Locktera CORE API Subscription Agreement

This Locktera CORE API Subscription Agreement (“Agreement”) is entered into by and between Locktera, Inc., a Texas corporation (“Locktera,” “Company,” “we,” “us,” or “our”), and the entity or organization identified in the applicable Order Form, Statement of Work, or other ordering document referencing this Agreement (“Customer,” “you,” or “your”).

This Agreement governs Customer’s access to and use of Locktera’s application programming interfaces (APIs), cryptographic container technology, encryption and policy enforcement systems, authorization mechanisms, software development kits (SDKs), developer tools, and related hosted, hybrid, or distributed services, including associated documentation, updates, and enhancements (collectively, the “Services”).

This Agreement is effective as of the date specified in the applicable Order Form, or if no Order Form exists, the date Customer first accesses or uses the Services (“Effective Date”).

1. DEFINITIONS

For purposes of this Agreement, the following capitalized terms shall have the meanings set forth below:

1.1 “API”

“API” means Locktera’s application programming interfaces that enable Customer systems to access, integrate with, and use the Services.

1.2 “Authorized Users”

“Authorized Users” means individuals or systems authorized by Customer to access or use the Services on Customer’s behalf, including:

(a) Customer’s employees;

(b) Customer’s contractors, consultants, or agents; and

(c) Customer-controlled applications, servers, or automated systems.

Customer is fully responsible for all acts and omissions of Authorized Users and all use of the Services under Customer’s account.

1.3 “Confidential Information”

“Confidential Information” has the meaning set forth in the Locktera CORE API Terms of Service.

1.4 “Container”

“Container” has the meaning set forth in the Locktera CORE API Terms of Service.

1.5 “Customer Data”

“Customer Data” has the meaning set forth in the Locktera CORE API Terms of Service.

1.6 “Documentation”

“Documentation” has the meaning set forth in the Locktera CORE API Terms of Service.

1.7 “Order Form”

“Order Form” has the meaning set forth in the Locktera CORE API Terms of Service.

1.8 “Services”

“Services” has the meaning set forth in the CORE API Terms of Service. The specific Services subscribed to are identified in the applicable Order Form.

1.9 “Subscription Term”

“Subscription Term” means the period during which Customer is authorized to access and use the Services, as specified in the applicable Order Form, including any renewal periods.

2. SCOPE OF SERVICES

The Services operate using cryptographic enforcement architecture as described in the TOS. Customer acknowledges and agrees to the shared responsibility model set forth therein.

2.1 Provision of Services

Subject to the terms and conditions of this Agreement and the applicable Order Form, Locktera shall make the Services available to Customer during the applicable Subscription Term.

Locktera shall provide the Services in accordance with the then-current Documentation.

Locktera may modify, enhance, or improve the Services from time to time, provided that such modifications do not materially reduce the core functionality of the Services purchased under the applicable Order Form.

3. LICENSE; ACCESS RIGHTS

Customer’s access to and use of the Services are governed by the license grant, ownership provisions, use restrictions, suspension rights, and related terms set forth in the Locktera CORE API Terms of Service (the “TOS”), which are incorporated herein by reference.

Nothing in this Agreement expands or modifies the scope of the license granted under the TOS except as expressly set forth in an applicable Order Form.

4. CUSTOMER RESPONSIBILITIES

4.1 Account Security and Credential Protection

Customer is solely responsible for maintaining the confidentiality and security of all credentials used to access the Services, including without limitation:

(a) API keys;

(b) authentication credentials;

(c) access tokens;

(d) encryption keys under Customer control; and

(e) administrative account credentials.

Customer shall implement and maintain reasonable administrative, technical, and physical safeguards designed to prevent unauthorized access to the Services.

Customer shall promptly notify Locktera of any known or suspected unauthorized access, credential compromise, or security incident affecting Customer’s account or use of the Services.

Locktera shall not be responsible for any loss, damage, or liability arising from unauthorized access resulting from Customer’s failure to secure its credentials or systems.

4.4 Authorized User Responsibility

Customer shall:

(a) ensure that all Authorized Users comply with this Agreement;

(b) ensure that Authorized Users access the Services solely for authorized purposes;

(c) promptly revoke access for individuals who are no longer authorized.

Customer is responsible and liable for all acts and omissions of its Authorized Users and any use of the Services under Customer’s account.

