Axiad Cloud Services Agreement

General Terms

This Axiad Cloud Services Agreement (this "Agreement") is entered into between Axiad IDS, Inc., a Delaware corporation with offices at 101 Metro Drive, Suite 560, San Jose, CA 95110? ("Axiad"), and the customer identified in the signature block or in the applicable Order Form ("Customer"), and is effective on the earlier of the date last signed below or the effective date of the first Order Form that references this Agreement (the "Effective Date"). This Agreement governs Customer's access to and use of the Axiad Conductor, Axiad Mesh, and/or Axiad Confirm cloud services and any related Professional Services. Customer and Axiad may be referred to individually as a "party" and collectively as the "parties".

This Agreement consists of these General Terms, the Product Schedules applicable to the Services Customer orders (Schedule A: Axiad Conductor; Schedule B: Axiad Mesh; Schedule C: Axiad Confirm), Exhibit 1 (Service Level Agreement), Exhibit 2 (Information Security), the Axiad Data Processing Addendum, and each Order Form and SOW that is executed by both parties and incorporated by reference. A Product Schedule applies only to the Services described in that Schedule.

1. DEFINITIONS

1.1 "Affiliate" of a party means any entity that, directly or indirectly, controls, is controlled by, or is under common control with, such party, where "control" means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity or the power to direct the management and policies of such entity.

1.2 "AI Features" means those features and functionality of the Services that use artificial intelligence, machine learning, large language models, or similar technologies to generate, summarize, classify, correlate, score, verify, or otherwise analyze information, including any conversational assistant, automated analysis, biometric or liveness matching, and machine-generated recommendations made available as part of the Services.

1.3 "Confidential Information" means any non-public information a party discloses or makes accessible to the other party under this Agreement or any Order Form. Confidential Information of Customer includes Account Information, Customer Data, and Customer Materials. Confidential Information of Axiad includes, without limitation, the Services, Documentation, technology, Threat Intelligence Data, security reports, and pricing.

1.4 "Connected System" means any third-party system, application, directory, data source, or service owned, licensed, controlled, or operated by or on behalf of Customer that Customer authorizes Axiad to connect to, access, or ingest data from in order to provide the Services (e.g., identity providers, directory services, certificate authorities, HR information systems, and endpoint or security telemetry sources).

1.5 "Customer Data" has the meaning given in Section 5.1.

1.6 "Customer Materials" means any data, content, configuration, credentials, or other materials that Customer or any of its Users provide, make accessible, or otherwise submit to Axiad in connection with the Services, including data ingested from a Connected System, but excluding Output and Axiad IP.

1.7 "Documentation" means the documentation Axiad makes available for the Services, including technical information, policies, and terms contained in or linked from webpages or applications associated with the Services, as updated by Axiad from time to time.

1.8 "Hardware" means physical products used in connection with the Services, such as smart cards, security keys, readers, printers, consumables, and devices, that are identified in an Order Form.

1.9 "Order Form" means an ordering document executed by Customer and Axiad or a Related Party that identifies the Services being ordered, usage parameters, fees, subscription term, and any related Professional Services or Hardware, and that references this Agreement.

1.10 "Output" means the results, insights, correlations, risk scores, verification results, findings, reports, inventories, analyses, and other data that the Services generate or derive from Customer Data, Customer Materials, or data from Connected Systems, excluding Axiad IP and Threat Intelligence Data.

1.11 "Product Schedule" means Schedule A (Axiad Conductor), Schedule B (Axiad Mesh), or Schedule C (Axiad Confirm), each of which sets out terms specific to the Service it describes and applies only when Customer has ordered that Service.

1.12 "Professional Services" means implementation, configuration, migration, training, or other services provided by Axiad other than the standard Services, as described in an SOW.

1.13 "Related Party" means an Axiad-authorized reseller or distributor of the Services, or an Axiad Affiliate, as specified in the applicable Order Form.

1.14 "Services" means the Axiad-hosted, cloud-based services identified in an Order Form, consisting of one or more of (a) Axiad Conductor, the credential management service for issuing and managing identity credentials described in Schedule A; (b) Axiad Mesh, the identity risk management platform described in Schedule B; and (c) Axiad Confirm, the identity verification service described in Schedule C; in each case including the associated Documentation, portals, consoles, and APIs. Services do not include Professional Services or Hardware.

1.15 "SOW" or "Statement of Work" means a document executed by Customer and Axiad or a Related Party that describes Professional Services and expressly references this Agreement. Each SOW is incorporated into this Agreement upon execution.

1.16 "Term" has the meaning given in Section 8.1.

1.17 "Third Party Service" means a service, model, data feed, or software developed or licensed by a third party and made available by Axiad as part of the Services.

1.18 "Threat Intelligence Data" means data, indicators, signals, and enrichment obtained by Axiad from its own sources or third-party providers and made available within the Services to support risk assessment, verification, correlation, and/or analysis. As between the parties, Threat Intelligence Data is Axiad IP.

1.19 "Users" means individuals authorized by Customer to access or use the Services and who have been supplied credentials by Customer (or by Axiad at Customer's request), including Customer's employees, consultants, contractors, agents, and, where the applicable Product Schedule provides, Customer's own end users. Customer shall ensure that consultants, contractors, and agents who are Users have agreed in writing to obligations no less protective of Axiad than this Agreement.

2. PROVISION AND USE OF THE SERVICES

2.1 Provision of Services. Axiad will make the Services available to Customer during the Term in accordance with this Agreement, the applicable Order Form, and the Documentation. Axiad will (a) use commercially reasonable efforts to make the Services available in accordance with the Service Level Agreement in Exhibit 1 (the "SLA"); (b) maintain the security practices described in Exhibit 2 ("Information Security"); and (c) operate, maintain, and update, the software and infrastructure Axiad uses to provide the Services (the "Axiad Infrastructure"). Unless an Order Form states otherwise, Axiad will provide the then-current generally available version of the Services.

2.2 Purchases Through Related Parties. Customer may purchase the Services directly from Axiad or through a Related Party. If Customer purchases through a Related Party, (a) the Services are made available under an Order Form between Customer and the Related Party, but this Agreement governs Customer's and its Users' use of the Services; (b) Customer's payment obligations and commercial relationship are with the Related Party, and Customer shall direct any refund or credit claims to the Related Party; and (c) the Related Party is not authorized to modify this Agreement or make representations or commitments on Axiad's behalf.

2.3 Right to Use. Subject to this Agreement, Axiad grants Customer a limited, non-exclusive, non-transferable, non-assignable (except as set forth in Section 9.3) right during the Term to access and use the Services and Documentation for Customer's internal business purposes, within the usage parameters (e.g., number of Users, identities, verifications, environments, or Connected Systems) stated in the applicable Order Form. Customer may permit its Affiliates and Users to use the Services under this right, provided Customer remains responsible for their compliance with this Agreement.

2.4 Professional Services. Any Professional Services will be described in an SOW. Axiad will perform Professional Services in a professional and workmanlike manner in accordance with the SOW. Unless the SOW states otherwise, Professional Services fees are invoiced as incurred, and Customer will reimburse reasonable, pre-approved travel expenses and related costs.

2.5 Updates; Future Functionality. Axiad may modify the features and/or functionality of the Services from time to time, provided the modification does not materially reduce the core functionality of the Services purchased during the then-current subscription term. Axiad will determine whether any new features and/or functionality require additional fees or acceptance of additional terms. Customer's purchase is not contingent on the delivery of any future feature or functionality, regardless of any oral or written communication about Axiad's plans.

2.6 Customer Responsibilities. Customer shall, and shall ensure that its Users: (a) comply with all applicable laws, including, without limitation, those relating to data privacy, biometric information, export control, and anti-corruption; (b) use reasonable security precautions in connection with access to and use of the Services, including protecting passwords, private keys, API tokens, and service accounts; (c) promptly cooperate with Axiad's reasonable investigation of any outage, security or service problem, or suspected breach of this Agreement; (d) provide and maintain true, accurate, and complete account information, including billing and technical contacts (the "Account Information"); (e) be responsible for all use of the Services under Customer's account, including by any person Customer directly or indirectly permits to access it, and immediately notify Axiad in writing of any known or suspected unauthorized access and/or use; (f) not store or transmit through the Services any content that infringes, misappropriates, or violates any applicable law or third-party right; and (g) use the Services only for Customer's internal business purposes and in accordance with this Agreement, the applicable Product Schedule, and the Documentation.

