GlacierPoint Scan MSP Addendum
Version 2026-10-23, effective 23 October 2026.
This addendum is part of the agreement between GlacierPoint Technologies LLC ("we", "us") and a managed service provider that uses GlacierPoint Scan on the MSP Plan for its clients' Environments ("you"). It adds to the Terms of Service and the Data Processing Addendum (DPA), and words defined there mean the same here. A "client" is an organization whose Environment (an Active Directory domain, a Microsoft 365 tenant, or the two linked) you enroll in your workspace. You stay our customer for every client Environment: we contract with you and bill you, not your clients. GlacierPoint Snapshot's MSP Addendum is the family's master text; this one says the same with GlacierPoint Scan's nouns (owner, 2026-10-13).
1. Acceptance and precedence
1.1 You accept this addendum, by name and version, when you buy the MSP Plan or ask us to activate it. At the online checkout an unticked box beside the pay button reads: "By checking this box and selecting Pay, I confirm that I am authorized to bind [LEGAL ENTITY NAME], and that it agrees to the Terms of Service, version [VERSION]. For an MSP plan, it also agrees to the MSP Addendum, version [VERSION]." Under it: "The purchasing MSP agrees to the MSP Addendum, version [VERSION], incorporated into the Terms of Service. I confirm that I am authorized to bind the MSP." Each version named is linked. Where the MSP Plan is set up by invoice or activated by us, you accept this addendum with the "Accept and request activation" step on the Billing page, which shows the same words and records the same, before we activate the Plan. We record the words shown, the versions and links of both documents, the time you ticked the box, your account, your address and the entity you bound, and the order email you receive names the versions. An MSP that bought before this addendum existed, or before a new version of it, accepts it in the same way at its next engagement, new functionality or renewal; a service already contracted is not cut off. The addendum is not signed. A separate written agreement signed by both of us prevails over it where they conflict (Terms 23). (Lawyer's language of 2026-10-22, adopted 2026-10-23.)
1.2 This addendum says how the Terms apply to your clients' Environments. Where the two differ on a client Environment, this addendum governs; a signed DPA governs the processing of personal data (DPA 13.1).
2. Your clients' authorization
2.1 Client authority. Before accessing or processing a client environment through a Product, the MSP must hold current written authorization from that client, given by an authorized representative, identifying the environment and the applicable Product and authorizing the material activities described in the versioned Product service description supplied to the client. That authorization must expressly cover, as applicable: collection, transfer, storage, retention, and disclosure of client and workforce information; designated email recipients; installation and operation of software; app registrations, administrative consents, standing permissions and their removal; backups and restores; approved tenant configuration changes and creation or modification of Group Policy Objects; report preparation and delivery; and separately scoped security testing and required infrastructure-provider permissions. Authorization of an assessment does not by itself authorize remediation, restore, or penetration testing. The MSP must obtain separate approval for materially different or expanded activities, keep evidence of authority, and provide reasonably necessary evidence to GlacierPoint on request, with unrelated confidential information redacted. The MSP must promptly notify GlacierPoint of any restriction or withdrawal and cease affected instructions.
The MSP is responsible for loss to the extent caused by its instructions exceeding that authority. Subject to the agreement's defense procedures and liability provisions, the MSP will defend GlacierPoint against third-party claims and indemnify it for resulting damages, reasonable settlements, and reasonable defense costs to the extent caused by the MSP's breach of this authorization warranty. This does not cover loss to the extent caused by GlacierPoint exceeding the MSP's authorized instructions or by GlacierPoint's negligence, gross negligence, fraud, or willful misconduct. GlacierPoint may suspend affected activity on a credible authority dispute while preserving applicable contractual rights.
The versioned Product service description is the authority matrix attached to this addendum (msp-authority-matrix.md, version 2026-10-23), one row per GlacierPoint product; the Scan row names the assessment reads, the remediation writes to a tenant and the Group Policy Objects created in a domain, each as an approved Remediation Plan describes, and says that the authorization of an assessment does not authorize remediation. The statement you tick when you add a client's Environment to your workspace records your confirmation for that Environment (Terms 7.2); each Remediation Plan is approved separately with the client's authority for that plan (Terms 11.5). (Lawyer's language of 2026-10-22, adopted 2026-10-23; the clause is written in the memo's words, "the MSP" and "GlacierPoint", so that it reads the same in every product's addendum.)
2.2 Keep that authorization while the Environment is enrolled in your workspace, and show it to us when we ask: for example when a client, an administrator of the Environment or an authority questions it, or when we have another reasonable concern about an Environment. Until you do, Terms 19.1 applies (suspension where we reasonably believe there is unauthorized assessment or change).
