Master Subscription Agreement

In this Agreement, the following terms shall have the meanings set out below:

Words importing the singular include the plural and vice versa. References to a person include any individual, company, partnership or unincorporated body. Headings are for convenience only. Any reference to “writing” or “written” includes email.

Right of Access. Subject to the Customer's compliance with this Agreement (including payment of the Fees), the Provider grants the Customer, for the Term, a non-exclusive, non-transferable, non-sublicensable, revocable right for its Authorised Users to access and use the Service solely for the Customer's and the Customer Affiliates' internal business purposes.

What is included in the Fees. The Fees set out in the Order Form are inclusive of, and the Customer shall not be charged separately for, the following in respect of the Core Platform and of any Add-On Module expressly licensed in the Order Form: (a) hosting, infrastructure and third-party cloud services consumed in delivering the Service; (b) routine maintenance, security patching, vulnerability remediation and infrastructure operations; (c) the Provider's ongoing product development, including new features, enhancements, modifications and upgrades made generally available to customers of the Service during the Term; and (d) standard technical support in accordance with Schedule 2.

What is not included. The Fees do not include, and the Provider may charge separately at its then-current professional services rates for: (a) integrations with the Customer's internal systems beyond the standard integrations made generally available within the Service; (b) data migration, onboarding or training services beyond those expressly included in Schedule 1; (c) consultancy, advisory or workshop services requested by the Customer; (d) work to remedy issues caused by the Customer's misuse of the Service or breach of this Agreement; (e) any Add-On Module, including the TPRM Module, which is licensed and charged separately in accordance with clause 6.7 and is not included in the Core Platform Fees unless expressly identified in the Order Form; and (f) any other work outside the scope of the Service as described in Schedule 1. Any such work shall be undertaken only where agreed in writing in advance.

Multi-Tenant Service. The Customer acknowledges that the Service is operated on a multi-tenant basis serving multiple customers from a common product. The Customer is not entitled to any bespoke version, fork, or modified instance of the Service.

Use Restrictions. The Customer shall not, and shall procure that its Authorised Users shall not: (a) resell, sublicense, rent, lease, distribute or commercially exploit the Service; (b) reverse engineer, decompile or disassemble the Service or any part of it, save to the extent permitted by mandatory law; (c) use the Service to build or assist in building any competing product or service; (d) remove or obscure any proprietary notices; (e) use the Service in breach of the Acceptable Use Policy or applicable law; or (f) attempt to circumvent any technical limitations of the Service.

Authorised Users. The Customer is responsible for the acts and omissions of its Authorised Users as if they were its own.

Continuous Evolution. The Customer acknowledges that the Service is a continuously evolving multi-tenant SaaS platform. The Provider may, in its sole discretion and at any time, add, modify, replace, deprecate or remove features and functionality of the Service, provided that the overall functionality of the Service is not, taken as a whole, materially diminished during the Term.

No Roadmap Commitment. Any product roadmap, release schedule, feature preview, beta capability or forward-looking statement made by the Provider is for informational purposes only and is not contractually binding. The Customer shall not rely on, and the Provider gives no warranty in respect of, the timing, scope or delivery of any future feature, capability or release.

Feedback and Feature Requests. The Customer may submit Feedback through the Provider's standard support channels. The Provider has sole and absolute discretion as to whether, when and how to act upon any Feedback, and gives no warranty, undertaking, commitment or representation as to:

Feedback IP. The Customer hereby irrevocably and unconditionally assigns to the Provider all Intellectual Property Rights in any Feedback, with full title guarantee, free of all third-party rights, and waives any moral rights it or its Authorised Users may have therein. To the extent any such assignment is not effective, the Customer grants the Provider a perpetual, irrevocable, worldwide, royalty-free, sublicensable, transferable licence to use, modify, exploit and commercialise such Feedback for any purpose without restriction.

Standard Product; No Customer-Specific Versions. The Customer acknowledges and agrees that the Service operates on a single common codebase and that the Provider does not maintain, develop, branch, fork or otherwise produce customer-specific versions or exclusive features of the Service. Any feature, modification, enhancement, configuration, integration or other development that the Provider implements during the Term—whether on its own initiative, in response to Feedback, in response to feature requests from any customer of the Service, in response to general market or competitive considerations, or otherwise—shall form part of the standard Service, shall be made available on the Provider's terms to all customers of the Service, and shall be the sole and exclusive property of the Provider. The Provider has sole and absolute discretion as to what work to undertake and as to whether, when and how any feature is implemented or included in the Service.

