What Should A Cybersecurity Reseller Agreement Cover?

A cybersecurity reseller agreement should clearly say what you can sell, who you can sell it to, how support works, how licences renew, who handles customer data, and who carries the risk if something goes wrong.

That sounds simple enough, but cybersecurity products come with a few channel-specific issues that ordinary software reseller terms often miss. You may be selling a tool that monitors systems, processes logs, detects threats, stores personal information, or makes strong security claims to end customers.

So your reseller terms and conditions need to do more than cover price and payment. They should protect the product, the channel relationship and the end customer experience, without promising more than the technology can actually deliver.

Do You Need A Written Cybersecurity Reseller Agreement?

Yes, if your business is selling cybersecurity products through another party, you should have a written reseller agreement in place.

A handshake or a purchase order might get the first deal moving, but it rarely answers the questions that matter once renewals, support issues, data access or customer complaints come up. Without clear terms, you may struggle to recover unpaid invoices, control how your product is marketed, or work out who is responsible when an end customer says the product failed.

A good IT reseller agreement usually covers:

• What is being resold, such as licences, subscriptions, hardware, managed services, implementation, training or support.
• Who can buy, including territories, customer segments, excluded customers and whether the reseller can use sub-resellers.
• Pricing and margins, including discounts, payment timing, taxes and currency.
• Licence rules, including user numbers, devices, environments, renewal dates and restrictions on use.
• Support obligations, including whether the reseller handles first-line support or escalates issues to the vendor.
• Data handling, especially if the product collects logs, endpoint data, personal information or security events.
• Liability and security claims, including what happens if the customer alleges a breach, outage or false promise.

Say you run a Melbourne cybersecurity vendor that sells endpoint protection through managed service providers. One reseller tells customers the product gives complete protection from ransomware. Another reseller opens support tickets straight to your engineering team for every password reset. A written agreement gives you a practical way to set boundaries before those habits become costly.

What Should Your Reseller Terms Actually Cover?

Your reseller terms should cover the full sales journey, from marketing and quoting through to renewal, support, termination and offboarding.

For cybersecurity products, the key is to make the channel model clear. Are you appointing the reseller as a sales agent, a non-exclusive reseller, an exclusive distributor, or a managed services partner? Each model creates different commercial and legal risks.

Appointment And Scope

Your agreement should explain exactly what rights the reseller has. For example, can they:

• sell directly to end customers?
• bundle your product with their own managed security services?
• sell in all of Australia, only in certain states, or also overseas?
• appoint other resellers or referral partners?
• use your trade marks, product screenshots and demo environments?

If you allow brand use, include clear brand guidelines. If your trade marks are registered with IP Australia, the agreement should still control how the reseller can use them in proposals, websites, ads and customer presentations.

Pricing, Orders And Payment

Your terms should say whether the reseller buys licences from you and resells them at their own price, or whether you contract directly with the end customer and pay the reseller a commission.

Be careful with resale pricing. Under the Competition and Consumer Act 2010, resale price maintenance is generally prohibited. You can often recommend a retail price, but you shouldn't require a reseller to sell above a minimum price unless you have a proper legal basis.

Your payment terms should also cover:

• when invoices are issued and payable
• whether payment is due even if the end customer hasn't paid the reseller
• what happens if a customer adds seats part way through a subscription term
• price increases at renewal
• refunds, credits and chargebacks

Marketing And Customer Claims

Cybersecurity marketing can be risky because customers rely on claims about protection, detection, compliance and response times. Your agreement should stop resellers from making claims you haven't approved.

Under the Australian Consumer Law, misleading or deceptive conduct is prohibited. This applies to business-to-business dealings as well as consumer sales. If a reseller says your product prevents all data breaches, meets every compliance requirement or guarantees no ransomware incident, that statement can create serious problems for both of you.

Keep approved marketing claims, technical documents and case studies up to date, and make it clear that resellers can't alter them without approval.

Who Is Responsible For The End Customer?

It depends on your channel model, but your agreement should make the customer relationship very clear.

In some reseller arrangements, the reseller contracts directly with the end customer and you remain behind the scenes as the vendor. In others, the end customer accepts your end user licence agreement, privacy terms and acceptable use rules directly.

For cybersecurity products, you'll often need both:

• a reseller agreement between you and the reseller; and
• an end customer agreement or EULA that controls how the end customer can use the product.

The reseller agreement should require the reseller to make sure the end customer accepts the correct end customer terms before accessing the product. This is often called a flow-down obligation, because key terms flow from the vendor to the end customer.

Those end customer terms should cover licence limits, acceptable use, prohibited reverse engineering, security responsibilities, data handling, suspension rights and limits on liability.

For example, if an end customer turns off a core detection setting, fails to patch their environment, ignores alerts or doesn't follow onboarding steps, your terms should make it clear that you aren't responsible for the resulting gap in protection.

How Should Support Tiers And Service Levels Work?

Your agreement should spell out support roles in detail, because support confusion is one of the fastest ways for a channel partnership to become strained.

