Terms of Use

These Terms of Use ("Terms") govern access to and use of the WHOCAN platform ("Service"), a cloud security analysis service provided by PRAGMABLE ("Provider", "we", "us"), a French société par actions simplifiée (SAS) with a share capital of €20,000, registered with the Paris Trade and Companies Register (RCS) under number 980 554 117, VAT number FR11980554117, whose registered office is at 9 rue de Budapest, 75009 Paris, France. PRAGMABLE can be contacted at legal@pragmable.com. By accessing or using the Service, the Customer ("Customer", "you") agrees to be bound by these Terms.

1. Definitions

• "Affiliate": Any entity that directly or indirectly controls, is controlled by, or is under common control with a Party, where "control" means holding more than 50% of the voting rights or having the power to direct the entity's management.
• "AI Assistant": The conversational assistant included in certain plans of the Service, which answers questions about the Customer Environment using large language models.
• "Authorized User": An individual — an employee of the Customer or of its Affiliates, or a contractor or service provider acting on the Customer's behalf — whom the Customer authorizes to use the Service under its account.
• "Confidential Information": Any non-public technical or business information of a Party, including without limitation information relating to techniques, algorithms, know-how, current and future products and services, research, engineering, designs, financial information, customers, and business plans. Customer Data, including Findings, is Confidential Information of the Customer; the non-public PRAGMABLE Materials are Confidential Information of PRAGMABLE.
• "Credentials": API keys, access tokens, IAM roles, passwords, and any other authentication mechanisms used in connection with the Service.
• "Customer": The legal entity or individual subscribing to and using the Service.
• "Customer Data": All data, content, and information submitted to the Service by or on behalf of the Customer or collected by the Service from the Customer Environment, together with the Findings, but excluding the PRAGMABLE Materials and Usage Data.
• "Customer Environment": The cloud accounts, infrastructure, systems, and resources connected to the Service by the Customer.
• "Data Act": Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data.
• "Documentation": PRAGMABLE's then-current technical documentation for the Service, including its recommended permission policies.
• "DPA": The data processing agreement between PRAGMABLE and the Customer under Article 28 of the GDPR, which forms part of these Terms (Section 14.1).
• "Fees": The amounts payable for the Service, as set out in the Order Form.
• "Findings": The query results, authorization evaluations (including answers to who-can and access-decision queries), access paths, entitlement and critical-sequence analyses, reports, alerts, and recommendations generated by the Service for the Customer.
• "GDPR": Regulation (EU) 2016/679 (General Data Protection Regulation).
• "Installed Components": Software that PRAGMABLE makes available for installation or execution in the Customer Environment or on the Customer's systems, such as data extraction tools, deployment templates and scripts, command-line tools and SDKs, and the Service software provided for a Customer-Managed Deployment.
• "Order Form": The order accepted by both Parties — online, including the plan selected at checkout, or as a signed ordering document — that sets out the plan, its scope, the Fees, and the Subscription Term.
• "Party": The Customer or PRAGMABLE, collectively the "Parties".
• "PRAGMABLE Materials": The Service, the Documentation, the RQL query language, query templates and libraries, the catalogs of cloud actions and critical sequences and their documentation, detection rules, and any other content provided by PRAGMABLE, including where reproduced in Findings.
• "Preview Access": Any beta, pre-release, trial, proof of concept (POC), test environment, early access, or evaluation access to the Service or any of its features that are not generally available.
• "Privacy Policy": PRAGMABLE's privacy policy, available at whocan.cloud/privacy.
• "Service": The WHOCAN cloud security analysis platform, including its web application and query console, the RQL query language, APIs, the AI Assistant where included in the Customer's plan, the Installed Components, and the Documentation.
• "Subscription Term": The initial period of a paid subscription and each renewal period, as set out in the Order Form.
• "Usage Data": Technical information about the operation and use of the Service, such as request volumes, performance metrics, feature adoption, and error reports, excluding Customer Data.

2. Eligibility

The Customer represents that it is a legal entity duly organized under applicable law, or an individual of legal age capable of entering into binding agreements. The Customer must have the authority to accept these Terms on behalf of the entity it represents.

3. Non-Consumer Service

The Service is designed for professional, business, and commercial use and is not intended for personal, family, or household purposes. To the fullest extent permitted by applicable law, these Terms are deemed to be entered into between two professionals.

Nonetheless, if the Customer qualifies as a consumer under applicable law, and applicable law provides consumers with statutory, non-waivable rights, such statutory provisions shall prevail over any conflicting provision of these Terms.

4. Service Description and Scope

The Service collects the identity and access management (IAM) configuration, policies, and resource metadata of the Customer Environment — through read-only access provisioned by the Customer, or from data the Customer extracts itself using Installed Components — and analyses them to answer authorization questions: which principals can perform which actions on which resources, through which access paths, and which identities hold critical sequences of permissions, such as privilege-escalation or data-exfiltration paths. Depending on the plan, the Service can also monitor the collected configuration over time and alert the Customer to changes.

All Findings are advisory in nature. They reflect a point-in-time analysis of the configuration data available to the Service when it was last collected. Changes made in the Customer Environment after that collection, and new actions, services, or behaviors introduced by the cloud provider, may not be reflected.

Authorization results, including answers to queries and access evaluations, reflect the policies and configuration data accessible to the Service and PRAGMABLE's understanding of each cloud provider's authorization semantics, which the cloud provider may change without notice. A result indicating that access is denied is not a guarantee that the cloud provider will deny it, and a result indicating that access is allowed is not a guarantee that it will allow it: controls and data outside what is accessible to the Service — such as accounts, services, or policy types that were not collected, or conditions evaluated only at request time — may affect the actual decision.

The Customer acknowledges that no security analysis tool can identify every misconfiguration, access path, or risk, or guarantee complete protection against cyber threats. Undetected risks may remain present in the Customer Environment.

