This Software as a Service Agreement (“Agreement”) is a binding legal agreement between you (“Customer”) and the applicable ControlUp entity identified in the applicable Order (“ControlUp”). By accessing or using the Software or Services, by executing an Order that references or incorporates this Agreement, or by clicking “I Agree” or a similar acknowledgment, Customer agrees to be bound by this Agreement. If Customer does not agree to these terms, it must not access or use the Software or Services. Customer (i) irrevocably waives, to the maximum extent permitted under applicable law, any requirement for an original (non-electronic) signature or for the delivery or retention of non-electronic records; and (ii) acknowledges and agrees that any processing of personal data in connection with the Software shall be governed by the applicable data protection terms, including the Data Processing Addendum or Privacy Policy, as applicable, each of which is incorporated herein by reference.
1. DEFINITIONS
All capitalized terms used in this Agreement shall have the meanings set forth in Exhibit A attached hereto. Other capitalized terms used in this Agreement are defined where they are used and have the meanings so indicated.
2. SERVICES AND SOFTWARE
2.1 Services and Software under Orders. ControlUp will implement, configure, maintain, and provide remote access to (i) the Software described in the applicable Order(s), and (ii) the Customer Data, in each case made accessible through the Facilities in accordance with the milestones, implementation dates, specifications, and requirements set out in this Agreement and the applicable Order(s).
2.2 Related Obligations and Restrictions.
(a) Grant of License. ControlUp hereby grants Customer, its Affiliates, and their respective employees, agents, and vendors a limited, non-exclusive, non-transferable (except as set out in Section 19.2), non-sublicensable, worldwide license during the Term to (a) access and use the Facilities as contemplated hereunder, including as described in the Services set out in the applicable Order, and (b) use the Software and Documentation, in each case subject to any geographical limitations, term restrictions, and payment obligations set forth in the applicable Order. This license is contingent upon Customer maintaining an active Order and fulfilling all payment obligations thereunder.
(b) Customer Responsibilities. Customer is solely responsible for: (i) ensuring that its users are appropriately qualified and trained to use the Software; (ii) all activities occurring under its use of the Software; (iii) using the Software in compliance with this Agreement and all applicable laws; and (iv) obtaining, at its own expense, all internet connectivity, equipment, and other infrastructure necessary to access and use the Software. ControlUp shall have no liability or Service Level obligations for any network-related issues exclusively attributable to Customer’s infrastructure, internet connectivity, or network configuration.
(c) Customer Restrictions. Customer shall not, and shall not permit any third party to: (a) access or use the Software to build a competitive product or service, or to develop a product incorporating any ideas, features, functions, or graphics substantially similar to those of the Software; (b) copy, reverse engineer, decompile, or disassemble the Software; (c) frame, mirror, or create links to the Software on any other server or platform; (d) transmit spam, unlawful, infringing, obscene, threatening, or defamatory content, or content that violates a third party’s privacy rights; (e) transmit or store viruses, malware, or other harmful code; (f) attempt to gain unauthorized access to the Software or related systems or networks; (g) use the Software in violation of applicable law; or (h) use the Software for any purpose other than Customer’s and its Affiliates’ internal business purposes.
(d) License Scope and Usage Limits. Customer’s permitted use of the Software and Services is limited to the quantity of licenses, metrics, or capacity purchased and set forth in the applicable Order or this Agreement (e.g., Named Users, Concurrent Sessions, Endpoints, or other authorized usage metrics), including: (a) where the Order includes ControlUp Scoutbees, usage limited to 20,000 tests per rolling 24-hour period; (b) Remote Control for Unmanaged Devices limited to fifty (50) sessions to unmanaged devices per rolling 24-hour period; and (c) where the Order includes AI Features, usage limited to the query, token, or consumption-based limits specified in the applicable Order or Documentation. Any use exceeding these limits may be automatically blocked or otherwise handled in accordance with the Monitoring and Excess Use provisions of this Agreement.
(e) Monitoring and Excess Use. ControlUp may monitor and audit Customer’s use of the Software and Services to verify compliance with the license metrics, quantities, and usage limitations specified in the applicable Order, including those set forth in Section 2.2(d). If ControlUp notifies Customer that its usage exceeds any such limitation (“Excess Use”), Customer shall, within thirty (30) days of such notice, either (a) cease the Excess Use, or (b) purchase additional licenses or capacity sufficient to cover the Excess Use, pro-rated through the end of the then-current Order Term.
(f) Pre-Authorized Growth. Any increase in Customer’s usage of the Software or Services that falls within the growth allowances, auto-scaling provisions, or expansion tiers expressly set forth in the applicable Order shall not constitute Excess Use under this Agreement.
(g) Repeated Excess Use. If Customer ceases Excess Use pursuant to the Monitoring and Excess Use provisions of this Agreement but subsequently incurs Excess Use again, and such Excess Use continues for a period exceeding one (1) month during the same Order Term, ControlUp may invoice Customer for such Excess Use at ControlUp’s then-current rates, pro-rated through the end of the Order Term, without affording Customer a cure period. Customer shall pay all such invoices within thirty (30) days of the invoice date, unless otherwise specified in the Order.
2.3 Customer Data.
(a) Ownership. As between the parties, Customer Data is and remains the property of Customer. ControlUp shall use Customer Data solely to perform its obligations under this Agreement, except as otherwise expressly permitted elsewhere in this Agreement.
(b) Availability. Customer Data shall generally be available to Customer through the Software or Facilities on a self-service basis. ControlUp shall additionally make Customer Data available for export in ControlUp’s then-current standard format upon Customer’s request, at no additional charge and no more than once per calendar month.
(c) Export and Deletion. For sixty (60) days following expiration or termination of the applicable Order, ControlUp will make Customer Data available for export in ControlUp’s then-current standard format at no charge. After that period, ControlUp has no obligation to retain Customer Data and may delete it, including copies residing in backup media, in accordance with ControlUp’s ordinary backup rotation cycle. ControlUp may retain Customer Data as required by applicable law, subject to the confidentiality and security obligations of this Agreement.
(d) Use of Anonymized and Aggregated Data. ControlUp may use Customer Data, alone or with its Affiliates and service providers, to generate anonymized and aggregated usage statistics to improve the Software and develop new functionality. ControlUp will not sell, lease, or otherwise disclose Customer Data to third parties, and will not commercially exploit Customer Data except as permitted above. ControlUp claims no ownership interest, lien, or other right in Customer Data.
(e) Back-up. ControlUp shall maintain backups of Customer Data in accordance with its standard backup and retention practices, as further described in the Disaster Recovery Plan. At no additional cost to Customer, ControlUp shall maintain redundant backup copies across multiple availability zones. Any third-party backup provider shall be subject to security obligations no less restrictive than those applicable to ControlUp under this Agreement.
2.4 Personnel and Subcontracting.
(a) Subcontracting. The Services will be primarily performed by ControlUp Personnel. ControlUp may subcontract the performance of any Services without Customer’s prior consent, provided that each Subcontractor is bound by written obligations no less restrictive than those set forth in this Agreement, including with respect to confidentiality and the protection of Customer Data. ControlUp remains fully liable for the acts and omissions of its Subcontractors as if performed by ControlUp directly. Engagement of Sub-processors requires no prior Customer consent and is governed exclusively by the applicable Data Processing Addendum.
(b) Performance through ControlUp Affiliates. ControlUp may perform its obligations under this Agreement, in whole or in part, through its Affiliates. ControlUp remains responsible for the performance of its obligations hereunder.
(c) Security and Supervision. ControlUp Personnel or Subcontractors, when on Customer premises, accessing Customer networks, or providing maintenance services, shall comply with Customer’s applicable security, supervision, and standard procedures.
3. AFFILIATES
3.1 Affiliate Use. Customer’s Affiliates may access and use the Services either: (i) by entering into their own Orders or Statements of Work with ControlUp that incorporate this Agreement by reference; or (ii) by being expressly included in Customer’s Order, subject to the following conditions: (A) such use is within the scope of the entitlements set forth in Customer’s applicable Order and does not exceed the total licensed volumes thereunder; (B) Customer expressly identifies each Affiliate it wishes to include under the Order prior to execution of such Order, or obtains ControlUp’s prior written authorization for any Affiliate not identified at the time of Order execution; (C) each Affiliate’s use is subject to and governed by the terms of this Agreement; and (D) Customer remains primarily liable for each Affiliate’s compliance with this Agreement and for all fees arising from Affiliate usage, including any overages.
