Software license andappliance terms.

1. Definitions

For the purposes of this Agreement, the following terms have the following meanings.

1.1 Devexana Software. All commercial and proprietary software, configurations, scripts, images, model weights, and intellectual property contained in Devexana’s commercial products and developed by, owned by, or licensed to Devexana, excluding Third-Party Software.

1.2 Third-Party Software. Any software, configuration, script, image, model, or intellectual property distributed with a Devexana product other than Devexana Software, in source, object, or other form. Each component is licensed under the terms that accompany it, are embedded in it, or are referenced by it. The bundled components and their licenses are listed in the open-source acknowledgments that ship with the product.

1.3 Appliance. The hardware unit supplied by Devexana on which Devexana Software runs, together with its firmware and preinstalled operating system.

1.4 Licensed Appliance. An Appliance, or a Customer-supplied system approved in writing by Devexana, on which Devexana Software is installed and for which Customer has paid all applicable Subscription Fees and agreed to these terms.

1.5 Edition. The Government/Education edition or the Business edition of Devexana Software. The editions differ in which features are enabled. No edition blocks the optional cloud AI in Section 8, and Section 7.3 governs telemetry in both.

1.6 Customer Data. All data Devexana Software reads from, derives from, or stores about Customer’s systems, records, personnel, and network, including records, embeddings, summaries, chat history, and audit entries, wherever that data sits on a Licensed Appliance.

1.7 Derivative Product. Any product or service resulting from the incorporation of, modification of, or integration with Devexana Software, where Devexana Software or the function of any part of it becomes an integral part of the resulting product or service.

1.8 Permitted Use. Use of Devexana Software on Licensed Appliances by Customer for Customer’s own internal governmental or business purposes, without use in a Derivative Product, as a hosted service, or in any product or service intended for resale, unless Customer has licensed Devexana Software for that purpose and paid the applicable fees.

1.9 Subscription Term. The period for which Customer has paid Subscription Fees for a Licensed Appliance, beginning on the Effective Date and continuing as set out in Section 11.

1.10 Support Services. The technical support, Software Updates, and appliance service Devexana provides during a paid Subscription Term, at the level stated on the applicable order.

1.11 Software Update. Any new version, enhancement, or fix to Devexana Software that Devexana generally releases to its customers, denoted by a change in version number. Updates ship as signed bundles and are applied by Customer; Devexana does not apply an update silently.

1.12 Subscription Fee. The then-current list price for the applicable Devexana Software and Support Services. Subscription Fees are due in advance of the Subscription Term they cover.

1.13 Appliance Fee. The then-current list price of an Appliance purchased by Customer.

2. License grant

2.1 Grant. Subject to these terms and to payment of the Subscription Fees, Devexana grants Customer a non-exclusive, non-transferable, non-assignable, non-sublicensable right to use Devexana Software for the Permitted Use on the Licensed Appliances for the duration of the Subscription Term. The license includes Support Services and Software Updates for that term.

2.2 Term license, not perpetual. The license granted in Section 2.1 lasts only while the Subscription Term is paid and current. It is not a perpetual license, and no perpetual right to use Devexana Software is granted.

2.3 Effect of non-renewal. If a Subscription Term ends without renewal, the license in Section 2.1 ends with it and Customer will stop using Devexana Software. Customer Data on the Appliance remains Customer’s; Section 3.6 governs the Appliance and the data on it.

2.4 The license unit. The license is granted per Licensed Appliance. Additional Licensed Appliances require additional Subscription Fees at the rates on the applicable order.

3. The appliance

3.1 What Devexana supplies. Where Customer purchases an Appliance, Devexana supplies the hardware unit with Devexana Software installed. The Appliance is sold; the software on it is licensed under Section 2.

3.2 Title and risk of loss. Title to an Appliance passes to Customer on Devexana’s receipt of the Appliance Fee in full. Risk of loss passes to Customer on delivery to the address on the order.

3.3 Hardware warranty. Devexana warrants that an Appliance will be free from defects in materials and workmanship, under normal use, for twelve (12) months from delivery.

3.4 Warranty service. Customer’s sole remedy under Section 3.3 is repair or replacement. Customer will request a return authorization from Devexana before returning an Appliance, and will remove or wipe Customer Data before shipment where the Appliance still boots. Devexana will not accept an unauthorized return. Devexana pays return freight for a unit found defective; Customer pays it for a unit found not defective.