The Service relies on automated analysis, including rule-based engines and, where applicable, machine learning or artificial intelligence techniques such as the AI Assistant, to generate Findings. Automated analysis may produce incomplete, inaccurate, or false-positive results. The Customer acknowledges that Findings do not constitute automated decision-making with legal or similarly significant effects within the meaning of Article 22 of the GDPR, and that all Findings require human review and validation before any action is taken.

5. Preview Access

PRAGMABLE may allow the Customer to access certain features or environments under Preview Access, including beta features, proof of concept (POC) environments, trial periods, test environments, or early access programs. Preview Access is provided for testing and evaluation purposes, for a limited period, and is not intended for production use.

Preview Access may be modified, removed, or discontinued, or made generally available (including for a fee) at PRAGMABLE's sole discretion and without any liability to the Customer.

All Preview Access is provided "AS IS," without warranty or representation of any kind. PRAGMABLE's liability for any damage arising out of or in connection with Preview Access is excluded in its entirety, except to the extent liability cannot be excluded or limited under applicable law. The Customer assumes all risks associated with its use of Preview Access.

Because Preview Access is a non-production service provided for testing and evaluation purposes for a limited period, the switching and data portability obligations of Chapter VI of the Data Act, set out in Section 14.4, do not apply to it (Article 31(2) of the Data Act). PRAGMABLE will nonetheless, on request made before Preview Access ends, use reasonable efforts to export the Customer's data.

6. Free Tier

6.1 Availability

PRAGMABLE may offer a free tier of the Service ("Free Tier") allowing the Customer to access certain features of the Service at no cost. The Free Tier may be limited in scope, capacity, features, or duration at PRAGMABLE's sole discretion.

6.2 No Payment, No Obligation

The Free Tier is provided without charge and without any commitment from PRAGMABLE regarding availability, continuity, or level of service. PRAGMABLE may at any time and without prior notice:

• modify, limit, or remove Free Tier features;
• impose usage limits or restrictions;
• discontinue the Free Tier entirely; or
• convert the Free Tier to a paid offering.

6.3 No Support

The Free Tier does not include any support obligation. PRAGMABLE may, at its discretion, provide limited support resources such as documentation or community channels, but is under no obligation to do so.

6.4 Liability

To the maximum extent permitted by applicable law, and in place of the cap in Section 16.1, each Party's total liability arising out of or related to the Free Tier shall not exceed one hundred euros (€100). Sections 15 and 16 otherwise apply in full to the Free Tier.

6.5 Termination

PRAGMABLE may suspend or terminate Free Tier access at any time and for any reason without prior notice. The notice and cure periods set forth in Sections 20.3 and 20.4 do not apply to the Free Tier. The Customer's right to retrieve its data under Section 14.4 applies after any such termination.

6.6 Data Retrieval and Deletion

Upon termination of Free Tier access, the Customer may retrieve its data, and PRAGMABLE will then delete it, as set out in Section 14.4, which applies to the Free Tier as it does to paid subscriptions.

6.7 Conversion to Paid Subscription

If the Customer upgrades from the Free Tier to a paid subscription, all Terms applicable to paying Customers shall apply from the date of upgrade. Any data, Findings, or configurations from the Free Tier will carry over to the paid subscription, subject to the applicable plan terms.

6.8 Remaining Terms

Except as modified by this Section 6, all other provisions of these Terms apply to the Free Tier, including but not limited to Customer Responsibilities (Section 10), Restrictions of Use (Section 11), Confidentiality (Section 13), and Indemnification (Section 17).

7. Customer-Managed Deployment

7.1 Scope

PRAGMABLE may offer the option to deploy the Service within the Customer's own infrastructure, cloud accounts, or private environments ("Customer-Managed Deployment"). This Section 7 applies exclusively to Customer-Managed Deployments and supplements the other provisions of these Terms.

7.2 Data Responsibility

In a Customer-Managed Deployment, all Customer Data remains within the Customer's infrastructure at all times. PRAGMABLE does not host, store, or process Customer Data on its own systems as part of the Customer-Managed Deployment.

The Customer is the sole data controller and, where applicable, data processor for all data generated, processed, or stored within its own infrastructure. The provisions of Section 14 (Data Processing and Privacy) that concern data hosted by PRAGMABLE — including Sections 14.2 (Data Location), 14.4 (Data Export, Switching and Deletion), 14.6 (Security Incident Notification), and 14.7 (Security Measures) — do not apply to data that remains exclusively within the Customer's infrastructure.

7.3 Telemetry and Service Data

Even in a Customer-Managed Deployment, PRAGMABLE may collect limited technical data necessary for the operation of the Service, including:

• license validation and entitlement checks;
• requests for catalog updates and documentation;
• anonymized usage metrics and feature adoption data;
• error reports and diagnostic information.

Such technical data does not include Findings or any data from the Customer Environment — such as policies, principals, resource identifiers, or other configuration — other than the identifiers of connected cloud accounts where needed to verify license limits. If Customer Environment data is inadvertently included in an error report, PRAGMABLE will delete it upon discovery and will not use it for any purpose.

7.4 Customer Infrastructure Responsibilities

In a Customer-Managed Deployment, the Customer is solely responsible for:

• provisioning, configuring, and maintaining the infrastructure on which the Service is deployed;
• ensuring the infrastructure meets the minimum requirements specified in the Documentation;
• applying updates, patches, and new versions of the Service made available by PRAGMABLE;
• managing backups, disaster recovery, and high availability of the deployment;
• controlling and securing all network access to and from the deployed Service;
• managing access controls, user accounts, and authentication mechanisms for the deployed instance.

7.5 License and Restrictions

A Customer-Managed Deployment grants the Customer a limited, non-exclusive, non-transferable right to install and operate the Service within the Customer's own infrastructure, subject to the license scope defined in the Order Form.

All provisions of Section 11 (Restrictions of Use) and Section 12 (Intellectual Property) apply in full to Customer-Managed Deployments, regardless of where the Service is deployed.

