SAAS SUBSCRIPTION AGREEMENT

Effective: July 1, 2025

SAAS SUBSCRIPTION AGREEMENT

This SaaS subscription agreement (the “Agreement”) is effective on the earlier of the date of (i) the execution of an Order referencing this Agreement; or (ii) Customer’s initial use of the Services (the “Effective Date”), by and between Oasis Security Inc., a company incorporated under the laws of Delaware having its principal place of business at 10 E 33rd St, New York, NY 10016 (“Oasis”) and the entity referenced in the Order (the “Customer”) (each, a “Party” and collectively, the “Parties”). Customer may use the Platform (as defined below) subject to the terms below.

If Customer has purchased the subscription granted hereunder from a partner, reseller or distributor authorized by Oasis (the “Partner”), to the extent there is any conflict between this Agreement and the agreement entered between you and the respective Partner, including any purchase order (the “Partner Order Form”), then, as between Customer and Oasis, this Agreement shall prevail. Any rights granted to you in such Partner Order Form which are not contained in this Agreement, apply only in connection with such Partner. In this case, you must seek redress or realization or enforcement of such rights solely with such Partner and not Oasis.

1. 1. SUBSCRIPTION TERMS

Subscription. Subject to the terms and conditions of this Agreement, Oasis hereby grants Customer, in connection with each Order, a limited, worldwide, non-exclusive, non-transferable, non-sublicensable right and license to remotely access (i.e. on a SaaS basis) and/or use Oasis’ cloud security platform (“Platform”), during the corresponding Subscription Term (as defined below), solely for Customer's internal purposes and in accordance with the subscriptions specified in the applicable Order (the “Subscription”). Unless otherwise indicated, the term “Platform” also includes all revisions, improvements and/or updates and any appliance, user manuals and documentation made available to Customer in connection with the operation of the Platform (the “Documentation”).  

• 1.1 Order. This Agreement governs the procurement of the Subscription and Services being procured by the Customer as set forth in the respective order from (or any other ordering or written document) which references this Agreement or Partner Order (if purchased via Partner( (the “Order”). The Order shall detail any restrictions or limitations, as applicable, in relation to the Subscription and Services, including, but not limited to, the quantity of Identities (as defined under the Order) (the “Identities”). To the extent of any conflict or inconsistency between the terms and conditions of this Agreement and an Order or a Partner Order, this Agreement shall prevail (unless an Order specifically states otherwise). The Platform and any related services provided to Customer and detailed in an Order shall be referred to as the “Services”.

• 1.2 Support. Support and maintenance services are provided according to Oasis’ Service Level Agreement made available on Oasis’ website at www.oasis.security/legal/sla (the “SLA”).

• 1.3 Additional Purchases. In the event Customer wishes, and Oasis agrees, to purchase Additional Identities (“Additional Purchases”), the Additional Purchases shall be coterminous in time with the Subscription Term, and the Subscription Fees for the Additional Identities shall be pro-rated accordingly and invoiced to the Customer.

• 1.4 Excess Usage. Oasis shall, on a monthly basis, review Customer’s average total usage of Identities and whether such usage exceeds the scope set forth in the Order (“Usage Review”). If a Usage Review reveals a rolling 6-month average usage that exceeds the consumption level by more than 10% of the scope specified in the Order, the Subscription Fees will be increased in accordance with the price per Identity specified in the corresponding Order, and Oasis will invoice Customer for the incremental Subscription Fees on a pro rata basis for the remainder of the Subscription Term.

• 1.5 Permitted Users. The Platform may be accessed solely by Customer's employees or service providers who are explicitly authorized by Customer to use the Platform (each, a “Permitted User”). Customer will ensure that the Permitted Users comply with the terms of this Agreement at all times; and shall be fully responsible for any breach of this Agreement by a Permitted User. Unauthorized access or use of the Platform must be immediately reported to Oasis. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control”, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

• 1.6 Prohibited Uses. Except as specifically permitted herein, without the prior written consent of Oasis, Customer must not, and shall not allow any Permitted User or any third party to, directly or indirectly: (i) copy, modify, create derivative works of or distribute any part of the Platform (including by incorporation into its products); (ii) sell, license (or sub-license), lease, assign, transfer, pledge, or share Customer's rights under this Agreement with any third party; (iii) use any “open source” or “copyleft software” in a manner that would require Oasis to disclose the source code of the Platform to any third party; (iv) disclose the results of any testing or benchmarking of the Platform to any third party; (v) disassemble, decompile, reverse engineer or attempt to discover the Platform’s source code or underlying algorithms; (vi) use the Platform in a manner that violates or infringes any rights of any third party; (vii) remove or alter any trademarks or other proprietary notices related to the Platform; (viii) circumvent, disable or otherwise interfere with security-related features of the Platform or features that enforce use limitations; (ix) export, make available or use the Platform in any manner prohibited by applicable laws (including without limitation export control laws); and/or (x) transmit any malicious code (i.e., software viruses, Trojan horses, worms, malware or other computer instructions, devices, or techniques that erase data or programming, infect, disrupt, damage, disable, or shut down a computer system or any component of such computer system) or other unlawful material in connection with the Platform.

