ETHICOMPASS SERVICES

1.1 "Services" means EthiCompass Proof and, where contracted with it, the governance scope, together with any associated Documentation, application programming interfaces, dashboards, reports, or other materials provided by Company.

1.2 "Subscription Term" means the period specified in the applicable Order Form during which Customer may access and use the Services.

1.3 "Customer Data" means the configuration, credentials, knowledge bases and other materials that Customer supplies to the Services, together with the inputs the Services send to the Target System and the responses the Target System returns. Customer Data is created and held within Customer's own environment, as described in Section 5.

1.4 "Documentation" means user guides, help articles, technical specifications, and other written materials provided by Company relating to the Services.

1.5 "Order Form" means the ordering document executed by the parties that specifies the Services to be provided, fees, and other commercial terms.

1.6 "Target System" means the artificial intelligence system that Customer operates and exposes for evaluation, identified in the Testing Authorisation.

1.7 "Testing Authorisation" means the written authorisation described in Section 3.4, without which no instance of the Services is provisioned or activated.

1.8 "Evaluation Record" means the record of the inputs sent to the Target System and of the responses observed, which constitutes the evidence supporting each finding reported.

2.1 License Grant. Subject to the terms and conditions of this Agreement, Company hereby grants to Customer a limited, non-exclusive, non-sublicensable, non-transferable license during the Subscription Term to access and use the Services solely for Customer's internal business purposes.

2.2 Use Restrictions. Customer shall not, and shall not permit any third party to:

3.1 EthiCompass Proof. Independent adversarial evaluation of the Target System. Company directs adversarial inputs at an interface Customer exposes for that purpose, observes how the Target System responds, and classifies the behaviour observed across the eight dimensions of the EthiCompass model. Deliverables are: the classification of observed behaviour across those dimensions; the occurrence rate per dimension over the agreed number of runs; a coverage report stating what was exercised and what was not; and the Evaluation Record supporting each finding.

3.2 Governance scope (optional). Where contracted with EthiCompass Proof, the governance scope projects the evidence the Services produce into the frameworks Customer answers to, and maintains the inventory, documentation and audit packages built on that evidence. It is an option of EthiCompass Proof, is ordered on the same Order Form, and is not available on its own.

3.3 What the Services do not provide. The Services report observed behaviour and the evidence of it. They do not issue a verdict, a pass, a certification, an attestation of conformity, or a legal or regulatory opinion, and nothing in the deliverables may be presented as any of those. A coverage report states the boundary of what was exercised; behaviour outside that boundary was not evaluated, and the absence of a finding is not a representation that no such behaviour exists.

3.4 Testing Authorisation. The Services operate by directing adversarial inputs at a system Customer controls. No instance of the Services is provisioned or activated until Customer has delivered a written authorisation, in the form Company requires and executed by a person with authority to bind Customer, which at a minimum: (a) identifies the Target System and the interface exposed for evaluation; (b) states that Customer owns or is otherwise entitled to authorise adversarial testing of that system, and that it has obtained any consent required from any third party whose model, infrastructure or terms of service govern it; (c) confirms that the interface exposed is a non-production environment, segregated from live operations and from production personal data; (d) states the scope of the authorised attack and the time window within which it may be conducted; (e) designates Customer's technical contact; and (f) acknowledges the retention and export terms of Section 5.4. No run shall be executed outside the scope or the time window so authorised, and Company may refuse or suspend provisioning where the authorisation is absent, incomplete or withdrawn.

3.5 Deployment. The Services are delivered as container images and run entirely within Customer's own environment, on premises or in Customer's own cloud account, in accordance with the deployment requirements Company publishes. Customer is responsible for providing infrastructure that meets those requirements.

4.1 Fees. All fees for the Services are as set forth in the applicable Order Form and are payable in United States dollars.

4.2 Payment Terms.

4.3 Late Payment. Any amounts not paid when due shall accrue interest at the rate of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law, whichever is less, plus all reasonable costs of collection.

