This Patchstack Master Solution Agreement (including the Addenda and all Orders), available at https://patchstack.com/master-solution-agreement (the “Agreement”) is referenced in an Order (as defined below) for service activation of subscription access to one or more Patchstack solutions and services. The entity that is listed as the customer in the Order (“Customer”) has indicated Customer’s binding acceptance of this Agreement, as required in order for Customer to subscribe to, receive, or use the Patchstack Solution (as defined below). By signing or online-accepting (including via email/slack) this Agreement or an Order, Customer has entered into this Agreement with Patchstack OÜ, commercial register code 14331217, located at Aida 7, 80011 Pärnu, Estonia (“Patchstack”). Notices to Patchstack as required by this Agreement must be sent via email to legal@patchstack.com. Notices to Customer as required by this Agreement should be sent to the persons indicated in the Order or as otherwise authorized by Customer.
1. DEFINITIONS
The following capitalized terms used in this Agreement will have the meanings given below.
1.1. “Ancillary Services”: Patchstack integration, set-up, professional, support and maintenance services, including as described in the Order Form and/or the Support and Service Level Policy Addendum, and which may include provision of enhanced uptime warranties under the Service Level Agreement.
1.2. “Confidential Information”: any of the following disclosed, or made available by or accessed or received from a party hereto: (a) any tangible or written information or materials conspicuously marked as “confidential”; and (b) any orally or visually disclosed information designated as confidential at the time of disclosure, and summarized in a writing delivered within thirty days of disclosure. The parties agree that the Patchstack Solution, Service Deliverables, and Access Information (as defined in section 2.5) constitute Patchstack’s Confidential Information subject to the protections of section 4.1, notwithstanding any other provision of this Agreement.
1.3. “Customer Operations”: websites, platforms, operations, offerings, or services owned or operated by the Customer.
1.4. “Data Processing Addendum” or “DPA”: the data processing addendum set forth in Exhibit A, attached.
1.5. “End User(s)”: the customers and end users of the Patchstack Solution-enabled Customer Operations.
1.6. “Order Form” or “Order”: the ordering document separately signed by or assented to by the parties and referencing this Agreement, setting forth the applicable Patchstack Solution subscriptions Customer has purchased, terms regarding Ancillary Services, if any, and other associated or supplementary terms. The first Order Form is attached as Exhibit C. Every Order Form is deemed attached hereto and made a part hereof.
1.7. “Other Applications”: the (a) Customer Operations, and (b) online or offline software, products, websites, services, information, platforms, data, functionality, offerings, hardware, inventions, and networks not developed by Patchstack.
1.8. “Patchstack Service”: the cloud-based internet-/network-delivered service(s) Patchstack delivers to Customer, including the features, functionality, websites, and analytics described in the Order Form and/or made available by Patchstack as part of its offering, and any new updates, versions, and changes to any of the foregoing as released by Patchstack.
1.9. “Patchstack Solution”: (a) Patchstack Service; (b) Service Deliverables; and (c) Ancillary Services.
1.10. “Service Deliverables”: as defined in section 3.5.
1.11. “Service Level Agreement” or “SLA”: the service level agreement set forth in the Order Form and/or Support and Service Level Policy Addendum.
1.12. “Support and Service Level Policy Addendum”: the Ancillary Services document set forth in Exhibit B, attached.
2. PATCHSTACK SOLUTION
2.1. Availability. This Agreement sets forth the terms governing Patchstack’s provision of access to the Patchstack Solution to the Customer, including the Patchstack Solution subscriptions detailed in one or more Order Forms. If Customer’s access to the Patchstack Solution, in whole or in part, is not the subject of an Order Form, Customer acknowledges that the terms of this Agreement nevertheless apply. Customer will provide to Patchstack, and acknowledges that Patchstack’s ability to successfully provide the Patchstack Solution depends on, reasonable and necessary cooperation and assistance, including timely decision-making, reliable access to project management, API access, and any items as may be described in the Order Form. Except as specifically set forth in an Order Form, Customer will have sole responsibility for the costs, expenses and deployment of any interconnection, installation and testing to use the Patchstack Solution and Other Applications.
2.2. Evaluation Trial; Pre-Release. Patchstack may make the Patchstack Solution available to Customer on an evaluation or trial basis (“Evaluation Trial”), or may make available certain features, functions, or versions of the Patchstack Solution as alpha, beta, or in early access, prototype, or pre-release form, or for evaluation purposes only (“Pre-Release Versions”). Patchstack is under no obligation to (a) provide Ancillary Services during or in support of the Evaluation Trial or for Pre-Release Versions; or (b) continue to develop, improve, or correct errors in Pre-Release Versions. Patchstack may terminate the Evaluation Trial or use of Pre-Release Versions at any time. NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, THE EVALUATION TRIAL AND PRE-RELEASE VERSIONS ARE PROVIDED “AS IS” AND WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, and the SLA does not apply to any Evaluation Trial or Pre-Release Versions. Customer must cancel the Evaluation Trial by the end of the stated number of days in the Evaluation Trial offer to avoid incurring charges, unless Patchstack notifies Customer or if the Order Form states otherwise.
2.3. Service Interruptions. Although it is Patchstack’s intention for the Patchstack Service to be continuously available, there may be occasions when the Patchstack Service may be interrupted or incur delays, including without limitation due to: (a) scheduled maintenance; (b) downtime caused by concurrent or consecutive failures, or failures at multiple locations, impacting the performance of internet services, networks or traffic exchange or control points controlled by entities other than Patchstack, including denial-of-service or other network attacks; (c) downtime caused by (i) any acts, omissions, APIs, connections or equipment of or controlled by or used for the benefit of Customer, or (ii) Other Applications; (d) circumstances or causes beyond Patchstack’s reasonable control, including any force majeure event; (e) suspension or termination (i) as permitted in this Agreement; (ii) for emergency reasons, (iii) as required by law or any governmental authority or agency; (iv) to prevent or ameliorate harm, data loss, violations or infringements of third party rights, or applicable law; or (v) based on credible evidence that Customer’s account has been compromised or hijacked.
2.4. Feedback. Patchstack may freely use and exploit in perpetuity any feedback, requirements, recommendations, ideas, bug fixes, comments, suggestions, or improvements relating to the Patchstack Solution, notwithstanding any other provision of this Agreement.
2.5. Access Information. Customer shall maintain the confidentiality of user name, password, and other technical information provided to Customer for access to the Patchstack Solution (“Access Information”) and is responsible for all use of Access Information. Customer will not transfer to any party Access Information, or use Access Information of another, without Patchstack’s prior written consent. Customer will immediately notify Patchstack of any unauthorized use of Access Information or any other breach of security.
2.6. Security and Compliance. Customer will take all necessary and reasonable steps to ensure that Customer has full legal right and authority to disclose and process all personal and personally identifying data, and that the processing of such data will not violate any applicable data protection or data privacy laws. Customer acknowledges that Patchstack is a data processor to the extent Patchstack processes personal data on behalf of Customer as part of the Patchstack Solution, and that Customer is the data controller. The parties hereby agree to the terms of the DPA.
2.7. Ancillary Services. In consideration of and subject to Customer’s compliance with this Agreement, including payment, Patchstack will provide the Ancillary Services as set out in the Order Form.
2.8. Service Messages. For purposes of service messages and notices about the Patchstack Solution to Customer, Patchstack may place a banner notice across Customer’s dedicated dashboard pages and send notices via email to an email address associated with Customer’s account.
2.9. Cloud Hosting Providers. Customer acknowledges that Patchstack engages Amazon Web Services or other cloud hosting provider to provide Other Applications in the form of public cloud hosting services enabling delivery of the Patchstack Service, pursuant to the terms of the AWS Customer Agreement at https://aws.amazon.com/agreement and related AWS policies, or the corresponding terms and policies of Patchstack’s cloud hosting provider if not AWS (collectively, the “CHP Agreement”). Customer shall refrain from taking any action or failing to take any action that may result in non-compliance with the CHP Agreement. Customer acknowledges that Patchstack has no ability to negotiate or alter the terms of the CHP Agreement or ensure the CHP’s compliance with applicable law, and that violation of the CHP Agreement may require Patchstack to suspend or terminate access to the Patchstack Service.
2.10. Integrated Reseller Terms. This section 2.10 applies if Customer is publicly offering the functionality of the Patchstack Service to its End Users as an integrated part of its Customer Operations.
2.10.1 No White Label. Customers offering the functionality of the Patchstack Service to its customers or end users as a part of its Customer Operations must conspicuously display: (a) the Patchstack logo; (b) a statement that the vulnerability data is provided by Patchstack or that Customer Operations are powered by Patchstack; and (c) a hyperlink to the relevant Patchstack database entry, all in human-readable, and in case of the hyperlink, clickable, form.
2.10.2 Data Caching. Unless otherwise approved by Patchstack in writing, Customer may store or cache Service Deliverables (including vulnerability and mitigation data) locally only to the extent reasonably necessary for Customer to deliver the Patchstack Solution to the same end user during the same active session of Customer Operations. Customer shall delete or purge such cached Service Deliverables promptly upon expiration of the applicable session. Customer shall not persist, aggregate, or redistribute cached Service Deliverables beyond what is permitted by this section.
