Master Services & License Agreement

IMPORTANT — READ CAREFULLY BEFORE DOWNLOADING, INSTALLING, OR USING ANY NEW NORMAL SECURITY SERVICE. BY CLICKING “I AGREE,” CREATING AN ACCOUNT, DOWNLOADING ANY NNS SOFTWARE, OR OTHERWISE ACCESSING OR USING ANY SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS AGREEMENT, UNDERSTAND IT, AND AGREE TO BE BOUND BY ITS TERMS. IF YOU DO NOT AGREE TO THESE TERMS, DO NOT DOWNLOAD, ACCESS, OR USE ANY SERVICE.

PREAMBLE

This Master Services and License Agreement (“Agreement”) is a legal agreement between the individual or entity accepting these terms (“Customer” or “you”) and New Normal Security, Inc., a Delaware corporation with offices at P.O. Box 1247, Meridian, ID 83680 (“NNS,” “we,” or “us”). This Agreement governs your access to and use of NNS’s software products and hosted services, as further described in the applicable Product Schedules attached hereto (each, a “Product Schedule,” and collectively, the “Services”).

By clicking “I Agree,” creating an account, downloading any NNS software, or otherwise accessing or using any Service, you acknowledge that you have read, understood, and agree to be bound by this Agreement and the applicable Product Schedule(s). If you are accepting this Agreement on behalf of a company or other legal entity, you represent and warrant that you have the authority to bind that entity to this Agreement. If you do not agree to these terms, do not download, access, or use any Service.

This Agreement incorporates by reference each Product Schedule for Services that Customer elects to use, together with any Order Forms executed between the parties (each, an “Order Form”). In the event of a conflict between this Agreement and a Product Schedule, the Product Schedule shall control solely with respect to the applicable Service and only to the extent necessary to resolve the conflict. In the event of a conflict between an Order Form and this Agreement or any Product Schedule, the Order Form shall control.

DEFINITIONS

“API” means an Application Programming Interface made available by NNS that enables programmatic access to, or integration with, the Services.

“Authorized User” means an individual who is authorized by Customer to use the Services and who has been supplied user credentials (including via single sign-on or email address) by or on behalf of Customer.

“Customer Data” means any data, content, code, configurations, or other information submitted by or on behalf of Customer to the Services, excluding Usage Data.

“Device” means a single computer, virtual machine, or hardware device owned or controlled by Customer.

“Documentation” means the user guides, help files, API documentation, and other technical materials made available by NNS at [docs.newnormalsecurity.com] describing the functionality and use of the Services.

“Effective Date” means the date on which Customer first accepts this Agreement by any of the methods described above.

“Order Form” means a written or electronic ordering document specifying the Services, subscription term, pricing, and any additional terms agreed between the parties.

“Product Schedule” means a schedule attached to this Agreement describing a specific NNS product, its license grant, delivery method, restrictions, and product-specific terms.

“Services” means, collectively, the software products and hosted services described in the applicable Product Schedules and Order Forms.

“Subscription Term” means the period during which Customer is authorized to access a paid Service, as specified in the applicable Order Form.

“Annual Subscription” means a Subscription Term of one (1) year, which automatically renews for successive one-year periods unless cancelled in accordance with Section 5.4.

“Monthly Subscription” means a Subscription Term of one (1) calendar month, which automatically renews for successive one-month periods unless cancelled in accordance with Section 5.4.

“Usage Data” means diagnostic data, performance metrics, crash reports, telemetry, and usage statistics collected by the Services that do not include Customer Data.

“Webhook” means an automated, event-driven data transfer mechanism made available by NNS that transmits data between NNS’s systems and a system designated by Customer upon the occurrence of a specified event.

SECTION 1 — ACCOUNTS AND ACCESS

Customer must create an account to access certain Services. Customer is responsible for maintaining the confidentiality of account credentials and for all activities that occur under Customer's account. Customer shall promptly notify NNS of any unauthorized access to or use of Customer's account. NNS reserves the right to suspend access to any account if NNS reasonably believes that unauthorized use has occurred or that the account is being used in violation of this Agreement.

Customer may add Services to its account by accepting the applicable Product Schedule and, for paid Services, completing an Order Form or other purchasing mechanism made available through NNS’s website or through Stripe (as defined in Section 5). Acceptance of an additional Product Schedule does not require re-execution of this Agreement; the new Product Schedule becomes part of this Agreement upon Customer's acceptance.

SECTION 2 — GENERAL RESTRICTIONS

Except as expressly permitted in this Agreement or the applicable Product Schedule, Customer shall not, and shall not permit any third party to, engage in the following activities with respect to any Service:

(a) No Embedding. Customer shall not incorporate, embed, bundle, compile, link, or otherwise include any Service, or any portion, module, library, or component thereof, as a constituent element of any other software product, application, platform, service, SDK, API, or solution, whether commercial or non-commercial, without the prior written consent of NNS. This restriction applies regardless of whether the resulting product is distributed or used solely internally.