7.6 Support

Unless otherwise agreed in writing, PRAGMABLE's support obligations for Customer-Managed Deployments are limited to the Service software itself. PRAGMABLE is not responsible for supporting the Customer's underlying infrastructure, network, or third-party components.

7.7 Remaining Terms

Except as modified by this Section 7, all other provisions of these Terms apply to Customer-Managed Deployments, including but not limited to Confidentiality (Section 13), Disclaimer of Warranties (Section 15), Limitation of Liability (Section 16), and Indemnification (Section 17).

8. Customer Authorization and Right to Grant Access

The Customer represents and warrants that it owns or has the full legal authority to grant PRAGMABLE access to the cloud accounts, systems, environments, and data connected to the Service.

The Customer confirms that such access does not violate any contractual obligation, internal policy, or applicable law.

If the Customer connects environments owned or operated by third parties, the Customer represents that it has obtained all necessary permissions and authorizations prior to granting access to PRAGMABLE.

PRAGMABLE shall not be responsible for any claim, dispute, or liability arising from the Customer's failure to obtain proper authorization.

9. Read-Only Analysis

The Customer authorizes PRAGMABLE to collect and analyse the configuration of the Customer Environments connected to the Service — including cloud configurations, infrastructure metadata, identity and access management settings, policies, and other security-relevant information — as necessary for the operation of the Service.

The Service accesses the Customer Environment only through the read-only permissions that the Customer provisions in accordance with the Documentation, or analyses data that the Customer extracts itself using Installed Components. The Service does not create, modify, or delete any resource, configuration, or data in the Customer Environment, and does not perform active exploitation, penetration testing, denial-of-service, or any other action intended to disrupt it. Installed Components that the Customer chooses to run write only to the locations the Customer designates.

Read-only requests made by the Service to the cloud provider's APIs may be recorded in the Customer's audit logs and count towards the cloud provider's API rate limits.

10. Customer Responsibilities

10.1 Infrastructure and Security

The Customer remains solely responsible for the security, configuration, operation, and maintenance of its infrastructure, systems, and cloud environments. PRAGMABLE does not operate, control, or manage the Customer Environment. The Customer retains full control and responsibility for all infrastructure changes, configurations, and operational decisions.

PRAGMABLE provides recommendations and analysis only and does not replace internal security practices or operational controls. The Customer is responsible for evaluating Findings with qualified personnel before implementation.

10.2 Credentials and Access Management

The Customer is solely responsible for the creation, management, protection, and use of any Credentials used in connection with the Service.

The Customer agrees to grant only the minimum permissions strictly necessary for the operation of the Service in accordance with the principle of least privilege. The Documentation provides recommended permission policies intended to limit access to only what is required.

The Customer acknowledges that it has reviewed, understood, and approved the permissions granted to the Service prior to deployment.

PRAGMABLE does not require or request administrative, unrestricted, or excessive permissions unless explicitly stated in the Documentation. Any broader permissions granted by the Customer are provided at the Customer's sole discretion and risk.

PRAGMABLE shall not be responsible for any security incident, data exposure, system modification, or operational impact arising from:

• excessive permissions granted by the Customer,
• misconfigured IAM roles or policies,
• compromised Credentials under the Customer's control, or
• the Customer's failure to follow the recommended least-privilege configuration.

10.3 Account Security and User Management

The Customer is responsible for maintaining the confidentiality and security of all account credentials, login details, and access tokens associated with its use of the Service.

The Customer shall ensure that:

• account credentials are individual and not shared between multiple users;
• access to the Service is limited to Authorized Users;
• any suspected unauthorized access or compromise of account credentials is reported to PRAGMABLE without undue delay.

The Customer is responsible for the acts and omissions of its Authorized Users as for its own, and for their compliance with these Terms.

10.4 Lawful Use

The Customer agrees not to use the Service for unlawful purposes, including unauthorized scanning, testing, or analysis of systems belonging to third parties. Any such misuse may result in immediate suspension or termination of the Service.

10.5 Customer Verification and Responsible Use

The Service is intended for the defensive analysis of cloud environments that the Customer owns or is expressly authorized to assess.

PRAGMABLE may, at any time and as a condition of continued or expanded access, carry out reasonable identity and legitimacy checks, including know-your-customer (KYC) verification, on the Customer and its Authorized Users. PRAGMABLE may reserve certain features for verified Customers, including enterprise capabilities and access to the most recent catalog updates.

PRAGMABLE may decline, restrict, or revoke access where it reasonably considers that the Service could be used to cause harm, including use by unverified parties or use directed at environments the Customer does not own or is not authorized to assess.

The Customer may use Findings in support of security assessments it is authorized to perform — such as penetration testing, red-team operations, or adversary emulation — on environments it owns or is permitted to assess. The Service itself performs no testing or exploitation (Section 9).

Where the Customer is a security or cloud service provider, it may use the Service to perform assessments or other services for its own clients, provided that it holds each client's written authorization to connect and analyse the client's environments (Section 8) and uses the resulting Findings only to provide services to that client. Where PRAGMABLE considers it appropriate, such use is subject to PRAGMABLE's prior written approval on a case-by-case basis, and PRAGMABLE may request evidence of the client's authorization.

This Section 10.5 supplements Sections 8 (Customer Authorization and Right to Grant Access), 9 (Read-Only Analysis), and 10.4 (Lawful Use), and is without prejudice to PRAGMABLE's rights under Section 20 (Term, Suspension and Termination).

