Acceptable Use Policy

This Acceptable Use Policy (“AUP”) governs Customer's and End Users' access to and use of the Locktera services, including Locktera Share, Locktera CORE API, Locktera Vault, Secure RAG, encryption services, cryptographic container services, SDKs, authorization systems, applications, and related systems and infrastructure (collectively, the “Services”), provided by Locktera, Inc., a Texas corporation (“Locktera,” “Company,” “we,” “us,” or “our”).

This AUP is incorporated by reference into and forms part of the Locktera Terms of Service and any applicable Master Services Agreement, Subscription Agreement, Order Form, or other agreement governing Customer's use of the Services (collectively, the “Agreement”).

This AUP applies to all use of the Services, including access through APIs, SDKs, integrations, applications, web interfaces, or other authorized means. Capitalized terms not defined herein shall have the meanings assigned under the Agreement.

Customer agrees to comply with this AUP and shall ensure that its End Users comply with its applicable requirements.

Locktera reserves the right to investigate actual, suspected, or alleged violations of this AUP and to take appropriate protective measures in accordance with Sections 5 and 10 and the Agreement.

Locktera may update this AUP in accordance with Section 8.

1. PROHIBITED USES

1.1 Illegal or Unauthorized Activities

Customer shall not use, or permit any End User to use, the Services:

(a) In violation of applicable laws or regulations, including those relating to data protection, privacy, export controls, economic sanctions, intellectual property, fraud, cybercrime, or unauthorized access to systems or data;

(b) To conduct unauthorized penetration testing, vulnerability scanning, exploitation, or security assessments against Locktera systems or infrastructure without prior written authorization;

(c) To collect, extract, harvest, or disclose nonpublic system information, operational metadata, credentials, or infrastructure information that Customer is not authorized to access;

(d) To circumvent technical restrictions, security protections, or enforcement measures lawfully implemented by Locktera; or

(e) To facilitate activities prohibited by applicable export control or sanctions laws.

1.2 Unauthorized Access or Security Violations

Attempt to gain unauthorized access to:

• The Services
• Locktera systems or infrastructure
• Other Locktera customers’ systems or data
• Any networks, systems, or devices

Including:

• Circumventing authentication or authorization controls
• Attempting to defeat cryptographic protections
• Credential harvesting
• Unauthorized decryption attempts

Reverse engineering, decompiling, disassembling, or attempting to derive nonpublic source code or proprietary cryptographic implementations, except to the extent expressly permitted by applicable law or authorized in writing by Locktera.

1.3 Service Interference or Disruption

Use the Services in a manner that interferes with or disrupts the integrity, availability, or performance of the Services, including:

• Distributed denial-of-service attacks
• Excessive or abusive API calls
• Traffic intended to degrade service performance
• Resource abuse
• Automated scraping, crawling, or data extraction

1.4 Malicious Code

Upload, transmit, store, or distribute:

• Malware
• Viruses
• Ransomware
• Trojan horses
• Worms
• Malicious scripts or executables

1.5 Fraudulent, Deceptive, or Illegal Activities

Use the Services for:

• Fraud
• Identity theft
• Deceptive practices
• Impersonation
• Unauthorized surveillance
• Distribution of illegal content

1.6 Circumvention of Service Controls

Attempt to:

• Circumvent access controls
• Circumvent usage limits
• Circumvent billing mechanisms
• Circumvent encryption or cryptographic enforcement mechanisms
• Misuse or share authentication credentials or API keys

1.7 Unauthorized Resale, Competitive Misuse, and Benchmarking

Customer shall not:

(a) Resell, sublicense, redistribute, or commercially exploit the Services except as expressly authorized under the Agreement or a separate written agreement with Locktera;

(b) Use unauthorized access to Locktera's proprietary systems, Confidential Information, source code, or nonpublic cryptographic implementations to develop a competing product or service;

(c) Disclose Locktera Confidential Information, proprietary security architecture, or nonpublic technical information in connection with benchmarking, comparative analysis, or publication without Locktera's prior written authorization; or

(d) Conduct benchmarking, load testing, or performance evaluations in a manner that materially interferes with the security, availability, or performance of the Services.

Nothing in this Section prohibits legitimate evaluation of the Services, publication of independently obtained performance results that do not disclose Confidential Information, or activities expressly permitted under applicable law.

