Effective October 1, 2026

These Pitchblack Customer Terms (these “Terms”) govern each Pitchblack Order Agreement between 3rd Stone Networks LLC, an Arizona limited liability company (“3SN”), and the customer named in it (“Customer”). 3SN offers the Pitchblack network perimeter security system, which combines inline hardware Appliances operating at Layer 2 in transparent, addressless mode, Embedded Firmware, and a cloud-hosted management console, together with deployment, onboarding, integration, and support services. These Terms apply only when an Order Agreement signed by both parties incorporates them by name and effective date. 3SN and Customer are each a “party.”

1. DEFINITIONS AND INTERPRETATION

Definitions. Capitalized terms have the meanings below or the meanings given where they are defined elsewhere in these Terms.

“Activation” means, for an Appliance, the earlier of (a) provisioning of the ordered SaaS Platform tier for that Appliance after its acceptance under Section 3.2, or (b) its first observation of live traffic at a Protected Site under Observation Approval, in each case as recorded in a written activation record that identifies the event, its date, and the confirming party. “Activation Date” means the date of Activation stated in that record.

“Agreement” means, for each Order Agreement, the Contract Documents that apply to it, read together.

“Allowlist” means the Customer-controlled list of sources or address ranges exempted from automated deny action.

“Appliance” means a Pitchblack hardware unit of a model identified in an Order Agreement, whether purchased or loaned, including a unit installed under an earlier pilot agreement that an Order Agreement purchases or continues on loan.

“Blocking Approval” means the Responsible Operator’s separate written approval, recorded in the Deployment Exhibit, for live blocking at an identified Protected Site under the documented enforcement configuration.

“Confidential Information” means nonpublic information disclosed by one party to the other in connection with the Agreement that is designated confidential or that a reasonable person would understand to be confidential, including nonpublic test results, security findings, pricing, Customer Data, and Pitchblack Technology.

“Contract Documents” means, for each Order Agreement, that signed agreement (including its Negotiated Terms), these Terms, and the signed SOWs, Data and Security Schedules, Deployment Exhibits, and any DPA that identify that agreement or the Protected Sites covered by it. The Onboarding Form is not a Contract Document.

“Customer Data” means data or content submitted, uploaded, observed, or transmitted by or on behalf of Customer through the System, including observed traffic metadata, on-box event records, customer-identifying telemetry and operational records, configuration, and support-accessible records, whether or not they constitute personal information. Customer Data excludes Pitchblack Technology.

“Data and Security Schedule” means the Pitchblack Data and Security Schedule signed by both parties, including its completed and technically verified Approved Data-Flow and Deployment Register.

“Deny Set” means the set of sources the System denies at the network perimeter.

“Deployment Exhibit” means the signed Pitchblack Deployment Exhibit, the site-specific deployment and enforcement plan for a Protected Site.

“DPA” means a data processing agreement signed by both parties that expressly references the Agreement and identifies its title, its version or date, and the processing it covers.

“Edge Node” means one licensed deployment instance comprising one Appliance and its associated SaaS Platform subscription. A Protected Site may have more than one Edge Node. Each Appliance, including a redundant, standby, or shared Appliance, becomes a licensed Edge Node on its Activation, unless the Order Agreement expressly states a different treatment for that Appliance.

“Embedded Firmware” means the firmware and software installed on or supplied for an Appliance.

“Evaluation Period” and “Conversion Date” have the meanings given in Section 8.5.

“Integration API” means the local management-plane interface of an Appliance that provides authorized status, event, and working Deny Set access through scoped keys for use by Customer’s security operations tools, such as SOC, SOAR, scripting, and internal agent tools.

“Negotiated Terms” means the changes to these Terms set out in the Negotiated Terms section of a signed Order Agreement.

“Observation Approval” means the Responsible Operator’s written approval, recorded in the Deployment Exhibit, for the System to observe live traffic within the documented scope.

“Onboarding Form” means the Pitchblack Onboarding Form that Customer completes after an Order Agreement is signed, as described in Section 2.7.

“Order Agreement” means a Pitchblack Order Agreement signed by both parties that incorporates these Terms and specifies the purchased or loaned Appliances, licensed Edge Nodes, selected products, fees, discounts, subscription term, and any Evaluation Period.

“Pitchblack Technology” means the nonpublic firmware (including Embedded Firmware), software, detection logic, rules, signatures, models, methods, architecture, documentation, configurations, updates, improvements, and related intellectual property of 3SN and its licensors. Pitchblack Technology excludes Customer Data and Customer’s title to the physical hardware of a purchased Appliance.

“Platform API” means the documented application programming interface of the SaaS Platform.

“Platform Base” means the undiscounted annual SaaS Platform subscription list charge for the licensed Edge Nodes under a particular Order Agreement, before any discount.

“Pricing Summary” means 3SN’s published Pitchblack Pricing Summary. The Pricing Summary is informational only and is not a Contract Document.

“Professional Services” means deployment, onboarding, configuration, integration, advisory, on-site, and other services 3SN performs under an Order Agreement or SOW, other than SaaS Platform access and support.

“Protected Site” means a Customer network perimeter location identified for the ordered Edge Nodes in the Onboarding Form or a Deployment Exhibit.

“Responsible Operator” means the Customer individual designated in the Deployment Exhibit with authority to grant Observation Approval and Blocking Approval.

“SaaS Platform” means the Pitchblack console and cloud services that manage the Appliances, the Allowlist, and the Deny Set for the authorized subscription, including applicable maintenance releases and security updates.

“Security Event” and “Subprocessor” have the meanings given in the Data and Security Schedule.

“SOW” means a statement of work for Professional Services signed by both parties.

“System” means the Appliances, SaaS Platform, Embedded Firmware, documentation, Integration API, and Platform API supplied under an Order Agreement.

“Terms” means these Pitchblack Customer Terms, including Schedule 1, in the version identified in the applicable Order Agreement or applied under Section 2.6.

1.2 Interpretation. Headings are for convenience only and do not affect interpretation. “Including” and similar terms mean including without limitation. “Days” means calendar days unless business days are specified, and “business days” excludes Saturdays, Sundays, and U.S. federal holidays. References to Sections and Schedules are to these Terms unless stated otherwise. The singular includes the plural and the reverse. No provision will be construed against a party because that party drafted it.

2. ORDERS AND SCOPE

2.1 Order Agreements. These Terms govern only Order Agreements and SOWs signed by both parties. Each Order Agreement incorporates these Terms in the version it identifies and becomes binding only when signed by both parties. Customer purchases only the Appliances, subscriptions, and services expressly identified in a signed Order Agreement or SOW. Prices and scope in a signed Order Agreement do not change because 3SN later changes its price list. A quote or the Pricing Summary does not by itself create a subscription.

2.2 Quote Validity.

Pricing in an Order Agreement remains valid through the quote expiration date stated in it. If Customer signs an Order Agreement after that date, the Order Agreement becomes binding only when 3SN reconfirms its pricing in writing.

2.3 Order Agreement Content. Each Order Agreement will identify the Appliances by model and quantity and whether each is purchased or loaned; the licensed Edge Nodes and SaaS Platform tier; any selected modules and support tier; any Evaluation Period; the start trigger, initial term, and renewal price or formula; fees, invoicing, and taxes; and an itemized first-period and renewal total. Operational details are recorded during onboarding under Section 2.7. A blank field in an Order Agreement does not create a charge, commitment, start trigger, renewal price, or permission to deploy.

2.4 Changes in Scope; Authorized Use. Edge Nodes, features, or managed operations beyond those ordered require a signed amendment or a new Order Agreement. Protected Sites for the ordered Edge Nodes are identified during onboarding. Customer may permit its personnel and contractors to use the System solely for Customer’s internal security operations at the Protected Sites, subject to Section 11.

2.5 Statements of Work. Each SOW will identify deliverables, responsibilities, fees, timetable, and an acceptance process. Work outside an SOW’s scope requires written approval that identifies the additional fees. Unless an applicable SOW expressly provides otherwise, Customer directs its own security decisions, and 3SN does not operate Customer’s Allowlist or Deny Set as a managed service.

2.6 Versions and Updates. Each version of these Terms is identified by its effective date, and 3SN will not issue two versions with the same effective date. Each Order Agreement identifies the version of these Terms by that date. 3SN will deliver a copy of that version with the Order Agreement and will provide another copy on request. If 3SN posts a version online, the posted copy of that version will not change. That version applies for the current term. 3SN may publish an updated version, which applies to an Order Agreement only from the start of its next renewal term, and only if 3SN gives Customer written notice of the update, with a copy or a link, at least 120 days before the current term ends. If Customer does not accept the update, Customer may give notice of nonrenewal under Section 8.2. No update applies retroactively, and Negotiated Terms continue to apply over an updated version unless the parties agree otherwise in writing.

2.7 Onboarding. After an Order Agreement is signed, Customer will complete the Onboarding Form, which records contacts, delivery locations, Protected Sites, scheduling, and site prerequisites. 3SN may rely on the information in the Onboarding Form, and Customer will promptly update it in writing, including by email to its 3SN onboarding contact, if that information changes. The Onboarding Form records operational information only. It cannot change price, quantity, term, start trigger, Negotiated Terms, or any provision of these Terms. The Data and Security Schedule and each Deployment Exhibit are signed during onboarding, before live observation, under Section 5.2.

3. APPLIANCES; DELIVERY AND ACCEPTANCE

3.1 Sale, Loan, Title, and Risk of Loss. The Order Agreement will state the model and quantity of each Appliance, whether it is purchased or loaned, and any shipping charges. 3SN will schedule delivery with Customer during onboarding and will provide the dated hardware specification for the delivered model and revision with the shipment. Title to a purchased Appliance passes to Customer upon full payment of its purchase price, and risk of loss passes on delivery to the location stated in the Onboarding Form. Title to a purchased Appliance does not include title to the Embedded Firmware, which is licensed under Section 4.1. 3SN retains title to loaned Appliances. Customer bears the risk of loss of or damage to a loaned Appliance after delivery, except for ordinary wear and damage caused by 3SN. Customer will return a loaned Appliance within 30 days after the applicable loan ends unless a signed Order Agreement purchases it or expressly continues the loan.

3.2 Acceptance. Customer will inspect each Appliance after installation and notify 3SN of any material nonconformity with the dated hardware specification within 10 business days. Absent timely notice, the Appliance is accepted at the end of that period. If installation is delayed for reasons not caused by 3SN or by a material nonconformity of the Appliance, acceptance occurs in two steps unless the Order Agreement states otherwise: (a) criteria that can be checked without installation, such as physical condition, model, revision, and included components, are inspected within 10 business days beginning 30 days after delivery; and (b) criteria that require installation are reviewed within 10 business days after installation. Absent timely notice at each step, the criteria for that step are accepted. Acceptance is complete when both steps are complete, and the warranty period in Section 13.1 runs from completed acceptance. Acceptance does not waive the hardware warranty in Section 13.1, and 3SN will address timely notified nonconformities under Section 13. Acceptance of hardware is not Observation Approval, Blocking Approval, or confirmation that a subscription has begun. A three-year refresh cycle mentioned in sales materials or the Pricing Summary is not a replacement commitment or an included benefit unless the Order Agreement expressly states it.

3.3 Site Readiness. Customer will provide suitable power, rack space, cooling, connectivity, access, personnel, and the site permissions identified in the signed Deployment Exhibit. Changes to network routing, monitoring scope, or operating configuration are subject to that Exhibit. Installation alone is neither Observation Approval nor Blocking Approval.

4. SAAS PLATFORM; LICENSES; UPDATES; EXPORT

4.1 License Grant. Subject to the Agreement, and without any right to source code or nonpublic detection methods:

(a) Subscription Rights. During the applicable subscription term, 3SN grants Customer a limited, nonexclusive, nontransferable, nonsublicensable right to access and use the SaaS Platform, Platform API, and Integration API solely for the licensed Edge Nodes, the Protected Sites, the users permitted by Section 2.4, and the purposes stated in the Agreement.

(b) Embedded Firmware. 3SN grants Customer a limited, nonexclusive, nontransferable, nonsublicensable license to use the Embedded Firmware in object code form solely to operate each Appliance as part of the System. For a purchased Appliance, the license to the Embedded Firmware necessary to operate that Appliance in its purchased configuration continues for as long as Customer owns it, subject to the restrictions in the Agreement, and ends if Customer transfers the Appliance unless 3SN consents in writing to the transfer of the license. For a loaned Appliance, the license ends when the loan ends, and Customer will return the Appliance under Section 3.1.

(c) Subscription-Dependent Functions. SaaS Platform access, console changes, Integration API access, support, updates, and other cloud-dependent features are available only during the applicable subscription term, including an Evaluation Period under Section 8.5, except for the export assistance in Section 4.4. After that term ends, a purchased Appliance operates, unsupported, only as documented for its installed Embedded Firmware and last approved configuration, including its last approved Deny Set and fail behavior, and 3SN does not warrant its continued operation. 3SN has no obligation to provide the subscription-dependent functions after the term, and their unavailability is not a breach of warranty or of the Agreement. On request, 3SN will provide its standard decommissioning instructions, and Customer is responsible for securely decommissioning, bypassing, or reconfiguring the Appliance.

(d) Credentials. Customer is responsible for securing its Platform API and Integration API keys, console credentials, and list controls, and for activity conducted under them, except to the extent caused by 3SN’s breach of the Agreement.

4.2 Availability. 3SN will make the SaaS Platform available at least 99.5% of each measured month, measured under Schedule 1, including its separate, limited exclusions for qualifying scheduled and emergency maintenance. Maintenance outside those exclusions counts as unavailable time under Schedule 1. Availability credits under Schedule 1 are Customer’s sole remedy for a measured availability shortfall, without limiting a remedy expressly available for a different breach. Any Order Agreement-specific availability terms must be stated in Negotiated Terms.

4.3 Updates; Security Suspension. 3SN may issue SaaS Platform maintenance releases and Embedded Firmware security updates. Customer will install, or permit installation of, a required firmware security update within 30 days after a 3SN security bulletin so directs, subject to an agreed maintenance window or emergency response plan. 3SN is not responsible for a nonconformity or Security Event to the extent caused by Customer’s failure to install a required security update within that period. 3SN may suspend affected access to address an imminent security threat or to comply with law. 3SN will give reasonable advance notice where practicable, limit the suspension to the affected portion of the System, promptly explain the basis, and restore access when the condition is resolved. Section 7.5 applies to any suspension.

4.4 Data Export. For 30 days after expiration or termination of a subscription, Customer may export available telemetry, event, and configuration data in the format and manner stated in the Data and Security Schedule, subject to legal retention and security restrictions. 3SN will provide reasonable export assistance during that period using the export method recorded in the Data and Security Schedule register, even though other support has ended. After the 30-day export period, 3SN will delete remaining Customer Data in accordance with Section 4.2 of the Data and Security Schedule and the approved register, including their provisions for backup cycles and documented legal preservation. Termination does not transfer Pitchblack Technology or extend the subscription rights in Section 4.1(a).

5. ALLOWLIST, DENY SET, AND DEPLOYMENT

5.1 Operational Authority. Customer’s designated security operators recorded in Part 6 of the Deployment Exhibit approve Allowlist entries, Deny Set promotions, reversals, and emergency exceptions. 3SN may recommend entries but will not direct Allowlist or Deny Set operations without a signed managed-services SOW that specifies authority and escalation. For each Protected Site, Part 6 records the authorized operators, the audit log location, the decision threshold for automated deny, the Deny Set expiration or review rule, the review interval, the treatment of HTTP and HTTPS traffic, published services, and payment processors, the test process before changes, false-positive escalation, and emergency reversal. Each change, actor, time, reason, review status, and reversal will be recorded in the audit log location. An uncompleted setting will not be applied as a default traffic policy at a live Protected Site. A promoted Deny Set entry remains until reversed and does not expire automatically unless Part 6 states an expiration rule; a review rule requires review but does not by itself expire an entry. Changes that alter live blocking must also satisfy the approval requirements of the Deployment Exhibit. The System is an aid to defense. It does not guarantee protection against intrusion, denial errors, or business interruption.

5.2 Observation and Blocking Approvals. Before the System observes live traffic at a Protected Site, the parties must sign the Data and Security Schedule and the applicable Deployment Exhibit, the register in the Data and Security Schedule must be technically verified for the deployed build, and the Responsible Operator must grant Observation Approval. Before live blocking, the Responsible Operator must separately grant Blocking Approval for the site, traffic path, configuration, enforcement mode, fail behavior, bypass, rollback method, and activation time recorded in the Deployment Exhibit. Neither installation nor observation is Blocking Approval. A Protected Site will not enter or materially change enforcement until the required Blocking Approval and passing bypass and rollback tests have been recorded.

5.3 Customer Control and Escalation. Customer retains control of its network design, approved operating mode, Allowlist, Deny Set, and business-continuity procedures. Each party will promptly escalate a suspected false positive, unsafe condition, or outage under the Deployment Exhibit, and designated operators may invoke the agreed bypass or rollback. 3SN will not represent a fail-open, fail-closed, or cloud-disconnection behavior different from the approved and tested configuration.

5.4 Changes to Deployment. A material change to a Protected Site, traffic path, enforcement mode, or failure behavior requires an updated Deployment Exhibit and renewed Blocking Approval for the affected Protected Site before the change takes effect. Neither party may use a changed build, configuration, integration, or support workflow to expand observed fields, cloud transfers, or access beyond the approved register without a signed amendment to the Data and Security Schedule.

6. PROFESSIONAL SERVICES AND SUPPORT

6.1 Deployment and Onboarding Package. Remote configuration, activation assistance, and baseline tuning included in an Order Agreement’s deployment and onboarding package are covered by the separately itemized deployment fee, if one is charged. “Included” does not mean free in addition to that fee. The standard package covers the ordered Edge Nodes at the Protected Sites identified during onboarding. Other deliverables, and acceptance criteria for them, require an SOW. On-site work, moves, additional Protected Sites or Edge Nodes, and out-of-scope work require an approved SOW or written change order identifying scope, price, schedule, and acceptance. Replacement of defective units remains governed by Section 13 and is not automatically a chargeable SOW service.

6.2 Support. The Order Agreement selects the support tier. 3SN’s support description for that tier, delivered with the Order Agreement, defines the tier’s hours, time zone, channels, severity levels, initial-response targets, and escalation. An initial-response target is not a repair, restoration, or security-outcome guarantee. 3SN will provide the selected support in a professional and workmanlike manner.

6.3 Acceptance of Milestones and Deliverables. For each deliverable or deployment milestone that triggers payment, the Order Agreement or SOW will state the deliverable, objective acceptance criteria, delivery evidence, review period, and correction period. Unless the Order Agreement or SOW states otherwise:

(a) Review. Customer will review a delivered item within 10 business days after 3SN provides the stated delivery evidence.

(b) Rejection. Customer may reject the item only by written notice, given within that review period, that identifies each listed acceptance criterion the item does not meet.

(c) Correction. 3SN will correct the identified nonconformity and resubmit the item within 15 business days after a valid rejection notice, and the review process will then repeat for the corrected item.

(d) Deemed Acceptance. An item is accepted when Customer confirms acceptance in writing, or at the end of the review period if Customer has not given a valid rejection notice, consistent with Section 3.2.

6.4 Customer Cooperation. Customer will give 3SN reasonable access, information, personnel, and test environments needed to perform Professional Services. 3SN is not responsible for a delay to the extent caused by Customer’s failure to meet its obligations or the prerequisites identified in the Order Agreement, SOW, or Deployment Exhibit, and affected dates will be extended accordingly.

6.5 Personnel. 3SN will perform Professional Services with qualified personnel. While on Customer premises or connected to Customer systems, 3SN personnel will follow Customer’s reasonable security and site policies that Customer provides to 3SN in writing in advance.

7. FEES, DISCOUNTS, PAYMENT, AND TAXES

7.1 Fees. Customer will pay the itemized fees in signed Order Agreements and SOWs. The SaaS Platform subscription is billed per licensed Edge Node unless the Order Agreement expressly states another metric. Appliances, deployment, compliance modules, extended warranties, separately priced support, Professional Services, shipping, on-site work, and taxes are not part of the Platform Base and receive no percentage discount unless the signed Order Agreement expressly states otherwise.

7.2 Discounts. Discounts apply only as stated in the signed Order Agreement and, unless it expressly states otherwise, only to the Platform Base. No other discount is implied from a quote, a prior order, or the Pricing Summary. Edge Nodes added to an Order Agreement during its term are priced at that Order Agreement’s per-Edge Node rate and discount, are prorated to the end of its current term, and end with that term. Unless the Order Agreement states otherwise, charges for a period other than 12 months, including a nonannual first period, are prorated daily from the annualized charge using a 365-day year. Renewals are priced under Section 8.2. No quote, illustration, or Pricing Summary supersedes the signed Order Agreement.

7.3 Invoicing and Payment. Invoices are due 30 days after the invoice date. Undisputed late amounts accrue interest at the lesser of 1.5% per month or the maximum lawful rate. Customer will notify 3SN of a good-faith invoice dispute, with reasonable supporting detail, before the due date and will pay the undisputed portion when due. The parties will work in good faith to resolve a disputed amount within 30 days after notice.

7.4 Suspension for Nonpayment. If an undisputed amount remains unpaid 15 days after 3SN gives written notice of nonpayment, 3SN may suspend SaaS Platform access and support until payment is received. Suspension does not extend the term or discharge payment obligations.

7.5 Protections During Suspension. A suspension under Section 4.3 or Section 7.4 does not, by itself, authorize a change to an Appliance’s last approved Deny Set, enforcement mode, or fail behavior, and Appliance behavior during the suspension is governed by the configuration documented and tested in the applicable Deployment Exhibit. During the suspension, Customer may export data using the export method recorded in the Data and Security Schedule register, and 3SN will provide emergency security support for active Security Events through the emergency procedure in the applicable Deployment Exhibit. A suspension does not authorize blocking outside the Deployment Exhibit or degradation of protections without notice to Customer. This Section does not prevent a change that is required to address the imminent security threat underlying a suspension under Section 4.3, if the change is made under the emergency procedure in the Deployment Exhibit.

7.6 Taxes. Fees exclude applicable taxes. Customer will pay applicable sales, use, value-added, and similar transaction taxes, other than taxes on 3SN’s net income, or will furnish a valid exemption certificate. Taxes and approved pass-through costs will be itemized separately on invoices.

7.7 Credits and Expenses. Unless the Order Agreement states otherwise, credits, including credits preserved by Section 8.1(d) and approved service credits, apply against the next invoices for fees under the same Order Agreement in the order earned and do not apply against taxes or pass-through costs. A credit balance that remains unapplied when the Order Agreement ends will be refunded to Customer within 30 days. Customer will reimburse out-of-pocket expenses only if they are identified as approved pass-through costs in the Order Agreement or SOW or approved by Customer in writing in advance, and only to the extent they are reasonable and documented.

8. TERM, RENEWAL, AND TERMINATION

8.1 Term; Subscription Start; Pilots.

(a) Agreement Term. Each Agreement begins when its Order Agreement is signed by both parties and continues while that agreement or a related SOW remains in force, unless terminated earlier under this Section 8.

(b) Order Agreement Term. Each Order Agreement has the initial term and start trigger it specifies. Absent a different signed term, the initial term is 12 months.

(c) Subscription Start. If the Order Agreement includes an Evaluation Period, the subscription term begins on the Conversion Date under Section 8.5. Otherwise, unless the Order Agreement expressly selects a fixed start date, the subscription term begins on the first Activation Date under the Order Agreement, and recurring fees for each Edge Node begin on its Activation Date, prorated under Section 7.2. Edge Nodes activated after the first Activation Date end with the Order Agreement’s subscription term and do not receive a separate full term. If Activation of an ordered Edge Node is delayed because Customer has not met a prerequisite identified in the Order Agreement, SOW, Onboarding Form, or Deployment Exhibit, and the delay continues for more than 30 days after 3SN gives written notice identifying the unmet prerequisite, the end of that period is the deemed Activation Date for that Edge Node for purposes of the Evaluation Period, the subscription term, and recurring fees, unless the Order Agreement states a different treatment. A deemed Activation Date does not authorize observation or blocking.

(d) Pilots. A credit earned under an earlier signed Pitchblack pilot agreement, including one signed by 3SN’s parent, 3rd Stone Networks Holding, Inc., applies under the Order Agreement that follows it. Omission of an earned credit from the Order Agreement does not extinguish it absent an express written waiver signed by both parties. If an Order Agreement purchases or continues the loan of an appliance installed under an earlier pilot agreement, the Onboarding Form will identify it by serial number, its Activation occurs only when recorded in a new activation record, and earlier pilot use does not count toward the subscription term.

8.2 Renewal. Unless an Order Agreement states otherwise, each subscription renews for successive terms equal to its initial term unless either party gives written notice of nonrenewal under Section 19.3 at least 90 days before the current term ends. Renewal pricing is the renewal price or formula stated in the Order Agreement. If none is stated, renewal pricing is 3SN’s then-current list price for the same configuration at renewal, without discount. Unless the Order Agreement states a fixed renewal price, 3SN will give Customer written notice of the renewal price at least 120 days before the current term ends. If 3SN does not give that notice, the renewal term is priced at the recurring charges in effect for the expiring term.

8.3 Termination for Cause. Either party may terminate the affected Order Agreement for the other party’s material breach that remains uncured 30 days after written notice describing it. A party may terminate immediately on written notice for a material breach that is incapable of cure, subject to applicable law. 3SN may suspend or terminate the affected service where continued performance is unlawful or presents an imminent security threat under Section 4.3.

8.4 Effect of Termination.

(a) Accrued Obligations. Termination does not relieve either party of obligations accrued before termination, including Customer’s obligation to pay fees for services provided through the effective date of termination.

(b) Refunds. If Customer terminates an Order Agreement under Section 8.3 for 3SN’s uncured material breach, or under Section 9.5 or Section 17, 3SN will refund prepaid fees for the terminated services attributable to the period after termination.

(c) Confidential Information. Each party will return or destroy the other party’s Confidential Information, subject to the export, retention, and deletion rules of the Data and Security Schedule and, for information other than Customer Data, lawful archival retention.

(d) Appliances. Customer will return loaned Appliances under Section 3.1. Purchased Appliances remain Customer’s property, and the Embedded Firmware license for them continues as provided in Section 4.1(b).

(e) Data Export. Customer may export data under Section 4.4.

8.5 Pilot Agreements.

Evaluation Period. If the Order Agreement includes an Evaluation Period, the following applies:

(a) Use at No Charge. The Evaluation Period begins on the first Activation Date, including a deemed Activation Date under Section 8.1(c), and lasts for the number of days stated in the Order Agreement, not to exceed 30. During it, Customer may use the ordered System at no charge to evaluate it for Customer’s internal security operations. Every Appliance is loaned during the Evaluation Period. All other provisions of the Agreement apply, including Sections 5, 9, 11, and 12 and the Data and Security Schedule, except that Schedule 1 credits do not apply.

(b) Conversion. Unless Customer cancels under Section 8.5(c), the subscription term begins on the day after the Evaluation Period ends (the “Conversion Date”). Recurring fees for each Edge Node activated before the Conversion Date begin on the Conversion Date, and recurring fees for each later Edge Node begin on its Activation Date. Appliances the Order Agreement lists as purchased are sold on the Conversion Date, and one-time fees are invoiced on the Conversion Date, unless the Order Agreement states otherwise.

(c) Cancellation. Customer may cancel the Order Agreement by written notice, including by email to the 3SN cancellation address stated in the Order Agreement, received before the Evaluation Period ends. Cancellation takes effect on the date stated in the notice, but no later than the last day of the Evaluation Period. On cancellation, no fees are owed under the Order Agreement, except fees under an SOW that Customer signed separately. Customer will return every Appliance within 30 days after cancellation, using return shipping that 3SN provides at its cost, and bears the risk of loss or damage under Section 3.1 until 3SN receives it. Data export and deletion follow Section 4.4.

(d) Liability. For claims arising from events during an Evaluation Period that ends in cancellation, the Fee Measure in Section 14.2 is $50,000.

(e) Extension. The parties may extend the Evaluation Period by written agreement, which may be made by email between authorized representatives.

9. DATA, SECURITY, AND INCIDENT RESPONSE

9.1 Customer Data. Customer owns Customer Data. Customer grants 3SN only the rights necessary to provide, secure, maintain, and support the ordered System and to make the narrowly defined improvement uses permitted by the executed Data and Security Schedule. The Data and Security Schedule, rather than any unincorporated privacy policy, controls observed fields, payload or decryption capability, telemetry, support access, retention, Subprocessors, safeguards, Security Events, and improvement uses. No live-traffic observation is permitted until the Data and Security Schedule is signed and its register has been technically verified for the deployed build. 3SN will not sell or share Customer Data, disclose it to an unapproved recipient, or use it for advertising, model training, or another purpose, except as the Data and Security Schedule expressly permits or Customer consents in writing.

9.2 Security Event Notice. 3SN will notify Customer through the registered 24-hour security channel without undue delay, and no later than 72 hours after 3SN becomes aware of facts reasonably indicating a suspected Security Event, or within any shorter period that applicable law requires of 3SN. The initial notice will include the information then reasonably known, and 3SN will update it as the investigation proceeds. Incomplete facts do not delay initial notice. Investigation updates, reports, and external-notification responsibilities are governed by the Data and Security Schedule. Notification does not by itself establish that a breach occurred or that 3SN is at fault.

9.3 Customer Monitoring Authority. Customer will expose to the System only networks and systems it controls or is authorized to monitor. Customer will identify permitted observation and any third-party systems in the Deployment Exhibit and the Data and Security Schedule, and will obtain and maintain the notices, consents, and permissions its deployment requires, including under the federal Wiretap Act (18 U.S.C. § 2510 et seq.), the Stored Communications Act (18 U.S.C. § 2701 et seq.), and comparable state laws. Customer’s signature is not, by itself, consent from every party to a communication. Neither party may exceed its actual authority over stored communications, remote support, or integrations, and each party remains responsible for its own legal compliance.

9.4 Safeguards. 3SN will maintain administrative, technical, and physical safeguards appropriate to the approved data flows, as further described in the Data and Security Schedule. At a minimum, 3SN will encrypt Customer Data using TLS 1.2 or later in transit and AES-256 at rest for the links and stores identified in the safeguard record of the Data and Security Schedule. An exception requires a documented compensating control that Customer accepts in writing. 3SN does not represent that any SOC 2 or other assurance report exists or covers a deployment. If an assurance report whose system description covers the services used for Customer’s deployment comes into existence, 3SN will provide it to Customer on request under reasonable confidentiality terms.

9.5 Subprocessors. 3SN will give Customer 30 days’ advance written notice before a new Subprocessor gains access to Customer Data and remains responsible for each Subprocessor’s performance. Customer may object on reasonable, material security grounds as provided in the Data and Security Schedule. If an objection remains unresolved after the good-faith consultation period stated there, Customer may terminate the affected service by written notice within the termination window stated there and will receive a refund of prepaid fees for that service attributable to the period after termination. This remedy does not limit a claim for a separate breach.

9.6 Personal Information; DPA. If Customer Data will include personal information subject to the California Consumer Privacy Act or a comparable U.S. state privacy law, 3SN will process it as Customer’s service provider or processor. Before the System observes that personal information, the parties will sign a DPA that includes the contract terms those laws require, including the terms required by Cal. Code Regs. tit. 11, § 7051(a). The DPA will identify its title, its version or date, and the processing it covers, and will state which of its terms control over the Data and Security Schedule.

9.7 Retention and Deletion. Retention periods and deletion schedules for active data, replicas, backups, and support logs are recorded in the Data and Security Schedule register. No unlisted copy may be retained beyond the stated period except under a documented legal preservation obligation. On Customer’s written request, 3SN will provide a standard certificate of deletion without additional charge. Nonstandard deletion assistance or bespoke certification is chargeable only if Customer approves its scope and fee in writing in advance.

10. COMPLIANCE AND PRODUCT CLEARANCE

10.1 Compliance with Laws; Export. Each party will comply with the laws that apply to its performance and its use of the System, including applicable export control, sanctions, and anti-corruption laws. Each party represents that it is not a person with whom U.S. persons are prohibited from dealing under U.S. sanctions or export control laws. Customer will not provide access to the System to a prohibited destination or person and will supply reasonably necessary destination and end-user information. Neither party represents that an export classification, certification, or government authorization has been obtained unless 3SN confirms it in writing with supporting release approval. Signing an Order Agreement is not evidence of export clearance.

10.2 FCC and Product Compliance. 3SN will not market (as 47 C.F.R. § 2.803 defines that term), sign an Order Agreement for, loan, ship, or place in operation an Appliance model and revision that requires FCC equipment authorization until the applicable authorization has been completed and verified. 3SN will not describe an Appliance as “FCC approved” or “FCC certified.” 3SN will record the actual authorization procedure, whether Supplier’s Declaration of Conformity or certification, and any FCC ID, for each delivered model and revision, and will provide that record on request. If 3SN cannot lawfully deliver an ordered Appliance by the scheduled delivery date for a reason relating to equipment authorization, 3SN may withhold delivery. Customer may then cancel the affected Appliance line and receive a refund of amounts prepaid for that undelivered Appliance and for the SaaS Platform subscription, deployment, compliance module, and shipping charges attributable to it. If the remaining ordered Appliances and services cannot reasonably serve their ordered purpose without the undelivered Appliance, Customer may instead cancel the entire affected Order Agreement, return any Appliances delivered under it, and receive a refund of all amounts prepaid under it. These are Customer’s sole and exclusive remedies for a delivery failure relating to equipment authorization. An Evaluation Period is not an exception to this release condition. Signing an Order Agreement is not evidence of authorization.

10.3 No Unsupported Claims. Neither party will claim that the System guarantees prevention of intrusions, a measured false-positive rate, a certification, or a customer’s regulatory compliance. Customer is responsible for its own regulated operations, and a compliance module supplies only the functions stated in its signed description.

10.4 U.S. Government End Users. The SaaS Platform, Embedded Firmware, and related documentation are commercial products and commercial computer software as those terms are used in FAR 2.101 and 12.212 and DFARS 227.7202. If Customer is, or acts on behalf of, an agency of the U.S. Government, the Government acquires only the rights stated in the Agreement.

11. OWNERSHIP AND RESTRICTED USE

11.1 Ownership. 3SN and its licensors retain all rights in Pitchblack Technology, including modifications, updates, improvements, and derivative works. Customer retains ownership of Customer Data and, upon full payment, title to the physical hardware of a purchased Appliance. 3SN owns the work product it creates in performing Professional Services, including integrations, scripts, and configuration templates, excluding Customer Data, Customer’s configurations of its own systems, and materials Customer provides or owned before the work. Customer may use that work product with the System during the applicable subscription term. 3SN will maintain customer-specific work product only as an SOW states. No rights are granted by implication.

11.2 Restrictions. Customer will not, and will not permit any person to: (a) copy or extract firmware, source code, detection rules, models, or nonpublic architecture; (b) reverse engineer the System; (c) bypass technical access controls; (d) use nonpublic access or output to build or improve a competing product; or (e) give a direct competitor of 3SN or an outside evaluator access to the System without 3SN’s prior written consent, except in each case to the extent a restriction is prohibited by nonwaivable law. 3SN will not unreasonably withhold consent for a controlled evaluation under written confidentiality and security terms. These restrictions do not prohibit need-to-know access by Customer’s employees, professional advisers, auditors, insurers, regulators, or prospective financing or acquisition counterparties who are bound by confidentiality obligations, provided they receive no 3SN source code or restricted technical materials. Customer will confine access to persons who need it for authorized use and are bound by confidentiality obligations, and is responsible for their acts and omissions.

11.3 Test Results, Security Findings, and Feedback. Neither party will publish the other party’s nonpublic test results or security findings without prior written consent, except as required by law. The parties will report and coordinate security findings through the coordinated vulnerability-disclosure channel recorded in the Data and Security Schedule. Customer may offer feedback, which 3SN may use without obligation. Feedback does not waive the confidentiality of Customer Data, nonpublic test results, pricing, or Pitchblack Technology.

11.4 Publicity. Neither party will use the other party’s name, logos, or trademarks in publicity, marketing materials, or customer lists without the other party’s prior written consent, except as required by law.

12. CONFIDENTIALITY

12.1 Obligations. Each party, as recipient, will use the other party’s Confidential Information only to perform or receive performance under the Agreement, will restrict access to persons who need to know it and are bound by confidentiality duties at least as protective as this Section, and will protect it with at least reasonable care and no less than the care it uses for its own similar information. These duties do not apply to information that the recipient establishes was publicly available without breach of the Agreement, was already known to it without a duty of confidence, was independently developed without use of the information, or was lawfully obtained from a source without a duty of confidence.

12.2 Compelled Disclosure; Duration. A recipient may disclose Confidential Information to the extent legally compelled, after giving notice where legally permitted and providing reasonable cooperation, at the discloser’s expense, in seeking protective treatment. Confidentiality duties survive termination for three years. For information that qualifies as a trade secret, they continue for as long as the information remains a trade secret. Restrictions on the use of Pitchblack Technology and the parties’ ownership rights survive independently.

13. WARRANTIES, REMEDIES, AND DISCLAIMERS

13.1 Hardware Warranty. For 12 months after acceptance, 3SN warrants that each purchased Appliance will materially conform to the dated hardware specification provided for it under Section 3.1. Customer must give reasonably detailed notice of a nonconformity during that period. 3SN will, at its expense and option, repair or replace the affected unit, including reasonable shipping for the repaired or replacement unit. If 3SN cannot cure the material nonconformity within 30 days after notice, Customer may return the affected unit for a refund of its purchase price. Repair, replacement, or, if cure fails, refund is the exclusive contractual remedy for breach of this hardware warranty, subject to remedies that cannot lawfully be excluded. Descriptions and specifications expressly made part of the bargain are not negated by this Section. An extended hardware warranty purchased under an Order Agreement extends this warranty on the coverage terms stated there.

13.2 SaaS Platform and Services Warranty. 3SN warrants that the SaaS Platform will materially perform as described in the Agreement, subject to Schedule 1, and that Professional Services will be performed in a professional and workmanlike manner. After Customer’s notice, 3SN will use a reasonable period to correct a material nonconformity or reperform nonconforming services. If 3SN cannot do so, Customer may terminate the affected service and receive a refund of unused prepaid fees allocable to it. Schedule 1 governs availability shortfalls.

13.3 Malicious Code. 3SN will use commercially reasonable measures, consistent with industry practice, designed to prevent the System as delivered by 3SN from containing viruses, ransomware, or other malicious code. This commitment does not apply to threat signatures, test patterns, or similar materials the System uses to detect threats.

13.4 Authority and Customer Warranties. Each party warrants that it has authority to enter into the Agreement. Customer warrants that it has authority to deploy the System at the approved Protected Sites and will maintain its Allowlist and Deny Set as required by Section 5.1. Neither party will make a promise on the other party’s behalf that is not in a signed agreement.

13.5 Disclaimers. The System assists Customer’s security personnel. It does not guarantee detection or prevention, or any measured detection or false-positive outcome, and no marketing claim of a measured false-positive rate is incorporated into the Agreement. EXCEPT FOR THE EXPRESS WARRANTIES IN THE AGREEMENT AND EXPRESS DESCRIPTIONS INCORPORATED INTO A SIGNED ORDER AGREEMENT, AND TO THE EXTENT PERMITTED BY LAW, 3SN DISCLAIMS THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND ALL OTHER IMPLIED WARRANTIES. This disclaimer does not negate an express warranty that cannot reasonably be reconciled with it.

14. LIMITATION OF LIABILITY

14.1 Exclusion of Certain Damages. To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or punitive damages, including lost profits, lost data, lost business, or business interruption, arising from the Agreement, the System, or any Deny Set or Allowlist action or omission. This Section 14.1 does not exclude reasonable, documented costs to investigate, contain, remediate, restore, or recover Customer Data following a Security Event, which are subject to the Data Cap in Section 14.3.

14.2 General Cap. Except as provided in Sections 14.3 and 14.4, each party’s aggregate liability for direct damages arising from or relating to the Agreement is limited to the greater of (a) the fees paid or payable by Customer under all Order Agreements during the 12 months preceding the event giving rise to the claim, or (b) the fees payable for the first 12 months of the affected Order Agreement (the greater amount, the “Fee Measure”), not to exceed $1,000,000 (the “General Cap”). For claims arising during an Evaluation Period, Section 8.5(d) applies.

14.3 Data Cap. 3SN’s aggregate liability for all claims arising from Security Events, breach of the Data and Security Schedule, or breach of Section 12 involving Customer Data is limited to two times the Fee Measure, not to exceed $2,000,000 (the “Data Cap”). The Data Cap is the exclusive cap for those claims, applies in place of the General Cap, and is not cumulative with it.

14.4 Exclusions from Caps. The General Cap and the Data Cap do not apply to: (a) Customer’s obligation to pay fees actually due; (b) a party’s fraud, willful misconduct, or willful unlawful acts, or regulatory fines or penalties that a party is required to pay due to its own willful misconduct; (c) breach of Section 12 not involving Customer Data; (d) Customer’s misuse of 3SN intellectual property or breach of Section 11.2; or (e) Customer’s responsibility for loss of loaned equipment under Section 3.1. Defense costs, amounts paid under Section 15, and the incident-response costs described in Section 14.1 count toward the applicable cap. All claims arising from the same or related events are subject to a single cap, measured as of the first such event. The caps apply in the aggregate to all Agreements between the parties under these Terms, not separately to each Order Agreement. Nothing in the Agreement limits liability that cannot lawfully be limited.

14.5 Allocation of Risk. These limits reflect an allocation of risk on which the fees are based and apply regardless of the form of claim, whether in contract, tort, or otherwise. Nothing in this Section 14 limits the return of property, payment of amounts due, or available equitable relief to protect Confidential Information or Pitchblack Technology.

15. THIRD-PARTY CLAIMS AND INSURANCE

15.1 Indemnification by Customer. Customer will defend, indemnify, and hold harmless 3SN against third-party claims to the extent they allege that Customer Data or other content provided by or for Customer infringes or violates a third party’s rights or applicable law, or to the extent they arise from Customer’s unauthorized monitoring, Customer’s misuse of the System, or Customer’s violation of law. Customer has no obligation under this Section 15.1 for claims arising from ordinary authorized use in accordance with the Agreement, or to the extent a claim is caused by 3SN’s breach of the Agreement, negligence, willful misconduct, unauthorized processing of Customer Data, or violation of law. If both parties’ acts contributed to a claim, each party’s responsibility is allocated in proportion to its contribution.

15.2 Indemnification by 3SN. 3SN will defend, indemnify, and hold harmless Customer against third-party claims that unmodified, authorized use of the System infringes a third party’s intellectual property rights. This obligation does not apply to a claim caused by Customer modifications, combinations with items not supplied or approved by 3SN, use outside the Agreement, or continued use after 3SN offers an available noninfringing replacement or modification that materially preserves contracted functionality and would avoid the claim. If a claim is made or appears likely, 3SN may procure continued use rights, modify or replace the affected System component, or terminate the affected subscription and refund its unused prepaid fees. This Section 15.2 states 3SN’s entire obligation, and Customer’s exclusive remedy, for third-party intellectual property infringement claims.

15.3 Procedure. The indemnified party will promptly notify the indemnifying party of a claim, provide reasonable cooperation at the indemnifying party’s expense, and permit the indemnifying party to control the defense with qualified counsel. Late notice relieves the indemnifying party of its obligation only to the extent of material prejudice. The indemnifying party may not settle a claim in a way that imposes an admission, a nonmonetary obligation, or unreleased liability on the indemnified party without its prior written consent, which will not be unreasonably withheld. The indemnified party may participate through its own counsel at its own expense. Section 14 determines the applicable monetary cap, including any treatment of defense costs.

15.4 Insurance. During the term of each Order Agreement, 3SN will maintain, with financially sound insurers: (a) commercial general liability insurance with limits of at least $1,000,000 per occurrence, $2,000,000 in the general aggregate, and $2,000,000 in the products-completed operations aggregate; and (b) technology errors and omissions and cyber liability insurance with limits of at least $2,000,000 per claim and $2,000,000 in the aggregate. 3SN may meet these limits through any combination of primary and umbrella or excess policies. On Customer’s written request, 3SN will include Customer as an additional insured under its commercial general liability policy for liability arising from 3SN’s operations under the Agreement. 3SN will provide a certificate of insurance on Customer’s reasonable request. Insurance limits do not expand or reduce either party’s liability under the Agreement.

16. DISPUTES AND GOVERNING LAW

16.1 Governing Law and Venue. The laws of the State of Arizona govern the Agreement, without regard to conflict-of-laws principles. Each party consents to the exclusive jurisdiction and venue of the state courts located in Maricopa County, Arizona, and the United States District Court for the District of Arizona for disputes concerning the Agreement, subject to either party’s right to seek urgent injunctive or other protective relief in any other court with jurisdiction.

16.2 Informal Resolution. Before filing a claim concerning the Agreement, a party will give written notice describing the dispute and allow 15 days for business representatives with authority to attempt resolution. This Section does not delay an application for urgent injunctive relief.

16.3 Equitable Relief. A breach of Section 11 or Section 12 may cause irreparable harm for which damages are an inadequate remedy. The non-breaching party may seek injunctive or other equitable relief in any court of competent jurisdiction, in addition to its other remedies.

16.4 Waiver of Jury Trial. TO THE EXTENT PERMITTED BY LAW, EACH PARTY KNOWINGLY AND VOLUNTARILY WAIVES ANY RIGHT TO A TRIAL BY JURY IN ANY ACTION ARISING FROM OR RELATING TO THE AGREEMENT.

17. FORCE MAJEURE

17.1 Force Majeure. Neither party is liable for a delay or failure to perform, other than a payment obligation, caused by circumstances beyond its reasonable control, such as acts of God, war, terrorism, civil unrest, government action, labor disturbances, widespread internet or utility failures, or failures of common carriers, if it promptly notifies the other party, takes reasonable steps to mitigate the impact, and resumes performance when practicable. An affected SaaS availability period is treated under Schedule 1. If material performance remains prevented for more than 60 consecutive days, either party may terminate the affected Order Agreement on written notice, and 3SN will refund unused prepaid fees for the undelivered service.

18. ASSIGNMENT AND SUBCONTRACTORS

18.1 Assignment. Neither party may assign the Agreement or an Order Agreement without the other party’s prior written consent, which will not be unreasonably withheld, except to a successor in a merger or a sale of all or substantially all of the related assets that assumes the Agreement in writing and is not the other party’s direct competitor. Customer’s assignment may not expand authorized use or Protected Sites. A prohibited assignment is void. The Agreement binds and benefits the parties and their permitted successors and assigns.

18.2 Subcontractors. 3SN may use subcontractors to perform its obligations and remains responsible for their performance. Subcontractors that access Customer Data are Subprocessors and are subject to the additional restrictions in the Data and Security Schedule.

19. GENERAL PROVISIONS

19.1 Order of Precedence. The Contract Documents are read together. For a conflict, each document controls only as to the following subjects:

(a) Negotiated Terms control over these Terms for the agreement that contains them, subject to the paragraph below;

(b) the executed Data and Security Schedule controls data handling, security, Security Events, Subprocessors, retention, and improvement uses;

(c) the applicable Deployment Exhibit controls deployment, Observation Approval, Blocking Approval, enforcement mode, bypass, rollback, and the Allowlist and Deny Set settings recorded in it;

(d) Schedule 1 controls availability measurement and credits;

(e) the Order Agreement controls price, quantity, term, start trigger, Evaluation Period, selected tier, and ordered scope;

(f) a signed SOW controls its deliverables, schedule, fees, and acceptance; and

(g) these Terms control all other matters.

Where two of these subjects overlap, the document listed first controls. Negotiated Terms, an Order Agreement, or an SOW cannot change the Data and Security Schedule, the Deployment Exhibit approval gates, or Sections 5.2, 11, 12, or 14 unless the change expressly identifies the affected provision. A DPA controls the data-protection terms it expressly identifies as controlling over the Data and Security Schedule, and data-protection matters the Data and Security Schedule does not address. Otherwise, the Data and Security Schedule controls operational data handling and Security Events unless a later signed amendment expressly identifies a superseding term. The Pricing Summary, quotes, and illustrations are not Contract Documents.

19.2 Entire Agreement; Amendment; Waiver; Severability. The Contract Documents for each Order Agreement are the entire agreement of the parties on their subject matter and supersede all prior and contemporaneous proposals, understandings, and agreements on that subject matter, except that obligations accrued under an earlier signed pilot agreement, and credits preserved by Section 8.1(d), continue. Terms in a Customer purchase order, a click-through acceptance, or other preprinted form have no effect. An amendment or waiver must be in writing and signed by both parties, except an updated version of these Terms that applies under Section 2.6. Failure to enforce a term is not a waiver. If a provision is unenforceable, it will be enforced to the maximum extent permissible, and the remaining provisions continue to the extent the bargain can operate.

19.3 Notices. Formal notices under the Agreement will be in writing and delivered by hand, certified mail (return receipt requested), or recognized overnight courier to the notice address stated in the Order Agreement, and are effective upon receipt. Operational security notices may also be sent to the 24-hour contacts registered in the Data and Security Schedule by the method specified there. A party may change its notice address by notice under this Section. Operational email does not substitute for a formal termination or nonrenewal notice unless an Order Agreement expressly authorizes it, except that a cancellation notice under Section 8.5(c) may be given by email.

19.4 Relationship; Third Parties; Counterparts. The parties are independent contractors, and nothing in the Agreement creates a partnership, joint venture, agency, or fiduciary relationship. There are no third-party beneficiaries, except indemnified persons expressly covered by Section 15. The Agreement is solely between Customer and 3SN. No parent, affiliate, member, manager, officer, director, employee, or agent of 3SN has any obligation or liability to Customer under the Agreement unless it signs a separate written guaranty or agreement that expressly undertakes that obligation. Each Order Agreement and other signed Contract Document may be signed in counterparts, each of which is an original, and electronic signatures are effective.

19.5 Survival. Sections 3.1 (as to loaned Appliances), 4.1(b), 4.1(c), 4.4, 7 (as to accrued payments and credits), 8.4, 9 (as to retained Customer Data), 11 through 14, 15.1 through 15.3, 16, and 19 survive termination or expiration to the extent necessary to give them effect.

19.6 Schedules and Signed Documents. Schedule 1 (SaaS Availability and Service Credits) is part of these Terms. The Order Agreement, Deployment Exhibits, the Data and Security Schedule, SOWs, and any DPA are separately signed documents. The Onboarding Form is an unsigned operational record under Section 2.7.

SCHEDULE 1

SAAS AVAILABILITY AND SERVICE CREDITS

to the Pitchblack Customer Terms

S1.1 Measurement. “Available” means the production SaaS console and Platform API are capable of accepting authenticated requests and returning a non-error response, as measured by 3SN’s production monitoring system from at least one monitoring location outside 3SN’s hosting environment. Monthly availability percentage equals total eligible minutes less unavailable eligible minutes, divided by total eligible minutes, multiplied by 100. Availability is measured in Mountain Standard Time (Arizona, UTC-7) from 3SN’s monitoring records, which control absent manifest error. An outage begins when two consecutive one-minute checks fail and ends at the first successful check. An individual Appliance, Customer’s network, third-party connectivity, the Integration API, and optional integrations are not the SaaS measurement point.

S1.2 Exclusions. The following are excluded from eligible minutes, and only these: (a) scheduled maintenance notified at least 48 hours in advance and not exceeding 4 hours per month; (b) emergency maintenance needed to address an imminent security threat or to prevent harm to the SaaS Platform, not exceeding 4 hours per month, if 3SN gives notice as soon as practicable; (c) force majeure under Section 17; and (d) time demonstrably attributable to Customer equipment, connectivity, misuse, or configurations outside 3SN’s control, to the extent those causes independently prevent access. Maintenance beyond these limits counts as unavailable time. 3SN will record excluded minutes and their causes in the monthly report. The monthly target remains 99.5% of eligible minutes.

S1.3 Credits. For a month below 99.5%, the credit against that month’s SaaS Platform charge is 5% for availability below 99.5% but at least 99.0%, and 10% for availability below 99.0%. The maximum credit for a month is 10% of that month’s SaaS Platform charge. Customer will submit a claim within 30 days after month end to the 3SN support contact provided during onboarding, stating dates and symptoms. A claim not submitted in that period is waived. 3SN will provide its measurement record and a reasoned determination within 30 days. Approved credits apply to the next invoice under the affected Order Agreement, or to the final invoice or a refund if no future invoice remains. Credits are not cash compensation except where no future invoice exists. No repeated-shortfall termination or refund remedy applies unless the Order Agreement expressly states one.