THESE TERMS CONTAIN CUSTOMER OBLIGATIONS REGARDING NOTICE TO AND CONSENT OF INDIVIDUALS WHOSE DEVICES AND COMMUNICATIONS THE SOFTWARE INSPECTS (SECTION 5.2), DISCLAIMERS OF WARRANTIES (SECTION 14), A LIMITATION OF LIABILITY THAT APPLIES TO CLAIMS FOR NEGLIGENCE (SECTION 16), AND A WAIVER OF TRIAL BY JURY (SECTION 19.3).
These Standpipe Terms of Service (these “Terms”) govern access to and use of the Standpipe offerings of OpsCompanion, Inc., a Delaware corporation (“OpsCompanion”), by the entity that accepts these Terms or executes an Order Form that references them (“Customer”). The individual who accepts these Terms on behalf of Customer represents and warrants that the individual has authority to bind Customer. These Terms, each Order Form, the Data Processing Addendum, and the documents each of them incorporates by reference constitute the agreement between OpsCompanion and Customer (the “Agreement”).
1. Definitions and Construction
1.1 Definitions. The following terms have the meanings set forth below. The terms “Assessment” (Section 7.1), “Evaluation Subscription” (Section 7.4), “Claim” and “Losses” (Section 15.1), “Indemnified Party” and “Indemnifying Party” (Section 15.4), “Confidential Information,” “Discloser,” and “Recipient” (Section 10.1), “Excluded Claims” (Section 16.3), “Feedback” (Section 11.3), “Subscription” and “Subscription Term” (Section 12.2), and “Support” (Section 6.4) have the meanings given in the Sections indicated. The terms “Customer Personal Data” and “Subprocessor” have the meanings that the Data Processing Addendum gives them.
“Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with a party, where “control” means ownership of more than fifty percent (50%) of the voting interests of the entity or the power to direct the management and policies of the entity.
“AI” means artificial intelligence.
“AI Feature” means a component of the Services that uses machine learning, natural language processing, or a language model, including the detection models in the Software and natural-language Policy authoring.
“Authorized User” means an employee or individual contractor of Customer or of an Affiliate of Customer, or of a contractor or managed service provider that Section 3.3 permits, whom Customer authorizes to access the Cloud Console.
“Beta Feature” means a feature, build, or version of the Services that OpsCompanion designates as alpha, beta, preview, early access, pre-release, or by a similar designation.
“Business Day” means a day other than a Saturday, a Sunday, or a day on which banks in St. Louis, Missouri, are authorized or required to close.
“Cloud Console” means OpsCompanion’s hosted administrative console, policy service, licensing and activation service, and related hosted components through which Customer manages Policies, Endpoints, and Authorized Users and views Service Data.
“Customer Data” means Endpoint Content, Service Data, Feedback Submissions, Policies that Customer creates, and other data that Customer or an Authorized User submits to the Services, excluding Usage Data.
“Customer-Designated Destination” means a storage location, security information and event management system, or other destination that Customer or its designee controls and to which Customer configures the Services to deliver Service Data.
“Data Processing Addendum” means OpsCompanion’s Data Processing Addendum (including its AI Schedule) at [https://opscompanion.ai/data-processing-agreement], or a data processing agreement that OpsCompanion and Customer execute in its place.
“Documentation” means OpsCompanion’s then-current user guides, technical specifications, release notes, and the Support Policy for the Services, as OpsCompanion makes them available to Customer.
“Endpoint” means a physical or virtual computing device on which the Software is installed.
“Endpoint Content” means the content of prompts, responses, files, messages, and other data that the Software inspects on an Endpoint, including content that the Software redacts, masks, blocks, or allows.
“Endpoint User” means an individual who uses an Endpoint while the Software is installed on it.
“Feedback Submission” means an example of Endpoint Content, a report of a false-positive or false-negative detection, or other sample data that Customer elects to submit to OpsCompanion under Section 9.4(b).
“Fees” means the fees for the Services stated in an Order Form.
“Malicious Code” means viruses, worms, time bombs, Trojan horses, ransomware, and other code designed to disrupt, damage, or gain unauthorized access to a computer system or data, excluding the interception, decryption, inspection, redaction, masking, and blocking functions that the Documentation describes.
“Monitoring Laws” means laws governing the interception, decryption, monitoring, inspection, recording, or logging of communications, electronic activity, or devices, or governing notice to, consent of, or consultation with individuals or their representatives concerning those activities, including wiretap and electronic communications privacy laws, employee monitoring notice laws, data protection laws, and laws and collective agreements that require consultation with works councils or other employee representatives.
“Open-Source Component” means software that is distributed under a license that permits recipients to access, modify, and redistribute its source code, including the GNU General Public License, the GNU Lesser General Public License, and the GNU Affero General Public License.
“Order Form” means an ordering document, online order, or Assessment enrollment that OpsCompanion accepts and that references these Terms, stating, as applicable, the plan, Subscribed Quantity, Subscription Term, and Fees.
“Permitted Purpose” means Customer’s internal information security, data protection, and AI governance purposes.
“Policy” means a detection, redaction, masking, blocking, warning, logging, or other rule that is configured in the Services.
“Service Data” means the data that the Software transmits from an Endpoint to the Cloud Console or to a Customer-Designated Destination, including Endpoint and device identifiers, hostnames, user identifiers, the identity of the AI applications and services accessed, timestamps, whether the account used appears to be a corporate or a personal account, the Policy matched, the category of sensitive data detected, the enforcement action taken, the software version and update status, agent health and performance data, and crash and diagnostic data.
“Services” means the Software, the Cloud Console, Updates, Support, and the Documentation, as the Documentation and the applicable Order Form describe them.
“Software” means OpsCompanion’s Standpipe endpoint software in object-code form, including its agent, local proxy, network extension and driver components, detection rules, and models, and all Updates to any of them.
“Subscribed Quantity” means the number of Endpoints stated in an Order Form.
“Support Policy” means OpsCompanion’s support policy for the Services at [https://opscompanion.ai/support-policy].
“Third-Party AI Service” means an AI application, model, agent, or service that a person other than OpsCompanion provides, including each such service that the Software detects or inspects.
