Managed Services

1. About these terms

These terms apply where Defy manages, monitors or administers infrastructure for you under a Service Agreement (a "Managed Environment"). They add to the Terms of Service; your Service Agreement takes priority for anything it specifically covers.

2. Onboarding

Where you engage Defy for Managed Services, or move existing infrastructure into a Managed Environment, onboarding generally follows these steps:

• Discovery & documentation — we inventory the hardware, software, credentials, and network topology relevant to the engagement.
• Baseline review — a lightweight check of patch status, exposed services, and existing backup coverage, performed before Defy assumes ongoing management responsibility, so both parties have a documented starting state.
• Access provisioning — administrative access is requested and granted on the least-privilege basis described in section 5 of the Terms of Service; any temporary elevated access used specifically for migration is revoked once onboarding is confirmed complete.
• Monitoring & tooling deployment — monitoring agents and management tooling are installed and validated as working before being relied on.
• Handover confirmation — written confirmation of exactly what is now inside the Managed Environment, and what, if anything, remains your responsibility.

Onboarding timelines depend on the size and condition of the environment being brought under management and are agreed as part of the Service Agreement, not fixed by these Terms.

3. Change Management Policy

For any infrastructure inside a Managed Environment:

• Routine changes — low-risk work such as patching within an agreed maintenance window, or minor configuration adjustments, may be carried out without a separate approval step each time, consistent with the maintenance schedule in the Service Levels & Support terms.
• Major changes — anything with a realistic risk of service disruption, including infrastructure migrations, firewall rule changes, DNS cutovers, or software upgrades with known breaking changes, requires your prior approval (email is sufficient) before being carried out.
• Emergency exception — the approval step above may be bypassed where a change is urgently required to contain an active security incident under section 4 (Incident Response Plan); in that case we notify you as soon as reasonably practicable after the fact, not before.

Where practical, major changes are tested in a non-production environment or scheduled during an agreed maintenance window, with a documented rollback plan.

4. Incident Response Plan

In the event of a suspected security incident, data breach, or significant failure affecting a Managed Environment or Cloud Platform infrastructure:

• Detection & containment — once our team engages with the incident within the coverage hours included in your Service Agreement, we take prompt steps to contain the issue and limit further impact.
• Notification — we notify you as soon as reasonably practicable, and without undue delay where the incident involves a confirmed compromise of personal data, consistent with the Privacy Policy.
• Investigation — a root cause investigation to determine scope and impact.
• Remediation — resolving the immediate issue and, where relevant, hardening against recurrence.
• Post-incident report — for significant incidents, a written summary of what happened, what was affected, and what's changed as a result, provided on request.

Report a suspected incident immediately to support@defy.com.fj or 999 1688. Incidents reported outside business hours are handled from the start of the next business day, unless your Service Agreement provides otherwise.

5. Data Export & Exit

For a planned exit from a Managed Services engagement, we ask for 30 days' written notice so the export can be scheduled without disrupting production services; exports are typically ready within 30 days of the scheduled export date, in a standard, documented format appropriate to the service (for example, a database dump for hosted applications, or a zone file for DNS records).

The export date, continued access, assistance scope and any migration or extended-storage charges must be agreed before the affected Service ends. The indicative export timing above does not extend a service-specific deletion deadline unless we agree in writing.

6. Offboarding

When a Managed Services or Cloud Platform engagement ends, in addition to section 5:

• Access revocation — all administrative access Defy holds to your systems (VPN, remote management tools, admin accounts) is revoked within 5 Business Days of termination taking effect, unless a transition period is separately agreed.
• Credential handover — where you request it, credentials for accounts or systems that need to remain under your control are provided to you, not simply deleted, as part of the transition.
• Equipment & access tokens — any Defy-provided hardware, physical access tokens, or similar is returned or deactivated.
• Final documentation — a summary of the infrastructure and configuration as it stood at handover, so a new provider or your own team isn't starting blind.

7. Vendor & Third-Party Risk Policy

Defy relies on a limited set of vetted service providers to help deliver the Services — for example, email delivery and payment processing (see our Privacy Policy for how data is shared with them).

Before relying on a new vendor for a function that touches Customer Data or production infrastructure, we consider that vendor's security practices and track record. We monitor our vendors' status pages and security advisories for issues that could affect the Services, and each vendor is only given access to what's necessary for the specific function it performs for us — not broad access to Customer Data generally.