Master Subscription Agreement

This Master Subscription Agreement (this “Agreement”) contains terms and conditions that govern your purchase of subscriptions to, and use of, the Services (as defined below), and is a contract between Kuberno Solutions Inc., a Delaware corporation (“KubernoGRC”), and the entity identified in the applicable Order (“Customer,” and together with KubernoGRC, the “Parties,” and each, a “Party”).

This Agreement becomes binding and effective on Customer upon the earliest of: (1) when Customer accesses or uses the Services, (2) when Customer clicks an “I Accept,” “Sign up” or similar button or check box referencing this Agreement, or (3) when Customer enters into an Order (as defined below) with KubernoGRC.

Capitalized terms not otherwise defined in this Agreement will have the respective meanings assigned to them in the Definitions section below.

Definitions

“Account Data” means information about Customer provided to KubernoGRC for account creation or administration, such as name, username, and email address of Authorized Users or billing contacts.

“Affiliate” means a business entity that directly or indirectly controls, is controlled by, or is under common control with a Party. For purposes of this definition, “control” means (a) ownership of more than 50% of voting securities or other equity interests of an entity, (b) the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract, or otherwise, or (c) the right to appoint or elect a majority of the board of directors or equivalent governing body of an entity.

“AI Customer Input” means any data, text, documents, queries, prompts, instructions, or other content or materials submitted or uploaded by Customer or its Authorized Users to the AI Features for processing, analysis, or generation of AI Customer Output.

“AI Customer Output” means any text, analysis, recommendations, reports, or other content or materials generated or produced by the AI Features in response to AI Customer Input.

“AI Features” means the artificial intelligence and machine learning-enabled capabilities, tools, and functionality made available by KubernoGRC as part of the Services, as further described in an applicable Order. Third-party providers engaged by KubernoGRC to power the AI Features are subprocessors under the DPA and are subject to the subprocessor notification obligations therein.

“AI Technology” means any software, system, algorithm, or model that employs machine learning, generative AI, natural language processing, or other artificial intelligence techniques to generate, analyze, classify, synthesize, or otherwise process inputs or produce outputs.

“API” means an application programming interface referenced in the Documentation that KubernoGRC maintains and makes available to Customer in connection with the Services.

“Applicable Laws” means all governmental laws, rules, directives, regulations, or orders applicable to a Party’s performance under this Agreement.

“AUP” means KubernoGRC’s Acceptable Use Policy, which includes KubernoGRC’s standards for AI feature acceptable use.

“Authorized User” means an individual employee, agent or contractor of Customer or an Affiliate for whom subscriptions to Services have been purchased and who has user credentials for the Services.

“Availability” means the Services being accessible for use by end users over the internet, measured in minutes per calendar month at the point of delivery by KubernoGRC’s hosting provider.

“Connection” means an integration or connection configured by Customer within the Services to enable data exchange via APIs or other means; such configurations do not grant KubernoGRC general access to Customer’s environment beyond the scope expressly configured by Customer.

“Customer Data” means data from Customer’s Environment submitted for Processing by the Services, including policies, risk registers, control documentation, assessment responses, audit workpapers, issues/incidents, regulatory obligations, and related workflow artifacts.

“Customer Environment” means systems, platforms, services, software, devices, sites and/or networks used internally by Customer to generate data used by the Services.

“Data Protection Laws” means all applicable laws and regulations relating to the processing, privacy, and security of Personal Information, including without limitation: the California Consumer Privacy Act (CCPA) as amended by CPRA; Virginia CDPA; Colorado CPA; Connecticut CTDPA; Texas TDPSA; and all other applicable US state privacy laws.

“Documentation” means the technical documentation, user manuals, and usage guides provided by KubernoGRC and expressly designated as applicable to the Services.

“Exceptions” means (a) Customer’s breach; (b) Customer’s failure to configure/use Services per Documentation; (c) failures/issues with Customer’s Environment; (d) Force Majeure; (e) suspensions per §8.c; or (f) maintenance windows with prior notice.

“Feedback” means bug reports, suggestions, or other feedback with respect to the Services or Documentation provided by Customer to KubernoGRC, exclusive of Customer Confidential Information.

“Fees” means charges for use of Services per this Agreement and applicable Orders, comprised of subscription amounts and any professional services stated in an Order.

“Force Majeure Event” means act of God; flood, fire, explosion; war, terrorism, invasion, riot, civil unrest; embargoes or blockades; national/regional emergency; pandemic; government mandated shutdowns.

“Intellectual Property Rights” means registered and unregistered rights under patent, copyright, trademark, trade secret, database protection, or similar laws worldwide.

“Malicious Code” means viruses, worms, Trojan horses, ransomware, spyware, time bombs, or other malicious, harmful, or disabling code, files, scripts, or agents.

“Order” means an order for Services submitted online and accepted by KubernoGRC or executed by both Parties.

“Order Term” means the initial subscription term specified in an Order and all Renewal Order Terms; if none specified, 12 months with auto-renewal unless terminated per this Agreement.

“Ordinary Course Providers” means third-party providers supporting provision of the Services and Support in the ordinary course of business (not specifically for Customer).

“Person” means any natural person, corporation, limited liability company, partnership, trust, governmental authority, or other legal entity.

“Personal Information” means information relating to an identified or identifiable natural person protected by Applicable Laws.

“Privacy Policy” means KubernoGRC’s Privacy Policy.

