HEROIC Enterprise Software Customer Terms of Service and End-User License Agreement

Last Updated: May 8th, 2025

This HEROIC Enterprise Customer Terms of Service and End-User License Agreement (the “Agreement”) is a legally binding contract between HEROIC Holdings, LLC (“HEROIC,” “we,” “us,” or “our”) and the entity or person (“Customer,” “you,” or “your”) who accesses or uses HEROIC’s proprietary cybersecurity services and software products. By using HEROIC’s services, you agree to the terms outlined in this Agreement.

1. Definitions

(a) “Service” means HEROIC’s proprietary platform(s), APIs, software, breach detection tools, datasets, and related cybersecurity services provided to Customer under this Agreement.

(b) “End User” means any individual authorized by Customer to use the Service on Customer’s behalf (e.g. Customer’s employees or contractors).

(c) “Credentials” means authentication materials such as usernames, passwords, API keys, and other access credentials for the Service.

(d) “Customer Data” means any information or data submitted, stored, or transmitted by Customer (or its End Users) via the Service, including personal data.

(e) “Output Data” means any reports, alerts, search results, analytics, or other content or information generated by or obtained from the Service.

(f) “Confidential Information” means all non-public, proprietary, or sensitive business, technical, financial, or security information disclosed by one party to the other in connection with this Agreement. Confidential Information does not include information that is (i) publicly available without breach of this Agreement, (ii) independently developed without use of the other party’s Confidential Information, or (iii) rightfully obtained from a third party without confidentiality obligation.

(g) “Order Form” means any written or electronic order document (including online registration or purchase flow) that is executed or accepted by Customer and HEROIC and specifies the Service, subscription term, fees, and any additional terms.

2. License Grant and Restrictions

(a) License Grant: Subject to the terms of this Agreement and the applicable Order Form, HEROIC grants Customer a limited, non-exclusive, non-transferable, non-sublicensable license to access and use the Service during the agreed subscription term. Use of the Service is limited to the scope and purpose set forth in this Agreement and any Order Form or documentation provided by HEROIC.

(b) License Restrictions: Customer shall not (and shall not permit any third party to):

(i) Resell or Sublicense: Resell, distribute, license, or sublicense the Service or provide access to the Service to any third party (except End Users authorized under this Agreement) without HEROIC’s express written permission.

(ii) Reverse Engineering: Reverse-engineer, decompile, disassemble, or otherwise attempt to derive source code or underlying ideas or algorithms of any part of the Service, except to the limited extent allowed by applicable law (and then only with prior written notice to HEROIC).

(iii) Derivative Works: Modify, adapt, or create derivative works based on the Service or any part of it.

(iv) Unauthorized Areas: Access or attempt to access any systems, networks, or data of HEROIC or its other customers that you are not expressly authorized to access, or use the Service to probe, scan, or test the vulnerability of any system or network without proper authorization.

(v) Competitive Use: Use the Service to build, develop, or enhance any competing product or service, or otherwise use the Service or Output Data for competitive analysis or benchmarking except as expressly permitted by HEROIC in writing.

(vi) Violation of Laws: Use the Service in violation of any applicable law or regulation, including export control laws or data privacy laws (additional specific compliance obligations are set forth in this Agreement’s Export Compliance section).

(c) Trial Use: If an Order Form or HEROIC provides Customer with trial, evaluation, or beta access to the Service, Customer may use the Service only for evaluating the Service’s suitability for Customer’s internal purposes during the trial period. Any Output Data or results generated during such trial or evaluation period are provided “as is” for evaluation only, not for production or commercial use. Customer agrees not to copy, disclose, distribute, or otherwise use any Output Data generated from the trial version for commercial purposes, resale, or public disclosure without HEROIC’s prior written consent. HEROIC reserves the right to terminate any trial access at any time.

(d) Reservation of Rights: Except for the limited rights expressly granted above, all rights, title, and interest in and to the Service and HEROIC’s technology are reserved by HEROIC. No rights are granted by implication or otherwise.

3. Customer Responsibilities

(a) Account Security: Customer is responsible for maintaining the confidentiality and security of its Credentials and account. Customer shall ensure that all Credentials (for itself and for End Users) are kept secure and not shared outside of authorized personnel. Customer must notify HEROIC immediately of any suspected unauthorized access to or use of its account or Credentials.

(b) Acceptable Use and Policies: Customer must use the Service only in accordance with this Agreement, HEROIC’s published usage policies, documentation, and all applicable laws. Customer is responsible for its End Users’ compliance with the terms of this Agreement. Customer shall not permit any End User or other party to use the Service in a manner that violates the Acceptable Use Policy set forth in this Agreement. HEROIC may issue updated usage guidelines or policies from time to time, and Customer agrees to adhere to the then-current policies.

