CodeHunter Master Services Agreement

This Master Subscription Agreement (“AGREEMENT”) is entered into as of the Effective Date (as defined below) by and between Affirm Logic Corporation d/b/a CodeHunter, a Virginia corporation (“CodeHunter”), and the entity on whose behalf these terms are accepted (“CUSTOMER”).

This Agreement governs Customer’s access to and use of the Services (as defined herein). The parties may enter into one or more ordering documents, statements of work, or order forms referencing this Agreement (each, an “ORDER”). Each executed Order is incorporated into and governed by this Agreement. Entities that directly or indirectly control, are controlled by, or are under common control with Customer, where “control” means ownership of more than fifty percent (50%) of the voting interests or the power to direct management of such Customer (each, a “CUSTOMER AFFILIATE”) may enter into Orders under this Agreement, in which case each such Affiliate agrees to be bound by the terms of this Agreement as if it were an original party hereto.

“EFFECTIVE DATE” means the effective date set forth in the initial Order executed by the parties, or, if no such date is specified, the date the last party executes the initial Order.

1. SERVICES

1.1 Subscription Services.

(a) During the subscription term set forth in an Order (the “SUBSCRIPTION TERM”), CodeHunter will provide Customer with access to its proprietary software-as-a-service platform, including analysis, deconstruction, sandboxing, and reporting (the “SUBSCRIPTION SERVICES”), as described in the applicable Order.

(b) The Subscription Services enable the ingestion, analysis, deconstruction, and reporting of software artifacts, code, logs, and related data (collectively, “SOFTWARE ARTIFACTS”). Software Artifacts are submitted for automated analysis and may include executable code, binaries, logs, and related technical data. Any non-technical or human-readable content embedded within Software Artifacts is not intended to be processed as part of the Services and is not retained except as necessary for processing or system integrity. Access to the Subscription Services is provided via web-based interfaces and application programming interfaces (the “PLATFORM”).

(c) Customer may configure integrations, APIs, and connections to third-party systems, including cloud-based security, content delivery, and infrastructure services (“CONNECTORS”) to enable automated submission of Software Artifacts. Customer acknowledges that such submissions may occur automatically based on Customer-controlled configurations.

(d) Customer may use the Subscription Services solely for its internal business purposes and in accordance with this Agreement and the applicable Order.

1.2 Licensed Materials. To the extent CodeHunter provides any documentation, software components, or other materials (“LICENSED MATERIALS”), CodeHunter grants Customer a limited, non-exclusive, non-transferable, non-sublicensable license to use such Licensed Materials during the Subscription Term solely in connection with the Subscription Services and for Customer’s internal business purposes. CodeHunter retains all rights, title, and interest in and to the Licensed Materials. No software is delivered to Customer as part of the Subscription Services.

1.3 Authorized Users. Customer may permit its employees and contractors (“AUTHORIZED USERS”) to access the Subscription Services. Customer is responsible for all use of the Subscription Services by its Authorized Users and for all activity conducted through its accounts, API credentials, and integrations, including automated submissions.

1.4 Support and Modifications. CodeHunter will provide the Subscription Services in accordance with its applicable service level agreement, viewable at [INSERT URL] (the “SLA”), which is incorporated herein by reference.

1.5 Non-Recurring Services. Customer may purchase implementation or other professional services (“NON-RECURRING SERVICES”), pursuant to an Order or statement of work. Unless otherwise agreed, CodeHunter retains all rights in any deliverables created in connection with such services. The Subscription Services and the Non-Recurring Services are individually or collectively referred to herein as the “SERVICES”.

1.6 Beta and Evaluation Services. From time to time, CodeHunter may make available to Customer certain features, functionality, or services that are designated as beta, preview, trial, or evaluation offerings (“BETA SERVICES”). Beta Services are provided solely for evaluation purposes and may be subject to additional terms or limitations specified by CodeHunter. Customer acknowledges that Beta Services are not fully tested, may contain errors or defects, and may be modified or discontinued at any time without notice. Notwithstanding anything to the contrary in this Agreement, Beta Services are provided “as is” and without any warranties, service levels, or support obligations of any kind. CodeHunter will have no liability arising out of or related to Customer’s use of Beta Services, except to the extent such limitation is prohibited by applicable law. Customer’s use of Beta Services is at its own risk.