The Customer shall: (a) provide the Provider with timely cooperation, information and access to Customer personnel reasonably required to enable the Provider to deliver the Service; (b) ensure that all Customer Data is lawful and does not infringe any third-party rights; (c) maintain the security of its Authorised Users' credentials and notify the Provider promptly of any actual or suspected unauthorised use of the Service; (d) comply with the Acceptable Use Policy set out in Schedule 3; and (e) use the Service in accordance with the Documentation.

The Customer warrants that it has, and will maintain throughout the Term, all rights, consents, authorities and lawful bases necessary for the Provider to host and process Customer Data as contemplated by this Agreement.

Customer Backups. Notwithstanding the Provider's backup arrangements described in Schedule 2, the Customer is responsible for maintaining its own redundant copies of any Customer Data critical to its operations, by exercising the export functions made available within the Service from time to time.

This Agreement commences on the Effective Date and continues for the Initial Term, after which it shall automatically renew for successive Renewal Terms unless terminated in accordance with this clause 5 or clause 14.

Either Party may prevent automatic renewal by giving the other not less than sixty (60) days' written notice prior to the end of the then-current Term.

The Customer has no right to terminate for convenience during the Initial Term. Termination during the Initial Term is permitted only in the circumstances set out in clause 14.

The Customer shall pay the Fees in the amounts and on the payment dates set out in the Order Form.

Fees shall be invoiced and paid via Stripe Billing using BACS Direct Debit (or, if agreed, debit/credit card) on a recurring monthly basis in advance. Where the Customer has opted for purchase-order driven invoicing, monthly invoices shall be issued via Stripe with auto-pay enabled and shall be payable on the date of issue.

All Fees are exclusive of VAT, which shall be payable in addition at the prevailing rate.

If any sum payable is not paid by the due date, the Provider may, without prejudice to any other right or remedy: (a) charge interest under the Late Payment of Commercial Debts (Interest) Act 1998; (b) recover its reasonable costs of collection; and (c) exercise its rights under clause 7 (Suspension).

The Provider may increase the Fees for any Renewal Term by written notice given not less than thirty (30) days prior to the start of that Renewal Term. Fees are held flat for the duration of the Initial Term.

All payments due under this Agreement shall be made in full, without any set-off, counterclaim, deduction or withholding, save as required by law.

Add-On Modules. Each Add-On Module is licensed and charged separately from the Core Platform, at the fee stated for that Add-On Module in the Order Form, and on the same billing cycle and payment terms as the Core Platform Fees unless the Order Form states otherwise. Where two or more modules described in Part B of Schedule 1 are licensed together as a bundle under paragraph 9 of that Part, that bundle is treated as a single Add-On Module for the purposes of this clause and is charged at the single fee stated for it in the Order Form. An Add-On Module may be taken as an addition to the Core Platform or, where the Order Form so provides, on a standalone basis. Where an Add-On Module is charged per company entity, a separate fee is payable for each entity for which it is enabled. Adding an Add-On Module during a Term does not alter the expiry date of that Term, and the fee for it shall be pro-rated to the end of the then-current Term. The Customer may elect not to renew an Add-On Module at the end of a Term without affecting the continuation of the Core Platform subscription, and vice versa, by written notice given in accordance with clause 5.

The Provider may suspend the Customer's and any Authorised User's access to the Service, in whole or in part, on written notice (which may be by email) where: (a) any sum payable is overdue by more than fourteen (14) days; (b) the Provider reasonably believes that the Service is being used in breach of this Agreement, the Acceptable Use Policy, or applicable law; (c) the Provider reasonably believes that suspension is necessary to prevent or mitigate a security incident, threat to platform integrity, or risk to other customers; or (d) it is required to do so by law, court order or regulatory authority.

The Provider shall, where reasonably practicable, give the Customer prior notice of suspension and an opportunity to remedy the cause. Suspension under this clause 7 shall not relieve the Customer of its obligation to pay the Fees, save where the suspension is solely due to an act or omission of the Provider not attributable to a default of the Customer.

All Intellectual Property Rights in and to the Service, the GRCxAI Platform, the underlying source code, architecture, models, prompt libraries, templates, content, training materials, the Documentation, and any modifications, configurations, customisations, integrations, derivative works, enhancements, bug fixes, optimisations or improvements thereof (whether developed by the Provider, the Customer, jointly, or by any third party, and whether before, during or after the Term, and whether on the Provider's own initiative, in response to Feedback or Customer requests, or otherwise) are and shall at all times remain the sole and exclusive property of the Provider. No right, title or interest in such Intellectual Property Rights is granted to the Customer save for the limited right of access and use expressly set out in clause 2.1.

