Acceptable Use Policy

1. Purpose, scope and status

1.1 This Acceptable Use Policy (AUP) is issued by SovSec Ltd, a private limited company registered in England and Wales under company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS] — and, from the date on which it assumes the contract by written notice, its Austrian subsidiary [SOVSEC FLEXCO NAME], registered in the Austrian commercial register (Firmenbuch) under FN [FN NUMBER], Landesgericht [COURT], seat [ADDRESS, AUSTRIA] (planned 2028) (SovSec, we, us).

1.2 It applies to everyone who accesses or uses any SovSec service or any Prismara product (the Services), including business clients and their authorised users, MSP partners and their customers, and individuals using Prismara Personal Free or Personal Secure (you). It also applies to our websites and Demo Sites (see SOV- LG-007).

1.3 This AUP forms part of every agreement under which we provide the Services. If you are a business client or partner, you must ensure that your users, and your own customers where you resell or manage Services, comply with it, and you are responsible for their breaches as for your own.

1.4 Where your agreement contains more specific rules (for example usage limits in an order, or the authorisation requirements for Prismara Crucible), those rules apply in addition to this AUP.

1.5 This AUP does not ask you to monitor anyone else's use and does not mean that we monitor the content of your data. Prismara is built so that, for many products, we cannot read your content (for example Mail sealed storage and Prism vaults). We enforce this AUP using metadata, rate signals, reports and lawful requests, as described in our Privacy Policy (SOV-LG-005).

2. Illegal and harmful content

2.1 You must not use the Services to create, store, send, share, publish or make available content that:

1. is illegal under the law applicable to you, to us or to the recipient, including content that constitutes child sexual abuse material, terrorist content, incitement to violence or hatred, or unlawful threats; 2. infringes intellectual property rights, privacy rights or other rights of any person; 3. is defamatory, harassing, discriminatory, or intended to intimidate or harm any person; 4. is fraudulent or deceptive, including impersonation of any person or organisation, fake invoices, investment scams or counterfeit goods offers; 5. promotes or facilitates the sale of illegal goods or services, including weapons, drugs or stolen data; or 6. discloses personal data, credentials or confidential information of others without a lawful basis.

2.2 We report child sexual abuse material to the competent authorities (including the Austrian Federal Criminal Police Office reporting point, Meldestelle Kinderpornografie und Kindersextourismus) as the law requires or allows, and we will terminate the account concerned.

3. Abuse: spam, phishing and malware

3.1 You must not use the Services to:

1. send unsolicited bulk or commercial messages (spam) or messages that breach § 174 TKG 2021 or equivalent anti-spam law, including by email, Prismara Talk, forms or notifications; 2. harvest, buy or use email lists or addresses collected without consent, or use list-bombing or dictionary attacks;

S O V S E C · A C C E P TA B L E U S E P O L I C Y SOV-LG-008 · v1.0 · EU

3. send or host phishing pages, credential-harvesting forms, or messages designed to trick recipients into revealing information or making payments (except authorised phishing simulations under clause 4); 4. host, distribute or link to malware, ransomware, spyware, exploit kits, botnet command-and-control or cryptomining code; 5. forge, falsify or obscure message headers, sender identity or domain authentication (SPF, DKIM, DMARC), or relay mail for third parties without authorisation; 6. use Prismara Spaces, Mail, Talk or Work share links as a file-hosting service for unlawful or abusive content, or to distribute content to the public at large; or 7. operate open proxies, open relays or anonymising services for third parties on Prismara Cloud or other Services.

3.2 Security research samples (for example malware held for analysis by a SOC, IR or detection engineering team) may be stored only in a clearly labelled, access-controlled location, must not be executable from shared links, and must never be distributed except to recognised security parties.

4. Security testing

4.1 You must not scan, probe, test the vulnerability of, attack or attempt to gain unauthorised access to any system, network, account or data — whether ours, another user's or a third party's — unless you have the prior, written authorisation of the owner of that system. Unauthorised access may be an offence under §§ 118a, 119, 119a and 126a–126c of the Austrian Criminal Code (StGB) and the corresponding laws of the Member State concerned.

