DeRISK™ Intelligence Platform — End User License Agreement

This EULA is a contract between DeNexus, Inc. and the organization you represent. It governs access to and use of the DeRISK™ Intelligence Platform. You accept it by ticking the acceptance box and selecting "Start". Capitalized terms are defined in the Definitions section at the end.

1. Who this agreement is between

1.1 DeNexus. DeNexus, Inc., a Delaware corporation, 101 Federal Street, Suite 1900, Boston, MA 02110, USA ("DeNexus", "we", "us"). We may designate an Affiliate as the contracting party for a region by updating Schedule A or in an Order Form.

1.2 Customer. The organization identified at sign-up by its legal name, country and email domain ("Customer", "you").

1.3 Authority. The individual who accepts this EULA confirms they are authorized to bind the Customer. If they are not, they are personally bound and must not use the Services.

1.4 Business use only. The Services are for organizations acting for business or professional purposes. They are not offered to consumers.

1.5 Eligibility. You confirm that you are not a Competitor, not acting for a Competitor, and not a Restricted Party (Section 16). A false confirmation is a material breach.

1.6 Acceptance and record. You accept by ticking the acceptance box and selecting "Start". We record the EULA version, date and time, user and organization. You can download this EULA at any time, and we email a confirmation of acceptance.

2. Order of precedence

2.1 Signed agreements replace this EULA. If you and DeNexus sign a DeRISK™ Master Services Agreement ("MSA"), the MSA governs your use instead of this EULA. Each of your Authorized Users still accepts Schedule B at first Start.

2.2 Ranking. If documents conflict, this order applies:

1. an Order Form, but only where it names and expressly modifies a specific provision;
2. the MSA;
3. the Data Processing Addendum (Schedule C), for personal data;
4. the other Schedules;
5. this EULA.

2.3 Schedules. Schedules A to F form part of this EULA. Each carries its own version number and date, and can change independently of this EULA.

2.4 Your terms do not apply. Terms in your purchase orders, vendor portals or similar documents have no effect, even if we accept or sign them.

3. The Services

3.1 What is covered. This EULA covers the DeRISK™ Intelligence Platform and its products: DeRISK™ CRQ, DeRISK™ Threat Intelligence, DeRISK™ UWA and DeRISK™ UWA-CP. It also covers the add-ons DeRISK™ Davy, DeRISK™ Scenario Simulator, DeRISK™ Consultant, Premium Threat-Intel Feed and Bring Your Own Threat-Intel (together, the "Services"). Schedule A states what each product, tier and add-on includes and where it is available.

3.2 Tiers. "Free Tiers" are DeRISK CRQ Levels 1–2, DeRISK UWA and UWA-CP Standard, and any trial or pilot. "Premium Tiers" are DeRISK CRQ Levels 3–5, DeRISK UWA and UWA-CP Professional and Enterprise, and all add-ons.

3.3 Licence. We grant you a limited, non-exclusive, non-transferable, non-sublicensable right to use the Services during the term. You may use them for your internal business purposes and for your clients under Section 4.3, within the entitlements in Schedule A or your Order Form.

3.4 Changes to the Services. We may add, change or remove features. If we materially reduce a paid feature during a committed term, you may terminate the affected subscription and receive a pro-rata refund of prepaid fees.

3.5 Free Tiers and pilots. We may change, limit, suspend or discontinue Free Tiers and pilots at any time. They come without support or service levels.

3.6 No roadmap commitments. Your purchase does not depend on any future feature. Statements about future products or features are not commitments.

3.7 Third-party services. Connectors and other third-party products you choose to use are governed by their providers' terms. We are not responsible for them.

4. Accounts and users

4.1 Authorized Users. Only your employees and contractors you authorize ("Authorized Users") may use the Services. Each needs individual credentials, which must not be shared. You are responsible for their acts and omissions.

4.2 Credentials. Keep credentials secure. Tell us promptly if you suspect any compromise.

4.3 Use for your clients. On any tier, you may use the Services on behalf of your clients, such as an insured, an applicant or an operator. To do so you must:

• have each client's authorization and the right to submit its data;
• remain fully responsible for that use;
• never act for a Competitor.

Your clients get no rights against DeNexus. Reselling the Services, or offering them as your own service, requires a separate partner agreement.

4.4 Agents and automation. Anything done through your credentials or our API, by a person, script or AI agent, is your act. Automated access is allowed only through interfaces we provide.

