Terms of Service

Plain Language Summary

This summary provides a high-level overview of our Terms of Service, but the full terms below govern your relationship with Enigma Labs B.V. By using our cybersecurity platform, you agree to these terms.

What you're agreeing to:

• Using our AI-powered cybersecurity services for your organisation's security needs
• Paying subscription fees according to your selected plan (monthly or annual)
• Following our Acceptable Use Policy and keeping your account credentials secure
• Understanding that while we strive for 99.9% uptime, no security solution can guarantee absolute protection

What you can expect from us:

• Professional cybersecurity services as described in our Documentation
• Secure handling of your data in accordance with our Privacy Policy and Data Processing Agreement
• Service credits if we fail to meet our 99.0% uptime threshold (20% of monthly fees)
• Protection of your confidential information
• Notification within 48 hours of any confirmed data breach affecting your data

Important limitations:

• Our liability is capped at 12 months of fees paid (with certain exceptions)
• All fees are non-refundable once paid
• You remain responsible for your overall security posture and decisions
• Disputes are resolved through arbitration in Amsterdam under NAI rules

Key contacts:

• Legal questions: hello@enigmalab.io
• Technical support: hello@enigmalab.io
• Security issues: hello@enigmalab.io
• Billing inquiries: hello@enigmalab.io

1. Overview and Acceptance

1.1 Agreement to Terms

These Terms of Service ("Terms") constitute a legally binding agreement between Enigma Labs B.V. ("Enigma Labs," "we," "us," or "our") and the organisation accepting these Terms ("Customer," "you," or "your"). These Terms govern your access to and use of the Enigma Labs cybersecurity platform and related services.

By clicking "I Accept," creating an account, accessing, or using our Services, you acknowledge that you have read, understood, and agree to be bound by these Terms. If you do not agree to these Terms, you must not access or use the Services.

1.2 Eligibility and Authority

You represent and warrant that:

• You are at least 18 years of age
• You have the legal authority to bind the organisation you represent to these Terms
• The organisation you represent is a business entity, not an individual consumer
• All registration information you provide is accurate, complete, and current

1.3 Electronic Acceptance

Your electronic acceptance of these Terms, whether by clicking "I Accept" or using the Services, constitutes a valid and binding agreement under Dutch law, including the Dutch Civil Code (Burgerlijk Wetboek) and applicable EU electronic commerce regulations.

1.4 Incorporated Documents

These Terms incorporate by reference the following documents, which form an integral part of this Agreement:

1.5 Order Forms and Statements of Work

When you enter into an Order Form or Statement of Work (SOW) with Enigma Labs, those documents become part of this Agreement. In the event of any conflict between documents, the following order of precedence applies:

1. Data Processing Agreement — for data protection matters
2. Order Form / Statement of Work — for specific deal terms
3. These Terms of Service — for general terms
4. Privacy Policy — for personal data matters

1.6 Unfair Terms Compliance

These Terms have been drafted in accordance with Directive 93/13/EEC on unfair terms in consumer contracts and Dutch implementing legislation. Although these Terms are intended for business-to-business relationships, we have endeavored to ensure that all terms are fair, transparent, and balanced.

2. Definitions

The following terms have the meanings set forth below wherever used in this Agreement:

3. Service Description and Scope

3.1 Description of Services

Enigma Labs provides professional cybersecurity services. Our Services include:

3.2 Service Delivery

The Services are provided via:

• Cloud-hosted infrastructure accessible through web browsers
• RESTful API access for integrations and automation
• Documentation available at https://enigmalab.io/docs

3.3 Support Services

Standard support included with all subscriptions:

• Email support during business hours (09:00-18:00 CET, Monday-Friday)
• Response time within 24 hours for non-critical issues
• Access to online Documentation and knowledge base

Premium support packages (available for additional fees):

• Priority response times
• Phone support
• Dedicated support representative
• 24/7 coverage options

3.4 Exclusions

The following are not included in the standard subscription:

• Professional services (implementation, training, consulting) — available separately
• Custom software development
• On-premises deployment
• 24/7 phone support (unless purchased)
• Managed security services

3.5 Modifications to Services

Enigma Labs reserves the right to:

• Modify, enhance, or discontinue features with 30 days advance notice for material changes
• Discontinue features entirely with 90 days advance notice
• Add new features and functionality at any time

3.6 Beta and Preview Features

From time to time, Enigma Labs may offer beta, pilot, or preview features:

• These features are provided "AS IS" with no warranties
• They may be discontinued at any time without notice
• They may contain bugs or defects
• They must not be used for production or mission-critical workloads
• Enigma Labs has no liability for issues arising from beta features
• Beta features are clearly labeled as such in the platform

3.7 Subcontractors

Enigma Labs may use subcontractors to perform portions of the Services, provided that:

• Enigma Labs remains fully responsible for their performance and compliance with this Agreement
• Subcontractors are bound by confidentiality obligations at least as protective as those in this Agreement
• For Personal Data processing, subcontractors are subject to the Data Processing Agreement requirements

3.8 Insurance

Enigma Labs maintains appropriate insurance coverage for a company of its size and nature, including cyber liability insurance. Details of coverage are available upon request for enterprise customers under NDA.