2. RESTRICTIONS. Customer shall not (a) sell, lease, sublicense, or otherwise make the Services available to third parties; (b) reverse engineer, decompile, or attempt to derive source code; (c) use the Services to provide services to third parties; (d) interfere with or disrupt the Services; (e) circumvent usage limits or security controls; or (f) use the Services in violation of applicable law.

3. CUSTOMER MATERIALS.

3.1 Customer Data; Ownership. During the Subscription Term, Customer and its Authorized Users may submit, transmit, or otherwise make available to the Subscription Services data, information, content, credentials, configurations, and materials, excluding Software Artifacts (collectively, “CUSTOMER DATA”). As between the parties, Customer retains all right, title, and interest in and to Customer Data. Nothing in this Agreement grants CodeHunter any ownership rights in Customer Data.

3.2 License to Customer Data. Customer hereby grants CodeHunter a non-exclusive, worldwide, royalty-free right and license to use Customer Data solely to provide, operate, maintain, and support the Subscription Services for Customer.

3.3 Software Artifacts. Customer submits Software Artifacts to the Subscription Services for automated analysis. As between the parties, Customer retains any ownership rights it may have in Software Artifacts. Customer represents and warrants that it has all rights necessary to submit such Software Artifacts. Any non-technical or human-readable content embedded in Software Artifacts is not relevant to the Services and may be removed or deleted during processing.

3.4. License to Software Artifacts. Customer grants CodeHunter a non-exclusive, worldwide, perpetual, irrevocable, royalty-free right and license to ingest, process, analyze, reproduce, and use Software Artifacts solely to provide, operate, maintain, and improve the Services. Without limiting the foregoing, CodeHunter may use Software Artifacts and any data derived therefrom, on an aggregated and de-identified basis, to develop, enhance, and improve its analytics, threat intelligence, detection capabilities, and machine learning models, provided that such use does not identify Customer or disclose Software Artifacts in identifiable form.

3.5 Automated Submission. Customer acknowledges that Software Artifacts may be submitted to the Subscription Services automatically through Customer-configured integrations, APIs, or workflows. Customer is solely responsible for such configurations and any resulting submission of Software Artifacts.

3.6 Incidental Data. The Services are not designed to process personal data, protected health information or sensitive information and Customer shall not knowingly provide such data to CodeHunter. However, Customer acknowledges Software Artifacts may incidentally contain such information. Customer is solely responsible for ensuring that its use of the Services complies with applicable laws, including with respect to any personal data included in Customer Data. CodeHunter does not monitor or filter Customer Data for the presence of personal data.

3.7 Data Retention. Customer Data is retained by CodeHunter as long as reasonably necessary to provide the Services. Software Artifacts that are identified as containing potential risks may be retained for up to thirty (30) days for purposes of analysis, system improvement, and security. Thereafter, Customer Data and Software Artifacts are deleted in accordance with CodeHunter’s data retention practices; provided that residual copies may persist in backup systems for a limited period of time.

3.8 Usage Data. CodeHunter may collect and use aggregated, de-identified data regarding use of the Services (“USAGE DATA”) including performance metrics, detection patterns, and threat insights, to operate, maintain, and improve the Services and for internal reporting and analytics purposes, provided that such Usage Data does not identify Customer or include Customer Data in identifiable form.

4. THIRD PARTY SERVICES AND CONNECTORS.

The Subscription Services may interoperate with Connectors, including for the ingestion of Software Artifacts into the Services and the transmission of analysis results, reports, or other outputs from the Services to such third-party systems.

