Master SaaS Subscription Agreement

1. Acceptance of Terms & Services

This Master Subscription Agreement ("Agreement") is entered into by and between TKOResearch Inc. ("Zelix", "Zelix Security", "Provider", "we", or "us") and the corporate entity agreeing to these terms ("Customer", "you"). By accessing or utilizing the Zelix platform, scanning SaaS ecosystems, or subscribing via Stripe, you represent that you have full authority to bind Customer to this Agreement.

2. Platform Description & Agentless Governance

Zelix provides autonomous Non-Human Identity (NHI) posture management, semantic scope threat matching, real-time ingestion webhooks, and regulatory compliance evidence generation. Customer acknowledges that Zelix operates agentlessly via official SaaS platform APIs (Microsoft Entra ID, Google Workspace, GitHub Enterprise, and Slack Enterprise Grid).

3. Service Level Agreement (SLA) & Uptime

Provider commits to commercially reasonable efforts to ensure the Zelix Web Console and Ingestion APIs achieve a minimum monthly uptime of:

• Growth & Scale Tiers: 99.9% monthly uptime.
• Enterprise Dedicated Tiers: 99.99% monthly uptime backed by financial service credits.

Scheduled maintenance windows are announced at least 48 hours in advance and scheduled during off-peak weekend hours.

4. Autopilot Remediation & Rollback Safety

Customer retains full authority over whether Autopilot executes in Supervised Mode (requiring human confirmation) or Autonomous Mode (automated quarantine of critical risks). Customer acknowledges that prior to any remediation action, Provider captures an encrypted rollback snapshot, enabling 1-click permission restoration.

5. Fees, Subscriptions & Seat Enforcement

Services are billed in advance on a recurring monthly or annual basis via Stripe. Subscription tiers are defined by the number of monitored Non-Human Identities (Starter: up to 50 NHIs; Growth: up to 250 NHIs; Scale: up to 1,000 NHIs). If Customer exceeds their tier limit by more than 15%, Provider provides a 14-day grace period to adjust subscription tiers before throttling additional discovery scans.

6. Customer Data Ownership & Confidentiality

Customer owns all rights, title, and interest in and to all data, metadata, and telemetry ingested from Customer's SaaS platforms. Provider shall not disclose Customer Data to any third party except as required to fulfill the Services (e.g. cloud hosting providers, Stripe billing, and Cloudflare R2 evidence storage) under equivalent confidentiality standards.

7. Limitation of Liability & Indemnification

Except for gross negligence or willful misconduct, neither party shall be liable for indirect, incidental, or consequential damages. Provider's aggregate liability under this Agreement shall not exceed the total fees paid by Customer to Provider in the twelve (12) months preceding the claim.

8. Governing Law & Dispute Resolution

This Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to conflict of law principles. Any dispute arising out of this Agreement shall be resolved through binding confidential arbitration.