(c) Required Consents: Customer represents and warrants that it has obtained and will maintain all necessary rights, consents, and permissions to provide Customer Data to HEROIC and to allow HEROIC to process, store, and transmit Customer Data in the course of providing the Service.

Customer shall ensure that its use of the Service (including HEROIC’s processing of Customer Data) does not violate any applicable law or infringe any rights of others.

(d) End User Management: Customer is responsible for managing its End Users’ access to the Service. This includes promptly removing access for individuals who are no longer authorized (e.g. upon termination of employment or contract), and ensuring that each End User uses the Service in compliance with this Agreement.

(e) Credential Revocation: Customer agrees to manage all usernames and passwords issued for use of the Service and shall promptly notify HEROIC to deactivate any credentials that are compromised, unused, or no longer appropriate.

4. Acceptable Use Policy

To protect the integrity of the Service and ensure lawful use, Customer agrees that neither it nor any End User will misuse the Service. Prohibited uses of the Service include, but are not limited to, the following:

(a) Illegal Purposes: Using the Service for any unlawful purpose or in furtherance of any activity that violates any law, regulation, or the rights of others. This includes, without limitation, using the Service to engage in fraud, theft, piracy, or any activity that would constitute a criminal offense or give rise to civil liability.

(b) Unauthorized Access and Interference: Attempting to gain unauthorized access to any portion of the Service or any other systems or networks through the Service. You may not interfere with or disrupt the integrity or performance of the Service or the data contained therein. Prohibited activities include distributing malware or viruses, launching denial-of-service attacks, or using the Service to attempt to probe or test vulnerabilities of any system (except in the course of bona fide security testing of your own assets and with prior notice to HEROIC).

(c) Automated Scraping or Data Mining: Engaging in any form of data scraping, data extraction, crawling, or harvesting of data from the Service, whether by bots, spiders, scripts, or any automated technology, except as explicitly allowed through HEROIC’s provided APIs and in accordance with HEROIC’s API usage guidelines. Excessively querying the Service or using automated means to collect information (including Output Data) in a manner that imposes undue burden or violates rate limits is expressly prohibited.

(d) Impersonation and Fraudulent Activity: Impersonating any person or entity or misrepresenting your identity or affiliation when using the Service. You shall not mask your usage or pretend to be another user or HEROIC representative to gain information or access. The Service may not be used in any manner to facilitate phishing, pretexting, or other fraudulent schemes.

(e) Misuse of Data and Privacy Violations: Using the Service to collect, store, or transmit any information in violation of privacy rights or data protection laws. You may not misuse any data obtained through the Service, including personal information, for any purpose other than your internal security operations. Any use of Output Data must comply with applicable laws and not violate any individual’s privacy or proprietary rights. For example, using Output Data to unlawfully monitor or target individuals (especially based on sensitive characteristics such as race, religion, sexual orientation, etc.) is strictly prohibited.

(f) Harassment or Harm: Using the Service to threaten, harass, or stalk any person, or to promote violence or harm. The Service must not be used to facilitate activities that could damage property, cause physical injury, or interfere with someone’s safety or well-being.

(g) Obscene or Offensive Use: Using the Service to access, store, or distribute material that is obscene, pornographic, defamatory, or otherwise offensive (except as reasonably required for cybersecurity analysis, such as analyzing malware that contains such content). Even in such cases, Customer should handle any offensive content in accordance with applicable law and ethical guidelines.

(h) Intellectual Property Infringement: Using the Service in a manner that infringes or misappropriates the intellectual property rights of HEROIC or any third party. You shall not use the Service to upload or distribute content that you do not have rights to, or to violate copyrights, trademarks, or trade secrets. Likewise, you may not use any information from the Service to facilitate the violation of a third party’s intellectual property or proprietary rights.

(i) Prohibited Data Types: Unless expressly permitted by HEROIC in writing, not to use the Service to store or transmit certain types of sensitive data that may impose specific legal or regulatory obligations on HEROIC (such as protected health information under HIPAA, cardholder data under PCI DSS, or similarly regulated data). If any such data is incidentally contained in Customer Data, Customer is solely responsible for compliance with all related regulations.

(j) AI/Machine Learning Training: Using the Service or Output Data to train or develop any artificial intelligence (AI), machine learning model, or similar algorithm is prohibited without HEROIC’s prior written consent. This means you may not feed data derived from the Service (including threat intelligence data, breach data, reports, or any Output Data) into any automated system for the purpose of improving that system’s algorithm, if doing so involves disclosing HEROIC’s data to the system or a third party.

(k) Benchmark Testing and Disclosure: Publishing, performing, or disclosing to third parties any benchmark tests or analysis of the Service without HEROIC’s prior written approval is prohibited. You may not use the Service or Output Data for competitive analysis or product comparison in a public manner. Any evaluations for internal purposes must be kept confidential and not shared in a way that could harm HEROIC’s interests.