2. SECURITY OBLIGATIONS

Customer shall implement and maintain appropriate administrative, technical, and organizational security measures to protect its Account, credentials, systems, and Customer Data.

Customer shall:

Maintain the confidentiality and security of API Keys, authentication credentials, and access tokens;

Not share API Keys, credentials, or authentication tokens with unauthorized parties;

Implement appropriate access controls, authentication mechanisms, and security safeguards to prevent unauthorized access to Customer systems and applications;

Ensure that only authorized users and systems access the Services and Customer Data;

Properly configure access policies, authorization controls, and permissions governing Customer Data and encrypted containers;

Promptly notify Locktera without undue delay upon becoming aware of any actual or suspected unauthorized access, credential compromise, or security incident involving the Services;

Immediately revoke or rotate compromised credentials;

Take reasonable steps to prevent unauthorized access to the Services, including protecting Customer infrastructure, networks, applications, and devices;

Not attempt to bypass or undermine authentication, authorization, or cryptographic enforcement mechanisms.

Customer is responsible for activities conducted under its Account by Customer, its authorized End Users, and persons or systems to whom Customer has granted access, including activities resulting from Customer's failure to maintain appropriate credential security or access controls.

Customer shall not be responsible for unauthorized activities to the extent caused or contributed to by Locktera's breach of the Agreement, failure to implement required security measures, or other acts or omissions for which Locktera is responsible under applicable law.

Locktera shall not be responsible for unauthorized access to the extent resulting from Customer's failure to secure its credentials, systems, applications, or access controls, except to the extent Locktera caused or contributed to such unauthorized access.

3. CUSTOMER DATA RESPONSIBILITY

Customer is responsible for the content, legality, accuracy, and authorized use of Customer Data in connection with the Services, including Customer-defined access policies and authorization decisions, except to the extent responsibility arises from Locktera's obligations under the Agreement, the Data Processing Addendum, or applicable law.

Customer represents and warrants that:

• Customer has all necessary rights, permissions, and lawful authority to upload, encrypt, store, process, and share Customer Data using the Services;
• Customer has obtained all required permissions, consents, and authorizations from End Users and any other applicable third parties;
• Customer Data and Customer’s use of the Services comply with all applicable laws, regulations, and data protection requirements;
• Customer is solely responsible for determining who is authorized to access Customer Data and for configuring access policies, permissions, and authorization controls governing encrypted containers;
• Customer is solely responsible for granting, managing, and revoking access to Customer Data;
• Customer shall not use the Services to store, transmit, or process data in violation of applicable law.

Customer acknowledges that Locktera does not control Customer Data content, does not determine authorization policies, and does not determine who may access Customer Data.

To the extent permitted by applicable law, Locktera shall not be responsible for claims, losses, damages, or unauthorized access arising from Customer's unlawful use of Customer Data, Customer-defined authorization decisions, or Customer's failure to configure or maintain appropriate security controls, except to the extent caused or contributed to by Locktera.

Nothing in this Section limits Locktera's obligations under the Agreement, the Data Processing Addendum, or applicable law, or excludes liability for Locktera's own acts or omissions to the extent such liability cannot lawfully be excluded.

4. SERVICE PROTECTION

Customer shall not use the Services in any manner that harms, disrupts, or interferes with the integrity, security, availability, or performance of the Services or Locktera infrastructure.

Customer shall not, and shall not permit any third party or End User to:

• Damage, disable, disrupt, overburden, or impair the Services or Locktera infrastructure;
• Interfere with or disrupt other customers’ use of the Services;
• Generate excessive or abusive API requests or traffic that exceeds reasonable usage levels;
• Attempt to probe, scan, test, or assess the vulnerability of the Services or Locktera infrastructure without authorization;
• Attempt to gain unauthorized access to Locktera systems, infrastructure, networks, or environments;
• Attempt to bypass, undermine, or interfere with authentication, authorization, or cryptographic enforcement mechanisms;
• Access or use the Services in a manner intended to discover, extract, or exploit system architecture, cryptographic implementation, or infrastructure details;
• Use automated tools, bots, scripts, or other mechanisms to access the Services in a manner that disrupts or degrades Service performance;
• Use the Services in any manner that compromises or threatens the security, integrity, or availability of the Services.

