
This Dispel Partner Program Agreement (this “Agreement”), which consists of this document and the exhibits identified below, is entered into as of the Effective Date by and between Dispel Global, Inc ("Dispel") and Partner, as set forth above or through clicking you accept this Agreement when onboarding onto the Dispel partner program dashboard at [partners.dispel.com](https://partners.dispel.com). Capitalized terms not defined in this Agreement have the meanings set forth in the exhibits.
#### 1. Products.
Dispel makes available the Remote Access Services (as defined in Exhibit A; the “Products”), and Partner desires to market and resell the Products in the Territory (as defined in your Partner Portal), in accordance with the terms and conditions of this Agreement. In connection with the resale of the Products, Partner may offer to resell to Customers the Support Services (as defined in Exhibit A).
#### 2. Pricing.
Resale prices for the Products and for Support Services will be established by Partner at its sole discretion. For each such resale, Partner will submit a purchase order to Dispel (“Purchase Order”) via the Partner Portal. The submittal of a Purchase Order will act as authorization for Dispel to proceed with the ordering process.
#### 3. Signatures.
The parties acknowledge that they have read and understand this Agreement, including this document and all exhibits, and agree to all of the terms and conditions of this Agreement by digital signature or checking the acceptance box on the Dispel Partner Portal website. By accessing the Dispel partner portal at [partners.dispel.com](https://partners.dispel.com) and continuing to use the website, you agree to these terms and any updates to these terms.
## Exhibit A: Terms and Conditions
### 1. Partner’s Rights.
#### 1.1 Marketing and Resale Rights.
Subject to the terms and conditions of this Agreement (including the payment obligations set forth in Section 5.4), Dispel grants to Partner a nonexclusive, nontransferable right and license during the Term within the Territory to:
(a) advertise, market, and promote the Products to Customers in the Territory;
(b) resell directly (i.e., not through distributors or resellers) to Customers in the Territory and to contractors for resale to Customers pursuant to Section 1.6 (i) the right to access and use the Remote Access Services, and (ii) the Support Services; and
(c) access and use the Remote Access Services for the sole purpose of providing the Support Services for Customers in accordance with Section 3.1 and exercising the rights in Section 1.5; provided that Partner shall purchase from Dispel a demo environment to access and use the Remote Access Services.
#### 1.2 Documentation Right.
Dispel grants to Partner a nonexclusive, nontransferable right and license during the Term to reproduce and distribute to Customers in the Territory the Documentation in connection with the resale of the Products pursuant to Section 1.1(b).
#### 1.3 Trademark License.
Dispel grants to Partner a nonexclusive, nontransferable right and license during the Term to use Dispel’s registered or common law trademarks and service marks solely: (a) in connection with Partner’s marketing, resale, advertising, and promotion of the Products in accordance with this Agreement; and (b) in accordance with any usage guidelines that Dispel provides to Partner from time to time. Partner agrees that all goodwill arising out of the use of the Trademarks by Partner will accrue to the sole benefit of Dispel. Partner will not at any time challenge, or assist others in challenging, the Trademarks. Partner will submit all advertising, marketing, branding, and promotional materials related to the Products to Dispel for advance review and approval, such approval not to be unreasonably withheld or delayed. Partner grants to Dispel a nonexclusive, nontransferable, license to use Partner’s registered and/or common law trademarks and service marks (the “Partner Trademarks”) solely in connection with any mutually-agreed upon marketing activities, in accordance with any usage guidelines that Partner provides to Dispel. Dispel agrees that all goodwill arising out of the use of the Partner Trademarks by Dispel will accrue to the sole benefit of Partner.
#### 1.4 Customer Terms of Service.
Prior to or simultaneously with completing the resale of a Product to a Customer, Partner shall ensure that such Customer has expressly agreed to the Customer Terms of Service. If a Customer does not agree to the Customer Terms of Service, that Customer will not be allowed to use the Remote Access Services or receive Support Services, and Dispel shall not be liable to Partner for refunding any Fees paid. For the avoidance of doubt, Dispel shall provide the Products and Support Services to the Customer only in accordance with the Customer Terms of Service.
a) Partner shall obtain Dispel’s prior, written approval (not to be unreasonably withheld) of the manner in which Partner intends to ensure that each Customer expressly agrees to the Customer Terms of Service, and upon Dispel’s request, shall provide documentation evidencing each Customer’s acceptance of the Customer Terms of Service.
b) Partner will immediately advise Dispel if Partner becomes aware of any breach by a Customer of any provision of the Customer Terms of Service.
c) In the event of a conflict between the Customer Terms of Service and any agreement between Partner and Customer, the Customer Terms of Service shall take precedence with respect to Dispel’s obligations and performance.
d) Nothing in this Agreement, the Customer Terms of Service, or any agreement between Partner and Customer obligates or will obligate Dispel to develop or assist in developing any Government-Off-The-Shelf products.
#### 1.5 Partner Internal Use.
Subject to the terms and conditions of this Agreement, Dispel hereby grants to Partner a nonexclusive, nontransferable, royalty-free (except as set forth in Section 5), revocable right to use the Remote Access Services during the Term and in accordance with the Documentation, for the sole purpose of providing demonstrations of the Products to prospective Customers in the Territory and for no other purpose. Partner acknowledges and agrees that it shall purchase from Dispel a demo environment to access and use the Remote Access Services pursuant to this Section 1.5.
#### 1.6 Right of Sublicense.
The rights granted pursuant to Sections 1.1, 1.2, 1.3, and 1.5 are nonsublicensable, except to the extent that Partner is engaged in a sales process to Customers involving multiple tiers of sales (i.e., selling to and through multiple tiers of contractors), in which case Partner shall have a limited right to sublicense the rights set forth in Sections 1.1, 1.2, 1.3, and 1.5 to only those third parties directly involved in such resale to Customers.
Any sublicense granted pursuant to this Section 1.6 shall be subject to the following restrictions:
a) such sublicense shall be limited solely to the contractor(s) duly authorized by Partner; provided that Partner shall report its duly authorized contractor(s) to Dispel on a regular basis as designated by Dispel;
b) such sublicense shall be subject to, and subordinate to, this Agreement and, in case of any conflict, the terms of this Agreement shall prevail;
c) Partner shall be responsible for, and shall ensure, any sublicensee’s compliance with this Agreement; and
d) Dispel shall have the right to review any such sublicense agreement upon request.
#### 1.7 Certain Restrictions.
Partner shall not:
a) resell, sublicense or otherwise make available the Products except as permitted by this Agreement;
b) resell, sublicense or otherwise make available the Products to any Dispel Direct Competitor;
c) represent itself as an agent of Dispel for any purpose, nor pledge Dispel's credit or give any condition or warranty or make any representation on Dispel's behalf or commit Dispel to any contracts;
d) copy, decompile, disassemble, design around or otherwise reverse engineer the Products or any portion thereof, or determine or attempt to determine any source code, algorithms, methods, or techniques embodied in the Products or any portion thereof, or extract ideas, algorithms, procedures, workflows, or hierarchies from the Products or otherwise use the Products for the purpose of creating another product or service unless such act is permitted under applicable law (even in the case where such act is permitted under applicable law, Partner shall not use anything learned from such act in a commercial or marketing setting);
e) interfere with, or disrupt the operation of, the servers or networks used to make the Products available, or violate any requirements, procedures, policies, or regulations of such servers or networks or their providers;
f) post, transmit, or otherwise make available through or in connection with the Products any virus, worm, Trojan horse, Easter egg, time bomb, spyware, or other computer code, file, or program that is, or is potentially, harmful or invasive or intended to damage or hijack the operation of, or to monitor the use of, any hardware, software, or equipment;
g) modify, translate, or create any Derivative Works based upon the Products (except to the extent this restriction is expressly prohibited by applicable law);
h) remove or alter any copyright, trademark, trade name, or other proprietary notices, legends, symbols, or labels appearing on or in copies of the Products except as permitted under this Agreement;
i) perform, or release the results of, benchmark tests or other comparisons of the Products with other programs without Dispel’s prior written consent;
j) transfer the Products to any computer other than a computer owned by Partner and used by Partner in Partner’s operations, except as permitted by this Agreement;
k) permit the Products to be used for the benefit of any third party (i.e., in an ASP, outsourcing or service bureau relationship or processing the data of any third party), except as permitted by this Agreement;
l) incorporate the Products or any portion thereof into any other program or product, or use the Products for production purposes;
m) assert, or attempt to assert, any ownership of or other rights to (including, but not limited to, the filing of any applications for patent, trademark, copyright, or any other intellectual property rights), over, or involving the Products;
n) challenge or assist third parties in challenging the ownership, validity, enforceability, or scope of Dispel’s and/or its affiliate’s intellectual property rights or other rights in the Products or Trademarks, or, unless otherwise expressly permitted hereunder, use Dispel’s and/or its affiliate’s intellectual property rights filed and/or registered in the US anywhere in the world as if such intellectual property rights were filed and/or registered worldwide (except to the extent this restriction is prohibited by applicable law);
o) advertise, market, promote, sell, distribute, use, export, or otherwise make available the Products to any entities or person not located in the Territory (including but not limited to any foreign offices, branches, locations, affiliates, or subsidiaries of a Territory entity or person that is located outside of the Territory), without Dispel’s express written prior permission;
p) in connection with the Products and Support Services or in performance of this Agreement (i) defame, threaten, abuse, or harass any person, or otherwise violate the legal rights of any person or entity, including any copyright, trademark, trade secret, right of publicity or privacy, or any other proprietary right; (ii) harvest or collect personally identifiable information from or about any person other than in the ordinary course of business or otherwise in violation of any applicable law; (iii) impersonate any person or entity, or falsely state or otherwise misrepresent Dispel’s affiliation with any person or entity; or (iv) engage in any fraudulent or otherwise tortious or unlawful conductor;
q) violate any laws or regulations, ordinances, and requirements of any governmental authority applicable to Partner’s activities under this Agreement; or
r) engage in any other activity prohibited by this Agreement or that is reasonably deemed by Dispel to be in conflict with the spirit or intent of this Agreement.
#### 1.8 Enablement Training.
Dispel offers training and certifications with respect to the Products and Support Services (“Enablement Training Program”). Through the Enablement Training Program, individuals may be certified by Dispel as Dispel Systems Certified Specialists. Certification information and standards may, at Dispel’s sole discretion, be modified or changed from time to time by Dispel without notice to Partner.
#### 1.9 Tiers.
a) Discounts. Partner will be eligible to receive benefits based upon its achieved tier within the Partner Program, including discounts off the list price for the Products. Tier information is included in the Partner Portal, which Dispel may modify, at its sole discretion, from time to time. Dispel may change eligibility requirements and will notify the Partner of any such updates. Tiers may be specific to a deal depending on how the deal was sourced, client renewal decisions, or other factors set at Dispel’s sole discretion.
b) No Hardware Discounts. Some implementations of the Dispel Products use hardware to provide integration into the broader system. To the extent that Partner resells any such hardware, Partner does not receive a discount on such connection hardware and any physical asset sold by Dispel (“System Enablement Components” or “Hardware”).
c) Determining Tiers. Dispel shall, in its sole discretion, determine the tier a Partner is eligible for provided such determination is consistent with the then-current version of the Tier information available in the Dispel Partner Portal (which may be updated from time to time with written notice from Dispel).
#### 1.10 Resale Policy Changes.
From time to time, Dispel may institute new or revised policies and procedures regarding the resale of the Products. Upon Partner’s receipt of notice from Dispel of any such new or revised policies or procedures, Partner will promptly implement such policies and procedures.
### 2. Ownership.
#### 2.1 Generally.
As between Dispel and Partner, Dispel and its licensors own all right, title, and interest in and to the Products and Trademarks (including all copies, modifications, and Derivative Works thereof and all intellectual property and proprietary rights embodied therein), except for the limited right and licenses expressly granted to Partner in this Agreement. For the avoidance of doubt, any modifications, Derivative Works, intellectual property, or proprietary rights created by Partner in contravention of this Agreement shall belong exclusively to Dispel and Partner hereby assigns to Dispel all right, title, and interest in and to all such modifications, Derivative Works, intellectual property, and proprietary rights in any manner and for any purpose.
#### 2.2 Feedback.
If Partner provides Dispel with any suggestions, ideas, feedback, reports, error identifications, or other information related to the Products or Dispel’s other products or services (“Feedback”), Partner hereby assigns to Dispel all rights, titles, and interests in and to all Feedback, including all patent rights, copyrights (including the rights stipulated under Articles 27 and 28 of the Copyright Act of Japan), trade secrets, and other intellectual property or proprietary rights therein, and agrees to assist Dispel in perfecting such rights and obtaining assignments of such rights from all individuals involved in generating the Feedback. Further, Partner shall not, and cause such individuals not to, exercise its/their moral rights in regard to the Feedback to Dispel and those designated by Dispel.
### 3. Channel Management.
#### 3.1 Maintenance and Support Services.
The list price for each Product may include certain labor hours for Support Services. Any Support Services requested by Customer in excess of the labor hours included in the list price shall be as detailed in the Pricing Guidelines and subject to the execution of a Purchase Order. Partner may describe to each Customer each of the tiers of maintenance and support offered by Dispel prior to the Partner and Customer completing the ordering documentation for the purchase of Products from Partner (“Order Documentation”).
#### 3.2 Problem Resolution.
Partner shall keep Dispel informed on a regular basis regarding any problems encountered with the Products by Partner or Customers, and regarding any resolutions developed for those problems. Partner shall communicate promptly to Dispel any and all modifications, design changes, or improvements to the Products suggested by any entity or person to Partner.
### 4. Dispel Professional Services.
To the extent that Partner wishes to engage Dispel to provide training, operational, technical, or other professional services to Customer in addition to the Support Services, the terms and conditions governing such professional services will be set forth in a separate professional services agreement entered into between Dispel and Partner. Nothing contained herein shall limit a Customer’s right to directly contact Dispel should such Customer desire to purchase training, operational, technical, or other professional services from Dispel. Partner will assist Customer with any such request for training, operational, technical, or other professional services from Dispel.
### 5. Pricing; Payment Terms.
#### 5.1 Pricing.
Resale prices for the Products and Support Services will be established by Partner at its sole discretion. Partner will purchase the Products and Support Services from Dispel at prices set forth in the pricing guidelines provided by Dispel to Partner, which may be updated by Dispel from time to time with written notice to Partner (“Pricing Guidelines”), subject to any discounts Partner is eligible to receive under the Partner Program. Partner may bundle Dispel products with other services, and Dispel’s pricing in no way affects a Partner’s pricing of those other services. The Pricing Guidelines are Dispel’s Confidential Information.
#### 5.2 Purchase Order.
Partner will submit to Dispel a Purchase Order for each resale of the Products and any Support Services. Dispel may accept or reject any Purchase Order at its discretion. By placing a Purchase Order, Partner: (a) represents and warrants that the applicable Customer has agreed to the Customer Terms of Service; and (b) agrees to pay Dispel the amounts for the ordered Products and Support Services as set forth in the Pricing Guidelines, subject to any applicable discounts and any applicable cash credits under Section 3.1 (collectively, “Fees”).
#### 5.3 Billing.
All Fees for the Products and Support Services will be billed to the Partner when the Products and Support Services are shipped/provided to the Customer. All Fees for items purchased by Dispel for the Customer will be pre-billed to the Partner and will be paid by the Partner in accordance with Section 5.4, notwithstanding Section 5.2. Any adjustments to subscription-based Fees made mid-billing cycle will be calculated and billed to Partner in arrears on the subsequent invoice. All orders made by Partner to Dispel are non-cancelable and all payments made by Partner to Dispel are non-refundable, including but not limited to, if any Customer fails to pay Partner for an order or fails to agree to the Customer Terms of Service and Dispel has terminated such Customer’s access to Services or Products as a result thereof. Other than any applicable cash credits under Section 3.1, under no circumstances will Dispel be obligated to issue a credit to Partner.
