Purchase Terms & Terms of Service

These Purchase Terms and Terms of Service (these "Terms") are entered into by and between Cyvatar AI Holdings LLC, a Delaware limited liability company with a principal place of business at 6230 Irvine Blvd, Suite 160, Irvine, California 92620 ("Cyvatar"), and the person or entity identified on the signature page of the Cyvatar Order Form (the "Client"), and also govern access to and use of the Cyvatar website at cyvatar.ai by any visitor or user.

For Clients executing a Cyvatar Order Form, these Terms are effective as of the date that both Client and Cyvatar have executed the Order Form, or, if on different dates, the later of the two dates shall apply (the "Effective Date"), and are subject at all times to Client's additional compliance with the Cyvatar Conditions of Use (set forth in Section IV below), the Privacy Policy, and any executed Master Service Agreement ("MSA"), each of which is incorporated by reference herein. Capitalized terms used herein but not defined shall have the meaning given to them in the MSA.

I. Warranty by Client

The "Quantity" selected by Client on the Order Form shall be based on the number of endpoints, devices, users, or accounts (collectively "Assets") that are managed or monitored by Cyvatar in connection with the delivery of the relevant Cyvatar Cybersecurity Solution. As of the Effective Date, the Client represents that the Quantity that is reflected in the Order is accurate and not less than the actual number of employees or contractors which Assets will be required to be managed or monitored as part of the relevant solution.

II. Solution Descriptions (Detailed Description of the Cyvatar Cybersecurity Solution Purchased); Third Party Products

Below are the various "Solution Descriptions" correlating with the various Cyvatar Cybersecurity Solutions available for purchase. If Client has any trouble accessing any relevant Solution Description, Client may request from Cyvatar a copy for its review prior to executing the Order Form. The applicable Solution Description shall define the scope of Professional Services and any deliverables, including a list of potential Third Party Products which might be licensed and resold to Customer in connection with the delivery of the Solution. Notwithstanding anything else, the relevant Solution Description(s) will define the total scope of work and deliverables to be provided by Cyvatar in connection with the purchase of the subscription to the relevant Solution.

Also linked below are the relevant Third Party Terms that Client will need to agree to be bound to prior to installation of the Third Party Product(s). The specific choice of Third Party Product(s) to be resold and licensed in connection with the Solution shall be determined by the number and type of Assets monitored and/or managed as part of the Solution, Client's technical requirements, and recommendations of Cyvatar after discussions with Client. The final list of Third Party Product(s) actually licensed and resold to Client as part of delivery of the Solution shall be approved by the Client. For clarity, Cyvatar is required to pass through Third Party Terms to the Client as part of reselling license to the relevant Third Party Product(s) to the Client and by executing the Order Form the Client acknowledges and agrees that it has reviewed the relevant Third Party Terms and, depending on the final approved list of Third Party Products approved by Client, Client assents to the relevant Third Party Terms as part of that approval and prior to the installation of the relevant Third Party Product(s).

For clarity, and notwithstanding the inclusion of links to Solutions not purchased and links to Third Party Terms relating to Third Party Product listed below which are not ultimately approved by Client for installation, only the Solution Description(s) associated with the Cyvatar Cybersecurity Solution purchased by Client (as identified in the Order Form) shall be incorporated into these Terms and delivered by Cyvatar to Client and only the relevant Third Party Terms which are associated with the Third Party Product(s) actually approved for installation on Client systems shall be applicable to the Client's purchase.

• Threat and Vulnerability Management (TVM)
• Secure Endpoint Management (SEM)
• Cloud SaaS Management (CSM)
• Security Awareness Training and Testing (SAT)
• Mobile Threat Defense (MTD)
• IT Asset Management (ITAM)
• Email Security Management (ESM)
• DNS Security Management (DSM)
• Incident Response Retainer Management (IRM)
• Multi-Factor Authentication (MFA)
• Extended Detection and Response (XDR)
• User Account Monitoring (UAM)
• Agentic vCISO & Compliance Program Management

Current Solution Descriptions and corresponding Third Party Terms are available on request from getoutcomes@cyvatar.ai.

