XorFox LLC Drawbridge Subscription Terms

By accepting this agreement, you and any entity that you represent ("Customer") are unconditionally consenting to be bound by and are becoming a party to these XorFox LLC Subscription Terms ("Agreement") as of the date of Customer's first login to the Licensed Materials (the "Effective Date").

Customer's continued use of the software or any Licensed Materials provided by XorFox LLC. (a Colorado Limited Liability Company with its principal offices located at 1001 Bannock Street Ste. 427, Denver CO 80203) or one of its affiliates and/or subsidiaries, as specified on an order form or quote ("XorFox Drawbridge Quote") shall also constitute assent to the terms of this agreement.

If these terms are considered an offer, acceptance is expressly limited to these terms. If you are executing this agreement on behalf of an organization, you represent that you have the authority to do so.

1. LICENSE AND SUPPORT

1.1 Subject to the terms and conditions of this Agreement, XorFox LLC hereby grants to Customer and its Affiliates (as defined below) a limited, non-exclusive, non-transferable, non-sublicensable license for Customer's and its Affiliates' employees and contractors to (1) internally (a) use, reproduce, modify, prepare derivative works based upon, and display the code of XorFox LLC ("XorFox Drawbridge") at the tier level selected by Customer or set forth on a Quote (as defined below), if applicable with the specifications generally promulgated by XorFox LLC from time to time (the "Software") solely (i) for its internal use in connection with the development of Customer's and/or its Affiliates' own software, and (ii) by the number of Realms (defined below) for which Customer has paid XorFox LLC; and (b) use the documentation, training materials or other materials supplied by XorFox LLC (the "Other XorFox LLC Materials"); and (2) modify the Software and publish patches to the Software.

Notwithstanding anything to the contrary, Customer agrees that XorFox LLC and/or its licensors (as applicable) retain all right, title and interest in and to all Software incorporated in such modifications and/or patches, and all such Software may only be used, copied, modified, displayed, distributed, or otherwise exploited in full compliance with this Agreement, and with a valid XorFox LLC Drawbridge subscription for the correct number of Realms.

The Software and Other XorFox LLC Materials are collectively referred to herein as the "Licensed Materials."

"Affiliate" means any entity(ies) controlling, controlled by, and/or under common control with a party hereto, where "control" means the ownership of more than 50% of the voting securities in such entity.

"User" means each individual end-user (person or machine) of Customer and/or its Affiliates (including, without limitation, employees, agents or consultants thereof) with access to the Licensed Materials hereunder.

"Realm" means each Keycloak authentication realm provisioned through the Licensed Materials, including its users, clients, identity providers, SCIM endpoints, themes, and associated configuration.

"Secrets Vault" means the encrypted storage feature within the Licensed Materials that allows Customer to store, retrieve, and manage sensitive values (such as API keys, credentials, and TOTP seeds) using AES-256-GCM encryption at rest with per-realm managed keys.

"Demo Container" means an ephemeral, time-limited virtual machine provisioned through the Licensed Materials for the sole purpose of demonstrating OIDC-based SSH authentication (OPKSSH). Demo Containers are not intended for production workloads and are automatically terminated after a fixed period.

1.2 Subject to the terms hereof, XorFox LLC will provide reasonable support to Customer for the Licensed Materials at the level corresponding to Customer's usage tier (community support for the Free tier, email support for the Standard tier, and email and phone support for the Volume tier). Notwithstanding anything to the contrary, in the event that Customer does not reasonably comply with written specifications or instructions from XorFox LLC's service engineers regarding any support issue or request (including without limitation, failure to make backups of Customer's Licensed Materials) (each, a "Support Issue"), XorFox LLC may terminate its support obligations to Customer with respect to such Support Issue upon seven (7) days' written notice if Customer does not cure such noncompliance within the notice period.

1.2.1 XorFox LLC will use reasonable commercial efforts to respond to support questions by phone or email during the next business day. The number of support questions is not limited.

