ChaosTrack Master Services Agreement

1. Definitions

1.1 "Affiliate" means an entity that controls, is controlled by, or is under common control with a Party, where control means ownership of more than 50% of voting securities.

1.2 "Applicable Laws" means all laws, rules, regulations, and orders applicable to a Party's performance under this Agreement.

1.3 "Authorized User" means an employee, contractor, or agent of Customer or a Customer Affiliate authorized by Customer to access the Platform.

1.4 "Confidential Information" has the meaning given in Section 7.1.

1.5 "Customer Deliverables" means readiness reports, audit and SOC 2 reports, executive summaries, gap analyses, Exercise results and transcripts, and incident response plans, policies, and playbooks that the Platform generates or tailors specifically for Customer's organization.

1.6 "Customer Materials" means data, documents, plans, records, and other content submitted to the Platform by or on behalf of Customer, including incident response plans, policies, organizational information, and Participant information.

1.7 "Data Protection Laws" means all laws applicable to the processing of Personal Data under this Agreement, including the EU and UK General Data Protection Regulation, the California Consumer Privacy Act as amended by the California Privacy Rights Act, and comparable state privacy laws.

1.8 "Documentation" means the user guides, technical documentation, and specifications ChaosTrack makes generally available for the Platform.

1.9 "EULA" means the ChaosTrack End User License Agreement published at https://chaostrack.com/eula.

1.10 "Exercise" means a tabletop exercise, fire drill, scenario walkthrough, or other simulated security scenario created, scheduled, or conducted through the Platform.

1.11 "Generated Content" means scenarios, injects, simulated messages, reports, recommendations, summaries, and other output produced by the Platform's artificial intelligence features. Generated Content comprises Scenario Content and Customer Deliverables.

1.12 "Intellectual Property Rights" means all patent, copyright, trademark, trade secret, database, and other intellectual property rights, registered or unregistered, anywhere in the world.

1.13 "Materials" means templates, forms, checklists, sample plans, and reference documents that ChaosTrack makes available to Customer for Customer's convenience.

1.14 "Order Form" means an ordering document, proposal, statement of work, participating addendum, online order, or subscription confirmation executed by or accepted by the Parties that references this Agreement.

1.15 "Participant" means an individual who takes part in an Exercise, whether or not that individual is an Authorized User.

1.16 "Personal Data" means information relating to an identified or identifiable natural person contained in Customer Materials or Exercise records and subject to Data Protection Laws.

1.17 "Platform" means the ChaosTrack hosted, browser-based cybersecurity preparedness and tabletop exercise platform made available at chaostrack.com and associated subdomains.

1.18 "Scenario Content" means Exercise scenarios, injects, and simulated messages generated by the Platform.

1.19 "Services" means the Platform, the Documentation, the Materials, all updates to the foregoing, any associated APIs, and any implementation, configuration, or professional services described in an Order Form. The Services are delivered exclusively as a hosted service; no component is installed or executed on Customer's systems.

1.20 "Subscription Term" means the period stated in the applicable Order Form during which Authorized Users may access the Platform, including the Initial Subscription Term and any Renewal Term.

1.21 "Third-Party AI Services" means the third-party generative artificial intelligence infrastructure ChaosTrack uses to produce Generated Content, currently Amazon Bedrock, operated by Amazon Web Services, Inc. ChaosTrack may change its Third-Party AI Services in accordance with Section 8.5.

1.22 "Usage Data" means ChaosTrack's technical logs, metrics, analytics, and telemetry regarding the performance, use, and operation of the Platform, excluding Customer Materials and Customer Deliverables.

2. Orders and Scope

2.1 Order Forms. Customer may acquire the Services under one or more Order Forms. Each Order Form is a separate contract that incorporates this Agreement and the EULA.

2.2 Precedence. In the event of conflict, the following order controls, highest first: (a) a separately negotiated agreement signed by both Parties that expressly supersedes this Agreement, including any state cooperative purchasing master agreement or participating addendum executed by ChaosTrack; (b) the applicable Order Form; (c) this Agreement; (d) the EULA; (e) the Privacy Policy.

2.3 Affiliates. Customer may permit its Affiliates to use the Services under an existing Order Form, provided that use is solely for the benefit of Customer and those Affiliates, and Customer accepts full responsibility for their acts and omissions, which are deemed those of Customer.