#### 5.4 Payment.
Each invoice issued by Dispel will identify the Fees payable by Partner. All amounts payable under this Agreement will be due within thirty (30) days of the receipt of the invoice therefor; unless the parties have agreed to a specific payment schedule in the Purchase Order, in which case the payment schedule in the Purchase shall control for that order. Payments must be remitted to the account identified by Dispel and are due on the date, and in the currency stated, in the invoice. Partner will pay such amounts regardless of whether it has received any payment from Customers. Any amounts not paid when due shall accrue a late fee at the rate of one and a half percent (1.5%) per month or the maximum rate allowed by law, whichever is lower. In the event Partner fails to pay within sixty (60) days the outstanding Fees set forth in an invoice from Dispel or payment schedule in the Purchase Order, Dispel may, in its sole discretion, (a) suspend or terminate the applicable Customer’s access to the Remote Access Services and/or Support Services, and/or (b) terminate this Agreement, upon written notice to Partner.
#### 5.5 Taxes.
Partner will be responsible, as required under applicable law, for identifying and paying all taxes and other governmental fees and charges (and any penalties, interest, and other additions thereto) that are imposed on Partner upon or with respect to the transactions and payments under this Agreement. All fees payable by Partner are exclusive of applicable taxes and duties, including VAT, GST, excise taxes, sales and transactions taxes, and gross tax receipts (“Indirect Taxes”). Dispel may charge, and Partner will pay, all Indirect Taxes that Dispel is legally obligated or allowed to collect from Partner. Partner will provide all information to Dispel as reasonably required to determine whether Dispel is obligated to collect Indirect Taxes from Partner under any applicable law. Dispel will not collect, and Partner will not pay, any Indirect Tax for which Partner furnishes Dispel a properly completed exemption certificate or a direct payment permit certificate for which Partner may claim an available exemption from such Indirect Tax. All payments made by Partner to Dispel under this Agreement will be made free and clear of any withholding or deduction for taxes. If any taxes (for example, international withholding taxes) are required to be withheld on any payment, Partner will pay additional amounts as necessary so that the net amount received by Dispel is equal to the amount then due and payable under this Agreement.
#### 5.6 Duties and Shipping Fees.
Partner is responsible for any foreign exchange, duty, shipping charges, and additional processing fees incurred, including any BIS license fees. If these fees are incurred after the initial invoice was sent, Dispel will invoice the Partner payable under Section 5.4.
#### 5.7 Records and Audit Rights.
During the Term and for a period of at least two (2) years thereafter, Partner will maintain complete and accurate records and accounts relating to this Agreement, including for each resale of the Products and Support Services resold by Partner: (a) the Customer’s name and address; (b) Product components made available to the Customer; and (c) documentation showing that the Customer agreed to the Customer Terms of Service. Dispel may audit such records and accounts of Partner from time to time to verify Partner’s compliance with the terms and conditions of this Agreement. Any such audit will be at Dispel’s expense; provided, however, that if such audit reveals an underpayment of three percent (3%) or more of fees payable to Dispel with respect to any calendar month, or any other material breach of this Agreement by Partner, Partner will promptly reimburse Dispel for all expenses in connection with such audit. Partner will promptly pay Dispel the amount of any underpayment (and correct any other noncompliance) revealed by any such audit.
### 6. Warranty Disclaimer.
#### 6.1 Warranty Disclaimer.
EXCEPT FOR THE WARRANTY SET FORTH IN THE THEN-CURRENT VERSION OF THE CUSTOMER TERMS OF SERVICE, DISPEL MAKES NO WARRANTIES WITH RESPECT TO THE PRODUCTS, THE SUPPORT SERVICES, ANY DOCUMENTATION, OR ANY OTHER PRODUCTS OR SERVICES, AND DISCLAIMS ALL STATUTORY OR IMPLIED WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT, AND ALL WARRANTIES ARISING FROM A COURSE OF DEALING, COURSE OF PERFORMANCE, USAGE, OR TRADE PRACTICE. DISPEL SPECIFICALLY DISCLAIMS ANY WARRANTY THAT THE PRODUCTS, THE SUPPORT SERVICES, OR ANY OPEN SOURCE COMPONENT WILL MEET ANY PARTNER OR CUSTOMER REQUIREMENTS OR THAT THE OPERATION OR USE OF THE PRODUCTS OR ANY OPEN SOURCE COMPONENT WILL BE UNINTERRUPTED OR ERROR-FREE. UNDER NO CIRCUMSTANCES SHALL DISPEL HAVE ANY LIABILITY WHATSOEVER FOR ANY HARDWARE PROVIDED BY DISPEL TO CUSTOMER IN CONNECTION WITH THIS AGREEMENT.
#### 6.2 Restrictions.
Partner will not make: (a) any representation or warranty on behalf of Dispel; (b) any representation concerning the quality, performance, or other characteristics of the Products or the Support Services, other than those which are consistent in all respects with the applicable Documentation; or (c) any commitment to modify any part of the Products or the Support Services.
### 7. Term and Termination.
#### 7.1 Term.
This Agreement will commence on the Effective Date and, unless earlier terminated in accordance with this Agreement, will continue in full force and effect until the end of the Initial Term set forth on the Cover Page. Thereafter, this Agreement will automatically renew for successive one (1) year periods (each, a “Renewal Term”), unless either party notifies the other party in writing at least sixty (60) days prior to the end of the then-current term that it does not wish to renew this Agreement, or unless earlier terminated in accordance with this Agreement. The Initial Term and any Renewal Terms are collectively referred to as the “Term.”
#### 7.2 Termination by Dispel.
Dispel may terminate this Agreement immediately upon written notice to Partner if: (a) Partner materially breaches Section 1 (“Partner’s Rights.”), Section 5 (“Pricing; Payment Terms.”) or Section 9 (“Confidentiality.”) and fails to cure such breach within seven (7) days after receipt of written notice of such breach from Dispel; (b) Partner materially breaches any other provision of this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice of such breach from Dispel or (c) Partner challenges or assists third parties in challenging the ownership, validity, enforceability, or scope of Dispel’s and/or its affiliates’ intellectual property rights or other rights in the Products or Trademarks. Dispel may also terminate this Agreement for any reason, with or without cause, at any time upon sixty (60) days’ written notice to Partner.
#### 7.3 Termination by Partner.
Partner may terminate this Agreement immediately upon written notice to Dispel if Dispel materially breaches any provision of this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice of such breach from Partner. Partner may also terminate this Agreement for any reason, with or without cause, at any time upon sixty (60) days’ written notice to Dispel.
#### 7.4 Mutual Termination.
Either party may terminate this Agreement immediately upon written notice to the other party if: (a) any proceeding is commenced by or against the other party seeking relief, reorganization, or arrangement under any laws relating to insolvency or bankruptcy, and such proceeding is not dismissed within sixty (60) days; (b) the other party makes an assignment of its property or assets for the benefit of its creditors; (c) a receiver, liquidator, or trustee is appointed for the other party’s property or assets; or (d) the other party is liquidated, dissolved, or wound up.
#### 7.5 Transition of Existing End Users.
Upon termination or expiration of this Agreement: (a) for each Product component resold by prior to any termination or expiration of this Agreement, each then-current Customer shall continue to have the right to use such Product component for the remainder of its current subscription term (with no right to renew such subscriptions), in accordance with the Customer Terms of Service, governing such subscription, and with the terms of this Agreement, provided that in no event shall such continued right to use the Products extend past twelve (12) months after the termination or expiration of this Agreement (the period that any such rights remain in effect after the termination or expiration of this Agreement, the “Wind-down Period”); (b) the parties shall promptly meet to negotiate in good faith the orderly wind-down of each party’s activities under this Agreement; and (c) each party shall continue to perform its relevant obligations under this Agreement during the Wind-down Period (but only with respect to obligations existing as of the date of termination or expiration and only to the extent that such obligations relate to Customers with active subscriptions to the Remote Access Services).
#### 7.6 Effect of Termination.
Upon termination or expiration of this Agreement: (a) all licenses granted to Partner under this Agreement will terminate immediately; and (b) Partner will immediately: (i) cease use and resale of the Products; (ii) discontinue use of the Trademarks; (iii) discontinue statements from which it might be inferred that any relationship exists between Partner and Dispel; (iv) cease to advertise, market, promote, or solicit or procure orders for, the Products or Support Services; and (v) return the Confidential Information, the Documentation, and all related materials and copies to Dispel.
#### 7.7 Sales to Permitted Government Customers.
If the parties have terminated or are in the process of terminating this Agreement pursuant to this Section 7 and, at such time, Partner is still actively involved in the bidding/sales process to a Permitted Government Customer due to a bid submitted prior to any notice of termination, then this Agreement shall continue to govern and remain in full force and effect only with respect to such outstanding bid/sales to such Permitted Government Customer and any resulting sales by Partner to such Permitted Government Customer. Partner shall be permitted to continue to support any such outstanding bids/sales to such Permitted Government Customer provided Partner is and remains in full compliance with this Agreement. Upon termination or conclusion of the outstanding bids/sales, then this Agreement shall terminate in accordance with this Section 7 unless otherwise agreed to by the parties in writing.
#### 7.8 No Harm upon Termination.
Partner will not be entitled to and, to the fullest extent permitted by law, waives any statutorily prescribed or other compensation, reimbursement, or damages for loss of goodwill, clientele, prospective profits, investments, or anticipated sales, commitments, or business opportunities of any kind arising from the termination of this Agreement.
#### 7.9 Survival of Terms.
The following sections will survive the expiration or termination of this Agreement: (a) Sections 1.7 (“Certain Restrictions.”), 2 (“Ownership.”), 5.7 (“Records and Audit Rights.”), 6 (“Warranty Disclaimer.”), 7 (“Term and Termination.”), 8 (“Relationship of the Parties.”), 9 (“Confidentiality.”), 10 (“Indemnification.”), 11 (“Limitation of Liability.”), 12 (“Miscellaneous.”), and 13 (“Definitions.”); and (b) any payment obligations of either party to the other party arising under this Agreement.
### 8. Relationship of the Parties.
#### 8.1 Independent Contractors.
The relationship of Dispel and Partner is that of independent contractors. Nothing in this Agreement will create, or be construed to create, any partnership, joint venture, agency, franchise, sales representative, employment, or fiduciary relationship between the parties. Except as otherwise provided in this Agreement, neither party will have any right, power, or authority to act or create any obligation, express or implied, on behalf of the other party. Dispel is in no manner associated with or otherwise connected with the actual performance of this Agreement on the part of Partner, nor with Partner’s employment of other persons or incurring of other expenses.
#### 8.2 Partner’s Employees.
It is understood that Partner is solely responsible for all of its employees and agents, its labor costs and expenses arising in connection therewith, and for any and all claims, liabilities, and damages or debts of any type whatsoever that may arise on account of Partner’s activities, or those of its employees or agents, in the performance of this Agreement.
#### 8.3 Nonexclusive Relationship.
Nothing in this Agreement will be construed as limiting Dispel’s marketing or distribution activities or its appointment of other original equipment manufacturers, dealers, distributors, resellers, licensees, or agents of any kind in any place.
### 9. Confidentiality.
Partner will use the Confidential Information only for purposes of exercising its rights or performing its obligations under this Agreement. Partner will hold the Confidential Information in strict confidence and will use the same degree of care that Partner uses to protect its own like information, but in no event less than a reasonable degree of care, to protect the Confidential Information from unauthorized use or dissemination. Partner will not disclose the Confidential Information to third parties without the prior written consent of Dispel and will only disclose Confidential Information to Partner’s employees who require such Confidential Information in connection with the performance of this Agreement and who are bound in writing by confidentiality obligations no less restrictive than those set forth in this Section 9. Partner agrees that any breach of this Section 9 would cause irreparable harm to Dispel for which monetary damages would not be adequate and, therefore, Partner agrees that, if Partner or its employee breaches this Section 9, Dispel will be entitled to equitable relief in addition to any other remedies it may have hereunder or at law or in equity.
### 10. Indemnification.
Partner will defend (at Dispel’s option), indemnify, and hold harmless Dispel, its licensors, its affiliates, and each of its and their respective members, officers, directors, agents, and employees (collectively, the “Dispel Parties”) against damages, costs, liabilities, expenses (including reasonable attorneys’ fees) and settlement amounts incurred in connection with any suit, claim or action by any third party against a Dispel Party based on: (a) Partner’s modification, use, marketing, resale, or distribution of the Products not in strict accordance with this Agreement; (b) any warranty or representation made by Partner or Partner’s agents which differ from those provided by Dispel; (c) injuries or damage to persons or property caused or claimed to have been caused by the negligent acts, errors, or omissions of Partner or Partner’s agents while in the course of performing under this Agreement; (d) any breach of Section 12.1; or (e) the infringement or misappropriation, or alleged infringement or misappropriation, of any copyright, patent, trade secret, or other intellectual property right by Partner (except to the extent such infringement or misappropriation arises from the distribution or use of the Products in compliance with the terms and conditions of this Agreement and the Customer Terms of Service). For third party claims, Dispel shall have the right to control its defense and select its own legal counsel to represent its interest and that of the Dispel Parties and Partner shall reimburse Dispel for such legal costs and attorneys’ fees promptly upon request for reimbursement. Partner may not settle any such claim without Dispel’s prior, written consent.
### 11. Limitation of Liability.
#### 11.1 Consequential Damages Waiver.
TO THE FULLEST EXTENT ALLOWED UNDER APPLICABLE LAW AND EXCEPT FOR ANY LIABILITY ARISING OUT OF BREACHES OF SECTIONS 1 OR 9 AND PARTNER’S PERFORMANCE OF ITS INDEMNITY OBLIGATIONS UNDER SECTION 10, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ANY THIRD PARTY FOR ANY INDIRECT, SPECIAL, PUNITIVE, INCIDENTAL, CONSEQUENTIAL, OR OTHER INDIRECT DAMAGES, INCLUDING ANY DAMAGES RESULTING FROM LOSS OF USE, LOSS OF DATA, INADVERTENT DISCLOSURE OF DATA, LOSS OF PROFITS, LOSS OF REVENUE, OR LOSS OF BUSINESS, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE PRODUCTS, NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY OF ANY KIND AND WHETHER OR NOT A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
#### 11.2 Limitation of Liability.
TO THE FULLEST EXTENT ALLOWED UNDER APPLICABLE LAW, THE AGGREGATE LIABILITY OF DISPEL ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE SUBJECT MATTER HEREOF, UNDER ANY LEGAL THEORY (WHETHER IN CONTRACT, TORT, INDEMNITY, OR OTHERWISE), SHALL BE LIMITED TO THE AMOUNTS RECEIVED BY DISPEL FROM PARTNER UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTH PERIOD PRIOR TO THE DATE THE CLAIM AROSE.
