# Clavenar Master Services Agreement Version 1.0.0 · Vanteguard Labs LLC This Master Services Agreement (“MSA”) applies only when an Order Form signed by Vanteguard Labs LLC (“Vanteguard”) and the customer identified there (“Customer”) incorporates version 1.0.0. ## 1. Services and order of precedence Vanteguard will provide the Clavenar services, software, support, and pilot activities stated in each Order Form. An Order Form controls its commercial scope; the Data Processing Addendum (“DPA”) controls personal-data processing; the Security and Data Schedule controls security commitments; and this MSA controls otherwise. A purchase order supplies administrative details only and does not add terms. Production use is prohibited until an executed Order Form identifies the approved production scope and both parties record the required go-live and secure-exchange details. Public demos, documentation, and open-source components remain governed by their own published terms and licenses. ## 2. Customer responsibilities and acceptable use Customer will provide accurate authorized instructions, designate accountable contacts, protect its accounts and keys, and use the services only for lawful purposes. Customer will not submit data it lacks authority to process, bypass technical limits, interfere with other tenants, or place credentials, production detail, regulated data, incident evidence, or vulnerability detail in a general website form. Required sensitive material must use the customer-controlled secure exchange in the Security and Data Schedule. ## 3. Fees, taxes, and payment Fees, billing unit, payment dates, expenses, renewal, and taxes are stated only in the executed Order Form. Customer is responsible for applicable transaction taxes other than taxes on Vanteguard’s net income. No public page, draft, or unsigned Order Form changes a price or creates a renewal commitment. ## 4. Confidentiality “Confidential Information” means non-public information disclosed under this MSA that is marked confidential or reasonably should be understood as confidential, including product plans, security material, credentials, customer data, and the terms of a non-public Order Form. It excludes information the recipient can document was already lawfully known without duty, became public without breach, was received lawfully without duty, or was independently developed without use of the disclosure. The recipient will use Confidential Information only to perform or receive the services, protect it with at least reasonable care and no less care than it uses for similar information, and disclose it only to personnel and contractors with a need to know and equivalent duties. A legally compelled recipient may disclose the minimum required after prompt notice when lawful and reasonable assistance at the discloser’s expense. These duties continue for five years after disclosure; trade secrets and credentials remain protected while they qualify or remain active. ## 5. Security, privacy, incidents, and deletion The DPA and Security and Data Schedule govern personal data, security controls, subprocessors, incident response, retention, return, and deletion. Vanteguard will not use Customer Data for advertising or sell it. Each party will notify the other through the contacts in the Order Form of a confirmed incident affecting the other party’s data or systems without undue delay and will coordinate accurate notices and remediation. ## 6. Intellectual property and licenses Each party retains its pre-existing technology, data, marks, and materials. Customer grants Vanteguard a limited right to process Customer Data only to provide, secure, support, and comply with law for the services. Vanteguard retains Clavenar and related improvements. Open-source components are governed solely by their included licenses. No right to either party’s marks is granted. Customer may provide feedback; Vanteguard may use it without restriction or payment if it does not identify Customer or disclose Customer Confidential Information. A custom deliverable, if any, and its ownership or license must be identified expressly in the Order Form. ## 7. Support, changes, and service levels Support channels, hours, response targets, service levels, maintenance windows, and any service credits exist only if stated in the Order Form. In the absence of an express production service level, Vanteguard will use commercially reasonable efforts but makes no uptime or response-time commitment. Vanteguard may change non-material features and will give reasonable notice of a material reduction to an active paid service. ## 8. Warranties and disclaimers Each party warrants that it has authority to enter the agreement. Vanteguard warrants that paid services will materially conform to their applicable documentation during the Order Form term and that it will use personnel with appropriate skill. Customer’s exclusive remedy for breach is re-performance; if Vanteguard cannot cure materially, Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid unused fees. Except for these express warranties, to the maximum extent permitted by law, the services are provided without implied warranties, including merchantability, fitness for a particular purpose, non-infringement, or uninterrupted or error-free operation. Clavenar supports governance decisions but does not replace Customer’s human oversight, legal duties, security program, or responsibility for agent actions. ## 9. Third-party claims Vanteguard will defend Customer against a third-party claim that the paid Clavenar service, when used as authorized, infringes a patent, copyright, or trademark, and pay finally awarded damages or approved settlement amounts. Vanteguard may modify, replace, procure rights for, or terminate the affected service with a pro-rata refund. This does not apply to Customer Data, combinations not supplied by Vanteguard, Customer modifications, continued use after notice, or use outside the agreement. Customer will defend Vanteguard against a third-party claim arising from Customer Data or Customer’s unlawful or unauthorized use and pay finally awarded damages or approved settlement amounts. The protected party must give prompt notice, reasonable cooperation at the defending party’s expense, and control of the defense, while retaining the right to participate. No settlement may admit fault or impose a non-monetary duty on the protected party without consent. ## 10. Liability Neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or lost profits, revenues, goodwill, or business interruption, arising from the agreement, even if advised of the possibility. Each party’s aggregate liability arising from an Order Form will not exceed fees paid or payable under that Order Form during the twelve months before the first event giving rise to liability. The exclusions and cap do not apply to payment obligations, fraud, willful misconduct, a party’s infringement of the other party’s intellectual property, Customer’s violation of acceptable use, or liability that law does not permit the parties to limit. Liability for breach of confidentiality, the DPA, or the Security and Data Schedule is capped at two times the general cap. These allocations apply regardless of claim theory and are an essential basis of the bargain. ## 11. Term, suspension, termination, and effect This MSA starts on the first incorporated Order Form and continues while one is active. Either party may terminate an affected Order Form for an uncured material breach after thirty days’ written notice, or immediately if the breach cannot be cured, the other party becomes insolvent, or continued performance would violate law. Vanteguard may suspend the minimum affected access needed to address an active security threat, unlawful use, or overdue undisputed fees after reasonable notice when practicable. On termination, Customer must stop the affected service and pay accrued amounts. Vanteguard will return or delete Customer Data under the DPA and Security and Data Schedule. Provisions that by their nature should survive do so, including confidentiality, accrued payment, intellectual property, disclaimers, liability, and dispute terms. ## 12. General Neither party may assign the agreement without consent, except to an affiliate or in connection with a merger, reorganization, or sale of substantially all relevant assets if the assignee assumes the agreement and is not a direct competitor. The parties are independent contractors. Neither is liable for delay caused by events beyond reasonable control, excluding payment duties, and the affected party will mitigate and resume performance. Notices must use the legal and security contacts in the Order Form; legal notices must also be sent by a trackable written method. The governing law, exclusive venue, and any dispute-escalation process must be completed in the Order Form before signature. If a provision is unenforceable, it will be limited to the minimum necessary and the remainder continues. Waivers must be written. The incorporated documents and signed Order Forms are the entire agreement and may be amended only in a signed writing.