11. Restrictions of Use

The Customer shall not, and shall not permit any third party to:

• reverse engineer, decompile, or disassemble the Service or the Installed Components, except to the extent that applicable law — including Article L. 122-6-1 of the French Intellectual Property Code — expressly permits such acts notwithstanding a contractual restriction, or that the open-source license governing a component permits them;
• reproduce or replicate the Service or its components, except for copies of Installed Components reasonably necessary for their use under these Terms;
• extract, copy, or compile the PRAGMABLE Materials — such as the catalog of critical sequences and its documentation — by systematic or automated means, or use them other than as part of the Findings in accordance with Section 12.2;
• make the Service available to any third party other than its Authorized Users, or resell, sublicense, or rent it, without PRAGMABLE's prior written authorization (the use of the Service to perform assessments for the Customer's own clients is governed by Section 10.5);
• use the Service to conduct unauthorized security testing against PRAGMABLE infrastructure;
• use the Service in violation of applicable laws or regulations.

Any penetration testing or security testing targeting PRAGMABLE systems requires prior written authorization.

12. Intellectual Property

12.1 PRAGMABLE Ownership and License

All rights, title, and interest in and to the Service and the PRAGMABLE Materials, including their software, algorithms, architecture, catalogs, documentation, and underlying technology, remain the exclusive property of PRAGMABLE or its licensors.

Subject to these Terms and, for paid subscriptions, to payment of the Fees, PRAGMABLE grants the Customer, for the duration of its subscription, a non-exclusive, non-transferable, non-sublicensable right for its Authorized Users to access and use the Service for the Customer's business purposes, including the assessments permitted by Section 10.5. Where the Service includes Installed Components, this right includes installing and running them, and making the copies of them reasonably necessary to use the Service, in accordance with the Documentation.

Installed Components distributed under an open-source license, as identified in the component or its documentation, are governed by that license, which prevails over these Terms for those components.

No rights are granted to the Customer other than those expressly set out in these Terms.

12.2 Customer Data and Findings

The Customer is and will remain the sole and exclusive owner of all rights, title, and interest in the Customer Data, including the Findings, which describe the Customer Environment and are Confidential Information of the Customer.

PRAGMABLE Materials reproduced in Findings, such as descriptions of critical sequences, remain the property of PRAGMABLE. PRAGMABLE grants the Customer a perpetual, worldwide, non-exclusive, royalty-free license to use them as part of the Findings for the Customer's own purposes, including the sharing permitted by Section 13.5.

The Customer grants PRAGMABLE a non-exclusive, worldwide, royalty-free license to host, copy, process, transmit, and analyse the Customer Data, for the duration of these Terms and of the periods set out in Section 14.4, solely as necessary to (a) provide, secure, and support the Service, (b) create the anonymized and aggregated data described in Section 14.3, and (c) comply with applicable law.

12.3 Feedback

The Customer has no obligation to provide feedback. However, if the Customer submits feedback, suggestions, or improvement ideas, the Customer acknowledges that such feedback is free from any confidentiality restriction and hereby grants PRAGMABLE a fully paid, royalty-free, perpetual, irrevocable, worldwide, non-exclusive, and fully sublicensable right and license to use, reproduce, adapt, modify, and otherwise commercially exploit such feedback. No feedback will be considered Customer Confidential Information, and nothing in these Terms limits PRAGMABLE's right to independently develop or market products or services, whether incorporating feedback or otherwise.

12.4 Third-Party Trademarks and No Affiliation

"Amazon Web Services", "AWS", "Google Cloud Platform", "GCP", "Microsoft Azure", and any related product names (including but not limited to IAM, S3, EC2, Lambda, BigQuery, Microsoft Entra ID) are trademarks or registered trademarks of their respective owners: Amazon.com, Inc., Google LLC, and Microsoft Corporation.

WHOCAN is an independent product of PRAGMABLE. It is not affiliated with, endorsed by, sponsored by, or officially connected with Amazon Web Services, Google Cloud Platform, Microsoft Azure, or any of their parent companies, subsidiaries, or affiliates.

References to third-party products, services, or documentation within the Service, its documentation, or its website are made for informational and interoperability purposes only and do not imply any partnership, sponsorship, or endorsement.

The use of third-party trademarks within the Service is solely to describe compatibility and integration capabilities, in accordance with applicable trademark fair use principles.

13. Confidentiality

13.1 Obligations

Each Party will, during the term of these Terms and for a period of three (3) years after their termination or expiry — or, for trade secrets, for as long as they remain trade secrets under applicable law — maintain in confidence all Confidential Information of the other Party and will not use such Confidential Information for any purpose except as expressly permitted herein.

Access to Confidential Information must be limited to authorized members of the receiving Party's organization who need to access such information and are subject to binding confidentiality obligations at least as protective as those set forth herein.

13.2 Exclusions

Confidential Information does not include information that:

• is or becomes generally known to the public through no fault or breach of these Terms by the receiving Party;
• the receiving Party can demonstrate was rightfully in its possession at the time of disclosure, without an obligation of confidentiality;
• is independently developed by the receiving Party without the use of or access to the disclosing Party's Confidential Information; or
• the receiving Party rightfully obtains from a third party not under a duty of confidentiality and without restriction on use or disclosure.

13.3 Compelled Disclosure

If a Party is legally required to disclose Confidential Information (including through legal proceedings, regulatory requests, or government investigations), it shall promptly notify the other Party unless legally prohibited from doing so and use reasonable efforts to limit disclosure and obtain confidential treatment or a protective order.

13.4 Remedies

The breaching Party shall be liable, subject to Section 16, for any damages resulting from its unauthorized disclosure or use of the other Party's Confidential Information. In the event of a breach or threatened breach of this Section 13, the disclosing Party shall be entitled to seek injunctive relief in addition to any other remedies available at law.

13.5 Sharing of Findings

Notwithstanding this Section 13, the Customer may share Findings, including the PRAGMABLE Materials they contain, with its Affiliates, auditors, insurers, and legal and professional advisers who are bound by confidentiality obligations, with any competent regulatory or supervisory authority, and, for assessments performed under Section 10.5, with the client whose environment the Findings concern.

14. Data Processing and Privacy

14.1 Personal Data and Roles

Each Party shall comply with the GDPR and applicable French data protection laws.

