Shadow AI Vulnerability Scanning Software
End User Customer Click-Through Terms of Service

These End User Customer Terms of Service (the “Terms”) govern access to and use of the Glasswing AI Shadow AI Vulnerability Scanning Software, related hosted functionality, accounts, documentation, reports, support and assessment capabilities (collectively, the “Scanner Service”). The Scanner Service is provided by IPivot, Corp. d/b/a Glasswing AI (“Glasswing”).

By checking the acceptance box and clicking “I Accept,” creating an account, purchasing an entitlement, downloading, installing, accessing or using the Scanner Service, the organization identified during registration or purchase (“End User Customer”) agrees to these Terms. The accepting person represents that the person is authorized to bind the End User Customer. If the End User Customer does not agree or the accepting person lacks authority, the End User Customer must not access or use the Scanner Service.

Purpose of the Scanner Service

The Scanner generates controlled test traffic from an authorized corporate endpoint to determine whether selected AI applications and agents appear Accessible, Blocked, Redirected or Inconclusive through the organization’s Tested Path and existing cybersecurity controls. Where supported, Product Output may also include AI Application Risk, Threat Reputation, Finding Confidence, Control Effectiveness, Risk Explanation and Recommended Action information. In addition to assessing cybersecurity exposure, the Scanner may support sales qualification and evaluation of appropriate remediation, professional services and Glasswing products.

Following an Assessment, End User Customer may request a meeting with Glasswing or the Contractual and Authorized Partner associated with the Assessment to better understand the Product Output, discuss potential remediation and evaluate relevant Glasswing products, professional services or other next steps. The Scanner identifies potential open Shadow AI exposure; it does not establish actual AI-application or AI-agent usage, prompt submission, data transfer, file upload or download, data leakage or organization-wide exposure.

1. End User Customer Eligibility and Authority

The Scanner Service is offered solely to companies, governmental entities, educational institutions and other organizational accounts acting in a business or professional capacity. It is not offered for personal or consumer use. The End User Customer may designate one Authorized User for each purchased license or seat. That Authorized User may operate the Scanner Service only on behalf of the End User Customer and solely to assess the End User Customer’s own authorized corporate-issued endpoint, corporate networks, DNS services, cybersecurity controls, locations and environments for internal business purposes.

A reseller, distributor, independent consultant, managed-service provider or other third party that resells or operates the Scanner Service for customers or prospects must be separately authorized under a written Glasswing partner agreement, applicable entitlement and the Glasswing Authorized Partner Operator Terms of Service. Acceptance of these Terms does not create partner, resale, distribution, consulting, managed-service or third-party assessment rights.

2. Agreement Structure and Order of Precedence

These Terms control End User Customer’s license to install, access and use the Scanner Service. The applicable purchase record, quote or ordering document ("Order Form") controls pricing, quantities, subscription term, Product Edition and purchased scope. The Glasswing Data Processing Addendum ("DPA") controls Glasswing’s Processing of Customer Personal Data on the End User Customer’s behalf. The Glasswing Privacy Policy governs Glasswing’s independent Processing of website-visitor, purchaser, account-contact and similar business information. If End User Customer and Glasswing have executed a Master Software and Services Agreement ("MSSA"), the MSSA is incorporated and governs the parties’ broader commercial relationship. An MSSA applies only when executed by End User Customer and Glasswing.

In a conflict: (a) incorporated international-transfer clauses control to the extent required by law; (b) the DPA controls Processing and protection of Customer Personal Data on the End User Customer’s behalf; (c) an executed MSSA controls matters specifically addressed by that agreement; (d) the Order Form controls fees, quantities, term, Product Edition and purchased scope; and (e) these Terms control the Scanner Service license, installation, access, operation, authorized testing and use of Product Output. The Privacy Policy applies to Glasswing’s independent Processing but does not grant product or assessment rights. The Glasswing End User License Agreement applies only to separately purchased Glasswing product licenses and does not govern the Scanner Service license unless a signed agreement expressly states otherwise.

