GlacierPoint Remind MSP Addendum
Version 2026-10-23, effective October 23, 2026.
This addendum is part of the agreement between GlacierPoint Technologies LLC ("we", "us") and a managed service provider that uses GlacierPoint Remind on the MSP plan for its clients' Microsoft 365 tenants ("you"). It adds to the Terms of Service and the Data Processing Addendum (DPA), and words defined there mean the same here. A "client" is an organization whose tenant you register in your workspace. You stay our customer for every client tenant: we contract with you and bill you, not your clients.
1. Acceptance and precedence
1.1 The purchasing MSP accepts this addendum at the MSP checkout by ticking a box, unticked by default, immediately beside the statement "The purchasing MSP agrees to the MSP Addendum, version [version] [direct link], incorporated into the Terms of Service. I confirm that I am authorized to bind the MSP." (the bracketed fields are filled at checkout); Pay stays disabled until the box is ticked, and the plan, its total price and the monthly billing terms (Terms 8.4) are shown beside it. An MSP plan paid by invoice or activated by hand is activated only after the same statement is accepted with "Accept and request activation". We record the exact text shown, the versions of the Terms and of this addendum and their links, the tick, the time, the account, the IP address, the MSP named and the authority stated, and the buyer receives a receipt that links those versions. An MSP that bought the plan before this addendum was published accepts it at its next new engagement, new functionality or renewal on these terms; a service already contracted is not cut off for that reason. It is not signed. A separate written agreement signed by both of us prevails over it where they conflict (Terms 23).
1.2 This addendum says how the Terms apply to your clients' tenants. Where the two differ on a client tenant, this addendum governs; the DPA governs the processing of personal data (DPA 13.1).
2. Your clients' authorization
2.1 Client authority. Before accessing or processing a client environment through GlacierPoint Remind, the MSP must hold current written authorization from that client, given by an authorized representative, identifying the environment and GlacierPoint Remind and authorizing the material activities described in the versioned service description of GlacierPoint Remind supplied to the client. That authorization must expressly cover, as applicable: collection, transfer, storage, retention, and disclosure of client and workforce information; designated email recipients; installation and operation of software; app registrations, administrative consents, standing permissions and their removal; backups and restores; approved tenant configuration changes and creation or modification of Group Policy Objects; report preparation and delivery; and separately scoped security testing and required infrastructure-provider permissions. Authorization of an assessment does not by itself authorize remediation, restore, or penetration testing. The MSP must obtain separate approval for materially different or expanded activities, keep evidence of authority, and provide reasonably necessary evidence to GlacierPoint Technologies LLC on request, with unrelated confidential information redacted. The MSP must promptly notify GlacierPoint Technologies LLC of any restriction or withdrawal and cease affected instructions.
The MSP is responsible for loss to the extent caused by its instructions exceeding that authority. Subject to the agreement's defense procedures and liability provisions, the MSP will defend GlacierPoint Technologies LLC against third-party claims and indemnify it for resulting damages, reasonable settlements, and reasonable defense costs to the extent caused by the MSP's breach of this authorization warranty. This does not cover loss to the extent caused by GlacierPoint Technologies LLC exceeding the MSP's authorized instructions or by GlacierPoint Technologies LLC's negligence, gross negligence, fraud, or willful misconduct. GlacierPoint Technologies LLC may suspend affected activity on a credible authority dispute while preserving applicable contractual rights.
The versioned service description is the attachment to this addendum, "Attachment: the authority matrix (service description, version 2026-10-23)", printed after section 8: the client's written authorization incorporates its common terms and the row of GlacierPoint Remind. "The MSP" is you. The statement you tick when you approve an app on the portal's pairing page records your confirmation for each tenant that app registers.
2.2 Keep that authorization while the tenant is registered in your workspace, and show it to us when we ask: for example when a client, a tenant's administrator or an authority questions it, or when we have another reasonable concern about a tenant. Until you do, Terms 19.1 applies (suspension where we reasonably believe there is unauthorized use).
2.3 When a client's authorization ends or is narrowed, stop using GlacierPoint Remind on that tenant beyond what the authorization still allows, remove the scheduled runs you set up in it, and hand the tenant over or have it removed as section 6 says.
3. Roles under the DPA
3.1 For a client's tenant, the client is the controller of the personal data its runs and reports hold, you are its processor, and we are your subprocessor, as DPA 2.1 says. You confirm that the client has authorized you in writing to use us and the subprocessors on our provider list.
3.2 We take instructions from you, not from your clients, and you relay theirs (DPA 2.1). The one exception is a dispute under section 6.2.
