Managed service responsibilities

1. The agreed scope

This addendum applies only if identified in your Order. The Order must list each included task and assign responsibility for infrastructure, virtual machine, operating system, runtime, database, application, website content, domain/DNS, certificates, backups and recovery. A component is not managed merely because it runs on a managed server.

For each included task, state its frequency or trigger, service limits, access needed, maintenance arrangements and any included administration allowance. Application development, CMS or plugin maintenance, database administration and migration require explicit inclusion. No unspecified numeric allowance or product entitlement is created by this standard text.

2. Access and changes

Novasean must use access only for the agreed task and lawful instructions, with appropriate authorisation and confidentiality. Third-party access involving personal data must follow the completed DPA and supplier authorisation. The customer must maintain an authorised contact and provide necessary lawful access through an agreed secure method, rather than sending passwords in a general ticket.

Routine changes must follow the agreed maintenance and notification process. When a proposed change is unsafe or outside scope, Novasean must explain the issue and obtain the required decision or agreement to additional work. Urgent security work may require shorter notice, followed by an explanation. The customer must test the application where that remains its responsibility.

3. Handover and incidents

Managed onboarding must record the service identifier, baseline, access roles, included tasks, alert route, backup enrolment where included, customer dependencies and handover outcome. Provisioning a VM does not by itself prove that managed onboarding is complete.

Incident handling must distinguish infrastructure, operating-system and application responsibilities. Triage does not add application management or a restoration guarantee. The support terms and completed schedule govern contact and escalation; the DPA governs personal-data breach duties. After recovery, the customer must perform the application and business-data checks assigned to it.

4. Changes and exit

Changes to scope, access, suppliers or chargeable work require the applicable contract and DPA process. On exit, Novasean must provide the agreed handover information and fulfil applicable switching duties. Customer credentials and access must be handed over, changed or revoked as appropriate without compromising another customer or retaining unnecessary access.