Expel, Inc Terms and Conditions Version 1.4 Last updated: June 15, 2020 SERVICES. The Services consist of: Expel’s proprietary, cloud-based software platform, which can be accessed and used on a hosted basis, and related services, for security operations management, as shall be described on the relevant Sales Order. DEFINITIONS. Capitalized terms shall have the meanings set forth in this section, or in the section where they are first used. “Access Protocols” means the passwords, access codes, technical specifications, connectivity standards or protocols, or other relevant procedures, as may be necessary to allow Licensee or any Authorized Users to access the Services. “Authorized User” means any individual who is an employee of Licensee or such other person or entity as may be authorized by Expel to access the Services pursuant to Licensee’s rights under this Agreement. “Integration Partner” means any third party that produces security software that has been deployed by Licensee and is used in conjunction with the Expel Services. “Intellectual Property Rights” means any and all now known or hereafter existing (a) rights associated with works of authorship, including copyrights, mask work rights, and moral rights; (b) trademark or service mark rights; (c) trade secret rights; (d) patents, patent rights, and industrial property rights; (e) layout design rights, design rights, and other proprietary rights of every kind and nature other than trademarks, service marks, trade dress, and similar rights; and (f) all registrations, applications, renewals, extensions, or reissues of the foregoing, in each case in any jurisdiction throughout the world. “Licensee Content” means any content that is uploaded onto the Services by Licensee or otherwise used on or in connection with the Software. “Sales Order” means any order form or other writing agreed between the parties identifying the Services to be made available by Expel pursuant to this Agreement, the subscription term, and any limitations or restrictions in connection with Licensee’s access to and use of such Services. “Software” means the software programs and any associated user interfaces and related technology that Expel makes available pursuant to this Agreement for access and use through the Services. PROVISION OF SERVICES Access. Expel will provide the Services via an online user portal. On or as soon as reasonably practicable after the execution of the Sales Order and acceptance of this Agreement, Expel shall provide to Licensee the necessary passwords, security protocols and policies and network links or connections and Access Protocols to allow Licensee and its Authorized Users to access the Services in accordance with the Access Protocols. Responsibility for Software and Content Hosting. Expel shall use commercially reasonable efforts to host and make available the Software accessible as part of the Services, provided that nothing herein shall be construed to require Expel to provide for, or bear any responsibility with respect to any telecommunications or computer network hardware required by Licensee or any Authorized User to provide access from the Internet to the Services. The Software may only be used in conjunction with the Services. Licensee shall not modify or distribute the Software in any way without the prior express written consent of Expel. Support Services. Expel shall use commercially reasonable efforts to provide the support services in accordance with Expel’s then-current service level agreement for the applicable Services as further described in the Support Exhibit. INTELLECTUAL PROPERTY License Grant. Subject to the terms and conditions of this Agreement, Expel grants to Licensee a non-exclusive, non-transferable license during the term set forth on the Sales Order to access and use the Services in accordance with the terms of this Agreement and any restrictions or limitations set forth on the applicable Sales Order(s). Ownership; Limitations. The Services (excluding the Licensee Content hosted thereon), Software, and all other materials provided by Expel hereunder, including but not limited to all manuals, reports, records, programs, data and other materials, and all Intellectual Property Rights in each of the foregoing, are the exclusive property of Expel and its suppliers. Licensee agrees that it will not, and will not permit any Authorized User or other party to: (a) permit any party to access the Software or use the Services, other than the Authorized Users authorized under this Agreement; (b) modify, adapt, alter or translate the Software, except as expressly allowed herein; (c) sublicense, lease, rent, loan, distribute, or otherwise transfer the Software to any third party; (d) reverse engineer, decompile, disassemble, or otherwise derive or determine or attempt to derive or determine the source code (or the underlying ideas, algorithms, structure or organization) of the Software; (e) use or copy the Software except as expressly allowed under this subsection; or (f) disclose or transmit any data contained in the Software to any individual other than an Authorized User, except as expressly allowed herein. Except as expressly set forth herein, no express or implied license or right of any kind is granted to Licensee regarding the Services, Software, or any part thereof, including any right to obtain possession of any source code, data or other technical material relating to the Software. License to Reports. As part of the Services, Expel will create and make available to Licensee security incident and other related reports (“Reports”). Expel hereby grants to Licensee the non-exclusive, non-sublicensable, non-transferable, right to use, reproduce, modify, create derivative works of, and display the Reports solely for Licensee’s internal business purposes. Licensee shall not have the right to distribute or otherwise make available the Reports to any third party, except as is required by law or by the order of a court or similar judicial or administrative body. Reservation of Rights. All rights in and to the Services and Software not expressly granted to Licensee in this Agreement are reserved by Expel and its suppliers. Except as expressly set forth herein, no express or implied license or right of any kind is granted to Licensee regarding the Software and Services or any part thereof, including any right to obtain possession of any source code, data or other technical material related to the Software. Open Source Software. Certain items of software may be provided to Licensee with the Software and are subject to “open source” or “free software” licenses (“Open Source Software”). Some of the Open Source Software is owned by third parties. The Open Source Software is not subject to the terms and conditions of the section titled Indemnification or the subsection titled License Grant. Instead, each item of Open Source Software is licensed under the terms of the end-user license that accompanies such Open Source Software. Nothing in this Agreement limits Licensee’s rights under, or grants Licensee rights that supersede, the terms and conditions of any applicable end user license for the Open Source Software. If required by any license for particular Open Source Software, Expel makes such Open Source Software, and Expel’s modifications to that Open Source Software, available