Master Subscription Agreement

1. Definitions

1.1“Platform” means TekRamp’s hosted OSCAL-native FedRAMP and CMMC compliance acceleration software, including the Aegis AI compliance assistant and accompanying documentation (“Documentation”).

1.2“Order Form” means an ordering document signed by the Parties that references this Agreement and sets out the Platform configuration, fees, and term.

1.3“Package” means a single authorization effort (for example, one System Security Plan or one system being authorized). Packages are the unit of platform scope.

1.4“Collaborator” means an Authorized User who can create and edit content. “Viewer” means a read-only Authorized User; Viewers are unlimited unless an Order Form states otherwise. “Authorized User” means an employee or contractor of Customer authorized by Customer to access the Platform on its behalf.

1.5“Customer Data” means data, files, and information that Customer or its Authorized Users submit to the Platform.

1.6“Feedback” means suggestions, comments, ideas, or other input regarding the Platform.

1.7“Confidential Information” means non-public information disclosed by a Party that is marked or reasonably understood to be confidential, including the Platform, fees, and the terms of any Order Form.

2. Orders; Provision of the Platform

2.1Subject to this Agreement and the applicable Order Form, TekRamp will make the Platform and any items specified in the Order Form available to Customer during the term stated in that Order Form.

2.2If Customer’s use exceeds the scope purchased in an Order Form (for example, additional Packages, frameworks, or Collaborator capacity), the Parties will document an upgrade. No additional fees apply unless and until Customer agrees to them in writing.

3. Evaluation (Pilot) Period

3.1If an Order Form includes an Evaluation Period, TekRamp will make the specified configuration available at no charge for that period so the Parties can confirm fit.

3.2Either Party may end the evaluation at any time, for any reason, on written notice. Customer may elect not to proceed by giving TekRamp written notice on or before the last day of the Evaluation Period, in which case the Order Form terminates with no further payment obligation.

3.3If Customer does not give such notice and continues to access the Platform after the Evaluation Period, the Subscription Term will commence automatically and the fees stated in the Order Form will become payable under Section 6.

4. License; Restrictions

4.1Subject to this Agreement, TekRamp grants Customer a limited, non-exclusive, non-transferable, and non-sublicensable right to access and use the Platform during the term solely for Customer’s internal business purposes.

4.2Customer will not, and will not permit any third party to: (a) copy, modify, or create derivative works of the Platform; (b) reverse engineer or attempt to derive source code, except to the extent this restriction is prohibited by applicable law; (c) resell, sublicense, rent, or make the Platform available to third parties on a service-bureau basis; (d) circumvent or disable any usage limits, security, or access controls; or (e) use the Platform to develop a competing product or service.

4.3Customer is responsible for its Authorized Users’ compliance with this Agreement and for all activity under its accounts, and will keep all credentials secure.

5. Fees; Payment

5.1Customer will pay the fees stated in the applicable Order Form. Unless the Order Form states otherwise, fees are invoiced annually in advance and are due within thirty (30) days of the invoice date.

5.2Fees are non-cancellable and amounts paid are non-refundable except as expressly stated in this Agreement. Fees are exclusive of taxes; Customer is responsible for applicable sales, use, and similar taxes, excluding taxes on TekRamp’s income.

5.3Overdue undisputed amounts accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law. TekRamp will not increase fees during a then-current Subscription Term beyond the amounts stated in the applicable Order Form.

6. Customer Responsibilities; Collaborative Feedback

6.1Customer will provide timely access, information, and cooperation reasonably required for onboarding and use, and is responsible for the accuracy and completeness of the information it provides.

6.2Where an Order Form contemplates an early-customer or founding-customer relationship, the Parties will maintain a collaborative feedback cadence as described in the Order Form. Such cadence is collaborative and is not a condition of Customer’s right to use the Platform.

7. Intellectual Property; Feedback

7.1TekRamp and its licensors own all right, title, and interest in and to the Platform, the Aegis assistant, the Documentation, and all related intellectual property, including all modifications, enhancements, and derivatives, whether or not informed by Feedback. No rights are granted except as expressly stated.

7.2Customer grants TekRamp a perpetual, irrevocable, worldwide, royalty-free, fully paid, and sublicensable license to use Feedback for any purpose, including to develop and improve TekRamp’s products and services, without restriction or obligation to Customer.

8. Customer Data; Security

8.1As between the Parties, Customer owns Customer Data. Customer grants TekRamp a non-exclusive license to host, process, transmit, and display Customer Data as needed to provide and support the Platform, and to use data in aggregated and de-identified form (which does not identify Customer or any individual) to operate and improve its services.

8.2TekRamp will maintain commercially reasonable administrative, physical, and technical safeguards designed to protect Customer Data. Customer is responsible for determining whether the Platform is appropriate for any particular category of data, including Controlled Unclassified Information (CUI), and for configuring its use accordingly. TekRamp makes no representation that the Platform is authorized to store or process CUI or classified information unless separately agreed in writing.

9. Confidentiality

9.1Each Party will protect the other’s Confidential Information using at least reasonable care, will use it only to perform under this Agreement, and will not disclose it except to personnel and advisors with a need to know who are bound by confidentiality obligations. These obligations continue during the term and for three (3) years thereafter (and, for trade secrets, for as long as they remain trade secrets). Fees and Order Form terms are TekRamp’s Confidential Information.

10. Marketing and References

10.1Following successful deployment and Customer’s confirmation of satisfaction, the Parties will discuss in good faith Customer’s participation in a customer testimonial, case study, public reference, use of Customer’s name and logo, and introductions to potential partners, on terms to be mutually agreed and coordinated with Customer’s leadership and marketing.

