Master Subscription Agreement

Subject to this Agreement, Auditious will make the Services described in the applicable Order Form or plan available to you during the subscription term for your internal business purposes. Auditious is a compliance automation and audit readiness platform that supports governance, risk management, security compliance monitoring, evidence management, and policy management workflows.

Auditious will provide support for the Services as described in the applicable plan, Order Form, or Support Policy. You may reach our support team at support@auditious.io.

Auditious will use commercially reasonable efforts to make the Services available in accordance with any Service Level Agreement referenced in your Order Form. We may perform scheduled or emergency maintenance, and availability may be affected by third-party outages, force majeure events, or circumstances beyond our reasonable control.

Auditious continuously improves the Services and may modify, update, or enhance features from time to time. We will not materially reduce the core functionality of the Services for which you have paid during your then-current subscription term.

You will pay the fees set out in the applicable Order Form or plan. Except as expressly stated in this Agreement, fees are non-refundable and subscription commitments are non-cancelable for the term you have committed to.

Unless the Order Form states otherwise, invoiced fees are due within thirty (30) days of the invoice date. Undisputed amounts that remain unpaid may accrue interest at the lower of 1.5% per month or the maximum permitted by law, and continued non-payment may result in suspension of the Services.

Fees are exclusive of taxes. You are responsible for all sales, use, value-added, withholding, and similar taxes and duties, except for taxes based on Auditious' net income.

Pricing is fixed for the duration of each Order Form term. Auditious may change pricing for renewal terms on prior notice, as described in the applicable Order Form or plan.

Auditious may offer free trials or beta features. These are provided on an "as is" basis, without warranty, and may be modified, suspended, or discontinued at any time. Data submitted during a trial may be permanently deleted if you do not purchase a subscription.

This Agreement begins on the Effective Date and continues for the term stated in your Order Form or plan. Unless the Order Form states otherwise, subscription terms renew automatically for successive periods equal to the prior term unless either party gives written notice of non-renewal at least thirty (30) days before the end of the current term.

Either party may terminate this Agreement if the other party materially breaches it and fails to cure the breach within thirty (30) days after receiving written notice, or if the other party becomes insolvent or subject to bankruptcy or similar proceedings.

Auditious may suspend your access to the Services if your use poses a security risk, violates this Agreement, remains unpaid after notice, or where required by law or a governmental authority. We will use reasonable efforts to give you advance notice where practicable.

On expiration or termination, your right to access the Services ceases. For a limited period following termination, and while your account remains active, you may export your Customer Data. Thereafter, Auditious may delete Customer Data in the ordinary course, as described in our Privacy Policy. Fees accrued before termination remain payable.

Provisions that by their nature should survive, including those on ownership, confidentiality, fees accrued, warranty disclaimers, indemnification, limitation of liability, and governing law, survive termination of this Agreement.

The Services, including all software, technology, designs, interfaces, trademarks, logos, content, and documentation, are and remain the exclusive property of Auditious and its licensors. Except for the limited rights granted here, no rights are transferred to you.

Subject to this Agreement, Auditious grants you a limited, non-exclusive, non-transferable, non-sublicensable, and revocable right to access and use the Services for your internal business purposes during the subscription term.

As between the parties, you retain ownership of all information, documents, evidence, policies, records, and other data that you upload or submit through the Services ("Customer Data"). You grant Auditious a non-exclusive, worldwide license to host, process, store, and transmit Customer Data solely to provide and support the Services. You represent that you have all rights and permissions necessary to provide Customer Data to Auditious.

Auditious may collect and use aggregated and de-identified data derived from operation of the Services ("Usage Data") to operate, secure, analyze, and improve the Services, provided that such data does not identify you, your users, or any individual.

You are responsible for your users' compliance with this Agreement and for all activity that occurs under your accounts. You must keep account credentials confidential and notify us promptly of any unauthorized use or security incident involving your account.

You agree not to, and not to permit any user to:

• Use the Services in violation of any applicable law or regulation;
• Attempt to gain unauthorized access to the Services or related systems;
• Interfere with or disrupt the integrity, performance, or security of the platform;
• Upload malicious code, malware, viruses, or harmful content;
• Reverse engineer, decompile, copy, modify, or create derivative works of the Services;
• Use the Services to infringe the intellectual property or privacy rights of others;
• Use the Services for fraudulent, deceptive, or unlawful purposes; or
• Resell, sublicense, or make the Services available to third parties except as expressly permitted.

The Services may include AI-assisted features. Where enabled, these features may produce output that is inaccurate or incomplete, and you are responsible for reviewing output before relying on it. Auditious uses Customer Data only to provide the Services to you and does not use Customer Data to train AI models for other customers. You may be able to disable certain AI features through the Services or by contacting us.

If you provide suggestions, recommendations, or other feedback about the Services, Auditious may use it without restriction or obligation to you.

"Confidential Information" means non-public information disclosed by one party to the other that is designated as confidential or that should reasonably be understood to be confidential given its nature and the circumstances of disclosure.

