UpSec Customer Terms of Service

1. Definitions

In this agreement and related documents, the following terms have the following meanings:

"Affiliates" means, with respect to either Party, any entity that, directly or indirectly, controls, is controlled by, or is under common control with such Party, where control means the power to direct the affairs or management of such entity, whether through the ownership of more than fifty percent (50%) of the voting securities, by contract, as trustee or executor.

"Agreement" means these Terms, the applicable Order Form, Support Policy, the Privacy Policy, the Data Processing Agreement (if applicable), any supplemental license terms applicable to a Product, and any other documents expressly incorporated herein by reference, each as amended from time to time in accordance with these Terms.

"Content" means any data, text, graphics, photographs, videos, audio clips, software, scripts, reports, findings, interactive features and other materials generated, provided or otherwise made available by UpSec through or in connection with the Product.

"Customer Account" means an account made available by UpSec to enable Customer to access and use the Product or certain features thereof.

"Customer Content" means any data, information, files, materials, reports, outputs or other content submitted, uploaded, transmitted, stored, generated or otherwise made available by Customer or its authorized users through or in connection with the Products.

"Data Processing Agreement" means a separate written agreement, if any, entered into between UpSec and Customer governing the processing of personal data by UpSec on behalf of Customer in connection with the Products and Services, as may be required by applicable data protection laws.

"Documentation" means any user guides, technical specifications, instructions, release notes, or other informational materials relating to the installation, operation, or use of the Products that UpSec may make available to Customer from time to time, excluding marketing materials. Documentation may be provided in any form or medium and may be updated by UpSec from time to time.

"End Point" means a unique host or device (either physical or virtual) of the Customer that is scanned, monitored, or otherwise processed by the Product when in operation.

"Free Trial" means any temporary, free-of-charge proof-of-value, proof-of-concept, pilot, evaluation, or trial access to a Product made available by UpSec to Customer for internal evaluation purposes and not for production use, unless otherwise expressly agreed in writing.

"Incident" means a period during which Product is unavailable, or any deviation from any functionality as defined for Product. The following, including but not limited to, shall not be considered as Incident: scheduled maintenance and upgrades, degraded performance, factors outside of UpSec’s control, including any force majeure event, failures of the internet, omissions of Customer and/or its end users, and enforcement of applicable regulations.

"Intellectual Property Rights" means all registered and unregistered rights granted, applied for or otherwise now or hereafter existing under or relating to patents, copyrights, trademarks, trade secrets, database rights, know-how and other intellectual property or proprietary rights, and all similar or equivalent rights or forms of protection, including all applications, registrations, renewals, extensions and continuations thereof, in any part of the world.

"Order Form" means a subscription order form that specifies the commercial details, subscription, and support Services, and other specific terms and conditions for the Product.

"Partner(s)" means UpSec's authorized reseller, distributor, referral partner or other authorized sales intermediary, but excludes any managed security service provider (MSSP) acting under a separate MSSP partner arrangement with UpSec.

"Privacy Policy" means UpSec’s personal data protection policy available at https://www.upsec.io/privacy.

“Product” or “Software” means any software, platform, service, feature, module, tool, update, upgrade, enhancement, modification or extension made available by UpSec to Customer under the Agreement, including:

• •UpSec External, a cloud-based software-as-a-service offering made available and hosted by UpSec or its service providers, where UpSec is providing Software, Customer Account and Content;
• •UpSec Internal, software deployed, installed or otherwise made available for use in Customer's or a third party's environment pursuant to the applicable Order Form.

For clarity, Products include updates provided by UpSec, but exclude third-party software and open-source software.

"Security Incident" means a confirmed breach of security resulting in unauthorized access to, acquisition, use, disclosure, alteration, destruction or loss of Customer Content, or unauthorized access to or compromise of the systems used by UpSec to provide the Products. Security Incident does not include unsuccessful attempts or activities that do not result in an actual compromise, including unsuccessful login attempts, scans, probes, pings, denial-of-service attempts, or other attacks on firewalls or networked systems.

"Service" means the provision and availability of the Product by UpSec, including any related support, maintenance, updates, upgrades, modifications and new features.

"Support Policy" means UpSec's support policies, procedures, and support-related guidelines applicable to the Products, whether set forth in a separate document or otherwise communicated by UpSec.

"Subscription Term" means the period during which Customer is authorized to access and use the applicable Products and Services, as specified in the applicable Order Form, including any renewal or extension thereof agreed by the Parties in writing, unless earlier terminated in accordance with the Agreement.

"Website" means the website located at https://www.upsec.io/.

2. Scope and Acceptance of the Agreement

2.1 Eligibility and Authority - The Products are intended for use by businesses and other organizations. By entering into this Agreement or using any Product, Customer represents and warrants that it has full legal capacity and authority to enter into this Agreement. If an individual enters into this Agreement or accesses or uses any Product on behalf of a legal entity or other organization, such individual represents and warrants that he or she has the authority to bind such entity or organization to this Agreement.

2.2 Acquisition through Partners - The Products may be purchased directly from UpSec or through a Partner. Unless otherwise expressly agreed in writing, these Terms shall apply regardless of whether the Products are acquired directly from UpSec or through a Partner. Commercial terms agreed between Customer and a Partner shall not modify or supersede this Agreement as between Customer and UpSec.

2.3 Acceptance of the Agreement - Customer shall be deemed to have accepted and become bound by this Agreement upon the earliest of: (a) execution of an Order Form; (b) accessing, using or attempting to use any Product; (c) installation or deployment of any Product; or (d) acceptance of the Agreement by any other means permitted by UpSec. By accessing or using a Product, Customer acknowledges that it has read, understood, and agrees to be bound by this Agreement.