Customer is solely responsible for: (a) obtaining and maintaining any required rights, licenses, or access to such third-party services; (b) configuring and managing all Connectors, including the direction, scope, and content of any data transmitted to or from the Services; and (c) ensuring that any transmission of Software Artifacts or Service outputs to third-party systems complies with applicable laws and third-party terms.

CodeHunter does not control and is not responsible for any third-party services or Connectors, or for any data transmitted to or from such services. CodeHunter makes no representations or warranties regarding the availability, performance, or security of any third-party services and disclaims all liability arising from or related to Customer’s use of Connectors.

5. FEES AND PAYMENT. Customer shall pay all fees set forth in each Order (“FEES”). Fees may include a base subscription fee, as well as additional fees based on integrations and volumes of Software Artifacts processed, as specified in the applicable Order. Fees are due within thirty (30) days of invoice unless otherwise specified in an Order. Customer will pay all Fees without setoff or deduction. Fees are non-refundable and non-cancellable except as expressly stated. If usage exceeds purchased amounts, Customer will pay applicable overage fees. CodeHunter may charge interest on overdue amounts at the rate of 1.5% per month or the maximum permitted by law, whichever is less, and may suspend Services for non-payment. Customer is responsible for all applicable taxes.

6. CUSTOMER RESPONSIBILITIES.

6.1 Customer is solely responsible for: (a) the accuracy, quality, legality, and content of all Customer Data submitted to the Subscription Services; (b) ensuring that it has all rights, permissions, and authorizations necessary to submit Customer Data and Software Artifacts to the Subscription Services and to grant the rights set forth in this Agreement; (c) the configuration and use of any integrations, APIs, and Connectors, including the direction, scope, and content of any data transmitted to or from the Services; (d) maintaining the confidentiality and security of its account credentials, API keys, and access tokens, and for all activities conducted through its accounts, systems, and integrations; (e) its use of the Subscription Services and any outputs, analyses, or results generated by the Services, including any reliance on such outputs for security or operational decisions; and (f) maintaining all systems, infrastructure, and connectivity necessary to access and use the Subscription Services.

6.2 Customer will not: (i) submit Customer Data or Software Artifacts in violation of applicable law or third-party rights; or (ii) submit or make available to the Subscription Services any Customer Data that includes personal data, personally identifiable information (PII), protected health information (PHI), or other regulated or sensitive information, except to the limited extent necessary for account creation, authentication, billing, or support-related communications.

6.3 Customer acknowledges that Software Artifacts may contain malicious or harmful code and that Customer is solely responsible for determining whether to submit such Software Artifacts to the Services.

7. CONFIDENTIALITY. Each party agrees to protect the other party’s confidential information using reasonable care and to use it only for purposes of this Agreement. Each party agrees to protect the other party’s Confidential Information using at least reasonable care and to use such information solely for purposes of this Agreement. “Confidential Information” means non-public information disclosed by a party that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information. Confidential Information does not include information that (a) is publicly available, (b) was known without restriction, (c) is independently developed, or (d) is rightfully received from a third party.

8. SECURITY; PRIVACY. CodeHunter will maintain reasonable administrative, technical, and physical safeguards designed to protect the Services. Each party will promptly notify the other of any known unauthorized access to data. To the extent personal data is processed, the parties will comply with applicable data protection laws and any applicable data processing addendum.

9. AI AND AUTOMATED PROCESSING. The Subscription Services utilize automated analysis, artificial intelligence, and machine learning technologies to ingest, analyze, and generate outputs based on Customer Data and Software Artifacts. Customer acknowledges and agrees that CodeHunter may use Software Artifacts and data derived from Customer’s use of the Services, on an aggregated and de-identified basis, to develop, train, improve, and enhance its models, analytics, detection capabilities, and related services, provided that such use does not identify Customer or disclose Customer Data in identifiable form. CodeHunter will not use Customer Data or Software Artifacts to train models in a manner that is intended to identify Customer or to expose Customer Data to other customers. As between the parties, Customer retains all rights in its Customer Data and any outputs generated specifically for Customer’s use of the Services, and CodeHunter retains all rights, title, and interest in and to the Services, including all models, algorithms, improvements, and derivative works thereof. Customer acknowledges that outputs generated by the Services are based on automated and probabilistic processes and are provided for informational purposes only. CodeHunter does not guarantee the accuracy, completeness, or reliability of such outputs, and such outputs should not be relied upon as Customer’s sole basis for security or operational decisions.