(b) No Distribution. Customer shall not copy, distribute, publish, sell, resell, sublicense, rent, lease, lend, or otherwise transfer any Service or any rights therein to any third party, except as expressly permitted herein.

(c) No Modification. Customer shall not modify, adapt, translate, localize, or create derivative works based upon any Service or any part thereof, except to the extent expressly permitted by the applicable Product Schedule or Documentation.

(d) No Reverse Engineering. Customer shall not reverse engineer, disassemble, decompile, decode, or otherwise attempt to derive or access the source code, underlying algorithms, data structures, or architecture of any Service, except to the limited extent permitted by applicable law notwithstanding this restriction, and only after prior written notice to NNS.

(e) No Circumvention. Customer shall not remove, disable, circumvent, or modify any proprietary notices, license enforcement mechanisms, digital rights management features, security controls, or access restrictions included in or associated with any Service.

(f) No Competitive Use. Customer shall not use any Service to benchmark, analyze, or develop a competing product or service, or to reverse engineer NNS’s business methods or product design.

(g) No Unlawful Use. Customer shall not use any Service for any purpose that is unlawful, fraudulent, harmful, or in violation of any applicable law or regulation.

(h) No Data Export; No Scraping of Output Data. Customer shall not export, extract, scrape, parse, copy, or transfer data from any Service, or from any output generated by any Service (including, without limitation, reports, scan results, findings, scores, and any data contained in PDF, HTML, or other formatted deliverables produced by the Services), except where explicitly authorized by NNS through an API or Webhook that NNS designates as an approved export mechanism, and then only in accordance with NNS’s supporting documentation for that API or Webhook. Without limiting the foregoing, Customer shall not use any automated tool, script, optical character recognition, screen scraping technology, or manual transcription to extract, reproduce, or repurpose data from Service-generated outputs for use in any third-party product, service, platform, or compliance certification process. All reports and outputs generated by the Services are provided solely for Customer’s internal use and may not be used as an input to, or data source for, any third-party product or service without NNS’s prior written consent.

SECTION 3 — ACCEPTABLE USE POLICY

Given the nature of NNS’s security tooling, Customer represents and warrants that Customer has all necessary legal authorizations, consents, and permissions to deploy and use the Services on any systems, networks, devices, repositories, or data to which the Services are applied. Customer shall use the Services only against systems, networks, applications, and data that Customer owns or for which Customer has obtained explicit written authorization from the owner to conduct security testing. Unauthorized use of the Services against systems, networks, or data that Customer does not own or is not authorized to test is strictly prohibited and may violate applicable cybersecurity, computer fraud, and unauthorized access laws.

Customer shall not use the Services to: (a) conduct denial-of-service attacks or deliberately disrupt the availability of any system; (b) exfiltrate, steal, or improperly access data belonging to third parties without authorization; (c) distribute malware, ransomware, or other malicious code; (d) violate any applicable export control, sanctions, or anti-terrorism laws; or (e) engage in any activity that could reasonably be expected to cause harm to NNS, its infrastructure, other customers, or third parties. NNS disclaims all liability arising from Customer's unauthorized or unlawful use of the Services.

Customer acknowledges that the Services are tools to assist with security-related activities and that NNS does not warrant or represent that use of the Services will prevent, detect, block, or mitigate any security incident, cyberattack, data breach, or vulnerability. Security outcomes depend on numerous factors outside NNS’s control. The Services and any output they generate do not constitute legal, regulatory, compliance, or professional security advice.

SECTION 4 — INTELLECTUAL PROPERTY

4.1 Ownership.

The Services, including all copies thereof and all intellectual property rights therein, are and shall remain the exclusive property of NNS and its licensors. This Agreement does not transfer to Customer any ownership interest in or to any Service. All rights not expressly granted herein are reserved by NNS. Customer retains all rights, title, and interest in and to Customer Data.

4.2 Proprietary Notices.

Customer shall not remove, alter, cover, or obscure any copyright notice, trademark, patent marking, or other proprietary rights notice incorporated in or accompanying any Service.

4.3 Feedback.

If Customer provides NNS with any suggestions, comments, bug reports, or other feedback regarding the Services ("Feedback"), Customer hereby grants NNS a perpetual, irrevocable, royalty-free, worldwide, fully sublicensable license to use, reproduce, modify, and incorporate such Feedback into the Services or any other NNS products or services, without any obligation of compensation or attribution to Customer.

4.4 Open Source.

The Services may include or be distributed with certain open source or third-party software components, which are subject to their respective open source license terms identified at [URL] or within the Documentation. In the event of a conflict between this Agreement and any applicable open source license, the open source license shall govern solely with respect to the applicable open source component and only to the extent necessary to resolve the conflict.