by written request at the notice address specified below. Feedback. Licensee agrees that Expel has the right to use any reporting of errors, problems, or defects, or suggestions for changes and improvements to the Services made by Licensee (collectively, “Feedback”) at its sole discretion, including incorporating all or some of the Feedback into the Software and Services or any other version of the Software and Services Expel may make available, or any other software or intellectual property created by Expel, all without notice to, payment of or consent from Licensee. This right is an unlimited, perpetual, fully paid-up, worldwide, non-exclusive, fully transferable, fully sublicensable and irrevocable right to execute, reproduce, distribute, perform, display, modify, create derivative works of, make, have made, use, import, sell, offer to sell and otherwise transfer the Feedback and to practice or have practiced any process or method involved in any use thereof. Licensee agrees and acknowledges that any products and services incorporating such Feedback will be the sole and exclusive property of Expel, and Licensee will gain no right, title or interest in or to the Software, Services, or any other products or services by virtue of Licensee’s provision of Feedback to Expel or for any other reason. FEES. Licensee agrees to pay to Expel the fees for the Services ordered, as set forth on Expel’s then-current pricing list (“Fees”). Except as otherwise set forth on a Sales Order, Fees shall be paid on an annual basis, in advance, net thirty (30) days of receipt of invoice. In addition to the Fees, Licensee agrees to pay, and to indemnify and hold Expel harmless from, any sales, use, excise, import or export, value added or similar tax or duty not based on Expel’s net income, including any penalties and interest, as well as any costs associated with the collection or withholding thereof, and all governmental permit fees, license fees and customs and similar fees which Licensor may incur in connection with this Agreement. LICENSEE CONTENT AND RESPONSIBILITIES License; Ownership. Licensee grants Expel a non-exclusive, worldwide, royalty-free and fully paid license (a) to use the Licensee Content as necessary for purposes of providing and improving the Services, and (b) to use the Licensee trademarks, service marks, and logos as required to provide the Services. The Licensee Content hosted by Expel as part of the Services, and all worldwide Intellectual Property Rights in it, is the exclusive property of Licensee. Licensee further grants Expel the right to create anonymous profiles and derivative insights based on the Licensee Content (the “Insights”) that it may use in connection with its business purposes; provided, however, that such Insights do not disclose any Confidential Information of Licensee or otherwise disclose the identity of Licensee or any Authorized User. Expel will own all such Insights. All rights in and to the Licensee Content not expressly granted to Expel in this Agreement are reserved by Licensee. Authorized Users Access to Services. Licensee may permit any Authorized Users to access and use the features and functions of the Services as contemplated by this Agreement and the restrictions in the Sales Order. User IDs cannot be shared or used by more than one Authorized User at a time. Licensee shall use commercially reasonable efforts to prevent unauthorized access to, or use of, the Services, and notify Expel promptly of any such unauthorized use known to Licensee. Licensee Warranty. Licensee represents and warrants that any Licensee Content hosted by Expel as part of the Services shall not (a) infringe any copyright, trademark, or patent; (b) misappropriate any trade secret; (c) be deceptive, defamatory, obscene, pornographic or unlawful; (d) contain any viruses, worms or other malicious code intended to damage Expel’s system or data; or (e) otherwise violate the rights, including any applicable privacy rights, of a third party. Expel is not obligated to back up any Licensee Content; the Licensee is solely responsible for creating backup copies of any Licensee Content at Licensee’s sole cost and expense. Licensee agrees that any use of the Services contrary to or in violation of the representations and warranties of Licensee in this section constitutes unauthorized and improper use of the Services. Licensee Responsibility for Data and Security. Licensee and its Authorized Users shall have access to the Licensee Content and shall be responsible for all changes to and/or deletions of Licensee Content and the security of all passwords and other Access Protocols required in order the access the Services. Licensee shall have the sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of all Licensee Content. WARRANTIES. Expel represents and warrants from a period of thirty (30) days from the date that Expel makes available the Services to Licensee, the Services will operate in material conformance with the functionality described on Expel’s website relating to the applicable Services; provided, however, Licensee has complied with all instructions and other requirements necessary to access and use the Services. Except for the foregoing warranty, to the maximum extent permitted by law, the Software, Services, and all other documentation and materials are provided “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. LICENSEE ACCESS AND USES THE SERVICES AT ITS OWN RISK. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY LICENSOR OR ITS AGENTS OR EMPLOYEES SHALL IN ANY WAY INCREASE THE SCOPE OF THIS WARRANTY. NOTWITHSTANDING ANY PROVISION OF THESE TERMS AND CONDITIONS, ANY SALES ORDER OR OTHERWISE TO THE CONTRARY, IN THE EVENT THERE ARE NO FEES ASSOCIATED WITH ANY SALES ORDER, OR IF EXPEL IS UNABLE AFTER A REASONABLE PERIOD OF TIME TO COLLECT ANY FEES ASSOCIATED WITH ANY SALES ORDER, EXPEL MAKES NO REPRESENTATIONS OR WARRANTY WHATSOEVER AND, TO THE FULLEST EXTENT PERMITTED BY LAW, HEREBY DISCLAIMS ANY AND ALL WARRANTIES, ORAL OR WRITTEN, EXPRESS OR IMPLIED AT LAW. LIMITATION OF LIABILITY Types of Damages. TO THE EXTENT LEGALLY PERMITTED UNDER APPLICABLE LAW, EXPEL OR ITS SUPPLIERS SHALL NOT BE LIABLE TO LICENSEE FOR ANY SPECIAL, INDIRECT, EXEMPLARY, PUNITIVE, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY NATURE INCLUDING, BUT NOT LIMITED TO DAMAGES OR COSTS DUE TO LOSS OF PROFITS, DATA, REVENUE, GOODWILL, PRODUCTION OR USE, BUSINESS INTERRUPTION, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR PERSONAL OR PROPERTY DAMAGE ARISING OUT OF OR IN CONNECTION WITH EXPEL’S PERFORMANCE HEREUNDER OR THE USE, MISUSE, OR INABILITY TO USE THE SOFTWARE, SERVICES OR OTHER PRODUCTS OR SERVICES HEREUNDER, REGARDLESS OF THE CAUSE OF ACTION OR THE THEORY OF LIABILITY, WHETHER IN TORT, CONTRACT, OR OTHERWISE, EVEN IF EXPEL HAS BEEN NOTIFIED OF THE LIKELIHOOD OF SUCH DAMAGES. Amount of Damages. THE MAXIMUM LIABILITY OF EXPEL ARISING OUT OF OR IN ANY WAY CONNECTED TO THIS AGREEMENT SHALL NOT EXCEED THE FEES PAID BY LICENSEE TO EXPEL DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT, ACT, OR OMISSION GIVING RISE TO THE LIABILITY. FOR THE AVOIDANCE OF DOUBT, IN THE EVENT THERE ARE NO FEES ASSOCIATED WITH ANY SALES ORDER, OR IF EXPEL IS UNABLE TO COLLECT ANY FEES ASSOCIATED WITH ANY SALES ORDER BY SIXTY (60) DAYS PAST THEIR DUE DATE, EXPEL SHALL HAVE NO LIABILITY WHATSOEVER, NOTWITHSTANDING ANY PROVISION OF THESE TERMS AND CONDITIONS, ANY SALES ORDER OR OTHERWISE TO THE CONTRARY. IN NO EVENT SHALL EXPEL’S SUPPLIERS HAVE ANY LIABILITY ARISING OUT OF OR IN ANY WAY CONNECTED TO THIS AGREEMENT. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE EXPEL’S LIABILITY FOR GROSS NEGLIGENCE OR INTENTIONAL MISCONDUCT OF EXPEL OR ITS EMPLOYEES OR AGENTS OR FOR DEATH OR PERSONAL INJURY. SOME STATES AND JURISDICTIONS DO NOT ALLOW FOR THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION AND EXCLUSION MAY NOT APPLY TO LICENSEE. Basis of the Bargain. The parties agree that the limitations of liability set forth in this section shall survive and continue in full force and effect despite any failure of consideration or of an exclusive remedy. The parties acknowledge that the prices have been set and the Agreement entered into in reliance upon these limitations of liability and that all such limitations form an essential basis of the bargain between the parties. These Terms and Conditions are entered into by and between, and may be enforced only by, Expel and Licensee. These Terms and conditions shall not be deemed to create any rights or liabilities in any third parties, including Integration Partner(s), nor to create any obligations of a party to any such third parties, and any such rights and liabilities are hereby expressly disclaimed. CONFIDENTIALITY Confidential Information. During the term of this Agreement, each party (the “Disclosing Party”) may provide the other party (the “Receiving Party”) with certain information regarding the Disclosing Party’s business, technology, products, or services or other confidential or proprietary information that is marked as “confidential” or “proprietary” or which the Receiving Party should reasonably know is confidential and/or proprietary, given the nature of information and context of disclosure (collectively, “Confidential Information”). For the avoidance of doubt, the Software, and all enhancements and improvements thereto will be considered Confidential Information of Expel. Protection of Confidential Information. The Receiving Party agrees that it will not use or disclose to any third party any Confidential Information of the Disclosing Party, except as expressly permitted under this Agreement. The Receiving Party will limit access to the Confidential Information to Authorized Users (with respect to Licensee) or to those employees who have a need to know, who have confidentiality obligations no less restrictive than those set forth herein, and who have been informed of the confidential nature of such information (with respect to Expel). In addition, the Receiving Party will protect the Disclosing Party’s Confidential Information from unauthorized use, access, or disclosure in the same manner that it protects its own proprietary information of a similar nature, but in no event with less than reasonable care. At the Disclosing Party’s request or upon termination of this Agreement, the Receiving Party will return to the Disclosing Party or destroy (or permanently erase in the case of electronic files) all copies of the Confidential Information that the Receiving Party does not have a continuing right to use under this Agreement, and the Receiving Party shall provide to the Disclosing Party a written affidavit certifying compliance with this sentence. Exceptions. The confidentiality obligations set forth in this section will not apply to any information that (a) becomes generally available to the public through no fault of the Receiving Party; (b) is lawfully provided to the Receiving Party by a third party free of any confidentiality duties or obligations; (c) was already known to the Receiving Party at the time of disclosure; (d) the Receiving Party can prove, by clear and convincing evidence, was independently developed by employees and contractors of the Receiving Party who had no access to the Confidential Information; or (e) is necessary to be disclosed to Integration Partner(s) in order for Expel to perform the Services. In addition, the Receiving Party may disclose Confidential Information to the extent that such disclosure is necessary for the Receiving Party to enforce its rights under this Agreement or is required by law or by the order of a court or similar judicial or administrative body, provided that the Receiving Party promptly notifies the Disclosing Party in writing of such required disclosure and cooperates with the Disclosing Party if the Disclosing Party seeks an appropriate protective order. INDEMNIFICATION By Expel. Expel will defend at its expense any suit brought against Licensee, and will pay any settlement Expel makes or approves, or any damages finally awarded in such suit, insofar as such suit is based on a claim by any third party alleging that the Software or the Services misappropriates any trade secret recognized under the Uniform Trade Secrets Act or infringes any copyright or United States patent issued as of the date Licensee accepts this Agreement. If any portion of the Software or the Services becomes, or in Expel’s opinion is likely to become, the subject of a claim of infringement, Licensee will immediately cease all use of the Software and Services upon notice by Expel. Notwithstanding the foregoing, Expel shall have no obligation under this section or otherwise with respect to any infringement claim based upon (a) any use of the Software or the Services not in accordance with this Agreement; (b) any use of the Software or the Services in combination with other products, equipment, software or data not supplied by Expel; or (c) any modification of the Software or the Services by any person other than Expel or its authorized agents. This subsection states the sole and exclusive remedy of Licensee and the entire liability of Expel, or any of the officers, directors, employees, shareholders, contractors or representatives of the foregoing, for infringement claims and actions. By Licensee. Licensee will defend at its expense any suit brought against Expel, and will pay any settlement Licensee makes or approves, or any damages finally awarded in such suit, insofar as such suit is based on a claim arising out of or relating to Licensee’s (and any of Licensee’s Authorized Users’) breach or alleged breach of the subsections titled Licensee Warranty. This subsection states the sole and exclusive remedy of Expel and the entire liability of Licensee, or any of the officers, directors, employees, shareholders, contractors or representatives of the foregoing, for the claims and actions described herein. Procedure. The indemnifying party’s obligations as set forth above are expressly conditioned upon each of the foregoing: (a) the indemnified party shall promptly notify the indemnifying party in writing of any threatened or actual claim or suit; (b) the indemnifying party shall have sole control of the defense or settlement of any claim or suit; and (c) the indemnified party shall cooperate with the indemnifying party to facilitate the settlement or defense of any claim or suit. TERM AND TERMINATION Term. This Agreement remains in effect so long as any Sales Order is in effect. Each Sales Order remains in effect for the period of time set forth on the Sales Order (“Initial Term”), unless earlier terminated by