Proprietary Commercial Software License Agreement

1. Copyright Notice

1.1 Scope of Copyright Protection

The CAI-AUTH software suite, including without limitation its source code, object code, binary distributions, compiled artefacts, build scripts, continuous-integration configurations, cryptographic test vectors, protocol specifications, architectural diagrams, user-interface layouts, iconography, graphical assets, documentation, marketing collateral, and accompanying files (collectively, the "Protected Works") are original literary and artistic works protected under:

1. Romanian Law No. 8/1996 on Copyright and Neighbouring Rights (Legea drepturilor de autor și a drepturilor conexe), as amended;
2. Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society;
3. Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs;
4. Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market;
5. the Berne Convention for the Protection of Literary and Artistic Works (Paris Act, 1971);
6. the WIPO Copyright Treaty (1996); and
7. any other applicable international treaty or domestic copyright law extending protection to the Protected Works.

1.2 Reservation of Rights

All rights in and to the Protected Works not expressly granted under this Agreement are reserved by the Licensor. No right, title, or interest in the Protected Works is transferred, conveyed, or assigned to the Licensee by reason of this Agreement. The Licensee acknowledges that the Protected Works constitute valuable intellectual property of the Licensor, including trade secrets, know-how, and patentable subject matter.

1.3 Jurisdiction of Original Authorship

The Protected Works were first created, fixed in a tangible medium of expression, and first published in Romania. For the purposes of determining the country of origin under Article 5(4) of the Berne Convention, Romania is the country of origin of the Protected Works, and Romanian copyright law governs questions of authorship, original ownership, duration of protection, and moral rights, subject to the rules of private international law.

2. Definitions

In this License Agreement (the "Agreement"), unless the context otherwise requires, the following capitalised terms shall have the meanings set forth below. Defined terms used in the singular include the plural and vice versa; words denoting any gender include all genders; and references to statutes or regulations include any successor enactments and any subordinate legislation made thereunder.

1. "Affiliate" means, with respect to any Person, any other Person that directly or indirectly controls, is controlled by, or is under common control with such Person, where "control" means the ownership of more than fifty percent (50%) of the voting equity interests or the power to direct the management or policies of such Person, whether through ownership of voting securities, by contract, or otherwise.
2. "Authorized User" means an individual natural person, whether an employee, contractor, consultant, or agent of the Licensee or an Affiliate thereof, who is expressly authorized by the Licensee to access and use the Software pursuant to the applicable licensing tier and who has agreed in writing or by click-through to be bound by terms no less protective of the Licensor than those set forth in this Agreement.
3. "Commercial Use" means any use of the Software in connection with the production of goods, the provision of services, the generation of revenue (whether direct or indirect), the support of any for-profit business operation, or any activity undertaken for pecuniary gain or commercial advantage, irrespective of whether fees are charged to End Users of the Licensee.
4. "Confidential Information" means any non-public technical, business, financial, or operational information disclosed by one party to the other, whether in oral, written, electronic, or any other form, that is marked or identified as confidential or that a reasonable Person would understand to be confidential given its nature and the circumstances of disclosure, including without limitation the Source Form of the Software, cryptographic keys, security architecture documentation, unpublished roadmaps, pricing, and customer lists.
5. "Contribution" means any source code, object code, documentation, design, idea, suggestion, feedback, bug report, error report, feature request, benchmark, test vector, or other creative or technical material submitted by or on behalf of the Licensee to the Licensor in connection with the Software, through any channel whatsoever, including without limitation pull requests, merge requests, electronic mail, issue trackers, community forums, live chat, or in-person meetings.
6. "Deployment" means the installation, configuration, orchestration, or operation of the Software, in whole or in part, on any computing infrastructure, whether physical, virtual, containerised, serverless, edge-computed, or otherwise, and whether owned, leased, or rented by the Licensee.
7. "Derivative Work" means any work based upon, derived from, incorporating, or adapted from the Software or any portion thereof, including translations, modifications, revisions, condensations, expansions, annotations, elaborations, port­ings to other platforms or languages, reimplementations of protocols, or any other form in which the Software may be recast, transformed, or adapted, as such term is understood under Romanian Law No. 8/1996 and the Berne Convention.
8. "Distribution" means the making available of the Software or any portion thereof to any third party, whether by transmission, transfer, provision of access, hosting, mirroring, proxying, packaging, bundling, pre-loading, or any other means, and whether for consideration or gratuitously.
9. "Documentation" means the user manuals, administrator guides, API references, protocol specifications, compliance documents, deployment runbooks, release notes, tutorials, white papers, and other technical or descriptive materials made available by the Licensor in respect of the Software, whether in printed, electronic, or online form.
10. "End User" means a natural person who interacts with any service, application, platform, product, or system operated by the Licensee in which the Software is deployed, whether or not such natural person is aware of the presence of the Software.
11. "Evaluation" means the internal, non-production testing, benchmarking, functional exploration, and compatibility assessment of the Software by the Licensee for the sole purpose of determining whether to enter into a Commercial Tier licensing arrangement with the Licensor.
12. "Feedback" has the meaning set out in Section 10.
13. "Intellectual Property Rights" means all intellectual and industrial property rights of any kind whatsoever throughout the world, whether registered or unregistered, and all applications for and rights to apply for the same, including without limitation copyrights and related rights, patent rights (including rights in inventions, utility models, and supplementary protection certificates), trade mark rights (including rights in service marks, trade names, and domain names), design rights, database rights (including rights under the sui generis database protection regime of Directive 96/9/EC), trade secret rights, rights in know-how, rights in confidential information, moral rights, and all other proprietary rights recognised by any applicable law.
14. "Licensee" or "You" means the individual natural person, legal entity, public authority, agency, or other organisation exercising rights under this Agreement, together with its Affiliates to the extent expressly permitted herein.
15. "Licensor" means CAI Technology SRL, a limited liability company (societate cu răspundere limitată) organised and existing under the laws of Romania, having its registered office at Str. Victor Brauner 34, Bucharest, Romania, represented by its founder and sole administrator Mr. Gelu Constantin, including its successors, assignees, and permitted transferees.
16. "Object Form" means the form of the Software resulting from mechanical transformation or translation of a Source Form, including compiled object code, linked binaries, bytecode, container images, mobile application packages, browser extension bundles, and any other non-human-readable executable representation.
17. "Open Source Software" means software distributed under a license approved by the Open Source Initiative or the Free Software Foundation, or otherwise satisfying the Open Source Definition, that grants recipients rights to use, copy, modify, and redistribute the software, typically subject to attribution and/or copyleft requirements.
18. "Person" means any natural person, legal entity, partnership, joint venture, association, trust, estate, public authority, or other organisation, whether or not having separate legal personality.
19. "Production Use" means any use of the Software that is not Evaluation, including any Deployment serving real End Users, processing real authentication events for commercial or operational purposes, or otherwise supporting the Licensee's business activities.
20. "Proprietary Information" means Confidential Information together with any other information, know-how, or trade secrets of the Licensor that derives independent economic value, actual or potential, from not being generally known to and not being readily ascertainable through proper means by other Persons who can obtain economic value from its disclosure or use.
21. "Redistribution" means the Distribution of the Software, whether or not modified, to any Person other than an Authorized User of the Licensee, and specifically including, without limitation, Distribution in the form of Object Form embedded in another software product.
22. "Services" means any hosted service, support service, professional service, or managed offering provided by the Licensor from time to time in relation to the Software, including the authentication service operated at https://auth.caitech.ro.
23. "Software" means CAI-AUTH (Cipher AI Authenticator), a post-quantum multi-factor authentication platform comprised of: (a) the Rust-language server component known as cai-auth-server; (b) the Rust-language core cryptographic library known as cai-auth-core; (c) the Android client application written in Kotlin with native JNI FFI bindings; (d) the Chrome browser extension built against Manifest V3; (e) the Python software development kit known as cai-auth-sdk; (f) all Updates thereto; (g) all Documentation; and (h) all configuration templates, compliance artefacts, supply-chain attestations, and auxiliary assets distributed therewith.
24. "Source Form" means the preferred form of the Software for making modifications to it, including all source files, configuration files, build scripts, and any associated documentation necessary to compile, assemble, link, or otherwise transform the Software into Object Form.
25. "Third-Party Components" means Open Source Software and other software or materials incorporated in or distributed together with the Software, the use of which is governed by the license terms of the respective third-party licensors, as further described in Section 11.
26. "Updates" means any updates, upgrades, bug fixes, security patches, service packs, new versions, enhancements, or modifications to the Software that are released or otherwise made available by the Licensor from time to time during the term of this Agreement, whether labelled as major or minor releases.

