This MSP Partner Agreement applies where the Customer is a managed service provider, reseller or similar intermediary ("MSP") procuring the Fig Services to provide managed compliance, security or risk-management services to its own end-user customers ("End Customers"). For new MSP platform orders, it's incorporated into the accepted Order Form, the Master Services Agreement and the MSP Subscription Agreement. Existing signed MSP agreements retain their agreed terms unless changed under their amendment procedure. For MSP-specific matters, this Agreement prevails over the Master Services Agreement. The accepted Order Form controls commercial terms it expressly overrides, and mandatory data-protection obligations in the Data Processing Agreement prevail for their subject matter. Nothing here excludes a liability that cannot lawfully be excluded.
1. Right to provide the Fig Services to End Customers
Fig grants the MSP a limited, non-exclusive, non-transferable right to provision End Customers onto the Fig Services, install the Fig Software within their environments, operate a Direct Integration with each End-Customer environment, and use Output to deliver managed services - provided the MSP doesn't sub-license, white-label or resell the Fig Services beyond this, doesn't provide access to a Fig competitor, and doesn't remove Fig's branding.
2. Onboarding and de-provisioning End Customers
Each End Customer is added by the MSP submitting a completed End-Customer Order Form (using the End-Customer Order Form provided separately by Fig) via Fig's Trust Centre or in writing, providing the End Customer's details, size and framework selection, technical contact, and confirmation that an End-Customer Agreement (below) is in place. Fig provisions the environment and any Direct Integration in line with the Service Level Agreement, and may decline to onboard an End Customer that's a Fig competitor, subject to sanctions, or otherwise poses a legal or security risk. Fig currently provisions End-Customer environments centrally; it may, on 30 days' notice, delegate some or all of this to the MSP. When an End Customer relationship ends, the MSP must notify Fig within 5 Business Days, stop providing the Fig Services to that End Customer, and ensure the Fig Software is removed and the End Customer's data is handled in line with the End-Customer Agreement.
Fig may update its standard pricing, partner pricing, discount structures and packaging for new End Customers from time to time. Unless otherwise stated in the applicable Order Form, updated prices apply only to End Customers onboarded after the effective date of the pricing change, and don't change Fees already agreed for existing End Customers during their then-current subscription term.
3. Required terms in the MSP's End-Customer Agreement
The MSP must have a written agreement with each End Customer, before providing the Fig Services to it, that at minimum:
- limits the End Customer's use to its own internal purposes, with no onward resale;
- includes restrictions on the Fig Services equivalent to those in the Master Services Agreement;
- records the End Customer's authorisation for Fig to install software and perform scanning, monitoring and reporting on its systems;
- confirms the End Customer is the Controller of its own personal data, that the MSP and Fig act as Processor/Sub-processor as applicable, and that Fig may sub-process and transfer personal data internationally on the terms of the Data Processing Agreement;
- records the End Customer's agreement to the scope of any Direct Integration between its environment and the MSP's;
- confirms the End Customer has no direct contractual relationship with Fig beyond the limited rights described in section 5 below, and will direct support and service issues to the MSP, not Fig;
- includes a liability cap and exclusion of indirect losses, and an obligation on the End Customer to indemnify the MSP for matters the MSP is required to indemnify Fig for, where caused by the End Customer;
- specifies clearly the scope of services the MSP is contracted to provide (since the MSP's authority to use the Fig Services for that End Customer is limited to that scope); and
- where the MSP uses the Vulnerability Scanner against the End Customer's assets, includes the End Customer's written authorisation as required by the Product-Specific Terms.
Fig should be named as a third-party beneficiary of these terms, entitled to enforce them directly. Fig may ask, on reasonable request, for a redacted copy of an End-Customer Agreement (commercial terms redacted) to confirm compliance.
4. Direct Integrations and Cross-Customer Integrations
Where the Fig Services support it, the MSP's environment may be directly integrated with an End Customer's environment ("Direct Integration"), or with another Fig customer's environment ("Cross-Customer Integration"). Cross-Customer Integrations are included as a standard platform capability where technically available. Fig provisions the technical connection centrally, but the MSP and the other customer must specifically authorise its scope, permissions, data access and any required data-protection arrangements before activation. Inclusion does not itself provide consent to access another customer's data. Fig remains responsible for its own obligations under the Data Processing Agreement. Fig may suspend or disable an integration where it reasonably believes continued operation poses a material security, legal or regulatory risk.
5. No privity between Fig and the End Customer
Fig has no contractual relationship with an End Customer and makes no commitment to an End Customer, except that: Fig owes each End Customer, as a third-party beneficiary, the Data Processing Agreement obligations that apply to that End Customer's personal data, and Fig may communicate directly with an End Customer's technical contact for data-breach notification, urgent security advisories, or where the law requires it. Beyond this, the End Customer has no right to enforce any term of the Master Services Agreement or this Agreement against Fig - including Service Levels, which Fig owes to the MSP only. Any commitment the MSP gives an End Customer (service levels, warranties, indemnities, and so on) is the MSP's own commitment, not Fig's.
6. MSP responsibility for End Customers
The MSP is responsible to Fig for its End Customers' acts and omissions as if they were its own - including paying the Fees for End-Customer use, ensuring End-Customer compliance with the restrictions in the Master Services Agreement, and having a valid End-Customer Agreement in place. The MSP indemnifies Fig for claims arising from an End Customer's breach, from a missing or non-compliant End-Customer Agreement, or from a Direct or Cross-Customer Integration, on the terms of the Master Services Agreement's indemnity clause. The MSP must not tell an End Customer that Fig is responsible for something that is, in fact, the MSP's responsibility.
7. Branding and marketing
The MSP may describe itself as a Fig partner or reseller, and use Fig's name and logo for that limited purpose in line with Fig's brand guidelines. The MSP may not white-label the Fig Services as its own unless it has a separate written white-labelling addendum with Fig.
8. Ending the MSP arrangement
Termination of the Master Services Agreement (or of the MSP's right to serve a particular End Customer) triggers the standard termination provisions of the Master Services Agreement in respect of all, or the relevant, End Customers. Fig may (but doesn't have to) offer affected End Customers a direct subscription on Fig's standard terms. The MSP remains solely responsible for the consequences of the termination as between itself and its End Customers.
End-Customer order details
The MSP must record the End Customer’s legal name, contact details, ordered services and authorisation in the applicable End-Customer order. These customer-specific details are recorded separately and are not blank fields in these standard terms.
This document is part of Fig's public legal documentation. It works alongside our Terms of Service, Master Services Agreement, Product-Specific Terms, Data Processing Agreement, Service Level Agreement and Support Policy.