(l) Other Misuses: Engaging in any other activity that HEROIC deems inconsistent with the intended use of the Service. HEROIC reserves the right to update this Acceptable Use Policy, and Customer agrees to abide by the updated policy upon notice.

(m) Enforcement: HEROIC may monitor usage of the Service for compliance (while respecting Customer’s confidentiality). If HEROIC reasonably determines that Customer or its End Users have violated this Acceptable Use Policy, HEROIC may suspend or limit the Service (consistent with the “Term and Termination” section of this Agreement) and/or require corrective action as a condition of continued use. Customer shall cooperate with any reasonable investigation by HEROIC of any suspected violation of this section.

5. Fees and Payment

(a) Fees: Customer agrees to pay the fees for the Service as specified in the applicable Order Form or other ordering documents. Fees are typically billed in advance (e.g. annually or as otherwise stated). Invoices are due and payable on the first day of each subscription period (unless a different schedule is set forth in the Order Form). All payments shall be made in the currency stated on the Order Form and are non-refundable except as expressly provided in this Agreement.

(b) Late Payments: Any undisputed fee not paid when due shall accrue interest at the rate of 1.5% per month (or the highest rate allowed by law, if lower), from the date such payment was due until the date paid. In addition, if Customer’s payment is more than thirty (30) days past due, HEROIC reserves the right to suspend access to the Service until payment is brought current, after providing notice to Customer. Customer shall be responsible for HEROIC’s reasonable costs of collection of overdue amounts, including attorneys’ fees.

(c) Taxes: All fees are exclusive of any sales, use, value-added, withholding, or similar taxes or duties. Customer is responsible for all applicable taxes and duties (excluding taxes based on HEROIC’s net income). If Customer is tax-exempt or entitled to direct pay, Customer must provide HEROIC with a valid tax-exemption certificate or other required documentation. HEROIC will not charge tax if a valid certificate is provided, but Customer shall indemnify HEROIC for any taxes (and related costs and penalties) that any taxing authority requires HEROIC to pay on Customer’s behalf.

(d) Billing Disputes: Customer must notify HEROIC in writing of any dispute or discrepancy in invoiced amounts within thirty (30) days of the invoice date, and the parties will work in good faith to resolve the dispute. Amounts not disputed within this time are deemed accepted. For any disputed amounts, Customer will pay all non-disputed amounts by the due date.

6. Intellectual Property

(a) HEROIC Ownership: HEROIC (and its licensors, if applicable) retain all right, title, and interest in and to the Service and all associated intellectual property, including but not limited to the software, technology, algorithms, databases, know-how, trademarks, logos, and any enhancements or modifications to the foregoing. Customer acknowledges that the Service (including any copies of software or materials) is licensed, not sold, and that no ownership rights are conveyed to Customer under this Agreement or otherwise.

(b) Customer Ownership: As between the parties, Customer retains all right, title, and interest in and to Customer Data. HEROIC does not claim ownership of Customer Data. Customer grants HEROIC a limited license to host, use, process, display, and transmit Customer Data solely as necessary to provide the Service to Customer and to fulfill HEROIC’s obligations under this Agreement. This license to Customer Data also extends to any subcontractors or subprocessors assisting HEROIC in providing the Service, but always subject to the same use restrictions.

(c) Anonymized Data: Customer agrees that HEROIC may collect and derive from Customer’s use of the Service certain data and information that may include portions of Customer Data, usage statistics, performance metrics, and other analytics. Any such data will be de-identified and aggregated so that neither Customer nor any individual can be identified (“Anonymized Data”). HEROIC retains all rights to Anonymized Data and may use it for lawful purposes such as improving the Service, developing new features, compiling statistical reports, and benchmarking performance. HEROIC will not publicly disclose any information that identifies Customer as the source of any Anonymized Data without Customer’s prior consent.

(d) Feedback: If Customer or any of its End Users provides HEROIC with any suggestions, ideas, enhancement requests, recommendations, or other feedback related to the Service or HEROIC’s products (“Feedback”), Customer grants HEROIC a worldwide, perpetual, irrevocable, sublicensable, royalty-free license to use and incorporate such Feedback in HEROIC’s products and services. HEROIC may utilize Feedback without any obligation of attribution or compensation to Customer or the End User providing the Feedback. Feedback is provided entirely voluntarily. Customer warrants that it has the right to provide the Feedback and that such Feedback does not include confidential or proprietary information of Customer or any third party.