4.5 Accurate information. Keep your sign-up details accurate, including legal name, country and email domain.

5. Acceptable use

5.1 Rules. You and your Authorized Users must follow Schedule B (Acceptable Use & AI Responsibilities). This Section 5 sets out the core rules.

5.2 No Competitors. Competitors may not access or use the Services on any tier without our prior written consent. No one may use the Services for a Competitor.

5.3 Prohibited conduct. You must not, and must not let anyone:

• analyze, benchmark or copy the Services, or use them to build or improve a competing product;
• use Outputs or the Services to train, calibrate, validate or distil any AI Model;
• extract DeNexus content in bulk, including questionnaire libraries, frameworks and threat intelligence;
• probe prompts or agent logic, attempt prompt injection or jailbreaks, or reverse engineer, decompile or disassemble any part of the Services;
• scrape the Services or access them by automated means, except through interfaces we provide;
• open multiple or false accounts, including to exceed Free Tier limits, or share credentials;
• perform security or penetration testing without our written consent, except under our published vulnerability disclosure policy;
• use threat intelligence to target or harm any third party;
• upload malicious code, or content you have no right to submit, such as licensed standards;
• publish benchmark or performance results about the Services;
• use the Services unlawfully or to infringe anyone's rights.

5.4 Monitoring. We may monitor use of the Services to detect and stop abuse, as described in our privacy notice.

5.5 Remedies. If you breach Section 5, we may:

• suspend or terminate your access immediately, without notice or refund;
• revoke your licence to Outputs and require you to delete Outputs and DeNexus content;
• charge a licence fee for all unauthorized use at our then-current Premium Tier list price;
• seek injunctive relief in any competent court;
• recover our reasonable legal and enforcement costs.

These remedies are cumulative. Section 14 does not limit them.

6. AI and Outputs

6.1 Nature of Outputs. The Services use AI Models. Outputs are probabilistic, model-based estimates that depend on your inputs and on stated assumptions. They may be incomplete or inaccurate. They may also be similar to Outputs other customers receive.

6.2 Not advice. Outputs are not insurance, actuarial, underwriting, financial, investment, credit, engineering, safety or legal advice. They are not a rating, certification or guarantee of security.

6.3 Human review. Qualified personnel must review Outputs before you rely on them. In DeRISK UWA and UWA-CP, a qualified underwriter must make every decision to bind, price, decline or set conditions. Automated ("Auto-Pilot") features may only rank, route or prioritize submissions.

6.4 Your decisions and duties. You alone are responsible for decisions you take using Outputs. You are also responsible for the legal and regulatory duties that apply to you, including:

• notices to applicants or insureds;
• human-oversight and AI-literacy duties;
• keeping your own records of inputs, Outputs and decisions. We do not keep a long-term archive for you.

6.5 Prohibited high-risk uses. You must not use the Services:

• to assess risk or set prices for natural persons in life or health insurance;
• to evaluate the creditworthiness of, or credit-score, natural persons;
• as a safety component of, or to control, critical infrastructure or industrial control systems.

Tell us before any use that could be high-risk under the EU AI Act. Schedule B allocates the EU AI Act roles and duties between us.

6.6 Sharing Outputs. You may share Outputs with your insurers, reinsurers, brokers, lenders, auditors, advisers and regulators. Insurers may also share them with the relevant applicant or insured. When you share:

• keep DeNexus attribution and the disclaimers intact;
• recipients may not rely on Outputs as against DeNexus, and you are responsible to them;
• do not publish Outputs, use them in marketing or share them with a Competitor without our written consent.

6.7 White-labelled reports. Where your tier includes white-labelling, you may remove DeNexus branding. The substance of the disclaimers must remain: not advice, AI-generated, human review required. You are responsible for your rebranded reports.

6.8 Transparency. Where the law requires, tell people who receive Outputs that they were produced with AI.

7. Your Data

7.1 You own your data. You, or your licensors, own all Customer Data. Documents, questionnaires and formats you submit stay yours, or their authors', even after we have processed them.

7.2 Our licence. You grant us a worldwide, non-exclusive, royalty-free licence to host, process, copy and analyze Customer Data, only for as long as we retain it under Section 7.5. We may use it only to:

• provide, secure, support and maintain the Services for you;
• build and improve our capability to read, parse and normalize documents. That capability is DeNexus IP; the content itself is never reused or disclosed;
• create configurations used only for you, such as your framework, actuarial model or report templates;
• comply with law.