SECTION 5 — FEES AND PAYMENT

5.1 Free Services.

Certain Services are made available at no charge, as indicated in the applicable Product Schedule. NNS reserves the right to modify, limit, or discontinue Free Services at any time without liability.

5.2 Paid Services.

Except where Customer obtains access to paid Services through an authorized NNS channel partner or managed services provider (“Channel Partner”) pursuant to a separate agreement between such Channel Partner and NNS, fees for paid Services shall be as set forth in the applicable Order Form or as displayed on NNS’s website at the time of purchase. Where Customer accesses paid Services through a Channel Partner, pricing, billing, and payment terms shall be as established between Customer and the Channel Partner, and NNS shall have no obligation to Customer with respect to fees, invoicing, or refunds for such Services. In all cases, all amounts are exclusive of taxes, and Customer shall be responsible for all applicable taxes, withholdings, and levies. Unless otherwise specified in the applicable Order Form or Channel Partner agreement, payment obligations are non-cancelable and fees are non-refundable during the applicable Subscription Term.

5.3 Payment Processing.

Payments for paid Services are processed by Stripe, Inc. or its affiliates (“Stripe"), which provides payment processing infrastructure for NNS transactions. By purchasing a paid Service, Customer agrees to Stripe’s terms of service, available at stripe.com/legal, with respect to payment processing, billing, and refund mechanics. NNS is not responsible for payment processing failures attributable to Stripe or Customer's payment provider.

5.4 Subscriptions and Renewal.

Paid Services are provided on a subscription basis for the Subscription Term specified at the time of purchase. NNS offers two Subscription Term options for paid Services: (a) an Annual Subscription, which automatically renews for successive one-year periods unless Customer cancels before the end of the then-current period through the account management interface or by contacting NNS; and (b) a Monthly Subscription, which automatically renews for successive one-month periods, and is charged at the then-current monthly fee on each renewal, unless Customer cancels before the end of the then-current period through the account management interface or by contacting NNS. On cancellation of either, access continues to the end of the period already paid for and then ends. A Customer who holds a Monthly Subscription may upgrade to an Annual Subscription at any time by selecting the upgrade option through the account management interface or by contacting NNS; upon upgrade, the Annual Subscription begins immediately, the applicable annual fees will be charged, and the Monthly Subscription is cancelled at the end of the monthly period already paid for, so no further monthly charge is raised. NNS will send renewal reminders for Annual Subscriptions as required by applicable law. NNS reserves the right to change pricing for Annual Subscription renewal terms upon at least thirty (30) days' advance notice; if Customer does not accept a price increase, Customer may cancel the Annual Subscription effective at the end of the then-current billing period.

5.5 Non-Payment.

If payment for a paid Service is not received when due, NNS may: (a) charge interest on overdue amounts at the lesser of 1.5% per month or the maximum rate permitted by applicable law; (b) suspend Customer's access to the applicable paid Service upon five (5) business days' written notice if the amount remains unpaid; and (c) terminate the applicable Subscription if payment is not received within thirty (30) days of the original due date. Suspension for non-payment shall not relieve Customer of its obligation to pay all outstanding fees.

SECTION 6 — CUSTOMER DATA

6.1 Ownership.

As between the parties, Customer retains all rights, title, and interest in and to Customer Data. NNS acquires no ownership rights in Customer Data.

6.2 License to NNS.

Customer grants NNS a limited, non-exclusive, worldwide license to host, process, transmit, display, and store Customer Data solely as necessary to provide the Services in accordance with this Agreement and the applicable Product Schedule.

6.3 Aggregated and Anonymized Data.

With Customer's opt-in consent (which may be provided through account settings), NNS may collect and use aggregated, de-identified data derived from Customer's use of the Services for the purpose of generating anonymized statistics, benchmarks, and marketing materials ("Aggregated Data"). Aggregated Data shall not identify Customer or any individual and shall not be considered Customer Data. Customer may withdraw consent at any time through account settings, after which NNS will cease collecting new Aggregated Data from Customer's account, though previously generated Aggregated Data may continue to be used.

6.4 Data Security.

NNS shall maintain commercially reasonable administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, disclosure, alteration, or destruction. NNS shall not access Customer Data except as necessary to provide the Services, to prevent or address service or technical problems, or as Customer may expressly direct.

6.5 Breach Notification.

In the event NNS becomes aware of a confirmed security breach affecting Customer Data, NNS shall notify the affected Customer without undue delay and in no event later than seventy-two (72) hours after confirmation of the breach. Such notice shall include, to the extent known, the nature of the breach, the categories of data affected, and the measures NNS is taking to address the breach.

6.6 Data Return and Deletion.

Upon termination or expiration of the Agreement or any Product Schedule, NNS shall make Customer Data available for export in a standard machine-readable format for a period of thirty (30) days following the effective date of termination. After the thirty (30) day period, NNS shall delete all Customer Data in its possession or control, except to the extent NNS is required by applicable law to retain copies, or except for Customer Data retained in routine backup archives (which shall be deleted in the ordinary course of backup rotation).