2.7 Restrictions. Customer shall not, and shall not permit any User or third party to: (a) modify or create derivative works of the Services; (b) reverse engineer, decompile, decrypt, or otherwise attempt to derive source code, models, model weights, algorithms, or underlying ideas of any component of the Services, including any AI Feature, except to the extent applicable law prohibits this restriction; (c) sell, resell, rent, lease, sublicense, or use the Services for timesharing or service bureau purposes, or otherwise make the Services available to any third party except Users; (d) disclose the results of any benchmark, penetration test, or performance evaluation of the Services without Axiad's prior written consent; (e) use the Services, any AI Feature, or any Output to build, train, or improve a competing product or service; (f) submit any content that Customer lacks the right to submit or that violates the acceptable-use terms of any applicable Third Party Service; (g) use the Services, any AI Feature, or any Output for unlawful surveillance, discriminatory profiling, or any purpose prohibited by applicable law; (h) interfere with the integrity or performance of the Services or attempt to gain unauthorized access to them or to related systems; or (i) remove or obscure any proprietary notices.

2.8 Suspension. Axiad may suspend Customer's and/or any User's access to the Services if: (a) Axiad reasonably believes the Services are being used in violation of this Agreement or applicable law; (b) Customer fails to cooperate with Axiad's investigation of a suspected violation or a governmental investigation; (c) Axiad reasonably determines that suspension is necessary to protect the Services, the Axiad Infrastructure, Axiad's other customers, or the public; (d) any undisputed payment is more than thirty (30) days past due; or (e) suspension is required by law. Axiad will use reasonable efforts to notify Customer in advance of a suspension, to limit the suspension to the affected Users or Services where practicable, and to restore access promptly once the cause is resolved. Suspension under this Section does not relieve Customer of its payment obligations.

3. FEES AND PAYMENT

3.1 Fees. Customer shall pay the fees stated in each Order Form and SOW (the "Fees") to Axiad or to the Related Party identified in the Order Form. Unless the Order Form states otherwise, all Fees are invoiced annually in advance and are due within thirty (30) days after the invoice date. Fees are based on the Services and quantities ordered, not actual usage, and quantities ordered may not be decreased during the then-current subscription term. Except as expressly provided in this Agreement, all payment obligations are non-cancelable and all Fees paid are non-refundable and not subject to set-off.

3.2 Late Payment; Disputes. Amounts not paid when due accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law, plus reasonable costs of collection. If Customer disputes an invoice in good faith, Customer shall notify Axiad in writing before the payment due date with reasonable detail, pay the undisputed portion of the invoice, and the parties will work in good faith to resolve the dispute promptly. Axiad will not charge interest on, or suspend for non-payment of, amounts disputed in good faith under this Section.

3.3 Overages. If Customer's use of the Services exceeds the usage parameters in the applicable Order Form, Axiad may invoice Customer for the excess at the rates stated in the Order Form or, if none are stated, at Axiad's current rates then in effect and prorated for the remainder of the subscription term, and Customer shall pay such invoice in accordance with Section 3.1.

3.4 Taxes. Fees exclude all sales, use, value-added, withholding, and similar taxes, levies, and duties ("Taxes"). Customer is responsible for all Taxes associated with its purchases under this Agreement and/or any Order Form, other than taxes based on Axiad's or the Related Party's net income. If Axiad or the Related Party is required to pay or collect Taxes for which Customer is responsible, the appropriate amount will be invoiced to and paid by Customer, unless Customer provides a valid tax exemption certificate.

4. WARRANTIES AND DISCLAIMERS

4.1 Service Warranty. Axiad warrants that (a) the Services will perform materially in accordance with the Documentation and the applicable Product Schedule; (b) Axiad will perform the Professional Services in a good and workmanlike manner; and (c) Axiad will implement commercially reasonable measures to detect and mitigate viruses and other malicious code on the Axiad systems that provide the Services. Axiad is not responsible for any breach of the foregoing warranties to the extent caused by Customer's or a User's unauthorized or misuse of the Services, breach of this Agreement, or failure to use the Services in accordance with the Documentation. Customer's exclusive remedy for breach of the warranty in clause (a) is for Axiad to correct the non-conformity or, if Axiad cannot do so within a reasonable time, for Customer to terminate the affected Order Form upon written notice to Axiad and receive a pro-rata refund of prepaid, unused Fees for the affected Services.

4.2 AI Features and Output; No Reliance. Customer acknowledges that AI Features and Output are generated by automated systems, may be incomplete or inaccurate, and may vary between requests. Axiad does not warrant that any Output, risk score, verification result, correlation, inventory, or recommendation is accurate, complete, current, or fit for any particular purpose. Output is an informational aid and is not a substitute for Customer's independent judgment. Customer is solely responsible for reviewing and validating Output and for deciding whether and how to act on and/or use it, and shall not use Output as the sole basis for any decision that produces a legal or similarly significant effect concerning an individual (including employment, access, or security decisions) where applicable law requires human review, notice, or appeal rights. To the extent Customer uses Output in any such a decision, Customer is the "deployer," "controller," or decision-maker under applicable automated-decision-making and artificial-intelligence laws and is responsible for any resulting notice, human-review, appeal, impact-assessment, and transparency obligations. Where Customer makes a conversational assistant or other AI Feature available to individuals, Customer is responsible for disclosures required by law that they are interacting with an artificial-intelligence system. Axiad will make available in the Documentation a description of each AI Feature's intended use, limitations known to Axiad at time of disclosure, and the general categories of data used to generate Output, and will notify Customer of material changes to these matters. Threat Intelligence Data and other third-party data are provided "as is." This Section allocates responsibility between the parties only and does not limit either party's independent obligations to regulators or third parties.

4.3 Hardware. Hardware is manufactured by third parties. Unless an Order Form expressly states otherwise, Axiad provides Hardware "as is," passes through to Customer any manufacturer warranty to the extent transferable, and has no other warranty, support, or return obligation with respect to Hardware. Title to Hardware passes to Customer on delivery and payment of the applicable Fees; risk of loss passes on delivery to the carrier that is delivering the Hardware.

4.4 High-Risk Activities. The Services are not designed or intended for use in any environment in which failure of the Services could lead to death, personal injury, or severe physical or environmental damage, including, without limitation, the operation of nuclear facilities, aircraft navigation or communication systems, air traffic control, life support, or weapons systems. Customer shall not use the Services for any such purpose.

4.5 DISCLAIMER. EXCEPT AS EXPRESSLY STATED IN SECTION 4.1, THE SERVICES, PROFESSIONAL SERVICES, HARDWARE, DOCUMENTATION, AI FEATURES, OUTPUT, THREAT INTELLIGENCE DATA, AND THIRD PARTY SERVICES ARE PROVIDED "AS IS," AND AXIAD AND ITS SUPPLIERS AND THIRD PARTY SERVICE PROVIDERS MAKE NO OTHER WARRANTIES OR REPRESENTATIONS OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, AND SPECIFICALLY DISCLAIM ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE, OR USAGE OF TRADE, TO THE MAXIMUM EXTENT PERMITTED BY LAW. AXIAD DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, THAT THEY WILL MEET CUSTOMER'S REQUIREMENTS, OR THAT OUTPUT WILL BE ACCURATE OR COMPLETE. AXIAD IS NOT RESPONSIBLE FOR DELAYS, INTERRUPTIONS, OR OTHER PROBLEMS INHERENT IN THE USE OF THE INTERNET OR ELECTRONIC COMMUNICATIONS, OR FOR ANY ACT OR OMISSION OF A CONNECTED SYSTEM OR ITS PROVIDER.

