Hexes Customer Agreement

Version 1.0 · Effective date: 2026-11-11

This Hexes Customer Agreement (the "Agreement") is between Hexes Security, Inc., a Delaware corporation with offices at 2261 Market Street STE 68751, San Francisco, CA 94114, USA, and the entity or person that accepts it ("Customer", "you"). It governs Customer's access to and use of the Offerings (defined below), however obtained: directly from Hexes Security, Inc., through a Partner, or through a cloud marketplace.

Acceptance. You accept this Agreement on the earliest of: (a) signing an Order that references it; (b) clicking or checking a box to accept it; or (c) downloading, installing, activating, accessing or using any Offering, including for evaluation. If you accept on behalf of a company or other legal entity, you represent that you have authority to bind it, and "Customer" means that entity. If you do not have that authority, or do not agree, do not accept this Agreement and do not use the Offerings.

Business use only. The Offerings are provided for business use only. Customer represents that it is acquiring and using them for the purposes of its trade, business or profession, and not as a consumer.

---

1. Definitions

Capitalized terms have the meanings below or where they are first defined.

• "Affiliate": any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where "control" means ownership of more than 50% of the voting interests, for so long as that control exists.
• "Authorized User": an employee or individual contractor of Customer or its Affiliates whom Customer permits to use an Offering for Customer's benefit.
• "Cloud Services": any Offering that Hexes Security, Inc. hosts or operates and makes available over a network, if and when made available and listed in an Order.
• "Acceptable Use Policy": the Hexes Acceptable Use Policy published at hexessecurity.com/legal/acceptable-use-policy (or a successor location), as updated under Section 17.3.
• "Customer Data": data, content and information that Customer or its Authorized Users submit to or process with an Offering, including workload, network, process, file, policy and configuration data from Customer's environments, and Support Materials. Customer Data does not include Usage Data.
• "Documentation": Hexes Security, Inc.'s then-current user guides, release notes, technical specifications and the Support Policy for an Offering, as published or provided by Hexes Security, Inc.
• "Entitlement": the scope of use Customer purchased, as stated in an Order and enforced by a license key or entitlement file, including the Subscription Term, the product edition, and the licensing metric and quantity (for example, nodes, clusters or workloads).
• "Evaluation Offering": any Offering provided free of charge for trial, evaluation, proof of concept or demonstration, or designated as an evaluation in an Order.
• "Feedback": suggestions, ideas, enhancement requests, recommendations or other feedback about the Offerings.
• "Hexes Materials": the Offerings, Documentation, Usage Data and all software, algorithms, interfaces, policies, signatures, rule sets, content and technology that Hexes Security, Inc. provides or uses to provide the Offerings, and all improvements and derivatives of any of them, excluding Customer Data and Open Source Components.
• "Hosted Evaluation": an Evaluation Offering that Hexes Security, Inc. hosts or operates, such as a Hexes console that Hexes Security, Inc. runs for evaluation customers, or an evaluation environment (for example, a sample cluster with demonstration workloads) that Hexes Security, Inc. provides for one evaluation.
• "Offerings": the Software, Cloud Services, Support and Professional Services that Hexes Security, Inc. provides under this Agreement, and any related Documentation.
• "Open Source Component": any software component made available under a license approved by the Open Source Initiative or a similar free or open-source license.
• "Order": an ordering document, quote, online order or marketplace offer for Offerings that is accepted by Hexes Security, Inc., or by a Partner and Customer, and that references this Agreement.
• "Partner": a reseller, distributor, managed service provider or cloud marketplace authorized by Hexes Security, Inc. to resell or provide Offerings.
• "Preview Feature": a feature or Offering identified as alpha, beta, preview, early access, experimental, roadmap or similar.
• "Professional Services": deployment, configuration, training, consulting or other services described in an Order or a statement of work.
• "Software": Hexes Security, Inc.'s downloadable or installable software, including the Hexes console, enforcement components, software images, installation packages and configuration templates, command-line tools and agents, and all Updates to them, in object-code form.
• "Subscription": a paid right to use an Offering for a Subscription Term under an Order.
• "Subscription Term": the period during which Customer is entitled to use an Offering, as stated in the Order, including renewals.
• "Support": the technical support and maintenance Hexes Security, Inc. provides under the Support Policy.
• "Support Materials": logs, support bundles, diagnostics, packet captures, screenshots and other files that Customer chooses to send to Hexes Security, Inc. in connection with Support.
• "Support Policy": the Hexes Support Policy published at hexessecurity.com/legal/support-policy (or a successor location), as updated under Section 17.3.
• "Updates": patches, fixes, updated rule sets, signatures and vulnerability data, and new versions of the Software that Hexes Security, Inc. makes generally available to customers with a current Subscription.
• "Usage Data": technical and statistical information about the deployment, configuration, health and use of the Offerings (such as cluster and installation identifiers, license and customer identifiers, product and platform versions, node, workload and cluster counts, feature usage, health indicators, license-validation data and usage reports) collected as described in Section 7.3. Usage Data does not include the content of Customer's network traffic, files, secrets or credentials.

2. Orders, Partners and marketplaces

2.1 Orders. Each Order is governed by this Agreement. Orders are non-cancellable and fees are non-refundable except as expressly stated in this Agreement.

2.2 Partners. If Customer buys through a Partner, the price, payment and invoicing terms are agreed between Customer and the Partner, and Hexes Security, Inc.'s rights to suspend under Section 6.4 apply if Hexes Security, Inc. is not paid for those Offerings. Any refund that this Agreement requires for an Offering bought through a Partner is limited to the amount Hexes Security, Inc. received for it, and may be paid to the Partner for credit to Customer. This Agreement still governs Customer's use of the Offerings. Partners are not agents of Hexes Security, Inc. and are not authorized to make promises or commitments on Hexes Security, Inc.'s behalf; any such promise binds only the Partner. Where a Partner provides Support or Professional Services itself, Hexes Security, Inc. is not responsible for them.