3. Grant of License — Evaluation Tier

3.1 Scope of Evaluation Grant

Subject to the Licensee's full and continuing compliance with the terms and conditions of this Agreement, the Licensor hereby grants to the Licensee a limited, personal, non-exclusive, non-transferable, non-sublicensable, worldwide, revocable, royalty-free license, for a period not to exceed sixty (60) consecutive calendar days commencing on the date of first installation or first access (the "Evaluation Period"), to:

1. install, execute, and operate one (1) single instance of the Software in Object Form on computing infrastructure lawfully controlled by the Licensee;
2. use the Software solely for internal Evaluation purposes, including functional testing, performance benchmarking, compatibility assessment with the Licensee's existing systems, and feasibility analysis in support of a prospective Commercial Tier engagement;
3. reproduce the Documentation in reasonable quantities solely for the internal use of the Licensee's Authorized Users engaged in the Evaluation; and
4. observe, study, and test the functioning of the Software solely to the extent permitted by Article 5(3) of Directive 2009/24/EC.

3.2 Evaluation Restrictions

The Evaluation Tier is expressly conditioned on the following:

1. no Production Use of any kind is permitted, and the Software shall not be used to process authentication events for any End User other than internal testing accounts under the direct control of the Licensee;
2. no Commercial Use of any kind is permitted, and the Licensee shall not charge fees, derive revenue, or obtain other commercial advantage from operation of the Software during the Evaluation Period;
3. no Redistribution of any kind is permitted, and the Software shall not be made available to Persons other than the Licensee's Authorized Users;
4. attribution to the Licensor shall be retained in all copies of the Software, and no proprietary notices shall be removed, obscured, or altered;
5. the Licensee shall, upon reasonable request of the Licensor, provide good-faith feedback regarding performance, compatibility, and usability observed during the Evaluation, subject always to the Feedback licence set out in Section 10;
6. upon expiry of the Evaluation Period, the Licensee shall either execute a Commercial Tier licensing agreement with the Licensor or promptly cease all use of the Software and destroy or return all copies thereof in accordance with Section 21; and
7. the Licensor shall have no obligation to provide any support, maintenance, Updates, service-level commitments, or indemnities in respect of the Evaluation Tier.

4. Grant of License — Developer Tier

4.1 Scope of Developer Grant

Subject to the Licensee being a natural person acting in a personal, non-commercial capacity, and subject further to the Licensee's full and continuing compliance with this Agreement, the Licensor hereby grants to such Licensee a personal, non-exclusive, non-transferable, non-sublicensable, worldwide, revocable, royalty-free license to:

1. install, execute, and operate the Software on computing infrastructure owned or lawfully controlled by the Licensee, solely for personal, non-commercial software development, experimentation, learning, hobbyist projects, and academic study;
2. modify the Source Form of the Software and prepare Derivative Works for the Licensee's own personal development purposes, provided that such Derivative Works are not Distributed, deployed for Commercial Use, or used to serve more than fifty (50) End Users in aggregate at any time;
3. make such backup copies of the Software as are reasonably necessary for personal development use, provided that each backup copy retains all proprietary notices of the Licensor; and
4. publish, on a personal blog or public code repository, short excerpts of the Licensee's Derivative Works (not exceeding twenty (20) lines per excerpt and not cumulatively comprising a material portion of the Software) solely for the purpose of educational discussion, provided that such excerpts are accompanied by a clear statement of the Licensor's copyright and that the Software is proprietary and is used under this Developer Tier.

4.2 Developer Tier Exclusions

The Developer Tier licence expressly does NOT permit, and the Licensee shall not under any circumstances:

1. deploy the Software in any environment processing payment card data regulated under PCI-DSS 4.0.1;
2. deploy the Software in any environment processing protected health information regulated under HIPAA, the HITECH Act, or any equivalent national health-data regulation;
3. deploy the Software in any environment operated by, or on behalf of, any governmental, military, defence, or intelligence authority, regardless of jurisdiction;
4. deploy the Software in any environment subject to DORA (Regulation (EU) 2022/2554), PSD3, or any other regulation governing financial-market infrastructure or critical infrastructure, unless and until a Commercial Tier or Government/Defence Tier licence has been executed;
5. serve more than fifty (50) End Users in aggregate across all Deployments operated by the Licensee under the Developer Tier;
6. Redistribute the Software, whether in Source Form or Object Form, to any Person; or
7. use the Software for any Commercial Use, including as a component of any product or service for which the Licensee or any third party charges fees or otherwise obtains commercial advantage.

5. Grant of License — Commercial Tier

5.1 Scope of Commercial Grant

The Commercial Tier licence is granted exclusively pursuant to a separate written commercial agreement executed by duly authorised representatives of the Licensor and the Licensee (a "Commercial Order Form"). The Commercial Order Form shall specify, without limitation:

1. the maximum number of Authorized Users, End Users, authentication events per unit of time, or other agreed usage metric;
2. the permitted Deployment regions, data-residency requirements, and any applicable sovereignty constraints;
3. the fees, payment terms, invoicing cadence, currency, and applicable taxes;
4. the initial term and any renewal mechanics;
5. the service-level agreement (SLA) applicable to Services, including uptime commitments, response-time targets, and credit mechanisms;
6. any professional-services statements of work;
7. any agreed-upon enhancements to the indemnity, liability cap, or warranty provisions of this Agreement; and
8. any security, privacy, compliance, and audit obligations specific to the Licensee's industry or regulatory environment.