5. CUSTOMER DATA, PRIVACY, AND INTELLECTUAL PROPERTY

5.1 Customer Data. As between the parties, Customer owns all right, title, and interest in and to all data and content that Customer or its Users submit to or store in the Services, including Account Information, Customer Materials, and data ingested from Connected Systems (collectively, "Customer Data"). Customer grants Axiad and its sub-processors a non-exclusive, worldwide, royalty-free license during the Term to host, copy, process, transmit, and display Customer Data solely as necessary to provide, secure, maintain, support, and/or improve the Services in accordance with this Agreement, including to generate Output. Axiad will protect Customer Data in accordance with Exhibit 2.

5.2 Data Processing Addendum. To the extent Axiad processes personal information contained in Customer Data on Customer's behalf, the Axiad Data Processing Addendum attached to or referenced in the Order Form (the "DPA") is incorporated into this Agreement. As between the parties, Customer is the "business," "controller," or equivalent and Axiad is the "service provider," "processor," or equivalent under applicable data-protection laws. In the event of a conflict between this Agreement and the DPA with respect to the processing of personal information, the DPA applies and controls.

5.3 Restricted Data. Customer shall not submit to the Services any special or sensitive category of personal information that the Services are not designed to process, including, without limitation, any protected health information subject to HIPAA, payment card data subject to PCI DSS, or (except for Axiad Confirm as described in Schedule C) biometric identifiers, unless the parties have executed a written addendum governing any such data. Axiad has no obligation or liability with respect to data submitted or made accessible in violation of this Section.

5.4 Connected Systems. Customer may authorize Axiad to connect to and ingest data from Connected Systems. Customer represents and warrants that it has, and will maintain, all rights, consents, and authorizations necessary for Axiad to access and process data from each Connected System for the purposes of this Agreement, and that doing so will not violate any applicable law or any agreement between Customer and any third party. Customer is responsible for the accuracy and legality of data obtained from Connected Systems and for provisioning and managing the credentials and permissions used to establish each connection. Axiad will access Connected Systems only as configured and authorized by Customer and solely to provide the Services, and will protect stored Connected System credentials in accordance with Exhibit 2. Customer may revoke Axiad's access to a Connected System at any time; Customer acknowledges any such that revocation may degrade or disable affected Services and that such degradation is not a breach of this Agreement or any Order Form by Axiad. Axiad is not responsible for the availability, content, or conduct of any Connected System or its provider.

5.5 Axiad IP. Axiad and its licensors own and retain all right, title, and interest in and to the Services, Documentation, Axiad Infrastructure, AI Features (including underlying models, algorithms, and systems), Threat Intelligence Data, any deliverables or work product from Professional Services (other than Customer Confidential Information incorporated in them), and all modifications, improvements, enhancements, and derivative works of the foregoing, together with all intellectual property rights therein (collectively, "Axiad IP"). Except for the limited rights expressly granted in this Agreement during the Term, no rights in any Axiad IP are granted to Customer. If Customer or a User provides suggestions or feedback regarding the Services, Axiad may use that feedback without restriction, obligation, attribution, or payment of any royalty or other fee.

5.6 Output. As between the parties, Customer owns the Output that the Services generate about Customer's own identities, Users, assets, and environment, subject to Axiad's rights in the Axiad IP and Threat Intelligence Data used to produce it. Axiad's ownership of the AI Features does not extend to such Output. Customer may use Output for its internal business purposes and as permitted by the applicable Product Schedule.

5.7 Deidentified and Aggregated Data. Axiad may create and use deidentified and aggregated data derived from Customer Data, Customer Materials, Output, and Customer's use of the Services to operate, secure, analyze, upgrade, maintain, and/or improve the Services, to develop new features and Threat Intelligence Data, and to detect and prevent fraud and/or abuse. Axiad will (a) implement technical and organizational measures reasonably designed to prevent reidentification of any individual or Customer; (b) not attempt to reidentify such data; (c) maintain and use such data solely in deidentified form; and (d) contractually prohibit any recipient from attempting reidentification. Data subject to reversible tokenization is not deidentified for purposes of this Section. Deidentified and aggregated data are Axiad IP.

5.8 Data Retention and Export. Axiad will retain Customer Data in the Services during the Term for the period stated in the applicable Product Schedule. Customer may export Customer Data at any time during the Term using the Services' export functionality or, on written request, Axiad will make Customer Data available in a commonly used format within forty-five (45) days. Axiad's retention of Customer Data is for the purpose of providing the Services and should not be relied on by Customer to satisfy its own legal, audit, or compliance retention requirements. Customer is responsible for retaining and managing its data in accordance with applicable law and its internal policies. Deletion of Customer Data following expiration or termination of this Agreement is governed by Section 8.4.

6. CONFIDENTIALITY

6.1 Ownership. Confidential Information remains the property of the disclosing party or, as applicable, the third parties who entrusted it to the disclosing party.

6.2 Protection. The receiving party will use at least the same degree of care it uses to protect its own confidential information of like importance, and not less than reasonable care, to (a) not use the disclosing party's Confidential Information for any purpose outside the scope of this Agreement; (b) limit access to those of its and its Affiliates' employees, officers, consultants, contractors, and professional advisors (collectively, "Representatives") who need access to perform or receive the Services and who are bound by confidentiality obligations no less protective than those in this Agreement; and (c) protect the disclosing party's trade secrets for so long as they remain trade secrets. Each party is responsible for any breach of this Section by its Representatives. Either party may disclose the terms of this Agreement in confidence to actual or prospective financing sources, acquirers, and professional advisors. Axiad may disclose the terms of this Agreement and any Order Form to a Related Party or sub-processor to the extent necessary to perform its obligations, under confidentiality terms no less protective than this Section.

6.3 Exclusions. Confidential Information does not include information that (a) is or becomes generally known to the public without breach of any obligation owed to the disclosing party; (b) was known to the receiving party before disclosure without breach of any obligation owed to the disclosing party; (c) is received from a third party without breach of any obligation owed to the disclosing party; or (d) is independently developed by the receiving party without use of or reference to the disclosing party's Confidential Information.

6.4 Compelled Disclosure. If the receiving party is required by law, regulation, or court order to disclose Confidential Information, it shall, to the extent legally permitted, give the disclosing party prompt written notice and reasonable cooperation, at the disclosing party's expense, to allow the disclosing party to contest or limit the disclosure or to seek a protective order, and shall disclose only the portion of Confidential Information it is legally required to disclose.

6.5 Duration; Remedies. The obligations in this Section 6 continue for five (5) years after expiration or termination of this Agreement, except that obligations with respect to trade secrets continue for so long as the information remains a trade secret, and obligations with respect to Customer Data continue for so long as Axiad retains it. Each party acknowledges that unauthorized disclosure of Confidential Information may cause irreparable harm for which monetary damages would be an inadequate remedy, and the disclosing party may seek injunctive relief in addition to any other legal or equitable remedy.

7. INDEMNIFICATION AND LIMITATION OF LIABILITY

7.1 Indemnification by Axiad. Axiad shall defend Customer and its officers, directors, and employees against any claim, demand, suit, or proceeding brought by a third party alleging that the Services, as provided by Axiad and used by Customer in accordance with this Agreement, infringe a third party’s United States patent, copyright, or registered trademark, or misappropriate a trade secret (an "Infringement Claim"), and shall pay any damages and costs finally awarded against Customer or agreed in a settlement approved in writing by Axiad. Axiad has no obligation for any Infringement Claim arising from or related to (a) any Customer Data, Customer Materials, or data from a Connected System; (b) the combination of the Services with any product, service, data, or process not provided by Axiad, where the claim would not have arisen but for the combination; (c) modification of the Services by anyone other than Axiad; (d) any use of the Services after Axiad has notified Customer to discontinue use because of an actual or threatened claim; or (e) any Hardware or Third Party Services. If the Services become, or in Axiad's opinion are likely to become, the subject of an Infringement Claim, Axiad may at its option and expense (i) procure the right for Customer to continue using the Services; (ii) modify or replace the Services to be non-infringing while substantially preserving functionality; or (iii) if neither of the foregoing is commercially reasonable or feasible to Axiad, terminate the affected Services upon written notice to Customer and refund any prepaid, unused Fees for the affected Services. This Section 7.1 states Axiad's entire liability and Customer's exclusive remedy for any Infringement Claim.