4.2 Prismara Crucible (automated penetration testing) and SovSec penetration testing services may be used only against targets for which the client has signed a Crucible / Penetration Test Authorisation (SOV-LG-011), confirming that it owns or is authorised to test every target in scope. Crucible enforces target verification (for example DNS or file-based proof of control) and will not run against unverified targets. Any attempt to bypass target verification, to widen scope, or to use Crucible against third parties is a serious breach of this AUP.

4.3 Phishing simulations and red-team exercises must be authorised in writing by the organisation being tested, limited to its own users, and must not impersonate SovSec, Prismara or any third-party brand in a way that could mislead the public.

4.4 Good-faith research on our own products and websites is welcome under our Vulnerability Disclosure Policy (SOV-LG-013). Research outside that policy is not authorised.

4.5 You may run security tools (including vulnerability scanners) against systems you own that are hosted on Prismara Cloud, provided the activity stays within your own resources, does not degrade shared infrastructure, and does not trigger load or denial-of-service effects. Tell support@sovsec.com in advance of any large-scale test.

5. Network and service abuse

5.1 You must not:

1. carry out or facilitate denial-of-service attacks, flooding, packet spoofing or traffic amplification; 2. interfere with, disrupt or place an unreasonable load on the Services, our infrastructure or any other user's service; 3. circumvent or attempt to circumvent authentication, licensing, tenant isolation, rate limits, quotas, usage metering or other technical controls;

S O V S E C · A C C E P TA B L E U S E P O L I C Y SOV-LG-008 · v1.0 · EU

4. access another user's account or data without authorisation, or share account credentials outside your organisation (accounts are personal to the named user unless the product expressly supports shared accounts); 5. reverse engineer, decompile or disassemble the Services except to the extent the law expressly allows despite this restriction (for example under § 40e of the Austrian Copyright Act (UrhG)); 6. use the Services to build a competing product, or benchmark and publish results without our consent where your agreement requires it; 7. use automated means to create accounts, or create accounts with false information or to evade a suspension; or 8. use the Services to mine cryptocurrency, unless you are a Prismara Cloud client and this is expressly allowed in your order.

6. Prismara ZTNA used as a personal VPN

6.1 Prismara Personal Secure includes Prismara ZTNA configured as a personal VPN. Your traffic leaves our network from shared egress IP addresses in the EU. Because other users share those addresses, misuse by one user can lead to the addresses being blocked for everyone. When using ZTNA as a VPN you must not:

1. use it for any illegal activity, or to evade a lawful court order, sanction or law-enforcement measure; 2. use it to download, upload or share material that infringes copyright or other intellectual property rights, including through peer-to-peer file sharing of infringing content; 3. launch or participate in attacks, scanning, brute-forcing or credential stuffing against any system; 4. send spam or bulk email, run mail servers, or operate proxies, exit relays or other services that let third parties route traffic through your connection; 5. engage in ticket scalping, ad fraud, click fraud, fake account creation or other automated abuse that damages the reputation of our egress IP addresses; or 6. use the service to access services in breach of their terms where this exposes others to blocking, or to access sanctioned services or jurisdictions in breach of EU sanctions.

6.2 Personal ZTNA is for personal, non-commercial use on the number of devices included in your plan. It is not a business remote-access product; business clients use Prismara ZTNA under their business agreement.

6.3 We do not log the content of your traffic or the websites you visit. We process the limited connection and abuse- signal data described in our Privacy Policy (SOV-LG-005) to operate the service and to deal with abuse. If we receive a credible abuse complaint or a lawful request relating to an egress IP address, we may act on it as described in section 10, and we will only disclose data where the law requires us to.

6.4 We may rate-limit or block specific ports and protocols (for example outbound SMTP on port 25) on shared egress addresses to protect their reputation.