For the personal data contained in Customer Data — such as the names and identifiers of users, roles, and groups, and other identifiers present in the configuration of the Customer Environment — the Customer is the controller, and PRAGMABLE acts as processor on the Customer's behalf under the DPA. Where the Customer itself acts as processor for its own clients, PRAGMABLE acts as its subprocessor, as set out in the DPA. The DPA forms part of these Terms, applies to every Customer whose Customer Data PRAGMABLE processes, and prevails over these Terms as regards that processing. A copy is available on request at privacy@pragmable.com.

For the personal data PRAGMABLE processes for its own purposes — the account data of Authorized Users, billing data, identity verification (KYC) data, Usage Data, and website data — PRAGMABLE acts as controller, as described in the Privacy Policy.

14.2 Data Location

Customer Data is hosted in the European Union. The infrastructure running the Service, including its databases and backups, is provided by OVH SAS (OVHcloud), a company incorporated in France, in data centers located in France, and is subject to French and European Union law. The web application is hosted in the European Union by Hostinger.

Some subprocessors belong to groups headquartered outside the European Union and may be subject to the laws of those countries, including laws allowing public authorities to access data. They currently include Datadog, which provides monitoring and error tracking from its European Union region, and, where Authorized Users use the AI Assistant, the large-language-model providers it relies on, which include Anthropic, processing prompts and the Customer Data they contain in the United States. Where the Customer configures its own large-language-model provider, that provider processes such data on the Customer's behalf and is not a subprocessor of PRAGMABLE. A current list of subprocessors and their locations is available on request at privacy@pragmable.com and is maintained in accordance with the DPA.

PRAGMABLE will not transfer Customer Data outside the EU/EEA unless:

• the Customer has given prior written consent;
• an adequate level of data protection is ensured in the destination country by an adequacy decision of the European Commission; or
• appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by a Transfer Impact Assessment where required.

To prevent access to Customer Data by public authorities of third countries that would conflict with European Union or Member State law, PRAGMABLE stores Customer Data in the European Union and encrypts it in transit and at rest; discloses Customer Data to a public authority only where legally compelled, and only to the extent strictly required; notifies the Customer of any such request unless legally prohibited from doing so; and challenges any request it considers unlawful or contrary to European Union law. This Section 14.2 constitutes PRAGMABLE's statement under Article 28 of the Data Act.

14.3 Anonymized Data and Service Improvement

PRAGMABLE may use Customer Data, including Findings, to create anonymized and aggregated data, and may use that data and the Usage Data to operate, secure, and improve the Service and to develop security insights, provided that such data does not identify, and cannot reasonably be used to identify, the Customer, its Authorized Users or any other individual, or the Customer's infrastructure. Anonymized and aggregated data is not Customer Data.

14.4 Data Export, Switching and Deletion

This Section 14.4 sets out the Customer's switching and data portability rights under Chapter VI of the Data Act. It applies to all subscriptions, including the Free Tier, but not to Preview Access (Section 5) or to data that remains exclusively within a Customer-Managed Deployment (Section 7.2).

(a) Export. The Customer may export its Exportable Data at any time during its subscription, at no charge, through the export features and APIs of the Service or, for any category these do not cover, on written request to PRAGMABLE.

(b) Exportable Data. The data that can be exported ("Exportable Data") consist of:

• the configuration of the Customer's account and projects, including connected cloud accounts, settings, variables, and virtual roles — excluding stored Credentials and other secrets, which are never returned for security reasons and of which the Customer holds the originals;
• the configuration data collected from, or submitted for, the Customer Environment;
• the Findings, including saved results, reports, and alarm history;
• the queries, monitors, alarm workflows, dashboards, and annotations saved by the Customer;
• the AI Assistant conversations of the Customer's Authorized Users;
• the list of Authorized Users and their roles, and the activity logs and Usage Data relating to the Customer's account.

Exportable Data are provided in structured, commonly used, machine-readable formats (JSON and, for tabular data, CSV). Data specific to the internal functioning of the Service whose disclosure would expose PRAGMABLE's trade secrets are excluded: the internal graph, index, and cache structures the Service derives from Customer Data, and the PRAGMABLE Materials other than as reproduced in Findings. These exclusions do not impede or delay switching, since the data from which those structures are derived remain exportable.

(c) Switching request. The Customer may at any time notify PRAGMABLE in writing that it wishes to switch to another provider, to port its Exportable Data to its own infrastructure, or to have its Exportable Data erased. The Customer chooses in that notice the date on which the transition period begins, which may be no later than two (2) months after the notice (maximum notice period).

(d) Transition period. The transition period lasts up to thirty (30) calendar days, during which these Terms remain in force and PRAGMABLE: (i) provides reasonable assistance to the Customer and to the third parties it authorizes; (ii) continues to provide the Service with due care to maintain business continuity; (iii) informs the Customer of any known risk to that continuity; and (iv) maintains a high level of security, in particular during the transfer of data. PRAGMABLE supports the Customer's exit strategy, including by providing all relevant information. If a transition period of thirty (30) days is technically unfeasible, PRAGMABLE will inform the Customer within fourteen (14) working days of the request, with reasons, and indicate an alternative transition period of no more than seven (7) months. The Customer may extend the transition period once, for the period it considers appropriate.

(e) End of the contract. These Terms terminate upon successful completion of the switching or, where the Customer requested erasure only, at the end of the notice period, and PRAGMABLE notifies the Customer of the termination. PRAGMABLE charges no switching fees. Fees accrue until termination, and switching does not release the Customer from the Fees for the remainder of a committed Subscription Term, which the Parties expressly agree as the only charge on early termination.