6.7 Data Location.

Customer Data is processed and stored in the United States. NNS may update the data processing location with at least sixty (60) days' advance notice to Customer.

6.8 Subprocessors.

NNS uses third-party service providers (“Subprocessors”) to assist in delivering the Services, including cloud infrastructure, payment processing, analytics, email communications, and customer support tools. NNS maintains a current list of Subprocessors at [URL], which NNS shall update at least thirty (30) days prior to engaging a new Subprocessor that processes Customer Data. If Customer objects to a new Subprocessor on reasonable data protection grounds, Customer may notify NNS in writing within fifteen (15) days of the update, and the parties shall discuss the objection in good faith. If the parties cannot resolve the objection, Customer may terminate the affected Product Schedule without penalty upon written notice.

SECTION 7 — SERVICE AVAILABILITY

(Hosted and SaaS Services Only)

7.1 Availability Target.

NNS targets 99.5% uptime for hosted Services, measured on a monthly basis and excluding Scheduled Maintenance and events beyond NNS’s reasonable control. This availability target is a goal and not a binding service level commitment with financial remedies. NNS may introduce formal service level agreements with service credits for enterprise customers via separate Order Forms.

7.2 Scheduled Maintenance.

NNS shall use commercially reasonable efforts to provide at least twenty-four (24) hours' advance notice of scheduled maintenance that is expected to result in material downtime. NNS shall endeavor to perform scheduled maintenance during off-peak hours.

7.3 Third-Party Infrastructure.

The hosted Services rely on third-party cloud infrastructure providers. NNS shall not be liable for downtime or service degradation caused by the acts or omissions of such providers, provided that NNS uses commercially reasonable efforts to select and monitor reliable providers and to restore service promptly.

7.4 Suspension.

NNS may temporarily suspend access to a hosted Service without liability if: (a) NNS reasonably determines that continued access poses a security risk to NNS’s infrastructure or other customers; (b) Customer's use violates the Acceptable Use Policy in Section 3; or (c) suspension is required to comply with applicable law or a government order. NNS shall provide notice of suspension as soon as reasonably practicable (which may be simultaneous with or following the suspension for urgent security matters) and shall restore access promptly once the basis for suspension is resolved. During any suspension, NNS shall preserve Customer Data.

SECTION 8 — UPDATES AND CHANGES

NNS has no obligation to provide updates, patches, bug fixes, enhancements, or new versions of any Service ("Updates"). If NNS makes Updates available, such Updates shall be governed by this Agreement unless accompanied by separate or updated terms. For downloadable Services, if the software includes an automatic update feature, Customer consents to the automatic download and installation of Updates unless Customer disables automatic updates through the software's settings. NNS reserves the right to modify the functionality of hosted Services from time to time to maintain or enhance quality, performance, security, or competitive positioning, provided that NNS shall not materially reduce the core functionality of a paid Service during an active Subscription Term without Customer's consent.

SECTION 9 — DISCLAIMER OF WARRANTIES

THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NNS AND ITS AFFILIATES, LICENSORS, AND SUPPLIERS EXPRESSLY DISCLAIM ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WITHOUT LIMITATION:

ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET ENJOYMENT, OR NON-INFRINGEMENT;

ANY WARRANTY ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE, OR USAGE OF TRADE;

ANY WARRANTY THAT THE SERVICES WILL MEET CUSTOMER'S REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, OR BE FREE OF ERRORS OR DEFECTS; AND

ANY WARRANTY WITH RESPECT TO THE SECURITY, RELIABILITY, TIMELINESS, ACCURACY, OR COMPLETENESS OF THE SERVICES OR ANY RESULTS OBTAINED THROUGH THEIR USE.

NO INFORMATION OR ADVICE OBTAINED FROM NNS OR THROUGH THE SERVICES SHALL CREATE ANY WARRANTY NOT EXPRESSLY STATED IN THIS AGREEMENT. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE EXCLUSIONS MAY NOT APPLY TO CUSTOMER IN FULL.

SECTION 10 — LIMITATION OF LIABILITY

10.1 Exclusion of Consequential Damages.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL NNS OR ITS AFFILIATES, LICENSORS, OR SUPPLIERS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT OR CUSTOMER'S USE OF OR INABILITY TO USE THE SERVICES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, LOSS OF DATA, LOSS OF GOODWILL, BUSINESS INTERRUPTION, SYSTEM FAILURE, OR THE COST OF SUBSTITUTE PRODUCTS OR SERVICES, REGARDLESS OF WHETHER SUCH DAMAGES WERE FORESEEABLE AND WHETHER OR NOT NNS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

10.2 Cap on Liability — Free Services.

FOR FREE SERVICES, NNS’S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT OR CUSTOMER'S USE OF THE FREE SERVICES SHALL NOT EXCEED TEN U.S. DOLLARS ($10.00).

