OX PLATFORM SUBSCRIPTION AGREEMENT

This Platform Subscription Agreement (“Agreement”) is between you and the applicable entity of OX, as described under the Order Form, together with its Affiliates (“OX”).

WHEREAS, OX develops, markets and sells subscriptions to its Platform (as defined below); and WHEREAS, Customer wish to subscribe a license to use the Platform; and WHEREAS, OX wishes to grant the Customer a license to use the Platform, all subject to the terms and conditions set forth in this Agreement.

NOW, THEREFORE, the parties agree as follows:

1. DEFINITIONS.

   1.1 “AI Features” means functionalities within the Platform that utilize artificial intelligence or machine-learning technologies to analyze Customer Data and provide machine-generated recommendations, insights, or suggestions.

   1.2 “AI Input” means Customer Data provided to, or otherwise processed by, the AI Features for the purpose of generating AI Output.

   1.3 “AI Output” means the results generated and returned by the AI Features based on AI Input.

   1.4 “Affiliate” means all entities which are controlling, controlled by or under common control with a party. For purposes of this Agreement, “control” means possessing, directly or indirectly, more than 50% of the power to direct or cause the direction of the management, policies or operations of an entity, whether through ownership of voting securities, by contract or otherwise.

   1.5 “Authorized Users” means Customer’s designated users that are granted access to use the Platform on an individual basis.

   1.6 “Customer Data” means data made available to OX by Customer which is processed by the Platform and is not personal information.

   1.7 “Documentation” means the standard documentation and user manuals of the Platform made available to Customer.

   1.8 “Output” means the Output Reports, data presented on the Platform’s dashboard and any feedback sent from the Platform.

   1.9 “Output Reports” means reports generated through the use of the Platform and includes output concerning Customer’s systems.

   1.10 “Platform” means OX’s cloud and/or on premise (as applicable) security platform, including all updates, upgrades, versions and modifications thereto, and the Documentation.

   1.11 “Security Incident” means a confirmed breach of OX’s security safeguards that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data.

   1.12 “SLA” means OX’s standard Service Level Agreement, as may be amended by OX from time to time at its sole discretion, provided that such updates do not materially degrade the support terms (when taken as a whole), which may be made available to Customer upon request.

   1.13 “Security Measures” means OX’s administrative, technical, and organizational security measures applicable to the Services, as may be updated by OX from time to time, provided that such updates shall not result in a material reduction in the overall level of security of the Services. The Security Measures may be made available to Customer upon request.

2. ORDERS; LICENSE GRANT, RESTRICTIONS, AND PROHIBITIONS.

   2.1 Orders. The Platform to be provided by OX pursuant to this Agreement will be set forth in one or more sales orders (each, an “Order”) incorporating this Agreement by reference. Customer may purchase a subscription to the Platform through a reseller or other partner authorized by OX (“Partner”). In such case, the ordering documents, including any related purchasing order, will be entered into between Customer and such Partner (collectively, the “Partner Order”), and Customer’s access to and use of the Platform shall be governed by this Agreement together with such Partner Order. To the extent there is any conflict between this Agreement and the Partner Order, then, as between Customer and OX, this Agreement shall prevail. Any rights granted to Customer in such Partner Order which are not contained in this Agreement apply only in connection with such Partner, and Customer must seek enforcement of such rights solely with such Partner and not OX. An Order and Partner Order are each referred to herein as an “Order Form”, as applicable.

   2.2 License Grant. Subject to the terms of this Agreement, OX hereby grants Customer a worldwide, royalty-free, non-exclusive, non-transferrable (except as provided in Section 13.3), non-sublicensable, revocable (in accordance with the terms of this Agreement) license to access and use the Platform and the Output and any Output Reports provided during the applicable Subscription Term (as defined herein), all of the foregoing solely for Customer’s internal business purposes.

   2.3 Authorized Users. Each Authorized User shall receive a unique login and password or other form of personal authentication preventing unauthorized use, which shall be used by that individual only, and cannot be shared or used by more than one Authorized User at a time.