4.5 Compliance with Applicable Laws

Customer shall use the Services in compliance with all applicable laws, regulations, and governmental requirements, including without limitation those relating to:

(a) data protection and privacy;

(b) export controls and sanctions;

(c) intellectual property; and

(d) cybersecurity and data security.

Customer is solely responsible for determining whether the Services meet Customer’s legal and regulatory obligations.

4.6 Responsibility for Customer Systems and Infrastructure

Customer is solely responsible for:

(a) the security, operation, and maintenance of its systems, applications, and infrastructure;

(b) securing any third-party storage systems used to store encrypted containers;

(c) ensuring proper integration of the Services into Customer systems;

(d) protecting Customer systems from unauthorized access.

Locktera shall not be responsible for vulnerabilities, breaches, or failures arising from Customer systems, infrastructure, or integrations not controlled by Locktera.

4.7 Responsibility for Customer Data and Authorization Decisions

Customer retains sole responsibility for:

(a) the accuracy, integrity, and legality of Customer Data;

(b) determining who may access Customer Data;

(c) granting, restricting, or revoking access to Customer Data;

(d) ensuring that Customer’s authorization policies reflect Customer’s intended access controls.

Locktera does not review, monitor, or control Customer authorization decisions.

4.8 Account Activity Responsibility

Customer is fully responsible for all activities conducted under its account, whether authorized or unauthorized, except to the extent caused by Locktera’s breach of this Agreement.

4.9 Identity and Access Responsibility

Customer is responsible for identifying, authenticating, and authorizing individuals or systems requesting access to Customer Data or encrypted Containers through Customer applications or integrations with the Services.

Customer shall implement and maintain appropriate identity management and authentication mechanisms within Customer-controlled systems, applications, and infrastructure, including integrations with third-party identity providers, OpenID Connect (OIDC), Identity and Access Management (IAM) systems, Single Sign-On (SSO) platforms, or similar authentication frameworks, as applicable.

Locktera provides authentication and authorization mechanisms for access to the CORE API Services, including validation of API credentials, evaluation of authorization requests, and enforcement of applicable cryptographic access policies.

Unless expressly agreed otherwise in writing, Locktera does not act as the identity provider or user directory for End Users of Customer applications and does not independently verify the real-world identity of such End Users.

Locktera may rely on identity context, recipient identifiers, authentication assertions, and authorization parameters supplied by Customer systems when evaluating access policies and enforcing cryptographic authorization controls.

Customer is responsible for ensuring that identity information and authorization parameters supplied by Customer-controlled systems accurately represent the authenticated user or system requesting access.

Locktera shall not be responsible for unauthorized access resulting from Customer-controlled identity management systems, authentication failures, incorrect identity information, misconfigured authorization policies, or compromised Customer credentials, except to the extent such unauthorized access is caused or contributed to by Locktera's breach of this Agreement or failure to perform its expressly agreed security obligations.

5. FEES AND PAYMENT

5.1 Fees

Customer shall pay all fees, charges, and other amounts (“Fees”) specified in the applicable Order Form.

Except as expressly stated in this Agreement or the applicable Order Form, all Fees are:

(a) non-cancelable;

(b) non-refundable; and

(c) not subject to offset or deduction.

Fees are based on Services purchased, subscription scope, or usage, and are not contingent upon Customer’s actual usage unless expressly stated in the applicable Order Form.

5.2 Invoicing and Payment Terms

Unless otherwise specified in the applicable Order Form:

(a) Locktera shall invoice Customer for Fees in advance or in arrears, as applicable;

(b) Customer shall pay all undisputed invoices within thirty (30) days from the invoice date;

(c) payments shall be made in U.S. dollars by approved payment methods specified by Locktera;

(d) Customer shall maintain accurate and current billing and payment information.

Customer shall notify Locktera in writing of any good-faith dispute regarding an invoice within fifteen (15) days of the invoice date. Failure to provide timely notice constitutes Customer’s acceptance of the invoice.

Undisputed amounts remain payable and shall not be withheld due to disputes relating to other invoices or Services.

5.3 Late Payments

Any amounts not paid when due may, at Locktera’s option, accrue interest at the lesser of:

(a) one and one-half percent (1.5%) per month; or

(b) the maximum rate permitted by applicable law,

from the date due until paid.