3. Changes to the Agreement

UpSec may amend these Terms from time to time. Any material changes will be communicated to Customer through the Website, the Product, email, or other reasonable means. Unless otherwise specified, changes to these Terms will become effective upon the date indicated in the updated version.

Customer's continued access to or use of any Product after the effective date of the updated Terms constitutes Customer's acceptance of such changes. If Customer does not agree to the updated Terms, Customer must cease using the affected Product and may terminate the Agreement in accordance with its terms.

For the avoidance of doubt, UpSec shall not unilaterally modify the applicable Order Form or any agreed fees, Subscription Term, or other commercial terms during the then-current Subscription Term, unless otherwise agreed by the Parties in writing.

4. Access to and Use of the Product

4.1 Grant of Rights - Subject to Customer's compliance with the Agreement and payment of all applicable fees (if any), UpSec grants Customer, during the applicable Subscription Term, solely for Customer's internal business purposes and solely within the scope specified in the applicable Order Form (including any applicable limitations relating to End Points, features, volumes, locations, or other usage metrics):

(a) with respect to UpSec External, a limited, non-exclusive, non-transferable, non-sublicensable, and revocable right to access and use the Product as a hosted software-as-a-service offering; and

(b) with respect to UpSec Internal, a limited, non-exclusive, non-transferable, non-assignable, non-sublicensable, and revocable license to install, deploy and use the Product in object code form, within Customer-managed or third-party environments designated by Customer, in accordance with the Agreement and applicable Documentation.

Any use exceeding the scope purchased by Customer or otherwise agreed by UpSec, including any applicable End Point limitations, is prohibited and may be restricted by UpSec. The rights granted under this Section are limited to the Products identified in the applicable Order Form or otherwise made available by UpSec as part of a Free Trial. The Products are licensed, not sold.

Except as expressly provided herein, no rights are granted to Customer by implication, estoppel or otherwise, and UpSec and its licensors (if any) reserve all rights not expressly granted under the Agreement. Nothing in the Agreement obligates UpSec to deliver or make available any copies of computer programs or code to Customer.

4.2 Authorized Users - Customer may permit its authorized employees, contractors, and/or Affiliates (collectively referred to as "Authorized Users") to access and use the Products, provided that such access is solely for Customer's internal business purposes and in accordance with the Agreement. Customer shall remain fully responsible and liable for all acts and omissions of its Authorized Users and Affiliates as if such acts or omissions were those of Customer itself.

An Affiliate may enter into a separate Order Form with UpSec, in which case such Affiliate shall be deemed the Customer under the applicable Order Form and shall be solely responsible for its own obligations thereunder.

4.3 Restrictions - Customer shall not, and shall not permit any third party to:

• a)copy, reproduce, modify, adapt, translate, create derivative works of, distribute, sell, sublicense, lease, assign, transfer, disclose or otherwise exploit any Product or Documentation, except as expressly permitted under the Agreement;
• b)reverse engineer, decompile, disassemble, decrypt, extract or otherwise attempt to derive or discover the source code, object code, underlying structure, ideas, algorithms, file formats, non-public APIs, architecture or other non-public aspects of any Product;
• c)access or use any Product to develop, support or provide a competing product or service;
• d)remove, alter, obscure or circumvent any copyright notices, trademarks, proprietary notices, security mechanisms or technical restrictions contained in or relating to any Product;
• e)interfere with, disrupt, impair or compromise the integrity, security, availability or performance of any Product or related infrastructure;
• f)introduce, transmit or store malware, malicious code, Trojan horses, spyware, ransomware or other harmful components in or through any Product;
• g)access or use any Product in violation of applicable laws, regulations or third-party rights, or for any unauthorized, unlawful or fraudulent purpose;
• h)permit any person other than Authorized Users to access or use the Products;
• i)exceed or circumvent any End Point limitations, user limitations, feature limitations or other usage restrictions set forth in the Agreement or the applicable Order Form, including through pooling, virtualization, multiplexing or similar techniques;
• j)publish or disclose benchmark tests, performance results or comparative analyses relating to any Product without UpSec's prior written consent;
• k)provide, resell, sublicense, host, operate or otherwise make any Product available to third parties as a managed service, service bureau, outsourcing or similar offering, except as expressly authorized by UpSec;
• l)install, activate or use more copies, instances or deployments of any Product than expressly permitted under the Agreement or applicable Order Form; and
• m)use any Product in a manner inconsistent with the Agreement or applicable Documentation.

4.4 Free Trials and Beta Features - UpSec may, in its discretion, make Products or certain features available on a Free Trial or beta basis. Unless otherwise agreed in writing, Free Trials and beta features are provided on an "AS IS" basis, may be modified, suspended or discontinued at any time, and may not be subject to the Support Policy, warranties or support obligations otherwise applicable under the Agreement.

5. Orders, Subscription Term and Usage Limitations

5.1 Orders - Products are ordered pursuant to one or more Order Forms entered into between Customer and UpSec. Each Order Form specifies, as applicable, the Products purchased, Subscription Term, Subscription Scope, number of End Points, applicable fees, support level and other commercial terms. In the event of any conflict between these Terms and an Order Form, the applicable Order Form shall prevail solely with respect to the subject matter of such conflict.

5.2 Subscription Term and Renewal - Unless otherwise specified in the applicable Order Form, Customer's right to access and use the Products commences on the effective date set forth in the applicable Order Form and continues for the Subscription Term specified therein.

Subscriptions do not automatically renew unless expressly agreed by the Parties in writing. Any renewal, extension or expansion of the Subscription Term or Subscription Scope shall be subject to a new or amended Order Form executed by the Parties.

