Legal Prismara Subscription Licence Terms

SOV-LG-009

Prismara Subscription Licence Terms

Applies to Business subscribers to Prismara · Version 1.0 · 2 November 2026

Draft — pending legal review. These documents are being finalised. Fields shown as [TO BE COMPLETED] are not yet filled in, and the wording may change before it is legally binding.

1. Status, structure and order of precedence

1.1 These Prismara Subscription & Software Licence Terms (the Subscription Terms) are made between SovSec Ltd, a private limited company registered in England and Wales under company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS] — and, from the date on which it assumes the contract by written notice, its Austrian subsidiary [SOVSEC FLEXCO NAME], registered in the Austrian commercial register (Firmenbuch) under FN [FN NUMBER], Landesgericht [COURT], seat [ADDRESS, AUSTRIA] (planned 2028) (SovSec, we, us) and the business customer named in the Order (the Customer, you).

1.2 They are a Service Schedule under the SovSec Master Services Agreement (SOV-LG-001, the MSA). The MSA's terms on confidentiality, data protection, notices, assignment, force majeure and dispute resolution apply to them. Personal data processed on your behalf is governed by the data processing agreement that forms part of the MSA.

1.3 If documents conflict, this order applies (highest first): (a) the Order, but only where it expressly states that it overrides a named clause; (b) these Subscription Terms, for Prismara subscriptions and software; (c) the MSA; (d) the Documentation; (e) the price card in force when the Order was signed (SOV-BC-022 (EU Service Catalogue & Price Card)).

1.4 These Subscription Terms are for business customers only. You confirm that you are acting for purposes of your trade, business, craft or profession. Consumers use Prismara Personal under the Prismara Personal Terms (SOV- LG-010).

1.5 Use of the Services is also subject to the Acceptable Use Policy (SOV-LG-008). You are responsible for your Users' compliance with it.

2. Definitions

Capitalised terms not defined here have the meaning given in the MSA.

Term Meaning

Cloud Services Prismara software provided as a service and hosted by SovSec (for example Identity, Admin, Mail, Talk, Work, Spaces, Prism, Gov, SOC, Desk, CRM, HR, ERP, Crucible and the management consoles of Core, Endpoint, Reach and ZTNA).

Installable Components Software that you install or run on your own devices or infrastructure: Prismara OS images, the Prismara Endpoint, Core, Reach and ZTNA agents, Prismara Work and Spaces desktop applications, the Prismara Prism apps and extensions, and Prismara Browser.

Services The Cloud Services and Installable Components you subscribe to, with the Documentation and support described here.

Plan A Prismara suite plan (Frontline, Essentials, Business, Secure or Sovereign) or a standalone product subscription, as listed in the Order.

Seat A licence for one named User (or, where the unit is a device, endpoint, agent, employee or asset, one such unit).

User An individual you authorise to use the Services: your employees, officers and contractors working for you.

Customer Data All data, content and files that you or your Users submit to, store in or generate through the Services, including telemetry from your devices. It excludes Service Data.

Term Meaning

Service Data Aggregated, de-identified data about the operation and security of the Services (for example performance metrics, error rates and threat indicators) that does not identify you or any individual.

Client-Held Key A cryptographic key or key share that is generated and held only by you or your Custodians, and that SovSec does not hold in usable form (for example Mail sealed storage keys, Prism vault keys and custodian-quorum keys).

Custodian A person you appoint to hold a share of a Client-Held Key in a key ceremony (M-of-N quorum).

Entitlement The record in Prismara Admin of the Plans, Seats and features you are licensed to use.

Major Version A release of an Installable Component identified by a change to the first number of its version (for example 2.x to 3.x).

Pre-release Feature A feature, product or version labelled alpha, beta, preview, early access, design-partner pilot or similar.

Documentation The user and administrator documentation published at learn.prismara.eu, as updated from time to time.

Open-Source Component Software licensed under an open-source licence (for example GPL, LGPL, MPL, Apache 2.0, MIT or BSD) that is included in or distributed with the Services.

3. Subscriptions, Seats and Plans

3.1 Ordering. You subscribe by signing an Order or accepting an online order form in Prismara Admin. The Order states the Plan(s), number of Seats, Subscription Term, billing frequency and price.

3.2 Seat model. Seats are assigned to named Users and may not be shared. You may reassign a Seat when a User permanently leaves or changes role, but not to rotate one Seat between several people. Where a Plan includes devices (for example Core UEM or Endpoint for up to 5 devices per User), the devices must be used by that User.

3.3 Adding Seats. You may add Seats at any time. Added Seats are charged pro rata to the end of the current Subscription Term at the same unit price and end with it.

3.4 Reducing Seats. You may reduce Seats with effect from the next renewal, by notice in Prismara Admin or to billing@sovsec.com at least 30 days before renewal. On rolling monthly terms, reductions take effect at the end of the current month.

3.5 True-up. Prismara Admin counts assigned Seats and active devices. If your use exceeds your Entitlement, we will tell you, and you will either remove the excess within 30 days or pay for it from the date the excess began at the Order's unit price.

3.6 Plans. The suite Plans and their main contents are set out below (list prices per User per month, excluding VAT, on a 12-month commitment). Monthly billing without a 12-month commitment carries a 15% premium unless a launch offer in the price card says otherwise. The Order and the price card prevail over this summary.

