These Endor Labs Master Services Terms are incorporated into and form part of the Order Form executed by Endor Labs Inc. (“Endor Labs”) and the customer identified in that Order Form (“Customer”) and, together with the Order Form and its exhibits, constitute the Agreement. They govern Customer’s access to and use of the Services. Capitalized terms have the meanings given in these Endor Labs Master Services Terms or the applicable Order Form.

1. Definitions

Capitalized terms used in this Agreement have the meaning set forth below or as defined elsewhere in this Agreement.

1.1 “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where “control” means ownership of more than fifty percent (50%) of the voting securities or equivalent ownership interest.

1.2 “Aggregated and De-identified Data” means data derived from Customer Data, Outputs, or Usage Data that has been aggregated or de-identified such that it does not identify, and could not reasonably be used, alone or in combination with other information, to identify Customer or any individual.

1.3 “Code Contributor” means an individual who has made one or more commits to a source code repository monitored by the Services within the preceding ninety (90) days, as measured by the Services.

1.4 “Customer Data” means any data, content, or materials submitted or made available by, or on behalf of, Customer or its Users to the Services, including source code, dependency manifests, container images, software bills of materials, and related metadata, or otherwise collected by the Services or any connected tools on Customer’s behalf, as applicable, including any Personal Data contained therein. Customer Data does not include Usage Data, Account Data (as defined in Exhibit A (Data Processing Agreement)), or Aggregated and De-identified Data.

1.5 “Documentation” means Endor Labs’ then-current technical documentation, help articles, in-product guidance, user guides, and other similar materials that Endor Labs makes available to Customer as updated from time to time.

1.6 “Endor Labs Data” means Endor Labs’ vulnerability, malicious package, dependency, license, and other security and risk intelligence data, including Endor Labs’ vulnerability database, reachability and risk analyses, annotations, scores, patches, and remediation guidance, and any data derived from them, in each case as made available through the Services, excluding Customer Data.

1.7 “Endor Labs Technology” means the Services, Documentation, and all technology, software, algorithms, models, model weights, training data, Endor Labs Data, and intellectual property owned by or licensed to Endor Labs, including any modifications, improvements, or derivative works thereof, excluding Customer Data and Outputs.

1.8 “Order Form” means an ordering document or online order specifying the Services to be provided, applicable fees, and other commercial terms, executed by both parties or completed through Endor Labs’ ordering process.

1.9 “Outputs” means any content, data, or materials generated by the Services in response to Customer Data or User inputs, including findings, reports, software bills of materials, and remediation suggestions relating to Customer Data.

1.10 “Personal Data” means any information that identifies, relates to, describes, or could reasonably be used to identify a natural person, as defined under applicable privacy law.

1.11 “Protected Health Information” means “protected health information” as defined in 45 C.F.R. § 160.103.

1.12 “Services” means Endor Labs’ proprietary products and services identified in the applicable Order Form, including any updates, upgrades, patches, bug fixes, or new features that Endor Labs makes generally available to its customers at no additional charge (“Updates”).

1.13 “Technical Success” means Endor Labs’ support and customer success offering, provided at the tier specified in the applicable Order Form and described in the Documentation.

1.14 “Usage Data” means data generated by or collected through Customer’s or its Users’ interaction with the Services, including log data, feature usage statistics, performance metrics, and other operational and technical data relating to the use of the Services. Usage Data may include Personal Data, in which case Endor Labs will process it in accordance with applicable law and its applicable privacy notices. Usage Data does not include Customer Data or the content of prompts, inputs, files, Outputs, or substantive support communications.

1.15 “Users” means the individuals whom Customer authorizes to access, use, or administer the Services, including employees, consultants, contractors, and agents of Customer and its Affiliates, excluding automated or service accounts (each, a “User”).

2. Services; Access

2.1 Provision of Services; License Grant. Subject to the terms of this Agreement and the applicable Order Form, during the applicable Subscription Term (as defined in Section 8.1), Endor Labs hereby grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Services, including any components made available as part of the Services and the tools and features provided for configuration, as described in the Documentation, for Customer’s internal business purposes, and, as applicable, to generate, receive, and use Outputs in accordance with this Agreement. Endor Labs may provide Updates to the Services at its discretion, and such Updates will be subject to the terms of this Agreement. Endor Labs will not materially reduce the core functionality of the Services during a Subscription Term without Customer’s prior written consent. Endor Labs may make application programming interfaces, the endorctl command-line tool, IDE and coding-agent integrations, or Model Context Protocol endpoints available as part of the Services; Customer’s access to and use of the Services through any of them is subject to this Agreement, the Documentation, and any usage limits in the applicable Order Form, and data submitted or received through them is treated the same as data submitted or received through any other interface of the Services.

