Skip to request access
← Back to vrymdor.com

Master Services Agreement

Including SaaS Terms, Software License, and Studio Services Terms

Vrymnox Systems LLC, doing business as Vrymdor

This Master Services Agreement (this "Agreement") is between Vrymnox Systems LLC, a Nebraska limited liability company that also does business as Vrymdor ("Vrymnox," "we," or "us"), and the customer that accepts this Agreement or signs an Order or Statement of Work that references it ("Customer"). This Agreement governs all products and services Vrymnox provides to Customer, including the Vrymnox Control Plane, the Self-Hosted Software, the Central Guardian, and Vrymdor Studio Services. Vrymnox's Data Processing Addendum, accepted together with this Agreement (the "Data Processing Addendum" or "DPA"), is part of this Agreement.

Customer accepts this Agreement on the earliest of: (a) signing an Order or Statement of Work that references it; (b) checking a box or clicking a button indicating acceptance at checkout, at account creation, or on an activation page; or (c) first accessing or using any Service (the "Effective Date"). The individual accepting this Agreement represents that they have authority to bind Customer.

Business Use Only. The Services are sold only to businesses and other organizations for their internal business purposes. They are not offered for personal, family, or household use, and Vrymnox does not provide physical security, alarm, or premises monitoring services. References in this Agreement to monitoring mean automated monitoring of software systems, networks, and AI agent activity.

1. Definitions

1.1 "Affiliate" means an entity that controls, is controlled by, or is under common control with a party, where control means ownership of more than fifty percent (50%) of the voting interests.

1.2 "Agent" means any artificial intelligence agent, automated workload, service account, bot, script, or other non-human process that Customer connects to or routes through the Services.

1.3 "Authorized Environment" means the servers, virtual machines, Kubernetes clusters, container hosts, private cloud accounts, and CI/CD build systems that Customer owns or controls (or that a third-party hosting provider operates exclusively for Customer) and that are permitted by the applicable Order.

1.4 "Authorized Users" means Customer's and its Affiliates' employees and individual contractors whom Customer authorizes to use the Services for Customer's internal business purposes.

1.5 "Central Guardian" means Vrymnox's local intelligence and telemetry engine, which performs security telemetry scanning, governance, risk, and compliance (GRC) scanning, compliance logging, orchestration, and local data processing using locally hosted artificial intelligence models, as further described in Section 9 and the Documentation.

1.6 "Control Plane" means the Vrymnox Control Plane hosted by Vrymnox, including the customer dashboard at app.vrymdor.com (or any successor address), the Gateway Proxy, application programming interfaces, webhook endpoints, and related hosted services.

1.7 "Customer Content" means all prompts, inputs, outputs, tool calls, tool parameters, responses, files, and other content that Customer's Agents or Authorized Users send through or submit to the Services.

1.8 "Customer Data" means Customer Content and all other data, logs, telemetry, and policy configurations that Customer submits to the Services or that the Services collect from Customer's environment. Customer Data does not include Service Data.

1.9 "Customer Materials" means all content, data, trademarks, logos, brand assets, product information, and other materials that Customer provides to Vrymnox for use in Studio Services, and all Intellectual Property Rights in them.

1.10 "Deliverables" means everything Vrymnox creates or provides in performing Studio Services, including software, configurations, integrations, architecture designs, scripts, documentation, reports, and Media Assets, but excluding Customer Materials.

1.11 "Documentation" means Vrymnox's then-current user guides, technical specifications, deployment instructions, and policy configuration guides for the Services.

1.12 "Final Outputs" means the specific Deliverables that a Statement of Work identifies as final outputs licensed to Customer, in the final form Vrymnox delivers them.

1.13 "Gateway Proxy" means the zero-trust proxy functionality of the Services that receives and evaluates traffic between Agents and large language models, tools, Model Context Protocol (MCP) servers, and other endpoints, and applies Customer's policies to that traffic, including parameter inspection, PII and secret redaction, non-human identity (NHI) access controls, and kill switches, whether operated by Vrymnox in the Control Plane or by Customer through the Self-Hosted Software.

1.14 "Integrations" means third-party products and services that interoperate with the Services, including large language model providers, MCP servers, Zapier, n8n, GitHub, identity providers, and cloud platforms.

1.15 "Intellectual Property Rights" means all patents, copyrights, trade secrets, trademarks, rights in software, models, data, and media, and all other intellectual property and proprietary rights anywhere in the world.

1.16 "Media Assets" means video trailers, 3D renders, animations, images, audio, motion graphics, media packages, and other digital media that Vrymnox creates or generates in performing Studio Services, in any format and at any stage of completion.

1.17 "NHI Seat" means one non-human identity (such as one Agent, service account, or workload identity) registered in the Services, as further described in the Documentation.

1.18 "Open Source Components" means software components licensed under a license approved by the Open Source Initiative or any similar free, open source, or public license.

1.19 "Order" means (a) an order form signed by both parties that references this Agreement, or (b) a purchase made through a Sales Channel, together with the plan description and pricing shown at the time of purchase.

1.20 "Proxy Call" means one request evaluated by the Gateway Proxy, counted as described in the Documentation.

1.21 "Sales Channel" means any channel through which Vrymnox sells subscriptions, including Vrymnox's website checkout, payment links Vrymnox issues, integrations that trigger provisioning (such as Zapier), and third-party marketplaces (such as GitHub Marketplace).

1.22 "Self-Hosted Software" means the Vrymnox software that Vrymnox provides for Customer to run in an Authorized Environment, in object code and container image form, including the Central Guardian when deployed in Customer's environment, container images, sidecars, agent binaries, Helm charts and orchestration manifests, local analysis engines, model files, license keys, and all updates, together with the Documentation. Self-Hosted Software excludes Open Source Components, which are governed by Section 10.

1.23 "Service Data" means the limited technical data described in Section 11.4.

1.24 "Services" means the Control Plane, the Self-Hosted Software, the Central Guardian, Studio Services, and any support or other services Vrymnox provides under an Order or Statement of Work.

1.25 "Statement of Work" or "SOW" means a statement of work signed by both parties that references this Agreement and describes Studio Services.

1.26 "Studio Pipeline" means Vrymnox's separate cloud media pipeline, together with Vrymnox's customization engines, render scripts, templates, prompts, workflows, models, and tools used to generate Media Assets and perform Studio Services.

1.27 "Studio Services" means integration, bespoke architecture setup, custom development, advisory, media generation, and other professional services Vrymnox performs under a Statement of Work.

1.28 "Subscription Term" means the subscription period stated in an Order, including any renewal period.

1.29 "Usage Limits" means the servers, AI agents, NHI Seats, instances, nodes, Proxy Call volumes, compliance packs, log retention period, tenants, environments, and other units of measure stated in an Order.