2. RESTRICTIONS AND RESPONSIBILITIES

2.1 Except as expressly authorized in Section 1.1, Customer will not, and will not permit any third party to: use the Licensed Materials for any purpose other than as specifically authorized in Section 1, or in such a manner that would enable any unlicensed person to access the Licensed Materials; use the Licensed Materials or any other XorFox LLC software for timesharing or service bureau purposes or for any purpose other than its and its Affiliates' own internal use (including without limitation, sublicensing, distributing, selling, reselling any of the foregoing); except as expressly permitted herein; use the Licensed Materials in connection with any high risk or strict liability activity (including, without limitation, space travel, firefighting, police operations, power plant operation, military operations, rescue operations, hospital and medical operations or the like); use the Licensed Materials or software other than in accordance with this Agreement and in compliance with all applicable laws and regulations (including but not limited to any privacy laws, and laws and regulations concerning intellectual property, consumer and child protection, obscenity or defamation); or use the Licensed Materials in any manner that (1) is harmful, fraudulent, deceptive, threatening, abusive, harassing, tortious, defamatory, vulgar, obscene, or libelous (including without limitation, accessing any computer, computer system, network, software, or data without authorization, breaching the security of another user or system, and/or attempting to circumvent any Realm or User authentication or security process), (2) impersonates any person or entity, including without limitation any employee or representative of XorFox LLC, or (3) contains a virus, trojan horse, worm, time bomb, unsolicited bulk, commercial, or "spam" message, or other harmful computer code, file, or program (including without limitation, password guessing programs, decoders, password gatherers, keystroke loggers, cracking tools, packet sniffers, and/or encryption circumvention programs).

2.2 Customer will cooperate with XorFox LLC in connection with the performance of this Agreement by making available such personnel and information as may be reasonably required, and taking such other actions as XorFox LLC may reasonably request. Customer will also cooperate with XorFox LLC in establishing a password or other procedures for verifying that only designated employees of Customer have access to any administrative functions of the Licensed Materials. Customer shall maintain during the term of this Agreement and through the end of the third year after the date on which the final payment is made under this Agreement, books, records, contracts and accounts relating to the payments due XorFox LLC under this Agreement (collectively, the "Customer Records"). XorFox LLC may, at its sole expense, upon 30 days' prior written notice to Customer and during Customer's normal business hours and subject to industry-standard confidentiality obligations, hire an independent third party auditor to audit the Customer Records only to verify the amounts payable under this Agreement. If an audit reveals underpayment, then Customer shall promptly pay the deficiency to XorFox LLC plus late fees pursuant to Section 5.2. XorFox LLC shall bear the cost of an audit unless the audit reveals underpayment by more than 5% for the audited period, in which case Customer shall promptly pay XorFox LLC for the reasonable costs of the audit.

2.3 Customer will be responsible for maintaining the security of Customer's account, passwords (including but not limited to administrative and User passwords, SCIM bearer tokens, vault encryption keys, and credentials for Realms) and files, and for all uses of Customer account with or without Customer's knowledge or consent.

2.4 Secrets Vault Restrictions. Customer acknowledges that the Secrets Vault is provided as a convenience for storing application-level secrets and is not a substitute for a dedicated Hardware Security Module (HSM), key management service, or PCI DSS-compliant cardholder data environment. Customer shall not store in the Secrets Vault: (a) payment card numbers (PANs), CVVs, or other cardholder data subject to PCI DSS; (b) protected health information (PHI) subject to HIPAA, unless Customer has entered into a separate Business Associate Agreement with XorFox LLC; or (c) any data whose storage would violate applicable law or regulation. Customer is solely responsible for the content stored in the Secrets Vault and for ensuring that its use complies with all applicable laws, regulations, and contractual obligations. XorFox LLC encrypts vault data at rest using AES-256-GCM but does not inspect, audit, or assume responsibility for the nature, sensitivity, or regulatory classification of stored content.

2.5 Demo Containers. Demo Containers are ephemeral, time-limited environments provided solely for demonstrating OIDC-based SSH authentication. Customer shall not use Demo Containers for production workloads, persistent data storage, cryptocurrency mining, network scanning, or any purpose other than evaluating SSH authentication functionality. Demo Containers may be terminated by XorFox LLC at any time without notice. XorFox LLC assumes no liability for data loss, service interruption, or any damages arising from the use or unavailability of Demo Containers.

2.6 Server Installation (BYOS). The Licensed Materials include a server installation feature ("BYOS") that allows Customer to run a Drawbridge-provided script on Customer's own Linux servers to configure OPKSSH-based SSH authentication. By running the BYOS installation script, Customer acknowledges and agrees that: (a) the script installs third-party open-source software (OPKSSH) on Customer's server, subject to OPKSSH's own license terms; (b) the script creates system user accounts (including sudo-enabled companion users) on Customer's server; (c) the script configures a background sync daemon (systemd service) that periodically communicates with the Drawbridge platform; (d) while the script is designed to not modify existing SSH keys, passwords, or firewall rules, XorFox LLC does not warrant that the installation will not interfere with Customer's existing server configuration, third-party software, security policies, or compliance posture; (e) Customer is solely responsible for evaluating the suitability of OPKSSH and the BYOS installation for Customer's environment, including compliance with Customer's security policies, change management procedures, and regulatory obligations; (f) XorFox LLC is not liable for any server downtime, data loss, security incidents, service disruption, or other damages arising from the installation, operation, or failure of OPKSSH or the BYOS sync daemon on Customer's servers; and (g) removal of the BYOS configuration from Customer's server is Customer's responsibility and is not automated by the Drawbridge platform.