10.3 Cap on Liability — Paid Services.

FOR PAID SERVICES, NNS’S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT OR CUSTOMER'S USE OF THE APPLICABLE PAID SERVICE SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY CUSTOMER TO NNS FOR SUCH PAID SERVICE DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

10.4 Essential Basis.

THE PARTIES ACKNOWLEDGE THAT THE LIMITATIONS IN THIS SECTION ARE AN ESSENTIAL ELEMENT OF THE BARGAIN BETWEEN THEM AND REFLECT A REASONABLE ALLOCATION OF RISK.

SECTION 11 — INDEMNIFICATION

11.1 By Customer.

Customer agrees to indemnify, defend (with counsel acceptable to NNS), and hold harmless NNS and its officers, directors, employees, agents, affiliates, licensors, and successors from and against any and all claims, liabilities, damages, losses, fines, penalties, costs, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) Customer's use or misuse of the Services in violation of this Agreement or applicable law; (b) Customer's violation of any third-party right, including any intellectual property or privacy right; (c) any claim that Customer's use of the Services on any unauthorized system or network caused damage to a third party; or (d) any breach of Customer's representations or warranties under this Agreement.

11.2 By NNS (Paid Services Only).

For paid Services only, NNS shall indemnify, defend, and hold harmless Customer from and against any third-party claim alleging that Customer's authorized use of the applicable paid Service infringes a valid U.S. patent, copyright, or trade secret of such third party, provided that Customer: (i) promptly notifies NNS in writing of such claim; (ii) grants NNS sole control of the defense and settlement; and (iii) provides reasonable cooperation at NNS’s expense. NNS’s obligations under this Section shall not apply to claims arising from: (x) Customer's combination of the Service with non-NNS products; (y) Customer's modification of the Service; or (z) Customer's use of the Service in violation of this Agreement. If the Service becomes, or in NNS’s opinion is likely to become, the subject of an infringement claim, NNS may at its option and expense: (1) procure the right for Customer to continue using the Service; (2) replace or modify the Service to make it non-infringing; or (3) if neither (1) nor (2) is commercially practicable, terminate the applicable Subscription and refund any prepaid fees for the unused portion of the Subscription Term. THIS SECTION STATES NNS’S ENTIRE LIABILITY AND CUSTOMER'S SOLE REMEDY WITH RESPECT TO INFRINGEMENT CLAIMS.

SECTION 12 — TERM AND TERMINATION

12.1 Term.

This Agreement is effective as of the Effective Date and shall continue until terminated as set forth herein. Each Product Schedule and Subscription shall remain in effect for its respective term as specified therein or in the applicable Order Form.

12.2 Termination by Customer.

Customer may terminate this Agreement at any time by: (a) canceling all active Subscriptions; (b) uninstalling all copies of downloaded software; and (c) providing written notice to NNS of termination. Termination does not relieve Customer of any obligation to pay fees accrued prior to the effective date of termination.

12.3 Termination by NNS.

NNS may terminate this Agreement or any Product Schedule: (a) immediately upon written notice if Customer breaches Section 2 (Restrictions), Section 3 (Acceptable Use Policy), or Section 4 (Intellectual Property); or (b) upon fifteen (15) days' written notice if Customer breaches any other material term of this Agreement and fails to cure such breach within such fifteen (15) day period.

12.4 Termination for Insolvency.

Either party may terminate this Agreement immediately upon written notice if the other party becomes insolvent, makes an assignment for the benefit of creditors, or becomes subject to any proceeding under any bankruptcy or insolvency law.

12.5 Effect of Termination.

Upon termination for any reason: (a) all licenses granted herein immediately terminate; (b) Customer must immediately cease all use of the Services; (c) Customer must uninstall and destroy all copies of downloaded software in Customer's possession or control; and (d) NNS shall make Customer Data available for export as described in Section 6. Sections 2, 3, 4, 6.1, 6.6, 6.7, 9, 10, 11, 12.5, 13, 14, 15, and 16 shall survive any termination of this Agreement.

SECTION 13 — EXPORT CONTROLS

The Services may be subject to U.S. export control laws and regulations, including the Export Administration Regulations ("EAR") and the sanctions programs administered by the Office of Foreign Assets Control ("OFAC"). Customer represents and warrants that: (a) Customer is not located in, and is not a national or resident of, any country subject to a U.S. government embargo or designated as a "state sponsor of terrorism"; (b) Customer is not listed on any U.S. government list of prohibited or restricted parties, including the Specially Designated Nationals List; and (c) Customer will comply with all applicable export and re-export laws and regulations in connection with Customer's use of the Services.

SECTION 14 — GOVERNING LAW AND DISPUTE RESOLUTION

14.1 Governing Law.

This Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles or the United Nations Convention on Contracts for the International Sale of Goods.

