TERMS OF SERVICES

These terms (“Terms”) together with your subscription plan and/or any applicable Purchase Order executed hereunder and any schedules or additional terms referenced to in these Terms, as well as any other document incorporated by reference, as amended or supplemented from time to time (“Agreement”) governs the relationship between you, either as an individual or a legal entity you represent, and A42, LLC, a Ukrainian limited liability company with registration number 45790296 (“A42”). It applies to your access and use of the services offered by A42 through its websites or other channels (“Services”). BY CLICKING ON THE “I ACCEPT” BUTTON, OR BY TAKING SIMILAR ACTION WHICH INDICATES ASSENT TO THIS AGREEMENT, IT BECOME BINDING BETWEEN A42 AND EITHER (1) THE INDIVIDUAL THAT SO CLICKS OR TAKES ACTION, OR (2) IF THAT INDIVIDUAL IS ACTING AS AN AUTHORIZED REPRESENTATIVE OF A LEGAL ENTITY, THEN THAT LEGAL ENTITY (“Customer” and “You” refer to you as an individual or the legal entity you represent). BY CLICKING THE “I ACCEPT” BUTTON, OR BY TAKING SIMILAR ACTION WHICH INDICATES ASSENT TO THE TERMS, YOU (A) ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THE TERMS; (B) REPRESENT AND WARRANT THAT THE YOU HAVE THE RIGHT, POWER, AND AUTHORITY TO ENTER INTO THE TERMS ON BEHALF OF THE CUSTOMER AND CAN BIND SUCH CUSTOMER THERETO; AND (C) ACCEPT THE TERMS AND AGREE THAT CUSTOMER IS LEGALLY BOUND BY ITS TERMS. IF YOU DO NOT AGREE TO THE TERMS, YOU SHALL NOT CLICK THE “I ACCEPT” BUTTON OR TAKE A SIMILAR ACTION WHICH INDICATES ASSENT TO THE TERMS, AND YOU MAY NOT ACCESS OR USE THE PRODUCTS. Customer and A42 may each be referred to herein as a “Party” and collectively as the “Parties. ”

You acknowledge that the purpose of the Services is to, as applicable, monitor and strengthen the security of Your platforms, networks, software, applications and infrastructures (“System”), and any digital property or resource owned by the Customer (“Asset”) and that in furtherance of the purpose, A42 may perform security and vulnerability scans or such continuous monitoring of a given Customer System and Asset (“Test”) included in the Services (“Purpose”). The Test may involve activities such as crawling, fuzz testing, authenticated testing, deploying test scripts, and conducting other non-intrusive penetration tests, all aimed at identifying security vulnerabilities.

A42 provides the Services under the following terms: A42 may take any actions or use any means it deems necessary to perform the Services. This may include, but is not limited to, overriding, bypassing, deactivating, or impairing protection mechanisms integrated into or associated with the Customer’s Systems and Assets; adding programs or files to the Customer’s Systems; reproducing or extracting data produced or provided by the Customer during the provision of the Services or other elements into A42’s systems; and accessing unauthorized modules, functionalities, or other parts of the Customer’s Systems or Assets. A42 will endeavor to ensure that the Services do not introduce new vulnerabilities or damage to the Customer’s Systems or Assets. However, the Customer acknowledges that the Services may interfere with or impact the Systems and Assets. A42 assumes no liability for security breaches or damages to the Customer’s Systems, Assets, or property arising from the Services, provided that A42 delivers the Services in full compliance with the Agreement. A42 will make reasonable efforts to promptly respond to the Customer’s requests, complaints, or queries during the provision of the Services.

During the provision of Services, A42 will notify the Customer of any unauthorized access, use, or security breach it becomes aware of in the Systems or Assets arising from the Services. A42 is not, however, obligated to stop such unauthorized access or notify authorities unless explicitly agreed upon in writing by the Parties. A42 will use reasonable efforts to identify vulnerabilities in the Systems and Assets but does not guarantee the identification or reporting of all vulnerabilities.

A42 will access and use the Systems and Assets strictly for the Purpose of providing the Services. A42 is solely responsible for procuring the necessary software, connections, and hardware configurations required for the delivery of the Services. A42 will comply with all applicable laws and regulations relevant to its provision of the Services. A42 will promptly inform the Customer of any facts related to the Services that it reasonably considers relevant to fulfilling its obligations under the Agreement.