3.2 Separate Orders. Where an Affiliate requires entitlements beyond those available under Customer’s existing Order, was not expressly identified in the applicable Order, or wishes to contract with ControlUp independently, such Affiliate must execute a separate Order with ControlUp, which shall incorporate the terms of this Agreement by reference unless the parties agree otherwise in writing.
3.3 Existing Customers. Where an Affiliate proposed to be included under Customer’s Order is itself an existing ControlUp customer with an active Order in effect, such Affiliate may not be included under Customer’s Order prior to the natural expiration of its own then-current Order term. For the avoidance of doubt, no existing Order between ControlUp and an Affiliate shall be terminated early for the purpose of consolidating such Affiliate under Customer’s Order. Upon expiration of the Affiliate’s existing Order term, the Affiliate may be included under Customer’s Order subject to the conditions set forth in Section 3.1 and subject to ControlUp’s prior written agreement.
3.4 Commercial Terms. The commercial terms applicable to each entity accessing the Services — whether Customer or any Affiliate — shall be set forth in the applicable Order for that entity and negotiated separately based on each entity’s specific requirements, volumes, and circumstances. The inclusion of an Affiliate under Customer’s Order or the execution of a separate Order by an Affiliate does not entitle such Affiliate to the same pricing, discounts, payment terms, or other commercial conditions as those agreed with Customer. ControlUp makes no representation that the commercial terms extended to Customer will be made available to any Affiliate, and each Affiliate’s commercial terms shall be determined at ControlUp’s sole discretion at the time of contracting.
4. END USER ACTIVITY
4.1 Privacy Policy. The collection, use, and retention of Customer’s information in connection with the Software is governed by ControlUp’s Privacy Policy, available at https://www.controlup.com/controlup-privacy-policy, which forms an integral part of this Agreement. Where applicable, processing of personal data is further governed by the Data Processing Addendum, as set forth elsewhere in this Agreement
4.2 End User Monitoring and Consent. Customer is aware that the Software includes features which may, in different jurisdictions, trigger legal obligations regarding privacy and data protection, including where such features are used to collect or monitor End User activity at an individual, identifiable level. Customer undertakes to use the Software in complete accordance with all applicable privacy laws and regulations in the jurisdictions where it operates, including any consent or notice requirements applicable to such monitoring.
5. EVALUATION AND PROOF OF CONCEPT
5.1 Evaluation Period. Unless otherwise specified in writing by ControlUp, each Evaluation shall be limited to thirty (30) days from the date access is first granted to Customer (“Evaluation Period”). ControlUp reserves the right to terminate an Evaluation at any time upon written notice.
5.2 As-Is Basis. The Software and Services provided during an Evaluation are provided strictly “AS IS” and “AS AVAILABLE,” with no indemnification, support, service level commitment, or warranty of any kind, express or implied.
5.3 Liability Cap. Notwithstanding anything to the contrary in this Agreement, ControlUp’s total aggregate liability arising out of or relating to any Evaluation shall not exceed ten thousand United States dollars (USD $10,000). The Limitation of Liability and Data Protection Liability Cap Sections of this Agreement do not apply to Evaluations, and this Section states ControlUp’s entire liability with respect to any Evaluation.
5.4 Data Access. Customer shall have no right to access data in the Evaluation environment after the Evaluation Period ends.
5.5 Separate Trial Agreement. This Section applies unless the parties have executed a separate Trial or Proof of Concept Agreement, in which case the terms of that agreement shall govern the Evaluation in its entirety and supersede this Section.
5.6 Conflict. In the event of any conflict between this Section and any other provision of this Agreement with respect to an Evaluation, this Section shall prevail.
6. SERVICE LEVELS AND SUPPORT SERVICES
6.1 Service Levels. ControlUp shall provide the Services in accordance with the Service Levels set out in the applicable Order and as detailed in ControlUp’s Service Level Agreement, available at https://support.controlup.com/docs/service-level-agreement-and-support-definitions (“Service Level Agreement”). Questions regarding the Service Levels or Support Services may be directed to support@controlup.com.
6.2 Support Services. ControlUp shall provide the Support Services set out in each applicable Order and as detailed in ControlUp’s Support Definitions, available at https://support.controlup.com/docs/service-level-agreement-and-support-definitions.
Scope of Support and Exclusions. ControlUp is responsible only for providing support for failures of its products to materially conform to the functional specifications set forth in the applicable product documentation. If the Customer provides ControlUp Support with all necessary components to replicate an issue, ControlUp will attempt to resolve it, provided it is able to reproduce the problem. To facilitate the collection of information and resolution of issues classified as Critical or High priority, the Customer must be available during business hours throughout the issue resolution process. ControlUp will not provide support in cases where the problem arises from the ControlUp product being combined, integrated, or operated with hardware or software not supported or authorized by ControlUp, improper or unauthorized use of the ControlUp product by the Customer in a manner inconsistent with the Agreed Use, or the inability to reproduce the issue on an unmodified version of the ControlUp product running on the applicable supported platform.
Exclusions for Third-Party Hosted Services and Sub-processors. ControlUp shall not be responsible for any service interruptions, outages, or performance issues caused by third-party hosting providers, cloud infrastructure providers, or other external services used in connection with the Software or Services (e.g., AWS, Azure, Google Cloud). Any such interruptions shall not constitute a breach of the Service Levels or give rise to liability on the part of ControlUp.
Exclusions for Suspension. The Service Levels shall not apply during any period in which Customer’s access to the Software or Services is suspended in accordance with this Agreement or is otherwise unavailable as a result of Customer’s breach.
7. DISASTER RECOVERY AND BUSINESS CONTINUITY PLAN
7.1 Disaster Recovery Plan. ControlUp shall maintain and apply business continuity and disaster recovery plans to all Services (the “Disaster Recovery Plan”), available at https://trustcenter.controlup.com/. The Disaster Recovery Plan shall: (i) be designed to continue the ControlUp business operations that are critical to the overall operation and functionality of the Services notwithstanding the occurrence of a Crisis; (ii) specify procedures and frequency of testing; and (iii) be maintained consistent with then-current generally accepted industry standards.
7.2 Contents. The Disaster Recovery Plan shall address: (a) technology infrastructure supporting the plan; (b) procedures to activate the plan, including notification and communication methods and contact lists; (c) disaster recovery strategies, processes, and procedures, including failover to an alternate site; and (d) scheduled and unscheduled plan maintenance. The Disaster Recovery Plan shall provide for redundancy or back-up of business operations designed to restore the Services within the recovery time and recovery point objectives specified therein.
7.3 Essais. ControlUp shall test the Disaster Recovery Plan at least once in any twelve (12) month period and shall review and update the plan on a regular basis in line with industry developments. Upon Customer’s written request, ControlUp shall provide an executive-level summary of the results of any such test and shall reasonably consider any recommendations made by Customer to remediate deficiencies identified by such test.
7.4 Prioritization. If a Crisis prevents ControlUp from providing the Services, ControlUp shall allocate its efforts and resources to restoring the Services in accordance with its then-current business continuity prioritization procedures.
7.5 Confidentiality. The Disaster Recovery Plan, any test results, and any related documentation constitute ControlUp Confidential Information and are provided subject to the Confidentiality Section of this Agreement.
8. INCIDENT MANAGEMENT
8.1 Incident Notification and Cooperation. Should a disaster or other event, including an Error, occur with a material adverse impact on the Services, the Facilities or the Software, each Party shall immediately notify the other Party and in any case, within 48 hours after becoming aware of such event. Each Party shall cooperate in good faith with the other Party (i) in the notification process of any incident to the other Party’s competent regulatory authority, where applicable (e.g. in case of data breaches (including personal data and critical data, where applicable), cyberattacks, etc.); (ii) in the assessment of any such incident, error, disaster and/or breach and its root causes; and (iii) in the definition and implementation of any remediation and/or action plan to address the identified deficiencies.