Price (€/ Plan Includes (summary) User/mo)

 Frontline      €3.90       Identity (standard); Mail 2 GB + web; Talk chat; Work (view/light edit, web); Prism (personal vault)

 Essentials     €8.90       Identity (standard); Mail 50 GB; Talk; Work (web); Spaces 1 TB pooled; Prism; Browser†; Admin +
                            launcher

Price (€/ Plan Includes (summary) User/mo)

 Business       €16.90           Everything in Essentials; Work desktop apps; Spaces Sync; Identity Plus (conditional access, step-up);
                                 Core UEM (5 devices/user); Gov Standard (labels, retention, DLP); Managed Browser policy

 Secure         €26.90           Everything in Business; Endpoint EDR (5 devices/user)†; ZTNA; Gov Advanced (DLP, eDiscovery, holds);
                                 Identity Advanced (risk, PIM-style elevation); SOC log connectors (self-run)

 Sovereign      €42.90           Everything in Secure; Endpoint XDR†; Gov Complete (Barriers, Priva, Lockbox); Mail Plus (archive,
                                 journaling to Gov); Prismara OS Enterprise rights†; Custodian-quorum key ceremonies; Priority support

† Delivered only once the relevant Prismara product is generally available, or by an interim component described in clause 9. Standalone products
(Identity, Mail, Talk, Work, Spaces, Prism, Browser, OS, Core, Endpoint, SOC, ZTNA, Gov, Reach, Desk, CRM, HR, ERP, Crucible and Cloud) may
be bought on their own at the prices in SOV-BC-022 (EU Service Catalogue & Price Card). Prismara Edge Relay is a research programme and is
not offered under these terms.

3.7 Availability gates the sale. We only sell a product as a paid Service once it is generally available. Before then,
a product may be offered as a design-partner pilot at no licence charge, as a Pre-release Feature under clause 11.

3.8     Crucible. Prismara Crucible (automated penetration testing) is also subject to the Penetration Testing
Authorisation & Rules of Engagement (SOV-LG-011). No Crucible test may start until a signed Authorisation Form
and Scope Sheet are in place.

3.9 Prismara Cloud. Prismara Cloud is billed by consumption at the rates in the price card. You are responsible for
the workloads you run on it and for keeping consumption within any budget you set.

4. Licence grant

4.1 Cloud Services. Subject to these terms and payment of the fees, we grant you a non-exclusive, non- transferable, non-sublicensable right during the Subscription Term for your Users to access and use the Cloud Services for your internal business purposes, within your Entitlement.

4.2 Installable Components. We grant you a non-exclusive, non-transferable, non-sublicensable licence during the Subscription Term to install and run the Installable Components, in object-code form, on devices and infrastructure that you own or control, up to the number of Seats or units in your Entitlement, solely to use the Services.

4.3 Prismara OS. Prismara OS Community may be used free of charge on the terms of its included open-source licences. Prismara OS Enterprise rights (management, signed enterprise images and support) are licensed per device under your Plan or a standalone subscription.

4.4 Affiliates and contractors. Your affiliates and contractors may use the Services on your behalf as Users. You are responsible for their acts and omissions as if they were your own.

4.5 Partners. If you buy through a Prismara partner, the partner may administer your tenant with your permission. These terms still govern your use of the Services; fees and invoicing are governed by your agreement with the partner.

4.6 Reservation of rights. All rights not expressly granted are reserved. The Services and Documentation are licensed, not sold. SovSec and its licensors own all intellectual property rights in them, subject to clause 5 and the licences of Open-Source Components.

5. Restrictions

5.1 Except as expressly allowed by these terms, the licence of an Open-Source Component, or mandatory law, you must not and must not allow anyone to:

1. copy, modify, translate or create derivative works of the Services; 2. decompile, disassemble or reverse-engineer the Services, except to the extent the law permits this for interoperability (§ 40e of the Austrian Copyright Act (UrhG), implementing Article 6 of Directive 2009/24/EC) and only after first asking us for the information needed; 3. sell, rent, lease, sublicense, resell or provide the Services to third parties as a service bureau, unless you are an authorised Prismara partner under a partner agreement; 4. remove, bypass or interfere with licence checks, Entitlement controls, security features, scope rails or usage limits; 5. access the Services to build a competing product, or run benchmarks for publication without our prior written consent (which we will not unreasonably withhold); 6. use the Services in breach of the Acceptable Use Policy (SOV-LG-008), export control or sanctions law, or any other law; 7. use the Services to test, scan or attack systems you are not authorised to test (see SOV-LG-011); or 8. use Pre-release Features in production or for regulated data, unless we agree otherwise in writing.

5.2 Nothing in these terms restricts any right you have under the licence of an Open-Source Component, or any right that cannot be restricted by contract.

6. Open-Source Components

6.1 The Services include Open-Source Components. Each is licensed to you under its own licence, which governs your use of that component and prevails over these terms to the extent they conflict. A list of Open-Source Components and their licences (third-party notices) is included with each Installable Component and in a software bill of materials (SBOM) available in Prismara Admin and on request.

6.2 Prismara Browser is built on the Chromium open-source project and includes components under the BSD-3- Clause, LGPL-2.1, MPL-2.0 and other licences. Prismara OS is built on openSUSE Leap and includes components under the GPL-2.0, GPL-3.0, LGPL and other licences. Other Installable Components may include such components too.

6.3 Corresponding source. Where a licence (such as the GPL or LGPL) requires it, we make the complete corresponding source code of the relevant component, including our modifications, available: (a) from a public source repository named in the third-party notices; or (b) on written request to legal@sovsec.com for at least three years after we last distributed the relevant version, for no more than the cost of physically providing it. This offer is valid to anyone in receipt of the binary.

6.4 LGPL components. Where an Installable Component links to a library licensed under the LGPL, you may modify that library and reverse-engineer the Installable Component to the extent needed to debug such modifications, as the LGPL allows.

6.5 Trade marks. Open-source licences do not grant rights in the Prismara and SovSec names and logos. If you redistribute modified open-source code, you must remove our trade marks. Third-party marks (for example Chromium, openSUSE) belong to their owners and are used only to describe origin; we are not endorsed by those projects.

6.6 Open-Source Components distributed as part of a paid Service are covered by our warranties, support and security updates under these terms in the same way as our own code, even though their licences disclaim warranties as between you and their authors.