5.3 Subscription Scope and Usage Limitations - Customer's rights to access and use the Products are limited to the scope specified in the applicable Order Form or otherwise agreed by UpSec, including any limitations relating to End Points, Authorized Users, features, modules, deployment locations, environments or other usage metrics (collectively, the "Subscription Scope"). Any use beyond the Subscription Scope may require the execution of an additional or amended Order Form and payment of additional fees.

5.4 Changes to Subscription Scope - Customer may request changes to the Subscription Scope during the Subscription Term. Any increase in the Subscription Scope, including additional Products, features, modules, Authorized Users, or End Points, shall be subject to UpSec's approval and may require the execution of an additional or amended Order Form and payment of additional fees.

Unless otherwise agreed by the Parties in writing, any reduction in the Subscription Scope shall take effect upon commencement of a subsequent Subscription Term.

5.5 Monitoring and Audit - Customer acknowledges that certain Products may contain mechanisms designed to monitor usage metrics relevant to the applicable Subscription Scope, including the number of End Points, Authorized Users, features or modules used. Customer shall not disable or interfere with any such mechanisms.

Upon reasonable prior notice, UpSec may request information reasonably necessary to verify Customer's compliance with the applicable Subscription Scope and the Agreement. Customer shall provide reasonable cooperation in connection with such verification. If any such verification reveals use exceeding the applicable Subscription Scope or other unauthorized use, Customer shall promptly pay the applicable fees for such excess or unauthorized use at UpSec's then-current rates, without prejudice to any other rights or remedies available to UpSec under the Agreement.

5.6 Suspension - UpSec may suspend Customer's access to or use of any Product or Customer Account, in whole or in part, upon notice to Customer, if:

• a)Customer materially breaches the Agreement;
• b)Customer fails to timely pay any undisputed amounts due under the Agreement;
• c)Customer exceeds the applicable Subscription Scope;
• d)Customer's use of the Product poses a material security risk to UpSec, the Product or any third party; or
• e)such suspension is required by applicable law or a governmental authority.

UpSec shall use commercially reasonable efforts to limit any suspension to the affected Product and to restore access promptly after the underlying issue giving rise to the suspension has been resolved. Suspension of the Product shall not relieve Customer of its obligation to pay any fees accrued prior to or during the period of suspension. Any suspension under this Section is without prejudice to UpSec's right to terminate the Agreement or any Order Form in accordance with Section 15.

6. Product-Specific Terms

6.1 UpSec External - UpSec External is a hosted software-as-a-service offering operated by UpSec or its service providers. Subject to the Agreement, UpSec shall make UpSec External available to Customer during the applicable Subscription Term.

Access to UpSec External requires the creation and maintenance of Customer Accounts and Authorized User credentials. Customer is responsible for maintaining the confidentiality of login credentials and for all activities conducted through Customer Accounts.

The availability, support and maintenance commitments applicable to UpSec External shall be governed by the applicable Support Policy.

6.2 UpSec Internal - UpSec Internal is deployed within Customer's or a third party's environment designated by Customer. Customer shall be responsible for providing and maintaining all infrastructure, systems, hardware, software, networking, cloud resources and other prerequisites necessary for the deployment and operation of UpSec Internal, unless otherwise agreed in writing.

Customer shall install, deploy and operate UpSec Internal in accordance with the Documentation and any technical requirements communicated by UpSec. UpSec may provide license keys, activation credentials or other access mechanisms necessary for the operation of UpSec Internal. Customer shall protect such credentials against unauthorized use and shall not share them except as permitted under the Agreement.

Customer acknowledges that the performance, availability and security of UpSec Internal may depend on Customer's environment and infrastructure. UpSec shall not be responsible for outages, failures, vulnerabilities or performance issues caused by Customer's systems, third-party systems or any configuration or deployment not performed or approved by UpSec.

Unless otherwise agreed between the Parties, Customer shall be responsible for backup, disaster recovery, system administration and operational security relating to Customer's environment.

7. Support and Professional Services

7.1 Support Services - Subject to Customer's compliance with the Agreement and payment of all applicable fees, UpSec shall provide support and maintenance services for the Products in accordance with the applicable Support Policy. The scope, availability, service levels, maintenance windows, support channels and incident response commitments are set forth in the Support Policy or the applicable Order Form.

Certain service levels and availability commitments may apply only to specific Products, as further described in the applicable Support Policy.

Support provided in connection with a Free Trial or beta feature shall be provided solely at UpSec's discretion, unless otherwise agreed in writing.

7.2 Incident Reports - Customer may report Incidents in accordance with the procedures specified in the applicable Support Policy or Order Form. Customer shall provide UpSec with reasonable information and cooperation necessary for investigating and resolving any Incident.

7.3 Updates and Maintenance - The Products may include updates, upgrades, enhancements, bug fixes, and new features made generally available by UpSec from time to time. Such updates shall be deemed part of the Products and subject to the Agreement.

For UpSec External, UpSec may perform scheduled maintenance affecting the availability or functionality of the Product. Planned maintenance windows and related procedures shall be governed by the applicable Support Policy.

For UpSec Internal, updates and maintenance activities may require Customer cooperation and may be deployed by Customer or with Customer's approval, unless otherwise agreed by the Parties. Customer acknowledges that the availability and timing of updates and maintenance activities for UpSec Internal may depend on Customer's environment and infrastructure. UpSec shall not be responsible for any downtime or disruption resulting from Customer's implementation, postponement or failure to implement updates.

7.4 Professional Services - Certain Products or subscriptions may include, or the Parties may otherwise agree upon, implementation, configuration, onboarding, training, consulting or other professional services ("Professional Services"). The scope and any applicable fees for such Professional Services shall be set forth in the applicable Order Form, statement of work or other written agreement. Unless otherwise expressly agreed in writing, Professional Services shall be performed using commercially reasonable skill and care and shall be subject to the terms of the Agreement.