“Update” means a release of the Software, or of the Policy templates, detection rules, or models that the Software uses, that OpsCompanion makes generally available to its customers.
“Usage Data” means data that OpsCompanion derives from the provision of the Services and that does not identify Customer, any Authorized User, any Endpoint User, or any Endpoint, including aggregated and de-identified statistics concerning the performance, reliability, and use of the Services.
1.2 Construction. In the Agreement: (a) “including” means including without limitation; (b) “or” is inclusive; (c) “law” includes statutes, regulations, rules, ordinances, orders, and binding governmental guidance, each as amended; (d) “days” means calendar days unless Business Days are specified; (e) headings are for convenience only; (f) the singular includes the plural and the reverse; (g) “writing” includes electronic records, except as Section 20.2 provides for notices; (h) all amounts are in United States dollars; (i) “commercially reasonable efforts” means the efforts that a prudent provider of comparable software would use in similar circumstances, which do not require a party to incur costs disproportionate to the benefit to the other party; (j) if the last day for performance falls on a day that is not a Business Day, the deadline extends to the next Business Day; (k) times are Central Time unless Section 20.2 provides otherwise; and (l) no provision is construed against a party because that party drafted it.
2. Agreement Structure
2.1 Acceptance. Customer accepts these Terms by (a) executing an Order Form that references these Terms or (b) selecting a box or button that states that Customer accepts these Terms. Access to or use of the Services without acceptance of these Terms is not authorized.
2.2 Order Forms. Each Order Form is governed by these Terms. An Order Form that OpsCompanion and Customer execute may modify these Terms only as to the Subscription the Order Form covers and only to the extent the Order Form identifies the provision of these Terms that it modifies.
2.3 Order of Precedence. If the documents that constitute the Agreement conflict, the following order of precedence applies, in descending order: (a) a written agreement that OpsCompanion and Customer execute that expressly supersedes these Terms; (b) the Data Processing Addendum, as to the processing of Customer Personal Data; (c) an Order Form, as to the provisions it modifies under Section 2.2; (d) these Terms; and (e) the Documentation. Terms in a purchase order, vendor registration form, or other document that Customer issues have no effect, even if OpsCompanion accepts or acknowledges that document.
2.4 Affiliates. Customer’s Affiliates may use the Services under an Order Form that Customer executes, and Customer is responsible for each Affiliate’s compliance with the Agreement. An Affiliate of Customer that executes its own Order Form under these Terms enters into a separate agreement with OpsCompanion and is “Customer” under that agreement.
2.5 Business Use. OpsCompanion offers the Services only for business use. Customer represents and warrants that Customer is acquiring the Services for business purposes and not for personal, family, or household purposes, and Customer shall ensure that each Authorized User is at least eighteen (18) years of age.
3. Subscriptions and Licenses
3.1 Cloud Console. Subject to the Agreement, OpsCompanion hereby grants Customer, during each Subscription Term, a non-exclusive, non-transferable (except under Section 20.3), non-sublicensable right for Authorized Users to access and use the Cloud Console for the Permitted Purpose in accordance with the Documentation.
3.2 Software. Subject to the Agreement, OpsCompanion hereby grants Customer, during each Subscription Term, a non-exclusive, non-transferable (except under Section 20.3), non-sublicensable license to install and run the Software in object-code form on Endpoints, up to the Subscribed Quantity and on additional Endpoints for which Customer pays Fees under Section 8.1, for the Permitted Purpose in accordance with the Documentation.
3.3 Contractors and Service Providers. Customer may permit its contractors and managed service providers to install the Software and to administer the Services on Customer’s behalf for the Permitted Purpose, if each of them is bound by written obligations at least as protective of OpsCompanion and its Confidential Information as the Agreement. Customer is responsible for the acts and omissions of its Affiliates, Authorized Users, contractors, and managed service providers in connection with the Services as if they were Customer’s own.
3.4 Open-Source and Third-Party Components. The Software includes Open-Source Components and third-party models. OpsCompanion shall identify each of them, and its license, in the Documentation or in a notices file that accompanies the Software. Each Open-Source Component is licensed to Customer under its own license. To the extent the license of an Open-Source Component grants Customer rights, or requires OpsCompanion to grant Customer rights, that are broader than or inconsistent with the Agreement, including rights to modify the component and to reverse engineer the Software to debug those modifications, that license governs as to that component, and Section 4.1 and Schedule 1 do not restrict those rights.
3.5 Reservation of Rights. OpsCompanion reserves all rights not expressly granted in the Agreement. The Agreement grants no implied license.
4. Use Restrictions; Security Testing; Suspension
4.1 Use Restrictions. Customer shall not, and shall not permit any Authorized User, Affiliate, contractor, managed service provider, or other person to, take any action that Schedule 1 prohibits.
4.2 Security Testing. Customer may test the security of the Software on Endpoints that Customer owns or controls for Customer’s internal evaluation, and Schedule 1(f) and Schedule 1(g) do not prohibit that testing. Customer shall not test the Cloud Console without OpsCompanion’s prior written consent. Customer shall report each vulnerability that Customer identifies in the Services to OpsCompanion at security@opscompanion.ai and shall not disclose the vulnerability to any third party until the earlier of (a) the date OpsCompanion makes a remediating Update available and (b) ninety (90) days after Customer’s report, unless OpsCompanion consents in writing to earlier disclosure.
4.3 Suspension. OpsCompanion may suspend Customer’s access to the Cloud Console and to Updates, in whole or in part, if (a) any undisputed Fees remain unpaid fifteen (15) days after OpsCompanion delivers notice of non-payment, (b) Customer materially breaches the Agreement, including Section 4.1, or Customer’s use of the Services violates law, or (c) suspension is necessary to prevent imminent harm to the Services, to OpsCompanion’s other customers, or to any person. OpsCompanion shall give Customer notice at least five (5) Business Days before a suspension under clause (a) or (b), and notice as promptly as practicable, and in any event within one (1) Business Day after, a suspension under clause (c). OpsCompanion shall limit the suspension to the Services and period necessary to address its cause and shall restore Customer’s access promptly after the cause is resolved. Section 6.2(c) describes the effect of a suspension on the Software.
