MASTER SERVICES AGREEMENT

This Master Services Agreement governs customer’s acquisition and use of Cerbos services. Capitalised terms have the definitions set forth herein.

If Customer registers for Trial Usage, the applicable provisions of this Agreement will also govern that Trial Usage.

By accepting this Agreement, by (1) clicking a box indicating acceptance, (2) executing an Order Form that references this agreement, or (3) using services in Trial Usage, Customer agrees to the terms of this Agreement. If the individual accepting this Agreement is accepting on behalf of a company or other legal entity, such individual represents that they have the authority to bind such entity and its Affiliates to these terms and conditions, in which case the term “Customer” shall refer to such entity and its Affiliates. If the individual accepting this agreement does not have such authority, or does not agree with these terms and conditions, such individual must not accept this Agreement and may not use the Services.

The Services may not be accessed for purposes of monitoring their availability, performance or functionality, or for any other benchmarking or competitive purposes.

Cerbos’s direct competitors are prohibited from accessing the Services, except with Cerbos’s prior written consent.

This Agreement was last updated on July 7, 2025. It is effective between Customer and Cerbos as of the date of Customer’s accepting this Agreement (the "Effective Date").

1. DEFINITIONS

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control," for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

"Agreement" means this Master Services Agreement.

"Anonymous Data" means the anonymous data derived from the anonymization and aggregation of Customer Data or collected by Cerbos as part of the monitoring, provision, usage and performance of the Services.

"Claim" means either Claim against Customer or Claim against Cerbos, as applicable.

"Claim against Customer" means claim, demand, suit or proceeding made or brought against Customer by a non-affiliated third party alleging that any Purchased Services, Proprietary Software or Material furnished by Cerbos infringe or misappropriate such third party’s intellectual property rights.

"Claim against Cerbos" means claim, demand, suit or proceeding made or brought against Cerbos by a non-affiliated third party (a) alleging that (i) the combination of a Non-Cerbos Application or configuration provided by Customer and used with the Services or Proprietary Software, or (ii) Material furnished by Customer infringes or misappropriates such third party’s intellectual property rights, or (b) arising from (i) Customer’s use of the Services or Proprietary Software in an unlawful manner or in violation of the Agreement, the Documentation, or Order Form, (ii) any Customer Data or Customer’s use of Customer Data with the Services, or (iii) a Non-Cerbos Application provided by Customer.

"Customer" means in the case of an individual accepting this Agreement on his or her own behalf, such individual, or in the case of an individual accepting this Agreement on behalf of a company or other legal entity, the company or other legal entity for which such individual is accepting this Agreement, and Affiliates of that company or entity (for so long as they remain Affiliates) which have entered into Order Forms.

"Customer Data" means electronic data and information submitted by or for Customer to the Services, excluding Non-Cerbos Applications.

"Documentation" means the applicable Service’s Trust and Compliance documentation at https://cerbos.dev/legal and its usage guides and policies, as updated from time to time, accessible via docs.cerbos.dev or login to the applicable Service.

"Early-Test Services" means Cerbos services or functionality that may be made available to Customer to try at its option at no additional charge which is clearly designated as early-test, pilot, developer preview, non-production, evaluation, or by a similar description.

"Enhancement Proprietary Software" means a proprietary software library made available alongside the provided Subscription Services by Cerbos to its Customers which includes, as of Effective Date, Cerbos Embedded Decision Point software.

"IPR" means all intellectual property rights, in each case whether registered or unregistered. Examples of IPR are patents, trademarks, copyright and rights in computer software, database rights, rights to use and protect the confidentiality of confidential information (including know-how and trade secrets).

"Malicious Code" means code, files, scripts, agents or programs intended to do harm, including, for example, viruses, worms, time bombs and Trojan horses.

"Non-Cerbos Application" means Web-based, mobile, offline or other software functionality that interoperates with a Service, that is provided by Customer or a third party. Non-Cerbos Applications, other than those obtained or provided by Customer, will be identifiable as such.

"Order Form" means an ordering document or online order specifying the Services to be provided hereunder that is entered into between Customer and Cerbos or any of their Affiliates, including any addenda and supplements thereto. By entering into an Order Form hereunder, an Affiliate agrees to be bound by the terms of this Agreement as if it were an original party hereto.

"Purchased Services" means Subscription Services that Customer or Customer’s Affiliate purchases under an Order Form or online purchasing portal, as distinguished from Trial Usage.

"Professional Services" means the support, implementation, training, and consultancy services Cerbos provides to Customer under the Agreement, as identified in the Order Form.

"Proprietary Software" means Enhancement Software and Self-Hosted Software.

"Self-Hosted Software" means a self-hosted proprietary software that is ordered by Customer under an Order Form or online purchasing portal, or provided to Customer free of charge (as applicable) or under a free trial, and provided by Cerbos to Customer.

"Services" means Professional Services and Subscription Services.

"Subscription Services" means the products and services that are ordered by Customer under an Order Form or online purchasing portal, or provided to Customer free of charge (as applicable) or under a free trial, and made available online by Cerbos, including associated Cerbos offline or mobile components, as described in the Documentation. "Services" exclude Non-Cerbos Applications.

"Cerbos" means Zenauth Ltd (trading as "Cerbos").

"User" means, in the case of an individual accepting these terms on his or her own behalf, such individual, or, in the case of an individual accepting this Agreement on behalf of a company or other legal entity, an individual who is authorized by Customer to use a Service, for whom Customer has purchased a subscription (or in the case of any Services provided by Cerbos without charge, for whom a Service has been provisioned), and to whom Customer (or, when applicable, Cerbos at Customer’s request) has supplied a user identification and password (for Services utilizing authentication). Users may include, for example, employees, consultants, contractors and agents of Customer and of its Affiliates, and third parties with which Customer or its Affiliates transact business.