### 12. Miscellaneous.
#### 12.1 Export Compliance.
Partner will comply with all applicable US, EU, and local foreign trade laws including sanctions laws. The following applies to the extent that it does not violate EU laws, particularly Art. 5 of Council Regulation (EC) No 2271/96. Taking this into account: (i) This Agreement is subject to any export laws, regulations, orders, or other restrictions imposed by the U.S. government (including the Export Administration Regulations (“EAR”) maintained by the U.S. Department of Commerce, trade and economic sanctions maintained by the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”), and the International Traffic in Arms Regulations (“ITAR”) maintained by the U.S. Department of State) or by any other governmental entity on the Products or any related information; (ii) Partner represents, warrants, and covenants that it is: (a) not located in Cuba, Iran, North Korea, Sudan, or Syria; and (b) not a denied party as specified in the regulations listed above; (iii) Partner shall comply with all applicable export and re-export control laws and regulations, including the EAR, trade and economic sanctions maintained by OFAC, and the ITAR; (iv) Notwithstanding any other provision of this Agreement to the contrary, Partner will not import, export or re-export, sell, transfer, divert, or otherwise dispose of, directly or indirectly, the Products or related information to any country, other destination, or person to which such import, export, or re-export is restricted or prohibited, or as to which any such government or any agency thereof requires an export license or other governmental approval at the time of such import, export, or re-export without first obtaining such license or governmental approval.
#### 12.2 Anti-Corruption Compliance.
This Agreement is subject to the U.S. Foreign Corrupt Practices Act (“FCPA”) and all other applicable anti-corruption laws. Prior to and during the term of this Agreement, Partner, on behalf of itself and its directors, officers, employees, reseller representatives, and agents, represents, warrants and covenants that it has complied and will comply with the FCPA and all other applicable anti-corruption laws. Partner will not take any action, or fail to take any action, that would result in Dispel violating any such laws. Partner agrees to execute the Anti-Corruption Certification of Compliance, a copy of which is attached hereto as Exhibit B, at the time of entering into this Agreement.
#### 12.3 Insurance.
Partner will, at its own expense, maintain the following insurance coverage during the Term: (a) worker’s compensation insurance as required by applicable law; (b) employee’s liability insurance with minimum coverage of one million dollars ($1,000,000) per occurrence; (c) commercial general liability insurance covering bodily injury and property damage liability, including contractual liability, with minimum coverage of one million dollars ($1,000,000) per occurrence for bodily injury and property damage combined; and (d) professional liability insurance for errors and omissions with a minimum limit of one million dollars ($1,000,000) per claim. Nothing in this Agreement shall be deemed to preclude Partner from selecting a new insurance carrier or carriers or obtaining new or amended policies at any time, as long as the above insurance coverage is maintained. Partner will provide to Dispel copies of applicable certificates of insurance upon Dispel’s reasonable request.
#### 12.4 Governing Law; Jurisdiction and Venue.
Notwithstanding the observation of non-negotiable rules and regulations, this Agreement is to be construed in accordance with and governed by the internal laws of the State of New York without giving effect to any choice of law rule that would cause the application of the laws of any jurisdiction other than the internal laws of the State of New York to the rights and duties of the parties. Any legal suit, action, or proceeding arising out of or relating to this Agreement shall be commenced exclusively in a federal or state court located in the City of New York, and each party hereto irrevocably submits to the exclusive jurisdiction and venue of any such court in any such suit, action, or proceeding.
#### 12.5 Government Use.
Partner acknowledges that all of the Products were developed entirely at private expense and that no part of the Products was first produced in the performance of a U.S. Government contract. Partner agrees that all of the Products and any derivatives thereof are “commercial items” as defined in 48 C.F.R. § 2.101, and if Partner is a U.S. Government agency or instrumentality or if Partner is providing all or any part of the Products or any derivatives thereof to the U.S. Government, such use, duplication, reproduction, release, modification, disclosure, or transfer of this commercial product and data is restricted in accordance with 48 C.F.R. § 12.211, 48 C.F.R. § 12.212, 48 C.F.R. § 227.7102-2 and 48 C.F.R. § 227.7202, as applicable. Consistent with 48 C.F.R. § 12.211, 48 C.F.R. § 12.212, 48 C.F.R. §§ 227.7102-1 through 227.7102-, and 48 C.F.R. §§ 227.7202-1 through 227.7202-4, as applicable, the Products are licensed to U.S. Government end users (a) only as commercial items and (b) with only those rights as are granted to all other users pursuant to this Agreement and any related agreement(s), as applicable. Accordingly, (x) Partner will have no rights in the Products except as expressly agreed to in writing by Partner and Dispel; (y) the Products may not be sold, sublicensed, or otherwise transferred by Partner to any person, company, or institution whatsoever other than as expressly permitted in this Agreement or as Dispel and Partner may otherwise agree in writing; and (z) Partner shall not remove or alter any proprietary markings on the Products. Because the Products are commercial items, Dispel and Partner agree that (1) only those mandatory Federal Acquisition Regulation (“FAR”) and FAR Supplement clauses made expressly applicable to commercial item agreements by applicable FAR and FAR Supplement prescription clause provisions and that are expressly agreed upon in writing by Dispel shall be flowed-down to Dispel and incorporated into this Agreement or any related purchase order involving shipment of the Products; (2) Dispel shall not be required to comply with the cost accounting standards or contract cost principles; and (3) nothing in this Agreement or any Order or other related purchase order involving shipment of the Products gives Partner any right to audit Dispel’s books and records.
#### 12.6 Assignment.
This Agreement may not be assigned, in whole or part, whether voluntarily, by operation of law, or otherwise, by Partner without the prior written consent of Dispel. Subject to the preceding sentence, the rights and liabilities of the parties hereto shall bind, and inure to the benefit of, their respective assignees and successors. Any attempted assignment other than in accordance with this Section 12.6 shall be null and void.
#### 12.7 Waiver.
The waiver by either party of a breach of or a default under any provision of this Agreement shall be in writing and shall not be construed as a waiver of any subsequent breach of or default under the same or any other provision of this Agreement, nor shall any delay or omission on the part of either party to exercise or avail itself of any right or remedy that it has or may have hereunder operate as a waiver of any right or remedy.
#### 12.8 Attorneys’ Fees.
If any legal action, including an action for injunctive relief, is brought relating to this Agreement or the breach hereof, the prevailing party in any final judgment or arbitration award, or the non-dismissing party in the event of a dismissal without prejudice, shall be entitled to the full amount of all reasonable expenses, including all court costs and actual attorneys’ fees paid or incurred in good faith.
#### 12.9 Severability.
If the application of any provision of this Agreement to any particular facts or circumstances is held invalid or unenforceable by a court of competent jurisdiction, then: (a) the validity and enforceability of such provision as applied to any other particular facts or circumstances and the validity of the other provisions of this Agreement will not in any way be affected or impaired thereby; and (b) such provision will be enforced to the maximum extent possible so as to effect the intent of the parties and reformed without further action by the parties to the extent necessary to make such provision valid and enforceable.
#### 12.10 Force Majeure.
Except for the payment of amounts due under this Agreement, neither party will be liable for any delay or failure to perform to the extent due acts of God, pandemic, earthquake, fire, flood, embargoes, utility or power outages, riots, war, and acts of civil and military authorities and other similar occurrences outside of a party’s reasonable control; provided, however, that such party gives the other party prompt written notice of the delay or failure and the reason for the delay or failure, and uses its reasonable efforts to limit the resulting delay or failure (“Force Majeure Event”). If a party is unable to perform its obligations under this Agreement as a result of a Force Majeure Event for more than thirty (30) consecutive days, the other party may terminate this Agreement upon written notice.
#### 12.11 Construction.
The captions and section and paragraph headings used in this Agreement are inserted for convenience only and shall not affect the meaning or interpretation of this Agreement. The words “include” and “including” shall not be construed as terms of limitation and shall therefore mean “including but not limited to” and “including without limitation.”
#### 12.12 Notices.
Any notice, request, demand, or other communication required or permitted hereunder shall be in writing, shall reference this Agreement and shall be deemed to be properly given: (a) when delivered personally; (b) seven (7) days after having been sent by registered or certified mail, return receipt requested, postage prepaid; (c) two (2) business days after deposit with a private industry express courier, with written confirmation of receipt; or (d) when transmitted by email if sent before 5:00 P.M. local time on a business day in the time zone to which it is sent, and otherwise on the next business day. All notices shall be sent to:
If partner: the address set forth in the Partner Portal if to Partner
If Dispel: Dispel, Attn: Legal, 61 Greenpoint Ave, Suite 634, Brooklyn NY 11222 USA; if by email:
or an email address designated by the receiving party and to the notice of the person executing this Agreement (or to such other (email) address or person as may be designated by a party by giving written notice to the other party pursuant to this Section 12.12).
#### 12.13 Counterparts; Headings.
This Agreement may be executed in two or more counterparts including by digital acceptance, each of which will be deemed an original and all of which together will constitute one and the same instrument. The headings contained herein are for convenience of reference only and will not be considered as substantive parts of this Agreement.
#### 12.14 Entire Agreement.
This Agreement (including the Cover Page and the exhibits to this Agreement, which are incorporated by reference) constitutes the entire agreement between the parties with respect to the subject matter of this Agreement and supersedes all prior agreements, oral or written, regarding such subject matter. This Agreement may be updated from time to time at Dispel’s sole discretion, and Partner’s continued use of the Partner Portal constitutes consent to these changes.
However, to the extent of any conflict or inconsistency between the provisions in this Agreement and any other documents or pages referenced in these Agreements, the following order of precedence will apply: (1) the terms of a seperately agreed Partner Program Agreement, (2) the terms of this Agreement, and (3) finally, any other documents or pages referenced in the Terms. Notwithstanding any language to the contrary therein, no terms or conditions stated in a customer purchase order, vendor onboarding process or web portal, or any other customer order documentation will be incorporated into or form any part of this Agreement, and all such terms or conditions will be null and void.
#### 12.15 Use of Other Party’s Name and Logo.
Subject to 8.1, each party shall be entitled to use the other party’s name and logo in its marketing materials and on its website in a manner designated by the other party. A party that intends to use the other party’s name and logo pursuant to this Section 12.15 shall give notice to the other party describing how such name and logo will be used, and the other party shall be given an opportunity to propose alterations before such name and logo are used. Dispel gives notice that it will use the partner logo on our website in a list of other partners.
### 13. Definitions.
#### 13.1 “Add-Ons”
means separately licensed hardware or software components used in conjunction with the Dispel Remote Access Services
#### 13.2 “Confidential Information”
means the confidential or proprietary information of Dispel or its affiliates (whether or not marked or identified as confidential or proprietary), including the Pricing Guidelines, inventions (whether or not patentable), trade secrets, ideas, know-how, techniques, processes, formulas, algorithms, schematics, research, development, software design and architecture, testing procedures, design and functional specifications, problem reports and performance information, training materials, marketing materials, marketing and financial plans and data, and the terms and conditions of this Agreement. Confidential Information does not include information (other than personal data) that: (a) is or becomes publicly known through no fault of Partner; (b) is known by or in the possession of Partner prior to its receipt from Dispel as evidenced by Partner’s written records; or (c) is lawfully obtained from a third party that has no obligation of confidentiality with respect to the information.
#### 13.3 “Customer”
means an individual or entity that purchases from Partner Remote Access Services. For the avoidance of doubt, Customer does not include any intermediaries or sublicensees pursuant to Section 1.6 involved in the sales process who are not users of the Products.
#### 13.4 “Customer Terms of Service”
means the terms at (as may be updated by Dispel from time to time).
#### 13.5 “Derivative Work”
means a new or modified work that is based on or derived from a preexisting work, including, without limitation, a work that, in the absence of a license, would infringe the copyright in such preexisting work or that uses trade secrets or other proprietary information with respect to such preexisting work.
#### 13.6 “Dispel Direct Competitor”
means an individual or entity that sells, produces, or otherwise provides access to software defined networks, communications networks and services in virtual private clouds utilizing virtual private network technology, ‘moving target defense’ networks, or remote access products.
#### 13.7 “Documentation”
means Dispel’s current online help resources, guides, and manuals provided by Dispel for use with the Remote Access Services.
#### 13.8 Remote Access Services”
means (a) the provision of access and use of networked infrastructures set up by Dispel on behalf of Customer for the purposes of secure remote access; (b) any web services provided to the Customer by Dispel for account management; (c) Dispel software applications (including any object code or executable files), including any related materials and documentation therefor; and any modifications, error corrections, bug fixes, new releases, enhanced functionality, or other updates thereto that may be provided hereunder by Dispel; and (d) any Add-Ons, as applicable.
#### 13.9 “Support Services”
means Support Tier One and Support Tier Three, together with any additional support services authorized by Dispel and purchased by Customer pursuant to Order Documentation.
#### 13.10 “Support Tier One”
means initial configuration of the Dispel Remote Access Services, assistance with basic administrative functions, diagnosis, and correction of errors.
#### 13.11 “Support Tier Three”
means the creation of custom deployments and assistance with systems engineering requests.
#### 13.12 “Government Customer”
means a specified agency, department, division, branch, or instrumentality of the national and/or federal Government or other national governments of other countries, international agencies of which the national and/or federal Government or another national government is or becomes a member, and any other national and/or federal Government or national government entity authorized to purchase off of government contracts on behalf of the national and/or federal Government or a national government of another country, in each case who purchases directly or indirectly from the Partner Remote Access Services.
#### 13.13 “Local Government Customer”
means a specified agency, department, division, branch, or instrumentality of a local government of the United States or other countries, national agencies of which such local government is or becomes a member, and any other local entity authorized to purchase off of government contracts on behalf of such local government, in each case who purchases directly or indirectly from Partner Remote Access Services.
## Exhibit B Anti-Corruption Certification of Compliance
For the purposes of this Anti-Corruption Certification of Compliance:
1\. “Anything of value” is defined broadly to include monetary and non-monetary payments, such as e.g. cash, a loan, gifts, travel, entertainment, or services.
2\. “Dispel” means Dispel Global, Inc, a Delaware corporation.
3\. “Government Official” means any officer, employee, or agent of (i) any government, at any level (national, state, provincial, or local) and any branch (executive, legislative, or judicial), (ii) any state-owned or state-controlled enterprise, (iii) any public international organization, or (iv) any political party, including a candidate for political office or political party official.
4\. “Partner” means the authorized reseller of Dispel’s software and services.
Partner, on behalf of itself and each of its directors, officers, employees, reseller representatives, and agents, hereby certifies that:
a) Partner has complied and will comply with the U.S. Foreign Corrupt Practices Act, the UK Bribery Act 2010, and all other applicable anti-corruption laws.
b) Partner has not requested, accepted, offered, or given, and will not request, accept, offer, or give, directly or indirectly, any bribe, kickback, or other improper or illegal payment of anything of value to any person in connection with the Agreement.
c) Partner has not corruptly taken any action in furtherance of an offer, payment, promise to pay, or authorization of the payment of anything of value, directly or indirectly, to a Government Official or any person for the purpose of:
i. Obtaining or retaining business;
ii. Influencing any act or decision of a Government Official or any person in his or her official capacity;
iii. Inducing the Government Official or any person to do or omit to do any act in violation of his or her lawful duty;
iv. Securing any improper advantage; or
v. Inducing any Government Official or any person to use his or her position improperly to affect any act or decision of a government or government agency, department, or instrumentality.
d) Partner is not aware of (i) any request made by any person, including any Government Official, for any payment of money or anything of value prohibited by provision b. or c. of this Certification; or (ii) any other individual or company making, offering, paying, promising, or authorizing any payment of money or anything of value prohibited by provision b. or c. of this Certification in connection with the reseller agreement between Partner and Dispel.
e) Partner will immediately advise Dispel by e-mail at or in writing, at 61 Greenpoint Ave, 6th Floor, Brooklyn, NY 11222, if it fails to comply with the provisions of this Certification or otherwise becomes aware of any changes to these representations and covenants.