III. Invoicing; Fees

Cyvatar may issue invoices for the fees due under the Order Form on the Effective Date and upon renewal. All fees payable to Cyvatar under the Order Form (collectively "Fees") are payable in U.S. dollars and are due upon delivery of Cyvatar's invoice. Cyvatar reserves the right to adjust the amount of the Fees between renewal terms and at Cyvatar's sole discretion. Unless otherwise specified in the Agreement, the Order is non-cancelable, and all Fees paid are non-refundable. Client will be responsible for any and all taxes due thereunder (except Cyvatar income taxes), including any sales, VAT, GST, duties and custom fees, and use taxes (if relevant), unless Client provides appropriate resale certificates, direct pay permits or exemption certificates to Cyvatar. Past due accounts will be charged interest on a monthly basis, calculated at one and one-half percent (1.5%) per month of the unpaid balance or the maximum rate allowable by law.

IV. Acceptance & Website Use (Conditions of Use)

You accept these Terms by (a) clicking an "I agree" or similar button, (b) executing an Order Form that references these Terms, or (c) accessing or using the Cyvatar website or Services. If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity. If you do not have such authority, or if you do not agree with these Terms, you must not access or use the Services.

You must be at least 18 years old and capable of forming a legally binding contract to use the Services. You agree not to (a) reverse engineer, decompile, or attempt to derive source code from the Services except to the extent permitted by law; (b) resell, sublicense, or make the Services available to third parties except as expressly authorized; (c) use the Services to develop a competing product; or (d) introduce malware, conduct unauthorized testing, or otherwise attempt to compromise the Services or the Cyvatar website.

V. Customer Obligations

To maintain the security and effectiveness of the Services — and consistent with cyber-insurance underwriting requirements that may apply to Customer's environment — Customer agrees to:

• Enable multi-factor authentication (MFA) on all administrative accounts, email accounts, remote-access systems, and any other identity systems integrated with the Services. Customer acknowledges that MFA is an industry-standard control and a common requirement of cyber-insurance carriers.
• Apply security patches for operating systems, applications, and firmware on a reasonable cadence consistent with vendor guidance and Customer's documented patch policy. Critical and high-severity vulnerabilities should be remediated within commercially reasonable timeframes.
• Maintain accurate Unit counts and notify Cyvatar of material changes to the protected environment (mergers, acquisitions, divestitures, large-scale endpoint additions or decommissions).
• Provide reasonable cooperation with Cyvatar's onboarding, deployment, and ongoing service activities, including timely access to systems, points of contact, and information necessary to deliver the Services.
• Use the Services lawfully and only for Customer's internal business purposes. Customer will not (a) reverse engineer, decompile, or attempt to derive source code from the Services except to the extent permitted by law; (b) resell, sublicense, or make the Services available to third parties except as expressly authorized; (c) use the Services to develop a competing product; or (d) introduce malware, conduct unauthorized testing, or attempt to compromise the Services.
• Safeguard credentials and promptly notify Cyvatar of any suspected unauthorized access.
• Comply with applicable law, including data protection, export control, and sanctions laws applicable to Customer's use of the Services.

Customer acknowledges that the effectiveness of managed cybersecurity services depends on Customer's cooperation and adherence to these obligations. Cyvatar's service-level commitments and any remediation obligations are conditioned on Customer's good-faith compliance with this Section.

VI. Cyvatar Obligations

Cyvatar will:

• Provide the Services described in the Order in a professional and workmanlike manner, consistent with generally accepted industry standards for managed cybersecurity providers.
• Maintain reasonable administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, disclosure, alteration, and destruction.
• Use commercially reasonable efforts to make the Services available in accordance with any service-level commitments in the Order, excluding scheduled maintenance, force majeure events, and outages caused by Customer or third-party systems outside Cyvatar's control.
• Notify Customer without undue delay of any confirmed Security Incident affecting Customer Data, in accordance with applicable law and the Order.
• Process personal data on Customer's behalf consistent with the Privacy Policy at cyvatar.ai/privacy.html and any executed Data Processing Addendum.