14.2 Informal Resolution.

Before initiating any formal proceeding, the parties agree to attempt to resolve any dispute informally. The party asserting the dispute shall provide written notice describing the nature of the dispute, and the parties shall negotiate in good faith for a period of thirty (30) days from receipt of such notice.

14.3 Binding Arbitration.

If informal resolution fails, any dispute arising out of or related to this Agreement shall be resolved by binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules then in effect. The arbitration shall be conducted by a single arbitrator in Wilmington, Delaware (or remotely at the arbitrator's discretion). The arbitrator's award shall be final and binding, and judgment thereon may be entered in any court of competent jurisdiction. Each party shall bear its own costs, and the parties shall share equally the fees of the arbitrator and the AAA.

14.4 Small Claims Exception.

Notwithstanding the foregoing, either party may bring an individual action in small claims court for disputes within that court's jurisdictional limits.

14.5 Injunctive Relief.

Notwithstanding the arbitration provision, NNS may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property rights or confidential information without the requirement of posting a bond.

14.6 Class Action Waiver.

TO THE FULLEST EXTENT PERMITTED BY LAW, CUSTOMER AND NNS EACH WAIVE THE RIGHT TO PARTICIPATE IN A CLASS ACTION, COLLECTIVE ACTION, OR OTHER REPRESENTATIVE PROCEEDING.

SECTION 15 — BETA SERVICES

NNS may from time to time make available pre-release, beta, pilot, or early access versions of Services or features ("Beta Services"). Beta Services are provided "AS IS" without any warranty of any kind and may be modified, suspended, or discontinued at any time without notice or liability. NNS makes no commitment that Beta Services will become generally available. Customer acknowledges that Beta Services may contain bugs, errors, or defects and agrees that use of Beta Services is at Customer's sole risk. NNS’s total liability for Beta Services shall not exceed ten U.S. dollars ($10.00) regardless of whether fees were charged. Any feedback provided regarding Beta Services shall be treated as Feedback under Section 4.

SECTION 16 — GENERAL PROVISIONS

16.1 Entire Agreement.

This Agreement, together with all Product Schedules, Order Forms, and policies expressly incorporated herein by reference (including the Privacy Policy available at [URL]), constitutes the entire agreement between the parties with respect to the Services and supersedes all prior or contemporaneous understandings, negotiations, or agreements, whether oral or written.

16.2 Amendment.

NNS reserves the right to modify this Agreement at any time. Modified terms will be posted at [URL] or provided through the Services with at least thirty (30) days' advance notice. Customer's continued use of the Services following the effective date of any modification constitutes acceptance of the modified terms. If Customer does not accept modified terms, Customer must cease using the Services and may terminate this Agreement. Notwithstanding the foregoing, no modification to the terms of a paid Subscription shall take effect during an active Subscription Term unless Customer affirmatively consents.

16.3 Severability.

If any provision of this Agreement is held invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, and the remaining provisions shall continue in full force and effect.

16.4 Waiver.

No failure or delay by either party in exercising any right or remedy shall operate as a waiver of that right or remedy. No waiver of any breach shall constitute a waiver of any subsequent breach.

16.5 Assignment.

Customer may not assign or transfer this Agreement or any rights or obligations hereunder without the prior written consent of NNS. NNS may freely assign this Agreement, including in connection with a merger, acquisition, or sale of all or substantially all of its assets. Any purported assignment in violation of this Section is null and void.

16.6 No Agency.

Nothing in this Agreement shall create any agency, partnership, joint venture, or employment relationship between the parties. Neither party shall have authority to bind the other.

16.7 Notices.

Notices to NNS shall be provided in writing to: New Normal Security, Inc., Attn: Legal, P.O. Box 1247, Meridian, ID 83680, or legal@newnormalsecurity.com. Notices to Customer may be provided to the email address associated with Customer's account or posted within the Services.

16.8 Force Majeure.

NNS shall not be liable for any failure or delay in performance resulting from causes beyond its reasonable control, including acts of God, natural disasters, war, terrorism, labor disputes, governmental actions, internet service provider failures, third-party infrastructure outages, or cyberattacks.

16.9 Language.

This Agreement is in the English language. Any translation is provided for convenience only; the English version controls in the event of conflict.

16.10 Electronic Acceptance.

Electronic acceptance (including clicking "I Agree," creating an account, downloading, or using the Services) shall have the same legal effect as a handwritten signature.

16.11 Publicity.

Unless Customer opts out in writing, NNS may identify Customer by name and logo as a user of the Services in NNS’s marketing materials, website, and investor presentations. NNS shall not issue any press release or detailed case study referencing Customer without Customer’s prior written approval. Customer may opt out of general publicity rights at any time by providing written notice to NNS.