1. 2. PAYMENT

1. 2.1 If Customer has purchased the Services directly from Oasis this Section ‎‎2 shall apply.

1. 2.2 Subscription Fees. Customer shall pay Oasis the Subscription fees specified in the Order (the “Subscription Fees”).

1. 2.3 General. Unless expressly stated otherwise in the Order: (a) all Subscription Fees are stated, and payable in US Dollars; (b) all payments under this Agreement are non-refundable, and are without any right of set-off or cancellation; (c) all Subscription Fees are payable, and shall be invoiced, in advance, and shall be paid within thirty (30) days of receipt of invoice; and (d) any amount not paid when due will accrue interest on a daily basis until paid in full, at the lesser of the rate of one and a half percent (1.5%) per month and the highest amount permitted by applicable law.

1. 2.4 Taxes. Amounts payable under this Agreement are exclusive of all applicable sales, use, consumption, VAT, GST, and other taxes, duties or governmental charges, except for taxes based upon Oasis' net income. In the event that Customer is required by any law applicable to it to withhold or deduct taxes for any payment under this Agreement, then the amounts due to Oasis shall be increased by the amount necessary so that Oasis receives and retains, free from liability for any deduction or withholding, an amount equal to the amount it would have received had Customer not made any such withholding or deduction.

If Customer purchased the subscription via a Partner, the Services are subject to the full payment of the applicable fees as set forth in the Partner Order Form.

1. 3. OWNERSHIP

1. 3.1 Oasis Materials. Oasis (and/or its licensors, as applicable) is, and shall be, the sole and exclusive owner of all right, title and interest (including without limitation all intellectual property rights) in and to: (a) the Platform and all related intellectual property (such as content appearing therein); (b) any feedback, suggestions, or ideas for or about the Platform (collectively, “Feedback”); and (c) any and all improvements, derivative works, and/or modifications of/to any of the foregoing.

1. 3.2 Customer Data. As between the Parties, Customer owns and retains all right, title and interest (including all intellectual property rights) in and to any data or information that originates, resides on, is otherwise processed through or derived from Customer’s systems and processed by Oasis in the provision of the Services (the “Customer Data”). Customer shall be solely responsible for the legality, reliability, integrity, accuracy and quality of all Customer Data. Customer hereby grants to Oasis a non-exclusive, worldwide, royalty free right to use Customer Data solely to the extent necessary to perform its obligations under this Agreement. To the extent Customer Data contains any personally identifiable information, Customer warrants and represents that it has provided all appropriate notices, received the required consents or permits and/or have any and all ongoing legal bases, and has acted in compliance with applicable privacy laws and regulations, as to allow Oasis to use the Customer Data to perform the Services in accordance with this Agreement. To the extent applicable, the Parties shall comply with Oasis’ Data Processing Agreement (the “DPA”), which is available at https://www.oasis.security/legal/dpa and forms an integral part of this Agreement.

1. 3.3 Analytic Data. Any anonymous information, which is derived from the use of the Platform (i.e., metadata, aggregated and/or analytics information and/or intelligence relating to the operation, support, and/or Customer’s use, of the Platform) which is not personally identifiable information and which does not identify Customer (“Analytics Information”) may be used for providing the Service, for development, and/or for statistical purposes. The Analytics Information shall be deemed as Oasis’ exclusive property.