2. CERBOS RESPONSIBILITIES

2.1 Provision of Purchased Services. Cerbos will (a) make the Services and/or Self-Hosted Software available to Customer pursuant to this Agreement, and the applicable Order Forms and Documentation, (b) provide applicable Cerbos standard support for the Purchased Services to Customer at no additional charge as described in Exhibit A, and/or upgraded enterprise support if purchased, (c) abide by the Service Level Agreement attached as Exhibit A, and (d) provide the Services in accordance with laws and government regulations applicable to Cerbos’s provision of its Services to its customers generally (i.e., without regard for Customer’s particular use of the Services), and subject to Customer’s and Users’ use of the Services in accordance with this Agreement, the Documentation and the applicable Order Form.

2.2 Open Source Software. Cerbos may make available certain open source software to its Customer which includes, as of Effective Date, Cerbos Policy Decision Point software (the "Open Source Software"). The Open Source Software shall be subject to the applicable open source license(s) and not this Agreement, and is provided by Cerbos at no charge. To the extent the terms of open source licenses applicable to Open Source Software prohibit any of the restrictions in this Agreement, such restrictions will not apply to such Open Source Software.

2.3 Proprietary Software. Cerbos may: (i) make available Enhancement Proprietary Software to enhance Customer’s use of the Subscription Services or (ii) make available a Self-Hosted Software in accordance with Section 2.1 hereof. The applicable Order Form may include details of the usage of Proprietary Software. Subject to the terms of this Agreement and the applicable Order Form, Cerbos grants to Customer a limited, non-exclusive, non-sublicensable, non-transferable license during the subscription term to install and use Proprietary Software to enhance Customer’s use of Subscription Services and to install and use the Self-Hosted Software.

2.4 Protection of Customer Data. Cerbos will maintain appropriate administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Customer Data, as described in the Documentation. Those safeguards will include, but will not be limited to, measures designed to prevent unauthorized access to or disclosure of Customer Data (other than by Customer or Users). The terms of the data processing addendum at https://cerbos.dev/legal (the "DPA") are hereby incorporated by reference. Upon request by Customer made within 30 days after the effective date of termination or expiration of this Agreement, Cerbos will make Customer Data available to Customer for export or download as provided in the Documentation. After such a 30-day period, Cerbos will have no obligation to maintain or provide any Customer Data, and as provided in the Documentation will thereafter delete or destroy all copies of Customer Data in its systems or otherwise in its possession or control, unless legally prohibited. Except for making the Customer Data available as outlined above, any Professional Services provided in further assistance to export or download of Customer Data is subject to additional charge to be mutually agreed in advance. For the avoidance of doubt, Cerbos shall not be responsible for deletion of Customer Data stored on any Devices.

2.5 Cerbos Personnel. Cerbos will be responsible for the performance of its personnel (including its employees and contractors) and their compliance with Cerbos’s obligations under this Agreement.

2.6 Early-Test Services. From time to time, Cerbos may make Early-Test Services available to Customer at no charge. Customer may choose to try such Early-Test Services or not at their sole discretion. Early-Test Services are intended for evaluation purposes and not for production use, are not supported, and may be subject to additional terms. Early-Test Services are not considered “Services” under this Agreement, however, all restrictions, Cerbos’s reservation of rights and Customer obligations concerning the Services, and use of any related Non-Cerbos Applications, shall apply equally to Customer’s use of Early-Test Services. Unless otherwise stated, any Early-Test Services trial period will expire upon the earlier of one year from the trial start date or the date that a version of the Early-Test Services becomes generally available without the applicable Early-Test Services designation. Cerbos may discontinue Early-Test Services at any time in Cerbos’s sole discretion and may never make them generally available. Cerbos will have no liability for any harm or damage arising out of or in connection with an Early-Test Service.

2.7 Trial Usage. “Trial Usage” is a short-term evaluation of the Subscription Services or Self-Hosted Software that is (i) provided free of charge or discounted, or (ii) pursuant to an Order Form that is specifically labelled “Proof of Concept”. A Trial Usage period ends the earlier of (a) the date Customer enters into a commitment Order Form for the Subscription Services or Self-Hosted Software for a minimum one-year term, (b) Cerbos’s written notice, (c) expiration of the agreed subscription term of the Trial Usage. The terms of this Section 2.7 govern Trial Usage and control over any conflicting provision of this Agreement; provided however that Trial Usage will be subject to all applicable provisions of this Agreement that are not in conflict with the provisions of this Section 2.7. Trial Usage shall be limited to internal testing and evaluation purposes. Unless specifically stated otherwise in an Order Form, Trial Usage is provided: (a) “AS IS”; and (b) without indemnification, warranty, or condition of any kind. No service level commitment will apply to Trial Usage. Certain features or functionality of the Subscription Services or Self-Hosted Software may not be available in Trial Usage.

3. USE OF SERVICES

3.1 Subscription Services. Unless otherwise provided in the applicable Order Form or Documentation, (a) Subscription Services are purchased as subscriptions for the term stated in the applicable Order Form or in the applicable online purchasing portal, (b) subscriptions for Subscription Services may be added during a subscription term at the same pricing as the underlying subscription pricing, prorated for the portion of that subscription term remaining at the time the subscriptions are added, and (c) any added subscriptions will terminate on the same date as the underlying subscriptions. Customer agrees that its purchases are not contingent on the delivery of any future functionality or features, or dependent on any oral or written public comments made by Cerbos regarding future functionality or features.

