Master Subscription Agreement

1. Order Forms

Customer's use of the Service is set out in one or more order forms, quotes, or provisioning documents that reference this Agreement (each, an "Order Form"). An Order Form specifies the subscribed plan, device or seat count, fees, and subscription term, and forms part of this Agreement once signed by both parties. If an Order Form conflicts with this Agreement, the Order Form controls for that conflict.

2. Access and use

Subject to this Agreement and the applicable Order Form, we grant Customer a non-exclusive, non-transferable right to access and use the Service during the subscription term, for Customer's internal business operations. Customer may allow its personnel and contractors ("Authorized Users") to use the Service on Customer's behalf; Customer is responsible for their compliance with this Agreement.

Customer may not: resell, sublicense, or make the Service available to third parties outside its own organization; reverse engineer or attempt to extract source code from the agent or dashboard, except to the extent applicable law prohibits this restriction; use the Service to build a competing product; or circumvent usage limits in the Order Form.

3. Customer Data and AI traffic processing

3.1 Customer Data. "Customer Data" means data Customer or its Authorized Users submit to the Service, and data the Alectura agent captures from devices Customer enrolls, including device/diagnostic data and, for AI endpoints in Alectura's deep-capture set, the content of AI prompts, tool calls, and related traffic ("Captured Content"). As between the parties, Customer owns Customer Data. We process Customer Data only to provide, secure, and support the Service, on Customer's instructions as set out in this Agreement and Customer's own configuration of the Service (including which devices are enrolled, which policies apply, and configured retention settings).

3.2 Customer's responsibility for consent and notice. The Service is designed to inspect network traffic on devices Customer enrolls. For the deep-capture endpoints identified in our documentation, this includes decrypting and capturing the content of that traffic. Customer represents and warrants that it has all rights, consents, and legal basis necessary under applicable law (including any employee notice, works council consultation, or monitoring-disclosure requirements in its jurisdiction) to deploy the Service on those devices and to authorize our processing of the resulting Captured Content, and that it will provide any notices to its personnel that applicable law requires. Customer is solely responsible for its decisions about which devices to enroll and which AI usage to monitor.

3.3 Data Processing Agreement. To the extent Customer Data includes personal data subject to GDPR, UK GDPR, or similar law, the parties will enter into a data processing addendum on request, which will be incorporated into this Agreement by reference.

4. Hosting and sub-processors

The Service is hosted on infrastructure provided by third parties (currently Amazon Web Services). We may use other sub-processors to provide the Service, consistent with our Privacy Policy. We remain responsible for sub-processors' performance of the obligations they perform on our behalf.

5. Security

We maintain administrative, technical, and physical safeguards designed to protect Customer Data, including encryption in transit and at rest, access controls, and tenant isolation between customers. Further detail is available on request.

6. Customer responsibilities

Customer will: (a) keep its account credentials confidential and be responsible for activity under its account; (b) use the Service in compliance with applicable law, including data protection and export control law; (c) not use the Service to capture or process data it doesn't have the right to capture or process; and (d) promptly notify us of any unauthorized use of its account or suspected security incident involving the Service.

7. Fees and payment

Customer will pay the fees specified in the applicable Order Form. Unless the Order Form states otherwise, fees are invoiced in advance and due within thirty (30) days of invoice date. Late amounts may accrue interest at the lesser of 1.5% per month or the highest rate allowed by law. Fees are exclusive of taxes; Customer is responsible for all applicable taxes other than taxes on our net income. Fees are non-refundable except as this Agreement expressly states.

8. Term, renewal, and termination

8.1 Term. This Agreement starts on the date of the first Order Form and continues until all Order Forms have expired or been terminated. Each Order Form's subscription term is as stated in that Order Form and renews automatically for successive terms of the same length unless either party gives written notice of non-renewal at least thirty (30) days before the then-current term ends, or the Order Form states otherwise.

8.2 Termination for cause. Either party may terminate this Agreement or an Order Form if the other party materially breaches it and doesn't cure the breach within thirty (30) days of written notice.

8.3 Effect of termination. On termination, Customer's access to the Service ends. We'll make Customer Data available for export for thirty (30) days following termination, after which we may delete it, unless a longer retention period is required by law or agreed in writing.