4. Account Registration and Security

4.1 Registration Requirements

To use the Services, you must:

• Complete the registration process with accurate, complete, and current information
• Maintain current contact and billing information at all times
• Designate at least one Account Administrator
• Provide a valid business email address (consumer email domains such as gmail.com, yahoo.com, hotmail.com, and outlook.com are not permitted for primary account registration)

4.2 Account Administrator Responsibilities

The Account Administrator is responsible for:

• Managing Authorized Users, including adding and removing access
• Controlling access permissions and role assignments
• Ensuring all Authorized Users comply with these Terms
• Maintaining accurate contact information for all users
• Responding to communications from Enigma Labs
• Designating a security contact for incident notifications

4.3 User Credential Security

Customer is responsible for:

• All activity that occurs under Customer's account credentials
• Ensuring Authorized Users use strong, unique passwords
• Enabling multi-factor authentication (MFA) when available (strongly recommended)
• Ensuring credentials are not shared among users
• Immediately notifying Enigma Labs of any suspected unauthorized access at hello@enigmalab.io
• Maintaining credential security as part of Customer's overall security posture

4.4 Unauthorized Access

If you suspect any unauthorized access to your account:

• Immediately change all passwords
• Review account activity logs
• Notify Enigma Labs at hello@enigmalab.io within 24 hours
• Cooperate with any investigation
• Document the suspected incident for your records

4.5 Account Suspension by Enigma Labs

Enigma Labs may suspend your account immediately, without prior notice, if:

• We detect a security threat or unauthorized access
• We suspect violation of the Acceptable Use Policy
• Required by law or legal process
• Necessary to protect the integrity of our platform or other customers

5. Subscriptions, Fees, and Payment

5.1 Subscription Terms

Enigma Labs offers the following subscription options:

• Subscriptions begin on the Effective Date
• All subscriptions automatically renew unless cancelled with proper notice
• Subscription terms are as specified in the applicable Order Form

5.2 Cancellation and Non-Renewal

To prevent auto-renewal:

• Provide written notice of cancellation at least 30 days before the renewal date
• Send notice to: hello@enigmalab.io
• Include your account identifier and organisation name
• Enigma Labs will acknowledge receipt within 5 business days

5.3 Fees and Payment

• Fees are as specified in the Order Form or published pricing
• All Fees are quoted in EUR (Euros) unless otherwise specified
• USD is accepted for international customers by prior arrangement
• Payment is due within 30 days of invoice date (Net 30)
• Invoices are sent electronically to the billing contact on file
• Accepted payment methods: bank transfer, credit card, or as agreed in writing

5.4 Taxes

• All Fees are exclusive of taxes
• Customer is responsible for all applicable taxes, including:
• Value Added Tax (VAT) where Customer is responsible
• Sales tax, use tax, or similar taxes
• Withholding taxes (with gross-up obligation)
• Enigma Labs will charge and remit Dutch VAT as required by law
• Customer must provide a valid VAT number if claiming VAT exemption

5.5 Late Payment

If payment is not received by the due date:

• Interest accrues at 1.5% per month or the maximum rate permitted by Dutch law, whichever is lower
• Enigma Labs may suspend Services if payment is more than 15 days overdue, after providing 5 days written notice
• Customer remains liable for all Fees during any suspension period
• Enigma Labs may engage collection agencies and recover reasonable collection costs
• Continued non-payment for 60+ days constitutes a Material Breach

5.6 Price Changes

• Enigma Labs may change Fees with 60 days written notice before the next renewal
• Price changes do not affect the current Subscription Term
• If a price increase exceeds 10% of the current Fees, Customer may terminate the Agreement effective at the end of the current Subscription Term by providing written notice within 30 days of receiving the price change notice
• For price increases of 10% or less, continued use after the renewal date constitutes acceptance

5.7 No Refunds

ALL FEES ARE NON-REFUNDABLE.

• No pro-rata refunds for early cancellation or termination
• No refunds for unused portions of the Subscription Term
• Service credits are applied to future invoices only, not refunded in cash
• Exception: If Enigma Labs terminates for convenience, Customer receives a pro-rata refund of prepaid Fees for the unused period

5.8 Disputed Invoices

If you dispute an invoice:

• Notify Enigma Labs in writing within 15 days of receipt
• Pay all undisputed portions by the due date
• Provide detailed explanation of the dispute with supporting documentation
• Parties will work in good faith to resolve within 30 days
• Undisputed portions remain subject to late payment provisions

6. Customer Data and Responsibilities

6.1 Customer Data Ownership

Customer retains all rights, title, and interest in and to Customer Data. Nothing in this Agreement transfers ownership of Customer Data to Enigma Labs.