   2.4 License Restrictions. Customer shall not, and shall not permit any third party on its behalf to: (i) resell, sublicense, lease, time-share or otherwise make a Platform available to any third-party other than its Authorized Users; (ii) attempt to gain unauthorized access to the Platform or disrupt the performance of the Platform; (iii) modify, copy or make derivative works based on the Platform (including any data provided and/or included therein); (iv) decompile, disassemble, reverse engineer or otherwise attempt to derive the Platform’ source code or underlying algorithms; (v) remove or alter any trademarks or other proprietary notices related to the Platform; (vi) use the Platform in a manner that violates or infringes any rights of any third party, including but not limited to, privacy rights, publicity rights or intellectual property rights; or (vii) access the Platform to build a competitive product or service or copying its features or user interface. Customer shall not use any Output, Output Reports, or AI Output to train, build, or improve any machine-learning or artificial-intelligence models, except for internal analytical purposes that do not train or fine-tune any generative or predictive models and do not create derivative works competing with OX or its AI Subprocessors (as defined below).

   2.5 License Prohibitions. Customer agrees not to use the Platform or permit the Platform to be used for the following purposes: (i) product benchmarking or other comparative analysis for any external use; (ii) to violate applicable laws; or (iii) propagate any virus, worms, Trojan horses or other programming routines intended to damage the Platform or any systems or data.

3. CUSTOMER DATA.

   3.1 License to Customer Data. Customer acknowledges that in order to use the Platform, it needs to provide OX with Customer Data. Accordingly, Customer hereby grants OX a royalty-free, fully-paid, irrevocable, non-exclusive license to use, process, display, copy and store the Customer Data in order to provide and administer the Platform and Output and any Output Reports for the benefit of Customer. Without derogating from the foregoing and for the avoidance of doubt, Customer is solely responsible for the backup of Customer Data and Customer alone can implement back up plans and safeguards appropriate for its requirements. As the exclusive owner of the Customer Data, Customer represents, warrants and covenants that to the extent the Customer Data includes any personally identifiable information, Customer has received and/or obtained any and all required consents or permits and has acted in compliance with any and all applicable privacy laws, so as to allow OX to receive, transfer and use the Customer Data solely in order to use the Platform. OX may however be required to disclose the Customer Data: (a) to satisfy any applicable law, regulation, legal process, subpoena or governmental request; or (b) to collect, store, transfer, and/or process the Customer Data through OX’s affiliates, subsidiaries, third party service providers and vendors as reasonably necessary to provide the Platform.

   3.2 Personal Data. To the extent that Customer needs a data processing agreement, Customer shall request OX to provide it with OX’s data processing agreement (“DPA”) and shall return such DPA signed to OX as described therein.

4. SUPPORT SERVICES AND PROFESSIONAL SERVICES.

   4.1 Support Services. OX will provide support services (“Support Services”) to Customer in accordance with OX’s support terms as set forth in the SLA.

5. FEES AND PAYMENT TERMS.

   5.1 Fees. All fees shall be as specified in the applicable Order Form. If Customer purchased the subscription via a Partner, the subscription is subject to the full payment of the applicable fees as set forth in the Partner Order between Customer and the respective Partner. All payments shall be made directly to Partner, as agreed between Customer and Partner. If Customer is entitled to a refund under the terms and conditions of this Agreement, then, unless OX specifies otherwise, OX will refund any applicable fees to the Partner, and the Partner alone will be responsible for refunding the appropriate amounts to Customer.

   5.2 Payment Terms. Unless specified otherwise in an applicable Order Form, all payments of fees shall be made in USD within 30 days of the date of invoice. Except as expressly provided herein, all payments made hereunder are non-refundable and non-cancellable. Payments of amounts made under this Agreement after their due date will incur interest at a rate equal to 1.5% per month (i.e., 18% per annum) or the highest rate permitted by applicable law, whichever is lower. Further, if any amount owed by Customer under this Agreement is overdue by more than 15 days, OX may, without limiting any other rights and remedies it may have, suspend its performance under this Agreement until such overdue payment is made in full.

   5.3 Taxes. All amounts payable by Customer under an Order hereunder are exclusive of all duties and taxes, including but not limited to sales, use, goods and services, excise or value added taxes and withholding taxes (collectively, “Taxes”), where applicable. Customer shall pay and bear all Taxes associated with this Agreement, excluding taxes based solely on OX’s net income. Any withholding amount or deduction imposed on the payment to be made to OX shall be the sole responsibility of Customer and any payments or fees due to OX shall not be decreased in any manner by such withholding amount.