“Process” means perform operations on data, content, or information, including submission, transmission, storage, adaptation or alteration; “Processing” has a correlative meaning.

“Pro-Rated Refund” means refund of a pro rata share of unused amounts prepaid by Customer based on the remaining portion of the current Order Term or Renewal Order Term.

“Renewal Order Term” means renewal of an Order for the same duration as the expiring term.

“Service Plan” means packaged plan and associated features as detailed in the Orders.

“Services” means KubernoGRC’s hosted governance, risk and compliance (GRC) platform (policy management, risk assessments, control testing, audit and issue management, obligations mapping, workflow/approvals, dashboards/reporting, integrations), Support, and any professional services described in an Order.

“Support” means KubernoGRC’s standard customer support for the Services.

“Usage Data” means information about Customer’s configuration and use of the Services (e.g., utilization, telemetry, performance, interaction metrics) used to operate, maintain, secure, and improve the Services and provide Customer with adoption and effectiveness insights; Usage Data does not include Personal Information and will not permit reconstruction of Customer Data.

1. Orders

Customer may access and use the Services in connection with one or more Orders. Subject to the terms of an Order, the Services support Customer’s GRC workflows, including collection, documentation, monitoring, management, and analysis of GRC-related data generated by Customer’s Environment.

2. Access and Use

a. Grant of Access. Subject to the applicable Order and this Agreement, KubernoGRC grants Customer the right to access and use the Services in accordance with the Documentation during the Order Term for Customer’s Environment.

b. Scope of Access.

c. Customer Instructions and Control.

d. Limitations. The rights granted under this Section 2 are limited, nonexclusive, and, except as otherwise provided in this Agreement, non-transferable.

3. Availability

KubernoGRC commits to make the Services Available at least 99.9% of the time, exclusive of Exceptions (the “Availability Standard”). Fee Credit Schedule. If Availability falls below the Availability Standard in any calendar month (excluding Exceptions), Customer may request a fee credit applied to the next invoice: (a) 99.0%–99.9%: 10% of monthly fees for the affected month; (b) 95.0%–99.89%: 20% of monthly fees; (c) below 95.0%: 30% of monthly fees. Credits are Customer’s sole and exclusive remedy for Availability failures, except that if Availability falls below 95.0% for three consecutive calendar months, Customer may also terminate the affected Order and request a pro-rated refund. Credit requests must be submitted to support@kubernogrc.com within 30 days after the end of the affected calendar month.

4. Support

During the subscription term, KubernoGRC will provide Support as described in Order form and then current support processes. KubernoGRC provides support Monday – Friday, excluding company holidays: New Years Day, Memorial Day, Independence Day, Labor Day, Thanksgiving Day, Friday after Thanksgiving, Christmas Eve, and Christmas Day (each a “Business Day”), during the hours of 8:00am – 5:00pm CST (“Support Hours” or “Business Hours”). Customers may contact support@kubernogrc.com. If at any time the Customer feels the support service is not progressing acceptably, the Customer may escalate through its designated Account Manager.

5. APIs

APIs may be provided to assist with access to certain data collected and processed by KubernoGRC. Customer determines which APIs to use and agrees to use them per Documentation.

6. Hosting and Other Providers

KubernoGRC may use Ordinary Course Providers and Affiliates to support provision of the Services and Support (including cloud hosting providers). KubernoGRC remains responsible for provision and for actions/omissions of its Ordinary Course Providers to the same extent as if performed directly.

7. Security and Privacy

a. Security Program & Exhibit. KubernoGRC employs administrative, physical, and technical measures aligned with industry practice to protect the Services. A summary of controls is set forth in the Security Exhibit (“Security Exhibit”). KubernoGRC may update the Security Exhibit to reflect improvements to security controls, provided updates do not materially reduce protections for Customer Data.

b. Usage Data. KubernoGRC may Process Usage Data—such as configuration metadata, performance and availability metrics, feature utilization statistics, and interaction telemetry (e.g., logins, page views, workflow counts)—to operate, maintain, secure, and improve the Services, to address Support Requests, and to provide Customer insights and recommendations. Usage Data will not include Customer Data in identifiable form and will not permit reconstruction of Customer Data. KubernoGRC may aggregate and anonymize Usage Data to develop new services and features and to promote KubernoGRC’s services, subject at all times to KubernoGRC’s security, confidentiality, and privacy obligations.

c. Incident Notification. In the event of a confirmed Security Incident involving unauthorized access to Customer Data under KubernoGRC’s control, KubernoGRC will notify Customer without undue delay and, where Personal Information is implicated, no later than seventy-two (72) hours after confirmation. Such notification will include information reasonably available at the time of notice. Thereafter, KubernoGRC will provide Customer with material updates regarding the investigation at reasonable intervals, until the Security Incident has been resolved or remediated.

d. Data Processing Addendum (DPA). To the extent Customer provides KubernoGRC with personal data subject to applicable data protection laws, Customer represents that it has a lawful basis for such disclosure, has provided all required notices to data subjects, and the Parties shall execute a separate Data Processing Agreement (“DPA”) if required by applicable law. In case of conflict between this Agreement and the DPA for processing of personal information, the DPA controls.

e. AI Data Use & Model Training. KubernoGRC will not use Customer Data or AI Customer Input to train AI Technology models made available to other customers. KubernoGRC may use Usage Data and AI Customer Outputs in aggregated or de-identified form that does not identify Customer or any User to operate, support, improve, and develop the AI Features and the Services.

f. AI Output Ownership. As between the Parties, Customer owns all AI Customer Output generated through Customer’s authorized use of the AI Features. KubernoGRC’s rights to use AI Customer Output are limited to: (i) providing the Services to Customer; and (ii) as otherwise set forth in this Agreement. KubernoGRC acquires no ownership interest in AI Customer Output.

g. AI Providers as Subprocessors. Third-party AI providers engaged by KubernoGRC to power or operate the AI Features are subprocessors for purposes of the DPA and are subject to KubernoGRC’s obligations to Customer under the DPA, including subprocessor notification requirements. KubernoGRC maintains a current list of AI providers at the Subprocessors List.