7. Entitlements, licence checks and grace period

7.1 Installable Components check your Entitlement with Prismara Admin when they start and at regular intervals, using signed tokens. No Customer Data is sent for licence checks; only tenant, device and component identifiers and version information.

7.2 Offline grace. If a device cannot reach Prismara Admin, the component continues to work normally for 14 days from its last successful check. Air-gapped and restricted deployments may use offline licence files under the Sovereign Plan or by agreement.

7.3 Lapse grace. If your subscription ends, is not renewed, or is suspended for non-payment, we give you a 30- day grace period (the Grace Period) during which all Services keep working, and we remind your billing and technical contacts at least three times.

7.4 Fail-closed licensing. After the Grace Period, licensed features stop in a controlled, fail-closed way designed to protect your security and your data:

Cloud Services move to read-only and export mode: Users can sign in, read and export Customer Data, but cannot create new content or send mail;
security agents (Endpoint, Core, ZTNA) keep enforcing the last policy they received and do not open access that was closed — they fail closed, not open — but stop receiving new policies, detections and feature updates;
ZTNA does not grant new network access; management consoles are read-only;
no Customer Data is deleted during or because of the Grace Period or the read-only phase; deletion follows clause 13 only.

7.5 Licence checks are not used to disable a Service as a means of pressure in a fee dispute you have raised in good faith and notified to us in writing before the due date, except under clause 14.

8. Customer Data, Client-Held Keys and custodians

8.1 Ownership. As between the parties, you own all Customer Data. We acquire no rights in it except the limited right to host, process, transmit and display it to provide, secure and support the Services, as instructed by you and under the data processing agreement.

8.2 No other use. We do not use Customer Data to train artificial intelligence models, for advertising, or for any purpose other than providing the Services, and we do not put Customer Data into third-party AI tools without your written instruction. We may use Service Data to operate, secure and improve the Services.

8.3 Location. Customer Data is hosted on dedicated servers in our hosting provider's data centre in Vienna, Austria, and stays in the EU/EEA, unless you instruct otherwise (for example by sending email to recipients outside the EU). Sub-processors are listed in the data processing agreement.

8.4 Encryption. Data in transit is protected with TLS 1.3 using hybrid post-quantum key exchange where both endpoints support it. Data at rest is encrypted. Where a product supports Client-Held Keys (Mail sealed storage, Prism vaults and custodian-quorum key ceremonies), content is encrypted with keys we do not hold in usable form.

C L I E N T- H E L D K E Y S : W E C A N N O T R E C O V E R Y O U R D ATA

If data is encrypted with keys that only you or your Custodians hold, SovSec cannot decrypt, recover or restore that data if the keys, key shares, recovery codes or master passwords are lost, destroyed or unavailable, or if you fail to keep a quorum of Custodians. This is a deliberate security property, not a defect. We are not liable for loss of access to such data, and the fees are not reduced because of it.

8.5 Custodian responsibilities. If you use custodian-quorum keys, you are responsible for: (a) appointing enough Custodians that the quorum (M of N) can be met when people are absent or leave — we recommend at least five Custodians for a three-of-five quorum; (b) keeping Custodian shares on separate, secured devices or hardware tokens; (c) running a re-share ceremony promptly when a Custodian leaves or a share may be compromised; (d) testing recovery at least once a year; and (e) keeping recovery settings for Prism vaults and Mail sealed storage switched on where your policy allows. We will support ceremonies as described in the Documentation.

8.6 Your responsibilities. You are responsible for the content of Customer Data and its lawfulness, for configuring the Services (including retention, sharing and access policies), for your Users' credentials, and for keeping independent copies of data you cannot afford to lose. Our backups are for disaster recovery of the Services and are not a substitute for your own retention arrangements.

8.7 Requests from authorities. If a public authority asks us for Customer Data, we will refer it to you where lawful, challenge requests that are unlawful or that come from authorities outside the EU/EEA and the UK without a valid legal basis, and disclose only the minimum we are legally required to. Data protected by Client-Held Keys cannot be disclosed in readable form by us.

9. Interim third-party EDR in Secure and Sovereign

9.1 Until Prismara Endpoint is generally available, the endpoint protection (EDR, and XDR for Sovereign) included in the Secure and Sovereign Plans is delivered using a European third-party EDR product that we resell and manage (currently [ESET / WithSecure — to be confirmed in the Order]) (the Interim EDR).

9.2 The Interim EDR is provided under the vendor's end-user licence terms, which we will give you before installation and which you agree to by installing it. Its telemetry is processed by its vendor as our sub-processor, as stated in the data processing agreement. The fee for the Interim EDR is included in the Plan price and is not charged separately.

9.3 When Prismara Endpoint becomes generally available, we will give you at least 90 days' written notice and a migration plan. Migration is included in the Plan price. If you prefer to keep the Interim EDR, we will offer it, if the vendor allows, at its then-current cost passed through without margin, and reduce your Plan price by the published Endpoint component value.

9.4 Our warranties and service levels for endpoint protection apply to the Interim EDR as they do to Prismara software, except to the extent a failure is caused by the vendor's product and we have passed on the vendor's remedies to you.

10. Updates, support periods and security updates

10.1 Cloud Services are updated continuously. We may change features, provided that a change does not materially reduce the security or core functionality of a Service you have paid for during the current Subscription Term. We give at least 90 days' notice before removing a material feature, and you may terminate the affected Service without penalty and receive a pro-rata refund of prepaid fees if a removal materially affects you.

10.2 Support period. For each Major Version of an Installable Component, we provide security updates for at least five years from its first release, consistent with Article 13(8) of Regulation (EU) 2024/2847 (Cyber Resilience Act). The end-of-support date for each Major Version is published in the Documentation and shown in Prismara Admin. Feature updates may be limited to current Major Versions.

10.3 Security updates are provided free of charge, separately from feature updates where technically feasible, and delivered automatically by default. You may defer them using Core or Reach policies, but you are responsible for the consequences of deferring a security update for more than 14 days after release, or 72 hours for a critical update.

