# Aevyra Customer Agreement

Version 2026-10-13.1 — prepared October 13, 2026  

This Agreement governs business use of Aevyra's hosted service and authorized self-hosted deployments. It provides a limited right to use the purchased offering while preserving the respective rights of Provider, Customer and third-party licensors. The effective date is the date of valid acceptance, not the preparation date above.

## 1 Parties and acceptance

The provider is **David W Pershall, doing business as TipTopTechknowlogy** (Provider). Customer is the business or organization identified in the accepted Order. An Order is a mutually signed order form or a checkout record that identifies Customer, the purchased offering, price, term, allowances and the specific terms presented for express acceptance. Customer's representative represents that they have authority to bind Customer.

Customer accepts through a signed Order incorporating these terms or an affirmative electronic action expressly agreeing to the identified version before purchase or licensed use. Merely visiting a website, viewing a footer, receiving Software or obtaining a report is not stipulated to constitute acceptance. A user acting without organizational authority may not purchase organizational access under this Agreement.

This offering is intended for business and organizational use. Applicable nonwaivable rights remain effective regardless of that intended audience. Provider will not use this Agreement to avoid rights that apply to a particular transaction by law.

## 2 Documents and priority

This Agreement incorporates the Aevyra Proprietary Software License identified in the Order. The accepted Order records commercial scope. An applicable signed data processing addendum governs its data-processing subject matter. A signed source-access, MSP, reseller or other addendum governs only the expressly granted special rights.

A mutually signed amendment expressly identifying a provision controls that provision. Otherwise this Agreement and the Proprietary Software License govern, with the license controlling proprietary Software use and this Agreement controlling commercial and service matters. An Order changes a legal restriction only when it expressly identifies the change and is signed by Provider, rather than merely entered as a customer purchasing note. A customer purchase order or portal entry cannot add terms or assign IP by itself. Documentation explains operation; it does not expand the license or override signed terms.

## 3 Definitions

**Offering** means the hosted service, self-hosted Software, Collector and support specifically purchased in the Order. **Software** means Provider's delivered proprietary application, components, updates and documentation; third-party components retain their separate licenses. **Authorized users** are Customer personnel and approved contractors acting for Customer within its entitlement. **Customer Data** means information Customer supplies or authorizes the Offering to collect, including evidence and organization-specific facts. **Reports** are completed assessment outputs generated for Customer. **Provider Material** means Software, preexisting report templates, nonpublic assessment implementation, and other material owned or licensed by Provider, excluding Customer Data and Customer's independent work.

## 4 Permitted use

Provider grants the limited rights stated in the Proprietary Software License for the term and scope in the Order. Customer may assess systems, accounts and domains it owns or is authorized to inspect, using documented functions and approved connections. Affiliates are included only when named in the Order. Customer's contractors may administer Customer's deployment under protective written duties, but receive no independent license to serve other organizations.

The standard grant is for Customer's internal estate. Commercial assessments for clients, MSP operations, resale, service-bureau use, OEM integration and white labeling require a signed addendum with client scope, tenant separation, downstream duties and commercial terms. Merely buying a higher allowance does not grant those rights.

A self-hosted Order must state authorized production installations, staging/development rights and recovery rights. Source access or source escrow is not included by default. Customer may create external integrations and deployment automation using documented interfaces without acquiring or copying protected implementation.

## 5 IP ownership and prohibited uses

Provider and its licensors retain their respective rights in Provider Material. No sale, assignment, exclusivity, source ownership or general derivative-work right is granted. Third-party rights and nonwaivable legal exceptions remain applicable.

Customer must comply with the Proprietary Software License, including its restrictions on unauthorized redistribution, modification, reverse engineering, systematic implementation extraction, account sharing, bypassing entitlements, and misuse of confidential material. Customer may not use Provider Material or confidential implementation to construct a substitute assessment engine, train or distill one, or offer an unauthorized competing implementation. This is a restriction on misuse of protected material, not a general prohibition on independent development or lawful competition.

Customer may not put proprietary Software, source or Provider confidential information into an external AI or code-analysis service without written permission and agreed protective terms. This does not prevent otherwise lawful use of Customer's own facts or data. Public documentation, lawfully public information and independently developed material are not designated trade secrets solely by this Agreement.

Copyright, license and confidentiality notices must remain on Software and complete copies of reports and documentation. Neither party may imply endorsement, publish the other's confidential information or use the other's marks beyond the permission granted. Provider will not identify Customer as a reference or use its logo without written consent. No customer-name publicity right is implied by buying the Offering.