2.3 Marketplaces. If Customer buys through a cloud marketplace, the marketplace's standard purchase terms govern the transaction between Customer and the marketplace operator, and this Agreement governs the Offerings. If the marketplace listing or private offer specifies a different agreement between Customer and Hexes Security, Inc., including a marketplace standard contract, that agreement governs instead.

2.4 Affiliates. Customer's Affiliates may use the Offerings under Customer's Entitlement, or may place their own Orders under this Agreement, in which case the Affiliate is "Customer" for that Order. Customer is responsible for its Affiliates' compliance with this Agreement.

3. License and use rights

3.1 Software license. Subject to this Agreement and payment of applicable fees, Hexes Security, Inc. grants Customer, during the Subscription Term, a limited, non-exclusive, non-transferable (except under Section 18.3), non-sublicensable license to install and use the Software, in object-code form, within the Entitlement, solely for Customer's internal business purposes and in accordance with the Documentation. Customer may make a reasonable number of copies for backup, disaster recovery, testing and staging, which count toward the Entitlement only where the Order or Documentation says so.

3.2 Cloud Services. If an Order includes Cloud Services, Hexes Security, Inc. grants Customer, during the Subscription Term, a non-exclusive, non-transferable right to access and use them within the Entitlement for Customer's internal business purposes. Section 9 applies to Cloud Services.

3.3 Documentation. Customer may copy and use the Documentation only in support of its authorized use of the Offerings.

3.4 Authorized Users and contractors. Customer may permit Authorized Users, including third-party contractors and outsourcers operating Customer's environment on Customer's behalf, to use the Offerings, provided they use them only for Customer's benefit. Customer is responsible for their acts and omissions as if they were Customer's own.

3.5 Entitlement and true-up. Customer must not exceed its Entitlement. If Customer's use exceeds the Entitlement (for example, more nodes than purchased), Customer will promptly notify Hexes Security, Inc. and, within 30 days of the excess use being identified by either party, purchase the additional Entitlement at Hexes Security, Inc.'s then-current prices, or Customer's contracted prices where the Order sets them, prorated to the end of the current Subscription Term. Temporary excess use within any grace allowance stated in the Documentation or Order is permitted.

3.6 Managed services. Customer may not use the Offerings to provide services to third parties, including as a managed security service, unless the Order expressly permits it.

3.7 Reservation of rights. All rights not expressly granted in this Agreement are reserved by Hexes Security, Inc. and its licensors. No rights are granted by implication or estoppel. The Software is licensed, not sold.

3.8 License keys, expiry and grace period. Subscriptions and Evaluation Offerings follow the same license rules. Each license key, or the Order, states the license's term, the grace period that follows its expiry, and its limits. During the grace period the Software continues to work and shows warnings. After the grace period, management features lock as described in the Documentation (for example, no policy changes, no Updates and no new vulnerability databases), while the Software continues to enforce its last configuration so that protection is not withdrawn abruptly. While locked, Customer can still move workloads to a less restrictive mode (from Enforcing to Watching or Learning) and install a new license key. Management features lock only on the dates that the license key states, never because call home fails or is turned off (Section 7.3). Operation during the grace period or while locked is not a renewal or extension of any Subscription Term or license, and Customer will promptly either renew or remove the affected Software as Section 16.4 requires.

4. Restrictions

Except as expressly permitted by this Agreement or by the license of an Open Source Component (Section 5), Customer will not, and will not permit anyone to:

1. copy, modify, translate or create derivative works of the Hexes Materials;
2. reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, algorithms or underlying structure of the Hexes Materials, except to the extent applicable law expressly permits this despite this restriction, and then only after giving Hexes Security, Inc. written notice and a reasonable opportunity to provide the information needed for interoperability;
3. remove, disable, bypass or circumvent any license key, signed entitlement file, usage limit, security control or technical protection measure, or tamper with license-validation data or usage reports;
4. rent, lease, lend, sell, resell, sublicense, distribute, time-share or otherwise make the Offerings available to any third party, except as expressly permitted in Sections 3.4 and 3.6;
5. use the Offerings, or any output, rule set, signature or data from them, to build, train, benchmark or improve a competing product or service, or to copy any of their features, functions or user interface;
6. publish or disclose to any third party the results of any benchmark, performance or comparative test of the Offerings without Hexes Security, Inc.'s prior written consent;
7. perform penetration, load or stress testing of any Cloud Services, or of Hexes Security, Inc.'s websites or other systems, without Hexes Security, Inc.'s prior written consent or except as permitted by the Hexes Vulnerability Disclosure Policy (security testing of Software that Customer runs in its own environment is permitted, subject to items 2 and 3);
8. remove or alter any proprietary, copyright, trademark or open-source notice in or on the Offerings;
9. use the Offerings in violation of applicable law, the Acceptable Use Policy, or the rights of others, including to intercept, monitor or inspect communications without the authority and any consents required by law;
10. access the Offerings through automated means except as described in the Documentation (for example, through published APIs and integrations); or
11. use any Evaluation Offering or Preview Feature in breach of Section 8.

5. Open Source Components

5.1 Open source licenses govern. The Offerings include Open Source Components. Each Open Source Component is licensed under its own license, which is identified in the third-party notices that Hexes Security, Inc. publishes with each release (the "Third-Party Notices"). Nothing in this Agreement limits Customer's rights under, or grants rights that supersede, the license of an Open Source Component. Where the license of an Open Source Component requires Hexes Security, Inc. to make the source code of that component available, Hexes Security, Inc. will do so as that license requires.