3.2 Usage Limits and Audit. Subscription Services and Proprietary Software may be subject to usage limits specified in Order Forms and Documentation. If Customer exceeds a contractual usage limit, Cerbos may work with Customer to seek to reduce Customer’s usage so that it conforms to that limit. If, notwithstanding Cerbos’s efforts, Customer is unable or unwilling to abide by a contractual usage limit, Customer will execute an Order Form for additional quantities of the applicable Services and Proprietary Software promptly upon Cerbos’s request, and/or pay any invoice for excess usage in accordance with the "Invoicing and Payment" section below. For the purpose of providing the Services in an efficient and contractually compliant way, Cerbos may audit Customer’s use of Services and Proprietary Software including to verify the Customer’s compliance with the usage limits. If necessary, Customer shall provide reasonable cooperation with such an audit.

3.3 Customer Responsibilities. Customer will (a) be responsible for Users’ compliance with this Agreement, Documentation and Order Forms, (b) be responsible for the accuracy, quality and legality of Customer Data, the means by which Customer acquired Customer Data, Customer’s use of Customer Data with the Services, and the interoperation of any Non-Cerbos Applications with which Customer uses Services, (c) use commercially reasonable efforts to prevent unauthorized access to or use of Services, or Proprietary Software, and notify Cerbos promptly of any such unauthorized access or use, (d) use Services, or Proprietary Software, only in accordance with this Agreement, Documentation, Order Forms and applicable laws and government regulations, and (e) comply with terms of service of any Non-Cerbos Applications with which Customer uses Services. Any use of the Services in breach of the foregoing by Customer or Users that in Cerbos’s judgement threatens the security, integrity or availability of Cerbos’s services, may result in Cerbos’s immediate suspension of the Services, however Cerbos will use commercially reasonable efforts under the circumstances to provide Customer with notice and an opportunity to remedy such violation or threat prior to any such suspension.

3.4 Usage Restrictions. Customer will not (a) make any Service or Proprietary Software available to anyone other than Customer or Users, or use any Service for the benefit of anyone other than Customer or its Affiliates, unless expressly stated otherwise in an Order Form or the Documentation, (b) sell, resell, licence, sublicence, distribute, rent or lease any Service or Proprietary Software, or include any Service in a service bureau or outsourcing offering, (c) use a Service, Proprietary Software, or Non-Cerbos Application to store or transmit infringing, libelous, or otherwise unlawful or tortious material, or to store or transmit material in violation of third-party privacy rights, (d) use a Service, Proprietary Software, Non-Cerbos Application to store or transmit Malicious Code, (e) interfere with or disrupt the integrity or performance of any Service or third-party data contained therein, (f) attempt to gain unauthorized access to any Service, or its related systems or networks, (g) permit direct or indirect access to or use of any Services, or Proprietary Software, in a way that circumvents a contractual usage limit, or use any Services, or Proprietary Software, to access, copy or use any of Cerbos intellectual property except as permitted under this Agreement, an Order Form, or the Documentation, (h) modify, copy, or create derivative works of a Service, or Proprietary Software, or any part, feature, function or user interface thereof, (i) frame or mirror any part of any Service, other than framing on Customer's own intranets or otherwise for its own internal business purposes or as permitted in the Documentation, (j) except to the extent permitted by applicable law, disassemble, reverse engineer, or decompile a Service, or Proprietary Software, or access it to (1) build a competitive product or service, (2) build a product or service using similar ideas, features, functions or graphics of the Service, or Proprietary Software, (3) copy any ideas, features, functions or graphics of the Service, or Proprietary Software, or (4) determine whether the Services, or Proprietary Software, are within the scope of any patent.

3.5 Removal of Non-Cerbos Applications. If Customer receives notice, including from Cerbos, that Non-Cerbos Application may no longer be used or must be removed, modified and/or disabled to avoid violating applicable law, third-party rights, or the Agreement, Customer will promptly do so. If Customer does not take required action, in accordance with the above, or if in Cerbos’s judgement continued violation is likely to reoccur, Cerbos may disable the applicable Service and/or Non-Cerbos Application. If requested by Cerbos, Customer shall confirm deletion and discontinuance of use of such Non-Cerbos Application in writing and Cerbos shall be authorized to provide a copy of such confirmation to any such third-party claimant or governmental authority, as applicable.

4. PROFESSIONAL SERVICES

4.1 Professional Services. Cerbos shall make available to Customer an appropriately trained employee or contractor to carry out the Professional Services. Such Cerbos resource shall be provided during working hours – 8:00 to 16:30 of GMT Monday to Friday excl. bank holidays (unless otherwise specifically agreed in an Order Form). Unless otherwise identified in an Order Form, all Professional Services must be used within the first subscription term or applicable renewal period. Any portion of the Professional Services not used within such period will be automatically forfeited, with no further action required of either party, and Customer will not be entitled to any refund or credit for any prepaid but unused fees.

4.2 Cancellation Fees. If Customer cancels the booked date of the Professional Services engagement (e.g. training for its Users), Customer will be liable to pay the following cancellation fees in accordance with Section 6 (Fees and Payment):

1. Less than 2 days’ notice - 75% of the relevant Fees apply
2. Less than 4 days’ but more than 2 days’ notice – 50% of the relevant Fees apply;
3. Less than 7 days’ but more than 4 days’ notice – 25% of the relevant Fees apply; or
4. More than 7 days’ notice – no fee and the date can be rebooked.

Where a cancellation fee applies then the forfeited date will be charged to the Customer at agreed rate for the applicable Professional Service.

4.3 Professional Services warranty. Cerbos shall provide the Professional Services with reasonable skill and care and in accordance with generally recognised commercial practices and standards and in accordance with the Order Form. Cerbos will re-perform Professional Services to remedy any breach of warranty. Customer must make any claim under the foregoing warranty to Cerbos in writing within 90 days of performance of such Professional Services in order to receive warranty remedies. This warranty and its remedy are exclusive and in lieu of all other warranties and conditions, whether express or implied.