7. Confidentiality

(a) Protection of Confidential Information: Each party (the “Receiving Party”) may have access to Confidential Information of the other party (the “Disclosing Party”) in connection with this Agreement. The Receiving Party shall: (i) use the Disclosing Party’s Confidential Information only for the purpose of fulfilling its obligations or exercising its rights under this Agreement; and (ii) protect the Disclosing Party’s Confidential Information from unauthorized use, access, or disclosure with at least the same degree of care it uses to protect its own confidential information of a similar nature, and no less than reasonable care. The Receiving Party shall limit access to the Disclosing Party’s Confidential Information to those of its employees, contractors, and advisors who need such access for purposes consistent with this Agreement and who are bound by confidentiality obligations at least as protective as those herein.

(b) Permitted Disclosures: The Receiving Party may disclose Confidential Information of the Disclosing Party if and to the extent required by law or court order, provided that (to the extent permitted) the Receiving Party gives prompt notice to the Disclosing Party to enable it to seek a protective order or otherwise prevent or limit such disclosure. If disclosure is ultimately required, the Receiving Party will disclose only that portion of Confidential Information legally required and will use reasonable efforts to ensure the information remains confidential.

(c) Exclusions: Confidential Information does not include information that the Receiving Party can demonstrate: (i) is or becomes generally publicly available through no fault of the Receiving Party; (ii) was known to the Receiving Party, free of any confidentiality obligations, before receipt from the Disclosing Party; (iii) is independently developed by the Receiving Party without use of or reference to the Disclosing Party’s Confidential Information; or (iv) is rightfully obtained by the Receiving Party from a third party that, to the Receiving Party’s knowledge, is not bound by a confidentiality obligation to the Disclosing Party.

(d) Return or Destruction: Upon written request by the Disclosing Party, and in any event upon termination of this Agreement, the Receiving Party will return or destroy (at the Disclosing Party’s election) all Confidential Information of the Disclosing Party in its possession or control and cease any further use. Notwithstanding the foregoing, the Receiving Party may retain copies of Confidential Information as required by law or for routine backup and archival purposes, provided that any retained information remains subject to the confidentiality obligations of this Agreement.

(e) Publicity and Branding: Notwithstanding the above, Customer agrees that HEROIC may disclose Customer’s name and logo as a customer of HEROIC for marketing and promotional purposes (such as on HEROIC’s website or sales presentations), HEROIC’s use of Customer’s name and logo will be in accordance with any branding guidelines provided by Customer and will not imply endorsement of HEROIC’s services beyond Customer’s actual use.

8. Data Privacy and Security

(a) HEROIC’s Security Measures: HEROIC will implement and maintain industry-standard security measures designed to protect Customer Data from unauthorized access, alteration, disclosure, or destruction. Such measures will include administrative, physical, and technical safeguards commercially reasonable for a cybersecurity service. HEROIC regularly monitors its systems for possible vulnerabilities and attacks and will promptly address any security incidents that may affect Customer Data, in accordance with applicable law and any separate data processing agreement (e.g., a Data Processing Addendum “DPA”, if applicable between the parties).

(b) Data Processing and Privacy: To the extent HEROIC processes any personal data on Customer’s behalf in performing the Service, the parties may enter into a DPA reflecting their respective rights and obligations under applicable data protection laws (such as GDPR, CCPA, etc.). In the absence of a separate DPA, HEROIC will only process personal data as needed to provide the Service and will not use or disclose personal data for purposes other than providing the Service, improving it, or as required by law.

(c) Customer’s Security Obligations: Customer is solely responsible for the data it chooses to submit to the Service. Customer shall not upload or transmit any Customer Data that contains malicious code or viruses. Customer shall secure any access it has to the Service (including protecting its Credentials) and follow industry best practices for cybersecurity in its own networks that interact with the Service.

(d) Incident Notification: In the event either party discovers a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data stored or transmitted by the Service (a “Data Breach”), that party will promptly notify the other. HEROIC’s notice will include, to the extent known, a description of the Data Breach, the type of data involved, and steps being taken to investigate and mitigate the issue. HEROIC will cooperate with Customer’s reasonable requests for further information regarding the Data Breach and take appropriate corrective action.

(e) Data Backups: Customer acknowledges that, unless otherwise expressly agreed, the Service is not intended to serve as the sole repository for Customer Data. Customer is responsible for maintaining its own backups of important Customer Data. HEROIC is not liable for restoration of lost Customer Data except to the extent caused by HEROIC’s breach of its security obligations.

9. Service Levels and Uptime Guarantees

(a) Service Levels. HEROIC may offer service level commitments (each, an “SLA”) related to uptime, availability, or support response times for certain paid subscription plans or custom engagements. Such SLAs, if applicable, will be detailed in the applicable Order Form or Statement of Work (SOW) and are subject to the conditions and remedies described therein.