1. 4. CONFIDENTIALITY

Each Party and/or its Affiliates (the "Recipient") may have access to certain non-public or proprietary information and materials of the other Party and/or its Affiliates (the "Discloser"), whether in tangible or intangible form ("Confidential Information"). Confidential Information includes, without limitation: (a) any information related to Discloser’s business, such as cost data, pricing methodologies, price lists, business plans and opportunities, marketing plans, financial and accounting information, forecasts and valuations, market share data, sales volumes, discounts, and budgets; (b) information relating to actual or potential customers, suppliers, products and services; and (c) technical data, computer programs and software code (including firmware and source code), ideas, inventions, algorithms, know-how, analyses, specifications, processes, techniques, formulas, designs and drawings, architectures, and other technology and intellectual property. Customer acknowledges that the Platform embodies Confidential Information of Oasis. Confidential Information shall not include information and material which: (a) at the time of disclosure by Discloser to Recipient hereunder, is in the public domain; (b) after disclosure by Discloser to Recipient hereunder, becomes part of the public domain through no fault of the Recipient; (c) was rightfully in the Recipient's possession at the time of disclosure by the Discloser hereunder, and which is not subject to prior continuing obligations of confidentiality; (d) is rightfully disclosed to the Recipient by a third party having the lawful right to do so; or (e) independently developed by the Recipient without use of, or reliance upon, Confidential Information received from the Discloser. The Recipient shall not disclose or make available the Discloser's Confidential Information to any third party (including without limitation by way of publishing), except to its employees, contractors, advisers, agents and investors, subject to substantially similar written confidentiality undertakings. Recipient shall take commercially reasonable measures, at a level at least as protective as those taken to protect its own Confidential Information of like nature (but in no event less than a reasonable level), to protect the Discloser's Confidential Information within its possession or control, from disclosure to a third party. The Recipient shall use the Discloser's Confidential Information solely for the purposes expressly permitted under this Agreement. In the event that Recipient is required to disclose Confidential Information of the Discloser pursuant to any law, regulation, or governmental or judicial order, the Recipient will (a) promptly notify Discloser in writing of such law, regulation or order, (b) reasonably cooperate with Discloser in opposing such disclosure, (c) only disclose to the extent required by such law, regulation or order (as the case may be). Upon termination of this Agreement, or otherwise upon written request by the Discloser, the Recipient shall promptly return to Discloser its Confidential Information (or if embodied electronically, permanently erase it), and certify such compliance writing.

1. 5. PERFORMANCE WARRANTY AND DISCLIAMER

Oasis warrants to the Customer that the Platform shall operate substantially in accordance with the material functions and features set out in the applicable Documentation (the “Warranty”). The Customer's sole and exclusive remedy and Oasis' sole liability for breach of this warranty, shall be to use commercially reasonable efforts to repair the Platform and, if Oasis cannot do so within a reasonable time, not to exceed 30 days, Customer may terminate this Agreement and receive a pro-rata refund of any amounts pre-paid by Customer for the remaining unused period of the Subscription Term.  The Warranty shall not apply if the failure of the Platform results from or is otherwise attributable to: (i) repair, maintenance or modification of the Platform by persons other than Oasis or its authorized contractors; (ii) accident, negligence, abuse or misuse of the Platform by Customer or its Permitted Users; (iii) use of the Platform other than in accordance with the Platform's Documentation; and/or (iv) the combination of the Platform with equipment or software not authorized or provided by Oasis. Oasis shall not be liable for any inaccuracy in the Service's output and/or delay and/or unavailability of the Platform, caused due to (a) failure of Customer's Internet access or any public telecommunications network, shortage of adequate power or transportation facilities, (b) any incompatibility between the Customer's systems and the Platform appliance and/or (c) maintenance of the Customer's systems affecting the operation of the Platform. EXCEPT AS OTHERWISE EXPLICITLY STATED IN THIS AGREEMENT, TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE PLATFORM, ITS RELATED SERVICES AND ANY OUTPUT RESULTED FROM THE USE OF THE PLATFORM ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS, AND ALL EXPRESS, IMPLIED AND STATUTORY CONDITIONS AND WARRANTIES (INCLUDING WITHOUT LIMITATION ANY IMPLIED CONDITIONS OR WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET POSSESSION, NON-INFRINGEMENT, OR QUALITY OF SERVICE, OR THAT OTHERWISE ARISE FROM A COURSE OF PERFORMANCE OR USAGE OF TRADE) ARE HEREBY DISCLAIMED BY OASIS AND ITS LICENSORS.

1. 6. LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

1. 6.1 EXCEPT FOR BREACHES OF CONFIDENTIALITY UNDER SECTION 4 (CONFIDENTIALITY), OASIS’ INDEMNIFICATION OBLIGATIONS UNDER SECTION ‎‎7, AND/OR LIABILITY ARISING FROM EITHER PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, IN NO EVENT SHALL EITHER PARTY, ITS AFFILIATES, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR ANY LOSS OF REVENUE, ANY CONSEQUENTIAL, INDIRECT, SPECIAL, INCIDENTAL, OR PUNITIVE DAMAGES.