3.3 You pass on to each client the information and notices the DPA gives you that concern it, including a change to our provider list (DPA 6.2) and the notice of a Personal Data Breach that affects its tenant (DPA 7).
4. Billing per tenant
4.1 The MSP plan covers your workspace and every tenant registered in it. It is billed monthly in advance, on the 1st of each month: a platform fee for the workspace plus a fee for each tenant registered in the workspace at midnight UTC that day. The fees are those of Terms 8.2; the price you pay is the one the checkout page or your invoice shows.
4.2 Paid online, the first payment covers the rest of the month of purchase, charged by the day for the platform and for the tenants registered at checkout; from then on Stripe charges on the 1st, after the tenants are counted. Paid by invoice, each month is invoiced in advance and the invoice is due within 30 days (Terms 8.3).
4.3 A tenant registered after midnight UTC on the 1st is covered from its registration and first billed on the next 1st. A tenant removed during a month is not refunded for that month (Terms 9.3) and is not counted from the next 1st.
4.4 You cancel a plan paid online on the Settings page, and a plan paid by invoice by writing to sales@glacierpointtech.com. Either way the plan runs to the end of the month already paid or invoiced and is not billed again; amounts already billed remain due. Canceling is not a refund (Terms 9).
4.5 A price change applies from the next month, with at least 30 days' notice (Terms 8.4). A failed payment and the end of the plan are as Terms 8.4 and 8.5 say; when the MSP plan ends, it ends for every tenant of the workspace.
5. Reports and warnings for your clients
5.1 You may give a client the reports and exports of that client's tenant, for the client's own use. You may not give them to anyone else, or give a client anything about another client's tenant. Reports and exports carry the report's closing notice: it says for whom and for what purpose a report is prepared, and that no other person may rely on it for a separate transaction or decision without our written agreement. Pass it on with them.
5.2 You may enter, as warning addresses of a client's tenant or as owners of its items, the addresses of the client's own staff, so that they receive the warnings too. You are responsible for that choice: the client's authorization of section 2.1 must cover it, you tell those people why they receive the mails, and you remove an address when its holder leaves the client or asks you to. Those people are not members of your workspace and cannot open the reports the mails link to. These addresses are customer-designated recipients under Terms 11.7: each warning mail names your organization as the one that designated the address and carries a link to stop or correct the notices; we may suspend delivery to an address that is invalid, disputed, subject to an abuse complaint or the subject of a request to stop, and we notify your workspace owners of a material suppression. Keep an alternative contact for the client's critical items.
5.3 After your plan or your engagement with the client ends, the client keeps what you gave it under section 5.1; this addendum gives the client nothing more, and the warnings to its staff stop with the plan.
6. Moving a tenant, and disputes with a client
6.1 A tenant's runs do not move between workspaces. To move a tenant to the client's own workspace or to another provider, the new workspace registers the tenant and makes its own runs. Before the tenant leaves your workspace, download the exports the client needs and hand them over as section 5 says, and remove the scheduled runs you set up in it. Deleted data leaves our server's encrypted archives within about eight weeks and the off-server copies within about 150 days (Terms 19.3).
6.2 If you and a client disagree about a tenant, for example about who may read it, whether its runs are kept or who receives its warnings, we act on the written instruction of the tenant's administrator of record: a person who holds the Global Administrator role in that tenant and shows us so in a way we can check. That instruction can be to remove the tenant and its runs from your workspace or to stop its warnings. We do not hand a report's contents to anyone ourselves.
6.3 The fees for a tenant are yours while it is registered in your workspace (section 4); a dispute between you and a client does not change them.
7. What you pass on to your clients
7.1 Before you register a client's tenant, tell the client, in your agreement with it, at least: that GlacierPoint Remind reads names and dates of credentials, certificates, tokens and records, never the credentials, and that what it reads can name people (Terms 4.1); that a scheduled run needs the one directory change of Terms 4.4; that warnings can be late or not arrive and that renewals stay the client's (Terms 11 and 13.2); where its data is kept and by whom (our provider list); and the terms of the DPA that concern it (section 3).
7.2 Bind the client, and the people who use what you give them under section 5, to the restrictions of Terms 5.2 and the acceptable use rules of Terms 12.
7.3 Do not promise a client more than the Terms give you: no promise of a complete report or of a warning for every item, no level of availability, no certification and no endorsement by Microsoft (Terms 13.2, 15 and 16).
7.4 Every member of your workspace sees every tenant registered in it. Do not invite a client's staff into a workspace that holds other clients' tenants; use warning addresses instead (section 5.2). Each member accepts the Terms in their own name when they join (Terms 1.2), and you remove members who no longer work for you or for the client (Terms 6.2).