2.2 Users. Customer may permit Users to access and use the Services and remains responsible for each User’s compliance with this Agreement as if it were Customer’s own use, for the confidentiality of all login credentials, and for all activities that occur under its account. Use of the Services in excess of the number of Code Contributors or any other usage limit specified in the applicable Order Form is subject to Section 7 (Fees; Payment). Customer and its Users may run the Services’ agents, the endorctl command-line tool, CI/CD integrations, and other automated tools on or through the Services as contemplated by the Documentation, and all activity of those agents and tools is deemed Customer’s activity under this Agreement. The Services will take remediation, blocking, or other actions that change Customer’s code, packages, configurations, or systems only as authorized by Customer or its Users, including through the policies and approval settings Customer configures, and Customer is responsible for the policies and approvals it configures and for reviewing the actions taken under them.

2.3 Subcontractors. Endor Labs may use subcontractors to perform its obligations under this Agreement. Endor Labs remains responsible for its subcontractors’ performance of Endor Labs’ obligations under this Agreement, but is not responsible for failures or unavailability of third-party services or infrastructure to the extent outside Endor Labs’ reasonable control, subject to Exhibit A (Data Processing Agreement) with respect to Personal Data.

2.4 Beta Features. Endor Labs may make beta or pre-release features (each, a “Beta Feature”) available for Customer’s internal evaluation. Beta Features are provided “as is,” are not supported, may be subject to additional limitations, and may be modified or discontinued at any time, and Endor Labs has no obligation to make any Beta Feature generally available.

2.5 Service Levels. Endor Labs will provide the Endor Labs-hosted Services in accordance with the service levels set forth in Exhibit B (Service Level Agreement).

2.6 Deployment. The Services are provided as Endor Labs-hosted cloud services in the hosting region (United States or European Union) specified in the applicable Order Form, and Customer may run scans through Endor Labs’ cloud scanning or through hybrid scanning in Customer’s own environment, as described in the Documentation. In connection with the Services: (a) Endor Labs’ obligations under Section 5 (Data Security) and Exhibit B (Service Level Agreement) apply only to the portions of the Services and systems hosted or managed by Endor Labs; (b) Customer is responsible for the security, availability, maintenance, and configuration of the environments, systems, infrastructure, credentials, and configurations within its control, and Endor Labs is not responsible for any failure or degradation of the Services to the extent attributable to any of the foregoing; and (c) where Customer selects hybrid scanning, Endor Labs will make the applicable software components of the Services available for deployment in Customer’s environment, which Customer may install and run on its own systems solely to use the Services during the Subscription Term, and will provide support, in accordance with the Documentation. Any additional deployment-specific terms will be set forth in the applicable Order Form.

2.7 AI Features. The Services include optional features that use artificial intelligence and machine learning technologies, including large language models provided by the third-party model providers identified in the Documentation or in Endor Labs’ Sub-processor list and, where made available, models developed or fine-tuned by Endor Labs (“AI Features”). Endor Labs may add, change, or replace the models and model providers it uses from time to time. Customer may disable the AI Features for its account through the administrative settings of the Services, and the Services are designed not to process Customer Data through AI Features that Customer has disabled, although disabling AI Features may limit the functionality of the Services. Where the Services permit Customer to use its own account or API key with a third-party model provider (“BYOK”), that provider is a Third-Party Service under Section 6 (Third-Party Services; Open-Source Software), Customer’s use of it is subject to Customer’s agreement with that provider, and Endor Labs is not responsible for the provider’s availability, processing, outputs, or charges. Endor Labs’ use of Customer Data in connection with AI Features is subject to Section 4.5 (Data) and Exhibit A (Data Processing Agreement).

2.8 Technical Success; Professional Services. Endor Labs will provide support for the Services at the Technical Success tier specified in the applicable Order Form (or, if none is specified, Endor Labs’ standard tier as described in the Documentation), in accordance with the Documentation and Exhibit B (Service Level Agreement). Any onboarding, implementation, training, or other professional services purchased by Customer will be described in the applicable Order Form or a statement of work referencing this Agreement (each, an “SOW”), and Endor Labs will perform them in a professional and workmanlike manner using personnel and methods of its choosing, subject to Customer’s timely cooperation and access to the systems and information reasonably required. Unless the applicable SOW expressly provides otherwise, professional services consist of configuration, enablement, and training on the Services, and any configurations, policies, integrations, and other materials that Endor Labs creates in performing them are Endor Labs Technology made available to Customer under Section 2.1 (Provision of Services; License Grant) for the Subscription Term.