2.7 Cloud VM Provisioning (BYOC). The Licensed Materials include a feature ("BYOC") that allows Customer to provision virtual machines in Customer's own cloud accounts (AWS, Azure, or other supported providers) using credentials provided by Customer. Customer acknowledges and agrees that: (a) Customer is solely responsible for the cloud credentials provided to Drawbridge and for ensuring that the associated IAM roles, service principals, or other access mechanisms are scoped to the minimum necessary permissions; (b) XorFox LLC provisions and terminates cloud resources on Customer's behalf using Customer's credentials, and Customer is solely responsible for all cloud provider charges incurred; (c) XorFox LLC is not liable for any cloud resources that are not properly terminated due to platform errors, network failures, or other causes, and Customer should monitor their cloud accounts for orphaned resources; (d) virtual machines provisioned through BYOC install third-party open-source software (OPKSSH) and are configured with cloud-init scripts that modify system configuration; and (e) Customer is solely responsible for the security, patching, monitoring, and decommissioning of cloud resources provisioned through the BYOC feature.

2.8 Third-Party Software. The Licensed Materials integrate with and may install third-party open-source software, including without limitation OPKSSH (OpenPubkey SSH). Such third-party software is provided "as-is" under its own license terms and is not warranted, maintained, or supported by XorFox LLC. XorFox LLC does not control the development, release, or security of third-party software and is not liable for any vulnerabilities, defects, incompatibilities, or damages arising from third-party software installed through the Licensed Materials. Customer is responsible for reviewing and accepting the license terms of any third-party software before using features that install such software.

2.9 Acceptable Use. Customer shall not use the Licensed Materials, including any Realm, Secrets Vault, Demo Container, or MCP interface, to store, transmit, distribute, or facilitate access to: (a) content that promotes or incites violence, terrorism, or hatred against any individual or group based on race, ethnicity, national origin, religion, sex, gender identity, sexual orientation, disability, or age; (b) sexually explicit or pornographic material; (c) content that exploits or endangers minors in any way; (d) material that infringes any third party's intellectual property, privacy, or publicity rights; (e) malware, ransomware, phishing kits, or other tools designed to compromise the security of third-party systems; (f) content or activity that violates any applicable local, state, national, or international law or regulation, including without limitation sanctions, export controls, and data protection laws; or (g) any content or conduct that XorFox LLC, in its sole discretion, determines to be harmful to its platform, reputation, other customers, or third parties. Violation of this Section constitutes a material breach of this Agreement and may result in immediate suspension or termination of Customer's account without notice or refund under Section 6.3.

2.10 Single Account Policy. Each individual or entity may maintain only one (1) active Drawbridge account. Creating multiple accounts to circumvent free-tier usage limits, resource quotas, rate limits, or billing obligations is a material breach of this Agreement. XorFox LLC may, in its sole discretion, merge duplicate accounts, suspend or terminate any accounts found to be in violation of this policy, and invoice the Customer for the aggregate usage across all such accounts at the applicable paid tier rates. For the avoidance of doubt, automated or scripted creation of multiple accounts for the purpose of obtaining additional free-tier allocations constitutes fraud and may be referred to applicable legal authorities.

3. CONFIDENTIALITY

3.1 Each party (the "Receiving Party") understands that the other party (the "Disclosing Party") has disclosed or may disclose information relating to the Disclosing Party's technology or business (hereinafter referred to as "Proprietary Information" of the Disclosing Party). Without limiting the foregoing, the Licensed Materials are XorFox LLC Proprietary Information.