VII. Intellectual Property

Cyvatar IP. Cyvatar and its licensors retain all right, title, and interest in and to the Services, including all software, models, methodologies, dashboards, reports, runbooks, playbooks, and documentation, and any improvements, modifications, or derivatives thereof (collectively, "Cyvatar IP"). No rights are granted to Customer except the limited, non-exclusive, non-transferable right to use the Services during the subscription term as set forth in these Terms and the Order.

Customer Data. As between the parties, Customer retains all right, title, and interest in and to Customer Data. Customer grants Cyvatar a worldwide, non-exclusive, royalty-free license to access, use, process, transmit, and disclose Customer Data solely as necessary to provide the Services, comply with law, and improve the Services consistent with the Privacy Policy.

Aggregated & De-Identified Data. Cyvatar may generate aggregated, de-identified, or anonymized data derived from Customer's use of the Services ("Aggregated Data") and may use Aggregated Data for any lawful business purpose, including service improvement, benchmarking, and threat intelligence, provided that Aggregated Data does not identify Customer or any individual.

Feedback. If Customer provides suggestions or feedback about the Services, Cyvatar may use that feedback without restriction or obligation.

VIII. Confidentiality

"Confidential Information" means non-public information disclosed by one party ("Discloser") to the other ("Recipient") that is identified as confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure. Customer Data is Customer's Confidential Information; Cyvatar IP, pricing, and non-public security findings are Cyvatar's Confidential Information.

Recipient will (a) use Confidential Information only to perform under these Terms, (b) protect it with at least the same care it uses for its own confidential information of similar importance (and no less than reasonable care), and (c) limit access to personnel and contractors who need to know and are bound by confidentiality obligations no less protective than these.

Confidentiality obligations do not apply to information that is or becomes public through no fault of Recipient, was rightfully known without restriction, is independently developed without use of Confidential Information, or is rightfully received from a third party without restriction. Recipient may disclose Confidential Information as required by law, provided it gives Discloser prompt notice (where legally permitted) and reasonable cooperation to seek protective treatment.

IX. Warranties & Disclaimers

Mutual. Each party represents and warrants that it has the legal authority to enter into these Terms.

Cyvatar warranty. Cyvatar warrants that the Services will be performed in a professional and workmanlike manner consistent with generally accepted industry standards. Customer's exclusive remedy, and Cyvatar's sole obligation, for breach of this warranty is for Cyvatar to use commercially reasonable efforts to re-perform the deficient Services or, if Cyvatar is unable to do so, to refund the fees paid for the deficient portion of the Services.

Disclaimer. EXCEPT FOR THE EXPRESS WARRANTIES IN THIS SECTION, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." CYVATAR DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. CYVATAR DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT THEY WILL DETECT, PREVENT, OR REMEDIATE ALL CYBERSECURITY THREATS.

X. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, BUSINESS INTERRUPTION, OR COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

EACH PARTY'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS — WHETHER IN CONTRACT, TORT, OR OTHERWISE — WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO CYVATAR UNDER THE APPLICABLE ORDER DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

The foregoing limitations do not apply to (a) Customer's payment obligations, (b) either party's indemnification obligations, (c) breach of confidentiality obligations, or (d) liability that cannot be limited under applicable law.

XI. Indemnification

By Cyvatar. Cyvatar will defend Customer against any third-party claim alleging that the Services, as provided by Cyvatar and used in accordance with these Terms, infringe a U.S. patent, copyright, or trademark, and will pay damages and costs finally awarded against Customer (or agreed in settlement). If the Services are or are likely to be enjoined, Cyvatar may, at its option, (i) procure the right for Customer to continue use, (ii) modify the Services to be non-infringing, or (iii) terminate the affected Services and refund any pre-paid, unused fees. Cyvatar has no obligation for claims arising from (a) Customer Data, (b) modifications not made by Cyvatar, (c) combination of the Services with non-Cyvatar products, or (d) use after notice of alleged infringement.