8.2 Customer Data Incidents. ControlUp undertakes to and shall ensure to report to Customer any incident impacting the confidentiality, integrity, availability or authenticity of any Customer Data. Such notification shall be sent to the email address specified in the Data Processing Addendum (DPA) and shall include the known details of the incident, its potential implications, and the actions taken or planned by ControlUp in response. The email must include the known details of the event, the implications and ControlUp’s actions undertaken in response to such event.
9. INFORMATION SECURITY
9.1 Information Security Program. ControlUp shall implement and maintain an information security program that complies with the requirements of SOC2 and/or ISO27001 certifications. The program shall include policies, procedures, and controls to protect customer data, ensure service integrity, and minimize disruptions, with regular audits and updates to maintain compliance with these standards. ControlUp will accurately and completely collect and maintain information regarding the storage location, media, and method of storage of all Confidential Information on an ongoing basis. Return, export, and deletion of Customer Data upon termination are governed by Section 2.3.
9.2 Outsourced Services. To the extent Services rendered by the ControlUp are considered “outsourced services” in accordance with any law or regulation on outsourcing applicable to the Customer and/or any Customer Affiliates in connection with this Agreement and the related Services, ControlUp shall comply at all times with the relevant applicable law or regulation, in particular it shall have verifiable internal controls in place to ensure compliance with security regulations and procedures and implement appropriate organizational and technical measures as contractually and specifically agreed for each Service in order to protect all Customer Data from unauthorized processing, and to ensure the accessibility, the confidentiality and safety, the availability, authenticity and the integrity of these Customer Data.
9.3 Protection. ControlUp must, at all times, take all necessary security and protective measures against, in particular, destruction, loss, access by unauthorized third parties or alteration of or to Customer Data provided or administered by the Customer or its subcontractors to which the ControlUp has access for the purposes of fulfilling its obligations under the Agreement.
9.4 Data Property. All Customer Confidential Information are and shall remain the Customer’s exclusive property and shall be treated as the Customer’s Confidential Information. Likewise, information generated by the systems, such as application logs, tables, reports, accounts, printed material of any and all types (account statements, etc.), is the Customer’s exclusive property. ControlUp shall acquire no rights over this information or data and only use the Customer’s Confidential Information to the extent necessary for the performance of the Services. Unless written approval from Customer given in advance, Customer’s Confidential Information must not be, notably used by the ControlUp and/or its Representatives other than for strict fulfilment of those obligations stipulated in the Agreement, which implies the Customer Data shall be rigorously physically and/or logically segregated from data of the ControlUp’s other users/customers.
10. ARTIFICIAL INTELLIGENCE
10.1 Access. Access to AI Features is subject to the applicable feature being included in Customer’s active Order, and may be subject to usage limits, consumption-based metrics, or fair use thresholds notified through the platform or documentation. Features identified as preview or beta are provided without support, Service Levels, indemnification, or warranty.
10.2 Use of Data. ControlUp and its Affiliates may process Customer Data, and may engage authorized third-party service providers to do so, to analyze usage, Inputs, Outputs, functionality, and feedback in order to support, maintain, and improve the Services. All application usage data used for analytics or AI purposes shall be anonymized and aggregated so that it cannot reasonably be used to identify any individual or Customer instance. ControlUp shall not use personal details contained in Inputs for such purposes. Customer represents that it holds all necessary rights in the Customer Data and authorizes such processing.
10.3 Disclaimer. AI FEATURES AND ANY OUTPUTS ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND. OUTPUTS MAY CONTAIN INACCURACIES, ERRORS, OR OMISSIONS. CUSTOMER IS SOLELY RESPONSIBLE FOR VALIDATING ANY OUTPUT BEFORE RELIANCE AND ASSUMES ALL RISK ARISING FROM SUCH RELIANCE. CONTROLUP SHALL HAVE NO LIABILITY FOR ANY DECISION MADE OR ACTION TAKEN IN RELIANCE ON ANY OUTPUT. AI Features are excluded from all Service Levels, and any downtime or degradation shall not constitute a breach or give rise to any remedy.
10.4 Acceptable Use. Customer shall not: (a) reverse engineer, extract, or replicate ControlUp’s AI models, algorithms, or training methodologies; (b) use any Output to develop or train a product or service competing with the Software or Services; (c) submit Inputs designed to manipulate, probe, or circumvent the models or their safeguards; or (d) use AI Features in violation of applicable law or with the intent to violate applicable law.
10.5 Opt-Out. Customer may elect, by written notice, to disable AI Features where such capability is made available. Opting out may degrade or disable features, analytics, and automation.
10.6 Intellectual Property. (a) ControlUp owns all right, title, and interest in the AI Features, all AI Platform Data, and all improvements to ControlUp’s models or services arising from operation of the AI Features. (b) Customer retains all right, title, and interest in its Customer Data and Inputs. The processing rights in Section 10.2 transfer no ownership to ControlUp. (c) As between the parties, Customer owns all right, title, and interest in Outputs generated in response to Customer’s Inputs, and ControlUp hereby assigns to Customer any right, title, and interest it may have in such Outputs. Customer acknowledges that Outputs are generated probabilistically, that ControlUp may generate identical or substantially similar Outputs for other customers, and that Customer’s ownership confers no exclusivity in and no right to restrict ControlUp’s generation or delivery of any such similar Output. Nothing in this Section transfers any right in the AI Features or AI Platform Data. (d) Outputs may reflect content or structures derived from third-party sources. ControlUp does not warrant that any Output is free from third-party intellectual property claims, and Customer is solely responsible for reviewing Outputs before any use beyond its internal operations. ControlUp’s indemnification obligations do not extend to Outputs. (e) Feedback regarding AI Features may be used by ControlUp without restriction, compensation, or confidentiality obligation.
10.7 Customer Inputs. Customer warrants that its Inputs do not infringe any third-party intellectual property rights and shall defend and indemnify ControlUp against any claim alleging that they do.
11. CONFIDENTIALITY, PROPRIETARY RIGHTS AND DATA PROTECTION
11.1 Restrictions. The receiving party will keep the Confidential Information of the disclosing party confidential. The receiving party may disclose the Confidential Information of the disclosing party to its Representatives who have a need to know such Confidential Information solely in connection with this Agreement. The receiving party will cause such Representatives to comply with this Agreement and will assume full responsibility for any breach of this Agreement by any such Representatives. The receiving party will not transfer or disclose any Confidential Information of the disclosing party to any third party without the disclosing party’s prior written permission and without such third party having a corresponding contractual obligation to keep such Confidential Information confidential. The receiving party will not use any Confidential Information of the disclosing party for any purpose other than in connection with this Agreement. Notwithstanding anything to the contrary, Customer may disclose ControlUp Confidential Information to third parties in connection with such third party’s provision of software or services to Customer. Such disclosures will be made under an obligation of confidentiality limiting the use of such Confidential Information by such third parties to the provision of software and/or services to Customer.
11.2 Exclusions. Confidential Information will not include information that: (i) is in the public domain at the time of disclosure; (ii) was in the possession of or demonstrably known by the receiving party prior to its receipt from the disclosing party without restriction on its use or disclosure; (iii) is independently developed by the receiving party without use of, reference to or reliance on the disclosing party’s Confidential Information; or (iv) becomes known by the receiving party from a source other than the disclosing party without breach of this Agreement and is not subject to an obligation of confidentiality.
11.3 Legal Requirements. If the receiving party is required to disclose any of the disclosing party’s Confidential Information under a subpoena, court order, statute, law, rule, regulation or other similar requirement (a “Legal Requirement”), the receiving party will, to the extent not precluded by law, provide prompt prior notice of such Legal Requirement to the disclosing party so the disclosing party may seek an appropriate protective order or other appropriate remedy or waive compliance with the provisions of this Agreement. If the disclosing party is not successful in obtaining a protective order or other appropriate remedy and the receiving party is, in the reasonable opinion of its counsel, legally compelled to disclose such Confidential Information, or if the disclosing party waives compliance with the provisions of this Agreement in writing, the receiving party may disclose, without liability hereunder, such Confidential Information in accordance with, but solely to the extent necessary, in the reasonable opinion of its counsel, to comply with the Legal Requirement. Notwithstanding anything to the contrary, Customer may disclose ControlUp Confidential Information as required to satisfy any request by any governmental or regulatory body. Recipient’s obligations of confidentiality for each item of discloser’s Confidential Information will not expire.