7.3 No training. We do not use Customer Data to train AI Models or to improve them for other customers. The only exceptions are the two uses in Section 7.2: reading and parsing capability, and configurations used only for you.

7.4 Your tenant only. Customer Data is used only for you. It is never made available to other customers or moved between tenants or products.

7.5 Retention.

Longer retention, or deletion after every run, is available on request and stated in your Order Form. Longer retention may carry a fee. Download links expire after a short period.

7.6 Downgrades. If you move from a Premium Tier to a Free Tier, retained data is hidden until its 12-month period ends. If you upgrade again within that period, it is restored; otherwise it is deleted.

7.7 Export and deletion at the end. After termination you have 30 days to export your Customer Data and Outputs, free of charge. We then delete them, and confirm deletion in writing on request. Copies in backups are deleted in the normal backup cycle.

7.8 Your responsibilities. You confirm that you have every right and consent needed to submit Customer Data, including data about your clients, insureds and their personnel. Do not submit special categories of personal data. If you connect your own threat-intelligence feeds, you confirm that your licences allow it. We may disable any feed whose provider objects or whose licence ends.

7.9 Personal data. Where Customer Data includes personal data, we process it as your processor under Schedule C. We process account data, such as user names, credentials, settings and usage, as a controller under our privacy notice. We keep account data for 12 months after the account closes, or longer where the law requires.

8. DeNexus IP

8.1 What we own. DeNexus owns the Services and all DeNexus IP. DeNexus IP includes improvements and derivative works, whoever makes them and whether or not they derive from use of Customer Data.

8.2 Vesting and assignment. Rights in DeNexus IP vest in DeNexus when created. If any of them vests in you, you assign it to DeNexus, and you will sign any document reasonably needed to confirm this. We grant no rights by implication, estoppel or otherwise.

8.3 Outputs. You own your Outputs, subject to the DeNexus IP embedded in them, such as templates, methods, formats and branding. We grant you a perpetual licence to that embedded DeNexus IP, solely as part of your Outputs and for the uses Section 6.6 allows. We may revoke it under Section 5.5. We use your Outputs only to provide the Services and under Section 7.5.

8.4 Processed Data and Run Records. Processed Data and Run Records belong to DeNexus. We treat them as your Confidential Information. We keep them for the same period as the related Customer Data, and Run Records for at most 12 months on a rolling basis, including after termination. Data deleted after a run leaves no Processed Data.

8.5 Usage Data. We may keep de-identified Usage Data, such as volumes, performance and error rates, to operate and improve the Services. Usage Data never identifies you and is never used to train AI Models.

8.6 Feedback. You grant us a perpetual, irrevocable, royalty-free licence to use any feedback or suggestions you give us.

8.7 Threat Intelligence. DeRISK™ Threat Intelligence content is DeNexus IP. You may use it internally and include it in Outputs you share under Section 6.6. You must not redistribute, resell or export it in bulk.

8.8 Third-party content. Some content comes from third parties under their own terms, set out in Schedule E. It is provided as is.

8.9 Our names and marks. DeRISK™, DeNexus and our product names are our trademarks. You may not use them except to identify DeNexus as the source of Outputs.

9. Fees and pricing changes

9.1 Free Tiers. Free Tiers carry no fees.

9.2 Premium Tiers. Fees are those in your Order Form. Unless your Order Form says otherwise, fees are invoiced annually in advance in US dollars and due within 30 days of invoice. Fees are non-refundable except where this EULA provides a refund. Fees exclude taxes; you pay all applicable taxes other than taxes on our income.

9.3 Late payment. Overdue amounts carry interest at 1.5% per month, or the highest lawful rate if lower. After 10 days' written notice we may suspend Premium Tiers until you pay.

9.4 Changes to prices and pricing structure. We may change prices and the way we price, for example the unit, tiers or packaging:

9.5 Priced options. Extended data retention, non-US data residency, single-tenant deployment and on-premise or private-cloud deployment are priced separately in an Order Form.

10. Confidentiality

10.1 What is confidential. Confidential Information is non-public information one party discloses to the other under this EULA that is marked confidential or reasonably should be treated as such. Customer Data, Outputs, Processed Data and Run Records are your Confidential Information. The Services, DeNexus IP and the terms of any Order Form are ours.

10.2 Exclusions. Information is not confidential if it is or becomes public through no fault of the recipient. The same applies if the recipient already lawfully knew it, lawfully received it from a third party, or developed it independently.