7.2 Indemnification by Customer. Customer shall defend Axiad, its Affiliates, Related Parties, Third Party Service providers, and suppliers, and their respective officers, directors, employees, and contractors (the "Axiad Indemnitees") against any claim, demand, suit, or proceeding brought by a third party arising out of or relating to (a) any Customer Data, Customer Materials, or data from a Connected System, including any allegation that Axiad's processing of any such data in accordance with this Agreement violates any applicable law or any third party's rights; (b) Customer's or a User's use of the Services in violation of this Agreement, the applicable Product Schedule, or applicable law; (c) Customer's breach of its representations and warranties in Section 5.4 (Connected Systems) or in any Product Schedule regarding notices, consents, or authorizations Customer is required to obtain; or (d) any personal injury, death, or property damage resulting from a User's use of the Services in an unauthorized or unlawful manner; and shall pay any damages and costs finally awarded against any Axiad Indemnitee or agreed in a settlement approved in writing by Customer.

7.3 Procedure. The indemnified party shall (a) promptly notify the indemnifying party in writing of the claim, provided that failure to give prompt written notice relieves the indemnifying party of its obligations only to the extent it is materially prejudiced by the delay; (b) give the indemnifying party sole control of the defense and settlement of the claim, except that the indemnifying party may not settle a claim in a manner that imposes any non-monetary obligation or admission of fault on the indemnified party without its prior written consent, not to be unreasonably withheld, conditioned, or delayed; and (c) provide reasonable cooperation and assistance at the indemnifying party's request and expense. The indemnified party may participate in the defense with counsel of its own choosing at its own expense.

7.4 EXCLUSION OF INDIRECT DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY NOR ITS AFFILIATES, RELATED PARTIES, SUPPLIERS, OR THIRD PARTY SERVICE PROVIDERS WILL BE LIABLE TO THE OTHER PARTY, WHETHER IN CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY, OR OTHERWISE, FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, PUNITIVE, RELIANCE, OR COVER DAMAGES, OR FOR ANY LOSS OF BUSINESS, REVENUE, PROFITS, GOODWILL, OR ANTICIPATED SAVINGS, INTERRUPTION OF USE, LOSS OR CORRUPTION OF DATA, OR COST OF PROCUREMENT OF SUBSTITUTE EQUIPMENT, GOODS, OR SERVICES, ARISING OUT OF OR RELATING TO THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF ANY SUCH DAMAGES AND EVEN IF A REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

7.5 CAP ON LIABILITY. TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL CUMULATIVE LIABILITY FOR DIRECT DAMAGES ARISING OUT OF OR RELATING TO THIS AGREEMENT AND ALL ORDER FORMS, WHETHER IN CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, WILL NOT EXCEED THE TOTAL FEES PAID AND PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM FOR THE SPECIFIC SERVICE GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. THE LIMITATIONS IN THIS SECTION 7.5 ARE CUMULATIVE FOR ALL CLAIMS AND ARE NOT PER INCIDENT.

7.6 EXCEPTIONS. THE EXCLUSIONS AND LIMITATIONS IN SECTIONS 7.4 AND 7.5 DO NOT APPLY TO (A) A PARTY'S INDEMNIFICATION OBLIGATIONS UNDER SECTIONS 7.1 AND 7.2; (B) A PARTY'S BREACH OF SECTION 6 (CONFIDENTIALITY) OR, IN THE CASE OF AXIAD, A SECURITY INCIDENT TO THE EXTENT CAUSED BY AXIAD'S BREACH OF EXHIBIT 2 OR THE DPA; (C) A PARTY'S GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR FRAUD; (D) A PARTY'S VIOLATION OF APPLICABLE LAW; (E) CUSTOMER'S PAYMENT OBLIGATIONS, INCLUDING ACCELERATED FEES UNDER SECTION 8.3; OR (F) ANY LIABILITY THAT CANNOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW (COLLECTIVELY, "EXCEPTED CLAIMS"). NOTWITHSTANDING THE FOREGOING, EXCEPT FOR CUSTOMER'S PAYMENT OBLIGATIONS AND LIABILITY DESCRIBED IN CLAUSE (C) OR (F), EACH PARTY'S TOTAL CUMULATIVE LIABILITY FOR ALL EXCEPTED CLAIMS WILL NOT EXCEED THREE TIMES (3X) THE TOTAL FEES PAID AND PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM FOR THE SPECIFIC SERVICE GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

7.7 Basis of the Bargain. The parties agree that the limitations in this Section 7 reflect a reasonable allocation of risk, are an essential basis of the bargain, and apply notwithstanding the failure of any exclusive remedy. Each Third Party Service provider and supplier that provides any portion of the Services is an intended third-party beneficiary of the disclaimers and limitations in Sections 4 and 7 with respect to the software or services it provides.

8. TERM AND TERMINATION

8.1 Term; Renewal. This Agreement commences on the Effective Date and continues until all Order Forms have expired or been terminated (the "Term"). Each Order Form states its initial subscription term. Unless the Order Form states otherwise, each Order Form automatically renews for successive renewal terms equal in length to the initial subscription term unless either party gives written notice of non-renewal at least sixty (60) days before the end of the then-current term (notice to Axiad must be sent to: SalesOperations@axiad.com). Axiad may increase Fees for any renewal term by written notice at least sixty (60) days before the end of the then-current term; if Axiad does not give such written notice and the Order Form does not state otherwise, Fees for the renewal term increase by seven percent (7%) over the prior term. Renewal Fees are also adjusted to reflect any change in quantities, Users, or other fee-bearing items.

8.2 Termination for Cause. Either party may terminate this Agreement or any affected Order Form on written notice if the other party (a) materially breaches this Agreement and fails to cure the material breach within thirty (30) days after receiving written notice describing the breach in reasonable detail; or (b) becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation, or assignment for the benefit of creditors that is not dismissed within sixty (60) days.

8.3 Early Termination; Acceleration of Committed Fees. (a) If, before expiration of the then-current subscription term of any Order Form, (a) Customer terminates this Agreement (including termination before Customer has begun using the Services) or the applicable Order Form for any reason other than Axiad's uncured material breach under Section 8.2, or (b) Axiad terminates this Agreement or the applicable Order Form due to Customer's uncured material breach under Section 8.2 (each, an "Early Termination"), then all unpaid subscription Fees committed under the terminated Order Form for the remainder of the committed subscription term shall immediately become due and payable by Customer. Customer shall pay such accelerated Fees to Axiad or the applicable Related Party within thirty (30) days following the effective date of the Early Termination, unless the applicable Order Form requires an earlier payment date.

(b) The parties acknowledge that the subscription commitments under each Order Form are non-cancelable under Section 3.1 and that Early Termination does not relieve Customer of its obligation to pay Fees committed for the applicable subscription term. For clarity, the accelerated Fees constitute unpaid committed subscription Fees previously agreed by Customer under the applicable Order Form and are not a penalty. Accelerated Fees shall be reduced by any subscription Fees already paid for the applicable Term and shall not include Taxes that have not been incurred, assessed, or become due.

8.4 Effect of Termination. On expiration or termination of this Agreement or an Order Form: (a) Customer's rights to access and use the Services terminate and Customer shall immediately cease all use, including any Documentation or software provided in connection with the Services; (b) each party shall return or destroy the other party's Confidential Information in its possession, except as retained under clause (d); (c) for thirty (30) days after the effective date of expiration or termination (the "Export Window"), Axiad will, on Customer's written request, make Customer Data available for export in a commonly used format; (d) after the Export Window, Axiad will delete Customer Data in the Services within ninety (90) days, except for deidentified and aggregated data retained under Section 5.7, Customer Data in routine backups (which will be deleted in the ordinary course of Axiad's backup rotation and remains protected under Section 6 and Exhibit 2 until deleted), and Customer Data Axiad is required to retain by law; and (e) if Customer terminated the Agreement or an Order Form for Axiad's uncured material breach, Axiad or the Related Party will refund the pro-rata portion of prepaid Fees for Services not provided after the effective date of termination. Except as stated in this Section 8.4 and Section 8.5, Axiad has no obligation to provide transition services or continued access to any data after termination.

