Partner Program Terms

“Partner” means a firm — a managed service provider, virtual CISO/CIO/CxO practice, or consultancy — accepted into the program.

“Client Workspace” means a GOVERNBOX organization tenant licensed through a Partner for one of the Partner’s end clients. Each Client Workspace is an ordinary GOVERNBOX tenant: logically isolated, with its own users, audit log, and data.

“Program Tier” means the Partner’s standing in the program (Registered Partner, Certified vCXO Partner, or Premier MSP Partner). The Program Tier sets the Partner’s wholesale discount level, support commitments, and onboarding depth. It is deliberately independent of any Client Workspace’s own subscription configuration.

“Workspace Configuration” means the product tier and module configuration (as described on our Plans page) licensed for a given Client Workspace. Each client’s configuration is chosen per client.

“NFR Workspace” means the Partner’s own not-for-resale workspace (Section 6).

“Rate Card” means the wholesale pricing schedule provided to a Partner at acceptance, as updated from time to time with notice. The Rate Card is confidential and is not published.

The program has three tiers. Each carries a minimum quota of active Client Workspaces, an escalating wholesale discount set out in the Rate Card, and the support and onboarding commitments described in Section 8:

• Registered Partner — at least 1 active Client Workspace. Self-service onboarding via the partner knowledge base.
• Certified vCXO Partner — at least 5 active Client Workspaces, and completion of the GOVERNBOX partner onboarding and certification curriculum (two 1-on-1 onboarding sessions covering the full governance workflow and the marketing claims guardrails). “Certified” is a program credential describing that completed onboarding; it is not a professional or regulatory certification, and Partners may not represent it as one.
• Premier MSP Partner — at least 15 active Client Workspaces. Includes a dedicated account manager and a quarterly business review.

Quota adjustments and grace. If a Partner falls below its tier’s quota, the Partner has a 60-day grace period to return to quota before the wholesale discount adjusts to the tier the Partner then qualifies for. A change in Program Tier or partner status never affects a Client Workspace’s availability — see Section 5.

Partners license Client Workspaces at a discount from the then-current retail annual price of each workspace’s Workspace Configuration. The discount percentage is set by the Partner’s Program Tier and stated in the Rate Card. For clarity: the discount applies per Client Workspace, to whatever configuration that client licenses — a Partner may run one client on a Starter single-module workspace and another on an Agency workspace, and the discount applies to each at its own retail price.

Resale / managed retainer model. Partners set their own end-client pricing and bill their clients directly. GOVERNBOX invoices the Partner for Client Workspace licenses at wholesale on the billing schedule in the executed partner agreement. The Partner is responsible for payment regardless of the Partner’s own collections from its clients.

Direct-billing referrals. Arrangements where GOVERNBOX bills the end client directly and pays the Partner a referral fee are available only by separate written agreement. [COUNSEL: referral-fee terms, registration, and any state-law disclosure requirements to be settled before the first such agreement.]

The Partner’s own subscription. Partner Program Tier standing is established and maintained through the Partner’s program subscription on the Partner’s NFR Workspace, together with the executed partner agreement.

Provisioning. Client Workspaces are provisioned for the Partner by GOVERNBOX (concierge provisioning), and through partner-facing tooling as it is released. Each Client Workspace is created for a named end-client organization.

How partner personnel work in a Client Workspace. Partner personnel sign in with their own GOVERNBOX credentials, tied to named individuals; no login is ever shared. From the partner portal they open a Client Workspace and work inside it through a partner seat that appears in the client’s user list labelled with the Partner’s name. Unless a narrower level is set for that client, a partner seat has the same permissions as the client’s Owner, because the Partner is engaged to run the client’s governance program, including exporting the client’s documents and records. If the client requires two-step sign-in for its own users, partner personnel must use two-step sign-in to open that client’s workspace.

Every action is recorded. Opening a Client Workspace, and every change made in it, is recorded in that client’s own append-only audit log, attributed to both the partner firm and the individual who acted. The client’s administrators can read that log at any time.

Client authorization. For a Client Workspace provisioned through the Partner, the Partner represents that its client has engaged it to set up and operate the workspace, and partner access begins at provisioning. Where an organization already using GOVERNBOX engages a Partner, GOVERNBOX links the Partner to that workspace only on the written authorization of one of the organization’s administrators, and the authorization is recorded in the client’s audit log.

When access ends. Partner access to a Client Workspace ends when the managing relationship for that workspace ends or is transferred, and a client may ask GOVERNBOX at any time to end a Partner’s access by writing to info@governbox.ai. When access ends, the Partner’s seats in that workspace are deactivated on the next request; records the Partner created stay in the workspace with their original attribution. The Partner must promptly remove partner personnel who no longer need access.

