Cyber Security Agreement
Version 2026-07-31-cyber-v2
This Cyber Security Agreement establishes the shared security responsibilities for Dealer's use of Image RO and its connected data sources.
1. Dealer account security
Dealer will protect its user credentials, restrict access to authorized personnel, promptly remove departed users, and use reasonable security practices on devices and networks that access the Services. Dealer will not share credentials, bypass access controls, introduce malicious code, or attempt unauthorized access to the Services or connected providers.
2. Connection security
Dealer will provide integration credentials and API access only through approved secure methods. Dealer is responsible for promptly updating Company when a credential, provider account, domain, DMS, or other connection changes, is revoked, or may be compromised.
3. Company safeguards
Company will maintain reasonable administrative, technical, and physical safeguards designed to protect Dealer Data against unauthorized access, alteration, loss, or disclosure. No system can be guaranteed completely secure, and Dealer acknowledges the inherent risks of Internet-based services.
4. Security incidents
Each party will promptly notify the other after discovering a suspected security incident that may materially affect the Services or Dealer Data. The parties will cooperate in good faith to investigate, contain, and remediate the incident, subject to applicable law and legitimate security, confidentiality, and legal constraints.
5. Suspension for protection
Company may suspend a connection or access to the Services when reasonably necessary to protect Dealer, Company, connected providers, or the Services from a security threat. Company will restore access when the threat has been reasonably addressed.
6. Limitation of liability for security events
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, COMPANY WILL NOT BE LIABLE FOR ANY LOSS, DAMAGE, COST, EXPENSE, LIABILITY, OR CLAIM ARISING OUT OF OR RELATING TO A CYBERATTACK, SECURITY INCIDENT, MALWARE, RANSOMWARE, DENIAL-OF-SERVICE EVENT, UNAUTHORIZED ACCESS, COMPROMISED CREDENTIAL, DATA LOSS, DATA DISCLOSURE, OR FAILURE OR ACT OR OMISSION OF A THIRD-PARTY PROVIDER, DEALER SYSTEM, NETWORK, OR USER. THIS LIMITATION APPLIES REGARDLESS OF THE LEGAL THEORY ASSERTED AND EVEN IF COMPANY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION DOES NOT APPLY TO THE EXTENT A COURT OF COMPETENT JURISDICTION FINALLY DETERMINES THAT THE LOSS RESULTED DIRECTLY FROM COMPANY'S GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR FRAUD, OR TO ANY LIABILITY THAT APPLICABLE LAW DOES NOT PERMIT COMPANY TO LIMIT OR EXCLUDE.