1.30 "Vrymnox Materials" means the Services, the Central Guardian, the Studio Pipeline, the Documentation, and all software, tools, engines, scripts, templates, know-how, and other materials that Vrymnox owned or developed before or independently of a Statement of Work, or that Vrymnox develops for general use, together with all improvements and derivative works of any of them, and all Intellectual Property Rights in them.

2. Orders, Statements of Work, and Account Activation

2.1 Orders and SOWs. Customer may purchase subscriptions and licenses through Orders and may engage Vrymnox for Studio Services through SOWs. Each Order and SOW is part of this Agreement.

2.2 Automated Provisioning. When Customer purchases through a Sales Channel, Vrymnox's systems may automatically create a Customer tenant and send an activation link to the email address provided with the purchase. Customer is responsible for providing an accurate email address, for controlling access to that email account and the activation link, and for all activity under the tenant after activation. The person who completes activation must accept this Agreement on Customer's behalf before the tenant becomes active. Activation links expire after seventy-two (72) hours.

2.3 Third-Party Marketplaces. If Customer purchases through a third-party marketplace, such as GitHub Marketplace, (a) the marketplace's terms govern payment, invoicing, refunds, and cancellation of that purchase, (b) this Agreement governs Customer's access to and use of the Services, and (c) Vrymnox may suspend or end Customer's access if the marketplace notifies Vrymnox that the subscription has ended or payment has failed.

2.4 Order of Precedence. If there is a conflict, the following order controls: (a) a signed Order or SOW, but only as to provisions that it expressly identifies as modifying this Agreement; (b) this Agreement, including its Exhibits and the Data Processing Addendum (which controls as to the processing of personal data); and (c) the Documentation. Any purchase order or other Customer-provided terms are for administrative convenience only and do not apply, even if Vrymnox accepts or acknowledges them.

3. Control Plane and Gateway Proxy

3.1 Access Right. Subject to this Agreement and payment of all fees, Vrymnox grants Customer a non-exclusive, non-transferable, non-sublicensable right during the Subscription Term for its Authorized Users and Agents to access and use the Control Plane, within the Usage Limits, solely for Customer's internal business purposes and in accordance with the Documentation.

3.2 Accounts and Credentials. Customer is responsible for its Authorized Users' and Agents' compliance with this Agreement; for safeguarding passwords, API keys, tokens, and other credentials; and for all activity under its accounts and credentials. Customer will promptly rotate any credential it believes is compromised and notify Vrymnox of any unauthorized use.

3.3 Changes. Vrymnox may update the Control Plane from time to time, but will not materially reduce the core functionality of the Services Customer has purchased during the current Subscription Term. Vrymnox will give at least thirty (30) days' notice before removing a documented API or changing it in a way that is not backward compatible, except where a shorter period is needed to address a security issue or comply with law.

3.4 Internal Administration. Vrymnox operates internal administration systems (including at admin.vrymnox.com) to provision, support, and secure the Services. Customer has no right to access those systems.

4. Self-Hosted Software License

4.1 License Grant. Subject to this Agreement and payment of all fees, Vrymnox grants Customer a non-exclusive, non-transferable, non-sublicensable license during the Subscription Term to:

(a) install and run the Self-Hosted Software, including as containers or sidecars in Docker, Kubernetes, or other container environments the Documentation supports, solely in an Authorized Environment;

(b) use the Self-Hosted Software solely for Customer's internal business purposes, within the Usage Limits, and in accordance with the Documentation;

(c) pull the Self-Hosted Software into Customer's private CI/CD pipelines and private container registries, and run it in build, test, and staging environments, solely to build, test, and deploy Customer's own applications for use permitted by this Agreement; and

(d) make a reasonable number of copies solely for backup and disaster recovery.

Use in non-production environments under clause (c) does not count against Usage Limits unless the Order states otherwise or the environment processes live production traffic. All copies remain subject to this Agreement.

4.2 Term of License. The license in Section 4.1 ends at the end of the Subscription Term, and may be suspended or terminated only as provided in this Agreement, including Sections 2.3, 14.6, 14.7, 15, 18.1, and 19.1, Exhibit B, and the Data Processing Addendum.

4.3 License Keys and Verification. The Self-Hosted Software may require license keys and may periodically connect to Vrymnox over an outbound-only encrypted connection on port 443 to validate the license, report usage against Usage Limits, and check for updates. Customer will not disable, circumvent, or interfere with license keys, usage reporting, or license verification. If the Self-Hosted Software cannot validate its license for thirty (30) consecutive days, Vrymnox may limit functionality until validation succeeds, except for deployments in an air-gapped environment that the Order identifies, which will use the offline license process in the Documentation.

4.4 Restrictions. Except as expressly permitted by this Agreement or by the license of an Open Source Component, Customer will not, and will not permit any person to:

(a) reverse engineer, decompile, disassemble, decrypt, or otherwise attempt to derive the source code, model weights, policy logic, redaction patterns, detection logic, routing logic, render scripts, or underlying algorithms of any Vrymnox Materials;

(b) extract, copy, or export any model files, policy engines, or other components from the Self-Hosted Software's containers or sidecars, other than Customer's own policy configurations;

(c) modify, adapt, translate, or create derivative works of the Vrymnox Materials, except for configuration changes the Documentation permits;

(d) copy the Self-Hosted Software except as permitted by Section 4.1;

(e) publish, push, or store the Self-Hosted Software or any container image that contains it in any public container registry, public repository, or other publicly accessible location;

(f) sell, resell, rent, lease, lend, distribute, sublicense, or otherwise make the Services available to any third party, or use them to provide managed, outsourced, or hosted services to third parties, unless the Order or SOW expressly permits it;

(g) remove or alter any proprietary notices, license keys, or code signatures (White-Label Delivery under Section 17.5 does not permit removal of any of them);

(h) run the Self-Hosted Software outside an Authorized Environment;

(i) access or use the Services to build a competing product or service, or for benchmarking or competitive analysis intended for publication, without Vrymnox's prior written consent;

(j) probe, scan, or test the vulnerability of the Control Plane or the Studio Pipeline, or bypass any security or rate-limiting feature, except under a written testing agreement with Vrymnox; or

(k) use the Services in violation of law or Section 13.

To the extent applicable law grants Customer a non-waivable right to decompile software for interoperability, Customer will first request the necessary interoperability information from Vrymnox in writing and allow Vrymnox a reasonable period to provide it.

4.5 Updates and Supported Versions. During the Subscription Term, Vrymnox will make available the updates and patches it generally releases. Customer is responsible for installing updates to the Self-Hosted Software. Vrymnox supports only the current version and the one (1) immediately prior major version, and Vrymnox's warranty, support, and indemnity obligations do not apply to unsupported versions.

4.6 Verification. On Vrymnox's reasonable written request, not more than once in any twelve (12) month period, Customer will provide a written certification of its usage against the Usage Limits, and will permit Vrymnox or an independent auditor bound by confidentiality obligations to verify Customer's compliance with this Section 4, during normal business hours, on at least thirty (30) days' notice, without access to Customer Content. Customer will promptly pay for any underpayment revealed. If the underpayment exceeds five percent (5%) for the audited period, Customer will also reimburse Vrymnox's reasonable audit costs.