3. Definitions

“Assessment” means an authorized execution of the Scanner Service from a specified corporate endpoint and active network path.

“Authorized User” means the single, specifically identified employee of the End User Customer whom the End User Customer designates, and Glasswing authorizes, to install, access and operate the Scanner Service under a particular purchased license or seat. An Authorized User is not an affiliate employee, contractor, consultant, managed-service provider or other third party.

“Authorized Endpoint” means the single registered corporate-issued Windows, macOS or Linux endpoint owned or controlled by the End User Customer and assigned to the Authorized User under a particular purchased license or seat.

“Active Assessment” means an Assessment that has been initiated and has not completed, failed, been cancelled or otherwise terminated by the Scanner Service.

“Customer Data” means information the End User Customer or its Authorized User submits to the Scanner Service, excluding Product Output, Glasswing technology and Protected AI Assets.

“Product Edition” means the edition, configuration and entitlement identified in the Order Form, license key or End User Customer account.

“Product Output” means findings, classifications, reports, analytics, risk scores, recommendations, test responses and other output generated by or through the Scanner Service, excluding Customer Data embedded in that output.

“Protected AI Assets” means all current and future Glasswing software, source code, object code, applications, tools, services, APIs, datasets, databases, AI-application and AI-agent inventories, destination lists, domains, hostnames, Server Name Indication information, metadata, taxonomies, classifications, categorizations, AI risk scores, scoring methodologies, detection and testing methodologies, heuristics, prompt intelligence, threat intelligence, telemetry, analytics, reports, dashboards, Product Output, models, model artifacts, embeddings, vector databases, knowledge graphs, retrieval systems, algorithms, workflows, documentation, research, findings, trade secrets, know-how, improvements, modifications and derivative works, regardless of format, storage method or method of access.

“Security Incident” means any actual or reasonably suspected unauthorized access to, acquisition, use, disclosure, alteration, loss, extraction, compromise or destruction of the Scanner Service, credentials, Product Output, Customer Data, Protected AI Assets or systems used to access or store them.

“Tested Path” means the corporate endpoint, active DNS resolver and route, destination route and egress, and the endpoint, browser, VPN, Zero Trust/SSE, CASB, firewall, proxy, secure web gateway and other controls through which Scanner Service traffic actually travels.

“AI Application Risk” means Glasswing’s context-dependent assessment of characteristics associated with a tested AI application or agent, which may include data-handling capabilities, account privileges, file-upload functionality, agentic authority, jurisdiction, business model and other risk factors. It is decision-support information, not a declaration that the destination is malicious.

“Threat Reputation” means time-sensitive information derived from one or more cybersecurity, domain-reputation, antivirus, malware, phishing or threat-intelligence sources. Absence of a current finding does not establish that a destination is safe.

“Finding Confidence” means Glasswing’s assessment of the strength and completeness of the evidence supporting a result classification. It is not a statistical guarantee.

“Control Effectiveness” means the observed response of applicable security controls to the controlled test through the Tested Path. It does not establish the general effectiveness of a product or control outside the tested conditions.

“Risk Explanation” means contextual information describing why a destination or finding may matter to the End User Customer.

“Recommended Action” means decision-support guidance that may include investigate, approve, restrict, block, redirect, monitor, remediate or validate. The End User Customer remains responsible for all policy and remediation decisions.

4. Product Edition and Entitlement

The End User Customer may use only the Product Edition, scan counts, reruns, locations, retention periods, report rights and number of purchased licenses or seats stated in its Order Form, purchase record, license key or account entitlement. Each purchased license or seat permits one Authorized User, one Authorized Endpoint and no more than one Active Assessment at a time. A Simulation Demo uses synthetic or expressly approved demonstration data and does not authorize a live Assessment. Any live, limited-use or subscription entitlement is confined to the End User Customer’s own authorized corporate environment and the purchased scope.