The Customer acknowledges and agrees that nothing in this Agreement, nor any prior or contemporaneous engagement, discussion, partnership proposal, proposal review, consultancy arrangement, evaluation, pilot, trial or other dealing between the Parties (or their respective Affiliates), shall operate to transfer, assign, license (except as expressly set out in this Agreement) or grant any beneficial interest in the Provider's Intellectual Property Rights to the Customer.

Customer Data. The Customer retains all Intellectual Property Rights in Customer Data. The Customer grants the Provider a non-exclusive, royalty-free, worldwide licence, for the Term and any post-termination data export period, to host, copy, process, transmit and display Customer Data solely as necessary to provide the Service and to comply with its obligations under this Agreement.

Anonymised and Aggregated Data. The Provider may collect, generate, use and retain anonymised, de-identified and aggregated data derived from use of the Service (“Service Data”) for the purposes of operating, securing, improving and developing the Service and the Provider's other products and services, provided such Service Data does not identify the Customer, any Customer Affiliate or any individual.

Each Party (the “Receiving Party”) shall keep confidential all information of a confidential nature disclosed to it by the other (the “Disclosing Party”), including the terms of this Agreement, technical and commercial information, and any information marked or reasonably understood to be confidential (“Confidential Information”).

The Receiving Party shall: (a) use Confidential Information only for the purposes of performing this Agreement; (b) not disclose it to any third party except to its employees, professional advisers and contractors with a need to know and who are bound by equivalent obligations of confidentiality; and (c) protect it using at least the same degree of care it uses for its own confidential information, and in any event no less than a reasonable standard of care.

Clause 9 does not apply to information that: (a) is or becomes public other than through breach of this Agreement; (b) was known to the Receiving Party before disclosure free of any duty of confidentiality; (c) is independently developed without reference to the Disclosing Party's information; or (d) is required to be disclosed by law or regulatory authority, provided (where lawful) the Disclosing Party is given prior notice.

The obligations in this clause 9 survive termination for a period of five (5) years.

Each Party shall comply with its obligations under Data Protection Laws in connection with this Agreement.

Where the Provider processes personal data on behalf of the Customer in providing the Service, the Customer is the controller and the Provider is the processor. The processing terms set out in Schedule 4 (Data Processing Agreement) shall apply.

The Provider shall implement and maintain appropriate technical and organisational measures to protect Customer Data against unauthorised access, loss, alteration or disclosure, in accordance with Schedule 4.

Mutual Warranties. Each Party warrants to the other that: (a) it is duly incorporated and validly existing under the laws of its jurisdiction of incorporation; (b) it has full authority to enter into and perform this Agreement; and (c) its entry into this Agreement does not conflict with any other agreement to which it is a party.

Limited Provider Warranty. The Provider warrants that the Service will be provided with reasonable care and skill.

Disclaimer. Except as expressly set out in this clause 11, and to the fullest extent permitted by law: (a) the Service is provided “as is” and “as available”; (b) the Provider gives no warranty, condition, guarantee or other term, express or implied, including any implied warranty as to satisfactory quality, fitness for a particular purpose, non-infringement, accuracy, completeness, or that use of the Service will be uninterrupted, error-free, secure, or that all defects will be corrected; (c) the Provider does not warrant that the Service will meet the Customer's requirements; (d) the Provider does not warrant the accuracy, completeness, or appropriateness of any AI-generated output, content, recommendations, scoring, classification or analysis produced by the Service, all of which are provided for informational purposes only and require human review and verification before being relied upon; and (e) the Customer is solely responsible for any decisions made, actions taken or omissions in reliance on the Service or any output thereof.

AI Outputs. The Customer acknowledges that the Service incorporates third-party large language models and other AI components, and that AI-generated outputs may be inaccurate, incomplete, inconsistent or otherwise unsuitable. The Customer shall apply appropriate human review to all AI-generated outputs before use, particularly in connection with regulatory, audit, legal or compliance matters.

Consequences of Service Failure. Save as expressly set out in this Agreement, the Customer's sole and exclusive remedies in respect of any failure of the Service to perform satisfactorily are: (a) to exercise its rights of termination under clause 14; and (b) to recover damages, subject to the limitations in clause 12.