3. Customer Obligations

3.1 Use Restrictions. Customer will not, and will not permit any third party to: (a) sublicense, sell, resell, rent, lease, transfer, distribute, or otherwise make the Services available to any third party other than Users; (b) modify, copy, or create derivative works based on the Services or Endor Labs Technology; (c) reverse engineer, disassemble, decompile, or otherwise attempt to discover the source code, object code, or underlying algorithms of the Services, or extract or reconstruct any model or training data; (d) access or use the Services or Endor Labs Data to build, train, or improve a product, service, or artificial intelligence or machine learning model that competes with the Services, or to benchmark the Services against a competitive product or service; (e) remove, alter, or obscure any proprietary notices on the Services; (f) use the Services to transmit harmful or malicious code, files, scripts, or agents (“Harmful Code”), other than by submitting Customer Data to the Services for scanning and analysis; (g) interfere with or disrupt the integrity or performance of the Services, or attempt to gain unauthorized access to the Services or their related systems, or circumvent or disable any usage limit, Code Contributor measurement, or authentication or security mechanism of the Services; (h) access, extract, scrape, harvest, mine, or systematically download Endor Labs Data, whether through the Services, any application programming interface, Outputs, or otherwise, or use Endor Labs Data to train, develop, or improve any artificial intelligence or machine learning model, vulnerability or security database, or product or service, in each case other than as necessary to use the Services and Outputs for Customer’s internal security operations (including remediating Customer’s own software) in accordance with the Documentation; or (i) use the Services in violation of any applicable law or regulation.

3.2 Customer Responsibilities. Customer is solely responsible for: (a) the accuracy, quality, and legality of Customer Data; (b) the means by which Customer acquired Customer Data; (c) Customer’s use of Outputs, including any decisions made or actions taken based on Outputs, such as remediation, upgrade, patching, and package-blocking decisions; (d) ensuring that Customer’s use of the Services and Outputs complies with all applicable laws and regulations; and (e) complying with applicable export control and sanctions laws in connection with its use of the Services, including by not accessing or using the Services from, or making any software component of the Services available in, any country or to any person subject to comprehensive sanctions or export restrictions. Customer will use the Services in compliance with this Agreement and all applicable laws.

3.3 Restricted Data. Customer will not submit to the Services any data that is subject to heightened regulatory requirements, including Protected Health Information, data controlled under U.S. export control laws (excluding EAR99 items) or classified under government security programs, or any other Restricted Data identified in Exhibit A (Data Processing Agreement) or the Documentation, unless Endor Labs has expressly agreed in writing to process such data and the parties have executed any supplemental agreements required by applicable law or regulation.

4. Intellectual Property; Data

4.1 Endor Labs IP. As between the parties, Endor Labs retains all right, title, and interest in and to the Services, Endor Labs Technology, and any modifications, improvements, or derivative works thereof, including all intellectual property rights therein. No rights are granted to Customer except as expressly set forth in this Agreement.

4.2 Customer Data. As between the parties, Customer retains all right, title, and interest in and to Customer Data. Customer grants Endor Labs a non-exclusive, worldwide license to use, process, and display Customer Data solely as necessary to provide, operate, secure, support, and maintain the Services, and to create Aggregated and De-identified Data, in accordance with this Agreement and applicable law.

4.3 Feedback. Customer grants Endor Labs a perpetual, irrevocable, worldwide, royalty-free license to use any suggestions, ideas, or other feedback relating to the Services (“Feedback”) without restriction or obligation to Customer, provided that any Feedback incorporating Customer’s Confidential Information remains subject to Section 9 (Confidentiality).

4.4 Outputs. As between the parties and to the extent permitted by applicable law, Customer owns all right, title, and interest, if any, in and to Outputs, subject to Endor Labs’ rights in the Endor Labs Technology and Endor Labs Data. Customer acknowledges and agrees that: (a) the Services may generate identical or similar Outputs for other customers in response to the same or similar inputs, and Endor Labs makes no exclusivity commitment with respect to any Output; and (b) Endor Labs may use Outputs to provide the Services and otherwise only as permitted under Section 4.5 (Data).

4.5 Data. Endor Labs will not use Customer Data or Outputs to train, fine-tune, develop, or improve any artificial intelligence or machine learning model, except as expressly authorized in writing by Customer or as Aggregated and De-identified Data in accordance with this Agreement. As between the parties, Endor Labs owns all right, title, and interest in and to Aggregated and De-identified Data. Endor Labs may use Aggregated and De-identified Data solely to: (a) provide, maintain, and improve the Services, including the machine learning models used to provide the Services; (b) perform analytics and benchmarking; and (c) publish aggregated statistics, benchmarks, and research findings that do not identify Customer or any individual. Endor Labs will not attempt to re-identify Aggregated and De-identified Data and will not sell Aggregated and De-identified Data or make it available to any third party for such third party’s independent use. Endor Labs may collect and use Usage Data to operate, secure, support, maintain, analyze, improve, and develop the Services, and to comply with applicable law. As between the parties, Endor Labs owns all right, title, and interest in and to Usage Data.