Customer shall be responsible for all reasonable costs incurred by Locktera in collecting overdue amounts, including attorneys’ fees, court costs, and collection agency fees, to the extent permitted by law.

5.4 Suspension for Nonpayment

Locktera may suspend Customer’s access to the Services if Customer fails to pay undisputed Fees when due and fails to cure such nonpayment within ten (10) days after receiving written notice from Locktera.

Locktera shall have no liability for any damages, losses, or liabilities arising from suspension of Services due to Customer’s nonpayment.

Suspension does not relieve Customer of its obligation to pay Fees.

5.5 Taxes

Fees do not include any taxes, duties, or governmental assessments, including sales, use, value-added, or withholding taxes (“Taxes”).

Customer is responsible for all Taxes associated with its purchase or use of the Services, excluding taxes based on Locktera’s net income.

If Customer is required by law to withhold any taxes, Customer shall gross-up payments such that Locktera receives the full amount of Fees due.

5.6 Fee Changes

Locktera may modify Fees upon renewal of the Subscription Term or upon prior written notice to Customer, provided that any fee increase shall not take effect during the then-current Subscription Term unless expressly permitted in the applicable Order Form.

6. CUSTOMER DATA

6.1 Customer Ownership of Customer Data

As between the parties, Customer retains all right, title, and interest in and to Customer Data, including all intellectual property rights therein.

Locktera acquires no ownership rights in Customer Data.

Except as expressly provided in this Agreement, nothing herein shall be construed as granting Locktera any rights to Customer Data.

Customer is solely responsible for the accuracy, integrity, legality, and content of Customer Data and for obtaining all rights, permissions, and authorizations necessary for Locktera to process Customer Data in accordance with this Agreement.

6.2 Limited License to Process Customer Data

Customer hereby grants Locktera a limited, non-exclusive, non-transferable license to access, process, transmit, store, and use Customer Data solely to the extent necessary to:

(a) provide, operate, maintain, and support the Services;

(b) enforce cryptographic access controls, authorization policies, and security protections;

(c) detect, prevent, and respond to security incidents, fraud, or abuse;

(d) comply with applicable laws, regulations, or binding legal obligations; and

(e) generate system metadata necessary for operation, security, billing, and compliance.

Locktera shall not use Customer Data for any purpose other than those expressly permitted by this Agreement.

6.3 Cryptographic Protection and Access Model

Customer acknowledges that Customer Data may be encrypted into cryptographic Containers and protected using encryption and authorization enforcement mechanisms.

Locktera's ability to access or decrypt protected Customer Data depends on the applicable Service, deployment architecture, Customer-defined authorization policies, and cryptographic key management configuration.

Locktera does not independently determine access permissions to Customer Data and does not decrypt protected Customer Data for advertising, profiling, or unrelated commercial purposes.

Customer retains responsibility for defining and managing authorization policies governing access to Customer Data.

Any legally required disclosure of Customer Data shall be subject to applicable law and Locktera's technical ability to access the requested information.

6.4 Machine Learning and Artificial Intelligence Restrictions

Locktera shall not use Customer Data, including encrypted or decrypted Customer Data, to train, fine-tune, validate, test, or improve any machine learning models, artificial intelligence systems, or algorithmic models, except with Customer’s prior express written authorization.

Locktera shall not use Customer Data for model training, profiling, behavioral analysis, or any purpose unrelated to providing the Services, unless explicitly authorized by Customer in writing.

This restriction does not apply to:

(a) anonymized and aggregated system metadata that does not identify Customer or Customer Data; or

(b) operational telemetry necessary to maintain the security, performance, or reliability of the Services.

6.5 Security and Integrity of Customer Data

Locktera shall implement and maintain reasonable administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, disclosure, or alteration.

Customer acknowledges that no system can guarantee absolute security, and Locktera does not warrant that unauthorized access will never occur.

6.6 Service Metadata and Operational Data

Locktera may collect and use operational metadata generated by Customer’s use of the Services, including without limitation:

(a) system performance metrics;

(b) audit and access logs;

(c) usage metrics; and

(d) operational telemetry.

Such metadata shall not include the contents of encrypted Customer Data and may be used by Locktera to operate, maintain, secure, and improve the Services.