7. Free mailboxes and sending limits

7.1 Prismara Personal Free includes a mailbox at name@prismara.eu. Free mailboxes are for personal correspondence. To protect deliverability for all users, the following controls apply:

 Control                          Personal Free                   Personal Secure      Business plans

 External recipients per 24       [100]                           [500]                As set in the order; default [2,000] per
 hours                                                                                 user

S O V S E C · A C C E P TA B L E U S E P O L I C Y SOV-LG-008 · v1.0 · EU

 Control                        Personal Free                         Personal Secure        Business plans

 Recipients per message         [20]                                  [50]                   [500]

 Messages per hour              [30]                                  [100]                  [500] per user

 New-account warm-up            Lower limits for the first [14]       Lower limits for the   Not applicable
                                days                                  first [7] days

 Automated forwarding to        Off by default; can be enabled        Allowed                Per tenant policy
 external addresses             after warm-up

 Bulk / marketing email         Not permitted                         Not permitted          Only with a dedicated sending domain
                                                                                             and consent records

7.2 Limits in square brackets are indicative and may be adjusted to protect the service; the current limits are shown in your account settings. Messages over the limits are deferred or rejected.

7.3 Accounts that send spam or phishing, show signs of compromise, or generate high complaint or bounce rates may be restricted to receive-only mode until the issue is resolved. Free accounts that are inactive for [12] months may be closed after at least [30] days' notice to the mailbox and any recovery address.

7.4 You must not create multiple free accounts to avoid limits, or use a free mailbox for business bulk-sending, newsletters, or as the sending address for automated systems.

8. Fair use

8.1 Where a plan is described as unlimited or includes generous allowances (for example storage, ZTNA bandwidth, Talk meetings or API calls), it is subject to fair use: use that is consistent with ordinary personal or business use by the number of users on the plan.

8.2 Use that is substantially higher than typical for comparable users and degrades the Services for others, or that is not the intended use (for example using Spaces as a backup target for an entire organisation's servers on a per- user plan, or ZTNA as a content-delivery relay), may be limited.

8.3 Before applying a fair-use limit we will, except in an emergency, contact you, explain the issue and give you a reasonable opportunity (normally at least [14] days) to reduce your usage or move to a suitable plan. Fair-use controls never apply to the quantities that are expressly guaranteed in your order.

8.4 For consumers, fair-use limits apply only as described in the Personal plan description you accepted, and do not reduce the characteristics of the service agreed under the VGG.

9. Encryption, export controls and sanctions

9.1 Prismara uses strong cryptography, including post-quantum algorithms. Prismara software and Services may be subject to Regulation (EU) 2021/821 (dual-use items), EU restrictive measures adopted under Art. 215 TFEU and the Austrian Foreign Trade Act 2011 (AußWG 2011), and to the export laws of other countries where they apply.

9.2 You must not use, export, re-export or provide access to the Services: (a) in or for a country or territory subject to comprehensive sanctions; (b) to or for a person or entity on a EU (or, where applicable, UN) sanctions list, or owned or controlled by one; or (c) for a prohibited end use, including weapons of mass destruction or military end uses where restricted.

9.3 You are responsible for complying with any local restrictions on the import or use of encryption in the country where you use the Services. We may block access from jurisdictions where we cannot lawfully provide the Services.

S O V S E C · A C C E P TA B L E U S E P O L I C Y SOV-LG-008 · v1.0 · EU

10. Consequences of a breach

10.1 If we reasonably believe you have breached this AUP, we may take one or more of the following steps, proportionate to the seriousness of the breach, the risk to others and your history:

 Step              What it means                                                           Typical use

 Warning           We tell you about the issue and what to change.                         First, minor or accidental breaches

 Content           We remove or disable access to specific content or a share link.        Notified illegal or infringing content
 action

 Restriction       We limit a feature (e.g. sending, sharing, VPN egress) or rate.         Spam, egress abuse, fair-use issues

 Suspension        We suspend the affected account(s) or Service temporarily.              Serious breach, compromise, ongoing
                                                                                           harm

 Termination       We end the account or agreement under its termination terms.            Severe or repeated breaches

 Reporting         We report to law enforcement, regulators or other authorities, and      Criminal activity; where the law
                   cooperate with them.                                                    requires

10.2 Except where immediate action is needed to prevent harm, to protect the Services or other users, or to comply with law, we will give you notice and a reasonable opportunity to remedy the breach before suspending or terminating. For business clients, suspension is limited to the affected users or Services where practicable.