10.3 Duties. Each party will use the other's Confidential Information only for this EULA. It will disclose it only to personnel, Affiliates, advisers and subcontractors who need it and are bound by similar duties. Each party protects the other's Confidential Information with at least reasonable care.

10.4 Required disclosure. A party may disclose Confidential Information when law or a court requires. Where lawful, it must give the other party prompt notice so it can seek protection.

10.5 Duration. These duties last 5 years after termination. For Customer Data they last as long as we hold it. For trade secrets they last as long as the information remains a trade secret.

11. Security and privacy

11.1 Our safeguards. We protect Customer Data with the administrative, technical and physical safeguards described in Schedule D. Customer Data is held in DeNexus's cloud environment, segregated by tenant.

11.2 Providers. We use subcontractors, including cloud and AI-model providers, and remain responsible for them. Where Schedule C applies, we list sub-processors and give notice of changes, with a right to object.

11.3 Incidents. If we confirm unauthorized access to Customer Data, we will notify you without undue delay. Where Schedule C applies, we will do so within the period stated there. We will also give you the information you reasonably need to meet your own obligations.

11.4 Your security. You are responsible for your systems, your Authorized Users' credentials, and the security of data before it reaches the Services.

12. Warranties and disclaimers

12.1 Mutual. Each party confirms that it is validly organized and has authority to enter into this EULA.

12.2 Premium Tiers. We warrant that Premium Tiers will perform materially as described in our documentation. If they do not, and you tell us, we will use reasonable efforts to fix the problem. If we cannot fix it within 30 days, you may terminate the affected subscription and receive a pro-rata refund of prepaid fees. This is your sole remedy for breach of this warranty.

12.3 Free Tiers. Free Tiers and pilots are provided "as is" and "as available", without any warranty.

12.4 Not a control or safety system. The Services analyze data. They do not control, protect or connect to operational technology unless you enable an integration. They are not designed for fail-safe use. They do not guarantee that any threat will be detected or any loss avoided.

12.5 Disclaimer. Except as stated in this Section 12, and to the extent the law allows, we disclaim all warranties, express or implied. This includes merchantability, fitness for a particular purpose, non-infringement, accuracy, and uninterrupted or error-free operation. Third-party data and content are provided without warranty.

13. Indemnities

13.1 Ours (Premium Tiers only). We will defend you against any third-party claim that your use of a Premium Tier, as allowed by this EULA, infringes that party's intellectual property rights. We will pay the damages finally awarded and any settlement we agree.

This does not apply to claims arising from:

• Customer Data, or your third-party feeds;
• your breach of this EULA;
• modifications not made by us;
• combination with anything we did not provide;
• use of a superseded version after we offered a non-infringing one.

If use may infringe, we may modify the Service, obtain a licence, or terminate the affected subscription and refund prepaid fees pro rata. This Section 13.1 is your sole remedy for infringement claims.

13.2 Yours (all tiers). You will defend DeNexus against any third-party claim arising from:

• Customer Data, including your right to submit it and your licences for feeds you connect;
• your breach of Section 5 or Section 6;
• your use of the Services for your clients;
• Outputs you share, or reliance on them by anyone you share them with;
• your breach of law.

You will pay the damages finally awarded and any settlement you agree.

13.3 Process. The party seeking defense must notify the other promptly and cooperate reasonably. The defending party controls the defense and settlement. It may not settle on terms that admit fault for, or impose obligations on, the other party without that party's consent.

14. Limitation of liability

14.1 No indirect losses. Neither party is liable for indirect, incidental, special, consequential or punitive damages. Nor is it liable for loss of profits, revenue, business, goodwill or data, or for the cost of substitute services.

14.2 DeNexus's total liability. DeNexus's total liability arising out of or relating to this EULA is capped:

14.3 Not limited. Sections 14.1 and 14.2 do not limit:

• your payment obligations;
• your liability for breach of Section 5, misuse of DeNexus IP, or your indemnities;
• either party's liability for fraud, wilful misconduct or gross negligence;
• either party's liability for death or personal injury;
• any liability that cannot lawfully be limited or excluded.

14.4 Basis of the bargain. These limits reflect the fees and the nature of the Services. They apply even if a remedy fails of its essential purpose.

15. Term, suspension and termination

15.1 Term. This EULA starts when you accept it. It continues until your account is closed or this EULA is terminated. Premium subscriptions run for the term in your Order Form or purchase, and renew as stated there.