8. Fees and Payment

8.1 Fees - Customer shall pay the fees set forth in the applicable Order Form. Unless otherwise specified in the applicable Order Form, all fees are payable in advance and are non-cancellable and non-refundable, except as expressly provided in the Agreement or required by applicable law. Failure or delay in making payment of any due fee may result in the withholding of delivery or access to the Product until your account balance is paid in full.

8.2 Invoicing and Payment - UpSec shall issue invoices in accordance with the applicable Order Form. Customer shall pay all undisputed amounts due under an invoice within the payment period specified therein, without set-off, counterclaim or deduction, except as required by applicable law. Customer shall be responsible for maintaining complete and accurate billing and contact information and shall promptly notify UpSec of any changes thereto.

8.3 Taxes - Fees are exclusive of any value-added, sales, use, withholding or similar taxes, duties or governmental charges, except for taxes imposed on UpSec's income. Customer shall be responsible for all applicable taxes, duties, levies, bank charges, wire transfer fees and similar charges associated with payments under the Agreement. If UpSec is required by applicable law to collect or remit any taxes on behalf of Customer, such amounts may be invoiced to Customer, unless Customer provides a valid exemption certificate or other documentation acceptable to the relevant taxing authority.

8.4 Fee Changes - UpSec may modify its fees from time to time by providing Customer with reasonable prior notice. Any such changes shall not affect the fees applicable to the then-current Subscription Term and shall apply only to any subsequent Subscription Term or any new or amended Order Form, unless otherwise agreed by the Parties.

8.5 Late Payments - Without prejudice to any other rights or remedies available under the Agreement or applicable law, UpSec reserves the right to charge interest on overdue amounts to the extent permitted by applicable law. Customer shall reimburse UpSec for reasonable costs incurred in collecting overdue amounts, including reasonable attorneys' fees and collection costs.

9. Customer Content, Privacy and Security

9.1 Customer Content - Customer retains all right, title and interest in and to Customer Content. Nothing in the Agreement transfers ownership of Customer Content to UpSec.

Customer grants UpSec a non-exclusive, worldwide, limited right to access, use, process, transmit, store and otherwise handle Customer Content solely to the extent necessary to provide, operate, maintain, secure and support the Products, perform Professional Services, comply with applicable law and exercise UpSec's rights and obligations under the Agreement.

Customer represents and warrants that it has all rights, permissions and legal bases necessary to provide Customer Content to UpSec and to permit its processing in accordance with the Agreement.

Customer is solely responsible for the accuracy, quality, integrity, legality and appropriateness of Customer Content and for maintaining appropriate backups thereof. Customer shall not rely on the Products as the sole repository or archive of Customer Content.

9.2 Security - Customer acknowledges that the use of software products and cloud-based services involves risks of unauthorized access, disclosure, corruption, loss, interruption or other security events and assumes such risks inherent in the use of the Products.

With respect to UpSec External, the Products are hosted and operated by UpSec and its third-party service providers. UpSec does not represent, warrant or guarantee that the Products or Customer Content will be free from vulnerabilities, security incidents, unauthorized access, interruptions or other harmful events caused by third parties or circumstances beyond UpSec's reasonable control.

With respect to UpSec Internal, Customer is solely responsible for the deployment, configuration, operation, maintenance and security of its own and any third-party environments designated by Customer, including all systems, networks, backups and Customer Content. UpSec shall have no responsibility or liability for any unauthorized access to, loss, corruption, destruction or disclosure of Customer Content arising from Customer's infrastructure, hosting arrangements, security practices or third-party environments.

Customer is solely responsible for maintaining appropriate backups and redundancy measures and for complying with any applicable legal, regulatory or industry-specific requirements relating to Customer Content and Customer's systems.

9.3 Security Incidents - In the event UpSec becomes aware of a Security Incident affecting Customer Content processed by UpSec in connection with UpSec External, UpSec shall use commercially reasonable efforts to take such remedial actions as UpSec considers appropriate under the circumstances and, where required by applicable law or the Data Processing Agreement, notify Customer of such Security Incident.

With respect to UpSec Internal, Customer shall be solely responsible for detecting, responding to and remediating any Security Incident affecting Customer's systems, infrastructure or Customer Content. Customer shall promptly notify UpSec of any Security Incident that may materially affect the Products or UpSec's systems.

Notwithstanding the foregoing, UpSec may take any actions it reasonably considers necessary to protect the Products, its systems, other customers or third parties, including suspending access to the Products or certain functionalities, and UpSec shall not be liable for any losses arising from such actions.

9.4 Privacy and Personal Data - UpSec may process Personal Data for which it acts as controller, including account, billing, support, usage, security and business contact data, in accordance with its Privacy Policy. To the extent UpSec processes Personal Data on behalf of Customer in connection with the Products, UpSec shall act as a processor or service provider, and Customer shall act as the controller or business, as applicable under relevant data protection laws.

UpSec's Privacy Policy and, where applicable, the Data Processing Agreement are incorporated into and form part of the Agreement. In the event of any conflict between the Agreement and the Data Processing Agreement with respect to the processing of Personal Data, the Data Processing Agreement shall prevail.

Customer is solely responsible for ensuring that it has obtained all rights, consents and legal bases required to process Personal Data through the Products and for complying with applicable data protection laws.

9.5 Usage Data - UpSec may collect or receive technical, diagnostic, telemetry and usage-related information regarding the operation and use of the Products ("Usage Data"). UpSec may use Usage Data for billing, support, security, maintenance, analytics, product development and other legitimate business purposes. UpSec may aggregate, anonymize or de-identify Usage Data and use such aggregated, anonymized or de-identified data for analytics, research, benchmarking, security intelligence, service improvement and other lawful business purposes, provided that such data does not identify Customer or any natural person.