10.3 When we restrict or remove content or an account, we will tell you what we did and why, and how you can challenge the decision, unless the law or a competent authority prevents us. Where Regulation (EU) 2022/2065 (Digital Services Act) applies to the Service concerned, we will provide a statement of reasons as required by Art. 17 DSA and you may use our internal complaint process at legal@sovsec.com.

10.4 Fees remain payable during a suspension caused by your breach, except where your agreement or mandatory consumer law says otherwise. Before termination we will give you a reasonable opportunity to export your data unless that would facilitate the harm or the law prevents it.

10.5 You are responsible for losses we suffer because of your breach of this AUP, subject to the liability terms of your agreement and, if you are a consumer, to mandatory consumer law.

11. Reporting abuse

11.1 Please report abuse of the Services as follows:

What you want to report Where

Spam, phishing or malware sent from or hosted on Prismara; abuse from a Prismara egress abuse@prismara.eu IP address; illegal content

Abuse involving SovSec services or sovsec.com security@sovsec.com

A security vulnerability in Prismara or our websites security@sovsec.com — see SOV- LG-013

Copyright or other IP infringement abuse@prismara.eu (subject: “IP notice”)

Requests from authorities legal@sovsec.com

S O V S E C · A C C E P TA B L E U S E P O L I C Y SOV-LG-008 · v1.0 · EU

11.2 To help us act quickly, include: the content or address concerned (for example the URL, share link, message headers or IP address with timestamp and time zone); why you consider it abusive or illegal; your name and email address (unless the report concerns child sexual abuse material, which you may report anonymously); and, for intellectual property complaints, a statement that you hold or represent the rights and that your report is accurate and complete to the best of your knowledge.

11.3 These details correspond to the elements of a notice under Art. 16 DSA. We will confirm receipt of your notice, decide on it in a timely, diligent and objective manner, and inform you of our decision and the available redress options.

11.4 We aim to acknowledge reports within [1] business day and to act on credible reports of phishing or malware within [24] hours. We do not tell the reported user who made the report unless the law requires it.

11.5 Please do not send malware samples as attachments; send a hash or a link to a sample in a password- protected archive and tell us the password separately.

12. Changes to this policy

12.1 We may update this AUP to respond to new types of abuse, changes in law or changes to the Services. The version and date are shown on the cover.

12.2 We will give business clients and Personal users at least [30] days' notice by email or in-product notice of changes that materially restrict permitted use, except where a change is needed urgently to address a security threat or a legal requirement. If you are a consumer and a change is to your disadvantage, you may end your subscription before it takes effect without penalty, as set out in your Personal terms.

12.3 This AUP is governed by the law that governs your agreement with us; for consumers, the mandatory law of your country of habitual residence also applies.

Drafting notes — remove before publication

• All bracketed numbers (send quotas, warm-up periods, inactivity closure, acknowledgement and action targets, notice periods) are indicative and must be confirmed against actual Prismara Mail / ZTNA configuration before publication.
• Confirm that abuse@prismara.eu is created and monitored (add to the CONTACT set) and that RFC 2142 role addresses (abuse@, postmaster@) exist for every sending domain.
• Confirm ZTNA logging statement (no content or destination logging) matches the actual implementation and SOV-LG-005; this is a public commitment.
• Sanctions / export wording to be checked by counsel (EU: confirm Austrian AußWG 2011 references and any notification duties).
• Digital Services Act: Prismara Mail/Spaces/Talk may be intermediary (hosting) services. Arts. 11–13, 16 and 17 apply regardless of size; SovSec Ltd is not established in the EU and must designate a legal representative in a Member State (Art. 13 DSA) — see SOV-LG-014. Rechtsanwalt to confirm.
• CSAM reporting route to be confirmed with counsel (Bundeskriminalamt reporting point).
• Reverse-engineering carve-out references to be confirmed (UrhG §§ 40d, 40e).