PRODUCT SCHEDULE A

NEWSCAN

A.1 — Product Description

NewScan is a downloadable security scanning tool that assists users with penetration testing, API security testing, and software audit activities. NewScan is delivered via download and installed on Customer's Device.

A.2 — License Grant

Subject to the terms of the Agreement and this Product Schedule, NNS grants Customer a limited, non-exclusive, non-transferable, non-sublicensable, royalty-free license to download, install, and use NewScan for Customer's personal or internal business purposes.

A.3 — License Metric

The license is granted on a per-Authorized User basis, as identified by the Authorized User's single sign-on credential or email address. Each Authorized User may install and use an unlimited number of copies of NewScan on Devices owned or controlled by that Authorized User. A single license may not be shared among multiple individuals.

A.4 — Pricing

NewScan is provided free of charge. There are no fees associated with downloading, installing, or using NewScan.

A.5 — Product-Specific Restrictions

In addition to the General Restrictions in Section 2 of the Agreement: (a) Customer shall not share, lend, or make available Authorized User credentials to any third party; and (b) Customer shall not permit any individual who is not the licensed Authorized User to use copies of NewScan installed under that Authorized User’s license.

A.6 — Updates

NNS has no obligation to provide Updates to NewScan. If automatic update functionality is included, Customer consents to the automatic download and installation of Updates, subject to Customer's ability to disable automatic updates through the software's settings.

A.7 — Data Collection

NewScan may collect Usage Data as described in Section 6 of the Agreement, including but not limited to: application version, operating system type, feature usage frequency, scan initiation and completion events, error and crash data, and general performance telemetry. NewScan does not collect the content or results of Customer’s security scans unless Customer has opted in to the Aggregated Data program described in Section 6.3. A complete description of data collected by NewScan is available at [URL]. Customer may opt out of Usage Data collection through the software's settings.

A.8 — Connectivity to Other NNS Products

NewScan may be configured to communicate with NewScan Pro and NNS Team Basics, subject to the terms of the applicable Product Schedules. The connectivity rules for such communication are specified in Product Schedules B and C.

A.9 — Term

The license for NewScan is perpetual unless terminated in accordance with Section 12 of the Agreement.

A.10 — Changes to NewScan

NNS reserves the right to add features, capabilities, or integrations to NewScan at any time. NNS shall not materially reduce or remove core functionality of NewScan without at least thirty (30) days’ advance notice posted within the software or at [URL]. New features may be offered as paid add-ons subject to separate Product Schedules or Order Forms.

PRODUCT SCHEDULE B

NEWSCAN PRO

B.1 — Product Description

NewScan Pro is a security detection and workflow integration service operated and maintained by NNS. NewScan Pro provides advanced detection capabilities that augment NewScan by receiving and analyzing data transmitted from a connected NewScan instance. NewScan Pro also includes JIRA integration and reporting features, which are delivered via SaaS.

B.2 — Service Grant

Subject to the terms of the Agreement and this Product Schedule, NNS grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right to access and use NewScan Pro during the applicable Subscription Term, solely for Customer's internal business purposes and in accordance with the Documentation.

B.3 — License Metric and Connectivity

Each NewScan Pro subscription is paired on a one-to-one (1:1) basis with a single NewScan instance. A single NewScan instance may communicate with only one (1) NewScan Pro subscription at a time, and a single NewScan Pro subscription may communicate with only one (1) NewScan instance at a time. An Authorized User running multiple copies of NewScan may purchase NewScan Pro subscriptions for any subset of those copies; however, each NewScan Pro subscription must be paired with a distinct NewScan instance, and the 1:1 pairing must be maintained at all times. NNS may enforce pairing through technical mechanisms, including but not limited to license keys, API tokens, or instance identifiers.

B.4 — Pricing and Payment

NewScan Pro is a paid subscription service. Pricing shall be as displayed on NNS’s website at the time of purchase or as set forth in the applicable Order Form. Payment shall be processed through Stripe in accordance with Section 5 of the Agreement.

B.5 — Subscription Term and Renewal

The initial Subscription Term shall be as specified at the time of purchase. Subscriptions automatically renew as described in Section 5 of the Agreement.

B.6 — Service Availability

NewScan Pro is subject to the availability provisions in Section 7 of the Agreement. NNS shall use commercially reasonable efforts to maintain availability of NewScan Pro during the Subscription Term.

B.7 — Customer Data

Customer Data transmitted from NewScan to NewScan Pro is governed by Section 6 of the Agreement. NNS processes Customer Data solely to provide the detection and analysis features of NewScan Pro.

B.8 — Product-Specific Restrictions

In addition to the General Restrictions in Section 2 of the Agreement: (a) Customer shall not attempt to connect more than one NewScan instance to a single NewScan Pro subscription; (b) Customer shall not share access credentials or API tokens for NewScan Pro with any unauthorized third party; and (c) Customer shall not use NewScan Pro to process data originating from any source other than a validly licensed NewScan instance.