6.7 No Obligation to Monitor Customer Data

Locktera does not monitor, review, or control Customer Data and shall have no responsibility for the content, accuracy, legality, or integrity of Customer Data except as expressly required to provide the Services.

7. SECURITY

Security obligations relating to the Services, including encryption mechanisms, container-level access enforcement, authorization validation, credential management responsibilities, shared responsibility allocation, and Security Incident notification, are governed by the Locktera CORE API Terms of Service.

This Agreement governs commercial subscription terms only and does not alter the security architecture or security allocation of responsibilities described in the TOS unless expressly set forth in an applicable Order Form.

Security controls are described in the TOS. Any uptime commitments or service credits shall be governed solely by a separate written Service Level Agreement, if applicable.

8. DATA PROTECTION

8.1 Data Processing Addendum

To the extent Locktera processes Personal Data on behalf of Customer, the Locktera Data Processing Addendum (“DPA”) is hereby incorporated into and forms part of this Agreement by reference.

The DPA governs the parties’ respective obligations with respect to the processing of Personal Data and shall control in the event of any conflict with this Agreement regarding Personal Data processing.

8.2 Roles of the Parties

To the extent Locktera processes Customer Personal Data on behalf of Customer in providing the Services, Customer acts as the data controller (or equivalent legal role), and Locktera acts as the data processor (or equivalent legal role), subject to the applicable Data Processing Addendum.

Locktera may separately act as an independent data controller for Personal Data processed for its own legitimate business purposes, including account administration, billing, security administration, and business communications, as described in the Locktera Privacy Policy.

Customer determines the purposes and means of processing Personal Data, including what Personal Data is submitted to the Services, how it is used, and who is authorized to access it.

Locktera processes Personal Data solely to provide the Services and does not determine the purposes or means of processing Personal Data.

Nothing in this Agreement shall be construed to grant Locktera ownership or control over Personal Data.

8.3 Processing on Customer Instructions

Locktera shall process Personal Data solely:

(a) in accordance with Customer’s documented instructions, including instructions provided through Customer’s use and configuration of the Services;

(b) as necessary to provide, operate, maintain, and support the Services; and

(c) as required to comply with applicable law, regulation, or binding governmental order.

Customer acknowledges that Customer’s configuration of authorization policies, API requests, and Service settings constitutes Customer’s instructions to Locktera.

8.4 Customer Responsibilities for Personal Data

Customer is solely responsible for:

(a) determining whether Customer Data includes Personal Data;

(b) ensuring that Customer has all necessary rights, consents, and legal bases required to provide Personal Data to Locktera for processing;

(c) complying with all applicable data protection and privacy laws;

(d) configuring the Services in a manner consistent with Customer’s legal obligations.

Customer represents and warrants that its instructions to Locktera regarding Personal Data comply with applicable law.

8.5 Security of Personal Data

Locktera shall implement and maintain reasonable administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction, as described in Section 7 (Security) and the DPA.

Such safeguards shall include encryption and access control mechanisms appropriate to the nature of the Services.

8.6 Subprocessors

Locktera may engage subprocessors to assist in providing the Services, provided that:

(a) Locktera remains responsible for the acts and omissions of its subprocessors to the same extent as Locktera under this Agreement; and

(b) such subprocessors are subject to data protection obligations consistent with this Agreement and the DPA.

8.7 International Data Transfers

To the extent Personal Data is transferred across national borders, Locktera shall implement appropriate safeguards as required by applicable data protection laws, including contractual protections incorporated in the DPA.

8.8 No Sale of Personal Data

Locktera does not sell Customer Personal Data and does not process Personal Data for advertising or profiling purposes unrelated to providing the Services.

9. CONFIDENTIALITY

Confidentiality obligations relating to the Services, including the definition of Confidential Information, protection standards, exclusions, compelled disclosure, duration of confidentiality, and remedies, are governed solely by Section 7 of the Locktera CORE API Terms of Service (the “TOS”), which is incorporated herein by reference.

This Agreement governs commercial subscription terms only and does not modify the confidentiality obligations set forth in the TOS unless expressly stated in an applicable Order Form.

10. TERM AND TERMINATION

Notwithstanding anything to the contrary in the Locktera CORE API Terms of Service (the “TOS”), the parties’ termination rights and obligations during any active Subscription Term shall be governed exclusively by this Section 10.