10.4 Vulnerability handling. We operate a coordinated vulnerability disclosure policy (reports to security@sovsec.com), provide SBOMs for Installable Components, and from 11 September 2026 notify actively exploited vulnerabilities and severe incidents affecting the security of Prismara products to the competent CSIRT and ENISA as the Cyber Resilience Act requires. We will tell you without undue delay about an actively exploited vulnerability affecting a Service you use and about any corrective measures.

10.5 Support. Support is provided by support@sovsec.com and the Prismara Admin portal during Monday to Friday, 08:00–18:00 CET/CEST, excluding Austrian public holidays, with the response times of your Plan or managed service. Sovereign includes priority support. Response targets are in the price card and, for managed services, the applicable service schedule.

11. Pre-release Features

11.1 We may offer Pre-release Features. They are provided for evaluation, may be incomplete, may change or be withdrawn at any time, are excluded from service levels and support response times, and are provided free of charge unless the Order says otherwise.

11.2 To the extent permitted by law, Pre-release Features are provided "as is" without warranty. Our liability for them is limited to €100 in total, except for liability that cannot be limited under clause 17.4.

11.3 You must not use Pre-release Features with production data, special category personal data or regulated data unless we agree in writing. We will give at least 30 days' notice before withdrawing a Pre-release Feature that holds Customer Data, so that you can export it.

12. Fees, payment and price changes

12.1 Fees. You pay the fees in the Order. Unless stated otherwise, fees are in EUR, exclude VAT and other taxes, and are invoiced annually or monthly in advance for subscriptions and monthly in arrears for consumption (Prismara Cloud, SOC data above the pooled allowance, and Crucible runs beyond the Plan).

12.2 Payment. Invoices are payable within 14 days of the invoice date by bank transfer or direct debit. B2B supplies to customers in other EU Member States are invoiced under the reverse-charge mechanism where applicable. Late payments bear default interest of 9.2 percentage points above the base rate of the Oesterreichische Nationalbank under § 456 of the Austrian Commercial Code (UGB) and the lump-sum recovery costs of EUR 40 under § 458 UGB.

12.3 Disputes. If you dispute an invoice in good faith, tell billing@sovsec.com before the due date and pay the undisputed part. We will not suspend Services for the disputed amount while we resolve the dispute.

12.4 Price changes. Prices are fixed for the first 12 months of a Subscription Term. After that we may increase them once a year on at least 60 days' written notice, by no more than the annual change in the Austrian consumer price index (VPI 2020 or its successor) published by Statistik Austria for the latest 12 months available, unless you

agree otherwise. Licences we pass through from third parties (for example Microsoft) follow the vendor's price and are charged at cost.

12.5 Launch offers. Launch offers described in the price card (for example founding-client discounts or rolling 30- day terms at the 12-month price for contracts signed in 2027) apply only if stated in the Order and on the conditions stated there.

13. Data export, exit and switching

13.1 Export at any time. You can export Customer Data at any time during the Subscription Term, without charge, using the export tools in Prismara Admin and each product, in open, commonly used and machine-readable formats (for example MBOX/EML for mail, iCalendar, vCard, OpenDocument and Office Open XML for documents, CSV/ JSON for records, and standard formats for logs). Export formats per product are listed in the Documentation.

13.2 Switching under the EU Data Act. The Cloud Services are data processing services within Chapter VI of Regulation (EU) 2023/2854 (the Data Act). Without limiting your other rights, you may:

switch to another provider or to your own on-premises systems, or delete your data, by giving us notice of no more than two months, after which a transition period of 30 calendar days starts in which we will complete the switching process (Data Act, Article 25);
if we notify you that the 30-day transition period is technically unfeasible, have it extended to no more than seven months, with service continuity; you may also extend it once for a period you consider more appropriate;
retrieve your exportable data and digital assets during a data retrieval period of at least 30 calendar days after the end of the transition period;
terminate the contract once the switching process is completed (or, if you only want deletion, at the end of the notice period);
rely on our obligation to delete all exportable data and digital assets after the retrieval period, once switching is completed successfully.

13.3 Switching charges. We do not charge switching or data egress charges. Until 11 January 2027 the Data Act would permit reduced charges not exceeding our direct costs; we have chosen not to charge them. From 12 January 2027 such charges are prohibited by Article 29 of the Data Act. Assistance that goes beyond the switching process (for example re-configuring your new provider's systems) may be offered separately at the day rate in the price card.

13.4 Information. Our exportable data categories, export formats, interfaces, known restrictions, and the procedures for switching are described in the Documentation and in an online register maintained as Article 26 of the Data Act requires. We will not impose pre-commercial, commercial, technical, contractual or organisational obstacles to switching.

13.5 Where the Data Act exempts a service (for example custom-built services or test versions under Article 31), we nevertheless apply the export rights in clause 13.1 and a 30-day exit period.

13.6 Deletion. After the exit or retrieval period we delete Customer Data from live systems within 30 days and from backups within a further 35 days, and confirm deletion in writing on request, except for data we must keep by law (for example invoices). Data encrypted with Client-Held Keys becomes unreadable once the keys are destroyed.

13.7 Installable Components. On termination you must uninstall the Installable Components and destroy copies, except Prismara OS Community and Open-Source Components you are entitled to keep under their licences.

14. Suspension

14.1 We may suspend all or part of the Services, by the smallest measure reasonably possible and only for as long as necessary, if: (a) it is needed to prevent or stop a security incident, an attack on the Services, or a serious threat to other customers; (b) your use breaches the Acceptable Use Policy in a way that causes or risks serious harm; (c) a court or authority orders it; or (d) undisputed fees remain unpaid 30 days after a written reminder that warned of suspension, and the Grace Period in clause 7 has ended.

14.2 Except in an emergency, we will give you notice and a reasonable chance to remedy before suspending. Suspension for non-payment uses the read-only mode in clause 7.4; it never deletes Customer Data or opens security controls.