2.3 When a client's authorization ends or is narrowed, stop using GlacierPoint Scan on that Environment beyond what the authorization still allows, and hand the Environment over or remove it as section 6 says.
3. Roles under the DPA
3.1 For a client's Environment, the client is the controller of the personal data in its Evidence, Reports and Remediation Plans, you are its processor, and we are your subprocessor, as DPA 2.1 says. You confirm that the client has authorized you in writing to use us and the subprocessors on our provider list.
3.2 We take instructions from you, not from your clients, and you relay theirs (DPA 2.1). The one exception is a dispute under section 6.2.
3.3 You pass on to each client the information and notices the DPA gives you that concern it, including a change to our provider list (DPA 6.2) and the notice of a Personal Data Breach that affects its Environment (DPA 7).
4. Billing per Environment
4.1 The MSP Plan is bought per client Environment, for 12 months, at the price the pricing page, the checkout or your invoice shows (at the date of this version, US$399 a year per Environment, before tax; Terms 8.2). Each client Environment is a separate Environment for fees and Plans (Terms 2.2); a linked domain and tenant are one Environment (Terms 3).
4.2 Paid online, the Plan renews only if you turned renewal on, with the reminders and the switch Terms 8.4(a) describes. Paid by invoice, it runs to its end date and renews by a new invoice (Terms 8.4(b)).
4.3 Removing an Environment from your workspace is refused while its paid term runs; you may end access at the end of the term instead (Terms 8.4(c), 19.2). Canceling is not a refund (Terms 9).
5. Reports and exported scripts for your clients
5.1 You may give a client the Reports and the remediation plans, receipts and exported scripts made for that client's Environment, for the client's own administrators to read and, for a script, to run on the client's own computers, on that Environment only. You may not give them to anyone else, or give a client anything made for another client's Environment.
5.2 Pass them on as they are, with a script's header and a Report's closing notice. Whoever runs an exported script directs the changes it makes and must be authorized to make them in that Environment (Terms 11.1 and 11.3); a script that someone edited is run at the risk of whoever edited it. A Report names people (administrators, accounts, hosts): hand it over securely.
5.3 After your Plan or your engagement with the client ends, the client may keep what you gave it as Terms 19.2 allows for Reports, on that Environment only; this addendum gives the client nothing more.
6. Moving an Environment, and disputes with a client
6.1 An Environment's Reports do not move between workspaces. To move an Environment to the client's own workspace or to another provider, the new workspace enrolls the Environment and runs its own assessment. Before you remove the Environment from your workspace, download the Reports the client needs and hand them over as section 5 says. Removal deletes the Environment's Reports, Evidence, Remediation Plans and collector pairings from our systems; the copies in our encrypted backups leave within the periods the Privacy Policy states (Terms 19.2).
6.2 If you and a client disagree about an Environment, for example about who may assess it or whether its Reports are kept or deleted, we act on the written instruction of the Environment's administrator of record: a person who holds the Global Administrator role in that tenant, or is a member of Domain Admins in that domain, and shows us so in a way we can check. That instruction can be to remove the Environment from your workspace. We do not hand a Report's contents to anyone ourselves: the console our operators use shows no Report contents, Evidence or remediation values.
6.3 The fees for an Environment are yours while it is enrolled in your workspace (section 4); a dispute between you and a client does not change them.
7. What you pass on to your clients
7.1 Before you enroll a client's Environment, tell the client, in your agreement with it, at least: that GlacierPoint Scan collects the Environment's security configuration and directory information, which names people (Terms 4, Privacy Policy 5); what a Remediation Plan does, that direct settings take effect immediately, that Group Policy Objects are created unlinked, and that a rollback may not fully restore the prior state and is not a substitute for backups (Terms 11); where its data is kept and by whom (our provider list); and the terms of the DPA that concern it (section 3).
7.2 Bind the client, and the administrators who use what you give them under section 5, to the restrictions of Terms 5.2 and the acceptable use rules of Terms 12.
7.3 Do not promise a client more than the Terms give you: no promise of a complete assessment, no promise that a change will have the effect described or that a rollback will succeed, no level of availability, no certification and no endorsement by Microsoft (Terms 13, 15 and 16).
7.4 Every member of your workspace sees every Environment enrolled in it. Do not invite a client's staff into a workspace that holds other clients' Environments. Each member accepts the Terms in their own name when they join (Terms 1.2), and you remove members who no longer work for you or for the client (Terms 6.2).