6. PROPRIETARY RIGHTS; THIRD PARTY COMPONENTS.

   6.1 Ownership by OX. As between Customer and OX, OX is the sole owner of all intellectual property rights to all materials provided by OX hereunder, including the Documentation, Platform (and any component therein) and any derivatives, improvements, enhancements, updates and upgrades thereof, Platform Data (as defined below) as well as OX’s Confidential Information and OX’s names, trademarks, trade names and logos, and Customer acknowledges that it has no rights thereto except as expressly set forth herein.

   6.2 Ownership by Customer. Customer is and shall remain the owner of the rights to the Customer Data, Customer Confidential Information, and any other materials it provides to OX in connection with the Platform.

   6.3 Platform Data. Customer acknowledges and agrees that OX may collect and use system information and information about Customer’s use of the Platform, including aggregated and anonymized Customer Data (“Platform Data”), and that OX shall own all rights title and interest in and to such Platform Data.

   6.4 Feedback. Nothing in this Agreement or in the parties’ dealings related to this Agreement will restrict OX’s right to use, disclose, publish, or otherwise exploit Feedback (as defined below), without compensating or crediting Customer or the individual providing such Feedback. No Feedback shall be deemed Customer Confidential Information to the extent that such Feedback relates to OX’s Platform and services. For the purposes of this Agreement, “Feedback” means any suggestion or idea for improving or modifying the Platform. There are no implied rights and all rights not expressly granted herein are reserved.

   6.5 Third Party Components and Sources. The Platform may include third party software components that are subject to open source and/or pass-through commercial licenses and/or notices (the “Third Party Software” and “Third Party Software Terms and Notices”, respectively). OX may make available with the Platform a list of such Third Party Software and Third Party Software Terms and Notices, and will comply with any valid written request submitted by Customer to OX for exercising Customer’s rights under such Third Party Software Terms and Notices. The Customer acknowledges that its use of the Platform is also governed by such Third Party Software Terms and Notices, and that to the extent of any conflict between this Agreement and any Third Party Software Terms and Notices, the latter shall control. Any covenants, representations, warranties, guarantees, conditions, indemnities or other commitments made by OX in this Agreement concerning the Platform, if any, are made by OX and not by any authors, licensors or suppliers of, or contributors to, such Third Party Software. Notwithstanding the foregoing sentence or anything in this Agreement to the contrary, OX does not make any representation, warranty, guarantee, or condition, and does not undertake any defense or indemnification, with respect to any Third Party Software.

   6.6 Analytic Information. Any anonymous information, which is derived from the use of the Platform (i.e., metadata, aggregated and/or analytics information and/or intelligence relating to the operation, support, and/or Customer’s use, of the Platform) which is not personally identifiable information and which does not identify Customer (“Analytics Information”) may be used for providing the Platform, for development, and/or for statistical purposes. Such Analytics Information is OX’s exclusive property.

7. AI FEATURES

   7.1 Nature of AI Features; Customer Review. Customers acknowledge that AI Output is machine-generated and may be inaccurate, incomplete, duplicative, or otherwise unsuitable for Customer’s environment. Customer is solely responsible for independently reviewing, validating, and testing all AI Output before any reliance or use in production environments and for any decisions made in reliance on AI Output. Use of AI Output is not a substitute for professional judgment or review by qualified personnel.

   7.2 AI Subprocessors. OX may use third-party artificial intelligence sub processors (“AI Subprocessors”) to process AI Input solely to generate AI Output for Customer. AI Subprocessors are contractually restricted from using AI Input to train their foundation models. A current list of AI Subprocessors is maintained on the Trust Center available at: https://www.ox.security/trust-center/ and may be updated from time to time.

   7.3 Data Use; Ownership. AI Input is used only to generate AI Output for Customer. As between the parties, Customer owns AI Input. OX may use aggregated, anonymized, or de-identified data derived from AI Input and usage of the AI Features for analytics, diagnostics, and improvement of the Platform and AI Features, provided such data does not reasonably permit identification of Customer or its Authorized Users.