(b) No Implied Guarantees. Unless expressly stated in a separate SLA or SOW, HEROIC makes no guarantee as to the availability or performance of the Service and disclaims all liability for unavailability, outages, or delays.

10. Professional Services

If HEROIC provides consulting, integration, or implementation services (“Professional Services”), such services will be governed by a separate Statement of Work (“SOW”) agreed to by the parties. Each SOW will outline the scope, timeline, deliverables, responsibilities, and applicable fees. HEROIC will perform Professional Services in a professional and workmanlike manner using qualified personnel.

11. Export Control & Sanctions Compliance

Customer must use the Service in compliance with all applicable export control and economic sanctions laws and regulations, including those of the United States. Without limiting the generality of the foregoing, Customer represents, warrants, and agrees to the following:

(a) Export Laws: Customer shall not export, re-export, release, or transfer any part of the Service or any related technology or data, except in full compliance with U.S. export control laws, including the U.S. Export Administration Regulations (EAR) and any applicable international or national regulations. Customer also agrees to comply with any applicable restrictions on the export or transfer of sensitive personal data, including those enacted under U.S. Executive Order 14117 (which addresses preventing access to U.S. sensitive personal data by foreign adversaries) and its implementing regulations.

(b) Sanctioned Parties and Regions: Customer is not located in, organized under the laws of, or ordinarily resident in any country or region that is subject to comprehensive U.S. embargoes or sanctions (including, for example, Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine) and will not allow any person from such regions to access or use the Service. Customer further certifies that neither Customer nor any of its owners or authorized users is listed on any U.S. government list of prohibited or restricted parties (such as the Specially Designated Nationals list maintained by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC), or the Entity List or Denied Persons List maintained by the U.S. Commerce Department). Customer shall not permit the Service to be used by any entity or individual subject to U.S. sanctions.

(c) Service Location and Usage: Customer shall not use, transfer, or allow access to the Service in any manner that would cause HEROIC to be in violation of U.S. export or sanctions laws. This includes, but is not limited to, prohibiting any access to the Service from the territories or by the persons described in subsection (b) above. Customer is responsible for notifying HEROIC immediately if at any time Customer’s representations in this section are no longer accurate.

(d) Indemnity for Compliance: Customer shall indemnify and hold HEROIC harmless from any fines, penalties, or liabilities incurred by HEROIC as a result of Customer’s violation of this Export Control & Sanctions Compliance section. HEROIC may terminate this Agreement immediately upon written notice if it determines, in its reasonable judgment, that continued performance of this Agreement would violate any export control or sanctions laws.

12. Term and Termination

(a) Term: This Agreement commences on the effective date specified in the first Order Form between the parties (or, if no Order Form, on the date Customer first accesses the Service) and will remain in effect for the duration of the subscription term specified. If Customer purchases a subscription for a fixed term (e.g. one year), this Agreement will automatically renew for successive renewal terms equal in length to the initial term unless either party gives the other written notice of non-renewal at least sixty (60) days before the then-current term ends or unless otherwise specified in the Order Form.

(b) Suspension of Service: HEROIC may suspend Customer’s access to the Service or any portion thereof immediately and with or without notice (i) if payment is delinquent beyond the applicable cure period, (ii) if Customer’s use of the Service poses a security risk to the Service or any other HEROIC customers, or may adversely impact the Service’s functionality or the data of other customers, (iii) if Customer or its End Users are in breach of the Acceptable Use Policy or other material terms of this Agreement, (iv) if HEROIC identifies an Emergency Security Issue that poses a risk to the availability, security, or integrity of the Service, or (v) if required by law or at the request of government authorities. HEROIC will make a good-faith effort to provide notice and an opportunity to remedy the issue prior to suspension when practicable, but may suspend immediately if the circumstances require. Suspension of the Service shall not constitute a termination of this Agreement and HEROIC may restore Customer’s access once the cause of suspension is resolved.

(c) Termination for Cause: Either party may terminate this Agreement (including any or all Order Forms) for cause upon thirty (30) days’ written notice to the other party of a material breach, if such breach remains uncured at the expiration of the 30-day cure period. For clarity, any failure by Customer to timely pay fees due that is not cured within thirty (30) days after written notice from HEROIC shall constitute a material breach for which HEROIC may terminate this Agreement immediately at the end of the cure period. Additionally, HEROIC may terminate this Agreement immediately upon written notice to Customer if Customer becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, or liquidation that is not dismissed within sixty (60) days.

(d) Effect of Termination: Upon any expiration or termination of this Agreement: (i) Customer’s rights to access and use the Service will immediately cease, and Customer shall promptly discontinue all use of the Service; (ii) within thirty (30) days after termination, each party shall return or destroy (at the other party’s election) all Confidential Information of the other party in its possession as provided in the Confidentiality section of this Agreement; and (iii) if requested by Customer within thirty (30) days of termination, HEROIC will make Customer Data available for export or download by Customer in a commonly used format. After such 30-day period, HEROIC may, without liability, delete or destroy any Customer Data in its systems, unless legally prohibited.