15.2 Free Tiers. Either party may stop Free Tier use at any time.

15.3 Termination for breach. Either party may terminate if the other materially breaches this EULA and does not cure the breach within 30 days of written notice. Breach of Section 5 needs no cure period (Section 5.5).

15.4 Suspension. We may suspend access immediately to protect the Services, other customers or third parties, or to comply with law. We will restore access once the cause is resolved.

15.5 Downgrades. Section 7.6 governs moves from a Premium Tier to a Free Tier.

15.6 Effect of termination. Your right to use the Services ends. Section 7.7 governs export and deletion of your data. Fees due before termination remain payable. Run Records follow Section 8.4.

15.7 Survival. After termination, only these survive:

• DeNexus IP already created, including our reading and parsing capability;
• Run Records, until their 12-month period ends;
• de-identified Usage Data.

Our licence to Customer Data ends when the data is deleted. Sections 5.5, 6, 8, 10, 13, 14, 18 and 19 also survive.

16. Compliance

16.1 Sanctions and export. You confirm that you are not a Restricted Party. You must not use the Services from, or for anyone in, a jurisdiction subject to comprehensive US, EU or UK sanctions. You will comply with all applicable export-control and sanctions laws.

16.2 Legal restrictions. We may restrict specific features in a jurisdiction where the law requires it.

16.3 AI regulation. We are responsible for the Services as we design and provide them. You are responsible for how you deploy and use them and for the decisions you take. Schedule B allocates EU AI Act transparency, human-oversight and AI-literacy duties between us.

16.4 Regulators. On request, we will give premium customers reasonable documentation about the Services for their regulators and auditors. This may be under confidentiality terms.

17. Changes to this EULA

17.1 Versions. Each version of this EULA and of each Schedule has a version number and effective date. Current and past versions, upcoming changes and a change log are published at denexus.ai/legal.

17.2 Non-material changes, such as clarifications or new products, apply when we post them.

17.3 Material changes. We give at least 30 days' notice of material changes by email or in the product. Examples include changes to data use, liability, IP or dispute resolution. You must accept the new version at your next "Start" to keep using the Services. For a committed term, a material change that is adverse to you applies from renewal, unless the law or security requires it sooner.

17.4 Prices. Section 9.4 governs price changes, not this Section 17.

18. Governing law and disputes

18.1 Governing law. This EULA, and any dispute arising out of or relating to it, is governed by the laws of the State of Delaware, USA. Delaware's conflict-of-laws rules do not apply. The UN Convention on Contracts for the International Sale of Goods does not apply.

18.2 Forum. Where disputes are decided depends on the country you gave at sign-up or in your Order Form:

18.3 Urgent relief and fees. Either party may seek urgent injunctive relief in any competent court to protect its intellectual property or Confidential Information. DeNexus may also sue for unpaid fees in the courts of your domicile.

18.4 Waivers. To the extent the law allows, each party waives trial by jury. Each party may bring claims only individually, not as a class, collective or representative action.

18.5 Mandatory law. Nothing in this Section 18 removes protections that mandatory law gives you and that cannot be waived by contract.

19. General

19.1 Assignment. You may not assign this EULA without our consent, except to a successor of all or substantially all of your relevant business. We may assign it to an Affiliate or to a successor of our business.

19.2 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control. This does not cover payment obligations. Such events include outages of third-party cloud, network or AI-model providers, cyberattacks, governmental action and natural disasters.

19.3 Notices. We send notices to the email address of your account administrator or in the product. You send notices to legal@denexus.ai. Notices take effect when sent, unless bounced.

19.4 Publicity. We will name you as a customer, or use your logo, only with your written consent.

19.5 Relationship. The parties are independent contractors. This EULA creates no third-party beneficiaries.

19.6 Entire agreement. This EULA and its Schedules are the entire agreement on their subject, subject to Section 2. If a provision is unenforceable, it is enforced to the maximum extent allowed and the rest stays in force. A failure to enforce is not a waiver.

19.7 Language. This EULA is written in English. Any translation is for convenience only, and the English version prevails.

19.8 US Government users. The Services are commercial computer software and services, provided to US Government users only under this EULA.

Definitions

Authorized Users (4.1), Confidential Information (10.1), Free Tiers and Premium Tiers (3.2), MSA (2.1) and Services (3.1) are defined where first used.