4.4 Cooperation. Customer will cooperate reasonably and in good faith with Cerbos in its performance of Professional Services by, without limitation: (a) allocating sufficient resources and timely performing any tasks reasonably necessary to enable Cerbos to perform its obligations under each Order Form; (b) timely delivering any Customer deliverables and other obligations required under each Order Form; (c) timely responding to Cerbos’s inquiries related to the Professional Services; (d) assigning an internal project manager for each Order Form to serve as a primary point of contact for Cerbos; (e) actively participating in scheduled project meetings; (f) providing, in a timely manner, and at no charge to Cerbos, office workspace, suitably configured computer equipment with Internet access, access to appropriate and knowledgeable employees and agents of Customer, secured remote access to Customer’s systems, continuous administrative access to Customer’s Services account, and coordination of onsite, online and telephonic meetings all as reasonably required by Cerbos; and (g) complete, accurate and timely information, data and feedback all as reasonably required.

4.5 Change Order. Changes to an Order Form will require a written Change Order signed by the parties prior to implementation of the changes. Such changes may include, for example, changes to the scope of work and any corresponding changes to the fees and schedule.

4.6 Delivery location. Cerbos shall deliver all Professional Services remotely unless otherwise mutually agreed between the parties. If any Cerbos resource is required to travel to Customer’s premises or any other third party premises to deliver the Professional Services to Customer, Customer shall be responsible for Cerbos’s reasonable expenses.

4.7 Subcontractors. Cerbos may, in its reasonable discretion, use subcontractors worldwide to perform the Professional Services hereunder. Cerbos will be responsible for the performance of Professional Services by its personnel (including employees and contractors) and their compliance with Cerbos’s obligations under this Agreement.

5. NON-CERBOS PRODUCTS AND SERVICES

5.1 Non-Cerbos Products and Services. Cerbos or third parties may make available third-party products or services, including, for example, Non-Cerbos Applications. Any acquisition by Customer of such products or services, and any exchange of data between Customer and any Non-Cerbos provider, product or service is solely between Customer and the applicable Non-Cerbos provider. Cerbos does not warrant or support Non-Cerbos Applications or other Non-Cerbos products or services, unless expressly provided otherwise in an Order Form. Cerbos is not responsible for any disclosure, modification or deletion of Customer Data resulting from access by such Non-Cerbos Application or its provider.

5.2 Integration with Non-Cerbos Applications. The Services may contain features designed to interoperate with Non-Cerbos Applications. Cerbos cannot guarantee the continued availability of such Service features, and may cease providing them without entitling Customer to any refund, credit, or other compensation, if for example and without limitation, the provider of a Non-Cerbos Application ceases to make the Non-Cerbos Application available for interoperation with the corresponding Service features in a manner acceptable to Cerbos.

6. FEES AND PAYMENT

6.1 Fees. Customer will pay all fees specified in Order Forms. Except as otherwise specified herein or in an Order Form, (i) fees are based on Services purchased and not actual usage, (ii) payment obligations are non-cancellable and fees paid are non-refundable, and (iii) quantities of Subscription Services purchased cannot be decreased during the relevant subscription term.

6.2 Invoicing and Payment. Customer will provide Cerbos with valid and updated credit card information, or if Customer requires a purchase order for processing the payment to Cerbos, with a valid purchase order or alternative document reasonably acceptable to Cerbos. If Customer provides credit card information to Cerbos, Customer authorizes Cerbos to charge such credit card for all Purchased Services listed in the Order Form for the initial subscription term and any renewal subscription term(s) as set forth in the “Term of Purchased Subscriptions” section below. Such charges shall be made in advance, either annually or in accordance with any different billing frequency stated in the applicable Order Form. If the Order Form specifies that payment will be by a method other than a credit card, Cerbos will invoice the Customer in advance and otherwise in accordance with the relevant Order Form. Unless otherwise stated in the Order Form, invoiced fees are due net 30 days from the invoice date. Customer is responsible for providing complete and accurate billing and contact information to Cerbos and notifying Cerbos of any changes to such information.

6.3 Overdue Charges. If any invoiced amount is not received by Cerbos by the due date, then without limiting Cerbos’s rights or remedies, (a) those charges may accrue late interest at the rate of 1.5% of the outstanding balance per month, or the maximum rate permitted by law, whichever is lower, and/or (b) Cerbos may condition future Service renewals and Order Forms on payment terms shorter than those specified in the “Invoicing and Payment” section above.

6.4 Suspension of Service and Acceleration. If any charge owing by Customer under this or any other agreement for services is 30 days or more overdue, (or 10 or more days overdue in the case of amounts Customer has authorized Cerbos to charge to Customer’s credit card), Cerbos may, without limiting its other rights and remedies, accelerate Customer’s unpaid fee obligations under such agreements so that all such obligations become immediately due and payable, and suspend Services until such amounts are paid in full, provided that, other than for customers paying by credit card or direct debit whose payment has been declined, Cerbos will give Customer at least 10 days’ prior notice that its account is overdue, in accordance with the “Notices” section below for billing notices, before suspending services to Customer.

6.5 Payment disputes. Cerbos will not exercise its rights under the “Overdue Charges” or “Suspension of Service and Acceleration” section above if Customer is disputing the applicable charges reasonably and in good faith and is cooperating diligently to resolve the dispute.