## 6 Customer Data and Reports

Customer retains all rights it has in Customer Data and its independent materials. Customer grants Provider a limited, nonexclusive right to process Customer Data only to supply the purchased Offering, carry out Customer's instructions, maintain its security and resolve support issues, or as otherwise required by law or expressly agreed. Provider may authorize necessary service providers under appropriate protective obligations. This is not a sale of Customer Data or a perpetual content license.

Provider will not sell Customer Data, use it to train a general-purpose AI model, or use identifiable evidence for unrelated marketing without a separate express agreement. Any use of content-derived cross-customer benchmarks or model training requires separately documented permission. Basic operational measurements that do not include evidence contents or reasonably identify Customer may be used to maintain the service, subject to applicable privacy duties.

Customer has a perpetual, nonexclusive, worldwide right to use, retain, reproduce and share its completed Reports for legitimate business purposes, including remediation, audit, insurance, procurement and regulatory disclosure. Customer may share them with advisers, auditors, insurers, regulators and its own customers. Customer may write summaries and quote findings; modifications must not be misrepresented as original Aevyra conclusions. Full copies must retain ownership notices. Report recipients acquire no license to Software or the assessment engine. This report permission survives termination and does not authorize selling Aevyra services or extracting templates for a substitute product.

## 7 Confidentiality

Each party receiving the other's nonpublic information that is marked confidential or reasonably understood to be confidential will use it only to perform or exercise rights under this Agreement, protect it using reasonable measures no less protective than those applied to comparable information of its own, and disclose it only to personnel or advisers with a need to know and appropriate confidentiality duties. Customer Data and nonpublic proprietary source, assessment implementation, security details and negotiated commercial terms are included where they meet that definition. Published customer guides and public demonstration results are not confidential merely because they concern Aevyra.

The receiving party is responsible for its authorized recipients. It must promptly notify the disclosing party after discovering unauthorized use or disclosure and reasonably cooperate in containment. No clause permits exploitation of confidential information retained in unaided memory. This does not restrict ordinary general skills and knowledge that do not disclose or use protected confidential information.

Confidential information excludes information the recipient can demonstrate was lawfully known without a duty before disclosure, lawfully received from an independent source without a duty, independently developed without use of confidential information, or made public without a breach. If compelled to disclose, the recipient will give advance notice where legally permitted, disclose only what is required and reasonably cooperate with protective measures at the discloser's expense.

These obligations continue for five years after the applicable disclosure; qualifying trade secrets remain protected for as long as they qualify under applicable law. Return/deletion requirements are subject to legally required retention and protected inaccessible backup copies. Retained material remains protected.

Nothing prohibits protected reporting to authorities, communication with an attorney or other legally protected disclosures. Consistent with 18 U.S.C. § 1833(b), an individual may disclose a trade secret in confidence to a federal, state or local government official or an attorney solely to report or investigate a suspected legal violation, or in a complaint or other document filed under seal. In an employer-retaliation action, qualifying disclosures to an attorney and use in court are permitted when filed under seal and not otherwise disclosed except by court order. This provision is not permission for unlawful access or unrelated publication.

## 8 Third-party software and existing grants

Provider Material may include or depend on third-party software. Applicable third-party license terms and required notices govern those components. This Agreement does not narrow an open-source license, excuse compliance with a source-offer obligation, or represent that all delivered code is owned solely by Provider. Provider will supply required notices with its distributions.

Neither this Agreement nor a replacement license retroactively revokes rights lawfully granted under an earlier agreement or applicable third-party license. Different terms for new releases or future periods require valid acceptance and respect continuing prior grants. Customer's independently owned materials are not reassigned by this Agreement.

## 9 Authorized changes and feedback

Customer may configure the Offering as documented. Modification of proprietary Software, access beyond operational diagnosis, source builds and source disclosure require a signed Source Access Addendum or statement of work. That document must specify permitted files, recipients, changes, support effects and ownership before work begins.

Unless a separate signed agreement provides otherwise, Provider retains its existing IP and work it creates independently; Customer retains its existing IP and independent materials. Commissioning work or paying a fee does not by itself create a work-made-for-hire or an assignment from Provider. Any assignment must be express and signed.

Customer may voluntarily submit feedback that it has the right to provide. For nonconfidential feedback only, Customer grants Provider a nonexclusive, perpetual, royalty-free right to implement and use the suggestion to improve its products. This does not license Customer Data, Customer confidential information, patented technology or unrelated customer software. The license is not an obligation to disclose feedback or an assignment of every idea Customer develops.