10.1 Term

This Agreement shall commence on the Effective Date and shall remain in effect for the duration of the Subscription Term specified in the applicable Order Form, unless earlier terminated in accordance with this Agreement.

Each Order Form shall have its own Subscription Term. Unless otherwise specified in the applicable Order Form, Subscription Terms shall automatically renew for successive renewal periods equal to the initial Subscription Term unless either party provides written notice of non-renewal at least thirty (30) days prior to the expiration of the then-current Subscription Term.

10.2 Termination for Cause

Either party may terminate this Agreement or any applicable Order Form upon written notice if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days after receiving written notice describing the breach in reasonable detail.

Locktera may terminate this Agreement or suspend access to the Services immediately upon written notice if:

(a) Customer fails to pay undisputed Fees when due and does not cure such failure within ten (10) days after written notice;

(b) Customer intentionally or materially violates applicable license restrictions in a manner that presents a significant security, intellectual property, or operational risk to Locktera, or fails to cure another material license violation within the applicable cure period;

(c) Customer’s use of the Services violates applicable law or poses a security risk to the Services or other customers; or

(d) continued provision of the Services would violate applicable law or legal obligations.

10.3 Termination for Convenience

Unless otherwise expressly provided in an applicable Order Form, neither party may terminate an active Subscription Term for convenience before its scheduled expiration.

Either party may elect not to renew a Subscription Term by providing written notice in accordance with Section 10.1.

The parties may mutually agree in writing to terminate an active Subscription Term before its scheduled expiration, including any applicable early termination fees, outstanding payment obligations, transition arrangements, and other agreed conditions.

Nothing in this Section limits either party's right to terminate for cause in accordance with Section 10.2 or any termination right expressly provided elsewhere in this Agreement or an applicable Order Form.

10.4 Effect of Termination

Upon expiration or termination of this Agreement or an applicable Order Form:

(a) Customer's right to initiate new production use of the Services shall terminate, except as otherwise expressly permitted under an applicable Order Form, transition agreement, or authorized Data Export Period;

(b) Customer shall cease creating new integrations, provisioning new Embedded Applications, or initiating new production workloads using the terminated Services, unless otherwise authorized in writing by Locktera;

(c) Customer shall remain responsible for all Fees accrued or otherwise payable under this Agreement or the applicable Order Form;

(d) Customer shall discontinue use of Locktera software, SDKs, and Documentation except to the extent reasonably necessary to exercise expressly authorized transition, export, or wind-down rights;

(e) Any continued access to the Services during an authorized transition or Data Export Period shall remain subject to the applicable security, licensing, confidentiality, and payment obligations of this Agreement;

(f) Locktera shall have no obligation to provide ongoing production Services after termination or expiration except as expressly required under this Agreement, an applicable Order Form, or a separate written transition agreement.

Termination shall not transfer ownership of Customer Data to Locktera or alter the parties' respective intellectual property rights.

The treatment of Customer Data following termination shall be governed by Section 10.5 and the applicable Data Processing Addendum.

10.5 Customer Data Export, Retention, and Transition

Following expiration or termination of this Agreement or an applicable Order Form, Customer may request access to available Customer Data export functionality for a period of thirty (30) days (the “Data Export Period”), unless otherwise specified in an applicable Order Form or required by applicable law.

During the Data Export Period, Locktera shall make available such export functionality as is supported by the applicable Services and reasonably necessary for Customer to retrieve Customer Data maintained within Locktera-controlled systems, subject to applicable security requirements and any lawful suspension or restriction of access.

Customer acknowledges that encrypted Containers stored in Customer-controlled or third-party storage environments remain under the control of the applicable storage account owner and are not automatically deleted or transferred by Locktera upon termination.

Customer is responsible for maintaining appropriate copies of Customer Data, encryption keys under Customer control, integration configurations, and other Customer-controlled information necessary for its operations.

Continued authorization services, cryptographic access enforcement, decryption-related operations, or other CORE API functionality following termination are not included in the Data Export Period unless expressly authorized under an applicable Order Form or separate written transition agreement.

Following expiration of the Data Export Period, Locktera may delete or render inaccessible Customer Data maintained within Locktera-controlled systems in accordance with the applicable Data Processing Addendum, Customer instructions, and applicable law.