5. Customer Responsibilities
5.1 Deployment and Configuration. Customer shall, with reasonable care, (a) select the Endpoints on which the Software is active and, to the extent the Services permit, the applications and destinations that the Software inspects; (b) configure and review each Policy, including each Policy that an AI Feature suggests, before deploying it; (c) install Updates and maintain security of the credentials, single sign-on configurations, and administrator accounts through which Customer accesses the Cloud Console; and (e) cause Authorized Users to comply with the Agreement.
5.2 Monitoring Compliance. Customer shall ensure that, at all times while the Software is active on an Endpoint:
(a) Customer or an Affiliate of Customer owns or controls the Endpoint, or the owner of the Endpoint has authorized the installation of the Software in writing;
(b) Customer has the authority under Monitoring Laws to cause the Software to intercept, decrypt, inspect, redact, mask, block, and log the communications and activity of each Endpoint User as the Policies configure, and to attribute that activity to individual Endpoint Users;
(c) Customer has given every notice, and obtained every consent, authorization, and agreement with employee representatives, that Monitoring Laws require for that deployment, including notice that the Software decrypts and inspects network traffic directed to Third-Party AI Services, whether accessed through a corporate or a personal account;
(d) Customer has a lawful basis under applicable data protection laws for the processing that the Software performs on the Endpoint; and
(e) if the Endpoint is a personal device of the Endpoint User, the Endpoint User has consented in writing to the installation of the Software and to the inspection that the Policies configure, and Monitoring Laws permit that deployment.
5.3 Authorization to Access Endpoints. Customer hereby authorizes OpsCompanion and the Software to access each Endpoint, to install on each Endpoint a root certificate that is unique to that Endpoint, to operate on each Endpoint as a local intercepting proxy, and to process data on and from each Endpoint, in each case as the Documentation describes and Customer’s Policies configure. Customer is responsible for the compatibility of the Software with Customer’s other software, including security software and applications that pin certificates.
5.4 Third-Party AI Services. Customer’s use of Third-Party AI Services is governed by Customer’s agreements with their providers. OpsCompanion is not responsible for any Third-Party AI Service, including its availability, its outputs, or its treatment of data that is transmitted to it, including data that the Software does not redact or block.
5.5 Support Sessions. OpsCompanion shall not view Customer’s screens or systems except during a screen-sharing or remote session that Customer initiates. Customer controls the content displayed during each session and shall not display payment card data or other data that is subject to heightened legal protection unless the display is necessary to resolve the issue for which Customer requested Support, and shall not display protected health information, as 45 C.F.R. Section 160.103 defines that term, unless a business associate agreement between OpsCompanion and Customer is then in effect. OpsCompanion shall use information that OpsCompanion views during a session, other than Endpoint Content, which Section 9.1 governs, solely to provide Support.
6. Nature of the Services; Updates; Support
6.1 Automated Detection. The Services apply automated detection, including AI Features that run on Endpoints, to classify network traffic and Endpoint Content. The Services do not detect, redact, or block every instance of sensitive data, every use of a Third-Party AI Service, or every risk, and the Services may detect, redact, or block content that presents no risk. The Services supplement, and do not replace, Customer’s security controls, policies, training, and human review. Customer acknowledges that Customer has evaluated the Services and determined that they are suitable for the Permitted Purpose on the terms of the Agreement.
6.2 Conditions in Which the Software Does Not Inspect. The Software does not inspect network traffic or enforce Policies on an Endpoint (a) while the Software is not installed or not running; (b) after the Software stops, fails, or cannot evaluate a request, in which case the Software may allow traffic to pass without inspection; (c) during a suspension under Section 4.3 and after the expiration or termination of the applicable Subscription; or (d) for traffic that the Software does not classify as directed to a Third-Party AI Service, which the Software does not decrypt. Customer shall maintain compensating controls for each of those conditions. If OpsCompanion makes available a configuration under which the Software blocks traffic that the Software cannot evaluate, Customer is responsible for the effects of selecting that configuration, including interruption of Customer’s use of Third-Party AI Services.
6.3 Updates and Modifications. OpsCompanion shall make Updates available to Customer during each Subscription Term, and the Software installs Updates automatically except to the extent Customer uses update controls that the Documentation describes. OpsCompanion shall digitally sign each release of the Software that OpsCompanion distributes. OpsCompanion is not required to support any release of the Software other than the then-current release and the release immediately preceding it. OpsCompanion may modify the Services, but shall not, during a Subscription Term for which Customer has paid or committed to pay Fees, materially decrease the core functionality of the Services described in the Documentation as of the start of that Subscription Term. If OpsCompanion breaches the preceding sentence, Customer may terminate the affected Subscription by notice within thirty (30) days after the modification, and OpsCompanion shall refund the prepaid Fees for the remainder of the terminated Subscription Term.
6.4 Support. OpsCompanion shall provide support for the Services in accordance with the Support Policy (“Support”). OpsCompanion’s obligations concerning response times, availability of the Cloud Console, and service credits are limited to those that the Support Policy or an Order Form states.
7. Assessments, Evaluations, and Beta Features
7.1 Assessments. OpsCompanion may, by invitation, provide a Subscription without Fees, so that Customer may assess the use of Third-Party AI Services on Customer’s Endpoints (an “Assessment”). The Subscription Term of an Assessment is the period stated in the Assessment enrollment, which is fourteen (14) days unless the enrollment states otherwise, and does not renew under Section 12.2. The Agreement governs each Assessment, except as Sections 7.2 through 7.5 and 16.2 provide.
7.2 End of Assessment. At the end of an Assessment:
(a) if Customer elected in the Assessment enrollment or an Order Form to convert the Assessment into a paid Subscription, and the enrollment or Order Form stated the plan, the Subscribed Quantity, the Fees, and the conversion date, the Assessment converts into a Subscription on those terms on the conversion date, unless Customer cancels the conversion by notice through the Cloud Console or to support@opscompanion.ai before the conversion date, and OpsCompanion shall notify Customer of the conversion date, plan, Subscribed Quantity, and Fees at least three (3) days before the conversion date; and
(b) in all other cases, the Assessment expires, and Section 12.4 applies.