3.2 The Receiving Party agrees: (i) not to divulge to any third person any such Proprietary Information, (ii) to give access to such Proprietary Information solely to those employees with a need to have access thereto for purposes of this Agreement, and (iii) to take the same security precautions to protect against disclosure or unauthorized use of such Proprietary Information that the party takes with its own proprietary information, but in no event will a party apply less than reasonable precautions to protect such Proprietary Information. The Disclosing Party agrees that the foregoing will not apply with respect to any information that the Receiving Party can document (a) is or becomes generally available to the public without any action by, or involvement of, the Receiving Party, or (b) was in its possession or known by it prior to receipt from the Disclosing Party, or (c) was rightfully disclosed to it without restriction by a third party, or (d) was independently developed without use of any Proprietary Information of the Disclosing Party. Nothing in this Agreement will prevent the Receiving Party from disclosing Proprietary Information pursuant to any judicial or governmental order, provided that the Receiving Party gives the Disclosing Party reasonable prior notice of such disclosure to contest such order. In any event, XorFox LLC may collect data with respect to and report on the aggregate response rate and other aggregate measures of the Licensed Materials' performance and Customer's usage of the Licensed Materials; provided that XorFox LLC will not identify Customer as the source of any such data without Customer's prior written consent. For the avoidance of doubt, use of a third party to host the data collected shall not be deemed a disclosure.

3.3 Each party acknowledges and agrees that the other may suffer irreparable damage in the event of a breach of the terms of Sections 1.1, 2.1 or 3.2 of this Agreement and that such party will be entitled to seek injunctive relief (without the necessity of posting a bond) in the event of any such breach.

3.4 Both parties will have the right to disclose the existence of the relationship between the parties, but not the terms and conditions of this Agreement, unless such disclosure of the Agreement terms is approved in writing by both Parties prior to such disclosure, or is included in a filing required to be made by a party with a governmental authority (provided such party will use reasonable efforts to obtain confidential treatment or a protective order) or is made on a confidential basis as reasonably necessary to potential investors or acquirers.

4. INTELLECTUAL PROPERTY RIGHTS

4.1 Except as expressly set forth herein, XorFox LLC alone (and its licensors, where applicable) will retain all intellectual property rights relating to the Licensed Materials and any suggestions, ideas, enhancement requests, feedback, code, or other recommendations provided by Customer, its Affiliates or any third party relating to the Licensed Materials, which are hereby assigned to XorFox LLC. This Agreement is not a sale and does not convey to Customer any rights of ownership in or related to the Licensed Materials, or any intellectual property rights.

4.2 Customer shall not remove, alter or obscure any of XorFox LLC's (or its licensors') copyright notices, proprietary legends, trademark or service mark attributions, patent markings or other indicia of XorFox LLC's (or its licensors') ownership or contribution from the Licensed Materials. Additionally, Customer agrees to reproduce and include XorFox LLC's (and its licensors') proprietary and copyright notices on any copies of the Licensed Materials, or on any portion thereof, including reproduction of the copyright notice. Notwithstanding anything to the contrary herein, certain components of the Licensed Materials, including without limitation, any component of the Licensed Materials distributed by XorFox LLC as part of XorFox Drawbridge, are licensed by third parties pursuant to the terms of certain third party licenses described in such source code annotations.

4.3 Customer and its licensors shall (and Customer hereby represents and warrants that they do) have and retain all right, title and interest (including, without limitation, sole ownership of) all software, information, content and data provided by or on behalf of Customer or made available or otherwise distributed through use of the Licensed Materials ("Content") and the intellectual property rights with respect to that Content. If XorFox LLC receives any notice or claim that any Content, or Customer's activities hereunder (including without limitation, with respect to any Content), infringes or violates the rights of a third party or any applicable law or regulation (a "Claim"), Customer will indemnify, defend and hold XorFox LLC harmless from all liability, damages, settlements, attorney fees and other costs and expenses in connection with any such Claim, as incurred. The immediately foregoing indemnity obligations are expressly conditioned on XorFox LLC providing Customer with prompt notice of, and reasonable cooperation and sole control over the defense and/or settlement of the applicable Claim. Subject to the foregoing, XorFox LLC may participate in the defense and/or settlement of any applicable Claim with counsel of its choosing at its own expense.

4.4 XorFox LLC will defend, indemnify and hold Customer harmless from liability and other amounts paid or payable to unaffiliated third parties resulting from (i) the infringement or violation of any intellectual property or proprietary rights by the Licensed Materials or (ii) the violation of applicable law or regulation by XorFox LLC in performance of its obligations hereunder, provided XorFox LLC is promptly notified of any and all threats, claims and proceedings related thereto and given reasonable assistance and the opportunity to assume sole control over defense and settlement thereof. Subject to the foregoing, Customer may participate in the defense and/or settlement of any claim that is indemnifiable by XorFox LLC with counsel of its choosing at its own expense. The foregoing obligations do not apply with respect to portions or components of the Licensed Materials (i) not created by XorFox LLC, (ii) that are modified after delivery by XorFox LLC, (iii) combined with other products, processes or materials where the alleged infringement relates to such combination, (iv) where Customer continues allegedly infringing activity after being notified thereof or after being informed of modifications that would have avoided the alleged infringement, or (v) where Customer's use of the Licensed Materials is not strictly in accordance with this Agreement and all related documentation.