6.6 Taxes. Cerbos's fees do not include any taxes, levies, duties or similar governmental assessments of any nature, including, for example, value-added, sales, use or withholding taxes, assessable by any jurisdiction whatsoever (collectively, "Taxes"). Customer is responsible for paying all Taxes associated with its purchases hereunder. If Cerbos has the legal obligation to pay or collect Taxes for which Customer is responsible under this section, Cerbos will invoice Customer and Customer will pay that amount unless Customer provides Cerbos with a valid tax exemption certificate authorized by the appropriate taxing authority. For clarity, Cerbos is solely responsible for taxes assessable against it based on its income, property and employees.

6.7 Right to increase Subscription fees each year. Cerbos reserves the right to increase the fees for Subscription Services with effect from 1st June of each year (the "Increase Day") for the currently purchased and future Subscription Services and it shall be implemented within the twelve (12) months following the Increase Day at the Customer’s annual anniversary of the start date of the applicable Subscription Service. Any increase shall not exceed the greater of 5% or the increase in the Retail Prices Index (or equivalent index in the country Customer is based) during the calendar year preceding the Increase Day plus 1%. Any increase shall be notified to the Customer as soon as practicable.

7. PROPRIETARY RIGHTS AND LICENCES

7.1 Reservation of Rights. Subject to the limited rights expressly granted hereunder, Cerbos and its Affiliates reserve all of their right, title and interest in and to the Services (including Modifications as defined below), Proprietary Software and its Confidential Information, including all of their related IPR. No rights are granted to Customer hereunder other than as expressly set forth herein.

7.2 Customer Data. Subject to rights of data subjects and limited rights expressly granted hereunder, Cerbos acknowledges Customer owns all rights, title and interest (including all and any IPR) in and to all of Customer Data and its Confidential Information. Customer grants Cerbos a limited licence and a right to copy, transmit, display and modify such Customer Data, solely as necessary for Cerbos to provide the Services to Customer under this Agreement, for the improvement of the Services, as well as to derive Anonymous Data in accordance with the Agreement. Customer shall be solely responsible for ensuring that Customer has obtained all necessary third party consents, made all required disclosures in connection with the foregoing grant and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of Customer Data.

7.3 Licence to Contract Property. Cerbos grants Customer a worldwide, perpetual, non-exclusive, non-transferable, royalty-free licence to copy, maintain, use and run (as applicable) solely for its internal business purposes associated with its use of Purchased Services any software code, documentation or similar deliverables, including any know-how contained therein, developed by Cerbos for Customer as part of Professional Services under this Agreement ("Contract Property"). Cerbos and Customer each retain all right, title and interest in its respective IPR and Cerbos retains all ownership rights in the Contract Property.

7.4 Feedback, Modification and Data. Customer grants to Cerbos and its Affiliates a worldwide, perpetual, irrevocable, royalty-free licence to use, distribute, disclose, and make and incorporate into its services any suggestion, enhancement request, recommendation, correction or other feedback provided by Customer or Users relating to the operation of Cerbos’s or its Affiliates’ services. If Customer requests any modification to the Subscription Service ("Modification"), Cerbos reserves the right to develop and implement the Modification as part of the Subscription Service and make the Modification available to all customers, whether or not Customer pays Cerbos to develop the Modification as part of the Professional Services. Customer will have no rights, title or interest in such Modifications other than the right to use them as part of the Subscription Services. Cerbos shall have the right to collect, track and analyse data and other information relating to the provision, use, and performance of various aspects of the Services including Anonymous Data for the purpose of enhancement of Services and Cerbos products and services. Anonymous Data will not be considered Customer Data nor Confidential Information.

8. CONFIDENTIALITY

8.1 Definition of Confidential Information. “Confidential Information” means all information disclosed by a party ("Disclosing Party") to the other party ("Receiving Party"), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information of Customer includes Customer Data; Confidential Information of Cerbos includes the Services, and the terms and conditions of this Agreement and all Order Forms (including pricing). Confidential Information of each party includes business and marketing plans, technology and technical information, product plans and designs, and business processes disclosed by such party. However, Confidential Information does not include any information that (i) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party, (ii) was known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any obligation owed to the Disclosing Party, (iii) is received from a third party without knowledge of any breach of any obligation owed to the Disclosing Party, or (iv) was independently developed by the Receiving Party. For the avoidance of doubt, the non-disclosure obligations set forth in this “Confidentiality” section apply to Confidential Information exchanged between the parties in connection with the evaluation of additional Cerbos services.

8.2 Protection of Confidential Information. As between the parties, each party retains all ownership rights in and to its Confidential Information. The Receiving Party will use the same degree of care that it uses to protect the confidentiality of its own confidential information of like kind (but not less than reasonable care) to (i) not use any Confidential Information of the Disclosing Party for any purpose outside the scope of this Agreement and (ii) except as otherwise authorized by the Disclosing Party in writing, limit access to Confidential Information of the Disclosing Party to those of its and its Affiliates’ employees and contractors who need that access for purposes consistent with this Agreement and who have signed confidentiality agreements with the Receiving Party containing protections not materially less protective of the Confidential Information than those herein. Neither party will disclose the terms of this Agreement or any Order Form to any third party other than its Affiliates, legal counsels and accountants without the other party’s prior written consent, provided that a party that makes any such disclosure to its Affiliates, legal counsels or accountants will remain responsible for such Affiliates’, legal counsels’ or accountants’ compliance with this “Confidentiality” section. Notwithstanding the foregoing, Cerbos may disclose the terms of this Agreement and any applicable Order Form to a contractor or Non-Cerbos Application Provider to the extent necessary to perform Cerbos’s obligations under this Agreement, under terms of confidentiality materially as protective as set forth herein.