5.2 Order of Precedence

In the event of a conflict between the terms of this Agreement and the terms of an executed Commercial Order Form, the terms of the Commercial Order Form shall prevail with respect to the specific subject matter addressed therein, and this Agreement shall otherwise continue to apply in full force and effect. Purchase orders, invoices, acknowledgements, and similar administrative documents issued by either party shall have no legal effect beyond the identification of goods or services and the payment of fees, and any conflicting pre-printed terms therein are expressly rejected.

5.3 Rights Granted under Commercial Tier

Upon execution of a Commercial Order Form and receipt by the Licensor of the applicable fees, the Licensor grants to the Licensee a non-exclusive, non-transferable, non-sublicensable (except as expressly permitted in the Commercial Order Form), revocable licence to install, configure, operate, and integrate the Software in Object Form in the Licensee's Production Use environment, subject to the metrics and restrictions set forth in the Commercial Order Form and this Agreement.

6. Grant of License — Government and Defence Tier

6.1 Scope and Pre-Conditions

No licence to use, install, or operate the Software in any capacity for, by, or on behalf of any governmental, military, defence, intelligence, law-enforcement, border-control, or homeland-security authority shall be effective unless and until a separate written agreement has been executed by duly authorised representatives of the Licensor and the relevant authority (a "Government Tier Agreement"). Without limiting the foregoing, the Government Tier Agreement shall address:

1. the specific NATO member state, European Union member state, or other jurisdiction in which Deployment will occur;
2. the classification level (e.g., NATO RESTRICTED, EU RESTRICTED, NATIONAL CONFIDENTIAL, SECRET, or equivalents) at which the Software will be processed, with a clear acknowledgement by the authority that the Software has not, as of the Effective Date, undergone formal accreditation at any classification level and that any reliance placed upon the Software at such classification levels is subject to the authority's own accreditation processes;
3. the authorisation, if any, for air-gapped, sovereign-cloud, on-premises, or otherwise offline Deployment, which shall be permissible only pursuant to an executed amendment to this Agreement explicitly identifying the air-gapped site(s), the responsible site-security officer, and the permitted duration;
4. the specific disclosure, accurate as of the date of the Government Tier Agreement, of the Software's cryptographic certification status under FIPS 140-3, Common Criteria (ISO/IEC 15408), EU Cybersecurity Certification Schemes established pursuant to Regulation (EU) 2019/881, and any other applicable certification regime, including any components for which validation is pending or has not been sought;
5. provisions governing export control, technology transfer, foreign ownership control and influence (FOCI), and any applicable Transatlantic Data Privacy Framework instruments;
6. source-code escrow, where required, with an independent escrow agent acceptable to both parties; and
7. any additional indemnities, warranties, and liability allocations required by the authority's procurement rules.

6.2 No Implied Governmental Licence

Notwithstanding any provision of this Agreement to the contrary, no use of the Software by any Person for, by, or on behalf of any governmental authority may be inferred, constructed, or deemed to arise from the Evaluation Tier, the Developer Tier, or any Commercial Tier Order Form not specifically identified as a Government Tier Agreement. Any such unauthorised governmental use shall constitute a material breach of this Agreement and may additionally contravene export-control, sanctions, or national-security laws applicable to both parties.

7. Restrictions on Use

The Licensee shall not, and shall not permit, authorise, assist, facilitate, or encourage any Authorized User or any third party to, directly or indirectly, undertake any of the following acts in respect of the Software:

1. reverse-engineer, decompile, disassemble, de-obfuscate, decrypt, or otherwise attempt to discover, derive, or reconstruct the Source Form, algorithms, protocol state machines, data structures, cryptographic constants, internal APIs, or other non-public elements of the Software, except and solely to the minimum extent that such acts cannot lawfully be prohibited and are expressly mandated by Article 6 of Directive 2009/24/EC on the legal protection of computer programs (the "Interoperability Carve-Out"), and provided further that (a) the information sought is not already available to the Licensee, (b) the acts are confined to the parts of the Software necessary to achieve interoperability, (c) the information is not used for any purpose other than to achieve the interoperability of an independently created computer program, and (d) the information is not disclosed to third parties except as necessary for such interoperability, and is not used for the development, production, or marketing of a computer program substantially similar in expression to the Software or for any other act which infringes copyright;
2. remove, alter, conceal, obscure, deface, overlay, or render less visible any copyright notice, trade mark, service mark, trade name, patent notice, security classification, version string, build identifier, or other proprietary designation contained in or on the Software, the Documentation, or the Services;
3. use the Software, or any Confidential Information obtained through use of the Software, to design, develop, market, or distribute any product or service that competes with the Software, the Services, or the Licensor's business, whether in the field of authentication, identity management, post-quantum cryptography, multi-factor authentication, hardware-bound credentials, behavioural biometrics, or otherwise;
4. use the Software, the Documentation, any Confidential Information, or any output thereof as training data, fine-tuning data, prompt data, evaluation data, or distillation data for any machine-learning model, large language model, diffusion model, foundation model, or other artificial-intelligence system, nor to create embeddings, vector representations, or other derived datasets for any such purpose;
5. sublicense, re-license, rent, lease, lend, time-share, sell, resell, transfer, assign, pledge, encumber, or otherwise transfer or make available the Software or any rights thereto to any Person without the prior express written consent of the Licensor;
6. engage in the unauthorised removal, disablement, bypassing, circumvention, or defeat of any licence-enforcement mechanism, telemetry check, time-limited trial control, signature-verification routine, integrity-protection mechanism, tamper-detection routine, "time-bomb" expiry check, kill-switch, feature-flag gating mechanism, or other technical protection measure included in the Software;
7. Distribute the Software through any unauthorised channel, including without limitation peer-to-peer networks, warez sites, grey-market resellers, unauthorised app stores, clandestine marketplaces, or any medium that facilitates the unauthorised reproduction of proprietary software;
8. use the Software to engage in, facilitate, or conceal any unlawful activity, including but not limited to unauthorised access to computer systems, fraud, money laundering, terrorist financing, sanctions evasion, or the creation or distribution of malware;
9. use the Software in any life-safety-critical, medical-life-support, nuclear-facility-control, aviation-control, autonomous-weapons, or other application where failure of the Software could reasonably be expected to result in death, personal injury, severe environmental damage, or large-scale property destruction, unless and until a Government/Defence Tier Agreement expressly authorising such use has been executed;
10. use the Software in violation of any applicable law, regulation, or binding industry code of conduct, including without limitation data-protection laws, telecommunications laws, financial-services regulations, consumer-protection laws, export-control laws, and sanctions regimes;
11. Distribute, publish, or make public any benchmark results, competitive analysis, performance evaluation, or security-assessment report concerning the Software without the Licensor's prior written consent, which consent shall not be unreasonably withheld for bona fide academic publications subject to reasonable review;
12. attempt to identify or exploit any security vulnerability in the Software other than through the Licensor's coordinated-disclosure channel at tehnic@caitech.ro, and the Licensee shall at no time publicly disclose any unremediated vulnerability without the Licensor's prior written consent or the expiry of a commercially reasonable embargo period, save where such restriction would be unlawful under applicable whistleblower-protection law.