5.2 Hexes products are not open source. The Offerings are proprietary commercial products. Hexes Security, Inc.'s own code, including its modifications of and additions to Open Source Components, and its configurations, compilations, policies, rule sets and content in the Offerings (everything other than Open Source Components) are proprietary to Hexes Security, Inc., are licensed only under this Agreement, and are provided in object-code form only. The fact that the Offerings include or build on Open Source Components does not make any proprietary portion open source, and nothing in this Agreement or in any open-source license obliges Hexes Security, Inc. to disclose or license the source code of its proprietary portions, except to the extent the license of a specific Open Source Component expressly requires it for that component.

5.3 Compliance. Hexes Security, Inc. will make commercially reasonable efforts to ensure that the Software, as delivered by Hexes Security, Inc., complies with the licenses of the Open Source Components it includes.

6. Fees, payment and taxes

6.1 Fees. Customer will pay the fees stated in each Order. Unless the Order states otherwise, Hexes Security, Inc. invoices fees annually in advance, and invoices are due within 30 days of the invoice date, in US dollars.

6.2 Late payment. Overdue amounts accrue interest at 1% per month or the highest rate permitted by law, whichever is lower, from the due date until paid. Customer will reimburse reasonable costs of collection, including attorneys' fees, for amounts more than 30 days overdue that are not subject to a good-faith dispute.

6.3 Disputes. Customer must notify Hexes Security, Inc. in writing of any good-faith invoice dispute before the due date, with reasonable detail. The parties will work together in good faith to resolve it, and Customer will pay any undisputed amounts on time.

6.4 Suspension for non-payment. If any undisputed amount is more than 15 days overdue, Hexes Security, Inc. may, after giving at least 15 days' written notice, suspend Support, Updates and Cloud Services until the amount is paid in full. This applies whether Customer pays Hexes Security, Inc. or a Partner.

6.5 Taxes. Fees exclude taxes. Customer is responsible for all sales, use, value-added, goods and services, withholding and similar taxes and duties relating to its purchases, other than taxes on Hexes Security, Inc.'s net income, property and employees. If Customer must withhold any tax by law, Customer will gross up its payment so that Hexes Security, Inc. receives the full amount invoiced, unless Customer provides a valid exemption certificate.

6.6 Renewal pricing. Hexes Security, Inc. may increase fees for a renewal Subscription Term by giving Customer written notice at least 75 days before the end of the then-current Subscription Term, unless the Order states otherwise.

7. Ownership, Customer Data, Usage Data and Feedback

7.1 Hexes Security, Inc. ownership. As between the parties, Hexes Security, Inc. and its licensors own all right, title and interest, including all intellectual property rights, in and to the Hexes Materials. Customer acquires only the limited rights expressly granted in this Agreement.

7.2 Customer Data. As between the parties, Customer owns all Customer Data. Customer grants Hexes Security, Inc. and its Affiliates and subprocessors a worldwide, non-exclusive, royalty-free license to host, copy, process, transmit and display Customer Data only as necessary to provide and secure the Offerings, provide Support, prevent or address technical, security or fraud problems, comply with law and as otherwise instructed by Customer. Software that Customer runs in its own environment processes Customer Data there; Hexes Security, Inc. does not receive Customer Data from that Software except as Customer chooses to send it (for example, Support Materials), when Customer connects it to a console that Hexes Security, Inc. hosts (Section 8.4), or as described in Section 7.3.

7.3 Usage Data, call home and usage reports. The Offerings collect Usage Data so that Hexes Security, Inc. can operate, support, troubleshoot, secure, maintain and improve them and verify compliance with the Entitlement. Where Software that Customer runs in its own environment can reach Hexes Security, Inc., it sends Hexes Security, Inc. a short report about once a day ("call home") containing identifiers (a random identifier of the installation, and the license and customer identifiers), product and platform versions, counts (such as nodes, enforcement components, workloads and groups per mode, and the total number of security events in the last 24 hours, in two totals without their content), which licensed features are in use, and health indicators. The Documentation lists the fields of each version of the report, and the Software shows the last report it sent. Call home is designed to exclude the names of workloads, pods, namespaces, images, nodes and users, IP addresses, and the content of policies, events, network traffic, files, secrets and credentials (Hexes Security, Inc. does receive the network address from which a report is sent). Call home is on by default, and Customer may turn it off as described in the Documentation. If call home fails or is turned off, the Software records it and continues to work: nothing is locked, slowed or disabled, for any license. The Software can always produce a usage report, and Customer will provide that report to Hexes Security, Inc. on request or as its Order states. Usage Data collection is an integral part of Cloud Services and Hosted Evaluations. Hexes Security, Inc. uses Usage Data for its internal business purposes: to provide, support, troubleshoot, secure, maintain and improve the Offerings, to verify compliance with the Entitlement, and to compile aggregated statistics. Hexes Security, Inc. will not disclose Usage Data to third parties in a form that identifies Customer or any individual, except to its service providers bound by confidentiality, as required by law, or with Customer's consent, and will not use Usage Data to sell advertising or to profile individuals.

7.4 No AI training on Customer Data. Hexes Security, Inc. will not use Customer Data, or Usage Data that identifies Customer, to train or fine-tune any machine-learning or generative-AI model without Customer's prior written consent.

