MSA Version Archive

Version 1.3

Operative from 16 August 2026 to 30 November 2026.

View the full text of version 1.3 →

Summary of the changes made by version 1.4:

(a) Schedule 4, paragraph 6 (Sub-processors) restated in full. The previous paragraph required thirty (30) days' notice before engaging any new or replacement sub-processor, with no exception. That obligation could not be performed in the circumstances where a change is most likely to be necessary — a security incident, the failure of an existing supplier, or a disaster-recovery event requiring the Service to be restored onto different infrastructure. Paragraph 6 now distinguishes standard changes (paragraph 6.2, thirty days' notice, unchanged) from expedited changes (paragraph 6.3), which may take effect immediately on four defined grounds: security, continuity following supplier failure, disaster recovery, and legal compulsion. An expedited engagement must be notified within five (5) Business Days and the Customer's right to object is expressly preserved from the date of that notice.

(b) Disaster-recovery provisions added (paragraph 6.3.1). The Provider may engage a provider not listed in the Schedule, selected at the time on the basis of availability and suitability, and may do so on an interim basis before migrating to a permanent platform. The Provider must use reasonable endeavours to keep processing within the United Kingdom or the European Economic Area, and may process outside those territories only where no suitable alternative is reasonably available and an appropriate transfer mechanism is in place. Interim engagements that become permanent are added to the sub-processor list. Paragraph 5 of Part A of Schedule 1 has been cross-referenced accordingly.

(c) Sub-processor obligations and Provider liability added (paragraph 6.6). The Provider must impose data protection obligations on each sub-processor that are no less protective than those in Schedule 4, and remains fully liable for each sub-processor's performance. These terms are required by Article 28(4) of the UK GDPR and were absent from previous versions.

(d) Objection procedure and current-list obligation stated expressly (paragraphs 6.4 and 6.7).

(e) Sub-processor list corrected. Microsoft Corporation has been added: it delivers transactional and notification email via Microsoft Graph, and provides hardware-security-module key wrapping via Azure Key Vault, which processes no personal data. Cloudflare's stated purpose has been corrected — it no longer refers to a Workers runtime, which is no longer used, and it now discloses that Cloudflare provides object storage of Customer documents, evidence files and backup archives, held under a European Union jurisdiction restriction, which previous versions did not state. OpenAI OpCo, LLC has been added: it provides large language model inference for the Provider's vendor-intelligence service, which supports the TPRM Module and the vCISO Module by analysing public-source information about vendors and threats, and it does not receive content entered into or uploaded to the Core Platform. Anthropic's stated location has been corrected to the United States; the previous wording referred to EU routing, which the Service does not use. Hetzner and Stripe are unchanged.

(f) Clause 17.2(d) cross-referenced to Schedule 4. Clause 17.2(d) previously treated sub-processor additions as taking effect immediately upon publication, which conflicted with the notice period in Schedule 4. It now defers to paragraph 6 of Schedule 4, so a single provision governs sub-processor changes.

(g) Encryption statements made specific (Schedule 2, paragraphs 7 and 8; Schedule 4, paragraph 5(c)). Previous versions referred to encrypted backups and to encryption at rest without saying what is encrypted. They now state it: Customer documents, evidence files and backup archives held in object storage are encrypted at rest by the storage provider, and stored integration credentials are encrypted at application level. Encryption in transit is unchanged.

Version 1.2

Operative from 11 August 2026 to 15 August 2026.

View the full text of version 1.2 →

Summary of the changes made by version 1.3:

(a) vCISO added as an Add-On Module, bundled with TPRM. A new definition of “vCISO Module”; the definition of “Add-On Module” restated to identify the TPRM Module and the vCISO Module as the Add-On Modules available, licensed together as a single bundle; the definition of “TPRM Module” cross-referenced to that bundle; a sentence added to clause 6.7 providing that a bundle of Part B modules is treated as a single Add-On Module charged at a single fee; a new paragraph 8 of Schedule 1 Part B describing the vCISO Module; and a new paragraph 9 of that Part governing the licensing of the two modules together, as an addition to the Core Platform or on a standalone basis.

(b) What the vCISO Module covers. Paragraph 8 records that the Module assesses only the estate the Customer has declared in the estate register, so undeclared or inaccurately declared components are not assessed and appear in no output; that maintaining that declaration is the Customer's responsibility; that forecasts are predictive and are not a representation that any event will or will not occur; and that the Module supports the Customer's security function rather than replacing it, its outputs being decision-support information and not professional security, legal or regulatory advice.