End of SOV-LG-008 Acceptable Use Policy v1.0 (EU edition). SovSec Ltd · Company no. [COMPANY NUMBER] (England and Wales) · VAT no. [UK VAT] · EU OSS / UID [NUMBER]; from 2028: [SOVSEC FLEXCO NAME], FN [FN NUMBER], UID ATU[NUMBER].

1. Purpose, scope and status

1.1 This Acceptable Use Policy (AUP) is issued by SovSec Ltd, a private limited company registered in England and Wales under company number [COMPANY NUMBER], whose registered office is at [REGISTERED OFFICE ADDRESS] (SovSec, we, us).

1.2 It applies to everyone who accesses or uses any SovSec service or any Prismara product (the Services), including business clients and their authorised users, MSP partners and their customers, and individuals using Prismara Personal Free or Personal Secure (you). It also applies to our websites and Demo Sites (see SOV- LG-007).

1.3 This AUP forms part of every agreement under which we provide the Services. If you are a business client or partner, you must ensure that your users, and your own customers where you resell or manage Services, comply with it, and you are responsible for their breaches as for your own.

1.4 Where your agreement contains more specific rules (for example usage limits in an order, or the authorisation requirements for Prismara Crucible), those rules apply in addition to this AUP.

1.5 This AUP does not ask you to monitor anyone else's use and does not mean that we monitor the content of your data. Prismara is built so that, for many products, we cannot read your content (for example Mail sealed storage and Prism vaults). We enforce this AUP using metadata, rate signals, reports and lawful requests, as described in our Privacy Policy (SOV-LG-005).

2. Illegal and harmful content

2.1 You must not use the Services to create, store, send, share, publish or make available content that:

1. is illegal under the law applicable to you, to us or to the recipient, including content that constitutes child sexual abuse material, terrorist content, incitement to violence or hatred, or unlawful threats; 2. infringes intellectual property rights, privacy rights or other rights of any person; 3. is defamatory, harassing, discriminatory, or intended to intimidate or harm any person; 4. is fraudulent or deceptive, including impersonation of any person or organisation, fake invoices, investment scams or counterfeit goods offers; 5. promotes or facilitates the sale of illegal goods or services, including weapons, drugs or stolen data; or 6. discloses personal data, credentials or confidential information of others without a lawful basis.

2.2 We report child sexual abuse material to the competent authorities (including the National Crime Agency) and may share it with the Internet Watch Foundation, as the law requires or allows, and we will terminate the account concerned.

3. Abuse: spam, phishing and malware

3.1 You must not use the Services to:

1. send unsolicited bulk or commercial messages (spam) or messages that breach PECR, including by email, Prismara Talk, forms or notifications; 2. harvest, buy or use email lists or addresses collected without consent, or use list-bombing or dictionary attacks; 3. send or host phishing pages, credential-harvesting forms, or messages designed to trick recipients into revealing information or making payments (except authorised phishing simulations under clause 4);

S O V S E C · A C C E P TA B L E U S E P O L I C Y SOV-LG-008 · v1.0 · UK

4. host, distribute or link to malware, ransomware, spyware, exploit kits, botnet command-and-control or cryptomining code; 5. forge, falsify or obscure message headers, sender identity or domain authentication (SPF, DKIM, DMARC), or relay mail for third parties without authorisation; 6. use Prismara Spaces, Mail, Talk or Work share links as a file-hosting service for unlawful or abusive content, or to distribute content to the public at large; or 7. operate open proxies, open relays or anonymising services for third parties on Prismara Cloud or other Services.

3.2 Security research samples (for example malware held for analysis by a SOC, IR or detection engineering team) may be stored only in a clearly labelled, access-controlled location, must not be executable from shared links, and must never be distributed except to recognised security parties.