   7.4 Restrictions. Customer will not use the AI Features or AI Output to (a) violate applicable law or third-party rights; (b) generate or disseminate harmful, unlawful, or deceptive content; (c) reverse-engineer or replicate underlying AI models (except as permitted by law); or (d) use AI Output contrary to Documentation or applicable guidelines. OX may suspend access to AI Features in cases of suspected misuse or security risk (without limiting other remedies).

   7.5 Acceptable Use / Provider Terms. Customer’s use of the AI Features shall not cause OX or any AI Subprocessor to violate applicable acceptable use policies that apply to the AI Features. Such terms shall apply only to the extent applicable to Customer’s actual use of the AI Features and will not apply retroactively to prior use.

   7.6 Representations and Warranties.

   7.6.1 OX warrants that it will provide the Services, and will design, configure, and deploy any AI Features, with due skill, care, and diligence, and in a professional and workmanlike manner consistent with prevailing industry practices and applicable law, so as to ensure that the AI Features perform substantially in accordance with the specifications set forth in this Agreement and the Documentation.

   7.6.2 OX warrants that to its knowledge, it has and will continue to ensure it has obtained all necessary permissions and licenses for the provision of the Services and the use of the AI Features configured and operated by OX. OX makes no representation regarding rights in or to any third-party foundation models, data sets, or open-source components beyond its contractual rights of use.

   7.6.3 OX shall use commercially reasonable efforts to address any material defects or performance issues in the AI Features that cause it to deviate from the specifications of the Services, provided such issues are reproducible and within OX’s reasonable control.

   OX MAKES NO WARRANTIES REGARDING THE ACCURACY, RELIABILITY, COMPLETENESS, OR FITNESS FOR PURPOSE OF ANY AI OUTPUT AND DISCLAIMS ALL WARRANTIES THAT AI OUTPUT WILL COMPLY WITH ANY CUSTOMER LEGAL, REGULATORY, OR OPERATIONAL REQUIREMENTS. THE AI FEATURES ARE NOT DESIGNED OR INTENDED FOR USE IN HAZARDOUS, SAFETY-CRITICAL, MEDICAL, FINANCIAL DECISIONING, OR ANY HIGH-RISK ENVIRONMENTS, INCLUDING ANY USE CASE CLASSIFIED AS HIGH RISK UNDER THE EU AI ACT OR ANY EQUIVALENT LAW. CUSTOMER SHALL NOT USE, AND SHALL NOT PERMIT ANY USE OF, THE AI FEATURES OR AI OUTPUT FOR ANY SUCH PURPOSE.

   7.7 Customer-Connected AI Systems. For clarity, where Customer elects to connect or enable its own AI Subprocessors (including any third-party model), Customer is solely responsible for such connection and all related data-handling, retention, training, security, provenance, and compliance obligations. OX shall have no responsibility or liability under this Section 7 with respect to any Customer connected AI Subprocessors.

   7.8 Agentic Pentesting; AI Agentic Addendum. Certain AI Features allow Customer to initiate active security testing against targets designated by Customer (the “AI Pentest Feature”). Customer’s enablement and use of the AI Pentest Feature is governed by the OX AI PENETRATION TESTING ADDENDUM (posted here: OX AI PENETRATION TESTING ADDENDUM) (the “AI Pentest Addendum“). The AI Pentest Addendum shall apply if, and only for so long as, Customer enables or uses the AI Pentest Feature, and shall have no force or effect with respect to Customer’s use of the Platform if Customer does not enable or use such features.

8. CONFIDENTIAL INFORMATION.

   8.1 Confidential Information. Each party agrees that “Confidential Information” includes, without limitation, all information provided by a party (“Disclosing Party”) to the other party (“Receiving Party”) that is either designated as confidential at the time of disclosure or should reasonably be considered, given the nature of the information or the circumstances surrounding its disclosure, to be confidential. For the avoidance of doubt, OX’s Confidential Information includes all non-public product features and information regarding pricing of its products and services. The Receiving Party will only use the Disclosing Party’s Confidential Information in connection with this Agreement and will not disclose it to any third party, except to the Receiving Party’s and its Affiliates’ employees, directors, consultants, agents (collectively, “Representatives”) who have a need to know and are subject to non-disclosure obligations with terms no less restrictive than those herein. The Receiving Party shall remain liable for any acts or omissions of its Representatives with respect to the Disclosing Party’s Confidential Information.