2.10.3 Permitted Disclosure of Vulnerability Information. Notwithstanding sections 3.5 and 4.1, Customer may disclose vulnerability and mitigation data included in the Service Deliverables to End Users, solely through Customer Operations, to the extent reasonably necessary for End Users to identify and remediate vulnerabilities affecting their own environments. Customer shall not disclose such data to the general public or make it available in any publicly accessible medium. Customer shall ensure that each End User receiving such data is bound by written confidentiality obligations no less restrictive than those set forth in this section 4, or, where disclosure is made programmatically through Customer Operations, that the terms governing the End User’s access to Customer Operations include confidentiality restrictions that are no less protective of Patchstack’s interests than those set forth in this section 4. Customer shall remain responsible for any disclosure or use of such data by End Users in breach of the foregoing requirements.
3. LICENSES TO CUSTOMER
3.1. License Grant. Subject to Customer’s compliance with the obligations of this Agreement, Patchstack hereby grants to Customer a non-sublicensable, non-transferable, and non-exclusive license, exclusively in support of Customer Operations, to use the Patchstack Service and Service Deliverables. The licenses set forth in this section are the only licenses granted to Customer with respect to the Patchstack Solution or associated intellectual property rights.
3.2. Unauthorized Use. Except as set forth above, Customer will not (a) make more than the number of copies of Service Deliverables reasonably required for authorized use and distribution as permitted by section 3.1; (b) modify, or create derivative works or improvements of, the Patchstack Solution; or (c) sublicense, rent, lease, or host the Patchstack Solution. All rights not expressly granted in this section are reserved to Patchstack. Customer will have no right or license to the Patchstack Solution other than the rights set forth in section 3.1. Customer shall not permit access to or the use of the Patchstack Solution or its functionality in whole or in part: (d) by or for the benefit of any third party or by any direct or indirect competitor of Patchstack, or (e) to create, maintain, support or enhance a competitive or substitute service, product or offering.
3.3. Reverse Engineering. Customer will not reverse engineer, modify, decompile, disassemble or otherwise attempt to derive the source code, interfaces or other information from the Patchstack Solution, or work around technical protections or limitations associated with the Patchstack Solution, except and only to the extent that: (a) such activity is expressly permitted by directly applicable law notwithstanding this limitation; (b) it is essential to engage in such activity in order to obtain information needed to achieve interoperability of independently created software with the Patchstack Solution; (c) such activity is confined to those parts of the Patchstack Solution which are necessary to achieve interoperability; and (d) Patchstack has not made such information available to Customer under reasonable terms and conditions upon Customer’s request sent to legal@patchstack.com. Any information supplied to or obtained by Customer under this section as a result of reverse engineering may only be used by Customer for the purpose described in this section, and will not be disclosed to any third party or used to create any software that is substantially similar to the Patchstack Solution.
3.4. Open Source. Certain components or libraries included in or bundled with the Patchstack Solution may be covered by open source licenses. To the extent required by such open source licenses, the terms of such licenses will apply in lieu of the terms of this section, solely with respect to those libraries or components that are licensed under such open source licenses.
3.5. Service Deliverables. Patchstack retains all right, title and interest in and to any “Service Deliverables”, defined as deliverables, software (including connectors, extensions, and plugins), APIs, materials, data, information or content (including vulnerability and mitigation data), and any updates and changes to any of the foregoing, provided to Customer in connection with Customer’s use of the Patchstack Solution, or developed as part of the Ancillary Services, and all associated intellectual property rights. Customer shall not disclose Service Deliverables to any third party and shall protect the confidentiality of Service Deliverables with the same degree of care, but no less than reasonable care, as Customer uses to protect Customer’s own confidential information of like nature.
3.6. Reservation of Rights. Patchstack retains all right, title and interest in and to, and as between the parties, is the exclusive owner of, the Patchstack Solution, and all economic exploitation rights therein (including all copyrights, trade secrets, and patents). The Patchstack Solution is for use solely by Customer and its staff, for Customer’s internal business purposes in support of Customer Operations. Patchstack grants no licensed rights to patents. The user interface, user experience, icons, presentation layer and elements, reports, layouts, and screen displays of or generated by the Patchstack Solution constitute Patchstack’s copyrightable content, trade dress, and trademarks and servicemarks, as applicable.
4. CONFIDENTIALITY
4.1. Duty. A party (or any of its affiliates) receiving Confidential Information (collectively the “Recipient”) from the party (or its affiliates) disclosing such Confidential Information (collectively the “Discloser”), shall protect the confidentiality of Discloser’s Confidential Information with the same degree of care, but no less than reasonable care, as used to protect Recipient’s own confidential information. Except as permitted by and subject to the restrictions of this Agreement, Recipient shall limit the distribution and communication of such Confidential Information to duly authorized personnel of Recipient who (a) have a strict need to view such Confidential Information, (b) are informed as to the confidential nature of such Confidential Information, and (c) are bound by written confidentiality obligations consistent with and no less restrictive than the requirements of this Agreement. Subject to the licenses granted under this Agreement, Recipient shall not use or benefit from Discloser’s Confidential Information except, or make more than a reasonable number of copies of Discloser’s Confidential Information, as strictly necessary for the purpose of fulfilling the objectives and obligations of this Agreement, and in the case of Customer, for the purpose of using the Patchstack Solution in compliance with this Agreement. Each party shall implement and maintain reasonable technical and organisational measures to protect Confidential Information, including access controls, encryption of Confidential Information in transit and at rest, and appropriate confidentiality markings.
4.2. Exceptions. Recipient’s obligations in section 4.1 will not apply to any portion of Confidential Information which falls into one or more of the following categories: (a) through no act or failure to act on the part of Recipient, and through no violation of this Agreement, is now or hereafter becomes publicly or generally known; (b) is rightfully known or lawfully in the possession of Recipient prior to disclosure; (c) is independently developed or ascertained by Recipient without use of Confidential Information; and (d) is hereafter rightfully furnished to Recipient by a third party without restriction on disclosure and without an apparent violation of confidentiality obligations owed to Discloser. Notwithstanding the foregoing, either party may disclose the terms of this Agreement, under written obligations of confidentiality, to such party’s legal and financial advisers and current or potential lenders and investors.
4.3. Compelled Disclosure. If Recipient is required, pursuant to a legal proceeding or other legal or regulatory requirement, to disclose Discloser’s Confidential Information, Recipient shall, to the extent permitted by law, provide to Discloser reasonable prior notice and cooperation in order for the parties to contest or limit such disclosure.
4.4. Return and Destruction. Upon termination of this Agreement or any Patchstack Service subscription for any reason, Recipient shall immediately destroy all Confidential Information received from Discloser. Notwithstanding the foregoing, Recipient may retain copies of Confidential Information, so long as such copies remain subject to the confidentiality protections of and are not used for any purpose inconsistent with this Agreement: (a) in electronic form created in the ordinary course of Recipient’s data information technology or archiving operations, or (b) for so long as necessary to comply with applicable legal requirements.
4.5. Application. Notwithstanding any other confidentiality or non-disclosure provisions to which the parties have agreed, this section 4 exclusively controls with respect to Confidential Information.
5. PAYMENT
5.1. Payments. Customer will pay to Patchstack the fees listed in the Order Form. Fees are exclusive of bank service fees or currency exchange settlements. All payments are non-refundable (except as may otherwise be specified in the Order Form or this Agreement). Charges are imposed at the beginning of the subscription. Customer represents and warrants that Customer: (a) is authorized to use the billing account provided to Patchstack and that any payment information provided is true, complete and accurate; and (b) has full authorization to allow Patchstack to charge Customer using Customer’s billing account. Except as otherwise set forth in the Order Form, payments are due within 30 days of Patchstack’s invoice. If Customer is delinquent in the payment of any invoice for a period of longer than ten business days, Patchstack may at its option, with five business days written notice to Customer, suspend access to the Patchstack Solution until such payments are made in full. Any payments that are not timely paid as provided hereunder will, at Patchstack’s option, bear compound interest at the rate of the lower of (i) one percent per month; or (ii) the highest rate permitted by applicable law. Payments to Patchstack will be made without deduction, counterclaim or set-off of any kind. Customer will not develop multiple Customer Operations to simulate or act as a single Customer Operation or otherwise access the Patchstack Solution in a manner intended to avoid incurring fees. Notwithstanding any other provision of this Agreement, nothing in this Agreement (including section 8.6) will preclude Patchstack from filing a fees and expenses collection action in any court of competent jurisdiction, and Customer hereby consents to the exercise of the jurisdiction of such court in any such collections action. Patchstack’s right to file such action is not subject to arbitration.
5.2. Payment Disputes. If Customer disputes all or any part of an invoice, Customer shall notify Patchstack in writing prior to the applicable invoice due date. In such notice, Customer shall specify in reasonable detail the basis of the dispute. The due date for undisputed portions will remain the same. Failure to submit such written notice by the due date will be deemed to constitute Customer’s acceptance of such invoice. Within ten business days of Patchstack’s receipt of the Customer’s dispute notice, the parties will cause their authorized representatives to meet in person (live or via remote interaction) in a good faith effort to resolve the dispute. Customer’s failure to participate in such dispute resolution will be deemed to constitute Customer’s acceptance of such invoice.
