AEVYRA PROPRIETARY SOFTWARE LICENSE Version 2026-10-13.1 — prepared October 13, 2026 Copyright © 2026 David W Pershall, doing business as TipTopTechknowlogy. All rights reserved in Provider-owned material to the extent provided by law. Third-party material remains subject to its own applicable licenses. 1. PARTIES AND SCOPE David W Pershall, doing business as TipTopTechknowlogy (Provider), licenses Provider's proprietary Aevyra software, Collector components, updates and accompanying documentation (Software) to the organization identified in an accepted order or account subscription (Customer). Software is licensed, not sold. This is a proprietary license, not an open-source license. This license applies when incorporated into a Customer Agreement and accepted order, or separately presented and expressly accepted before delivery or use. Possession, public download, a footer link, or this notice alone does not establish acceptance or grant a commercial license. A signed amendment may expressly vary a specific provision. The Customer Agreement governs fees, service obligations, liability, disputes and termination procedures. 2. LIMITED GRANT During Customer's paid or expressly authorized evaluation term, and subject to the accepted order and this license, Provider grants a nonexclusive, nontransferable and nonsublicensable right to use Software solely for the internal security assessment and governance of Customer's authorized estate. No right is granted by implication, estoppel or the provision of credentials. Hosted access permits authorized users to access the enabled service and its documented functions. It does not grant access to server-side source, build systems, assessment policies or private operating environments. A self-hosted order additionally permits installation and operation of the delivered release on the sites, production instances and environments identified in that order. Customer may make the minimum copies needed for those installations and protected backup or recovery, retaining notices. Development, staging, disaster recovery, affiliates and additional production instances require the coverage stated in the order; an omitted category is not an unlimited entitlement. Employees and contractors may use Software on Customer's behalf within its entitlement and under confidentiality and use obligations at least as protective as this license. Customer is responsible for their compliance. A contractor administering Customer's deployment receives no independent resale or service-bureau entitlement. 3. RESTRICTIONS Except as expressly authorized in an accepted signed addendum, Customer may not, and may not authorize or facilitate another person to: (a) distribute, publish, upload to a public repository, sell, rent, lease, lend, sublicense or otherwise provide Software, proprietary source, installers, container images, license credentials or private technical documentation to another organization; (b) operate Software for third-party customers, offer it as a managed service, service bureau, OEM product or white-label service, or resell access; (c) copy, adapt, translate, modify or create derivative works of proprietary Software beyond installation/configuration permitted by documentation; (d) reverse engineer, decompile, disassemble or attempt to recover proprietary source, confidential scoring policies, weights, rule sets or other nonpublic implementation information; (e) systematically query, scrape or extract service responses to reconstruct confidential implementation, or use Software or Provider confidential information to build, train, tune, distill or validate a substitute assessment engine or competing implementation; (f) submit proprietary Software, source or Provider confidential information to an external AI, code-generation or analysis service without Provider's written consent and protective terms approved for that disclosure; (g) remove or obscure ownership, attribution, confidentiality, license or integrity notices, circumvent entitlement or access controls, share accounts outside approved users, or exceed purchased limits; (h) represent Software as Customer's own product, or use Aevyra branding beyond identifying authorized use and the origin of genuine reports. These restrictions apply only to rights Provider can lawfully restrict. They do not override nonwaivable statutory rights, applicable third-party licenses, public-domain material, or independently developed work created without using protected Software or Provider confidential information. Where the law permits an activity notwithstanding a contractual restriction, Customer may exercise that right within its legal scope. A request to Provider for interoperability information is encouraged but is not a condition on an otherwise nonwaivable legal right. Nothing prohibits protected reporting to regulators, lawful testimony or legally protected security activity. 4. SOURCE ACCESS AND MODIFICATIONS Delivery of an executable, a Python file, a script or other readable code does not convey ownership or general development rights. Delivered proprietary source may be accessed only by authorized administrators as reasonably necessary for permitted installation, diagnosis and operation. Modification, source disclosure, independent builds and broader development require a separately signed Source Access Addendum specifying the files, persons, purposes and permitted changes. No obligation to disclose source or establish source escrow arises from a self-hosted purchase. Customer retains its independently created deployment automation, external integrations, configurations and other work that does not reproduce or derive from proprietary Software. Ownership and licensing of an authorized patch or custom software deliverable must be settled in the signed addendum or statement of work before that work begins. There is no automatic transfer of Customer's unrelated intellectual property to Provider. 