BlueRock License Agreement

Effective Dec 1 2025

1. Some Definitions

BlueRock/we/our: BlueRock Security, Inc.

Content: all data, findings, analyses, ratings, remediation guidance, evidence, text, graphics, and other materials that are made available through the Service or Software, excluding Your own data and any data generated solely within Your own systems.

Documentation: BlueRock’s official user documentation and support materials for the Materials (located at customer.bluerock.io or provided with the Materials).

Materials: means the Software, the Service, and the Service Data.

Order Form: a document or online order form which references these terms and which (1) is executed by You and BlueRock or (2) You submit (and BlueRock accepts) via BlueRock’s standard online process (including via a third party marketplace such as AWS Marketplace).

Order Term: the license term described in the Order Form (or if no license term is specified in the Order Form, one (1) month).

Service: the BlueRock webservice(s) or other online service(s) identified on the Order Form (if any).For clarity, the Service may include (a) an online trust registry or similar information service that provides security-related information, ratings, or analysis data about certain servers, services, or software, and (b) any other online services identified in the applicable Order Form.

Service Outputs: the data and outputs provided by the Service for You, including any scores, ratings, analysis results, findings, remediation guidance, or evidence generated for You.

Software: the BlueRock software product identified in the Order Form.

You/Your: you personally, or, if you’re entering into this Agreement on behalf of an organization or entity (who you are fully authorized to bind to this Agreement), that organization or entity.

Free Tier: any tier or portion of the Service or Software that BlueRock makes available without a paid subscription, with limited functionality, data, or usage permitted, typically accessed via a public-facing website or API that BlueRock designates for free public use.

Paid Subscription Tier: any paid subscription tier of the Service or Software that provides more detailed analysis, content, or features in return for recurring fees, as described in an Order Form or online subscription plan.

1. Accepting this Agreement

By entering into an Order Form, or by downloading or using the Materials, You agree to these terms (together with the Order Form, the “Agreement”) to the exclusion of all other terms, and You confirm that you are authorized to enter into this Agreement on behalf of Your organization or entity.

2. What You Get

During the Order Term, subject to the terms of the Agreement, BlueRock grants You a limited, non-exclusive, non-transferable license for Your internal business purposes to:

• Install and run the Software in Your public cloud, private cloud or private data center in accordance with the Documentation;

• Access the Service over the Internet (including via APIs provided by the Service), and use the data and outputs provided by the Service (“Service Outputs”) in accordance with the Documentation solely for Your internal purposes;

• Use APIs provided by the Software to provide data from the Software to Your reporting, event, and vulnerability management systems;

• Use our Documentation to help with setup and operation of the Software and Service.

For the avoidance of doubt, if You access any Free Tier of the Service or Software without a paid subscription or Order Form, BlueRock grants You a limited, non-exclusive, non-transferable license only to use the Free Tier of the Software and access and view the Free Tier of a Service and its publicly available Content for Your own internal, evaluation and informational purposes.

The Free Tier does not include any rights to install or access any Paid Subscription Tier, or obtain dedicated cybersecurity assessments, unless we separately agree in writing in an Order Form or other written agreement.

3. What You Can’t Do

You agree not to:

• Reverse-engineer, decompile, or modify the Materials (except where this restriction is prohibited by law).

• Share or use the Materials with or for third parties (unless we agree in writing).

• Use the Materials to monitor or secure systems You don’t control.

• Use (unless we agree in writing) any Materials for the purposes of competitive evaluation threat analysis for malicious purpose, or to develop any competitive product or service.

• Remove any notices from the Materials.

• Use the Materials in any way that violates laws, including export laws, or third-party rights.

Additional restrictions for Service and Content (including any Free Tier):

No scraping or bulk copying. You may not use AI agents, robots, spiders, scrapers, or any other automated tools or processes to access, copy, or download the Service or any Content; copy, download, or store any substantial portion of the Service or Content, whether manually or by automation.