5.3. Taxes. Customer will bear and be responsible for the payment of all taxes, including all sales, use, value-added, rental receipt, personal property or other taxes and their equivalents which may be levied or assessed in connection with this Agreement or provision of the Patchstack Solution (excluding only taxes based on Patchstack’s income). If Patchstack is required to pay or collect any such taxes or other charges for which Customer is responsible under this section, Customer will pay the appropriate amount as invoiced. If Customer is required by local law to withhold or deduct taxes based upon Patchstack’s income from any payment(s) owed hereunder, such payment(s) will be increased (grossed up) in such amounts as would have been received by Patchstack as if no such withholding or deduction were required.
6. DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITY
6.1. Disclaimer. TO THE MAXIMUM EXTENT POSSIBLE UNDER APPLICABLE LAW, PATCHSTACK DISCLAIMS ALL WARRANTIES OF ANY KIND WITH RESPECT TO THE PATCHSTACK SOLUTION, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. Customer acknowledges that the value or use of the Patchstack Solution is not reliant or dependent on the availability of any future functionality or features or on any oral or written public or private comments or representations made by Patchstack, reliance on which Customer hereby disclaims. Patchstack makes no warranty that (a) the Patchstack Solution will meet Customer’s requirements, goals or needs, (b) Patchstack Solution access will be uninterrupted, timely, secure or error-free, or (c) any delays, errors or deficiencies in the Patchstack Solution will be corrected. Customer acknowledges that no vulnerability detection or mitigation service can guarantee identification of, or protection against, all security vulnerabilities at all times. The nature and volume of software vulnerabilities change continuously, and complete coverage is not achievable by any vendor. Patchstack will use commercially reasonable efforts to maintain and update its vulnerability detection and mitigation capabilities, but does not warrant that the Patchstack Service will detect or mitigate every vulnerability affecting Customer Operations.
6.2. Limitation of Liability.
6.2.1 Subject to section 6.2.2, each party’s maximum cumulative aggregate liability for all claims, liabilities or obligations (other than Customer’s payment obligations under this Agreement and excluding prevailing party awards under section 8.9) arising under or relating to the “Subject Matter” (defined as this Agreement and all exhibits, its performance or non-performance, the Patchstack Solution, and its and their availability, quality or performance, End Users, Customer’s decision to select Patchstack and the Patchstack Solution, and all or any of the foregoing), regardless of the number of claims or the theory of liability, whether for breach of this Agreement, including breach of warranty, or in tort or otherwise, will not exceed the greater of (i) US$10,000 or (ii) all amounts paid by Customer to Patchstack under this Agreement, if any, during the most recent full calendar year. Subject to section 6.2.2, neither party will be liable for any indirect, punitive, special, incidental or consequential damages, or liable for interruption of business, loss of profits, anticipated revenue, use, data, goodwill, or other economic advantage, reputational harm, regulatory fines or penalties, or cost of cover or replacement, in connection with, related to or arising out of the Subject Matter, regardless of the theory of liability, whether for breach of this Agreement, including breach of warranty, or in tort or otherwise, even if such party has been previously advised of the possibility of such damages. Each party, on behalf of itself and its affiliates, hereby accepts the exclusions and limitation of, and waives claims for losses, damages, expenses, or liability, limited and/or excluded by, this section, regardless of the validity or efficacy of any remedy provided herein, and even if any remedy fails of its essential purpose. Each party expressly disclaims that such party is owed any duties or are entitled to any remedies not expressly set forth in this Agreement. The foregoing limitations and exclusions apply to the maximum extent permitted by applicable law. Notwithstanding the foregoing, the limitations and exclusions in this section 6.2 will not limit or exclude liability to the extent that such limitation or exclusion is prohibited by the mandatory provisions of the governing law applicable under section 8.5, including any mandatory rules relating to liability for intentional misconduct or gross negligence.
6.2.2 Section 6.2.1 will not apply to: (i) obligations under or liability for breach of sections 6.3 or 6.4; or (ii) limit or exclude remedies, or limit or exclude the recovery of any damages or losses, caused by or arising or resulting from (a) breach of section 3, or (b) infringement by one party of the intellectual property rights of the other party.
6.3. Patchstack Indemnity.
6.3.1 For as long as a subscription term under this Agreement is in effect and for two years thereafter, Patchstack shall defend “Customer Parties” (defined as Customer, its affiliates, and officers, directors, employees and agents of Customer and its affiliates), at its expense, from and against any third party demand, claim, action, suit or legal proceeding alleging that Customer’s authorized use of the Patchstack Service is an infringement of such third party copyrights, trade secrets, or US-, EU- or UK-originated patents. Further, Patchstack will indemnify and hold Customer Parties harmless against all costs, damages, losses, liabilities, and expenses (including, without limitation, costs and reasonable attorneys’ fees) finally awarded by a court of competent jurisdiction, or such settlement amount negotiated by Patchstack, attributable to such claim.
6.3.2 Patchstack’s performance under this section 6.3 is conditioned on Customer’s compliance with the following conditions: (a) Customer promptly gives Patchstack written notice of the claim, provided that a failure to provide such notice will only relieve Patchstack of its obligations to the extent Patchstack is materially prejudiced by such failure; (b) Customer gives Patchstack sole control of the defense and settlement of the claim, provided that Patchstack shall keep Customer reasonably informed as to the status and progress of the defense of the claims; and (c) Customer provides to Patchstack all available information, reasonable assistance and authority to defend, at Patchstack’s expense. Patchstack will not attempt to compromise or settle such claim without Customer’s prior written consent (not to be unreasonably withheld), provided that if such settlement does not require Customer to incur any liability or obligation, pay money, or admit fault, Patchstack may settle such claim with written notice to Customer but without Customer’s prior written consent.
6.3.3 Patchstack’s obligations under section 6.3 will not apply to any claims to the extent based upon or arising from: (a) the combination of the Patchstack Service with Other Applications; (b) modifications, extensions or enhancements of the Patchstack Service developed by a party other than Patchstack; (c) functionality, components, APIs, portions, or aspects of the Patchstack Service developed to enable the interoperability of the Patchstack Service with Other Applications; (d) modifications to the Patchstack Service required by Customer; (e) Other Applications; (f) any use of the Patchstack Service in breach of this Agreement; or (g) intellectual property rights in which Customer or any Customer affiliate owns or has a direct or indirect interest.
6.3.4 If the Patchstack Solution becomes the subject of a third party intellectual property infringement, misappropriation, or other claim, Patchstack may, in its sole discretion and at no cost to Customer: (a) modify the Patchstack Solution so that it no longer infringes or misappropriates; or (b) obtain a license for Customer’s continued use of the Patchstack Solution in accordance with this Agreement; or (c) otherwise resolve the issue; or (d) terminate Customer’s subscription for the Patchstack Solution and, provided all outstanding Patchstack charges have been paid, refund to Customer a prorated amount of any unused prepaid fees covering the remainder of the term of the terminated subscription. This section 6.3 states Customer’s sole remedy and Patchstack’s sole obligation with respect to infringement or misappropriation of a third party’s intellectual property rights, or other third-party claims covered by section 6.3.1, with respect to Patchstack or the Patchstack Solution.
6.4. Customer Indemnity.
6.4.1 For as long as a subscription term under this Agreement is in effect and for two years thereafter, Customer shall defend “Patchstack Parties” (defined as Patchstack, its affiliates, and officers, directors, employees and agents of Patchstack and its affiliates), at its expense, from and against any demand, claim, action, suit, or proceeding arising out of or related to: (a) Customer Operations; or (b) actual or alleged violation of this Agreement or applicable law. Further, Customer shall indemnify and hold the Patchstack Parties harmless against all costs, damages, losses, liabilities, and expenses (including, without limitation, costs and reasonable attorneys’ fees) finally awarded by a court of competent jurisdiction, or such settlement amount negotiated by Customer, in connection with such claims.
6.4.2 Customer’s performance under this section 6.4 is conditioned on Patchstack’s compliance with the following conditions: (a) Patchstack promptly gives Customer written notice of the claim, provided that a failure to provide such notice will only relieve Customer of its obligations of this section to the extent Customer is materially prejudiced by such failure; (b) Patchstack gives Customer sole control of the defense and settlement of the claim, provided that Customer shall keep Patchstack reasonably informed as to the status and progress of the defense of the claims; and (c) Patchstack provides to Customer all available information, reasonable assistance and authority to defend, at Customer’s expense. Customer shall not attempt to compromise or settle such claim without Patchstack’s prior written consent (not to be unreasonably withheld), provided that if such settlement does not require Patchstack to incur any liability or obligation, pay money, or admit fault, Customer may settle such claim with written notice to Patchstack but without Patchstack’s prior written consent.
7. TERM AND TERMINATION
7.1. Term. Access to the Patchstack Solution commences upon the subscription start date set forth in the Order Form and will continue in effect for the term specified in the Order Form. Unless the Order Form provides otherwise, each subscription will automatically renew for successive periods equal to the initial subscription term, unless either party provides written notice of non-renewal at least thirty days prior to the end of the then-current term. Customer is solely responsible for retrieval of Customer’s data and feeds prior to termination of the subscription.