15. Term, renewal and termination

15.1 Term. Each subscription starts on the start date in the Order and runs for the Subscription Term stated there (typically 12 months, or rolling monthly).

15.2 Renewal. Annual subscriptions renew automatically for further 12-month terms unless either party gives notice of non-renewal at least 30 days before the end of the current term. We will remind you at least 60 days before an annual renewal. Monthly subscriptions renew each month until cancelled by either party with effect from the end of the current month.

15.3 Termination for cause. Either party may terminate a subscription in accordance with the MSA, including for material breach not remedied within 30 days of notice. You may also terminate as stated in clauses 10.1 and 13 and under the Data Act.

15.4 Effect. On termination, the licences end, subject to clause 13 (exit period) and clause 6 (Open-Source Components). Fees for the period up to termination remain payable. If you terminate for our uncured material breach, or under clause 10.1, we refund prepaid fees for the period after termination.

15.5 Clauses 2, 5, 6, 8, 13, 16 to 19 and any others that by their nature should survive, survive termination.

16. Warranties

16.1 We warrant that during the Subscription Term: (a) the Services will perform materially as described in the Documentation; (b) we will provide them with reasonable skill and care and in line with good industry practice; (c) we will not materially decrease their overall security; and (d) to our knowledge, Installable Components as delivered are free from malicious code.

16.2 If a Service does not conform to clause 16.1, you must notify us within a reasonable time with enough detail to reproduce the problem. We will, at our option and expense, correct the non-conformity within a reasonable time, provide a workaround, or, if we cannot do so, allow you to terminate the affected Service and refund prepaid fees for the remaining term. This is without prejudice to claims for damages under clause 17.

16.3 The warranties do not apply to problems caused by: use contrary to the Documentation or these terms; your configuration, hardware, networks or third-party software; Pre-release Features; or deferred security updates.

16.4 Between businesses, the statutory warranty (Gewährleistung) under §§ 922 ff. of the Austrian Civil Code (ABGB) applies as modified by this clause 16: the warranty period is 12 months from the start of the relevant Subscription Term or Major Version, the first remedy is correction under clause 16.2, and § 377 UGB (prompt notification) applies to Installable Components. We do not warrant that the Services will be error-free, uninterrupted, or able to prevent every security incident.

16.5 Note. The Austrian Consumer Warranty Act (Verbrauchergewährleistungsgesetz, VGG), including its update obligations, applies only to contracts with consumers and does not apply to these business terms. Our security- update obligations to you arise from clause 10 and the Cyber Resilience Act.

17. Liability

17.1 Cap. Subject to clauses 17.3 and 17.4, each party's total liability arising out of or in connection with these Subscription Terms in any 12-month period, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the fees paid and payable by you under these Subscription Terms in the 12 months before the event giving rise to the claim. This cap is separate from and not cumulative with the MSA cap for other services.

17.2 Excluded losses. Subject to clauses 17.3 and 17.4, neither party is liable for: loss of profits, revenue, business, goodwill or anticipated savings; or indirect or consequential loss. Liability for loss of data is limited to the cost of restoring it from the latest backup we are required to keep.

17.3 Not limited. The cap and exclusions do not apply to: your obligation to pay fees; your liability under clause 5 (restrictions) or for infringement of our intellectual property rights; either party's indemnity obligations under the MSA; or breach of confidentiality obligations (where the cap is twice the amount in clause 17.1).

17.4 Unlimited. Nothing in these terms limits or excludes liability for damage caused intentionally (Vorsatz) or by gross negligence (grobe Fahrlässigkeit), for death or personal injury, under the Austrian Product Liability Act (PHG), or any other liability that cannot be limited under mandatory law.

17.5 For slight negligence (leichte Fahrlässigkeit), liability is limited as set out in clauses 17.1 and 17.2. In line with § 1298 ABGB, the burden of proof for lack of fault lies with the party in breach.

17.6 Security. The Services reduce, but cannot eliminate, security risk. We are not liable for a security incident to the extent it results from your failure to follow the Documentation, apply security updates, protect credentials or keys, or act on a notified critical finding or alert.

18. Export control and sanctions

18.1 The Services include cryptographic functions. They may be subject to Regulation (EU) 2021/821 (EU Dual- Use Regulation), in particular Category 5 Part 2 (information security) of its Annex I, to national export laws of the Member States, and to UK and other export laws.

18.2 We have classified the Services and rely on the applicable exemptions for mass-market cryptography or general authorisations where they apply. On request we will give you the classification and any export control information you reasonably need.

18.3 You must not export, re-export, transfer or make the Services available, including by giving remote access, (a) to any country, entity or person subject to EU, UN, UK or US sanctions or embargoes, or (b) for a prohibited end use, including military, weapons of mass destruction or internal repression, without the required authorisation. We may suspend Services immediately if needed to comply with such laws.

19. General, governing law and jurisdiction

19.1 Changes to these terms. We may update these Subscription Terms for future Orders and renewals. A change during a Subscription Term that materially disadvantages you requires your written agreement, except where needed to comply with law, in which case we will give as much notice as possible and you may terminate the affected Service.

19.2 Notices to SovSec go to legal@sovsec.com with a copy by post to our registered office; notices to you go to the contacts in the Order. Operational notices may be sent through Prismara Admin.

19.3 Assignment. SovSec Ltd may transfer these terms to its Austrian subsidiary [SOVSEC FLEXCO NAME] by written notice; the subsidiary will then be your contracting party and your rights will not be reduced. Any other assignment needs the other party's consent, not to be unreasonably withheld.

19.4 Governing law. These Subscription Terms and any non-contractual obligations arising out of or in connection with them are governed by Austrian law, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods (CISG).

19.5 Jurisdiction. The competent court in Vienna, Austria (Innere Stadt) has exclusive jurisdiction, subject to the escalation and mediation steps in the MSA. We may also sue you at your general place of jurisdiction.