5. Usage Limits, Metering, and Overages

5.1 Usage Limits. Customer will not exceed its Usage Limits except as permitted by this Section 5.

5.2 Metering. Vrymnox measures Proxy Calls, NHI Seats, and other metered usage through the Services and, for Self-Hosted Software, through the usage reporting described in Section 4.3. Vrymnox's metering records are presumed accurate unless Customer shows a material error.

5.3 Overages. If Customer's usage exceeds a Usage Limit in any billing period, Vrymnox will invoice the excess in arrears at the overage rate in the Order or, if none is stated, at Vrymnox's then-current list price (for example, a stated price per ten thousand (10,000) Proxy Calls). Excess NHI Seats, instances, or nodes are billed from the date the excess began through the end of the billing period. Overage charges are unit-based usage fees, not time-based charges.

5.4 Usage Alerts and Caps. The Services may let Customer set usage alerts or hard caps. If Customer sets a hard cap, the Gateway Proxy will treat traffic above the cap as provided in the Documentation, which may include blocking it.

5.5 Usage Disputes. Customer must raise any dispute about metered charges in writing within thirty (30) days after the invoice date, with reasonable detail. Vrymnox will investigate in good faith and correct any error by credit or refund.

6. Vrymdor Studio Services

6.1 Statements of Work. Vrymnox will perform Studio Services only under a signed SOW. Each SOW will describe the services, Deliverables, Final Outputs, milestones, delivery dates, acceptance criteria, fixed fees, and any White-Label Delivery or portfolio restrictions. Vrymnox has no obligation to perform work not described in a signed SOW.

6.2 Fixed-Fee Pricing Only. All Studio Services are priced exclusively on a fixed-fee basis, either for the whole project, for defined milestones, or as a fixed monthly retainer for a defined monthly output, as stated in the SOW. No Studio Services will be billed on an hourly, daily, time-and-materials, or other time-based basis, and no SOW, change order, invoice, or other document may provide for time-based billing. Any such provision is void, and the parties will replace it with a fixed fee agreed in writing.

6.3 Change Orders. Either party may request a change to an SOW. A change takes effect only when both parties sign a written change order that states the revised scope, any revised fixed fee or milestone fee, and any revised schedule. Vrymnox is not required to perform changed or additional work until a change order is signed.

6.4 Customer Cooperation. Customer will provide the Customer Materials, information, approvals, system access, and personnel the SOW requires, on time. Vrymnox is not responsible for delays or failures caused by Customer's late or incomplete cooperation, and the schedule will be extended accordingly. If Customer's delay exceeds thirty (30) days, Vrymnox may invoice the fee for the current milestone as if it had been completed, or require a change order.

6.5 Customer Materials. Customer represents that it has all rights needed to provide the Customer Materials and to allow Vrymnox to use them in performing Studio Services, and that the Customer Materials do not infringe any third party's rights or contain unlawful content. Customer will not include Customer telemetry, personal data, or confidential security information in Customer Materials intended for media generation unless the SOW expressly provides for it.

6.6 Acceptance. Each Deliverable is accepted on the earlier of (a) Customer's written acceptance, (b) Customer's failure to give written notice of a material nonconformity with the SOW's acceptance criteria within ten (10) business days after delivery (or any shorter review period the SOW states for an interim milestone), or (c) Customer's use of the Deliverable in production or publication. If Customer gives timely notice of a material nonconformity, Vrymnox will correct it and redeliver, and the acceptance process will repeat. Creative and aesthetic preferences that are not stated in the acceptance criteria are not nonconformities, but the SOW may include a stated number of revision rounds.

6.7 AI-Generated Media. Customer acknowledges that Media Assets may be generated wholly or partly using artificial intelligence tools and models, that similar outputs may be generated for others, and that some AI-generated material may not be protected by copyright under applicable law. Vrymnox does not warrant that any Media Asset is unique or eligible for copyright protection.

6.8 Third-Party Assets. If a Deliverable includes stock media, fonts, music, models, or other third-party assets, Vrymnox will identify them in the SOW or at delivery, and Customer's use of them is subject to the applicable third-party license terms.

6.9 Independent Work. Nothing in this Agreement prevents Vrymnox from providing similar services or creating similar Media Assets for others, so long as Vrymnox does not use Customer's Confidential Information or Customer Materials in doing so.

7. Fail-Closed Operation and Operational Acknowledgments

7.1 Fail-Closed by Default. Customer acknowledges that the Gateway Proxy is designed to prioritize security over connectivity. By default, the Gateway Proxy operates in "fail-closed" mode: if a policy check cannot be completed (including because of a timeout, a policy engine error, an unreachable dependency, a license validation failure, or an exhausted hard cap), the Gateway Proxy will block the affected traffic rather than allow it. As a result, Agents, applications, and workflows that depend on that traffic may stop working until the condition is resolved.

7.2 Not a Defect or Outage. Blocking traffic in fail-closed mode is the intended operation of the Services. It is not a breach of warranty, a failure of the Services, or downtime for purposes of any service level commitment, except to the extent the blocking is caused by unavailability of the Control Plane itself that counts as downtime under Exhibit B.

7.3 Fail-Open Configuration. If the Documentation permits Customer to configure any policy or route to "fail open," Customer does so at its own risk and is solely responsible for any traffic, data, or action that passes through the Gateway Proxy without a completed policy check.

7.4 Policies and Kill Switches. Customer is responsible for configuring, testing, and maintaining its policies, redaction rules, NHI permissions, and kill switch settings, and for deciding when to use a kill switch. A kill switch stops traffic for the affected Agent through the Gateway Proxy. It does not stop actions an Agent takes through any route that does not pass through the Gateway Proxy, and it does not reverse actions already taken.

7.5 Redaction. PII and secret redaction relies on pattern matching and automated analysis and will not detect every item of personal information or every secret in every format. Latency figures in the Documentation or marketing materials (such as sub-ten-millisecond redaction) are typical performance targets under stated conditions, not guarantees.

7.6 Agents and Third-Party Models. Customer is solely responsible for its Agents, their instructions and permissions, and their actions and outputs, including actions taken through Integrations. When Customer routes Agent traffic through the Gateway Proxy to a third-party large language model or other Integration that Customer selects, that traffic is sent to the provider at Customer's direction. Vrymnox does not control and is not responsible for any Integration, or for its availability, outputs, or data practices.

8. AI Governance and Regulatory Roles

8.1 Governance Tool. The Services are AI governance and security tools. They help Customer apply policies to Agent traffic and may generate logs, reports, and compliance evidence exports (including materials Customer may use for transparency obligations under Article 50 of the EU Artificial Intelligence Act, and for alignment with OWASP guidance on agentic AI security).