Locktera shall have no obligation to retain Customer Data beyond the applicable retention period except as required by law or expressly agreed in writing.

Nothing in this Section requires Locktera to disclose proprietary cryptographic architecture, source code, security mechanisms, or other Locktera Confidential Information.

10.6 Effect of Suspension and Termination on Cryptographic Protection

Suspension, expiration, or termination of this Agreement does not, by itself, remove encryption or other cryptographic protections previously applied to Customer Data or encrypted Containers.

Customer acknowledges that the ability to access or decrypt encrypted Containers may depend on continued availability of applicable authorization services, cryptographic key management components, Customer-controlled credentials, and other technical dependencies associated with the Services.

Unless expressly provided in an applicable Order Form or separate written transition agreement, Locktera is not obligated to maintain ongoing authorization, key management, decryption, or cryptographic enforcement services following expiration or termination of the applicable Subscription Term.

Customer is responsible for evaluating the operational dependencies of its applications and encrypted Containers and implementing appropriate continuity, backup, and transition arrangements consistent with the Documentation and applicable Service configuration.

Nothing in this Section authorizes Customer to circumvent Locktera's cryptographic protections, licensing controls, or intellectual property rights.

10.7 Survival

The following Sections shall survive expiration or termination of this Agreement:

Fees and Payment obligations accrued prior to termination

License Restrictions

Confidentiality

Customer Data provisions

Limitation of Liability

Indemnification

Export Controls

Survival provisions

Any other provisions that by their nature are intended to survive termination

11. WARRANTIES AND DISCLAIMERS

11.1 Mutual Authority Warranty

Each party represents and warrants that:

(a) it is duly organized and validly existing under applicable law;

(b) it has full power and authority to enter into and perform this Agreement; and

(c) this Agreement constitutes a valid and binding obligation enforceable against it in accordance with its terms.

11.2 Limited Service Warranty

Locktera warrants that during the Subscription Term:

(a) the Services will materially conform to the applicable Documentation; and

(b) Locktera will provide the Services in a professional and workmanlike manner consistent with industry standards.

Customer’s sole and exclusive remedy, and Locktera’s sole liability, for breach of this warranty shall be for Locktera to use commercially reasonable efforts to correct the nonconformity.

11.3 Disclaimer of Warranties

EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.”

LOCKTERA DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WITHOUT LIMITATION:

(a) ANY IMPLIED WARRANTIES OF MERCHANTABILITY;

(b) FITNESS FOR A PARTICULAR PURPOSE;

(c) NON-INFRINGEMENT;

(d) TITLE;

(e) ACCURACY, COMPLETENESS, OR RELIABILITY OF RESULTS;

(f) THAT THE SERVICES WILL MEET CUSTOMER’S REQUIREMENTS;

(g) THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF HARMFUL COMPONENTS.

11.4 No Guarantee of Uninterrupted or Error-Free Service

Customer acknowledges that:

(a) the Services may be subject to limitations, delays, and other issues inherent in the use of internet and cloud-based systems;

(b) Locktera does not guarantee uninterrupted availability or operation of the Services;

(c) temporary service interruptions may occur for maintenance, updates, security measures, or circumstances beyond Locktera’s reasonable control.

Locktera shall not be liable for delays, interruptions, or failures resulting from events beyond its reasonable control, including network failures, third-party service outages, force majeure events, or Customer system failures.

11.5 Security Disclaimer

While Locktera implements commercially reasonable security safeguards as described in this Agreement, Locktera does not warrant or guarantee that:

(a) unauthorized access will never occur;

(b) security incidents will never arise; or

(c) the Services are immune from compromise.

Customer acknowledges that no system can provide absolute security.

Locktera does not warrant that encryption mechanisms will prevent all unauthorized access under all circumstances.

11.6 No Legal or Compliance Warranty

Locktera does not warrant that the Services will ensure Customer’s compliance with any specific law, regulation, or industry standard.

Customer is solely responsible for determining whether the Services meet Customer’s legal or regulatory requirements.

11.7 Disclaimer of Third-Party Integrations and Infrastructure

The Services may interoperate with or be used in connection with Customer systems, third-party software, storage providers, cloud infrastructure, networks, or other third-party services not controlled by Locktera.

Locktera does not warrant, endorse, or assume responsibility for the security, availability, integrity, or performance of any Customer systems or third-party systems.