No commercial or competitive reuse. Unless we expressly agree in writing, You may not use the Service or any Content to build, train, or operate a competing registry, database, or security analysis product or service; incorporate the Content or any derivative work of the Content into any third-party product, service, API, or public documentation; or sell, license, resell, redistribute, or otherwise monetize the Content or Service Outputs, other than as expressly permitted in an Order Form.

No malicious or illegal use. You may not use the Service or any Content to develop, test, execute, assist in the development of, or distribute exploits, malware, viruses, or any other tools or code designed for unauthorized access or security compromise; engage in or assist data theft, unauthorized access, or bypassing security controls; or engage in any fraudulent, deceptive, illegal, or otherwise harmful activity.

If You are unsure whether a particular use is permitted, You agree to contact BlueRock before proceeding.

4. Data

When You use the Software, You retain ownership of all data generated or processed through Your systems, and BlueRock doesn’t access any end customer data on Your systems. The Software may contain functionality to generate billing reports, and if requested by BlueRock, You agree to run such functionality and provide such reports to BlueRock.

If you use the Service, You retain ownership of Your own data that You provide to the Service. Notwithstanding anything else, BlueRock may generate, use, retain and make available Aggregated De-Identified Data for BlueRock’s business purposes (including without limitation, for purposes of improving, testing, operating, promoting and marketing BlueRocks’s products and services). “Aggregated De-Identified Data” means data submitted to, collected by, or generated by BlueRock in connection with Your use of the Service, but only in aggregate, de-identified form which can in no way be linked specifically to You or Your customers. With written approval by You, BlueRock may make public security findings generated from the data You provide to Service.

For clarity, BlueRock may also generate Aggregated De-Identified Data from the Content and Service Outputs, provided that such data cannot be linked specifically to You or Your customers.

5. Ownership and Feedback

As between You and BlueRock, BlueRock owns all right, title and interest in and to the Materials. You agree that any feedback or product suggestions You provide to BlueRock may be freely used and exercised by BlueRock for any purpose, so long as BlueRock doesn’t identify You or Your customers as the source of that feedback.

6. Fees & Billing

• You will pay the fees (if any) described on the Order Form

• Fees are billed monthly or annually, depending on the plan described in the Order Form.

• Unless the Order Form says otherwise, Your Order Term renews automatically for successive periods unless cancelled by You or Bluerock at least 30 calendar days before the next renewal.

• No refunds for partial use or early termination.

• If You fall behind by more than 90 days on paying Your invoices from BlueRock, we may cancel Your license with 30 days’ notice.

• Use of any Free Tier of the Service is generally provided at no charge. Any use of the Service beyond the Free Tier (including any Paid Subscription Tier, premium registry access, or dedicated assessment services) will be subject to the fees and billing terms in an applicable Order Form or online subscription plan.

7. Support & Updates

We will provide support and updates if and as described in the Order Form, which may change upon renewal or commercially reasonable notice. New features may be released over time.

8. Evaluation Use

If You’re using the Materials for free (other than in a proof-of-value (POV) trial), then BlueRock isn’t obligated to provide support, and Section 12 (Indemnity) won’t apply.

For clarity, any access to and use of the Free Tier of the Service is considered free/evaluation use under this Section 8.

9. End of Use

You can stop using the Materials at any time by destroying or removing all copies of the Materials or ceasing to access or use the Service. We may terminate this Agreement and Your license by notifying You if You violate any provision of this Agreement and You don’t cure that violation within 30 days of the notice.

Notwithstanding the foregoing, for serious or security-sensitive violations of this Agreement in connection with the Service (including, without limitation, scraping or bulk extraction of Content, account or credential sharing in violation of BlueRock’s written terms, or malicious or illegal use as described in Section 3), BlueRock may suspend or terminate Your access to the Service (including any Free Tier) immediately, without prior notice. No refunds are due in connection with termination for Your breach.