2.4 Resellers and Cooperative Purchasing. Where Customer acquires the Services through an authorized reseller, marketplace, or public procurement vehicle, fees and payment are governed by that arrangement, but this Agreement governs Customer's use of the Services. No reseller or intermediary is authorized to modify this Agreement or make commitments on ChaosTrack's behalf.

2.5 Trials and Preview Features. Services provided free of charge, and features designated beta, preview, or early access, are provided "AS IS," without warranty or support, are not ready for production use, and may be modified or discontinued at any time. Sections 11.1 and 11.2 do not apply to them.

3. Provision of the Services

3.1 Access. Subject to Customer's compliance with this Agreement and payment of applicable fees, ChaosTrack will make the Services available to Customer during the Subscription Term. The rights of access, and the restrictions on use, are set out in the EULA.

3.2 Hosted Delivery. The Platform is delivered exclusively as a hosted, browser-based service. ChaosTrack does not provide, and Customer is not required to install, any client software, agent, connector, or plug-in. The Platform does not execute code within Customer's environment and does not access Customer's endpoints or networks.

3.3 Support. ChaosTrack provides technical support by email during Business Hours. "Business Hours" means Monday through Friday, 9:00 a.m. to 5:00 p.m. Pacific Time, excluding U.S. federal holidays. No uptime, response time, or availability commitment applies unless expressly stated in an Order Form or a separate support agreement signed by ChaosTrack.

3.4 Security. ChaosTrack will implement and maintain appropriate technical and organizational measures designed to protect Customer Materials and Customer Deliverables against unauthorized access, disclosure, alteration, and destruction, taking into account the nature of the processing and the state of the art. ChaosTrack will make its then-current security documentation available to Customer on request.

3.5 Changes to the Services. ChaosTrack may modify or discontinue features, provided that ChaosTrack will not materially diminish the core functionality of the Platform during a paid Subscription Term without giving Customer at least thirty (30) days' notice. Where such a change materially and adversely affects Customer, Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid, unused fees.

4. Customer Responsibilities

4.1 Compliance. Customer will use the Services in accordance with this Agreement, the EULA, and Applicable Laws, and is responsible for the acts and omissions of its Authorized Users and Participants.

4.2 Credentials. Customer is responsible for all activity under its account, will maintain the confidentiality of credentials, will enable available authentication controls, and will notify ChaosTrack promptly at security@chaostrack.com of any unauthorized access.

4.3 Customer Materials. Customer has exclusive control over and responsibility for what Customer Materials are submitted to the Services, and for their accuracy, quality, integrity, legality, and appropriateness. Customer represents that it has all rights, consents, and authorizations necessary for ChaosTrack to process Customer Materials as contemplated by this Agreement.

4.4 Sensitivity Assessment. Customer must assess the sensitivity of Customer Materials before submission and must not submit the categories of restricted information identified in the EULA absent ChaosTrack's prior written agreement.

4.5 Exercises. Customer's obligations regarding authorization, participant notice, content suitability, and deconfliction of Exercises are set out in the EULA and are material obligations under this Agreement.

5. Fees, Invoicing, and Taxes

5.1 Fees. Customer will pay all fees stated in the applicable Order Form. Except as otherwise stated, fees are invoiced annually in advance and payable within thirty (30) days of the invoice date, in U.S. dollars.

5.2 Fee Disputes. If Customer disputes an invoice in good faith, Customer must notify ChaosTrack in writing within fifteen (15) days of the invoice date with reasonable detail. Provided Customer gives timely notice, cooperates to resolve the dispute, and pays all undisputed amounts when due, ChaosTrack will not suspend or terminate for non-payment of the disputed amount.

5.3 Late Payment. Undisputed amounts not paid when due bear interest at the lesser of 1.5% per month or the maximum rate permitted by Applicable Laws, and Customer will reimburse ChaosTrack's reasonable costs of collection.

5.4 Taxes. Fees are exclusive of taxes. Customer is responsible for all sales, use, value-added, and similar taxes, excluding taxes on ChaosTrack's income, property, or personnel. Customer will provide a valid exemption certificate where applicable.

5.5 Price Changes. ChaosTrack may change fees effective on renewal, on at least sixty (60) days' written notice before the end of the then-current Subscription Term.

6. Term, Suspension, and Termination

6.1 Term. This Agreement takes effect on the Effective Date and continues until all Order Forms have expired or been terminated. Each Order Form runs for the initial period stated in it (the "Initial Subscription Term") and renews automatically for successive periods of equal length (each a "Renewal Term") unless either Party gives written notice of non-renewal at least thirty (30) days before the end of the then-current term.

