End User License Agreement

1.1 "Authorized Users" means Client's employees, contractors, and agents permitted by Client to access the Products for Client's internal business purposes.

1.2 "DPA" means the Ekatra Data Processing Agreement, available at ekatra.io/legal/dpa, which governs Ekatra's processing of personal data on Client's behalf and is incorporated into this Agreement by reference.

1.3 "Documentation" means the user guides and technical materials Ekatra makes available describing the Products' features and use.

1.4 "Permitted Purpose" means Client's internal use of the Products for its own business continuity, emergency management, and operational response activities, as further described in any applicable order or product description.

1.5 "Products" means Ekatra's software products, services, and AI-assisted features made available to Client under a subscription, as described in the applicable order or product description. The Products do not include any ServiceNow platform capabilities, which are separately licensed to Client by ServiceNow.

1.6 "Subscription Term" means the period during which Client is authorized to access a Product, as specified in the applicable order.

2.1 License Grant. Subject to Client's compliance with this Agreement and timely payment of applicable fees, Ekatra grants Client a limited, non-exclusive, non-transferable, non-sublicensable license during the Subscription Term to access and use the Products solely by Authorized Users for the Permitted Purpose.

2.2 Authorized Users. Client is responsible for its Authorized Users' compliance with this Agreement. Client shall promptly notify Ekatra of any unauthorized access to the Products.

3.1 Prohibited Uses. Client shall not, and shall not permit any Authorized User or third party to:

(a) reverse engineer, decompile, or otherwise attempt to derive the source code or underlying structure of the Products;

(b) sublicense, sell, resell, or otherwise make the Products available to any third party other than Authorized Users;

(c) use the Products to develop a competing product or service, or benchmark the Products against a competing product without Ekatra's prior written consent;

(d) use the Products to process protected health information, payment card data, criminal-justice information, or export-controlled technical data unless expressly authorized in writing by Ekatra;

(e) use the Products for surveillance or tracking of individuals in a manner that is unlawful or discriminatory;

(f) use the Products as the sole automated fail-safe for life-critical systems, including medical devices, nuclear facilities, or aircraft navigation;

(g) use the Products as a substitute for 9-1-1 or any government-operated emergency communication system;

(h) use the Products for or on behalf of any U.S. federal government agency without a separate written agreement with Ekatra covering applicable federal acquisition requirements; or

(i) use the Products in violation of applicable law, including export control and sanctions laws.

4.1 AI Outputs. Certain Products generate draft response plans, task templates, recommendations, or other AI-assisted outputs ("AI Outputs"). AI Outputs are decision-support tools only and do not constitute professional advice. Client is solely responsible for reviewing and approving all AI Outputs before taking any operational action. Ekatra does not warrant that AI Outputs will be error-free or suitable for any particular scenario.

4.2 Human Review. Client shall ensure that qualified personnel review and approve all AI Outputs before any AI Output is used to direct field operations, activate a response plan, or otherwise affect real-world conditions.

4.3 No Training on Client Data. Ekatra will not use Client data, Authorized User inputs, or AI Outputs generated from Client data to train, fine-tune, or evaluate any AI or machine-learning model shared across customers or made available to third parties, without Client's prior written consent.

4.4 ServiceNow AI Terms. AI features that operate through the ServiceNow platform are also subject to ServiceNow's then-current AI Acceptable Use Policy under Client's ServiceNow agreement.

5.1 Data Processing. Ekatra's collection and processing of personal data in connection with the Products is governed by the DPA and Ekatra's Privacy Policy (ekatra.io/legal/privacy). In the event of a conflict between the DPA and this Agreement on matters of personal data, the DPA controls.

5.2 Data Architecture. The Products are designed so that Client data remains within Client's ServiceNow instance, subject to Client's chosen ServiceNow data residency. Ekatra processes Client data solely to deliver and support the Products and for no other commercial purpose.

5.3 No Retention of Everbridge Data. Ekatra will not retain any data originating from or provided through Everbridge's products or services for more than sixty (60) days after the transaction or activity for which such data was accessed is complete, except as required by law.

5.4 Security. Ekatra maintains an information security program appropriate to the nature of data processed, including encryption in transit and at rest, multi-factor authentication for administrative access, vulnerability management, and annual security training. Details are set out in Annex II of the DPA.