6.2 License Grant to Enigma Labs

Customer grants Enigma Labs a limited, non-exclusive, worldwide license to:

• Process Customer Data solely to provide the Services
• Store and backup Customer Data for service delivery
• Analyze aggregated, anonymized data to improve the Services (in a manner that does not identify Customer or any individual)

This license terminates upon termination of the Agreement and deletion of Customer Data.

6.3 Customer Responsibilities

Customer is solely responsible for:

• The accuracy, quality, and legality of Customer Data
• Obtaining all necessary rights, consents, and authorizations to submit data
• Ensuring use of Services complies with all applicable laws
• Evaluating alerts and taking appropriate security actions in a timely manner
• Overall security posture and security-related decisions
• Configuring the Services appropriately for their environment
• Maintaining independent backups of critical data, refreshed at least weekly (the Services are not designed to be Customer's sole backup solution)
• Actions of all Authorized Users
• Ensuring Authorized Users comply with these Terms

6.4 Prohibited Content

Customer shall not submit data that:

• Violates any applicable law or regulation
• Infringes third-party intellectual property, privacy, or other rights
• Contains malware, viruses, or code intended to harm Enigma Labs systems
• Is subject to export control restrictions that Customer has not disclosed
• Contains unlawful, harmful, threatening, defamatory, or obscene content

6.5 Data Processing Agreement

For the processing of Personal Data, Customer and Enigma Labs shall enter into a Data Processing Agreement (DPA) that complies with GDPR requirements. The DPA is incorporated by reference into this Agreement and takes precedence over conflicting terms for data protection matters.

Enterprise customers should contact hello@enigmalab.io to execute a DPA.

6.6 Security Incident Notification

In the event of a confirmed Security Incident affecting Customer Data:

• Enigma Labs will notify Customer's designated security contact within 48 hours of confirmation
• Notification will include: nature of the incident, types of data affected, measures taken, and recommended actions
• Enigma Labs will cooperate with Customer's reasonable investigation requests
• Enigma Labs will provide updates as material new information becomes available
• This obligation is in addition to any notification requirements in the Data Processing Agreement

6.7 Data Export and Portability

• Customer may export Customer Data at any time through the platform's export features
• Upon written request, Enigma Labs will provide reasonable assistance with data export
• Standard export formats: JSON, CSV
• Export functionality may be subject to technical limitations
• Large data exports may require scheduling to minimize service impact

6.8 Data Deletion

Upon termination of the Agreement:

• Customer has 30 days to export Customer Data
• After the 30-day export period, Enigma Labs will delete Customer Data
• Deletion timeline: within 90 days of the export period expiration
• Some data may be retained as required by law or for legitimate business purposes (anonymized analytics, billing records)
• Backup copies may persist for up to 180 days in encrypted backup systems before automatic deletion
• Upon request, Enigma Labs will provide written confirmation of deletion

7. Service Level Agreement

7.1 Uptime Commitment

Enigma Labs commits to providing the following level of service availability:

7.2 Availability Measurement

• Availability is calculated as: (Total minutes in month - Downtime minutes) / Total minutes in month × 100
• Downtime begins when Enigma Labs confirms the issue through its monitoring systems, or when Customer reports it with reasonable evidence, whichever is earlier
• Downtime ends when the Services are restored and accessible

7.3 Scheduled Maintenance

• Regular maintenance window: Saturdays 02:00-06:00 CET
• Advance notice: 7 days for scheduled maintenance
• Scheduled maintenance is excluded from uptime calculations
• Enigma Labs will use reasonable efforts to minimize disruption
• Maintenance notifications sent to Account Administrator email

7.4 Emergency Maintenance

Enigma Labs may perform emergency maintenance without advance notice when necessary for:

• Security patches or critical updates
• System stability issues
• Prevention of data loss

Emergency maintenance is excluded from uptime calculations. Enigma Labs will notify Customers as soon as practicable.

7.5 Service Credits

If monthly availability falls below 99.0%, Customer may request a service credit:

Credit Terms:

• Maximum credit per month: 20% of monthly Fees
• Credits are applied to future invoices only (no cash refunds)
• Credits are not cumulative across months and do not carry over if unused within 12 months
• Request deadline: Within 30 days of the incident
• Request method: Email to hello@enigmalab.io with incident details including dates, times, and impact description
• Enigma Labs will respond to credit requests within 10 business days; failure to respond within this period constitutes acknowledgment of the request

7.6 Exclusions from Uptime Commitment

The following are excluded from the uptime calculation and credit eligibility:

• Scheduled or emergency maintenance
• Customer's acts or omissions
• Customer's equipment, software, or network connections
• Third-party services or internet connectivity issues
• Force majeure events
• Suspension due to Customer's breach or non-payment
• Features labeled as beta, preview, or pilot
• Factors outside Enigma Labs' reasonable control
• Outages lasting less than 5 consecutive minutes

7.7 Sole Remedy

SERVICE CREDITS ARE CUSTOMER'S SOLE AND EXCLUSIVE REMEDY for any downtime, service unavailability, or failure to meet the Uptime Commitment. This limitation applies regardless of the theory of liability.