6.2 Termination for Cause. Either Party may terminate this Agreement or an affected Order Form if the other Party: (a) fails to cure a material breach within thirty (30) days after written notice; (b) ceases operations without a successor; or (c) becomes subject to a bankruptcy or insolvency proceeding not dismissed within sixty (60) days.

6.3 Suspension. ChaosTrack may suspend access where Customer fails to pay undisputed amounts within ten (10) days after notice, or where ChaosTrack reasonably believes Customer has breached the acceptable use restrictions or Exercise obligations in the EULA. Except where ChaosTrack reasonably believes immediate action is required to prevent harm, ChaosTrack will give advance notice and will work with Customer in good faith to resolve the matter. Suspension is limited to the affected portion of the Services where practicable.

6.4 Effect of Termination. On expiration or termination: (a) all rights of access terminate; (b) Customer will pay all amounts accrued through the effective date of termination; (c) Customer will cease using the Services and delete or destroy all copies of Documentation and Materials in its possession; and (d) each Party will return or destroy the other's Confidential Information on request.

6.5 Data Export. For thirty (30) days following termination, ChaosTrack will make Customer Materials and Customer Deliverables available for export. Thereafter ChaosTrack may delete them in accordance with Section 8.9.

6.6 Refunds. If Customer terminates for ChaosTrack's uncured material breach, or ChaosTrack terminates without cause, ChaosTrack will refund prepaid, unused fees on a pro-rata basis. In all other cases fees are non-refundable.

6.7 Survival. Sections 1, 5 (as to amounts accrued), 6.4, 6.5, 6.7, 7, 8.9, 9, 10, 11.3, 11.4, 12, 13, 14, 15, and 16 survive termination, together with any other provision that by its nature should survive.

7. Confidentiality

7.1 Definition. "Confidential Information" means non-public information disclosed by one Party (the "Disclosing Party") to the other (the "Receiving Party") that is designated confidential or that a reasonable person would understand to be confidential from its nature or the circumstances of disclosure. ChaosTrack's Confidential Information includes the Platform, the scenario library, templates, Documentation not made public, fees, and non-public security and roadmap information. Customer's Confidential Information includes Customer Materials, Customer Deliverables, incident response plans, Exercise results, and credentials.

7.2 Obligations. The Receiving Party will protect Confidential Information using at least reasonable care, will not disclose it except to employees, Affiliates, and professional advisors with a need to know who are bound by comparable obligations, and will use it only to exercise rights and perform obligations under this Agreement. The Receiving Party remains responsible for its recipients' compliance.

7.3 Exclusions. Confidential Information excludes information that: (a) is or becomes public without breach; (b) was rightfully known without restriction before disclosure; (c) is rightfully received from a third party without restriction; or (d) is independently developed without use of the Disclosing Party's Confidential Information.

7.4 Compelled Disclosure. The Receiving Party may disclose Confidential Information where required by Applicable Laws, including public records or freedom of information legislation, provided it gives prompt notice where legally permitted, discloses only what is required, and reasonably cooperates in seeking protective treatment.

7.5 Equitable Relief. The Parties acknowledge that breach of this Section may cause irreparable harm for which monetary damages are inadequate, and that the non-breaching Party may seek injunctive relief without posting bond.

8. Data Protection

8.1 Roles. With respect to Personal Data contained in Customer Materials and Exercise records, Customer is the controller (or business) and ChaosTrack is the processor (or service provider). ChaosTrack acts as a controller only with respect to account registration data, billing data, and website usage data collected directly from Customer's personnel, as described in the Privacy Policy.

8.2 Processing on Instructions. ChaosTrack will process Personal Data only on Customer's documented instructions, which comprise this Agreement, the EULA, the applicable Order Form, and Customer's use of the Platform's features, except where processing is required by Applicable Laws. ChaosTrack will not sell or share Personal Data, and will not retain, use, or disclose it for any purpose other than providing the Services.

8.3 Confidentiality of Personnel. ChaosTrack will ensure that personnel authorized to process Personal Data are bound by appropriate obligations of confidentiality.

