Norvet MSP Subcontractor Code of Conduct & Compliance

Effective Date: 7-13-2023
Last Updated: 5-24-2024
Issued By: Norvet MSP (“Norvet,” “we,” “us,” “our”)
Applies To: Any person or entity performing work for Norvet or receiving payment from Norvet, including all subcontractors, consultants, vendors, white-label partners, black-label partners, grey-label partners, and independent contractors (each a “Subcontractor,” “you,” or “your”).

1. Purpose and Intent

This Subcontractor Code of Conduct & Compliance (this “Code”) is a mandatory governance document designed to:

protect Norvet, its Clients, and Norvet’s business relationships;

prevent subcontractor misconduct, unauthorized Client contact, and billing/collection failures; and

impose clear controls across White Label, Black Label, Grey Label, and Independent engagement models.

This Code is written to be aggressive, enforceable, and operationally usable. Where ambiguity exists, interpretation will favor Client security, continuity, and Norvet’s contractual obligations to its Clients.

2. Automatic Binding and Acceptance by Performance (“Payment Lock”)

2.1 Binding Effect Without Signature

You are automatically bound by this Code if you do any of the following:

perform any work for Norvet (whether paid or unpaid, direct or indirect);

access, receive, view, store, transmit, or process any Norvet or Client information;

accept any payment (partial or full) from Norvet;

accept any assignment, ticket, work order, SOW, purchase order, or request from Norvet; or

represent yourself as able to perform services for Norvet.

Signature is not required for enforceability. Performance and/or receipt of payment constitutes acceptance and creates a binding agreement.

2.2 No “Different Terms” by Invoice, Email, Portal, or Link

No invoice terms, portal terms, clickwrap, email footer, or linked terms you present will modify this Code unless expressly agreed in a written amendment signed by an Authorized Norvet Signatory (defined below).

3. Order of Precedence; Relationship to Other Agreements

3.1 Order of Precedence

If this Code conflicts with any Subcontractor proposal, invoice, statement, or purchase order, this Code controls unless a later written document signed by an Authorized Norvet Signatory explicitly overrides a specific section of this Code.

3.2 Flow-Down Obligations

To the extent you support services delivered by Norvet to a Client under a master services agreement, statement of work, security addendum, or similar contract (“Client Agreement”), you agree that Client-facing obligations flow down to you to the extent applicable to your role—especially regarding confidentiality, data protection, security, communications controls, and transition support.

4. Definitions (Critical)

“Client” means any Norvet customer, prospective customer, lead, referral, former customer, or any person/entity introduced to you by Norvet, including their affiliates, users, employees, contractors, donors, and stakeholders.

“Client Data” means any data, content, credentials, configurations, logs, tickets, messages, documents, or personal information belonging to, originating from, or relating to a Client or its users.

“Credentials” means any usernames, passwords, API keys, tokens, certificates, recovery codes, MFA methods, admin accounts, shared secrets, SSH keys, vault entries, or authentication artifacts.

“Illegal Contact” (also called “Unauthorized Client Contact”) means any direct or indirect communication between you (or your personnel) and a Client that is not expressly authorized in writing by Norvet in advance. It is “illegal” by contract definition (not a criminal-law label) and is a material breach.

“Authorized Client Contact” means Client communication explicitly approved by Norvet in writing, identifying: (i) approved persons, (ii) approved channels, (iii) approved scope/topic, and (iv) approved timeframe.

“Norvet Confidential Information” means non-public information about Norvet including pricing, margins, contracts, ticket notes, internal policies, tooling, security configurations, proposals, and Client lists.

“Change Order” means a written change order signed by a Client (if applicable) and an Authorized Norvet Signatory that modifies scope, pricing, responsibilities, or deliverables.

“Authorized Norvet Signatory” means only Norvet’s owner(s) or officer(s), or a person expressly authorized in writing by Norvet to bind Norvet contractually.

5. Engagement Models and Branding Rules

5.1 White Label

You operate as Norvet. The Client must not be told you are a subcontractor. You must:

use Norvet-approved email/phone/chat channels if provided;

never disclose your company name, employees, rates, or location;

avoid statements like “I’m a contractor/vendor/partner” unless Norvet authorizes.