7.2. Termination. This Agreement or any subscription will be terminable for cause as follows: (a) by either party in the event of a material remediable breach of this Agreement; in such an event, the terminating party will give notice of such default and opportunity to cure if the breach is remediable or reasonably capable of cure, and if the remediable breach is not substantially cured within thirty days from receipt of such written notice, the terminating party may notify the defaulting party in writing of the immediate termination of this Agreement or any subscription(s); or (b) immediately upon written notice by either party in the event of material irremediable breach of this Agreement. Patchstack may additionally terminate this Agreement or any subscription upon written notice to Customer if either party: (c) becomes the subject of a legal proceeding under a law relating to insolvency or bankruptcy; (d) has property that becomes under the control of a custodian or equivalent under applicable law, or is assigned for the benefit of creditors; (e) generally ceases relevant business operations; or (f) generally fails to pay debts as they become due or acknowledges in writing its inability to do so. Additionally, Patchstack may suspend or terminate a subscription: (g) if Customer is late in the payment of any Patchstack invoice twice in any four-month period; (h) in the event of breach of section 8.2, or (i) as required by law or any court, agency or governmental authority, or for emergency reasons.
7.3. Effect. Upon termination, all access and licensed rights under this Agreement terminate, and Customer will cease all use of the Patchstack Solution and Service Deliverables, and pay any outstanding fees owed to Patchstack and all remaining fees applicable to the remaining term of the subscription. Notwithstanding any other provision of this Agreement, Customer shall destroy all copies of Service Deliverables in its and Customer Parties’ (as that term is defined in section 6.3.1) possession or control. Termination will not relieve Customer of the obligation to pay fees payable to Patchstack for the period prior to the effective date of termination. Rightful and lawful termination of this Agreement by either party, or expiration under the terms hereof, will not in itself give rise to any liability or claim for damages on account of such termination or expiration; provided that termination or expiration shall not affect any accrued rights, obligations, or claims of either party arising prior to the effective date of termination or expiration, including without limitation any rights under sections 6.3 or 6.4. The rights of either party under this section 7 are in addition to any other rights and remedies permitted by law or under this Agreement. Sections 2.4, 2.5, 2.6, 2.10 (excluding 2.10.1), 3 (excluding section 3.1), 4, 5, 6, 7.3 and 8 will survive any termination or expiration of this Agreement.
8. GENERAL PROVISIONS
8.1. Trademarks; Media. Subject to section 2.10, neither party is granted any right, title or license to any trademarks or servicemarks of the other party. Patchstack reserves all right, title and interest in and to Patchstack trademarks, servicemarks, trade names, domain names, and similar identifiers. Customer hereby authorizes Patchstack to disclose in Patchstack websites, marketing collateral, and corporate presentations that Customer has selected Patchstack and purchased the use of Patchstack’s solutions and services. Customer may revoke such authorization at any time upon five business days written notice.
8.2. Export Control. Customer agrees to comply with all export and import laws and regulations of the United States, the United Kingdom, the European Union, and other applicable jurisdictions. Without limiting the foregoing: (a) Customer represents and warrants that it is not listed on any government or international list of prohibited, sanctioned, or restricted parties, or located in or a national of a country that is subject to any government or international embargo, sanction or designation, (b) Customer will not (and will not permit any third parties to) access or use the Patchstack Solution in violation of any export embargo, prohibition or restriction, or applicable law, and (c) Customer will not submit any information or application that is controlled under the U.S. International Traffic in Arms Regulations or similar laws or regulations.
8.3. Anti-Bribery. Each party shall comply with all applicable anti-bribery and anti-corruption laws, including the U.S. Foreign Corrupt Practices Act and the UK Bribery Act 2010. Neither party shall, directly or indirectly, offer, promise, give, or authorize the giving of any financial or other advantage to any public official, political party, or any other person in order to obtain or retain business or any improper advantage in connection with this Agreement.
8.4. Force Majeure.
8.4.1 Excused Performance. Neither party shall be responsible or liable to the other party, or be deemed to have defaulted under or breached this Agreement, for any failure or delay in fulfilling or performing any term or obligation of this Agreement (other than payment obligations under section 5, confidentiality obligations under section 4, or licence restrictions under section 3), if and for as long as such failure or delay arises from any cause beyond the reasonable control of that party (a “Force Majeure Event”), including: acts of God; fire, flood, earthquake, or other natural disaster; epidemic or pandemic; war, armed conflict, invasion, terrorism, or civil unrest; government action, sanctions, embargo, or trade restriction; labour dispute, strike, or lockout (and neither party shall be required to settle a labour dispute on unfavourable terms); failure, disruption, or degradation of internet services, telecommunications networks, cloud hosting infrastructure, or third-party service providers; cyberattack, distributed denial-of-service attack, or ransomware; or power grid, network, or utility failure.
8.4.2 Notification. The party affected by a Force Majeure Event shall notify the other party in writing within a commercially reasonable time after becoming aware of the event, describing the nature and expected duration of the disruption; provided that failure to provide such notice shall not forfeit the affected party’s rights under this section but may be considered in assessing the reasonableness of the affected party’s response.
8.4.3 SLA Exclusion. Force Majeure Events shall be excluded from any calculation of service availability, uptime, or service level commitments under the SLA.
8.4.4 Extended Force Majeure. If a Force Majeure Event affecting a party’s performance continues for more than sixty consecutive days, either party may terminate the affected subscription(s) upon written notice to the other party, without liability on account of such termination, and Patchstack shall refund to Customer a prorated portion of any prepaid fees attributable to the terminated portion of the subscription term following the effective date of termination.
8.5. Governing Law. The Subject Matter (as defined in section 6.2), and any disputes between the parties and related to or concerning the Subject Matter (including tort as well as contract claims, and whether pre-contractual or extra-contractual), notwithstanding the choice of laws rules of any jurisdiction to the contrary, will be governed by the procedural and substantive laws of Delaware, USA, if Customer is headquartered or domiciled in North, Central or South America, or the laws of Estonia, if Customer is headquartered or domiciled anywhere else.
8.6. Dispute Resolution.
8.6.1 Binding Arbitration. Any disputes between or claims brought by either party arising out of or related to the Subject Matter (as defined in section 6.2), including tort as well as contract claims, and whether pre-contractual or extra-contractual, as well as the arbitrability of any disputes (subject to section 8.6.3 below) must be referred to and finally settled by binding arbitration. If Customer is headquartered or domiciled in North, Central or South America, arbitration will be conducted by JAMS (jamsadr.com) in accordance with the Comprehensive (Expedited) Rules of Arbitration in effect at the time of arbitration except as inconsistent with this section, and the venue for the arbitration will be New York City, New York. If Customer is headquartered or domiciled anywhere else, arbitration will be conducted before the Arbitration Court of the Estonian Chamber of Commerce and Industry (ECCI) in accordance with the Arbitration Rules in effect at the time of arbitration except as inconsistent with this section, and the venue for the arbitration will be Tallinn. The arbitration will be conducted by telephone, on-line and/or based solely upon written submissions where no in-person appearance is required. If in-person appearance is required, such hearings will be held in New York City or Tallinn, as applicable above. The arbitrator will apply the law specified in section 8.5 above. All awards may if necessary be enforced by any court having jurisdiction.
8.6.2 Proceedings. The existence of any dispute, the existence or details of the arbitration proceeding, and all related documents, materials, evidence, and awards, must be kept confidential. Except as required by law, no party will make any public statements concerning the other party or make any public announcements with respect to the proceeding or the award or ruling, except as required to enforce the award or ruling. The parties hereby waive the right to a trial by jury and agree to only bring claims in an individual capacity and not as a plaintiff or class member in any purported class or representative proceeding. All disputes will be arbitrated only on an individual basis and not in a class, consolidated or representative action. The arbitrator does not have the power to vary these provisions. All claims (excluding requests for injunctive or equitable relief) between the parties must be resolved using arbitration in accordance with this section. Should either party file an action contrary to this section, the other party may recover lawyers’ fees and costs associated with enforcing this section, provided that the party seeking the award has notified the other party in writing of the improperly filed claim, and the other party has failed to withdraw the claim in a timely fashion.
8.6.3 Injunctive and Provisional Relief. Notwithstanding the foregoing, nothing in this section will preclude the right and ability of either party to bypass arbitration and file and maintain at any time in any court of competent jurisdiction under the laws applicable thereto an action for recovery of injunctive or provisional relief (and either party’s right to do so is not arbitrable).
8.6.4 Consumer Savings. If any Customer is determined by a court or tribunal of competent jurisdiction to be a consumer under applicable mandatory law, the dispute resolution provisions of this section will be modified to the minimum extent required by such mandatory law, and the remaining provisions of this section will continue in full force and effect.
8.7. Assignment. Customer will not assign, delegate, or transfer, in whole or in part, this Agreement or any subscription, whether voluntarily, involuntarily, by merger, consolidation, dissolution, sale of assets, or otherwise, without Patchstack’s prior written consent. Any such purported assignment, delegation or transfer without such written consent will be void. Patchstack may assign, transfer, or delegate this Agreement, in whole or in part, without Customer’s prior consent: (a) to any Patchstack affiliate; (b) in connection with a merger, acquisition, corporate reorganization, or sale of assets or equity; or (c) in connection with any transaction described in clause (b), to a designated service provider engaged by Patchstack, its assignee, or its successor to continue operation of the Patchstack Solution. Customer agrees that any such assignment, transfer or delegation includes the transfer of all rights, obligations, and associated data (including account information and operational data) to the extent necessary to ensure continuity of service under this Agreement. The assignee, transferee, or delegate shall be bound by the terms of this Agreement with respect to such data and the provision of the Patchstack Solution. This Agreement will be binding on, and inure to the benefit of, the parties and their respective and permitted successors and assigns.