5.5 Breach Notification. Ekatra will notify Client within twenty-four (24) hours of confirming a security incident involving unauthorized access to Client data. Ekatra will not make any public statement referencing Everbridge in connection with a security incident without Everbridge's prior written consent, except as required by law.

5.6 Subprocessors. Ekatra will provide at least thirty (30) days' advance notice before engaging any new subprocessor that will process Client data. Client may object on reasonable data-protection or security grounds within fifteen (15) days of such notice.

6.1 Ekatra IP. Ekatra retains all right, title, and interest in and to the Products, Documentation, AI models, and underlying technology. No rights are granted to Client except as expressly set out in this Agreement.

6.2 Client IP. Client retains all right, title, and interest in and to Client data and source documents. Client grants Ekatra a limited license to use Client data solely to deliver the Products during the Subscription Term.

6.3 Feedback. Client may provide feedback about the Products and Ekatra may use such feedback without restriction or obligation to Client.

6.4 Open Source. Ekatra represents that no open-source component of the Products is subject to a copyleft license that would require Client's proprietary software to be made available under open-source terms.

7.1 Limited Warranty. Ekatra warrants that during the Subscription Term: (a) the Products will materially conform to the Documentation; (b) the Products do not contain malicious code, viruses, or similar harmful components, and are designed to prevent unauthorized access; (c) the Products will not materially interfere with Everbridge's products or Client's ServiceNow instance; (d) no open-source component encumbers Client's proprietary software with copyleft obligations; and (e) Ekatra will comply with applicable data protection, privacy, and export control laws.

7.2 Warranty Remedy. If Ekatra breaches the warranty in Section 7.1(a), Client's sole remedy is to notify Ekatra in writing. Ekatra shall use commercially reasonable efforts to correct the non-conformity within thirty (30) days. If Ekatra cannot do so, Client may terminate the affected Product and receive a pro-rated refund of prepaid unused fees.

7.3 Disclaimer.

EXCEPT AS EXPRESSLY STATED IN SECTION 7.1, THE PRODUCTS ARE PROVIDED "AS IS." EKATRA DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. EKATRA IS NOT RESPONSIBLE FOR THE AVAILABILITY OR PERFORMANCE OF THE SERVICENOW PLATFORM, EVERBRIDGE PRODUCTS, OR ANY THIRD-PARTY SERVICES. AI OUTPUTS ARE PROVIDED AS DECISION-SUPPORT DRAFTS ONLY - EKATRA MAKES NO WARRANTY AS TO THEIR ACCURACY OR FITNESS FOR ANY OPERATIONAL PURPOSE.

8.1 Exclusion of Consequential Damages.

IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES - INCLUDING LOSS OF REVENUE, PROFITS, BUSINESS, OR DATA - ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE PRODUCTS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

8.2 Liability Cap.

EACH PARTY'S TOTAL CUMULATIVE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE PRODUCTS SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CLIENT TO EKATRA FOR THE PRODUCTS DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

8.3 Exceptions. Sections 8.1 and 8.2 do not apply to: (a) either party's indemnification obligations under Section 9; (b) Client's breach of Section 3 (restrictions); (c) breach of Section 11.3 (confidentiality); or (d) liability arising from gross negligence or willful misconduct.

8.4 Enhanced Cap for Security Incidents. Notwithstanding Section 8.2, Ekatra's total liability for claims arising directly from a security incident caused by Ekatra's material failure to maintain its security program shall not exceed two times (2x) the fees paid by Client during the twelve (12) months preceding the incident. The exclusion of consequential damages in Section 8.1 continues to apply.

8.5 Essential Basis. The limitations in this Section 8 reflect a reasonable allocation of risk and are an essential element of the basis of the bargain between the parties.

9.1 Ekatra Indemnification. Ekatra will defend Client against any third-party claim that the Products, as delivered by Ekatra and used in accordance with this Agreement, infringe any U.S. patent, copyright, trademark, or trade secret, and will indemnify Client for damages finally awarded or agreed in settlement by Ekatra. This obligation does not apply to claims arising from: (a) Client's modification of the Products; (b) combination with third-party products not supplied by Ekatra where the claim would not arise but for the combination; or (c) Client's use of the Products in violation of this Agreement. If an infringement claim is brought or threatened, Ekatra may at its option: (i) obtain the right for Client to continue using the Products; (ii) modify the Products to be non-infringing; or (iii) if neither is commercially practicable, terminate the affected Product with sixty (60) days' notice and refund prepaid unused fees.