10. LIMITED WARRANTY AND DISCLAIMER.

10.1 Mutual Representations. Each party represents that it has the authority to enter into this Agreement.

10.2 CodeHunter Warranties. CodeHunter warrants that:

(a) The Subscription Services will operate in all material respects in accordance with the applicable documentation made available by CodeHunter.

(b) The Non-Recurring Services shall be provided in a professional and workmanlike manner, in accordance with industry standards.

(c) The Services will be performed by CodeHunter in compliance with applicable laws and regulations.

10.3 Customer’s sole and exclusive remedy, and CodeHunter’s sole obligation, for any breach of the warranties set forth in Section 10.2 will be for CodeHunter to use commercially reasonable efforts to correct the non-conforming Subscription Services or re-perform the applicable Non-Recurring Services. If CodeHunter is unable to correct such non-conformance within a reasonable period of time, either party may terminate the affected Subscription Services, and CodeHunter will refund any prepaid fees for the unused portion of the applicable Subscription Term.

10.4 EXCEPT AS OTHERWISE EXPRESSLY REPRESENTED OR WARRANTED IN THIS AGREEMENT, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICES, THE DOCUMENTATION, AND ANY OTHER PRODUCTS OR SERVICES PROVIDED BY CODEHUNTER ARE PROVIDED “AS IS,” AND CODEHUNTER DISCLAIMS ANY AND ALL OTHER PROMISES, REPRESENTATIONS AND WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, NON-INTERFERENCE, SYSTEM INTEGRATION AND/OR DATA ACCURACY. CODEHUNTER DOES NOT WARRANT THAT THE SERVICES OR ANY OTHER PRODUCTS OR SERVICES PROVIDED BY CODEHUNTER WILL MEET CUSTOMER’S REQUIREMENTS OR THAT THE OPERATION OF THE APPLICATION SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT ALL ERRORS WILL BE CORRECTED. CUSTOMER ACKNOWLEDGES THAT SOFTWARE ARTIFACTS MAY CONTAIN EMBEDDED DATA OR CONTENT THAT IS NOT RELEVANT TO THE SERVICES. CODEHUNTER DOES NOT REVIEW OR VALIDATE SUCH CONTENT AND DISCLAIMS ANY RESPONSIBILITY FOR SUCH EMBEDDED INFORMATION. CODEHUNTER DOES NOT GUARANTEE THAT THE SERVICES WILL DETECT ALL THREATS, VULNERABILITIES, OR MALICIOUS ACTIVITY. NO WARRANTY IS MADE ON THE BASIS OF COURSE OF PERFORMANCE, COURSE OF DEALING, OR TRADE USAGE. THE SERVICES ARE DESIGNED TO ASSIST IN IDENTIFYING POTENTIAL RISKS. CODEHUNTER DOES NOT GUARANTEE THAT ALL THREATS OR VULNERABILITIES WILL BE DETECTED.

11. INDEMNIFICATION.

11.1 Indemnification of Customer.

(a) CodeHunter agrees to defend or settle any claim brought against Customer by an unaffiliated third party alleging that Customer’s use of the Services as authorized by this Agreement infringes such third party’s intellectual property rights (an “INFRINGEMENT CLAIM”). CodeHunter shall pay all amounts that are finally awarded against Customer based on any such claims by a court of competent jurisdiction or any amounts that CodeHunter has agreed to pay in settlement of the relevant third-party claim.

