Subscription Services Agreement

This Subscription Services Agreement ("Agreement") is between Alesian Security LLC, a Colorado limited liability company ("Alesian"), and the customer named in an Order Form that references it ("Customer"). It takes effect when both parties sign an Order Form, or when Customer accepts it online.

The Agreement consists of: (1) each Order Form; (2) the Data Processing Addendum ("DPA"), where Alesian processes Customer Personal Data; (3) the Acceptable Use Policy; and (4) these terms. If they conflict, that list sets the order of precedence, except that the DPA always governs personal data.

1. Definitions

• Customer Data: data, including Customer Personal Data, that Customer or its Users provide to the Service, or that the Service collects from Customer's systems with Customer's authorization (such as DMARC reports).
• Documentation: Alesian's then-current user documentation for the Service.
• Output: detections, scores, reports and evidence produced by the Service for Customer.
• Service: the hosted services and any professional services identified in an Order Form.
• Users: Customer's employees and contractors whom Customer authorizes to use the Service.

2. The Service

2.1 Provision. Alesian will provide the Service in all material respects in accordance with the Order Form and Documentation, using reasonable skill and care.

2.2 Use. Customer may allow its Users to use the Service for Customer's internal security purposes during the Subscription Term. Customer is responsible for its Users' compliance with this Agreement.

2.3 Restrictions. Customer will not (a) resell, sublicense or make the Service available to third parties except as the Order Form allows; (b) reverse engineer the Service except as law permits; (c) use it to build a competing product; (d) interfere with or bypass its security; (e) use it unlawfully or in breach of the Acceptable Use Policy; or (f) use the Service or Output to train a machine-learning model offered to third parties.

2.4 Watched names and verified properties. Customer may watch any domain name for lookalikes. Block requests, takedown requests and mail-defense services are available only for domains Customer owns or is authorized in writing to act for, Block requests require Customer to verify control of the domain by an email sent from an administrative address at that domain, and Alesian may require verification of control or authority before enabling takedown requests or mail-defense services. Block requests are governed by Schedule 1.

2.5 Professional services. Any assessments, reviews or setup services in an Order Form are provided with reasonable skill and care. Customer will give timely access and information needed to perform them.

2.6 Changes. Alesian may improve and change the Service but will not materially reduce the functionality of a subscribed Service during the Subscription Term.

2.7 Support. Alesian provides support by email at admin@alesiansecurity.com during business hours (US Mountain Time) and aims to respond within one business day. Alesian gives no uptime or availability commitment.

3. Customer Data

3.1 Ownership. Customer owns Customer Data.

3.2 License to Alesian. Customer grants Alesian a license to host, copy, process and transmit Customer Data to provide, secure and support the Service, and as Customer instructs.

3.3 Aggregated data. Alesian may create de-identified, aggregated data from use of the Service that does not identify Customer or any person, and use it to operate, improve and describe the Service.

3.4 Customer responsibilities. Customer is responsible for the accuracy and legality of Customer Data, and for having the rights and permissions needed for Alesian to access Customer's systems (such as its DMARC reporting address).

3.5 Personal data. The DPA applies to Customer Personal Data.

3.6 Security. Alesian will maintain the security measures described in the DPA and its Security Overview.

3.7 Export and deletion. If an Order Form ends without renewal, Alesian keeps Customer Data for 90 days so that the Service can resume on late renewal, then deletes it as set out in the DPA. Customer may request an export in a machine-readable format, or earlier deletion, at any time.

3.8 Domain intelligence is not Customer Data. Public information Alesian collects about domain names (including DNS, WHOIS and blocklist history, and mail received at Alesian's own monitoring addresses) belongs to Alesian, even where it concerns a name Customer watches, and is not deleted when this Agreement ends. Customer's watch lists, notes and decisions are Customer Data.

4. Fees and taxes

4.1 Customer will pay the fees in each Order Form. Unless stated otherwise, fees are payable in US dollars, are non-cancelable, and are non-refundable, except as this Agreement provides.

4.2 Customer may dispute an invoice in good faith by written notice within 30 days, and must pay any undisputed part when due.