8.2 Customer's Role. As between the parties, Customer determines which AI systems and Agents it uses, for what purposes, with what data, and how they are presented to people. Customer is responsible for determining its own role and obligations under the EU Artificial Intelligence Act and other AI laws (including as a "deployer," and as a "provider" of any AI system it develops or places on the market), and for meeting those obligations. Customer acknowledges that a party's role under those laws is determined by the law and the facts, not by this Agreement.

8.3 No Compliance Guarantee. Vrymnox does not guarantee that use of the Services, or any GRC scan, compliance log, evidence export, or report, will satisfy any law, regulation, standard, framework, audit, or certification. References to any law or framework describe intended uses and alignment, not a representation of compliance. Customer is responsible for reviewing any output before relying on it or submitting it to anyone.

9. Data Governance and Processing Architecture

9.1 Central Guardian (Local Processing). The Central Guardian processes security telemetry, GRC scans, compliance logs, and other Customer Data using artificial intelligence models that run on infrastructure Vrymnox or Customer controls, and does not send Customer Data to any public or third-party AI model provider. The Central Guardian is offered in the following deployment models, as stated in the Order. (a) Customer-Deployed. Where Customer runs the Self-Hosted Software in its Authorized Environment, including in an air-gapped environment, log content and other telemetry are processed by a model running in that environment and remain there. Vrymnox receives only Service Data and the data Customer chooses to send to the Control Plane, for example through an Integration, a network self-scan Customer enables, or a support request. (b) Vrymnox-Hosted. The Control Plane and the Vrymnox-operated Central Guardian run on the infrastructure described in Section 9.3 and serve multiple customers. Customer Data on that infrastructure, including content Customer submits to the Control Plane (such as support tickets and documents Customer uploads for analysis), is processed there by a Vrymnox-hosted model and is logically separated from other customers' data by access controls in the application and the database that limit each customer to its own records. A dedicated instance or dedicated database for Customer is provided only if an Order expressly provides for it.

9.2 Studio Pipeline (Cloud Media Processing). Studio Services that involve media generation, 3D rendering, or trailer compilation are performed in the Studio Pipeline, which is hosted on third-party cloud infrastructure separate from the Central Guardian. The Central Guardian sends the Studio Pipeline only sanitized production instructions, which Vrymnox designs to exclude Customer telemetry, security logs, and personal data. The Studio Pipeline also processes any Customer Materials that Customer provides for media generation, and may use the third-party AI providers named in Vrymnox's published subprocessor list to generate scripts, images, voice, and other media from those instructions and Customer Materials. Customer Data processed by the Central Guardian is not otherwise transferred to the Studio Pipeline, except Customer Data that an SOW expressly authorizes Vrymnox to use in Media Assets, such as aggregate platform counts.

9.3 Third-Party Hosting. The Control Plane, the Studio Pipeline, and any Vrymnox-operated Central Guardian instance are hosted on third-party cloud infrastructure, currently DigitalOcean, LLC (and any successor hosting provider Vrymnox selects with notice under the Data Processing Addendum). Vrymnox is responsible for selecting, configuring, and securing its use of that infrastructure in accordance with Section 12. Vrymnox is not responsible for outages, failures, or acts of the hosting provider that are outside Vrymnox's reasonable control, and those events are force majeure events under Section 22.4 to the extent they meet that definition.

9.4 Customer-Side Perimeter. Data processed by Self-Hosted Software or a Customer-deployed Central Guardian is only as secure as the Authorized Environment in which it runs. Customer is responsible for the security, network boundaries, access controls, and backups of that environment.

10. Open Source Components and Integrations

10.1 Open Source. The Services include Open Source Components identified in the open source notice delivered with the Self-Hosted Software and published at https://vrymdor.com/open-source (the "Open Source Notice"). Each Open Source Component is licensed under its own license, not this Agreement, and nothing in this Agreement limits Customer's rights under that license. The inclusion of Open Source Components does not subject the proprietary portions of the Vrymnox Materials to any open source license. Where the Services include a Meta Llama model, that model is licensed under the Llama Community License for its version, and Customer will use it in compliance with the Meta Llama Acceptable Use Policy, which the Open Source Notice includes. Where a license requires Vrymnox to make source code available, Vrymnox will do so as described in the Open Source Notice.

10.2 Integrations. The Services may let Customer connect Integrations, including webhook nodes for Zapier, n8n, and GitHub. Customer authorizes Vrymnox to exchange Customer Data with each Integration Customer enables, as needed to operate that Integration. Vrymnox is not responsible for any Integration, its security, or its use of data.

11. Customer Data, Customer Content, and Service Data

11.1 Ownership. As between the parties, Customer owns all Customer Data. Customer grants Vrymnox a non-exclusive, worldwide, royalty-free license during the term of this Agreement to host, copy, process, transmit, and display Customer Data solely as needed to provide, secure, and support the Services for Customer, and as Customer otherwise instructs.

11.2 No Training. Vrymnox will not use Customer Data or Customer Materials to train or improve any artificial intelligence model made available to anyone other than Customer, without Customer's prior written consent.

11.3 Personal Data and Sensitive Data. To the extent Vrymnox processes personal data on Customer's behalf, the parties' Data Processing Addendum governs that processing. Customer will not route through the Control Plane or provide for Studio Services any protected health information under HIPAA, payment card data subject to PCI DSS, criminal justice information, or special categories of personal data under the GDPR, unless the parties have signed an agreement that expressly covers it.

11.4 Service Data. Vrymnox may collect, and the Self-Hosted Software and Central Guardian may transmit, the following "Service Data": (a) license, activation, and pairing information, such as access tokens, a randomly generated node identifier, a one-way hash of a hardware identifier, and a node or gateway label, which defaults to the host name unless Customer sets a different label; (b) software version, operating system family, processor architecture, uptime, connection status, and health information, sent at regular intervals; (c) daily counts of security events and usage against Usage Limits, such as authentication failures, blocked threats, policy decisions, and request totals; (d) for the Gateway Proxy, the identifiers of the Agents and the names of the tools and models Customer registers, their status and call counts, policy and readiness scores, and hashes of policy files and tool definitions; and (e) error and performance metrics. Service Data does not include Customer Content, log lines, IP addresses contained in Customer's logs or telemetry, or telemetry content, which the Self-Hosted Software processes locally and does not send to Vrymnox. Vrymnox and its network provider necessarily receive the public IP address from which the software connects, and use it only to secure and operate the connection. The following are not Service Data and are sent to Vrymnox only when Customer turns them on, and Vrymnox treats them as Customer Data: (i) results of network self-scans that Customer enables, which list open ports, protocols, services, and software product and version names, with a short summary written by the local model, but not IP addresses; and (ii) security events that Customer configures an Integration to forward to the Control Plane, such as GitHub, AWS CloudTrail, or identity provider events. In an air-gapped deployment, Service Data is written to a signed local file that Customer exports and delivers to Vrymnox, and nothing is sent over the network. Vrymnox may use Service Data to provide, support, secure, bill for, and improve the Services and to verify compliance with this Agreement, and may use Service Data that is aggregated and does not identify Customer or any individual for any lawful purpose.