9. Ownership

9.1 The Service. As between the parties, we own the Service, including the agent software, dashboard, and all underlying technology, and all intellectual property rights in them. This Agreement grants Customer no rights to the Service other than those expressly stated.

9.2 Customer Data. As stated in Section 3.1, Customer owns Customer Data.

9.3 Feedback. If Customer gives us feedback or suggestions about the Service, we may use it without restriction or obligation to Customer.

10. Confidentiality

Each party may receive non-public business, technical, or product information from the other ("Confidential Information"). The receiving party will use Confidential Information only to perform under this Agreement, protect it with the same degree of care it uses for its own similar information (and no less than reasonable care), and not disclose it except to personnel and advisors who need it and are bound to confidentiality obligations at least as protective as this Agreement.

These obligations don't apply to information that's public through no fault of the receiving party, already known to it without confidentiality obligation, independently developed, or lawfully received from a third party. A party may disclose Confidential Information if required by law, provided it gives the other party reasonable notice where legally permitted. Customer Data, including Captured Content, is Customer's Confidential Information.

11. Warranties and disclaimers

We warrant that the Service will materially conform to our then-current documentation. Customer's exclusive remedy for breach of this warranty is that we'll correct the non-conformance or, if we can't do so within a reasonable time, either party may terminate the affected Order Form for a pro-rated refund of prepaid, unused fees.

EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE SERVICE IS PROVIDED "AS IS," AND WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DON'T WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT IT WILL DETECT OR PREVENT EVERY SECURITY INCIDENT OR POLICY VIOLATION.

12. Indemnification

12.1 By us. We'll defend Customer against a third-party claim alleging that the Service, as provided by us, infringes that third party's intellectual property rights, and will indemnify Customer for damages finally awarded, provided Customer promptly notifies us of the claim, gives us control of the defense, and cooperates with us. This obligation doesn't apply to claims arising from Customer's modification of the Service, use in combination with products we didn't provide, or use outside the scope of this Agreement.

12.2 By Customer. Customer will defend and indemnify us against a third-party claim arising from Customer's breach of Section 3.2 (Customer's responsibility for consent and notice), Customer Data, or Customer's use of the Service in violation of this Agreement, on the same procedure as Section 12.1.

13. Limitation of liability

EXCEPT FOR BREACHES OF SECTION 10 (CONFIDENTIALITY), A PARTY'S INDEMNIFICATION OBLIGATIONS, OR CUSTOMER'S PAYMENT OBLIGATIONS, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOST PROFITS OR REVENUE, ARISING OUT OF THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY. EACH PARTY'S TOTAL LIABILITY ARISING OUT OF THIS AGREEMENT WILL NOT EXCEED THE FEES CUSTOMER PAID TO US IN THE TWELVE (12) MONTHS BEFORE THE CLAIM AROSE.

Nothing in this Agreement limits either party's liability for gross negligence, willful misconduct, or fraud, or excludes liability that can't be limited under applicable law.

14. Governing law and venue

This Agreement is governed by the laws of New South Wales, Australia, without regard to conflict-of-law principles. The parties submit to the exclusive jurisdiction of the courts of New South Wales, Australia, for any dispute arising out of this Agreement.

15. General

Assignment. Neither party may assign this Agreement without the other's written consent, except to a successor in a merger, acquisition, or sale of substantially all assets; either party may terminate this Agreement if it reasonably objects to an assignment to a direct competitor.

Force majeure. Neither party is liable for delay or failure to perform caused by events beyond its reasonable control.

No third-party beneficiaries. This Agreement doesn't create rights for anyone other than the parties.

Notices. Notices under this Agreement must be in writing and sent to the contact listed on the applicable Order Form, or to hello@alecturalabs.com for notices to us.

Entire agreement. This Agreement, together with all Order Forms, is the entire agreement between the parties regarding the Service and supersedes prior agreements on the subject. Amendments must be in writing and signed by both parties, except that we may update this Agreement's general terms (not pricing or Order Form terms) with thirty (30) days' notice; continued use after that period constitutes acceptance.

Severability. If a provision of this Agreement is unenforceable, the rest remains in effect.

16. Definitions

"Order Form": see Section 1.

"Customer Data" and "Captured Content": see Section 3.1.

"Service": the Alectura endpoint agent and web dashboard, as described in Alectura's then-current documentation.

"Authorized Users": see Section 2.