5. PAYMENT OF FEES

5.1 Unless and until XorFox LLC and Customer have executed a quote document specifically referencing this Agreement with respect to amounts due on account of the Licensed Materials (a "Quote", which is hereby incorporated by reference, if applicable), and unless Customer's subscription to (and payment with respect to) the Licensed Materials has been made on Customer's behalf by a reseller, Customer will pay XorFox LLC the applicable fees as set forth at XorFox Drawbridge Pricing (the "Pricing") for the Licensed Materials selected and/or used by Customer (the "Fees") without any right of set-off or deduction. On the first business day of each calendar month starting with the Effective Date, XorFox LLC will invoice Customer (or its reseller, if applicable) for the previous month's usage.

5.2 Per-Call Billing. Fees are calculated on a per-call basis using graduated pricing tiers as published on the Pricing page. An "API Call" includes, without limitation, each HTTP request routed through the platform's proxy layer to any realm-scoped endpoint, including but not limited to: (a) each invocation of an MCP tool (e.g., creating or deleting a Realm, managing payment methods, uploading themes, provisioning Demo Containers, or querying account information); (b) each REST API request made to the Drawbridge platform on behalf of Customer or Customer's Realms; (c) each end-user authentication event (login, token exchange, token refresh) occurring within any of Customer's Keycloak Realms; (d) each SCIM provisioning request (user sync, group sync) received by any of Customer's Realms; (e) each Secrets Vault operation (create, read, update, delete, import) performed against any of Customer's Realms; and (f) each SAML assertion, OIDC discovery, or other identity protocol request directed at a Customer Realm. The first 5,000 API Calls per billing period are provided at no charge. Usage beyond 5,000 API Calls is billed at the applicable tiered rate. XorFox LLC reserves the right to modify the definition of what constitutes an API Call, the number of free API Calls, and the applicable pricing tiers at any time upon reasonable notice to Customer.

5.3 All payments will be made in accordance with the payment schedule and the method of payment set forth in the Pricing. If not otherwise specified, (a) XorFox LLC will invoice Customer monthly in arrears for the previous month's usage, and (b) payments will be charged automatically to the payment method on file. Except as expressly set forth in this Agreement, all Fees paid and/or due hereunder (including any prepaid amounts) are non-refundable, including without limitation if this Agreement is terminated in accordance with Section 6 below.

5.4 Any unpaid fees are subject to a finance charge of one percent (1.0%) per month, or the maximum permitted by law, whichever is lower, plus all expenses of collection, including reasonable attorneys' fees. Fees under this Agreement are exclusive of all taxes, including national, state or provincial and local use, sales, value-added, property and similar taxes, if any. Customer agrees to pay such taxes (excluding US taxes based on XorFox LLC's net income) unless Customer has provided XorFox LLC with a valid exemption certificate. In the case of any withholding requirements, Customer will pay any required withholding itself and will not reduce the amount paid to XorFox LLC on account thereof.

6. TERMINATION

6.1 This Agreement shall continue until terminated in accordance with this Section 6. Either party may terminate this Agreement upon 15 days' written notice to the other party hereto in the event that Customer has no then-current subscription with respect to the Licensed Materials.

6.2 Customer may terminate this Agreement at any time upon written notice to XorFox LLC. Either party may terminate this Agreement immediately upon 15 days' written notice to the other party in the event of any material breach of this Agreement (including without limitation, any breach of Section 2.2 and/or failure to pay any amounts when due hereunder) by such party where such material breach is not cured during such notice period.

6.3 XorFox LLC reserves the right to suspend or terminate Customer's account and access to the Licensed Materials at any time, for any reason or no reason, without prior notice. Without limiting the foregoing, XorFox LLC may immediately terminate this Agreement if it determines, in its sole discretion, that Customer has violated any term of this Agreement, engaged in conduct that is harmful to other customers or to XorFox LLC, or used the Licensed Materials in a manner not authorized by this Agreement. XorFox LLC shall not be liable to Customer or any third party for any such suspension or termination.

