1. Status, scope and order of precedence
This page is Cooper Agile’s standard operating and service framework for MARCH, BASTION and CITADEL. It explains the baseline we expect to put into a proposal; it is not by itself a signed Master Services Agreement, quotation or SLA. The signed agreement, mission charter, data-processing terms, security-provider contract and SLA schedules prevail where they are more specific. Existing FORT and Garden Care engagements retain their own published and signed terms.
2. Quotes, charges and change control
Every programme is individually scoped and quoted. Price depends on the formation, mission scope, cloud/hybrid/on-prem deployment, on-site work, third-party usage, licensed security providers, and any reserved human capacity. Taxes and third-party charges are shown separately.
- A proposal defines deliverables, acceptance criteria, named capacity, dependencies, timing and price before work starts.
- Cloud, hybrid and on-prem designs are priced against actual hardware, connectivity, resilience, licensing, maintenance and operating requirements.
- Third-party subscriptions, usage, advertising, hardware and licensed-provider charges are itemised separately wherever feasible. Client-owned accounts and data relationships are preferred.
- New requirements, changed assumptions and additional capacity require written change control. No unlimited support, unlimited improvements or unlimited staffing is implied.
3. Programme horizons, reviews and exit
MARCH runs for six months and BASTION for twelve months. CITADEL is a sixty-month framework with annually agreed scopes, prices and SLA schedules. The programme name describes the operating horizon, not a promise that every possible business outcome is included.
- MARCH and BASTION are fixed for their stated terms, with monthly operating reviews and the gates described on their programme pages.
- CITADEL has monthly operating reviews, quarterly executive reviews and annual scope/value/SLA gates. Either party may exit at an annual anniversary with 90 days’ written notice.
- Any party may terminate for material breach that remains uncured after the written notice and cure process, subject to the signed agreement and applicable law.
- Exit includes an agreed handover, return or deletion of data, access removal, export of client records and settlement of properly accrued charges.
5. Severity, escalation and human response
Severity is assigned from operational impact, not from the channel used to contact us. The signed SLA defines contacts, escalation paths and any out-of-hours arrangements.
- P1 — Critical: a production service or safety-critical capability is unavailable, or an active severe security incident requires immediate coordination.
- P2 — High: material degradation or substantial operational impact with no proportionate workaround.
- P3 — Normal: limited impact, a bounded defect, or a workaround exists while a correction is scheduled.
- P4 — Request: information, routine maintenance, configuration or an agreed improvement request.
- A ticket acknowledgement records receipt and initial coordination. It is not a workaround, resolution, root-cause finding or guarantee of restored service.
6. Service breach, security incident and remedies
A missed target or obligation is recorded with its source, impact, owner and timeline. We escalate operationally first, then commercially where the issue persists. Security and privacy incidents are handled under the agreed incident runbook and notified without undue delay where the signed schedule or applicable law requires it.
- The default contractual cure period is 30 days after written notice for a remediable material breach, unless the signed agreement or law requires a different process.
- Repeated or severe SLA failure triggers a service review covering cause, corrective action, affected monitoring and prevention.
- Uptime percentages, resolution targets, service-credit rates, exclusions and claim windows exist only in a signed SLA schedule; no public percentage or credit is invented here.
- Termination rights for uncured material breach do not remove accrued payment obligations, confidentiality, data-return or other provisions intended to survive exit.
7. Monitoring, KPIs and M&E evidence
Each mission charter establishes baselines, targets, data sources, owners, collection cadence and Monitoring Mechanisms before results are claimed. Evidence packs distinguish output, outcome and longer-term impact; synthetic demonstrations are labelled and never substituted for client evidence.
- Automated probes, logs, model evaluations, data-quality tests, CRM/search analytics and human review are selected to fit the KPI.
- Every threshold has an agreed action: investigate, escalate, revise, scale or stop.
- Reports state limitations, missed targets and corrective decisions. Activity volume alone is not evidence of value.