11.4 Data Protection Contract Requirements. ControlUp and Customer shall enter into a Data Processing Addendum (“DPA”) available at https://controlup.com/privacy/dpa.
11.5 Disposition of Confidential Information on Termination or Expiration. Upon termination or expiration of this Agreement or upon the disclosing party’s written request and where practicable, the receiving party will return to the disclosing party all copies of Confidential Information already in the receiving party’s possession or within its control. Alternatively, with the disclosing party’s prior written consent, the receiving party may destroy such Confidential Information using means to protect against unauthorized access to or use of the information, including, where appropriate, burning, shredding, or pulverizing such information, or by taking such other means as to assure that such information may not be recoverable following its disposal. In such case, an officer of the receiving party will certify in writing to the disclosing party that all such Confidential Information has been destroyed. Notwithstanding the above, the receiving party may retain copies of such Confidential Information as required by applicable law, or, to the extent such copies are electronically stored in accordance with the receiving party’s email record retention policies, so long as such Confidential Information is kept confidential as required under this Agreement.
11.6 Ownership. ControlUp shall own and retain all right, title and interest in and to (a) the Software and Services, including any and all improvements, enhancements or modifications thereto (regardless of the developing party and whether or not the same are a result of any feedback by the Customer), and (b) all intellectual property rights related to any of the foregoing. The Customer shall also refrain from reverse engineering, decompiling, disassembling or attempting in any other manner whatsoever to discover the source code of the Software.
11.7 Feedback. If Customer provides any suggestions, comments, ideas, or other feedback to ControlUp regarding the Software, Services, or any ControlUp technology or offering (“Feedback”), ControlUp shall own all right, title, and interest in and to such Feedback, and Customer hereby irrevocably assigns to ControlUp all rights in such Feedback. ControlUp may use, disclose, reproduce, license, distribute, and exploit Feedback for any purpose without restriction, compensation, or confidentiality obligation to Customer.
12. AUDIT RIGHTS
12.1 Customer Audit. ControlUp has its and its Subcontractors internal system of control of the Service delivery processes audited on an annual basis according to an internationally accepted reporting standard such as ISAE 3402 or a similar standard by an independent auditing company. Customer will receive such annual reports in due course after preparation for Customer’s review. In addition, ControlUp shall deliver to Customer any report and finding made on ControlUp and the Subcontractors, whether produced by their internal or external auditors or by other third parties appointed by ControlUp or the Subcontractors in relation to the Agreement. Customer and its Affiliates where applicable, reserve a right to audit either itself/themselves or through a third-party independent contractor selected by Customer at Customer’s expense, the ControlUp and/or its Subcontractors during standard business hours, subject to reasonable coordination and no more than once per calendar year. The Audit right includes but is not limited to an on-site audit and review of ControlUp’s architecture, systems and procedures used, and records kept, in connection with the Services and the Software, as well as an audit of the performance of the agreed Services. Customer and its Affiliates, where applicable, reserve the right to request information on this matter for monitoring purpose. During the Term and for twelve (12) months thereafter, ControlUp agrees to maintain, in accordance with generally accepted accounting principles, complete and accurate records so as to permit Customer to monitor compliance with this Agreement, and applicable laws, rules and regulations. Each audit and review shall be conducted upon Customer’s reasonable request. Upon notice of any audit findings, ControlUp shall use commercially reasonable efforts to make any necessary changes to ensure compliance with its obligations under the Agreement, and applicable laws, rules and regulations. Any audits described in this Section shall be conducted during reasonable times and upon reasonable advance notice to ControlUp and shall be of reasonable duration and shall not unreasonably interfere with ControlUp’s day-to-day operations. Further, Customer shall not conduct an audit more than once per year. In the event that Customer conducts an audit through a third party independent contractor, such independent contractor shall be required to enter into a non-disclosure agreement containing confidentiality provisions substantially similar to those set out in Section 11 to protect ControlUp Confidential Information. The ControlUp, having obtained external certifications (ISO 27001, ISO 27017, ISO 27018 and ISO 27701, is committed to provide evidence of such certifications on a yearly basis.
12.2 Regulatory Audit. In addition to the above audit rights in favor of Customer, and/or its affiliates, where applicable, ControlUp will provide to Customer’s and/or Affiliates regulators and other law enforcement agents access at all reasonable times, after providing ControlUp with at least forty-eight (48) hours advance notice (except in the event of audits or investigations by regulators or other law enforcement agents, or investigations of reasonable suspicion of misappropriation, fraud or business irregularities of a potentially criminal nature, or relating to Customer data protection requirements), to ControlUp’s records kept in connection with the Services and the Software for the purpose of performing regulatory audits to enable Customer’s regulators included Customer’S Affiliates regulators or other law enforcement personnel to confirm that ControlUp is meeting all applicable information privacy, security, regulatory and other legal requirements which ControlUp is required to comply with in connection with performance of its obligations under this Agreement. During the Term and for twelve (12) months thereafter, ControlUp agrees to maintain, in accordance with generally accepted accounting principles, complete and accurate records so as to permit Customer’s regulators included Customer’s Affiliates regulators and any other law enforcement agents to confirm that ControlUp is meeting all applicable information privacy, security, regulatory and other legal requirements which ControlUp is required to comply with in connection with performance of its obligations under this Agreement.
13. FEES AND OTHER PAYMENTS
13.1 Fees. The Fees for the Services and Software will be specified in the applicable Order. Customer shall provide ControlUp with complete and accurate billing and contact information. This information includes Customer’s legal company/organization name (if applicable), street address, telephone number, fax number (if applicable), e-mail address, and name of an authorized billing contact. In the event of a change of any of this information, Customer agrees to update the information within 30 days of any change.
13.2 Non-Cancellable Commitment. Each Order constitutes a binding, non-cancellable commitment for the full Order Term and the full Fees set out therein. Fees are non-refundable except as expressly provided in this Agreement. Customer may not terminate or reduce the scope of an Order for convenience, and no reduction in Customer’s usage of the Software or Services shall entitle Customer to any refund, credit, or reduction in Fees.
13.3 Taxes. Except to the extent that Customer has provided an exemption certificate, direct pay permit or other such appropriate documentation, ControlUp shall add to each invoice and Customer shall pay any sales, use, excise, value-added, gross receipts, services, consumption and other similar transaction taxes (“Transaction Taxes”) however designated that are properly due and payable upon the Software and Services provided under this Agreement, and required by law to be collected from Customer, excluding however taxes based upon ControlUp’s net income and any taxes or amounts in lieu thereof (e.g., Ohio Commercial Activity Tax, and Washington B&O Tax) paid or payable by ControlUp. Such Transaction Taxes shall only become due and payable by Customer upon the receipt of an invoice from ControlUp in line with local transaction tax rules and regulations.
13.4 Purchase Orders and Additional Legal Terms. If Customer issues a purchase order, such purchase order shall be for the total fees set forth in the applicable Order. ControlUp hereby rejects any additional or conflicting terms included in any purchase order or other Customer ordering documents, and acceptance of such documents is expressly conditioned on the terms and conditions of this Agreement.
13.5 Late Payment Fee. Any undisputed amounts not paid when due will accrue interest at a rate of one and one-half percent (1.5%) per month, or the maximum rate permitted by law, whichever is lower, from the due date until paid in full. Customer must notify ControlUp in writing of any good-faith dispute regarding an invoice within thirty (30) days of the invoice date, specifying the disputed amount and the basis for the dispute; all amounts not so disputed shall be deemed undisputed and must be paid when due. Customer shall reimburse ControlUp for all reasonable costs of collection, including reasonable attorneys’ fees, court costs, and collection agency fees, incurred in recovering any undisputed amount not paid when due.
13.6 Suspension. If any undisputed amount remains unpaid for more than thirty (30) days after its due date, ControlUp may, upon ten (10) days’ prior written notice, suspend Customer’s access to the Software and Services until all outstanding amounts are paid in full. Suspension shall not relieve Customer of its payment obligations, and ControlUp shall have no liability for any consequences of a suspension made in accordance with this Section. If the non-payment is not cured within thirty (30) days following suspension, ControlUp may terminate the relevant Order and this Agreement for material breach. Termination for non-payment shall not release Customer from its obligation to pay all fees accrued or committed through the end of the applicable Order term, including any remaining fees due under a multi-year commitment.