3.5 What the warranty does not cover. Section 3.3 does not cover damage from accident, misuse, unauthorized modification, unauthorized repair, power events, environmental conditions outside the Appliance’s stated operating range, or a cause described in Section 4.1.

3.6 Return, wipe, and decommissioning. On termination or non-renewal, Customer may keep the Appliance as Customer’s property. Devexana will not require its return and will not request a copy of Customer Data on it. Where Customer chooses to return an Appliance for service, trade-in, or disposal, Customer is responsible for wiping Customer Data first; at Customer’s written request Devexana will perform a documented wipe and give written confirmation of it.

4. Exceptions to license and support

4.1 Unless the parties agree otherwise in writing, Support Services do not cover a failure caused by:

• 4.1.1 accident, neglect, misuse, or abuse by Customer, Customer’s employees or agents, or a third party;
• 4.1.2 a fault in an attachment, component, or product that is not part of the Licensed Appliance;
• 4.1.3 Customer’s failure to observe Section 6;
• 4.1.4 Customer’s failure to install the most recent Software Update that Devexana has confirmed resolves the reported failure;
• 4.1.5 a fault caused by the failure of a product or component not supplied by Devexana;
• 4.1.6 modification of, or damage to, Devexana Software or a Licensed Appliance by anyone other than Devexana; or
• 4.1.7 fire, flood, lightning, storm, war, act of violence, or a similar event.

4.2 Unless the order says otherwise, Support Services do not include: support of Third-Party Software, of software not supplied by Devexana, or of systems that are not Licensed Appliances; customization or integration work; support of a modified or customized build of Devexana Software; or repair of the connected systems Devexana Software reads but does not supply.

5. Payment

5.1 Fees and expenses. Fees are stated and payable in United States Dollars and are exclusive of out-of-pocket expenses. Customer will reimburse Devexana for reasonable travel expenses incurred for on-site work Customer requests, agreed in writing in advance. These terms govern Customer’s future purchases of additional Licensed Appliances, which may be purchased and renewed at the rates on the applicable order unless the parties agree otherwise in writing.

5.2 Invoices. Devexana will invoice Customer on execution of an order and on each renewal. Customer will pay within thirty (30) days of the invoice date. Subscription Fees are due before the Subscription Term they cover begins; Appliance Fees are due before the Appliance ships. Devexana may suspend Support Services, or change its credit terms, if payment is not received within sixty (60) days of the invoice date.

5.3 Taxes. Fees are exclusive of Taxes. Customer will pay an amount equal to any Taxes arising from this Agreement, excluding taxes on Devexana’s net income. “Taxes” means any tax, levy, duty, customs fee, charge, or contribution imposed by any authority, including any related fine, penalty, or interest. Where Customer is a tax-exempt governmental entity, Customer will supply its exemption certificate and Devexana will not invoice the exempted tax.

5.4 Appropriation. Where Customer is a governmental entity, Customer’s payment obligation for a future fiscal year is subject to the appropriation of funds for that year. If funds are not appropriated, Customer may terminate on written notice at the end of the funded period, without further liability beyond amounts due for the period served.

6. Customer’s obligations

6.1 Access. Customer will give Devexana the access to a Licensed Appliance that Devexana reasonably needs to perform Support Services. Devexana does not require, and will not ask for, standing remote access to a production Licensed Appliance or to Customer’s connected systems; support access to a production system is arranged per incident and on Customer’s terms. Customer may refuse access for security reasons, and Devexana is then relieved of Support Services that reasonably require the refused access.

6.1.1 Designated pilot, demonstration, evaluation, and beta systems. Devexana may hold remote access to a system that the parties have designated in writing as a pilot, demonstration, evaluation, or beta deployment, on the terms of that designation. A designation is “in writing” whether it is made in a signed agreement or confirmed in writing between the parties, including by electronic mail. A designated system may be a delivered production Licensed Appliance; designation, not the kind of hardware, is what brings a system within this Section. Access under this Section is held with Customer’s consent and Customer may revoke it at any time on written notice, whereupon Section 6.1 governs that system again and Devexana is relieved of Support Services that reasonably require the revoked access.