4. Security testing

4.1 You must not scan, probe, test the vulnerability of, attack or attempt to gain unauthorised access to any system, network, account or data — whether ours, another user's or a third party's — unless you have the prior, written authorisation of the owner of that system. Unauthorised access may be an offence under the Computer Misuse Act 1990.

4.2 Prismara Crucible (automated penetration testing) and SovSec penetration testing services may be used only against targets for which the client has signed a Crucible / Penetration Test Authorisation (SOV-LG-011), confirming that it owns or is authorised to test every target in scope. Crucible enforces target verification (for example DNS or file-based proof of control) and will not run against unverified targets. Any attempt to bypass target verification, to widen scope, or to use Crucible against third parties is a serious breach of this AUP.

4.3 Phishing simulations and red-team exercises must be authorised in writing by the organisation being tested, limited to its own users, and must not impersonate SovSec, Prismara or any third-party brand in a way that could mislead the public.

4.4 Good-faith research on our own products and websites is welcome under our Vulnerability Disclosure Policy (SOV-LG-013). Research outside that policy is not authorised.

4.5 You may run security tools (including vulnerability scanners) against systems you own that are hosted on Prismara Cloud, provided the activity stays within your own resources, does not degrade shared infrastructure, and does not trigger load or denial-of-service effects. Tell support@sovsec.com in advance of any large-scale test.

5. Network and service abuse

5.1 You must not:

1. carry out or facilitate denial-of-service attacks, flooding, packet spoofing or traffic amplification; 2. interfere with, disrupt or place an unreasonable load on the Services, our infrastructure or any other user's service; 3. circumvent or attempt to circumvent authentication, licensing, tenant isolation, rate limits, quotas, usage metering or other technical controls; 4. access another user's account or data without authorisation, or share account credentials outside your organisation (accounts are personal to the named user unless the product expressly supports shared accounts);

S O V S E C · A C C E P TA B L E U S E P O L I C Y SOV-LG-008 · v1.0 · UK

5. reverse engineer, decompile or disassemble the Services except to the extent the law expressly allows despite this restriction (for example under the Copyright, Designs and Patents Act 1988, s. 50B); 6. use the Services to build a competing product, or benchmark and publish results without our consent where your agreement requires it; 7. use automated means to create accounts, or create accounts with false information or to evade a suspension; or 8. use the Services to mine cryptocurrency, unless you are a Prismara Cloud client and this is expressly allowed in your order.

6. Prismara ZTNA used as a personal VPN

6.1 Prismara Personal Secure includes Prismara ZTNA configured as a personal VPN. Your traffic leaves our network from shared egress IP addresses in the EU. Because other users share those addresses, misuse by one user can lead to the addresses being blocked for everyone. When using ZTNA as a VPN you must not:

1. use it for any illegal activity, or to evade a lawful court order, sanction or law-enforcement measure; 2. use it to download, upload or share material that infringes copyright or other intellectual property rights, including through peer-to-peer file sharing of infringing content; 3. launch or participate in attacks, scanning, brute-forcing or credential stuffing against any system; 4. send spam or bulk email, run mail servers, or operate proxies, exit relays or other services that let third parties route traffic through your connection; 5. engage in ticket scalping, ad fraud, click fraud, fake account creation or other automated abuse that damages the reputation of our egress IP addresses; or 6. use the service to access services in breach of their terms where this exposes others to blocking, or to access sanctioned services or jurisdictions in breach of UK sanctions.

6.2 Personal ZTNA is for personal, non-commercial use on the number of devices included in your plan. It is not a business remote-access product; business clients use Prismara ZTNA under their business agreement.

6.3 We do not log the content of your traffic or the websites you visit. We process the limited connection and abuse- signal data described in our Privacy Policy (SOV-LG-005) to operate the service and to deal with abuse. If we receive a credible abuse complaint or a lawful request relating to an egress IP address, we may act on it as described in section 10, and we will only disclose data where the law requires us to.

6.4 We may rate-limit or block specific ports and protocols (for example outbound SMTP on port 25) on shared egress addresses to protect their reputation.