8. Customer Responsibilities and Restrictions

a. Customer Responsibilities. Customer is responsible for, and KubernoGRC shall have no liability with respect to:

b. Use Restrictions. Customer shall not, and shall not permit any Authorized User or other third party to:

c. Investigation and Suspension. KubernoGRC may investigate any actual, suspected, or threatened violation of this Agreement, the Documentation, or the AUP, including any unauthorized access to or use of the Services. In connection with any such investigation or where otherwise reasonably necessary to protect the Services, KubernoGRC’s other customers, or any third party, KubernoGRC may suspend the access of any affected Authorized User or, if reasonably necessary, Customer’s access to the Services, in whole or in part. KubernoGRC shall use commercially reasonable efforts to provide Customer with advance written notice of any such suspension (a “Suspension Notice”) and to limit the scope and duration of the suspension to what is reasonably necessary to address the underlying issue; provided that KubernoGRC may suspend access without prior notice in the case of (i) willful misconduct by Customer or any Authorized User, (ii) a material breach of Section 8(b) (Use Restrictions) or the AUP, (iii) a security incident, threat, or vulnerability requiring immediate action to protect the Services, KubernoGRC’s other customers, or any third party, or (iv) any suspension required to comply with Applicable Law or a governmental order. KubernoGRC shall promptly restore access once the underlying issue has been resolved to KubernoGRC’s reasonable satisfaction. Suspension under this Section shall not relieve Customer of its obligation to pay Fees during the suspension period, except to the extent the suspension results from KubernoGRC’s breach of this Agreement.

9. Compliance with Applicable Laws

a. General Compliance. Each Party shall comply with all laws, statutes, regulations, rules, and governmental orders applicable to its performance under this Agreement (“Applicable Laws”), including those relating to data protection and privacy, anti-bribery and anti-corruption, and export controls and economic sanctions.

b. Anti-Bribery and Anti-Corruption. Each Party represents, warrants, and covenants that it has not and will not, directly or indirectly, offer, promise, give, or authorize the giving of anything of value to any government official, political party, political candidate, or any other person for the purpose of improperly obtaining or retaining business or securing any improper advantage in connection with this Agreement, in violation of the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act 2010, or any other applicable anti-bribery or anti-corruption laws.

c. Export Controls. The Services, including any documentation, and any related technical data included with, or contained in, the Services (collectively, “Regulated Product”) may be subject to U.S. or foreign export control laws and regulations, including the Export Administration Regulations. Customer shall not directly or indirectly, export, re-export, or release any Regulated Product to any jurisdiction or country to which, or any party to whom, the export, re-export, or release of any Regulated Product is prohibited by applicable U.S. or foreign law, regulation, or rule.

d. Sanctions Representations. Customer represents and warrants that neither Customer nor any of its Affiliates, directors, officers, employees, or, to Customer’s knowledge, any person acting on Customer’s behalf is (i) identified on any list of sanctioned or restricted persons maintained by OFAC, the U.S. Department of State, the U.S. Department of Commerce, the United Nations Security Council, the European Union, the United Kingdom, or any other applicable governmental authority; (ii) owned or controlled by, or acting on behalf of, any such sanctioned or restricted person; or (iii) located, organized, or resident in a jurisdiction subject to comprehensive economic sanctions (each, a “Sanctions Target”). Customer shall promptly notify KubernoGRC in writing if Customer becomes, or has reason to believe it will become, a Sanctions Target during the term of this Agreement.

e. Remedy. Notwithstanding anything to the contrary in this Agreement, KubernoGRC may suspend or terminate this Agreement and any Order immediately upon written notice if KubernoGRC reasonably determines that Customer has breached this Section or that continued performance would cause KubernoGRC to violate any Applicable Law.

10. Pricing and Fees

a. Fees. Customer shall pay KubernoGRC all Fees set forth in the applicable Order in accordance with the payment terms specified therein. All Fees are stated and payable in United States dollars and are non-cancelable and non-refundable except as expressly set forth in this Agreement. Unless otherwise specified in the Order, invoices are due and payable within fifteen (15) days of the invoice date.

b. Late Payments. Any amount not paid when due shall accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law, calculated on a simple interest basis from the date such amount was due until paid in full.

c. Fee Disputes. Customer must notify KubernoGRC in writing of any good-faith dispute regarding an invoice within ten (10) days of the date of the disputed invoice, specifying in reasonable detail the nature and basis of the dispute. Any amounts not disputed within such period shall be deemed accepted and due. The Parties shall work together in good faith to resolve any disputed amounts promptly. KubernoGRC shall not suspend or terminate the Services, and shall not exercise any other remedies based on non-payment, with respect to disputed amounts while the Parties are cooperating in good faith to resolve the dispute; provided, however, that Customer shall timely pay all undisputed amounts in accordance with this Section.

d. Credit Cards. If Customer is paying Fees using a credit card or supported digital payment method, Customer authorizes KubernoGRC to charge Customer’s account and must keep billing information current. KubernoGRC uses a third-party intermediary to manage credit card processing, which is not permitted to use Customer’s credit card information except in connection with authorized purchases. Customer shall be responsible for any fees, costs, or charges incurred by KubernoGRC as a result of Customer’s failure to maintain current and accurate billing information, including but not limited to returned payment fees, reprocessing costs, and any reasonable collection costs associated with recovering amounts that could not be collected due to outdated or invalid payment information.

