ChaosTrack End User License Agreement

Important — Read Carefully

THIS END USER LICENSE AGREEMENT ("EULA") GOVERNS ACCESS TO AND USE OF THE CHAOSTRACK PLATFORM. IT IS A BINDING LEGAL AGREEMENT BETWEEN YOU AND CHAOSTRACK, INC., A DELAWARE CORPORATION LOCATED AT 4150 ORCHARD CT, PALO ALTO, CA 94306 ("CHAOSTRACK," "WE," OR "US").

THE CHAOSTRACK PLATFORM IS A HOSTED, BROWSER-BASED SERVICE. NO SOFTWARE IS INSTALLED, DEPLOYED, OR EXECUTED ON CUSTOMER'S SYSTEMS, AND THE PLATFORM TAKES NO ACTION WITHIN CUSTOMER'S ENVIRONMENT. THIS EULA GRANTS A RIGHT OF ACCESS TO THAT HOSTED SERVICE.

THIS EULA FORMS PART OF THE CHAOSTRACK MASTER SERVICES AGREEMENT AT HTTPS://CHAOSTRACK.COM/TERMS-OF-SERVICE (THE "MSA"), WHICH GOVERNS OWNERSHIP, CONFIDENTIALITY, DATA PROTECTION, WARRANTIES, INDEMNIFICATION, LIABILITY, TERM, AND FEES. SEE SECTION 9.

BY ACCESSING OR USING THE PLATFORM, BY CLICKING "I ACCEPT," OR BY EXECUTING AN ORDER FORM THAT REFERENCES THIS EULA, YOU AGREE TO BE BOUND BY ITS TERMS. IF YOU DO NOT AGREE, DO NOT ACCESS OR USE THE PLATFORM.

IF YOU ARE ENTERING INTO THIS EULA ON BEHALF OF A COMPANY, GOVERNMENT ENTITY, OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE AUTHORITY TO BIND THAT ENTITY. IN THAT CASE, "YOU" AND "CUSTOMER" REFER TO THAT ENTITY.

SECTION 5 SETS OUT RESTRICTIONS ON YOUR USE OF THE PLATFORM. SECTION 6 IMPOSES MANDATORY OBLIGATIONS BEFORE YOU MAY RUN ANY EXERCISE. SECTION 7 ADDRESSES ARTIFICIAL INTELLIGENCE.

1. Definitions

Capitalized terms used but not defined in this EULA have the meaning given in the MSA. The following terms are used throughout:

1.1 "Authorized User" means an employee, contractor, or agent of Customer or a Customer Affiliate whom Customer authorizes to access the Platform.

1.2 "Exercise" means a tabletop exercise, fire drill, scenario walkthrough, or other simulated security scenario created, scheduled, or conducted through the Platform.

1.3 "Generated Content" means scenarios, injects, simulated messages, reports, recommendations, summaries, and other output produced by the Platform's artificial intelligence features.

1.4 "Participant" means an individual who takes part in an Exercise, whether or not that individual is an Authorized User.

1.5 "Platform" means the ChaosTrack hosted, browser-based cybersecurity preparedness and tabletop exercise platform made available at chaostrack.com and associated subdomains.

1.6 "Restricted Information" means: protected health information regulated by HIPAA; financial account information regulated by the Gramm-Leach-Bliley Act; Social Security numbers, driver's license numbers, and other unique government identifiers; biometric information, including as defined by the Illinois Biometric Information Privacy Act; criminal justice information subject to the FBI CJIS Security Policy; and any other category of sensitive personal information designated under Data Protection Laws.

2. Relationship to the MSA

2.1 One Agreement. This EULA and the MSA are intended to be read together as a single agreement. The MSA governs the commercial and legal relationship between the Parties. This EULA governs the rights and restrictions applicable to accessing and using the Platform.

2.2 Precedence. In the event of conflict, the order of precedence in MSA Section 2.2 applies: a separately negotiated agreement, then the applicable Order Form, then the MSA, then this EULA, then the Privacy Policy.

2.3 No Conflict Intended. This EULA does not amend, limit, or expand any provision of the MSA. Where a subject is addressed in both, the MSA controls.

3. Grant of Access Rights

3.1 Right of Access. Subject to Customer's compliance with this EULA and the MSA, ChaosTrack grants Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Platform during the Subscription Term, solely for Customer's internal business purposes and only through Authorized Users.