6.4 Either party may terminate this Agreement, without notice, (i) upon the institution by or against the other party of insolvency, receivership or bankruptcy proceedings (provided such proceedings are not dismissed within one hundred twenty (120) days of such institution), (ii) upon the other party's making an assignment for the benefit of creditors, or (iii) upon the other party's dissolution or ceasing to do business without a successor.

6.5 Customer's rights to the Licensed Materials, and any licenses granted hereunder, shall terminate upon any termination of this Agreement. In the event that Customer terminates this Agreement pursuant to the second sentence of Section 6.2 above, XorFox LLC will not refund to Customer any pre-paid Fees for Services not actually received by Customer as of the date of such termination. The following Sections will survive any termination of this Agreement: 2 through 6 (except for Section 4.3), and 8 through 13.

7. WARRANTY; CUSTOMER SOFTWARE SECURITY

XorFox LLC represents and warrants that (i) it has all rights and licenses necessary for it to perform its obligations hereunder, and (ii) it will not knowingly include, in any XorFox LLC software released to the public and provided to Customer hereunder, any computer code or other computer instructions, devices or techniques, including without limitation those known as disabling devices, trojans, or time bombs, that are intentionally designed to disrupt, disable, harm, infect, defraud, damage, or otherwise impede in any manner, the operation of a network, computer program or computer system or any component thereof, including its security or user data. If, at any time, XorFox LLC fails to comply with the warranty in this Section, Customer may promptly notify XorFox LLC in writing of any such noncompliance. XorFox LLC will, within thirty (30) days of receipt of such written notification, either correct the noncompliance or provide Customer with a plan for correcting the noncompliance. If the noncompliance is not corrected or if a reasonably acceptable plan for correcting them is not established during such period, Customer may terminate this Agreement as its sole and exclusive remedy for such noncompliance.

8. WARRANTY DISCLAIMER

EXCEPT AS EXPRESSLY STATED HEREIN, THE LICENSED MATERIALS, SOFTWARE AND XORFOX LLC PROPRIETARY INFORMATION AND ANYTHING PROVIDED IN CONNECTION WITH THIS AGREEMENT ARE PROVIDED "AS-IS," WITHOUT ANY WARRANTIES OF ANY KIND. XORFOX LLC AND ITS LICENSORS HEREBY DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

WITHOUT LIMITING THE FOREGOING, XORFOX LLC DOES NOT WARRANT THAT: (A) THE SECRETS VAULT ENCRYPTION IS SUITABLE FOR ANY PARTICULAR REGULATORY COMPLIANCE REQUIREMENT; (B) DATA STORED IN THE SECRETS VAULT WILL NOT BE LOST, CORRUPTED, OR RENDERED INACCESSIBLE DUE TO HARDWARE FAILURE, SOFTWARE DEFECTS, OR FORCE MAJEURE EVENTS; (C) DEMO CONTAINERS WILL BE AVAILABLE, PERFORMANT, OR FREE FROM VULNERABILITIES; (D) SCIM PROVISIONING WILL BE ERROR-FREE OR THAT USER DATA SYNCHRONIZED THROUGH SCIM WILL BE ACCURATE OR COMPLETE; (E) THE PLATFORM WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE; (F) THE BYOS INSTALLATION SCRIPT WILL EXECUTE WITHOUT ERRORS ON ALL LINUX DISTRIBUTIONS, KERNEL VERSIONS, OR SERVER CONFIGURATIONS, OR THAT OPKSSH WILL BE COMPATIBLE WITH CUSTOMER'S EXISTING SSH CONFIGURATION, SECURITY SOFTWARE, OR COMPLIANCE REQUIREMENTS; (G) CLOUD RESOURCES PROVISIONED THROUGH BYOC WILL BE PROPERLY TERMINATED IN ALL CIRCUMSTANCES, OR THAT CUSTOMER WILL NOT INCUR UNEXPECTED CLOUD PROVIDER CHARGES; OR (H) THIRD-PARTY SOFTWARE INSTALLED BY THE LICENSED MATERIALS (INCLUDING OPKSSH) WILL BE FREE FROM VULNERABILITIES, DEFECTS, OR SECURITY ISSUES. CUSTOMER IS SOLELY RESPONSIBLE FOR MAINTAINING INDEPENDENT BACKUPS OF ALL DATA, INCLUDING WITHOUT LIMITATION SECRETS VAULT CONTENTS, REALM CONFIGURATIONS, AND USER DATA, AND FOR MONITORING CLOUD RESOURCES PROVISIONED THROUGH BYOC.