13.7 Reseller Orders. Where Customer places an Order through an authorized reseller or other third party, the Fees, payment terms, and invoicing arrangements applicable to that Order are solely between Customer and such reseller, and ControlUp shall have no responsibility for billing, collection, or refunds thereunder. If Customer fails to pay any amount due to the reseller in respect of such Order, ControlUp may suspend Customer’s access to the Software and Services in accordance with the Suspension Section above, provided that the reseller has furnished ControlUp with documentation evidencing such non-payment. Suspension under this Section shall not relieve Customer of any obligation to the reseller, and ControlUp shall have no liability to Customer arising from any such suspension. Any dispute regarding amounts payable to a reseller shall be resolved between Customer and the reseller and shall not affect Customer’s obligations under this Agreement.
14. TERM
14.1 Agreement Term. This Agreement is effective as of the Effective Date and, unless terminated earlier in accordance with this Agreement, will continue until the termination or expiration of any and all Orders (the “Term”).
15. TERMINATION
15.1 Termination for Material Breach. If either party materially breaches this Agreement or any Order, and such breach is incapable of cure, or such breach is capable of cure but the breaching party does not cure such breach within thirty (30) days after written notice of material breach, the non-breaching party may terminate the relevant Order and this Agreement upon written notice of immediate effect (“Termination for Cause”).
15.2 Effect of Expiration/Termination. In case of Termination for Cause by Customer, Customer shall be entitled to receive, as a sole remedy, a refund equal to the proportional portion of the fees already paid to ControlUp, which may also be set-off against yet unbilled and/or unpaid fees for the remainder of the Order Term.
15.3 Upon termination of this Agreement, for any cause whatsoever, the following terms shall apply: (I) any rights granted to Customer under this Agreement, shall terminate automatically; and (ii) Customer shall remove and destroy any copies of the Software installed by it, and/or by anyone on its behalf.
15.4 Transition Assistance. Upon expiration or termination other than for Customer’s material breach, and at Customer’s written request, ControlUp will provide transition assistance as Professional Services under a separate Order at ControlUp’s then-current rates. ControlUp shall have no obligation to provide assistance to, or cooperate with, any third party, or to disclose any Confidential Information, methodologies, or technology.
16. RENEWAL
16.1 Auto-Renewal. This Agreement shall remain in effect for the term specified in the applicable Order (the “Initial Term”). Thereafter, certain Orders under this Agreement may be subject to automatic renewal for successive one (1) year periods (each, a “Renewal Term” and together with the Initial Term, the “Term”), in accordance with ControlUp’s then-current auto-renewal policy (the “Auto-Renewal Policy”, available at https://www.controlup.com/auto-renewal-policy/). The Auto-Renewal Policy applies only to customers within its defined scope. If the Auto-Renewal Policy applies to Customer and Customer does not wish to renew, Customer must provide written notice of non-renewal prior to the end of the then-current Term, following the cancellation procedures described in the policy.
16.2 Non-Auto-Renewal Orders. Customers that fall outside the scope of the Auto-Renewal Policy must enter into a new Order to continue receiving services under this Agreement.
17. REPRESENTATIONS, WARRANTIES, COVENANTS AND LIMITATION OF LIABILITY
17.1 Non-Infringement. ControlUp represents, warrants and covenants that: (i) it has and will have all rights, titles, licenses, intellectual property, permissions and approvals necessary in connection with its performance under this Agreement and to grant Customer the rights granted hereunder; and (ii) none of the Services or Software nor their use as contemplated under this Agreement, do or will infringe, violate, trespass or in any manner contravene or breach any patent, copyright, trademark, license or other property or proprietary right or constitute the unauthorized use or misappropriation of any trade secret of any third party.
17.2 Software and Services. ControlUp represents, warrants and covenants that: (i) the Software and resulting Services will conform to and operate in accordance with the Documentation; (ii) it shall perform the Services in conformance with the levels of service, quality control and other performance standards described in each applicable Order and/or Exhibit to this Agreement; (iii) all Services provided in connection with this Agreement are and will be performed to the best of ControlUp’s ability and in an effective, timely, professional and workmanlike manner in accordance with the highest applicable industry standards and practices; and (iv) ControlUp Personnel performing any Services hereunder will be appropriately trained and have a level of skill commensurate with the requirements of this Agreement, and ControlUp will promptly and cooperatively work with Customer to rectify any reasonable issues that Customer has with any person who is performing Services under this Agreement, including replacement, upon Customer’s reasonable request.
17.3 Defects; Errors. ControlUp represents, warrants and covenants that Software and Facilities will properly operate without a material defect or Error.
17.4 Compliance with Laws. ControlUp represents, warrants and covenants that the Services, Software and the use contemplated under the Agreement is and for the duration of the Term, shall continue to be in compliance with all applicable national, federal, state and local laws, rules and regulations, and that ControlUp shall take no action or make any omission that would cause Customer to fail to comply with such laws, rules and regulations. ControlUp agrees to inform Customer in writing of developments affecting the representations, warranties, and covenants set forth in this Section 17.4 during the Term. Without limiting the generality of the foregoing:
(a) Anti-Bribery and Anti-Corruption. In connection with this Agreement, ControlUp represents, warrants and covenants that is and at all times has been in compliance with all applicable anti-bribery and anti-corruption laws, including, but not limited to, the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, the Organisation for Economic Co-operation and Development Convention on Combating Bribery of Foreign Public Officials in International Business Transactions. Except as previously disclosed to Customer in writing, ControlUp represents, warrants and covenants that: (i) ControlUp has not and will not make, permit or authorize, directly or indirectly, any offer, payment, promise, gift or transfer of money, anything of value, or any financial or other advantage to any person to secure any improper advantage; (ii) ControlUp has not been and is not currently subject to any governmental or regulatory review, audit, inspection or investigation related to applicable anti-bribery laws; and (iii) ControlUp is not aware of any allegations, investigations or inquiries by any governmental authority with regard to a potential violation of applicable anti-bribery law by ControlUp or its Representatives or other persons acting on its behalf. ControlUp agrees to accurately record in its books and records any and all expenses related to this Agreement. ControlUp agrees that it will not permit any of its Representatives to pay bribes in connection with ControlUp’s execution of its obligations under this Agreement. In the event ControlUp obtains credible information indicating that any of its Representatives have paid bribes in connection with ControlUp’s execution of its obligations under this Agreement, ControlUp will promptly notify Customer in writing. ControlUp agrees to provide Customer with periodic certifications of compliance with applicable anti-bribery and anti-corruption laws.
(b) Anti-Money Laundering. In connection with this Agreement, ControlUp represents, warrants and covenants that it is and at all times has been in compliance with all laws, rules and regulations relating to the prevention of money laundering and/or terrorist financing applicable to it or its property or in respect of its business or operations, including all applicable financial record-keeping, know-your-customer and reporting requirements of the United States, and equivalent laws, rules and regulations enforced by other jurisdictions, which laws include, without limitation, the Currency and Foreign Transactions Reporting Act of 1970 (commonly known as the Bank Secrecy Act), as amended from time to time, including by the USA PATRIOT Act of 2001.
(c) Sanctions. In connection with this Agreement, ControlUp represents, warrants and covenants that is and at all times has been in compliance with all applicable laws and regulations relating to economic or financial sanctions or embargos administered or enforced by a competent governmental authority, including without limitation: (i) the United Nations Security Council; (ii) the European Union; (iii) the governmental institutions and agencies of the United States, including the Office of Foreign Assets Control of the United States Department of Treasury (“OFAC”); and (iv) the governmental institutions and agencies of the United Kingdom, including Her Majesty’s Treasury (“HMT”). ControlUp represents, warrants, and covenants, that it has implemented, and will periodically review to ensure the adequacy of, compliance measures reasonably designed to achieve compliance with this paragraph, and shall promptly notify Customer upon discovery of any circumstances that may indicate a breach of these obligations.