7.3 Assessment Review. OpsCompanion personnel may review the results of an Assessment with Customer during a session that Customer initiates. OpsCompanion may retain its notes of the review and the business contact information of Customer’s representatives for up to one (1) year after the end of the Assessment to follow up with Customer. Those notes are Customer’s Confidential Information.
7.4 Evaluations and Beta Features. OpsCompanion may make available Subscriptions for which the Order Form states that Customer pays no Fees (each, an “Evaluation Subscription”) and Beta Features. Customer may use Beta Features in production environments at Customer’s own risk. OpsCompanion may modify or discontinue a Beta Feature at any time, and OpsCompanion’s obligation to provide Support for Beta Features is limited to commercially reasonable efforts.
7.5 Assessments, Evaluations, and Beta Features Provided As Is. Section 13.2 does not apply to an Assessment, an Evaluation Subscription, or a Beta Feature, each of which OpsCompanion provides “AS IS.”
8. Fees and Payment
8.1 Fees. Customer shall pay the Fees. Fees for each billing period are calculated on the greater of (a) the Subscribed Quantity and (b) the greatest number of Endpoints on which the Software is active on any day during that billing period, as the licensing service of the Cloud Console records that number. If the licensing service cannot record that number for any Endpoint, Customer shall certify to OpsCompanion in writing the number of Endpoints on which the Software was active, within ten (10) Business Days after OpsCompanion’s request. OpsCompanion may invoice, and Customer shall pay, Fees for Endpoints in excess of the Subscribed Quantity at the per-Endpoint rate in the applicable Order Form for each billing period in which the excess occurs.
8.2 Invoicing and Payment. Unless an Order Form states otherwise, OpsCompanion shall invoice Fees for the Subscribed Quantity monthly in advance and Fees for excess Endpoints monthly in arrears, and Customer shall pay each invoice within thirty (30) days after the invoice date. If Customer provides a payment card or other payment method to OpsCompanion’s payment processor, Customer hereby authorizes OpsCompanion to charge that payment method on each billing date for the Fees then due, including Fees for excess Endpoints and for renewal Subscription Terms, until Customer revokes the authorization by notice or the Subscription ends.
8.3 Late Payment and Disputes. Amounts not paid when due bear interest from the due date until paid at the lesser of one percent (1%) per month and the maximum rate that law permits, and Customer shall reimburse OpsCompanion’s reasonable costs of collection, including reasonable attorneys’ fees. To dispute an invoice, Customer must notify OpsCompanion of the disputed amount and the basis for the dispute in reasonable detail within fifteen (15) days after the invoice date, and Customer shall pay the undisputed portion when due. Interest does not accrue on an amount that Customer disputes in good faith under this Section 8.3 while the parties work to resolve the dispute.
8.4 Taxes. Fees exclude taxes. Customer shall pay all sales, use, value-added, goods and services, withholding, and similar taxes and duties that any taxing authority assesses on the Services, other than taxes on OpsCompanion’s net income, property, and employees. If Customer is exempt from a tax, Customer must deliver a valid exemption certificate to OpsCompanion before the invoice date for the exemption to apply.
8.5 Fee Changes. OpsCompanion may change the Fees for a renewal Subscription Term by notice to Customer at least thirty (30) days before that renewal Subscription Term begins. Fees that an Order Form states for a Subscription Term do not change during that Subscription Term.
8.6 No Refunds; No Set-Off. Fees are non-refundable except as Sections 6.3, 12.4(d), 13.4, 15.3, 20.1, and 20.5 and Section 6.4 of the Data Processing Addendum provide. Customer shall pay Fees without set-off, deduction, or counterclaim.
9. Data
9.1 Endpoint Content. The Software inspects Endpoint Content locally, and OpsCompanion shall not cause or permit the Software to transmit Endpoint Content to OpsCompanion or its Subprocessors, except for Feedback Submissions or content incidentally captured in crash or diagnostic data. This restriction does not apply to Service Data, which may include device, process, AI usage, tool and Model Context Protocol activity, Policy, detection, intent classification, and operational metadata derived from Endpoint Content. Service Data other than crash and diagnostic data (“Routine Service Data”) excludes prompt and response bodies, file contents, matched sensitive values, and request or Policy paths. OpsCompanion shall use Endpoint Content received in crash or diagnostic data or viewed during Support solely to diagnose and resolve the issue to which that data or Support relates and delete all copies within ninety (90) days after receipt.
9.2 Customer Data. As between the parties, Customer owns Customer Data. Customer hereby grants OpsCompanion a non-exclusive, worldwide, royalty-free license during the term of the Agreement, and thereafter until OpsCompanion completes the export and deletion that Section 12.4(c) requires, to host, copy, process, transmit, and display Customer Data solely to (a) provide, secure, and support the Services for Customer; (b) prevent or address service, security, and technical problems; (c) comply with law; (d) perform any other processing that Customer directs in writing; and (e) make the uses that Sections 9.3 and 9.4(b) permit.
9.3 Usage Data. OpsCompanion may derive Usage Data from Service Data and may use Usage Data to operate, secure, maintain, and improve OpsCompanion’s products and services and to prepare aggregated industry reports. OpsCompanion shall not attempt to re-identify Usage Data and shall not disclose Usage Data in a form that identifies Customer, any Authorized User, any Endpoint
9.4 No Training; Feedback Submissions.
(a) OpsCompanion shall not use Customer Data, directly or through any third party, to train, fine-tune, or otherwise modify the weights, parameters, or training data of any AI or machine-learning model, except Feedback Submissions that Customer authorizes for that use under Section 9.4(b).
(b) Customer may submit Feedback Submissions through any feature that the Services make available for that purpose or in writing, and may authorize OpsCompanion to use identified Feedback Submissions to evaluate and improve OpsCompanion’s detection rules and models. Customer shall minimize the personal data in each Feedback Submission and shall not include protected health information, as 45 C.F.R. Section 160.103 defines that term, in a Feedback Submission unless a business associate agreement between OpsCompanion and Customer is then in effect. Customer may revoke an authorization by notice, and OpsCompanion shall then cease any further use of the Feedback Submissions covered by the revoked authorization and delete them within thirty (30) days, but is not required to retrain any model that OpsCompanion trained before the revocation.