8.3 Compelled Disclosure. The Receiving Party may disclose Confidential Information of the Disclosing Party to the extent compelled by law to do so, provided the Receiving Party gives the Disclosing Party prior notice of the compelled disclosure (to the extent legally permitted) and reasonable assistance, at the Disclosing Party's cost, if the Disclosing Party wishes to contest the disclosure. If the Receiving Party is compelled by law to disclose the Disclosing Party’s Confidential Information as part of a civil proceeding to which the Disclosing Party is a party, and the Disclosing Party is not contesting the disclosure, the Disclosing Party will reimburse the Receiving Party for its reasonable cost of compiling and providing secure access to that Confidential Information.

9. REPRESENTATIONS, WARRANTIES, EXCLUSIVE REMEDIES AND DISCLAIMERS

9.1 Representations. Each party represents that it has validly entered into this Agreement and has the legal power to do so.

9.2 Cerbos Warranties. Cerbos warrants that during an applicable subscription term (a) this Agreement, the Order Forms and the Documentation will accurately describe the applicable administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Customer Data, (b) Cerbos will not materially decrease the overall security of the Subscription Services, (c) the Subscription Services and Proprietary Software will perform materially in accordance with the applicable Documentation. For any breach of a warranty above, Customer’s exclusive remedies are those described in the “Termination” and “Refund or Payment upon Termination” sections below.

9.3 Disclaimers. EXCEPT AS EXPRESSLY PROVIDED HEREIN, NEITHER PARTY MAKES ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND EACH PARTY SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW. SERVICES PROVIDED IN TRIAL USAGE, AND EARLY-TEST SERVICES AND OPEN SOURCE SOFTWARE ARE PROVIDED “AS IS,” AND AS AVAILABLE EXCLUSIVE OF ANY WARRANTY WHATSOEVER.

10. MUTUAL INDEMNIFICATION

10.1 Indemnification. A Party ("Indemnifying Party") will defend the other Party ("Indemnified Party") against a Claim, and will indemnify Indemnified Party from any damages, attorney fees and costs finally awarded against Indemnified Party as a result of, or for amounts paid by Indemnified Party under a settlement approved by Indemnifying Party in writing of, a Claim, provided Indemnified Party (a) promptly gives Indemnifying Party written notice of the Claim, (b) gives Indemnifying Party sole control of the defence and settlement of the Claim (except that Indemnifying Party may not settle any Claim unless it unconditionally releases Indemnified Party of all liability), and (c) gives Indemnifying Party all reasonable assistance, at Indemnifying Party’s expense.

10.2 Indemnification remedies and exclusions. If Cerbos receives information about an infringement or misappropriation claim related to the Services or Proprietary Software, Cerbos may in its discretion and at no cost to Customer (i) modify the Services or Proprietary Software so that they are no longer claimed to infringe or misappropriate, without breaching Cerbos’s warranties under “Cerbos Warranties” above, (ii) obtain a licence for Customer’s continued use of that Service or Proprietary Software in accordance with this Agreement, or (iii) terminate Customer’s subscriptions for those Services or Proprietary Software upon 30 days’ written notice and refund Customer any prepaid fees covering the remainder of the term of the terminated subscriptions. The defence and indemnification obligations in this section “Mutual Indemnification” do not apply if (I) the allegation does not state with specificity that the Services or Proprietary Software are the basis of the Claim Against Customer; (II) a Claim Against Customer arises from the use or combination of the Services, Proprietary Software or any part thereof with software, hardware, data, or processes not provided by Cerbos, if the Services, Proprietary Software or use thereof would not infringe without such combination; (III) a Claim Against Customer arises from Services or Proprietary Software under an Order Form for which there is no charge; (IV) a Claim against Customer arises from a Non-Cerbos Application or Customer’s breach of this Agreement, the Documentation, or applicable Order Forms; (V) a Claim Against Cerbos arises from Cerbos’s breach of this Agreement, the Documentation or applicable Order Forms.

10.3 Exclusive Remedy. This “Mutual Indemnification” section states the indemnifying party’s sole liability to, and the indemnified party’s exclusive remedy against, the other party for any third-party claim described in this section.

11. LIMITATION OF LIABILITY

11.1 Limitation of Liability. Subject to the “Exclusion of Consequential and Related Damages” and “Limitation of Restrictions” sections below, in no event shall the aggregate liability of each party together with all of its Affiliates arising out of or related to this Agreement (whether in contract or tort or under any other theory of liability) exceed the total amount paid by Customer and its Affiliates hereunder in the twelve (12) months preceding the first incident out of which the liability arose. The foregoing limitation will not limit Customer’s and its Affiliates' payment obligations under the “Fees and Payment” section above.

11.2 Exclusion of Consequential and Related Damages. Subject to the “Limitation of Restrictions” section below, in no event shall either party or its Affiliates have any liability to the other party or its Affiliates under or in relation to this Agreement whether in contract, tort or under any other theory of liability for:

(a) any financial damages as a result of loss or damage to property, economic loss, cost of replacement services, loss of profits, loss of revenue, loss of orders, loss of goodwill, and/or loss resulting from damage to image or reputation in each case whether direct or indirect, or

(b) any indirect or consequential loss or damage arising from or related to this Agreement,

howsoever caused and whether or not such losses are foreseeable, even if that party or its Affiliate has been advised (or is otherwise aware) of the possibility of such losses in advance.

11.3 Limitation of Restrictions. Nothing in this “Limitation of Liability” section shall exclude or limit the liability of either party or its Affiliates for death or personal injury caused by that party’s or its Affiliates’ negligence or for fraud or fraudulent misrepresentation or for any other liability to the extent that the same may not be excluded or limited as a matter of applicable law.

12. TERM AND TERMINATION

12.1 Term of Agreement. This Agreement commences on the date Customer first accepts it and continues until all Services hereunder have expired or have been performed or terminated.