either party in accordance with the subsection titled Termination. Following the Initial Term, the Sales Order shall automatically renew for additional, successive periods of one (1) year (each, a “Renewal Term”), at the same terms as the final year of the Initial Term, unless and until either party gives notice to the other party of its intent not to renew the Sales Order at least ninety (90) days prior to the end of the Initial Term or then-current Renewal Term. The Initial Term and any Renewal Term(s) are collectively referred to herein as the “Term”. Termination. Either party may terminate this Agreement immediately upon notice to the other party if the other party materially breaches this Agreement, and such breach remains uncured more than thirty (30) days after receipt of written notice of such breach. Effect of Termination. Upon termination of this Agreement for any reason: (a) all rights and obligations of both parties, including all licenses granted hereunder, shall immediately terminate; and (b) within ten (10) days after the effective date of termination, each party shall comply with the obligations to return all Confidential Information of the other party, as set forth in the section titled Confidentiality. The sections and subsections titled Definitions, Limitations, Ownership, Feedback, Disclaimer of Warranties, Limitation of Liability, Confidentiality, Indemnification, Effect of Termination, and Miscellaneous will survive expiration or termination of this Agreement for any reason. MISCELLANEOUS Compliance with Laws. Licensee shall comply with all laws, regulations, rules, ordinances and orders applicable to its access to and use of the Services. Without limiting the foregoing, Licensee shall comply with the relevant export administration and control laws and regulations, as may be amended from time to time, including, without limitation, the United States Export Administration Act, to ensure that the Services are not transferred or exported (directly or indirectly) in violation of U.S. law. Assignment. Licensee may not assign or delegate, directly or indirectly, by operation of law, change of control or otherwise, this Agreement or any of its rights or obligations under this Agreement to any third party, and any attempt to do so will be void and of no effect. Governing Law and Venue. This Agreement will be subject to and governed by the laws of the Commonwealth of Virginia, without regard to conflicts of laws principles. For any litigation arising from or related to this Agreement, the parties hereby consent to the exclusive jurisdiction of and venue in the state and federal courts located in Fairfax County, Virginia. Notwithstanding the foregoing, Expel shall be entitled to seek equitable relief in any court of competent jurisdiction to prevent any threatened or ongoing breach of this Agreement. Government End Users. The Services are a “commercial item” as that term is defined at 48 C.F.R. 2.101, consisting of “commercial computer software” and “commercial computer software documentation” as such terms are used in 48 C.F.R. 12.212. Consistent with 48 C.F.R. 12.212 and 48 C.F.R. 227.7202-1 through 227.7202-4, all U.S. Government end users acquire the Services with only those rights set forth therein. Export. Licensee agrees not to export, reexport, or transfer, directly or indirectly, any U.S. technical data acquired from Expel, or any products utilizing such data, in violation of the United States export laws or regulations. Severability. If any provision of this Agreement is, for any reason, held to be invalid or unenforceable, the other provisions of this Agreement will remain enforceable and the invalid or unenforceable provision will be deemed modified so that it is valid and enforceable to the maximum extent permitted by law. Without limiting the generality of the foregoing, Licensee agrees that the section titled Limitation of Liability will remain in effect notwithstanding the unenforceability of any provision in the subsection titled Limited Warranty. Waiver. Any waiver or failure to enforce any provision of this Agreement on one occasion will not be deemed a waiver of any other provision or of such provision on any other occasion. Remedies. Except as provided in the sections titled Limited Warranty and Indemnification, the parties’ rights and remedies under this Agreement are cumulative. Licensee acknowledges that the Services and Software contain valuable trade secrets and proprietary information of Expel, that any actual or threatened breach of the sections titled Intellectual Property or Confidentiality or any other breach by Licensee of its obligations with respect to Intellectual Property Rights of Expel will constitute immediate, irreparable harm to Expel for which monetary damages would be an inadequate remedy. In such case, Expel will be entitled to immediate injunctive relief without the requirement of posting bond, including an order that any Software, or any portions thereof, that Licensee attempts to import into any country or territory be seized, impounded and destroyed by customs officials. If any legal action is brought to enforce this Agreement, the prevailing party will be entitled to receive its attorneys’ fees, court costs, and other collection expenses, in addition to any other relief it may receive. Force Majeure. Any delay in the performance of any duties or obligations of either party (except the payment of money owed) will not be considered a breach of this Agreement if such delay is caused by a labor dispute, shortage of materials, fire, earthquake, flood, or any other event beyond the control of such party, provided that such party uses reasonable efforts, under the circumstances, to notify the other party of the cause of such delay and to resume performance as soon as possible. Independent Contractors. Licensee’s relationship to Expel is that of an independent contractor, and neither party is an agent or partner of the other. Licensee will not have, and will not represent to any third party that it has, any authority to act on behalf of Expel. Notices. All notices or other communications required or permitted under this Agreement will be made in writing to the other party by electronic mail as follows: If to Expel, notices@expel.io and if to Licensee, at the email address provided to Expel upon registration. Notwithstanding the foregoing, all legal notices will be made in writing to the other party as follows: If to Expel, 12950 Worldgate Drive, Suite 200, Herndon, VA 20170, and if to Licensee, at the address provided to Expel upon registration. Such notices will be delivered by courier, by certified or registered mail (postage prepaid and return receipt requested), or by a nationally-recognized express mail service. Notice will be effective upon receipt or refusal of delivery. If delivered by electronic mail, any such notice will be considered to have been given on the day such electronic mail was sent. If delivered by certified or registered mail, any such notice will be considered to have been given five (5) business days after it was mailed, as evidenced by the postmark. If delivered by courier or express mail service, any such notice shall be considered to have been given on the delivery date reflected by the courier or express mail service receipt. Each party may change its contact