B.9 — Prerequisite

Use of NewScan Pro requires an active, validly licensed copy of NewScan. Customer must accept Product Schedule A prior to or concurrently with accepting this Product Schedule B.

B.10 — Changes to NewScan Pro

NNS reserves the right to add features, capabilities, or integrations to NewScan Pro at any time. NNS shall not materially reduce or remove core functionality of NewScan Pro during an active Subscription Term without Customer’s consent. Changes that expand functionality (such as additional integrations or reporting capabilities) shall not require a new Product Schedule or Order Form unless separately priced.

PRODUCT SCHEDULE C

NNS TEAM BASICS

C.1 — Product Description

NNS Team Basics is a multi-user, cloud-based SaaS platform operated and maintained by NNS that enables teams to centralize, manage, and collaborate on security scanning activities across multiple NewScan instances. NNS Team Basics is delivered as a fully hosted service accessible via web browser or API.

C.2 — Service Grant

Subject to the terms of the Agreement and this Product Schedule, NNS grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right to access and use NNS Team Basics during the applicable Subscription Term, solely for Customer's internal business purposes and in accordance with the Documentation.

C.3 — License Metric and Connectivity

NNS Team Basics is licensed on a per-account basis (“NNS Team Account”). Multiple NewScan instances owned or controlled by Customer may communicate with a single NNS Team Account. The maximum number of NewScan instances that may connect to a NNS Team Account shall be as specified in the applicable Order Form or as set forth on NNS’s website at the time of purchase; if no maximum is specified, the number of connected instances shall be limited to the Authorized Users on Customer's account. Customer shall not permit NewScan instances operated by third parties (other than Authorized Users) to connect to Customer's NNS Team Account.

C.4 — Authorized Users

Customer may invite Authorized Users to access the NNS Team Account in accordance with the account tier purchased. Customer is responsible for the acts and omissions of all Authorized Users and shall ensure that each Authorized User complies with the Agreement. Customer shall promptly remove access for any individual who is no longer an Authorized User.

C.5 — Pricing and Payment

NNS Team Basics is a paid subscription service. Pricing shall be as displayed on NNS’s website at the time of purchase or as set forth in the applicable Order Form. Payment shall be processed through Stripe in accordance with Section 5 of the Agreement.

C.6 — Subscription Term and Renewal

The initial Subscription Term shall be as specified at the time of purchase. Subscriptions automatically renew as described in Section 5 of the Agreement.

C.7 — Service Availability

NNS Team Basics is subject to the availability provisions in Section 7 of the Agreement. Given the multi-user, team-collaboration nature of this Service, NNS shall prioritize availability and shall provide status updates via [status.newnormalsecurity.com] during any unplanned outage.

C.8 — Customer Data

Customer Data submitted to or processed by NNS Team Basics is governed by Section 6 of the Agreement. Customer Data within NNS Team Basics is logically segregated from other customers' data in NNS’s multi-tenant environment. NNS processes Customer Data solely to provide the features and functionality of NNS Team Basics.

C.9 — Administrative Controls

Customer shall designate at least one account administrator who shall have the ability to: (a) manage Authorized Users and their access levels; (b) configure NewScan instance connections; (c) access account-level reporting; and (d) manage billing and subscription settings. NNS shall not be responsible for any actions taken by Customer's account administrator(s) within the scope of their administrative authority.

C.10 — Product-Specific Restrictions

In addition to the General Restrictions in Section 2 of the Agreement: (a) Customer shall not share or disclose NNS Team Account credentials with unauthorized third parties; (b) Customer shall not permit any individual who is not an Authorized User to access the NNS Team Account; (c) Customer shall not use NNS Team Basics to aggregate or centralize scanning data from NewScan instances that are not validly licensed under Product Schedule A; and (d) Customer shall not use NNS Team Basics for the benefit of any third party or as a managed service offering without NNS’s prior written consent.

C.11 — Prerequisite

Use of NNS Team Basics requires at least one active, validly licensed copy of NewScan connected to the NNS Team Account. Customer must accept Product Schedule A prior to or concurrently with accepting this Product Schedule C.

C.12 — Enterprise Negotiation

For enterprise customers requiring customized terms (including enhanced SLAs, data processing addenda, or modified liability provisions), NNS will make available a negotiable Order Form that may supplement or modify the terms of this Product Schedule upon mutual written agreement.

C.13 — Changes to NNS Team Basics

NNS reserves the right to add features, capabilities, or integrations to NNS Team Basics at any time. NNS shall not materially reduce or remove core functionality of NNS Team Basics during an active Subscription Term without Customer’s consent. Changes that expand functionality shall not require a new Product Schedule or Order Form unless separately priced.

Contact Information

New Normal Security, Inc.

Attn: Legal Department

P.O. Box 1247, Meridian, ID 83680

legal@newnormalsecurity.com

© New Normal Security, Inc. All rights reserved.