External and Third-Party Information. This clause 11.6 applies wherever the Service presents, matches against or derives output from information the Provider obtains from external sources. Those sources include public and statutory registers (such as company registries, tax and VAT registers, and data-protection and certification or scheme registers), credit and financial data providers, sustainability and vendor-rating providers, vulnerability, exploit and threat-intelligence feeds, security advisories published by vendors and authorities, news and media reporting, and information published by a third party about itself. It applies to the Core Platform and to every Add-On Module, including the TPRM Module and the vCISO Module.

(a) Coverage is selective, not exhaustive. The Provider determines which sources it ingests and does not monitor all publicly available information. The Service is not, and is not represented to be, a complete record of the vulnerabilities, threats, incidents, advisories, registrations or exposures affecting the Customer, its estate or any third party. Sources may be added, changed, restricted or withdrawn at any time, including by the source operator.

(b) Accuracy is not warranted. The Provider prefers sources it considers established and credible. That is a statement of the Provider's practice and not a warranty as to any source or its content: the Provider does not independently verify all information obtained from external sources and gives no warranty as to its accuracy. Such information may be inaccurate, out of date, incomplete at the time of publication, subsequently corrected or retracted, contested as to attribution, or affected by the editorial bias, national perspective or commercial interest of whoever published it. Scores, ratings, relevance tags, country assessments and similar measures derived from that material are outputs of the Provider's models and are opinions rather than statements of fact.

(c) No commitment as to timing. The Provider gives no commitment, target or guarantee as to the period between information being published at source and that information becoming available within the Service, nor as to the frequency with which any source is ingested, matched or refreshed. The Service is not a real-time service, and is not a security monitoring, threat detection, alerting or incident response service. The Customer remains responsible for its own security monitoring, vulnerability management and incident detection and response.

(d) Absence of a finding is not assurance. The absence of a finding, alert, advisory, forecast, record or other output does not indicate that no vulnerability, threat, incident, exposure or registration exists, and shall not be relied upon by the Customer, or represented by the Customer to any third party, as assurance that none exists.

(e) Verify before acting where it matters. Where an output appears to the Customer to be inconsistent with what it knows, or would be material to a decision it is about to take, the Customer should check it against the underlying source or another authority before acting on it. This is in addition to, and does not limit, the human review the Customer is required to apply under clause 11.4.

Liability that Cannot Be Excluded. Nothing in this Agreement excludes or limits either Party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot lawfully be excluded or limited.

Excluded Loss. Subject to clause 12.1, neither Party shall be liable to the other (whether in contract, tort (including negligence), breach of statutory duty, restitution or otherwise) for any:

Liability Cap. Subject to clauses 12.1 and 12.2, the total aggregate liability of each Party arising out of or in connection with this Agreement (whether in contract, tort, breach of statutory duty or otherwise) shall not exceed an amount equal to one hundred per cent (100%) of the Fees paid by the Customer in the twelve (12) month period immediately preceding the first event giving rise to the claim (or, if the claim arises before twelve months have elapsed, the annualised value of the Fees as set out in the Order Form).

Reasonableness. The Parties acknowledge that the limitations and exclusions in this clause 12 are reasonable having regard to the nature of the Service, the Fees payable, the multi-tenant model on which the Service is provided, and the allocation of risk between the Parties.

Customer Indemnity. The Customer shall indemnify and hold harmless the Provider, its directors, officers, employees and agents, from and against any and all losses, damages, costs (including reasonable legal costs), liabilities and expenses arising out of or in connection with: (a) any Customer Data or the processing thereof; (b) any breach by the Customer or any Authorised User of clause 2.5, the Acceptable Use Policy, or applicable law; (c) any third-party claim arising from the Customer's use of, or reliance on, the Service or any output thereof; and (d) any claim by an Authorised User against the Provider, save where such claim arises from the Provider's breach of this Agreement.

Provider IP Indemnity. The Provider shall indemnify the Customer against direct losses awarded against the Customer by a court of competent jurisdiction in respect of any third-party claim that the Customer's use of the Service in accordance with this Agreement infringes that third party's UK Intellectual Property Rights, provided that:

Exclusions. The Provider's indemnity in clause 13.2 does not apply to any claim arising from: (a) Customer Data; (b) modifications to the Service made by anyone other than the Provider; (c) combination of the Service with materials not supplied by the Provider; (d) use of the Service other than in accordance with this Agreement and the Documentation; or (e) use of any AI-generated output without appropriate human review.