## 10 Customer responsibilities

Customer will maintain lawful authorization for its selected collection scope, required provider permissions, appropriate notices and consents, and accurate account and billing information. It will restrict user access, protect credentials, comply with law and third-party service terms, and promptly report suspected misuse. Customer may not submit malware, unlawfully obtained evidence, or material it lacks the rights to provide.

Customer is responsible for reviewing scope, collection failures, unknowns and evidence age, and for human review of findings and remediation. Self-hosted administrators also maintain their infrastructure, backups, certificates, secret management, supported dependencies and service configuration. Provider does not receive permission to enter Customer's systems merely because Customer licenses Software. Remote support requires separate customer authorization and agreed scope.

## 11 Security and personal data

Provider will use reasonable administrative, technical and organizational measures appropriate to the hosted Customer Data it processes and will bind necessary personnel and subprocessors to protective obligations. Provider will notify Customer without undue delay after confirming unauthorized access to hosted Customer Data, provide available information reasonably needed for response, and cooperate in mitigation subject to legal and investigative restrictions. Applicable law and a signed data processing addendum may impose more specific duties.

Customer should use approved workflows and avoid supplying private key material or unnecessary personal or regulated data. This Agreement alone does not authorize processing of protected health information or establish a business associate agreement. Cross-border, regulated or processor/controller arrangements requiring additional terms must be addressed before such processing begins.

An applicable privacy notice describes processing of account and website personal information. A data processing addendum, retention schedule, subprocessor list and relevant data-transfer terms must be established where required. This Agreement does not substitute for those documents. For self-hosted use, responsibility for Provider-accessed support data must be documented; Customer ordinarily operates its own storage and security boundary.

## 12 Term, fees and renewal

The term, plan, allowed systems and runs, price, payment schedule and deployment rights are recorded in the accepted Order or checkout record. Fees are due as stated there; invoice terms require a signed Order. Applicable taxes other than taxes on Provider's income are Customer's responsibility unless a valid exemption applies. No extra charge or purchased upgrade is authorized solely by exceeding an allowance; collection may be limited pending an expressly accepted purchase.

**A monthly hosted subscription renews for successive one-month periods only if that automatic renewal and recurring price were conspicuously disclosed and expressly accepted before billing. Customer may cancel future renewals at any time before the next renewal using Manage billing where available or the billing contact stated in its Order. Cancellation takes effect at the end of the paid period, and Provider must acknowledge it.** Provider will not obstruct cancellation if portal access is unavailable. The Order or checkout record must identify the next charge or applicable frequency and cancellation method.

A self-hosted, annual or negotiated Order does not automatically renew unless it expressly states the renewal arrangement and Provider complies with applicable notice and consent requirements. Trial-to-paid conversion also requires an expressly accepted price, conversion date and cancellation method. An evaluation does not silently become paid.

Provider must disclose a price change at least thirty days before it would apply, or earlier where required by law. A price increase requires Customer's affirmative acceptance; without acceptance the affected subscription ends at the current paid term rather than renewing at an unaccepted price. A signed negotiated Order may adopt another lawful process expressly.

Prepaid fees are not refunded for Customer's convenience cancellation, except as required by law or expressly provided here or in the Order. Refunds for Provider's breach, discontinued service or covered IP claims are addressed below. No chargeback prohibition overrides lawful billing-dispute rights. Customer may notify Provider of a good-faith invoice dispute; the parties will investigate and Customer will pay undisputed amounts.

## 13 Service, support and limited warranty

Provider will supply the purchased Offering and support expressly included in the Order. No particular uptime commitment, round-the-clock support, implementation service or certification is promised unless included in a signed service level or support schedule. Reasonable updates may be provided; Provider will not materially reduce purchased core functionality during a prepaid term without an equivalent remedy or a proportionate refund for the affected unused period.

Provider warrants that paid Software and service will materially conform to the applicable supplied documentation during the subscription term when operated in a supported, authorized configuration. Customer must report a claimed material nonconformity within thirty days after discovery, with reasonable diagnostic information. Provider will use reasonable efforts to correct or supply a workaround. If it cannot resolve a material nonconformity within thirty days after notice, Customer may terminate the affected Offering and receive a refund of unused prepaid fees for that Offering. This remedy does not remove nonwaivable rights or the remedies for breaches outside this limited warranty.