9.5 Data Processing Addendum; Security. The Data Processing Addendum is incorporated in these Terms and governs OpsCompanion’s processing of Customer Personal Data. OpsCompanion shall maintain the security measures that the Data Processing Addendum describes for Customer Data in OpsCompanion’s possession or control, and Section 7 of the Data Processing Addendum applies to all Customer Data, reading each reference to Customer Personal Data in Section 7 and in the definition of “Security Incident” in Section 1 of the Data Processing Addendum as a reference to Customer Data.
9.6 Customer-Designated Destinations. Each copy of Service Data that the Services deliver to a Customer-Designated Destination leaves OpsCompanion’s possession and control upon delivery, and OpsCompanion is not responsible for the security, retention, or use of that copy after delivery.
10. Confidentiality
10.1 Confidential Information. “Confidential Information” means non-public information that a party (the “Discloser”) discloses to the other party (the “Recipient”) in connection with the Agreement and that is designated as confidential or that a reasonable person would understand to be confidential from its nature and the circumstances of disclosure. Customer Data is Customer’s Confidential Information. The Services, the Documentation, OpsCompanion’s pricing, and OpsCompanion’s security reports, including its System and Organization Controls (SOC) reports and penetration test summaries, are OpsCompanion’s Confidential Information. Confidential Information excludes information that the Recipient can demonstrate (a) is or becomes publicly available without breach of the Agreement; (b) was known to the Recipient without restriction before receipt from the Discloser; (c) is received from a third party without breach of an obligation owed to the Discloser; or (d) is independently developed by the Recipient without use of the Discloser’s Confidential Information.
10.2 Obligations. The Recipient shall (a) use the Discloser’s Confidential Information solely to exercise its rights and perform its obligations under the Agreement; (b) disclose the Discloser’s Confidential Information only to its and its Affiliates’ employees, contractors, advisors, auditors, insurers, and financing sources who need to know it for those purposes and who are bound by confidentiality obligations at least as protective as this Section 10; and (c) protect the Discloser’s Confidential Information with at least the care that the Recipient uses to protect the Recipient’s own information of similar sensitivity, and no less than reasonable care. The Recipient is responsible for any breach of this Section 10 by a person to whom the Recipient discloses Confidential Information. Upon the Discloser’s request after the Agreement ends, the Recipient shall return or destroy the Discloser’s Confidential Information, except copies retained in automated backups until deleted in the ordinary course (and, as to Customer Data, within the periods that Section 10 of the Data Processing Addendum states) or as law or bona fide document-retention policies require, which remain subject to this Section 10.
10.3 Compelled Disclosure. The Recipient may disclose the Discloser’s Confidential Information to the extent law or a court or governmental order requires, if the Recipient gives the Discloser prompt notice of the requirement (where law permits), reasonably cooperates at the Discloser’s expense with the Discloser’s efforts to obtain a protective order, and discloses only the portion that is legally required.
10.4 Duration. The Recipient’s obligations under this Section 10 continue during the term of the Agreement and for five (5) years after its expiration or termination, and, as to Confidential Information that constitutes a trade secret under applicable law and as to Customer Data, for so long as that information remains a trade secret or remains in the Recipient’s possession, respectively.
11. Intellectual Property
11.1 OpsCompanion Ownership. As between the parties, OpsCompanion owns all right, title, and interest, including all intellectual property rights, in and to the Services, Usage Data, and all improvements, modifications, and derivative works of the Services, including detection rules, Policy templates, models, and custom detections that OpsCompanion develops, whether or not at Customer’s request or expense, excluding Open-Source Components and third-party models, which their licensors own. Customer hereby assigns to OpsCompanion all right, title, and interest that Customer acquires in custom detections and other improvements to the Services that OpsCompanion develops at Customer’s request, excluding Customer Data and Customer’s Confidential Information.
11.2 Customer Policies. OpsCompanion’s ownership under Section 11.1 extends to the functionality, templates, and detection logic that Customer uses to create Policies, but not to the Policies that Customer creates.
11.3 Feedback. Customer hereby grants OpsCompanion a perpetual, irrevocable, worldwide, royalty-free, fully paid, sublicensable license to use and incorporate into OpsCompanion’s products and services any suggestion, comment, or idea concerning the Services that Customer or an Authorized User provides to OpsCompanion (“Feedback”). Feedback excludes Customer’s Confidential Information and Feedback Submissions, which Section 9.4 governs. OpsCompanion shall not identify Customer publicly as the source of Feedback without Customer’s consent.
12. Term and Termination
12.1 Term of Agreement. The Agreement begins when Customer accepts these Terms and continues until every Subscription under it has expired or been terminated.
12.2 Subscription Term and Renewal. Each subscription to the Services (a “Subscription”) has the initial term that its Order Form states, or one (1) month if the Order Form states none, and thereafter renews automatically for successive renewal terms, each equal to the shorter of the initial term and twelve (12) months (the initial term and each renewal term, each a “Subscription Term”), unless either party gives the other party notice of non-renewal (a) at least thirty (30) days before the end of the then-current Subscription Term, if that Subscription Term is longer than one (1) month, or (b) before the end of the then-current Subscription Term, if that Subscription Term is one (1) month or shorter.
12.3 Termination for Cause. Either party may terminate the Agreement, or an affected Subscription, by notice to the other party if (a) the other party materially breaches the Agreement and does not cure the breach within thirty (30) days after receipt of notice describing the breach in reasonable detail, or (b) the other party becomes the subject of a petition in bankruptcy or another proceeding relating to insolvency, receivership, liquidation, or assignment for the benefit of creditors that is not dismissed within sixty (60) days. Termination of the Agreement terminates every Subscription under it.
12.4 Effect of Expiration or Termination. Upon the expiration or termination of a Subscription:
(a) the rights and licenses that Section 3 grants for that Subscription end;
(b) Customer shall uninstall the Software from all affected Endpoints within thirty (30) days and, upon OpsCompanion’s request, shall certify the uninstallation in writing;
(c) upon Customer’s written request made within thirty (30) days after the expiration or termination, OpsCompanion shall deliver to Customer, within thirty (30) days after the request, an export of the Service Data for that Subscription in OpsCompanion’s possession in a commonly used, machine-readable format, and OpsCompanion shall delete Customer Data for that Subscription within the periods that Section 10 of the Data Processing Addendum states;
(d) if Customer terminates for OpsCompanion’s breach under Section 12.3, OpsCompanion shall refund the prepaid Fees for the remainder of the terminated Subscription Term; and
(e) if OpsCompanion terminates for Customer’s breach under Section 12.3, Customer shall pay all unpaid Fees for the remainder of the terminated Subscription Term, which become due on the effective date of termination.