5. OWNERSHIP AND CONFIDENTIALITY Provider and its licensors retain their respective intellectual property rights in Software, proprietary templates and nonpublic assessment material. Customer receives the express use rights above. Public facts and general ideas are not converted into proprietary property by this license. Nonpublic proprietary source, implementation details and technical material received under circumstances reasonably indicating confidentiality are Provider confidential information. Customer will use them only for the licensed purpose, restrict access to persons with a need to know, and protect them with reasonable measures no less protective than those used for its own comparable confidential information. Customer will promptly notify Provider of suspected unauthorized access, use or disclosure and reasonably cooperate in containment. Information lawfully public, independently developed without use of confidential information, already lawfully known without a duty, or lawfully obtained from another source without a duty is excluded. Confidentiality continues for five years after the applicable disclosure and, for information qualifying as a trade secret, for as long as it retains that status under applicable law. Disclosure of trade secrets in confidence to a government official or attorney solely to report or investigate a suspected legal violation, or in a lawsuit filing made under seal, and other legally protected disclosures are not prohibited. A person bringing a retaliation claim may use qualifying information as allowed by 18 U.S.C. § 1833(b). 6. CUSTOMER DATA AND REPORTS Customer retains its rights in its inputs, evidence, configurations and organization-specific facts. Provider does not receive ownership of them through this license. Provider's preexisting software and report templates remain Provider material. Customer may retain, reproduce and share its completed assessment reports and findings indefinitely for its legitimate business, governance, remediation, procurement, insurance, audit and regulatory purposes, including with its advisers, customers and regulators. Recipients receive no Software or engine license. Customer may quote findings and prepare its own summaries, provided it does not falsely describe modified results as an unaltered Aevyra report. Preserve notices in complete report copies. Confidential information included in a report remains subject to its applicable duties and legal disclosures. Report permission does not authorize redistribution of Software, resale of Aevyra services, extraction of proprietary templates for a substitute product, or training on Provider confidential implementation. It does not restrict Customer from using its own data or facts for otherwise lawful purposes. 7. THIRD-PARTY COMPONENTS Third-party software, including open-source dependencies, is governed by its applicable license and notices. This license does not restrict rights granted by those licenses, claim ownership of third-party material or excuse Provider from notice, source-offer or other applicable distribution obligations. The distributor must supply the notices required for the actual release. No blanket claim that a release contains no open-source material is made. 8. TERM AND END OF USE The license lasts for the accepted term unless terminated under the Customer Agreement. A subscription does not become perpetual through delivery of a self-hosted copy. A perpetual grant requires an express signed order. At expiration or termination, Customer must cease running Software and remove operational copies. On reasonable request it will certify compliance. A copy that must be retained by law or cannot reasonably be separated from routine protected backups may remain inaccessible for normal use and must be deleted under the applicable retention cycle. No right to restore that copy for production arises without a renewed entitlement. Customer may retain its own data and completed reports as described above. Provider is not authorized by this license to enter Customer's systems, remove Customer data or operate undisclosed destructive or remote-access mechanisms. Any technical entitlement checks or required network access must be disclosed in the accepted order and deployment documentation. 9. ADDITIONAL TERMS Demonstration or evaluation rights cover only the expressly offered scope and period and do not permit production deployment or commercial redistribution. MSP, reseller, OEM, white-label and source-access rights require their respective signed addenda; a standard Customer subscription supplies none of them. New terms operate prospectively following valid acceptance. This license does not retroactively revoke rights lawfully granted under a previous agreement or third-party license. Remedies remain those available under the Customer Agreement and applicable law; this notice alone guarantees no remedy or exclusivity over ideas, algorithms or independently created functionality. Provider contact for legal notices: david@tiptoptechknowlogy.com. Confirm the operative contact in the accepted Customer Agreement or order.