7.8 Uptime Reporting

Upon request, Enigma Labs will provide Customer with monthly uptime reports showing availability metrics for the preceding period.

8. Acceptable Use Policy

8.1 Permitted Use

Customer may use the Services only for lawful business purposes in accordance with this Agreement and applicable laws.

8.2 Prohibited Uses

Customer shall not, and shall not permit Authorized Users to:

Illegal Activities:

• Use Services for any unlawful purpose or in violation of any applicable law
• Facilitate illegal activities by third parties
• Violate export control, sanctions, or trade restriction laws
• Engage in fraud, money laundering, or terrorist financing

Security Violations:

• Attempt to gain unauthorized access to any systems, networks, or data
• Probe, scan, or test vulnerabilities of Enigma Labs systems without authorization
• Interfere with or disrupt the Services or servers
• Circumvent security features or access controls
• Use the Services to attack or scan systems you do not own or have explicit permission to test
• Distribute malware, viruses, worms, or harmful code

Misuse:

• Send spam, phishing messages, or unsolicited communications
• Harass, abuse, stalk, or harm others
• Impersonate any person or entity
• Collect data about other Enigma Labs customers
• Use the Services to mine cryptocurrency without authorization

Commercial Restrictions:

• Resell, sublicense, or transfer access to the Services without authorization
• Use the Services to build a competitive product or service
• Perform competitive analysis or benchmarking without written consent
• Exceed usage limits specified in the Order Form

Technical Restrictions:

• Reverse engineer, decompile, disassemble, or attempt to derive source code
• Copy, modify, or create derivative works of the Services
• Remove or alter proprietary notices, labels, or marks
• Use automated tools (bots, scrapers) to access Services except through approved APIs
• Frame or mirror any part of the Services without authorization

8.3 Consequences of Violation

Enigma Labs may:

• Immediately suspend or terminate access for AUP violations
• Terminate without notice for serious violations
• Hold Customer liable for Fees during suspension
• Report illegal activities to appropriate authorities
• Seek indemnification for losses caused by violations

8.4 Reporting Violations

Report suspected violations to: hello@enigmalab.io

9. Intellectual Property Rights

9.1 Enigma Labs Intellectual Property

Enigma Labs retains all rights, title, and interest in and to:

• The Services, Platform, and all software
• All algorithms, machine learning models, and technology
• Documentation and training materials
• Trademarks, logos, brand elements, and trade dress
• Any improvements, modifications, or derivative works
• Aggregated, anonymized insights derived from usage data

9.2 License Grant to Customer

Subject to Customer's compliance with this Agreement, Enigma Labs grants Customer a limited, non-exclusive, non-transferable, non-sublicensable license to:

• Access and use the Services during the Subscription Term
• Use Documentation in connection with permitted use of Services
• Access the Platform through web browsers and approved APIs

This license terminates upon termination of this Agreement.

9.3 License Restrictions

Customer shall not:

• Copy, modify, or create derivative works of the Services
• Reverse engineer, decompile, or disassemble the Services
• Sell, resell, sublicense, or transfer the Services
• Use the Services to build a competing product or service
• Remove or alter proprietary notices or markings
• Use Enigma Labs trademarks without prior written permission

9.4 Feedback

If Customer provides suggestions, ideas, or feedback about the Services ("Feedback"):

• Customer grants Enigma Labs a perpetual, irrevocable, royalty-free, worldwide license to use Feedback
• Enigma Labs may incorporate Feedback into the Services without obligation to Customer
• Feedback is provided without any confidentiality obligation
• Customer has no right to compensation for Feedback

9.5 Customer Intellectual Property

Customer retains all rights in Customer Data and Customer's pre-existing intellectual property. Customer grants only the limited licenses expressly stated in this Agreement.

9.6 No Implied Licenses

Except for the express licenses granted in this Agreement, neither party grants any rights to its intellectual property. All rights not expressly granted are reserved.

9.7 Publicity and References

Neither party shall use the other's name, logo, or trademarks in any publicity, advertising, or marketing materials without prior written consent, except that:

• Enigma Labs may list Customer's company name as a client in general marketing materials and on its website
• Customer may opt out of such listing by written notice to hello@enigmalab.io

10. Confidentiality

10.1 Definition of Confidential Information

"Confidential Information" means non-public information disclosed by one party ("Discloser") to the other ("Recipient") that:

• Is marked as "confidential" or "proprietary" at the time of disclosure; or
• Should reasonably be understood to be confidential given its nature and the circumstances of disclosure

10.2 Enigma Labs Confidential Information

Includes but is not limited to:

• Services, software, algorithms, and technology
• Pricing, business plans, and strategies
• Security measures, architecture, and vulnerabilities
• Non-public product roadmaps
• Third-party audit reports and security assessments

10.3 Customer Confidential Information

Includes but is not limited to:

• Customer Data
• Business information submitted through the Services
• Security configurations and vulnerability information
• Non-public business plans and strategies

10.4 Exclusions

Confidential Information does not include information that:

• Is or becomes publicly available without breach of this Agreement
• Was known to Recipient before disclosure by Discloser
• Is independently developed by Recipient without use of Confidential Information
• Is rightfully received from a third party without restriction

10.5 Confidentiality Obligations

Recipient shall:

• Use Confidential Information only for purposes of this Agreement
• Protect Confidential Information with at least the same care as its own confidential information (minimum: reasonable care)
• Limit disclosure to employees and contractors with a need to know who are bound by confidentiality obligations at least as protective as these
• Not disclose to third parties without Discloser's prior written consent

10.6 Permitted Disclosures

Recipient may disclose Confidential Information if required by law, provided Recipient:

• Gives Discloser prompt written notice (where legally permitted)
• Cooperates with Discloser's efforts to seek a protective order
• Discloses only the minimum amount required

10.7 Duration

Confidentiality obligations survive termination of this Agreement for:

• 5 years for general Confidential Information
• Indefinitely for trade secrets
• Until deletion for Customer Data

11. Warranties and Disclaimers

11.1 Enigma Labs Warranties

Enigma Labs warrants that:

• It has the authority to enter into this Agreement
• The Services will perform materially as described in the Documentation
• Services will be provided in a professional and workmanlike manner
• Enigma Labs will comply with applicable laws in providing the Services
• To Enigma Labs' knowledge, the Services do not infringe third-party intellectual property rights

11.2 Customer Warranties

Customer warrants that:

• It has the authority to enter into this Agreement
• It will comply with all applicable laws in using the Services
• It has all necessary rights to submit Customer Data
• Customer Data does not violate third-party rights

11.3 DISCLAIMERS

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, EXCEPT FOR THE EXPRESS WARRANTIES STATED IN SECTION 11.1.

ENIGMA LABS SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING:

• IMPLIED WARRANTIES OF MERCHANTABILITY
• FITNESS FOR A PARTICULAR PURPOSE
• NON-INFRINGEMENT
• ACCURACY OR COMPLETENESS OF RESULTS

ENIGMA LABS DOES NOT WARRANT THAT:

• THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE
• ALL SECURITY THREATS WILL BE DETECTED OR PREVENTED
• THE SERVICES WILL MEET ALL CUSTOMER REQUIREMENTS
• DEFECTS WILL BE CORRECTED
• THE SERVICES WILL BE COMPATIBLE WITH ALL SYSTEMS OR SOFTWARE

11.4 Cybersecurity-Specific Disclaimers

THE SERVICES ARE DESIGNED TO HELP DETECT AND RESPOND TO SECURITY THREATS BUT CANNOT GUARANTEE PREVENTION OF ALL SECURITY INCIDENTS. NO SECURITY SOLUTION CAN PROVIDE ABSOLUTE PROTECTION.

CUSTOMER ACKNOWLEDGES AND AGREES THAT:

• THE SERVICES PROVIDE INFORMATION AND ALERTS THAT REQUIRE CUSTOMER EVALUATION AND ACTION
• CUSTOMER REMAINS SOLELY RESPONSIBLE FOR ITS OVERALL SECURITY POSTURE AND DECISIONS
• ENIGMA LABS IS NOT LIABLE FOR SECURITY INCIDENTS THAT OCCUR DESPITE THE SERVICES FUNCTIONING AS DESIGNED
• THE EFFECTIVENESS OF THE SERVICES DEPENDS IN PART ON CUSTOMER'S CONFIGURATION, RESPONSE TIME, AND OVERALL SECURITY PRACTICES
• CUSTOMER SHOULD NOT RELY ON THE SERVICES AS ITS SOLE SECURITY MEASURE
• THREAT DETECTION IS BASED ON KNOWN PATTERNS AND AI ANALYSIS, WHICH MAY NOT IDENTIFY ALL THREATS, INCLUDING NOVEL OR ZERO-DAY ATTACKS

11.5 Third-Party Services

The Services may integrate with third-party services. Enigma Labs makes no warranties regarding third-party services and is not responsible for their availability, security, or performance.

11.6 Beta Features

Beta, pilot, or preview features are provided "AS IS" without any warranty. They may be discontinued at any time without notice.

12. Limitation of Liability

12.1 LIMITATION ON DAMAGES

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

NEITHER PARTY SHALL BE LIABLE FOR ANY:

• INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES
• LOSS OF PROFITS, REVENUE, OR BUSINESS
• LOSS OF DATA OR DATA BREACH COSTS (except as part of direct damages subject to the cap)
• BUSINESS INTERRUPTION
• LOSS OF GOODWILL OR REPUTATION
• COST OF SUBSTITUTE SERVICES

REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE), EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

12.2 LIABILITY CAP

EXCEPT FOR EXCLUDED CLAIMS (DEFINED BELOW), EACH PARTY'S TOTAL AGGREGATE LIABILITY UNDER THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE CLAIM.