8.5 Transition Assistance. On Customer's written request made before or during the Export Window, Axiad will provide reasonable Professional Services to assist Customer in retrieving Customer Data and transitioning from the Services under an SOW at Axiad's then-current rates.

8.6 Survival. Sections 1, 2.6, 2.7, 3, 4.2 through 4.5, 5 (other than the license in Section 5.1 and Customer's rights under Section 5.8), 6, 7, 8.3 through 8.6, and 9, and any provision of a Product Schedule that by its nature should survive, survive expiration or termination of this Agreement.

9. GENERAL

9.1 Governing Law; Venue. This Agreement is governed by the laws of the State of California, without regard to its conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act do not apply. The parties consent to the exclusive jurisdiction and venue of the state courts located in Santa Clara County, California and the United States District Court for the Northern District of California, and waive any objection to venue or personal jurisdiction in those courts, except that either party may seek preliminary injunctive or other equitable relief in any court of competent jurisdiction. Except for claims relating to payment or to infringement or misuse of a party's intellectual property, no claim under this Agreement may be brought more than one (1) year after the claim accrued.

9.2 Export; Government Use. Each party shall comply with applicable export control and sanctions laws. Customer represents that it and its Users are not located in, or nationals of, a country or territory subject to comprehensive U.S. sanctions, and are not on any U.S. government restricted-party list. If Customer is a U.S. government entity, the Services and Documentation are "commercial computer software" and "commercial computer software documentation" under FAR 12.212 and DFARS 227.7202, and are provided with only those rights granted to all other customers under this Agreement.

9.3 Assignment. Neither party may assign this Agreement or any Order Form without the other party's prior written consent, not to be unreasonably withheld, delayed, or conditioned, except that either party may assign this Agreement or any Order Form in its entirety without consent to an Affiliate or to a successor in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, provided the assignee assumes all obligations under this Agreement and, in the case of an assignment by Customer, the assignee is not a competitor of Axiad. Any attempted assignment in violation of this Section is void. This Agreement binds and benefits the parties and their permitted successors and assigns.

9.4 Severability; Waiver. If any provision of this Agreement or any Order Form is held invalid or unenforceable, it will be construed, limited, or severed to the extent required to eliminate the invalidity, and the remaining provisions remain in full force. A party's failure or delay in exercising any right is not a waiver of it, and a waiver on one occasion is not a waiver on any other. Waivers must be in writing and signed by the waiving party.

9.5 Force Majeure. Neither party is liable for any delay or failure to perform (other than payment obligations) caused by circumstances beyond its reasonable control, including, without limitation, acts of God, acts of government, flood, fire, earthquake, civil unrest, acts of terror, epidemic, pandemic, quarantine, strikes or labor disputes (other than those involving the affected party's own personnel), failures of Internet or telecommunications services or of infrastructure not within the party's control, and denial-of-service attacks. Economic hardship is not a force majeure event. The affected party shall give prompt written notice (email suffices) describing the circumstances and shall use commercially reasonable efforts to resume performance. If a force majeure event prevents Axiad from providing the Services for more than thirty (30) consecutive days, Customer may terminate the affected Order Form on written notice and receive a pro-rata refund of prepaid, unused Fees.

9.6 Relationship of the Parties. The parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary, or employment relationship, and neither party may bind the other or make representations on its behalf.

9.7 Notices. Routine operational communications may be sent by email or through the Services. Notices of breach, termination, indemnification claims, or other legal matters must be in writing, in English, and delivered by nationally recognized overnight courier or by email with confirmation of receipt to the addresses stated in the applicable Order Form (for Axiad, a copy of any written notice must also be sent to: legal@axiad.com) or such other address as a party designates in writing. Notices are effective on receipt.

9.8 Entire Agreement; Order of Precedence. This Agreement, including the Product Schedules, Exhibits, the DPA, and each Order Form and SOW, is the entire agreement between the parties regarding its subject matter and supersedes all prior agreements, proposals, marketing materials, and representations, written or oral, including any prior Axiad Cloud Services Agreement, Axiad Terms of Use, Axiad Mesh Terms of Use, and/or Axiad Confirm addendum, as to Services ordered on or after the Effective Date. Terms in any Customer purchase order or other Customer ordering document are void. In the event of conflict, the following order of precedence applies: (a) the DPA, solely with respect to processing of personal information; (b) the applicable Order Form or SOW, but only where it expressly states that it overrides a specific provision of this Agreement; (c) the applicable Product Schedule; (d) these General Terms; (e) the Exhibits; and (f) the Documentation. There is no presumption against the drafting party, headings are for convenience only, and "including" means "including without limitation."

9.9 Amendment. This Agreement may be amended only by a written instrument signed by authorized representatives of both parties. Axiad may update Exhibit 2 (Information Security) and the sub-processor list from time to time, provided the update does not materially reduce the overall security of the Services during the then-current term.

9.10 Counterparts; Electronic Signatures. This Agreement and any Order Form or SOW may be executed in counterparts, including by electronic signature or exchange of signed PDF copies, each of which is deemed an original and all of which together constitute one instrument.

IN WITNESS WHEREOF, the parties have caused this Agreement to be executed by their duly authorized representatives to be effective as of the Effective Date.

SCHEDULE A: AXIAD CONDUCTOR

This Schedule A applies to Axiad Conductor and forms part of the Agreement when Customer orders Axiad Conductor.

A.1 Service Description. Axiad Conductor is an Axiad-hosted credential management service for issuing, managing, and governing the lifecycle of identity credentials for Users and devices, including public key infrastructure ("PKI") certificates, FIDO2 and passkey authenticators, one-time-password tokens, smart cards and other physical authenticators, and mobile credentials, together with the portals and APIs described below. Conductor is delivered as a dedicated-tenant or multi-tenant service as specified in the Order Form or Documentation.

A.2 Conductor Components. (a) "User Portal" means the Conductor web application through which Users add, view, and manage their identity credentials. (b) "Operator Portal" means the Conductor web application through which Customer's designated IT administrators and operators perform management tasks, including issuing and revoking credentials, troubleshooting, configuring policies, and reviewing audit logs. (c) "Enrollment Service" means the Conductor APIs available for requesting, retrieving, renewing, and revoking PKI credentials and other authenticators. The User Portal, Operator Portal, and Enrollment Service are Covered Services for purposes of Exhibit 1 as described in the Conductor tier of the SLA.

A.3 Customer Environment and Connected Systems. Conductor depends on Customer-operated systems that are Connected Systems under Section 5.4 of the General Terms, which may include Customer's directory service (for example, LDAP or Active Directory), identity provider, certificate authorities, mobile device management, and issuance workstations. Customer is responsible for maintaining the availability, configuration, and service accounts of those systems and for meeting the Customer Requirements in Exhibit 1. Where the deployment requires it, Customer shall establish and maintain a highly available IPsec VPN or other approved connection to the Conductor tenant, with reliable internal networking from the VPN gateway to Customer's directory and issuance workstation subnets (less than 1% packet loss and under 250 ms response time measured from the Conductor VPC), and Internet connectivity with an average round-trip time to the hosting region under 250 ms. Axiad is not responsible for Unavailability or degradation caused by a Connected System or Customer network.

A.4 Certificates and Trust Decisions. Where Conductor issues or manages PKI credentials, Customer is responsible for its own certificate policy and certification practices, for designating the certificate authorities Conductor integrates with, for the content and accuracy of identity attributes submitted for inclusion in credentials, and for all decisions to issue, suspend, or revoke credentials. Axiad acts on Customer's configured policies and instructions and does not act as a certification authority for Customer unless an Order Form expressly provides for an Axiad-hosted certification authority, in which case the additional terms in the Order Form or Documentation apply.

