Enterprise Secure — program catalogue and terms

1. Why Enterprise Secure exists

Large merchants, chains and holdings need more than “store hosting”: clear shared responsibility, an Incident path, evidence for diligence/NIS2-oriented operations, and optional insurance-process support.

Enterprise Secure is a program layer added to the IoneShop Platform:

The full Secure pack is typically offered with the Enterprise plan; individual modules may be added to Platform (per Order Form).

2. Shared responsibility (legal safety anchor)

3. Cyber Protection Program (CPP)

Product promise: the Platform is maintained under protection adequate to multi-tenant SaaS risk.

Scope (examples):

• baseline hardening and patching of Platform components,
• segmentation / tenant isolation,
• Provider-layer security monitoring,
• notices of material vulnerabilities affecting the Service,
• review of critical sub-processors.

Out of scope:

• hardening Customer laptops / AD / office network,
• Customer store pentest on demand without separate SOW,
• breach-free guarantee.

Deliverables: control overview (security overview), status/Incident channel, periodic report if in Order Form.

4. Incident Response (IR)

Product promise: when something goes wrong on the Platform — someone answers, there is a playbook and communication.

Scope:

• escalation point (hours and P1/P2 per Secure SLA),
• Platform Incident triage (availability / security),
• Provider-side containment (isolation, Platform secret rotation, abuse blocks),
• notification timeline to Customer (and support for Art. 33/34 when Provider = processor),
• post-incident review (PIR) within contractual deadline.

Out of scope:

• IR for the Customer’s entire organisation (Customer SOC),
• malware removal from Customer user endpoints,
• guarantee of sales / GMV recovery.

Legal principle: IR is delivered with due professional care; it is not a guarantee of outcome (“zero harm”).

5. Cyber Risk Assessment (CRA)

Product promise: once per period (e.g. quarter / year) — workshop + report: what sits on the Platform side, what on the Customer side, where configuration gaps exist.

Scope:

• questionnaire + review of IoneShop configuration (roles, SSO, webhooks, domains, integrations),
• shared-responsibility matrix tailored to the Customer,
• recommendation list (priority / effort),
• optionally: support with procurement / NIS2 readiness questionnaires for the Platform (not legal opinion on Customer’s NIS2 status).

Out of scope:

• ISO/SOC certification,
• counsel opinion on Customer’s NIS2 applicability,
• assessment of entire IT supply chain beyond agreed scope.

Legal principle: CRA is advisory. Customer accepts residual risk decisions.

6. Forensics Support (FS)

Product promise: on suspected breach — we do not erase traces: Platform logs are preserved within the retention window and we cooperate with forensic firms.

Scope:

• preservation of Platform logs/artefacts within Provider control,
• export in agreed format (best effort),
• cooperation with forensic firm chosen by Customer or from preferred list,
• chain-of-custody description on Provider side.

Out of scope:

• full examination of Customer endpoints / cloud,
• acting as court expert without separate agreement,
• guarantee of admissibility in specific proceedings.

Fees: hours beyond pack — per Order Form rate card; P1 priority may have higher rate.

7. Incident Cover Assist (ICA) — insurance-process support

Incident Cover Assist means support around the insurance process and Incident documentation — not an automatic policy or indemnity payment by the Provider.

The Provider is not an insurer. ICA is operational and documentation assistance; policy terms are governed solely by the Customer’s insurer (or partner named in the Order Form).

Variants (selected in Order Form):

1. ABSGROUP INC. is not an insurance undertaking unless the Order Form expressly states otherwise in writing.
2. Insurer denial does not create Provider liability beyond Enterprise Terms Section 14 limits (Secure sub-cap: 100% of Secure fees / 12 months).
3. Customer must maintain its own insurance adequate to its risk if compliance requires it — Secure does not replace it.

8. Packaging

Pack names in Order Form may be customised; scope always = SOW checklist.

9. Limits, exclusions, Provider security

1. Secure liability: sub-cap in Enterprise Terms Section 14 — 100% of net Secure module fees in the 12 months preceding the event (unless Order Form differs).
2. Exclusions: Customer / Customer staff fault, lack of IR cooperation, unapproved tests, Force Majeure, third-party actions outside Provider control.
3. Customer must not publish that “IoneShop guarantees our NIS2 compliance” or “we are insured by IoneShop” unless ICA-Facility and policy wording allow it.
4. Secure does not authorise public penetration tests of the Platform without written consent (window, scope, NDA).

10. How to buy

1. Demo / Secure scope workshop.
2. Order Form: pack + Capacity Band + SLA + DPA.
3. Kick-off: IR contacts, channels, log retention.
4. First CRA within T+30/90 days (if in pack).

Contact: [email protected]

11. Related documents

*IoneShop Enterprise Secure 1.1-secure. Not legal advice or an insurance policy.*