11.5 Retention and Deletion. For thirty (30) days after the end of this Agreement, Vrymnox will make Customer Data stored in Vrymnox-hosted systems available for export on request. After that period Vrymnox will delete it, except for copies in backups deleted on the normal backup cycle and copies Vrymnox must keep by law, which remain subject to Section 16. Vrymnox may keep copies of Deliverables and Media Assets as provided in Section 17.

12. Security

12.1 Security Program. Vrymnox will maintain a written information security program with administrative, technical, and physical safeguards appropriate to the nature of the Services and Customer Data, including the measures described in Annex 2 of the Data Processing Addendum: encryption of Customer Data in transit over public networks, encryption of backups and of stored credentials and secrets, access controls with multi-factor authentication, logging, vulnerability management, and personnel confidentiality. For Self-Hosted Software, Vrymnox will follow secure development practices, including automated testing, dependency vulnerability scanning, pinning of container images to verified versions, and checksum verification of installer bundles.

12.2 Security Incidents. If Vrymnox becomes aware of any breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Data in Vrymnox's possession or control (a "Security Incident"), Vrymnox will notify Customer without undue delay, and in any event within seventy-two (72) hours after confirming it; provide information reasonably available to Vrymnox to help Customer meet its own obligations; take reasonable steps to contain and remediate the Security Incident; and cooperate reasonably with Customer's investigation.

12.3 Customer Environment. A compromise of Customer's environment, accounts, Agents, or Integrations is not a Security Incident unless caused by Vrymnox's breach of this Agreement.

13. Customer Responsibilities and Acceptable Use

Customer will: (a) maintain an Authorized Environment that meets the Documentation's minimum requirements; (b) permit outbound connections over TLS on port 443 to the Vrymnox endpoints listed in the Documentation as needed for the features Customer uses; (c) configure the Services in accordance with the Documentation and any configuration Vrymnox approves in writing, and test policy changes before applying them to production; (d) maintain its own backups; (e) have all rights, notices, and consents needed for the telemetry scanning, network monitoring, logging, inspection, and redaction it uses the Services to perform, including any required employee notices; and (f) use the Services in compliance with law. Customer will not (i) use the Services to scan, monitor, or intercept any system, network, or communication it is not authorized to monitor; (ii) develop or operate malware, or attack any system; (iii) evade any law or any third party's security or usage controls; (iv) make modifications to the Services or deploy them in configurations that the Documentation does not support or Vrymnox has not approved in writing ("Unapproved Configurations"); or (v) use Final Outputs in a manner that is unlawful, defamatory, misleading, or infringing.

14. Fees, Billing, Renewal, and Suspension

14.1 Subscription and Usage Fees. Customer will pay the fees in each Order. Unless the Order states otherwise, subscription fees are billed in advance, usage fees are billed monthly in arrears, and invoiced amounts are due within thirty (30) days after the invoice date. Purchases through Vrymnox's website or payment links are charged to the payment method Customer provides, and Customer authorizes Vrymnox and its payment processor to charge that method for all fees when due, including usage fees and renewals.

14.2 Studio Fees. Studio Services fees are the fixed project fees, fixed milestone fees, or fixed monthly retainer stated in the SOW, invoiced as stated in the SOW (for example, a deposit on signing and the balance of each milestone fee on acceptance of that milestone). Fixed fees are not adjusted for the time Vrymnox spends. Any SOW expenses that Customer agrees to reimburse must be stated in the SOW as fixed amounts or not-to-exceed amounts approved in advance.

14.3 No Time-Based Billing. No fee for Studio Services or other professional services is calculated by the hour, by the day, or on a time-and-materials basis. Proration of subscription or seat fees for a partial billing period is not time-based billing.

14.4 Taxes; Late Payment. Fees exclude all sales, use, value-added, withholding, and similar taxes, which Customer will pay (other than taxes on Vrymnox's net income). Overdue amounts accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by law. Except as expressly stated in this Agreement or an SOW, fees are non-cancelable and non-refundable.

14.5 Automatic Renewal. Unless the Order states otherwise, each Subscription Term automatically renews for successive periods equal to the expiring term (or twelve (12) months, if shorter), unless either party gives notice of non-renewal before the end of the then-current term: for monthly plans, by cancelling in the dashboard at any time before the renewal date, and for annual or longer plans, at least thirty (30) days before the renewal date. For annual or longer plans, Vrymnox will send Customer a written reminder of the upcoming renewal and any price change at least fifteen (15) days, and no more than sixty (60) days, before the non-renewal notice deadline. Customer may cancel online through the dashboard. Any price increase for a signed Order will not exceed seven percent (7%) over the prior term's fees unless Customer agrees in writing.

14.6 Suspension for Non-Payment. If any undisputed amount is more than ten (10) days overdue (or a card or other payment charge fails and is not cured within that time), Vrymnox may, after at least five (5) business days' notice to Customer's billing contact, suspend Customer's access to the Services, including by disabling license keys, and may pause Studio Services, until all overdue amounts are paid. Before suspending Services that Customer uses in production to route Agent traffic, Vrymnox will send a second notice at least two (2) business days in advance stating that, because of fail-closed operation, suspension may block that traffic. If any undisputed amount remains unpaid for thirty (30) days after the due date, Vrymnox may terminate the affected Order or SOW on notice.

14.7 Suspension for Security Reasons. Vrymnox may suspend any part of the Services, or any credential, Agent, tenant, or license key, immediately and with only the notice that is practicable, if Vrymnox reasonably believes that (a) Customer's use poses a security risk to the Services, to Vrymnox, or to any third party; (b) Customer's account or credentials have been compromised; (c) Customer is breaching Section 4.4 or Section 13; or (d) suspension is required by law. Vrymnox will limit the suspension to the extent and duration reasonably necessary and will restore the Services promptly once the issue is resolved.

15. Term and Termination

15.1 Term. This Agreement begins on the Effective Date and continues until all Orders and SOWs have expired or been terminated.

15.2 Termination for Cause. Either party may terminate this Agreement or any Order or SOW on written notice if the other party (a) materially breaches this Agreement and does not cure the breach within thirty (30) days after written notice describing it, or (b) becomes the subject of a bankruptcy, insolvency, receivership, or assignment for the benefit of creditors that is not dismissed within sixty (60) days. Vrymnox may terminate immediately on written notice if Customer breaches Section 4.4 or Section 16.

15.3 Termination of an SOW for Convenience. Customer may terminate an SOW for convenience on fifteen (15) days' written notice. In that case, Customer will pay (a) the fixed fees for all milestones completed or accepted before the termination date, and (b) a fixed termination fee for the milestone in progress equal to fifty percent (50%) of that milestone's fee, or any other amount stated in the SOW. Customer receives a license under Section 17.3 only to Final Outputs for milestones that are fully paid. For a fixed monthly retainer, the termination terms in the SOW apply in place of this Section 15.3.

15.4 Effect of Termination. When this Agreement or an Order ends: (a) all rights and licenses granted under it end, except licenses to fully paid Final Outputs under Section 17.3, which survive unless terminated for Customer's breach; (b) Customer will stop using the affected Services, remove the Self-Hosted Software (including container images, sidecars, agent binaries, model files, and license keys) from all systems and registries within thirty (30) days, and certify in writing on request that it has done so; (c) Customer will pay all fees accrued through the effective date of termination; and (d) if Customer terminates for Vrymnox's uncured breach, Vrymnox will refund any prepaid subscription fees for the remainder of the terminated Subscription Term and any prepaid Studio fees for milestones not yet delivered and any prepaid retainer fee for a month whose retainer output was not delivered. Customer should reroute Agent traffic away from the Gateway Proxy before the Services end.

15.5 Survival. Sections 1, 4.4, 4.6, 5.5, 6.7 through 6.9, 7, 8.3, 9.3, 11.2, the last sentence of 11.4, 11.5, 12.2, 12.3, 13(v), 14 (for amounts accrued), 15.3 through 15.5, and 16 through 22 survive any expiration or termination.

16. Confidentiality

16.1 Definition. "Confidential Information" means all non-public information a party ("Discloser") discloses to the other party ("Recipient") in connection with this Agreement that is marked or identified as confidential or that a reasonable person would understand to be confidential. Vrymnox's Confidential Information includes the non-public portions of the Vrymnox Materials, including the Central Guardian, the Studio Pipeline, policy and routing logic, render scripts, model files, architecture, and pricing. Customer's Confidential Information includes Customer Data and non-public Customer Materials. Confidential Information excludes information that is or becomes public through no fault of Recipient, was known to Recipient without restriction before disclosure, is rightfully received from a third party without restriction, or is independently developed without use of Discloser's Confidential Information.

16.2 Obligations. Recipient will use Discloser's Confidential Information only to perform its obligations and exercise its rights under this Agreement, will disclose it only to its and its Affiliates' employees, contractors, and advisors who need to know it and are bound by confidentiality obligations at least as protective as this Section, and will protect it with at least reasonable care. Recipient may disclose Confidential Information when required by law, after giving Discloser prompt notice where legally permitted and reasonable cooperation in seeking a protective order. These obligations last during the term of this Agreement and for five (5) years after it ends, and for trade secrets and Customer Data, for as long as they remain confidential.

17. Intellectual Property

17.1 Vrymnox Ownership. Vrymnox and its licensors own and retain all right, title, and interest in and to (a) the Vrymnox Materials, and (b) all Deliverables and Media Assets, including all software, customization engines, render scripts, configurations, architecture designs, video trailers, 3D renders, and media packages created through the Central Guardian, the Studio Pipeline, or otherwise in performing Studio Services, and all Intellectual Property Rights in them, but excluding Customer Materials. To the extent Customer acquires any right in any of them, Customer assigns that right to Vrymnox. No Deliverable is a "work made for hire" for Customer. The Self-Hosted Software is licensed, not sold. Vrymnox reserves all rights not expressly granted.

17.2 Customer Ownership. As between the parties, Customer retains all right, title, and interest in and to Customer Data and Customer Materials, including where they appear in a Deliverable. Customer grants Vrymnox a non-exclusive, royalty-free license to use Customer Materials solely to perform Studio Services for Customer and as permitted by Section 17.6.

17.3 License to Final Outputs. Subject to payment of all fees for the applicable milestone or project, Vrymnox grants Customer a non-exclusive, non-transferable (except under Section 22.2), worldwide license to use, reproduce, display, perform, and distribute the Final Outputs identified in the SOW, solely for the purposes and in the media, territory, and term stated in the SOW (or, if the SOW is silent, perpetually, for Customer's own business, marketing, and internal purposes). Customer may not resell or sublicense Final Outputs on a standalone basis, create derivative works of Final Outputs except as the SOW permits (such as editing for length or format), or use them to train any artificial intelligence model. Any custom software Deliverable is licensed on the terms of Section 4 unless the SOW states otherwise. Deliverables that are not Final Outputs (including source files, project files, render scripts, prompts, and intermediate assets) are not licensed to Customer and will not be delivered unless the SOW says so.

17.4 Protection Beyond Copyright. Because some Media Assets may not be protected by copyright, the restrictions in this Section 17 and in Section 4.4 apply as contractual obligations regardless of whether any Intellectual Property Right exists in the Deliverable.

17.5 White-Label Delivery. If an SOW or Order designates Customer for delivery without Vrymnox branding ("White-Label Delivery"), Vrymnox will deliver the Final Outputs and the designated software interfaces without Vrymnox or Vrymdor names, logos, or "Powered by Vrymdor" marks visible to Customer's end users, and Customer is not required to display those marks. White-Label Delivery does not transfer any ownership, does not permit removal of license keys, code signatures, or copyright notices embedded in software or metadata, and does not permit Customer to claim that it developed the Vrymnox Materials. Vrymnox may require Customer's own terms with its end users to protect the Vrymnox Materials at least as much as this Agreement does.

17.6 Portfolio and Showcase Rights. Unless the SOW restricts it, Customer grants Vrymnox a non-exclusive, perpetual, royalty-free right to display completed Media Assets (such as renders and video trailers) and non-sensitive project visuals in Vrymnox's studio portfolio, website, social media, and promotional materials. This right does not extend to (a) Customer's Confidential Information, Customer Data, security architecture, telemetry, or any visual that reveals non-public information about Customer's systems; (b) any project for a Customer designated for White-Label Delivery, unless Customer consents in writing; or (c) Customer's name, trademarks, or logos, which Vrymnox may use only with Customer's prior written consent (email is sufficient). Customer may withdraw consent to future portfolio use on written notice for any reason, and Vrymnox will stop new uses within a reasonable time, but need not recall printed materials already distributed.

17.7 Feedback. If Customer provides suggestions or feedback about the Services, Vrymnox may use it without restriction or obligation, so long as Vrymnox does not identify Customer as its source or disclose Customer's Confidential Information.

18. Warranties and Disclaimers

18.1 Software Warranty. Vrymnox warrants that during the Subscription Term (a) the Control Plane and the supported versions of the Self-Hosted Software will perform materially in accordance with the Documentation, and (b) Vrymnox will not knowingly include in the Self-Hosted Software, as delivered, any virus, malicious code, or undisclosed remote-disable feature, other than the license verification, usage reporting, and suspension features described in this Agreement. Customer's exclusive remedy for breach of clause (a) is for Vrymnox to use commercially reasonable efforts to correct the nonconformity, and if Vrymnox cannot do so within thirty (30) days after Customer's written notice, either party may terminate the affected Order and Vrymnox will refund prepaid fees for the remainder of its Subscription Term.

18.2 Studio Warranty. Vrymnox warrants that it will perform Studio Services in a professional and workmanlike manner. Customer's exclusive remedy for breach of this warranty, if Customer notifies Vrymnox within thirty (30) days after delivery of the affected Deliverable, is for Vrymnox to re-perform the nonconforming services, and if Vrymnox cannot do so within a reasonable time, to refund the fixed fee paid for the affected milestone.

18.3 Exclusions. These warranties do not apply to nonconformities caused by the Authorized Environment, Customer Materials, Customer's configuration or policies, Unapproved Configurations, Integrations, unsupported versions, Open Source Components (except as integrated and delivered by Vrymnox), or use not in accordance with this Agreement or the Documentation.

18.4 Availability. Vrymnox's only commitments regarding availability of the Control Plane are those in the service level terms in Exhibit B, and the service credits and termination right stated there are Customer's sole remedies for unavailability.

18.5 No Guarantee of Security Outcomes. The Services are tools to help Customer scan, monitor, govern, and secure its systems and Agent traffic. Vrymnox does not warrant that the Services will detect, block, or redact every threat, vulnerability, data element, secret, or prohibited action; that any AI model's output or any GRC scan will be accurate or complete; or that Customer's systems or data will be secure.

18.6 Beta Features. Any feature Vrymnox identifies as beta, preview, trial, or evaluation is provided "AS IS," without warranty, indemnity, service level commitment, or support.

18.7 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS SECTION 18, THE SERVICES AND DELIVERABLES ARE PROVIDED "AS IS," AND VRYMNOX DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE, AND ANY WARRANTY THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE.

19. Mutual Indemnification

19.1 By Vrymnox. Vrymnox will defend Customer and its Affiliates against any claim by a third party alleging that the Services or Final Outputs, as delivered by Vrymnox and used in accordance with this Agreement, infringe or misappropriate that third party's United States patent, copyright, trademark, or trade secret, and will pay any damages and costs finally awarded against Customer, or agreed by Vrymnox in settlement, as a result of the claim. If the Services or a Final Output become, or in Vrymnox's opinion are likely to become, the subject of such a claim, Vrymnox may at its option and expense (a) obtain the right for Customer to continue using them, (b) modify or replace them so they are non-infringing with substantially similar functionality, or (c) if neither is commercially reasonable, terminate the affected Order or license and refund prepaid fees for the unused Subscription Term or the fee paid for the affected Final Output. Vrymnox has no obligation for any claim to the extent arising from Customer Data, Customer Materials, Integrations, third-party assets identified under Section 6.8, Open Source Components not modified by Vrymnox, AI-generated similarity to third-party material that Vrymnox did not know of, unsupported versions, modifications or Unapproved Configurations not made by Vrymnox, combination with items not provided by Vrymnox where the claim would not exist but for the combination, or use in breach of this Agreement. This Section 19.1 states Vrymnox's entire liability and Customer's exclusive remedy for infringement claims.

19.2 By Customer. Customer will defend Vrymnox and its Affiliates, and their managers, members, officers, employees, and contractors, against any claim by a third party arising from: (a) Customer Data or Customer Materials, including any claim that they infringe or misappropriate any third party's rights; (b) Customer's misuse of the Services or Final Outputs, or use in breach of Section 4.4, 13, or 17; (c) Unapproved Configurations or modifications made by or for Customer (other than by Vrymnox); (d) Customer's Agents or their actions; (e) Customer's scanning, monitoring, routing, inspection, or logging of any system, network, or communication without the necessary authority, notices, or consents; or (f) Customer's violation of law; and will pay any damages and costs finally awarded against Vrymnox, or agreed by Customer in settlement, as a result of the claim.

19.3 Procedure. The indemnified party will give the indemnifying party prompt written notice of the claim (although delay relieves the indemnifying party of its obligations only to the extent it is prejudiced), sole control of the defense and settlement (except that the indemnifying party may not settle any claim in a way that imposes liability or an admission on the indemnified party without its consent), and reasonable cooperation at the indemnifying party's expense. The indemnified party may participate with its own counsel at its own expense.

20. Limitation of Liability

20.1 Exclusion of Indirect Damages. EXCEPT FOR EXCLUDED CLAIMS, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, OR BUSINESS OPPORTUNITY, BUSINESS INTERRUPTION (INCLUDING INTERRUPTION CAUSED BY FAIL-CLOSED OPERATION), LOSS OF DATA, OR COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR RELATING TO THIS AGREEMENT, EVEN IF ADVISED OF THEIR POSSIBILITY.

20.2 Aggregate Cap. EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT, ALL ORDERS, AND ALL SOWS, UNDER ANY THEORY OF LIABILITY, WILL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY CUSTOMER TO VRYMNOX UNDER THIS AGREEMENT DURING THE SIX (6) MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY.

20.3 Data Protection Cap. This Section 20.3 applies only if an Order states that the Data Protection Cap applies. In that case, for claims arising from a party's breach of Section 12 (Security) or Section 16 (Confidentiality), including any Security Incident, each party's total liability under that Order will not exceed the greater of (a) two (2) times the amount in Section 20.2 or (b) the dollar amount stated in the Order, in place of the cap in Section 20.2. For claims under this Section 20.3, reasonable costs of investigating a Security Incident, notifying affected individuals and regulators, and restoring data are direct damages and are not excluded by Section 20.1. Otherwise, the cap in Section 20.2 applies to those claims.

20.4 Excluded Claims. "Excluded Claims" means (a) a party's fraud, gross negligence, or willful misconduct; (b) Customer's obligation to pay fees; (c) Customer's breach of Section 4.4, 13, 17, or 21, or infringement or misappropriation of Vrymnox's Intellectual Property Rights; and (d) Customer's obligations under Section 19.2. Excluded Claims are not subject to the exclusions in Section 20.1 or the cap in Section 20.2. Vrymnox's obligations under Section 19.1 are not subject to the cap in Section 20.2 and are instead subject to a separate cap equal to two (2) times the amount in Section 20.2.

20.5 Basis of the Bargain. The limitations in this Section 20 are an essential basis of the bargain, apply regardless of the theory of liability, and apply even if a limited remedy fails of its essential purpose.

21. Export and Government Use

21.1 Export. The Services contain encryption and cybersecurity technology subject to United States export control and sanctions laws. Customer will not export, re-export, or transfer them, or permit access to them, in violation of those laws, including to any embargoed country or region or to any person on a U.S. government restricted party list. Customer represents that it is not located in, or owned or controlled by a person in, any such country or region, and is not on any such list.