5. Data Security

Endor Labs will maintain an information security program that includes commercially reasonable administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, use, disclosure, alteration, or destruction. Endor Labs will review and update its safeguards as appropriate, consistent with generally accepted industry standards for similarly situated providers. To the extent Endor Labs processes Personal Data on Customer’s behalf in connection with the Services, the parties’ obligations are set forth in Exhibit A (Data Processing Agreement) or a separately executed data processing agreement. Endor Labs’ obligations under this Section apply to Customer Data in Endor Labs’ possession or control; where Customer runs scans in its own environment through hybrid scanning, Customer is responsible for safeguarding Customer Data and the software components of the Services within that environment. Endor Labs makes its security documentation and independent audit reports available at trust.endorlabs.com, subject to reasonable confidentiality obligations.

6. Third-Party Services; Open-Source Software

The Services may permit Customer or its Users to connect to, integrate with, or use products, services, or content provided by third parties, including source control and CI/CD platforms, package registries and repositories, IDEs and coding agents, and ticketing and communications tools, that Customer or its Users select, authorize, access or enable, including any third-party AI model provider accessed using Customer’s own account or API keys (each, a “Third-Party Service”). A Third-Party Service is not part of the Services, and Customer’s use of any Third-Party Service is subject to that third party’s terms of service and privacy policies. Customer authorizes Endor Labs to access and exchange Customer Data with the Third-Party Services that Customer or its Users connect to the Services as needed to provide the Services. Endor Labs is not liable for failures, outages, changes in capabilities, or acts or omissions attributable to any Third-Party Service, and Endor Labs makes no warranty with respect to any Third-Party Service. The Services may also rely on third-party model, hosting, or infrastructure providers; Endor Labs’ responsibility for such providers is as set forth in Section 2.3 (Subcontractors). The Services may incorporate open-source software components that are subject to their own applicable license terms, which govern Customer’s use of those components and, in the event of a conflict, control over this Agreement solely with respect to those components. Open-source software components include the open-source libraries underlying any patched versions that Endor Labs makes available through the Services (including Endor Patches); those libraries remain subject to their applicable open-source licenses, Customer elects whether to deploy them in its own discretion, and Endor Labs’ warranties and indemnities in this Agreement apply to Endor Labs’ own modifications and to the Services, not to the underlying open-source code. Endor Labs provides such components on an “as is” basis and makes no warranties with respect to them except as expressly set forth in this Agreement.

7. Fees; Payment

7.1 Fees. Customer will pay all fees specified in the applicable Order Form (“Fees”). Except as expressly set forth in this Agreement, all Fees are non-refundable and non-cancellable. Unless otherwise specified in the applicable Order Form, all Fees will be in USD and will be payable on net thirty (30) day terms. Any undisputed amounts not paid when due will accrue interest at the rate of one and one-half percent (1.5%) per month, or the maximum rate permitted by applicable law, whichever is less. Customer will notify Endor Labs in writing of any disputed amounts, with reasonable supporting detail, within thirty (30) days of the applicable invoice date, and will pay all undisputed amounts while the parties resolve the dispute in good faith. Fees for Technical Success are invoiced with, and prorated together with, the corresponding subscription.

7.2 Taxes. All Fees are exclusive of taxes. Customer is responsible for all applicable taxes (other than taxes based on Endor Labs’ net income) arising from or relating to this Agreement. If Endor Labs is required to collect or remit any such taxes, they will be invoiced to Customer and paid in accordance with this Section.

7.3 Code Contributors. Subscriptions priced per Code Contributor cover the number of Code Contributors specified in the applicable Order Form, as measured by the Services. If a measurement, which Endor Labs may take at any time, shows more Code Contributors than the number specified, Customer will purchase the excess (“Additional Code Contributors”), which are invoiced quarterly in arrears at the per-Code Contributor rate in the applicable Order Form (or, if none is stated, Endor Labs’ then-current rates), prorated for and coterminous with the then-current Subscription Term, are not charged for periods before the measurement, and are added to the Code Contributor quantity for any Renewal Term.

7.4 Fair Usage. The Services include scan capacity that scales with the number of Code Contributors, as described in the Documentation (“Fair Usage”). Where Customer’s scan volume materially and persistently exceeds Fair Usage, including through automated or agentic workflows, Endor Labs may require Customer to purchase additional scan capacity at the rates in the applicable Order Form or Endor Labs’ then-current rates, and may reasonably limit scan volume that threatens the integrity or performance of the Services.