9. LIMITATION OF LIABILITY

EXCEPT WITH RESPECT TO BREACH(ES) OF SECTION 1.1 AND/OR 2.1, IN NO EVENT WILL EITHER PARTY OR THEIR LICENSORS BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN ANY WAY CONNECTED WITH THE USE OF THE LICENSED MATERIALS OR ANYTHING PROVIDED IN CONNECTION WITH THIS AGREEMENT, ANY DELAY OR INABILITY TO USE THE LICENSED MATERIALS OR ANYTHING PROVIDED IN CONNECTION WITH THIS AGREEMENT OR OTHERWISE ARISING FROM THIS AGREEMENT, INCLUDING WITHOUT LIMITATION, LOSS OF REVENUE OR ANTICIPATED PROFITS OR LOST BUSINESS OR LOST SALES, WHETHER BASED IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF DAMAGES. EXCEPT WITH RESPECT TO BREACH(ES) OF SECTION 1.1 AND/OR 2.1, THE TOTAL LIABILITY OF EACH PARTY AND ITS LICENSORS, WHETHER BASED IN CONTRACT, TORT (INCLUDING NEGLIGENCE OR STRICT LIABILITY), OR OTHERWISE, WILL NOT EXCEED, IN THE AGGREGATE, THE GREATER OF (i) ONE THOUSAND DOLLARS ($1,000), OR (ii) THE FEES PAID TO XORFOX LLC HEREUNDER IN ONE YEAR PERIOD ENDING ON THE DATE THAT A CLAIM OR DEMAND IS FIRST ASSERTED. THE FOREGOING LIMITATIONS WILL APPLY NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.

10. U.S. GOVERNMENT MATTERS

Notwithstanding anything else, Customer may not provide to any person or export or re-export or allow the export or re-export of the Licensed Materials or any software or anything related thereto or any direct product thereof (collectively "Controlled Subject Matter"), in violation of any restrictions, laws or regulations of the United States Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control, or any other United States or foreign agency or authority. Without limiting the foregoing Customer acknowledges and agrees that the Controlled Subject Matter will not be used or transferred or otherwise exported or re-exported to countries as to which the United States maintains an embargo (collectively, "Embargoed Countries"), or to or by a national or resident thereof, or any person or entity on the U.S. Department of Treasury's List of Specially Designated Nationals or the U.S. Department of Commerce's Table of Denial Orders (collectively, "Designated Nationals"). The lists of Embargoed Countries and Designated Nationals are subject to change without notice. Use of the Licensed Materials is representation and warranty that neither the User nor Realm is located in, under the control of, or a national or resident of an Embargoed Country or Designated National. The Controlled Subject Matter may use or include encryption technology that is subject to licensing requirements under the U.S. Export Administration Regulations. As defined in FAR section 2.101, any software and documentation provided by XorFox LLC are "commercial items" and according to DFAR section 252.2277014(a)(1) and (5) are deemed to be "commercial computer software" and "commercial computer software documentation." Consistent with DFAR section 227.7202 and FAR section 12.212, any use modification, reproduction, release, performance, display, or disclosure of such commercial software or commercial software documentation by the U.S. Government will be governed solely by the terms of this Agreement and will be prohibited except to the extent expressly permitted by the terms of this Agreement.

11. MISCELLANEOUS

If any provision of this Agreement is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable. This Agreement is not assignable, transferable or sublicensable by either party without the other party's prior written consent, not to be unreasonably withheld or delayed; provided that either party may transfer and/or assign this Agreement to a successor in the event of a sale of all or substantially all of its business or assets to which this Agreement relates. Both parties agree that this Agreement is the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement, and that all waivers and modifications must be in a writing signed or otherwise agreed to by each party, except as otherwise provided herein. No agency, partnership, joint venture, or employment is created as a result of this Agreement and neither party has any authority of any kind to bind the other in any respect whatsoever. In any action or proceeding to enforce rights under this Agreement, the prevailing party will be entitled to recover costs and attorneys' fees. All notices under this Agreement will be in writing and will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by facsimile or e-mail; and upon receipt, if sent by certified or registered mail (return receipt requested), postage prepaid. XorFox LLC will not be liable for any loss resulting from a cause over which it does not have direct control. This Agreement will be governed by the laws of the State of Colorado, U.S.A. without regard to its conflict of laws provisions. The federal and state courts sitting in Denver County, Colorado, U.S.A. will have proper and exclusive jurisdiction and venue with respect to any disputes arising from or related to the subject matter of this Agreement.