(e) Surviving Provisions: Any provision of this Agreement that by its nature should survive termination or expiration shall survive, including but not limited to: Fees and Payment (to the extent of accrued fees), Intellectual Property, Feedback, Confidentiality, Export Compliance, Disclaimers, Limitation of Liability, Indemnification, Non-Solicitation, and Miscellaneous.

13. Warranties and Disclaimers

(a) Authority and Ownership Warranty: Each party represents and warrants that it has the full power and authority to enter into this Agreement and to perform its obligations. Customer further represents that it has the necessary rights to provide the Customer Data to HEROIC and that use of Customer Data by HEROIC for the purposes of this Agreement will not violate any law or infringe any rights of third parties.

(b) Service Performance: HEROIC warrants that during any paid subscription term, the Service will perform in all material respects as described in the applicable documentation or specifications provided to Customer. Customer’s sole and exclusive remedy, and HEROIC’s sole liability, for a breach of this warranty will be for HEROIC to use commercially reasonable efforts to correct the reported non-conformity.

(c) Malware Disclaimer: Customer acknowledges that, in the course of providing cybersecurity services (such as breach detection or threat intelligence), the Service may involve processing or transmission of malicious code, suspicious files, or threat data. HEROIC will take standard precautions to prevent harm to Customer’s systems, but Customer is responsible for ensuring that its use of the Service is conducted securely (for example, using secure environments to download or analyze any suspicious files provided through the Service).

(d) General Disclaimer: Except as expressly provided in this Agreement, the Service is provided on an “AS IS” and “AS AVAILABLE” basis. HEROIC MAKES NO OTHER WARRANTIES of any kind, whether express, implied, statutory or otherwise, and specifically disclaims all implied warranties, including any warranties of merchantability, fitness for a particular purpose, title, non-infringement, or that the Service will be uninterrupted or error-free. No advice or information, whether oral or written, obtained from HEROIC or elsewhere, will create any warranty not expressly stated in this Agreement.

(e) Beta and Trial Features: From time to time, HEROIC may offer new or beta features or services (“Beta Features”) for Customer’s trial or evaluation. Use of Beta Features is at Customer’s option and risk. Beta Features are provided “as-is” and without any warranties whatsoever, and may be subject to additional terms. HEROIC makes no promises that Beta Features will be continued or made generally available.

14. Indemnification

(a) HEROIC’s Indemnity: HEROIC shall defend Customer and its officers, directors, and employees (collectively, the “Customer Indemnitees”) against any claim, demand, suit, or proceeding made or brought by a third party alleging that Customer’s use of the Service in accordance with this Agreement infringes or misappropriates such third party’s intellectual property rights (each, an “IP Claim”). HEROIC will indemnify and hold harmless Customer Indemnitees against any damages, attorney fees, and costs finally awarded against them as a result of, or for amounts paid by them under a court-approved settlement of, an IP Claim, provided that Customer (i) promptly notifies HEROIC in writing of the IP Claim (and in any event notice must be given in time for HEROIC’s defense not to be materially prejudiced); (ii) gives HEROIC sole control of the defense and settlement of the IP Claim (except that HEROIC may not settle any IP Claim without Customer’s consent unless it unconditionally releases Customer of all liability); and (iii) provides to HEROIC, at HEROIC’s cost, all reasonable assistance in the defense of the IP Claim. This Section represents Customer’s exclusive remedy and HEROIC’s sole liability for any third-party intellectual property claims.

If the Service becomes, or in HEROIC’s opinion is likely to become, the subject of an IP Claim, HEROIC may, at its option and expense, either: (1) obtain the right for Customer to continue using the Service as permitted in this Agreement; (2) modify the Service so that it becomes non-infringing without material loss of functionality; or (3) if the above options are not feasible, terminate Customer’s subscription to the Service and refund Customer a pro-rata portion of any prepaid fees for the terminated portion of the subscription term. HEROIC shall have no liability for any IP Claim to the extent that the claim arises from Customer’s breach of this Agreement, Customer Data, or any use of the Service in combination with software, hardware, or data not provided by HEROIC if the Service would not be infringing without such combination.