9.6 AI Features - Certain features of UpSec External may incorporate artificial intelligence or machine learning capabilities ("AI Features"). AI Features are not included in, and shall not form part of, UpSec Internal unless expressly agreed by the Parties in writing. Customer acknowledges that AI Features may generate outputs based on Customer prompts, inputs or other information provided through the Products and that such outputs may be inaccurate, incomplete or unsuitable for Customer's intended purposes.

Customer remains solely responsible for reviewing and validating any output generated by AI Features before relying on or using such output.

Unless otherwise expressly agreed, Customer shall not submit to AI Features any information that Customer is prohibited from disclosing under applicable law or contractual obligations.

UpSec may use third-party service providers to provide AI Features. Such third-party providers shall process Customer data in accordance with the Agreement, the Privacy Policy and, where applicable, the Data Processing Agreement.

10. Intellectual Property Rights

10.1 Ownership - As between the Parties, UpSec and its licensors retain and shall retain all right, title and interest, including all Intellectual Property Rights, in and to the Products, Documentation, Website, Content, Usage Data, and all improvements, modifications, enhancements, updates and derivative works thereof. The Products are made available to Customer on a limited right-to-use basis in accordance with the Agreement and no ownership rights are transferred to Customer, irrespective of the use of terms such as "purchase", "subscription" or similar terminology.

Any unauthorized use of any part of the Products, Documentation or Content may constitute an infringement of Intellectual Property Rights, and UpSec reserves all rights and remedies available under applicable law.

Customer retains all right, title and interest, including all Intellectual Property Rights, in and to Customer Content. UpSec does not acquire any ownership rights in Customer Content by virtue of the Agreement or Customer's use of the Products.

10.2 Reservation of Rights - Except for the limited rights expressly granted under the Agreement, all rights in and to the Products, Documentation and related Intellectual Property Rights are reserved by UpSec and its licensors. No rights are granted by implication, estoppel or otherwise. Nothing in the Agreement obligates UpSec to provide Customer with access to any source code.

10.3 Feedback - Customer may, from time to time, provide suggestions, comments, recommendations, ideas or other feedback relating to the Products or Services ("Feedback"). Customer hereby grants UpSec a perpetual, irrevocable, worldwide, non-exclusive, transferable, sublicensable, royalty-free and fully paid-up right and license to use, reproduce, modify, adapt, create derivative works from and otherwise exploit such Feedback for any lawful purpose, without restriction or obligation to Customer. UpSec shall not be required to implement any Feedback.

10.4 Third-Party Components and Integrations - The Products may incorporate, interoperate with or otherwise rely upon certain third-party software, services, applications, APIs, models, libraries, data sources or other components, including open-source software (collectively, "Third-Party Components"). Third-Party Components are subject to the terms and conditions and licenses applicable to such components and, to the extent required, such terms shall prevail solely with respect to the relevant Third-Party Components. UpSec may replace, update, discontinue or modify Third-Party Components from time to time, provided that this does not materially reduce the core functionality of the applicable Products. Unless expressly agreed otherwise, UpSec does not provide separate warranties, support or maintenance for Third-Party Components and shall not be responsible for their availability, accuracy, security, performance or continued operation.

Customer may enable or use integrations, plug-ins, modules or services provided by third parties in connection with the Products ("Third-Party Integrations"). Customer is solely responsible for obtaining and maintaining any licenses, permissions and authorizations required for such Third-Party Integrations and for complying with any applicable third-party terms. Customer acknowledges that the operation of Third-Party Integrations may require the exchange of Customer Content or other information with the applicable third parties. Customer represents and warrants that it has all rights and permissions necessary for such exchange.

Third-Party Integrations are not part of the Products and, unless expressly agreed otherwise, UpSec does not provide any warranty, support or maintenance with respect to Third-Party Integrations and shall not be responsible for any unavailability, errors, security incidents, data loss or other issues arising from or relating to Third-Party Components or Third-Party Integrations.

10.5 Trademarks & Use of Logos - Except as expressly provided in the Agreement, neither Party grants the other any right or license to use its trademarks, trade names, logos or other branding elements. Customer may not use UpSec's name, trademarks or logos without UpSec's prior written consent. Unless Customer notifies UpSec otherwise in writing, UpSec may identify Customer as a customer of UpSec and use Customer's name and logo on UpSec's website, customer lists and marketing materials. Nothing in this clause shall be construed as granting UpSec any ownership rights in the Customer’s logo.

11. Confidentiality

11.1 Confidential Information - "Confidential Information" means any non-public information disclosed by one Party ("Disclosing Party") to the other Party ("Receiving Party"), whether in oral, written, electronic or other form, which is designated as confidential or which reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Without limitation, Confidential Information of UpSec includes the Products, Documentation, source code, object code, technical information, non-public features, and the commercial terms of the Agreement and any Order Form. Confidential Information of Customer includes Customer Content and other non-public information provided by Customer.

Confidential Information shall not include information which the Receiving Party can demonstrate: (a) was lawfully known to it without restriction before disclosure; (b) was independently developed without use of or reference to the Confidential Information; (c) becomes publicly available through no breach of the Agreement; (d) is lawfully obtained from a third party without breach of any confidentiality obligation; or (e) is disclosed pursuant to applicable law, regulation, or a valid order of a competent authority, provided that, to the extent legally permitted, the Receiving Party gives prompt notice to the Disclosing Party and reasonably cooperates in limiting the scope of such disclosure.