6.1.2 How a Licensed Appliance is reached. Devexana holds no access to Customer’s systems. A Licensed Appliance answers on Customer’s own network, behind Customer’s firewall, and accepts no inbound connection from Devexana. Devexana can reach it only where Customer opens a path: a remote session Customer starts and watches, or a virtual private network Customer establishes, authorizes in writing, and can close. Devexana operates no tunnel, no agent, no relay, and no standing credential of its own on a Licensed Appliance or on Customer’s network. A path Customer opens is a designation under Section 6.1.1: it names the systems it reaches, it lasts for the period stated in it, and Customer may revoke it at any time on written notice. Devexana Cloud (Section 7A) is not such a path; it carries no route into a Licensed Appliance.

6.2 Use and care.

• 6.2.1 Customer will not modify Devexana Software or the Licensed Appliance’s system configuration without Devexana’s prior consent, other than the configuration the product itself exposes.
• 6.2.2 Customer will operate Devexana Software in accordance with its documentation, by trained personnel or persons under their supervision.
• 6.2.3 Customer will test Software Updates before applying them to a production Licensed Appliance, in accordance with good practice. DEVEXANA IS NOT RESPONSIBLE FOR LOSS OF OR DAMAGE TO DATA, OR LOSS OF USE OF CUSTOMER’S COMPUTER OR NETWORK SYSTEMS.

6.3 Credentials and connected systems. Customer is responsible for the credentials it supplies to Devexana Software for its connected systems, for the scope of access those credentials carry, and for having the authority to grant that access. Devexana Software stores connector and device credentials in the operating system keychain on the Licensed Appliance, not in configuration files or the database.

6.4 Backups. Customer is responsible for backups of the Licensed Appliance and of its connected systems, and for restoring its own data after service. DEVEXANA IS NOT RESPONSIBLE FOR LOSS OF OR DAMAGE TO DATA OR LOSS OF USE OF CUSTOMER’S COMPUTER OR NETWORK SYSTEMS.

6.5 Support requests. To receive Support Services, Customer will follow the support guidelines Devexana publishes, identify the account and the software version, describe the failure and what was being done when it occurred, and cooperate with the assigned technician.

7. Customer data and vendor access

7.1 Ownership. Customer Data is and remains Customer’s property. Devexana claims no right, title, or interest in Customer Data and acquires no license to it under this Agreement.

7.2 Where it lives. Customer Data is processed and stored on the Licensed Appliance, in an encrypted local database. Devexana operates no hosted mirror of Customer Data. Two things sit outside the Appliance, and neither is Customer Data: the encrypted snapshots of the optional off-site backup service in Section 7.8, which are ciphertext Devexana cannot decrypt or read, and the account, organization, and appliance records of Devexana Cloud in Section 7A.

7.3 No telemetry by default, no phone-home. Devexana Software transmits no usage data, crash reports, analytics, inventory, or operational, network, or monitoring data about Customer or Customer’s systems to Devexana or to any third party. One exception is the optional appliance telemetry in Section 7A.6: it is off in every Appliance Devexana ships, an administrator turns it on, and it carries the closed list of readings stated in Section 5B of the Privacy Policy and nothing else. It carries no Customer Data. The others are the optional cloud AI and web lookup in Section 8, which send what Section 8 describes and only to the providers configured on the Licensed Appliance, and the optional alert email, which sends alert notices only through the mail relay an administrator configures. Devexana receives no readable Customer Data from the operation of the software, and cannot produce readable Customer Data in response to a subpoena or other legal demand, because Devexana does not hold Customer Data in a form it can read.

7.4 Sending content off the appliance. Once a key or sign-in for a cloud AI provider is stored on a Licensed Appliance, the optional cloud AI capabilities described in Section 8 can send the content of a question off it: the cloud consult, and built-in cloud assistance. Built-in cloud assistance can send the question together with records, device configuration, and command output the appliance read. No edition of Devexana Software blocks any of them.

7.5 No training on Customer Data. Devexana does not use Customer Data to train, tune, or evaluate any model, and does not permit a provider to do so through Devexana’s product.

7.6 Evidence. Every outbound call a Licensed Appliance makes is recorded in an append-only egress log on the Appliance, with its purpose, its destination, the account that caused it, and the time, except web lookups, which are recorded in the audit log as Section 8.6 describes. Customer can read that log without involving Devexana.

7.7 Support material. Where Customer voluntarily sends Devexana a log bundle, screenshot, or export for support, Devexana holds that material only for as long as needed to resolve the request and will delete it on Customer’s written request. Customer is responsible for what it chooses to send.