19.6 Language. These terms are made in English. A German translation may be provided for convenience; the English text prevails.

19.7 Severability. If any provision is invalid or unenforceable, the rest remains in force, and the parties will replace the provision with a valid one that comes closest to its purpose.

Drafting notes — remove before publication

Confirm [COMPANY NUMBER], [REGISTERED OFFICE ADDRESS], [VAT NUMBER] and, for the EU edition, the Austrian subsidiary details and EU VAT/OSS registration.
Interim EDR vendor (ESET or WithSecure) to be fixed; obtain the vendor's reseller/MSP agreement and EULA flow-down terms and check that clause 9 (pass-through pricing, migration) is compatible.
Clause 7 (fail-closed licensing): confirm with engineering that read-only/export mode and agent behaviour after lapse are implemented as described; check interplay with CRA security-update obligations for Installable Components after a subscription ends.
Clause 10.2: five-year support period mirrors CRA Art. 13(8). CRA reporting obligations (Art. 14) apply from 11 September 2026; the main obligations apply from 11 December 2027. Confirm wording with counsel.
Clause 11.2: €/£100 cap for free Pre-release Features — check enforceability (UCTA reasonableness; § 879(3) ABGB for standard terms).
Clause 16 (EU): confirm the 12-month B2B warranty period and § 377 UGB reference are acceptable for SaaS (largely a service/Werkvertrag mix) under Austrian law.
EU Data Act (clause 13, EU edition): verified that Chapter VI applies from 12 September 2025 and switching charges are prohibited from 12 January 2027 (Art. 29); notice period max. two months, transition period 30 days (extendable to seven months), retrieval period min. 30 days (Art. 25). The Digital Omnibus proposal may introduce SME/custom-service relief — monitor. Prepare the Art. 26 information/online register. Consider whether UK-edition customers with EU establishments are in Data Act scope (clause 13 UK edition gives equivalent contractual rights).
Export control (clause 18): obtain a formal classification of each product (Cat. 5 Part 2, mass-market note / UK equivalent) before first export; confirm current UK legal reference for the assimilated dual-use regulation.
Open-source (clause 6): legal review of Chromium and openSUSE licence compliance (notices, written offer, trade-mark policies for 'openSUSE' and 'Chromium'); confirm source repository location.
Price indexation: confirm CPI (UK) / VPI 2020 (Austria) clause and 60-day notice; MSA cross-references (clause numbers for escalation and indemnities) to be aligned once SOV-LG-001 is final.

End of SOV-LG-009 Prismara Subscription & Software Licence Terms v1.0 (EU edition). SovSec Ltd · Company no. [COMPANY NUMBER] (England and Wales) · VAT no. [UK VAT] · EU OSS / UID [NUMBER]; from 2028: [SOVSEC FLEXCO NAME], FN [FN NUMBER], UID ATU[NUMBER].

1. Status, structure and order of precedence

1.5 Use of the Services is also subject to the Acceptable Use Policy (SOV-LG-008). You are responsible for your Users' compliance with it.

2. Definitions

Capitalised terms not defined here have the meaning given in the MSA.

Term Meaning

Services The Cloud Services and Installable Components you subscribe to, with the Documentation and support described here.

Plan A Prismara suite plan (Frontline, Essentials, Business, Secure or Sovereign) or a standalone product subscription, as listed in the Order.

Seat A licence for one named User (or, where the unit is a device, endpoint, agent, employee or asset, one such unit).

User An individual you authorise to use the Services: your employees, officers and contractors working for you.

Customer Data All data, content and files that you or your Users submit to, store in or generate through the Services, including telemetry from your devices. It excludes Service Data.

Term Meaning

Custodian A person you appoint to hold a share of a Client-Held Key in a key ceremony (M-of-N quorum).

Entitlement The record in Prismara Admin of the Plans, Seats and features you are licensed to use.

Major Version A release of an Installable Component identified by a change to the first number of its version (for example 2.x to 3.x).

Pre-release Feature A feature, product or version labelled alpha, beta, preview, early access, design-partner pilot or similar.

Documentation The user and administrator documentation published at learn.prismara.eu, as updated from time to time.

Open-Source Component Software licensed under an open-source licence (for example GPL, LGPL, MPL, Apache 2.0, MIT or BSD) that is included in or distributed with the Services.

3. Subscriptions, Seats and Plans

3.1 Ordering. You subscribe by signing an Order or accepting an online order form in Prismara Admin. The Order states the Plan(s), number of Seats, Subscription Term, billing frequency and price.

3.3 Adding Seats. You may add Seats at any time. Added Seats are charged pro rata to the end of the current Subscription Term at the same unit price and end with it.

Price (£/ Plan Includes (summary) User/mo)

 Frontline     £2.90       Identity (standard); Mail 2 GB + web; Talk chat; Work (view/light edit, web); Prism (personal vault)

 Essentials    £5.90       Identity (standard); Mail 50 GB; Talk; Work (web); Spaces 1 TB pooled; Prism; Browser†; Admin +
                           launcher

 Business      £12.90      Everything in Essentials; Work desktop apps; Spaces Sync; Identity Plus (conditional access, step-up);
                           Core UEM (5 devices/user); Gov Standard (labels, retention, DLP); Managed Browser policy

Price (£/ Plan Includes (summary) User/mo)

 Secure         £19.90           Everything in Business; Endpoint EDR (5 devices/user)†; ZTNA; Gov Advanced (DLP, eDiscovery, holds);
                                 Identity Advanced (risk, PIM-style elevation); SOC log connectors (self-run)

 Sovereign      £32.90           Everything in Secure; Endpoint XDR†; Gov Complete (Barriers, Priva, Lockbox); Mail Plus (archive,
                                 journaling to Gov); Prismara OS Enterprise rights†; Custodian-quorum key ceremonies; Priority support

† Delivered only once the relevant Prismara product is generally available, or by an interim component described in clause 9. Standalone products
(Identity, Mail, Talk, Work, Spaces, Prism, Browser, OS, Core, Endpoint, SOC, ZTNA, Gov, Reach, Desk, CRM, HR, ERP, Crucible and Cloud) may
be bought on their own at the prices in SOV-BC-026 (UK Service Catalogue & Price Card). Prismara Edge Relay is a research programme and is
not offered under these terms.