# Partner Support Enablement
Learn how Dispel supports our partners and enable channel success
This document defines the support structure and relationship between Dispel, our partners, and partner customers using the Dispel Zero Trust Engine and our other products (for brevity we use the term "Dispel Zero Trust Engine" and "Dispel Engine" in this document to encompass all technology Dispel makes available to partners). It establishes who is responsible for what, how to categorize the severity of customer issues, standard resolution process flows for common customer FAQs and issues, and when to escalate cases to Dispel.
## Definitions
{% columns %}
{% column %}
#### Reseller & Distributor
A **Reseller/Distributor** is a partner that purchases products or services from a vendor and then sells them to end customers, often providing sales reach, regional presence, and client management. They act as intermediaries, ensuring the vendor’s solutions are accessible to a broader market.
{% endcolumn %}
{% column %}
#### MSP & OEM
**Managed Service Providers (MSP)/Original Equipment Manufacturers (OEM)** deliver additional value by integrating, managing, or embedding the vendor’s technology into their own offerings. MSPs provide ongoing operational services such as monitoring, maintenance, and security to end customers, while OEMs incorporate the vendor’s technology into their own branded products or solutions, creating a seamless experience for the customer.
{% endcolumn %}
{% endcolumns %}
## Who is responsible for customer support in the channel?
### For Resellers & Distributors
{% hint style="info" %}
Dispel directly supports customers who purchase through resellers & distributor channels.
{% endhint %}
Resellers and distributors—e.g. Dispel partners who are sales channels for Dispel—do not typically provide customer service or technical support for Dispel to their customers. Those services are contracted through the reseller/distributor by the customer to Dispel.
### Managed Service Providers & Original Equipment Manufacturers
{% hint style="info" %}
The MSP & OEM directly support their customers.
{% endhint %}
This contrasts with OEMs and service providers ("MSP") who wish to retain ownership of customer relationships and support interactions, while Dispel provides technical assistance where needed. This framework ensures efficient issue resolution while maintaining OEM control over customer service and platform management.
### Summary
Channel Model
Implementation
Customer Success
Maintenance
Technical Support
Reseller/Distributor
Dispel
Dispel
Dispel
Dispel
OEM/MSP
Partner
Partner
Partner
Dispel
## Supporting our Partners
Once a sale has been made, all Dispel partners receive as part of the resale agreement Basic Plan Technical Support for the platform that Dispel deployed for the partner under our [Support Policy - Service Level Agreement](/support/support-policy).
### Internal Technical Support
Partners seeking further support may opt to purchase service hours from Dispel or retain a dedicated Technical Account Manager (P-TAMs) to support the Dispel Zero Trust Engine platform.
Learn more about P-TAMs here: [Technical Account Manager (P-TAM)](/partner-program/partner-enablement/technical-account-manager-p-tam)
Plan SLAs
Service Hours
Dedicated Technical Account Manager
Basic available to all
Premium & Mission Critical options
Hourly rates as used with a minimum retainer
Available as 1 or ½ FTE
Localization options extra
### Customer Support Augmentation
Dispel offers both service hours and dedicated Partner Customer Success Managers (P-CSMs) for partners who wish to augment their customer services with Dispel personnel. Dispel P-CSMs interface directly with partner customers providing implementations, customer support, and performing maintenance. P-CSMs can also provide training and enablement to partner teams.
Learn more about P-CSMs here: [Customer Success Manager (P-CSM)](/partner-program/partner-enablement/customer-success-manager-p-csm)
Service Hours
Dedicated Customer Success Manager
Not offered
Available as 1 or ½ FTE
Localization options extra
***
## Customer Support Obligations for OEMs & MSPs
End customers are responsible for managing Dispel Zero Trust Engine deployments and components within their own environments. Their role includes user account and access management, which encompasses configuring security settings, inviting users, onboarding and managing devices, approving access requests, and defining user roles and device access policies.
The OEM/MSP's primary responsibility is to provide customer service and success for its customers, ensuring a seamless experience on the Dispel Engine. Unless the OEM/MSP [has contracted with Dispel to perform this work](/partner-program/partner-enablement/customer-success-manager-p-csm), OEM/MSPs serve as the sole point of contact for customer support, handling Wicket installations, Tier 1 troubleshooting, general support inquiries, and overseeing customer onboarding and training. OEM/MSPs remain responsible for direct communication with their customers, while Dispel operates as a secondary support resource for OEM/MSP personnel.
Dispel’s primary responsibility is to provide technical support to the partner and act as an escalation point for all Severity Levels issues that OEM/MSPs are unable to resolve. Dispel’s role is limited to maintaining the overall health, security, and functionality of the platform, ensuring infrastructure stability, and providing advanced troubleshooting when necessary. In addition to technical support, Dispel is responsible for providing training resources and documentation for OEM/MSPs to carry out their customer service and success roles. Dispel will be responsible for providing initial materials for training, as well as additional materials as new features, FAQs, and processes are implemented.
This structure ensures that our OEM/MSP partners retain full ownership of customer interactions while leveraging Dispel’s expertise for technical escalations. By maintaining a clear division of responsibilities, OEM/MSPs can efficiently support its customers while ensuring that Dispel remains focused on platform stability and high-level issue resolution.
## Definitions
### **Service Types Descriptions**
* **Implementation:** Tasks related to setting up, configuring, and deploying the Dispel Zero Trust Engine and associated infrastructure. This includes prepping and installing Dispel Wicket ESIs at customer sites.
* **Customer Success**: Tasks focused on end-user onboarding, training, troubleshooting, and customer communication to ensure a smooth user experience.
* **Maintenance**: Provide ongoing upkeep and functionality of the Dispel Zero Trust Engine platform, including making bug fixes and routine update packages available.
* **Technical Support**: Advanced troubleshooting and issue resolution for technical escalations, as well as maintaining infrastructure health and stability.
### **Task Category Descriptions**
* **User Account Management**: This category involves managing user accounts on the Dispel Zero Trust Engine. It includes creating, modifying, and deleting user accounts, ensuring proper authentication methods, and managing role-levels for individual users.
* **User Access Management**: Focuses on controlling and configuring user access permissions. This includes granting or revoking access to specific devices or resources, setting user roles, and enforcing security protocols to ensure proper authorization.
* **Partner Customer Communication:** Encompasses direct communication with partner customers regarding inquiries, updates, and troubleshooting. This includes ensuring partner customers are informed and supported during their use of the Dispel Zero Trust Engine.
* **Wicket Deployment and Installation**: Covers the information collection and installation of Wickets, ensuring installations result in successful Wicket connections to Dispel Regions as well as to downstream devices.
* **End-User Support**: Addresses assistance provided to partner customers for operational or usage-related questions about the Dispel Zero Trust Engine. This includes guiding them through platform functionalities, providing troubleshooting steps, and resolving non-technical queries. If a user issue cannot be categorized under the defined Severity Levels because there is no performance impact of the software, such as a user requesting an MFA reset because they have changed their authenticator, the issue would be categorized under this task.
* **Training and Onboarding**: Includes guiding partner customers through the initial setup and familiarization process for the Dispel Zero Trust Engine. This involves user training, walkthroughs, and ensuring a smooth onboarding experience for end-users.
* **Virtual Desktop Stack Management**: Involves overseeing the Virtual Desktop Infrastructure (VDI) stack for accessing partner customer networks. Partner's role includes identifying when additional VDIs are needed, ensuring the appropriate stakeholders are informed to adjust contract and stack sizes, and updating stack Golden Images as necessary to maintain operational efficiency and end-user accessibility.
* **Network Connectivity**: Covers the establishment and maintenance of network connections between Wickets, customer devices, and Dispel Regions. This includes troubleshooting connectivity issues and ensuring data transmission is secure and uninterrupted.
* **Dispel Zero Trust Engine Bugs**: Refers to identifying, reporting, and resolving software bugs or glitches within the Dispel Zero Trust Engine. This ensures continued usability, reliability, and security of the platform for partner customers.
* **Infrastructure Maintenance**: Encompasses the ongoing upkeep of the Dispel Zero Trust Engine’s infrastructure. This includes applying updates, monitoring system health, and ensuring optimal performance for Wickets and Cloud infrastructure across all environments.
* **Critical Infrastructure Outages**: Involves addressing major disruptions to the Dispel Zero Trust Engine’s functionality or infrastructure. These incidents require immediate resolution to restore platform availability and maintain critical services.
### **Role Descriptions**
* **Primary:** The party with primary responsibility is accountable for completing the task or addressing the issue. This includes performing the required actions, ensuring resolution, and communicating outcomes to relevant stakeholders. A primary responsibility indicates ownership of the process from start to finish.
* **Secondary:** The party with secondary responsibility provides support or escalation assistance when the issue cannot be resolved by the primary party. This may involve advanced troubleshooting, offering guidance, or taking over specific tasks beyond the primary party’s capabilities. Secondary responsibility does not involve direct ownership but ensures availability for support when needed.
* **Documentation and Training:** The party with documentation and training responsibility will provide materials necessary for Primary parties to efficiently fulfill their role. These materials may include training webinars, diagrams, white papers, and certification programs. Documentation and Training responsibility does not involve direct ownership or intervention, but rather ensures availability of training resources for knowledge to be shared at-scale.
### RACI Matrix
*The matrix below outlines responsibilities across common support scenarios, ensuring OEM/MSP partners and Dispel can collaborate effectively. Escalation to Dispel is based on the communicated severity and partner’s ability to resolve the issue internally. Severity Levels 1 and 2 are prioritized for Dispel’s intervention.*
For more details on the Shared Responsibility model, please see:
Task Category
Service Type
Customer’s Role
OEM/MSP's Role
Dispel's Role
User Account management
Implementation
Primary
Documentation and Training
User Access Management
Implementation
Primary
Documentation and Training
Communication with Client
Customer Success
Primary
Documentation and training for partner
End-User Support
Customer Success
Primary
Documentation and training for partner
Wicket Deployment & Installation
Implementation
Primary
Documentation and training for partner
Training & Onboarding
Customer Success
Primary
Documentation and training for partner
Virtual Desktop Stack Management
Customer Success
Primary
Documentation and training for partner
Network Connectivity
Implementation
Primary
Applying Wicket ESI patches & updates
Maintenance
Primary
Dispel Zero Trust Engine bugs
Maintenance
Primary
Dispel Zero Trust Engine security patches
Maintenance
Primary
Critical Infrastructure Outages
Technical Support
Primary
# Frequently Asked Questions
Get answers to common questions about our partner program.
## FAQ
Does Dispel work with partners globally?
Yes. We work with partners all around the world, with active partnerships in EMEA, NA, LATAM, and APAC.
Can we get a white-labeled version of Dispel?
Yes. Custom white-labeling is available for purchase for partners. Please [contact our Channel Partner Team](https://dispel.com/book) to get pricing information.
Can we make Dispel available on our own domain?
Yes, custom domains are available for purchase. Please [contact our Channel Partner Team](https://dispel.com/book) to get pricing information.
Who is responsible for client implementations and support?
Dispel divide our channel partners into Resellers/Distribution or OEM/MSPs. In reseller/disti sales, Dispel provides implementation services directly to clients and offers a variety of support packages for purchase. For OEM/MSP sales, you the partner are responsible for your client support and implementing Dispel at client sites.
# Technical Account Manager (P-TAM)
Dispel Partner Technical Account Managers (P-TAMs) serve as your specialized technical resource for Dispel Zero Trust Engine platform operations, documentation, and partner enablement. P-TAMs work exclusively with partner organizations to streamline technical processes, create custom guidance, and provide expert opinions.
{% hint style="info" %}
P-TAMs maintain strict boundaries around customer-facing activities and will not communicate directly with your end customers, nor will they create, modify, or manage any customer-facing documents or materials.
If you would like customer support augmentation services, please visit [Customer Success Manager (P-CSM)](/partner-program/partner-enablement/customer-success-manager-p-csm).
{% endhint %}
Dispel makes documentation, marketing materials, and technical guidance available to all partners. We also provide commercially reasonable support for registered and quaified sales opportunities. Partners use P-TAMs when they want additional support, have questions that go beyond standard materials, require specific guidance, or need support on nuanced areas such as export compliance.
## Service Areas
The flexibility of P-TAMs precludes an exhaustive description of all potential practice areas. Areas we often support clients in are illustrated in this section. P-TAMs will not provide services they are not qualified to perform.
### Technical Documentation and Knowledge Management
P-TAMs can provide comprehensive technical documentation tailored specifically to your organization's needs and processes. We can develop custom implementation guides that reflect your specific deployment procedures for the Dispel Zero Trust Engine, including step-by-step technical workflows customized to your infrastructure and existing technology stack. These guides serve as valuable resources for your technical teams and help standardize your implementation processes across multiple customer deployments.
Beyond implementation guides, P-TAMs can create detailed technical reference materials including specific documentation for your use cases, configuration recommendations that embody best practices, and comprehensive troubleshooting runbooks for common technical scenarios. They also can advise on security and compliance documentation aligned with your industry requirements, ensuring your technical materials meet the specific standards and regulations that govern your business.
Knowledge base development represents another core capability of P-TAMs. They can create searchable internal knowledge repositories that serve as central resources for your technical staff, develop comprehensive FAQ databases tailored to your most common technical scenarios, and produce detailed procedure documentation for complex technical processes. This knowledge management approach helps your organization capture and institutionalize technical expertise while reducing the time spent on repetitive technical questions.
### Form Completion and Administrative Support
{% hint style="info" %}
Dispel provided documents, including those written by P-TAMs, do not constitute legal, regulatory, or compliance advice. Always seek professional advice from licensed attorneys regarding your particular facts and circumstances.
{% endhint %}
P-TAMs can help complete complex partner forms and technical documentation that require deep platform knowledge. They can handle technical sections of internal security questionnaires, and partner compliance documentation for industry-specific requirements. P-TAMs can also assist in more detailed regulatory compliance questions.
In procurement scenarios, P-TAMs can assist in partner reference architecture design and documentation. P-TAMs cannot complete end client documents or questionnaires.
### Extensive Technical Question Support
P-TAMs can support partners with more detailed technial questions beyond those addressed by our documentation. This includes detailed product walkthrough calls, customer system architecture diagramming, and custom requests for low-level system information.
### Partner Enablement and Training
The[ Dispel Enterprise Academy](https://dispel.com/training) offers on-demand, web training and certification in selling, maintaining, and deploying Dispel.
P-TAMs can further develop custom training materials for your technical team that reflect both Dispel platform capabilities and your specific implementation approaches. This includes creating program content, developing technical competency assessments, and designing ongoing education programs that keep your team current with platform developments.
Process development represents another key area where TAMs can add value. They can create standard Dispel operating procedures that reflect your organization's preferred approaches to common technical tasks, develop quality assurance process documentation, and establish technical escalation procedures that bridge Dispel and your teams.
## Service Delivery Model
P-TAMs are available as either full-time equivalent (1.0 FTE) or half-time equivalent (0.5 FTE) dedicated resources, with localization options available for organizations requiring multi-timezone coverage. Dispel also offers P-TAMs on an hourly basis.
P-TAMs work through designated partner technical contacts and provide commercially reasonable efforts on all assigned tasks and projects.
#### Compare service delivery models:
| | Dedicated | Hourly |
| ------------------- | ------------------------------ | ----------------------------------- |
| Prioritization | Top-of-queue | In queue |
| Billing | Fixed, predictable annual rate | Variable, billed monthly in arrears |
| Retainer Required? | No | Yes |
| Localization Add-On | Available[^1] | Available[^1] |
[^1]: Additional fees depend upon language and time-zone availability.
# Customer Success Manager (P-CSM)
Dispel Partner Customer Success Managers (P-CSM) provide customer support services to end clients, augmenting OEM[^1] and MSP[^2] customer support teams.