Subject to entering into the Agreement and choosing the subscription plan specifying the scope, price and terms for provision of an individual Services , and payment of all applicable fees, A42 grants You a non-exclusive, non-transferable, non-assignable, and limited right to use the Services during the Agreement term for Your internal business purposes only. Parties may agree to execute a separate written document incorporated by reference into the Agreement, specifying the scope, price and terms for provision of an individual Services (“Purchase Order”). You may allow the Services to be used by:

Your employees, any corporation, company or other entity controlled by or under common control with You, and "control" means ownership or control, direct or indirect, now or during the term fo Agreement, of more than (50%) of the outstanding shares or interest entitled to vote for the election of directors (“Affiliates”) and their employees, and third-party consultants acting as independent contractors or subcontractors on Your behalf or on behalf of your Affiliates, solely for the purpose of providing services to You and/or Your Affiliates. You agree that Tests and other activities performed during Services provision are not to be considered security incidents or breaches of Your Systems and Assets.

The Customer must comply with all relevant national and international laws, including those related to privacy, cybersecurity, consumer protection, and regulatory obligations. It is the Customer’s responsibility to ensure legal compliance for granting access to its Systems and Assets for the Services, including conducting impact assessments and other regulatory measures. A42 bears no liability for the Customer’s regulatory compliance.

The Customer is exclusively responsible for: Defining the scope of the Services for its Systems and Assets, and specifying processes, tools, and methodologies. Notifying relevant authorities about the Services and obtaining required authorizations to avoid misinterpretation as real cyber-attacks.

Securing all necessary permissions from licensors, owners, controllers, and subjects of Systems and Assets to allow A42 to provide Services lawfully. The Customer warrants that all Systems and Assets listed in the Agreement can be legally accessed and tested.

Establishing procedures to handle requests, complaints, or inquiries from providers, suppliers, clients, or personnel whose Systems and Assets are included in the Services scope. Ensuring participation and cooperation from third-party Services providers or licensors whose Systems, Assets, or services are involved.

Allowing A42 to perform Services without interference, blocking, or restrictions. Issuing instructions to A42 as needed for accessing Systems and Assets, acknowledging that restrictive instructions may limit vulnerability identification.

Implementing effective risk management and operational controls to mitigate potential disruptions to critical systems or services.

Informing A42 immediately of any unauthorized third-party access, security breaches, or suspected incidents related to the Systems or Assets, and taking reasonable steps to address them.

Providing A42 with accurate, up-to-date, and sufficient information and assistance necessary for Services delivery. A42’s performance is dependent on the quality and timeliness of the Customer’s input. Determining the suitability, security, and reliability of the Services for Customer’s purposes. A42 is not liable if the Services do not fully meet the Customer’s requirements.

A42 may suspend access to and use of the Services (in whole or in part) for You, Your Affiliates, or individual users, who has been granted access to the Services by You or Your Affiliates (“User”), with prior notice, if A42 reasonably determines that Your, Your Affiliates’, or any User’s use of the Service: threatens the security, availability, or integrity of the Services or other customer environments; violates the explicit usage rights outlined in the Agreement, or applicable laws governing the Service; or creates a legal or third-party liability risk for A42. The suspension will be limited to the specific component, access, or usage deemed unauthorized under this Section 5. A42 will promptly restore access to the Services for the affected Customer, Affiliate, or User once the underlying issue is resolved.

Fees for the Services. In exchange for the provision of the Services and the licenses granted hereunder, You agree to pay the fees specified in the Agreement.

are non-cancelable, fees are non-refundable, and quantities purchased cannot be reduced during the Purchase Oder term. Taxes and Deductions. All sums payable under the Agreement shall be free and clear of all deductions or withholdings unless the applicable law requires a deduction or withholding to be made. If a deduction or withholding is required by the applicable law, the Customer shall pay such additional amount as will ensure that the net amount received by A42 equals the full amount which it would have received had the deduction or withholding not been required. If any sum payable by the Customer under or pursuant to the Agreement is subject to any tax under applicable law of the Customer’s jurisdiction, then the Customer shall pay such additional amount as will ensure that the total amount paid, less tax chargeable on such amount, is equal to the amount that would otherwise be payable under the Purchase Oder. Invoice Payments. Payment must be made in advance as outlined in the Agreement. Undisputed invoices are payable within thirty (30) days of the invoice date.

Billing Information. You must provide A42 with updated billing details upon signing the Agreement. Invoices will be issued electronically based on the information You provide and sent to Your designated email address. A42 ensures the authenticity, integrity, and legibility of the electronic invoice.