information for receipt of notice by giving notice of such change to the other party. Counterparts. This Agreement may be executed in one or more counterparts, each of which shall be deemed an original and all of which shall be taken together and deemed to be one instrument. Entire Agreement. This Agreement is the final, complete and exclusive agreement of the parties with respect to the subject matters hereof and supersedes and merges all prior discussions between the parties with respect to such subject matters. No modification of or amendment to this Agreement, or any waiver of any rights under this Agreement, will be effective unless in writing and signed by an authorized signatory of Licensee and the Expel. SUPPORT EXHIBIT Expel 24x7 Service Level Agreement Definitions. The following capitalized terms will have the definitions set forth below. All other capitalized terms that are not defined herein shall have those meanings accorded to them in Expel’s Terms of Service agreement. “Alert” means an alert to be analyzed by Expel that is generated by a Supported Product. “Covered System” means a computing device (to the extent supported by Expel) that Licensee specifies as within the scope of the Expel Service whose system information or network traffic is observable to support Expel Service delivery. “Expel Service” means the SaaS offerings and related services made available by Expel that are designed to help customers manage their security operations, that may include alert analysis, investigations, incident reporting, non-remedial alerts, and access to a customer portal that allows the customer to review such alerts, investigations and incidents, as ordered pursuant to a Sales Order. “Incident” means a report of confirmed compromise of one or more of Licensee’s Covered Systems. “Investigation” means the process executed by Expel to confirm whether possible compromises are false positives or true compromises. “Nodes” means the number of Covered Systems within Licensee’s environment, which is reflected on the Sales Order. “Normal Business Hours” means 8 a.m. to 5 p.m. Eastern Time Monday through Friday excluding United States federal holidays. “Scheduled Downtime” means the total amount of time during any calendar month, measured in minutes, during which Licensee is not able to access the Service due to planned system maintenance performed by Expel. Expel will provide Licensee with reasonable prior notice of such Scheduled Downtime. “Supported Product” means a Product owned by or leased to Licensee and supported by Expel that generates Alerts to be analyzed by Expel. “Threat Hunting” means a combination of automated and manual tasks leveraging and limited to capabilities of Supported Products whose goal is to generate Alerts and/or Investigations, as ordered pursuant to a Sales Order. “Total Monthly Time” means the total minutes in the relevant calendar month less Scheduled Downtime. For any partial calendar month during which Licensee subscribes to the Service, availability will be calculated based on the entire calendar month, not just the portion for which Licensee subscribed. “Unscheduled Downtime” means the total amount of time during any calendar month, measured in minutes, during which the Licensee is not able to access the features and functions of the customer portal, including e-mail notifications of incidents, other than Scheduled Downtime, as defined above. Unscheduled Downtime shall not include any period during which the Service is unavailable as a result of (i) non-compliance by Licensee with any provision of this SLA; (ii) incompatibility of Licensee’s equipment or software with the Service; (iii) actions or inactions of Licensee or third parties; (iv) Licensee’s use of the Service after Expel has advised Licensee to modify its use of the Service, if Licensee did not modify its use as advised; (v) acts or omissions of Licensee or Licensee’s employees, agents, contractors, or vendors, or anyone gaining access to the Service by means of Licensee’s passwords or equipment; (vi) performance of Licensee’s systems or the Internet; (vii) any systemic Internet failures; (viii) network unavailability or Licensee’s bandwidth limitations; or (ix) Scheduled Downtime. “System Availability” means, with respect to any particular calendar month, the difference between Total Monthly Time and Unscheduled Downtime, divided by the Total Monthly Time. Represented algebraically, System Availability for any particular calendar month is determined as follows: Scope of Service. During the Term, Expel will provide Licensee with the Expel Service described in this Section 2, as set forth on the Sales Order and in accordance with the terms of the Agreement. All services Licensee requests that are not described in this Section 2 will be performed at the On-Demand Services rate defined on the Sales Order. All services requested by Licensee that are not described in this Section 2 are subject to Expel’s availability. The Expel Service is available for the number of Nodes purchased. If the number of Nodes exceeds the amount reflected on the Sales Order by more than ten percent (10%), Expel will notify Licensee in writing, and will issue an invoice for the difference in number of Nodes at Expel’s then-current rates pro-rated for the remaining portion of the then-current Term. Alert Analysis and Investigations. Expel will analyze Alerts on a 24x7x365 basis for signs of malicious activity. If Expel determines that an Alert is indicative of potentially malicious activity, Expel will create an Investigation. If the Investigation results in sufficient evidence of malicious activity, Expel will create an Incident. Incident Reporting. Upon confirmation of malicious activity by Expel, Expel will publish an Incident to the online user portal and notify (which may include e-mail notification) Licensee of the new Incident within 10 minutes. At its discretion, Expel may perform an extended investigation, and/or may aggregate and review multiple Alerts from related Covered systems to determine the extent of activity related to the Incident. Expel analysts may append results from the extended investigation or subsequent Alert analysis to the initial Incident report if Expel determines that additional or subsequent Alerts are related, and in such cases, Expel will not be required to publish a separate Incident for each such related Alert. Non-Remediable Alerts. Expel has no obligation to notify Licensee or generate new Incidents for new Alerts that are directly related to previously published Incidents for which Expel has already provided recommended remediation steps, when Licensee has acknowledged the prior Incident but cannot, or chooses not to, remediate the cause of these Alerts. Portal Access. Alerts, Investigations and Incidents will be provided by an online user portal. System Performance System Availability: Expel will undertake commercially reasonable measures to ensure that System Availability equals or exceeds ninety-nine point nine five percent (99.95%) during each calendar month (the “Service Standard”). Access to Support; Response Times: Licensee may report Unscheduled Downtime at any time (“24x7x365”) by sending Expel an e-mail to outage@expel.io. Expel will exercise commercially reasonable efforts to respond to reports of Unscheduled Downtime within 15 