12.5 Survival. The following provisions survive the expiration or termination of the Agreement for the periods stated: (a) Section 10, for the period that Section 10.4 states; (b) Sections 9.2 and 9.5, until OpsCompanion completes the export and deletion that Section 12.4(c) requires; (c) Sections 4.1 and 18.2 and Schedule 1, until Customer completes the uninstallation that Section 12.4(b) requires; and (d) Sections 1, 8 (as to amounts accrued before expiration or termination), 9.1, 9.3, 9.4, 9.6, 11, 12.4, 12.5, 14, 15, 16, 17, 19, and 20, without limitation of time.
13. Warranties
13.1 Mutual Warranties. Each party represents and warrants to the other party that (a) the representing party is duly organized and in good standing under the laws of its jurisdiction of organization; (b) the representing party has the power and authority to enter into and perform the Agreement; and (c) the representing party’s entry into and performance of the Agreement do not breach any agreement to which the representing party is a party.
13.2 OpsCompanion Warranties. OpsCompanion warrants to Customer that (a) during each Subscription Term for which Customer pays Fees, the Services will perform materially in accordance with the Documentation; and (b) the Software, as OpsCompanion delivers it, will not contain Malicious Code.
13.3 Exclusions. Section 13.2 does not apply to a nonconformity that results from (a) modification of the Services by any person other than OpsCompanion or its subcontractors; (b) use of the Services other than in accordance with the Agreement and the Documentation; (c) Customer’s failure to install an Update that OpsCompanion made available; (d) a Third-Party AI Service, Customer’s systems, or Customer’s network; or (e) a Policy that Customer configures.
13.4 Remedy. To obtain a remedy for a breach of Section 13.2(a), Customer must notify OpsCompanion of the nonconformity, describing it in reasonable detail, within thirty (30) days after Customer first becomes aware of it. OpsCompanion shall then use commercially reasonable efforts to correct the nonconformity. If OpsCompanion does not correct the nonconformity within thirty (30) days after receipt of Customer’s notice, either party may terminate the affected Subscription by notice, and OpsCompanion shall refund the prepaid Fees for the remainder of the terminated Subscription Term. This Section 13.4 states Customer’s sole and exclusive remedy, and OpsCompanion’s entire liability, for breach of Section 13.2(a).
13.5 Customer Warranty. Customer represents and warrants that Customer has all rights, consents, and authorizations necessary to provide Customer Data to OpsCompanion and to grant the licenses in Section 9.2 and Section 11.3.
14. Disclaimers
EXCEPT AS SECTION 13 EXPRESSLY STATES, OPSCOMPANION PROVIDES THE SERVICES “AS IS” AND “AS AVAILABLE,” AND OPSCOMPANION AND ITS LICENSORS DISCLAIM ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR ARISING FROM COURSE OF DEALING OR USAGE OF TRADE, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ACCURACY. OPSCOMPANION DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, THAT THE SERVICES WILL DETECT, REDACT, OR BLOCK ANY PARTICULAR DATA, USE, OR RISK, OR THAT OUTPUT OF AN AI FEATURE, INCLUDING A POLICY THAT AN AI FEATURE SUGGESTS, WILL BE ACCURATE OR COMPLETE. OPSCOMPANION MAKES NO WARRANTY CONCERNING ANY THIRD-PARTY AI SERVICE OR OPEN-SOURCE COMPONENT.
15. Indemnification
15.1 By Customer. Customer shall defend, indemnify, and hold harmless OpsCompanion, its Affiliates, and their respective directors, officers, employees, and agents from and against all losses, damages, liabilities, fines, penalties, settlement amounts, costs, and expenses, including reasonable attorneys’ fees (collectively, “Losses”), arising out of, resulting from, or relating to any claim, demand, suit, or proceeding by a third party, including a governmental authority or an Endpoint User (each, a “Claim”), to the extent the Claim arises out of, results from, or relates to (a) Customer’s breach of Section 5.2 or Schedule 1; (b) Customer Data, or the processing of Customer Data that Customer directs or configures; or (c) Customer’s use of the Services in violation of law.
15.2 By OpsCompanion. This Section 15.2 applies only to a Subscription for which the Order Form states that OpsCompanion’s infringement indemnity applies. OpsCompanion shall defend, indemnify, and hold harmless Customer and its directors, officers, and employees from and against all Losses arising out of any Claim alleging that the Services, as OpsCompanion provides them and as Customer uses them in accordance with the Agreement, infringe or misappropriate a United States patent, copyright, trademark, or trade secret of a third party. OpsCompanion has no obligation under this Section 15.2 for a Claim to the extent it arises out of (a) an Open-Source Component, as distinguished from OpsCompanion’s combination or modification of it; (b) Customer Data or a Policy that Customer configures; (c) a combination of the Services with any product, service, or data that OpsCompanion did not provide, if the Claim would not have arisen but for the combination; (d) a modification of the Services by any person other than OpsCompanion or its subcontractors; (e) use of a release that OpsCompanion no longer supports under Section 6.3, if use of a supported release would have avoided the Claim; (f) an Assessment, an Evaluation Subscription, or a Beta Feature; or (g) a Third-Party AI Service.
15.3 Mitigation. If the Services become, or in OpsCompanion’s opinion are likely to become, the subject of a Claim covered by Section 15.2, OpsCompanion may, at its option and expense, (a) obtain for Customer the right to continue using the Services; (b) modify or replace the Services so that they are non-infringing without materially decreasing their functionality; or (c) if OpsCompanion determines that neither clause (a) nor clause (b) is commercially reasonable, terminate the affected Subscription and refund the prepaid Fees for the remainder of the terminated Subscription Term. Sections 15.2 and 15.3 state OpsCompanion’s sole liability, and Customer’s exclusive remedy, for any Claim of infringement or misappropriation.