Each party will protect the other party's Confidential Information using at least reasonable care, will use it only to exercise its rights and perform its obligations under this Agreement, and will not disclose it except to representatives who need to know it and are bound by confidentiality obligations.

Confidential Information does not include information that:

• Is or becomes publicly available through no breach of this Agreement;
• Was lawfully known to the receiving party before disclosure;
• Is independently developed without use of the Confidential Information; or
• Is lawfully received from a third party without a duty of confidentiality.

A party may disclose Confidential Information to the extent required by law or a court or governmental order, provided that, where legally permitted, it gives reasonable prior notice to the other party.

Auditious maintains administrative, technical, and organizational safeguards designed to protect the information processed through the Services, as further described in our Information Security Addendum, which is available on request. No internet-based service can be guaranteed to be completely secure, and you acknowledge the inherent risks of electronic transmission and storage.

Auditious processes personal data in accordance with our Privacy Policy. Where Auditious processes personal data on your behalf, our Data Processing Addendum applies and is available on request at support@auditious.io.

Auditious may engage sub-processors and service providers to help deliver the Services. A current list of sub-processors is available on request. Auditious remains responsible for its sub-processors' performance of the obligations that apply to them.

You are responsible for configuring the Services appropriately and for ensuring you have the rights and a lawful basis for any data you upload. Unless separately agreed in writing, you will not upload regulated or sensitive data, such as protected health information or cardholder data, and you will contact us in advance if you require a Business Associate Agreement or similar arrangement.

Each party represents that it has the authority to enter into this Agreement and to perform its obligations under it.

Auditious warrants that the Services will perform materially in accordance with their documentation during the subscription term. Your exclusive remedy, and Auditious' sole obligation, for breach of this warranty is for Auditious to use commercially reasonable efforts to correct the non-conformity or, if it cannot do so within a reasonable time, to terminate the affected Services and refund any prepaid, unused fees for those Services.

EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. TO THE MAXIMUM EXTENT PERMITTED BY LAW, AUDITIOUS DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, TITLE, ACCURACY, AND UNINTERRUPTED OPERATION. AUDITIOUS DOES NOT WARRANT THAT THE SERVICES WILL GUARANTEE REGULATORY COMPLIANCE, CERTIFICATION, OR AUDIT SUCCESS.

Auditious will defend you against any third-party claim alleging that the Services, as provided by Auditious and used in accordance with this Agreement, infringe that third party's intellectual property rights, and will indemnify you for damages finally awarded or agreed in settlement. If the Services become, or Auditious believes they may become, subject to an infringement claim, Auditious may, at its option, procure the right for you to continue using the Services, modify or replace them to make them non-infringing, or terminate the affected Services and refund any prepaid, unused fees. This obligation does not apply to claims arising from Customer Data, your combination of the Services with other products, or your use of the Services in breach of this Agreement.

You will defend and indemnify Auditious and its affiliates, and their officers, directors, and employees, against claims, liabilities, damages, and costs arising from your Customer Data, your use of the Services, your violation of this Agreement or applicable law, or your infringement of third-party rights.

The indemnified party will promptly notify the indemnifying party of the claim, give it sole control of the defense and settlement (provided that a settlement imposing any obligation on the indemnified party requires that party's consent), and provide reasonable cooperation.

This Section states each party's sole liability and exclusive remedy for the third-party claims described in it.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOSS OF DATA, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID BY YOU TO AUDITIOUS DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

The limitations in Sections 9.1 and 9.2 do not apply to your payment obligations, a party's indemnification obligations under Section 8, or a party's breach of its confidentiality obligations, in each case to the extent permitted by applicable law.

The parties agree that these limitations are an essential basis of the bargain and apply regardless of the form of action.

This Agreement, together with any Order Forms and the documents incorporated by reference, is the entire agreement between the parties regarding the Services and supersedes all prior or contemporaneous agreements on that subject. In case of conflict, an Order Form controls, then this Agreement, then the incorporated documents.

Neither party may assign this Agreement without the other party's prior written consent, except that either party may assign it in connection with a merger, acquisition, or sale of substantially all of its assets, on notice to the other party.

This Agreement is governed by the laws of India, without regard to conflict of law principles. The parties submit to the exclusive jurisdiction of the courts of competent jurisdiction in India for any dispute arising out of or relating to this Agreement.

Neither party is liable for delays or failures caused by events beyond its reasonable control, including natural disasters, cyberattacks, governmental actions, labor disputes, internet or utility failures, or acts of war.

Notices under this Agreement must be in writing. Notices to Auditious may be sent to support@auditious.io. Notices to you may be sent to the email address associated with your account.

Each party will comply with applicable export control and economic sanctions laws. You represent that you are not subject to any applicable sanctions or export restriction that would prohibit your use of the Services.

The Services may interoperate with third-party products and integrations that you choose to connect. Auditious does not control and is not responsible for those third-party services, and your use of them may be subject to separate terms.

If any provision of this Agreement is held unenforceable, the remaining provisions remain in effect. A party's failure to enforce a provision is not a waiver. Nothing in this Agreement creates a partnership, agency, or joint venture between the parties.