(b) Customer’s Indemnity: Customer shall defend HEROIC and its officers, directors, employees, and agents (collectively, the “HEROIC Indemnitees”) against any claim, demand, suit, or proceeding made or brought by a third party arising out of or related to: (i) Customer Data (including any claim that Customer Data, or HEROIC’s use thereof as permitted under this Agreement, infringes or violates the rights of a third party or violates any law); (ii) Customer’s use of the Service in violation of this Agreement or applicable law (including any breach of the Acceptable Use Policy or unauthorized use of the Service); or (iii) Customer’s business or services (for example, any security breach or incident caused by Customer’s failure to appropriately secure its systems, or any dispute between Customer and a third party that is not caused by HEROIC). Customer will indemnify and hold harmless the HEROIC Indemnitees against any damages, losses, and costs (including reasonable attorneys’ fees) finally awarded against them as a result of, or for amounts paid by them under a settlement approved by Customer, for such claims, provided that HEROIC (i) promptly notifies Customer in writing of the claim; (ii) gives Customer sole control of the defense and settlement of the claim (Customer may not settle any claim without HEROIC’s consent unless it unconditionally releases HEROIC of all liability); and (iii) provides to Customer, at Customer’s cost, all reasonable assistance.

(c) Exclusions: A party’s indemnification obligations will not apply to the extent the underlying claim arises from the indemnified party’s breach of this Agreement or negligence or willful misconduct.

(d) Additional Terms: The indemnifying party’s obligations under this section are contingent on the indemnified party complying with the conditions of defense and cooperation stated above. An indemnifying party shall not be liable for any settlement it does not approve in writing.

15. Limitation of Liability

(a) Types of Damages: To the fullest extent permitted by law, in no event will either party be liable to the other party (or to any third party claiming through the other party) for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, data, or business interruption, arising out of or related to this Agreement or the use of or inability to use the Service, regardless of the theory of liability (contract, tort, or otherwise), and even if the liable party has been advised of the possibility of such damages or if a remedy fails of its essential purpose.

(b) Liability Cap: Except for the specific liabilities excluded below, each party’s aggregate liability arising out of or related to this Agreement shall not exceed the total amount of fees paid or payable by Customer to HEROIC for the Service in the twelve (12) months immediately preceding the event giving rise to the liability. If no fees were paid (for example, during a free trial), HEROIC’s liability shall not exceed $100.

(c) Excluded Claims: Notwithstanding the foregoing, nothing in this Agreement shall limit or exclude either party’s liability for: (i) death or bodily injury or tangible personal property damage caused by its gross negligence or willful misconduct; (ii) its infringement or misappropriation of the other party’s intellectual property rights; (iii) Customer’s payment obligations for the Service; or (iv) matters for which liability cannot be limited or excluded under applicable law.

(d) Independent Allocations of Risk: Each provision of this Agreement that provides for a limitation of liability, disclaimer of warranties, or exclusion of damages is intended to allocate the risks between the parties under this Agreement. This allocation is reflected in the pricing offered by HEROIC and is an essential element of the basis of the bargain between the parties. Each of these provisions is severable and independent of all other provisions of this Agreement, and will apply even if any limited remedy fails of its essential purpose.

16. Miscellaneous

(a) Governing Law: This Agreement is governed by and shall be construed in accordance with the laws of the State of Utah, USA, without regard to its conflict of law principles.

(b) Dispute Resolution: The parties agree to make a good faith effort to resolve any disputes, controversies, or claims arising under this Agreement through informal negotiations before initiating any legal proceedings. If the dispute cannot be resolved within thirty (30) days, either party may proceed with formal resolution in accordance with the Governing Law and Jurisdiction provisions herein.

(c) Jurisdiction and Venue: The parties agree that any disputes or claims arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the state and federal courts located in Utah County, Utah. Each party hereby waives any objection to personal jurisdiction or venue in such courts, including any claim that an action has been brought in an inconvenient forum. Notwithstanding the foregoing, HEROIC may seek injunctive or other equitable relief in any court of competent jurisdiction to address an unauthorized use or disclosure of HEROIC’s intellectual property or Confidential Information.

(d) Force Majeure: Neither party shall be liable for any delay or failure in performance of its obligations (except for payment obligations) if such delay or failure is caused by events or circumstances beyond its reasonable control (“Force Majeure Events”). Force Majeure Events include, but are not limited to: acts of God (such as earthquakes, hurricanes, floods, or other natural disasters); fire or explosion; epidemics or pandemics; acts of government (such as war, invasion, riot, or embargo; government orders or regulations; or actions by civil or military authorities); national or regional emergencies; strikes, labor disputes, or shortages; power failures or utility interruptions; telecommunications or Internet outages; or cyberattacks or third-party network intrusions that could not be prevented by reasonable security measures. The party affected by a Force Majeure Event shall give prompt notice to the other party with details of the event and an estimation of the impact on its performance. The obligations of the affected party will be suspended to the extent made necessary by the event, and the affected party shall use reasonable efforts to mitigate the effects of the Force Majeure Event and resume full performance as soon as practicable. If a Force Majeure Event continues for an extended period (e.g., more than 30 days), either party may have the right to terminate the Agreement upon written notice, without further liability, provided that Customer will pay for any Services provided up to the date of termination.