17.5 Customer Data Representations. Customer represents and warrants that it has all rights, permissions, and authorizations necessary for ControlUp to process and use Customer Data as contemplated under this Agreement, including any inputs or data provided to the AI Features. Customer shall not use or distribute any AI Output in a manner that it knows, or reasonably should know, is likely to infringe or misappropriate any third party’s intellectual property rights.
17.6 Encryption. ControlUp will identify in the applicable Order any encryption used in the Services and Software and the Commodity Classification, Export License or License Exceptions, and Import License granted with respect thereto. ControlUp represents that it has complied with, and will continue to comply with, all applicable laws, rules and regulations of the United States or any foreign country with respect to the export or importation of the Services and Software, any modifications, enhancements or updates thereto, and any technical data derived therefrom.
17.7 Disclaimer. EXCEPT AS EXPRESSLY SET OUT IN THIS AGREEMENT, NEITHER PARTY MAKES ANY OTHER WARRANTY, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Customer acknowledges that ControlUp engages reputable providers of hosting services, for generation and hosting services of the Software (“Hosting Services”), and that notwithstanding anything to the contrary in this Agreement or any Order: (i) such services are provided pursuant to the general terms of use of such provider of Hosting Services, (ii) ControlUp cannot and does not make warranties for the Hosting Services, (iii) ControlUp is not obligated to impose the terms under this Agreement on a provider of Hosting Services, and (iv) ControlUp shall have no liability whatsoever in respect of the Hosting Services and its providers.
18. LIABILITY AND INDEMNIFICATION
18.1 Limitation of Liability. NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT OR ANY ORDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW CONTROLUP OR CUSTOMER SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL OR PUNITIVE DAMAGES, EVEN IF IT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN ADDITION, IN NO EVENT SHALL THE TOTAL LIABILITY OF CONTROLUP AND ANYONE ON ITS BEHALF FOR ALL DAMAGES, LOSSES, CLAIMS AND COSTS, WHETHER IN CONTRACT, TORT OR OTHERWISE, EXCEED THE AGGREGATE AMOUNT PAID OR PAYABLE BY CUSTOMER TO CONTROLUP DURING THE PERIOD OF 12 MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE LIABILITY. NOTWITHSTANDING THE ABOVE, NO LIMITATION OR EXCLUSION OF EITHER PARTY’S LIABILITY WILL APPLY WITH RESPECT TO ANY CLAIMS ARISING OUT OF OR RELATING TO CONFIDENTIALITY, PROPRIETARY RIGHTS AND NON-INFRINGEMENT INDEMNIFICATION OBLIGATIONS, OR EITHER PARTY’S WILLFUL MISCONDUCT OR GROSS NEGLIGENCE, OR ANY CLAIMS FOR PERSONAL INJURY OR PROPERTY DAMAGE (INCLUDING WITHOUT LIMITATION ALL COSTS ASSOCIATED WITH THE RECOVERY OR REPLACEMENT OF LOST OR DAMAGED DATA), OR CUSTOMER’S PAYMENT OBLIGATIONS UNDER THIS AGREEMENT, INCLUDING ANY FEES ACCRUED OR COMMITTED UNDER ANY ORDER. For the avoidance of doubt, any fines or penalties assessed on a party under applicable law arising out of the other party’s breach of this Agreement are direct damages.
18.2 Data Protection Liability Cap. NOTWITHSTANDING ANYTHING ELSE IN THIS AGREEMENT, CONTROLUP’S TOTAL AGGREGATE LIABILITY FOR CLAIMS ARISING OUT OF OR RELATING TO DATA PROTECTION AND PRIVACY OBLIGATIONS SHALL NOT EXCEED THE LESSER OF (A) THREE (3) TIMES THE ANNUAL FEES PAID OR PAYABLE BY CUSTOMER UNDER THIS AGREEMENT OR (B) FIVE MILLION DOLLARS (USD $5,000,000).
18.3 Indemnification by ControlUp. ControlUp shall defend or settle any third-party action, claim or proceeding brought against Customer to the extent based upon a claim that ControlUp’s proprietary Software, Services, and technology (excluding any Customer Data, Customer Inputs, third-party integrations, or AI-generated Outputs) infringe any third-party intellectual property right. ControlUp’s obligation to indemnify Customer shall be limited to the following: ControlUp agrees to pay Customer reasonable attorneys’ fees and expenses, incurred in investigation or defense of such claims, and all damages and liabilities finally awarded against Customer or paid in settlements and arising out of such third-party claims. Customer shall give ControlUp prompt notice of any such claim made against it, shall provide (at the ControlUp’s request and expense) such information and assistance in the defense of such claims as reasonably requested by ControlUp, and shall grant ControlUp sole control of the defense of any such claim, suit or proceeding, including appeals, negotiations and any settlement or compromise thereof. If the use of Software and/or the Services or part thereof becomes, or in ControlUp’s opinion may become, subject to any claim of infringement of any duly issued patent or copyright or asserted trade secret right and its use is thereby enjoined, ControlUp’s sole liability shall be, at ControlUp’s option, to either: (i) procure for Customer the right to continue using the Software and/or the Services as per the terms of this Agreement; (ii) replace or modify the applicable Software and/or Services so that they are not infringing and substantially equivalent in function to the enjoined Software and/or Services, so that it is non-infringing; or (iii) if neither of the foregoing alternatives is reasonably practical, ControlUp shall refund a portion of the License Fees paid to ControlUp for such Software and/or Services based on the Software’s then-current depreciated value and terminate this Agreement and refund any unused, prepaid fee covering the remainder of the Agreement Term after the effective date of such termination, without any further liability. Notwithstanding the foregoing, ControlUp shall have no liability for Customer’s willful acts or for any settlement or compromise incurred or made by Customer without ControlUp’s prior written consent. ControlUp shall have no obligation to defend and shall have no liability to the extent an infringement allegation is based upon: (x) use by Customer of the Software in conjunction or in combination with any device other than as authorized by ControlUp, or any use of the Software by Customer that is in violation of this Agreement, (y) use of the Software by Customer in a manner or for an application other than for which it was designed, (z) Customer’s modifications to the Software, (xx) ControlUp’s compliance with Customer’s particular design, instructions or specifications, (yy) Customer’s failure to implement any modifications, including corrections and enhancements, made available to Customer by ControlUp, if such use would have prevented the infringement, (zz) any Customer-provided content, data, or Inputs, including any claim that Customer Data or Customer Inputs infringe any third-party intellectual property right; or (zzz) any Output generated by AI Features, including any claim arising from the accuracy, completeness, or fitness of such Output. Subsections (x) through (zzz) above will be both individually and collectively known as “Other Claims”.
18.4 Customer Indemnification. Customer will defend any third-party action, claim, or proceeding brought against ControlUp and will pay any damages or court costs (excluding consequential and exemplary damages) finally awarded against ControlUp, or agreed to by Customer in settlement or compromise, to the extent such claim, suit, or proceeding is based on: (i) an infringement allegation arising from Other Claims; (ii) Customer’s use of the Software in violation of the terms and conditions herein; and (iii) Customer’s violation of any international, federal, provincial, state, or local, law, rule or regulation including any such law, rule or regulations which are privacy related. ControlUp shall give Customer prompt notice of any such claim made against it, shall provide (at Customer’s request and expense) such information and assistance in the defense of such claims as reasonably requested by Customer, and shall grant Customer sole control of the defense of any such claim, suit or proceeding, including appeals, negotiations and any settlement or compromise thereof.
18.5 Each party may be represented in any such indemnification proceeding by counsel of its own choosing at its own expense. The indemnifying party shall not agree to any settlement or compromise that admits fault or imposes liability on the part of the indemnified party without its prior written consent.
19. GENERAL
19.1 Governing Law. This Agreement shall be governed, construed, interpreted and enforced according to the laws applicable to the relevant ControlUp Entity in the Order, as follows:
(i) Order signed with ControlUp, Inc.: The Agreement shall be governed by the laws of the State of New York, without giving effect to its provisions regarding conflict of laws, and only the courts in New York County, New York shall have jurisdiction in any conflict or dispute arising out of this Agreement.
(ii) Order signed with ControlUp Technologies Ltd.: The Agreement shall be governed by the laws of Israel, without giving effect to its provisions regarding conflict of laws, and only the courts in Tel Aviv, Israel shall have jurisdiction in any conflict or dispute arising out of this Agreement.