12.3 EXCLUDED CLAIMS

The following are not subject to the liability cap:

• Customer's payment obligations for Fees
• Either party's indemnification obligations under Section 13
• Breaches of confidentiality obligations under Section 10
• Gross negligence (grove schuld) or willful misconduct (opzet) under Dutch law
• Fraud or fraudulent misrepresentation
• Death or personal injury caused by negligence
• Any liability that cannot be limited under applicable Dutch or EU law

12.4 Acknowledgment

Customer acknowledges that:

• The Fees reflect the allocation of risk in this Agreement
• The limitations of liability are essential to the Agreement
• Enigma Labs would not enter into this Agreement without these limitations
• These limitations apply even if any remedy fails of its essential purpose

12.5 Multiple Claims

The existence of multiple claims does not increase the liability cap. All claims arising from related facts or circumstances shall be treated as a single claim for purposes of the liability cap.

13. Indemnification

13.1 Customer Indemnification

Customer shall defend, indemnify, and hold harmless Enigma Labs, its affiliates, and their officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from:

• Customer Data or Customer's use of Customer Data
• Customer's violation of this Agreement, including the Acceptable Use Policy
• Customer's violation of applicable laws
• Customer's infringement of third-party rights
• Claims by Customer's Authorized Users or end-users
• Customer's use of the Services in combination with other products or services not provided by Enigma Labs

13.2 Enigma Labs Indemnification

Enigma Labs shall defend, indemnify, and hold harmless Customer from and against any third-party claims that the Services (as provided by Enigma Labs and used in accordance with this Agreement) infringe a third party's intellectual property rights, and shall pay any damages finally awarded or settlement amounts.

13.3 Exclusions from Enigma Labs Indemnification

Enigma Labs has no obligation for claims arising from:

• Customer's modification of the Services
• Combination of Services with products not provided by Enigma Labs
• Customer's use of the Services after notice to discontinue due to infringement
• Customer's use in violation of this Agreement
• Open-source components used in accordance with their licenses
• Customer Data or Customer-provided specifications

13.4 Indemnification Procedures

The indemnified party must:

• Provide prompt written notice of the claim to the indemnifying party (delay does not relieve obligations except to the extent of prejudice)
• Give the indemnifying party sole control of defense and settlement
• Provide reasonable cooperation (at indemnifying party's expense)
• Not admit liability or settle without the indemnifying party's prior written consent

13.5 Infringement Remedies

If the Services are held to infringe or Enigma Labs believes they may infringe, Enigma Labs may at its option and expense:

• Obtain the right to continue providing the Services
• Modify the Services to be non-infringing while maintaining material functionality
• Replace the Services with non-infringing alternatives of substantially equivalent functionality
• If none of the above are commercially reasonable, terminate the affected Services and provide a pro-rata refund of prepaid Fees for the unused period

14. Term and Termination

14.1 Term

• This Agreement begins on the Effective Date
• Initial Subscription Term as specified in Order Form (monthly or annual)
• Auto-renews for successive periods of the same length unless terminated
• Continues until terminated as provided herein

14.2 Non-Renewal

Either party may prevent renewal by providing written notice at least 30 days before the renewal date:

• Customer notice to: hello@enigmalab.io
• Enigma Labs notice to: Customer's registered email address
• Notice via email and registered post recommended for important communications

14.3 Termination for Cause by Either Party

Either party may terminate if the other party:

• Commits a Material Breach (as defined in Section 2) and fails to cure within 30 days of written notice specifying the breach
• Becomes subject to bankruptcy, insolvency, receivership, or liquidation proceedings
• Ceases operations or makes an assignment for benefit of creditors

14.4 Termination for Cause by Enigma Labs

Enigma Labs may terminate immediately without notice or cure period if Customer:

• Fails to pay Fees within 60 days of due date
• Materially violates the Acceptable Use Policy
• Uses the Services in a manner that threatens the security or integrity of the platform
• Engages in illegal activity using the Services
• Attempts to circumvent security controls or access unauthorized data

14.5 Termination for Convenience by Enigma Labs

Enigma Labs may terminate for convenience with 90 days written notice. In this case, Customer receives a pro-rata refund of prepaid Fees for the unused portion of the Subscription Term.

14.6 Termination for Convenience by Customer

Customer may terminate for convenience at any time with written notice. However:

• No refunds of prepaid Fees
• Customer remains liable for Fees through the end of the current Subscription Term

14.7 Effects of Termination

Upon termination or expiration:

• Customer's access to Services terminates immediately (or at end of notice period, as applicable)
• Customer must cease all use of the Services
• Customer has 30 days to export Customer Data (see Section 6.8)
• After 30 days, Enigma Labs will delete Customer Data (within 90 days total)
• Each party must return or destroy the other's Confidential Information upon request
• Termination does not relieve Customer of obligation to pay accrued Fees

14.8 Survival

The following provisions survive termination:

• Section 2 (Definitions)
• Section 5 (payment obligations for accrued Fees)
• Section 6.8 (Data Deletion)
• Section 9 (Intellectual Property Rights)
• Section 10 (Confidentiality) — for 5 years
• Section 11 (Warranties and Disclaimers)
• Section 12 (Limitation of Liability)
• Section 13 (Indemnification)
• Section 14.7-14.8 (Effects of Termination, Survival)
• Section 17 (Governing Law and Dispute Resolution)
• Section 18 (General Provisions)