8. Term; Termination

8.1 Term and Renewal. This Agreement commences on the Effective Date and continues until all Order Forms have expired or been terminated. Each subscription runs for the initial subscription term specified in the applicable Order Form (the “Initial Term”) and renews as set forth in that Order Form (each renewal period, a “Renewal Term” and, collectively with the Initial Term, the “Subscription Term”). Fees for a Renewal Term are Endor Labs’ then-current rates unless the applicable Order Form provides otherwise, and any limit on renewal price increases stated in an Order Form applies only to renewals of the same products, edition, and quantities.

8.2 Termination. Either party may terminate an Order Form or this Agreement upon written notice if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days after receiving written notice. Either party may also terminate upon written notice if the other party becomes insolvent, makes an assignment for the benefit of creditors, has a receiver appointed, or is subject to a bankruptcy or similar proceeding not dismissed within sixty (60) days. Endor Labs may terminate an Order Form or this Agreement upon ten (10) days’ written notice for Customer’s breach of Section 3.1 (Use Restrictions) or Customer’s use of the Services in violation of applicable law. For breaches that by their nature are not capable of cure, including reverse engineering, extraction of Endor Labs Data, or use of the Services or Endor Labs Data to develop a competing product, Endor Labs may terminate immediately upon written notice.

8.3 Suspension. Endor Labs may suspend access to the Services to the extent Endor Labs reasonably determines necessary to address a security risk, unlawful activity, a threat to the integrity or availability of the Services, or a violation of Section 3.1 (Use Restrictions) (including any actual or reasonably suspected extraction of Endor Labs Data) or any policy identified in the applicable Order Form or Documentation, or to the extent required by a third-party provider used to provide the Services. Endor Labs may also suspend access upon ten (10) business days’ written notice for failure to pay undisputed amounts when due. Endor Labs will provide prompt notice of any suspension and restore access when the issue is resolved; suspension does not relieve Customer of its payment obligations.

8.4 Effects of Termination; Survival. Upon termination or expiration of this Agreement: (a) all rights granted to Customer cease; (b) Customer will discontinue use of the Services and remove any software components of the Services deployed in its environment, and may retain and use Outputs generated during the Subscription Term for its internal business purposes, subject to Section 3.1 (Use Restrictions) and Endor Labs’ rights in Endor Labs Data; (c) each party will return or destroy the other party’s Confidential Information in accordance with Section 9 (Confidentiality); and (d) Endor Labs will make Customer Data in Endor Labs’ possession or control available for export in an industry-standard, machine-readable format for thirty (30) days, after which Endor Labs may delete Customer Data, and Endor Labs will delete Customer Data within ninety (90) days after Customer’s written request, subject to routine backups, legal retention requirements, and Exhibit A (Data Processing Agreement). The following provisions survive any expiration or termination of this Agreement: Section 3.1 (Use Restrictions), with respect to Endor Labs Data and retained Outputs; Section 4 (Intellectual Property; Data), with the license granted in Section 4.2 (Customer Data) surviving solely to the extent necessary for permitted retention, export, security, legal compliance, and deletion; Section 5 (Data Security), for so long as Endor Labs retains Customer Data; Section 7 (Fees; Payment), for outstanding payment obligations; Section 8.4 (Effects of Termination; Survival); Section 9 (Confidentiality); Sections 10.3 (Disclaimer) and 10.4 (Output); Sections 11 (Indemnification), 12 (Limitation of Liability), 14 (Governing Law; Dispute Resolution), and 15 (Miscellaneous); and any other provision that by its nature should survive.

9. Confidentiality

“Confidential Information” means all non-public information disclosed by or on behalf of one party or its Affiliates (“Discloser”) to the other party (“Recipient”) that is marked confidential or that a reasonable person would understand to be confidential given the nature of the information or the circumstances of its disclosure. Endor Labs’ Confidential Information includes the Services, Endor Labs Technology, and the terms of this Agreement. Customer’s Confidential Information includes Customer Data, including source code. Recipient will: (a) use Confidential Information only to exercise its rights and perform its obligations under this Agreement; (b) protect it with at least the same care it uses for its own similar information, and no less than reasonable care; and (c) disclose it only to its and its Affiliates’ employees, contractors, officers, agents, directors, and professional advisors who need to know and are bound by confidentiality obligations at least as protective as this Agreement (each, a “Representative”). Recipient is responsible for any breach by its Representatives. Recipient will promptly notify Discloser of any unauthorized use, disclosure, or loss of Confidential Information and reasonably cooperate in Discloser’s investigation. Confidential Information does not include information that: (a) is or becomes public without breach of this Agreement; (b) Recipient rightfully knew, without restriction, before disclosure, as shown by its records or other reasonable evidence; (c) Recipient rightfully obtains from a third party without restriction; (d) Recipient independently develops without reference to Discloser’s Confidential Information, as shown by its records or other reasonable evidence; (e) is approved for release by Discloser in writing; or (f) is Usage Data or Aggregated and De-identified Data. Recipient may disclose Confidential Information if required by law or legal process, provided it gives Discloser prompt notice where legally permitted and, at Discloser’s expense, reasonably cooperates in any effort to limit the disclosure or obtain confidential treatment. Subject to Section 8.4 (Effects of Termination; Survival) and Exhibit A (Data Processing Agreement) with respect to Customer Data, upon Discloser’s written request following termination or expiration of this Agreement, Recipient will return or destroy all Confidential Information in its possession or control within thirty (30) days and, at Discloser’s request, certify the return or destruction in writing. Recipient may retain: (a) archival copies for legal and compliance purposes; (b) automatic electronic backups; and (c) copies subject to legal hold or required by applicable law, in each case subject to this Agreement. The obligations set forth in this Section 9 (Confidentiality) will survive the expiration or termination of this Agreement for three (3) years, except that obligations for trade secrets continue for as long as the information remains a trade secret under applicable law.