Payment Confirmation. Upon confirmation of payment, You will receive an email confirming the transaction and the commencement of the Services upon you access to the account.

Refund. You have a right to request a refund of the fees paid in advance within 14-days’ withdrawal period, provided that A42 does not start the provision of the Services. For avoidance of doubts, your access to your account on A42 website initiates an immediate start of provision of the Services.

Ownership of Intellectual Property. All copyrights and related rights, design rights, registered designs, patents, trademarks and Services marks (registered and unregistered), trade secrets, database rights, know-how, rights in confidential information and all other intellectual property rights throughout the world for the full term of the rights concerned, including any derivative works incorporating any of the foregoing that may be created or developed in the course of provision of Services, including software, technology, and content (“Intellectual Property Rights”) are the sole property of A42 and/or its licensors. This includes any enhancements or developments made to the Services. You acknowledge that no ownership, title, or interest in these Intellectual Property Rights is transferred to You under the Agreement, except for the limited rights of use granted in Section 3 of these Terms.

Ownership of Results. Any outcome generated by a completed Test, vulnerability findings and reports (“Results”) are owned by You. However, this excludes any Intellectual Property Rights of A42 embedded within the Results (e.g., software, copyrighted works, know-how, trade secrets, attack vectors, and payloads). You may use A42's Intellectual Property Rights included in the Results solely to address any identified security vulnerabilities in Your systems. Use of Anonymized Data. You grant A42 a non-exclusive, sublicensable, royalty-free, worldwide, perpetual, and irrevocable license to use data generated from Your use of the Service, in anonymized and aggregated form, for commercial purposes, including sharing with third parties. This use will maintain Your confidentiality, and the material disclosed will not be capable of being reverse-engineered.

Use of Names and Trademarks. Neither Party may use the other Party’s names, trademarks, or logos without prior written consent, except A42 may: (i) use the Customer’s name and trademarks on its website, and (ii) indicate it provides Services to the Customer, adhering to the Customer’s brand and communication guidelines as provided.

Confidential Information. Confidential Information refers to all information disclosed by either Party (“Disclosing Party”) or observed by the Party receiving the information (“Receiving Party”) as a result of or in connection with the provision of Services, whether before, on, or after the date of the Agreement. This includes, but is not limited to:

(a) Assets;

(b) Technical, organizational, commercial, and financial data;

(c) Trade secrets, customer and supplier lists, personal data, studies, know-how, technology, product planning and formulation, computer programs, electronic codes, inventions, and research projects;

(d) Information related to costs, profits, markets, sales, prices, or clients;

(e) Business, strategic, and marketing plans; and

(f) Intellectual property of either Party, as well as any ideas, processes, methodologies, or schemes, regardless of whether such information is in tangible, oral, or visual form, or marked as confidential. General Obligation. Both Parties agree to maintain the confidentiality of all Confidential Information. Neither Party shall disclose, share, market, or make available such information to any third party, whether for free or otherwise. Standard of Care. Both Parties must protect Confidential Information with the same level of care they use to safeguard their own confidential data, ensuring at least reasonable efforts are made. Each Party must follow the other Party’s instructions regarding the handling of Confidential Information and seek clarification when in doubt about disclosure. Exceptions to Confidentiality. The above obligation does not apply to:

(a) Disclosure of Confidential Information to a Party's legal, technical, or accounting advisors, provided it is reasonably necessary for fulfilling rights or obligations under these Terms and/or Agreement in general.

(b) Information that the receiving Party can prove:(i) is or becomes publicly available through no fault of the Receiving Party; (ii) was independently developed by the Receiving Party without using the Disclosing Party's Confidential Information; (iii) was lawfully received from a third party, unless the Receiving Party has reason to believe the third party violated a confidentiality obligations; (iv) was already known to the Receiving Party before accessing the disclosing Party's Confidential Information.

Customer’s Responsibilities. The Customer must ensure that only personnel directly involved in the Services are aware of its scope and impact. Such personnel must maintain confidentiality to preserve the validity of the Service's results. If other personnel become aware of the Service, the Customer must: (i) document and notify A42; (ii) inform affected personnel that the intrusion is part of authorized testing; (iii) initiate appropriate measures as if responding to a real cyber threat, including notifying competent authorities, after which the Services shall proceed without interference.

Disclosure by Legal Obligation. If the Receiving Party is required to disclose Confidential Information due to legal, regulatory, or court orders:

(a) The receiving Party must inform the Disclosing Party promptly (unless prohibited by law) to allow the Disclosing Party to object or seek protective measures.