8. Cybersecurity, CCTV and physical-security operations
Cyber and physical-security work begins with jurisdiction, site, asset, risk and responsibility mapping. Controls can include access hardening, patching, backup/recovery, private recording, CCTV architecture, AI-assisted alerts, human review, retention rules and incident coordination.
- The client is responsible for lawful surveillance, required notices or consent, worker/community considerations, retention choices and any sector-specific duties unless a signed agreement allocates a specific task otherwise.
- AI-assisted monitoring produces signals for review; it is not infallible detection, a safety guarantee or permission for indiscriminate surveillance.
- Guarding, armed response and other licensed activities are provided only by appropriately licensed providers under separate jurisdiction-specific contracts, vetting, insurance and operational procedures.
- No 24/7 control room, emergency response, guarding or armed-response service exists unless the relevant signed provider schedule explicitly says so.
9. Privacy and international regulatory alignment
Privacy and compliance duties depend on the client, data, people, jurisdiction and service. We use responsibility matrices, data inventories, access controls, retention schedules, processor/subprocessor terms and evidence records where applicable. Using Cooper Agile does not by itself make a client compliant or certified.
- POPIA: South African responsible-party/operator roles, lawful processing, security safeguards, information-officer duties, data-subject requests and breach processes are allocated in the signed terms.
- GDPR / UK GDPR: where in scope, controller/processor roles, lawful basis, international transfers, retention, rights, sub-processors and breach duties are documented. Similar local privacy laws are assessed where relevant.
- FICA: applicable accountable institutions retain their own customer due-diligence, recordkeeping, reporting and regulatory-accountability duties. We can support agreed systems and evidence workflows; we do not assume the client’s legal obligations unless law and a signed agreement expressly allow it.
- PCI DSS: payment flows are designed to reduce cardholder-data scope where practical, using appropriate payment providers and segmentation. PCI DSS responsibilities and any assessment evidence are scoped explicitly; no certification is implied.
- Cross-border hosting and support are disclosed in the relevant data schedule, including transfer safeguards and subprocessors where required.
10. Subcontractors, specialist partners and licensed providers
We may use vetted specialists where the signed scope permits, with confidentiality, access and responsibility controlled. The client receives relevant provider and subcontractor information where required. Limitless Potential may be proposed as a specialist partner network for advanced R&D or moonshots; that work is separately scoped with hypotheses, expert review and stage gates, never guaranteed breakthroughs or unsupported scientific claims.
11. Client responsibilities and dependencies
The client provides timely access, accurate information, lawful data and instructions, required licences/consents, a decision-maker, safe on-site conditions and reasonable cooperation. Dependencies and start gates are written into the charter. Delays or changed assumptions trigger an open re-plan rather than silent schedule absorption.
12. Data, intellectual property and confidentiality
Client data and client-owned accounts remain the client’s. Each party retains its pre-existing intellectual property. Deliverables, licences, reusable components, third-party materials and any transfer of rights are stated in the signed scope. Confidential information is used only for the agreed engagement and protected with proportionate controls, subject to law and the signed confidentiality terms.
13. Suspension, force majeure and service changes
The signed agreement governs suspension for non-payment, unlawful use, imminent security risk or unsafe conditions, with notice and restoration procedures appropriate to the situation. Events outside reasonable control are handled under the agreed force-majeure and continuity provisions. Material service, provider or subprocessors changes follow the agreed notice and change-control process.
14. Warranties, liability, insurance and governing law
Professional-service warranties, liability caps or exclusions, indemnities, insurance, consumer rights, non-excludable liabilities and governing law belong in the signed agreement and depend on the parties, service and jurisdiction. Nothing on this public framework excludes a right or liability that applicable law does not allow us to exclude. No unsupported insurance, licence or certification claim is made.
15. Handover, portability and continuity
Runbooks, documentation, training, service registers, data exports and access handover are planned throughout delivery, not improvised at exit. Specific formats, timing, retained records and deletion evidence are agreed in the contract, subject to legal retention duties. A capability only we can operate is not considered a complete handover.