A practical support model might look like this:

• Level 1 support - the reseller handles basic customer questions, password resets, onboarding and first checks.
• Level 2 support - the reseller investigates configuration, integrations and standard troubleshooting.
• Level 3 support - the vendor handles product bugs, platform outages, deeper technical issues and escalations.

Your terms should also cover how incidents are logged, what information the reseller must provide, when issues can be escalated, and what happens if a ticket is caused by customer misuse or a third-party system.

If you offer service levels, be precise. For example, define severity levels, response times, support hours, excluded downtime, planned maintenance and any service credits. A promise to respond within one business day is very different from a promise to fix a critical vulnerability within one business day.

You should also decide whether the reseller can offer its own support commitments to the end customer. If they promise 24/7 incident response but you only provide business hours vendor support, your agreement should say that extra promise is the reseller's responsibility.

How Do Licence Renewals, Auto-Renewals And Cancellations Work?

Your reseller agreement should set out the renewal process clearly, because subscription timing is where many software reseller disputes start.

Cybersecurity products are often sold on monthly, annual or multi-year subscriptions. Your agreement should answer:

• does the licence renew automatically?
• how much notice is needed to cancel or reduce seats?
• can prices change at renewal?
• what happens if the reseller misses the renewal deadline?
• does access stop immediately if payment is late?
• who tells the end customer about renewal dates and price changes?

Automatic renewal clauses can be useful, but they need to be clear. If your agreement is a standard form contract with a small business or consumer, the unfair contract terms regime under the Australian Consumer Law may apply. A small business is generally covered if it has fewer than 100 employees or annual turnover under $10 million.

From November 2023, unfair contract terms in standard form consumer and small business contracts can attract penalties. For companies, the maximum penalty can be the greater of $50 million, three times the benefit obtained, or 30 percent of adjusted turnover during the breach turnover period. So, renewal terms should be transparent and balanced, not buried in fine print.

If the end customer is treated as a consumer under the Australian Consumer Law, consumer guarantees may also apply. This can include business customers where the goods or services cost $100,000 or less, or are ordinarily acquired for personal, domestic or household use. You generally can't contract out of those guarantees.

What Data And Privacy Terms Do Cybersecurity Resellers Need?

You need data and privacy terms if your product, reseller or support team handles personal information, customer system data, logs, security events or credentials.

Cybersecurity tools often touch sensitive parts of a customer's environment. Even if you don't store obvious personal details, logs can contain usernames, IP addresses, device identifiers, email addresses, file paths and incident details that may identify people.

Your agreement should cover:

• what data the product collects and why
• whether the vendor, reseller or customer controls that data
• where data is stored, including any overseas hosting
• who can access admin consoles and logs
• minimum security controls for the reseller
• confidentiality obligations
• incident notification steps
• data return or deletion when the agreement ends

The Privacy Act 1988 and Australian Privacy Principles may apply if your annual turnover is over $3 million, or if an exception applies. Some cybersecurity businesses choose to align with the Privacy Act anyway, because enterprise customers increasingly expect it.

If an eligible data breach occurs under the Privacy Act, you may need to notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable. Your reseller terms should say who investigates, who notifies, who approves customer communications and who pays for remediation steps.

If you support customers in regulated sectors, such as critical infrastructure, health or finance, extra obligations may apply. This is where tailored advice is worth getting, because a generic software reseller template may not deal with sector-specific reporting, audit or security requirements.

How Should Liability For Security Claims Be Managed?

Your agreement should manage liability by matching responsibility to control. In other words, the party that makes a promise, controls a process or causes a problem should usually carry the risk for it.

No cybersecurity product can honestly guarantee that an end customer will never suffer a breach. Your terms should avoid absolute promises and focus on what the product is designed to do, what exclusions apply, and what the customer must do for the product to work properly.

Useful liability terms often include:

• approved claims, so resellers can only use vendor-approved statements about performance and security outcomes
• customer responsibilities, such as configuration, patching, access controls, backups and responding to alerts
• exclusions for misuse, unsupported systems, customer changes, third-party products and unauthorised modifications
• liability caps, often linked to fees paid over a set period
• indemnities for unauthorised claims, IP infringement caused by reseller materials, privacy breaches or breach of confidentiality
• insurance requirements, such as cyber liability, professional indemnity or technology errors and omissions insurance

There are limits to what you can exclude, especially under the Australian Consumer Law. You should also avoid clauses that are too one-sided in a standard form small business contract, because unfair contract term rules may apply.

The aim isn't to push all risk onto the other party. The aim is to be fair and clear, so everyone knows what they're promising and where the boundaries sit.

Key Takeaways

• A cybersecurity reseller agreement should cover the channel model, pricing, licence rules, support tiers, renewals, data handling and liability.
• End customer terms matter. Make sure the customer accepts the right EULA or customer agreement before using the product.
• Support obligations should be specific, especially around escalation, severity levels, response times and who deals with the customer.
• Cybersecurity claims need tight control. Resellers should only use approved statements that you can back up.
• Privacy and incident response terms are essential where your product or support team touches logs, credentials or personal information.
• Templates often miss reseller-specific issues, so your agreement should be tailored to your product, customer base and sales model.

If you'd like help with your cybersecurity reseller agreement, end customer licence terms, support arrangements or data handling clauses, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.