11. Taxes

Customer is responsible for any sales, use, value-added, withholding or similar taxes or levies that apply to the Fees, whether domestic or foreign. Fees and expenses are exclusive of taxes. If KubernoGRC is required by applicable law to collect or remit Taxes for which Customer is responsible, KubernoGRC may invoice Customer for such amounts, and Customer shall pay such amounts unless it provides a valid exemption certificate from the appropriate taxing authority.

12. Ownership

a. KubernoGRC IP. Customer acknowledges that, as between Customer and KubernoGRC, KubernoGRC owns all right, title, and interest, including all intellectual property rights, in and to the Services, the Documentation, and Feedback.

b. Customer Environment and Customer Data. KubernoGRC acknowledges that, as between KubernoGRC and Customer, Customer owns all right, title, and interest, including all intellectual property rights, in and to the Customer Environment and the Customer Data. Customer hereby grants to KubernoGRC a non-exclusive, royalty-free, worldwide license to reproduce, distribute, and otherwise use and display the Customer Environment and the Customer Data and perform all acts with respect to the Customer Environment and the Customer Data as may be necessary for KubernoGRC to provide the Services to Customer.

c. Usage Data. KubernoGRC may collect and generate data and information relating to the provision, use, and performance of the Services, including Usage Data, in aggregated and anonymized form (“Aggregated Usage Data”). Customer hereby grants to KubernoGRC a non-exclusive, perpetual, irrevocable, royalty-free, worldwide license to reproduce, distribute, modify, and otherwise use and exploit Aggregated Usage Data to operate, maintain, improve, and develop the Services; provided that KubernoGRC shall not (i) use Aggregated Usage Data to target Customer competitively, or (ii) use or disclose Aggregated Usage Data in a manner that could reasonably be used to reconstruct or re-identify Customer Data.

13. Confidentiality

a. Definition. As used herein, “Confidential Information” means all confidential information disclosed by or otherwise obtained from a Party (“Disclosing Party”) to or by the other Party (“Receiving Party”), whether orally, visually or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Customer’s Confidential Information includes Customer Data (subject to KubernoGRC’s rights as set forth herein). KubernoGRC’s Confidential Information includes the Services, any documentation provided, Customer Usage Data, Account Data, and KubernoGRC’s product and marketing plans, financial, security, technical architectural or similar information. Confidential Information does not include any information that (i) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party; (ii) was known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any obligation owed to the Disclosing Party; (iii) is received from a third party without breach of any obligation owed to the Disclosing Party; or (iv) was independently developed by the Receiving Party.

b. Protection of Confidential Information. Except as otherwise permitted in writing by the Disclosing Party, the Receiving Party shall: (i) use the same degree of care that it uses to protect the confidentiality of its own confidential information of like kind (but in no event less than reasonable care) not to disclose or use any Confidential Information of the Disclosing Party for any purpose outside the scope of this Agreement; (ii) limit access to Confidential Information of the Disclosing Party to those of its employees, contractors and agents who need such access for purposes consistent with this Agreement and who have signed or are otherwise are bound by confidentiality obligations no less stringent than the protections herein; and (iii) implement commercially reasonable safeguards designed to protect against unauthorized access to and disclosure of the Disclosing Party’s Confidential Information. The Receiving Party may disclose Confidential Information of the Disclosing Party if it is compelled by law to do so, provided the Receiving Party gives the Disclosing Party prior notice of such compelled disclosure (to the extent legally permitted) and reasonable assistance, at the Disclosing Party’s cost, if the Disclosing Party wishes to contest the disclosure. If the Receiving Party is compelled by law to disclose the Disclosing Party’s Confidential Information as part of a civil proceeding to which the Disclosing Party is a party, and the Disclosing Party is not contesting the disclosure, the Disclosing Party will reimburse the Receiving Party for its reasonable cost of compiling and providing secure access to such Confidential Information.

14. Disclaimers

EXCEPT AS SPECIFICALLY PROVIDED HEREIN, ALL SERVICES, SUPPORT, AND ALL OUTPUT, INFORMATION AND MATERIAL DERIVED FROM THE SERVICES IS PROVIDED “AS IS” AND “AS AVAILABLE,” AND KUBERNOGRC EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES OR CONDITIONS OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ALL IMPLIED WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE. KUBERNOGRC MAKES NO WARRANTY THAT THE SERVICES WILL BE AVAILABLE 24/7, PERFORM WITHOUT INTERRUPTION, OR THAT THE SERVICES OR ANY DATA DERIVED FROM THE SERVICES BE FREE FROM ERRORS OR VIRUSES. KUBERNOGRC SHALL NOT BE LIABLE FOR ANY DAMAGES ARISING FROM CUSTOMER’S USE OF, RELIANCE ON, OR INABILITY TO ACCESS AND USE THE SERVICES OR ANY OUTPUT INFORMATION GENERATED FROM THE SERVICES.