A.5 Hardware. Smart cards, security keys, readers, printers, consumables, and other Hardware identified in an Order Form are subject to Section 4.3 of the General Terms. Customer is responsible for the physical custody, distribution, and lifecycle of Hardware issued to its Users, and for any personalization data Customer causes to be written to Hardware. Lead times, minimum order quantities, and shipping terms for Hardware are as stated in the Order Form.

A.6 Users. For Axiad Conductor, Users are Customer's workforce, including employees, contractors, and other individuals to whom Customer issues credentials, and the devices enrolled by or for them. Conductor is licensed based on the User or credential metric stated in the Order Form.

A.7 Data Retention. For purposes of Section 5.8 of the General Terms, Axiad will retain Customer Data in Axiad Conductor for up to two (2) years during the Term. Axiad will make available to Customer, through the Operator Portal or on written request, audit events generated by the credential management, PKI, and authentication functions of Conductor; Customer is responsible for exporting and retaining audit events required for its own compliance purposes.

A.8 Service Levels. The Conductor tier of Exhibit 1 applies to Axiad Conductor, including its Critical Service and Non-Critical Service commitments.

SCHEDULE B: AXIAD MESH

This Schedule B applies to Axiad Mesh and forms part of the Agreement when Customer orders Axiad Mesh.

B.1 Service Description. Axiad Mesh is an Axiad-hosted, multi-tenant, cloud-based identity risk management platform that correlates identities across Connected Systems, assesses and scores identity and related security risk, tracks and inventories cryptographic and other identity assets, and provides related analysis, reporting, and AI Features, as further described in the Documentation and the applicable Order Form.

B.2 Web Console. "Web Console" means the Axiad Mesh web application through which Users access and operate the Services, including dashboards, administrative interfaces, and the production APIs that Axiad makes generally available as part of Axiad Mesh. The Web Console and production APIs are the Covered Services for the Mesh tier of Exhibit 1.

B.3 Connected Systems and Ingestion. Axiad Mesh operates by ingesting identity attributes, directory and account data, authentication and entitlement data, certificate and cryptographic asset data, and security telemetry from Connected Systems that Customer authorizes under Section 5.4 of the General Terms. Ingestion, synchronization, correlation, and risk-computation pipelines operate asynchronously and are subject to the Data Processing Objectives in Exhibit 1 rather than the availability commitment.

B.4 AI Features and Threat Intelligence. Axiad Mesh includes AI Features, which may include a conversational assistant, automated analysis, and machine-generated recommendations, and incorporates Threat Intelligence Data. Axiad's commitments regarding large language model providers, including PII minimization and no-training and limited-retention requirements, are set out in Section 2 of Exhibit 2. Customer may disable specified AI Features through the Web Console where the Documentation so provides.

B.5 Output. Threat Intelligence Data embedded in Output may be used by Customer solely for its internal business purposes and may not be extracted, republished, or provided to third parties separately from the Output in which it appears.

B.6 Multi-Tenancy. Axiad Mesh is delivered from a shared, multi-tenant environment. Axiad implements logical controls designed to isolate each customer's Customer Data from that of other customers, as described in Exhibit 2.

B.7 Data Retention. For purposes of Section 5.8 of the General Terms, Axiad will retain Customer Data in Axiad Mesh for up to two (2) years during the Term, unless a longer or shorter period is configured by Customer within the Services or specified in the Order Form.

B.8 Service Levels. The Mesh tier of Exhibit 1 applies to Axiad Mesh, including the Data Processing Objectives.

SCHEDULE C: AXIAD CONFIRM

This Schedule C applies to Axiad Confirm and forms part of the Agreement when Customer orders Axiad Confirm.

C.1 Service Description. Axiad Confirm is an Axiad-hosted identity verification service that Customer may use to verify the identity of a User at enrollment, credential recovery, help-desk interaction, or other points that Customer configures, which may include verification of government-issued identity documents, biometric facial comparison and liveness detection, and related risk signals (each such process, a "Verification"). Axiad Confirm may be delivered through Third Party Service providers as identified in the Documentation and the sub-processor list.

C.2 Users and End Users. For Axiad Confirm, Users include the individuals whose identities Customer verifies through the Services, which may include Customer's employees and contractors and, where the Order Form so provides, Customer's own customers and other end users ("End Users"). Customer is responsible for End Users' interactions with the Services and for all obligations to End Users described in this Schedule.

C.3 Biometric and Personal Information; Notices and Consents. Customer acknowledges that a Verification may involve the collection and processing of biometric identifiers and biometric information (including facial geometry and liveness data), images of identity documents, and other personal information of Users (collectively, "Verification Data"). Notwithstanding Section 5.3 of the General Terms, Customer may submit Verification Data to Axiad Confirm solely for the purpose of performing Verifications. Before any User undergoes a Verification, Customer shall, at its own expense, provide all notices and obtain all consents, authorizations, and written releases required by applicable law, including biometric information privacy laws (such as the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and Washington's biometric privacy law), consumer privacy laws, and any other law governing the collection, processing, retention, or destruction of Verification Data. Such notices shall disclose, to the extent required by law, that Verification Data is collected, the purpose of collection, the retention period and destruction schedule applicable under Section C.6, and that Axiad and its Third Party Service providers process Verification Data on Customer's behalf. Customer shall maintain a publicly available retention and destruction policy for biometric data where required by applicable law and shall provide Axiad with copies of its notices and consent records on reasonable request. Customer represents and warrants that it has obtained, and will maintain during the Term, all such notices, consents, and releases, and Customer's indemnity under Section 7.2(c) of the General Terms applies to any breach of this Section C.3.

C.4 Flow-Down to Customer's Own Customers. Where Customer makes Axiad Confirm available to End Users under an agreement between Customer and its own customers, Customer shall ensure that each such agreement (a) permits Axiad and its Third Party Service providers and sub-processors to collect, use, reproduce, transmit, and process Verification Data as necessary to perform Verifications and otherwise provide, secure, and support the Services; (b) permits Axiad to create and use deidentified and aggregated data in accordance with Section 5.7 of the General Terms; and (c) permits Axiad and its Third Party Service providers to use Verification Data to detect, investigate, and prevent fraudulent, abusive, or illegal activity, including by maintaining fraud signals that do not identify an individual beyond what is necessary for that purpose.

C.5 Use Restrictions. Customer shall (a) use each Verification result only for the User and the session for which it was requested, and shall not reuse a Verification result to authenticate a different User or a different session; (b) not store, compile, or develop a database of Verification results, Verification Data, or biometric templates for any purpose other than maintaining historical records of Verification outcomes as required for Customer's audit and compliance purposes; (c) not use Axiad Confirm, or any Output from it, to make decisions in a manner that unlawfully discriminates against any individual; and (d) not use Axiad Confirm for any purpose for which the Documentation states it is not intended, including law-enforcement identification or surveillance of individuals who have not initiated a Verification.

C.6 Retention and Destruction of Verification Data. Axiad will retain biometric identifiers, biometric templates, and identity document images only for as long as necessary to complete the Verification and any related fraud review and, in any event, will permanently destroy them within thirty (30) days after the Verification is completed, or sooner if required by applicable law or configured by Customer within the Services. Verification results and associated non-biometric Output are Customer Data and are retained for up to one (1) year during the Term for purposes of Section 5.8 of the General Terms. Axiad will destroy Verification Data using methods designed to render it unrecoverable and will require its Third Party Service providers to do the same.

C.7 Roles of the Parties. Verification Data is Personal Data under the DPA, and Axiad's processor commitments for biometric data are set out in Section 3.5 of the DPA.

C.8 Verification Results Are Not Guarantees. A Verification result is Output subject to Section 4.2 of the General Terms. It is a risk signal and does not guarantee that a User is who they claim to be, that an identity document is genuine, or that a transaction is not fraudulent. Customer is responsible for determining the level of assurance appropriate for each use case, for configuring Verification thresholds accordingly, and for providing any human review or appeal process required by applicable law where a Verification result is used to deny an individual access, employment, or a service.