8.8. Injunctive Relief. Customer acknowledges that breach of this Agreement, or any unauthorized use, disclosure or distribution of the Patchstack Solution (or its functionality) may cause irreparable harm to Patchstack, the extent of which would be difficult to ascertain, and that Patchstack will be entitled to seek immediate injunctive relief (in addition to any other available remedies, including remedies under intellectual property rights, the availability of which Customer acknowledges), in any court of competent jurisdiction under the applicable laws thereto.
8.9. Prevailing Party. A party prevailing, whether by compromise, settlement, judgment, default or abandonment, in any litigation or arbitration proceeding between the parties arising from or related to the Subject Matter, including in interim proceedings and appeals, is entitled to an award of reasonable professionals’ fees (including fees of lawyers, attorneys, solicitors, barristers, advocates, counselors, witnesses, and experts) and costs incurred in or related to the litigation or arbitration, including arbitration-related fees. A party that seeks to enforce claims against the other party is a prevailing party if it substantially recovers the relief requested in its claims; otherwise, the other party is the prevailing party. If both parties seek to enforce claims, the party that nets a greater recovery will be the prevailing party or, if neither party is awarded any relief, no party is the prevailing party. Any costs and fees involved in securing a prevailing party award shall be fully assessed against and paid by the party resisting enforcement of the award. This section is in addition and without prejudice to availability of professionals’ fees as a remedy under applicable law, including laws pertaining to intellectual property rights.
8.10. Important Final Terms.
8.10.1 Entire Agreement. Except as may otherwise be set forth in the Order Form, this Agreement and the Order Form constitute the entire agreement between the parties and govern the use of the Patchstack Solution and Service Deliverables, superseding any prior agreements, understandings, communications or proposals. Customer acknowledges that Customer is not relying on any statement, warranty, representation or inducement made by or on behalf of Patchstack that is not specified in this Agreement. Customer acknowledges that no officer, agent, representative or employee of Patchstack has any authority, express or implied, to make any statement, warranty, representation or inducement not specifically set forth in this Agreement. The terms of any click-wrap, on-line or similar agreement, and the terms of any purchase order, presented by Customer will be of no force or effect unless separately agreed to in an independent writing signed by an officer of Patchstack, who is the only person with authority to agree to such terms, order or agreement.
8.10.2 Interpretation and Severability. This Agreement will be fairly interpreted in accordance with its terms and without any strict construction in favor of or against either party. If any provision of this Agreement is found by a court of competent jurisdiction to be invalid, the parties nevertheless agree that the court should endeavour to give effect to the parties’ intentions as reflected in the provision, and the other provisions of this Agreement remain in full force and effect. Without limiting the foregoing, if any limitation, exclusion, or other protective provision of this Agreement is held to be unenforceable, void, or unfair under applicable law, the parties agree that it will be deemed modified to the minimum extent necessary to make it enforceable, rather than voided entirely, and the remaining provisions will continue in full force and effect.
8.10.3 Waiver. No waiver of any provision of this Agreement will be deemed a further waiver or continuing waiver or such provision or any other provision, and a party’s failure to assert any right or provision under this Agreement will not constitute a waiver of such right or provision.
8.10.4 Language. This Agreement is in the English language only, which language will be controlling in all respects, and all versions of this Agreement in any other language will be for accommodation only and will not be binding on the parties to this Agreement. All communications and notices made or given pursuant to this Agreement will be in the English language.
8.10.5 Relationship of Parties. Nothing herein will be deemed to create an agency, partnership, joint venture, employee-employer or franchisor-franchisee relationship of any kind between the parties and any user or other person or entity, nor do these terms extend rights to any third party.
Exhibit A: Data Processing Addendum
Exhibit B: Support and Service Level Policy Addendum
Exhibit C: Initial Order Form
EXHIBIT A: DATA PROCESSING ADDENDUM
This Data Processing Addendum (“DPA”) is an agreement between Patchstack and Customer. This DPA supplements the Patchstack Master Solution Agreement between the parties (the “Agreement”). Capitalised terms not otherwise defined herein will have the meanings given to them in the Agreement.
Customer acknowledges that the Patchstack Solution processes HTTP traffic, vulnerability data, and related technical information associated with Customer Operations, some of which may contain Personal Data as defined below. Such Personal Data is processed as a necessary incident of the Patchstack Solution’s security monitoring, vulnerability detection, and virtual patching functions. Patchstack does not determine the purposes for which Customer Operations generate or collect such data, nor does Patchstack inspect, select, or make decisions based on the substance of such data except as required to provide the Patchstack Solution.
Customer may be the controller of Personal Data, or the processor of Personal Data. When Customer is the controller and Personal Data is processed by Patchstack in providing the Patchstack Solution, Patchstack will be the processor of that Personal Data. When Customer is the processor and Personal Data is processed by Patchstack in providing the Patchstack Solution, Patchstack will be the sub-processor of that Personal Data.
This DPA applies only to the extent that Patchstack processes Personal Data for Customer as Customer’s processor or sub-processor.
DEFINITIONS
“Data Protection Law” means all applicable data protection and privacy legislation, including: (a) the General Data Protection Regulation (EU) 2016/679 (“EU GDPR”); (b) the EU GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“UK GDPR”); (c) the UK Data Protection Act 2018; (d) the Swiss Federal Act on Data Protection of 25 September 2020 (“Swiss FADP”); (e) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020; and (f) any other applicable data protection legislation, in each case as amended, superseded, or replaced from time to time.
“EU Standard Contractual Clauses” means the standard contractual clauses annexed to the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj, specifically Module 2 (controller to processor) and Module 3 (processor to processor) as applicable, and any modifications and replacements to them, or other standard contractual clauses adopted by the European Commission and entered into by the parties, from time to time.
“GDPR” means the EU GDPR and/or the UK GDPR, as applicable.
“Instructions” means (a) the Agreement (including this DPA), (b) Customer’s use of the Patchstack Solution including Customer’s preferences, settings, and controls within the Patchstack Solution, and (c) any other written instructions provided by Customer and acknowledged by Patchstack as valid instructions with which Patchstack agrees to comply.
“Personal Data” means any information relating to an identified or identifiable natural person that is processed by Patchstack in connection with the provision of the Patchstack Solution, and which is subject to Data Protection Law.
“Standard Contractual Clauses” or “SCCs” means the EU Standard Contractual Clauses and/or the UK Addendum, as applicable.
“Sub-processor” means any processor that is engaged by Patchstack to assist in its processing of Personal Data for Customer.
“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018, as amended from time to time, and available at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf.
The terms “controller”, “data subject”, “processor”, “processing”, and “supervisory authority” have the meanings given to them in the EU GDPR or the UK GDPR, as applicable. Where this DPA refers to the Swiss FADP, such terms will be interpreted in accordance with the Swiss FADP.
DATA PROTECTION
1. General Compliance. Both parties will comply with their respective obligations under Data Protection Law. This DPA is in addition to, and does not relieve, remove, or replace, a party’s obligations under Data Protection Law.
2. Scope and Roles. This DPA applies to Personal Data processed by Patchstack for Customer, if any. In this context, Patchstack may act as processor to Customer, who may act either as controller or processor with respect to Personal Data. If Customer acts as a processor, Customer represents and warrants on an ongoing basis that the relevant controller has authorised: (a) the Instructions; and (b) Customer’s engagement of Patchstack and its Sub-processors. Customer will forward to the relevant controller promptly and without undue delay any notice provided by Patchstack under this DPA.
3. Processing Details. Details of Personal Data processing (constituting Annex I and Annex II to the EU Standard Contractual Clauses and/or Appendix Information for the UK Addendum, as applicable):
Data Exporter: Customer.
Data Importer: Patchstack OU, Aida tn 7, 80011 Parnu linn, Parnu maakond, Estonia.
Subject Matter: Personal Data as described below, processed in connection with the provision of the Patchstack Solution.
Purpose: the provision of the Patchstack Solution to Customer, including vulnerability detection, virtual patching, security monitoring, and related analytics.
Nature of the Processing: collection, logging, storage, analysis, retrieval, consultation, use, disclosure by making available, alignment, combination, restriction, erasure, and destruction of Personal Data, in each case as a necessary incident of the provision of the Patchstack Solution as described in the Agreement and initiated by Customer.
Categories of Data Subjects: the data subjects may include: (a) Customer’s employees and other individuals in a working relationship with Customer; (b) representatives of Customer’s cooperation partners; (c) Customer’s customers, users, and potential customers or users who are natural persons; (d) visitors to and users of Customer Operations (websites, platforms, and services protected by the Patchstack Solution); and (e) any other individuals whose Personal Data is transmitted to or entered into the Patchstack Solution by or on behalf of Customer.
Types of Personal Data: Patchstack processes the following categories of Personal Data as a necessary incident of providing the Patchstack Solution:
- SaaS firewall logs (collected from any CMS with the Patchstack firewall enabled): IP addresses, user agent strings, and HTTP form submission data associated with blocked threats. Form submission data may incidentally contain Personal Data such as names, email addresses, or other information submitted by website visitors, the specific contents of which vary and cannot be predetermined (“Captured Personal Data”);
- SaaS activity logs (collected from WordPress sites with the Patchstack plugin installed): IP addresses, usernames, and email addresses, depending on the activity type logged;
- Account and contact data: names, email addresses, and other contact information of Customer’s representatives provided through the Patchstack customer portal or in connection with account administration;
- Other: any other Personal Data that Customer transmits to or enters into the Patchstack Solution.