11.2 Obligations and Duration - The Receiving Party shall use the Confidential Information solely for the purposes of exercising its rights and performing its obligations under the Agreement and shall protect such Confidential Information using at least the same degree of care it uses to protect its own confidential information, but in no event less than reasonable care.

The Receiving Party may disclose Confidential Information only to its Affiliates, employees, contractors, professional advisers and representatives who have a need to know such information and who are subject to confidentiality obligations no less protective than those set forth herein. The Receiving Party shall remain responsible for any breach of this Section by such persons.

The obligations set forth in this Section shall remain in effect during the term of the Agreement and for a period of ten (10) years following its termination or expiration; provided, however, that with respect to trade secrets and personal data, such obligations shall survive for so long as such information remains protected as trade secret or personal data under applicable law.

11.3 Return or Destruction - Upon termination of the Agreement or upon written request of the Disclosing Party, the Receiving Party shall promptly return or destroy the Confidential Information of the Disclosing Party and, upon request, certify such destruction. Notwithstanding the foregoing, the Receiving Party may retain copies of Confidential Information to the extent required by applicable law, provided that any retained Confidential Information shall remain subject to this Section.

11.4 Remedies - Each Party acknowledges that unauthorized use or disclosure of Confidential Information may cause substantial harm to the Disclosing Party. Accordingly, the Disclosing Party shall be entitled to seek compensation for any damages suffered and to exercise any other rights and remedies available under the Agreement or applicable law.

11.5 Relationship with Separate Non-Disclosure Agreements - If the Parties have entered into a separate non-disclosure agreement, such agreement shall remain in full force and effect and, in the event of any conflict between such agreement and this Agreement, the provisions of the separate non-disclosure agreement shall prevail to the extent of such conflict.

12. Representations, Warranties and Disclaimers

12.1 Mutual Representations and Warranties - Each Party represents and warrants that:

• a)it has full power and authority to enter into the Agreement and perform its obligations thereunder;
• b)the execution and performance of the Agreement do not violate any agreement binding upon such Party; and
• c)it shall comply with all applicable laws and regulations in connection with the performance of its obligations under the Agreement.

12.2 Customer Representations and Warranties - Customer represents and warrants that:

• a)it has all necessary rights, permissions, and legal bases to use and provide Customer Content in connection with the Products;
• b)Customer Content and Customer's use of the Products shall not violate any applicable laws or infringe any third-party rights;
• c)Customer is solely responsible for the accuracy, quality, legality, and integrity of Customer Content and for evaluating whether the Products are suitable for Customer's intended purposes and regulatory requirements;
• d)Customer shall not upload or otherwise process personal data through the Products unless it has obtained all necessary rights, notices, consents and other legal bases required under applicable data protection laws. Unless otherwise expressly agreed in writing and, where applicable, subject to a separate Data Processing Agreement, Customer shall not upload special categories of personal data, sensitive personal data, or other regulated data requiring enhanced protection.

12.3 Limited Product Warranty - UpSec represents and warrants that it has the necessary authority and rights to provide the Products and grant the rights expressly granted under the Agreement.

With respect to UpSec Internal, UpSec further warrants that it owns, or has obtained sufficient rights to, the Software and the Intellectual Property Rights necessary to grant the license expressly provided under the Agreement.

During the applicable Subscription Term, the Products shall materially conform to the applicable Documentation when used in accordance with the Documentation and this Agreement.

The foregoing warranties shall not apply to any non-conformity resulting from misuse, unauthorized modifications, unsupported environments, third-party products, Customer systems, or any combinations thereof, or Customer's failure to comply with the Agreement or Documentation.

Customer's sole and exclusive remedy for any breach of the warranties set forth in this Section 12.3 shall be UpSec's use of commercially reasonable efforts to correct or provide a workaround for the applicable non-conformity, provided that Customer has paid all applicable fees and is not in material breach of the Agreement.

12.4 DISCLAIMER OF WARRANTIES - EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN SECTION 12.3 ABOVE, AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE PRODUCTS, DOCUMENTATION, AND ANY RELATED SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. UPSEC DISCLAIMS ALL OTHER WARRANTIES, REPRESENTATIONS AND CONDITIONS, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE OR USAGE OF TRADE. WITHOUT LIMITING THE FOREGOING, UPSEC DOES NOT WARRANT THAT THE PRODUCTS WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE FROM VULNERABILITIES, BUGS, OR THAT ALL DEFECTS OR ERRORS WILL BE DETECTED OR CORRECTED.

12.5 High-Risk Activities – The Products are not designed, intended or licensed for use in hazardous or high-risk environments where failure of the Products could lead to death, personal injury, environmental damage or significant property loss, including nuclear facilities, weapons systems, aviation systems, life-support systems, autonomous vehicles or critical infrastructure. Customer assumes all risks arising from any such use.

13. Indemnification

13.1 UpSec IP Indemnification - UpSec shall defend Customer against any third-party claim alleging that Customer's authorized use of the Products in accordance with the Agreement infringes any patent, copyright, trademark or other Intellectual Property Right of such third party ("IP Claim"), and shall indemnify Customer for any damages, costs and amounts finally awarded against Customer by a court of competent jurisdiction or agreed in settlement by UpSec in connection with such IP Claim.

UpSec's obligations under this Section are subject to Customer:

• a)promptly notifying UpSec in writing of the IP Claim;
• b)granting UpSec sole control of the defense and settlement of the IP Claim; provided that UpSec shall not enter into any settlement imposing any liability or obligation on Customer without Customer's prior written consent, not to be unreasonably withheld, conditioned or delayed; and
• c)providing reasonable cooperation and assistance, at UpSec's expense;
• d)not admitting liability, settling, compromising or otherwise taking any action with respect to the IP Claim without UpSec's prior written consent, and any failure to comply with the foregoing shall relieve UpSec of its obligations under this Section to the extent prejudiced thereby.