15. Term and Termination

a. Term. Unless otherwise included in an Order, the initial term of this Agreement is one (1) year from the date of Order signature (the “Initial Term”). At the end of the Initial Term, this Agreement will automatically renew for additional one (1) year periods (the “Renewal Term”), unless either Party provides the other Party at least sixty (60) days written notice prior to the expiration of the end of the then current term of its intent not to renew this Order. The Initial Term and any Renewal Term together, the “Term.”

b. Termination. Following the Initial Term, either Party may terminate this Agreement upon thirty (30) days advance written notice to the other Party if the other Party materially breaches this Agreement and fails to cure such breach to the reasonable satisfaction of the non-breaching Party within the thirty (30) days written notice period.

c. Effect of Termination. Upon any expiration or termination of this Agreement: (i) Customer shall immediately cease all access to and use of the Services; (ii) all fees and other amounts owed by Customer under this Agreement and any Order accrued but not yet paid as of the effective date of termination or expiration shall become immediately due and payable; and (iii) upon Customer’s written request received within sixty (60) days after the effective date of termination or expiration, KubernoGRC shall make available to Customer a copy of Customer’s then-current Customer Data in a commercially reasonable format. After such period, KubernoGRC shall use commercially reasonable efforts to delete all remaining Customer Data in identifiable form in its possession or control within 180 days following the expiration of such period, except to the extent KubernoGRC is required to retain such information under applicable law or for legitimate internal recordkeeping, compliance, or audit purposes. Upon Customer’s written request, KubernoGRC will provide written confirmation of deletion within 30 days of completion.

d. Survival. The following Sections shall survive any termination or expiration of this Agreement: Section 8(b) (Use Restrictions); Section 12 (Ownership); Section 13 (Confidentiality); Section 14 (Disclaimers); Section 15(c) (Effect of Termination); Section 16 (Indemnification); Section 17 (Limitations of Liability); Section 18 (Business Associate Agreement, to the extent a BAA has been executed); and Sections 20 through 33 (General Provisions). In addition, any payment obligations accrued prior to the effective date of termination or expiration shall survive.

16. Indemnification

a. By KubernoGRC. KubernoGRC shall indemnify, defend, and hold Customer harmless from and against any claims, losses, liabilities, damages, costs and expenses (including, without limitation, reasonable attorneys’ fees) arising from a claim, suit or proceeding brought against Customer by a third party to the extent it is based on a claim that the Services infringe a United States patent, copyright, or trade secret (each, an “Infringement Claim”); provided, however, that Customer promptly notifies KubernoGRC in writing of such Infringement Claim, cooperates with KubernoGRC, and allows KubernoGRC sole authority to control the defense, and settlement of such Infringement Claim; provided, further, that KubernoGRC shall not settle, compromise, or consent to the entry of any judgment with respect to any Infringement Claim without the prior written consent of Customer (such consent not to be unreasonably withheld, conditioned, or delayed) if such settlement, compromise, or judgment (i) requires any admission of fault, liability, wrongdoing, or culpability on the part of the Customer; (ii) imposes any injunctive or other equitable relief or any non-monetary obligation on the Customer; or (iii) does not include an unconditional release of the Customer from all liability with respect to such Infringement Claim. If an Infringement Claim has been made, or in KubernoGRC’s opinion is likely to be made, KubernoGRC may, at its sole option and expense, either: (i) procure for Customer the right to continue using the Services; (ii) replace or modify the Services so that it becomes non-infringing; or (iii) terminate both Parties’ respective rights and obligations under this Agreement with regard to the Services, and refund to Customer a pro-rata amount of any prepaid fees actually paid by Customer for the unused portion of such Services. This Section will not apply to the extent that the alleged infringement arises from: (i) Customer’s provision of, or KubernoGRC’s use of or compliance with, any Customer Data or instructions provided by Customer, including but not limited to the failure to obtain any required authorization or consents to provide the Customer Data to KubernoGRC; (ii) Customer’s modification of the Services or combination of the Services with any third-party products, services, or data not provided or approved by KubernoGRC; (iii) Customer’s use of the Services in a manner inconsistent with this Agreement or any applicable documentation; or (iv) Customer’s continued use of the Services after KubernoGRC has provided Customer with a non-infringing alternative or notified Customer of the alleged infringement.

b. By Customer. Customer shall indemnify, defend and hold KubernoGRC harmless from and against all claims, losses, liabilities, damages, costs and expenses (including, without limitation, reasonable attorneys’ fees) arising from a claim, suit or proceeding brought against KubernoGRC by a third party arising out of or related to (i) the use or misuse of the Services by the Customer or its Authorized Users; (ii) Customer’s provision of or KubernoGRC’s use of any Customer Data, including but not limited to the failure to obtain any required authorizations or consents to provide the Customer Data to KubernoGRC; (iii) Customer’s reliance on or use of any output received from the Services; (iv) Customer’s material breach of this Agreement; (v) Customer’s violation of any law or the rights of any third party; and (vi) Customer’s negligence, gross negligence or willful misconduct (each, a “Customer-Related Claim”); provided, however, that KubernoGRC promptly notifies Customer in writing of such Customer-Related Claim, cooperates with Customer, and allows Customer sole authority to control the defense, and settlement of such Customer-Related Claim; provided, further, that Customer shall not settle, compromise, or consent to the entry of any judgment with respect to any Customer-Related Claim without the prior written consent of KubernoGRC (such consent not to be unreasonably withheld, conditioned, or delayed) if such settlement, compromise, or judgment (i) requires any admission of fault, liability, wrongdoing, or culpability on the part of the KubernoGRC; (ii) imposes any injunctive or other equitable relief or any non-monetary obligation on the KubernoGRC; or (iii) does not include an unconditional release of the KubernoGRC from all liability with respect to such Customer-Related Claim.

