Service Agreement Overview
This page explains the types of provisions Bonelli Systems expects to address in managed IT, cybersecurity, compliance-supporting, cloud, Microsoft, and Applied AI Engineering engagements. It is not itself a signed agreement, quote, statement of work, legal advice, or offer to provide services on any specific terms.
1. Engagement Structure
Bonelli Systems typically scopes work through one or more written documents that define the client, effective date, services, deliverables, term, pricing, service levels, exclusions, client responsibilities, data handling, and signatures or electronic approval. A statement of work or order should identify what is included and what is out of scope for that engagement.
2. Current Service Areas
Bonelli Systems provides technology services that may include:
- Managed IT and support: monitoring, maintenance, endpoint and server support, vendor coordination, device and network operations, backup monitoring, and practical technology planning.
- Cybersecurity: security assessments, vulnerability scanning, penetration testing, security awareness, incident support, endpoint/security tooling, and security operations support.
- Compliance-supporting services: control alignment, evidence support, remediation planning, and technical support for frameworks such as NIST, PCI, SOC 2, HIPAA-related environments, and other client-specific requirements.
- Cloud and Microsoft services: Microsoft 365, Azure, identity, licensing, tenant administration, cloud infrastructure, private cloud, virtual desktop, and related engineering.
- Network, infrastructure, and physical security: network design, server installation/management, structured cabling coordination, and video surveillance or physical-security technology support.
- Applied AI Engineering: model evaluation, workload benchmarking, private/local AI deployment, retrieval and data pipelines, autonomous operations monitoring, AI product engineering, model-serving infrastructure, observability, audit logging, guardrails, and operation of AI-enabled systems.
3. Scope, Deliverables, and Exclusions
Services should be limited to the scope expressly stated in the applicable statement of work or order. Services not expressly included should be treated as excluded unless Bonelli Systems agrees in writing. Common exclusions may include unsupported or end-of-life systems, client-controlled changes, vendor outages, unapproved emergency work, third-party software defects, unsupported personal/BYOD devices, projects not included in the SOW, and remediation work outside the agreed assessment or support scope.
4. Client Responsibilities
Clients should expect to provide timely cooperation, accurate information, authorized contacts, necessary approvals, supported systems, appropriate licenses, and secure access methods. For security, compliance, and AI engagements, clients are responsible for identifying data sensitivity, regulatory requirements, prohibited uses, decision owners, escalation contacts, systems of record, and any legal or compliance constraints that affect the work.
5. Credentials and Access
Administrative access should be provided through approved secure methods such as delegated administration, named accounts, privileged access management, temporary access, or secure credential exchange. Bonelli Systems is not responsible for delays caused by lack of access, expired credentials, insufficient permissions, unsupported systems, or client security controls that prevent agreed work.
6. Service Levels
Service levels should apply only where expressly stated in a signed statement of work, order, or SLA schedule. Response targets are generally targets for initial response or escalation, not guaranteed resolution times, unless the applicable SLA states otherwise. Resolution depends on issue complexity, client cooperation, vendor availability, supported-system status, required approvals, and other factors outside Bonelli Systems’ control.
7. Security, Assessments, and Compliance Support
Security assessments, Microsoft 365 reviews, vulnerability scans, penetration tests, compliance-readiness reviews, and similar services identify conditions observed during the agreed assessment window and scope. They do not guarantee detection of every vulnerability, misconfiguration, compromise, threat, or future incident. Bonelli Systems provides technical and compliance-supporting services, not legal advice, audit certification, or guaranteed certification outcomes unless expressly stated in a signed agreement.
8. Applied AI Engineering Terms
AI services
Applied AI Engineering services may include model evaluation, workload benchmarking, private or local AI deployment, retrieval and data pipelines, autonomous operations monitoring, AI product engineering, model-serving infrastructure, observability, audit logging, guardrails, and operation of AI-enabled systems, only as described in an applicable statement of work.
Client data and model training
Client data provided for AI evaluation or AI system operation remains client data. Bonelli Systems will use client data only to perform the services, evaluate agreed workloads, build and operate agreed systems, troubleshoot, maintain security, and comply with legal obligations. Bonelli Systems will not use client confidential information or client data to train public AI models or publish client-identifying results unless the client expressly authorizes such use in writing.
Third-party models and APIs
A statement of work should identify whether an AI system uses public cloud APIs, private tenant services, local/open-weight models, third-party hosted models, or client-provided systems. Where third-party AI providers are used, their terms, data-handling practices, availability, pricing, model behavior, and lifecycle changes may apply.