## How customers interact with P-CSMs
When partners contract with Dispel for P-CSMs to provide customer support, Dispel support will be enabled for a sub-domain. End clients can then use the Dispel support widget to chat with P-CSMs.
The Dispel support window open on the right-hand side of the Zero Trust Engine dashboard.
{% hint style="info" %}
## What is a sub-domain?
If you contract with Dispel for a white-labeled instance of the Zero Trust Engine, the instance will be deployed onto a sub-domain (e.g., remote.acmecorp.com).
{% endhint %}
## Practice Areas
P-CSMs provide client-facing implementation, customer success, maintenance, and technical support. The flexibility of P-CSMs precludes an exhaustive description of all their practice areas. Generally, they exist to augment your customer support capabilities, providing a turnkey support function for Dispel's products.
## Relationship as-between P-CSMs and Partners
Dispel P-CSMs do not report to partners, though they will coordinate with them. P-CSMs follow Dispel operating procedures and act in accordance with our standards for support. P-CSMs do not represent the partner, and are clearly marked as Dispel personnel.
## Service Level Agreements (SLAs)
P-CSMs follow Dispel SLAs for response times, which can be found here: [Support Policy - Service Level Agreement](/support/support-policy#response-times).
Dispel P-CSMs operate on the following work hours:
| Tier | Basic | Premium | Mission Critical |
| --------------- | ----------------------------------------------------------------- | ------- | ---------------- |
| Operating Hours | 9 AM – 5 PM EST, Monday - Friday, excluding U.S. federal holidays | 24 x 7 | 24 x 7 |
Because Dispel will act as the customer support team, we require sufficient staffing to ensure proper coverage.
## Service Delivery Model
P-CSMs are available as either full-time equivalent (1.0 FTE) or half-time equivalent (0.5 FTE) dedicated resources, with localization options available for organizations requiring multi-timezone coverage. In order to ensure continuity of service, Dispel does not offer P-CSMs on an hourly basis.
#### Minimum Staffing Requirements
Dispel establishes minimum dedicated staffing requirements in order to ensure a guaranteed quality-of-service standard for all customer support tickets.
One P-CSM FTE can generally support 10 - 15 customers. If support utilization exceeds a reasonable threshold for a P-CSM, Dispel will require the partner add additional staffing.
P-CSMs operate in 8 hour workdays. Three FTEs are therefore needed in order to provide 24 x 7 support.
| Tier | Minimum Staffing (US-based) | Minimum Staffing (Localized) |
| ---------------- | --------------------------- | ---------------------------- |
| Mission Critical | 3 FTEs | 3 FTEs |
| Premium | 3 FTEs | 3 FTEs |
| Basic | 0.5 FTE | 1 FTE |
[^1]: Original equipment manufacturers
[^2]: Managed service providers
# Supplying Dispel
Dispel prioritizes quality, customer focus, and integrity. We are committed to delivering top-quality products and services to our customers on time and as promised, while adhering to a strong compliance and integrity program. Our goal is to consistently meet or exceed customer expectations.
Achieving this depends on the cooperation of our suppliers and sub-processors. In practice, this requires our vendors to adhere to our standards and demonstrate a commitment to continuous, sustainable improvement with full transparency.
## Fundamentals of working with Dispel
Working with best-in-class suppliers is essential for our success. This section outlines our requirements and expectations of doing business with Dispel as well as the many programs we have in place to ensure the development of a sustainable, high-quality supply chain.
# Cyber Security Requirements
Version 1.1, Published November 17, 2025
{% file src="/files/2BFRNdoLutTH3K6E82cx" %}
**Download a PDF copy of the Cyber Security Requirements**
{% endfile %}
***
This document outlines minimum cyber security requirements applicable to Dispel Suppliers that:
1. process, access, interact with, or store Dispel Information, Personally Identifiable Information (PII), or
2. have access to Dispel Information Systems, or
3. supply Software-Related Products\[1] and/or services to Dispel pursuant to the respective contract referencing this document.
The Supplier is responsible to take all the necessary measures and steps to comply with the requirements listed in this document.
Dispel reserves the right to ask for documentation and evidence, as well as to perform or order a compliance audit, to determine whether the listed requirements are fulfilled.
The Supplier shall ensure that all sub-suppliers, sub-processors, or sub-contracting relationships or external dependencies that provide services or supply Software-Related Products that are part of supplied products to Dispel or provide services related to the development of supplied products to Dispel (e.g., code implementation or testing) comply with the requirements listed in this document or with equivalent requirements to the ones listed in this document.
Notwithstanding the foregoing, the Supplier shall be fully responsible for all acts and omissions of its sub-suppliers, sub-processors, or sub-contracting relationships or external dependencies as if they were Supplier's acts or omissions.
Dispel reserves the right to update this document from time to time and any such modification or amendment will be applicable from the date of the respective modification or amendment as indicated in the new release of this document which shall, however, not be earlier than the actual release date.
*This document contains the terms “including,” “include,” “in particular,” “such as,” or similar expressions. They shall be construed as illustrative and shall not limit the sense of the words preceding those terms. The term ‘Third-Party’ used in this document refers to any entity that is providing goods, services, products, and/or Software-Related Products to Dispel pursuant to the contract referencing this document or any contractor, agent or third party who provides hardware, software, goods, or services to Dispel or any of its entities.*
## 1. IT Security Requirements
### 1.1. Cyber security & Privacy Governance
To comply with Dispel’s cyber security and privacy policies and standards, the Supplier shall implement and maintain a comprehensive cyber security and privacy program. The Supplier shall define roles and responsibilities by assigning qualified individuals and resources to manage and coordinate the program. The Supplier shall have measures to monitor and report on the program’s effectiveness and provide ongoing education and training to align with industry best practices in cyber security and privacy.
### 1.2. Risk Management
The Supplier shall implement and maintain a risk management process to identify, assess, and manage information security risks. This process shall include regular risk assessments and the prioritization of resources to address identified risks. The Supplier shall maintain a risk register to document key risk factors, including organizational risk tolerance. Additionally, the Supplier shall have a program to manage risks associated with third-party software, artificial intelligence, and autonomous technologies.
### 1.3. Third-Party Management
The Supplier shall implement and maintain a third-party risk management process to effectively oversee and manage risks associated with third-party providers. This process shall ensure the identification, assessment, and mitigation of risks, as well as the regular review and adjustment of third-party relationships to align with organizational security requirements.
### 1.4. Information Assurance
The Supplier shall implement and maintain processes for assessing cyber security and privacy controls in systems, applications, and services. The Supplier shall conduct regular assessments, including third-party evaluations, to ensure that the controls are implemented effectively. For Suppliers hosting Dispel data, SOC 2 Type II certification or an equivalent attestation is required to demonstrate compliance and security assurance.
### 1.5. Incident Response
The Supplier shall implement and maintain a documented cyber security incident management program to ensure an organization-wide capability for handling cyber security and privacy related incidents. This program shall cover preparation, automated detection, reporting, analysis, containment, eradication, and recovery. The incident response plan shall be made available to Dispel and shall be regularly reviewed and modified to incorporate lessons learned, business process changes, and industry developments, as necessary. Processes shall exist to monitor and report incidents both internally to the organization and externally to regulatory authorities, Dispel, and affected parties, as necessary. An integrated team of cyber security, IT, & business function representatives capable of addressing incident response shall be established.
Incident Response controls shall cover, but not be limited to, the following areas:
* Training personnel in their incident response roles and responsibilities.
* Evaluate incident response capabilities to determine their operational effectiveness.
* Performing forensics and preserving the integrity of chain of custody in line with applicable laws and regulations.
* Providing incident information to the product/service providers and other supply chain partners.
* Implementing and governing an insider threat response capability.
* Responding to sensitive information spills and formally assigning roles and responsibilities for managing such incidents.
* Incorporating lessons learned by analyzing incidents to reduce future impact.
The Supplier shall notify Dispel (business/engagement manager and Dispel CSIRT at ) promptly, in accordance with any applicable law or regulation and in any event within 72 hours after discovery of any security incidents or threats relating to the Services and/or Dispel material, data, or information. Identified remedial actions following an incident shall be documented in a remediation plan, including action items, ownership, and delivery dates, and shall be shared with Dispel. Remedial action shall be executed in a timely manner.
### 1.6. Asset Management
The Supplier shall implement and maintain an asset management program to oversee and control organizational assets. This program shall ensure accurate tracking and accountability for assets throughout their lifecycle, maintaining documentation and regular review. It shall also include measures to secure and manage asset information and ensure compliance with organizational standards and audit requirements. Cyber security and privacy controls must be applied to all assets by identifying, assigning, and documenting asset scope, categorization, and control applicability boundaries. Assets shall be securely disposed of, destroyed, or repurposed to prevent information recovery. All organizational assets must be returned upon termination of employment or contract. Regular inspections of critical assets shall be conducted to detect and prevent tampering. Asset inventories must be reviewed regularly and be available for audit by designated officials.
### 1.7. Data Classification
The Supplier shall implement and maintain a data classification and handling process to ensure that systems, applications, and services are classified according to the highest level of data sensitivity that is stored, transmitted, and/or processed. Physical and logical controls shall be implemented to securely store digital and non-digital data and/or media using Supplier-defined security measures until they are destroyed or sanitized. Data handling requirements shall guide the management, processing, storage, transmission, and protection of data to ensure its confidentiality, integrity, and availability. Data classification controls shall cover, but not be limited to, the following areas:
* Identifying and documenting the location of information and its residing system.
* Protecting and controlling media during transport.
* Securely disposing media when it is no longer required, using formal procedures.
* Sanitizing media according to data sensitivity before disposal.
* Data flow diagrams to capture data flows for applications, infrastructure, and third-party sharing.
* Guidance for securely sharing information between systems.
* Data retention shall comply with regulatory and contractual obligations.
### 1.8. Human Resources Security
The Supplier shall implement and maintain a comprehensive human resources security program to protect organizational assets and data. This program shall cover cyber security responsibilities, conduct screening (as permitted by regional regulations), and establish clear guidelines for acceptable technology use, including consequences for violations. Employees shall receive role-based training to maintain compliance with security standards, and third-party personnel security shall be managed through regular reviews and monitoring of their cyber security and privacy roles and responsibilities. Internal and third-party users shall sign appropriate access agreements, such as Non-Disclosure Agreements (NDAs), before being granted access.
If Supplier has access to Dispel systems or services, Supplier shall notify Dispel within 24 hours of any personnel change (including, but not limited to additions, terminations, removal from serving the Dispel account).
### 1.9. Security Awareness & Training
The Supplier shall provide cyber security and privacy awareness training to all employees and contractors relevant to their job functions. This training shall occur before authorizing system access, during system changes, and annually thereafter. All training activities shall be documented, maintained, and regularly updated.
### 1.10. Change Management
The Supplier shall implement a change management process to oversee and control modifications to organizational assets. This process shall ensure that changes are authorized, reviewed by relevant stakeholders, and communicated to all affected parties, with the aim of minimizing risk and maintaining system integrity.
### 1.11. Security Operations
The Supplier shall ensure continuous protection of systems, applications, and data to maintain the organization's security posture. A security operations center or an equivalent continuous monitoring shall be established to maintain vigilance over the organization’s networks, systems, and applications thereby ensuring a proactive defense posture against cyber threats.
### 1.12. Threat Management
The Supplier shall implement and maintain a threat intelligence program with cross-organization information-sharing capability to influence development of security architectures and selection of security solutions. Utilizing threat intelligence feeds to stay aware of evolving threats, the Supplier shall leverage attacker tactics and procedures for implementation of preventative controls. An insider threat program shall be established to report potential threats and promote awareness. Cyber threat hunting using indicators of compromise shall be conducted to detect and disrupt advanced threats. The Supplier shall implement measures to detect and trace data exfiltration activities, ensuring the identification of unauthorized access or individuals involved.
### 1.13. Vulnerability & Patch Management
The Supplier shall implement and maintain a vulnerability management program to identify, analyze, prioritize, and address security vulnerabilities. This program shall ensure continuous detection, monitoring, timely response to identified vulnerabilities, and effective mitigation strategies. Vulnerability management controls shall cover, but not be limited to, the following areas:
* Patching for all operating systems, applications, end-user software, middleware, network devices, firmware etc.
* Centrally manage and track remediation of vulnerabilities based on defined timelines.
* Compare the results of vulnerability assessment reports over time to determine trends in system vulnerabilities.
### 1.14. Network Security
The Supplier shall implement measures to ensure the integrity and confidentiality of network communications or information transmitted across network interfaces by monitoring and controlling communications at boundaries, restricting untrusted connections, and protecting data flows.
Measures shall exist to uniquely identify and authenticate source and destination points for information transfer. Data protection measures shall be implemented to protect sensitive Dispel information.
Techniques such as network segmentation, intrusion/detection systems, and secure transmission channels shall be employed to minimize risks. The Supplier shall protect data over open networks, define secure remote access methods, and control third-party access. Secure wireless access and continuous monitoring shall be implemented to prevent unauthorized connections.
### 1.15. Continuous Monitoring
The Supplier shall ensure continuous oversight of security events and effective incident response through comprehensive enterprise-wide monitoring. Enhanced activity monitoring shall be implemented for high-risk individuals. The Supplier shall utilize tools to support the centralized collection and correlation of security-related event logs across the enterprise. Measures shall exist to integrate the analysis of event logs with other sources to enhance the ability to identify inappropriate or unusual activity. Measures shall provide event log report generation capabilities to aid in detecting and assessing anomalous activities. Trend analysis and reporting shall aid in refining security controls. The Supplier shall utilize non-repudiation measures to ensure the origin, authenticity, and integrity of information. Cross-organizational log sharing and monitoring third-party activities shall be established to help identify and mitigate potential security incidents effectively.
### 1.16. Configuration Management
The Supplier shall implement and maintain secure baseline configurations for technology platforms, aligned with industry standards. This process shall require that systems be configured to minimize security risks, provide only essential functionality, and are regularly reviewed and updated to prevent unauthorized modifications. Governance and reporting measures for baseline configuration management shall exist including a method to determine deviations from defined baselines. Controls shall be implemented to prevent information leakage, prevent unauthorized software installations, and enforce software restrictions to comply with applicable contracts, copyright laws, and the secure use of open-source software.
### 1.17. Security Engineering & Architecture
The Supplier shall develop an enterprise architecture, aligned with industry standards or leading practices, with consideration for cyber security and privacy principles that addresses risk to organizational operations, assets, individuals, other organizations. Industry recognized cyber security and privacy practices shall be implemented in the specification, design, development, implementation, and modification of systems and services. Safeguards shall be in place to prevent unauthorized and unintended information transfer via shared system resources. A diverse set of technologies shall be utilized to mitigate the impact of vulnerabilities from the same original equipment manufacturer (OEM). The Supplier shall consider the adoption of deception security controls. Time synchronization technology shall be utilized to synchronize time across all systems. Additionally, the Supplier shall develop and maintain a network architecture diagram to illustrate the network architecture, including configuration, interconnections, and security controls, ensuring it is kept up-to-date and reflective of the current state.
### 1.18. Endpoint Security
The Supplier shall protect the confidentiality, integrity, and availability of endpoint devices by ensuring they are secure from unauthorized access and potential threats. Controls shall prohibit software installations without explicitly assigned privileges. The Supplier shall maintain system stability and consistently apply security measures across all endpoint devices. Anti-malware technologies shall be used and regularly updated, with central management to combat evolving threats. Protections against phishing and spam shall also be centrally managed to detect and minimize risks from malicious code.
### 1.19. Cryptographic Protections
The Supplier shall implement and maintain cryptographic measures to protect data at rest and during transmission to ensure confidentiality and integrity. Secure authentication and encryption techniques shall be used for wireless access.