minutes of each such report. System Monitoring and Measurement: Expel uses a third party service (“Monitoring Service”) to monitor System Availability on an ongoing basis. Measurements of System Availability will be calculated on a monthly basis for each calendar month during the Term based on the records of such Monitoring Service. Licensee acknowledges that the Monitoring Service may become unavailable for reasons outside Expel’s control, and in such event, Expel will make commercially reasonable efforts to notify Licensee promptly in the event such unavailability materially affects Expel’s ability to monitor System Availability. Customer Networks and Licensee Requirements. The Expel Service may only be provided for computer systems and networks leased to or owned by Licensee, and under Licensee’s control, up to the number of Nodes allowed, as set forth on the applicable Sales Order. Licensee is responsible for maintenance and management of its computer network(s), servers, and software, and any equipment or services related to maintenance and management of the foregoing. Licensee is responsible for correctly configuring its systems in accordance with any instructions provided by Expel, as may be necessary for provision of access to the features and functions of the Service. Remedy for Breach of Section 3: Credits Against Fees: In the event Unscheduled Downtime occurs, Licensee will be entitled to credits against its subsequent payment obligations (as set forth in the Agreement) (“Service Credits”) according to the following table: System Availability Credit as a Percentage of One Month of Service 99.95% – 100.00% 0% 99.00% – 99.94% 10% 95.00% – 98.99% 25% Less than 95.0% 50% Licensee’s rights under this Section 5.1 are Licensee’s sole and exclusive remedy with respect to any Unscheduled Downtime or any failure by Expel to meet the Service Standard required by Section 3.1. 2. Maximum Service Credits: The maximum amount of Service that Expel will issue to Licensee for Unscheduled Downtime in a single calendar month will not exceed fifty percent (50%) of the service fees for such month. 3. Requesting Service Credits: As a condition to Expel’s obligation to provide Service Credits to Licensee, Licensee must request such Service Credits by sending an e-mail identifying the date and time of the Unscheduled Downtime for which Licensee is requesting Service Credits, with sufficient evidence (including description of the incident and duration of the incident) to credit@expel.io within thirty (30) days following such Unscheduled Downtime. If Licensee fails to request any Service Credits to which Licensee is entitled in accordance with this Section 6.3, Expel will have no obligation to issue such Service Credits to Licensee. Expel Night Shift Service Level Agreement Definitions. The following capitalized terms will have the definitions set forth below. All other capitalized terms that are not defined herein shall have those meanings accorded to them in Expel’s Terms of Service agreement. “Alert” means an alert to be analyzed by Expel that is generated by a Supported Product. “Covered System” means a computing device (to the extent supported by Expel) that Licensee specifies as within the scope of the Expel Service whose system information or network traffic is observable to support Expel Service delivery. “Expel Service” means the SaaS offerings and related services made available by Expel that are designed to help customers manage their security operations, that may include alert analysis, investigations, incident reporting, non-remedial alerts, and access to a customer portal that allows the customer to review such alerts, investigations and incidents, as ordered pursuant to a Sales Order. “Incident” means a report of confirmed compromise of one or more of Licensee’s Covered Systems. “Investigation” means the process executed by Expel to confirm whether possible compromises are false positives or true compromises. “Nodes” means the number of Covered Systems within Licensee’s environment, which is reflected on the Sales Order. “Normal Business Hours” means 8 a.m. to 5 p.m. Eastern Time Monday through Friday excluding United States federal holidays. “Scheduled Downtime” means the total amount of time during any calendar month, measured in minutes, during which Licensee is not able to access the Service due to planned system maintenance performed by Expel. Expel will provide Licensee with reasonable prior notice of such Scheduled Downtime. “Service Window” means all times outside of 8 a.m. to 5 p.m. Monday through Friday in the time zone designated by Licensee on a Sales Order, and all hours during United States federal holidays. “Supported Product” means a Product owned by or leased to Licensee and supported by Expel that generates Alerts to be analyzed by Expel. “Threat Hunting” means a combination of automated and manual tasks leveraging and limited to capabilities of Supported Products whose goal is to generate Alerts and/or Investigations, as ordered pursuant to a Sales Order. “Total Monthly Time” means the total minutes in the relevant calendar month less Scheduled Downtime. For any partial calendar month during which Licensee subscribes to the Service, availability will be calculated based on the entire calendar month, not just the portion for which Licensee subscribed. “Unscheduled Downtime” means the total amount of time during any calendar month, measured in minutes, during which the Licensee is not able to access the features and functions of the customer portal, including e-mail notifications of incidents, other than Scheduled Downtime, as defined above. Unscheduled Downtime shall not include any period during which the Service is unavailable as a result of (i) non-compliance by Licensee with any provision of this SLA; (ii) incompatibility of Licensee’s equipment or software with the Service; (iii) actions or inactions of Licensee or third parties; (iv) Licensee’s use of the Service after Expel has advised Licensee to modify its use of the Service, if Licensee did not modify its use as advised; (v) acts or omissions of Licensee or Licensee’s employees, agents, contractors, or vendors, or anyone gaining access to the Service by means of Licensee’s passwords or equipment; (vi) performance of Licensee’s systems or the Internet; (vii) any systemic Internet failures; (viii) network unavailability or Licensee’s bandwidth limitations; or (ix) Scheduled Downtime. “System Availability” means, with respect to any particular calendar month, the difference between Total Monthly Time and Unscheduled Downtime, divided by the Total Monthly Time. Represented algebraically, System Availability for any particular calendar month is determined as follows: 2. Scope of Service. During the Term, Expel will provide Licensee with the Expel Service described in this Section 2, as set forth on the Sales Order and in accordance with the terms of the Agreement. All services Licensee requests that are not described in this Section 2 will be performed at the On-Demand Services rate defined on the Sales Order. All services requested by Licensee that are not described in this Section 2 are subject to Expel’s availability. The Expel Service is available for the number of Nodes purchased. If the number of Nodes exceeds the amount reflected on the Sales Order by more than