7.8 Off-site backup. Where Customer enables the optional off-site backup service, the Licensed Appliance encrypts each snapshot with the appliance’s own database key before upload and stores the result with Devexana’s cloud storage provider in United States regions. Two separate keys bear on a stored snapshot, and they sit in different hands. The appliance’s database key is the one that opens the contents; it stays in Customer’s and the appliance’s custody, it is never uploaded, and neither Devexana nor the storage provider holds a copy of it. The storage service separately wraps each stored object with a key Devexana administers, so Devexana can retrieve an object and remove that wrapping; what it recovers is the appliance’s ciphertext, which Devexana cannot decrypt or read. A restore therefore requires both the stored ciphertext and Customer’s appliance key. Customer may instead direct backups to Customer’s own storage account. Losing the appliance key makes the backups unrecoverable, which is why key escrow is part of onboarding. Section 7.1 applies to the contents of a backup as it does to all other Customer Data.

7A. Devexana Cloud

7A.1 What it is. Devexana Cloud is an optional web dashboard, operated by Devexana, at which Customer’s staff sign in to see the Licensed Appliances Customer has registered, to manage who on Customer’s staff holds an account in that dashboard, and to retrieve the encrypted snapshots described in Section 7.8. It is a separate service from Devexana Software on a Licensed Appliance, and a Licensed Appliance operates without it.

7A.2 It is not a route into an Appliance. Devexana Cloud opens no inbound path to a Licensed Appliance and carries no remote-access capability. It never authenticates a person to a Licensed Appliance: an Appliance verifies a sign-in itself, against the identity provider Customer configures on that Appliance, and does not ask Devexana Cloud whether a person may enter. Section 6.1.2 governs how an Appliance is reached.

7A.3 Accounts. There is no public sign-up. An account exists in Devexana Cloud only where an administrator of Customer’s organization invites it. A person signs in with a Google account, with a Microsoft Entra account, or with an email address and a password. An administrator adds and removes people and sets each person’s role. An email-and-password account works in Devexana Cloud only; on a Licensed Appliance that person still signs in with the credentials that Appliance holds.

7A.4 What it holds. Devexana Cloud holds account records, organization membership and roles, the identifier, name, edition, and software version of each registered Appliance, backup metadata, and, where Customer enables the service in Section 7.8, the encrypted backup ciphertext. It holds no Customer Data. Section 2B of the Privacy Policy states what is recorded about a person who signs in.

7A.5 One direction only. A Licensed Appliance sends to Devexana Cloud only what Sections 7.8 and 7A.6 describe, and only where Customer has enabled that capability. Devexana Cloud sends nothing to a Licensed Appliance except in answer to a request an administrator makes from that Appliance. Every call an Appliance makes is recorded in the Appliance’s egress log under Section 7.6.

7A.6 Optional appliance telemetry. An administrator may turn on a periodic report from a Licensed Appliance to Devexana Cloud, so that the dashboard can show how the Appliance is loaded. It is off in every Appliance Devexana ships. The report carries the closed list of readings stated in Section 5B of the Privacy Policy and nothing else: no Customer Data, no record content, no host name, no network address, and no person’s name. Turning it off stops the reports immediately.

7A.7 Availability. Devexana Cloud is provided as-is and without a service-level commitment. Devexana may change or discontinue it on notice. An interruption of Devexana Cloud does not affect the operation of Devexana Software on a Licensed Appliance, and Customer’s staff continue to sign in to the Appliance as before.

8. Optional cloud AI

8.1 What it is. The cloud consult sends a question to a cloud AI provider to improve an answer. On the Anthropic route it also sends the title and problem text of up to five records the appliance retrieved for the question. What is sent is prepared as Section 8.3 describes.

8.2 No edition blocks it. The cloud consult is off by default in every edition of Devexana Software. No edition blocks it in the product’s code, and Devexana makes no representation that any edition does. The Government/Education edition and the Business edition behave the same way; on a Government/Education-edition Licensed Appliance, the settings review reports cloud escalation as a finding while it is on.

8.3 What applies in every edition. An administrator turns the cloud consult on; where Customer has turned on dual approval, a second administrator must agree. Before anything is sent it is redacted: a suspected secret, or an identifier-shaped span that cannot be classified, blocks the send; other identifiers are replaced with placeholders, except on the OpenRouter route and in cloud deployment mode, where by default they are sent as written. On the OpenAI, OpenRouter, and Amazon Bedrock routes, a named user consents to each question, given on a previewed, redacted copy of what would be sent. On the Anthropic route, a user may also consent once for a whole conversation, and by default a question the Licensed Appliance could not answer, and classifies as safe to consult on, is sent without a confirmation step; a question about Customer’s own network state, identities, or incidents is never sent that way. On request, Devexana configures the Licensed Appliance to require a confirmation for every send. Where the Licensed Appliance is set up in cloud deployment mode, a question it cannot answer on its own is sent to the consult without a confirmation step. Every outbound call is written to the egress log before it is made. Turning the consult off stops the consult’s calls.