10. Warranties; Disclaimers

10.1 Endor Labs Warranties. Each party warrants that it has the authority to enter into this Agreement and to grant the rights granted herein. Endor Labs warrants that the Services will perform materially in accordance with the Documentation during the applicable Subscription Term. As Customer’s sole and exclusive remedy and Endor Labs’ entire liability for breach of the foregoing performance warranty, Endor Labs will, at its option: (i) use commercially reasonable efforts to correct the non-conforming Services, or (ii) if Endor Labs is unable to correct such non-conformance within thirty (30) days, either party may terminate the applicable Order Form and Endor Labs will refund to Customer any prepaid Fees for the remainder of the Subscription Term. Endor Labs warrants that any professional services will be performed in a professional and workmanlike manner; as Customer’s sole and exclusive remedy for breach of this warranty, Endor Labs will re-perform the non-conforming services.

10.2 Customer Warranties. Customer warrants that: (a) Customer’s use of the Services will comply with applicable law; and (b) Customer has all rights, consents, and permissions necessary to provide Customer Data to Endor Labs and to authorize Endor Labs’ processing of Customer Data as described in this Agreement, and Customer Data does not infringe any third party’s rights, violate applicable law (including applicable data protection laws), or contain Harmful Code, in each case other than the vulnerabilities, malicious packages, exposed secrets, license issues, and other risks that Customer submits Customer Data to the Services to identify.

10.3 Disclaimer. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN THIS SECTION, THE SERVICES AND ANY OUTPUTS ARE PROVIDED “AS IS” AND ENDOR LABS DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, ENDOR LABS DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE.

10.4 Output. Customer acknowledges that the Services may use artificial intelligence and machine learning technologies, and that Outputs may be inaccurate, incomplete, or unsuitable for Customer’s intended purposes. Customer is solely responsible for evaluating and verifying all Outputs before any use or reliance, including for compliance with applicable laws and regulations. Customer should not rely on Outputs as a substitute for independent professional judgment, and, except for Endor Labs’ express obligations under this Agreement, Endor Labs will have no liability for decisions made or actions taken by Customer based on Outputs. Without limiting the foregoing, the Services are designed to assist, and not to replace, Customer’s own security review, remediation, and engineering processes, and Endor Labs does not warrant that the Services will identify or remediate every vulnerability, malicious package, exposed secret, or other risk in Customer’s software.

11. Indemnification

11.1 Endor Labs Indemnification. Endor Labs will defend and indemnify Customer, its Affiliates, and their respective officers, directors, employees, and agents from and against any third-party claim alleging that Customer’s authorized use of the Services (excluding Outputs) in accordance with this Agreement infringes or misappropriates such third party’s intellectual property rights, and will pay any damages finally awarded or settlement amounts agreed to by Endor Labs. If the Services become, or in Endor Labs’ reasonable opinion are likely to become, the subject of an infringement claim, Endor Labs may, at its sole option and expense: (a) procure the right for Customer to continue using the Services; (b) modify the Services to make them non-infringing; or (c) if neither of the foregoing options is commercially practicable, terminate the affected Order Form and refund to Customer any prepaid Fees for the remainder of the Subscription Term. Endor Labs’ indemnification obligations under this Section will not apply to the extent any claim arises from: (i) Customer’s use of the Services in a manner not authorized by this Agreement or the Documentation; (ii) Customer’s combination of the Services with third-party products, services, or content not provided by Endor Labs; or (iii) Customer’s continued use of the Services after Endor Labs has notified Customer of a potential infringement concern. This Section states Endor Labs’ sole and exclusive liability, and Customer’s sole and exclusive remedy, for any claim of intellectual property infringement.

11.2 Customer Indemnification. Customer will defend and indemnify Endor Labs, its Affiliates, and their respective officers, directors, employees, and agents from and against any third-party claim arising out of or relating to: (a) Customer Data; (b) Customer’s breach of Section 3 (Customer Obligations); or (c) Customer’s use of the Services or Outputs in violation of applicable law. Customer will pay any damages finally awarded or settlement amounts agreed to by Customer.