7.5 Feedback. Customer is not required to provide Feedback. If Customer or its Authorized Users provide Feedback, Customer grants Hexes Security, Inc. a perpetual, irrevocable, worldwide, royalty-free, fully paid, transferable and sublicensable license to use and exploit the Feedback for any purpose, without obligation or attribution. Hexes Security, Inc. will not publicly identify Customer as the source of Feedback without Customer's consent. Feedback is provided "as is".

8. Evaluation Offerings and Preview Features

8.1 Evaluations. Hexes Security, Inc. may make Evaluation Offerings available at its discretion, and sets up each evaluation itself. An evaluation follows the license rules in Section 3.8: its term, its grace period and its limits (for example, on the number of clusters or nodes) are those stated in its license key, or otherwise agreed by Hexes Security, Inc. in writing. The Software counts and reports use against these limits rather than refusing nodes or clusters, and Customer will stay within them. Customer may use the Evaluation Offering only for internal evaluation in a non-production environment. Hexes Security, Inc. may suspend, reset or end any evaluation at any time. At the end of an evaluation, Customer will stop using the Evaluation Offering and remove it, including any Software installed in Customer's own clusters, unless it buys a Subscription.

8.2 Preview Features. Preview Features are provided for Customer's optional use, may be incomplete, may contain errors and may change or be discontinued at any time without notice. Hexes Security, Inc. has no obligation to make any Preview Feature generally available. Customer will not use a Preview Feature in production unless Hexes Security, Inc. expressly permits it in writing.

8.3 As is; limited liability. EVALUATION OFFERINGS AND PREVIEW FEATURES ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY, INDEMNITY, SUPPORT OR SERVICE LEVEL COMMITMENT OF ANY KIND. SUBJECT TO SECTIONS 15.4(d) AND 15.4(e), HEXES SECURITY, INC.'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO EVALUATION OFFERINGS AND PREVIEW FEATURES WILL NOT EXCEED US$1,000. Where this Section 8 conflicts with any other section of this Agreement, this Section 8 governs Evaluation Offerings and Preview Features.

8.4 Hosted Evaluations. In a Hosted Evaluation:

(a) Customer's Authorized Users sign in to a Hexes console that Hexes Security, Inc. hosts for evaluation customers. Hexes Security, Inc. keeps each evaluation customer's data separate from other customers'.

(b) Customer may connect its own clusters, within the limits in Section 8.1, to that console over a connection that Customer's cluster opens. Through it, the console receives, stores and displays Customer Data from those clusters, such as workload, network, process, file, vulnerability, policy, configuration and event data, and sends to those clusters the changes that Customer's Authorized Users make or approve. Customer will connect only clusters, and include only data, that it is entitled to use for an evaluation.

(c) Hexes Security, Inc. may provide an evaluation environment. Customer will use it only to evaluate the Offerings, and will not put production data, or personal data other than its Authorized Users' account details, in it.

(d) Hexes Security, Inc. processes Customer Data in a Hosted Evaluation under Section 7.2, the DPA and Section 8.5. Sections 9.2, 9.3 and 9.4 apply to a Hosted Evaluation as if it were Cloud Services; Sections 9.1 and 9.5 do not.

(e) Hexes Security, Inc. personnel may access Customer's data in the Hosted Evaluation as needed to operate, support and secure it.

(f) Hexes Security, Inc. may reset an evaluation, which erases Customer's changes and data in it and returns it to its starting state, or end it, at any time, with notice where practicable.

8.5 Data at the end of a Hosted Evaluation. When a Hosted Evaluation ends, Hexes Security, Inc. deletes the Customer Data in it, including the data the console holds from Customer's clusters, and the evaluation environment, except where the law requires Hexes Security, Inc. to keep it. Hexes Security, Inc. keeps no backup copies of a Hosted Evaluation. Hexes Security, Inc. is not required to make Customer Data from a Hosted Evaluation available for export. If Customer wants to keep its policies, it should export them from the console before the evaluation ends; they can then be imported into an installation under a Subscription. Usage Data and account records are kept as described in the Hexes Privacy Notice.

9. Cloud Services

This Section 9 applies only if and when Customer subscribes to Cloud Services, and to Hosted Evaluations as stated in Section 8.4(d).

9.1 Availability and service levels. Hexes Security, Inc. will make the Cloud Services available in accordance with the Documentation and any service level commitment stated in the Order or Documentation. Service credits stated in such a commitment are Customer's sole and exclusive remedy for failure to meet it.

9.2 Security. Hexes Security, Inc. will implement and maintain administrative, physical and technical safeguards designed to protect Customer Data in the Cloud Services against unauthorized access, use, alteration or disclosure, as described in the Documentation and the Data Processing Addendum.

9.3 Customer responsibilities. Customer is responsible for: its Authorized Users' account credentials and activity; the accuracy, quality and legality of Customer Data and of the means by which it was obtained; configuring the Offerings appropriately; and obtaining all rights, notices and consents necessary for Hexes Security, Inc. to process Customer Data as contemplated by this Agreement.

9.4 Suspension. Hexes Security, Inc. may suspend access to Cloud Services, in whole or in part, if Hexes Security, Inc. reasonably determines that (a) Customer's use poses a security risk to the Cloud Services or any third party, (b) Customer's use may subject Hexes Security, Inc. or others to liability, (c) Customer is in material breach of Section 4 or the Acceptable Use Policy, or (d) suspension is required by law. Hexes Security, Inc. will limit the suspension to the extent reasonably practicable, give notice where legally permitted and practicable, and restore access promptly once the cause is resolved.