8.4 Security. The measures described in Section 3.4 apply to Personal Data.

8.5 Subprocessors. Customer authorizes ChaosTrack to engage subprocessors, including hosting providers and Third-Party AI Services, to process Personal Data. ChaosTrack will impose data protection obligations on each subprocessor no less protective than those in this Section, will maintain a current list of subprocessors available to Customer on request, will give Customer reasonable notice before adding a new subprocessor, and will provide a reasonable opportunity to object. ChaosTrack remains responsible for its subprocessors' performance.

8.6 Assistance. Taking into account the nature of the processing, ChaosTrack will provide reasonable assistance to enable Customer to respond to requests from individuals exercising rights under Data Protection Laws, and to meet Customer's obligations regarding security, breach notification, and data protection impact assessments.

8.7 Incident Notification. ChaosTrack will notify Customer without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data processed on Customer's behalf, and will provide information reasonably available to it to assist Customer in meeting its own notification obligations.

8.8 International Transfers. The Services are hosted and operated in the United States. Where Personal Data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to the United States, the Parties will give effect to an appropriate transfer mechanism, including standard contractual clauses where required.

8.9 Deletion and Return. Following the export period in Section 6.5, ChaosTrack will delete Personal Data processed on Customer's behalf, except where retention is required by Applicable Laws.

8.10 Data Processing Addendum. Where the Parties execute a separate data processing addendum, that addendum governs the processing of Personal Data and prevails over this Section to the extent of any conflict.

8.11 Audit. On reasonable written request, no more than once in any twelve-month period, ChaosTrack will provide information reasonably necessary to demonstrate compliance with this Section, including current third-party audit reports or certifications where available.

9. Ownership and Intellectual Property

9.1 ChaosTrack Property. ChaosTrack owns and retains all right, title, and interest in and to: the Platform and Documentation; all models, algorithms, prompts, and system architecture; the ChaosTrack scenario library and all scenario, inject, and report templates; the Materials; Usage Data; and all improvements and derivative works of the foregoing, together with all associated Intellectual Property Rights.

9.2 Scenario Content. ChaosTrack owns Scenario Content. ChaosTrack grants Customer a perpetual, non-exclusive, non-transferable, royalty-free license to use, reproduce, and internally distribute Scenario Content generated for Customer, for Customer's internal training, preparedness, audit, and regulatory purposes.

9.3 Customer Deliverables. As between the Parties, Customer owns all right, title, and interest in and to Customer Deliverables. To the extent ChaosTrack holds any Intellectual Property Rights in Customer Deliverables, ChaosTrack assigns those rights to Customer. ChaosTrack retains no license in Customer Deliverables other than the limited right to process them as necessary to provide the Services.

9.4 Customer Materials. Customer owns and retains all right, title, and interest in and to Customer Materials. A document derived from, tailored from, or based upon a ChaosTrack template or the ChaosTrack scenario library does not thereby become the property of ChaosTrack. Customer grants ChaosTrack a non-exclusive, worldwide license to host, copy, transmit, display, and process Customer Materials solely to provide, secure, maintain, and support the Services.

9.5 Use of Customer Deliverables. Customer may use and distribute Customer Deliverables within its organization and may share them with its auditors, insurers, and regulators. Customer may not sell Customer Deliverables or provide them to a competitor of ChaosTrack in a manner that discloses ChaosTrack's Confidential Information.

9.6 Aggregated Data. ChaosTrack may create and use aggregated, de-identified, or anonymized data derived from use of the Services for analytics, benchmarking, and product improvement, provided such data does not identify, and cannot reasonably be associated with, Customer, any Authorized User, any Participant, or any other identifiable individual, and is not disclosed in a form attributable to Customer.

9.7 Feedback. If Customer provides suggestions, feature requests, or other feedback, Customer grants ChaosTrack a perpetual, irrevocable, worldwide, royalty-free, sublicensable license to use and exploit that feedback without restriction or obligation, provided ChaosTrack will not identify Customer as the source without Customer's prior written consent.

9.8 Reservation. Except for the rights expressly granted, each Party reserves all rights.

10. Artificial Intelligence

10.1 Use of AI. The Platform uses generative artificial intelligence, delivered through Third-Party AI Services, to produce Generated Content. Each Third-Party AI Service is a subprocessor under Section 8.5, and ChaosTrack remains responsible for its performance.

10.2 No Model Training. ChaosTrack will not use Customer Materials, Customer Deliverables, or Exercise records to train, retrain, or fine-tune any machine learning model, except in aggregated and de-identified form in accordance with Section 9.6.