(iii) Order signed with ControlUp GmbH: The Agreement shall be governed by the laws of Germany, without giving effect to its provisions regarding conflict of laws, and only the courts in Frankfurt, Germany shall have jurisdiction in any conflict or dispute arising out of this Agreement.
(iv) Order signed with ControlUp UK Limited: The Agreement shall be governed by the laws of England and Wales, without giving effect to its provisions regarding conflict of laws, and only the courts in London, United Kingdom shall have jurisdiction in any conflict or dispute arising out of this Agreement.
(v) Order signed with ControlUp Pty Ltd: The Agreement shall be governed by the laws of the State of New South Wales, Australia, without giving effect to its provisions regarding conflict of laws, and only the courts in Sydney, New South Wales, Australia shall have jurisdiction in any conflict or dispute arising out of this Agreement.
(vi) Order signed with ControlUp Canada Inc., a Canadian corporation, having its principal place of business at 26 Wellington St. E., Suite 300, Toronto, Ontario, Canada: The Agreement shall be governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without giving effect to its provisions regarding conflict of laws, and only the courts located in Toronto, Ontario shall have jurisdiction in any conflict or dispute arising out of this Agreement.
19.2 Assignment. Neither party will assign its rights or obligations under this Agreement without the prior written consent of the other party and any attempt to do so without such consent will be null and void. Notwithstanding the above and anything to the contrary otherwise set out in this Agreement, in the event ControlUp undergoes any change of control, such change will constitute an assignment.
19.3 Notices. Any notice required or permitted under this Agreement shall be sent by registered mail to the address set forth in the applicable Order, or by email to the designated notice email address, including, for ControlUp, legal@controlup.com. Notices shall be deemed received: seven (7) business days after delivery if sent by registered mail, or two (2) business days after transmission if sent by email.
19.4 Reseller and Third-Party Access. Customer acknowledges that any reseller or third party through which it obtains access to the Software or Services acts solely as an independent distributor and not as an agent of ControlUp, and has no authority to make representations, warranties, or commitments on behalf of ControlUp, or to alter, amend, or modify this Agreement. Any agreement between Customer and such reseller is separate from and independent of this Agreement, and no term of any such agreement shall bind ControlUp, create any obligation on ControlUp, or entitle Customer to any right against ControlUp, regardless of whether ControlUp has knowledge of such terms. Customer’s sole rights in respect of the Software and Services are those set forth in this Agreement.
19.5 No Waiver by Conduct. No waiver of any of the terms of this Agreement or any Order will be valid unless in writing and designated as such. Any inaction or delay on the part of either party in enforcing any of its rights under this Agreement will not be construed as a waiver of such right to enforce the same for such occurrence or any other occurrence.
19.6 Publicity. Neither party shall use the other party’s name, logo, or marks in any press release or public announcement without prior written consent. ControlUp may identify Customer as a customer and use Customer’s name and logo in customer lists, on its website, and in sales and marketing materials. Customer may withdraw this right upon thirty (30) days’ written notice, on a going-forward basis only. Disclosures required by law, to professional advisors or investors under confidentiality, or of previously approved materials, do not require consent.
19.7 Severability. If any of the provisions of this Agreement are for any reason held to be invalid, illegal or unenforceable by a court of competent jurisdiction, the remaining provisions of this Agreement will be unimpaired and will remain in full force and effect, and the invalid, illegal or unenforceable provision will be replaced by a valid, legal and enforceable provision that comes closest to the intent of the parties underlying the invalid, illegal or unenforceable provision.
19.8 Third Party Beneficiaries. Unless expressly stated otherwise, this Agreement is for the sole benefit of the parties hereto and their successors and permitted assigns, and nothing herein, express or implied, shall give or be construed to give any person other than the parties any legal or equitable rights hereunder, provided that ControlUp’s Affiliates and Subcontractors shall be entitled to the benefit of, and may enforce, the limitations of liability, disclaimers, and confidentiality provisions set forth in this Agreement.
19.9 Force Majeure. Neither party shall be liable for any delay or failure to perform its obligations under this Agreement (other than payment obligations) to the extent such delay or failure results from any cause beyond its reasonable control, including acts of God, natural disaster, epidemic or pandemic, war, terrorism, civil unrest, labor dispute, government action, embargo, failure of the internet or public telecommunications networks, cyberattack, or failure of third-party cloud infrastructure or utilities. The affected party shall notify the other party without undue delay and use commercially reasonable efforts to resume performance. If such event continues for more than sixty (60) days, either party may terminate the affected Order upon written notice.
19.10 Survival. The following provisions survive expiration or termination of this Agreement or any Order: Definitions; Customer Data (Section 2.3); Confidentiality, Proprietary Rights and Data Protection; Fees and Other Payments with respect to amounts accrued prior to termination; Representations, Warranties, Covenants and Limitation of Liability; Indemnification; and this Section, together with any provision that by its nature is intended to survive.
19.11 Order of Precedence. In the event of any conflict between this Agreement and any Order, Addendum, Data Processing Addendum, Customer purchase order, or vendor portal terms, this Agreement shall prevail regardless of whether such document was executed by ControlUp or incorporated by reference. An Order may vary commercial terms only (fees, volumes, term, Service scope); no other document may expand ControlUp’s obligations, warranties, indemnities, or liability unless it expressly identifies the specific Section being varied and is signed by an authorized ControlUp representative. In no event shall any document increase ControlUp’s aggregate liability beyond the limits in Sections 17.7 and 17.8.
19.12 Entire Agreement. This Agreement, including all exhibits and Orders executed hereunder, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior or contemporaneous agreements, proposals, negotiations, representations, and understandings, whether written or oral, relating to such subject matter, including, without limitation, any prior non-disclosure agreement, proof of concept agreement, evaluation agreement, end user license agreement, or similar arrangement between the parties. Notwithstanding the foregoing: (i) any non-disclosure agreement entered into by the parties shall continue to apply solely with respect to Confidential Information disclosed prior to the Effective Date, unless expressly superseded in writing, and (ii) any accrued payment obligations or liabilities arising under a prior agreement shall survive in accordance with their terms.
19.13 Modification. ControlUp may update or modify this Agreement at any time by posting a revised version at https://www.controlup.com/saas-agreement/ or by otherwise notifying Customer in writing. Modifications take effect on the date the revised Agreement is posted, unless a later effective date is specified. Customer’s continued access to or use of the Software or Services following notice of a modification constitutes acceptance of the updated Agreement. ControlUp recommends that Customer review this page periodically. No other modification to this Agreement is valid unless agreed in a writing signed by an authorized representative of ControlUp.
Last updated: August 2026
Exhibit A
Définitions
“Affiliate” means, with respect to either party, any entity that controls, is controlled by, or is under common control with such party. For purposes of the Agreement, “control” means possessing, (i) directly or indirectly, the power to direct or cause the direction of the management, policies or operations of an entity, whether through ownership of voting securities, by contract or otherwise; or (ii) the ownership of, or the power to vote, at least fifty percent (50%) of the voting stock, shares or interests of such entity. An entity that otherwise qualifies under this definition will be included within the meaning of “Affiliate” even though it qualifies after the execution of the Agreement.
“Agreement” means this Software as a Service Agreement, as posted at https://www.controlup.com/saas-agreement/ and as updated by ControlUp from time to time in accordance with the Modification Section, together with all Exhibits and Orders.
“AI Features” means the artificial intelligence and machine learning functionality made available by ControlUp as part of the Services, including the underlying models, algorithms, and methodologies.
“AI Platform Data” means aggregated and anonymized data, insights, behavioral patterns, model performance data, and operational learnings derived from the operation of the Services across ControlUp’s customer base, regardless of whether such data originates in whole or in part from Customer’s use of the Services. AI Platform Data does not constitute Customer Data or Customer Confidential Information.
“Business Day” means Monday through Friday, excluding any holidays recognized by Customer. All time period references in this Agreement to “days” other than Business Days shall be deemed to refer to calendar days.