15.4 Procedure. A party seeking defense or indemnification under this Section 15 (the “Indemnified Party”) shall (a) give the party from which the Indemnified Party seeks defense or indemnification (the “Indemnifying Party”) notice of the Claim promptly, and in any event within thirty (30) days, after the Indemnified Party receives notice of it; provided that failure to give notice within that period relieves the Indemnifying Party of its obligations under this Section 15 only to the extent the Indemnifying Party is actually prejudiced by the failure; (b) give the Indemnifying Party sole control of the defense and settlement of the Claim, except that the Indemnifying Party shall not settle a Claim in a manner that imposes any obligation or admission of liability on the Indemnified Party, other than the payment of amounts that the Indemnifying Party pays in full, without the Indemnified Party’s prior written consent, which the Indemnified Party shall not unreasonably withhold; and (c) provide reasonable cooperation at the Indemnifying Party’s expense. The Indemnified Party may participate in the defense with counsel of its choice at its own expense.
16. Limitation of Liability
16.1 Excluded Damages.
EXCEPT IN RESPECT OF EXCLUDED CLAIMS, NEITHER PARTY IS LIABLE UNDER OR IN CONNECTION WITH THE AGREEMENT FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOSS OF GOODWILL, LOSS OR CORRUPTION OF DATA, OR COSTS OF SUBSTITUTE GOODS OR SERVICES, EVEN IF THE PARTY WAS ADVISED OF THE POSSIBILITY OF THOSE DAMAGES.
16.2 Liability Cap.
EXCEPT IN RESPECT OF EXCLUDED CLAIMS, EACH PARTY’S AGGREGATE LIABILITY UNDER OR IN CONNECTION WITH THE AGREEMENT DOES NOT EXCEED THE FEES THAT CUSTOMER PAID AND IS OBLIGATED TO PAY UNDER THE AGREEMENT DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY. OPSCOMPANION’S AGGREGATE LIABILITY ARISING OUT OF AN ASSESSMENT, AN EVALUATION SUBSCRIPTION, OR A BETA FEATURE DOES NOT EXCEED ONE THOUSAND DOLLARS ($1,000). OPSCOMPANION’S OBLIGATIONS UNDER SECTION 15.2 ARE SUBJECT TO THIS SECTION 16.2.
16.3 Excluded Claims. “Excluded Claims” means (a) a party’s fraud or willful misconduct; (b) Customer’s obligation to pay Fees; (c) Customer’s breach of Section 5.2 or Schedule 1, or Customer’s infringement or misappropriation of OpsCompanion’s intellectual property rights; and (d) Customer’s obligations under Section 15.1.
16.4 Application.
SECTIONS 16.1 AND 16.2 APPLY TO ALL CLAIMS, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, STATUTE, OR ANY OTHER THEORY, AND APPLY EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE. THE PARTIES ACKNOWLEDGE THAT THE FEES REFLECT THE ALLOCATION OF RISK IN THIS SECTION 16, WHICH IS AN ESSENTIAL BASIS OF THE BARGAIN BETWEEN THEM. TO THE EXTENT LAW DOES NOT PERMIT A LIMITATION IN THIS SECTION 16, THAT LIMITATION APPLIES TO THE MAXIMUM EXTENT LAW PERMITS.
17. Publicity
Neither party shall use the other party’s name, logo, or trademarks, including in a customer list, case study, testimonial, press release, or investor material, without the other party’s prior written consent. A party that grants consent to the publication of a quotation or case study may require approval of its final text.
18. Compliance
18.1 Compliance with Laws. Each party shall comply with the laws that apply to it in performing the Agreement.
18.2 Export and Sanctions. The Software contains encryption technology that is subject to United States export control laws. Each party shall comply with the export control and economic sanctions laws of the United States and other applicable jurisdictions in connection with the Agreement. Customer represents and warrants that Customer is not, and is not owned or controlled by, a person that is designated on a United States government restricted-party list or located, organized, or ordinarily resident in a country or territory that is subject to comprehensive United States sanctions. Customer shall not install the Software on an Endpoint located in, or permit access to the Services from, any such country or territory, or by any such person.
18.3 Anti-Corruption. Neither party shall offer, give, solicit, or accept any bribe or other improper payment in connection with the Agreement.
18.4 Government End Users. The Software and Documentation are “commercial computer software” and “commercial computer software documentation” within the meaning of the Federal Acquisition Regulation and the Defense Federal Acquisition Regulation Supplement, and a United States government end user acquires them only with the rights that the Agreement grants to all other customers.
19. Governing Law and Disputes
19.1 Governing Law. The Agreement and every claim arising out of or relating to it are governed by the laws of the State of Missouri, without regard to conflict-of-laws principles that would require the application of the laws of another jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act, as enacted in any jurisdiction, do not apply.
19.2 Forum. Each party hereby irrevocably submits to the exclusive jurisdiction of the state courts located in the City of St. Louis or St. Louis County, Missouri, and the United States District Court for the Eastern District of Missouri, for every action arising out of or relating to the Agreement, and hereby waives any objection to venue and any claim of inconvenient forum in those courts. Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property rights or Confidential Information.
19.3 Waiver of Jury Trial.
EACH PARTY HEREBY KNOWINGLY, VOLUNTARILY, AND INTENTIONALLY WAIVES ITS RIGHT TO A TRIAL BY JURY IN ANY ACTION OR PROCEEDING ARISING OUT OF OR RELATING TO THE AGREEMENT OR THE SERVICES, TO THE FULLEST EXTENT LAW PERMITS.
19.4 Equitable Relief; Remedies Cumulative. A breach of Section 4.1, Section 10, or Schedule 1 may cause the non-breaching party irreparable harm for which monetary damages are an inadequate remedy, and the non-breaching party may seek specific performance and injunctive relief for that breach without posting a bond, in addition to its other remedies. Except as Sections 13.4 and 15.3 provide, the rights and remedies under the Agreement are cumulative and in addition to any other rights and remedies available at law or in equity.