4.4 Taxes. Customer shall be responsible for all applicable federal, state, local, and foreign taxes, duties, tariffs, assessments, and governmental charges (collectively, "Taxes"), excluding only taxes based on Company's net income.

5.1 Customer Data Ownership. Customer retains all right, title, and interest in and to Customer Data.

5.2 Company does not process Customer Data. The Services are deployed and executed entirely within Customer's own environment. Company neither hosts, receives nor retains Customer Data, including the inputs sent to the Target System, the responses it returns and the Evaluation Record, and accordingly does not act as a processor in respect of them. Customer remains the controller of all personal data present in its environment. Where Company is exceptionally given access to such data in the course of a support request under Section 6, that access occurs solely on Customer's documented instruction, is limited to what the request requires, and is governed by a written processing instrument executed for that purpose. Each party shall comply with applicable data protection laws, including, as applicable, the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

5.3 Security Measures. Because the Services run within Customer's environment, Customer maintains control over all data storage and security measures. Company is responsible for the integrity of the container images it delivers, which are identified by digest so that Customer can verify what it runs.

5.4 Evaluation Record. The Evaluation Record is produced and held within Customer's own environment and under Customer's control; no copy is transmitted to or retained by Company. Retention is a configuration of Customer's instance, set by Customer, with thirty (30) calendar days from the conclusion of the engagement as the configured maximum Company recommends. The Evaluation Record is exportable by Customer in a machine-readable format, and is deleted on expiry of the configured period or earlier at Customer's instruction. Because it never leaves Customer's environment, Company cannot restore, reproduce or attest to an Evaluation Record that Customer has deleted, and the Services are not Customer's system of record.

6.1 What is supported, and what Company can see. The Services run inside Customer's environment and require no egress to operate. Company has no remote access to, and no telemetry from, any Customer installation. Accordingly, Company cannot detect an incident by itself, and every ticket begins with Customer reporting it; and Company cannot diagnose an installation it cannot observe, so response times run from receipt of a ticket accompanied by the diagnostic information described in Section 6.2.

6.2 Support channels, hours and tickets. Support is provided by email at support@ethicompass.com and through the ticketing system Company provisions, during business hours of 9:00 AM to 6:00 PM United States Eastern Time, Monday to Friday, excluding United States federal holidays. Tickets received outside business hours are treated as received at the start of the next business hour. A ticket is complete, and the response clock starts, when it carries the deployed image digests, the engagement manifest reference, the run identifier where applicable, the logs and diagnostic output produced by the deployment, and a description of the behaviour observed against the behaviour expected. Customer exports these from its own environment; Company cannot collect them.

6.3 Response commitments. Initial response times are four (4) business hours for a deployment that cannot start or cannot complete a run; eight (8) business hours where runs complete but the result is not usable as evidence; forty-eight (48) business hours for partial impact with a workaround available; and five (5) business days for cosmetic or documentation issues. This Section commits response times only. It does not commit resolution times, and it contains no availability or uptime commitment, because Company neither hosts nor operates the installation.

6.4 Releases and updates. Updates are delivered as container images identified by digest, which Customer pulls into its own registry and applies on its own schedule. There is no automatic update, and Company shall not require internet access as a condition of support. Company supports the current release and the one immediately preceding it.

6.5 Exclusions. Support does not cover: the Target System, whose availability, latency, behaviour, exposed endpoint and credentials are Customer's responsibility, so that a target which is unreachable or which rate-limits the Services is not a Service incident; infrastructure below the published deployment requirements, including model roles that are not provisioned, where Company's obligation is limited to identifying the shortfall; disagreement with a finding, a classification or an occurrence rate, which is not a support matter and for which the Evaluation Record exists; improper use, unauthorised modifications, or packs or code introduced by Customer; and any engagement conducted without a valid Testing Authorisation or outside the scope or time window it authorises.

7.1 Limited Warranty. Company warrants that the Services will materially conform to the applicable Documentation during the Subscription Term.