Aevyra supplies assessment and governance decision support. It does not guarantee detection of every weakness, prevent attacks, certify regulatory compliance, or automatically enforce all recommended controls. Scores apply to supported observed evidence; unknown checks and incomplete coverage affect interpretation. Demonstrations use synthetic evidence. Customer remains responsible for business, security and legal decisions.

Except for the express warranties and to the maximum lawful extent, the Offering is supplied without additional implied warranties, including merchantability, fitness for a particular purpose and uninterrupted or error-free operation. Evaluation and demonstration access is supplied as available without the paid conformity warranty. No disclaimer negates the express security, confidentiality or data-processing obligations above.

## 14 Suspension and termination

Provider may limit access when reasonably necessary to address an immediate security threat, unlawful use, active IP misuse or a material entitlement violation. It will narrow the action where practicable, give prompt notice unless legally prohibited, and restore access when the cause is resolved. For ordinary undisputed nonpayment, Provider will give at least ten days' notice and an opportunity to pay before suspension. Good-faith billing disputes do not justify suspension solely for the disputed portion.

Either party may terminate for a material breach not cured within thirty days after written notice. An ongoing deliberate disclosure or misuse of proprietary IP, or a breach incapable of cure, may justify immediate termination to the lawful extent. Provider may terminate an affected Offering on thirty days' notice if it permanently discontinues it, refunding the unused prepaid amount. If Customer terminates for Provider's uncured material breach, Provider refunds unused prepaid fees for the affected Offering. Customer may stop renewal or elect not to renew as specified in Section 12.

At expiration or termination, Software use rights end. Customer must stop running proprietary Software and remove its operational copies as the license requires. Customer may retain its data and completed Reports, and may retain limited archival material where required by law or inaccessible within routine protected backups; retained proprietary material may not be used operationally.

For hosted use, Customer may request export of its available Customer Data and Reports during the paid term and within thirty days after termination. Provider will use reasonable efforts to supply the supported export without requiring purchase of a new subscription, subject to lawful restrictions and verification of the requester. After that period, Provider may delete active service copies subject to legal holds and the applicable retention schedule; protected backups follow their documented cycle. This is a contractual export commitment and need not imply a particular automated export button. Self-hosted Customer already controls its storage and is responsible for preserving exports.

Termination does not transfer IP or cancel accrued lawful fees. Ownership, use restrictions, confidentiality, retained-report rights, liability, dispute provisions and other terms intended to continue survive as appropriate. Provider is not authorized to delete Customer evidence or install undisclosed destructive enforcement merely to end an entitlement.

## 15 IP claims and indemnification

For a third-party claim that authorized, unmodified Provider Software, as supplied and used within scope in the United States, infringes that party's U.S. copyright or misappropriates its trade secret, Provider will defend Customer and pay covered damages finally awarded or amounts agreed in a settlement Provider approves, subject to Section 16. Customer must promptly notify Provider, reasonably cooperate at Provider's expense, and allow Provider to control the defense. Provider may not settle in a way that requires Customer to admit fault or incur a nonmonetary obligation without Customer's consent.

This undertaking excludes claims caused by Customer Data, unauthorized modifications or use, combinations not supplied or required by Provider where the claim would not otherwise arise, or continued use after Provider supplies a materially equivalent noninfringing alternative and reasonable transition instructions. Provider may obtain rights, modify or replace the affected Software without materially reducing purchased functionality, or terminate the affected Offering and refund unused prepaid fees. This clause does not create patent, trademark or foreign-jurisdiction indemnity unless a signed Order adds it.

Customer will defend Provider against a third-party claim arising from Customer Data unlawfully supplied, Customer's unauthorized collection of third-party evidence, or Customer's unauthorized resale or distribution, and pay damages finally awarded or approved settlement amounts attributable to that conduct, subject to Section 16. The same notice, cooperation, defense control and settlement protections apply reciprocally. No indemnity covers the indemnitee's own wrongful conduct. These duties do not remove direct remedies for misuse of Provider IP or a separate confidentiality breach.

## 16 Liability allocation

To the maximum lawful extent, neither party is liable for indirect, consequential, special or punitive damages or lost profits arising under this Agreement. This exclusion does not excuse payment of covered third-party claims under Section 15 or bar reasonable direct costs of restoring or retrieving data following a breach, subject to the applicable cap.

Except for the exceptions below, each party's aggregate monetary liability arising from the Agreement is limited to the greater of **US$1,000** or the fees paid or payable for the affected Offering during the twelve months preceding the event first giving rise to the claim. For an evaluation with no paid Order, the corresponding cap is **US$100**.