Special Categories of Data: the parties do not anticipate the processing of sensitive or special categories of Personal Data or data relating to criminal convictions or offences. Customer agrees not to transmit special category data through the Patchstack Solution. In the event Customer does so in breach of this restriction, Patchstack will have no liability for any claim arising from or relating to such data.
Processing Operations: as described in this DPA, including this section 3.
Duration of Processing:
- Captured Personal Data and SaaS firewall logs: for the duration of Customer’s subscription or until Customer’s account is deleted, whichever occurs first, unless a shorter retention period is configured by Customer via the Patchstack Solution.
- SaaS activity logs: for the duration of Customer’s subscription or until Customer’s account is deleted, whichever occurs first.
- Account and contact data: for the duration of the Agreement and for such further period as required to comply with applicable law.
Competent Supervisory Authority: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) (EU); the UK Information Commissioner’s Office (“ICO”) (UK); and the Federal Data Protection and Information Commissioner (Switzerland), as applicable.
4. Customer Warranties. Customer will ensure and warrants on an ongoing basis that it has all necessary and appropriate consents, lawful bases, and notices in place, in any form required by Data Protection Law, to enable the lawful transfer of Personal Data to Patchstack for the duration and purposes of the Agreement. The parties agree that Personal Data processing is required as a part of Patchstack’s provision of the Patchstack Solution, and that Personal Data is not exchanged for monetary or other valuable consideration.
5. Transfer Responsibility. Customer will ensure and warrants that where Personal Data is transferred outside the European Economic Area (“EEA”), Switzerland, or outside the UK, as part of Customer’s use or deployment of the Patchstack Solution, adequate measures will be taken to ensure the Personal Data will be protected to an adequate level and the data subjects’ rights under Data Protection Law will not be prejudiced by such a transfer. Subject to Patchstack’s obligations in section 10.5 below with respect to Sub-processors, and section 13 below with respect to the Standard Contractual Clauses if applicable, Customer acknowledges that Customer is solely responsible for ensuring that Personal Data is transferred out of the EEA, Switzerland, or the UK in full compliance with Data Protection Law.
6. Customer Security Measures. Customer will ensure and warrants that Customer utilises appropriate technical and organisational measures to ensure a level of security appropriate to such risks, including, as appropriate, the measures referred to in Data Protection Law.
7. Ongoing Security Assessment. Customer confirms that it has assessed any security measures in place at the time of this Agreement, and that it will continue to do so on an ongoing basis to ensure its obligations under this DPA. Customer is solely responsible (as between the parties) if such measures fail to meet the standards required by Data Protection Law.
8. Data Subject Information. Customer undertakes and confirms that any information required to be provided to a data subject has been so provided, or an applicable exemption is available and is being relied upon by Customer.
9. Independent Controllers. Customer and Patchstack agree that to the extent each party processes any Personal Data of the other party’s personnel in connection with entry into the Agreement or the management of their business relationship, such party processes such data as an independent controller.
10. Patchstack’s Obligations. Patchstack shall, in relation to any Personal Data processed in connection with the provision of the Patchstack Solution:
10.1. process that Personal Data only on the Instructions, except to the extent Patchstack is required to process data by applicable law or if in Patchstack’s reasonable opinion such Instructions infringe Data Protection Law. In either case, Patchstack will without undue delay notify Customer unless applicable law prohibits Patchstack from so notifying Customer;
10.2. not access or use, or disclose to any third party, any Personal Data, except, in each case, as necessary to maintain or provide the Patchstack Solution, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order);
10.3. ensure that it has in place appropriate technical and organisational measures set forth in Annex 1 to this DPA designed to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction, or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures;
10.4. ensure that all Patchstack personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential;
10.5. ensure that where Sub-processors are used outside the EEA, Switzerland, or the UK, such that Personal Data is transferred outside the EEA, Switzerland, or the UK, and such transfer is not to a third country recognised as providing an adequate level of protection under applicable Data Protection Law, Patchstack will use commercially reasonable efforts to ensure that appropriate transfer mechanisms are in place, which may include without limitation use of the SCCs;
10.6. maintain general records of processing activities carried out on behalf of Customer as required by Data Protection Law;
10.7. taking into account the nature of the processing, insofar as reasonable and practicable, assist Customer in responding to any request from a data subject and in ensuring compliance with its obligations under Data Protection Law with respect to security, breach notifications, impact assessments, and consultations with supervisory authorities or regulators. Patchstack agrees to provide, upon reasonable request and at Customer’s expense, information reasonably necessary for Customer to conduct transfer impact assessments. Patchstack’s obligation to provide assistance under this section 10.7 is limited to the Personal Data processed by Patchstack and the processing Patchstack performs. Patchstack is not obligated to provide legal advice or to assess the compliance of Customer’s broader processing activities;
10.8. notify Customer without undue delay (and within 72 hours or any notice period mandated by Data Protection Law, whichever is shorter) on becoming aware of and validating a Personal Data security incident and will provide all information required by Data Protection Law. Patchstack is not obligated to report unsuccessful incidents or incidents that result in no unlawful or accidental destruction, loss, alteration, disclosure of, or unauthorised access to Personal Data or any of Patchstack’s equipment or facilities storing Personal Data. Such non-reportable incidents may include, without limitation, pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorised access to traffic data that does not result in access beyond headers), or similar incidents. Patchstack’s obligation to report or respond to a security incident under this section is not and will not be construed as an acknowledgement by Patchstack of any fault or liability of Patchstack with respect to the incident. Patchstack has no obligation to assess or inspect data in order to identify information subject to any specific legal requirements;
10.9. make available to Customer information reasonably necessary to demonstrate compliance with Patchstack’s obligations under this section 10. Patchstack may satisfy this obligation by providing: (a) summaries or attestation letters derived from third-party audits or certifications conducted within the preceding twelve months; and/or (b) written responses to reasonable written questions submitted by Customer. If Customer reasonably demonstrates that the foregoing measures are insufficient to verify compliance, Patchstack will permit an audit or inspection of the processing activities covered by this DPA, subject to the following conditions: (i) Customer will provide not less than sixty days’ prior written notice; (ii) such audit will be conducted no more than once per calendar year; (iii) such audit will be conducted at Customer’s sole expense (including any reasonable fee charged by Patchstack for staff time and resources); (iv) the auditor must be a reputable third-party audit firm mutually agreed upon by the parties (such agreement not to be unreasonably withheld), which has entered into a confidentiality agreement acceptable to Patchstack; (v) the audit will be limited in scope and duration to that which is reasonably necessary to verify compliance with this DPA and will not extend to Patchstack’s other customers’ data, proprietary systems, source code, or trade secrets; (vi) the auditor’s findings will be shared with Patchstack and will be treated as Confidential Information of Patchstack under the Agreement; and (vii) Customer will use reasonable efforts to minimise disruption to Patchstack’s operations. For the avoidance of doubt, this section 10.9 supersedes any conflicting audit provisions in the SCCs to the maximum extent permitted by Data Protection Law; and
10.10. at the written direction of Customer, delete Personal Data on termination of the Agreement unless required by applicable law to store the Personal Data.
11. Reciprocal Cooperation. Customer shall provide reasonable cooperation and information to Patchstack in connection with any inquiry, investigation, or proceeding by a supervisory authority or regulator that relates to Personal Data processed under this DPA, including by confirming the lawful basis for processing, confirming or clarifying Instructions, and providing information that is not within Patchstack’s possession or control. Customer shall respond to reasonable requests for cooperation under this section without undue delay.
12. Consent Notification. Customer will immediately notify Patchstack if any necessary appropriate consents and notices required to enable lawful transfer of Personal Data to Patchstack for the duration and purposes of this Agreement have been breached, terminated, withdrawn, or are otherwise no longer valid.
13. International Transfers. The parties agree that (a) the EU Standard Contractual Clauses apply if Personal Data from the EEA and/or Switzerland is transferred via the use of the Patchstack Solution in a country outside of the EEA or Switzerland, and such transfer is not to a third country that the applicable data protection authority considers to provide an adequate level of protection; (b) the UK Addendum applies if Personal Data from the UK is transferred via the Patchstack Solution in a country that is outside of the UK, and such transfer is not to a country that the UK Secretary of State considers to provide an adequate level of protection (such outbound transfers of Personal Data from the EU, Switzerland, or the UK, each an “EU/UK Outbound Transfer”). If no EU/UK Outbound Transfer occurs, the SCCs and this section 13 will not apply. As used in this section, the terms “Data Importer” and “Data Exporter” will have the meanings given to them in the Standard Contractual Clauses. The parties acknowledge that for the purposes of the Standard Contractual Clauses Patchstack is acting in the capacity of a Data Importer and Customer is the Data Exporter (notwithstanding that Customer may be located outside of the EEA, Switzerland, or the UK or is acting as a processor on behalf of third-party controllers). Each party will comply with the applicable obligations of the Standard Contractual Clauses in their respective roles as Data Exporter and Data Importer. The data subjects, categories of data, and processing operations (as required to be disclosed in the Standard Contractual Clauses) are as set forth in this DPA. Annex 1 to this DPA details the technical and security measures Patchstack has implemented, as required to be disclosed in the Standard Contractual Clauses.