Locktera shall not be liable for any loss, damage, unauthorized access, or security incident arising from:

(a) Customer systems, applications, or infrastructure;

(b) third-party storage providers, cloud infrastructure, or networks;

(c) Customer integrations with third-party software or services; or

(d) failures, vulnerabilities, or misconfigurations of systems not controlled by Locktera.

Customer is solely responsible for securing its systems and any third-party systems used in connection with the Services.

12. LIMITATION OF LIABILITY

All limitations of liability, exclusions of damages, liability caps, aggregation rules, and applicable carve-outs relating to the Services are governed solely by Section 10 of the Locktera CORE API Terms of Service (the “TOS”), which is incorporated herein by reference.

This Agreement governs commercial subscription terms only and shall not expand, alter, or override the liability limitations set forth in the TOS unless expressly stated in an applicable Order Form.

13. INDEMNIFICATION

All indemnification obligations relating to the Services, including defense obligations, settlement control, intellectual property infringement claims, exclusions, procedures, and limitations, are governed solely by Section 9 of the Locktera CORE API Terms of Service (the “TOS”), which is incorporated herein by reference.

This Agreement governs commercial subscription terms only and does not modify or expand the indemnification obligations set forth in the TOS unless expressly stated in an applicable Order Form.

14. ACCEPTABLE USE POLICY

14.1 Compliance with Acceptable Use Policy

Customer shall comply with the Locktera Acceptable Use Policy (“AUP”), as may be updated from time to time and made available by Locktera.

The AUP is incorporated by reference into this Agreement and forms a binding part hereof.

Customer shall ensure that all Authorized Users comply with the AUP.

14.2 Prohibited Uses

Without limiting the generality of the AUP, Customer shall not, and shall not permit any third party to, use the Services to:

(a) violate any applicable law, regulation, or governmental order;

(b) store, transmit, or process content that is unlawful, infringing, fraudulent, or abusive;

(c) interfere with, disrupt, or attempt to gain unauthorized access to the Services or related systems;

(d) probe, scan, test, or exploit vulnerabilities in the Services without Locktera’s prior written authorization;

(e) attempt to bypass, disable, or circumvent cryptographic enforcement mechanisms, access controls, authorization systems, or security features;

(f) use the Services in a manner that materially degrades or interferes with the operation of the Services;

(g) conduct security attacks, including denial-of-service attacks, against Locktera infrastructure or other users;

(h) use the Services for competitive analysis, benchmarking, or development of competing products or services, except as expressly authorized;

(i) distribute malware or malicious code through the Services.

14.3 Monitoring and Enforcement

Locktera may investigate suspected violations of the AUP and may take appropriate action, including:

(a) suspension or restriction of access to the Services;

(b) removal of content where permitted by law;

(c) reporting unlawful activity to appropriate authorities;

(d) termination of this Agreement.

Locktera shall use reasonable discretion in exercising its rights under this Section.

14.4 Material Breach

A material violation of the Acceptable Use Policy constitutes a material breach of this Agreement.

Locktera may immediately suspend or restrict access to the Services where reasonably necessary to prevent or mitigate unlawful activity, a significant security risk, unauthorized access, or material harm to Locktera, its customers, or the Services.

Except where immediate termination is permitted under Section 10.2 or required by applicable law, termination for an Acceptable Use Policy violation shall be subject to the applicable notice and cure provisions of Section 10.2.

Suspension or termination under this Section shall not relieve Customer of payment obligations properly due under this Agreement.

14.5 Updates to the AUP

Locktera may update the AUP from time to time to reflect changes in law, technology, or operational requirements.

Material changes to the AUP shall become effective upon reasonable notice to Customer.

Continued use of the Services following such notice constitutes acceptance of the updated AUP.

15. ASSIGNMENT

15.1 Assignment by Locktera

Locktera may assign or transfer this Agreement, in whole or in part, without Customer’s consent:

(a) to an affiliate; or

(b) in connection with a merger, acquisition, corporate reorganization, sale of all or substantially all of its assets, change of control, or similar transaction.

This Agreement shall be binding upon and inure to the benefit of Locktera’s permitted successors and assigns.

15.2 Assignment by Customer

Customer shall not assign, transfer, delegate, or otherwise convey this Agreement, in whole or in part, whether by operation of law or otherwise, without the prior written consent of Locktera, which shall not be unreasonably withheld.