10.2Except as provided in a separate written consent from Customer, TekRamp will not publicly identify Customer by name or logo or characterize Customer as a customer in public-facing materials. Nothing in this Section obligates either Party to provide any specific reference activity, each of which remains subject to mutual agreement.

11. Warranties; Disclaimer

11.1Each Party represents that it has the authority to enter into and perform this Agreement.

11.2TekRamp warrants that, during the term, the Platform will perform materially in accordance with its Documentation. As Customer’s sole and exclusive remedy for breach of this warranty, TekRamp will use commercially reasonable efforts to correct the non-conformity and, if it cannot do so within a reasonable time, either Party may terminate the affected Order Form and TekRamp will refund any prepaid, unused fees for the terminated period.

11.3EXCEPT AS EXPRESSLY STATED, THE PLATFORM IS PROVIDED “AS IS,” AND TEKRAMP DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTY THAT THE PLATFORM WILL BE UNINTERRUPTED OR ERROR-FREE.

12. Compliance Disclaimer

12.1The Platform is a tool that assists and accelerates Customer’s compliance activities. TekRamp does not guarantee, and Customer does not rely on TekRamp to guarantee, any particular assessment score, certification, authorization, or regulatory outcome, including any FedRAMP authorization or CMMC certification at any level.

12.2Customer is solely responsible for its own compliance posture, policies, and controls; for the accuracy and completeness of information it enters; and for selecting, engaging, and paying any independent assessor (including any C3PAO or 3PAO). TekRamp is not a law firm, accounting firm, certified assessor, or C3PAO, and provides no legal, audit, or assessment services under this Agreement.

13. Limitation of Liability

13.1NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR DATA, ARISING OUT OF OR RELATING TO THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

13.2EXCEPT FOR THE EXCLUDED CLAIMS, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE LIABILITY.

13.3“Excluded Claims” means: (a) Customer’s payment obligations; (b) a Party’s breach of its confidentiality obligations; (c) Customer’s breach of Section 4.2 (Restrictions) or infringement of TekRamp’s intellectual property; (d) a Party’s indemnification obligations; and (e) a Party’s gross negligence or willful misconduct. The limitations in this Section apply notwithstanding any failure of essential purpose of any limited remedy.

14. Indemnification

14.1TekRamp will defend Customer against third-party claims alleging that the Platform, as provided by TekRamp and used in accordance with this Agreement, infringes a U.S. patent, copyright, or trademark or misappropriates a trade secret, and will indemnify Customer for amounts finally awarded or agreed in settlement. These obligations do not apply to claims arising from Customer Data, Customer’s combination of the Platform with non-TekRamp items, or use not permitted by this Agreement. If the Platform becomes, or TekRamp believes it may become, subject to such a claim, TekRamp may, at its option, procure the right to continue use, modify or replace the Platform, or terminate the affected Order Form and refund prepaid, unused fees.

14.2Customer will defend TekRamp against third-party claims arising from Customer Data, Customer’s use of the Platform in violation of this Agreement or applicable law, or Customer’s representations to third parties regarding its compliance status, and will indemnify TekRamp for amounts finally awarded or agreed in settlement.

14.3The indemnified Party will give prompt written notice, reasonable cooperation, and sole control of the defense to the indemnifying Party; no settlement imposing liability or admission on the indemnified Party may be entered without its consent, not to be unreasonably withheld.

15. Term; Termination

15.1This Agreement begins on the first Order Form’s effective date and continues while any Order Form is in effect. Each Order Form runs for the term stated in it, including any Evaluation Period and Subscription Term.

15.2Either Party may terminate an Order Form (or this Agreement, if no Order Form is active) for the other’s material breach that remains uncured thirty (30) days after written notice, or immediately if the other becomes insolvent or subject to bankruptcy proceedings not dismissed within sixty (60) days.

15.3On termination or expiration: (a) Customer’s right to access the Platform ends; (b) for thirty (30) days, TekRamp will make Customer Data available for export, after which it may delete it in the ordinary course; (c) each Party will return or destroy the other’s Confidential Information on request; and (d) accrued payment obligations survive. Sections that by their nature should survive (including 5 (accrued fees), 7, 8, 9, 10.2, 11.3, 12, 13, 14, 15, and 16) survive.

16. General

16.1Independent Contractors. The Parties are independent contractors; this Agreement creates no partnership, agency, employment, or joint venture.

16.2Assignment. Neither Party may assign this Agreement without the other’s prior written consent, except to a successor in connection with a merger, acquisition, or sale of substantially all assets, on written notice.

16.3Governing Law; Venue. This Agreement is governed by the laws of the Commonwealth of Virginia, without regard to its conflict-of-laws rules. The Parties consent to the exclusive jurisdiction of the state and federal courts located in Fairfax County, Virginia, and each waives any right to a jury trial.

16.4Notices; Force Majeure. Notices must be in writing and effective on receipt. Neither Party is liable for any delay or failure (other than payment obligations) caused by events beyond its reasonable control.

16.5Entire Agreement; Updates. This Agreement together with each Order Form is the entire agreement between the Parties and supersedes prior discussions on its subject matter. TekRamp may update this Agreement from time to time by posting a revised version; the version in effect as of an Order Form’s effective date governs that Order Form for its then-current Term, and updates apply to renewals and new Order Forms. Amendments to an executed Order Form must be in a writing signed by both Parties.

16.6Waiver; Severability; Counterparts. No waiver is effective unless in writing. If any provision is held unenforceable, it will be modified to the minimum extent necessary and the remainder will remain in effect. This Agreement and any Order Form may be executed in counterparts and by electronic signature, each an original and together one instrument.