(b) If an Infringement Claim is made or appears possible, Customer agrees to permit CodeHunter, at CodeHunter’s sole discretion, to: (i) enable Customer to continue to use the Services; (ii) to modify or replace any such infringing material to make it non-infringing; or (iii) require Customer to cease use of, and, if applicable, return, such materials as are the subject of the infringement claim, and in the case of this clause (iii), CodeHunter shall in connection with such requirement refund unearned pro rata portion of fees attributable to the materials or portion of the Services with regard to which the use is discontinued.

(c) CodeHunter will have no obligation to indemnify where the alleged infringement, violation or misappropriation arises, in whole or in part, from: (i) modification of any CodeHunter product or services; (ii) combination, operation or use of any CodeHunter products or service with other software, hardware, systems or technologies not provided by CodeHunter or explicitly authorized by the Documentation; (iii) Customer’s breach of Sections 3.3 or 6; or (iv) Customer’s use of the Services other than in accordance with the Documentation.

(d) THE PROVISIONS OF THIS SECTION 11 SET FORTH CODEHUNTER’S SOLE AND EXCLUSIVE OBLIGATIONS, AND CUSTOMER’S SOLE AND EXCLUSIVE REMEDIES, WITH RESPECT TO THIRD PARTY CLAIMS OF INFRINGEMENT OR MISAPPROPRIATION OF INTELLECTUAL PROPERTY RIGHTS OF ANY KIND.

11.2 Indemnification of CodeHunter. Customer shall defend or settle any claim brought against CodeHunter by an unaffiliated third party arising from Customer Data or Customer’s use of the Services in violation of this Agreement. Customer shall pay all amounts that are finally awarded against CodeHunter based on any such claims by a court of competent jurisdiction or any amounts that Customer has agreed to pay in settlement of the relevant third-party claim.

11.3 Indemnification Procedures. With respect to any claim, demand or action for which an indemnity is provided under this section, the party to be indemnified (the “INDEMNIFIED PARTY“) shall: (i) give prompt written notice to the indemnifying party (the “INDEMNIFYING PARTY“) of the claim, demand or action for which an indemnity is sought (provided, however, that failure of Indemnified Party to provide such notice will not release the Indemnifying Party from any of its indemnity obligations except to the extent that the Indemnifying Party’s ability to defend such claim is prejudiced thereby), (ii) reasonably cooperate in the defense or settlement of any such claim, demand or action, at the expense of the Indemnifying Party; and (iii) give the Indemnifying Party sole control over the defense or settlement of any such claim; provided, however, the Indemnifying Party shall not enter into any settlement without the Indemnified Party’s express consent that (1) assigns, imparts or imputes fault or responsibility to the Indemnified Party or its affiliates, (2) includes a consent to an injunction or similar relief binding upon the Indemnified Party or its affiliates, (3) fails to contain reasonable confidentiality obligations protecting the confidentiality of the settlement, or (4) provides for relief other than monetary damages that the Indemnifying Party solely bears.

12. LIMITATION OF LIABILITY. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, OR USE, ARISING OUT OF OR RELATED TO THIS AGREEMENT, REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT, OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

CODEHUNTER WILL NOT BE LIABLE FOR (A) THE CONTENT, ACCURACY, OR COMPLETENESS OF ANY CUSTOMER DATA OR SOFTWARE ARTIFACTS SUBMITTED TO THE SERVICES, (B) CUSTOMER’S FAILURE TO IMPLEMENT APPROPRIATE SECURITY MEASURES OR TO USE THE SERVICES IN ACCORDANCE WITH DOCUMENTATION, OR (C) ANY FAILURE TO IDENTIFY, DETECT, OR PREVENT VULNERABILITIES, THREATS, OR MALICIOUS ACTIVITY.

EXCEPT FOR (i) CUSTOMER’S PAYMENT OBLIGATIONS, (ii) EITHER PARTY’S INDEMNIFICATION OBLIGATIONS, (iii) A PARTY’S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS, OR (iv) A PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, EACH PARTY’S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED THE TOTAL FEES PAID BY CUSTOMER FOR THE SERVICES IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

THE LIMITATIONS IN THIS SECTION APPLY NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY REMEDY.