Any attempted assignment in violation of this Section shall be null and void.

15.3 Permitted Internal Transfers

Notwithstanding the foregoing, Customer may assign this Agreement without Locktera’s consent to an affiliate or in connection with a merger, acquisition, or sale of all or substantially all of Customer’s assets, provided that:

(a) the assignee agrees in writing to be bound by this Agreement; and

(b) Customer provides prompt written notice to Locktera.

Customer shall remain liable for any obligations arising prior to assignment.

15.4 No Assignment of Access Rights or Credentials

Customer shall not assign, transfer, sell, sublicense, or otherwise transfer access credentials, API keys, or rights to access the Services to any third party except as expressly permitted under this Agreement.

16. GOVERNING LAW

16.1 Governing Law

This Agreement and any dispute, claim, or controversy arising out of or relating to this Agreement or the Services shall be governed by and construed in accordance with the laws of the State of Texas, without regard to its conflict-of-laws principles.

The United Nations Convention on Contracts for the International Sale of Goods does not apply to this Agreement.

16.2 Venue and Jurisdiction

Any legal action, suit, or proceeding arising out of or relating to this Agreement shall be brought exclusively in the state or federal courts located in Dallas County, Texas.

Each party hereby irrevocably submits to the exclusive jurisdiction and venue of such courts and waives any objection based on improper venue or inconvenient forum.

16.3 Equitable Relief

Notwithstanding the foregoing, either party may seek injunctive relief, equitable relief, or other remedies in any court of competent jurisdiction to protect its intellectual property, Confidential Information, or security interests.

17. ENTIRE AGREEMENT

17.1 Entire Agreement

This Subscription Agreement, together with the Locktera CORE API Terms of Service (the “TOS”), any applicable Order Forms, OEM / Embedded Use Addenda, Data Processing Addendum (DPA), Acceptable Use Policy, Privacy Policy, Documentation, and any exhibits or addenda expressly incorporated herein (collectively, the “Agreement”), constitutes the entire agreement between the parties regarding the subject matter hereof and supersedes all prior or contemporaneous agreements, proposals, negotiations, representations, or communications, whether written or oral.

17.2 Order of Precedence

In the event of any conflict, inconsistency, or ambiguity between this Subscription Agreement and the Locktera CORE API Terms of Service (the “TOS”), this Subscription Agreement shall control with respect to the Services purchased under the applicable Order Form.

Except as expressly provided herein, all other conflicts between documents comprising the Agreement shall be resolved in accordance with the Order of Precedence set forth in the TOS.

17.3 Amendments

Except as otherwise expressly permitted herein, this Subscription Agreement and the Locktera CORE API Terms of Service (the “TOS”), as incorporated herein, may be amended only by a written document signed by authorized representatives of both parties.

Notwithstanding the foregoing, Locktera may update the Acceptable Use Policy, Privacy Policy, and Documentation from time to time upon reasonable notice to Customer; provided that such updates shall not materially reduce the core functionality of the Services purchased under the applicable Order Form or materially diminish Customer’s rights during the Subscription Term.

17.4 Waiver

Failure by either party to enforce any provision of this Agreement shall not constitute a waiver of future enforcement of that or any other provision.

Any waiver must be in writing and signed by the waiving party.

17.5 Severability

If any provision of this Agreement is held to be invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect.

The invalid provision shall be modified to the minimum extent necessary to make it enforceable while preserving its original intent.

17.6 Independent Contractors

The parties are independent contractors, and nothing in this Agreement shall create any partnership, joint venture, agency, or fiduciary relationship.

Neither party has authority to bind the other.

18. SIGNATURES

18.1 Authority to Execute

Each individual signing this Agreement represents and warrants that they have full legal authority to bind the respective party to this Agreement.

18.2 Electronic Signatures

This Agreement may be executed by electronic signature, including via DocuSign or similar electronic signature platforms, and such electronic signatures shall be deemed to have the same legal effect as original signatures.

18.3 Counterparts

This Agreement may be executed in one or more counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same agreement.

This online copy is provided for review. Execution and acceptance of this Agreement are governed by the applicable Order Form and the terms of this Agreement. Signature blocks are included in the execution version provided to contracting parties.