9.5 Data retrieval and deletion. For at least 30 days after a Cloud Services subscription ends (or longer where applicable law requires), Hexes Security, Inc. will, on request, make Customer Data available for export in the format the Cloud Services support. After that period, Hexes Security, Inc. may delete Customer Data from the Cloud Services in accordance with its data retention practices, and will delete it, including from active systems, within 30 days after Customer's written request to [email protected], except copies in backups (which are overwritten in the normal course and remain protected under this Agreement until then) and as required by law.

10. Confidentiality

10.1 Definition. "Confidential Information" means non-public information disclosed by one party (the "Discloser") to the other (the "Recipient") in connection with this Agreement that is marked confidential or that a reasonable person would understand to be confidential, including the Hexes Materials, pricing and the terms of any Order, Customer Data, and each party's business, technical, product and security information. Confidential Information does not include information that the Recipient can show (a) is or becomes publicly available through no fault of the Recipient, (b) was rightfully known to the Recipient without restriction before receipt, (c) is rightfully received from a third party without a duty of confidentiality, or (d) is independently developed by the Recipient without use of the Discloser's Confidential Information. Open Source Components in source-code form are not Hexes Security, Inc.'s Confidential Information.

10.2 Obligations. The Recipient will use the Discloser's Confidential Information only to exercise its rights and perform its obligations under this Agreement, and will protect it using at least the same degree of care it uses for its own information of a similar nature, and no less than reasonable care. The Recipient may disclose Confidential Information only to its and its Affiliates' employees, contractors, advisors, auditors, financing sources and potential acquirers who need to know it and are bound by confidentiality obligations at least as protective as these.

10.3 Compelled disclosure. The Recipient may disclose Confidential Information to the extent required by law or court order, if it gives the Discloser prompt notice (where legally permitted) and reasonable assistance, at the Discloser's expense, to seek a protective order or similar treatment.

10.4 Duration and return. These obligations last during the term of this Agreement and for five years after it ends, and for trade secrets and Customer Data for as long as they remain protected by law or held by the Recipient. On the Discloser's written request after this Agreement ends, the Recipient will return or destroy the Discloser's Confidential Information, except copies retained in routine backups or as required by law, which remain subject to this Section 10.

10.5 Equitable relief. Unauthorized use or disclosure of Confidential Information, or breach of Section 4, may cause irreparable harm for which damages are an inadequate remedy. The non-breaching party may seek injunctive or other equitable relief in any court of competent jurisdiction, without posting a bond, in addition to any other remedy.

11. Privacy and security

11.1 Data Processing Addendum. To the extent Hexes Security, Inc. processes personal data on Customer's behalf in providing the Offerings (including in Support Materials, Hosted Evaluations or Cloud Services), the Hexes Data Processing Addendum (the "DPA") applies and is incorporated into this Agreement.

11.2 Privacy Notice. Hexes Security, Inc.'s collection and use of personal data as a controller, such as business contact information of Customer's personnel and Usage Data, is described in the Hexes Privacy Notice.

11.3 Support Materials. Customer should send only the Support Materials reasonably needed to resolve a Support request, and should remove or mask secrets, credentials and personal data where practicable. Hexes Security, Inc. will use Support Materials only to provide Support and, using only de-identified or aggregated information derived from them, to fix defects in the Offerings, and will retain and delete them in accordance with the Support Policy.

11.4 Security of Customer's environment. Customer is responsible for the security of its own environments, infrastructure and networks in which it deploys the Software, including access controls, credentials, backups, and applying Updates.

12. Support and Professional Services

12.1 Support. During a paid Subscription Term, Hexes Security, Inc. will provide Support and Updates for the Software and Cloud Services in accordance with the Support Policy and the Support level in the Order.

12.2 Professional Services. Hexes Security, Inc. will perform Professional Services described in an Order or statement of work. Unless agreed otherwise, Professional Services expire 12 months after the Order date. Deliverables of Professional Services are Hexes Materials licensed to Customer under Section 3, excluding Customer Data and Customer's Confidential Information included in them. Customer will provide timely access, information and cooperation reasonably required for the Professional Services.

12.3 Third-party products. Products, services and integrations that are not supplied by Hexes Security, Inc. and that Customer chooses to use with the Offerings (for example, SIEMs, ticketing systems, identity providers, registries or cloud platforms) are governed by their own terms. Hexes Security, Inc. is not responsible for them, and their availability or behavior is not a breach of this Agreement.

13. Warranties and disclaimers

13.1 Mutual. Each party represents that it has validly entered into this Agreement and has the legal power to do so.

13.2 Software warranty. Hexes Security, Inc. warrants that, for 90 days after Hexes Security, Inc. first makes the Software available to Customer under an Order (other than for evaluation), the Software, when used in accordance with the Documentation, will perform substantially in accordance with its Documentation.

13.3 Cloud Services and Support warranty. Hexes Security, Inc. warrants that during the Subscription Term the Cloud Services will perform substantially in accordance with their Documentation, and that Support and Professional Services will be performed in a professional and workmanlike manner consistent with generally accepted industry standards.

13.4 Malicious code. Hexes Security, Inc. will use commercially reasonable, industry-standard measures designed to ensure that the Software, as delivered by Hexes Security, Inc., does not contain viruses, ransomware or other malicious code. License keys, entitlement checks and usage limits described in the Documentation are not malicious code.

13.5 Exclusive remedy. Customer must notify Hexes Security, Inc. of a breach of warranty in writing, with reasonable detail, within the applicable warranty period (for Professional Services, within 30 days after performance). Hexes Security, Inc. will, at its option and expense, (a) repair or replace the non-conforming Software or Cloud Services or re-perform the non-conforming services, or (b) if Hexes Security, Inc. determines that (a) is not commercially reasonable, terminate the affected Offering and refund the fees prepaid for it that are attributable to the period after termination (or, for Professional Services, the fees paid for the non-conforming services). THIS SECTION 13.5 STATES CUSTOMER'S SOLE AND EXCLUSIVE REMEDY AND HEXES SECURITY, INC.'S ENTIRE LIABILITY FOR BREACH OF WARRANTY.