Locktera may implement reasonable technical protections, including rate limiting, throttling, traffic filtering, blocking, or temporary access restrictions, where necessary to protect the security, integrity, availability, or performance of the Services. Such measures shall be proportionate to the identified risk and implemented in accordance with the Agreement.

5. INVESTIGATION AND ENFORCEMENT

Locktera reserves the right to investigate actual, suspected, or alleged violations of this Acceptable Use Policy and activities that reasonably threaten the security, integrity, availability, or lawful operation of the Services.

Where Locktera reasonably determines that an actual or suspected violation presents a material security risk, threatens Service availability, violates applicable law, or creates a substantial risk to other customers, Locktera may take proportionate protective measures, including:

(a) Restricting, suspending, or limiting access to affected Services, Accounts, API credentials, or integrations;

(b) Implementing rate limits, traffic restrictions, or other technical safeguards;

(c) Temporarily disabling access to affected resources where reasonably necessary to contain a security threat;

(d) Preserving relevant operational records and security evidence in accordance with applicable law and contractual obligations; and

(e) Cooperating with competent governmental authorities where legally required or permitted.

Locktera shall use commercially reasonable efforts to limit enforcement actions to affected Accounts, systems, or Services and avoid unnecessary disruption to unaffected Customer operations.

Except where necessary to comply with applicable law, address an immediate security threat, or carry out Customer's documented instructions, Locktera shall not intentionally delete or alter Customer Data as an enforcement measure.

Where Customer Data resides in Customer-controlled infrastructure, Locktera's enforcement authority shall be limited to the Services and technical controls under Locktera's authority.

Locktera may take immediate protective action without prior notice where reasonably necessary to prevent or mitigate a material security threat or unlawful activity.

Where practicable and legally permitted, Locktera shall notify Customer of material enforcement actions and provide a reasonable opportunity to remedy the violation.

Locktera shall not be liable for proportionate enforcement actions taken in good faith and in accordance with the Agreement and applicable law, except to the extent liability arises from Locktera's breach of its contractual or statutory obligations.

6. COOPERATION

Customer agrees to cooperate fully and promptly with Locktera in connection with any investigation of actual, suspected, or alleged violations of this Acceptable Use Policy or any activity that threatens the security, integrity, or availability of the Services.

Such cooperation shall include, without limitation:

• Providing relevant information, records, logs, or technical data relating to Customer’s use of the Services;
• Providing information relating to End Users, systems, or applications accessing the Services through Customer’s Account;
• Taking prompt corrective action to mitigate and prevent further violations;
• Assisting Locktera in investigating security incidents, unauthorized access, or misuse of the Services;
• Complying with reasonable requests from Locktera necessary to protect the Services or Locktera infrastructure.

Customer acknowledges that Locktera may take immediate action to protect the Services while any investigation is ongoing.

A material failure by Customer to provide reasonable cooperation necessary to investigate or mitigate a significant security threat or violation of this AUP may constitute a material breach of the Agreement, subject to applicable notice and cure provisions, except where immediate protective action is reasonably necessary.

Nothing in this Section requires Customer to disclose information protected by applicable legal privilege or to violate applicable law or binding confidentiality obligations.

7. THIRD-PARTY USE

Customer is responsible for access to and use of the Services under its Account by Customer and parties for whom Customer is responsible under the Agreement, subject to the limitations and exceptions set forth in this Section, including:

• End Users;
• Contractors;
• Affiliates;
• Agents or representatives;
• Any individual or entity accessing the Services through Customer credentials, API Keys, or authorization grants;
• Any party to whom Customer provides access to Customer Data or encrypted containers.

Customer shall ensure that all such parties comply with this Acceptable Use Policy and the Locktera Terms of Service.

Customer is responsible for:

(a) Activities conducted by Customer and its authorized End Users under Customer's Account or credentials;

(b) Unauthorized activities to the extent resulting from Customer's failure to maintain appropriate credential security, configure access controls properly, or manage authorization permissions; and

(c) Sharing, delegation, or distribution of access rights to Customer Data or encrypted containers by Customer or its authorized representatives.

Customer shall not be responsible for unauthorized activities to the extent caused or contributed to by Locktera's breach of the Agreement or applicable law.

