Ongoing Monitoring — Service Terms

What the Monitoring service checks, what it deliberately does not do, and how it is authorised, notified and billed; these terms accompany the Service Agreement (Document 03).

1. What is monitored

1.1. Verfend performs scheduled, non-intrusive checks on the agreed assets listed in Annex A (Document 02), covering:

• availability and reachability;
• TLS certificate validity and expiry;
• exposed services and security-relevant HTTP headers;
• known-vulnerable components (version / CVE indicators);
• change detection on monitored endpoints.

1.2. Checks run on a weekly schedule (frequency to confirm). Results that warrant attention are reviewed by a person before any notification is sent, so you receive reviewed notifications rather than raw alerts.

1.3. Anything confirmed is recorded as a finding with a finding ID and rated Critical / High / Medium / Low using CVSS v3.1, consistent with the main service.

2. What Monitoring is not

2.1. Monitoring is not a security operations centre (SOC) and not real-time intrusion detection or incident response.

2.2. It does not observe internal traffic, endpoints or logs, and does not act on your behalf during an incident.

2.3. It gives no guarantee of detection: scheduled external checks can miss issues that arise or are resolved between runs. It complements, and does not replace, your own security measures.

3. Notifications & response times

3.1. Notifications are sent through email / the agreed channel to the Client's named contact.

3.2. Indicative review and notification targets, during business hours (09:00–18:00, America/Recife, UTC−3, Mon–Fri excluding Brazilian public holidays):

• Critical / High: notified within one business day of a reviewed check;
• Medium / Low: summarised in the monthly review.

3.3. These are notification targets, not guaranteed detection or remediation times.

4. Client duties

4.1. The Client keeps the monitored assets list current and informs Verfend in advance of material changes (new hosts, migrations, decommissioning, or a change of hosting/cloud provider).

4.2. The Client maintains a reachable named contact and confirms that its hosting/cloud provider's terms permit scheduled non-intrusive checks, obtaining any separate consent the provider requires.

5. Authorisation continuity

5.1. Monitoring operates under a standing authorisation limited to non-intrusive checks on the listed assets only, recorded by the tick-box in the Authorisation to Test (Document 04, §4).

5.2. The standing authorisation does not permit exploitation, intrusive testing, or testing of any asset not listed. Such work is scoped and authorised separately (Validate / Assess / Resolve).

5.3. Either party may narrow or pause the authorisation in writing at any time.

6. Data handling

6.1. Check results, evidence and Client data are stored encrypted and kept confidential, consistent with the Service Agreement (Document 03, §6 and §12) and the LGPD (and GDPR where EU data subjects are involved).

6.2. Personal data is redacted in notifications and reports wherever possible.

7. Term, billing & cancellation

7.1. Monitoring runs on a rolling monthly term and is billed monthly in advance (see the Payment Terms, Document 13).

7.2. Either party may cancel with 30 days' written notice; no refund is given for the current paid period.

7.3. Verfend may suspend Monitoring for non-payment after 7 days' written notice; suspension pauses checks and notifications until the account is settled.

Verfend · Independent Security Operations · email · website · Document 10 v1.0 · date