C.9 Service Levels. The Confirm tier of Exhibit 1 applies to Axiad Confirm. Verification completion times depend on Third Party Service providers and on the User's device and network and are not subject to Service Credits.

EXHIBIT 1: SERVICE LEVEL AGREEMENT

1. Introduction

This Service Level Agreement ("SLA") governs the availability of the Services under the Agreement. Capitalized terms not defined in this SLA have the meanings given in the Agreement. Axiad may update this SLA only in accordance with Section 9.9 of the Agreement, and no update will materially reduce the Service Commitment or Service Credits applicable to Customer during a then-current subscription term. Availability is measured using Axiad's monitoring systems, which are the system of record for this SLA.

2. Definitions

2.1 "Covered Services" means the generally available production components of each Service identified in the Service Commitment table in Section 3, and excludes the Excluded Components.

2.2 "Excluded Components" means (a) data ingestion, synchronization, and processing pipelines, including connectors to Connected Systems and scheduled analytics, correlation, and risk-computation jobs (addressed for Axiad Mesh by the Data Processing Objectives in Section 4); (b) AI Features and Verifications, to the extent their operation depends on the availability of a Third Party Service, model, or inference provider; (c) alpha, beta, preview, early-access, evaluation, or similar pre-release features identified as such; (d) free, trial, proof-of-concept, sandbox, or other non-production tenants or environments; and (e) Hardware and Customer-operated systems.

2.3 "Monthly Uptime Percentage" means, for a Covered Service in a calendar month, the total number of minutes in the month minus the minutes of Unavailability of that Covered Service, divided by the total number of minutes in the month, expressed as a percentage. Monthly Uptime Percentage excludes downtime resulting directly or indirectly from an SLA Exclusion.

2.4 "Unavailability" means one or more full minutes during which a Covered Service is not accessible to, or returns persistent server errors for, Customer's Users, for reasons within Axiad's reasonable control, as measured by Axiad's monitoring systems.

2.5 "Service Credit" means a credit, calculated under Section 5, that Axiad applies against future Fees otherwise due from Customer.

3. Service Commitment

During the Term, Axiad will use commercially reasonable efforts to make each Covered Service available with at least the Monthly Uptime Percentage stated below (each, a "Service Commitment"):

If a Covered Service does not meet its Service Commitment in a calendar month, Customer is eligible for a Service Credit under Section 5.

4. Data Processing Objectives (Axiad Mesh)

Because data collection and analysis in Axiad Mesh operate asynchronously, interruptions to ingestion and processing do not prevent access to the Web Console and, therefore, do not constitute Unavailability. Axiad will instead use commercially reasonable efforts to meet the following objectives (the "Data Processing Objectives"): (a) data successfully ingested from a Connected System will be reflected in the applicable dashboards, inventories, and risk analyses within twenty-four (24) hours of ingestion; and (b) following any interruption of a connector or processing pipeline attributable to Axiad, ingestion will resume automatically or be restored by Axiad within twenty-four (24) hours, resuming from the most recent checkpoint without a full re-collection where technically feasible. The Data Processing Objectives are operational targets only; they are not subject to Service Credits and failure to meet any of them is not a breach of the Agreement, provided that Axiad will treat persistent failures as support matters under its standard support practices.

5. Service Credits

Service Credits are calculated as a percentage of the Fees paid by Customer for one month of the affected Service under the applicable Order Form (that is, one-twelfth of the annual Fees for that Service), excluding one-time fees, Professional Services, Hardware, and Taxes:

Service Credits are applied only against future Fees for the affected Service, do not entitle Customer to a refund or other payment, may not exceed in aggregate twenty-five percent (25%) of one month's Fees for the affected Service in any calendar month, and are not transferable to any other account or agreement. If the Order Form has expired or been terminated and no future Fees are due, Axiad will pay the Service Credit to Customer within sixty (60) days. Service Credits are Customer's sole and exclusive remedy for any failure to meet a Service Commitment or any other obligation under this SLA, and under no circumstance is a failure to meet a Service Commitment or any other obligation under this SLA deemed a default or breach of the Agreement or any Order Form.

6. Credit Request Procedure

To receive a Service Credit, Customer must open a case with Axiad Support at support@axiad.com within thirty (30) days after the end of the calendar month in which the Service Commitment was not met. The request must include "SLA Credit Request" in the subject line, the dates and times of each period of claimed Unavailability, and the affected Service and components. Axiad will validate each request against its monitoring systems. Customer is not required to submit logs; if Customer elects to provide logs or screenshots, Customer must first remove all confidential information, personal information, keys, and credentials, and Axiad may reject and delete any submission that contains such information. If Axiad confirms the Service Commitment was not met, Axiad will issue the Service Credit within one billing cycle after confirmation. Requests received after the thirty-day deadline or lacking the required information are not eligible.

7. Maintenance

7.1 Approach. Axiad deploys new features, updates, and fixes using practices designed to avoid downtime. Axiad Mesh does not have recurring scheduled maintenance windows. Axiad Conductor uses a weekly maintenance window as published in the Documentation (currently weekly between 6:00 PM and 12:00 AM Pacific Time), during which Axiad targets less than fifteen (15) minutes of downtime per window.

7.2 Planned Maintenance. If Axiad determines that maintenance is reasonably expected to cause downtime or materially affect Service functionality outside a published window, Axiad will (a) notify Customer's designated contacts by email at least ten (10) business days in advance where practicable; (b) schedule the maintenance outside peak usage hours where practicable; and (c) limit downtime to the shortest duration reasonably practical under the circumstances ("Planned Maintenance"). Downtime during published maintenance windows and Planned Maintenance is excluded from Unavailability up to a combined maximum of eight (8) hours per calendar month per Service; downtime in excess of that amount counts as Unavailability.

7.3 Emergency Maintenance. Where emergency maintenance is necessary to address a security vulnerability or protect the integrity of the Services, Axiad will make commercially reasonable efforts to notify Customer in advance ("Emergency Maintenance"). Downtime during Emergency Maintenance is excluded from Unavailability.

8. Customer Requirements

The Service Commitment is conditioned on Customer: (a) using a reliable Internet connection to access the Services; (b) maintaining the availability and correct configuration of any identity provider or single sign-on service Customer uses to authenticate its Users; (c) maintaining accurate administrative and technical contact information so Axiad can deliver maintenance and incident notifications; and (d) meeting the product-specific requirements in the applicable Product Schedule, including Customer's obligations for Connected Systems, directory services, and network connectivity (Schedules A.3 and B.3) and for Verification integration (Schedule C) (together, the "Customer Requirements").

9. SLA Exclusions

The Service Commitment does not apply to any Unavailability, suspension, degradation, or downtime arising from (collectively, the "SLA Exclusions"): (a) suspension or termination of the Services in accordance with the Agreement; (b) a force majeure event under Section 9.5 of the Agreement, or an outage of the underlying cloud infrastructure provider or Internet beyond the demarcation point of the Axiad Infrastructure; (c) any unavailability, throttling, rate limiting, misconfiguration, credential expiration or revocation, API change, or other act or omission of a Connected System or its provider, or Customer's failure to meet the Customer Requirements; (d) any act or omission of Customer, its Users, or any third party acting at Customer's direction, including use of the Services in an unauthorized or unlawful manner; (e) Customer's equipment, software, network, or other technology, or third-party technology not provided by Axiad; (f) published maintenance windows (within the monthly cap), Planned Maintenance (within the monthly cap), or Emergency Maintenance; (g) any Excluded Component, including unavailability of an AI Feature or Verification to the extent caused by a Third Party Service, model, or inference provider; and (h) any period during which Customer's account is in arrears. If availability is affected by factors other than those used in the Monthly Uptime Percentage calculation, Axiad may issue a Service Credit at its sole discretion.

EXHIBIT 2: INFORMATION SECURITY

This Exhibit 2 states the technical and organizational security measures Axiad maintains for the Services and constitutes the Security Measures referenced in Schedule 2 of the DPA. Axiad may update these measures from time to time, provided no update materially reduces the overall security of the Services during a then-current subscription term.