   8.2 Exclusions. The duties described in Section 8.1 will not apply to any information that: (a) is or becomes publicly available through no fault of the Receiving Party; (b) is rightfully known by the Receiving Party prior to disclosure by the Disclosing Party; (c) is rightfully obtained by the Receiving Party without restriction from a third party not known by the Receiving Party to be subject to restrictions on disclosure; or (d) is disclosed by the Receiving Party with the prior written approval of the Disclosing Party. Notwithstanding the foregoing, the Receiving Party may also disclose Confidential Information if and only to the extent it is required to be disclosed by law or regulatory or court order, so long as, if permitted under applicable law, Receiving Party provides advance notice to the Disclosing Party as promptly as possible and reasonably cooperates with the Disclosing Party’s efforts to limit or obtain a protective order or other relief regarding such disclosure at Disclosing Party’s expense.

   8.3 Injunctive Relief. Both parties hereby agree that the Confidential Information to be disclosed hereunder is of a unique and valuable character, that damages to the Disclosing Party that would result from the unauthorized dissemination of the Confidential Information would be impossible to calculate and that such party agrees that the Disclosing Party has no adequate remedy at law. The parties further agree that the Disclosing Party shall be entitled to obtain injunctive relief (without the posting of any bond or other security) preventing the further use and/or disclosure of any Confidential Information in violation of the terms hereof.

   8.4 Return and Destruction. Upon termination of this Agreement, the Receiving Party will, upon written request, promptly destroy or return the Disclosing Party’s Confidential Information and all copies thereof, provided that the Receiving Party shall not be obligated to erase Confidential Information contained in archived computer system backups in accordance with its security and/or disaster recovery procedures, provided further that any such retained Confidential Information shall continue to be protected by the confidentiality obligations of this Agreement.

9. WARRANTY DISCLAIMER.

   9.1 WARRANTY DISCLAIMER. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE PLATFORM, ANY OUTPUT AND ANY OUTPUT REPORTS PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS, OX AND ITS THIRD-PARTY LICENSORS MAKE NO WARRANTIES, EXPRESS OR IMPLIED, RELATING TO THE PLATFORM, REPORTS AND/OR PROFESSIONAL SERVICES. OX DISCLAIMS AND EXCLUDES THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OF NONINFRINGEMENT OF THIRD PARTIES’ RIGHTS. OX DOES NOT WARRANT THAT CUSTOMER’S USE OF THE PLATFORM WILL BE UNINTERRUPTED OR THAT THE OPERATION OF THE PLATFORM WILL BE ERROR-FREE OR SECURE OR THAT IT WILL BE COMPATIBLE WITH ALL OF CUSTOMER’S EQUIPMENT OR SOFTWARE CONFIGURATIONS, OR THAT THE PLATFORM IS DESIGNED TO MEET ALL OF CUSTOMER’S BUSINESS REQUIREMENTS, OR THAT THE PLATFORM WILL PREVENT ANY CYBER ATTACKS AND/OR CYBER BREACH IN CUSTOMER’S ENVIRONMENT. OX SHALL NOT BE RESPONSIBLE FOR ANY WARRANTIES AND REPRESENTATIONS MADE BY ANY PARTNER TO CUSTOMER.

10. INDEMNIFICATION.

    10.1 OX Indemnity. OX will indemnify and defend Customer and hold Customer harmless against all third party losses finally awarded by a court of competent jurisdiction or pursuant to a settlement agreement signed by OX arising from actions, proceedings, suits, claims or demands that may be brought or instituted against Customer by any third party that Customer’s use of the Platform in accordance with the terms of this Agreement infringes such third party’s intellectual property rights (“Infringement Claims”). Notwithstanding the foregoing, OX shall have no liability or obligation hereunder with respect to any Infringement Claim to the extent arising from or related to: (a) any use of the Platform not in accordance with this Agreement and the Documentation; (b) modifications, adaptations, alterations, or enhancements of the Platform not created by or for OX; (c) the combination of the Platform with items not supplied by OX or approved for use with the Platform by OX in the Documentation to the extent such claim would not have arisen but for the combination; or (d) Customer’s continuing use of any version of the Platform after an update, modification or replacement of the Platform is made available to the Customer and Customer fails to implement within a reasonable period of time. If the Platform or part thereof becomes, or in OX’s opinion may become, subject to an Infringement Claim or Customer’s use thereof may be otherwise enjoined, OX may, at its option, either: (i) procure for Customer the right to continue using the Platform; (ii) replace or modify the Platform, so that it is non-infringing; or (iii) if neither of the foregoing alternatives is reasonably practical, terminate this Agreement and refund, from either OX or Partner (as the case may be), the subscription fees prepaid for the unexpired term, if any, upon the destruction (and certification of destruction) of any Platform components in Customer’s possession. This Section 10.1 states OX’s entire liability and Customer’s exclusive remedy for infringement.