8. Reservation of Rights

All rights not expressly granted to the Licensee under this Agreement are reserved by the Licensor. Without limiting the generality of the foregoing, no licence is granted, whether by implication, exhaustion, estoppel, waiver, acquiescence, course of dealing, course of performance, usage of trade, or otherwise, in respect of:

1. any patent, patent application, utility model, design right, or other industrial-property right of the Licensor, except as and to the extent expressly set forth in Section 12;
2. any trade mark, service mark, trade name, logo, trade dress, or other brand identifier of the Licensor;
3. any Source Form of the Software, except as specifically permitted under the Developer Tier;
4. any unreleased, experimental, research-stage, or future-roadmap feature or component of the Software; or
5. any Services, Documentation, or ancillary materials except as expressly licensed hereunder.

9. Intellectual Property Rights

9.1 Ownership and Retention

As between the parties, the Licensor owns all right, title, and interest in and to the Software, the Documentation, the Services, all Intellectual Property Rights therein, and all improvements, modifications, and Derivative Works thereof, irrespective of who creates such improvements, modifications, or Derivative Works. The Licensee acquires no ownership interest in the Software under this Agreement.

9.2 Copyright

The Software is protected by copyright as described in Section 1. The Software constitutes an original intellectual creation of its authors as contemplated by Article 1(3) of Directive 2009/24/EC, and is accordingly entitled to full copyright protection.

9.3 Trade Secrets and Know-How

The Software, including without limitation its Source Form, internal protocol design, cryptographic parameter selection, performance-tuning heuristics, deployment topology, and supply-chain attestations, constitutes protectable trade-secret information within the meaning of Directive (EU) 2016/943 of the European Parliament and of the Council on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use, and disclosure, and Romanian Law No. 11/1991 on combating unfair competition. The Licensor has taken and continues to take reasonable steps to maintain the secrecy of such information.

9.4 Patents — Pending Applications

9.5 Trade Marks

"CAI-AUTH", "Cipher AI", "Cipher AI Authenticator", "CAI Technology", "TriFactor Binding", "Action-Visible Confirmation", "Continuous Behavioural Binding", and the associated logos and trade dress are trade marks or unregistered trade marks of the Licensor. The Licensee shall not use, register, or apply to register any of the foregoing marks or any confusingly similar mark in any jurisdiction without the prior express written consent of the Licensor.

10. Ownership and Contributions

10.1 Feedback Licence

If the Licensee or any Authorized User provides to the Licensor any Feedback, including but not limited to bug reports, feature requests, suggestions, comments, benchmarks, test vectors, architectural observations, or similar materials (collectively, "Feedback"), the Licensee hereby irrevocably assigns to the Licensor all right, title, and interest in and to such Feedback worldwide, including all Intellectual Property Rights therein, free of any obligation of compensation, attribution, or accounting. To the extent that any such assignment is unenforceable under applicable law, the Licensee hereby grants to the Licensor a perpetual, irrevocable, worldwide, royalty-free, fully-paid-up, non-exclusive, sublicensable licence to use, reproduce, prepare Derivative Works of, publicly display, publicly perform, distribute, and otherwise exploit the Feedback for any purpose.

10.2 Contributions

If the Licensee submits any Contribution to the Licensor, the Licensee hereby agrees that:

1. the Licensee irrevocably assigns, transfers, and conveys to the Licensor all right, title, and interest worldwide in and to the Contribution, including all Intellectual Property Rights therein, with such assignment taking effect immediately upon submission;
2. the Licensee waives any and all moral rights in respect of the Contribution to the fullest extent permitted by applicable law, and where such waiver is not permitted, covenants not to assert any such moral rights against the Licensor, its successors, licensees, or distributees;
3. the Licensee represents and warrants that it has the full legal right and authority to effect such assignment, that the Contribution is the original creation of the Licensee (or, where the Contribution incorporates third-party material, that such material is clearly identified and is available under a licence compatible with the Licensor's proprietary distribution model), and that the Contribution does not infringe upon any Intellectual Property Right of any third party;
4. the Licensor may, at its sole discretion, incorporate, modify, reject, or discard the Contribution without any obligation to the Licensee;
5. the Licensor may distribute the Contribution as part of the Software under the terms of this Agreement or any successor or different licence of the Licensor's choice; and
6. no compensation shall be owed to the Licensee for the Contribution or for the Licensor's use thereof.

11. Third-Party Components

11.1 Acknowledgement

The Software incorporates certain Third-Party Components, each of which is licensed to the Licensee under the terms of the applicable third-party licence. The Third-Party Components include, without limitation:

• ed25519-dalek — Ed25519 signature implementation in Rust;
• ml-dsa — Module-Lattice-based Digital Signature Algorithm (FIPS 204) implementation;
• ml-kem — Module-Lattice-based Key Encapsulation Mechanism (FIPS 203) implementation;
• x25519-dalek — X25519 elliptic-curve Diffie-Hellman implementation;
• blake3 — BLAKE3 cryptographic hash function;
• argon2 — Argon2id password-based key derivation function;
• chacha20poly1305 — ChaCha20-Poly1305 authenticated encryption with associated data;
• axum — ergonomic and modular Rust web framework;
• sqlx — asynchronous, pure-Rust SQL toolkit with compile-time checked queries;
• tokio — asynchronous runtime for Rust;
• serde — serialisation and deserialisation framework for Rust;
• jni — Java Native Interface bindings for Rust;
• cbor2 — Concise Binary Object Representation library for Python; and
• such other components as may be identified from time to time in the Software Bill of Materials (SBOM) distributed with the Software.

11.2 Precedence

To the extent that the terms of a third-party licence applicable to a Third-Party Component conflict with the terms of this Agreement in respect of that specific Third-Party Component, the terms of the third-party licence shall govern solely with respect to that Third-Party Component, and this Agreement shall otherwise continue in full force and effect.

11.3 Software Bill of Materials

A complete, machine-readable inventory of Third-Party Components incorporated in each release of the Software is published in CycloneDX format and made available at /download/ on the Licensor's Services endpoint. Each such SBOM is accompanied by Sigstore / Cosign digital signatures and is attested to via the Rekor transparency log, in accordance with SLSA (Supply-chain Levels for Software Artifacts) Level 3 requirements. The Licensee is encouraged to verify these attestations prior to Deployment.