“Confidential Information” means any and all information relating to or disclosed in the course of this Agreement, which is or should be reasonably understood to be confidential or proprietary to the Discloser, including the Parties and the business of the Parties and their respective Affiliates, Customer data, any documents exchanged between the Parties in connection with the Agreement. A Recipient’s obligation to protect Confidential Information does not apply to any Confidential Information that the Recipient can demonstrate: (i) was publicly available at the time of disclosure to it; (ii) was published or otherwise became publicly available after disclosure to the Recipient, through no fault of its own; (iii) was in the possession of the Recipient at the time of disclosure to it from a third party who had a lawful right to such information and disclosed such information to it, without a breach of duty owed to the Discloser; or (iv) was independently developed by the Recipient without reference to Confidential Information of the Discloser, as proven by dated written records. Collectively Customer Confidential Information and ControlUp Confidential Information.
“ControlUp Confidential Information” means (i) all information relating to the business, operations, technology, or affairs of ControlUp and its Affiliates to which Customer has access, whether in oral, written, graphic, electronic, or machine-readable form, in the course of or in connection with the Agreement; (ii) the Software, Services, Facilities, and Documentation, including their architecture, design, configuration, source code, data models, algorithms, artificial intelligence and machine learning models, and any underlying methodologies, know-how, or technology; (iii) ControlUp’s information security program, policies, audit reports, certifications, penetration test results, vulnerability and threat data, and business continuity and disaster recovery plans; (iv) ControlUp’s nonpublic financial information, pricing, discounts, product roadmaps, and development plans; (v) any information expressly described in an applicable Order as ControlUp Confidential Information; (vi) notes, analyses, and studies prepared by Customer or any of its Representatives during the Term or at any time thereafter incorporating any of the information described in this definition; and (vii) the terms and conditions of the Agreement. ControlUp Confidential Information is protected under this Agreement regardless of whether it is marked or otherwise identified as confidential.
“ControlUp Entity” means the specific ControlUp group company that enters into the Agreement with Customer, being one of the following:
(i) ControlUp, Inc., a Delaware corporation, having its principal place of business at 3141 Stevens Creek Blvd #41038, San Jose, CA 95117, United States;
(ii) ControlUp Technologies Ltd., an Israeli limited liability company, having its principal place of business at 2 Nim Blvd., Rishon Lezion 7546302, Israel;
(iii) ControlUp GmbH, a German company, having its principal place of business at Mazars Rechtsanwaltsgesellschaft mbH, Theodor-Stern-Kai 1, 60596 Frankfurt am Main, Germany;
(iv) ControlUp UK Limited, a company incorporated in England and Wales, having its principal place of business at 5.2 Central House, 1 Ballards Lane, London N3 1LQ, United Kingdom;
(v) ControlUp Pty Ltd, an Australian proprietary limited company, having its principal place of business at c/o YML Group, Tower 1, Westfield Shopping Plaza, NSW 2022, Australia; or
(vi) ControlUp Canada Inc., a Canadian corporation, having its principal place of business at 26 Wellington St. E., Suite 300, Toronto, Ontario, Canada.
“ControlUp Personnel” means any third party warranting, administering or otherwise involved in the offer, sale, performance, or fulfillment of the Services hereunder, including any of ControlUp’s employees, representatives, agents, contractors, or subcontractors.
“Crisis” means an extraordinary event affecting ControlUp that requires emergency response measures to be taken, including any event that may result in the Services, Software or Facilities becoming unavailable for a significant amount of time.
“Customer Confidential Information” means (i) all information related to the business of Customer and any of its Affiliates, clients and other third parties, to which ControlUp has access, whether in oral, written, graphic or machine-readable form, in the course of or in connection with the Agreement, including without limitation the Customer Data, (ii) any and all information to which ControlUp has access relating to a current or former employee, officer, or director of Customer or any of its Affiliates, (iii) notes, analyses and studies prepared by ControlUp or any of its Representatives, during the Term or at any time thereafter, incorporating any of the information described in this definition, and (iv) the terms and conditions of the Agreement.
“Customer Data” means all Customer Confidential Information, all personal data and any other information relating to the employees, contractors, clients or customers of Customer (excluding ControlUp) or relating to the businesses of Customer or its Affiliates, including third party information, operations, facilities, products, services and markets, all as to the extent provided to or obtained by ControlUp from Customer, Customer’s employees, contractors or agents pursuant to the Agreement, or derived from any of the above or Customer’s use of the Services.
“Data Processing Addendum” or “DPA” means ControlUp’s Data Processing Addendum, available at https://controlup.com/privacy/dpa, as updated from time to time.
“Documentation” means the user, operations and training manuals, marketing materials, proposals, and responses to requests for information or proposals, as well as any specifications, concerning the Services and relevant Software licensed under the Agreement.
“End Point” refers to each hardware or virtualized based station monitored by the Software under the terms of this Agreement, including, but not limited to, personal computers, laptops, terminal services, VDI, servers, screens, etc.
“Error” means any defect or error in the Facilities or in the code of any Software that prevents: (i) the Facilities or Software from operating in accordance with the relevant Documentation; (ii) access to the Customer Data stored on the ControlUp’s Facilities; or (iii) the Services from being provided in accordance with the SLA.
“Evaluation” means the period during which the Software and Services are made available to Customer free of charge for evaluation, trial, proof of concept, or similar purpose.
“Excess Use” means any instance in which Customer’s use of the Software or Services exceeds the license metrics, quantities, or capacities purchased and set forth in the applicable Order, including but not limited to the number of Named Users, Concurrent Sessions, Endpoints, or other authorized usage metrics.
“Facilities” means the application software, operating system software, firmware, networks, communication devices and lines and all other equipment, software, devices and related materials provided by or used by ControlUp in providing access to the Software, the Customer Data maintained by ControlUp for Customer and/or Hosted Services under the applicable Order.
“Fee” means the fee for the Services and Software as specified in the relevant Order.
“Hosted Services” means the Services described in Section 2.1 of the Agreement.
“Implementation Date” means the implementation date set out in an applicable Order for the respective Services and Software.
“Input” means any data, content, prompt, instruction, or material submitted by or on behalf of Customer to the Software, the Services, or the AI Features.
“Named User/s” refers to any individual on Customer’s behalf who has been authorized by Customer to use the Software.
“Order” means each duly executed ordering document under which Customer or its Affiliates purchase Software, Services, or Professional Services, including any order form, quote, schedule, statement of work, or similar document, in each case that references or incorporates this Agreement.
“Order Term” means the period during which an Order is in effect, as specified in that Order.
“Output” means any content, recommendation, script, insight, analysis, prediction, or other result generated by the AI Features in response to Customer’s Inputs. Output does not include Customer Data.
“Professional Services” means any time-bound, project-based services provided by ControlUp to Customer pursuant to an applicable Order or Statement of Work, including but not limited to implementation, configuration, integration, training, consulting, and advisory services. Professional Services do not include the Services or Support Services provided under this Agreement.
“Representatives” means each party’s officers, directors, employees, partners, resellers, vendors, attorneys, accountants, agents and independent subcontractors (and their employees) and other representatives.
“Service Levels” means the service level commitments applicable to the Services as set out in the Service Level Agreement.
“Services” means all services described in the Agreement, including the relevant Order(s), the Hosted Services, Support Services and the Facilities.
“Software” means the current version of the computer programs licensed hereunder as of the Order Effective Date and each new version available during the applicable Order Term licensed to Customer and to its Affiliates under an Order and all Documentation, error-corrections, patches and bug fixes.
“Subcontractor” means any third party engaged by ControlUp to perform, or to assist ControlUp in performing, all or any part of the Services, in accordance with Section 2.6. Sub-processors are not Subcontractors for the purposes of this Agreement.
“Sub-processor” means any third party engaged by ControlUp to process personal data on ControlUp’s behalf in connection with the provision of the Services. Sub-processors are governed exclusively by the applicable Data Processing Addendum and are not subject to the subcontracting requirements of Section 2.6.
“Support Services” means the maintenance and support services described in https://support.controlup.com/docs/service-level-agreement-and-support-definitions.
“System” means any of Customer’s, its Affiliates’ or, with respect to those third parties permitted to access and use the Facilities and Software pursuant to the Agreement, any such third party’s, software, firmware, hardware, computer systems and devices, and networks, whether owned, leased or rented by Customer, any of its Affiliates or, as applicable, any such third party, or otherwise provided for the benefit, or under the control, of any of the above.
English English 
Deutsch
Français