12.2 Term of Purchased Subscriptions. The term of each subscription shall be as specified in the applicable Order Form. Except as otherwise specified in an Order Form, subscriptions will automatically renew for additional one-year terms, unless either party gives the other a written notice (email acceptable) at least 90 days before the end of the relevant subscription term. Except as expressly provided in the applicable Order Form, renewal of promotional or one-time priced subscriptions will be at Cerbos’s applicable list price in effect at the time of the applicable renewal. Notwithstanding anything to the contrary, any renewal in which subscription volume or subscription length for any Services has decreased from the prior term will result in re-pricing at renewal without regard to the prior term’s per-unit pricing.

12.3 Termination. A party may terminate this Agreement for cause (i) upon 30 days written notice to the other party of a material breach if such breach remains uncured at the expiration of such period, or (ii) if the other party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation or assignment for the benefit of creditors.

12.4 Refund or Payment upon Termination. If this Agreement is terminated by Customer in accordance with the “Termination” section above, Cerbos will refund Customer any prepaid fees covering the remainder of the term of all Order Forms after the effective date of termination. If this Agreement is terminated by Cerbos in accordance with the “Termination” section above, Customer will pay any unpaid fees covering the remainder of the term of all Order Forms to the extent permitted by applicable law. In no event will termination relieve Customer of its obligation to pay any fees payable to Cerbos for the period prior to the effective date of termination.

12.5 Surviving Provisions. The sections titled “Trial Usage,” “Fees and Payment,” “Proprietary Rights and Licences,” “Confidentiality,” “Disclaimers,” “Mutual Indemnification,” “Limitation of Liability,” “Refund or Payment upon Termination,” “Removal of Non-Cerbos Applications,” “Surviving Provisions” and “General Provisions” will survive any termination or expiration of this Agreement, and the section titled “Protection of Customer Data” will survive any termination or expiration of this Agreement for so long as Cerbos retains possession of Customer Data.

13. GENERAL PROVISIONS

13.1 Right to Update Agreement. Cerbos reserves the right to update this Agreement from time to time. Cerbos will publish the updated Agreement on Cerbos website. Cerbos shall notify Customer of the updated Agreement, including by referencing the current version of the Agreement when Cerbos invoices Customer. The updated Agreement will become binding on Customer upon the earlier of (a) 10 business day after Customer becoming aware of the updated Agreement as published on Cerbos website or (b) 10 business day after receiving notification of the updated Agreement. Customer’s continued use of the Services following the publication and the notification of the updated Agreement shall constitute Customer’s acceptance of the updated Agreement. If Customer does not accept the updated Agreement, Customer must notify Cerbos within 10 business days of becoming aware or being notified whichever is sooner, then the update shall not take place until the Customer’s next purchase of additional Services or the renewal of the Purchased Services.

13.2 Innovation. Customer recognises that Cerbos always seeks to innovate and find ways to improve the Services with new features and functions. Customer agrees that Cerbos may therefore change the Services (i) without notice provided such changes do not materially adversely affect the nature or quality of the Services or (ii) on written notice to Customer where such changes will materially adversely affect the nature or quality of the Services, provided that Customer shall have the right to terminate the Agreement on giving written notice to Supplier not more than one (1) month following any such change taking effect. Cerbos will refund Customer any prepaid fees covering the remainder of the term of all Order Forms after the effective date of termination.

13.3 Export Compliance. The Services, other Cerbos technology, and derivatives thereof may be subject to export laws and regulations of the United Kingdom and other jurisdictions. Cerbos and Customer each represent that it is not on any U.K. Sanction list.

13.4 Anti-Corruption. Neither party has received or been offered any illegal or improper bribe, kickback, payment, gift, or thing of value from an employee or agent of the other party in connection with this Agreement. Reasonable gifts and entertainment provided in the ordinary course of business do not violate the above restriction.

13.5 Entire Agreement and Order of Precedence. This Agreement is the entire agreement between Cerbos and Customer regarding Customer’s use of Services and supersedes all prior and contemporaneous agreements, proposals or representations, written or oral, concerning its subject matter. No representation, undertaking or promise shall be taken to have been given or be implied from anything said or written in negotiations between the parties prior to this Agreement except as expressly stated in this Agreement. Neither party shall have any remedy in respect of any untrue statement made by the other upon which that party relied on in entering this Agreement (unless such untrue statement was made fraudulently) and that party's only remedies shall be for breach of contract as provided in this Agreement. The parties agree that any term or condition stated in a Customer purchase order or in any other Customer order documentation (excluding Order Forms) is void. In the event of any conflict or inconsistency among the following documents, the order of precedence shall be: (1) the applicable Order Form, (2) Addenda to this Agreement including Product Addendum and Data Processing Addendum, (3) this Agreement, and (4) the Documentation. Titles and headings of sections of this Agreement are for convenience only and shall not affect the construction of any provision of this Agreement.

13.6 Relationship of the Parties. The parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the parties. Each party will be solely responsible for payment of all compensation owed to its employees, as well as all employment-related taxes.

13.7 Third-Party Beneficiaries. There are no third-party beneficiaries under this Agreement.

13.8 Waiver. No failure or delay by either party in exercising any right under this Agreement will constitute a waiver of that right.

13.9 Severability. If any provision of this Agreement is held by a court of competent jurisdiction to be contrary to law, the provision will be deemed null and void, and the remaining provisions of this Agreement will remain in effect.