12. Patents and Patent Covenants

12.1 Limited Non-Assert Covenant

Subject to Sections 12.2 and 12.3, the Licensor hereby covenants, for the duration of this Agreement and in respect of each Licensee in good standing, not to assert against the Licensee any claim of patent infringement in respect of the Licensee's use of the unmodified Software strictly within the scope of the licence granted to the Licensee under Sections 3, 4, 5, or 6, as applicable. This covenant is personal to the Licensee, is non-transferable, is non-sublicensable, and terminates automatically upon any termination of this Agreement or any material breach by the Licensee.

12.2 Scope Limitations

The covenant in Section 12.1 extends only to patents or patent applications owned or licensable by the Licensor and reading on the Software as distributed by the Licensor. The covenant does not extend to:

1. any modified version of the Software, reimplementation, port, or Derivative Work, to the extent that infringement arises from such modifications or re-implementations;
2. the combination of the Software with any third-party software, hardware, process, or method, to the extent that infringement arises from such combination;
3. any use of the Software outside the licence grants of Sections 3 through 6; or
4. any Third-Party Component, in respect of which any applicable patent covenant is exclusively as set forth in the corresponding third-party licence.

12.3 Defensive Termination

If the Licensee, any Affiliate of the Licensee, or any Person acting in concert with the Licensee commences or voluntarily joins any lawsuit, counterclaim, cross-claim, interference, re-examination, opposition, inter-partes review, post-grant review, or other proceeding asserting that the Software, the Services, or any portion thereof infringes any patent or other Intellectual Property Right, then (a) the covenant in Section 12.1 shall terminate automatically and immediately; (b) all licence grants under this Agreement shall terminate automatically and immediately; and (c) the Licensor shall be entitled, in addition to any other remedy, to seek recovery of its reasonable attorneys' fees and costs incurred in defending against such proceeding.

13. Export Control and Sanctions Compliance

13.1 Cryptographic Dual-Use Classification

The Licensee acknowledges that the Software is subject to the export-control and sanctions laws of multiple jurisdictions, including without limitation: (a) the U.S. Export Administration Regulations (EAR), 15 C.F.R. Parts 730–774, as administered by the Bureau of Industry and Security of the U.S. Department of Commerce; (b) the Office of Foreign Assets Control (OFAC) sanctions regulations of the U.S. Department of the Treasury; (c) Regulation (EU) 2021/821 of the European Parliament and of the Council setting up a Union regime for the control of exports, brokering, technical assistance, transit, and transfer of dual-use items; (d) Romanian national export-control laws and decisions of the National Agency for Export Controls (Agenția Națională de Control al Exporturilor, "ANCEX"); and (e) all applicable resolutions of the United Nations Security Council.

13.2 Restricted Parties and Territories

The Licensee represents, warrants, and covenants that, throughout the term of this Agreement:

1. the Licensee, its direct and indirect owners, its directors and officers, and its Authorized Users are not listed on, and are not owned fifty percent (50%) or more in the aggregate by Persons listed on, the OFAC Specially Designated Nationals (SDN) List, the OFAC Sectoral Sanctions Identifications List, the EU Consolidated Sanctions List, the UN Consolidated Sanctions List, the UK OFSI Consolidated List, the U.S. Department of Commerce Entity List, the U.S. Department of Commerce Denied Persons List, the U.S. Department of State Debarred Parties List, or any equivalent restricted-party list of any jurisdiction;
2. the Licensee is not located, organised, or ordinarily resident in, and will not export, re-export, transfer, or make available the Software to any Person located, organised, or ordinarily resident in, the Russian Federation, the Republic of Belarus, the Islamic Republic of Iran, the Democratic People's Republic of Korea, the Syrian Arab Republic, the Republic of Cuba, the Crimea region of Ukraine, the so-called Donetsk People's Republic, the so-called Luhansk People's Republic, or any other jurisdiction subject to comprehensive trade sanctions administered by the European Union, the United States, the United Kingdom, the United Nations, or Romania;
3. the Licensee will not use the Software for any end-use prohibited by applicable export-control laws, including without limitation any use related to the design, development, production, stockpiling, or use of chemical, biological, nuclear, or radiological weapons, or of missiles or unmanned aerial vehicles capable of delivering such weapons; and
4. the Licensee will obtain, at its own cost and expense, all licences, permits, authorisations, consents, and clearances required by applicable export-control laws prior to any export, re-export, or transfer of the Software.

13.3 Compliance Cooperation

The Licensee shall promptly notify the Licensor of any export-control investigation, enforcement action, or suspected violation involving the Software, and shall cooperate with the Licensor in good faith in connection with any resulting inquiry, audit, or remediation effort.

14. Warranty Disclaimers

14.1 "AS IS" Disclaimer

EXCEPT AS EXPRESSLY SET FORTH IN A DULY EXECUTED COMMERCIAL ORDER FORM, THE SOFTWARE, THE DOCUMENTATION, AND THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITH ALL FAULTS AND DEFECTS, AND WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSOR EXPRESSLY DISCLAIMS ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO:

• the implied warranties of merchantability, fitness for a particular purpose, satisfactory quality, and non-infringement;
• warranties that the Software will meet the Licensee's requirements, operate without interruption, be error-free, secure, free of vulnerabilities, or free of harmful code;
• warranties regarding the accuracy, reliability, completeness, or timeliness of any output, data, or result produced by the Software;
• warranties regarding the compatibility of the Software with any specific hardware, operating system, network, or third-party service;
• warranties regarding the suitability of the Software's cryptographic implementations for any specific regulatory regime, security level, or threat model, pending completion of independent third-party cryptographic review and any applicable formal validation under FIPS 140-3 and/or Common Criteria, which as of the Effective Date has not been completed; and
• warranties regarding the continuous availability of the Services or the preservation of any particular version of the Software.

14.2 Consumer-Law Carve-Out

Nothing in this Agreement is intended to exclude or restrict any warranty, condition, or liability that cannot lawfully be excluded or restricted under the law of any jurisdiction in which the Licensee is a consumer, including (where applicable) the United Kingdom Consumer Rights Act 2015 and mandatory consumer-protection provisions of Romanian and EU law. Where such mandatory provisions apply, the disclaimers in this Section 14 shall apply only to the maximum extent permitted by law.

15. Limitation of Liability

15.1 Exclusion of Indirect Damages

SUBJECT TO SECTION 15.3, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR TO ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING WITHOUT LIMITATION LOST PROFITS, LOST REVENUES, LOST GOODWILL, LOST OPPORTUNITIES, LOSS OR CORRUPTION OF DATA, COST OF COVER, OR COST OF SUBSTITUTE GOODS OR SERVICES, ARISING OUT OF OR RELATING TO THIS AGREEMENT, THE SOFTWARE, OR THE SERVICES, REGARDLESS OF THE LEGAL THEORY UPON WHICH ANY SUCH LIABILITY IS BASED (INCLUDING BREACH OF CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE), AND EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR IF SUCH DAMAGES WERE REASONABLY FORESEEABLE.