(c) External and third-party information addressed in one place, across the whole Service. New clause 11.6 applies wherever the Service presents, matches against or derives output from information obtained from external sources — public and statutory registers such as company registries, tax and VAT registers and data-protection, certification and scheme registers; credit and financial data providers; sustainability and vendor-rating providers; vulnerability, exploit and threat-intelligence feeds; security advisories; news and media reporting; and information a third party publishes about itself — and applies to the Core Platform as well as to every Add-On Module. It records, at (a) to (e): that source coverage is selective rather than exhaustive and the Service is not a complete record; that the Provider prefers sources it considers established and credible but that this is a statement of practice and not a warranty, does not independently verify all such information, and that the information may be inaccurate, out of date, retracted, contested as to attribution or affected by the publisher's editorial bias, national perspective or commercial interest, with derived scores and ratings being opinions rather than statements of fact; that no commitment is given as to how quickly information published at source becomes available, or how often a source is refreshed, and that the Service is not a real-time, monitoring, detection, alerting or incident response service; that the absence of a finding is not assurance that nothing exists and may not be relied upon or represented to a third party as such; and that where an output looks inconsistent with what the Customer knows, or would be material to a decision, the Customer should check it against the underlying source before acting, in addition to the human review already required by clause 11.4.

These consequences already followed from clauses 11.3(b), 11.3(c), 11.3(d) and 11.3(e), from clause 11.4 and from Schedule 2, which between them disclaim accuracy, completeness, fitness for the Customer's requirements and AI-generated output, place reliance on the Customer, and give no commitment as to timing. Clause 11.6 states them expressly, and in terms specific to externally sourced information, rather than leaving them to be inferred. It is therefore a clarification under clause 17.2(d).

(d) Sub-processor change carried into the source. The replacement of Supabase, Inc. with Hetzner Online GmbH in the Schedule 4 sub-processor table, made under Schedule 4 paragraph 6 while version 1.2 was in force, now forms part of the document text rather than being applied on publication. The archived version 1.2 linked above records the document as published, including that change. No wording is altered by carrying it across.

(e) No other change. All other terms of version 1.2 are carried forward unaltered.

Adding an Add-On Module, and bundling it with an existing one at no separate fee, is an expansion of the Service that removes no right and imposes no new obligation. It is therefore a non-material change under clause 17.2(d), so version 1.3 takes effect on publication.

Version 1.1

Published 6 August 2026 with an effective date of 6 September 2026. Superseded by version 1.2 before it took effect, so it was never the operative version.

View the full text of version 1.1 →

Summary of the changes made by version 1.2:

(a) Two frameworks added. Schedule 1 paragraph 2 now states twenty-nine (29) frameworks rather than twenty-seven (27), adding the Digital Operational Resilience Act (Regulation (EU) 2022/2554) and HIPAA (Security, Privacy and Breach Notification Rules). Both now ship with a dedicated content set — DORA with 46 mapped controls, 18 document templates and 56 assessment questions; HIPAA with 67 controls, 18 templates and 54 questions — together with training courses. Version 1.1 omitted them because that content did not exist when it was drafted.

(b) No other change. The Add-On Module and TPRM provisions introduced by version 1.1 (definitions, clauses 2.2, 2.3 and 6.7, and Schedule 1 Part B) are carried forward unaltered.

Adding framework coverage is an expansion of the Service and therefore a non-material change under clause 17.2(d), so version 1.2 takes effect on publication.

Version 1.0

Operative from 1 May 2026 to 5 September 2026.

View the full text of version 1.0 →

Summary of the changes made by version 1.1:

(a) Third-Party Risk Management separated as an Add-On Module. New definitions of “Core Platform”, “Add-On Module” and “TPRM Module”; the definition of “Service” restated as the Core Platform together with any Add-On Module identified in the Order Form; clauses 2.2 and 2.3 scoped accordingly; new clause 6.7 governing Add-On Module fees, pro-rating and independent renewal; and a new Part B of Schedule 1 describing the TPRM Module, which may be taken as an addition to the Core Platform or on a standalone basis.

(b) Compliance framework coverage restated. Schedule 1 paragraph 2 previously referred to nineteen (19) frameworks in a single undifferentiated list. It now states the twenty-seven (27) frameworks that have their own dedicated content set — controls library, assessment questions and document templates — and separately identifies ISO/IEC 27002, CCPA and US state privacy law, the FCA Handbook (relevant sections), ISO 9001 and the NIST AI Risk Management Framework, which are addressed through mapped controls, guided assessments and document templates delivered within those frameworks and the guided assessment library rather than as separate framework programmes. Coverage of these is unchanged in substance; only its description is now accurate. Two frameworks named in version 1.0 — DORA and HIPAA — are no longer named, as the Service does not currently deliver a control, assessment or template set for either (HIPAA is addressed in training content only). The paragraph also notes that the IASME MSP scheme remains under development and records the dedicated EU AI Act and Provision 29 modules.

(c) Core vendor capability made explicit. Schedule 1 paragraph 3 now records the vendor register and questionnaire-based vendor assessments included in the Core Platform, and distinguishes them from the continuous vendor intelligence provided by the TPRM Module.