3.2 Hosted Delivery; No Installation. The Platform is delivered exclusively as a hosted, browser-based service. ChaosTrack does not provide, and Customer is not required to install, any client software, agent, connector, plug-in, or other component on Customer's systems. The Platform does not execute code within Customer's environment, does not access Customer's endpoints or networks, and does not transmit content to Customer's production email, messaging, or security systems except through an integration Customer expressly enables under Section 8.

3.3 Documentation and Materials. Customer may reproduce a reasonable number of copies of the Documentation and Materials solely for internal use in connection with the Platform.

3.4 Reservation of Rights. No rights are granted other than those expressly stated. Access to the Platform is licensed, not sold. Ownership is governed by MSA Section 9.

4. Authorized Users and Account Security

4.1 User Limits. Customer may permit only the number and type of Authorized Users specified in the Order Form. Credentials may not be shared but may be reassigned when a prior user no longer requires access.

4.2 Responsibility. Customer is responsible for all activity under its account and for each Authorized User's and Participant's compliance with this EULA. Their acts and omissions are treated as those of Customer.

4.3 Security. Customer will maintain the confidentiality of all credentials, enable available authentication controls, and notify ChaosTrack promptly at security@chaostrack.com upon becoming aware of unauthorized access to or use of the Platform.

4.4 Age. The Platform is not directed to children. No person under 13 years of age may be an Authorized User or a Participant.

5. Acceptable Use Restrictions

Customer will not, and will not permit any Authorized User, Participant, or third party to:

• (a) copy, modify, translate, or create derivative works of the Platform, except as expressly permitted;
• (b) reverse engineer, decompile, or disassemble the Platform, or attempt to derive its source code, underlying models, model weights, prompts, or architecture, except to the limited extent this restriction is unenforceable under Applicable Laws;
• (c) rent, lease, lend, sell, sublicense, distribute, time-share, or provide access to the Platform as a service bureau or managed service to any third party, except as expressly authorized in an Order Form;
• (d) remove, alter, or obscure any proprietary notice, watermark, or attribution in the Platform, the Materials, or Generated Content;
• (e) access the Platform to build, train, or improve a competing product or service, to conduct competitive analysis, or to disclose performance or benchmark results without ChaosTrack's prior written consent;
• (f) use the Platform, or any Generated Content, to develop, deploy, or deliver actual malware, ransomware, exploits, or other malicious code, or to conduct any live penetration test, intrusion, denial-of-service attack, credential harvesting, or social engineering campaign against any person or system;
• (g) extract Generated Content from the Platform and deliver it to any individual outside the context of an authorized Exercise, or in any manner designed to deceive, defraud, harass, or cause harm;
• (h) conduct an Exercise involving any individual whom Customer lacks authority to include, or who is not an employee, contractor, or agent of Customer or of an entity that has authorized the Exercise in writing;
• (i) circumvent any usage limit, rate limit, access control, or technical protection measure;
• (j) submit to the Platform any material that infringes third-party rights or is unlawful, or any Restricted Information absent ChaosTrack's prior written agreement;
• (k) submit to the Platform any data that Customer is contractually or legally prohibited from disclosing to Third-Party AI Services or from transferring to or processing in the United States;
• (l) interfere with or disrupt the integrity or performance of the Platform, or attempt to gain unauthorized access to it, other than through a coordinated disclosure process ChaosTrack makes available; or
• (m) use the Platform in violation of Applicable Laws, including export control, sanctions, computer fraud, anti-hacking, wiretap, employment, and data protection laws.

Breach of this Section is a material breach of the MSA and may result in suspension or termination under MSA Section 6.3.

6. Exercise Authorization and Safeguards

Customer acknowledges that the Platform generates realistic, simulated security scenarios — including phishing, business email compromise, ransomware, insider threat, and supply chain compromise narratives — and that Generated Content is designed to read as genuine.

6.1 In-Platform Delivery. Exercises are conducted within the Platform. The Platform does not transmit simulated attack messages to Customer's live email, messaging, or production systems, and takes no action within Customer's environment.

6.2 Participant Authorization. Before initiating any Exercise, Customer represents and warrants that it has authority to require or invite each Participant's involvement, and has provided every notice and obtained every consent, approval, and authorization required by Applicable Laws, by contract, by works council or collective bargaining obligation, and by Customer's internal policies.