15.2 Aggregate Cap

SUBJECT TO SECTION 15.3, THE TOTAL AGGREGATE LIABILITY OF EITHER PARTY ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL AMOUNTS ACTUALLY PAID BY THE LICENSEE TO THE LICENSOR UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT FIRST GIVING RISE TO THE CLAIM, OR, WHERE NO SUCH AMOUNTS HAVE BEEN PAID (AS IN THE EVALUATION TIER OR DEVELOPER TIER), ONE HUNDRED EUROS (€100).

15.3 Carve-Outs

The exclusions and limitations in Sections 15.1 and 15.2 shall not apply to: (a) liability for fraud or fraudulent misrepresentation; (b) liability for gross negligence or wilful misconduct; (c) liability for death or personal injury caused by the negligence of a party; (d) a party's breach of its confidentiality obligations under Section 17; (e) the Licensor's indemnification obligations under Section 16; (f) the Licensee's indemnification obligations for IP infringement caused by unauthorised modification or combination of the Software; (g) the Licensee's obligation to pay fees owed under any Commercial Order Form; or (h) any other liability that cannot lawfully be excluded or limited under applicable law.

16. Indemnification

16.1 Licensor Indemnity for IP Infringement

Subject to Sections 16.2 and 16.3, the Licensor shall defend, indemnify, and hold harmless the Licensee from and against any and all third-party claims, suits, or proceedings alleging that the Licensee's use of the unmodified Software, strictly within the scope of the licence granted hereunder, directly infringes any copyright, trade-mark, or issued patent in Romania, any European Union member state, the United Kingdom, or the United States (each, an "IP Claim"), and shall pay any finally awarded damages, costs, and reasonable attorneys' fees attributable to such IP Claim.

16.2 Conditions to Indemnity

The Licensor's indemnification obligation under Section 16.1 is conditioned upon the Licensee: (a) providing the Licensor with prompt written notice of the IP Claim (and in any event within fifteen (15) days of becoming aware thereof); (b) granting the Licensor sole control over the defence and settlement of the IP Claim, provided that the Licensor shall not settle any IP Claim in a manner that imposes any non-indemnified financial liability on the Licensee without the Licensee's prior written consent; and (c) providing the Licensor with all reasonable information, assistance, and authority necessary to defend the IP Claim at the Licensor's expense.

16.3 Exclusions

The Licensor shall have no obligation under Section 16.1 with respect to any IP Claim to the extent arising from: (a) use of the Software in combination with any product, service, or technology not provided or expressly approved by the Licensor, where the alleged infringement would not have arisen but for such combination; (b) any modification, Derivative Work, or customisation of the Software not made or expressly authorised by the Licensor; (c) use of the Software in violation of this Agreement or applicable law; (d) use of a superseded version of the Software after the Licensor has made a non-infringing Update available to the Licensee at no additional cost; or (e) compliance by the Licensor with Licensee-specific designs, requirements, or specifications.

16.4 Remedies

If the Software is, or in the Licensor's reasonable judgment is likely to become, the subject of an IP Claim, the Licensor may, at its option and expense: (a) procure for the Licensee the right to continue using the Software; (b) modify the Software so that it becomes non-infringing while remaining substantially equivalent in functionality; (c) replace the Software with non-infringing software of substantially equivalent functionality; or (d) if none of the foregoing is commercially reasonable, terminate the affected licences and refund a pro-rata portion of any prepaid fees covering the remaining unused term. The remedies in this Section 16 constitute the Licensee's sole and exclusive remedy, and the Licensor's sole and exclusive liability, with respect to IP Claims.

17. Confidentiality

17.1 Mutual Obligations

Each party (the "Receiving Party") shall, in respect of the Confidential Information of the other party (the "Disclosing Party"): (a) hold such Confidential Information in strict confidence; (b) use such Confidential Information only for the purposes of performing its obligations and exercising its rights under this Agreement; (c) disclose such Confidential Information only to its employees, contractors, professional advisers, and permitted subcontractors who have a bona fide need to know for the permitted purposes and who are bound by confidentiality obligations no less protective than those set out herein; and (d) protect such Confidential Information using the same degree of care that it uses to protect its own confidential information of similar sensitivity, but in no event less than a reasonable degree of care.

17.2 Exceptions

The obligations in Section 17.1 shall not apply to information that the Receiving Party can demonstrate: (a) was in the public domain at the time of disclosure or has entered the public domain thereafter through no fault of the Receiving Party; (b) was rightfully in the Receiving Party's possession prior to disclosure and without any obligation of confidentiality; (c) was independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information; or (d) was rightfully received by the Receiving Party from a third party not under any duty of confidentiality to the Disclosing Party.

17.3 Compelled Disclosure

If the Receiving Party is required by law, regulation, court order, or other governmental process to disclose Confidential Information of the Disclosing Party, the Receiving Party shall, to the extent legally permissible, promptly notify the Disclosing Party, provide reasonable assistance (at the Disclosing Party's expense) in any effort to seek a protective order or similar confidential treatment, and disclose only the minimum amount of Confidential Information required.

17.4 Survival

The confidentiality obligations under this Section 17 shall survive the termination or expiration of this Agreement for a period of five (5) years, provided that obligations in respect of trade secrets shall continue for so long as such information retains its status as a trade secret under applicable law.

18. Data Protection

18.1 Respective Roles

Where the Licensee uses the Software to process personal data of End Users, the Licensee is the "controller" and the Licensor, when operating the Services, is the "processor", each as such terms are defined in Regulation (EU) 2016/679 (the "GDPR"). The Licensee, as controller, is solely responsible for determining the purposes and means of processing, establishing the lawful basis for processing, responding to data-subject requests, and complying with all controller obligations under the GDPR, the Romanian Law No. 190/2018, and any other applicable data-protection law.

18.2 Data Processing Agreement

Where the Licensor acts as processor, the parties shall enter into a separate Data Processing Agreement (a "DPA") substantially in the form made available by the Licensor at /download/dpa-template.pdf, satisfying the requirements of Article 28 GDPR and incorporating, where applicable, the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) for the transfer of personal data to third countries.

18.3 International Transfers

To the extent that the Software involves the transfer of personal data from the European Economic Area or the United Kingdom to a third country, such transfer shall be subject to an appropriate transfer mechanism under Articles 44–49 GDPR (and equivalent provisions of UK GDPR), including adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, or derogations. The Licensee shall perform and document any transfer impact assessment required under the judgement of the Court of Justice of the European Union in Schrems II (Case C-311/18).

18.4 Security Measures

The Licensor implements and maintains appropriate technical and organisational measures designed to ensure a level of security appropriate to the risks presented by processing, as required by Article 32 GDPR. A description of such measures, including pseudonymisation, encryption in transit and at rest, access controls, logging, and regular testing, is made available to the Licensee upon reasonable request.