(f) Retrieval period and erasure. After the transition period, or after any other termination or expiry of these Terms, the Customer may retrieve its Exportable Data for thirty (30) calendar days. PRAGMABLE then erases all Exportable Data and other Customer Data within thirty (30) days, unless applicable law requires their retention, and confirms the erasure in writing on request. Copies held in encrypted backups are erased as the backups rotate, within ninety (90) days, and remain protected by these Terms until then. Logs are kept as set out in Section 14.5. The Customer may request earlier deletion of its data in writing.

(g) Unauthorized environments. Where PRAGMABLE has suspended or terminated access because a Customer Environment was connected without proper authorization or for unlawful purposes, PRAGMABLE may withhold from retrieval, and erase, the data relating to that environment.

14.5 Logs and Audit

PRAGMABLE may maintain logs of platform activity for security, troubleshooting, and compliance purposes. Such logs may include technical information related to the operation of the Service and are retained for up to twelve (12) months from their creation, after which they are deleted or anonymized.

14.6 Security Incident Notification

PRAGMABLE will notify the Customer of any confirmed or reasonably suspected security incident affecting Customer Data without undue delay, and in any event within forty-eight (48) hours of becoming aware of it, so that the Customer can meet its own obligations, including notification of the supervisory authority under Article 33 of the GDPR. Notifications are sent to the email address associated with the Customer's account and to any security contact the Customer has designated.

The notification will include, to the extent available, and will be supplemented as further information becomes available:

• a description of the nature of the incident;
• the categories and approximate number of data subjects and data records concerned;
• the likely consequences of the incident;
• the measures taken or proposed to address the incident and mitigate its effects; and
• a contact point for further information.

PRAGMABLE will cooperate reasonably with the Customer's own notifications and investigation. A notification is not an acknowledgment of fault or liability.

14.7 Security Measures

PRAGMABLE implements and maintains appropriate technical and organizational measures to protect the Service and Customer Data against unauthorized access, loss, or alteration, as further described in the DPA, including:

• encryption of Customer Data in transit and at rest, including backups;
• individual accounts, multi-factor authentication, and least-privilege access for PRAGMABLE personnel, with administrative access to production systems restricted to a private network;
• logging and monitoring of production systems, including intrusion detection;
• vulnerability management, patching, and dependency management;
• regular backups and a documented incident response process;
• confidentiality undertakings from all personnel with access to Customer Data.

PRAGMABLE will not materially reduce the overall level of these measures during a Subscription Term. Upon the Customer's reasonable written request, no more than once per year, PRAGMABLE will provide a summary of its security measures, subject to confidentiality.

15. Disclaimer of Warranties

The Service is provided on an "AS IS" and "AS AVAILABLE" basis.

PRAGMABLE does not warrant that the Service will operate without interruption or error.

PRAGMABLE is responsible for the third-party software, libraries, and services it uses to provide the Service, and applies reasonable supply-chain security practices to them, including dependency management, review of updates, and monitoring of published vulnerabilities. Beyond those practices and the other commitments in these Terms, PRAGMABLE gives no warranty in respect of such third-party components.

Except as expressly stated in these Terms, PRAGMABLE makes no warranties, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, or non-infringement.

Unless a separate Service Level Agreement (SLA) has been executed in writing between PRAGMABLE and the Customer, the Service is provided without any commitment regarding availability, response time, or performance levels. PRAGMABLE will use commercially reasonable efforts to maintain the availability of the Service but does not guarantee uninterrupted access.

16. Limitation of Liability

16.1 Liability Cap

Subject to Section 16.3, each Party's total aggregate liability arising out of or related to these Terms and the Service, whatever the cause of action, shall not exceed the total Fees paid or payable by the Customer during the twelve (12) months preceding the event giving rise to the claim. This cap applies equally to both Parties and to all claims, including claims relating to confidentiality, data protection, security incidents, and the indemnities in Section 17. The limits applicable to Preview Access and to the Free Tier are set out in Sections 5 and 6.4.

16.2 Excluded Damages

Subject to Section 16.3, neither Party shall be liable for any indirect damages within the meaning of French law, including loss of profits, loss of revenue, loss of data, loss of business opportunities, reputational harm, or business interruption.

PRAGMABLE shall not be responsible for:

• configuration changes, system failures, or operational impacts resulting from Customer infrastructure configurations or third-party services;
• failures, vulnerabilities, or security incidents arising from third-party services, cloud providers, external libraries, or integrations used by the Customer.

16.3 Exceptions

Nothing in these Terms excludes or limits a Party's liability for (a) death or personal injury; (b) willful misconduct (dol) or gross negligence (faute lourde); (c) the Customer's obligation to pay the Fees; or (d) any other liability that cannot be excluded or limited under applicable French law.

17. Indemnification

17.1 By the Customer

The Customer agrees to indemnify, defend, and hold harmless PRAGMABLE, its officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising from:

• the Customer's breach of applicable laws or third-party rights;
• the Customer's violation of these Terms;
• the Customer's use of the Service on infrastructure it does not own or is not authorized to test.

17.2 By PRAGMABLE (IP Indemnification)

PRAGMABLE agrees to defend, indemnify, and hold the Customer harmless from and against any third-party claim alleging that the Customer's use of the Service in compliance with these Terms infringes upon such third party's intellectual property rights.

If such a claim is made or appears likely, PRAGMABLE may, at its option and expense: (a) procure for the Customer the right to continue using the Service; (b) modify or replace the affected part of the Service so that it is no longer infringing, without material loss of functionality; or, if neither option is reasonably available, (c) terminate the affected subscription and refund the prepaid Fees covering the period after termination.

PRAGMABLE's indemnification obligation does not apply to the extent the third-party claim arises out of or relates to:

• the Customer's breach of these Terms;
• Customer Data or content;
• use of the Service in connection with materials not provided by PRAGMABLE; or
• Preview Access.

This Section 17.2 states PRAGMABLE's entire liability, and the Customer's exclusive remedy, for any infringement of third-party intellectual property rights by the Service.