(b) Disclosure shall be limited to what is strictly required and must comply with the Disclosing Party's recommendations, provided they align with legal obligations. The Receiving Party should also seek to maintain confidentiality through reasonable efforts, such as confidentiality agreements. Duration of Confidentiality Obligations. The confidentiality obligations in this Section apply during the term of the Agreement and for five (5) years after its termination. For information related to trade secrets under applicable law, the confidentiality period extends indefinitely while such information remains secret. Reference and Legal Use. Either Party may include the other Party’s name and a description of the Services in reference lists, proposals, internal business documents, plans for shareholders, or where required for legal, regulatory, or accounting purposes.

Term of the Agreement. Agreement begins on the date You choose the subscription plan and pay all applicable initial fees. Unless terminated earlier, it will continue for the term specified in the subscription plan You choose upon entering into the Agreement. The term will automatically renew for successive periods equal in length to the initial term unless You provide written notice to A42 at least 30 days before the current term ends, indicating that You do not wish to renew.

Termination for Cause. Either Party may terminate the Agreement with written notice if the other Party materially breaches its provisions and fails to remedy the breach within thirty (30) calendar days of receiving written notice. Additionally, termination may occur without liability if either Party enters compulsory or voluntary liquidation, ceases operations, or takes any action that significantly impairs its ability to perform its obligations under the Agreement, including payment of fees.

A42 may terminate the Agreement immediately by providing written notice to You if a suspension event under Section 5 remains unresolved for more than 30 days.

If a Party has grounds to terminate the Agreement for cause, it may also terminate all outstanding Purchase Orders (where applicable) on the same grounds or, at its discretion, only terminate the specific Purchase Orders related to the cause for termination.

Effects of Termination. If You terminate the Agreement for material breach by A42 of the Agreement, You are entitled to a pro-rata refund of any prepaid, unused fees from A42. If A42 terminates the Agreement for cause, any outstanding amounts owed to A42 become immediately payable, and You will not be entitled to any compensation or refund from A42. Upon termination of the Agreement for any reason:

(a) Your rights under Agreement will end; and

(b) Each Party, upon request, must return or destroy all Confidential Information of the other Party within fourteen

(14) days. However, this excludes Confidential Information stored in backups or archives that cannot be retrieved without significant effort, or information that must be retained due to legal or regulatory obligations. YOU HEREBY CONSENT AND ACKNOWLEDGE THAT YOUR ACCESS TO YOUR ACCOUNT ON A42 WEBSITE INITIATES AN IMMEDIATE START OF PROVISION OF THE SERVICES AND THAT THIS CONSENT IMPLIES THAT YOU WILL NOT BE ABLE TO UNILATERALLY TERMINATE THIS CONTRACT (WITHDRAW FROM IT) WITHOUT JUST CAUSE WITHIN THE USUAL 14-DAY CONSUMER REMORSE PERIOD.

A42 agrees to defend, indemnify, and hold You, along with Your Affiliates, representatives and employees, harmless from any costs, damages, losses, or expenses—including reasonable attorneys’ fees and other legal costs—arising from third-party claims that the use of the Services infringes any third-party Intellectual Property Rights. You agree to defend, indemnify, and hold A42, its Affiliates, representatives, and employees harmless from any costs, damages, losses, or expenses—including reasonable attorneys’ fees and other legal costs—arising from third-party claims that:

(a) Your use of the Service, in violation of the Agreement, infringes third-party rights, including but not limited to Intellectual Property Rights or privacy rights;

(b) You lack the required authorizations, approvals, or permissions necessary for lawful use of the Service, including conducting Tests; or

(c) Your use of the Services breaches the acceptable use provisions outlined in Section 4. A42 shall not be liable to You or Your Affiliates for any direct or indirect damages resulting from Your or Your Affiliates' use of the Service, provided the Services has been delivered in compliance with these Terms. Additionally, A42 is not liable for the accuracy or availability of any integrated third-party services or products. Nothing in the Agreement limits or excludes either Party’s liability for: (a) damages caused by willful misconduct, gross negligence, or fraud; or (b) the indemnity obligations. A42’s total liability under the Agreement for all damages shall be limited to 100% of the total fees paid or payable by You in the contract year during which the breaches occurred.