AI output limitations
AI and machine-learning systems can produce inaccurate, incomplete, biased, unsafe, or unexpected outputs. Unless a signed statement of work states otherwise, AI outputs are decision-support tools and should be reviewed by qualified human personnel before use in legal, financial, medical, employment, safety-critical, operational shutdown, or similarly material decisions.
Autonomous operations controls
Autonomous Operations AI or control-loop functionality should be deployed only under a written statement of work that defines monitored systems, authority levels, escalation paths, human override, audit logging, fail-safe behavior, testing/acceptance criteria, maintenance responsibilities, and prohibited actions. Unless expressly agreed in writing, Bonelli Systems will not authorize an AI system to take safety-critical, production-disrupting, financial, employment, legal, medical, or regulated action without human approval.
Open-source and open-weight components
AI solutions may include open-source, source-available, or open-weight components. The applicable statement of work should identify material components where appropriate. Third-party components remain subject to their own licenses and terms.
9. Data Protection and Regulated Data
If an engagement requires Bonelli Systems to process personal information, protected health information, payment-card data, privileged legal material, export-controlled data, or other regulated/sensitive data, the parties should execute an applicable data processing addendum, business associate agreement, confidentiality addendum, security schedule, or similar document before such data is provided. The data-specific addendum should control for the regulated data it covers.
10. Security Incident Notice
A client agreement should define security-incident notice obligations. A typical structure is that Bonelli Systems will notify the client without undue delay after confirming unauthorized access to client data within Bonelli Systems’ control, and in any event within the timeframe required by applicable law or the applicable data addendum. Notice should include available information regarding the nature of the incident, affected systems/data, mitigation steps, and recommended client actions, subject to ongoing investigation and legal restrictions.
11. Third-Party Products and Vendors
Third-party products, subscriptions, cloud services, software, hardware, and vendor support are subject to the applicable vendor’s terms, warranties, service levels, lifecycle policies, and pricing. Bonelli Systems may assist with procurement, configuration, administration, and support, but does not control third-party provider availability, product changes, security incidents, pricing changes, or end-of-life decisions.
12. Microsoft Partner Association and Delegated Administration
Where Bonelli Systems performs Microsoft-related services, the applicable statement of work or order may request that the client acknowledge Bonelli Systems through Microsoft partner association mechanisms such as CPOR or successor programs. Such association does not grant Bonelli Systems access to client data or environments unless separately authorized through delegated administration or other approved access controls. Client remains responsible for tenant ownership, licensing compliance, vendor account standing, and vendor terms.
13. Intellectual Property and Work Product
A client agreement should distinguish client data, client-specific final deliverables, Bonelli Systems pre-existing tools and know-how, reusable frameworks, generalized methods, open-source components, and third-party materials. Unless an agreement states otherwise, client data remains client data; Bonelli Systems retains its pre-existing tools, templates, scripts, frameworks, know-how, generalized methods, libraries, and reusable components; and third-party components remain subject to their own licenses.
14. Fees, Changes, Renewal, and Termination
Pricing, payment terms, taxes, late fees, renewals, termination rights, early termination fees, transition assistance, data return/deletion, and fee adjustments should be stated in the applicable signed agreement or SOW. Bonelli Systems should not rely on placeholder terms or unresolved choices for these business terms.
15. Limitation of Liability, Texas Law, and No Guarantee
A final client agreement should include counsel-approved limitations of liability, warranty disclaimers, exclusions of indirect damages, indemnity provisions, dispute-resolution terms, Texas governing law and venue where appropriate, and survival provisions. Unless expressly stated in a signed agreement, Bonelli Systems does not guarantee uninterrupted service, complete security, detection or prevention of all threats, successful recovery from all incidents, regulatory compliance, certification, audit outcome, business result, or performance of third-party products or services.
16. Questions to Ask Before Signing an IT, Security, or AI Agreement
- What services, systems, users, sites, tenants, devices, or datasets are explicitly in scope?
- Which services are excluded or require a separate SOW?
- What are the response targets, and are they response targets or resolution guarantees?
- Who owns client data, work product, reusable tools, logs, benchmark results, and AI outputs?
- What data may be sent to third-party vendors, cloud services, or AI model providers?
- What happens if regulated or sensitive data is involved?
- What security-incident notice and transition-assistance obligations apply?
- What vendor terms, lifecycle policies, and price changes can affect the engagement?
17. Contact
To review your current IT, cybersecurity, Microsoft, or AI service agreement against real operational risk, contact Bonelli Systems at office@bonellisystems.com or 469-518-6987.