12. SERVICE LIMITS AND FAIR USE

To maintain platform stability and ensure fair access for all Customers, XorFox LLC enforces the following default resource limits per account. These limits may be adjusted by XorFox LLC at any time without prior notice.

Free Tier Includes:

• 5,000 API Calls per month at no charge
• Up to 2 Realms with OIDC, SAML, and SCIM provisioning
• Secrets Vault with AES-256-GCM encryption (per realm)
• 1 custom theme upload
• 1 Demo Container with OPKSSH
• MCP agent access (25 tools)

Resource Quotas (per account, all tiers):

• Maximum Realms: 2 (Free tier), 20 (Standard/Volume/Enterprise, adjustable on request)
• Maximum Demo Containers: 1 (Free tier), 3 (Standard/Volume)
• Maximum BYOS Servers per Realm: 10
• Maximum BYOC Cloud Credentials per Account: 5
• Maximum Billing Addresses: 10
• Maximum Payment Tokens: 5

Rate Limits:

• MCP API tool calls: 60 per agent per minute

Attempts to exceed these limits will result in the relevant request being rejected. Repeated or automated attempts to circumvent these limits may be considered a breach of Section 2.1 of this Agreement. Customers requiring higher limits should contact XorFox LLC to discuss enterprise arrangements.

13. DATA PRIVACY AND SECURITY

13.1 Customer shall ensure that any and all information or data, including without limitation, personal data, used by Customer in connection with the Agreement ("Customer Data") is collected, processed, transferred and used in full compliance with Applicable Data Protection Laws (as defined below) and that it has all obtained all necessary authorizations and consents from any data subjects to process Customer Data. Customer Data includes, without limitation: (a) data stored in the Secrets Vault; (b) user identity data within Customer's Realms; (c) user data synchronized via SCIM provisioning; and (d) authentication logs and session data.

13.2 Customer shall adopt and maintain appropriate organizational, technical and security measures prior to any such collection, processing or transfer in order to protect against unauthorized access to or use of Customer Data. Customer shall immediately inform XorFox LLC upon becoming aware of any breach within the meaning of Applicable Data Protection Law relating to Customer Data (a "Security Incident") and to cooperate with XorFox LLC in any investigation thereof and in the implementation of any measures reasonably required to be taken in response thereto.

13.3 Secrets Vault Data. XorFox LLC encrypts Secrets Vault data at rest using AES-256-GCM with per-realm managed keys. Notwithstanding the foregoing, XorFox LLC does not guarantee that encrypted data cannot be compromised through means beyond XorFox LLC's reasonable control, including without limitation zero-day vulnerabilities, cryptographic algorithm weaknesses discovered after the date of encryption, or unauthorized access obtained through Customer's own credentials or systems. Customer acknowledges that the Secrets Vault is not a certified HSM or FIPS 140-2 validated module and should not be relied upon as such. Customer is solely responsible for rotating secrets, managing access controls, and maintaining independent backups of vault contents.

13.4 SCIM Provisioning Data. When Customer enables SCIM provisioning, user and group data is transmitted from Customer's identity provider to Customer's Realm via the SCIM endpoint. XorFox LLC processes this data on behalf of Customer as a data processor. Customer is responsible for ensuring that SCIM data transmitted to the platform complies with all applicable privacy laws and that Customer has obtained all necessary consents from data subjects whose information is synchronized.

13.5 Account Closure and Data Deletion. Upon termination of this Agreement or Customer's request for account closure, XorFox LLC will delete Customer's Realms, Secrets Vault contents, user data, payment information, and associated records within a commercially reasonable timeframe. Certain data may be retained as required by applicable law, regulation, or XorFox LLC's SOC 2 compliance obligations. Deleted data cannot be recovered.

13.6 If required by Applicable Data Protection Laws, the parties will enter into standard contractual clauses under GDPR (as defined below) for the transfer of any Customer Data outside of the European Union. For purposes hereof: (a) "Applicable Data Protection Laws" means any applicable laws, statutes or regulations as may be amended, extended or re-enacted from time to time which relate to personal data including without limitation (i) prior to 25 May 2018, the EU Data Protection Directive 95/46/EC as transposed into EU Member State law; (ii) from and after 25 May 2018, GDPR and any EU Member State laws implementing the GDPR; and (iii) the e-Privacy Directive 2002/58/EC, as amended and as transposed into EU Member State law and any legislation replacing the e-Privacy Directive and (b) "GDPR" means the Regulation (EU) 2016/679 of the European Parliament and of the Counsel of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.