A42 represents and warrants that: (a) It has the authority to grant the licenses and rights related to the Services as outlined in the Agreement;

(b) The Services will materially conform to the features, functionality, and specifications described in the Agreement; and

(c) Any professional services provided by A42 will be executed with diligence, timeliness, professionalism, and in accordance with prevailing industry standards and practices. EXCEPT AS EXPRESSLY SET FORTH IN THE AGREEMENT, A42 DISCLAIMS ALL OTHER WARRANTIES AND REPRESENTATIONS TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WHETHER EXPRESS, IMPLIED, OR STATUTORY. THIS INCLUDES, BUT IS NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, AND FITNESS FOR A PARTICULAR PURPOSE. A42 DOES NOT GUARANTEE THAT THE SERVICES WILL BE FREE FROM DEFECTS OR INTERRUPTIONS OR THAT IT WILL IDENTIFY ALL POTENTIAL SECURITY VULNERABILITIES. A42 ALSO DISCLAIMS ANY WARRANTY THAT THE SERVICES WILL MEET YOUR SPECIFIC REQUIREMENTS OR THAT ITS OPERATION OR OUTPUT WILL BE UNINTERRUPTED OR ERROR-FREE. YOU ACKNOWLEDGE THAT USE OF THE SERVICES INVOLVES SIMULATING A REAL SYSTEM INTRUSION, AND YOU ACCEPT FULL RESPONSIBILITY FOR ANY CONSEQUENCES RESULTING FROM SUCH USE, INCLUDING THOSE ARISING FROM THE USE OF INFORMATION PROVIDED IN REPORTS GENERATED BY THE SERVICES.

Neither Party shall be held liable for failing to fulfill its obligations under the Agreement due to events beyond its reasonable control that were unforeseeable at the time the Agreement was executed and could not have been prevented or mitigated through reasonable actions. Such events include, but are not limited to, explosions, fires, storms, earthquakes, floods, droughts, riots, strikes, civil disobedience, sabotage, acts of terrorism, civil wars, revolutions, wars, or government actions ("Force Majeure"). Each Party shall make commercially reasonable efforts to take necessary and appropriate actions within its control to minimize the impact and consequences of a Force Majeure event. The affected Party must promptly notify the other Party in writing of the occurrence and conclusion of the Force Majeure event. If a Force Majeure event persists for more than 10 consecutive days or 15 non-consecutive days, either Party may terminate the Agreement by providing written notice to the other Party, without incurring further liability.

Neither Party may assign or transfer any rights under the Agreement without the prior written consent of the other Party, which shall not be unreasonably withheld. However, either Party may, with prior written notice, transfer any rights under the Agreement to an Affiliate or a third party as part of a merger, sale of all or substantially all of its shares or assets, or a corporate reorganization.

A42 reserves the right to update these Terms, with the most current version accessible on its website. Revised Terms will take effect as soon as they are published online. A42 will notify Customer of any significant changes, particularly those that materially affect Customer’s rights or obligations. By continuing to use the Services after the updated Terms become effective, You acknowledge and agree to be bound by them.

All notices or communications under the Agreement must be in writing and delivered either by email or letter to the designated contact person. Such communications will be considered effectively delivered: (a) immediately upon sending, if sent by email (provided no automated notification of non-delivery is received); or (b) five (5) business days after dispatch, if sent by registered mail. Notices addressed to You will be sent to the contact person and email address specified in the Agreement. Notices addressed to A42 shall be sent to: info@a42.tech; Ukraine, 04052, Kyiv City, 17, Hlybochytska str.

The Agreement shall be governed by and construed in accordance with the laws of Ukraine, regardless of laws principles. Any disputes arising from the Agreement shall be settled by the commercial court of Kyiv, the Parties expressly waiving the competence of any other courts.

The Agreement shall be applied to the fullest extent permitted by applicable law. If any provision is deemed unenforceable by a court, You and we will replace the invalid provision with terms that are enforceable under applicable law while ensuring the remaining provisions remain in effect.

The Agreement constitute the entire understanding between You and A42 regarding the Service, superseding all prior agreements, discussions, or statements, whether written or oral, related to Your use of the Services.

The failure, delay, or partial exercise of any right under the Agreement shall not be considered a waiver or expiration of such rights. All rights remain valid and enforceable regardless of whether they are exercised. The Parties agree that they act as independent contractors with respect to the Agreement. Neither Party shall claim authority to bind, represent, or create obligations or warranties on behalf of the other Party as an agent, employee, or in any other capacity.

The Agreement shall bind and benefit the Parties, their representatives, successors, and permitted assigns.

Last updated: 18.01.2025