A material violation of this AUP by Customer or an End User for whom Customer is responsible may result in suspension or termination of the affected Services in accordance with Sections 5 and 10 and the Agreement.

8. UPDATES TO THIS POLICY

Locktera may update this Acceptable Use Policy from time to time to reflect changes in the Services, security requirements, operational practices, or applicable law.

Updated versions will be published on Locktera's website or otherwise communicated to Customer.

Where an update materially and adversely affects Customer's rights or obligations, Locktera will provide reasonable advance notice through email, the Services interface, or another appropriate communication method, except where immediate changes are reasonably necessary to address security threats, legal requirements, or material operational risks.

Customer's continued use of the Services after the effective date of an updated AUP constitutes acceptance of the updated AUP, subject to applicable law and the Agreement.

If Customer does not agree to a material update, Customer may exercise any applicable termination rights established under the Agreement.

This AUP, as amended in accordance with this Section, remains incorporated into and governed by the Agreement.

9. REPORTING VIOLATIONS

Locktera encourages Customers, End Users, and third parties to report any suspected violations of this Acceptable Use Policy or any activity that may compromise the security, integrity, or availability of the Services.

Suspected violations, security concerns, or vulnerabilities may be reported to:

legal@locktera.com

Locktera reserves the right to investigate any reported violations and to take appropriate action in accordance with the Locktera Terms of Service and this Acceptable Use Policy.

Locktera's investigation and enforcement activities shall be governed by Section 5, the Agreement, and applicable law.

Locktera encourages responsible reporting of suspected security vulnerabilities. Submission of a vulnerability report does not authorize penetration testing, vulnerability scanning, exploitation, or access to systems or data without Locktera's prior written permission. Security researchers seeking authorization to conduct testing should contact legal@locktera.com. Locktera may establish a separate vulnerability disclosure policy governing authorized research and reporting procedures.

10. EFFECT OF VIOLATION

A material violation of this Acceptable Use Policy may constitute a material breach of the Agreement.

Locktera may exercise the suspension, termination, and other remedies available under the Agreement and applicable law, subject to the investigation and enforcement procedures established in Section 5.

Where reasonably practicable and consistent with the protection of the Services, Locktera may provide Customer with notice and an opportunity to remedy a violation before terminating the affected Services.

Nothing in this Section restricts Locktera's ability to take immediate, proportionate protective measures where necessary to address an imminent security threat, unlawful activity, or material interference with the Services.

Locktera reserves the right to seek recovery of damages, costs, and reasonable attorneys' fees to the extent recoverable under the Agreement or applicable law, and to seek injunctive or other equitable relief where legally available.

Nothing in this Section limits either party's mandatory obligations under applicable law.

11. CONTACT INFORMATION

If you have any questions regarding this Acceptable Use Policy or wish to report violations, you may contact Locktera at:

Locktera, Inc. Dallas, Texas, United States legal@locktera.com https://locktera.com

Locktera will review and investigate reported violations in accordance with its security and enforcement procedures.

12. INCORPORATION INTO AGREEMENT

This Acceptable Use Policy is incorporated by reference into and forms part of the Agreement governing Customer's access to and use of the Services.

A material violation of this AUP may constitute a material breach of the Agreement and may result in suspension, termination, or other remedies in accordance with Sections 5 and 10 and the applicable provisions of the Agreement.

In the event of a conflict between this AUP and the Agreement, the Agreement shall control, except where the Agreement expressly provides otherwise. Nothing in this AUP supersedes mandatory obligations under the Locktera Data Processing Addendum or applicable Data Protection Laws.

13. RESERVATION OF RIGHTS

Locktera reserves all rights and remedies available under the Agreement and applicable law with respect to violations of this Acceptable Use Policy.

Nothing in this Acceptable Use Policy limits Locktera’s ability to protect the security, integrity, and availability of the Services.

14. EFFECTIVE DATE AND ACCEPTANCE

This Acceptable Use Policy becomes effective on the date identified as its effective date in the published version or as otherwise specified in the applicable Agreement.

By accessing or using the Services, Customer agrees to comply with this AUP, subject to the terms of the Agreement and applicable law.

Locktera's rights and remedies arising from violations occurring before termination or suspension shall survive to the extent provided under the Agreement or required by applicable law.