14. SCC Governing Law. The parties further agree that for all EU/UK Outbound Transfers, the governing law of the Standard Contractual Clauses entered into by Patchstack and Customer will be: (a) the laws of Estonia, unless Customer is located in the UK; or (b) the laws of the UK, if Customer is located in the UK. If any inconsistency arises between this section 14 and any other provision for the governing law of the Standard Contractual Clauses entered into between Customer and Patchstack, this section 14 will take precedence.
15. Conflict with SCCs. To the extent required by applicable Data Protection Law, in the event of any conflict between this DPA and the EU Standard Contractual Clauses, the EU Standard Contractual Clauses will prevail, and in the event of any conflict between this DPA and the UK Addendum, the UK Addendum will prevail.
16. Audit Rights. Customer agrees that it shall exercise any audit rights under this DPA (including any audit rights granted by the Standard Contractual Clauses or Data Protection Law) in accordance with section 10.9 above.
17. Government Access. Patchstack represents and warrants that, as of the start date of Customer’s subscription, it has not received any order, request, or other communication from a governmental body for the disclosure of Personal Data and it shall:
17.1. if it receives such order, request, or other communication, attempt to redirect the governmental body to request that data directly from Customer. As part of this effort, Patchstack may provide Customer’s basic contact information to the relevant body. If compelled to disclose Personal Data to a governmental body, then Patchstack will give Customer reasonable notice of the demand to allow Customer to seek a protective order or other appropriate remedy unless Patchstack is legally prohibited from doing so;
17.2. provide information to Customer on request regarding: (a) the number of orders, requests, or other communications from governmental bodies for the disclosure of Personal Data and/or assistance in surveillance processes and the type of information requested, (b) its responses to the foregoing, and (c) its process for challenging such orders, requests, and communications; and
17.3. notify Customer if Patchstack becomes aware that its ability to maintain the confidentiality and security of Personal Data has been materially compromised for any reason.
18. Sub-processors. Customer agrees that Patchstack may use Sub-processors to fulfil its contractual obligations under this DPA or to provide certain services on its behalf, such as providing hosting and infrastructure services, and consents to the use of Sub-processors as described in this section. The Patchstack website (currently posted at https://patchstack.com/subprocessors/) lists Sub-processors that are currently engaged by Patchstack to deliver the Patchstack Solution. (Such webpage constitutes Annex III/Appendix 3 to the Standard Contractual Clauses if and as applicable.)
18.1. At least ten business days before Patchstack engages any new Sub-processor to carry out processing activities on Personal Data on behalf of Customer, Patchstack will endeavour to update the applicable website and provide Customer notice of that update as per the means specified for notices in the Agreement. The notice will identify the new Sub-processor, describe in reasonable detail the processing activities to be performed, and specify the country or countries in which the processing will take place.
18.2. Customer may object to a new Sub-processor by notifying Patchstack in writing within ten days of receiving Patchstack’s notice under section 18.1. An objection must set out in reasonable detail the specific data protection or information security grounds on which it is based (a “Qualifying Objection”). An objection constitutes a Qualifying Objection only if Customer demonstrates, on reasonable grounds, that the new Sub-processor’s technical and organisational measures for the protection of Personal Data are materially inferior to those maintained by the Sub-processor it is replacing, or, where the new Sub-processor is not replacing an existing Sub-processor, materially inferior to the measures described in Annex 1 to this DPA. For the avoidance of doubt, objections based on grounds unrelated to data protection or information security do not constitute Qualifying Objections.
18.3. If Customer does not notify Patchstack of an objection within the period specified in section 18.2, Customer will be deemed to have consented to the new Sub-processor’s appointment.
18.4. On receipt of a Qualifying Objection, the parties will engage in good faith discussions for a period of not more than 30 days (the “Resolution Period”) to resolve the objection. Patchstack will refrain from engaging the new Sub-processor for processing of Customer’s Personal Data during the Resolution Period. During the Resolution Period, Patchstack may: (a) appoint on an interim basis an alternative Sub-processor whose technical and organisational measures address the grounds of the objection; or (b) continue with the current Sub-processor, if any.
18.5. If the Qualifying Objection cannot be resolved through good faith discussions under section 18.4, and Patchstack reasonably determines that use of the new Sub-processor is reasonably necessary to provide the affected service, Patchstack may terminate the affected portion of the Patchstack Service, or if not practicable, the relevant subscription, on 30 days’ written notice without penalty as to the terminated affected service. Where Patchstack terminates the relevant subscription in its entirety under this section 18.5, Patchstack will refund any prepaid fees covering the remainder of the subscription term following the effective date of termination, provided all Patchstack fees accrued prior to termination have been paid.
19. DPA Revisions. Patchstack may propose revisions to this DPA by replacing it with any applicable controller-to-processor standard clauses or similar terms forming part of an approved code of conduct or applicable certification scheme (which will apply when replaced by attachment to this Agreement). Customer and Patchstack will negotiate such changes in good faith as soon as reasonably practicable.
20. SCC Updates. The parties agree that, if any new versions or revisions to the EU Standard Contractual Clauses are approved by the European Commission, or new versions or revisions of the UK Addendum are approved and published by the ICO, such that the implementation of the Standard Contractual Clauses in this DPA no longer applies or is no longer appropriate, the parties shall work together to enter into new standard contractual clauses as appropriate.
21. EU SCC Elections. Where the EU SCCs apply to transfers of Personal Data governed by this DPA, the following options are deemed to be selected and incorporated, each clause reference in this section being a reference to a clause in the EU SCCs: (a) Clause 7 (docking clause) will not apply; (b) at Clause 9 (use of sub-processors), Option 2 (general written authorisation) will apply for both Module 2 and Module 3; (c) at Clause 11 (redress), the optional redress mechanism will not apply; and (d) the competent supervisory authority under Clause 13 will be the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) for transfers subject to the EU GDPR.
22. Swiss FADP. Where the Swiss FADP applies to transfers of Personal Data governed by this DPA, the EU Standard Contractual Clauses will apply as modified by the following: (a) references to “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP; (b) references to specific articles of Regulation (EU) 2016/679 will be interpreted as references to the equivalent provisions of the Swiss FADP; (c) references to “EU”, “Union”, and “Member State” will not be interpreted in a way that excludes data subjects in Switzerland from exercising their rights in their place of habitual residence; (d) references to the “competent supervisory authority” will be interpreted as references to the Federal Data Protection and Information Commissioner; (e) references to “Member State” law will be interpreted as including Swiss law; and (f) the EU Standard Contractual Clauses will be governed by Swiss law and disputes will be resolved before the competent Swiss courts.
23. CCPA. This section 23 applies to the extent that Patchstack processes Personal Data that is subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”) (“California Personal Data”). For the purposes of the CCPA, Patchstack is a “Service Provider” as defined in California Civil Code section 1798.140(ag). In its capacity as Service Provider, Patchstack:
23.1. shall process California Personal Data solely for the specific business purpose of providing the Patchstack Solution to Customer as described in the Agreement, or as otherwise permitted by the CCPA;
23.2. shall not sell or share (as those terms are defined by the CCPA) California Personal Data;
23.3. shall not retain, use, or disclose California Personal Data for any purpose other than the business purpose specified in the Agreement, including any commercial purpose other than providing the Patchstack Solution, except as permitted by the CCPA;
23.4. shall not combine California Personal Data received from or on behalf of Customer with personal information received from any other person or collected from Patchstack’s own interaction with data subjects, except as permitted by the CCPA;
23.5. shall provide reasonable assistance to Customer (at Customer’s expense) in responding to verifiable consumer requests under the CCPA, to the extent that such requests relate to Personal Data processed by Patchstack;
23.6. shall notify Customer if Patchstack makes a determination that it can no longer meet its obligations under the CCPA;
23.7. shall permit Customer to take reasonable and appropriate steps to help ensure that Patchstack uses California Personal Data in a manner consistent with Customer’s obligations under the CCPA, provided that such steps do not require Patchstack to disclose its confidential information or trade secrets; and
23.8. hereby certifies that it understands and will comply with the restrictions and obligations set out in this section 23.
24. UK Addendum. Where the UK Addendum applies to transfers of Personal Data governed by this DPA, the parties agree that:
24.1. the UK Addendum will be populated by reference to this DPA and its Annexes and that any changes in formatting (including for the avoidance of doubt with respect to Part 1: Tables) will not adversely affect the validity of the DPA or the compliance with Data Protection Law of any international transfers of Personal Data made thereunder;
24.2. any formatting changes do not reduce the standard of Appropriate Safeguards (as defined in the UK Addendum) provided; and
24.3. neither party shall be entitled to end the UK Addendum pursuant to Section 19 except where a revision under Section 18 materially reduces the Appropriate Safeguards.
25. Liability. Liability arising out of or relating to this DPA (whether in contract, tort, or otherwise) is subject to the limitations and exclusions of liability set out in the Agreement.
26. Governing Law. This DPA is governed by and construed in accordance with the governing law and jurisdiction provisions of the Agreement, except to the extent that a different governing law is mandated by the SCCs or by applicable Data Protection Law.
27. Conflicts. In the event of any conflict between this DPA and the Agreement, this DPA will prevail with respect to matters of data protection. In the event of any conflict between this DPA and the SCCs, the SCCs will prevail to the extent required by Data Protection Law.