17. Limitations of Liability

TO THE GREATEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATING TO THIS AGREEMENT, WHETHER BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL THEORY, EVEN IF A PARTY HAS BEEN PREVIOUSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR LOSSES.

TO THE GREATEST EXTENT PERMITTED BY APPLICABLE LAW, KUBERNOGRC’S LIABILITY TO CUSTOMER ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL BE LIMITED TO DIRECT DAMAGES IN AN AMOUNT NOT TO EXCEED, IN THE AGGREGATE, THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER TO KUBERNOGRC UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM (THE “GENERAL CAP”).

THE LIMITATIONS OF LIABILITY IN THIS SECTION SHALL NOT IN ANY WAY LIMIT CUSTOMER’S (I) PAYMENT OBLIGATIONS UNDER THIS AGREEMENT; (II) INDEMNIFICATION OBLIGATIONS UNDER SECTION 16; (III) LIABILITY FOR BREACH OF SECTION 13 (CONFIDENTIALITY); OR (IV) LIABILITY FOR NEGLIGENCE, GROSS NEGLIGENCE, OR WILLFUL MISCONDUCT. FOR THE AVOIDANCE OF DOUBT, THE LIABILITY CAPS SET FORTH IN THIS SECTION APPLY SOLELY TO KUBERNOGRC’S LIABILITY TO CUSTOMER AND DO NOT LIMIT OR CAP CUSTOMER’S LIABILITY TO KUBERNOGRC.

NOTWITHSTANDING THE FOREGOING GENERAL CAP, THE AGGREGATE LIABILITY OF KUBERNOGRC TO CUSTOMER SHALL BE LIMITED TO TWO TIMES (2X) THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM (THE “ELEVATED CAP”) SOLELY WHERE THE CLAIM ARISES DIRECTLY FROM: (I) A CONFIRMED SECURITY INCIDENT INVOLVING UNAUTHORIZED ACCESS TO CUSTOMER DATA UNDER KUBERNOGRC’S CONTROL, CONSTITUTING A BREACH OF SECTION 7 (SECURITY AND PRIVACY) OR THE DPA; OR (II) KUBERNOGRC’S UNAUTHORIZED DISCLOSURE OF CUSTOMER’S CONFIDENTIAL INFORMATION OR PERSONAL INFORMATION IN BREACH OF SECTION 13 (CONFIDENTIALITY). FOR CLARITY, THE ELEVATED CAP APPLIES ONLY TO THE SPECIFIC CLAIMS ENUMERATED ABOVE AND DOES NOT APPLY TO ANY OTHER CLAIMS ARISING UNDER THIS AGREEMENT, INCLUDING GENERAL SERVICE FAILURES, PERFORMANCE ISSUES, OR FEATURE UNAVAILABILITY. THE GENERAL CAP AND ELEVATED CAP ARE NON-CUMULATIVE; IN NO EVENT SHALL KUBERNOGRC’S TOTAL AGGREGATE LIABILITY EXCEED THE ELEVATED CAP.

SOLE REMEDY. KUBERNOGRC’S INDEMNIFICATION OBLIGATIONS SET FORTH IN SECTION 16(a) STATE KUBERNOGRC’S SOLE LIABILITY AND OBLIGATION, AND CUSTOMER’S SOLE AND EXCLUSIVE REMEDY, FOR ANY ACTUAL, THREATENED, OR ALLEGED CLAIMS THAT THE SERVICES INFRINGE, MISAPPROPRIATE, OR OTHERWISE VIOLATE ANY INTELLECTUAL PROPERTY RIGHTS OF ANY THIRD PARTY.

18. Business Associate Agreement

a. If any Order involves Customer’s access to or use of the Services in connection with Protected Health Information (PHI) as defined under HIPAA (45 C.F.R. § 160.103), Customer must notify KubernoGRC prior to any such use. The Parties shall execute a Business Associate Agreement (BAA), available upon request and attached as an Exhibit to this agreement, or executed as a standalone addendum, before any PHI is submitted to or processed by the Services. Customer shall not submit PHI to the Services unless a fully executed BAA is in effect.

Failure to execute a BAA prior to submitting PHI constitutes a material breach of this Agreement. In the event Customer submits PHI to the Services without a fully executed BAA in effect, Customer shall indemnify, defend, and hold harmless KubernoGRC and its officers, directors, employees, and agent from and against any and all claims, losses, liabilities, damages, fines, penalties, costs, and expenses (including reasonable attorneys’ fees” arising out of or related to: (i) Customer’s unauthorized submission of PHI to the Services; (ii) any resulting HIPAA violation or regulatory investigation or enforcement action, (iii) any breach notification obligations triggered by Customer’s unauthorized PHI submission; and (iv) any third-party claims arising from the unauthorized processing of such PHI. This indemnification obligation shall survive termination or expiration of this Agreement.