13.10 Assignment. Neither party may assign any of its rights or obligations hereunder, whether by operation of law or otherwise, without the other party’s prior written consent (not to be unreasonably withheld); provided, however, either party may assign this Agreement in its entirety (including all Order Forms), without the other party’s consent to its Affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Notwithstanding the foregoing, (a) if a party is acquired by, sells substantially all of its assets to, or undergoes a change of control in favor of a direct competitor of the other party, then such other party may terminate this Agreement upon written notice. In the event of such a termination, Cerbos will refund Customer any prepaid fees covering the remainder of the term of all subscriptions for the period after the effective date of such termination. Subject to the foregoing, this Agreement will bind and inure to the benefit of the parties, their respective successors and permitted assigns.

13.11 Notices. Except as otherwise specified in this Agreement, all notices related to this Agreement will be in writing and will be effective upon (a) personal delivery, (b) the second business day after mailing, or (c) except for notices of termination or an indemnifiable claim (“Legal Notices”), the day of sending by email. Notices to Cerbos will be addressed to the attention of Legal team to Cerbos’s registered address, e-mail: [...]; or as updated by Cerbos via written notice to Customer. Billing-related notices to Customer will be addressed to the relevant billing contact designated by Customer, and Legal Notices to Customer will be addressed to Customer and be clearly identifiable as Legal Notices. All other notices to Customer will be addressed to a system administrator of the relevant Services designated by Customer.

13.12 Governing Law and Venue. This Agreement, and any disputes arising out of or related hereto, will be governed exclusively by the laws of England and Wales, the courts located in London, United Kingdom, will have exclusive jurisdiction over any dispute relating to this Agreement, and each party consents to the exclusive jurisdiction of those courts.

EXHIBIT A

SERVICE LEVEL AGREEMENT

1. APPLICABILITY

This Service Level Agreement (“SLA”) sets forth the service level terms and conditions for the Subscription Services provided by Cerbos branded as "Cerbos Hub" (the "Uptime SLA Services") and Proprietary Software as provided under the Master Services Agreement (“Agreement”) to which this SLA is attached. If there is any conflict between the terms and conditions of this SLA and the provisions of the Agreement, the provisions of this SLA shall prevail.

2. UPTIME COMMITMENT

2.1. Availability. Uptime SLA Services shall be available for at least 99 % of the time (i.e., 24 hours a day, seven days a week) computed over a calendar quarter (the "Uptime Commitment").

2.2. Exclusions. Specifically excluded from the calculation of the Uptime Commitment are:

a. planned downtime, including any scheduled maintenance (of which Cerbos shall give at least 24 hours‘ advance electronic notice),

b. any unavailability caused by circumstances beyond Cerbos’s reasonable control, including, for example, an act of God, act of government, flood, fire, earthquake, civil unrest, act of terror, strike or other labor problem (other than one involving Cerbos employees), denial of service attack, internet service provider failure or delay, or

c. downtime caused by Customer’s use of Uptime SLA Services (i) in breach of the Agreement, or Documentation, where applicable, or (ii) in connection with the software, hardware or equipment of third parties.

2.3. Remedies. If Cerbos fails to meet the Uptime Commitment, and Customer notifies Cerbos thereof within 15 days as of the end of the applicable calendar quarter, Customer will be eligible to receive a credit (“Service Credit”) calculated as a percentage of the quarterly amount of the Uptime SLA Services Fee as follows:

The applicable Service Credit to which Customer becomes eligible will be applied as a deduction of the amount due from Customer to Cerbos for charges for the affected Subscription Service in the next invoice. Additionally, if Cerbos breaches the Uptime Commitment in two consecutive calendar quarters or the availability is below 80% in one calendar quarter, Customer has a right to terminate the Agreement upon a written notification delivered to Cerbos within 15 days as of the end of the calendar quarter, and get a refund of any prepaid fees (if applicable) for the period as of the effective date of such termination. The remedies provided under this Section 2 are Customer’s sole and exclusive remedies for the breach of the Uptime Commitment.

3. STANDARD SUPPORT PROVIDED BY CERBOS.

3.1. Standard Support. Cerbos will provide webchat support for Customer’s support requests (“Support Request”) – web chat between 09:00 and 18:00 London time on weekdays, excluding English Bank and Public Holidays (“Business Hours”).

3.2. Standard Support Response time. Cerbos’s support shall make a good faith effort to respond to Customer within 3 business days regarding their support request.

4. ENTERPRISE SUPPORT

4.1. If Customer purchases the enterprise support from Cerbos, the following provisions shall apply.

4.2. Enterprise Support. Cerbos will provide webchat support for Customer’s support requests (“Support Request”) – web chat between 09:00 and 18:00 London time on weekdays, excluding English Bank and Public Holidays (“Business Hours”).

4.3. Named contacts. As part of Customer’s purchase of the Enterprise Support, Customer gets the right to name a certain number of individuals as its named contacts. Only the named contacts have the right to raise a Support Request for the Enterprise Support. A change in the named contact shall be notified to Cerbos 48 hours in advance and a change can be made only three (3) times a year. Further changes can be made only with Cerbos’s written consent.

4.4. Priority Levels and Enterprise Support Response times. Cerbos’ support levels and response times for individual Support Request may vary depending on the severity of the Support Request and the applicable priority level. Customer may include a priority level classification in its Support Request, final classification will however be determined by Cerbos at its sole discretion in accordance with the descriptions below. Cerbos will use commercially reasonable efforts to provide initial responses and recurring updates for individual Support Request within the response times indicated below.

4.5. Response time tracking. Times are measured from the time and date of logging of the relevant incident during Business Hours. In the case of an incident reported out of hours, the incident shall be measured from the start of the new period of service desk support with exception to Priority 1 issues that are monitored automatically 24/7.

4.6. Disclaimers. Cerbos does not guarantee that it will resolve all non-material or non-critical issues raised by Customer. Cerbos shall be under no obligation to provide support if Customer does not abide by the terms of the Agreement.