(e) Non-solicitation: During the term of this Agreement and for twelve (12) months following its termination or expiration, Customer agrees that it will not, without HEROIC’s prior written consent, directly or indirectly solicit for employment or hire any employee or contractor of HEROIC who had material contact with Customer in connection with the performance of this Agreement. This restriction does not apply to general solicitations for employment not specifically targeted at HEROIC employees (such as advertisements or job listings to the public), provided that no proactive targeting of HEROIC personnel occurs. If Customer breaches this section and hires a covered HEROIC employee, Customer agrees that HEROIC shall be entitled to, in addition to any other remedies, payment of an amount equal to twelve (12) months of that employee’s total compensation as liquidated damages (the parties acknowledge that actual damages would be difficult to determine and this amount represents a fair estimate of the loss). This Non-Solicitation clause is not intended to prohibit or restrict employment mobility rights under applicable law, but rather to protect the investment each party makes in its personnel.

(f) Entire Agreement: This Agreement, including all Order Forms and any referenced attachments (such as a Data Processing Addendum), constitutes the entire agreement between HEROIC and Customer regarding the Service and supersedes all prior or contemporaneous agreements, understandings, and communications, whether written or oral, relating to its subject matter. In the event of any conflict between the terms of this Agreement and an Order Form, the Order Form shall control for that order, but only for the specific Services and term stated therein.

(g) Amendments and Waivers: No modification, amendment, or waiver of any provision of this Agreement will be effective unless it is in writing and signed by an authorized representative of each party. However, HEROIC may update the Acceptable Use Policy or other general policies from time to time as needed to reflect evolving legal requirements or service usage (such updates will be effective upon posting to HEROIC’s website or otherwise notifying Customer, and are incorporated herein by reference). The failure of either party to enforce any provision of this Agreement will not constitute a waiver of future enforcement of that or any other provision.

(h) Limitation on Claims: To the extent permitted by law, any claim or cause of action arising out of or related to this Agreement or the use of the Service must be filed within one (1) year after the date on which the claim first could be filed (for example, when the event giving rise to the claim occurred), or else be forever barred. This section does not apply to claims for non-payment or claims for indemnification.

(i) Assignment: Customer may not assign or transfer this Agreement, in whole or in part, whether by law or otherwise (including through a merger or change of control), without HEROIC’s prior written consent, and any attempted assignment without such consent will be null and void. Any permitted assignee shall assume all obligations of its assignor under this Agreement. HEROIC may assign this Agreement in its discretion in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Subject to the foregoing, this Agreement will bind and benefit the parties and their respective successors and permitted assigns.

(j) Severability: If any provision of this Agreement is held by a court of competent jurisdiction to be invalid, illegal, or unenforceable, that provision shall be enforced to the maximum extent permissible and the remaining provisions of this Agreement will remain in full force and effect. The parties will negotiate in good faith a valid and enforceable provision that most nearly reflects the original intent of the unenforceable provision.

(k) No Agency: The parties are independent contractors, and nothing in this Agreement shall be construed to create a partnership, joint venture, franchise, or agency relationship between the parties. Neither party has any authority to act on behalf of or bind the other in any manner.

(l) Notices: All legal notices or communications required or permitted under this Agreement shall be in writing and shall be delivered to the addresses specified on the Order Form (or if no Order Form, to the principal business address of the respective party) or to such other address as may be designated by a party in writing. Notices shall be deemed given: (i) when delivered personally; (ii) when sent by electronic mail to the email address specified by the receiving party (with confirmation of transmission); (iii) one business day after being sent by reputable overnight courier; or (iv) three business days after being sent by U.S. certified mail, return receipt requested. Notices to HEROIC should be sent to: (with a physical copy to HEROIC’s corporate address if requested).

(m) No Third-Party Beneficiaries: There are no third-party beneficiaries to this Agreement; this Agreement is intended solely for the benefit of the parties and their permitted successors and assigns.

(n) Headings: Section headings in this Agreement are for convenience only and have no legal or contractual effect.

(o) Counterparts and Electronic Signatures: If this Agreement (or any Order Form) is signed, it may be executed in counterparts, which together will constitute one instrument. Signatures delivered electronically (by PDF, email, or via an electronic signature service) shall be considered binding and equivalent to original signatures.

Contact Information: If you have any questions about this Agreement or need to contact HEROIC for any reason, please email or call our headquarters at the number listed on our website. We value our relationship with you and are happy to discuss any questions or concerns regarding these terms.

By using the Service or signing an Order Form, you, the Customer, acknowledge that you have read this Agreement, understand it, and agree to be bound by its terms.