8.4 What Devexana does not claim. What happens to content after it is sent depends on the provider. Content sent to OpenAI, the testing partner, may be retained by OpenAI under its own terms. Content sent to Anthropic or to Amazon Bedrock is retained according to the terms of the account it is sent under. The OpenRouter route requests zero data retention from the provider on every call. Devexana has not signed its own retention agreement with any provider and does not represent that any cloud AI path is FedRAMP authorized. Devexana’s Compliance Disclosure states which agreements are signed and which are not, and is updated when that changes. A Customer whose compliance boundary disallows any external service should store no cloud AI key or sign-in on the Licensed Appliance; the product functions without one.

8.5 Customer’s decision. Storing a cloud AI key or sign-in, enabling the cloud consult or built-in cloud assistance, choosing the provider, and each consent given within them are Customer’s decisions. Customer is responsible for determining whether what these capabilities send may lawfully leave Customer’s boundary.

8.6 Optional web lookup. Devexana Software also offers an optional web lookup that forwards a search phrase, not Customer’s records, to the search provider configured on the Licensed Appliance (Brave, Tavily, Anthropic, OpenRouter, or a local search service that queries public search engines), using that provider’s key where it needs one. It is off by default, and Devexana turns it on at Customer’s request. Each search is recorded in the Licensed Appliance’s audit log; a search through OpenRouter is also recorded in the egress log.

8.7 Built-in cloud assistance. Built-in cloud assistance is used by the network assistant and, where enabled, also plans chat investigations and writes chat answers. It can send the question together with records, device configuration, and command output the Licensed Appliance read. It uses the same key as the consult’s OpenRouter route, which requests zero data retention on every call. Once that key is stored, the part of built-in cloud assistance that uses it is on unless an administrator turns it off, whether or not the consult is on. The chat investigations and the network assistant’s agent engine run only where Devexana has enabled them, and Devexana turns them off on request. Where Devexana has configured it, it can instead use an Anthropic account. It does not ask for a confirmation before each call, and what it sends is not redacted the way a consult is. Every call is written to the egress log before it is made. Sections 8.4 and 8.5 apply to it as they apply to the cloud consult.

9. Advisory readings

9.1 Advisory output. Devexana Software reads from connected systems and presents findings, summaries, and suggestions. Output may be incomplete or incorrect. All operational, legal, and records decisions remain the responsibility of the operator and of Customer.

9.2 Reading is read-only by construction. The connector families that read Customer’s systems reject write operations at registration. The models on a Licensed Appliance read, summarize, and suggest; they do not act on connected systems.

9.3 Human-approved changes. Where Devexana Software makes a change to a connected system (for example, a network device configuration change over SSH), that capability is off by default and separately permissioned, and every change requires a named human operator’s per-action approval before it is applied. A change is simulated before approval where the target device supports it, and a rollback point is captured before applying.

9.4 Reversal. Reversal of an applied change is best-effort within the capabilities of the affected device and is not guaranteed.

9.5 The approver. The named human who approves a change is responsible for that change.

10. Intellectual property

10.1 Ownership. Except for the license expressly granted in Section 2, Devexana and its suppliers retain all right, title, and interest in and to Devexana Software, its interfaces, the visual designs, the models shipped with it, and all copies, modifications, and derivative works, including all patent, copyright, trademark, trade secret, trade dress, and other intellectual-property rights. Customer obtains a limited license only; no ownership is conveyed. Customer will not register or attempt to register, directly or indirectly, any intellectual-property right of Devexana or its suppliers.

10.2 Claimed rights and prior art. Devexana claims and reserves all patent, copyright, and other intellectual-property rights in Devexana Software and its interfaces, including the switch-and-firewall faceplate visualization and the grounded, human-approved interaction system. This description is published as of the effective date of these terms and is intended as a public disclosure; it constitutes prior art against later filings by others, and it does not restrict what anyone else may file.