15. Suspension

15.1 Right to Suspend

Enigma Labs may suspend Customer's access to Services, in whole or in part, if:

• Customer fails to pay Fees within 15 days of due date (after 5 days written notice)
• Customer violates the Acceptable Use Policy
• Required by law or legal process
• Necessary to prevent harm to Enigma Labs, other customers, or third parties
• Customer's use poses a security risk to the platform
• Customer's account shows signs of unauthorized access

15.2 Notice

Enigma Labs will provide reasonable advance notice of suspension when feasible, except:

• Immediate suspension for serious AUP violations
• Immediate suspension for active security threats
• Suspension required by law or legal process

15.3 During Suspension

• Customer remains liable for all Fees during suspension
• Customer Data will be preserved during suspension
• If suspension continues for more than 60 days, Enigma Labs may delete Customer Data after providing 30 days advance written notice
• Suspension does not terminate the Agreement unless converted to termination

15.4 Resumption

Services will be restored promptly when:

• Overdue payments are received in full (including interest and costs)
• AUP violation is remedied to Enigma Labs' reasonable satisfaction
• Security threat is resolved
• Legal requirement is lifted

15.5 No Liability

Enigma Labs shall not be liable to Customer or any third party for any suspension made in accordance with this section.

16. Modifications to Terms

16.1 Right to Modify

Enigma Labs may modify these Terms of Service at any time.

16.2 Notice of Changes

Material changes include:

• Changes to Fees or payment terms
• Changes to limitation of liability
• Changes to Customer's substantive rights
• Changes to dispute resolution provisions
• Changes to data handling or security practices

16.3 Acceptance of Changes

• Continued use of Services after the effective date constitutes acceptance
• If Customer objects to material changes, Customer may terminate before the effective date by providing written notice
• Termination for objection to material changes: no refund of prepaid Fees, but no further payment obligations after termination date

16.4 Current Terms

The current version of these Terms is always available at: https://enigmalab.io/tos

Previous versions are available upon request to hello@enigmalab.io.

17. Governing Law and Dispute Resolution

17.1 Governing Law

This Agreement and any disputes arising from it shall be governed by and construed in accordance with the laws of the Netherlands, without regard to conflict of law principles.

17.2 Arbitration

All disputes arising in connection with these Terms of Service, or further agreements resulting therefrom, shall be settled in accordance with the Arbitration Rules of the Netherlands Arbitration Institute (NAI). The arbitral tribunal shall consist of one arbitrator. The place of arbitration shall be Amsterdam, the Netherlands. The language of the arbitration shall be English. The arbitrator's decision shall be final and binding upon both parties. Judgment on the award may be entered in any court of competent jurisdiction.

17.3 Informal Resolution

Before initiating arbitration, the parties shall attempt to resolve disputes informally:

• Complaining party sends written notice describing the dispute to the other party
• Parties have 30 days to attempt resolution through good-faith negotiation
• If not resolved within 30 days, either party may initiate arbitration

17.4 Confidentiality of Proceedings

All arbitration proceedings, including the existence of the dispute, submissions, evidence, and the award, shall be kept confidential by both parties, except as required by law or to enforce the award.

17.5 Costs

Each party shall bear its own costs and attorneys' fees, unless the arbitrator determines that a claim was frivolous or brought in bad faith, in which case the losing party shall pay the prevailing party's reasonable costs and fees.

17.6 Injunctive Relief

Notwithstanding the arbitration clause, either party may seek injunctive or other equitable relief from any court of competent jurisdiction to protect its intellectual property rights or Confidential Information, without being required to post bond.

17.7 Class Action Waiver

To the extent permitted by applicable law, all disputes shall be resolved on an individual basis. Neither party shall bring claims as a plaintiff or class member in any class, consolidated, or representative action.

18. General Provisions

18.1 Entire Agreement

This Agreement, including all documents incorporated by reference, constitutes the entire agreement between the parties regarding its subject matter and supersedes all prior agreements, representations, and understandings, whether written or oral.

18.2 Order of Precedence

In case of conflict between documents, the following order of precedence applies:

1. Data Processing Agreement
2. Order Form or Statement of Work
3. These Terms of Service
4. Privacy Policy

18.3 Severability

If any provision of this Agreement is held invalid, illegal, or unenforceable by a court or arbitrator of competent jurisdiction, the remaining provisions continue in full force and effect. The invalid provision shall be modified to the minimum extent necessary to make it valid while preserving the parties' intent, or if modification is not possible, severed from the Agreement.

18.4 Waiver

No waiver of any provision of this Agreement shall be effective unless in writing and signed by the waiving party. Failure to enforce any right does not constitute a waiver of that right. A waiver of any breach does not constitute a waiver of any subsequent breach.