1. 6.2 EXCEPT FOR BREACHES OF CONFIDENTIALITY UNDER SECTION 4 (CONFIDENTIALITY), OASIS’ INDEMNIFICATION OBLIGATIONS UNDER SECTION ‎‎7, AND/OR LIABILITY ARISING FROM EITHER PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT THE COMBINED AGGREGATE LIABILITY OF EITHER PARTY, ITS AFFILIATES, OR LICENSORS UNDER, OR OTHERWISE IN CONNECTION WITH, THIS AGREEMENT SHALL NOT EXCEED THE AMOUNT ACTUALLY PAID BY CUSTOMER TO OASIS UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE DATE GIVING RISE TO LIABILITY.

1. 7. INDEMNIFICATION

1. 7.1 Oasis agrees to defend, at its expense, any third party action or suit brought against the Customer alleging that the Platform, when used as permitted under this Agreement, infringes intellectual property rights of a third party (“Infringement Claim”); and Oasis will pay any damages awarded in a final judgment against the Customer that are attributable to any such claim, or that are otherwise agreed in a settlement with the prior written consent of Oasis, provided that (i) the Customer promptly notifies Oasis in writing of such claim; (ii) the Customer grants Oasis the sole authority to handle the defense or settlement of any such claim and provides Oasis with all reasonable information and assistance at Oasis’ expense; and (iii) Customer refrains from admitting any liability or otherwise compromising the defense in whole or in part, without the express prior written consent of Oasis. Oasis will not be bound by any settlement that the Customer enters into without Oasis' prior written consent.

1. 7.2 Oasis will have no liability under this Section (Indemnification) to the extent that the Infringement Claim is based on or results from: (i) modifications to the Platform made by a party other than Oasis; (ii) the Customer's failure to implement software updates provided by Oasis specifically to avoid infringement; or (iii) combination or use of the Platform with equipment, devices or software not supplied by Oasis or not in accordance with the Documentation.

1. 7.3 Should the Platform (in whole or in part) become, or in Oasis’ opinion be likely to become, the subject of an Infringement Claim, then Customer permits Oasis, at Oasis’  option and expense, to either: (x) obtain for Customer the right to continue using the Platform (or part thereof); or (y) replace or modify the Platform (or part thereof) so that it's use hereunder becomes non-infringing; provided, however, that if (x) and (y) are not, in Oasis' opinion, commercially feasible, Oasis may terminate this Agreement upon written notice to Customer and Customer shall be entitled to receive a pro-rated refund of any prepaid Subscription Fees hereunder based on the remaining period of the then-current Subscription Term.

1. This Section represents Oasis' sole obligation and liability, and Customer's sole remedy, for any Infringement Claim.

1. 8. TERM AND TERMINATION

1. 8.1 Term. This Agreement commences on the Effective Date and, unless terminated in accordance herewith, shall continue in full force and effect for the duration specified in the Order (“Initial Subscription Term”).

Upon expiration of the Initial Subscription Term, the Initial Subscription Term shall automatically renew for successive periods of equal length, unless terminated earlier as set forth herein and/or either Party provides the other Party with at least a sixty (60) days' prior written notice of non-renewal (each a “Renewal Subscription Term” (if applicable), and together with the Initial Subscription Term, the “Subscription Term”). The Subscription Fees will be automatically increased for each Renewal Subscription Term by the greater of: (i) five percent (5%) or (ii) the increase in the Consumer Price Index (CPI).

1. 8.2 Termination for Breach.  Each Party may terminate this Agreement immediately upon written notice to the other Party if the other Party commits a material breach under this Agreement and, if curable, fails to cure that breach within sixty (60) days after receipt of written notice specifying the material breach (except that for payment defaults, such cure period will be seven (7) days).

1. 1. 8.3
2. Termination for Bankruptcy.  Each Party may terminate this Agreement upon written notice to the other Party upon the occurrence of any of the following events in respect of such other Party: (a) a receiver is appointed for the other Party or its property, which appointment is not dismissed within sixty (60) days; (b) the other Party makes a general assignment for the benefit of its creditors; (c) the other Party commences, or has commenced against it, proceedings under any bankruptcy, insolvency or debtor’s relief law, which proceedings are not dismissed within sixty (60) days; or (d) the other Party is liquidating, dissolving or ceasing normal business operations.

1. 8.4 Effect of Termination; Survival. Upon termination of this Agreement for any reason: (a) the Subscription shall automatically terminate; (b) Customer shall cease all access and use of the Platform; and (c) Customer shall pay any outstanding Fees and other charges that accrued as of termination, which become immediately due and payable, and, if necessary Oasis shall issue a final invoice therefor. Sections 3 (Ownership) through 9 (Miscellaneous) (but excluding 5 (Performance Warranty)) shall survive termination of this Agreement, as shall any right, obligation or provision that is expressly stated to so survive or that ought by its nature to survive. Termination shall not affect any rights and obligations accrued as of the effective date of termination.