10.3 Third-Party AI Service Commitments. ChaosTrack will use only Third-Party AI Services that are contractually committed to: (a) not storing prompts or model outputs beyond what is necessary to return a response; (b) not disclosing prompts or model outputs to the providers of the underlying foundation models; and (c) not using prompts or model outputs to train or improve any foundation model. ChaosTrack will not enable any optional feature of a Third-Party AI Service that would permit such use, and will not consent to any such use on Customer's behalf.

10.4 Nature of Generated Content. Generated Content is probabilistic and may be inaccurate, incomplete, outdated, or unsuitable for a particular purpose, and may not be unique to Customer. Customer will evaluate Generated Content, including through human review where appropriate, before relying on, distributing, or acting on it.

10.5 No Professional Advice. Neither the Services, the Materials, nor Generated Content constitutes legal, regulatory, compliance, insurance, or professional security advice. Customer will consult a qualified professional as appropriate and acknowledges that it uses the Materials and Generated Content at its own risk.

10.6 Preparedness Tool. The Platform is a preparedness and training tool. It does not monitor, detect, or respond to actual security events and takes no action within Customer's environment.

11. Warranties and Disclaimers

11.1 Mutual. Each Party represents and warrants that it is duly organized, validly existing, and in good standing, and has full authority to enter into and perform this Agreement.

11.2 ChaosTrack Warranty. ChaosTrack warrants that the Platform will perform materially in accordance with the Documentation during the Subscription Term. Customer must report any non-conformity in reasonable detail within thirty (30) days of discovery. As Customer's exclusive remedy and ChaosTrack's entire liability for breach of this warranty, ChaosTrack will use commercially reasonable efforts to correct the non-conformity or provide a workaround; if ChaosTrack fails to do so within a reasonable period, Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid, unused fees.

11.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN SECTIONS 11.1 AND 11.2, THE SERVICES, MATERIALS, AND GENERATED CONTENT ARE PROVIDED "AS IS" AND "AS AVAILABLE," AND CHAOSTRACK DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, CONFORMITY TO PROMOTIONAL MATERIALS, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

CHAOSTRACK DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE; THAT DEFECTS WILL BE CORRECTED; THAT GENERATED CONTENT WILL BE ACCURATE OR COMPLETE; THAT EXERCISES WILL ACCURATELY PREDICT REAL-WORLD OUTCOMES; THAT ALL VULNERABILITIES WILL BE IDENTIFIED; OR THAT USE OF THE SERVICES WILL PREVENT, DETECT, CONTAIN, OR MITIGATE ANY ACTUAL SECURITY INCIDENT OR SATISFY ANY LEGAL, REGULATORY, OR FRAMEWORK REQUIREMENT. CUSTOMER REMAINS SOLELY RESPONSIBLE FOR THE SECURITY OF ITS ENVIRONMENT AND FOR ITS OWN INCIDENT RESPONSE PROGRAM.

11.4 Exclusions. ChaosTrack has no liability for any failure to the extent arising from: (a) Customer's systems, networks, or internet connectivity; (b) misuse of the Services by Customer, an Authorized User, or a third party; (c) modification of the Services by anyone other than ChaosTrack; or (d) any other cause outside ChaosTrack's reasonable control.

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES, SO SOME EXCLUSIONS MAY NOT APPLY.

12. Indemnification

12.1 By ChaosTrack. ChaosTrack will defend Customer, its Affiliates, and their officers, directors, and employees against any third-party claim alleging that the Services, as provided by ChaosTrack and used in accordance with this Agreement, infringe or misappropriate that third party's United States patent, copyright, trademark, or trade secret rights, and will indemnify Customer against damages finally awarded against Customer as a result of such claim, or amounts paid in settlement approved in writing by ChaosTrack.

12.2 Remedies. If the Services become, or in ChaosTrack's opinion are likely to become, the subject of a claim under Section 12.1, ChaosTrack may at its option and expense: (a) procure the right for Customer to continue using the Services; (b) modify or replace the Services so they are non-infringing while materially preserving functionality; or (c) terminate the affected Order Form and refund prepaid, unused fees on a pro-rata basis. Sections 12.1 and 12.2 state ChaosTrack's entire liability and Customer's exclusive remedy for any claim of intellectual property infringement.