10.3 Extensions. Devexana grants Customer the right to build, use, and distribute extensions that interface with Devexana Software’s documented APIs, so long as each extension is designed to operate, and operates, as an adjunct to Devexana Software and not as a substitute for it or as a means of circumventing the license unit in Section 2.4.

10.4 Confidentiality of the software. Customer will not disclose Devexana Software, or information marked confidential, trade secret, or proprietary, to a third party, and will not duplicate or use it except as this Agreement permits. Customer will take reasonable steps, during and after the term, to prevent unauthorized access to or copying of Devexana Software.

10.5 No reverse engineering. Except where applicable law gives Customer the right regardless of contract, Customer will not reverse engineer, decompile, disassemble, or extract Devexana Software, its models, or their weights; will not copy or reimplement the faceplate visualization and its interaction design in order to build a competing product; and will not scrape or systematically capture the interfaces, by hand or with any automated agent, crawler, or recorder.

10.6 Notices. Copies of Devexana Software must retain the trademark, service-mark, and copyright notices that appear in the unaltered original, in the size, location, color, and visibility in which they appear there.

10.7 Trademarks. No right or license to use a Devexana trade name, service mark, or trademark is granted by this Agreement.

10.8 Survival. This Section 10 survives termination of this Agreement.

11. Term and termination

11.1 Term. The Subscription Term begins on the Effective Date and continues for one (1) year, renewing for successive one-year terms unless either party gives written notice of non-renewal at least thirty (30) days before the next term begins, or unless the order states a different term.

11.2 Termination for breach. If either party materially breaches this Agreement and does not cure within thirty (30) days of written notice, the other party may terminate on written notice. No cure period is required for a breach of Section 10.

11.3 Termination for non-appropriation. Section 5.4 applies.

11.4 Effect of termination. On termination, Customer will stop using Devexana Software. Customer keeps the Appliance and the Customer Data on it, as Section 3.6 provides. Customer will pay for Devexana Software and Support Services provided up to the effective date of termination. Sections 3.6, 5, 7, 9, 10, 11.4, 13, 14.2, 15, 16, 18, 19, and 20 survive termination.

12. Continuing business

Nothing in this Agreement limits Devexana from providing software, materials, or services to itself or to other customers, however similar to what is delivered to Customer.

13. Limitation of liability

13.1 Limitation of liability. FOR ALL EVENTS AND CIRCUMSTANCES, DEVEXANA’S AND ITS AFFILIATES’ AGGREGATE AND CUMULATIVE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT, REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR OTHERWISE, IS LIMITED TO DIRECT DAMAGES AND WILL NOT EXCEED THE AMOUNT CUSTOMER PAID DEVEXANA UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY.

13.2 Disclaimer of damages. IN NO EVENT WILL DEVEXANA OR ITS AFFILIATES BE LIABLE FOR ANY CLAIM BASED ON A THIRD-PARTY CLAIM, OR FOR ANY INCIDENTAL, CONSEQUENTIAL, SPECIAL, INDIRECT, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR DAMAGES ARISING FROM MALFUNCTION, DELAY, LOSS OF DATA, LOST PROFITS, LOST SAVINGS, INTERRUPTION OF SERVICE, OR LOSS OF BUSINESS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

13.3 Exclusions. Sections 13.1 and 13.2 do not limit liability that cannot be limited under applicable law.

14. Representations and warranties

14.1 Authority. Each party represents that it has the authority to enter into this Agreement.

14.2 Disclaimer. EXCEPT AS EXPRESSLY STATED IN SECTION 3.3 AND THIS SECTION 14, DEVEXANA SOFTWARE IS PROVIDED “AS IS,” WITHOUT WARRANTY OR CONDITION OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. THE WARRANTIES IN SECTION 3.3 AND THIS SECTION 14 ARE THE SOLE AND EXCLUSIVE WARRANTIES, EXPRESS OR IMPLIED. NO ORAL OR WRITTEN INFORMATION GIVEN BY DEVEXANA, ITS AFFILIATES, RESELLERS, AGENTS, OR EMPLOYEES CREATES A WARRANTY OR ENLARGES ONE. DEVEXANA DOES NOT WARRANT THAT USE OF THE SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE, AND DOES NOT WARRANT THAT THE OUTPUT OF THE MODELS SHIPPED WITH IT IS COMPLETE OR CORRECT.