    10.2 Customer Indemnity. Customer agrees to defend, indemnify and hold harmless OX and its Affiliates and the respective officers, directors and employees from any third party claims, damages, liabilities, costs, and expenses (including reasonable attorney’s fees) arising from: (i) Customer’s or its Authorized Users’ use of the Platform; (ii) any claim that the Customer Data infringes or violates any intellectual property rights, or any other proprietary right of a third party; and/or (iii) Customer’s breach of its representations and warranties under this Agreement.

    10.3 Indemnification Procedure. The indemnified party shall give the indemnifying party prompt notice of any claim, grant the indemnifying party sole control of the defense and/or settlement of any claim (provided that the indemnifying party shall not enter into any settlement that admits liability on behalf of the indemnified party or imposes any obligations on the indemnified party without the prior written consent of the indemnified party, other than payment of amounts indemnified hereunder or, in the case of an Infringement Claim, cessation of use of the allegedly infringing item) and provide reasonable assistance as requested by the indemnifying party at the indemnifying party’s sole expense.

11. LIMITATION OF LIABILITY.

    EXCEPT FOR EITHER PARTY’S WILLFUL MISCONDUCT AND INDEMNIFICATION OBLIGATIONS: (A) IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY, OR TO ANY THIRD PARTIES, FOR INDIRECT, SPECIAL, CONSEQUENTIAL, COLLATERAL OR INCIDENTAL DAMAGES, INCLUDING WITHOUT LIMITATION LOSS OF BUSINESS, REVENUES, PROFITS AND GOODWILL, OR INTERRUPTION OF USE, LOSS OR INACCURACY OF DATA, OR LOSS OF OR COST OF PROCURING SUBSTITUTE TECHNOLOGY, GOODS OR SERVICES, IN EACH CASE EVEN IF A PARTY IS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (B) EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM DURING THE TWELVE (12) MONTHS PRIOR TO THE EVENT GIVING RISE TO LIABILITY; PROVIDED THAT FOR BREACH OF CONFIDENTIALITY OBLIGATIONS UNDER SECTION 8, A SECURITY INCIDENT, OR BREACH OF DATA PROTECTION OBLIGATIONS, SUCH LIABILITY SHALL NOT EXCEED TWO (2) TIMES THAT AMOUNT.

12. TERM; TERMINATION.

    12.1 Term. The term of this Agreement shall commence on the Effective Date and remain in full force and effect until no Order Form remains in effect hereunder (the “Term”). The subscription period shall be as set forth in the applicable Order Form (the “Subscription Term”), for a single or recurring term, and if no such term is set forth, shall continue for one (1) year from the last signature date of such Order Form. The Subscription Term shall automatically renew for successive terms of one (1) year each, unless either party notifies the other party of non-renewal at least 60 days before the end date of the then-current Subscription Term. Except as otherwise expressly provided in the applicable Order Form, upon renewal of the Subscription Term, the fees for each renewal Subscription Term and recurring services, if any, shall automatically be increased by 5% per annum from the applicable fees for the expiring Subscription Term. The Order Form, this Agreement and the Subscription Term may not be early terminated, except as otherwise outlined herein below.