3.7 Availability gates the sale. We only sell a product as a paid Service once it is generally available. Before then,
a product may be offered as a design-partner pilot at no licence charge, as a Pre-release Feature under clause 11.

3.8     Crucible. Prismara Crucible (automated penetration testing) is also subject to the Penetration Testing
Authorisation & Rules of Engagement (SOV-LG-011). No Crucible test may start until a signed Authorisation Form
and Scope Sheet are in place.

3.9 Prismara Cloud. Prismara Cloud is billed by consumption at the rates in the price card. You are responsible for
the workloads you run on it and for keeping consumption within any budget you set.

4. Licence grant

4.4 Affiliates and contractors. Your affiliates and contractors may use the Services on your behalf as Users. You are responsible for their acts and omissions as if they were your own.

5. Restrictions

5.1 Except as expressly allowed by these terms, the licence of an Open-Source Component, or mandatory law, you must not and must not allow anyone to:

1. copy, modify, translate or create derivative works of the Services;

2. decompile, disassemble or reverse-engineer the Services, except to the extent the law permits this for interoperability (sections 50B and 296A of the Copyright, Designs and Patents Act 1988) and only after first asking us for the information needed; 3. sell, rent, lease, sublicense, resell or provide the Services to third parties as a service bureau, unless you are an authorised Prismara partner under a partner agreement; 4. remove, bypass or interfere with licence checks, Entitlement controls, security features, scope rails or usage limits; 5. access the Services to build a competing product, or run benchmarks for publication without our prior written consent (which we will not unreasonably withhold); 6. use the Services in breach of the Acceptable Use Policy (SOV-LG-008), export control or sanctions law, or any other law; 7. use the Services to test, scan or attack systems you are not authorised to test (see SOV-LG-011); or 8. use Pre-release Features in production or for regulated data, unless we agree otherwise in writing.

5.2 Nothing in these terms restricts any right you have under the licence of an Open-Source Component, or any right that cannot be restricted by contract.

6. Open-Source Components

7. Entitlements, licence checks and grace period

7.4 Fail-closed licensing. After the Grace Period, licensed features stop in a controlled, fail-closed way designed to protect your security and your data:

Cloud Services move to read-only and export mode: Users can sign in, read and export Customer Data, but cannot create new content or send mail;
security agents (Endpoint, Core, ZTNA) keep enforcing the last policy they received and do not open access that was closed — they fail closed, not open — but stop receiving new policies, detections and feature updates;
ZTNA does not grant new network access; management consoles are read-only;
no Customer Data is deleted during or because of the Grace Period or the read-only phase; deletion follows clause 13 only.

8. Customer Data, Client-Held Keys and custodians

C L I E N T- H E L D K E Y S : W E C A N N O T R E C O V E R Y O U R D ATA

9. Interim third-party EDR in Secure and Sovereign

10. Updates, support periods and security updates

10.2 Support period. For each Major Version of an Installable Component, we provide security updates for at least five years from its first release. We do this as manufacturer of products with digital elements placed on the EU market under Regulation (EU) 2024/2847 (Cyber Resilience Act), and apply the same commitment to UK customers. The end-of-support date for each Major Version is published in the Documentation and shown in Prismara Admin. Feature updates may be limited to current Major Versions.

for the consequences of deferring a security update for more than 14 days after release, or 72 hours for a critical update.

10.5 Support. Support is provided by support@sovsec.com and the Prismara Admin portal during Monday to Friday, 08:00–18:00 UK time, excluding bank holidays in England, with the response times of your Plan or managed service. Sovereign includes priority support. Response targets are in the price card and, for managed services, the applicable service schedule.

11. Pre-release Features

11.2 To the extent permitted by law, Pre-release Features are provided "as is" without warranty. Our liability for them is limited to £100 in total, except for liability that cannot be limited under clause 17.4.

12. Fees, payment and price changes

12.1 Fees. You pay the fees in the Order. Unless stated otherwise, fees are in GBP, exclude VAT and other taxes, and are invoiced annually or monthly in advance for subscriptions and monthly in arrears for consumption (Prismara Cloud, SOC data above the pooled allowance, and Crucible runs beyond the Plan).

12.2 Payment. Invoices are payable within 14 days of the invoice date by bank transfer or direct debit. Late payments bear interest under the Late Payment of Commercial Debts (Interest) Act 1998 (currently 8% a year above the Bank of England base rate) and fixed compensation under that Act.

12.4 Price changes. Prices are fixed for the first 12 months of a Subscription Term. After that we may increase them once a year on at least 60 days' written notice, by no more than the annual change in the UK Consumer Prices Index (CPI) published by the Office for National Statistics for the latest 12 months available, unless you agree otherwise. Licences we pass through from third parties (for example Microsoft) follow the vendor's price and are charged at cost.

13. Data export, exit and switching

13.2 Exit period. After termination or expiry, you have a 30-day exit period during which the Services are read-only and you can export Customer Data. At your request before the end of that period, we will extend it once by up to 60 days at the pro-rata Plan price.

13.3 Exit assistance. We will provide reasonable assistance with migration to another provider or to your own systems, including documented export interfaces. Up to two days of assistance is free of charge; further work is charged at cost (the day rate in the price card). We do not charge exit or switching fees.

13.4 Deletion. After the exit or retrieval period we delete Customer Data from live systems within 30 days and from backups within a further 35 days, and confirm deletion in writing on request, except for data we must keep by law (for example invoices). Data encrypted with Client-Held Keys becomes unreadable once the keys are destroyed.