The client owns its workspace. The end-client organization retains all right, title, and interest in the data in its Client Workspace — policies, registers, assessments, evidence, and audit history.

Client Workspaces survive partner changes. A Client Workspace’s availability is never conditioned on the Partner’s quota, tier, standing, suspension, or termination. If the Partner-client relationship ends for any reason — including termination of the Partner’s participation in the program — the Client Workspace and all its data remain intact, and GOVERNBOX will transition the workspace to direct billing with the client or to a successor partner designated by the client, without data loss. Licensing already paid through the Partner remains in effect for the period paid.

Offboarding cooperation. Partners will cooperate in good faith in any transition, and may not withhold, condition, or delay a client’s access to its own workspace or data.

Each accepted Partner receives one not-for-resale workspace with full product depth, at no license charge, for (a) demonstrations to prospective clients and (b) the Partner’s own internal governance program. The NFR Workspace may not be resold, shared with a client as that client’s production environment, or used to operate a client’s governance program of record. GOVERNBOX may reclaim NFR access when a partner agreement ends.

Roadmap features are described as such. Partner co-branding on client deliverables (for example, “Governance managed by [Partner] · Powered by GOVERNBOX.ai” on board reports and Trust Pages) and Premier-tier white-labeling of client-facing deliverables are program roadmap features. They become available as released, at the tiers stated at release. Trust Page theming, when released, uses constrained brand elements (partner logo and palette within the product’s theming system) — never arbitrary partner-supplied code or stylesheets.

Marketing claims guardrails (non-negotiable). Partners describing GOVERNBOX output to clients or the public must stay within the approved framing:

• Approved: “defensible starting point,” “audit-ready governance framework,” “automated crosswalks,” “grounded control library,” and equivalent language that keeps human review in the loop.
• Prohibited: describing output as “certified legal advice,” “100% legally compliant,” “guaranteed audit clearance,” or any claim that generated output removes the client’s obligation to review and approve its own governance documents.

Repeated or willful violation of the claims guardrails is grounds for termination for cause under Section 9.

Support response targets by Program Tier: Registered — 24 business hours; Certified vCXO — 8 business hours; Premier MSP — 2 business hours via the priority desk. Business hours are Monday–Friday, 9:00–17:00 US Eastern, excluding US federal holidays. Response targets are measured from receipt of a support request through the partner support channel identified in the welcome packet.

Platform availability commitment: 99.5% monthly uptime for Registered Partners’ Client Workspaces and 99.9% for Certified vCXO and Premier MSP Partners’, in each case measured monthly by an independent third-party monitoring service against the production application endpoints, excluding maintenance announced in advance. The current measurement source and public status page are identified in the welcome packet.

[COUNSEL: remedies for service-level misses — service credits or termination rights — to be defined in the executed partner agreement; this schedule intentionally states the commitments and measurement only.]

Term. Partner agreements run on a 12-month renewable term, billed as set out in the executed agreement.

Termination for convenience. Either party may terminate the partner agreement on 60 days’ written notice. Active Client Workspaces remain functional for the remainder of their paid subscription terms and transition under Section 5.

Termination for cause. GOVERNBOX may suspend or terminate a Partner immediately for material breach, including violation of the marketing claims guardrails, misuse of partner access to client data, or non-payment. Suspension or termination of a Partner never suspends a Client Workspace; Section 5 governs.

[COUNSEL / PROGRAM: deal-registration procedures — how a Partner registers a prospective client, how long a registration protects the deal, and how conflicts with GOVERNBOX’s direct pipeline or another partner’s registration are resolved — will be published as program rules under this section. Until published, conflicts are handled case by case in good faith, and GOVERNBOX will not knowingly use a Partner’s registration information to compete for that client directly.]

As between GOVERNBOX and each end client, GOVERNBOX’s handling of Client Workspace data is governed by our Terms of Service, Privacy Policy, and Data Usage Policy. The Partner accesses a Client Workspace as the client’s authorized service provider, and is responsible to its client for that access under the Partner’s own engagement terms. Partners must maintain the confidentiality of client data accessed through the program, the Rate Card, and non-public program information.

Partner access is described to clients in our Privacy Policy (Section 6.10) and Terms of Service (Section 4).

[COUNSEL: whether a partner data-processing addendum is required between GOVERNBOX and the Partner, or between the Partner and its client, remains to be confirmed.]

We may update these Partner Program Terms and the Rate Card with at least 30 days’ notice to active Partners. Changes apply prospectively from the next renewal of the affected partner agreement unless the Partner agrees otherwise. The version in effect for an executed agreement is the one incorporated at execution or renewal.