ten percent (10%), Expel will notify Licensee in writing, and will issue an invoice for the difference in number of Nodes at Expel’s then-current rates pro-rated for the remaining portion of the then-current Term. Alert Analysis and Investigations. Expel will analyze Alerts generated during the Service Window for signs of malicious activity. If Expel determines that an Alert is indicative of potentially malicious activity, Expel will create an Investigation. If the Investigation results in sufficient evidence of malicious activity, Expel will create an Incident. Licensee may request that Expel review or perform work on Investigations created by Licensee outside of the Service Window at the On-Demand Services rate defined on a Sales Order, subject to Expel’s availability. Incident Reporting. Upon confirmation of malicious activity by Expel, Expel will publish an Incident to the online user portal and notify (which may include e-mail notification) Licensee of the new Incident within 10 minutes. At its discretion, Expel may perform an extended investigation, and/or may aggregate and review multiple Alerts from related Covered systems to determine the extent of activity related to the Incident. Expel analysts may append results from the extended investigation or subsequent Alert analysis to the initial Incident report if Expel determines that additional or subsequent Alerts are related, and in such cases, Expel will not be required to publish a separate Incident for each such related Alert. Non-Remediable Alerts. Expel has no obligation to notify Licensee or generate new Incidents for new Alerts that are directly related to previously published Incidents for which Expel has already provided recommended remediation steps, when Licensee has acknowledged the prior Incident but cannot, or chooses not to, remediate the cause of these Alerts. Portal Access. Alerts, Investigations and Incidents will be provided by an online user portal. Licensee will have access to the online user portal 24x7x365. 3. System Performance System Availability: Expel will undertake commercially reasonable measures to ensure that System Availability equals or exceeds ninety-nine point nine five percent (99.95%) during each calendar month (the “Service Standard”). Access to Support; Response Times: Licensee may report Unscheduled Downtime at any time (“24x7x365”) by sending Expel an e-mail to outage@expel.io. Expel will exercise commercially reasonable efforts to respond to reports of Unscheduled Downtime within 15 minutes of each such report. System Monitoring and Measurement: Expel uses a third party service (“Monitoring Service”) to monitor System Availability on an ongoing basis. Measurements of System Availability will be calculated on a monthly basis for each calendar month during the Term based on the records of such Monitoring Service. Licensee acknowledges that the Monitoring Service may become unavailable for reasons outside Expel’s control, and in such event, Expel will make commercially reasonable efforts to notify Licensee promptly in the event such unavailability materially affects Expel’s ability to monitor System Availability. 4. Customer Networks and Licensee Requirements. The Expel Service may only be provided for computer systems and networks leased to or owned by Licensee, and under Licensee’s control, up to the number of Nodes allowed, as set forth on the applicable Sales Order. Licensee is responsible for maintenance and management of its computer network(s), servers, and software, and any equipment or services related to maintenance and management of the foregoing. Licensee is responsible for correctly configuring its systems in accordance with any instructions provided by Expel, as may be necessary for provision of access to the features and functions of the Service. 5. Remedy for Breach of Section 3: Credits Against Fees: In the event Unscheduled Downtime occurs, Licensee will be entitled to credits against its subsequent payment obligations (as set forth in the Agreement) (“Service Credits”) according to the following table: System Availability Credit as a Percentage of One Month of Service 99.95% – 100.00% 0% 99.00% – 99.94% 10% 95.00% – 98.99% 25% Less than 95.0% 50% Licensee’s rights under this Section 5.1 are Licensee’s sole and exclusive remedy with respect to any Unscheduled Downtime or any failure by Expel to meet the Service Standard required by Section 3.1. 2. Maximum Service Credits: The maximum amount of Service that Expel will issue to Licensee for Unscheduled Downtime in a single calendar month will not exceed fifty percent (50%) of the service fees for such month. 3. Requesting Service Credits: As a condition to Expel’s obligation to provide Service Credits to Licensee, Licensee must request such Service Credits by sending an e-mail identifying the date and time of the Unscheduled Downtime for which Licensee is requesting Service Credits, with sufficient evidence (including description of the incident and duration of the incident) to credit@expel.io within thirty (30) days following such Unscheduled Downtime. If Licensee fails to request any Service Credits to which Licensee is entitled in accordance with this Section 6.3, Expel will have no obligation to issue such Service Credits to Licensee. Expel for Phishing Service Level Agreement Definitions. The following capitalized terms will have the definitions set forth below. All other capitalized terms that are not defined herein shall have those meanings accorded to them in Expel’s Terms of Service agreement. “Alert” means an alert to be analyzed by Expel that is generated by a Supported Product. “Email” means an email to be analyzed by Expel that is forwarded by the customer from their phishing inbox. “Covered System” means a computing device (to the extent supported by Expel) that Licensee specifies as within the scope of the Expel Service whose system information or network traffic is observable to support Expel Service delivery. “Expel Service” means the SaaS offerings and related services made available by Expel that are designed to help customers manage their security operations, that may include Alert analysis, Investigations, Incident reporting, non-remedial alerts, and access to a customer portal that allows the customer to review such alerts, investigations and incidents, as ordered pursuant to a Sales Order. “Incident” means a report of confirmed compromise of one or more of Licensee’s Covered Systems. “Investigation” means the process executed by Expel to confirm whether possible compromises are false positives or true compromises. “Users” means the number of end-users who have an email address and who will have access to the Expel Service, which is reflected on the Sales Order. “Business Hours” means 9 a.m. to 5 p.m. Eastern Time Monday through Friday excluding United States federal holidays. “Scheduled Downtime” means the total amount of time during any calendar month, measured in minutes, during which Licensee is not able to access the Service due to planned system maintenance performed by Expel. Expel will provide Licensee with reasonable prior notice of such Scheduled Downtime. “Supported Product” means a Product owned by or leased to Licensee and supported by Expel that Expel accesses to investigate Emails. “Total Monthly Time” means the total minutes in the relevant