5.2 Black Label

The Client may know you exist, but Norvet remains the prime contractor. You must:

clearly state you are acting “on behalf of Norvet” only if Norvet authorizes;

never negotiate scope, pricing, credits, refunds, or contract terms with the Client.

5.3 Grey Label

Limited disclosure may occur (e.g., specialized vendor). You must:

follow Norvet’s communications script;

communicate only within the explicitly approved scope;

defer all commercial issues to Norvet.

5.4 Independent

You are retained for a defined task. You must:

treat all Client touchpoints as restricted;

communicate only through Norvet unless Authorized Client Contact exists.

Default rule (all models): If it isn’t explicitly authorized in writing, it is prohibited.

6. Authority Limits; No Unauthorized Promises (Absolute)

6.1 No Authority to Bind Norvet

You have zero authority to:

modify Norvet pricing, discounting, billing terms, service credits, or payment timing;

expand or reduce scope;

promise SLAs, security outcomes, restoration timelines, or guarantees;

accept Client instructions that conflict with Norvet’s instructions;

sign any Client document;

create any “side deal” with the Client.

6.2 Change Orders Required

Any deviation from scope, price, tools, security controls, or deliverables requires a signed Change Order (or written authorization from Norvet) before work begins.
If you perform unauthorized work, Norvet may refuse payment and you bear all associated costs.

6.3 Unauthorized Promises = Subcontractor Liability

If you make any unauthorized promise (verbal or written) to any Client or third party, you agree to:

indemnify Norvet for all resulting claims, credits, chargebacks, refunds, penalties, or reputational damages; and

accept immediate termination and payment remedies described below.

7. Illegal Client Contact (Strict Prohibition)

7.1 Definition of Illegal Contact (Very Broad)

Illegal Contact includes, without limitation:

contacting a Client by phone, text, email, social media, chat, Teams/Slack, ticket portals, in-person visits, or through a mutual contact without written authorization;

discussing Norvet internal operations, security posture, tools, staffing, finances, disputes, invoices, pricing, or Client contract terms;

soliciting work, proposing services, upselling, or offering alternative support;

asking a Client for direct payment;

sending “helpful” warnings or advice that Norvet did not approve;

“just checking in,” “networking,” or any contact outside the authorized channel.

7.2 Permitted Exceptions (Narrow)

Only the following is permitted, and only if pre-approved in writing by Norvet:

scheduling and performing a Client-approved on-site visit;

participating in a Client call where Norvet is present or has expressly delegated you;

receiving a Client inbound communication routed by Norvet and responding within the approved scope.

7.3 Mandatory Reporting

If any Client contacts you directly (even innocently), you must:

notify Norvet within 2 hours (business hours) or by next business morning (after hours), and

provide the message details and refrain from substantive response unless Norvet instructs otherwise.

7.4 No Solicitation / No Poaching

You shall not, directly or indirectly, solicit or accept work from any Client introduced by Norvet during the engagement and for 24 months after the last date you performed any work related to that Client.

8. No Hostage Rule (Data, Credentials, Support, and Transition)

8.1 Absolute Prohibition on Withholding

You may never withhold, delay, encrypt, delete, destroy, lock, ransom, disable, or refuse to provide:

Client Data, logs, exports, tickets, documentation, runbooks;

Credentials or access needed to operate Client systems;

tool access, configuration exports, backup restore access, or security monitoring handoff;

reasonable support necessary for continuity during transition,

even if you claim Norvet owes you money, even if a dispute exists, and even if you allege breach by Norvet.

8.2 Disputes Are Separate From Continuity

All commercial disputes must be handled separately from Client continuity. You agree continuity is paramount and that your duty to cooperate survives disputes.

8.3 Transition Cooperation Requirement

Upon request by Norvet (or upon termination), you must, at no additional cost unless pre-approved in writing:

provide all documentation, credentials, and work artifacts within 2 business days;

participate in up to two (2) knowledge-transfer calls (up to 60 minutes each) within 10 business days;

certify deletion/return of Client Data and Norvet Confidential Information.

8.4 Payment Forfeiture Trigger

Violation of the No Hostage Rule is a material breach and triggers:

immediate termination for cause;

forfeiture/withholding and clawback rights (Section 12); and

injunctive relief rights (Section 18).