12.3 Exclusions. ChaosTrack has no obligation under Section 12.1 to the extent a claim arises from: (a) Customer Materials; (b) Customer Deliverables or Scenario Content modified by Customer; (c) combination of the Services with any product, data, or system not supplied by ChaosTrack; (d) use of the Services in breach of this Agreement, the EULA, or Applicable Laws; (e) trials or preview features; or (f) use of a superseded version where the claim would have been avoided by an available update.

12.4 By Customer. Subject to Section 15.4, Customer will defend ChaosTrack and its officers, directors, and employees against any third-party claim arising out of or relating to: (a) Customer Materials, including any claim that they infringe or violate a third party's rights; (b) any Exercise, including claims by Participants, Customer personnel, or any regulator or supervisory authority; (c) Customer's breach of the acceptable use restrictions or Exercise obligations in the EULA; or (d) Customer's violation of Applicable Laws. Customer will indemnify ChaosTrack against damages finally awarded as a result of such claim, or amounts paid in settlement approved in writing by Customer. This Section does not apply to the extent a claim arises from ChaosTrack's negligence, gross negligence, or willful misconduct.

12.5 Procedure. The indemnified Party will give prompt written notice of the claim, grant the indemnifying Party sole control of the defense and settlement (provided that no settlement imposing a non-monetary obligation, admission of liability, or unreimbursed payment on the indemnified Party may be made without its consent), and provide reasonable cooperation at the indemnifying Party's expense. The indemnified Party may participate at its own expense with counsel of its choice. Failure to give prompt notice relieves the indemnifying Party only to the extent it is materially prejudiced.

13. Limitation of Liability

13.1 Exclusion of Indirect Damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAWS, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS OR PROSPECTS, LOST REVENUE, BUSINESS INTERRUPTION, OR COST OF SUBSTITUTE SERVICES, REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

13.2 Liability Cap. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAWS, CHAOSTRACK'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID BY CUSTOMER UNDER THE APPLICABLE ORDER FORM IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. WITH RESPECT TO TRIALS AND PREVIEW FEATURES, CHAOSTRACK'S TOTAL AGGREGATE LIABILITY WILL NOT EXCEED USD $500.

13.3 Exclusions from the Limitations. Subject to Section 13.4, Sections 13.1 and 13.2 do not limit: (a) Customer's obligation to pay fees; (b) Customer's indemnification obligations under Section 12.4; (c) either Party's breach of Section 7; or (d) either Party's fraud, gross negligence, or willful misconduct.

13.4 ChaosTrack's Capped Obligations. Notwithstanding Section 13.3, and for the avoidance of doubt:

• (a) ChaosTrack's total aggregate liability under Section 12.1, including its obligation to defend and indemnify Customer against infringement claims, is subject to the cap in Section 13.2; and
• (b) ChaosTrack's liability for unauthorized access to, alteration, corruption, destruction, or theft of Customer Materials, Customer Deliverables, or Customer's Confidential Information is subject to the cap in Section 13.2, except where such loss arises from ChaosTrack's gross negligence or willful misconduct.

13.5 Excluded Liability. Nothing in this Agreement limits either Party's liability for death or personal injury caused by negligence, or for any other liability that cannot be limited or excluded under Applicable Laws.

13.6 Allocation of Risk. The Parties agree that these limitations represent a reasonable allocation of risk, are an essential basis of the bargain, and apply notwithstanding the failure of essential purpose of any limited remedy.

14. Export Control and Sanctions

Each Party will comply with all applicable export control and sanctions laws, including those administered by the U.S. Department of Commerce Bureau of Industry and Security and the U.S. Treasury Department's Office of Foreign Assets Control. Customer represents that it is not located in, organized under the laws of, or ordinarily resident in a sanctioned jurisdiction; is not identified on any restricted party list, nor 50% or more owned by any party on such a list; and will not export, re-export, or make the Services available in violation of such laws. Customer will not use the Services to process information controlled under the U.S. International Traffic in Arms Regulations.

15. Government Customers

15.1 Commercial Item Status. The Services and Documentation are "commercial products," "commercial computer software," and "commercial computer software documentation" as those terms are used in 48 C.F.R. § 2.101, § 12.212, and § 227.7202. U.S. Government end users acquire only the rights set out in this Agreement and the EULA, consistent with 48 C.F.R. §§ 12.212 and 227.7202-1 through 227.7202-4.