    12.2 Termination. Either Party may terminate this Agreement upon prior written notice sent to the other Party if (a) the other party commits a material breach of any of its obligations and such breach remains uncured for thirty (30) days after receipt of the notice, except for Customer’s failure to pay applicable fees, which must be cured within fifteen (15) days after receipt of written notice; (b) the other party commits a non-remediable material breach, in which case termination shall take effect immediately; or (c) the other party makes any assignment for the benefit of creditors, or a receiver, trustee in bankruptcy or similar officer is appointed to take charge of any or all of the other party’s property, or the other party seeks protection under any bankruptcy, receivership, trust deed, creditors arrangement, composition or comparable proceeding or such a proceeding is instituted against the other party and is not dismissed within 90 days, or the other party becomes insolvent or, without a successor, dissolves, liquidates or otherwise fails to operate in the ordinary course, in which case termination shall take effect immediately. Each Partner Order may be terminated in accordance with any termination rights specified therein.

    12.3 Effect of Termination. Upon any termination of this Agreement, Customer shall no longer be entitled to use the Platform or any other services provided by OX, shall lose all access to the Platform and any Customer Data stored within the Platform (if any), and the license granted to Customer under this Agreement shall automatically terminate. Within fifteen (15) days of such termination, Customer shall permanently and irretrievably delete the Platform (if installed on-premise) and any Documentation made available to it by OX, including all copies and portions thereof it may have in its possession, and shall, upon request by OX, provide written certification to OX that such erasure has been completed. Customer shall be solely responsible for downloading Customer Data prior to termination of this Agreement. In the event Customer fails to do so, upon Customer’s written request, OX shall make available to Customer, for a period of 30 days from the effective date of such termination, a reasonable opportunity to download the Customer Data at a time nominated by OX. Upon Customer’s written request following such 30-day period, OX shall permanently delete the Customer Data in OX’s possession or control. In the event that this Agreement is terminated as a result of Customer’s breach, then all outstanding Order Forms shall be terminated immediately.

    12.4 Survival. Notwithstanding any termination of this Agreement, Sections 1 (Definitions), 5 (Fees and Payment Terms, with respect to amounts accrued prior to termination), 6 (Proprietary Rights; Third Party Components), 8 (Confidential Information), 9 (Warranty Disclaimer), 10 (Indemnification), 11 (Limitation of Liability), 12.3 (Effect of Termination), 12.4 (Survival), and 13 (General Provisions), shall survive and continue to be in effect in accordance with their terms.

    12.5 Audit and Security.

    12.5.1 OX maintains an information security and data protection program designed to safeguard the Platform and Customer Data against unauthorized access, use, alteration, or disclosure, and shall implement and comply with the Security Measures. Upon written request, OX will provide Customer with available summaries, reports, or certifications reasonably demonstrating its security controls.

    12.5.2 In the event of a confirmed Security Incident involving Customer Data, OX shall notify Customer without undue delay following confirmation, provide information reasonably available regarding the nature and scope of the incident, and take reasonable steps to mitigate its effects. OX shall maintain records of remedial actions and shall reasonably cooperate with Customer’s inquiries relating to such incident.

    12.5.3 Any Customer-initiated audit shall be conducted no more than once per twelve (12) month period, upon at least thirty (30) days’ prior written notice, during normal business hours, and in a manner that does not unreasonably interfere with OX’s operations. The annual limitation shall not apply where required by applicable law or in connection with a confirmed Security Incident. Customer shall bear all costs of any audit unless such audit establishes that OX materially failed to comply with its Security Measures, in which case OX shall bear the reasonable, documented out-of-pocket costs of such audit. Customer shall maintain the confidentiality of any information obtained.

    12.6 Insurance.

    During the Term of this Agreement, OX shall maintain the following insurance coverages with carriers having an A.M. Best rating of A-VIII or better or a Standard & Poor’s rating of A- or better:

    (a) Commercial General Liability Insurance providing coverage of USD 3,000,000 per occurrence and in the aggregate;

    (b) Workers’ Compensation and Employers’ Liability insurance or any alternative plan or coverage as permitted or required by applicable law, providing coverage of USD 1,000,000;

    (c) Technology Professional Errors and Omissions Liability including Network Security and Privacy Liability coverage, with limits of not less than USD 2,000,000 per claim and in the aggregate, covering liability arising from data breaches and the unauthorized disclosure of personal data. If OX’s Professional Errors and Omissions insurance is written on a claims-made basis, coverage will have an extended reporting period of twelve (12) months, all such claims made policies of OX shall be renewed and kept in force for at least one (1) year after completion of Agreement.