4.3 Overdue amounts may bear interest at 1% per month or the maximum lawful rate, if lower. If an undisputed amount is more than 15 days overdue, Alesian may suspend the Service after giving at least 10 days' written notice.

4.4 Fees exclude taxes. Customer pays all taxes except those on Alesian's income. If Customer must withhold tax, it will gross up the payment so Alesian receives the full amount.

4.5 Alesian may change fees on renewal by giving notice at least 45 days before the end of the current term.

5. Ownership and feedback

Alesian and its licensors own the Service, Documentation and all related intellectual property. Alesian grants Customer a license to use Output for its internal security purposes, and to share it with its advisers, registrars, hosts and law enforcement to protect its names, during and after the Subscription Term. Alesian may use feedback freely.

6. Confidentiality

6.1 "Confidential Information" is non-public information disclosed by one party to the other that is marked confidential or should reasonably be understood to be confidential. It excludes information that is or becomes public without breach, was already known to the recipient without restriction, is received from a third party without restriction, or is independently developed.

6.2 The recipient will use Confidential Information only for this Agreement, protect it with at least reasonable care, and disclose it only to personnel and advisers who need to know it and are bound by duties of confidentiality. It may disclose it where law requires, after giving notice where lawful.

6.3 On request after termination, the recipient will return or delete Confidential Information, except copies kept under law or in routine backups, which remain confidential.

7. Warranties and disclaimers

7.1 Each party warrants that it has authority to enter into this Agreement and will comply with laws that apply to it.

7.2 Alesian warrants that the Service will perform materially as described in the Documentation. Customer's sole remedy for breach of this warranty is for Alesian to use reasonable efforts to correct the non-conformity or, failing that, for either party to terminate the affected Service and for Alesian to refund prepaid fees for the unused period. Customer must report the breach within 30 days of discovering it.

7.3 Detection is probabilistic. Alesian does not warrant that the Service will identify every lookalike domain, that every detection is malicious, or that any blocklist operator or registrar will act on a submission.

7.4 Except as stated in this Agreement, the Service is provided "as is" and each party disclaims all other warranties, including merchantability, fitness for a particular purpose, and non-infringement.

8. Indemnities

8.1 By Alesian. Alesian will defend Customer against any third-party claim that the Service, as provided, infringes a US patent, copyright or trademark or misappropriates a trade secret, and pay resulting damages finally awarded or agreed in settlement. This does not apply to claims arising from Customer Data, modification not made by Alesian, combination with items not provided by Alesian, or use in breach of this Agreement. If the Service is or may be found infringing, Alesian may obtain the right for Customer to continue using it, modify it to be non-infringing, or terminate the affected Service and refund prepaid fees for the unused period.

8.2 By Customer. Customer will defend Alesian against any third-party claim arising from (a) Customer Data; (b) domains Customer verified, or used block, takedown or mail-defense services for, without authority; (c) block or takedown requests made in breach of Schedule 1 or the Acceptable Use Policy; or (d) Customer's breach of law, and pay resulting damages finally awarded or agreed in settlement.

8.3 Procedure. The indemnified party must promptly notify the other of the claim, give it sole control of the defense and settlement, and provide reasonable help at the indemnifying party's cost. No settlement may impose liability or admissions on the indemnified party without its consent. This section 8 states each party's entire liability for such claims.

9. Limitation of liability

9.1 Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill or data, however caused.

9.2 Each party's total liability under this Agreement is limited to the amount stated in the Order Form or, if none is stated, the fees actually paid by Customer under this Agreement in the 12 months before the first event giving rise to liability. Fees not yet paid, or payable for future periods, do not count toward this limit.

9.3 Sections 9.1 and 9.2 do not limit Customer's payment obligations, either party's indemnity obligations, liability for breach of section 6, liability for fraud, gross negligence or wilful misconduct, or any liability that cannot be limited by law.

10. Term, termination and suspension

10.1 This Agreement lasts until all Order Forms have ended. Each Order Form lasts for its Subscription Term and renews as it states.

10.2 Either party may terminate an Order Form or this Agreement by written notice if the other (a) materially breaches it and does not cure within 30 days of notice; or (b) becomes insolvent or enters bankruptcy or a similar proceeding.