8. Responsibility and survival
8.1 You answer to us for your clients' tenants as for your own (Terms 2.2), including the warranties of Terms 7.1 and the indemnity of Terms 18.1 for a tenant read, or a warning sent, without its owner's authorization. This addendum adds no indemnity and no cap of its own: the limits of Terms 17 apply to it and the Terms together.
8.2 We have no contract with your clients and give them no warranty. Nothing in this addendum gives a client rights against us beyond those the law gives (Terms 23).
8.3 Sections 2.2, 5, 6 and 8 survive the end of the MSP plan as far as a client's exit and amounts already owed need them.
MSP Addendum, Attachment: the authority matrix (service description, version 2026-10-23)
The versioned service description that a client's written authorization to its managed service provider incorporates under MSP Addendum 2.1. For each GlacierPoint product the client's authorization must expressly cover the acts in its row. The MSP keeps the client's authorization and furnishes it on request. A new version of this attachment is published with notice; an authorization given on an earlier version covers the acts that version listed.
Common to every product: the MSP installs and operates the product's software for the client's environment; the product collects the client's configuration and directory information as the product's Terms and Privacy Policy describe, transfers it over encrypted connections to the product's portal hosted by GreenCloud in the United States, keeps it for the retention periods of Terms 10.6, copies it encrypted to Backblaze for backup, and shows it to the MSP's users and to the client's users the MSP invites; the MSP may give the client the reports and exports made for that client's tenant; the subprocessors of the product's provider list act for GlacierPoint; operational notices go to the addresses the MSP designates for the client, including the client's own staff, under the product's operational-contact terms; workforce information in reports is the client's to give notice of to its staff.
| Product | What the product reads | What it writes or holds in the client's tenant (each with the MSP's typed confirmation) | Product-specific acts the authorization must name |
|---|---|---|---|
| Snapshot | The tenant's Microsoft 365 configuration (Entra, Exchange, SharePoint, Teams, Intune, security settings) for backup | Changes applied to the tenant through a restore or rollback the MSP approves; the one-time setup's app registration for scheduled backups; the sign-in registration the app creates on first sign-in | Backups kept hosted or in a local vault; restore scripts prepared for the tenant, which the MSP may give the client; comparison and change alerts |
| Scan | The tenant's and the Active Directory domain's security configuration for assessment | Remediation writes to the tenant and Group Policy Objects created in the domain, each operation as an approved Remediation Plan describes, recorded with a best-effort rollback; the collector's own registration for sign-in | Authorization of an assessment does not authorize remediation; each Remediation Plan is approved separately by the MSP with the client's authority for that plan |
| Remind | The names and expiry dates of the tenant's credentials (app registration secrets and certificates, enterprise application certificates, Intune tokens, domain and mail DNS records, Conditional Access references, directory synchronization); never a credential's value | The sign-in registration the app creates on first sign-in (read permissions, no credential); the scheduled-run registration (its service principal, admin consent for seven read permissions, a certificate's public part), each set up, renewed or removed only with the typed confirmation | Warning emails before each expiry to the addresses the MSP enters, including the client's staff; DNS lookups of the client's domains through public resolvers from the computer running the app |
| Ledger | The tenant's licenses, accounts and sign-in times; Microsoft's published list prices | The sign-in registration the app creates on first sign-in (five delegated read scopes, no credential) | Reports that name the client's employees with last sign-in and flag stale or never-activated accounts; the client gives its staff the required notices and reviews before removing a license or access; no use for employment decisions |
| Atlas | The tenant's configuration and its administrators for documentation | The sign-in registration the app creates on first sign-in; the scheduled-run registration holding a standing grant of Global Reader and Exchange.ManageAsApp, each set up, renewed or removed only with the typed confirmation | Scheduled documents naming administrators, kept up to 730 days; the Word export the MSP edits and delivers to the client as its own; "new document" mails to the addresses the MSP enters; DNS lookups through public resolvers |
| Probe | The targets of a signed scope: internal hosts and services from a collector inside the client's network; the client's proven public assets from GlacierPoint's scanner | Nothing in a tenant; traffic sent to the listed targets within the signed scope only; a low-privilege directory read with an account the client supplies for an authenticated engagement | Separately scoped penetration testing: the client's written authorization names the environment, the targets, the techniques and intensity, the window and the exclusions, and the permissions of hosting and cloud providers; an authorization to manage IT or to run another product does not authorize testing; the MSP's operator accepts the engagement statement for the named client |
An MSP that holds a client's authorization for one product does not thereby hold it for another: each product the MSP runs for a client is named in the authorization with its row.