9. Confidentiality; Non-Disclosure; Non-Use

9.1 Confidentiality Obligation

You must protect Norvet Confidential Information and Client Data using at least the same care you use for your own sensitive information, and never less than commercially reasonable care.

9.2 Prohibited Use

You may not use Norvet Confidential Information or Client Data for:

marketing or portfolio references;

training AI models or analytics not required to deliver services;

your own business development;

contacting or soliciting Clients;

any purpose outside Norvet’s written instructions.

9.3 Subcontractor Personnel

You may share Norvet/Client information only with personnel who:

have a strict need-to-know;

are bound by confidentiality obligations at least as strict as this Code; and

are trained in secure handling.

You are fully responsible for your personnel’s actions and omissions.

10. Security Controls (Minimum Baseline)

You must maintain and enforce minimum safeguards on any system used to access Norvet or Client environments:

MFA enforced for all accounts accessing Client or Norvet systems;

patching and supported OS/software versions;

endpoint protection/EDR or reputable anti-malware;

encryption in transit and at rest where feasible;

secure password management (no browser-stored credentials for privileged accounts; use a vault);

least privilege; no shared admin accounts unless explicitly authorized;

secure disposal and deletion of Client Data.

If you cannot meet these controls, you must disclose that in writing before accessing any Client Data. Norvet may deny access immediately.

11. Billing & Net 30 Invoicing (Strict Process)

11.1 Mandatory Net 30 Billing Structure

All invoices must be issued on Net 30 terms and will be payable Net 30 from Norvet’s receipt of a correct, complete, and compliant invoice.

11.2 Invoice Format Requirements (Non-Negotiable)

Invoices must be submitted in Norvet’s required format and must include, at minimum:

Norvet engagement name / Client code (as provided by Norvet);

dates of service;

ticket IDs/work order numbers;

clear description of work performed;

time entries (start/stop or duration), labor category, rate (if applicable);

pre-approved expenses (with receipts);

your legal business name, address, tax ID (if applicable), payment instructions.

If Norvet provides a template, you must use it.

11.3 Submission Deadline (Late = Waived)

Invoices must be submitted no later than five (5) business days after month-end (or work completion, if earlier).
Invoices submitted later than thirty (30) days after month-end may be rejected and deemed waived at Norvet’s sole discretion.

11.4 No Double Billing; No Bundled Vagueness

You may not:

bill the same work twice;

bill time not actually worked;

bill “admin,” “overhead,” “internal meeting,” or “research” without Norvet’s written approval;

bill vague line items (“IT support,” “misc,” “projects”) without ticket linkage.

11.5 Audit Trail Required

You must keep time records, ticket notes, and supporting documentation for three (3) years and provide them within 3 business days upon request.

12. Payment Withholding, Forfeiture, Setoff, Clawback, and Penalties

12.1 Condition Precedent to Payment

Payment is conditioned on:

compliance with this Code;

timely, accurate invoicing;

delivery of all required work artifacts; and

adherence to communication controls.

12.2 Withholding / Setoff Rights (Broad)

Norvet may withhold, reduce, or set off any amounts otherwise owed to you to cover:

Client credits/refunds caused by you;

costs to remediate your errors, omissions, or misconduct;

costs of transition caused by your noncooperation;

legal fees and investigation costs arising from your breach;

any losses or claims tied to your actions/inactions.

12.3 Monthly Payment Forfeiture (Aggressive Enforcement)

Norvet may hold, suspend, or forfeit your payment for the month (in whole or part), at Norvet’s discretion, if you:
a) submit improper, incomplete, unverifiable, or late billing;
b) engage in Illegal Contact; or
c) make unauthorized promises, discounts, scope changes, or side-deals to a Client.

12.4 Clawback

If Norvet discovers (within 24 months) that you were paid for noncompliant or improperly billed work, Norvet may demand repayment (clawback) within 10 days of notice. Failure to repay authorizes Norvet to pursue collection, setoff, and legal remedies.

12.5 Administrative Charges

Norvet may impose reasonable administrative fees for repeated billing defects, rework, or compliance failures requiring staff time to correct.

13. Verbal Agreements Are Void; Side-Deals Do Not Bind Norvet

You acknowledge and agree:

Norvet is not bound by any verbal agreement, text message, hallway conversation, or informal email between you and any Client.

