YOU MUST READ THE TERMS AND CONDITIONS OF THIS 42CRUNCH USER AGREEMENT ("AGREEMENT") BEFORE APPLYING FOR, ENROLLING FOR, OR USING THE 42CRUNCH SERVICE ("SERVICE"). IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, DO NOT ENROLL FOR OR USE THE SERVICE. BY CLICKING "ACCEPT" BELOW OR BY USING THE SERVICE, YOU AGREE TO BECOME A PARTY TO, AND BE BOUND BY, THE TERMS OF THIS AGREEMENT. BY CLICKING "DECLINE" BELOW, YOU INDICATE THAT YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT AND THEREFORE AGREE NOT TO USE THE SERVICE. This 42Crunch End User Service Agreement sets forth an agreement (the "Agreement") between You ("End-User"), and 42Crunch Ltd, a UK Limited Company ("42Crunch"), for access to the 42Crunch Service (the "Service"). This End User Service Agreement sets the terms required prior to, and is a condition to, using of the Service, unless End-User entered into a written agreement with 42Crunch or an authorized 42Crunch Reseller or 42Crunch Partner (collectively, "Authorized Reseller") and such written agreement contains terms governing the use of and access to the Service. 1. Use of Service Upon End-User's acceptance of the terms and conditions of this Agreement and End-User agreement of the subscription license of the Service, End-user will be entitled to use the Service solely to secure APIs and data which are owned by the End-User, or to secure APIs and data for which End-User has obtained the rights to use the Service. It is the End-User’s sole responsibility to obtain such rights. 2. Grant of License Subject to the terms and conditions of this Agreement, 42Crunch hereby grants to End-User a non-transferable, non-exclusive, royalty-free right and license to use the Service solely to: (i) Assess, filter, and secure End-User APIs; (ii) review the Reports and Dashboards produced by the Service for the purpose of managing the security of the End-User’s APIs; and (iii) use the recommended solutions to remediate the security issues discovered. The 42Crunch Service encompasses the original object code version of the 42Crunch services, machine-readable instructions, and related licensed materials. The term “42Crunch services” means the software services necessary to use the Service. These software services are Administration, API Contract Security Audit, API Contract Conformance Scan, and API Protection services, which together comprise 42Crunch Platform necessary to deliver the Service. 42Crunch reserves the right to change the name of these services as and when required. Any change in the 42Crunch services does not alter any of the terms and conditions of this agreement related to the use of the Service. 3. Restrictions End-User's use of the Service is subject to the following restrictions and End-User hereby agrees as follows: (a) End-User may use the Service only to secure APIs or applications owned by and registered to End-User, or for which End-User has the full right and authority by the owner of the APIs or applications. (b) End-User agrees not to reverse engineer, decompile, or disassemble any software which provides or enables the Service, or otherwise attempt to derive the processes by which the Service is provided, except to the extent the foregoing restriction is expressly prohibited by applicable law. (c) The Service is exclusively provided to End-User. To that effect, End-User is not allowed to subcontract, sublease, or let any other End-User use the Service. (d) Upon termination or expiration of the Service, End-User must cease all use of the Service. 4. Ownership As between the parties, all title, copyrights, trademarks, service marks, patents, patent applications, and all other intellectual proprietary rights now known or hereafter recognized in any jurisdiction in and to the Service, the Reports, the Plugins, and in each case all software embedded therein or related thereto, all data and information contained therein — excluding individual factual data gathered from the End-User's API end point and client APIs — (the "Intellectual Property Rights") are owned by 42Crunch or its licensors, and End-User agrees to make no claim of interest therein or ownership thereto. End-User further acknowledges that the Service structure, organization, and code are the valuable trade secrets of 42Crunch or its licensors, and all data and information contained within the Service or the Reports (excluding individual factual data gathered from the End-User's API endpoint and client APIs) are confidential information of 42Crunch. End-User agrees to keep such information in confidence and not disclose it to any third parties. 