8. Responsibility and survival
8.1 You answer to us for your clients' Environments as for your own (Terms 2.2), including the warranties of Terms 7 and the indemnity of Terms 18 for an Environment assessed or changed without its owner's authorization, as section 2.1 allocates it. This addendum adds no cap of its own: the limits of Terms 17 apply to it and the Terms together.
8.2 We have no contract with your clients and give them no warranty. Nothing in this addendum gives a client rights against us beyond those the law gives (Terms 23).
8.3 Sections 2.1, 2.2, 5, 6 and 8 survive the end of the MSP Plan as far as a client's exit and amounts already owed need them.
Attachment: MSP Addendum, Attachment: the authority matrix (service description, version 2026-10-23)
The versioned service description that a client's written authorization to its managed service provider incorporates under MSP Addendum 2.1. For each GlacierPoint product the client's authorization must expressly cover the acts in its row. The MSP keeps the client's authorization and furnishes it on request. A new version of this attachment is published with notice; an authorization given on an earlier version covers the acts that version listed.
Common to every product: the MSP installs and operates the product's software for the client's environment; the product collects the client's configuration and directory information as the product's Terms and Privacy Policy describe, transfers it over encrypted connections to the product's portal hosted by GreenCloud in the United States, keeps it for the retention periods of Terms 10.6, copies it encrypted to Backblaze for backup, and shows it to the MSP's users and to the client's users the MSP invites; the MSP may give the client the reports and exports made for that client's tenant; the subprocessors of the product's provider list act for GlacierPoint; operational notices go to the addresses the MSP designates for the client, including the client's own staff, under the product's operational-contact terms; workforce information in reports is the client's to give notice of to its staff.
| Product | What the product reads | What it writes or holds in the client's tenant (each with the MSP's typed confirmation) | Product-specific acts the authorization must name |
|---|---|---|---|
| Snapshot | The tenant's Microsoft 365 configuration (Entra, Exchange, SharePoint, Teams, Intune, security settings) for backup | Changes applied to the tenant through a restore or rollback the MSP approves; the one-time setup's app registration for scheduled backups; the sign-in registration the app creates on first sign-in | Backups kept hosted or in a local vault; restore scripts prepared for the tenant, which the MSP may give the client; comparison and change alerts |
| Scan | The tenant's and the Active Directory domain's security configuration for assessment | Remediation writes to the tenant and Group Policy Objects created in the domain, each operation as an approved Remediation Plan describes, recorded with a best-effort rollback; the collector's own registration for sign-in | Authorization of an assessment does not authorize remediation; each Remediation Plan is approved separately by the MSP with the client's authority for that plan |
| Remind | The names and expiry dates of the tenant's credentials (app registration secrets and certificates, enterprise application certificates, Intune tokens, domain and mail DNS records, Conditional Access references, directory synchronization); never a credential's value | The sign-in registration the app creates on first sign-in (read permissions, no credential); the scheduled-run registration (its service principal, admin consent for seven read permissions, a certificate's public part), each set up, renewed or removed only with the typed confirmation | Warning emails before each expiry to the addresses the MSP enters, including the client's staff; DNS lookups of the client's domains through public resolvers from the computer running the app |
| Ledger | The tenant's licenses, accounts and sign-in times; Microsoft's published list prices | The sign-in registration the app creates on first sign-in (five delegated read scopes, no credential) | Reports that name the client's employees with last sign-in and flag stale or never-activated accounts; the client gives its staff the required notices and reviews before removing a license or access; no use for employment decisions |
| Atlas | The tenant's configuration and its administrators for documentation | The sign-in registration the app creates on first sign-in; the scheduled-run registration holding a standing grant of Global Reader and Exchange.ManageAsApp, each set up, renewed or removed only with the typed confirmation | Scheduled documents naming administrators, kept up to 730 days; the Word export the MSP edits and delivers to the client as its own; "new document" mails to the addresses the MSP enters; DNS lookups through public resolvers |
| Probe | The targets of a signed scope: internal hosts and services from a collector inside the client's network; the client's proven public assets from GlacierPoint's scanner | Nothing in a tenant; traffic sent to the listed targets within the signed scope only; a low-privilege directory read with an account the client supplies for an authenticated engagement | Separately scoped penetration testing: the client's written authorization names the environment, the targets, the techniques and intensity, the window and the exclusions, and the permissions of hosting and cloud providers; an authorization to manage IT or to run another product does not authorize testing; the MSP's operator accepts the engagement statement for the named client |
An MSP that holds a client's authorization for one product does not thereby hold it for another: each product the MSP runs for a client is named in the authorization with its row.