19. Audit Rights

19.1 Compliance Audits

The Licensor may, not more frequently than once in any twelve (12) month period, and upon not less than thirty (30) days' prior written notice, audit the Licensee's use of the Software to verify compliance with this Agreement. Audits shall be conducted during normal business hours, in a manner that does not unreasonably interfere with the Licensee's business operations, and subject to customary confidentiality obligations protecting the Licensee's confidential information.

19.2 Audit Methodology

Audits may be conducted by the Licensor's internal personnel or by an independent auditor bound by equivalent confidentiality obligations. At the Licensor's option and at its cost, audits may be performed remotely via secure screen-share, questionnaire, or automated telemetry validation, provided that the Licensee retains the right to require in-person audits to ensure adequate protection of its own confidential information.

19.3 Remediation and Costs

If an audit reveals any material discrepancy between the Licensee's actual use of the Software and the scope of the licence granted under this Agreement, the Licensee shall remediate such discrepancy within sixty (60) days by (as applicable) ceasing unauthorised use, purchasing additional licences to cover over-deployment at the then-current list price, or entering into an amended Commercial Order Form. The costs of the audit shall be borne by the Licensor, except that if the audit reveals a material underpayment (defined as exceeding five percent (5%) of amounts properly due), the Licensee shall reimburse the Licensor for the reasonable costs of the audit in addition to the remediation actions above.

20. Term and Termination

20.1 Term

This Agreement commences on the date the Licensee first installs, accesses, or uses the Software (the "Effective Date" for the Licensee) and continues until terminated in accordance with this Section 20 or until expiry of the applicable Evaluation Period or Commercial Order Form term, whichever occurs first.

20.2 Termination for Material Breach

Either party may terminate this Agreement by written notice to the other party if the other party commits a material breach of this Agreement and, in the case of a breach that is capable of cure, fails to cure such breach within thirty (30) days after receipt of written notice describing the breach in reasonable detail. Failure to pay fees owed under a Commercial Order Form within the applicable payment-terms period constitutes a material breach.

20.3 Termination for Insolvency

Either party may terminate this Agreement immediately upon written notice if the other party: (a) ceases to conduct business in the ordinary course; (b) becomes the subject of insolvency, receivership, bankruptcy, winding-up, liquidation, administration, or similar proceedings; (c) makes a general assignment for the benefit of creditors; or (d) suffers the appointment of a trustee or similar officer over a substantial portion of its assets.

20.4 Termination by the Licensor for Patent Assertion

The Licensor may terminate this Agreement immediately upon written notice if the Licensee or any Affiliate thereof asserts any patent-infringement claim against the Licensor or any of its licensees relating to the Software, as further described in Section 12.3.

21. Effect of Termination

21.1 Cessation of Use

Upon any termination or expiration of this Agreement, the Licensee shall immediately: (a) cease all use of the Software, the Services, and the Documentation; (b) cause any cached authentication tokens and session artefacts issued by the Services to expire or be destroyed; (c) uninstall and delete all copies of the Software from all devices, servers, and storage media under its control or the control of its Authorized Users; (d) destroy or, at the Licensor's election, return all Confidential Information of the Licensor in its possession; and (e) upon the Licensor's request, deliver to the Licensor a written certification, signed by a duly authorised officer of the Licensee, attesting that the foregoing has been completed.

21.2 Data Export Window

Unless termination is for the Licensee's uncured material breach, the Licensor shall, during a thirty (30) day period following termination (the "Export Window"), make available to the Licensee commercially reasonable tools to export Licensee data processed by the Services in a structured, commonly-used, machine-readable format. Following the end of the Export Window, the Licensor may, and within sixty (60) days after the Export Window shall, delete all Licensee data from its production systems, subject to retention required by applicable law or for legitimate legal-hold purposes.

21.3 Survival

The following Sections shall survive any termination or expiration of this Agreement: Section 1 (Copyright Notice), Section 2 (Definitions), Section 7 (Restrictions on Use) to the extent relating to residual materials, Section 8 (Reservation of Rights), Section 9 (Intellectual Property Rights), Section 10 (Ownership and Contributions), Section 12.3 (Defensive Termination), Section 13 (Export Control and Sanctions Compliance), Section 14 (Warranty Disclaimers), Section 15 (Limitation of Liability), Section 16 (Indemnification) with respect to accrued claims, Section 17 (Confidentiality) subject to its stated term, Section 19 (Audit Rights) with respect to audits commenced prior to termination, Section 21 (Effect of Termination), Section 22 (Governing Law and Jurisdiction), Section 23 (Compliance with Mandatory Law), Section 25 (Notices), and Section 29 (Miscellaneous).

22. Governing Law and Jurisdiction

22.1 Governing Law

This Agreement and any non-contractual obligations arising out of or in connection with it shall be governed by and construed in accordance with the laws of Romania, without regard to its rules on conflict of laws. The United Nations Convention on Contracts for the International Sale of Goods (CISG) and the Uniform Computer Information Transactions Act (UCITA) shall not apply to this Agreement.

22.2 Exclusive Jurisdiction

Subject to Section 22.3, the parties submit to the exclusive jurisdiction of the competent courts of Bucharest, Romania, for the resolution of any dispute, claim, or controversy arising out of or in connection with this Agreement. The Licensor shall nonetheless be entitled to seek injunctive relief or other equitable remedies in any court of competent jurisdiction to prevent or restrain irreparable harm, including without limitation unauthorised use or disclosure of Confidential Information or infringement of Intellectual Property Rights.

22.3 Optional Arbitration for Non-EU Licensees

Where the Licensee is domiciled outside the European Economic Area and the United Kingdom, either party may, by written notice to the other party given at any time before the filing of any court proceeding, elect to submit any dispute arising out of or in connection with this Agreement to binding arbitration under the UNCITRAL Arbitration Rules then in force. The seat of arbitration shall be Geneva, Switzerland. The language of arbitration shall be English. Where the amount in dispute is less than two hundred fifty thousand euros (€250,000), the tribunal shall consist of a sole arbitrator; in all other cases the tribunal shall consist of three (3) arbitrators, one appointed by each party and the presiding arbitrator appointed by the two party-appointed arbitrators or, failing agreement, by the appointing authority designated under the UNCITRAL Rules. Any award rendered shall be final and binding and may be enforced in any court of competent jurisdiction.

23. Compliance with Mandatory Law

Nothing in this Agreement shall be construed to require or permit any action in violation of applicable mandatory law. If any provision of this Agreement is held by a court or tribunal of competent jurisdiction to be invalid, illegal, or unenforceable in any respect, such provision shall be deemed modified to the minimum extent necessary to render it enforceable while preserving, to the greatest extent possible, the original economic and legal intent of the parties. The invalidity, illegality, or unenforceability of any one or more provisions shall not affect the validity, legality, or enforceability of the remaining provisions, all of which shall continue in full force and effect.