5. API Indemnity (a) End-User represents and warrants that End-User has full right, power, and authority to have the Service run on End-User’s APIs or applications identified by End-User. End-User will indemnify and hold harmless 42Crunch, its customers, Authorized Resellers, partners and sponsors, and their officers, directors, employees, and agents from and against any third-party claims, suits, liabilities, losses, damages, judgments, awards, fines, penalties, costs, and expenses (including reasonable attorneys' fees) incurred by or levied against the same resulting from or based on End-User's use of or inability to use the Service, including any claim resulting from End-User's breach of this Section 5. (b) End-User also acknowledges and agrees that the filtering and the security operations performed on such APIs by the Service may expose vulnerabilities and attacks resulting in the Service blocking the API client requests from reaching the API endpoint, or blocking the API server responses from reaching the API client. Consequently, End-User assumes the risk for all damages, losses, and expenses from the disruption of the End-User’s API or application resulting from the use of the Service. (c) 42Crunch will defend, indemnify, and hold harmless End-User from and against any and all claims, losses, liabilities, damages, and expenses (including, without limitation, reasonable attorneys' fees) arising from any claim brought against End-User by a third party alleging that the Service or Reports infringe or misappropriate a third party's intellectual property or proprietary rights, provided that End-User grants 42Crunch sole control over the defence or settlement of such claim and cooperates reasonably in the defence or settlement of such claim. If End-User's use of the Service or Reports is enjoined as a result of such a claim of infringement, or if 42Crunch determines that it is likely to be so enjoined, 42Crunch will, at its option, (a) procure for End-User the right to continue using the item in accordance with its rights under this Agreement, (b) replace or modify the item with a substantially equivalent non-infringing item; or (c) terminate this Agreement and refund to End-User a pro-rata portion of the amounts paid by End-User hereunder in connection with the Agreement based on the unexpired portion of the Subscription at the time of such termination. This Section 11 states 42Crunch's sole liability and End-User's sole and exclusive remedy for a claim of infringement related to the Service or Reports. 6. Beta Products 42Crunch may designate certain new or enhanced products or features within the Service as "Beta Products" that are available for use or testing by End-User. Such Beta Products are not ready for use in a production environment, nor does 42Crunch recommend the Beta Products be used in a production environment. At this early stage of development, operation of the Beta Products may be unpredictable and lead to erroneous results. End-User acknowledges and agrees that: (i) the Beta Products are experimental and have not been fully tested; (ii) the Beta Products may not meet End-User's requirements; (iii) the use or operation of the Beta Products may not be uninterrupted or error-free; (iv) use of the Beta Products is for purposes of evaluating and testing the product and providing feedback to 42Crunch; (v) End-User shall inform its personnel regarding the nature of the Beta Products; and (vi) End-User will hold all information relating to the Beta Products and its use of the Beta Service, including any performance measurements and other data relating to the Beta Products, in strict confidence and shall not disclose such information to any unauthorized third parties. Use of the Beta Products shall be subject to all of the terms and conditions set forth herein relating to the Service. End-User shall promptly report any errors, defects, or other deficiencies in the Beta Products to 42Crunch. NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, ALL BETA PRODUCTS ARE PROVIDED "AS-IS" AND "AS-AVAILABLE," WITHOUT WARRANTIES OF ANY KIND. End-User hereby waives any and all claims, now known or later discovered, that End-User may have against 42Crunch and its suppliers or licensors arising out of End User’s use of the Beta Products. 7. Confidentiality Each party agrees to keep in confidence and not to disclose to any third parties any confidential or proprietary information it receives from the other party hereunder ("Confidential Information"), nor to use such Confidential Information for any purpose other than as expressly set forth in this Agreement. To be accorded treatment as Confidential Information under this Agreement, the disclosing party must identify any such information as confidential or proprietary at the time of disclosure. Information that is already in the public domain through no fault of the receiving party, or was already known to the receiving party through no breach of a confidentiality obligation to the disclosing party, shall not be treated as Confidential Information hereunder. All data regarding End-User's API information, such as URLs, API data, security settings, or network characteristics (including data that 42Crunch obtains as a result of its provision of the Service hereunder), will be deemed Confidential Information of the End-User. All data and information contained within the Dashboard or Reports generated by the Service will be deemed Confidential Information of End-User. 42Crunch will collect company name, user data, API definition files, Service logs, and performance data, such as (but not limited to) connections rates, API traffic statistics, attacks blocks, transaction logs, or data throughput, solely for the purpose of producing end user Reports, end user Dashboard, and the Service maintenance, support, and licensing compliance. 