7.2 DISCLAIMER OF WARRANTIES. EXCEPT FOR THE LIMITED WARRANTY SET FORTH IN SECTION 7.1, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." COMPANY HEREBY DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

7.3 Artificial intelligence models. The artificial intelligence models distributed with or used by the Services are licensed by their respective providers and are passed through to Customer "AS IS", on, and limited to, the terms and warranties the model provider itself offers. Company gives no warranty of its own as to those models' outputs, accuracy, fitness for a particular purpose or non-infringement beyond what the applicable model licence grants, and the indemnity in Section 9.1 does not extend to claims arising from the models as licensed by their providers.

7.4 No warranty of completeness. Company does not warrant that the Services will identify every vulnerability, failure mode or undesirable behaviour of the Target System. The Services report what was observed within the coverage the engagement exercised, and the coverage report states that boundary.

8.1 EXCLUSION OF DAMAGES. IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING WITHOUT LIMITATION LOSS OF PROFITS, LOSS OF GOODWILL, LOSS OF DATA, OR BUSINESS INTERRUPTION, REGARDLESS OF THE THEORY OF LIABILITY AND WHETHER OR NOT SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

8.2 LIABILITY CAP. COMPANY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL AMOUNTS PAID BY CUSTOMER TO COMPANY FOR THE SERVICES GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO LIABILITY.

9.1 Company Indemnification. Company shall defend, indemnify, and hold harmless Customer from and against any third-party claims alleging that the Services infringe any United States patent, copyright, or trademark, and shall pay all damages finally awarded against Customer by a court of competent jurisdiction or agreed to in settlement, provided that Customer: (a) promptly notifies Company in writing of such claim; (b) grants Company sole control of the defense and settlement thereof; and (c) provides reasonable cooperation in the defense of such claim.

9.2 Customer Indemnification. Customer shall defend, indemnify, and hold harmless Company from and against any third-party claims arising out of or relating to: (a) Customer Data; (b) Customer's use of the Services in violation of this Agreement; (c) Customer's violation of applicable law; or (d) any evaluation conducted against a system Customer was not entitled to authorise, or outside the scope or time window of the Testing Authorisation, and shall pay all damages finally awarded against Company by a court of competent jurisdiction or agreed to in settlement.

10.1 Termination for Convenience. Either party may terminate this Agreement at the expiration of the then-current Subscription Term by providing thirty (30) days' prior written notice to the other party.

10.2 Termination for Cause. Either party may terminate this Agreement immediately upon written notice if the other party materially breaches this Agreement and fails to cure such breach within fifteen (15) days after receiving written notice thereof.

10.3 Effect of Termination. Upon termination of this Agreement: (a) Customer's right to access and use the Services shall immediately cease; and (b) Company shall delete or disable access to Customer Data within thirty (30) days, unless retention is required by applicable law.

11.1 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles.

11.2 Jurisdiction and Venue. Any legal action or proceeding arising out of or relating to this Agreement shall be instituted exclusively in the state or federal courts located in Wilmington, Delaware, and each party hereby consents to the personal jurisdiction of such courts.

12.1 Entire Agreement. This Agreement, together with any applicable Order Forms, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations, and discussions.

12.2 Amendment. Company may modify this Agreement from time to time by providing thirty (30) days' prior notice via posting on Company's website or other reasonable means. Customer's continued use of the Services after such notice period shall constitute acceptance of the modified Agreement.

12.3 Assignment. Neither party may assign this Agreement without the prior written consent of the other party, except that either party may assign this Agreement to a successor in interest in connection with a merger, acquisition, or sale of all or substantially all of its assets.

12.4 Notices. All notices required or permitted hereunder shall be in writing and shall be sent tolegal@ethicompass.com (for notices to Company) or to the address specified in the applicable Order Form (for notices to Customer).

12.5 Severability. If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

12.6 Waiver. No waiver of any provision of this Agreement shall be deemed or shall constitute a waiver of any other provision.