13.6 Exclusions. The warranties do not apply to non-conformities caused by: use not in accordance with this Agreement or the Documentation; modifications not made by Hexes Security, Inc.; combination with products, services or environments not supplied by Hexes Security, Inc. or specified in the Documentation; Open Source Components as made available by their licensors; failure to install Updates that would have avoided the issue; Evaluation Offerings or Preview Features; or events outside Hexes Security, Inc.'s reasonable control.

13.7 DISCLAIMER. EXCEPT AS EXPRESSLY STATED IN THIS SECTION 13, THE OFFERINGS AND ALL HEXES SECURITY, INC. MATERIALS ARE PROVIDED "AS IS", AND HEXES SECURITY, INC. AND ITS LICENSORS AND SUPPLIERS DISCLAIM ALL OTHER WARRANTIES, CONDITIONS AND REPRESENTATIONS, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, QUIET ENJOYMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. WITHOUT LIMITING THE FOREGOING, HEXES SECURITY, INC. DOES NOT WARRANT THAT THE OFFERINGS WILL BE UNINTERRUPTED OR ERROR-FREE, WILL DETECT, PREVENT OR BLOCK ALL THREATS, ATTACKS, VULNERABILITIES, INTRUSIONS OR MALICIOUS ACTIVITY, WILL NOT BLOCK LEGITIMATE TRAFFIC OR ACTIVITY, THAT VULNERABILITY DATA, WHICH HEXES SECURITY, INC. COMPILES FROM THIRD-PARTY SOURCES, WILL BE COMPLETE, ACCURATE OR CURRENT, OR THAT ANY OUTPUT, POLICY OR RECOMMENDATION WILL BE ACCURATE OR COMPLETE. SECURITY PRODUCTS ARE ONE PART OF A SECURITY PROGRAM; CUSTOMER REMAINS RESPONSIBLE FOR ITS OVERALL SECURITY, FOR TESTING POLICIES BEFORE ENFORCING THEM, AND FOR ITS COMPLIANCE OBLIGATIONS. SOME JURISDICTIONS DO NOT ALLOW CERTAIN DISCLAIMERS, SO SOME OF THEM MAY NOT APPLY TO CUSTOMER.

13.8 Not for high-risk use. The Offerings are not designed or intended for use where their failure could reasonably be expected to lead directly to death, personal injury or severe physical or environmental damage, such as operating nuclear facilities, aircraft navigation or air traffic control, or life-support systems. Customer is solely responsible for any such use.

14. Indemnification

14.1 By Hexes Security, Inc. Hexes Security, Inc. will defend Customer and its Affiliates, and their officers, directors and employees, against any claim, demand, suit or proceeding brought by a third party (a "Claim") alleging that the Software or Cloud Services, as provided by Hexes Security, Inc. and used by Customer in accordance with this Agreement, infringes or misappropriates that third party's patent, copyright, trademark or trade secret, and will pay any damages, costs and attorneys' fees finally awarded against them, or agreed in a settlement Hexes Security, Inc. approves, resulting from the Claim.

14.2 Exclusions. Hexes Security, Inc. has no obligation under Section 14.1 for any Claim to the extent arising from: (a) Customer Data, or designs, specifications or instructions provided by Customer; (b) modifications of the Offerings not made by Hexes Security, Inc.; (c) combination of the Offerings with products, services, data or processes not supplied by Hexes Security, Inc., where the Claim would not have arisen but for the combination; (d) use of a version of the Software other than the then-current version, if the then-current version, made available to Customer at no additional charge, would have avoided the Claim, and Customer was notified of that; (e) use in breach of this Agreement or after Hexes Security, Inc. has notified Customer to stop use under Section 14.3; (f) Open Source Components, to the extent the Claim arises from the Open Source Component as made available by its licensor and not from Hexes Security, Inc.'s modifications; or (g) Evaluation Offerings, Preview Features or Offerings provided free of charge.

14.3 Remedies. If the Offerings become, or in Hexes Security, Inc.'s opinion are likely to become, the subject of a Claim, Hexes Security, Inc. may, at its option and expense: (a) obtain for Customer the right to continue using them; (b) modify or replace them so that they are non-infringing without materially reducing their functionality; or (c) if neither (a) nor (b) is commercially reasonable, terminate Customer's rights to the affected Offering and refund the fees prepaid for it that are attributable to the period after termination.

14.4 By Customer. Customer will defend Hexes Security, Inc. and its Affiliates, and their officers, directors and employees, against any Claim arising from (a) Customer Data, including any allegation that Customer Data or its processing as permitted by this Agreement infringes or misappropriates a third party's rights or violates applicable law, (b) Customer's use of the Offerings in breach of Section 4 or the Acceptable Use Policy, or (c) Customer's use of the Offerings to provide services to third parties, and will pay any damages, costs and attorneys' fees finally awarded against them, or agreed in a settlement Customer approves, resulting from the Claim.

14.5 Procedure. The indemnified party will (a) give the indemnifying party prompt written notice of the Claim (a delay relieves the indemnifying party of its obligations only to the extent the delay prejudices it), (b) give the indemnifying party sole control of the defense and settlement, provided that the indemnifying party may not, without the indemnified party's prior written consent, enter into a settlement that imposes any obligation on, or admits fault by, the indemnified party (other than ceasing use of an affected Offering), and (c) provide reasonable cooperation at the indemnifying party's expense. The indemnified party may participate with its own counsel at its own expense.