9.2 Client Indemnification. Client will defend and indemnify Ekatra against any third-party claim arising from Client's use of the Products in violation of this Agreement or applicable law, or from the content of Client data.

9.3 Procedure. The indemnified party shall: (a) promptly notify the indemnifying party; (b) give the indemnifying party sole control of the defense (provided settlements imposing obligations on the indemnified party require its consent); and (c) provide reasonable cooperation at the indemnifying party's expense.

10.1 Term. This Agreement begins when Client first accesses the Products and continues until all active Subscription Terms have expired or been terminated.

10.2 Termination for Cause. Either party may terminate this Agreement or any subscription immediately on written notice if the other party: (a) materially breaches this Agreement and fails to cure within thirty (30) days after written notice; or (b) becomes insolvent or subject to bankruptcy proceedings.

10.3 Effect of Termination. On termination: (a) Client's license to access the affected Products immediately ceases; and (b) Ekatra will delete Client data in accordance with the DPA. Sections 3, 4.3, 6.1, 7.3, 8, 9, 10.3, and 11 survive termination.

11.1 Governing Law. This Agreement is governed by the laws of the State of Delaware, without regard to conflict-of-laws principles. Notwithstanding the foregoing, Ekatra's obligations with respect to personal data are governed by applicable data protection law. Disputes shall first be subject to good-faith negotiation between senior representatives for thirty (30) days. Unresolved disputes shall be settled by binding arbitration administered by JAMS under its Commercial Arbitration Rules, seated in Wilmington, Delaware. Either party may seek injunctive relief in any court of competent jurisdiction to protect intellectual property or confidential information.

11.2 Updates to this Agreement. Ekatra may update this Agreement from time to time and will post the updated version at https://www.ekatra.io/legal/emergencyact-eula with at least sixty (60) days' advance notice of material changes. Continued use of the Products after the effective date of any update constitutes acceptance. For changes that materially and adversely affect Client's rights, Client may terminate the affected subscription within thirty (30) days of Ekatra's notice and receive a pro-rated refund of prepaid fees.

11.3 Confidentiality. Each party will protect the other's non-public confidential information with at least the same care it applies to its own, and will use it only for purposes of this Agreement. These obligations do not apply to information that is or becomes public through no fault of the Receiving Party, is independently developed, or is required to be disclosed by law.

11.4 Export Controls. Client will not export or transfer the Products in violation of applicable U.S. export control or sanctions laws.

11.5 Assignment. Neither party may assign this Agreement without the other's prior written consent, except in connection with a merger, acquisition, or sale of substantially all of its assets, provided the assignee assumes all obligations. Any other purported assignment is void.

11.6 Third-Party Beneficiary. Where Client procures the Products through Everbridge, Inc., Everbridge is an express third-party beneficiary of Sections 4, 5, 7.1, and 9.1 of this Agreement and may enforce those provisions directly against Ekatra. Client may also enforce this Agreement directly against Ekatra without routing claims through Everbridge.

11.7 Force Majeure. Neither party is liable for delays caused by events beyond its reasonable control, provided the affected party promptly notifies the other and uses commercially reasonable efforts to resume performance. Force majeure does not excuse payment obligations or Ekatra's breach notification obligations under Section 5.5.

11.8 Relationship of Parties. The parties are independent contractors. Nothing in this Agreement creates any partnership, employment, franchise, or agency relationship.

11.9 Entire Agreement; Order of Precedence. This Agreement, together with the DPA and the applicable order and product description, is the entire agreement between the parties on its subject matter. In the event of conflict, the applicable order controls, then the product description, then the DPA, then this Agreement.

11.10 Severability; Waiver. If any provision is held invalid, the remainder continues in full force. A party's failure to enforce any provision is not a waiver.

11.11 Contact. Questions about this Agreement may be directed to info@ekatra.io or Ekatra AI, Inc., 3945 Freedom Cir #560, Santa Clara, CA 95054.