calendar month less Scheduled Downtime. For any partial calendar month during which Licensee subscribes to the Service, availability will be calculated based on the entire calendar month, not just the portion for which Licensee subscribed. “Unscheduled Downtime” means the total amount of time during any calendar month, measured in minutes, during which the Licensee is not able to access the features and functions of the customer portal, including e-mail notifications of Incidents, other than Scheduled Downtime, as defined above. Unscheduled Downtime shall not include any period during which the Service is unavailable as a result of (i) non-compliance by Licensee with any provision of this SLA; (ii) incompatibility of Licensee’s equipment or software with the Service; (iii) actions or inactions of Licensee or third parties; (iv) Licensee’s use of the Service after Expel has advised Licensee to modify its use of the Service, if Licensee did not modify its use as advised; (v) acts or omissions of Licensee or Licensee’s employees, agents, contractors, or vendors, or anyone gaining access to the Service by means of Licensee’s passwords or equipment; (vi) performance of Licensee’s systems or the Internet; (vii) any systemic Internet failures; (viii) network unavailability or Licensee’s bandwidth limitations; or (ix) Scheduled Downtime. “System Availability” means, with respect to any particular calendar month, the difference between Total Monthly Time and Unscheduled Downtime, divided by the Total Monthly Time. Represented algebraically, System Availability for any particular calendar month is determined as follows: Scope of Service. During the Term, Expel will provide Licensee with the Expel Service described in this Section 2, as set forth on the Sales Order and in accordance with the terms of the Agreement. All services Licensee requests that are not described in this Section 2 will be performed at the On-Demand Services rate defined on the Sales Order. All services requested by Licensee that are not described in this Section 2 are subject to Expel’s availability. The Expel Service is available for the number of Users purchased. If the number of Users exceeds the amount reflected on the Sales Order by more than ten percent (10%), Expel will notify Licensee in writing, and will issue an invoice for the difference in number of Users at Expel’s then-current rates pro-rated for the remaining portion of the then-current Term. Email Analysis and Investigations. Expel will analyze Emails on a 9 am x 5 pm EST basis excluding U.S. federal holidays for signs of malicious activity. If Emails are submitted outside of Normal Business Hours, Expel will review those Emails on the next business day during Normal Business Hours . If Expel determines that an Email is indicative of potentially malicious activity, Expel will create an Investigation. If the Investigation results in sufficient evidence of malicious activity, Expel will create an Incident. Incident Reporting. Upon confirmation of malicious activity by Expel, Expel will publish an Incident to the online user portal and notify (which may include e-mail notification) Licensee of the new Incident within 10 minutes. At its discretion, Expel may perform an extended Investigation, and/or may aggregate and review multiple Emails to determine the extent of activity related to the Incident. Expel analysts may append results from the extended investigation or subsequent analysis to the initial Incident report if Expel determines that additional or subsequent Alerts are related, and in such cases, Expel will not be required to publish a separate Incident for each such related Alert. Non-Remediable Alerts. Expel has no obligation to notify Licensee or generate new Incidents for new Alerts that are directly related to previously published Incidents for which Expel has already provided recommended remediation steps, when Licensee has acknowledged the prior Incident but cannot, or chooses not to, remediate the cause. Portal Access. Access to Alerts, Investigations and Incidents will be provided by an online user portal. System Performance System Availability: Expel will undertake commercially reasonable measures to ensure that System Availability equals or exceeds ninety-nine point nine five percent (99.95%) during each calendar month (the “Service Standard”). Access to Support; Response Times: Licensee may report Unscheduled Downtime at any time (“24x7x365”) by sending Expel an e-mail to outage@expel.io. Expel will exercise commercially reasonable efforts to respond to reports of Unscheduled Downtime within 15 minutes of each such report. System Monitoring and Measurement: Expel uses a third party service (“Monitoring Service”) to monitor System Availability on an ongoing basis. Measurements of System Availability will be calculated on a monthly basis for each calendar month during the Term based on the records of such Monitoring Service. Licensee acknowledges that the Monitoring Service may become unavailable for reasons outside Expel’s control, and in such event, Expel will make commercially reasonable efforts to notify Licensee promptly in the event such unavailability materially affects Expel’s ability to monitor System Availability. Customer Networks And Licensee Requirements. The Expel Service may only be provided for computer systems and networks leased to or owned by Licensee, and under Licensee’s control, up to the number of Nodes allowed, as set forth on the applicable Sales Order. Licensee is responsible for maintenance and management of its computer network(s), servers, and software, and any equipment or services related to maintenance and management of the foregoing. Licensee is responsible for correctly configuring its systems in accordance with any instructions provided by Expel, as may be necessary for provision of access to the features and functions of the Service Remedy For Breach Of Section 3: Credits Against Fees: In the event Unscheduled Downtime occurs, Licensee will be entitled to credits against its subsequent payment obligations (as set forth in the Agreement) (“Service Credits”) according to the following table: System Availability Credit as a Percentage of One Month of Service 99.95% – 100.00% 0% 99.00% – 99.94% 10% 95.00% – 98.99% 25% Less than 95.0% 50% Licensee’s rights under this Section 5.1 are Licensee’s sole and exclusive remedy with respect to any Unscheduled Downtime or any failure by Expel to meet the Service Standard required by Section 3.1. Maximum Service Credits: The maximum amount of Service that Expel will issue to Licensee for Unscheduled Downtime in a single calendar month will not exceed fifty percent (50%) of the service fees for such month. Requesting Service Credits: As a condition to Expel’s obligation to provide Service Credits to Licensee, Licensee must request such Service Credits by sending an e-mail identifying the date and time of the Unscheduled Downtime for which Licensee is requesting Service Credits, with sufficient evidence (including description of the incident and duration of the incident) to credit@expel.io within thirty (30) days following such Unscheduled Downtime. If Licensee fails to request any Service Credits to which Licensee is entitled in accordance with this Section 6.3, Expel will have no obligation to issue such Service Credits to Licensee.