1. 9. MISCELLANEOUS

1. 9.1 Entire Agreement and Amendments. This Agreement represents the entire agreement of the Parties with respect to the subject matter hereof, and supersedes and replaces all prior and contemporaneous oral or written understandings and statements by the Parties with respect to such subject matter. Without limiting the generality of the foregoing, this Agreement supersedes any terms or conditions (whether printed, hyperlinked, or otherwise) in any Customer's purchase order or other standardized business forms, which purport to supersede, modify or supplement this Agreement. This Agreement may only be modified or supplemented by a written instrument duly signed by each Party. The section and subsection headings used in this Agreement are for convenience of reading only. This Agreement may be executed in any number of counterparts (including digitally, electronically scanned and e-mailed PDF copies, and any similarly signed and electronically or digitally transmitted copies) each of which will be considered an original, but all of which together will constitute one and the same instrument.

1. 9.2 Assignment. This Agreement may not be assigned by either Party, in whole or in part, without the other Party’s prior express written consent; except that this Agreement may be assigned by either Party in connection with a merger, consolidation, sale of all of the equity interests of the Party, or a sale of all or substantially all of the assets of the Party to which this Agreement relates. Subject to the provisions of this Section (Assignment), this Agreement will bind and benefit each Party and its respective successors and assigns.

1. 9.3 Governing Law; Jurisdiction. This Agreement shall be governed by and construed under the laws of the State of New York, without reference to principles and laws relating to the conflict of laws. The competent courts of New York, NY shall have the exclusive jurisdiction with respect to any dispute and action arising under or in relation to this Agreement. Notwithstanding the foregoing, Oasis may seek injunctive or other equitable relief in any court of competent jurisdiction worldwide.

1. 9.4 Customer Reference. Unless stated otherwise in an Order, Customer hereby grants Oasis a revocable right and license to: (a) use Customer’s name to identify Customer as a customer of Oasis on Oasis’ websites, presentations, marketing materials or otherwise (collectively, “Marketing Materials”); and/or (b) Customer’s logo to identify Customer as customer of Oasis, in Oasis’ Marketing Materials. Without derogating from the foregoing, following the deployment of the Services, Customer hereby agrees to participate in a case study about Oasis and its Services which may be published by Oasis in its Marketing Materials.

1. 9.5 Waiver and Remedies. No failure or delay on the part of either Party in exercising any right or remedy hereunder will operate as a waiver thereof, nor will any single or partial exercise of any such right or remedy preclude any other or further exercise thereof, or the exercise of any other right or remedy. Any waiver granted hereunder must be in writing, duly signed by the waiving Party, and will be valid only in the specific instance in which given. Except as may be expressly provided otherwise in this Agreement, no right or remedy conferred upon or reserved by either Party under this Agreement is intended to be, or will be deemed, exclusive of any other right or remedy under this Agreement, at law, or in equity, but will be cumulative of such other rights and remedies.

1. 9.6 Relationship. The relationship of the Parties is solely that of independent contractors, neither Party nor its employees are the servants, agents, or employees of the other, and no exclusivities arise out of this Agreement. Nothing in this Agreement shall be construed to create a relationship of employer and employee, principal and agent, joint venture, partnership, association, or otherwise between the Parties. Neither Party has any authority to enter into agreements of any kind on behalf of the other Party and neither Party will create or attempt to create any obligation, express or implied, on behalf of the other Party.

1. 9.7 Force Majeure. Oasis will not be liable for any delay or failure to provide the Service resulting from circumstances or causes beyond the reasonable control of Oasis including, but not limited to on account of strikes, shortages, riots, insurrection, fires, flood, storms, acts of God, war, government or quasi-governmental authorities actions, riot, acts of terrorism, earthquakes, explosions, power outages, pandemic or epidemic (or similar regional health crisis), or any other cause that is beyond the reasonable control of Oasis.

1. 9.8 Notices. All notices or other communications provided for in connection with this Agreement shall be in writing and shall be given in person, by courier, email, or by registered or certified mail, postage prepaid, addressed as set forth in the Order. All notices and other communications delivered in person or by courier service shall be deemed to have been given as of one business day after sending thereof, those given by facsimile transmission with confirmation or receipt shall be deemed to have been given as of the date of transmission thereof (provided that such date is a business day in the country of receipt and if not, the next business day), and all notices and other communications sent by registered mail shall be deemed given three (3) days after posting. Notices sent by email shall be deemed received upon receipt of such email.

‍