18.5 Assignment

• Customer may not assign this Agreement without Enigma Labs' prior written consent, which shall not be unreasonably withheld
• Enigma Labs may assign this Agreement to an affiliate or in connection with a merger, acquisition, corporate reorganisation, or sale of all or substantially all of its assets
• Any attempted assignment in violation of this section is void
• This Agreement binds and benefits the parties and their permitted successors and assigns

18.6 No Third-Party Beneficiaries

This Agreement is solely for the benefit of the parties hereto. No third party has any rights under this Agreement, except that Enigma Labs' affiliates are third-party beneficiaries of the limitation of liability and indemnification provisions.

18.7 Independent Contractors

The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship between the parties.

18.8 Force Majeure

Neither party is liable for delays or failures in performance due to circumstances beyond its reasonable control ("Force Majeure"), including:

• Natural disasters, pandemics, epidemics, or acts of God
• War, terrorism, riots, or civil unrest
• Government actions, regulations, embargoes, or sanctions
• Internet or telecommunications failures not caused by the affected party
• Cyberattacks on third-party infrastructure
• Labor disputes not involving the affected party's employees
• Power outages or utility failures

The affected party must:

• Provide prompt notice of the Force Majeure event
• Use reasonable efforts to mitigate the impact
• Resume performance as soon as reasonably practicable

If Force Majeure continues for more than 60 days, either party may terminate affected Services with written notice, and Customer will receive a pro-rata refund of prepaid Fees for the affected period.

18.9 Notices

All legal notices must be in writing and sent to:

To Enigma Labs: Enigma Labs B.V. Attn: Legal Department Korte Lijnbaanssteeg 1 1012SL Amsterdam, Netherlands Email: hello@enigmalab.io

To Customer: The address and email provided during registration or as updated in account settings.

Notices are effective:

• When delivered personally
• One business day after sending by recognized overnight courier
• Upon confirmed delivery by email (read receipt or reply)
• Three business days after sending by registered mail

For important notices (termination, breach, legal claims), sending via both email and registered post is recommended.

18.10 Export Compliance

Customer shall comply with all applicable export control laws and regulations, including those of the European Union, the Netherlands, and the United States. Customer shall not export or re-export the Services to prohibited countries, persons, or entities.

18.11 Anti-Corruption

Each party represents and warrants that it has not and will not, in connection with this Agreement:

• Violate any applicable anti-corruption or anti-bribery laws, including the Dutch Criminal Code (Wetboek van Strafrecht), the UK Bribery Act, and the US Foreign Corrupt Practices Act
• Offer, pay, promise, or authorize payment of money or anything of value to any government official, political party, or public international organisation to influence official action or obtain improper advantage
• Engage in money laundering or terrorist financing

Violation of this section constitutes a Material Breach permitting immediate termination.

18.12 Government Customers

If Customer is a government entity, additional terms may apply. Contact hello@enigmalab.io before accepting these Terms.

18.13 Audit Rights

Upon Customer's written request (no more than once per calendar year), Enigma Labs shall provide Customer with:

• Copies of relevant third-party audit reports (e.g., SOC 2 Type II, ISO 27001 certification), subject to confidentiality obligations
• Written responses to reasonable security questionnaires (up to 100 questions)

On-site audits of Enigma Labs' facilities are not permitted except:

• As required by applicable data protection law (subject to the Data Processing Agreement)
• Following a confirmed Security Incident affecting Customer Data
• Subject to separate written agreement on scope, timing, and cost allocation

18.14 Language

This Agreement is in English. If translated into any other language, the English version prevails in case of conflict or ambiguity.

18.15 Headings

Section headings are for convenience only and do not affect the interpretation of this Agreement.

18.16 Construction

This Agreement shall not be construed against either party as the drafter. Both parties have had the opportunity to review this Agreement with legal counsel. The terms "include," "includes," and "including" are not limiting.

19. Contact Information

19.1 Legal Inquiries

For questions about these Terms:

• Email: hello@enigmalab.io
• Mail: Enigma Labs B.V., Attn: Legal Department, Korte Lijnbaanssteeg 1, 1012SL Amsterdam, Netherlands

19.2 Technical Support

For technical support:

• Email: hello@enigmalab.io
• Website: https://enigmalab.io/support
• Hours: Monday-Friday, 09:00-18:00 CET

19.3 Security Issues

To report security issues or Acceptable Use Policy violations:

• Email: hello@enigmalab.io
• Response: Within 24 hours for security matters

19.4 Billing Inquiries

For billing questions:

• Email: hello@enigmalab.io

19.5 Privacy Matters

For privacy-related questions:

• Email: hello@enigmalab.io
• DPO: hello@enigmalab.io
• Privacy Policy: https://enigmalab.io/privacy

19.6 General Inquiries

For all other inquiries:

• Email: hello@enigmalab.io
• Website: https://enigmalab.io

Document Information

This document was prepared in accordance with Dutch law and European Union regulations. It is intended for business-to-business relationships. Enigma Labs B.V. recommends that all customers review these Terms with their legal counsel before accepting.

© 2026 Enigma Labs B.V. All rights reserved.