15.2 Cooperative Purchasing. Where Customer acquires the Services under a state cooperative purchasing master agreement, participating addendum, or similar public procurement vehicle executed by ChaosTrack, the terms of that vehicle prevail over this Agreement to the extent of any conflict.

15.3 Public Records. Customer may be subject to public records or freedom of information legislation. Nothing in Section 7 requires Customer to withhold information it is legally obligated to disclose, provided Customer gives ChaosTrack prompt notice where permitted and reasonably cooperates in seeking confidential treatment for ChaosTrack's Confidential Information.

15.4 Statutory Limitations. Where Customer is a federal, state, local, or tribal government entity prohibited by Applicable Laws or constitutional provision from agreeing to any provision of this Agreement — including provisions relating to indemnification, limitation of liability, governing law, venue, automatic renewal, or payment of interest — that provision applies only to the extent permitted by the law applicable to Customer, and the remainder of this Agreement continues in full force and effect.

15.5 Accessibility. ChaosTrack will make available, on request, its most current accessibility conformance report describing the Platform's conformance with the Web Content Accessibility Guidelines and Section 508 of the Rehabilitation Act.

15.6 Non-Appropriation. Where Customer is a government entity whose payment obligations are subject to appropriation of funds, Customer may terminate an Order Form at the end of a fiscal period if funds are not appropriated, on written notice, without further liability other than for amounts accrued through the termination date.

16. General Provisions

16.1 Governing Law. This Agreement is governed by the laws of the State of California, excluding its conflict of laws rules, subject to Section 15.4. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

16.2 Venue. Subject to Section 15.4, the Parties submit to the exclusive jurisdiction of the state and federal courts located in Santa Clara County, California, and waive any objection to venue there.

16.3 Informal Resolution. Before initiating proceedings, the Parties will attempt in good faith to resolve any dispute through discussion between senior representatives for at least thirty (30) days after written notice, except where a Party seeks injunctive or equitable relief.

16.4 Assignment. Neither Party may assign this Agreement without the other's prior written consent, except that either Party may assign to an Affiliate or in connection with a merger, reorganization, or sale of substantially all assets, on written notice given within sixty (60) days, provided the assignee assumes all obligations. Any other attempted assignment is void.

16.5 Entire Agreement. This Agreement, together with each Order Form, the EULA, and the Privacy Policy, is the complete and exclusive agreement between the Parties regarding its subject matter and supersedes all prior proposals, communications, and agreements. Terms in a purchase order, vendor portal, or onboarding process are void unless expressly accepted in writing by ChaosTrack.

16.6 Amendment. ChaosTrack may update this Agreement by posting a revised version and updating the Effective Date. For a Subscription Term of twelve (12) months or longer, changes take effect on renewal. For all other subscriptions, changes take effect thirty (30) days after posting. Each Order Form is subject to the version of this Agreement in effect when the Order Form was made. If Customer objects to a change, Customer's sole remedy is not to renew.

16.7 Severability. If any provision is held unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions remain in effect.

16.8 Waiver. No failure or delay in exercising a right operates as a waiver, and no waiver of one breach waives any other.

16.9 Force Majeure. Neither Party is liable for failure to perform (other than payment obligations) caused by events beyond its reasonable control, including acts of God, natural disaster, war, civil unrest, terrorism, cyberattack, and internet or cloud provider disruption, provided the affected Party gives prompt notice and uses diligent efforts to resume performance.

16.10 Independent Contractors. The Parties are independent contractors. This Agreement creates no partnership, franchise, joint venture, agency, or employment relationship.

16.11 No Third-Party Beneficiaries. There are no third-party beneficiaries to this Agreement, except that ChaosTrack's licensors are intended beneficiaries of Sections 9, 11, and 13.

16.12 Publicity. Neither Party may use the other's name, marks, or logos in publicity without prior written consent. Subject to Customer's prior written consent and any Customer brand guidelines, ChaosTrack may identify Customer as a ChaosTrack customer.

16.13 Notices. Notices to ChaosTrack must be sent to ChaosTrack, Inc., 4150 Orchard Ct, Palo Alto, CA 94306, with a copy to legal@chaostrack.com. Notices to Customer may be sent to the address or email specified in the Order Form or on the account. Notice is effective one business day after email or overnight courier, or three business days after registered mail.

16.14 Interpretation. Headings are for convenience only. "Including" means "including without limitation."

17. Contact

Privacy Policy: https://chaostrack.com/privacy-policy