7. Free mailboxes and sending limits

7.1 Prismara Personal Free includes a mailbox at name@prismara.eu. Free mailboxes are for personal correspondence. To protect deliverability for all users, the following controls apply:

 Control                          Personal Free                   Personal Secure      Business plans

 External recipients per 24       [100]                           [500]                As set in the order; default [2,000] per
 hours                                                                                 user

 Recipients per message           [20]                            [50]                 [500]

 Messages per hour                [30]                            [100]                [500] per user

S O V S E C · A C C E P TA B L E U S E P O L I C Y SOV-LG-008 · v1.0 · UK

 Control                        Personal Free                         Personal Secure        Business plans

 New-account warm-up            Lower limits for the first [14]       Lower limits for the   Not applicable
                                days                                  first [7] days

 Automated forwarding to        Off by default; can be enabled        Allowed                Per tenant policy
 external addresses             after warm-up

 Bulk / marketing email         Not permitted                         Not permitted          Only with a dedicated sending domain
                                                                                             and consent records

7.2 Limits in square brackets are indicative and may be adjusted to protect the service; the current limits are shown in your account settings. Messages over the limits are deferred or rejected.

7.3 Accounts that send spam or phishing, show signs of compromise, or generate high complaint or bounce rates may be restricted to receive-only mode until the issue is resolved. Free accounts that are inactive for [12] months may be closed after at least [30] days' notice to the mailbox and any recovery address.

7.4 You must not create multiple free accounts to avoid limits, or use a free mailbox for business bulk-sending, newsletters, or as the sending address for automated systems.

8. Fair use

8.1 Where a plan is described as unlimited or includes generous allowances (for example storage, ZTNA bandwidth, Talk meetings or API calls), it is subject to fair use: use that is consistent with ordinary personal or business use by the number of users on the plan.

8.2 Use that is substantially higher than typical for comparable users and degrades the Services for others, or that is not the intended use (for example using Spaces as a backup target for an entire organisation's servers on a per- user plan, or ZTNA as a content-delivery relay), may be limited.

8.3 Before applying a fair-use limit we will, except in an emergency, contact you, explain the issue and give you a reasonable opportunity (normally at least [14] days) to reduce your usage or move to a suitable plan. Fair-use controls never apply to the quantities that are expressly guaranteed in your order.

9. Encryption, export controls and sanctions

9.1 Prismara uses strong cryptography, including post-quantum algorithms. Prismara software and Services may be subject to UK export control law (including the Export Control Order 2008 and retained Regulation (EC) No 428/2009 as amended in UK law), UK sanctions regulations made under the Sanctions and Anti-Money Laundering Act 2018, and to the export laws of other countries where they apply.

9.2 You must not use, export, re-export or provide access to the Services: (a) in or for a country or territory subject to comprehensive sanctions; (b) to or for a person or entity on a UK (or, where applicable, UN) sanctions list, or owned or controlled by one; or (c) for a prohibited end use, including weapons of mass destruction or military end uses where restricted.

9.3 You are responsible for complying with any local restrictions on the import or use of encryption in the country where you use the Services. We may block access from jurisdictions where we cannot lawfully provide the Services.

S O V S E C · A C C E P TA B L E U S E P O L I C Y SOV-LG-008 · v1.0 · UK

10. Consequences of a breach

10.1 If we reasonably believe you have breached this AUP, we may take one or more of the following steps, proportionate to the seriousness of the breach, the risk to others and your history:

 Step              What it means                                                           Typical use

 Warning           We tell you about the issue and what to change.                         First, minor or accidental breaches

 Content           We remove or disable access to specific content or a share link.        Notified illegal or infringing content
 action

 Restriction       We limit a feature (e.g. sending, sharing, VPN egress) or rate.         Spam, egress abuse, fair-use issues

 Suspension        We suspend the affected account(s) or Service temporarily.              Serious breach, compromise, ongoing
                                                                                           harm

 Termination       We end the account or agreement under its termination terms.            Severe or repeated breaches

 Reporting         We report to law enforcement, regulators or other authorities, and      Criminal activity; where the law
                   cooperate with them.                                                    requires

10.2 Except where immediate action is needed to prevent harm, to protect the Services or other users, or to comply with law, we will give you notice and a reasonable opportunity to remedy the breach before suspending or terminating. For business clients, suspension is limited to the affected users or Services where practicable.