14.6 Exclusive remedy. THIS SECTION 14 STATES EACH PARTY'S SOLE AND EXCLUSIVE LIABILITY, AND THE OTHER PARTY'S SOLE AND EXCLUSIVE REMEDY, FOR ANY THIRD-PARTY CLAIM OF INFRINGEMENT OR MISAPPROPRIATION OF INTELLECTUAL PROPERTY RIGHTS.

15. Limitation of liability

15.1 Exclusion of certain damages. EXCEPT FOR EXCLUDED CLAIMS, IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES, LICENSORS OR SUPPLIERS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL OR ANTICIPATED SAVINGS, LOSS OR CORRUPTION OF DATA, BUSINESS INTERRUPTION, OR COST OF PROCURING SUBSTITUTE GOODS OR SERVICES, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THEIR POSSIBILITY.

15.2 General cap. EXCEPT FOR EXCLUDED CLAIMS AND AS PROVIDED IN SECTIONS 8.3 AND 15.3, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID BY CUSTOMER FOR THE OFFERING GIVING RISE TO THE LIABILITY DURING THE 12 MONTHS BEFORE THE FIRST EVENT GIVING RISE TO LIABILITY.

15.3 Indemnity cap. HEXES SECURITY, INC.'S TOTAL AGGREGATE LIABILITY UNDER SECTION 14.1 WILL NOT EXCEED THE AMOUNT DESCRIBED IN SECTION 15.2. THIS CAP IS SEPARATE FROM, AND NOT IN ADDITION TO, ANY OTHER AMOUNT PAYABLE UNDER SECTION 15.2 FOR THE SAME EVENT.

15.4 Excluded Claims. "Excluded Claims" means: (a) Customer's obligations to pay fees; (b) Customer's breach of Section 3 or 4 or infringement or misappropriation of Hexes Security, Inc.'s intellectual property rights; (c) Customer's obligations under Section 14.4; (d) a party's gross negligence, willful misconduct or fraud; and (e) liability that cannot be limited or excluded under applicable law.

15.5 Basis of the bargain. These limitations apply to all claims, whether in contract, tort (including negligence), strict liability or otherwise, and even if a limited remedy fails of its essential purpose. The parties agree that these limitations are an essential basis of the bargain and reflect a fair allocation of risk.

16. Term and termination

16.1 Term. This Agreement starts when Customer first accepts it and continues until all Subscription Terms have ended, unless terminated earlier under this Section 16. If no Subscription Term is in effect, either party may terminate this Agreement on written notice.

16.2 Renewal. Unless the Order states otherwise, each Subscription Term automatically renews for successive periods of 12 months (or the length of the initial term, if shorter) unless either party gives written notice of non-renewal at least 60 days before the end of the then-current Subscription Term. Subscriptions bought through a Partner or marketplace renew as stated in the Partner's or marketplace's terms.

16.3 Termination for cause. Either party may terminate this Agreement or an affected Order by written notice if the other party (a) materially breaches this Agreement and does not cure the breach within 30 days after receiving written notice describing it, or (b) becomes insolvent, makes a general assignment for the benefit of creditors, or becomes the subject of any bankruptcy, receivership or similar proceeding that is not dismissed within 60 days. Hexes Security, Inc. may terminate immediately on notice if Customer breaches Section 4 or Section 18.6 in a way that cannot reasonably be cured.

16.4 Effect. When an Order or this Agreement ends: (a) all licenses and rights granted for the affected Offerings end, and Customer will stop using, uninstall and destroy all copies of the affected Software and Hexes Security, Inc.'s Confidential Information, and on request certify that it has done so; (b) Customer will pay all unpaid fees for the Subscription Term, except that if Customer terminates for Hexes Security, Inc.'s uncured material breach, Hexes Security, Inc. will refund prepaid fees for the period after termination; and (c) Section 9.5 applies to Customer Data in Cloud Services, and Section 8.5 to Customer Data in a Hosted Evaluation.

16.5 Survival. Sections 1, 3.5 (for excess use identified after termination), 3.7, 4, 5, 6 (for amounts owed), 7, 8.3, 8.5, 9.5, 10, 11.1, 11.3, 13.7, 13.8, 14, 15, 16.4, 16.5, 17 and 18, and any other provision that by its nature should survive, survive termination or expiration.

17. Verification, changes and Documentation

17.1 Verification. During the Subscription Term and for one year after it, Customer will keep reasonable records of its use of the Offerings. Not more than once in any 12-month period, on at least 30 days' written notice, Hexes Security, Inc. may ask Customer to certify in writing its use of the Offerings, and to run any tool Hexes Security, Inc. provides for counting deployed units. If the certification or tool does not resolve a reasonable concern, Hexes Security, Inc., or an independent auditor bound by confidentiality, may audit Customer's relevant records during normal business hours in a way that does not unreasonably interfere with Customer's operations. Customer will promptly pay for any use exceeding the Entitlement under Section 3.5, and, if the excess exceeds 5% of the Entitlement, the reasonable costs of the audit.

17.2 Changes to this Agreement. Hexes Security, Inc. may update this Agreement by publishing a new version at hexessecurity.com/legal (or a successor location) with a new version number. The version in effect when an Order is placed governs that Order for its Subscription Term, and a renewal or new Order is governed by the version in effect when it is placed. A new version does not apply to an existing Subscription Term unless Customer accepts it (for example, by clicking to accept it in the Offerings), except that changes required by law apply as stated in the notice.