UpSec shall have no liability under Section 13.1 to the extent any IP Claim arises out of:

• a)any modification of the Products not made by or on behalf of UpSec;
• b)the use of the Products with third-party software, hardware, services or data not supplied or approved by UpSec, where the infringement would not have arisen but for such combination;
• c)Customer's use of the Products outside the scope of the Agreement or contrary to the Documentation;
• d)compliance with Customer's instructions, specifications or requirements; or
• e)Customer's failure to implement updates or replacements made available by UpSec, where such claim would have been avoided by using the current version.

If the Products become, or in UpSec's reasonable opinion are likely to become, subject to an IP Claim, UpSec may, at its option and expense:

a) procure for Customer the right to continue using the affected Products;

b) replace or modify the affected Products so that they become non-infringing while substantially preserving their functionality; or

c) terminate the affected Products upon written notice if the foregoing alternatives are not commercially reasonable. Upon any such termination, UpSec shall refund any prepaid fees attributable to the unused portion of the affected Subscription Term.

This Section 13.1 sets forth UpSec's sole liability and Customer's exclusive remedy with respect to any IP Claim.

13.2 Customer Indemnification - Customer shall defend, indemnify and hold harmless UpSec, its Affiliates and their respective directors, officers, employees and contractors from and against any third-party claims, damages, liabilities, losses, fines, penalties, costs and reasonable attorneys' fees arising out of or relating to:

• a)Customer Content, including any allegation that Customer Content infringes, misappropriates or otherwise violates any third-party rights;
• b)Customer's breach of the Agreement or applicable laws;
• c)any infringement or alleged infringement of third-party rights arising from Customer Content;
• d)Customer's processing of personal data or failure to obtain any required consents, notices or other legal bases;
• e)Customer's instructions, specifications, or integrations provided to UpSec;
• f)Customer's or its Authorized Users' unauthorized, unlawful, fraudulent or negligent use of the Products & Services;
• g)Customer's violation of any restrictions set forth in the Agreement or any applicable third-party terms and conditions;
• h)any Security Incident, unauthorized access or disclosure of Customer Content resulting from Customer's systems, infrastructure, configurations or actions.

14. LIMITATION OF LIABILITY

14.1 EXCLUSION OF DAMAGES & LIABILITY CAP – TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EITHER PARTY AND ITS AFFILIATES, LICENSORS, OFFICERS, DIRECTORS, EMPLOYEES AND CONTRACTORS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS OPPORTUNITY, GOODWILL, DATA, BUSINESS INTERRUPTION OR COST OF SUBSTITUTE GOODS OR SERVICES, ARISING OUT OF OR RELATING TO THE AGREEMENT OR THE USE OF THE PRODUCTS OR SERVICES, REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, UPSEC'S (AND ITS AFFILIATES’) AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY CUSTOMER TO UPSEC UNDER THE APPLICABLE ORDER FORM DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM; IF NO FEES WERE PAID UNDER THE APPLICABLE ORDER FORM DURING SUCH TWELVE (12)-MONTH PERIOD, UPSEC SHALL HAVE NO LIABILITY.

14.2 EXCEPTIONS – THE LIMITATIONS AND EXCLUSIONS SET FORTH IN SECTION 14.1 SHALL NOT APPLY TO:

A) EITHER PARTY'S OBLIGATIONS UNDER SECTION 13 (INDEMNIFICATION);

B) EITHER PARTY'S BREACH OF SECTION 11 (CONFIDENTIALITY);

C) CUSTOMER’S PAYMENT OBLIGATIONS UNDER THE AGREEMENT;

D) CUSTOMER'S BREACH OF SECTION 4.3 (RESTRICTIONS) OR ANY OTHER RESTRICTIONS, OBLIGATIONS OR PROHIBITIONS UNDER THE AGREEMENT;

E) EITHER PARTY'S FRAUD, WILFUL MISCONDUCT OR GROSS NEGLIGENCE; OR

F) ANY LIABILITY WHICH CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW, IN WHICH CASE THE LIMITATIONS AND EXCLUSIONS SET FORTH IN THIS SECTION SHALL APPLY TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW.

14.3 SELF-HOSTED ENVIRONMENTS – WITH RESPECT TO UPSEC INTERNAL, CUSTOMER IS SOLELY RESPONSIBLE FOR THE SECURITY, CONFIGURATION, OPERATION, MAINTENANCE AND BACKUP OF ITS SYSTEMS, NETWORKS AND CUSTOMER CONTENT. UPSEC SHALL NOT BE LIABLE FOR ANY LOSS, CORRUPTION, DISCLOSURE OR UNAVAILABILITY OF CUSTOMER CONTENT OR SYSTEMS ARISING FROM CUSTOMER'S OR ANY THIRD PARTY'S ENVIRONMENT OR SECURITY MEASURES.

15. Termination

15.1 Termination - Either Party may terminate the Agreement upon written notice if:

• a)the other Party materially breaches the Agreement and fails to cure such breach within thirty (30) days after receiving written notice specifying the breach, provided that no cure period shall apply where the breach is incapable of cure; or
• b)the other Party becomes insolvent, enters liquidation, bankruptcy or any similar proceeding, or is unable to pay its debts as they become due.

UpSec may additionally terminate the Agreement or any affected Order Form immediately upon written notice if Customer:

• a)breaches Section 4.3 (Restrictions);
• b)fails to pay any undisputed amounts due under the Agreement and such failure continues for fifteen (15) days after written notice; or
• c)otherwise commits a material breach which by its nature justifies immediate termination.