17.3 Procedure

The indemnified Party will promptly inform the indemnifying Party of the applicable claim. The indemnifying Party will have sole control of the defense and all related settlement negotiations, provided it may not settle the claim unless it unconditionally releases the indemnified Party of all liability or obtains the indemnified Party's prior approval. The indemnified Party will cooperate with the claim investigation, defense, and trial upon reasonable request.

Each Party's obligations under this Section 17 are subject to the limits set out in Section 16.

18. Fees, Pricing and Service Changes

18.1 Fees

The Customer shall pay the Fees set out in the Order Form, in the currency stated there. Where the Customer's plan includes limits, such as a maximum number of connected cloud accounts, or usage-based charges, usage beyond the plan is charged at the rates stated in the Order Form or, absent such rates, requires an upgrade to a suitable plan. Except as expressly provided in Sections 17.2, 19, 20.6, and 21, Fees are non-refundable.

18.2 Invoicing and Payment

Subscription Fees are invoiced or charged in advance at the start of each billing period, and usage-based Fees in arrears. Fees paid by card or direct debit are collected on the invoice date; other invoices are payable within thirty (30) days of the invoice date. Payments are made without set-off or deduction. No discount is granted for early payment.

18.3 Late Payment

Any amount not paid when due automatically bears late-payment interest, from the day after the due date and without any reminder being necessary, at the rate applied by the European Central Bank to its most recent refinancing operation plus ten (10) percentage points, together with the fixed indemnity for recovery costs of forty euros (€40) per invoice, in accordance with Articles L. 441-10 and D. 441-5 of the French Commercial Code. Where the recovery costs incurred exceed that amount, PRAGMABLE may claim additional compensation upon justification. PRAGMABLE may also suspend the Service in accordance with Section 20.3.

18.4 Taxes

Fees are exclusive of VAT and any other applicable taxes, which are borne by the Customer. French VAT is invoiced where applicable. A Customer established in another Member State of the European Union that provides a valid VAT identification number self-assesses VAT under the reverse-charge mechanism (Article 196 of Council Directive 2006/112/EC). A Customer established outside the European Union is responsible for any VAT, GST, sales, or similar taxes applicable in its jurisdiction.

18.5 Price Changes

PRAGMABLE may change its prices by giving the Customer at least thirty (30) days' prior written notice. A price change takes effect only at the start of the first renewal of the Subscription Term following that notice, and never during a Subscription Term already under way. If the Customer does not accept the change, it may cancel the renewal of its subscription in accordance with Section 20.1.

18.6 Service Modifications

PRAGMABLE may modify, update, or improve the Service at any time in order to enhance security, functionality, or performance, which may result in changes to features or functionality. During a paid Subscription Term, PRAGMABLE will not materially reduce the core functionality of the Service included in the Customer's plan. This commitment does not apply to Preview Access or to the Free Tier, nor to changes required by law, by a cloud provider, or to address a security risk.

19. Changes to Terms

PRAGMABLE may modify these Terms from time to time. When PRAGMABLE makes a material change, it will provide the Customer with prominent notice by email or within the platform. Price changes are governed by Section 18.5.

To the extent any material change is materially less favorable to the Customer than the original term, the Customer may, as its sole and exclusive remedy, terminate these Terms and obtain a pro-rata refund of any prepaid and unused Fees.

The Customer's failure to terminate and request a pro-rata refund within thirty (30) days from the date the Customer is informed of the change will be deemed acceptance of the revised Terms.

20. Term, Suspension and Termination

20.1 Subscription Term, Renewal and Cancellation

Each paid subscription starts on the date set out in the Order Form and runs for the initial Subscription Term stated there. Unless cancelled, it renews automatically for successive periods of the same length, at the prices then in effect under Section 18.5.

Either Party may cancel the renewal: for a monthly subscription, at any time before the next renewal date; for an annual or longer subscription, by notice given at least thirty (30) days before the end of the current Subscription Term. The Customer may cancel from its account settings, where available, or by written notice under Section 28 (General Provisions). Cancellation takes effect at the end of the current Subscription Term, until which the Customer keeps access to the Service; Fees already paid for that term are not refunded.

The Customer's right to switch provider or to have its data erased under Section 14.4 applies at any time, irrespective of the Subscription Term. The Free Tier and Preview Access have no Subscription Term and may end as set out in Sections 5 and 6.

20.2 Immediate Suspension

PRAGMABLE may immediately suspend or restrict access to the Service if it reasonably determines that the Customer's use may pose a security risk, violate applicable laws, violate these Terms, or threaten the integrity of the platform.

20.3 Suspension for Non-Payment

PRAGMABLE may suspend access to the Service eight (8) days after written notice to the Customer if the Customer fails to pay any amounts due under these Terms.

20.4 Termination for Breach

Either Party may terminate these Terms, or the affected subscription, immediately on written notice if the other Party is in material breach and fails to cure that breach within thirty (30) days of receipt of written notice describing it.

PRAGMABLE may terminate access immediately if the Customer's use of the Service breaches applicable law or these Terms in a manner that cannot be cured.

20.5 Security and Abuse Prevention

PRAGMABLE reserves the right to temporarily or permanently block access to the Service for any Authorized User, organization, IP address, or Customer Environment if it detects suspicious or abusive behavior, including but not limited to:

• unauthorized extraction, dumping, or scraping of the PRAGMABLE Materials (Section 11);
• automated access patterns that exceed reasonable usage limits;
• attempts to bypass technical protections or access controls;
• activity that threatens the security, integrity, or availability of the Service; or
• use of the Service in connection with malicious or fraudulent activities.

PRAGMABLE will use commercially reasonable efforts to notify the affected Customer prior to implementing any block, except where notification may compromise an investigation, violate legal obligations, or where immediate action is required to prevent harm. Notifications will be sent to the email address associated with the Customer account.

The Customer may request review of any block by contacting PRAGMABLE support. PRAGMABLE will review the request in good faith and respond within a reasonable timeframe.