For a party's breach of its confidentiality or express data-protection obligations, the cap is the greater of **US$2,000** or twice those twelve-month fees. The IP defense undertaking in Section 15 is within the ordinary cap unless a signed Order specifies a different amount. Claims may not be stacked to multiply applicable aggregate caps.

The caps and damages exclusion do not limit Customer's lawful obligation to pay purchased fees, Customer's infringement or misappropriation of Provider IP or deliberate unauthorized redistribution, either party's fraud, willful misconduct or gross negligence, or liability that cannot lawfully be limited. Trade-secret misuse falls within the IP exception, rather than becoming capped merely because it also breaches confidentiality. These exceptions preserve legally available remedies; they do not make every allegation an established violation.

A party may seek appropriate equitable relief for threatened or actual misuse of IP or confidential information. A court determines whether relief, security or other conditions are justified; this Agreement does not automatically entitle a party to an injunction, statutory damages or an award of attorneys' fees. Attorneys' fees are recoverable only where applicable law or a separately agreed enforceable provision permits them.

## 17 License verification and records

Customer will keep reasonable records of licensed installations, approved users and authorized scope. At most once in a twelve-month period, on at least fifteen business days' notice, Provider may request a written compliance certification. If specific reasonable evidence of a material violation remains unresolved, an independent auditor bound to confidentiality may review relevant license records during normal business hours, narrowly limited to compliance. Provider pays the audit unless a material excess use is established and a signed Order provides for Customer to bear reasonable verified audit costs.

An audit grants no unrestricted network access, review of unrelated Customer Data or authority to inspect competitors' confidential information. Required metering, network contact or technical activation for a self-hosted deployment must be disclosed in the Order. No hidden telemetry is authorized. Customer must promptly correct established excess use through an agreed entitlement or by reducing usage; no automatic penalty or surprise invoice is created by an audit.

## 18 Assignment and continuity

Customer may not assign or sublicense its grant without Provider's written consent, which will not be unreasonably withheld for a bona fide merger or sale of substantially all of Customer's relevant business to a successor that assumes this Agreement and can meet its confidentiality and scope duties. An assignment to a competing software provider or a materially expanded estate may require a separately negotiated agreement. No assignment changes purchased scope by itself.

Provider may assign this Agreement in a bona fide incorporation, reorganization or business transfer only to a successor that assumes the relevant obligations, has the rights needed to supply the Offering, and gives Customer notice. An assignment is not permission to repurpose Customer Data. A future company acquires Provider's IP only through an actual transfer or license; this clause does not itself execute that transfer. Source escrow or business-continuity rights require a separate signed agreement stating specific release events and continuing use restrictions.

## 19 Notices and changes

Provider's business and legal-notice email is **david@tiptoptechknowlogy.com**. Customer's notice and billing contacts are identified in its Order or verified account record. The operative Order must confirm Provider's contact and any physical address required for a particular legal notice. Operational notices may also appear in the application, but notices of legal breach, termination or material term changes must be sent to the designated contact in a retainable form. Notice is effective on confirmed delivery; where a law prescribes another method or timing, that requirement controls. A sender receiving a failure notice must use another agreed lawful method.

Changes to this Agreement or the license do not apply retroactively or solely because a page is edited. Provider must identify the new version, notify Customer and obtain affirmative acceptance for a future term or a mutually signed amendment. A customer that does not accept may use its existing accepted terms through its current paid term and decline renewal. Emergency operational security measures do not by themselves rewrite ownership, prices or license rights.

## 20 Governing law and general terms

New York law governs, excluding conflict rules to the lawful extent. Subject to nonwaivable jurisdiction rights, the parties consent to courts with jurisdiction in Onondaga County, New York, or the United States District Court for the Northern District of New York. Either party may seek necessary interim relief in another court with proper jurisdiction. This Agreement does not impose mandatory arbitration or a class-action waiver.

The parties are independent contractors. Neither is the other's agent or partner. Failure to enforce a term is not a continuing waiver. If a provision is unenforceable, the lawful remainder continues; a court may narrow a restriction only to the extent the law permits rather than creating a new bargain. Neither party is liable for delay caused by events outside its reasonable control if it mitigates and gives notice; that excuse does not transfer IP, excuse accrued payment or waive confidentiality and data-protection duties that remain feasible.

This Agreement, the accepted license, Order and applicable signed addenda form the parties' agreement concerning the Offering. Electronic signatures and counterparts may be used. The accepting representative must be shown and be able to retain the exact applicable terms. No term claims rights beyond those available under applicable law.