10. Disclaimer

BLUEROCK PROVIDES THE MATERIALS “AS IS” AND WITHOUT WARRANTY OF ANY KIND, AND HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, PERFORMANCE, ACCURACY, RELIABILITY, AND NON-INFRINGEMENT. THIS DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS AGREEMENT.

Security decisions should not be based solely on the Service or any Content or Service Outputs, and You remain responsible for Your own security posture and risk decisions.

11. Limitation of Liability

TO THE FULLEST EXTENT ALLOWED BY LAW, EXCEPT FOR YOUR BREACH OF SECTION 3, NEITHER YOU NOR BLUEROCK WILL BE LIABLE UNDER ANY LEGAL THEORY FOR INDIRECT OR CONSEQUENTIAL DAMAGES. OUR TOTAL LIABILITY UNDER ANY LEGAL THEORY IS LIMITED TO THE FEES YOU’VE PAID IN THE LAST 12 MONTHS.

12. Indemnity

BlueRock will indemnify and defend You against third party claims alleging that the Materials infringe third party intellectual property rights, so long as You give BlueRock prompt notice of the claim, the option to control defense and settlement, and reasonable assistance (at BlueRock’s expense). BlueRock’s obligations don’t apply to (1) anything not created or provided by BlueRock, (2) anything made to Your specifications, (3) anything modified after delivery, (4) anything combined with anything else not provided by BlueRock, (5) Your continued infringement after being given non-infringing modifications, or (6) infringement arising from your violation of the Agreement.

13. Combined Software Notice

BlueRock includes a combination of proprietary software licensed by BlueRock, and third party and BlueRock open source components provided in accordance with their respective licenses. For a list of open source components and license terms, visit: https:// www.bluerock.io/opensource.

14. Changes to the Terms

Unless Your Order Form says otherwise, BlueRock may change the terms of this License Agreement at any time by notifying You (e.g., by placing a notice on its website or sending You an email), and any changed terms will apply to You beginning on Your next Order Term. If You don’t agree with any new terms, You can reject them, but you’ll no longer be able to use the Software or Services. If You uses the Software or Services in any way after a change is effective, that means You agree to all of the changes. Except for changes by BlueRock as described here, no other amendment or modification of the Agreement will be effective unless in writing and signed by both You and BlueRock.

13. “Boilerplate” Legal Terms

You will comply with all export laws, restrictions and regulations in connection with Your use of the Materials, and will not export or re-export the Materials in violation of those laws (including by providing any Materials to any sanctioned individual or entity). This Agreement is personal to You and You will not assign or transfer the Agreement or the Materials to any third party. BlueRock may assign, delegate or transfer this Agreement without consent in whole or in part. This Agreement represents the complete agreement between the parties concerning its subject matter and supersedes all prior agreements and representations between them (and the Order Form controls). You agree that BlueRock may use Your name and logo to refer to You as a customer of BlueRock on its website and in marketing materials (should You choose to opt-out, please send an email with your company name to opt-out@bluerock.io). If any provision of this Agreement is held to be unenforceable for any reason, it will be reformed only to the extent necessary to make it enforceable. A party’s failure to act with respect to a breach of this Agreement by the other party won’t constitute a waiver (all waivers must be in a signed writing) and won’t limit that party’s rights with respect to that breach or any subsequent breaches. Except for payment, neither party will be liable for any failure to perform due to causes beyond such party’s reasonable control. This Agreement shall be governed by and construed under Delaware law without regard to any conflicts of law provisions thereof. Any disputes will be resolved (and the parties consent to exclusive jurisdiction and venue) in the state and federal courts located in San Francisco, California.

12. Contact

We can contact and provide notices to You at the address(es) on the Order Form. You can contact and provide notices to BlueRock as follows:

BlueRock Security, Inc.

www.bluerock.io

400 Concar Ave, 3rd Floor, San Mateo CA 94402

legal@bluerock.io