### 1.20. Identification & Authentication
The Supplier shall implement and maintain identification and access management controls to uniquely identify, authenticate, and audit users, devices, and services. Access rights shall be reviewed based on defined frequency and revoked promptly upon termination of employment. Measures shall be in place to proactively govern account management of individual, group, system, service, application, guest, and temporary accounts. Multi-factor authentication shall be required for critical systems and remote access. Vendor supplied default credentials shall be changed during installation. Measures shall exist to federate credentials to allow cross-organization authentication of individuals and devices.
### 1.21. Mobile Device Management
The Supplier shall implement and maintain mobile device management (MDM) controls. Measures shall be implemented to protect mobile devices from tampering and capability to remotely wipe devices shall be enabled to prevent unauthorized access to organizational data.
### 1.22. Physical and Environmental Security
The Supplier shall implement and maintain physical access controls to authorize access to facilities based on individual roles and responsibilities. The Supplier shall identify, authorize, and monitor visitors before allowing access to the facility. Asset location and movement within organization defined controlled areas shall be tracked and monitored. Additionally, the Supplier shall designate secure areas to safeguard sensitive information and assets and implement measures to detect and respond to physical security incidents. Power and telecommunications cabling carrying data or supporting information services shall remain protected always from interception, interference, or damage. Technical, operational, and management controls shall be implemented at alternate work sites (e.g., disaster recovery sites, business continuity locations etc.).
### 1.23. Privacy
The Supplier shall implement and maintain a comprehensive privacy program to protect personal data (PD). A Privacy Officer (PO) or similar position being responsible for privacy compliance shall be appointed to oversee privacy practices. Information about privacy-related activities shall be accessible to the public and privacy notices shall be clear and readily available. The scope of personal data processing activities, including geographic locations and third-party recipients that process personal data, shall be defined. Personal data shall be retained only as long as necessary (or for the duration of the agreement with Dispel, whichever is earlier) and securely disposed. The use of personal data for internal purposes shall be minimized and authorized. Individuals shall have access to a defined process for appealing adverse decisions and correcting incorrect information to ensure fairness and accuracy. Personal data shall be shared with third parties only for specified purposes and with the general written authorization of the customer consent. Privacy testing, training, and monitoring activities shall be conducted regularly. The quality and integrity of personal data shall be ensured, and records of data disclosures shall be maintained and made available upon request to Dispel.
### 1.24. Artificial & Autonomous Technologies
The Supplier shall maintain an inventory of all artificial intelligence (AI) and autonomous technologies (AAT) including third-party components. The Supplier shall assess and map the risks and benefits of these technologies to manage potential impacts. Additionally, the Supplier shall identify data sources for AI and AAT to prevent third-party intellectual property (IP) rights infringement and ensure compliance. Supplier shall not use any Dispel data with AI without Dispel’s express written consent.
### 1.25. Business Continuity & Disaster Recovery
The Supplier shall implement and maintain a business continuity and disaster recovery program to ensure service resilience through coordination with internal and external parties. Critical systems and applications supporting essential missions and business functions shall be clearly identified. Measures shall be in place to adequately train contingency personnel and stakeholders in their roles and responsibilities. Contingency plans shall be regularly evaluated, updated, and informed by root cause analysis and lessons learned. Procedures shall ensure the availability and integrity of data to meet recovery time and point objectives (RTO/RPO). Recovery operations at alternate sites shall align with these objectives. Telecommunication service providers shall be required to have contingency plans to avoid single points of failure.
### 1.26. Maintenance
The Supplier shall implement and maintain processes to perform controlled maintenance activities throughout the lifecycle of a system, application, or service. Processes shall be defined to ensure maintenance support for systems meet the defined recovery time objective. Checks shall be in place to validate if media containing diagnostic and test programs are verified for malicious content before usage. Measures exist to review remote maintenance/diagnostic sessions and to validate if systems performing remote maintenance/diagnostics have a security capability like the system being serviced. A current list of authorized maintenance personnel shall be maintained and reviewed as per defined timelines. Physical security of technology assets awaiting service or repair shall be maintained.
### 1.27. Compliance
The Supplier shall ensure compliance with relevant statutory, regulatory, and contractual requirements. Instances of non-compliance with relevant statutory, regulatory, or contractual requirements incidents shall be documented and addressed. Oversight of cyber security and privacy controls shall be reported to executive leadership. An internal audit function shall exist to provide insights around the effectiveness of the organization's technology and information governance processes. Audits shall be planned with minimal impact on business operations. Legal assessments shall determine the validity of government data requests and notify the Customer of investigation requests when permissible. Access for investigations shall be restricted to the least privileges necessary.
### 1.27. Capacity & Performance Planning
The Supplier shall implement measures to manage resource utilization of systems and to ensure sufficient capacity for information processing and support during contingency operations.
### 1.28. Technology Development & Acquisition
The Supplier shall integrate security into all phases of software development, aligning with industry standards. Development, testing, and production environments shall be kept separate to reduce risks of unauthorized access or changes or impact to production environments. Unsupported or end-of-life systems shall be replaced, or their continued use shall be justified and documented.
***
## 2. Product Security Requirements
This section states additional minimum cyber security requirements that shall be fulfilled for any Software-Related Product that is supplied to Dispel pursuant to the respective contract referencing this document (hereinafter referred to as “Product”).
### 2.1. Secure Development Lifecycle
The Supplier shall establish, document, and implement initiatives in line with commonly accepted industry standards and practices to build security into the software development process of the Product. Such initiatives shall build security within all phases of the development lifecycle, e.g., training, requirement, design, implementation, verification, release, and response.
### 2.2. Security Quality
The Supplier shall take measures to improve the security quality of the Product. These measures shall follow commonly accepted industry standards and practices and shall include, where technically feasible:
* Robustness testing, including fuzzing and flooding.
* Vulnerability scanning for known vulnerabilities and exploits.
* Security testing, including static code analysis or binary code analysis.
### 2.3. Backdoor Accounts and Hardcoded Credentials
The Product shall not have any accounts, passwords, or private/secret keys that cannot be changed, disabled, or removed by the authorized end user of the Product. The Product shall not have any accounts (individual, shared, debug, etc.,) that are not documented (this does not imply that the associated access credentials must be disclosed).
### 2.4. Cryptographic Tools and Security Functionalities
Any cryptographic tool and security functionality implemented or used in the Product shall follow commonly accepted security industry recommendations and guidelines (e.g., as recommended by NIST or defined in international standards). This includes, for example:
* Cryptographic algorithms to hash, encrypt, or sign data for storage or transmission.
* Protocols and procedures to support cryptographic algorithms (e.g., to exchange certificates, to establish keys, or to generate random numbers).
* Functionality to authenticate end users or for access control.
Any cryptographic tool or security functionality implemented or used in the Product that does not follow commonly accepted security industry recommendations and guidelines shall be documented and communicated to Dispel. Such documentation shall include, at least, its origin (e.g., proprietary tool), its reference documentation (e.g., academic publication), its functionality (e.g., encryption), its main security-related features, characteristics, and parameters (e.g., used ECC curve), as well as in which context or part of the Product it is used (e.g., user authentication).
### 2.5. Protection from Malware Propagation
The Supplier shall proactively take measures to prevent malware from being propagated. These measures shall follow commonly accepted industry standards and practices and shall include successfully scanning software deliverables (including their storage media, e.g., CDs, hard disks, or flash cards) with different suitable and up-to-date antivirus solutions before delivery.
### 2.6. Handling of Digital Certificates
If digital certificates are used in the development of the Product (e.g., to sign code or as a root to derive product-specific certificates), they shall be protected and handled according to commonly accepted industry standards and practices.
### 2.7. Product Documentation
The documentation provided with the Product shall include:
* All user and system accounts in the Product with a recommendation to change at least the access credentials.
* Description of all ports, services, and software needed to support any functionality in the Product, as well as how these ports, services, and software can be configured and, when applicable, how these can be disabled, blocked, or uninstalled.
* Information on proper configuration and usage of cyber security related functionalities in the Product.
* Specific instructions on how to configure the security controls provided by the Product (e.g., RBAC, security logging, or secure communication), as well as security controls provided in addition to the Product (e.g., antivirus, whitelisting, or security monitoring).
* A recommendation for at least one malware prevention solution to be used during the operation of the Product, if such a solution exists. The recommendation shall include the specific version of the malware prevention solution, as well as a description of the performed testing and validation by the Supplier.
### 2.8. Vulnerability Handling
The Supplier shall establish, document, and implement a process to react to vulnerabilities and security issues associated with the Product. The process shall follow commonly accepted industry standards and practices and shall include procedures and interfaces to:
1. Enable Dispel to submit vulnerability reports.
1. The Supplier shall provide Dispel with all necessary information on how Dispel can report found vulnerabilities.
2. Acknowledge the receipt of a vulnerability report submitted by Dispel within two business days or such shorter term as reasonably requested by Dispel from the report submission.
3. For vulnerabilities where Dispel is the original finder, submit information to Dispel on the result of the vulnerability verification within seven business days or such shorter term as reasonably requested by Dispel from the acknowledgment of a vulnerability submission by Dispel.
1. The Supplier shall provide information on the vulnerability validity and severity, the list of potentially affected Products and their versions, as available at that time, and whenever possible, information on how to verify the existence of the vulnerability in its Products.
2. The Supplier shall also provide an estimate regarding the timeframe for the remediation release, as well as possible workarounds while the remediation solution is defined and implemented.
4. Share vulnerability remediation and advisory reports.
1. The Supplier shall provide Dispel with information on how vulnerability remediation and advisory reports related to any submitted vulnerability by Dispel or any other entity are shared with Dispel.
2. The advisory report shall include the description of the vulnerability, information about the remediation and workarounds, the list of affected systems and products, the vulnerability impact (threats, exploits, and severity rating), and related references (e.g., to related vulnerabilities).
3. If the Product is included in the build or installation package of any Dispel product (e.g., such as libraries or an embedded OS), the Supplier shall have a means to release the vulnerability remediation and the advisory report to Dispel prior to public disclosure.
In addition, the Supplier shall take all actions as reasonably requested by Dispel in case of a vulnerability or other security issue associated with the Product.
### 2.9. Patch Management
The Supplier shall establish, document, and implement a strategy and process to deal with third-party software security updates and patches relevant to the Product.
Relevant third-party software shall at least include:
1. **Type A:** Any third-party software that is included in the build or installation package of the Product (e.g., third-party libraries or embedded OS).
2. **Type B:** Any third-party software on which the Product depends or that is typically used in the deployment of the Product without being an integrated part of it (e.g., MS Windows, MS Office, Java Runtime Environment, or Acrobat Reader).
The strategy and process for third-party software of type A (as specified above) shall at least include:
* Monitoring for security updates and patches to all relevant third-party software.
* Execution of the vulnerability handling process (as defined in [requirement 2.8](#ref186469577)) for security updates and patches deemed applicable and where the patch or update addresses vulnerabilities or security issues.
The strategy and process for third-party software of type B (as specified above) shall at least include:
* Maintaining a list of all relevant third-party software dependencies.
* Recommended general approach for application of security updates and patches for each of the listed third-party software dependencies.
* As reasonably requested by Dispel, for security updates and patches deemed applicable:
* Validation of third-party software updates and patches.
* Communication to Dispel of the validation results and the taken/planned actions to resolve validation issues.
* At Dispel’s discretion, Dispel can perform the validation of the Product’s third-party software updates and patches. In such circumstances, the Supplier shall first inform Dispel of any Product’s third-party software update or patch and then support Dispel during the validation and to resolve validation issues.
### 2.10. Software Integrity and Authenticity
The Supplier shall provide Dispel with the capability to verify the integrity and authenticity, e.g., through digital signatures, of software deliverables associated with the Product, at least, by packaging any software delivered to Dispel in a way to allow Dispel to verify the integrity and authenticity of such package. Where technically feasible, all relevant files of the software deliverable shall be digitally signed.
### 2.11. Data Collection
While the Supplier’s rights, if any, with regard to collection, processing, and use of data are covered in separate documents, the Supplier shall in any case document, and make available to Dispel such documentation, any data collection activity performed by the Product, detailing which data are collected and the related functionality and/or purpose, as well as if, where, and how these data are stored, used, processed, and transmitted.
### 2.12. Vulnerability Assessment
Dispel reserves the right to perform an assessment on the security of the Product to identify potential vulnerabilities.
***
\[1] A “**Software-Related Product**” is defined as a product or system, including all versions and updates, that (i) uses any type of software, (ii) is partly based on any type of software, or (iii) is in itself a type of software. Here, software shall be considered in its broadest sense and includes for instance firmware, drivers, applications, etc.
# Vendor Data Protection Addendum
Version 2.0, Published January 25, 2025
{% file src="/files/eEcpexdLJQlssMjbMB2b" %}
**Download a PDF copy of the Vendor Data Protection Addendum**
{% endfile %}
***
### Section 1 - Purpose
This Data Protection Addendum (“Addendum”) is entered into between Dispel, LLC & Dispel Global, Inc (“Dispel”) and Vendor (each a “Party” and collectively, the “Parties”). This Addendum supplements and forms part of any existing, current, or future agreement between the Parties (any such agreement being individually or together referred to as the “Agreement”). This Addendum will be in effect as of the effective date of the Agreement (“Effective Date”); provided, however, the relevant obligations apply only to the extent that (i) Personal Data is subject to the Applicable Data Privacy Laws; and (ii) an Applicable Data Privacy Law has taken effect.
### Section 2 - Relationship with the Agreement
In the event of a conflict between this Addendum and the Agreement, the Addendum will control to the extent necessary to resolve the conflict. In the event the Parties use an International Data Transfer Mechanism and there is a conflict between the obligations in that International Data Transfer Mechanism and this Addendum, the International Data Transfer Mechanism will control.
### Section 3 - Definitions
Capitalized terms used but not defined have the meanings given in the Agreement.
1. “**Applicable Data Privacy Laws**” means all data protection and privacy laws applicable to the Processing of Personal Data under the Agreement, including, but not limited to, the California Consumer Privacy Act (“CCPA”), as amended from time to time and including any regulations promulgated thereunder.
2. “**Consent**” means a Data Subject’s freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the Processing of Personal Data relating to him or her.
3. “**Controller**” means the entity that determines the purposes and means of Processing Personal Data. “Controller” includes equivalent terms in other Applicable Data Privacy Laws, such as the CCPA-defined terms “Business” and “Third Party,” as context requires.
4. “**Data Breach**” means “breach of the security of the system,” “security breach,” “breach of security,” “breach of system security,” and other analogous terms referenced in Applicable Data Privacy Laws.
5. “**Data Exporter**” means the Party that (1) has a corporate presence or other stable arrangement in a jurisdiction that requires an International Data Transfer Mechanism and (2) transfers Personal Data, or makes Personal Data available to, the Data Importer.
6. “**Data Importer**” means the Party that (1) is located in a jurisdiction that is not the same as Data Exporter’s jurisdiction and (2) receives Personal Data from the Data Exporter or is able to access Personal Data made available by the Data Exporter.
7. “**Data Subject**” means an identified or identifiable natural person.
8. “**Personal Data**” means information that is linked or linkable, directly or indirectly, to an identified or identifiable natural person. “Personal Data” includes equivalent terms in Applicable Data Protection Laws, such as the CCPA-defined term “Personal Information,” as context requires.
9. “**Processor**” means an entity that Processes Personal Data on behalf of another entity. “Processor” includes equivalent terms in other Applicable Data Privacy Laws, such as the CCPA-defined term “Service Provider,” as context requires.