14.3 Compliance status. Devexana states its certification status in its Compliance Disclosure and claims no authorization it does not hold. Devexana is not FedRAMP authorized, is not StateRAMP authorized, and has not completed a SOC 2 Type II audit.

15. Marks and publicity

15.1 Devexana marks. No right or license to use a Devexana trade name, service mark, or trademark is granted by this Agreement.

15.2 Customer’s name and marks. Devexana will not use Customer’s name, logo, seal, or the name of any deployment in advertising, press, promotion, a customer list, a case study, or any other public disclosure without Customer’s prior written consent, given for that specific use. Consent may be limited in scope and duration and may be withdrawn on written notice, after which Devexana will stop the use in materials it controls within a reasonable period.

15.3 Freedom to use ideas. Ideas, methods, concepts, know-how, techniques, and improvements developed in the course of this Agreement may be used by either party without an obligation to account, subject to Sections 10 and 16.

16. Confidentiality

16.1 The parties will maintain the confidentiality of Devexana’s pricing and product roadmap, and of other non-public technical or business information received from the other party and marked or identified as confidential, for two (2) years after termination of this Agreement. This Section does not apply to information that is public, independently developed, or lawfully received from a third party.

16.2 Public-records exception. Where Customer is subject to the New York Freedom of Information Law or a comparable public-records statute, Customer’s disclosure of material in response to a lawful request is not a breach of this Section, provided Customer gives Devexana notice early enough for Devexana to seek protection for material Devexana believes is exempt.

17. Reporting and self-certification

17.1 Reporting. Customer will promptly notify Devexana if the number of Licensed Appliances in use exceeds the number for which Customer has paid, giving the number and the dates they were put into use. Devexana will invoice for the difference on a pro-rata basis and Customer will pay in accordance with Section 5.

17.2 Annual self-certification. Once per year, on Devexana’s written request, an authorized officer of Customer will certify in writing the number of Licensed Appliances in use. Devexana will not enter Customer’s facilities or inspect Customer’s records to verify compliance.

17.3 Correction. If a self-certification shows under-reporting, Customer will pay for the additional Licensed Appliances within fifteen (15) days of Devexana’s invoice.

18. Export and prohibited uses

18.1 Export. Devexana Software and any technical data supplied with it are subject to the export control laws of the United States and may be subject to the export laws of the country of delivery. Customer will comply with those laws. Devexana Software may not be sold, leased, transferred to, or used by a restricted end user, in a restricted country, or by anyone engaged in activity relating to weapons of mass destruction, including the design, development, production, or use of nuclear materials, nuclear facilities, or nuclear weapons, missiles or missile projects, or chemical or biological weapons. Customer will defend and indemnify Devexana against demands, notices, fines, penalties, sanctions, claims, liabilities, and costs, including attorneys’ fees, resulting from Customer’s breach of this Section. Devexana may terminate this Agreement on Customer’s breach of this Section without liability to Customer. This Section survives termination.

18.2 United States Government restricted rights. Devexana Software is commercial computer software and its documentation is commercial computer software documentation, developed entirely at private expense. Where Customer is, or is acquiring on behalf of, an agency of the United States Government, the software and documentation are supplied with only the rights granted in this Agreement, in accordance with FAR 12.212 and DFARS 227.7202 as applicable. No greater right is granted by implication, by course of dealing, or by a term appearing on a government form.

18.3 Excluded Data. Devexana Software is not designed or licensed for use with classified national-security information, information subject to the International Traffic in Arms Regulations, or other information whose handling requires a clearance, an authorization, or a facility accreditation that Devexana does not hold (“Excluded Data”). Customer will not connect Devexana Software to a system holding Excluded Data or otherwise place Excluded Data within the software’s reach. Devexana has no liability arising from Excluded Data placed within the software’s reach in breach of this Section.

18.4 No high-risk use. Devexana Software is not fault-tolerant and is not designed or intended for use in a hazardous environment, or in any application where its failure could lead to death, personal injury, or severe physical or environmental damage, including the operation of nuclear facilities, aircraft navigation or communication, air traffic control, direct life-support machines, or weapons systems. Devexana disclaims any express or implied warranty of fitness for such use. Reading from, documenting, or reporting on a system that supports such an application is not itself a use prohibited by this Section.

19. Governing law and disputes

19.1 Governing law and venue. This Agreement is governed by the laws of the State of New Jersey, without regard to its conflict-of-laws provisions, and any controversy or claim arising out of or relating to it will be venued in the state or federal courts located in Bergen County, New Jersey, to whose jurisdiction the parties consent. Where Customer is a New York governmental entity, this Agreement is instead governed by the laws of the State of New York. Where the parties have signed a master agreement, the governing-law and venue terms of that agreement control over this Section.