6.3 Employment and Labor Obligations. Customer is solely responsible for determining what disclosures to make to Participants regarding Exercises, for how Exercise results are recorded and used in relation to individual Participants, and for compliance with applicable employment, privacy, and labor laws. Requirements differ materially by jurisdiction, and ChaosTrack makes no representation as to Customer's compliance obligations.

6.4 Content Suitability. Exercise scenarios may depict distressing events, including workplace crime, insider betrayal, extortion, and business failure. Customer is responsible for assessing the suitability of scenario content for its Participants and for configuring or customizing content accordingly.

6.5 Deconfliction. Customer will maintain internal procedures enabling Participants and Customer's security personnel to distinguish an Exercise from a genuine incident, will designate a point of contact aware of all active Exercises, and will ensure that Exercise material is not escalated, reported, or acted upon as a real security incident.

6.6 Scope Control. Customer is solely responsible for the scope, participant selection, timing, and content of each Exercise, including any customization of Generated Content. ChaosTrack does not review or approve Exercise scope.

6.7 Suspension. ChaosTrack may suspend an Exercise or Customer's access where ChaosTrack reasonably believes an Exercise is unauthorized, unlawful, or likely to cause harm to any person, in accordance with MSA Section 6.3.

7. Artificial Intelligence and Generated Content

MSA Section 10 governs ChaosTrack's use of artificial intelligence, including its commitment not to train models on Customer Materials and the commitments required of its Third-Party AI Services. This Section sets out Customer's corresponding obligations.

7.1 Human Review. Customer will review Generated Content before relying on it, distributing it, or acting on it, and will not treat it as a substitute for professional judgment.

7.2 Suitability. Customer will evaluate whether Generated Content is appropriate for its intended use and will develop its own internal policies governing the use of Generated Content within its organization.

7.3 No Representation as to Origin. Customer will not represent Generated Content as human-authored, or as reviewed, approved, vetted, or certified by ChaosTrack. Generated Content does not represent the views of ChaosTrack or its licensors.

7.4 Authorization of AI Processing. Customer acknowledges and authorizes the transmission of Customer Materials and Exercise data to Third-Party AI Services for the purpose of generating Generated Content and is responsible for confirming that such transmission is permitted under Customer's own obligations to its personnel, customers, and regulators.

7.5 Preparedness Tool Only. THE PLATFORM IS A PREPAREDNESS AND TRAINING TOOL. IT DOES NOT MONITOR, DETECT, OR RESPOND TO ACTUAL SECURITY EVENTS, AND TAKES NO ACTION IN CUSTOMER'S ENVIRONMENT. CUSTOMER REMAINS SOLELY RESPONSIBLE FOR THE SECURITY OF ITS ENVIRONMENT AND FOR ITS OWN INCIDENT RESPONSE PROGRAM. THE WARRANTY DISCLAIMERS IN MSA SECTION 11.3 APPLY IN FULL.

8. Third-Party Integrations

8.1 Availability. The Platform may offer optional integrations with third-party products. Integrations are enabled at Customer's election and are not enabled by default.

8.2 Customer Responsibility. Customer's use of any third-party product is governed by Customer's agreement with that provider. Customer is responsible for maintaining valid licenses, for the scope of permissions and API credentials it grants to ChaosTrack, for ensuring that data exchanged through an integration may lawfully be exchanged, and for compliance with the third-party provider's acceptable use policy.

8.3 No Warranty. ChaosTrack does not control third-party products, does not warrant them, and is not liable for their acts, omissions, availability, or security. ChaosTrack may modify or discontinue any integration where the third-party provider changes or withdraws its interfaces.

9. Terms Governed by the MSA

The following subjects are governed exclusively by the MSA and are not restated here:

In summary and without limiting those provisions: Customer owns Customer Materials and Customer Deliverables; ChaosTrack owns the Platform, its models, the scenario library, the templates, and Scenario Content, and grants Customer a perpetual internal-use license to Scenario Content generated for Customer; ChaosTrack acts as processor in respect of Personal Data contained in Customer Materials and Exercise records; and ChaosTrack does not train models on Customer Materials.

10. Term and Termination

This EULA takes effect when Customer first accepts it and continues for so long as any Order Form remains in effect. It terminates automatically on termination or expiration of the MSA. On termination, all rights of access terminate, and Customer will cease using the Platform and delete or destroy all copies of Documentation and Materials in its possession. MSA Sections 6.4 through 6.7 govern the consequences of termination, including data export and survival.

11. Contact

Master Services Agreement · Privacy Policy