By Customer. Customer will defend Cyvatar against any third-party claim arising from (a) Customer Data, (b) Customer's breach of Section V (Customer Obligations), or (c) Customer's violation of applicable law in using the Services, and will pay damages and costs finally awarded (or agreed in settlement).

Procedure. The indemnified party will promptly notify the indemnifying party of the claim, give the indemnifying party sole control of defense and settlement (provided no settlement imposes liability on the indemnified party without consent), and provide reasonable cooperation.

XII. Term & Termination

These Terms remain in effect during the subscription term set forth in the Order and any renewal terms.

• Termination for cause. Either party may terminate these Terms or the affected Order on written notice if the other party materially breaches and fails to cure within thirty (30) days of written notice (or ten (10) days for non-payment).
• Termination for insolvency. Either party may terminate immediately if the other becomes insolvent, makes an assignment for the benefit of creditors, or becomes subject to bankruptcy proceedings not dismissed within sixty (60) days.
• Effect. Upon termination, Customer's right to use the Services ends. Cyvatar will, on Customer's written request made within thirty (30) days of termination, make Customer Data available for export in a commercially reasonable format. After that period, Cyvatar may delete Customer Data consistent with its retention policies and applicable law.
• Survival. Sections III (for amounts owed), VII, VIII, IX, X, XI, XIII, XIV, and any other provisions that by their nature should survive, will survive termination.

XIII. Governing Law

These Terms are governed by the laws of the State of Delaware, United States, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

XIV. Dispute Resolution

Informal resolution. Before filing a claim, the parties agree to attempt to resolve any dispute informally by good-faith negotiation between authorized representatives for at least thirty (30) days following written notice of the dispute.

Binding arbitration. If the dispute is not resolved informally, the parties agree to resolve it by binding arbitration administered by JAMS under its Comprehensive Arbitration Rules and Procedures, before a single arbitrator. The seat of arbitration is Wilmington, Delaware. The arbitrator's award is final and may be entered in any court of competent jurisdiction.

Exceptions. Either party may bring an action in court for injunctive or equitable relief to protect intellectual property rights or Confidential Information.

No class actions. Disputes will be resolved only on an individual basis and not as part of any class, consolidated, or representative action.

XV. Modifications

Cyvatar may update these Terms from time to time. Material changes will be communicated by posting the updated Terms at this URL with a new "Last Modified" date and, where appropriate, by email or in-product notice. Continued use of the Services after the effective date of an update constitutes acceptance of the updated Terms. If a change materially and adversely affects Customer's rights, Customer may terminate the affected Order on written notice within thirty (30) days of the change, with a pro-rata refund of any pre-paid, unused fees.

For Customers under a signed Order, Cyvatar will not make changes that materially reduce the Services or commitments set forth in that Order during its then-current term without Customer's consent.

XVI. General

Entire agreement. These Terms, together with the applicable Order and the Privacy Policy, constitute the entire agreement between the parties regarding the Services and supersede prior or contemporaneous agreements on that subject.

Assignment. Neither party may assign these Terms without the other's prior written consent, except that either party may assign without consent in connection with a merger, acquisition, or sale of substantially all assets, provided the assignee assumes all obligations.

Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, labor disputes, internet or utility outages, or governmental action.

Notices. Notices to Cyvatar must be sent to getoutcomes@cyvatar.ai. Notices to Customer will be sent to the email address on the applicable Order or account record.

Severability. If any provision is held unenforceable, the remaining provisions remain in effect, and the unenforceable provision will be modified to the minimum extent necessary to be enforceable.

No waiver. Failure to enforce any right is not a waiver of that right.

Independent contractors. The parties are independent contractors. Nothing in these Terms creates a partnership, agency, or employment relationship.

XVII. Contact

Questions about these Terms or the Services? Reach out: