Netra Security Terms of Service

1 Agreement Structure and Definitions

1.1 Agreement

The agreement between the parties consists of these Terms, each applicable Order Form, any Data Processing Addendum executed by the parties, and any service-specific terms expressly incorporated by reference (collectively, the “Agreement”). If documents conflict, the following order of precedence applies: (a) the Data Processing Addendum for matters concerning processing of personal data; (b) the Order Form; (c) these Terms; and (d) other incorporated policies or documentation. A purchase order does not modify the Agreement, and any additional or conflicting terms in a purchase order are void unless expressly accepted in writing by Netra.

1.2 Key Definitions

Authorized User. An employee, contractor, agent, or other individual whom Customer authorizes to use the Services for Customer’s internal business purposes.

Customer Data. Data, content, files, prompts, responses, logs, configurations, personal data, and other information submitted to, collected by, or processed through the Services on Customer’s behalf.

Documentation. Netra’s then-current user, administrative, technical, and security documentation made available for the Services.

Order Form. An ordering document, online order, statement of work, or other written agreement specifying the Services, subscription term, fees, usage limits, or other commercial terms.

Services. The Netra AI Security Platform and the subscribed AI security, token governance, data protection, monitoring, investigation, endpoint, support, and related services identified in an Order Form.

Software. Netra-provided endpoint agents, sensors, connectors, applications, updates, and other software components used to access or enable the Services.

2 Services and License

2.1 Provision of Services

Subject to the Agreement and payment of applicable fees, Netra will provide the Services during the subscription term. The Services may include cloud-hosted functionality, administrative consoles, APIs, endpoint agents, integrations, monitoring, policy enforcement, analytics, and AI-assisted investigation or recommendations. Features available to Customer may depend on the Order Form, deployment model, configuration, operating system, region, and enabled modules.

2.2 Subscription License

Netra grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the subscription term to access and use the Services and to install and use the Software solely for Customer’s internal business and security purposes, in accordance with the Agreement and Documentation. Customer may permit Authorized Users to exercise these rights on its behalf and remains responsible for their compliance.

2.3 Accounts and Administrators

Customer will provide accurate account information, designate appropriate administrators, maintain the confidentiality of credentials, enforce reasonable access controls, and promptly disable access that is no longer authorized. Accounts may not be shared except through functionality expressly designed for shared or service accounts. Customer must promptly notify Netra of suspected unauthorized access or compromise.

2.4 Changes and Updates

Netra may update the Services and Software to improve security, performance, functionality, or legal compliance. Netra will not materially reduce the core functionality of paid Services during a current subscription term. Netra may discontinue features that are not material to the subscribed Services or that must be changed for security, legal, third-party, or technical reasons.

3 Customer Responsibilities and Acceptable Use

3.1 Customer Responsibilities

Customer is responsible for its systems, endpoints, networks, configurations, Authorized Users, instructions, and Customer Data; for determining whether the Services are appropriate for its use; for obtaining all required notices, consents, and authorizations; and for using the Services in compliance with applicable law, employment requirements, privacy obligations, and Customer’s own policies. Customer will not direct Netra to process data that Customer is not legally authorized to process.

3.2 Prohibited Use

Customer and its Authorized Users must not, and must not permit any third party to:

• use the Services unlawfully, to infringe another person’s rights, or to process malware or content intended to facilitate unauthorized access, fraud, or abuse;
• reverse engineer, decompile, disassemble, translate, or attempt to discover source code, non-public APIs, models, algorithms, or underlying structure, except to the limited extent such restriction is prohibited by law;
• copy, modify, create derivative works of, sell, resell, lease, sublicense, time-share, or provide the Services to third parties except as expressly allowed in an Order Form;
• circumvent usage limits, access controls, security measures, or technical restrictions; interfere with the integrity, availability, or performance of the Services; or conduct penetration testing without Netra’s prior written authorization;
• upload or transmit malicious code, use the Services to gain unauthorized access to systems or data, or use the Services in a manner that materially disrupts Netra or other customers;
• remove proprietary notices, use Netra’s trademarks without authorization, or represent that Customer is affiliated with or endorsed by Netra; or
• use the Services to develop, train, benchmark, or provide a competing product or service, except that Customer may conduct internal security and performance evaluations for its own use.

4 Customer Data and Privacy

4.1 Ownership and Instructions

As between the parties, Customer retains all rights in Customer Data. Customer instructs Netra to process Customer Data only as necessary to provide, secure, and support the Services; prevent fraud or misuse; comply with law; and otherwise perform the Agreement. Netra acquires no ownership of Customer Data. Netra may improve the Services using aggregated or deidentified information only as described in Section 4.7.

4.2 Privacy and Data Processing

Netra will process personal data in accordance with the Agreement, the applicable Data Processing Addendum, and the Netra Privacy Policy. If Netra processes personal data on Customer’s behalf, the parties will enter into or be bound by Netra’s Data Processing Addendum as required by applicable law. The Data Processing Addendum controls in the event of a conflict regarding personal data processing.

4.3 Subprocessors

Customer authorizes Netra to engage subprocessors in accordance with the applicable Data Processing Addendum. Netra’s current subprocessors are identified on the Subprocessors page. Netra remains responsible for its subprocessors’ performance of obligations delegated to them under the Agreement, subject to the Agreement’s limitations.

4.4 Security

Netra will maintain administrative, technical, and organizational safeguards designed to protect Customer Data against unauthorized access, use, alteration, or disclosure. Additional information is provided in the Netra Security Policy and any applicable security exhibit or Data Processing Addendum. Customer acknowledges that no service is completely secure and that Customer is responsible for securely configuring and using the Services.

4.5 Security Incidents

Netra will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a security incident involving unauthorized access to or disclosure of Customer Data and will provide information reasonably necessary for Customer to meet applicable legal obligations. Notification is not an admission of fault or liability. More specific incident notification commitments in an executed Data Processing Addendum or Order Form will control.

4.6 Data Export and Deletion

During the subscription term, Customer may export Customer Data using available functionality or may request reasonable export assistance, which may be subject to additional fees. Following expiration or termination, Netra will make Customer Data available for export for 30 days unless the Order Form states otherwise. Netra may then delete Customer Data in accordance with its retention practices, except to the extent retention is required by law or Customer Data remains in backups maintained under standard rotation and access controls. Customer should export needed data before the export period ends. Where the Data Processing Addendum applies, the return and deletion of Personal Data will be handled in accordance with that Data Processing Addendum.

4.7 Aggregated and Deidentified Data

Netra may generate and use aggregated or deidentified information that does not identify Customer, any Authorized User, or any individual to operate, secure, analyze, and improve the Services; develop benchmarks and usage statistics; and conduct research. Netra will not attempt to reidentify such information.

5 Confidentiality

5.1 Confidential Information

“Confidential Information” means non-public information disclosed by or on behalf of one party (the “Discloser”) to the other party (the “Recipient”) that is marked confidential or that a reasonable person would understand to be confidential, including Customer Data, security information, product plans, pricing, business information, and the non-public features and performance of the Services.

5.2 Protection and Permitted Use

The Recipient will use the Discloser’s Confidential Information only to exercise rights or perform obligations under the Agreement, protect it using at least reasonable care, and disclose it only to personnel, contractors, professional advisers, and subprocessors who need to know it and are bound by confidentiality obligations at least as protective as these Terms. The Recipient is responsible for their compliance.

5.3 Exclusions and Required Disclosure

Confidential Information does not include information the Recipient can demonstrate was lawfully known without restriction, becomes public through no breach, is received lawfully from a third party without a duty of confidentiality, or is independently developed without use of the Confidential Information. If disclosure is legally required, the Recipient will, to the extent permitted, give prompt notice and reasonable assistance so the Discloser may seek protection.

6 Intellectual Property

6.1 Netra Technology

Netra and its licensors retain all rights, title, and interest in the Services, Software, Documentation, Netra technology, improvements, derivatives, and related intellectual property. No rights are granted except those expressly stated in the Agreement.

6.2 Feedback

If Customer provides suggestions, ideas, or feedback, Netra may use them without restriction or obligation, provided that Netra does not identify Customer as the source without permission.

6.3 Customer Marks

Netra may not publicly use Customer’s name, logo, or trademarks without Customer’s prior written consent, except that Netra may identify Customer internally and to its professional advisers and service providers as necessary to perform the Agreement.

7 AI Enabled Features

The Services may use machine learning or artificial intelligence to classify data, identify patterns, generate summaries, prioritize findings, or recommend actions. AI-generated results may be incomplete, inaccurate, or require context. Customer is responsible for human review and for decisions or actions taken based on such results. Netra does not use Customer Data to train generalized models made available to other customers. Netra may use aggregated or deidentified data as described in Section 4.7.

8 Third Party Services

The Services may interoperate with third-party products, services, models, applications, or data sources selected or enabled by Customer. Customer’s use of third-party services is governed by its agreement with the applicable provider. Netra is not responsible for third-party services or for Customer Data processed by them after Customer directs or enables a transfer, except to the extent the third party acts as Netra’s subprocessor. Changes to third-party services may affect interoperability.

9 Warranties and Disclaimers

9.1 Mutual Authority

Each party represents that it has authority to enter into the Agreement and perform its obligations.

9.2 Service Warranty

Netra warrants that, during the subscription term, the Services will perform in all material respects in accordance with the Documentation and that Netra will not materially decrease the overall security of the Services. Customer’s exclusive remedy for breach of this warranty is for Netra to use commercially reasonable efforts to correct the nonconformity; if Netra cannot do so within a reasonable period, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused portion of the terminated subscription. This warranty does not apply to issues caused by Customer, third-party services, unauthorized modifications, misuse, or use contrary to the Documentation.

9.3 Disclaimer

EXCEPT AS EXPRESSLY PROVIDED IN THE AGREEMENT, THE SERVICES, SOFTWARE, DOCUMENTATION, BETA FEATURES, AND AI-GENERATED RESULTS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE MAXIMUM EXTENT PERMITTED BY LAW, NETRA DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. NETRA DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, THAT ALL SECURITY THREATS OR POLICY VIOLATIONS WILL BE DETECTED OR PREVENTED, OR THAT AI-GENERATED RESULTS WILL BE COMPLETE OR ACCURATE.

10 Indemnification

10.1 Netra IP Indemnity

Netra will defend Customer against a third-party claim that Customer’s authorized use of the paid Services infringes a United States patent, copyright, or trademark, and will pay damages and costs finally awarded or agreed in settlement, provided Customer promptly notifies Netra, gives Netra sole control of the defense and settlement, and provides reasonable cooperation. Netra has no obligation for claims arising from Customer Data, third-party services, combinations not supplied by Netra, unauthorized modification, continued use after notice, or use outside the Agreement. Netra may modify or replace the affected Services, obtain the right to continue use, or terminate the affected Services and refund prepaid fees for the unused portion.

10.2 Customer Indemnity

Customer will defend Netra against a third-party claim arising from Customer Data, Customer’s unlawful or unauthorized use of the Services, or Customer’s breach of Section 3, and will pay damages and costs finally awarded or agreed in settlement, subject to equivalent notice, control, and cooperation requirements.

11 Limitation of Liability

11.1 Exclusion of Certain Damages

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR LOST PROFITS, REVENUE, GOODWILL, OR DATA; BUSINESS INTERRUPTION; COST OF SUBSTITUTE SERVICES; OR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, EVEN IF ADVISED OF THE POSSIBILITY.

11.2 Liability Cap

EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER FOR THE AFFECTED SERVICES DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY. “EXCLUDED CLAIMS” MEANS CUSTOMER’S PAYMENT OBLIGATIONS; EITHER PARTY’S INDEMNIFICATION OBLIGATIONS; CUSTOMER’S BREACH OF SECTION 3; OR A PARTY’S FRAUD, WILLFUL MISCONDUCT, OR LIABILITY THAT CANNOT LAWFULLY BE LIMITED. Liability for breach of confidentiality or data protection obligations is subject to two times that cap, unless an Order Form states otherwise.

12 Term Suspension and Termination

12.1 Term

These Terms begin when Customer first accepts them and continue while any Order Form remains in effect. Each subscription term and renewal will be stated in the applicable Order Form.

12.2 Suspension

Netra may suspend access to the extent reasonably necessary to address an imminent security threat, unlawful use, or material breach of Section 3. When practicable, Netra will provide advance notice and limit the scope and duration of suspension. Netra will restore access promptly after the issue is resolved.

12.3 Termination for Cause

Either party may terminate the Agreement or an affected Order Form if the other party materially breaches it and fails to cure within 30 days after written notice, or immediately if the breach is not curable. Either party may terminate if the other becomes subject to insolvency or bankruptcy proceedings that are not dismissed within 60 days.

12.4 Effect of Termination

Upon expiration or termination, Customer’s rights to access and use the affected Services end. Customer must uninstall affected Software if requested. Sections that by their nature should survive will survive, including confidentiality, intellectual property, disclaimers, indemnification, limitations of liability, governing law, and data return and deletion.

13 Compliance with Laws

Each party will comply with laws applicable to its performance under the Agreement. Customer will not use the Services in violation of export controls, sanctions, anti-bribery laws, employment monitoring requirements, or privacy and data protection laws. Customer represents that it and its Authorized Users are not prohibited parties and will not access or use the Services from an embargoed jurisdiction except as authorized by applicable law.

14 Governing Law and Disputes

The Agreement is governed by the laws of the State of Delaware, without regard to conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply. The state and federal courts located in Delaware will have exclusive jurisdiction over disputes arising out of or relating to the Agreement, and each party consents to personal jurisdiction and venue there. Before filing a claim, the parties will attempt in good faith for at least 30 days to resolve the dispute through discussions between authorized business representatives, except that either party may seek immediate injunctive or equitable relief to protect confidential information or intellectual property.

15 General

15.1 Notices

Legal notices must be in writing. Notices to Customer may be sent to the billing, administrative, or legal contact identified in the Order Form or Customer account. Notices to Netra must be sent to Netra Security Inc., 1527 Padres Ct, San Jose, CA 95125, United States, with an electronic copy to the notice address identified in the applicable Order Form. Operational communications, security notices, and service announcements may be provided through the Services or by email and do not require formal legal notice.

15.2 Assignment

Neither party may assign the Agreement without the other’s prior written consent, except to an affiliate or in connection with a merger, reorganization, sale of substantially all assets, or change of control, provided the assignee agrees in writing to be bound and is not a direct competitor of the non-assigning party. Any prohibited assignment is void.

15.3 Force Majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disasters, war, terrorism, civil unrest, labor disputes, government actions, utility or communications failures, widespread internet disruption, epidemics, or third-party infrastructure failures, except that this section does not excuse payment obligations.

15.4 Entire Agreement Waiver and Severability

The Agreement is the complete agreement regarding its subject and supersedes prior or contemporaneous proposals, representations, and agreements on that subject. Amendments must be in writing and signed by authorized representatives, except as stated in Section 15.6. Failure to enforce a provision is not a waiver. If a provision is unenforceable, it will be modified to the minimum extent necessary, and the remainder will remain effective.

15.5 Independent Contractors and No Third Party Beneficiaries

The parties are independent contractors. The Agreement does not create a partnership, franchise, agency, fiduciary, or employment relationship. There are no third-party beneficiaries.

15.6 Updates to These Terms

Netra may update these Terms from time to time. Netra will post the updated version with a new effective date and provide reasonable advance notice of material changes. Material changes will take effect at the start of Customer’s next renewal term unless required earlier for law or security, in which case Netra will provide notice as reasonably practicable. Changes will not retroactively reduce Customer’s rights during a current paid subscription term.

15.7 Electronic Acceptance Counterparts and Language

The Agreement may be accepted electronically and executed in counterparts, each of which is deemed an original. Electronic signatures and acceptance have the same effect as originals. If the Agreement is translated, the English version controls to the extent permitted by applicable law.

16 Contact

Questions about these Terms may be directed through Netra’s published contact channels or to the legal or administrative contact identified in the applicable Order Form. Formal notices must comply with Section 15.1.