Termination of the Agreement shall automatically terminate all then-existing Order Forms, unless otherwise expressly agreed by the Parties.

UpSec may discontinue or cease offering a Product upon reasonable prior written notice. If such discontinuation results in the termination of the affected Order Form before the end of the applicable Subscription Term, UpSec shall refund any prepaid Fees attributable to the unused portion of such Subscription Term, which shall constitute Customer's sole and exclusive remedy in connection therewith.

15.2 Effect of Termination - Upon expiration, non-renewal or termination of the Agreement or any Order Form:

• a)Customer's rights to access and use the affected Products shall cease upon the effective date of termination or expiration;
• b)with respect to UpSec Internal, Customer shall cease all use of the Software and Documentation and, within thirty (30) days following termination or expiration, permanently uninstall, delete, destroy or, at UpSec's request, return all copies thereof, in whatever form or media and whether modified or incorporated into other materials; provided, however, that expiration or termination of the applicable subscription shall not, by itself, require Customer to delete historical test results, reports or other Customer Content generated through UpSec Internal, and Customer may retain access to such information for its internal purposes, provided that Customer shall not be entitled to continue using the Software or initiate new scans, tests or other activities requiring a valid subscription.
• c)Customer shall promptly pay all amounts accrued and payable prior to the effective date of termination;
• d)either Party shall return to the other Party and purge its systems from any Confidential Information it holds or has access to, unless required for regulatory purposes according to applicable retention laws.

Except as expressly provided in the Agreement or required by applicable law, all fees paid or payable under the Agreement are non-refundable. In the event of expiration or non-renewal of an Order Form, Customer may continue to access and use the applicable Products until the end of the then-current Subscription Term, subject to continued compliance with the Agreement and payment of all applicable fees. If UpSec terminates the Agreement or any Order Form due to Customer's uncured, non-curable or immediate termination breach, Customer's rights to access and use the affected Products shall cease on the effective date of termination, and no refund, credit or reduction of fees shall be due.

Termination shall not relieve either Party of any rights, remedies, obligations or liabilities accrued prior to the effective date of termination.

15.3 Survival - Any provision hereunder that by its nature ought to survive termination of these Terms, shall survive termination, including without limitation Section 4.3 (Restrictions), 10 (Intellectual Property Rights), 11 (Confidentiality), 12 (Representations, Warranties and Disclaimers), 13 (Indemnification), 14 (Limitation of Liability), 15 (Termination), 16 (Company Contracting Entity, Governing Law and Jurisdiction), 17 (General Provisions).

16. Company Contracting Entity, Governing Law and Jurisdiction

The UpSec entity entering into the Agreement shall be the entity specified in the applicable Order Form. The governing law and the courts having exclusive jurisdiction over any dispute arising out of or relating to the Agreement, including its existence, validity, interpretation, performance or termination, shall depend on the UpSec entity identified in the applicable Order Form, as follows:

The United Nations Convention on Contracts for the International Sale of Goods (CISG) shall not apply to the Agreement.

17. General Provisions

17.1 Independent Contractors - The Parties are independent contractors. Nothing in the Agreement shall be construed to create any partnership, joint venture, agency, fiduciary or employment relationship between the Parties, and neither Party shall have any authority to bind the other Party.

17.2 Assignment - Customer may not assign, transfer or delegate the Agreement, in whole or in part, without UpSec's prior written consent. Any attempted assignment in violation of this Section shall be null and void. UpSec may assign the Agreement, in whole or in part, to any Affiliate or to any successor in connection with a merger, consolidation, reorganization or sale of all or substantially all of its assets or business. UpSec may subcontract the performance of any part of the Products or Services to its Affiliates or contractors, provided that UpSec shall remain responsible for their performance.

17.3 Force Majeure - Neither Party shall be liable for any delay or failure to perform its obligations under the Agreement (except payment obligations) to the extent caused by circumstances beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, labor disputes, governmental actions, interruption or failure of telecommunications or Internet services, cyberattacks, denial-of-service attacks, failures of third-party service providers or utilities, or other events beyond such Party's reasonable control. The affected Party shall use commercially reasonable efforts to mitigate the effects of such event and resume performance as soon as reasonably practicable.

17.4 Notices - Any notices required or permitted under the Agreement shall be in writing and delivered by email or other contact details specified in the applicable Order Form.

17.5 Entire Agreement - The Agreement, together with the applicable Order Forms and any documents expressly incorporated by reference, constitutes the entire agreement between the Parties with respect to its subject matter and supersedes all prior or contemporaneous understandings, communications and agreements, whether written or oral.

17.6 Waiver - No failure or delay by either Party in exercising any right or remedy under the Agreement shall constitute a waiver thereof. Any waiver shall be effective only if made in writing and shall apply only to the specific instance for which it is given. All rights and remedies under the Agreement are cumulative and not exclusive.

17.7 Severability - If any provision of the Agreement is held to be invalid, illegal or unenforceable, such provision shall be modified to the minimum extent necessary to render it enforceable, and the remaining provisions of the Agreement shall remain in full force and effect.

17.8 Amendments - These Terms may be modified or amended by mutual written agreement signed by duly authorized representatives of the Parties, which shall apply to agreements executed in physical signed form. However, for agreements accepted electronically or through a click-wrap process, we reserve the right to modify these Terms at any time by posting the updated Terms on our Website or through Product or the applicable platform. Your continued use of the Software following the posting of revised Terms shall constitute your acceptance of and agreement to be bound by such modifications.

17.9 Electronic Signatures and Counterparts - The Agreement and any Order Forms may be executed electronically and in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.

17.10 Headings - The headings used in the Agreement are for convenience only and shall not affect the interpretation of any provision.