11.3 Indemnification Procedures. The indemnifying party’s obligations are conditioned on the indemnified party: (a) providing prompt written notice of the claim; (b) granting sole control of the defense and settlement to the indemnifying party; and (c) providing reasonable cooperation at the indemnifying party’s expense. Failure to provide prompt notice relieves the indemnifying party only to the extent it is materially prejudiced. The indemnifying party will not settle any claim in a manner that imposes obligations on, requires any admission of fault by, or fails to fully release the indemnified party without the indemnified party’s prior written consent.

12. Limitation of Liability

12.1 Consequential Damages Exclusion. EXCEPT FOR: (A) EITHER PARTY’S GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR FRAUD; (B) EITHER PARTY’S INDEMNIFICATION OBLIGATIONS UNDER SECTION 11 (INDEMNIFICATION); (C) CUSTOMER’S BREACH OF SECTION 3.1 (USE RESTRICTIONS); OR (D) CUSTOMER’S PAYMENT OBLIGATIONS UNDER THIS AGREEMENT (COLLECTIVELY, THE “EXCLUDED CLAIMS”), TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR BUSINESS OPPORTUNITY ARISING OUT OF OR RELATING TO THIS AGREEMENT, REGARDLESS OF THE THEORY OF LIABILITY, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

12.2 General Cap. EXCEPT WITH RESPECT TO THE EXCLUDED CLAIMS, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM (THE “GENERAL CAP”).

12.3 Enhanced Cap. Notwithstanding the General Cap, each party’s total aggregate liability arising out of or relating to a party’s breach of: (a) Section 9 (Confidentiality); (b) Section 5 (Data Security); or (c) the data security obligations in Exhibit A (Data Processing Agreement) or any business associate agreement between the parties, in each case resulting in unauthorized disclosure of Personal Data or Protected Health Information, will not exceed two (2) times the amount of the General Cap.

12.4 Basis of the Bargain. The limitations of liability set forth in this Section reflect the allocation of risk between the parties and are an essential element of the basis of the bargain between the parties.

13. Insurance

Endor Labs will maintain commercially reasonable insurance coverage appropriate for its obligations under this Agreement, including commercial general liability and technology errors and omissions coverage. Endor Labs will provide certificates of insurance evidencing such coverage upon Customer’s reasonable written request.

14. Governing Law; Dispute Resolution

This Agreement is governed by the laws of the State of California, without regard to its conflict-of-laws principles. Before initiating any formal proceeding, the parties will attempt in good faith to resolve any dispute through negotiation between senior executives for thirty (30) days after written notice of the dispute. Any dispute not resolved through that process will be finally resolved by binding arbitration administered by JAMS under its Comprehensive Arbitration Rules and Procedures before a single arbitrator seated in San Francisco, California. Either party may seek injunctive or other equitable relief in any court of competent jurisdiction for any breach or threatened breach of Section 3.1 (Use Restrictions), Section 4 (Intellectual Property; Data), or Section 9 (Confidentiality), which the parties agree may cause irreparable harm for which monetary damages are inadequate, without posting bond or proving damages. EACH PARTY WAIVES ANY RIGHT TO PARTICIPATE IN A CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION AND ANY RIGHT TO A TRIAL BY JURY IN ANY ACTION ARISING OUT OF OR RELATING TO THIS AGREEMENT.

15. Miscellaneous

15.1 Force Majeure. Neither party will be liable for any failure or delay in performing its obligations under this Agreement (other than payment obligations) to the extent caused by events beyond its reasonable control, including natural disasters, war, terrorism, government actions, epidemics, and internet, telecommunications, or third-party infrastructure failures (“Force Majeure Event”). The affected party will give prompt written notice to the other party and will use commercially reasonable efforts to mitigate. If a Force Majeure Event continues for more than sixty (60) days, either party may terminate the affected Order Form upon written notice, and Endor Labs will refund any prepaid Fees for the remainder of the Subscription Term.

15.2 U.S. Government Rights. The Services and Documentation are “commercial computer software” and “commercial computer software documentation” as those terms are used in 48 C.F.R. §§ 2.101 and 12.212, and any U.S. Government end user acquires only the rights set forth in this Agreement.

15.3 Assignment. Neither party may assign this Agreement without the other’s prior written consent, not to be unreasonably withheld, except that either party may assign without consent to an Affiliate or in connection with a merger, change of control, or sale of substantially all assets. Any attempted assignment in violation of this Section is void, and this Agreement binds the parties’ permitted successors and assigns.

15.4 Notices. Notices under this Agreement must be in writing and delivered to the address and email address set forth in the applicable Order Form by personal delivery, nationally recognized overnight courier, email (other than email returning an automated non-delivery notice), or certified or registered mail (return receipt requested), and are deemed given upon receipt.

