Master Subscription Agreement

1. Services. "Services" means superhack’s proprietary SaaS platform that uses specialized AI agents to autonomously perform penetration testing against Customer's authorized systems, applications, and infrastructure in order to identify security vulnerabilities and help Customer remediate them as quickly as possible.
2. Order Form. "Order Form" means the ordering document mutually executed by the parties that sets forth specific terms, pricing, and subscription details for the Services.
3. Authorized Users. "Authorized Users" means the total number of active users authorized to access the Customer's superhack account, used for the purpose of calculating fees.
4. Customer Data. "Customer Data" means any data, content, or materials that Customer submits to the Services.

1. Grant of Rights. superhack grants Customer a non-exclusive, non-transferable right to access and use the Services during the applicable Subscription Term, solely for internal business operations.
2. Usage Restrictions. Customer shall not (i) reverse engineer or copy the Services, (ii) use the Services to build a competing product, or (iii) use the Services in violation of applicable law.

1. Fees. Fees are calculated based on the number of Authorized Users as specified in the Order Form. All fees are non-cancelable and non-refundable, except as otherwise provided.
2. Payment Terms. Unless otherwise stated in the Order Form, all payments are due within 30 days of invoice.
3. Late Payments. Late payments may incur interest at 1.5% per month or the maximum amount permitted by law, whichever is less.
4. Auto-Renewal. Subscriptions renew automatically unless either party provides written notice of non-renewal at least 60 days prior to the renewal date.

1. Accuracy of Data. Customer is responsible for ensuring the accuracy of Customer Data.
2. Access Controls. Customer must maintain appropriate access controls.
3. Compliance. Customer must use the Services in compliance with applicable laws and this Agreement.

1. DPA Incorporation. To the extent superhack processes any personal data on behalf of Customer, the parties agree to be bound by superhack’s Data Processing Agreement (DPA) ("DPA"), which is hereby incorporated into this Agreement by reference.

1. Obligation. Each party agrees to protect the other’s Confidential Information using the same degree of care it uses to protect its own confidential information, but in no event less than reasonable care.
2. Survival. Confidentiality obligations shall survive for three (3) years after termination of this Agreement.

1. Ownership. superhack retains all rights, title, and interest in and to the Services and related intellectual property.
2. Customer Data. Customer retains all rights to its Customer Data.
3. Feedback License. Customer grants superhack a worldwide, royalty-free, irrevocable license to use any suggestions, enhancement requests, or other feedback provided by Customer for product development and improvement, including derivative works.

1. Use of AI. The Services may use AI-generated output to assist in analysis and recommendations.
2. Access. Such content is provided "as-is" and is only accessible within the authenticated user interface of the superhack platform.

1. Service Commitment. superhack will provide the Services using reasonable care and skill.
2. Disclaimer. EXCEPT AS EXPRESSLY SET FORTH HEREIN, THE SERVICES ARE PROVIDED "AS IS" AND SUPERHACK DISCLAIMS ALL WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
3. Indemnification. superhack will defend Customer against any third-party claim alleging that the Services, when used by Customer as permitted under this Agreement, infringe a third party’s intellectual property rights, and will pay amounts finally awarded by a court or agreed in a settlement approved by superhack that result from such claim. This obligation applies only if Customer promptly notifies superhack of the claim, allows superhack to control the defense and settlement, and provides reasonable assistance. superhack has no obligation under this Section 9.3 to the extent a claim results from (a) modification of the Services not made by superhack, (b) use of the Services with products, services, or data not provided by superhack, or (c) use of the Services in breach of this Agreement.

1. Cap on Liability.

   Subject to Section 10.3, each party’s total aggregate liability arising out of or in connection with this Agreement, whether in contract, tort (including negligence) or otherwise, shall be limited to an amount equal to the total fees actually paid by Customer to superhack under the applicable Order(s) during the twelve (12) month period immediately preceding the event giving rise to the liability. For the avoidance of doubt, fees that are invoiced but not yet paid at the time the event giving rise to liability occurs are not included in this amount.

2. Exclusion of Damages.

   Except for liability arising under Section 10.3, neither party shall be liable to the other for any indirect, incidental, special, punitive, or consequential damages, including loss of profits, revenue, business, or data, even if such party has been advised of the possibility of such damages.

3. Statutory Liability.

   Nothing in this Agreement shall exclude or limit either party’s liability to the extent such limitation or exclusion is not permitted under applicable mandatory law, including liability for death or personal injury, gross negligence, intent, or under the German Product Liability Act.

1. Use of AI Models. The Services are powered in part by third-party AI models and providers, which superhack uses to perform analysis and to operate its testing agents.
2. Choice of Providers. superhack remains free, in its sole discretion, to select, combine, and change the AI models and providers it uses from time to time.
3. Privacy-Protective Configuration. superhack configures its use of such providers to be as privacy-protective as reasonably possible and, to the fullest extent made available by each provider, prevents them from using or retaining Customer Data or training their models on data submitted through the Services.
4. AI Disclaimer. The Services rely on cutting-edge, frontier AI models and providers — including Anthropic, OpenAI, and others. Such models are inherently probabilistic and experimental in nature and carry inherent risks: they may behave unpredictably, produce inaccurate, incomplete, misleading, or unexpected results, and may not perform as described or intended by their providers or by superhack. The Services and any output generated with the assistance of such models are provided “as is” and “as available”. To the maximum extent permitted by law, superhack makes no warranties of any kind in respect of such AI models and providers and disclaims all liability arising out of or relating to their use, including any failure of a model or provider to perform as expected.

1. Term. This Agreement begins on the Effective Date and continues until terminated.
2. Termination for Cause. Either party may terminate for material breach upon 30 days’ written notice if such breach remains uncured.
3. Access Termination. Upon termination, Customer's access to the Services will cease.
4. Data Return or Deletion. superhack will delete or return Customer Data in accordance with the DPA.

1. Jurisdiction. This Agreement shall be governed by the laws of the Federal Republic of Germany.
2. Dispute Resolution. The exclusive venue for any dispute shall be the courts of Berlin, Germany.

1. Entire Agreement. This Agreement, together with the following documents, constitutes the entire agreement between the parties:

   • Data Processing Agreement (DPA)
   • Service Description
   • Service Level Terms
   • Acceptable Use Policy
   • Beta & Experimental Features Terms
   • Any applicable Order Forms

   Each of these documents is incorporated by reference and shall have the same legal force and effect as if fully set forth in this Agreement.

2. Amendment. No amendment shall be effective unless in writing and signed by both parties.
3. Assignment. Neither party may assign this Agreement without prior written consent, except in the case of a merger or sale of substantially all assets.
4. Force Majeure. Force majeure applies to delays or failures due to causes beyond a party's reasonable control.

IN WITNESS WHEREOF, the parties have executed this Agreement as of the Effective Date set forth in the applicable Order Form.