42Crunch may not access, use, or refer to any End-User information or data contained within the Service including Dashboard and Reports under GDPR compliance. Nothing in this Agreement shall prohibit 42Crunch from using aggregated data of all Service metrics in any format for any purpose, provided that such data cannot be identified to or associated with an individual End-User. 8. Warranty Disclaimer THE SERVICE AND ANY REPORTS ARE BEING PROVIDED "AS IS" WITHOUT ANY WARRANTY OF ANY KIND. 42CRUNCH, ITS AUTHORIZED RESELLERS, PARTNERS, AND SPONSORS EXPRESSLY DISCLAIM ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUALITY, ACCURACY, AND NON-INFRINGEMENT OF THIRD-PARTY RIGHTS. Without limiting the foregoing, 42Crunch makes no warranty that the Service will be error-free, free from interruption or failure, or absolutely secure from unauthorized access, or that the Service will detect every and each vulnerability or attack on End-User's APIs. 42Crunch does not warrant that the Service or the Reports or Dashboards provide proof that End-User's APIs or infrastructure are secure. 9. Limitation of Liability WARNING: THE 42CRUNCH SERVICE IS DESIGNED TO TEST FOR SECURITY FLAWS AND CAN DO DAMAGE TO TARGET SYSTEMS DUE TO THE NATURE OF ITS FUNCTIONALITY. TESTING FOR SECURITY FLAWS INHERENTLY INVOLVES INTERACTING WITH TARGETS IN NON-STANDARD WAYS WHICH CAN CAUSE PROBLEMS IN SOME VULNERABLE TARGETS. THE END-USER MUST TAKE DUE CARE WHEN USING THE SOFTWARE, MUST READ ALL DOCUMENTATION BEFORE USE, AND BACK UP TARGET SYSTEMS BEFORE USE. WHERE THE END-USER USES THE SOFTWARE ON PRODUCTION SYSTEMS OR OTHER SYSTEMS, IT EXPRESSLY HEREBY ACCEPTS THE RISK OF DAMAGE AND RISK OF LOSS OF DATA, OR LOSS OF USE IN RESPECT OF SUCH DATA AND SYSTEMS, AND ACCEPTS THAT IT SHOULD NOT USE THE SOFTWARE ON ANY SYSTEMS FOR WHICH IT DOES NOT ACCEPT THE RISK OF DAMAGE, RISK OF LOSS OF DATA, OR LOSS OF USE. THIS SERVICE (INCLUDING ALL 42CRUNCH COMPONENTS) IS BEING PROVIDED TO END-USER BY 42CRUNCH. TO THE MAXIMUM EXTENT PERMITTED BY LAW, UNDER NO CIRCUMSTANCES SHALL 42CRUNCH, ITS SUCCESSORS, PARTNERS, OR AUTHORIZED RESELLERS, BE LIABLE TO END-USER UNDER THIS AGREEMENT FOR ANY DAMAGES OF ANY KIND, INCLUDING LOSS OF PROFITS, LOSS OF DATA, APPLICATION OR EQUIPMENT DOWNTIME, OR FOR ANY DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY OR SPECIAL DAMAGES OF ANY KIND WHATSOEVER, WHETHER IN TORT, CONTRACT, OR OTHERWISE, ARISING OUT OF END-USER'S USE OR INABILITY TO USE THE SERVICE, EVEN IF 42CRUNCH HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT SHALL 42CRUNCH, ITS CUSTOMER, AND ITS AUTHORIZED RESELLERS' TOTAL LIABILITY TO END-USER FOR ALL DAMAGES IN ANY ONE OR MORE CAUSES OF ACTION, WHETHER IN CONTRACT, TORT, OR OTHERWISE, EXCEED THE TOTAL ANNUAL AMOUNT PAID BY THE END-USER FOR THE USE OF THE SERVICE. 10. U.S. Government Users The software and accompanying documentation embedded in or related to the Service are "commercial items," as such terms are defined at 48 C.F.R. 2.101, consisting of "commercial computer software" and "commercial computer software documentation," as such terms are used in 48 C.F.R. 12.212, and is provided to the U.S. Government only as a commercial end item. Government entities acquiring the use of such software and accompanying documentation shall have only those rights set forth herein. 11. US and EU Export Restrictions End-User may not download and use the Service if End-User is (a) a national or resident of any country to which the United States has embargoed goods, or (b) on the United States Treasury Department's list of Specially Designated Nationals or on the U.S. Commerce Department's Table of Denial Orders, or (c) a resident or national of any country under sanction by the European Commission under Article 215 TFEU. End-User is representing and warranting that End-User is not located in, under the control of, or a national or resident of any such country, or on any such list. 12. General End-User agrees to comply with all applicable laws in its use of the Service, including all applicable export control laws. This Agreement is governed by the laws of the United Kingdom, without reference to conflict of laws principles. The application of the United Nations Convention of Contracts for the International Sale of Goods is expressly excluded. Any dispute between End-User and 42Crunch regarding this Agreement will be subject to the exclusive jurisdiction of the United Kingdom courts of law. This Agreement is the entire agreement between End-User and 42Crunch and supersedes any other communications or advertising with respect to the Service and documentation. If any provision of this Agreement is held invalid, the remainder of this Agreement will continue in full force and effect. No provision of this Agreement shall be deemed waived or modified except in writing signed by an authorized representative of 42Crunch. There are no implied licenses hereunder. End-User may not assign this Agreement without the prior written consent of 42Crunch.