1. Data Hosting

The Services are hosted in Amazon Web Services ("AWS") and Microsoft Azure data centers located in the United States.

Axiad Conductor and Axiad Confirm are hosted in the AWS US East (Northern Virginia) region unless the Order Form specifies a different region.

Axiad Mesh is hosted in Azure and AWS regions in the United States. Backup copies may be stored in any region within the United States. Axiad will not transfer Customer Data outside the United States without Customer's prior written consent, except as required to perform Verifications through Third Party Service providers identified in the sub-processor list, or as otherwise agreed in the DPA.

AWS and Azure data centers maintain SOC 1, SOC 2, and SOC 3 reports and ISO/IEC 27001 certification.

2. Sub-processors and Third Party Services

Axiad engages sub-processors and Third Party Service providers to provide the Services, including cloud hosting, in-memory data stores, message streaming, threat intelligence, identity verification, and large language model processing providers. Axiad imposes on each sub-processor data-protection and security obligations that are materially as protective as those in this Exhibit and the DPA. Where AI Features process Customer Data, Axiad implements measures designed to minimize personal information transmitted to any large language model provider (including filtering and tokenization prior to transmission), and contractually requires such providers not to use Customer Data, prompts, or outputs to train, fine-tune, or otherwise improve any artificial-intelligence or machine-learning model, and not to retain them beyond the period necessary to return the applicable output; embeddings, vector indexes, and other derived representations are subject to the same restriction. The Sub-processor List, and Customer's notice and objection rights, are governed by Section 4 of the DPA.

3. Security Program

Axiad maintains a documented information security program, aligned to ISO/IEC 27001 and 27002 and the SOC 2 Trust Services Criteria, that is reviewed at least annually, communicated to personnel, and assigns an accountable owner for each security domain it covers. Axiad maintains third-party audit reports, certifications, and attestations for the Services, which include SOC 2, ISO/IEC 27001, and, for the Axiad offering in scope, FedRAMP. Axiad will provide the then-current reports and certificates to Customer on request and under confidentiality, and publishes their current status at https://engage.axiad.com/trust.

4. Security Organization and Personnel

4.1 Security Officer. Axiad designates a security officer responsible for compliance with the security rules applicable to the Services and for serving as Customer's point of contact for security matters. Axiad's security officer can be reached at security_officer@axiad.com.

4.2 Personnel. Subject to applicable law, Axiad conducts background checks on employees with access to Customer Data or Customer Confidential Information. Additionally, Axiad personnel are bound by written confidentiality obligations, receive security and privacy awareness training on hire and at least annually, and are subject to disciplinary process for policy violations.

4.3 Asset Management. Axiad maintains an inventory of the systems and media that store or process Customer Data, reviews it periodically, investigates discrepancies, and treats any discrepancy attributable to loss or theft of equipment as a security incident. Axiad will inform Customer of any material discrepancy affecting Customer Data.

5. Access Control

Axiad limits physical and logical access to systems used to provide the Services to personnel and subcontractors who need access to perform the Services, using documented access-management procedures based on need-to-know and least-privilege principles. Access is provisioned through individual accounts, requires multi-factor authentication for administrative and production access, is reviewed at least quarterly, and is adjusted or revoked promptly on change of duties or termination. Axiad separates incompatible duties or, where separation is not practicable, implements compensating controls such as regular review of activity logs. For multi-tenant Services, Axiad implements logical controls designed to isolate each customer's Customer Data from that of other customers. Connected System credentials stored by the Services are encrypted at rest and access to them is restricted and logged.

6. Encryption

Customer Data is encrypted in transit over public networks using TLS 1.2 or higher, and at rest using AES-256 or an equivalent industry-standard algorithm. Cryptographic keys are managed through a hardware-backed key management service with restricted access and periodic rotation. Private keys and other secrets the Services manage on Customer's behalf are protected using hardware security modules or equivalent controls.

7. Logging and Monitoring

Axiad logs security-relevant events on the systems used to provide the Services, including access to the logs themselves, retains security logs for at least twelve (12) months, and monitors logs, systems, and infrastructure to detect anomalies and enable rapid response. Reported events are handled under Axiad's information security incident management procedure.

8. Vulnerability and Patch Management

8.1 Vulnerability Management. Axiad maintains a vulnerability management procedure covering detection, severity-based triage, remediation, and follow-up across the systems and applications used to provide the Services. Externally facing production, development, and test systems and candidate build images are scanned regularly, and application interfaces are tested periodically by Axiad or its upstream technology providers. If a vulnerability affecting the Services is classified as critical, Axiad will notify Customer and take remedial action as quickly as practicable under the circumstances.

8.2 Security Patches. Axiad keeps the systems used to provide the Services current with manufacturer-recommended security patches, tested and deployed under a change management procedure. Critical-severity patches are addressed promptly, high-severity patches are installed within seven (7) days of release unless Customer agrees otherwise, and other patches are applied in the regular maintenance cycle.

8.3 Penetration Testing. Axiad engages an independent third party to perform penetration testing of the Services at least annually and after significant changes to the technical environment, and remediates findings based on severity. An executive summary of the most recent test is available upon written request and constitutes Axiad Confidential Information.

9. Malware Protection

Axiad implements prevention, detection, and recovery measures designed to protect against malware, including anti-malware software with regularly updated signatures on the Axiad systems used to process Customer Data.

10. Data Transmission

Where Axiad transmits Customer Data to or from external networks, including subcontractor networks, Customer's network, and the networks of Connected Systems and Third Party Service providers, Axiad implements procedures designed to protect the transmission against interception, copying, modification, re-routing, and destruction. Documentation of external data flows is available upon written request.

11. Business Continuity and Backup

Axiad maintains business continuity and disaster recovery plans for the Services that are tested at least annually. Customer Data is backed up at least daily and backups are encrypted and stored in a geographically separate AWS availability zone or region within the United States. Upon written request, Axiad will make its then-current recovery point and recovery time objectives available to Customer.

12. Security Incidents

Axiad will notify Customer without undue delay, and in any event within seventy-two (72) hours, after Axiad confirms a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data (a "Security Incident"). The notice will include the information reasonably available to Axiad at the time, including the nature of the incident, the categories and approximate volume of Customer Data affected, the measures taken or proposed, and a point of contact, and Axiad will supplement the notice as further information becomes available. Axiad will promptly investigate, mitigate, and remediate the Security Incident and implement measures to prevent recurrence. Axiad's notification is not an acknowledgment of fault or liability. Section 6 of the DPA adds obligations specific to personal information. Unsuccessful attempts or activities that do not compromise the security of Customer Data (such as blocked port scans, failed login attempts, or denial-of-service attacks that do not result in unauthorized access) are not Security Incidents.

13. Customer Audit and Assurance

Axiad will make available to Customer, upon written request and subject to Customer’s confidentiality obligations, information reasonably necessary to demonstrate compliance with this Exhibit, which Axiad may satisfy by providing then-current third-party audit reports, certifications, penetration test summaries, and responses to reasonable written security questionnaires (not more than once per year). If those materials are insufficient to satisfy a requirement of applicable law or a regulator with authority over Customer, Customer (or an independent auditor bound by a written confidentiality agreement signed by such auditor and Axiad) may conduct an audit of Axiad's controls relevant to the Services no more than once in any twelve (12) month period, on at least fifteen (15) business days' written notice, during Axiad's normal business hours, at Customer's expense, and in a manner that does not unreasonably interfere with Axiad's operations. Customer will not be given access to information of any other Axiad customer or to systems and facilities not used to provide the Services. Axiad will take commercially reasonable efforts to remediate material and adverse audit findings within a reasonable time.

14. Customer Security Responsibilities

Security of the Services is shared. Customer is responsible for the security of its own networks, devices, and Connected Systems; for configuring the Services (including authentication, role-based access, and data-retention settings) in accordance with the Documentation and its own requirements; for protecting the credentials it and its Users use to access the Services; and for promptly reporting suspected security issues to security_officer@axiad.com.