10. “**Sensitive Data**” means the following types and categories of data: Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, a mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or immigration status; genetic data; biometric data; neural data; government identification numbers; payment card information; unencrypted identifier or username in combination with a password or other access code that would allow access to an account; precise geolocation information; and information from a known child.
11. “**Standard Contractual Clauses**” means the European Union standard contractual clauses for international transfers from the European Economic Area (“EEA”) to third countries, Commission Implementing Decision (EU) 2021/914 of 4 June 2021, available at .
12. “**Subprocessor**” means a Processor engaged by a Party who is acting as a Processor.
13. The following terms have the meanings assigned to them in Applicable Data Privacy Laws: “**Business**,” “**Business** **Purpose**,” “**Cross-Context Behavioral Advertising**,” “**Process**” (and its cognates), “**Sale**” (and its cognates), “**Service Provider**,” “**Share**” (and its cognates), and “**Third Party**.”
### Section 4 - Description of the Parties’ Personal Data Processing Activities and Status of the Parties
1. The Description of Processing Form describes the purposes of Parties’ Processing, the types or categories of Personal Data involved in the Processing, and the categories of Data Subjects affected by the Processing.
2. The Description of Processing Form lists the Parties’ statuses under Applicable Data Privacy Laws.
### Section 5 - International Data Transfer
1. Some jurisdictions require that an entity transferring Personal Data to a recipient in another jurisdiction take extra measures to ensure that the Personal Data has special protections if the law of the recipient’s jurisdiction does not protect Personal Data in a manner equivalent to the transferring entity’s jurisdiction (an “**International Data Transfer Mechanism**”). Parties will comply with an International Data Transfer Mechanism, including the Standard Contractual Clauses, that may be required by Applicable Data Privacy Laws.
2. If the International Data Transfer Mechanism on which Parties rely is invalidated or superseded, Parties will work together in good faith to find a suitable alternative.
3. With respect to Personal Data of Data Subjects located in a jurisdiction that requires an International Data Transfer Mechanism (e.g., the EEA, Switzerland, or the United Kingdom) that Data Exporter transfers to Data Importer, or permits Data Importer to access, the Parties agree that by executing this Addendum they also execute the Standard Contractual Clauses, which will be incorporated by reference and form an integral part of the Agreement. Parties agree that, with respect to the elements of the Standard Contractual Clauses that require Parties’ input, Schedules 1-2 and the Description of Processing Form contain information relevant to the Standard Contractual Clauses and their Annexes. The Parties agree that, for Personal Data of Data Subjects in the United Kingdom, Switzerland, or another country specified in Schedule 2, they adopt the modifications to the Standard Contractual Clauses listed in Schedule 2 to adapt the Standard Contractual Clauses to local law, as applicable.
### Section 6 - General Data Privacy Obligations
1. **Compliance**. The parties will comply with their respective obligations under Applicable Data Protection Laws, including by providing the same level of privacy protection that is required of Businesses under the CCPA.
2. Upon request, Vendor will provide reasonably relevant information to Dispel to enable Dispel to fulfill its obligations (if any) to conduct data protection assessments or prior consultations with data protection authorities.
3. **Notification**. Vendor will notify Dispel if it determines that it can no longer meet its obligations under Applicable Data Privacy Laws.
### Section 7 - Vendor’s Obligations as a Third Party (if applicable)
If Vendor is a Third Party with regard to Personal Data that is collected, exchanged, or otherwise Processed in connection with the Vendor’s performance of the agreement (see Description of Processing Form), then:
1. Vendor acknowledges that Dispel is making Personal Data available to Vendor for the limited and specific purposes described in Description of Processing Form and Vendor agrees to use such Personal Data only for such purposes and for no other purpose.
2. Vendor will not Sell or Share Personal Data made available to it by Dispel unless Vendor provides data subjects with notice and the opportunity to opt out of such Sharing or Selling.
3. Vendor will allow Dispel to take reasonable and appropriate steps to ensure that Vendor is using the Personal Data provided or made available to Vendor by or on behalf of Dispel, or obtained or collected by Vendor in connection with the purposes described in Description of Processing Form, in a manner consistent with Dispel’s obligations under Applicable Data Privacy Laws.
4. Vendor will assist Dispel in complying with Data Subjects’ request to opt out of Processing, in no event later than 15 business days after receiving the request, if Dispel notifies Vendor that it is required to do so under Applicable Data Privacy Laws. Vendor will forward the opt-out request to any other person to whom it has made the Personal Data available.
5. If Dispel discovers unauthorized use of Personal Data by Vendor, Dispel may, upon notice, take reasonable and appropriate steps to stop and remediate such unauthorized use.
### Section 8 - Vendor’s Obligations as Independent Controller (if applicable)
If Vendor is a Controller of Personal Data that is collected, exchanged, or otherwise Processed in connection with the Vendor’s performance of the Agreement (see Description of Processing Form), then:
1. Vendor acknowledges and agrees that Vendor is independently responsible for compliance and will comply with Applicable Data Privacy Laws (e.g., obligations of Controllers).
2. Vendor agrees to be responsible for providing notice to Data Subjects as may be required by Applicable Data Privacy Laws and responding to Data Subjects’ requests to exercise their rights under Applicable Data Privacy Laws.
3. If Vendor receives any type of request or inquiry from a governmental, legislative, judicial, law enforcement, or regulatory authority, or faces an actual or potential claim, inquiry, or complaint in connection with Parties’ Processing of Personal Data provided to Vendor by or on behalf of Dispel, its affiliates, or their respective end users, or obtained or collected by Vendor in connection with the purposes described in Description of Processing Form (collectively, an “**Inquiry**”), then Vendor will notify Dispel without undue delay, but in no event later than ten (10) business days, unless such notification is prohibited by applicable law. Vendor will promptly provide Dispel with information relevant to the Inquiry, including any information relevant to the defense of a claim, to enable Dispel to respond to the Inquiry.
### Section 9 - Vendor’s Obligations as a Processor, Subprocessor, or Service Provider (if applicable)
1. Vendor will have the obligations set forth in this SECTION 9 if it Processes the Personal Data of Data Subjects in its capacity as Dispel’s Processor or Service Provider; for clarity, these obligations do not apply to Vendor in its capacity as an Independent Controller or Third Party.
2. **Scope of Processing**
1. Vendor will Process Personal Data solely for the Business Purposes specified in the Description of Processing Form, to carry out its obligations under the Agreement, and to carry out Dispel’s documented instructions.
2. Processing any Personal Data outside the scope of the Agreement and this Addendum will require prior written agreement between Vendor and Dispel.
3. Vendor is prohibited from retaining, using, or disclosing the Personal Data (1) for any purpose other than the Business Purposes specified in the Description of Processing Form, including retaining, using, or disclosing the Personal Data for a commercial purpose other than carrying out Dispel’s instructions, (2) outside of the Parties’ direct business relationship, unless permitted by Applicable Data Privacy Laws, or (3) by combining Personal Data that Vendor receives from, or on behalf of, Dispel with Personal Data that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the Data Subject, provided that Vendor may combine Personal Data to perform any Business Purposes permitted by Applicable Data Privacy Law.
3. Vendor will not Sell or Share the Personal Data that it collects or obtains pursuant to the Agreement.
4. **Confidentiality.** Vendor will ensure that each person who Processes Personal Data is subject to a duty of confidentiality with respect to such Personal Data.
5. **Compliance**.
1. Vendor will assist Dispel in complying with Data Subjects’ requests to delete and correct Personal Data under Applicable Data Protection Law when Dispel forwards such requests that it receives to Vendor and will make available to Dispel any Personal Data in its possession that Dispel needs to respond to Data Subjects’ requests to access their Personal Data.
2. Vendor will make available to Dispel, upon the Dispel’s reasonable request, all information in its possession necessary to demonstrate Vendor’s compliance with its obligations under Applicable Data Privacy Laws.
6. **Permitted Activities**. Notwithstanding the foregoing prohibitions, Parties agree that Vendor may, and Dispel instructs Vendor to, Process Personal Data for the following activities when necessary to support the Business Purposes specified in the Description of Processing Form; detect data security incidents; protect against fraudulent or illegal activity; effectuate repairs; and maintain and improve the quality of the services provided for the Business Purposes specified in the Description of Processing Form.
7. **Subprocessors**. If Vendor discloses Personal Data to a Subprocessor for a Business Purpose, Vendor and Subprocessor will enter into a written contract that prohibits the Subprocessor from (i) Selling or Sharing Personal Data; or (ii) retaining, using, or disclosing Personal Data for any purpose other than for the specific Business Purpose for which the Personal Data was disclosed. Vendor will require any Subprocessor to comply with applicable obligations under Applicable Data Privacy Laws, including to provide the same level of privacy protection required of Businesses by the CCPA. Vendor must notify Dispel before engaging a new Subprocessor and give Dispel an opportunity to object to the engagement.
8. **Duration of Processing, Deletion and Return of Personal Data**. Vendor shall retain Personal Data for a period coterminous with the term of the Agreement. At the expiration or termination of the Agreement, or upon request by Dispel, Vendor will, without undue delay: (1) return all Personal Data to Dispel; or (2) upon request by Dispel, destroy all Personal Data, in each case unless applicable laws expressly require otherwise or the Parties agree otherwise expressly in writing. For any Personal Data that Vendor retains after expiration or termination of the Agreement, Vendor will continue to comply with this Addendum.
9. Assessment and Remediation.
1. Dispel may take reasonable and appropriate steps, as provided in Applicable Data Privacy Laws, to ensure Vendor Processes the Personal Data in a manner consistent with Dispel’s obligations under Applicable Data Privacy Laws, including by conducting reasonable assessments or audits, as provided by Applicable Data Privacy Laws. If Dispel and Vendor agree to an assessment by a qualified and independent third party, Vendor agrees to provide a report of such assessment to Dispel upon request.
2. If Dispel discovers unauthorized use of Personal Data by Vendor or Vendor’s Subprocessors, Dispel may, upon notice, take reasonable and appropriate steps to remediate such unauthorized use.
### Section 10 - Security
1. Vendor will implement appropriate technical and organizational measures to protect Personal Data from a Data Breach and to preserve the security and confidentiality of Personal Data, as set out in Schedule 1.
2. Upon becoming aware of a Data Breach, Vendor will:
1. Notify Dispel without delay of the Data Breach, but in any case, no later than 48 hours after becoming aware of or reasonably suspecting the Data Breach;
2. Promptly investigate or perform required assistance in the investigation of the Data Breach and provide Dispel with detailed information about the Data Breach, including a description of the Data Breach, the approximate number of Data Subjects affected, the Data Breach’s current and foreseeable impact, and the measures Vendor is taking to address the Data Breach and mitigate its effects; and
3. Promptly take all commercially reasonable steps to mitigate the effects of the Data Breach or assist Dispel in doing so.
3. Vendor will comply with this SECTION 10 at Vendor’s cost, unless the Data Breach arose from Dispel’s negligent or willful acts.
4. Vendor must obtain Dispel’s written approval before notifying any governmental entity, individual, the press, or other third party of a Data Breach that affected or reasonably could affect Personal Data that Vendor obtained from, or Processed on behalf of, Dispel. Notwithstanding anything to the contrary in this Addendum, Vendor may notify a third party about a Data Breach affecting Personal Data if it is under a legal obligation to do so, provided that Vendor must: (1) make every effort to give Dispel prior notification, as soon as possible, if it intends to disclose the Data Breach to a third party; and (2) if it is not possible to give Dispel such prior notification, notify Dispel immediately once it becomes possible to give notification. For any disclosure of a Data Breach to a third party, Vendor will, as part of its notification to Dispel, disclose the identity of the third party and a copy of the notification (if the notification to the third party has not been sent, Vendor will provide the draft to Dispel and permit Dispel to offer edits or updates).
### Section 11 - Miscellaneous
1. **Entire agreement**. This Addendum is the Parties’ entire agreement on this subject and merges and supersedes all related prior and contemporaneous oral understandings, representations, prior discussions, letters of intent, or preliminary agreements.
2. **No further amendment**. Except as modified by this Addendum, the Agreement remains unmodified and in full force and effect.
***
## Schedule 1: Technical and Organizational Security Measures
Vendor shall adhere to Dispel’s Cybersecurity Requirements for Suppliers, found here:
***
## Schedule 2: Jurisdiction-Specific Clauses
1. **Jurisdiction-specific Obligations and Information for International Transfers**
1. **Generally**. The parties agree that, for any jurisdiction not listed below that requires an International Data Transfer Mechanism, they hereby enter into and agree to be bound by the EEA Standard Contractual Clauses for transfers of personal data from that jurisdiction unless (1) the parties otherwise agree in writing or (2) a jurisdiction promulgates its own International Data Transfer Mechanism, in which case the parties hereby agree to negotiate an update to this DPA to incorporate such International Data Transfer Mechanism.
2. **European Economic Area.**
1. “EEA Standard Contractual Clauses” means the European Union standard contractual clauses for international transfers from the European Economic Area to third countries, Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
2. For transfers from the EEA that are not subject to an adequacy decision or exception, the parties hereby incorporate the EEA Standard Contractual Clauses by reference and, by signing this DPA, also enter into and agree to be bound by the EEA Standard Contractual Clauses. The parties agree to select the following options made available by the EEA Standard Contractual Clauses.
1. Clause 9, Module 2(a): The parties select Option 2. The time period is 30 days.
2. Clause 9, Module 3(a): The parties select Option 2. The time period is 30 days.
3. Clause 11(a): The parties do not select the independent dispute resolution option.
4. Clause 17: The parties select Option 1. The parties agree that the governing jurisdiction is the Republic of Ireland.
5. Clause 18: The parties agree that the forum is the Republic of Ireland.
6. Annex I(A): The statuses of the parties as Controllers or Processors and Data Exporters or Data Importers is described in Schedule 1.
7. Annex I(B): The parties agree that Schedule 1 describes the transfer.
8. Annex I(C): The competent supervisory authority is the Data Protection Commission.
9. Annex II: The parties agree that Schedule 1 describes the technical and organizational measures applicable to the transfer.
10. Annex III: The parties agree that the Description of Processing Form describes the relevant subprocessors and their roles in processing personal data.
3. **Switzerland**. The parties agree to the following modifications to the EEA Standard Contractual Clauses to make them applicable to transfers of personal data from Switzerland.
1. The parties adopt the GDPR standard for all data transfers from Switzerland.
2. Clause 13 and Annex I(C): The competent authorities under Clause 13, and in Annex I(C), are the Federal Data Protection and Information Commissioner and, concurrently, the EEA member state authority identified above.
3. Clause 17: The parties agree that the governing jurisdiction is the Republic of Ireland.
4. Clause 18: The parties agree that the forum is the Republic of Ireland. The parties agree to interpret the EEA Standard Contractual Clauses so that data subjects in Switzerland are able to sue for their rights in Switzerland in accordance with Clause 18(c).
4. United Kingdom.
1. “**IDTA**” means the International Data Transfer Agreement issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as modified by the UK Information Commissioner’s Office from time to time.
2. For transfers from the United Kingdom that are not subject to an adequacy decision or exception, the parties hereby incorporate the IDTA by reference and, by signing this DPA, also enter into and agree to be bound by the Mandatory Clauses of the IDTA.
3. Pursuant to Sections 5.2 and 5.3 of the IDTA, the parties agree that the following information is relevant to Tables 1 – 4 of the IDTA and that by changing the format and content of the Tables neither party intends to reduce the Appropriate Safeguards (as defined in the IDTA).
1. Table 1: The parties’ details, key contacts, data subject contacts, and signatures are in the signature block of the DPA.