19. Publicity

Neither Party shall issue any press release, public announcement, or other public statement regarding this Agreement or the relationship between the Parties without the prior written consent of the other Party. Notwithstanding the foregoing, KubernoGRC may (i) identify Customer as a customer of KubernoGRC and use Customer’s name and logo in KubernoGRC’s customer lists, website, marketing materials, and investor communications; and (ii) develop and publish case studies, testimonials, and similar promotional materials describing Customer’s use of the Services; provided, however, that any case study, testimonial, or similar material that quotes Customer or describes Customer’s specific use of the Services shall be subject to Customer’s prior review and approval, not to be unreasonably withheld. Customer may revoke the permissions granted in this Section at any time upon written notice to KubernoGRC, and KubernoGRC shall cease further use of Customer’s name, logo, and related materials in new publications within a reasonable period following receipt of such notice; provided, however, that KubernoGRC shall have no obligation to recall, modify, or remove materials already published, printed, or distributed prior to such notice.

20. Notices

All notices provided by KubernoGRC to Customer under this MSA may be delivered in writing (a) by nationally recognized overnight delivery service (“Courier”) or U.S. mail to the mailing address provided by Customer on the Order Form; or (b) by electronic mail to the email address associated with Customer’s account owner. Customer must give notice to KubernoGRC in writing by Courier or U.S. mail to 1100 Main, Suite 400, Kansas City, MO 64105, Attn: Legal Department and by email to legal@kubernogrc.com. All notices shall be deemed effective upon delivery by electronic mail; or, if otherwise delivered, upon the earlier of receipt or two (2) business days after being deposited in the mail or with a Courier, as permitted above.

21. Customer Affiliates

Customer may authorize its Affiliates to access and use the Services under an Order entered into by Customer, provided that (i) each such Affiliate’s use shall be subject to the terms of this Agreement and the applicable Order; (ii) Customer shall remain responsible for each such Affiliate’s compliance with this Agreement and the applicable Order; and (iii) Customer and each authorized Affiliate shall be jointly and severally liable for all obligations under this Agreement and the applicable Order arising from or relating to such Affiliate’s access to or use of the Services.

22. Assignment; Successors and Assigns

KubernoGRC may assign or transfer this Agreement to an affiliate or to a successor to all of its business or assets to which this Agreement relates, whether by merger, sale of assets, sale of stock, reorganization, or otherwise unless it is to a direct competitor of Customer. Customer shall not assign or transfer this Agreement, or any of the rights or obligations hereunder without the prior written consent of KubernoGRC. This Agreement shall inure to the benefit of and be binding upon each Party’s respective permitted successors and permitted assigns. Any attempted assignment or delegation in violation of this provision shall be void and without effect.

23. Relationship of the Parties

The relationship between the Parties is that of independent contractors. Nothing contained in this Agreement shall be construed as creating any agency, partnership, joint venture, employment, or other form of joint enterprise, fiduciary, or similar relationship between the Parties, and neither Party shall have authority to contract for or bind the other Party in any manner whatsoever.

24. No Third-Party Beneficiaries

This Agreement is for the sole benefit of the Parties hereto and their respective permitted successors and assigns, and nothing herein, express or implied, is intended to or shall confer upon any other person or entity any legal or equitable right, benefit, or remedy of any nature whatsoever under or by reason of this Agreement.

25. Force Majeure

Neither Party will be considered in breach of, or liable for any delay or failure of performance under this Agreement to the extent such breach, delay, or failure is caused by or results directly from any unforeseen cause(s) beyond a Party’s reasonable control, including, but not limited to, fire, flood, inclement weather, accidents, earthquakes, telecommunication line failures, electrical outages, network failures, acts of God, terrorism, civil commotion, or labor disputes.

26. Governing Law; Venue

This Agreement and any claim (whether in contract, tort or otherwise) or other matter arising out of or relating to this Agreement or the transactions contemplated hereby shall be governed by and construed in accordance with the laws of the State of Delaware, without giving effect to any choice or conflict of law principle or rule (whether of the State of Delaware or any other jurisdiction). Any dispute arising in connection with this Agreement will be resolved exclusively in the state or federal courts in Wilmington, Delaware.

27. Dispute Resolution

a. Informal Negotiation. In the event of any dispute, controversy, or claim arising out of or relating to this Agreement, or the breach, termination, or validity thereof (each, a “Dispute”), the Parties shall first attempt to resolve such Dispute through good-faith negotiation. Either Party may initiate this process by delivering written notice to the other Party describing the Dispute in reasonable detail (a “Dispute Notice”). Within fifteen (15) days of receipt of a Dispute Notice, senior representatives of each Party with authority to resolve the Dispute shall meet or confer (in person, by telephone, or by video conference) and attempt in good faith to negotiate a resolution. Neither Party may commence mediation or litigation with respect to a Dispute until the earlier of: (i) the expiration of such fifteen (15) day negotiation period; or (ii) the receiving Party’s written acknowledgment that informal negotiation has been exhausted.

b. Mediation. If the Dispute is not resolved through informal negotiation within thirty (30) days after delivery of the Dispute Notice (or such longer period as the Parties may agree in writing), either Party may submit the Dispute to non-binding mediation administered by a mutually agreed-upon mediator. The costs of mediation shall be shared equally by the Parties. Neither Party may commence litigation with respect to a Dispute until the earlier of: (i) the conclusion of the mediation without resolution; or (ii) forty-five (45) days after the submission of the Dispute to mediation, unless the Dispute involves a claim for injunctive or other equitable relief as set forth in Section 19c.