This Section 20.5 is without prejudice to PRAGMABLE's rights under Sections 20.2 (Immediate Suspension) and 20.4 (Termination for Breach).

20.6 Effect of Termination

Upon expiry or termination of these Terms or of a subscription, for any reason: (a) the Customer's right to use the Service ends, and the Customer shall cease all use of it; (b) the Customer shall uninstall the Installed Components, other than those governed by an open-source license, and destroy all copies of them; (c) Fees accrued up to the effective date of termination become due; and (d) the Customer's data is made available for retrieval, and then deleted, as set out in Section 14.4.

If the Customer terminates for PRAGMABLE's uncured material breach under Section 20.4, PRAGMABLE refunds the prepaid Fees covering the period after the effective date of termination.

20.7 Survival

Sections 1 (Definitions), 12 (Intellectual Property), 13 (Confidentiality), 14 (Data Processing and Privacy) for as long as PRAGMABLE holds Customer Data, 14.3 (Anonymized Data and Service Improvement) without limitation in time, 15 (Disclaimer of Warranties), 16 (Limitation of Liability), 17 (Indemnification), 18 (Fees, Pricing and Service Changes) as regards Fees accrued before termination, 20.6 (Effect of Termination), 20.7 (Survival), 22 (Governing Law and Jurisdiction), 27 (Governing Language), and 28 (General Provisions) shall survive the expiration or termination of these Terms to the fullest extent necessary for their enforcement and for the protection of the Party in whose favor they operate.

21. Force Majeure

Neither Party shall be liable for any delay or failure to perform its obligations, other than payment obligations, caused by an event of force majeure within the meaning of Article 1218 of the French Civil Code, that is, an event beyond the affected Party's control which could not reasonably have been foreseen when these Terms were accepted and whose effects cannot be avoided by appropriate measures.

An outage of a cloud provider or other subcontractor, a cyberattack, or an internet disruption constitutes force majeure only if it meets these conditions, which in particular requires the affected Party to have implemented the security and continuity measures that these Terms require of it.

The affected Party shall promptly notify the other Party and use reasonable efforts to mitigate the effects of the event. If the event prevents performance for more than sixty (60) consecutive days, either Party may terminate these Terms upon fifteen (15) days' prior written notice, and PRAGMABLE will refund any prepaid Fees covering the period after termination.

22. Governing Law and Jurisdiction

These Terms shall be governed by and construed in accordance with the laws of France, without regard to conflict of law principles. The United Nations Convention on Contracts for the International Sale of Goods (Vienna, 1980) shall not apply.

The Parties undertake to take all reasonable steps to reach a mutual agreement on any dispute before initiating legal proceedings.

Any dispute arising from or relating to these Terms or the use of the Service shall fall under the exclusive jurisdiction of the courts of Paris, France — where it has jurisdiction, the commercial court of Paris (currently the Tribunal des activités économiques de Paris) — even in the case of summary or interim proceedings (référé), third-party claims (appel en garantie), or multiple defendants.

23. Export Compliance

The Customer agrees to comply with all applicable export control and trade sanction laws and regulations.

The Customer represents that it is not located in, under the control of, or a national or resident of any country subject to applicable trade restrictions and is not listed on any government sanctions list.

24. Anti-Bribery

Each Party shall comply with applicable anti-bribery and anti-corruption laws, including the French law of December 9, 2016, on transparency, the fight against corruption and the modernization of economic life (Loi Sapin II).

25. AWS Marketplace

If the Service is purchased through AWS Marketplace, billing, payment processing, and subscription management may be handled by AWS in accordance with AWS Marketplace terms and conditions.

In the event of a conflict between these Terms and the applicable AWS Marketplace terms regarding billing or payment, the AWS Marketplace terms shall prevail.

26. Support

Customer support for the Service is provided in accordance with PRAGMABLE's Support Policy applicable to the Customer's plan, which may be updated from time to time and made available on the PRAGMABLE website or documentation portal. During a paid Subscription Term, PRAGMABLE will not materially reduce the level of support included in the Customer's plan.

27. Governing Language

These Terms are drafted in English. In the event of a translation into any other language, the English version shall prevail in case of conflict or ambiguity.

28. General Provisions

• Severability: If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
• Entire Agreement: These Terms, together with the DPA, the Order Form, and any SLA, constitute the entire agreement between the Parties regarding the Service, superseding any prior or contemporaneous agreements, communications, and proposals.
• Order of Precedence: In case of conflict, the following order applies: (1) any separate agreement signed by both Parties for the Service, such as a Master Subscription Agreement, and its order forms; (2) the DPA, as regards the processing of personal data; (3) the Order Form; (4) any SLA, as regards service levels; (5) these Terms; and (6) the Support Policy and the Documentation. Where the Service is purchased through AWS Marketplace, Section 25 applies to billing and payment.
• Assignment: Neither Party may assign these Terms without the prior written consent of the other Party, except to an Affiliate or in connection with a merger, reorganization, or sale of substantially all of its assets. The assigning Party will provide the other Party with prompt written notice.
• Waiver: Failure by either Party to enforce any provision of these Terms shall not constitute a waiver of that provision or any other provision.
• Independent Contractors: The Parties are independent contractors. Nothing in these Terms creates a relationship of agency, partnership, joint venture, or employment between the Parties. Neither Party has the authority to bind or commit the other Party in any way.
• Publicity: Neither Party may use the other Party's name, logo, or trademarks in publicity, customer lists, or marketing materials without the other Party's prior written consent (email suffices), which may be withdrawn at any time for future use.
• Notices: Notices to PRAGMABLE shall be sent to legal@pragmable.com or to PRAGMABLE, 9 rue de Budapest, 75009 Paris, France; notices to the Customer, to the email address associated with its account. The Parties may use email to satisfy written notice or consent requirements under these Terms.
• No Third-Party Beneficiaries: Except as expressly set out herein, there are no third-party beneficiaries under these Terms.