13. TERM; TERMINATION.

13.1 Term. This Agreement will be in effect as of the effective date set forth on an Order and continue until the Subscription Terms under all Orders have expired, unless terminated sooner as provided herein. Except as otherwise specified in an Order, the Subscription Term under an Order will automatically renew for successive twelve-month periods unless either party gives the other party notice of non-renewal at least 60 days before the end of the Subscription Term (each, a “RENEWAL TERM”).

13.2 Termination. Either Party may terminate this Agreement: (a) for material breach, upon thirty (30) days’ written notice, if such breach remains uncured at the end of such period; or (b) immediately upon written notice if the other party becomes insolvent, files for bankruptcy, has a receiver appointed, or ceases to conduct business in the ordinary course. If Customer terminates this Agreement or an Order for any reason other than CodeHunter’s uncured material breach, all Fees for the remainder of the applicable Subscription Term will become immediately due and payable, and no prepaid Fees will be refunded.

13.3 Effect of Termination. Upon expiration or termination of this Agreement, (a) Customer will immediately cease use of the Services; (b) each party will cease use of the other party’s Confidential Information (subject to retention as required by law); and (c) all outstanding payment obligations will become immediately due and payable. Sections relating to intellectual property, confidentiality, disclaimers, limitation of liability, and any other provisions which by their nature should survive will survive termination.

13.4 Suspension of the Services. CodeHunter may suspend Customer’s access to the Services, in whole or in part, upon written notice if: (a) Fees are more than thirty (30) days past due; (b) Customer is in breach of Sections 2 (Restrictions) or 3 (Customer Data); (c) suspension is reasonably necessary to prevent harm to the Services, CodeHunter, or other customers; or (d) required by law or governmental order. CodeHunter will use commercially reasonable efforts to limit suspension to the affected portion of the Services and to restore access promptly once the issue is resolved.

14. Miscellaneous.

14.1 Compliance with Laws. Each party will comply with applicable laws in connection with its performance under this Agreement. Customer will comply with all applicable export control and sanctions laws.

14.2 Governing Law; Severability. This Agreement is governed by the laws of the Commonwealth of Virginia, without regard to choice-of-law provisions. Each party hereby agrees that any and all causes of action between the parties arising from or in relation to this Agreement shall be brought exclusively in the state and federal courts located within the Commonwealth of Virginia.

14.3 Notices. All notices under this Agreement must be in writing and will be deemed given upon receipt if delivered by hand, recognized overnight courier, or certified mail. Notices may also be sent by email if confirmed by a non-automated reply.

14.4 Assignment. Customer may not assign this Agreement without CodeHunter’s prior written consent, not to be unreasonably withheld. Notwithstanding the foregoing, either party may assign this Agreement without consent in connection with a merger, acquisition, or sale of substantially all of its assets, upon written notice to the other party.

14.5 Force Majeure. CodeHunter will not be liable for any delay or failure due to acts of God, earthquakes, shortage of supplies, transportation difficulties, labor disputes, riots, war, fire, epidemics, and force majeure events and other causes beyond CodeHunter’s reasonable control.

14.6 Publicity. CodeHunter may identify Customer as a customer and use Customer’s name and logo in its marketing materials, subject to Customer’s reasonable brand guidelines.

14.7 Entire Agreement. This Agreement, together with all Orders, constitutes the entire agreement between the parties and supersedes all prior agreements. Any conflicting or additional terms in a purchase order or similar document are void and of no effect.

14.8 Amendments. This Agreement may be amended only in writing signed by both parties, except that CodeHunter may update online policies referenced herein (e.g., acceptable use or security policies) upon reasonable notice.

14.9 Independent Contractors. The parties are independent contractors and nothing in this Agreement creates any partnership, joint venture, or agency relationship.

14.10 Severability; Waiver. If any provision is held unenforceable, it will be modified to the minimum extent necessary, and the remainder will remain in effect. Failure to enforce any provision will not constitute a waiver.