10.3 When we restrict or remove content or an account, we will tell you what we did and why, and how you can challenge the decision, unless the law or a competent authority prevents us.

10.4 Fees remain payable during a suspension caused by your breach, except where your agreement or mandatory consumer law says otherwise. Before termination we will give you a reasonable opportunity to export your data unless that would facilitate the harm or the law prevents it.

10.5 You are responsible for losses we suffer because of your breach of this AUP, subject to the liability terms of your agreement and, if you are a consumer, to your statutory rights.

11. Reporting abuse

11.1 Please report abuse of the Services as follows:

What you want to report Where

Spam, phishing or malware sent from or hosted on Prismara; abuse from a Prismara egress abuse@prismara.eu IP address; illegal content

Abuse involving SovSec services or sovsec.com security@sovsec.com

A security vulnerability in Prismara or our websites security@sovsec.com — see SOV- LG-013

Copyright or other IP infringement abuse@prismara.eu (subject: “IP notice”)

Requests from authorities legal@sovsec.com

S O V S E C · A C C E P TA B L E U S E P O L I C Y SOV-LG-008 · v1.0 · UK

11.2 To help us act quickly, include: the content or address concerned (for example the URL, share link, message headers or IP address with timestamp and time zone); why you consider it abusive or illegal; your name and email address (unless the report concerns child sexual abuse material, which you may report anonymously); and, for intellectual property complaints, a statement that you hold or represent the rights and that your report is accurate and complete to the best of your knowledge.

11.3 We aim to acknowledge reports within [1] business day and to act on credible reports of phishing or malware within [24] hours. We do not tell the reported user who made the report unless the law requires it.

11.4 Please do not send malware samples as attachments; send a hash or a link to a sample in a password- protected archive and tell us the password separately.

12. Changes to this policy

12.1 We may update this AUP to respond to new types of abuse, changes in law or changes to the Services. The version and date are shown on the cover.

12.2 We will give business clients and Personal users at least [30] days' notice by email or in-product notice of changes that materially restrict permitted use, except where a change is needed urgently to address a security threat or a legal requirement. If you are a consumer and a change is to your disadvantage, you may end your subscription before it takes effect without penalty, as set out in your Personal terms.

12.3 This AUP is governed by the law that governs your agreement with us.

Drafting notes — remove before publication

• All bracketed numbers (send quotas, warm-up periods, inactivity closure, acknowledgement and action targets, notice periods) are indicative and must be confirmed against actual Prismara Mail / ZTNA configuration before publication.
• Confirm that abuse@prismara.eu is created and monitored (add to the CONTACT set) and that RFC 2142 role addresses (abuse@, postmaster@) exist for every sending domain.
• Confirm ZTNA logging statement (no content or destination logging) matches the actual implementation and SOV-LG-005; this is a public commitment.
• Sanctions / export wording to be checked by counsel (UK: OTSI/OFSI, Export Control Joint Unit; confirm current references for retained dual-use regulation).
• UK Online Safety Act 2023: Prismara Talk/Spaces sharing features may make parts of Prismara a user-to-user service. Solicitor to assess whether OSA duties (illegal content risk assessment, reporting and complaints) apply, given Prismara is not intended for public content sharing.
• CSAM reporting route to be confirmed with counsel (NCA / IWF arrangements).
• Reverse-engineering carve-out references to be confirmed (CDPA 1988 ss. 50A–50C, 296A).

End of SOV-LG-008 Acceptable Use Policy v1.0 (UK edition). Company no. [COMPANY NUMBER] · Registered office: [REGISTERED OFFICE ADDRESS] · VAT no. [VAT NUMBER].