Third-Party Administrative Access Authorization & Release

Use this form to direct The Boom Company (dba Boom Logic) (“Provider”) to grant a third party administrative access to systems, networks, or environments that Provider hosts and/or manages for you (“Client”) under your existing agreement with Provider, consisting of your Order(s), the Master Services Agreement, and applicable Service Attachments and Schedules (collectively, the “Agreement”). Capitalized terms not defined here have the meanings given in the Agreement.

1. Client Information

2. Third Party to Receive Access

3. Scope of Access Authorized

Hosted servers / cloud infrastructure (specify):  

Network equipment (firewalls, switches, wireless) (specify):  

Domain / identity administration (Active Directory, Azure AD / Entra, Microsoft 365)

BoomTalk™ VoIP environment

Backup / disaster-recovery systems

Other (specify):  

4. Acknowledgments, Terms & Release

By signing below, Client agrees and acknowledges as follows:

• Authorization and direction. Client directs Provider to provision the access described in Section 3 to the individuals named in Section 2. In provisioning and maintaining that access, Provider acts solely on Client’s instruction.
• Third party acts for Client. The third party is Client’s agent, contractor, or designee — not Provider’s. Client is responsible for the third party’s acts and omissions within the accessed environment as if they were Client’s own, and Client is responsible for the third party’s compliance with this form and the Agreement.
• Acknowledgment of risk. Administrative access permits the modification and deletion of data, configurations, security controls, and services. Client acknowledges that the third party’s actions may cause, among other things: service outages or degraded performance; loss or corruption of data; weakened security posture or security incidents; loss of configurations implemented by Provider; and interruption of monitoring, patching, or backup processes. CLIENT UNDERSTANDS AND ACCEPTS THESE RISKS AND THE CONSEQUENCES OF THE ACCESS IT IS AUTHORIZING.
• Changes are unauthorized alterations for purposes of the Agreement. Changes made by or through the third party’s access constitute alterations and modifications not authorized by Provider under the Agreement, including for purposes of the Agreement’s exclusions, service level commitments, and warranty provisions.
• Release; no Provider responsibility. TO THE MAXIMUM EXTENT PERMITTED BY LAW, PROVIDER IS NOT RESPONSIBLE OR LIABLE FOR ANY LOSS, DAMAGE, OUTAGE, DATA LOSS OR CORRUPTION, SECURITY INCIDENT OR BREACH, COMPLIANCE VIOLATION, OR OTHER HARM ARISING FROM OR RELATED TO THE ACCESS AUTHORIZED BY THIS FORM OR THE THIRD PARTY’S ACTS OR OMISSIONS, AND CLIENT RELEASES AND HOLDS PROVIDER HARMLESS FROM ALL SUCH CLAIMS, CONSISTENT WITH THE AGREEMENT.
• Remediation is billable and outside existing agreements. Any diagnosis, repair, restoration, rebuild, data recovery, or security remediation arising from or related to the third party’s access is not included in, and is outside the scope of, Client’s current management agreements with Provider. Such work, if requested, will be provided as Supplemental Services or Project Services under the Agreement and billed at Provider’s then-prevailing rates, including after-hours and holiday rates where applicable.
• Service levels and warranties. Service level commitments and service warranties do not apply to issues caused by or arising from the third party’s access, and Provider may treat systems under concurrent third-party administration as outside SLA coverage for the duration of that access. Following the access period, Provider may recommend (and Client may separately engage Provider to perform) validation of the affected environment against Provider’s security and configuration standards.
• Credentials and security. Provider will issue scoped, named credentials where feasible. Credentials may be used only by the individuals named in Section 2 and may not be shared. Provider may require multi-factor authentication and may log third-party activity. Provider may suspend or restrict the access, with notice to Client, if Provider reasonably believes it poses a risk to Client’s environment, Provider’s infrastructure, or other clients.
• Regulatory compliance. Client is solely responsible for ensuring the third party’s access complies with laws and regulations applicable to Client, including, where applicable, HIPAA. If the accessed systems contain protected health information or other regulated data, any required agreement with the third party (including any business associate agreement) is Client’s responsibility; Provider’s Data Processing Agreement with Client does not extend to or cover the third party.
• Indemnification. Consistent with the Agreement, Client shall defend, indemnify, and hold Provider harmless from third-party claims, costs, and expenses (including reasonable attorneys’ fees) arising from or related to the access authorized by this form or the third party’s acts or omissions.
• Revocation and expiration. Client may revoke this authorization at any time by written notice to Provider, and access will be disabled within a commercially reasonable time after receipt. Access expires automatically at the end date stated in Section 3. Sections 4 through 6 and 9 through 11 of these acknowledgments survive revocation or expiration.
• Relationship to the Agreement. This form is governed by and incorporated under the Agreement. It supplements, and does not amend, the Agreement; in the event of a conflict regarding the access it describes, this form controls as to that access.

5. Client Signature