19.2 Informal resolution first. Before commencing a proceeding, the party raising a dispute will give the other a written description of the problem, and both parties will make a good-faith effort for thirty (30) days to resolve it. This Section does not prevent either party from seeking injunctive relief.

19.3 No jury waiver. Nothing in this Agreement waives either party’s right to a trial by jury.

19.4 Time to bring a claim. No claim arising out of this Agreement may be brought by either party more than two (2) years after the cause of action accrued.

19.5 UCITA. If the Uniform Computer Information Transactions Act, or a similar federal or state law, is enacted, it does not apply to this Agreement, and the governing law is as if that law had not been enacted.

20. Miscellaneous

20.1 Acceptance and updates. These terms, the Privacy Policy, and the Compliance Disclosure are presented in the product before first use. Customer’s acceptance (account, document version, and timestamp) is recorded on the Licensed Appliance in the append-only audit log. When a materially updated version ships, the user is asked to review and accept it before continuing. Accessing or using Devexana Software in any manner constitutes acceptance of the then-current version of these terms, whether or not a click-through acceptance was recorded. Accepting any version of these terms constitutes agreement to these terms as they may be updated from time to time. Continued use of the software after these terms change constitutes acceptance of the updated terms. This Section is subject to Section 20.12.

20.2 Precedence. Where Customer and Devexana have signed a master agreement, that agreement prevails over these terms to the extent of any conflict. These terms prevail over terms appearing on a purchase order or invoice.

20.3 Notices. Notices must be in English and in writing, and are deemed given when delivered by hand or five (5) days after being sent by a method that provides positive confirmation of delivery, to the addresses on the order. Notice to Devexana must include a copy to: DEVEXANA INC., PO Box 1, Demarest, New Jersey 07627; legal@devexana.com.

20.4 Right of refusal. Devexana may decline to supply Devexana Software to a purchaser, including where the intended use would breach Section 18. Where Devexana declines after payment, Devexana will refund the fees paid, less fees Devexana has already incurred.

20.5 Assignment. This Agreement binds the parties and confers no right, benefit, or remedy on any other person. Neither party may assign without the other’s prior written consent, which will not be unreasonably withheld; Devexana may assign to an affiliate or in connection with a merger or a sale of all or substantially all of its assets, on written notice and without Customer’s approval.

20.6 Public records and retention. Customer’s obligations under applicable public-records and records-retention law remain Customer’s. Devexana provides retention scheduling, legal hold, and export tooling on the Licensed Appliance to support them. Devexana holds no readable Customer Data that could be responsive to a request directed at Devexana. What Devexana does hold is the account, organization, and appliance records described in Section 7A.4 and the encrypted backup ciphertext described in Section 7.8.

20.7 Force majeure. Except for payment obligations, neither party is liable for delay in or failure of performance caused by acts of God, war, riot, strike, fire, flood, earthquake, government restriction, terrorist act, or other cause beyond its reasonable control. The delayed party is entitled to a reasonable extension of time.

20.8 Independent contractor. Devexana is an independent contractor. Nothing in this Agreement creates an employment relationship or a partnership. Each party is responsible for its own taxes.

20.9 Headings. Headings are inserted for convenience and are not part of this Agreement for purposes of interpretation.

20.10 Severability. If a provision of this Agreement is held invalid or unenforceable, the remaining provisions remain in effect, and the provision is deemed modified to the least extent necessary to make it valid and enforceable.

20.11 Waiver. Delay or failure to exercise a right is not a waiver or forfeiture of it. A waiver is valid only in writing, signed by an authorized representative of the party against whom it is asserted.

20.12 Complete agreement; amendment. This Agreement is the final, complete, and exclusive statement of the parties’ agreement on its subject matter and supersedes prior and contemporaneous agreements on that subject matter, notwithstanding different or additional terms appearing on a purchase order or other document used by Customer. Except as Section 20.1 provides for updated product terms, this Agreement may be amended only by a written instrument signed by both parties that refers specifically to this Agreement. Any claim relating to Devexana Software will be made against DEVEXANA INC. alone.

20.13 Counterparts. This Agreement may be executed in counterparts and by electronic signature, each of which is an original and all of which together are one instrument.