17.3 Documentation and Support Policy. Hexes Security, Inc. may update the Documentation, the Support Policy and the Acceptable Use Policy from time to time, but no update will materially reduce the security, functionality, or level of Support of a purchased Offering during the current Subscription Term, except to address legal requirements or security risks.

17.4 Discontinuation. Hexes Security, Inc. may discontinue an Offering or a feature by giving Customer at least 6 months' written notice, or if a third-party dependency ends or a legal or security reason requires it, as much notice as reasonably practicable. If Hexes Security, Inc. discontinues an Offering during a prepaid Subscription Term without providing a substantially similar replacement, Hexes Security, Inc. will refund the prepaid fees for it attributable to the period after discontinuation.

18. General

18.1 Governing law and venue. This Agreement is governed by the laws of the State of California, USA, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act, in any form enacted, do not apply. Each party irrevocably submits to the exclusive jurisdiction and venue of the state courts located in Santa Clara County, California, and the United States District Court for the Northern District of California, for any dispute arising out of or relating to this Agreement, except that either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property rights or Confidential Information.

18.2 Notices. Notices under this Agreement must be in writing and are effective when delivered by hand, by a recognized courier, or by email with confirmation of transmission. Notices to Hexes Security, Inc. must be sent to [email protected], with a copy to Hexes Security, Inc., Attn: Legal, 2261 Market Street STE 68751, San Francisco, CA 94114, USA. Notices to Customer will be sent to the address or email in the Order or Customer's account. Routine operational notices may be given through the Offerings or by email.

18.3 Assignment. Neither party may assign or transfer this Agreement without the other party's prior written consent, which will not be unreasonably withheld, except that either party may assign it, without consent, to an Affiliate or to a successor in a merger, acquisition, corporate reorganization or sale of all or substantially all of its assets or of the business to which this Agreement relates, provided the assignee is not a direct competitor of the other party and agrees in writing to be bound. Any other attempted assignment is void. This Agreement binds and benefits the parties and their permitted successors and assigns.

18.4 Subcontractors. Hexes Security, Inc. may use subcontractors and Affiliates to perform its obligations, and remains responsible for their performance.

18.5 Force majeure. Neither party is liable for any delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, such as natural disasters, epidemics, war, terrorism, civil unrest, labor disputes (other than its own workforce), government action, failures of public networks or utilities, or attacks on infrastructure that could not reasonably have been prevented.

18.6 Export and sanctions. The Offerings are subject to US export control and economic sanctions laws, including the Export Administration Regulations and regulations administered by the Office of Foreign Assets Control, and may be subject to the laws of other countries. Customer will comply with those laws and will not export, re-export, transfer or provide access to the Offerings to any country, region, entity or person prohibited by them, or for any prohibited end use. Customer represents that it is not, and is not owned or controlled by, a person on any US or other applicable restricted-party list, and is not located in a comprehensively embargoed country or region.

18.7 Anti-corruption. Each party will comply with applicable anti-bribery and anti-corruption laws, including the US Foreign Corrupt Practices Act and the UK Bribery Act 2010. Customer has not received or been offered any bribe, kickback or improper payment from Hexes Security, Inc. or its personnel in connection with this Agreement, and will promptly report any such offer to [email protected].

18.8 US government end users. The Software and Documentation are "commercial items", "commercial computer software" and "commercial computer software documentation" as defined in the Federal Acquisition Regulation and the Defense Federal Acquisition Regulation Supplement. Consistent with FAR 12.211, 12.212 and DFARS 227.7202, US government end users acquire only the rights set out in this Agreement. Any provision of this Agreement that is inconsistent with federal procurement law does not apply to a US government end user to the extent of the inconsistency.

18.9 Publicity. Hexes Security, Inc. may identify Customer by name and logo as a customer on its website and in marketing materials, in accordance with Customer's reasonable trademark guidelines, unless Customer opts out by emailing [email protected]. Any other publicity requires the other party's prior written consent.

18.10 Independent contractors; no third-party beneficiaries. The parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary or employment relationship. There are no third-party beneficiaries of this Agreement, except the indemnified persons under Section 14.

18.11 Order of precedence. If documents conflict, the following order applies, from highest to lowest: (a) an Order signed by both parties, for the Offerings in it, only where it expressly states that it overrides a specific section of this Agreement; (b) the DPA, as to personal data; (c) this Agreement; (d) other Orders; (e) the Support Policy and Acceptable Use Policy; and (f) the Documentation. Pre-printed or additional terms in any purchase order, vendor portal, invoice or other Customer document do not apply and are rejected, even if Hexes Security, Inc. accepts or signs the document.

18.12 Entire agreement; amendment; waiver. This Agreement, together with the Orders and the documents incorporated by reference, is the parties' entire agreement on its subject matter and supersedes all prior or contemporaneous agreements, proposals and representations. Except as stated in Section 17, it may be amended only in a writing signed by authorized representatives of both parties. A failure or delay to enforce any provision is not a waiver.

18.13 Severability. If any provision is held unenforceable, it will be enforced to the maximum extent permissible and the remaining provisions will remain in full force.

18.14 Electronic acceptance; counterparts; language. This Agreement and Orders may be accepted electronically and executed in counterparts. This Agreement is written in English; any translation is for convenience only, and the English version governs.

18.15 Headings and interpretation. Headings are for convenience only. "Including" means "including without limitation". References to a website location include any successor location.

Documents incorporated by reference: Hexes Data Processing Addendum · Hexes Acceptable Use Policy · Hexes Support Policy · Hexes Privacy Notice (for information) · Third-Party Notices published with each release. All are available at hexessecurity.com/legal.

Hexes Security, Inc. · 2261 Market Street STE 68751, San Francisco, CA 94114, USA · [email protected]

All legal documents