2. Table 2:
1. The UK country’s law that governs the IDTA is: England and Wales
2. The primary place for legal claims to be made by the parties is: England and Wales
3. The statuses of the Data Exporter and Data Importer are described in Schedule 1.
4. The Data Importer represents and warrants that the UK GDPR does apply to its processing of personal data under the Agreement.
5. The relationship among the agreements setting forth data protection terms among the parties, including this Section, the DPA, and the Agreement, is described in Section 1 of the DPA.
6. The duration that the parties may process personal data is set forth in the DPA.
7. The IDTA is coterminous with the DPA. Neither party may terminate the IDTA before the DPA ends unless one of the parties breaches the IDTA or the parties agree in writing.
8. The Data Importer may transfer personal data to another organization or person (who is a different legal entity) if such transfer complies with the IDTA’s applicable Mandatory Clauses.
9. The parties will review the Security Requirements listed in Table 4, and the supplementary measures described in Schedule 1, to this DPA annually.
3. Table 3:
1. The categories of personal data, Sensitive Data, data subjects, and purposes of processing are described in Schedule 1. Such description may only be updated by written agreement of the parties.
4. Table 4:
1. The security measures adopted by the parties are described in Schedule 1 of this DPA. Such security measures may only be updated by written agreement of the parties.
5. The parties agree to adopt the additional technical, organizational, and/or contractual protections that may be required by their transfer impact assessment described in Schedule 1 of this DPA.
# Code of Conduct
Version 1.0, Published December 26, 2024
{% file src="/files/ODiCkT8HrvNhWpwloI9n" %}
**Download a PDF copy of the Code of Conduct**
{% endfile %}
***
At Dispel, we only work with suppliers that share our commitment to integrity, sustainability and human rights and have agreed to meet the requirements set out in this Supplier Code of Conduct.
Dispel's purpose is to enable a more secure, efficient future for operations, manufacturing, and industrial systems. In keeping with our purpose, Dispel is committed to maintaining the highest standards of integrity and transparency, and complying with all applicable laws and regulations across its global business operations. Given that the conduct of Dispel's suppliers and sub-processors can have a substantial impact on both Dispel and its stakeholders, we require all suppliers to adhere to similar legal standards and values as Dispel.
“Suppliers” refers to third parties—including individual contractors, vendors and sub-processors—that Dispel engages to purchase goods and/or services and/or works. The Supplier Code of Conduct does not apply to end-use customers.
As a Dispel supplier, you comply with all applicable laws and regulations wherever you operate, observe the principles reflected in Dispel’s Code of Conduct, and meet the requirements set out in this Dispel Supplier Code of Conduct, as well as your contractual obligations to Dispel.
We cannot cover every situation that may arise in this Code of Conduct, so we ask that you, as our supplier, be thoughtful and ethical. The Supplier Code should be viewed as the minimum standards that we expect from our supplier community. Dispel will assess a Supplier’s commitment to compliance with these requirements when making procurement and sourcing decisions.
***
## Human Rights and Decent Work
We require our suppliers to respect the same international human rights principles and standards as Dispel. You shall respect the personal dignity, privacy and rights of each individual and refrain from making anyone work against his or her will. You will also prohibit behaviors, practices and threats that are intended to cause or are likely to result in physical, psychological, sexual or economic harm, including gender-based violence and harassment. In particular, you will:
* Refrain from discrimination, harassment and retaliation based on gender, age, ethnicity, nationality, religion, disability, union membership, political affiliation, sexual orientation or other characteristics protected under local law and ensure equal and fair treatment of all workers;
* Not hire individuals under 15 years of age, or 14 years of age where local law allows, consistent with ILO Convention number 138, or under the legal minimum age for employment in the country, whichever is greatest;
* Ensure that any young workers (under the age of 18) in your employ are protected from performing any work that may harm their physical or mental development, interfere with their education, or compromise their potential or dignity;
* Conduct human rights due diligence to identify, assess, eliminate or mitigate the risks of potential adverse effects related to forced and/or child labor in your supply chain. Adopt a traceability system that records information on product origins, suppliers and processing steps regarding forced labor and child labor. Develop a risk management plan to monitor and identify risks in the supply chain relating to forced labor and child labor;
* Not use any form of [modern slavery and/ or forced labor](#user-content-fn-1)[^1] and allow all workers the freedom to leave their employment upon reasonable notice;
* Unless stipulated by applicable law, not require workers to surrender their original personal certificates and identifications, such as government-issued identification, passports or work permits, as a condition of employment;
* Compensate workers fairly and in a timely manner. Follow local wage and overtime payment regulations and / or collective agreements. Where these do not exist, compensate employees so at the minimum they can meet their basic needs;
***
## Business Ethics
{% hint style="danger" %}
We do not tolerate any form of bribery or corruption and only enter into business relationships with third parties that share our ethical standards.
{% endhint %}
You shall conduct your business in an ethical manner. In particular, you will:
* Not commit or become involved in, and seek to prevent, any form of bribery, corruption, fraud, theft, money laundering, unlawful tax evasion or any other violation of applicable laws;
* Ensure that no payments (including facilitation payments), gifts or any other commitments are made to Dispel customers or employees, public officials or any other party in order to obtain or retain business, secure an improper advantage or influence someone to improperly perform their duties;
* Adhere to antitrust and other competition laws and have in place effective processes and procedures to prevent anti-competitive behavior, and conduct your business in line with fair competition;
* Disclose to Dispel information regarding any actual, potential or perceived conflicts of interest relating to your activities as an Dispel supplier, including disclosure of any financial interest that an Dispel employee, customer or their relatives or other proxy may hold in your business;
* Respect the intellectual property rights of Dispel and others. Secure and protect all confidential information provided by Dispel and our respective business partners;
* Comply with all applicable international trade and export control regulations and, in particular, properly classify and obtain all applicable approvals, licenses and certificates prior to export or transfer of products, technology or software.
**Do not give gifts to influence Dispel**\
Do not offer, provide, or solicit gifts or entertainment that might compromise a Dispel employee’s judgment or independence. This includes, but is not limited to:
* Cash, cash equivalents, such as gift cards, gifts or charitable contributions individually or cumulatively valued at more than $150 in any one year; and
* Entertainment that is lavish or that takes place in a location inconsistent with Dispel’s values
***
## Business and Information Security
We use our assets responsibly and only for legitimate business purposes that are consistent with Dispel’s interests and rights and in accordance with our rules and governance.
You shall conduct your business in a secure manner, taking care of the safety and security of people as well as physical assets and information or data assets. In particular, you will:
* Implement reasonable measures for minimizing exposure of Dispel to security threats such as cyberattacks, theft, and crime;
* When visiting or working at Dispel locations, follow Dispel’s security procedures and report any security concerns through the appropriate Dispel channels;
* Implement and maintain appropriate physical, technical and organizational measures to protect Dispel information and assets from destruction or unauthorized disclosure;
* Adhere to applicable information security and cybersecurity regulations and standards, and immediately report to us any suspected or actual incidents that may impact Dispel information or systems;
* Observe all applicable data-privacy regulations and laws on the collection, processing and transfer of personal data and cooperate in good faith with Dispel to ensure compliance with the aforementioned requirements.
***
## Procurement by Suppliers
We are committed to a transparent and competitive sourcing process and to dealing fairly and responsibly with our suppliers.
You shall procure goods and services in a responsible manner. In particular, you will:
* Require your suppliers (including but not limited to labor agents or agencies, material suppliers and subcontractors) to respect standards consistent with the Dispel Supplier Code of Conduct and include your requirements in agreements with your suppliers;
* Effectively communicate these principles along your supply chain and implement a process to verify supplier performance;
* Inform Dispel immediately if you suspect a violation of these principles has taken place in your supply chain and work with your suppliers to mitigate and prevent further violations and remediate negative events that have occurred in the past;
* When working at Dispel locations, only subcontract work with prior consent from Dispel.
We expect you to create a comprehensive overview of your supply chain, also known as supply chain mapping, so you can quickly identify and mitigate risks in terms of all topics covered in this Supplier Code of Conduct.
***
## Documentation, Inspections, Reporting and Corrective Actions
We comply with all regulations and laws on reporting or disclosure of human rights and environmental due diligence and take appropriate actions in a timely manner to address non-compliances or implement improvements.
To ensure and demonstrate compliance with the Dispel Supplier Code of Conduct, you will:
* Comply with all regulations and laws regarding public reporting or disclosure on human rights and environmental due diligence, including laws requiring public disclosures on due diligence on modern slavery and child labor across the supplier’s value chain;
* Create and maintain relevant documentation and provide supporting documentation to Dispel upon request;
* Report to Dispel without undue delay in writing any identified risks to and violations of the principles outlined in this Supplier Code of Conduct and take appropriate corrective actions to prevent, end or mitigate the risk or violation.
To verify your compliance, we reserve the right to audit and inspect your operations, upon reasonable notice, with your consent. Such consent shall not be unreasonably withheld. If the results of such an audit or inspection show that you do not comply with this Dispel Supplier Code of Conduct, you shall take necessary corrective actions in a timely manner as directed by us.
If you fail to comply with this Dispel Supplier Code of Conduct, or fail to take necessary corrective actions to remedy violations of the Dispel Supplier Code of Conduct within a reasonable timeframe, Dispel reserves the right to take action against you, including suspending or terminating your activities as one of our suppliers.
***
## Glossary
This glossary explains important terms used in the Dispel Supplier Code of Conduct and implementation guide. It is based on universally accepted definitions, which have been edited for clarity and ease of understanding.
**Child labor** is often defined as work that deprives children of their childhood, their potential or their dignity. It refers to work that is mentally, physically, socially or morally dangerous and harmful to children and/or interferes with their schooling. Child labor also refers to employment of children who are underage or who do excessively long and heavy or hazardous work as determined by the laws of a state.
**Employees** include any staff or personnel engaged or employed by a supplier, including temporary labor engaged via labor agents or agencies.
**Facilitation payments** are payments made to a public official to facilitate or expedite the performance of routine governmental action (e.g., processing papers, issuing permits) that the person or company making the payment is legally entitled to receive.
**Grievance mechanisms** are formal, legal or non-legal (or “judicial/non-judicial”) complaint processes that can be used by individuals, workers, communities and/or civil society organizations that are negatively affected by certain business activities and operations.
**Human rights** refer to the basic rights and freedoms that belong to every person in the world, simply because they are human beings. They define the minimum standards necessary for people to live with dignity, freedom, equality, justice and peace. They are inherent to everyone, irrespective of race, gender, language, religion, political or other opinion, national or social origin, property, birth or status. The Universal Declaration of Human Rights, adopted by the United Nations General Assembly in 1948, establishes the fundamental rights and freedoms of all human beings.
**Modern slavery** is an umbrella term covering practices such as forced labor, debt bondage, child labor, forced marriage, involuntary prison labor, victims of slavery and human trafficking.
**Suppliers** refers to a third parties, including individual contractors, that Dispel engages to purchase goods and/or services and/or works.
[^1]: Modern slavery and/or forced labor, including but not limited to involuntary prison labor, victims of slavery and human trafficking.
# Recruiter Policy
Version 1.0, Published January 6, 2025
This Vendor Policy for Recruiters is designed to establish a clear framework for collaboration between recruiters and Dispel. The purpose of this policy is to ensure a productive, transparent, and equitable candidate experience while aligning recruitment efforts with Dispel’s hiring needs and standards. By outlining the terms and expectations, this policy supports both recruiters and Dispel in identifying and hiring top talent effectively.
This policy applies to all external recruiting agencies, vendors, and independent recruiters (“Recruiters”) engaged to support Dispel’s hiring efforts. Compliance with this policy is mandatory for all recruitment partnerships.
***
## **Key Guidelines**
1. **Authorized Collaboration**
* Recruiters must have a signed agreement with Dispel before submitting any candidate. Unauthorized submissions will not be considered, and Dispel will not be obligated to compensate the recruiter for such submissions.
2. **Candidate Ownership and Submission Process**
* All candidates must be submitted through Dispel’s designated Applicant Tracking System (ATS) for proper documentation and tracking.
* Dispel retains sole discretion in accepting or rejecting candidates submitted by recruiters. Only candidates expressly accepted by Dispel will be considered for further evaluation and interview.
3. **Transparency and Communication**
* Recruiters are required to provide accurate and complete candidate information, including resumes, contact details, and any relevant screening notes.
* Regular communication and updates about submitted candidates must occur in accordance with Dispel’s defined timelines and protocols.
* Provide complete and accurate information on candidates' interviewing status at other firms.
4. **Avoidance of Duplication**
* To avoid confusion and inefficiencies, recruiters must verify whether a candidate is already in Dispel’s hiring pipeline before submitting them. Any duplicate submissions will be handled according to Dispel’s internal policies.
5. **Compliance with Equal Opportunity Standards**
* Recruiters must adhere to Dispel’s commitment to Equal Employment Opportunity (EEO) and ensure that no candidate is discriminated against based on race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or any other protected characteristic.
***
## **Candidate Acceptance**
For a candidate to be considered “accepted” by Dispel, the following conditions must be met:
* A executed agreement must be in place between the Recruiter and Dispel.
* The candidate *must* be submitted to Dispel's ATS. Recruiters agree they shall not email candidate resumes.
* The candidate’s submission must be acknowledged and confirmed in writing by Dispel through the ATS.
* Dispel will notify the recruiter if the submitted candidate has been officially moved forward for further stages in the hiring process.
* Any candidates not explicitly accepted will be deemed as not under consideration, and Dispel will not owe a fee for these submissions.
***
## **Vendor Performance**
Recruiters are expected to provide high-quality candidates who meet the qualifications and cultural fit for Dispel. Regular evaluations of recruiter performance will be conducted, and partnerships may be terminated if expectations are not consistently met.
***
## **Enforcement**
Failure to comply with this policy may result in the termination of the recruiting partnership and the forfeiture of any fees for unauthorized submissions. Dispel reserves the right to modify this policy at its discretion.
***
## **Acknowledgment**
All recruiters engaged with Dispel must review and acknowledge this policy before submitting candidates. By submitting any candidate to Dispel, the Recruiter acknowledges and agrees to this policy. Questions or clarifications about the policy should be directed to Dispel’s Talent Acquisition team.
# Foreign Ownership, Control, or Influence
Foreign Ownership, Control, or Influence
Dispel serves clients globally, protecting critical infrastructure and manufacturing around the world. Part of our supply-chain security includes considerations for where our suppliers and service providers are based, and the extent to which foreign ownership, control, or influence ("**FOCI**") may impact our supply chain.
FOCI does not disqualify a company from serving or supplying Dispel. After completing the questionnaire, a review will be conducted considering the following factors:
* Record of economic and government espionage against U.S. targets
* Record of enforcement and/or engagement in unauthorized technology transfer
* The type and sensitivity of the information that shall be accessed
* The source, nature, and extent of FOCI
* Record of compliance with pertinent U.S. laws, regulations and contracts
* The nature of any applicable bilateral and multilateral security and information exchange agreements
* Ownership or control, in whole or in part, by a foreign government
* Any other indications of a foreign interests’ capability to control or influence the company’s operations or management
In addition to these specific factors, Dispel also assesses companies for any other factors that may indicate or demonstrate a capability on the part of foreign interests to control or influence the company’s operations or management in a manner that would be detremental to our end customers.
## Questionnaire
Dispel's FOCI form is modeled after Standard Form (SF) 328, the Certificate Pertaining to Foreign Interest, which is a 10-question document designed to help identify the presence of FOCI in an organization. Each of the 10 questions requires a yes or no answer, and any yes answer requires that additional information or documentation be included with the form.
{% embed url="" %}