13.5 Installable Components. On termination you must uninstall the Installable Components and destroy copies, except Prismara OS Community and Open-Source Components you are entitled to keep under their licences.

14. Suspension

15. Term, renewal and termination

15.1 Term. Each subscription starts on the start date in the Order and runs for the Subscription Term stated there (typically 12 months, or rolling monthly).

15.5 Clauses 2, 5, 6, 8, 13, 16 to 19 and any others that by their nature should survive, survive termination.

16. Warranties

16.2 If a Service does not conform to clause 16.1, you must notify us within a reasonable time with enough detail to reproduce the problem. We will, at our option and expense, correct the non-conformity within a reasonable time, provide a workaround, or, if we cannot do so, allow you to terminate the affected Service and refund prepaid fees for the remaining term. This, together with any service credits, is your sole remedy for breach of clause 16.1, without prejudice to clause 17.4.

16.4 Except as expressly stated in these terms, all warranties, conditions and other terms implied by statute or common law (including those as to satisfactory quality and fitness for purpose) are excluded to the extent permitted by law. We do not warrant that the Services will be error-free, uninterrupted, or able to prevent every security incident.

17. Liability

17.2 Excluded losses. Subject to clauses 17.3 and 17.4, neither party is liable for: loss of profits, revenue, business, goodwill or anticipated savings; or indirect or consequential loss. We are not liable for loss or corruption of data, except for the cost of restoring it from the latest backup we are required to keep.

17.4 Unlimited. Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot be limited or excluded by law. The parties agree that the limits in this clause 17 are reasonable for the purposes of the Unfair Contract Terms Act 1977, having regard to the fees, the availability of insurance and the parties' ability to protect their own data and systems.

17.5 Security. The Services reduce, but cannot eliminate, security risk. We are not liable for a security incident to the extent it results from your failure to follow the Documentation, apply security updates, protect credentials or keys, or act on a notified critical finding or alert.

18. Export control and sanctions

18.1 The Services include cryptographic functions. They may be subject to UK export controls, including the Export Control Order 2008 and the retained Dual-Use Regulation (Regulation (EC) No 428/2009 as it forms part of UK law), and to the UK Strategic Export Control Lists, as well as to EU and other export laws.

18.3 You must not export, re-export, transfer or make the Services available, including by giving remote access, (a) to any country, entity or person subject to UK, UN, EU or US sanctions or embargoes, or (b) for a prohibited end use, including military, weapons of mass destruction or internal repression, without the required authorisation. We may suspend Services immediately if needed to comply with such laws.

19. General, governing law and jurisdiction

19.2 Notices to SovSec go to legal@sovsec.com with a copy by post to our registered office; notices to you go to the contacts in the Order. Operational notices may be sent through Prismara Admin.

19.3 Assignment. We may assign or novate these terms to an affiliate (including our planned Austrian subsidiary) by notice, provided your rights are not reduced.

19.4 Governing law. These Subscription Terms and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with them are governed by the laws of England and Wales.

19.5 Jurisdiction. The courts of England and Wales have exclusive jurisdiction, subject to the escalation and mediation steps in the MSA.

19.6 Third parties. A person who is not a party has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term.

19.7 Severability. If any provision is invalid or unenforceable, the rest remains in force, and the parties will replace the provision with a valid one that comes closest to its purpose.

Drafting notes — remove before publication

Confirm [COMPANY NUMBER], [REGISTERED OFFICE ADDRESS], [VAT NUMBER] and, for the EU edition, the Austrian subsidiary details and EU VAT/OSS registration.
Interim EDR vendor (ESET or WithSecure) to be fixed; obtain the vendor's reseller/MSP agreement and EULA flow-down terms and check that clause 9 (pass-through pricing, migration) is compatible.
Clause 7 (fail-closed licensing): confirm with engineering that read-only/export mode and agent behaviour after lapse are implemented as described; check interplay with CRA security-update obligations for Installable Components after a subscription ends.
Clause 10.2: five-year support period mirrors CRA Art. 13(8). CRA reporting obligations (Art. 14) apply from 11 September 2026; the main obligations apply from 11 December 2027. Confirm wording with counsel.
Clause 11.2: €/£100 cap for free Pre-release Features — check enforceability (UCTA reasonableness; § 879(3) ABGB for standard terms).
Clause 16 (EU): confirm the 12-month B2B warranty period and § 377 UGB reference are acceptable for SaaS (largely a service/Werkvertrag mix) under Austrian law.
EU Data Act (clause 13, EU edition): verified that Chapter VI applies from 12 September 2025 and switching charges are prohibited from 12 January 2027 (Art. 29); notice period max. two months, transition period 30 days (extendable to seven months), retrieval period min. 30 days (Art. 25). The Digital Omnibus proposal may introduce SME/custom-service relief — monitor. Prepare the Art. 26 information/online register. Consider whether UK-edition customers with EU establishments are in Data Act scope (clause 13 UK edition gives equivalent contractual rights).
Export control (clause 18): obtain a formal classification of each product (Cat. 5 Part 2, mass-market note / UK equivalent) before first export; confirm current UK legal reference for the assimilated dual-use regulation.
Open-source (clause 6): legal review of Chromium and openSUSE licence compliance (notices, written offer, trade-mark policies for 'openSUSE' and 'Chromium'); confirm source repository location.
Price indexation: confirm CPI (UK) / VPI 2020 (Austria) clause and 60-day notice; MSA cross-references (clause numbers for escalation and indemnities) to be aligned once SOV-LG-001 is final.

End of SOV-LG-009 Prismara Subscription & Software Licence Terms v1.0 (UK edition). Company no. [COMPANY NUMBER] · Registered office: [REGISTERED OFFICE ADDRESS] · VAT no. [VAT NUMBER].

Questions about this document? Contact us. SovSec Ltd — Sovereignty is Security.