MSSP and Partner Terms

1. Roles

• The partner contracts with its customer and is the controller of the data it places in the platform for that customer.
• Eresus is the processor for that data, under the Data Processing Addendum, unless a separate agreement says otherwise.
• The partner is responsible for the lawfulness of its processing and for its own notices, bases, and authorizations.

2. Authorization for every target

Before the partner scans a downstream customer’s system, the partner must hold written authorization from that customer for the named targets, exactly as the Responsible Scanning Policy requires of any customer. The partner obtains and retains that authorization; Eresus does not verify it target by target, and the partner is solely responsible for it.

3. Tenant and data separation

• The partner keeps each downstream customer’s data in a separate tenant or workspace and does not combine two customers’ assessment content in one tenant.
• The partner must not attempt to access another customer’s tenant, and must not use one customer’s data to assess another.
• Where the partner operates a multi-customer view, that view must not cross the tenant boundary unless every affected customer has authorized it in writing.

4. Entitlement and use

• Partner use is limited to the entitlements, seat counts, and regions purchased. The partner does not exceed them or share credentials across personnel.
• The partner may not resell, sublicense, or white-label the platform beyond the terms of the partner agreement.
• The partner does not remove, obscure, or alter proprietary notices, and does not reverse engineer the platform except as permitted by law.

5. Support and escalation

• The partner provides first-line support to its own customers. Eresus provides second-line support to the partner under the Support and Service Levels terms, not directly to the downstream customer unless the partner agreement says otherwise.
• Where the partner agreement includes a service level to the downstream customer, the partner is responsible for it. Eresus support targets are a floor for the partner and do not automatically create an obligation to the downstream customer.
• For a security incident affecting personal data, the partner notifies Eresus at security@eresussec.com without undue delay, and the coordination process in the Data Processing Addendum applies.

6. Security obligations

• The partner protects its access with strong authentication, including single sign-on where available, and keeps personnel access to least privilege.
• The partner notifies Eresus promptly of any suspected compromise of its access or of a downstream customer’s data.
• The partner does not use the platform to attack a third party or to conduct testing outside an authorized scope.

7. Branding and references

The partner may describe itself as an authorized Eresus partner only as the partner agreement allows. Neither party names the other’s customers publicly without written permission, and the partner does not make claims about Eresus certifications or capabilities beyond what Eresus publishes.

8. Suspension and termination

• Eresus may suspend a partner or a downstream tenant that breaches these terms, that scans without authorization, or where continued use risks the security or availability of others.
• On termination, the partner exports and removes its customers’ data as agreed, and the return-and-deletion provisions of the Data Processing Addendum apply.

9. Governing law

These terms are governed by the laws of the Republic of Türkiye, and the parties submit to the competent courts of the Republic of Türkiye at the forum named in the order; failing that, the courts that have jurisdiction under Turkish law, unless the partner agreement names a different governing law and forum.