28. Severability. If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions will continue and remain in full force and effect.
29. Updates. Patchstack may update this DPA from time to time to reflect changes in law, regulatory guidance, or its practices. Notice of material changes will be provided in accordance with the Agreement, such changes to take effect upon the next renewal of Customer’s subscription. Customer’s renewal of its subscription indicates Customer’s acceptance of and agreement to the modified DPA.
30. Assignment. This DPA will be binding upon and inure to the benefit of the parties and their respective successors and permitted assigns. Patchstack may assign or transfer this DPA in connection with any assignment of the Agreement permitted under the Agreement, without requiring Customer’s separate consent. Customer agrees that any such assignment or transfer includes the transfer of all rights, obligations, and associated data (including Personal Data) to the extent necessary to ensure continuity of service under this Agreement. Any assignee or successor will be bound by the obligations of this DPA to the same extent as Patchstack. For the avoidance of doubt, following any such assignment, references to “Patchstack” in this DPA will be read as references to the assignee or successor entity, and the Instructions will continue in effect.
DPA ANNEX 1: TECHNICAL AND ORGANISATIONAL SECURITY MEASURES
(Annex II to the EU Standard Contractual Clauses and/or Appendix Information for the UK Addendum, as applicable.)
In this Annex, “Processor” refers to Patchstack and “Controller” refers to Customer (or, where Customer acts as a processor, to the controller on whose behalf Customer engages Patchstack). The Processor implements and maintains the following technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, or damage, in accordance with Article 32 of the GDPR.
As of 2026, the Processor holds SOC 2 Type II and ISO 27001 certifications. The Processor will provide copies of current certification documents or audit summaries to the Controller on request, subject to the confidentiality obligations in the Agreement.
1. Encryption
In transit. All Personal Data transmitted over public networks is encrypted using TLS 1.2 or higher. The Processor’s HTTPS implementation uses industry-standard algorithms and certificates. Unencrypted connections (plain HTTP) are not accepted for any interface that processes Personal Data.
At rest. Personal Data stored in the Processor’s production environment is encrypted at rest using AES-256 or equivalent encryption. Encryption keys are managed through the cloud hosting provider’s key management service or an equivalent solution that enforces key rotation and access controls.
2. Access Control
Authentication. The Processor enforces a password policy for all user-facing interfaces that requires a minimum length, complexity, and expiry cadence consistent with current industry guidance. Multi-factor authentication is required for: (a) all Processor personnel accessing production systems or infrastructure that stores Personal Data; and (b) all administrative or privileged accounts.
Authorisation and least privilege. Access to Personal Data is granted on a need-to-know basis. The Processor maintains role-based access controls that limit each user and system to the minimum privileges required to perform their function. Access rights are reviewed periodically and revoked promptly upon change of role or termination of employment.
Customer data segregation. Customer data is stored in multi-tenant systems that enforce logical separation between customers. The Processor’s application layer validates each request against the authenticated customer’s permissions before returning data. Customers are not permitted direct access to the underlying infrastructure.
API access. Public APIs are secured using API keys, OAuth tokens, or equivalent credential mechanisms. API credentials are unique per customer account.
3. Personnel Security
Confidentiality obligations. All Processor personnel who have access to Personal Data are bound by written confidentiality obligations, whether through employment contracts, non-disclosure agreements, or equivalent binding instruments.
Training. The Processor provides data protection and information security awareness training to personnel with access to Personal Data, at onboarding and periodically thereafter.
Background verification. The Processor conducts background verification on personnel with access to production systems to the extent permitted by applicable law.
4. Network and Infrastructure Security
Cloud infrastructure. The Processor hosts its production environment with a cloud infrastructure provider whose physical and environmental security controls are independently audited (e.g., SOC 2 Type II, ISO 27001, or equivalent). The Processor will identify the hosting provider and data centre region on request.
Network controls. Network access control mechanisms are designed to prevent unauthorised traffic from reaching the production environment. Technical measures include virtual private cloud segmentation, security groups, and firewall rules. Administrative access to production infrastructure is restricted to authorised personnel via secure, audited channels.
Intrusion detection. The Processor maintains monitoring capabilities designed to detect unauthorised access attempts and anomalous activity on systems that process Personal Data.
5. Vulnerability Management
Patching. The Processor maintains a vulnerability management programme that includes timely application of security patches to operating systems, libraries, and application dependencies. Critical and high-severity vulnerabilities are remediated within timeframes consistent with industry practice.
Code review. Security reviews of application code are performed, which may include static analysis, peer review, or automated scanning, to identify and remediate software vulnerabilities before deployment to production.
Penetration testing. The Processor conducts or commissions independent penetration testing of its production environment at least annually. Identified vulnerabilities are triaged and remediated according to severity.
6. Logging and Monitoring
The Processor’s infrastructure logs authentication events, administrative actions, and access to systems that store Personal Data. Logs are retained for a period sufficient to support incident investigation and are protected against tampering. Automated alerting is configured to notify appropriate personnel of security-relevant events.
7. Incident Response
The Processor maintains a documented incident response process that includes identification, containment, eradication, recovery, and post-incident review. The process designates responsible personnel and defines escalation procedures. The notification obligations in the DPA govern the Processor’s communication with the Controller in the event of a Personal Data breach.
8. Availability and Resilience
Redundancy. The Processor’s production architecture is designed for redundancy, including deployment across multiple availability zones where supported by the hosting provider.
Backups. Production data is backed up regularly. Backups are encrypted and stored in a location that is logically or physically separate from the primary production environment. The Processor tests backup restoration periodically.
Disaster recovery. The Processor maintains a disaster recovery capability designed to restore the availability of and access to Personal Data in a timely manner following a physical or technical incident. Recovery objectives are commensurate with the nature of the service.
9. Secure Deletion
On termination of the Agreement or at the Controller’s written request, the Processor deletes Personal Data from production systems and, within a reasonable period, from backups and replicas, unless retention is required by applicable law. Deletion is performed using methods designed to render the data unrecoverable.
10. Audit and Compliance Verification
The Processor makes available to the Controller, on request and subject to the confidentiality obligations in the Agreement, information reasonably necessary to demonstrate compliance with the measures described in this Annex. The provisions of the DPA govern all audit and inspection rights.
EXHIBIT B: SUPPORT AND SERVICE LEVEL POLICY ADDENDUM
This Support and Service Level Policy Addendum (“SLA”) forms part of the Master Solution Agreement (“MSA”) between Patchstack and Customer for the use of Patchstack-operated services.
1. Scope of Coverage
This SLA applies exclusively to the following Patchstack-operated services (collectively, the “Covered Services”):
- Patchstack SaaS Platform (including dashboard, API, and plugin integration endpoints)
- Threat Intelligence Database (including rules delivery and signature update services)
While the Covered Services may operate on AWS infrastructure, this SLA governs only Patchstack’s own service availability, not that of AWS or any other third-party provider.
2. Uptime Measurement
Measurement Period: Monthly, on a calendar basis.
Definition of Downtime. Downtime is defined as either:
- A complete service outage lasting five (5) minutes or longer affecting any public-facing endpoint or API, or
- Degraded performance resulting in full feature unavailability (e.g., rule updates not syncing or the dashboard being unresponsive).
Exclusions. Downtime shall not include:
- Scheduled maintenance announced at least twenty-four (24) hours in advance.
- Routine deployments, software upgrades, or internal infrastructure tasks.
- External events outside Patchstack’s control, including but not limited to: upstream provider or third-party service failures; Distributed Denial of Service (DDoS) attacks; force majeure events (natural disasters, war, governmental actions, etc.).
- Customer-side issues, including but not limited to: misconfigurations or integration errors; local network, hardware, or connectivity issues.
Verification of Uptime. At the Customer’s written request, Patchstack will:
- Share relevant monitoring logs pertaining to the incident period.
- Permit third-party verification of uptime calculations.
3. SLA Tiers and Service Credit Policy
| Monthly Uptime Percentage | Service Credit |
|---|---|
| ≥ 99.95% | None |
| < 99.95% and ≥ 99.0% | 10% |
| < 99.0% and ≥ 95.0% | 25% |
| < 95.0% | 100% |
- Only one tier of credit applies per calendar month.
- Credits will be applied to the next billing cycle.
- Credits are only available to Customers directly affected by the outage.
4. Credit Claims Procedure
To request a service credit, the Customer must:
- Submit a written claim to Patchstack Support within thirty (30) calendar days of the end of the month in which the downtime occurred.
- Include the following details:
- Affected account or organization name.
- Affected service (e.g., SaaS Platform or Threat Intelligence Database).
- Exact date and time of the disruption.
- Description of the impact experienced.
- Supporting evidence such as logs or timestamps, if available.
Claim Review Process. Patchstack will review and assess the claim using internal monitoring systems. A written response will be provided within ten (10) business days of receipt. If approved, credits will be applied as follows:
- For subscription-based services: applied as a billing offset on the next invoice.
- For usage-based fees: applied as a cash offset or, if no invoice is due, refunded within thirty (30) days of credit approval.
5. Limitations and Exclusions
- This SLA and its remedies represent the Customer’s sole and exclusive remedy for any service unavailability or performance issues.
- Service credits cannot be exchanged for cash except as stated in Section 4.
- Credits do not accumulate or transfer between months or accounts.