15.5 Order of Precedence; Entire Agreement. If there is a conflict between the terms of this Agreement and any other document, the order of precedence is: (a) the applicable Order Form, including any Special Terms set forth therein; (b) the Endor Labs Master Services Terms; and (c) all other exhibits, schedules, policies, and guidelines referenced herein, except that Exhibit A (Data Processing Agreement) controls over all other documents with respect to the processing of Personal Data, unless amended by Special Terms that expressly reference the provision amended, and any business associate agreement between the parties controls with respect to Protected Health Information. This Agreement controls ownership of, and the permitted uses of, Aggregated and De-identified Data that no longer constitutes Personal Data. This Agreement, together with all Order Forms, exhibits, and any documents expressly incorporated by reference, is the entire agreement between the parties with respect to its subject matter and supersedes all prior and contemporaneous agreements, proposals, and communications, whether oral or written. Any terms in Customer’s purchase order or other ordering document that are in addition to or inconsistent with this Agreement are expressly rejected and will have no force or effect. Any non-disclosure agreement between the parties continues to govern Confidential Information disclosed before the Effective Date; this Agreement governs Confidential Information disclosed on or after the Effective Date.

15.6 General. This Agreement may be amended only by a written instrument signed by both parties. A party’s failure to enforce any provision of this Agreement is not a waiver of that provision. If any provision is held invalid or unenforceable, the remaining provisions remain in full force and effect. Nothing in this Agreement confers any rights or remedies on any person other than the parties and their permitted successors and assigns. The parties are independent contractors, and nothing in this Agreement creates any agency, partnership, joint venture, employment, or fiduciary relationship. This Agreement may be executed in counterparts, including by electronic signature, each of which is deemed an original and all of which together constitute one agreement, and electronic execution and delivery have the same legal effect as original ink signatures.

Exhibit A: Data Processing Agreement

Endor Labs’ Data Processing Agreement, as made available by Endor Labs to Customer, is incorporated into the Agreement as this Exhibit A.

Exhibit B: Service Level Agreement

Capitalized terms used but not defined in this Service Level Agreement have the meanings given to them in the Endor Labs Master Services Terms or the Order Form that incorporates them by reference. The Uptime Commitment in this Exhibit B applies to the Endor Labs-hosted Services and does not apply to scans or software components running in Customer’s environment.

1. Uptime Commitment. Endor Labs will use commercially reasonable efforts to maintain a Monthly Uptime Percentage for the Services of at least 99.9%, calculated as ((Total Minutes in Month − Downtime) / Total Minutes in Month) × 100. “Downtime” means the total cumulative minutes per calendar month during which the Services are unavailable, excluding: (a) scheduled maintenance for which Endor Labs has given at least forty-eight (48) hours’ advance notice (Endor Labs will schedule maintenance during off-peak hours where practicable); (b) acts, omissions, equipment, software, systems, or networks of Customer or its Users (including anyone accessing the Services through Customer’s credentials), incompatibility of Customer’s environment with the Services, or Customer’s continued use of the Services after Endor Labs has advised Customer to modify its use; (c) outages, latency, rate limits, capacity constraints, suspensions, or other failures of third-party model, cloud, hosting, or infrastructure providers beyond Endor Labs’ reasonable control; (d) Force Majeure Events; (e) suspensions permitted under this Agreement; (f) Beta Features and Third-Party Services; or (g) the Internet generally or any systemic Internet failure or bandwidth limitation.

2. Service Credits. If the Monthly Uptime Percentage falls below 99.9% in any calendar month, Customer may request a service credit as set forth below:

Service credits are Customer’s sole and exclusive remedy for any failure to meet the Uptime Commitment, are applied as a credit against future fees, are not redeemable for cash, and will not exceed 15% of the monthly fees for the affected month. To receive a credit, Customer must submit a written request within thirty (30) days after the end of the affected month. For purposes of these credits, “monthly fee” means one-twelfth of the annual fees for Customer’s Technical Success subscription under the applicable Order Form. Service credits are available only while Customer maintains an active subscription and is current on all undisputed amounts, and uptime is measured by Endor Labs’ monitoring systems, which measurements are conclusive absent manifest error.

3. Support. Endor Labs will provide support for the Services through Endor Labs’ designated support channels during Endor Labs’ standard support hours (9:00 a.m. to 5:00 p.m. Pacific time on weekdays, excluding U.S. federal holidays), as described in the Documentation or the applicable Order Form. Endor Labs will use commercially reasonable efforts to provide an initial response to support requests within the targets below, based on the severity level reasonably assigned by Endor Labs. Response targets are initial-response commitments, not resolution commitments, and apply during support hours.