Mitigation. If a claim of the type covered by clause 13.2 is made or appears likely, the Provider may, at its option and at no cost to the Customer: (a) procure for the Customer the right to continue using the affected part of the Service; (b) modify or replace the affected part so that it is non-infringing; or (c) on written notice, terminate this Agreement and refund the pro-rata portion of any pre-paid Fees attributable to the unused remainder of the Initial Term or then-current Renewal Term. The remedies in this clause 13 are the Customer's sole and exclusive remedies, and the Provider's sole liability, in respect of any infringement of third-party Intellectual Property Rights.

Either Party may terminate this Agreement immediately by written notice if the other: (a) commits a material breach of this Agreement which, if remediable, is not remedied within thirty (30) days of written notice requiring remedy; or (b) becomes insolvent, ceases or threatens to cease to carry on business, has a receiver or administrator appointed, enters into any composition with its creditors, or any analogous event occurs in any jurisdiction.

The Provider may terminate this Agreement immediately by written notice if: (a) the Customer fails to pay any undisputed sum within thirty (30) days of the due date, having received written notice of such failure; or (b) the Customer commits a material breach of clause 2.5, the Acceptable Use Policy, or any law applicable to its use of the Service.

On termination or expiry: (a) the Customer's rights to access and use the Service shall cease immediately; (b) all accrued Fees become immediately due and payable; (c) the Provider shall, on request made within thirty (30) days of termination, make Customer Data available for export in a commonly used machine-readable format for a period of ninety (90) days, after which the Provider may delete or anonymise Customer Data subject to its lawful retention obligations; and (d) clauses 8, 9, 10, 11.3, 12, 13, 14.3, 16 and 17 shall survive termination.

Neither Party shall be liable for any delay or failure in performance (other than payment obligations) caused by events beyond its reasonable control, including acts of God, war, terrorism, civil unrest, fire, flood, pandemic, governmental action, failure of public infrastructure, cyber attacks affecting third-party providers, or failure of upstream cloud, AI model, or telecommunications providers, provided that the affected Party promptly notifies the other and uses reasonable endeavours to mitigate the effect. If a force majeure event continues for more than ninety (90) consecutive days, either Party may terminate this Agreement on written notice without liability.

Negotiation. If any dispute arises out of or in connection with this Agreement, the Parties' senior representatives shall meet (in person or by videoconference) within fourteen (14) days of written notice of the dispute and use reasonable endeavours to resolve it in good faith.

Mediation. If the dispute is not resolved by negotiation within thirty (30) days of the notice, the Parties shall attempt to resolve it by mediation under the Centre for Effective Dispute Resolution (CEDR) Model Mediation Procedure. The mediation shall take place in London, in English. The fees of the mediator shall be borne equally by the Parties.

Litigation. Nothing in this clause 16 shall prevent a Party from seeking urgent injunctive or other equitable relief from a court at any time. Following compliance with clauses 16.1 and 16.2 (or where a Party fails to participate in good faith), either Party may commence proceedings in accordance with clause 17.6.

Entire Agreement. This Agreement (including its Schedules) constitutes the entire agreement between the Parties in relation to its subject matter and supersedes all prior agreements, proposals, partnership proposals, partnership reviews, evaluations, communications and understandings, whether written or oral. Each Party acknowledges that, in entering into this Agreement, it has not relied on any statement, representation, assurance or warranty other than those expressly set out in this Agreement.

Variation and Updates. No variation of the commercial terms of this Agreement (as set out in any Order Form) is effective unless in writing and signed by an authorised representative of each Party. The Provider may, however, update this Agreement (excluding any signed Order Form) from time to time as set out below:

Assignment. Neither Party may assign or transfer its rights or obligations without the prior written consent of the other (such consent not to be unreasonably withheld), save that the Provider may assign or novate this Agreement to any acquirer of all or substantially all of its business or assets relating to the Service.

Notices. Notices shall be given in writing to the addresses set out in the Order Form (or such other address as notified in writing) and shall be deemed received: if delivered by hand, on delivery; if sent by email, on transmission with confirmation of delivery; or if sent by recorded post, two Business Days after posting.

Third Party Rights. A person who is not a party to this Agreement has no rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms, save that Customer Affiliates identified in the Order Form may enforce their rights of access to the Service.

Governing Law and Jurisdiction. This Agreement and any dispute arising out of or in connection with it shall be governed by the laws of England and Wales, and the Parties submit to the exclusive jurisdiction of the courts of England and Wales.

Severability. If any provision of this Agreement is held by any court or other competent authority to be invalid or unenforceable, the remainder of this Agreement shall continue in full force and effect.

Counterparts. This Agreement may be executed in counterparts (including by electronic signature), each of which shall be deemed an original and all of which together constitute one agreement.