10.3 Alesian may suspend the Service, or part of it, immediately where reasonably necessary to prevent harm to the Service, other customers or third parties, or unlawful use, and otherwise under section 4.3. Alesian will give notice where practicable and restore access once the issue is resolved.

10.4 If Customer terminates for Alesian's breach, Alesian will refund prepaid fees for the remaining term. If Alesian terminates for Customer's breach, Customer will pay unpaid fees for the remaining term.

10.5 Sections 3.3, 3.7, 3.8, 4 (for amounts owed), 5 to 9, 10.4, 10.5 and 11 survive.

11. General

11.1 Governing law and venue. This Agreement is governed by Colorado law, without regard to conflict-of-laws rules. The state courts located in Jefferson County, Colorado, and the United States District Court for the District of Colorado, have exclusive jurisdiction. The UN Convention on Contracts for the International Sale of Goods does not apply.

11.2 Notices. Notices must be in writing and sent to the email addresses in the Order Form. Notices of breach or termination must also be sent by a method that confirms receipt.

11.3 Publicity. Neither party may use the other's name or logo publicly without prior written consent, except that Alesian may identify Customer as a customer in private communications and, with consent, publicly.

11.4 Assignment. Neither party may assign this Agreement without the other's consent, except to a successor in a merger, acquisition or sale of substantially all the relevant business, on notice.

11.5 Subcontractors. Alesian may use subcontractors and remains responsible for them.

11.6 Export and sanctions. Each party will comply with applicable export control and sanctions laws. Customer confirms it is not a sanctioned person and will not permit sanctioned persons to use the Service.

11.7 Force majeure. Neither party is liable for delay caused by events beyond its reasonable control, other than payment obligations.

11.8 Independent parties. The parties are independent contractors. There are no third-party beneficiaries.

11.9 Entire agreement. This Agreement is the entire agreement about its subject matter and supersedes prior agreements. Customer purchase order terms have no effect. Amendments must be in writing and signed by both parties. If a provision is unenforceable, the rest remains in effect. A failure to enforce is not a waiver. It may be signed in counterparts and electronically.

Schedule 1 — Block requests

1. 1. Authority. Each block request authorizes Alesian to submit the named domain to third-party blocklist operators in Customer's name, identifying Customer as the affected party, with the evidence Alesian holds.
2. 2. Review. A person at Alesian reviews and approves every request before submission, aiming to do so within one business day. Alesian may decline any request.
3. 3. Credits. Each request uses one block credit when Customer makes it. A credit pays for evaluating the domain and, if approved, submitting it. It is not returned if the evaluation stops the request (including because Alesian finds no real threat or finds that the domain belongs to Customer or its affiliates), if Alesian later withdraws a submission, or if an operator declines, delays or removes a listing. Purchased credits are valid for 12 months from purchase. Credits included with a subscription expire at the end of the month in which they are granted. Unused credits expire and are not refunded.
4. 3A. Final requests. Customer may request a block for each detected domain once. A request cannot be withdrawn by Customer, repeated or appealed for the same domain, whatever the outcome.
5. 3B. Operator decisions. Operators act independently. Alesian does not guarantee any listing, its scope or duration.
6. 4. Customer confirmations. Customer confirms, for each request, that the request protects a verified property under section 2.4, that the domain to be blocked is not its own or its affiliates', that it has a genuine basis to believe the domain imitates it or is used to harm it or those who deal with it, and that its information is accurate.
7. 5. Monitoring. During the Subscription Term, Alesian monitors listed domains and notifies Customer if a listing lapses.
8. 6. Withdrawal. Alesian may withdraw a submission and ask operators to delist a domain if it reasonably concludes the request was mistaken or improper, and will tell Customer. Withdrawal does not return the credit.
9. 7. Takedowns. A takedown (asking a registrar or host to suspend or remove a domain) is an escalation. Alesian will consider one only for a domain for which a block was already requested and where abuse continued afterward, and only if Customer provides direct evidence of the abuse, such as a phishing message. Alesian decides case by case, may decline without giving a reason, and does not guarantee any registrar or host will act.