Agreements

Use of LightHouse™ is governed by the master services agreement (MSA) and the data processing agreement (DPA), accepted in LightHouse or executed outside it and recorded by Atlantic.

Methods

Method	Used for	Recorded as
Click-through at sign-up	Self-service sign-up	Accepted
Acceptance at Billing → Terms	New versions of the standard text	Accepted
Order form	Sales-led onboarding	Accepted, with the route order_form
Negotiated MSA or DPA signed outside the portal	Sales-led onboarding with negotiated terms	Executed agreement

Versions

Each agreement’s version is the date its text took effect, such as 2026-10-31. The text of each version is published on the company site under that date (see Legal). A later version is published alongside earlier versions; published versions are not edited. When a new version takes effect, LightHouse lists it as awaiting acceptance on Billing → Terms and in the set-up mission’s Settle how you pay step.

Procedure

The Agreements panel on Billing → Terms shows, for each agreement, the version in force and its status: Accepted, Awaiting acceptance or Executed agreement.

1. Open Billing → Terms, signed in as a person with the client_admin role.

2. Read the standard text from the link beside the version.

3. Choose Accept the master services agreement or Accept the data processing agreement.

   Result: the panel shows the agreement as Accepted, with the version.

Acceptance is made by a person. Atlantic staff, machine keys and delegated tokens cannot accept. If a new version took effect after the page was loaded, the acceptance is refused; reload the page, read the new text and accept again.

Acceptance record

Field	Content
Agreement and version	For example, msa 2026-10-31
Time	When the acceptance was made
Person	The verified sign-in email address
Origin	Keyed hashes of the network address and browser. These show whether steps came from the same party; the address itself is not stored

The record is append-only and cannot be edited or deleted while the tenant exists. It is also entered in the tenant’s audit log as agreement_accepted.

Negotiated agreements

An organisation that negotiates its MSA or DPA signs it outside the portal. Atlantic records the executed agreement against the tenant:

Field	Content
Contract reference	The reference on the signed document
Effective date	The date from which the agreement governs
Signatories	Both parties’ signatories
Document hash	The SHA-256 hash of the signed document. LightHouse holds the hash, which identifies the signed file; it does not hold the document

The record is append-only and appears in the tenant’s audit log as agreement_executed_recorded, an action by Atlantic.

From its effective date, an executed agreement governs in place of the standard text for that agreement. Later versions of the standard text are not offered for acceptance; a negotiated agreement changes by amendment, recorded as a further executed agreement. The panel shows the reference, effective date, signatories and hash. To compare the organisation’s copy with the record:

shasum -a 256 signed-agreement.pdf

API

Route	Role	Action
GET /api/v1/agreements	Any role	Returns the versions in force, when the tenant accepted each, any executed agreement that governs, and what is pending
POST /api/v1/agreements	client_admin, a person	Accepts the versions in force, such as {"msa": "2026-10-31", "dpa": "2026-10-31"}; the response lists what was newly recorded

A version already accepted is not recorded again. An agreement governed by an executed agreement cannot be accepted through this route (409).