20. General
20.1 Changes to These Terms. OpsCompanion may modify these Terms by posting the modified Terms and giving Customer notice at least thirty (30) days before the modification takes effect. For a Subscription for which Customer pays Fees, a modification that materially and adversely affects Customer takes effect at the start of the next renewal Subscription Term, unless law or a security risk to the Services requires an earlier effective date, in which case Customer may terminate the affected Subscription by notice within thirty (30) days after the modification takes effect, and OpsCompanion shall refund the prepaid Fees for the remainder of the terminated Subscription Term. Customer’s continued use of the Services after a modification takes effect constitutes acceptance of the modification, to the extent law permits. An Order Form or other agreement that OpsCompanion and Customer execute may be amended only by a writing that both parties execute.
20.2 Notices. Each notice under the Agreement must be in writing and is duly given (a) when delivered personally; (b) on the first Business Day after deposit with a nationally recognized overnight courier for next-Business-Day delivery; or (c) on the date of transmission if sent by electronic mail, except that a notice of breach, termination, or a Claim sent by electronic mail is duly given only if a copy is also delivered under clause (a) or (b) within two (2) Business Days. A notice that OpsCompanion delivers through the Cloud Console is duly given when posted. A notice given after 5:00 p.m. in the recipient’s local time is deemed given on the next Business Day. Notices to OpsCompanion must be addressed to OpsCompanion, Inc., 211 N Broadway, One Metropolitan Square, Saint Louis, Missouri 63102, Attention: Chief Executive Officer, with a copy by electronic mail to legal@opscompanion.ai. Notices to Customer must be addressed to the address or electronic mail address in the applicable Order Form or Customer’s account. OpsCompanion may deliver notices concerning the operation of the Services, including notices under Sections 7.2, 8.5, and 20.1, through the Cloud Console or by electronic mail to Customer’s administrators. Either party may change its notice address by notice to the other party.
20.3 Assignment. Neither party may assign or transfer the Agreement, by operation of law or otherwise, without the other party’s prior written consent, except that either party may assign the Agreement without consent to a successor to all or substantially all of the business or assets to which the Agreement relates, by merger, sale of assets or equity, or reorganization, if the successor assumes the assigning party’s obligations under the Agreement in writing. A change of control of a party is not an assignment under this Section 20.3. Any purported assignment in violation of this Section 20.3 is void. The Agreement binds and benefits the parties and their permitted successors and assigns.
20.4 Subcontractors. OpsCompanion may use subcontractors to perform its obligations under the Agreement and is responsible for their performance as for its own. The Data Processing Addendum governs OpsCompanion’s engagement of Subprocessors.
20.5 Force Majeure. Neither party is liable for a failure or delay in performance, other than an obligation to pay money, to the extent caused by events beyond the affected party’s reasonable control, including natural disasters, epidemics, war, terrorism, civil disturbance, labor disputes not involving the affected party’s own employees, failures of public utilities or telecommunications networks, failures of Third-Party AI Services, and acts of governmental authorities. The affected party shall notify the other party promptly and use commercially reasonable efforts to resume performance. If the failure or delay continues for more than thirty (30) days, either party may terminate the affected Subscription by notice, and OpsCompanion shall refund the prepaid Fees for the remainder of the terminated Subscription Term.
20.6 Relationship; No Third-Party Beneficiaries. The parties are independent contractors, and the Agreement creates no partnership, joint venture, agency, fiduciary, or employment relationship. The Agreement confers no rights on any person other than the parties, their permitted successors and assigns, and the persons that Section 15 entitles to defense or indemnification.
20.7 Waiver; Severability. A waiver is effective only if it is in writing and signed by the waiving party, and a waiver of one breach is not a waiver of any other breach. If a court of competent jurisdiction holds a provision of the Agreement unenforceable, that provision is enforced to the maximum extent permissible, and the remaining provisions remain in effect.
20.8 Entire Agreement. The Agreement is the entire agreement between the parties concerning its subject matter and supersedes all prior and contemporaneous agreements, proposals, and representations concerning that subject matter, including any terms of service for the Services that Customer accepted before accepting these Terms. Customer has not relied on any statement, promise, or representation that the Agreement does not contain.
20.9 Electronic Acceptance; Counterparts. Electronic acceptance of these Terms and electronic signature of an Order Form have the same effect as a handwritten signature. An Order Form may be executed in counterparts, each of which is an original and all of which together constitute one instrument.
20.10 Expenses. Except as Sections 8.3 and 15 provide, each party bears its own costs and expenses in connection with the Agreement.
SCHEDULE 1
USE RESTRICTIONS
Except as Section 3.4 and Section 4.2 permit, Customer shall not, and shall not permit any person to:
(a) install the Software on a device that neither Customer nor an Affiliate of Customer owns or controls, except as Section 5.2(a) and Section 5.2(e) permit;
(b) use the Services to intercept, decrypt, inspect, record, or log the communications or activity of any person in violation of Monitoring Laws, or for any purpose other than the Permitted Purpose;
(c) use output of the Services as the sole basis for a decision concerning the hiring, discipline, compensation, promotion, or termination of the employment or engagement of an individual, or for any other decision that produces legal or similarly significant effects for an individual;
(d) use the Services to infer the emotional state of an individual;
(e) copy, modify, translate, or create derivative works of the Services, except as Section 3.4 permits;
(f) reverse engineer, decompile, or disassemble the Software, or attempt to derive the source code, detection rules, or models of the Software, except to the extent Section 3.4 permits or law permits notwithstanding this restriction;
(g) remove, disable, or circumvent any license control, tamper protection, or security feature of the Services;
(h) sell, resell, rent, lease, sublicense, or provide the Services to any third party, including on a service-bureau, managed-service, or time-sharing basis, except as a partner of OpsCompanion under a written agreement with OpsCompanion that authorizes it;
(i) access or use the Services to build a competing product or service, or to copy the features, Policy templates, detection logic, or user interface of the Services;
(j) publish or disclose to any third party the results of any benchmark or performance test of the Services without OpsCompanion’s prior written consent;
(k) transmit Malicious Code through the Services or use the Services in violation of law;
(l) use the Services in an environment that requires fail-safe performance, in which a failure of the Services could lead to death, personal injury, or physical or environmental damage; or
(m) interfere with or disrupt the integrity or performance of the Cloud Console, or attempt to gain unauthorized access to the Services or to OpsCompanion’s systems.