    For all policies required to be carried hereunder, OX shall: (i) provide for a minimum of 30 days’ advance notice to Customer prior to cancellation (ii) be written as primary policies, not contributing with and not in excess of coverage which Customer may carry, if any.

13. GENERAL PROVISIONS.

    13.1 Entire Agreement. This Agreement (including all Order Forms) constitutes the entire agreement, and supersedes all prior negotiations, understandings or agreements (oral or written), between the parties regarding the subject matter of this Agreement (and all past dealing or industry custom). Any inconsistent or additional terms on any related Customer-issued purchase orders, vendor forms, invoices, policies, confirmation or similar form, even if signed by the parties hereafter, will have no effect under this Agreement. In the event of any conflict between the terms of this Agreement and the terms of any Order Form, the terms of this Agreement will control unless otherwise explicitly set forth in an Order Form.

    13.2 Modification and Waiver. No modification, consent or waiver under this Agreement will be effective unless in writing and signed by both parties. The failure of either party to enforce its rights under this Agreement at any time for any period will not be construed as a waiver of such rights. If any provision of this Agreement is determined to be illegal or unenforceable, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable.

    13.3 Assignment. A party to this Agreement may not assign, delegate, or otherwise transfer any or all of its rights or obligations under this Agreement without the prior written consent of the other party, such consent not to be unreasonably withheld, delayed or conditioned. Notwithstanding the foregoing, OX may assign this Agreement in whole: (a) to its Affiliates; or (b) in connection with a merger transaction, change of control, sale of all or substantially all of assets, or any similar transaction of OX.

    13.4 Relationship of the Parties. Customer and OX shall operate as independent contractors and not as partners, joint venturers, agents or employees of the other. Neither party shall have any right or authority or assume or create any obligations or make any representations or warranties on behalf of the other party, whether expressed or implied, or to bind the other party in any respect whatsoever.

    13.5 Export and Import Compliance. Customer shall comply with U.S., Israeli, and all applicable import, export and re-export regulations, including but not limited to, any regulations of the Office of Export Administration of the U.S. Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control, and other U.S. agencies and the export control regulations of the European Union, to ensure that neither the Platform nor any technical data related thereto are exported or re-exported directly or indirectly in violation of, or used for any purposes prohibited by, such laws and regulations.

    13.6 Use of Customer Name. OX may use Customer’s name, logo, and trademarks and refer to its relationship with Customer in its business development and marketing efforts.

    13.7 Force Majeure. Except for payment obligations, neither party shall have any liability under the Agreement to the extent that the performance of its obligations is delayed, hindered or prevented by an event or circumstance outside the reasonable control of the party, including fire, storm, flood, earthquake, adverse weather conditions, pandemic, explosions, Acts of God, terrorism or the threat thereof, nuclear, chemical or biological contamination, compliance with any law, governmental controls, restrictions or prohibitions general strikes, lock-outs, industrial action or employment dispute not caused by or specific or limited to the affected party, protests, public disorder, general interruptions in communications or power supply, and denial of service attacks.

    13.8 Governing Law; Jurisdiction. This Agreement is governed by the following laws: (i) if the Order Form was executed with OX Appsec Security Ltd, this Agreement is governed by the laws of the State of Israel, without reference to its conflict of laws rules, and each party irrevocably agrees that the courts of Tel Aviv, Israel have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this Agreement or its subject matter or formation; or (ii) if the Order Form was executed with OX Appsec Security, Inc., this Agreement is governed by the laws of the State of New York, without reference to its conflict of laws rules, and each party irrevocably agrees that the courts of New York County, New York have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this Agreement or its subject matter or formation. The parties expressly waive any right to a jury trial regarding disputes related to this Agreement.

    13.9 Notices. All notices and demands hereunder shall be in writing and shall be delivered to the address of the receiving party referenced below (or at such different address as may be designated by such party by written notice to the other party). All notices or demands shall be served by personal service or sent by certified, registered or signed-for mail, return receipt requested, by reputable national or international private express courier, or by electronic transmission, with confirmation received, to the email address specified below, and shall be deemed complete upon receipt: To OX: the address listed in the applicable Order Form or by email to ar@ox.security (on sales or legal related issues). To Customer: the address and contact information listed in the applicable Order Form.