24. Force Majeure

Neither party shall be liable for any failure or delay in performance of its obligations under this Agreement (other than the obligation to pay fees when due) to the extent caused by events beyond its reasonable control, including without limitation acts of God, earthquake, flood, fire, storm, pandemic, epidemic, war, armed conflict, terrorism, civil unrest, labour strikes, government action, embargoes, sanctions, failures of utility services or public telecommunications networks, cyber-attack by a sophisticated adversary notwithstanding reasonable security measures, and comparable events (each, a "Force Majeure Event"). The affected party shall promptly notify the other party of the Force Majeure Event and shall use commercially reasonable efforts to resume performance. If a Force Majeure Event continues for more than thirty (30) days, the performing party shall employ reasonable workarounds; if it continues for more than one hundred twenty (120) days, either party may terminate this Agreement upon written notice without further liability.

25. Notices

25.1 General Notices

Routine communications between the parties relating to day-to-day operations, technical support, and commercial administration may be exchanged by electronic mail to the addresses designated from time to time by each party, and shall be deemed received upon confirmation of delivery or the next business day, whichever is earlier.

25.2 Formal Notices

Any notice of termination, breach, indemnification claim, or other formal legal notice under this Agreement shall be in writing and shall be delivered by: (a) registered mail or international courier with signed proof of delivery; or (b) electronic mail with confirmed delivery receipt and simultaneous registered-mail follow-up. Notices to the Licensor shall be addressed to: CAI Technology SRL, Attn: Legal Department, Str. Victor Brauner 34, Bucharest, Romania, with a copy to office@caitech.ro. Notices to the Licensee shall be addressed to the most recent address provided to the Licensor in an executed Commercial Order Form or registration record.

26. Assignment

26.1 Assignment by the Licensee

The Licensee shall not, directly or indirectly, assign, transfer, sublicense, delegate, or otherwise dispose of this Agreement or any rights or obligations hereunder, whether voluntarily, involuntarily, by operation of law, or otherwise, without the Licensor's prior written consent, except that the Licensee may assign this Agreement, without such consent, to a bona fide successor to all or substantially all of its business or assets relating to the subject matter hereof, whether by merger, acquisition, reorganisation, or sale of assets, provided that: (a) the Licensee is not in material breach of this Agreement at the time of assignment; (b) the successor is not a competitor of the Licensor; (c) the successor agrees in writing to assume all of the Licensee's obligations under this Agreement; and (d) the Licensee provides the Licensor with written notice of such assignment within thirty (30) days.

26.2 Assignment by the Licensor

The Licensor may assign this Agreement, in whole or in part, without the Licensee's consent, to any Affiliate or to any Person acquiring all or substantially all of the Licensor's business or assets relating to the Software or the Services, whether by merger, acquisition, reorganisation, or sale of assets.

26.3 Effect of Prohibited Assignment

Any purported assignment in violation of this Section 26 shall be null and void ab initio and shall entitle the non-breaching party to terminate this Agreement immediately upon written notice.

27. Subcontractors

27.1 Use of Subcontractors

The Licensor may engage subcontractors and sub-processors in the performance of its obligations under this Agreement, including without limitation: (a) infrastructure-as-a-service and platform-as-a-service providers located within the European Union for hosting the Services; (b) content-delivery-network operators; (c) managed database providers; (d) Firebase Cloud Messaging and equivalent push-notification intermediaries for the delivery of authentication-challenge notifications to mobile clients; (e) electronic-mail and transactional-communications providers; (f) supply-chain transparency services (Sigstore, Rekor); and (g) cyber-security monitoring, log-aggregation, and anti-abuse providers.

27.2 Subcontractor List and Updates

A current list of the Licensor's material subcontractors is maintained at /download/subcontractors.json on the Licensor's Services endpoint. The Licensor shall provide not less than thirty (30) days' prior notice (by updating the published list and, where feasible, by direct notification) before adding or replacing a material subcontractor. The Licensee's sole remedy in respect of any objection to a new subcontractor shall be to terminate the applicable Commercial Order Form without penalty within such thirty (30) day window.

27.3 Licensor's Responsibility

The Licensor remains responsible to the Licensee for the performance of any subcontractor to the same extent as if the Licensor had performed the relevant obligations itself, and shall ensure that each subcontractor is bound by obligations of confidentiality and, where applicable, data-protection obligations consistent with Article 28(4) GDPR.

28. Modifications to the License

28.1 Notice of Material Changes

The Licensor may modify this Agreement from time to time. Material modifications shall take effect no sooner than thirty (30) days after the Licensor provides notice by one or more of the following means: (a) publishing the modified Agreement at https://auth.caitech.ro/license with an updated "Last updated" date; (b) in-product notification within the Software; or (c) email to the primary contact designated by the Licensee.

28.2 Acceptance by Continued Use

Continued use of the Software or the Services after the effective date of a modified version of this Agreement constitutes acceptance of the modified terms. If the Licensee does not agree to the modified terms, the Licensee must, within the thirty (30) day notice period, give written notice of rejection to the Licensor and cease all use of the Software and the Services. Upon such rejection, this Agreement shall terminate and the parties shall comply with Section 21.

28.3 Non-Material Changes

Non-material changes (such as typographical corrections, reformatting, or clarifications that do not alter any party's substantive rights or obligations) may take effect upon publication without the thirty-day notice period.

29. Miscellaneous

29.1 Entire Agreement

This Agreement, together with any executed Commercial Order Form, Government Tier Agreement, or DPA, constitutes the entire agreement between the parties concerning the subject matter hereof and supersedes all prior or contemporaneous written or oral understandings, proposals, representations, warranties, and agreements. Each party acknowledges that it has not relied on any statement, representation, assurance, or warranty not expressly set forth herein.

29.2 No Waiver

No waiver of any provision of this Agreement, or of any right or remedy hereunder, shall be effective unless in writing and signed by the party granting the waiver. A party's failure or delay in exercising any right, power, or remedy shall not operate as a waiver thereof, nor shall any single or partial exercise preclude any other or further exercise.

29.3 No Partnership

Nothing in this Agreement shall be construed as creating a partnership, joint venture, agency, employment, or fiduciary relationship between the parties. Neither party has authority to bind the other or to incur any obligation on the other's behalf.

29.4 Counterparts and Electronic Execution

Where this Agreement or any amendment or Commercial Order Form is executed by the parties, it may be executed in counterparts, each of which shall be deemed an original and which together shall constitute one and the same instrument. Execution by electronic signature (including DocuSign, Adobe Sign, or equivalent trust services meeting the requirements of Regulation (EU) No 910/2014, "eIDAS") shall have the same legal effect as execution by a manuscript signature on paper.

29.5 Headings

Section headings are inserted for convenience of reference only and shall not affect the interpretation of this Agreement.

29.6 Language

This Agreement is executed in the English language, which is the authoritative version. Any translation into another language is provided for convenience only and shall not be used for interpretation in the event of any discrepancy.

29.7 Third-Party Beneficiaries

This Agreement confers no rights on any Person other than the parties and their permitted successors and assigns. The Contracts (Rights of Third Parties) Act 1999 (to the extent applicable) is expressly excluded.