c. Litigation; Equitable Relief. If the Dispute is not resolved through mediation, either Party may pursue its available legal remedies in accordance with the governing law and venue provisions of this Agreement. Notwithstanding the foregoing, nothing in this Section shall limit either Party’s right to seek immediate injunctive or other equitable relief from a court of competent jurisdiction where necessary to prevent irreparable harm, protect Confidential Information, or enforce intellectual property rights, without first exhausting the negotiation or mediation steps set forth above.

d. Tolling. The running of any applicable statute of limitations shall be tolled during the pendency of any informal negotiation or mediation conducted pursuant to this Section.

e. Continued Performance. Unless and until this Agreement is terminated in accordance with its terms, each Party shall continue to perform its obligations under this Agreement during the pendency of any Dispute resolution process, provided that Customer continues to pay all undisputed amounts when due.

28. Attorney Fees

If either Party commences any action or proceeding to enforce its rights under this Agreement and prevails in such action or proceeding, the prevailing Party shall be entitled to recover from the non-prevailing Party its reasonable attorneys’ fees, court costs, and other expenses incurred in connection with such action or proceeding, in addition to any other relief to which the prevailing Party may be entitled.

29. Interpretation

In this Agreement, except to the extent the context otherwise requires: (i) the words “include,” “includes,” and “including” shall be deemed to be followed by the words “without limitation”; (ii) the word “or” is not exclusive and shall be deemed to mean “and/or”; (iii) the words “herein,” “hereof,” “hereby,” “hereto,” and “hereunder” refer to this Agreement as a whole and not to any particular provision; (iv) references to sections, exhibits, and schedules refer to the sections of, and exhibits and schedules attached to, this Agreement; (v) the singular includes the plural and the plural includes the singular; (vi) references to any statute, rule, or regulation include all amendments, modifications, and successor provisions thereto; (vii) references to “days” mean calendar days unless otherwise specified, and references to “business days” mean any day other than a Saturday, Sunday, or federal holiday in the United States; (viii) the headings in this Agreement are for convenience only and shall not affect the interpretation of this Agreement; and (ix) this Agreement shall be construed without regard to any presumption or rule requiring construction or interpretation against the Party drafting it.

30. Conflicts Due to Language Translation

This Agreement has been prepared and executed in the English language. Any translation of this Agreement into another language is provided solely for the convenience of the Parties, and the English-language version shall govern and control in all respects, including in the interpretation, construction, and enforcement of this Agreement. All notices, communications, and other documents delivered under or in connection with this Agreement shall be in the English language, and in the event of any conflict or inconsistency between the English-language version and any translation thereof, the English-language version shall prevail.

31. Severability

If any term or provision of this Agreement is held by a court of competent jurisdiction to be invalid, illegal, or otherwise unenforceable in any jurisdiction, then such term or provision will be interpreted in such jurisdiction so as to accomplish its objectives to the greatest extent possible under applicable law; provided, that such invalid, illegal or unenforceable term or provision will not affect any other term or provision of this Agreement or cause the term or provision to be invalid, illegal or unenforceable in any other jurisdiction.

32. Amendment and Modification; Waiver

Except as expressly provided in this Section and elsewhere herein, no amendment to or modification of this Agreement is effective unless it is in writing and signed by each Party. Notwithstanding the foregoing, KubernoGRC may modify the Agreement from time to time by posting a revised version at the same location, and such modifications will be effective the first day of the calendar month following posting; provided, however, that for Orders with a term of twelve months or longer, modifications will not take effect as to Customer until the next Renewal Order Term. Customer’s exclusive remedy for any objection to a modification is to elect not to renew the applicable Order. No waiver of any provision of this Agreement is effective unless it is in writing, identified as a waiver to this Agreement, and signed by the Party waiving its right. No failure to exercise, or delay in exercising, any right, remedy, power, or privilege arising from this Agreement shall operate or be construed as a waiver thereof; nor shall any single or partial waiver or exercise of any right, remedy, power, or privilege hereunder preclude or limit any other or further exercise thereof or the exercise of any other right, remedy, power or privilege. Notwithstanding the foregoing, if KubernoGRC modifies any terms that materially and adversely affect Customer’s rights or obligations under this Agreement, Customer may elect to terminate the applicable Order within thirty (30) days of the effective date of such modification upon written notice to KubernoGRC, and KubernoGRC shall refund to Customer any prepaid, unused fees covering the period following the effective date of termination.

33. Cumulative Remedies

The rights and remedies of each Party under this Agreement are cumulative, and are in addition to, and not in substitution for, any other rights and remedies available at law, in equity, or otherwise.

34. Entire Agreement

This Agreement and any exhibits, schedules, and attachments hereto constitutes the entire agreement between the Parties with respect to the subject matter hereof, and supersedes and merges all prior and contemporaneous agreements, understandings, or representations, whether written or oral. This Agreement sets forth the general terms and conditions applicable to the Services and any related services provided by KubernoGRC. No terms or conditions proposed by either Party shall be binding on the other Party unless expressly accepted in writing by both Parties, and each Party hereby objects to and rejects all terms and conditions not so expressly accepted.