Any Client-facing commercial or scope commitment must be documented in a signed Change Order.

If a Client claims you made a promise, you will fully cooperate in rebutting it and will indemnify Norvet for resulting damages.

14. Professional Conduct Standards

You must:

act professionally, ethically, and respectfully;

avoid harassment, discrimination, retaliation, or hostile conduct;

avoid conflicts of interest and disclose any potential conflicts immediately;

refrain from disparaging Norvet, its Clients, or other vendors;

comply with all Client site rules when on-site (if authorized).

15. Compliance With Laws; Export/Sanctions; No Bribery

You will comply with all applicable laws and regulations, including (as applicable) privacy, cybersecurity, consumer protection, anti-bribery, sanctions, export controls, and labor laws.

You represent that you are not barred from providing services and that you will not use prohibited labor or engage in illegal conduct.

16. Indemnification; Duty to Defend (Subcontractor → Norvet)

You shall defend, indemnify, and hold harmless Norvet and its owners, officers, employees, agents, Clients, and affiliates from and against any and all claims, demands, actions, damages, liabilities, penalties, fines, costs, and expenses (including attorneys’ fees) arising from or relating to:

your breach of this Code;

Illegal Contact;

unauthorized promises or misrepresentations;

billing inaccuracies, fraud, or overbilling;

security incidents caused by your systems, personnel, or negligence;

violations of law by you or your personnel;

infringement or misuse of IP by you.

17. Limitation of Norvet Liability to Subcontractor

To the maximum extent permitted by law:

Norvet will not be liable to you for any indirect, incidental, special, consequential, punitive, or lost-profit damages.

Norvet’s total liability to you for any claim will not exceed the amounts actually paid to you by Norvet for the specific work giving rise to the claim during the three (3) months preceding the event.

18. Equitable Relief (Injunction) and Emergency Remedies

You agree that breach of Sections 7 (Illegal Contact), 8 (No Hostage), 9 (Confidentiality), 10 (Security), or 13 (Verbal Agreements) causes irreparable harm. Norvet is entitled to:

temporary restraining orders, injunctions, and specific performance,

without needing to post bond to the maximum extent permitted by law,

plus recovery of attorneys’ fees and costs.

19. Termination (Immediate for Cause)

Norvet may terminate your access and engagement immediately upon notice if you:

engage in Illegal Contact;

violate the No Hostage Rule;

breach confidentiality or security obligations;

submit fraudulent, misleading, or repeated improper invoices; or

refuse to cooperate with transitions.

Upon termination, you must immediately:

cease representing Norvet;

return all Norvet and Client information;

provide transition cooperation under Section 8.

20. Audit Rights

Norvet may audit your compliance (including invoice support and access controls) upon reasonable notice. You must cooperate fully and provide requested documentation promptly.

21. Governing Law; Exclusive Venue (DeKalb County, Georgia)

This Code and any dispute arising from it will be governed by the laws of the State of Georgia, and the exclusive venue will be state or federal courts located in DeKalb County, Georgia. You consent to personal jurisdiction and venue there.

22. Notices

Notices must be in writing and delivered by email (with confirmation) and/or certified mail to the addresses provided by the parties. Norvet may designate notice instructions per engagement.

23. Miscellaneous

Severability: If any part is unenforceable, the rest remains effective.

No Waiver: Failure to enforce a right is not a waiver.

Assignment: You may not assign or delegate without Norvet’s written consent.

Survival: Sections on confidentiality, no hostage, non-solicitation, indemnity, audit, venue, and remedies survive termination.

Exhibit A — Norvet Required Invoice Content (Checklist)

Your invoice must include:

Norvet job/client code and ticket/work order IDs

dates, times, duration, work description

rates approved by Norvet (if applicable)

pre-approved expenses + receipts

your legal entity name + remittance instructions

statement: “I certify this invoice is accurate, complete, and compliant with Norvet’s Subcontractor Code of Conduct & Compliance.”

Exhibit B — Authorized Client Contact Protocol (Summary)

No Client contact unless Norvet authorizes in writing.

If a Client contacts you directly: report to Norvet immediately; do not respond substantively.

Never discuss pricing, contracts, disputes, Norvet internal matters, or staffing.

Never solicit, upsell, or accept direct payment from a Client.