21.2 Government Use. The Self-Hosted Software and Documentation are "commercial computer software" and "commercial computer software documentation," and any government use is subject to this Agreement under FAR 12.212 and DFARS 227.7202, as applicable.

22. General

22.1 Governing Law and Venue. This Agreement is governed by the laws of the State of Nebraska, without regard to conflict of laws principles. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act do not apply. The parties consent to the exclusive jurisdiction of the state and federal courts located in Lancaster County, Nebraska, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its Intellectual Property Rights or Confidential Information.

22.2 Assignment. Neither party may assign this Agreement without the other party's prior written consent, except that either party may assign it, on written notice, to an Affiliate or to a successor in a merger, acquisition, or sale of all or substantially all of its business or assets to which this Agreement relates, so long as the assignee is not a direct competitor of the other party. Any other assignment is void.

22.3 Subcontractors. Vrymnox may use subcontractors to perform Studio Services and other Services, and remains responsible for their performance under this Agreement.

22.4 Force Majeure. Neither party is liable for any delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, acts of government, war, terrorism, labor disputes, internet, cloud hosting, or utility failures, outages of Integrations, or attacks by third parties that could not have been prevented by reasonable security measures.

22.5 Independent Contractors. The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, employment, or fiduciary relationship.

22.6 Non-Solicitation. During the term of any SOW and for twelve (12) months after it ends, Customer will not solicit for employment or engagement any Vrymnox employee or contractor who performed Studio Services under that SOW. General advertisements not targeted at Vrymnox personnel do not violate this Section.

22.7 Notices. Notices to Customer may be sent to the email address associated with Customer's account or stated in the Order or SOW. Notices to Vrymnox must be sent to ernesth@vrymnox.com with a copy to Vrymnox Systems LLC, 200 S 21st Street, Suite 400A, Lincoln, Nebraska 68510. Notices to Vrymnox of breach, termination, or an indemnifiable claim sent by email must also be sent by courier to the address above. Notices to Customer are effective when sent by email.

22.8 Changes to This Agreement. For Customers that accepted or signed this Agreement without an order form signed by both parties under Section 1.19(a), Vrymnox may update this Agreement by posting a revised version and giving Customer at least thirty (30) days' notice, and the revised version applies from the start of Customer's next renewal term. A signed SOW does not change this, but changes to the terms of an SOW require a writing signed by both parties. Changes to this Agreement as it applies under such an order form require a writing signed by both parties.

22.9 Entire Agreement; Waiver; Severability. This Agreement, including all Orders, SOWs, Exhibits, and the Data Processing Addendum, is the entire agreement between the parties on its subject matter and supersedes all prior agreements and understandings on that subject. No waiver is effective unless in writing. If any provision is held unenforceable, it will be enforced to the maximum extent permitted and the rest of this Agreement remains in effect.

22.10 Counterparts; Electronic Signature. This Agreement, any Order, and any SOW may be accepted electronically or signed in counterparts and by electronic signature, each of which is an original.

Exhibit A: Form of Order Form

This Order Form is entered into under, and is governed by, the Master Services Agreement (the "Agreement") between Vrymnox Systems LLC, d/b/a Vrymdor, and the Customer named below.

Customer legal name: [NAME]

Customer address and notice email: [ADDRESS / EMAIL]

Order Form effective date: [DATE]

Services: [Control Plane (cloud) / Self-Hosted Software (containers and sidecars) / Central Guardian (Customer-deployed / Vrymnox-hosted shared / Vrymnox-operated dedicated instance)]

Plan: [Core Guard / Active Defense / Sovereign Vault (dedicated database) / AI Node Community / AI Node Pro / AI Node Business / AI Node Enterprise]

Usage Limits: [number] servers; [number] AI agents; compliance packs: [None / HIPAA / PCI]; log retention: [number] years; [number] NHI Seats; [number] Proxy Calls per [month]; [number] tenants

Overage rates: $[AMOUNT] per additional server per month; $[AMOUNT] per additional AI agent per month; $[AMOUNT] per 10,000 Proxy Calls

Authorized Environment: [Customer cloud accounts and regions / on-premises clusters / CI/CD systems]; air-gapped: [Yes / No]

White-Label Delivery: [No / Yes, for the following interfaces: [describe]]

Managed service or third-party use permitted: [No / Yes, as follows: [describe]]

Subscription Term: [twelve (12)] months beginning on [DATE]

Fees: $[AMOUNT] per [month / year], billed [in advance]; usage fees billed monthly in arrears

Payment terms: [Net 30 / card on file]

Optional Data Protection Cap (Section 20.3): [Does not apply / Applies; dollar amount under Section 20.3(b): $[AMOUNT]]

Special terms (each must identify the Section of the Agreement it modifies): [None]

VRYMNOX SYSTEMS LLC

By: ______________________________

Name: [NAME]

Title: [TITLE]

Date: ____________________________

[CUSTOMER NAME]

By: ______________________________

Name: [NAME]

Title: [TITLE]

Date: ____________________________

Exhibit B: Service Level Terms

1. Availability Commitment. Vrymnox will use commercially reasonable efforts to make the Control Plane Available at least 99.9% of the time in each calendar month ("Monthly Uptime"). "Available" means the Control Plane's Gateway Proxy endpoint and dashboard respond to properly formed requests, as measured by Vrymnox's monitoring. This Exhibit applies only to paid subscriptions to the Control Plane. It does not apply to Self-Hosted Software, a Customer-deployed Central Guardian, the Studio Pipeline or Studio Services, beta features, or free plans.

2. Exclusions. The following do not count as unavailability: (a) scheduled maintenance announced at least forty-eight (48) hours in advance, not to exceed four (4) hours per month; (b) emergency maintenance to address a security vulnerability; (c) traffic blocked by fail-closed operation under Section 7 of the Agreement, except where the block results from the Control Plane itself not being Available; (d) blocking caused by Customer's policies, hard caps, kill switches, expired or invalid credentials, Unapproved Configurations, or suspension under Section 14 of the Agreement; (e) failures or latency of large language models, MCP servers, or other Integrations; (f) problems with Customer's networks, Agents, or environment, or with the public internet; (g) force majeure events, including hosting provider outages outside Vrymnox's reasonable control; and (h) Customer's breach of the Agreement.

3. Service Credits. If Monthly Uptime falls below the commitment, Customer may request a credit against the next invoice for the affected Control Plane subscription fees for that month: 10% if Monthly Uptime is below 99.9% but at least 99.0%, and 25% if below 99.0%. Customer must request the credit within thirty (30) days after the end of the month. Credits for any month will not exceed 25% of that month's Control Plane subscription fees, have no cash value, and are Customer's sole and exclusive remedy for unavailability, except that if Monthly Uptime is below 95% in any two (2) consecutive months, Customer may terminate the affected Order on written notice and receive a refund of prepaid fees for the remainder of its Subscription Term.

4. Latency. Latency figures in the Documentation are targets and are not part of this commitment.