A Remediation Validation Report may be included when stated in the applicable entitlement. It is a reporting capability and not a separate software license. Glasswing may apply account, device, tenant, geographic, scan-count, rate, destination and technical controls to enforce the purchased entitlement.

5. End User Customer Scanner License

Subject to timely payment and compliance with these Terms and the applicable Order Form, Glasswing grants the End User Customer a limited, non-exclusive, non-transferable and non-sublicensable right during the applicable term to designate one Authorized User for each purchased license or seat to install, access and operate the Scanner Service on one Authorized Endpoint solely to assess the End User Customer’s own authorized corporate environment for internal business purposes and within the purchased Product Edition limits. Only one Active Assessment may be conducted under a license or seat at a time. Glasswing may suspend or terminate this right only as permitted by these Terms or another applicable agreement.

The Scanner Service is licensed, not sold. A license or seat, Authorized User designation, Authorized Endpoint registration, installer, activation credential, license key or account access may not be shared, loaned, transferred, sublicensed or used by another person or entity. Parent companies, subsidiaries, sister companies and other affiliates require separate licenses or seats unless expressly included in the Order Form. Contractors, consultants, managed-service providers and other third parties may not operate the Scanner Service under an End User Customer license or seat.

Authorized User Reassignment. The End User Customer may request reassignment of a license or seat to another employee by providing the replacement employee’s name, business email address, title and other information reasonably requested by Glasswing. Reassignment is effective only after Glasswing approves the request and updates the entitlement. Unless Glasswing approves otherwise, a license or seat may not be reassigned more than once during any thirty-day period.

Authorized Endpoint Reassignment. The End User Customer may request reassignment to a replacement corporate-issued Windows, macOS or Linux endpoint. Reassignment is effective only after Glasswing approves and registers the replacement endpoint and deactivates the previously registered endpoint. Unless Glasswing approves otherwise, an Authorized Endpoint may not be reassigned more than once during any thirty-day period.

6. Authorization to Test

Before every Assessment, the End User Customer and Authorized User must have legally sufficient authority to assess the End User Customer’s Authorized Endpoint, corporate networks, DNS services, security tenants and environments within the approved scope. The End User Customer shall obtain all internal security, privacy, employment, works-council, third-party and contractual approvals required for the Assessment. Knowledge of a domain, DNS resolver, IP address, credential or system does not constitute authorization.

The End User Customer shall not scan or test another legal entity, a prospect, an affiliate not expressly included in the Order Form, an employee’s personal environment, a guest network, a service-provider tenant or infrastructure the End User Customer does not own, control or have legally sufficient authority to assess for its own internal business purposes. The End User Customer shall define and document the approved scope, timing, Authorized Endpoint, Tested Path and escalation contacts and shall immediately stop if authorization is withdrawn, the responsible owner requests a stop or unexpected operational impact occurs.

7. Tested Path and Credible Results

The End User Customer acknowledges that Scanner results depend upon the Tested Path. End User Customer is responsible for selecting an appropriate corporate reference endpoint and verifying the effective DNS resolver and route; destination route and egress; VPN or Zero Trust/SSE steering and authentication; endpoint-security, browser-control, CASB, firewall, proxy and secure-web-gateway health and policy status; whether the Scanner process is within enforcement scope; and available control-console evidence.

An Assessment performed on a home, guest, unmanaged or bypass path may describe accessibility from that Tested Path but must not be characterized as a defensible assessment of End User Customer’s corporate security-control coverage. End User Customer shall preserve material limitations and shall not present a point-in-time Tested Path result as organization-wide or continuous proof.

8. Exposure Testing; Not Usage Monitoring

The Scanner Service generates controlled DNS queries and TCP and TLS/SNI connection attempts and, where supported and enabled, limited HTTP requests to determine whether selected AI-application or AI-agent destinations appear Accessible, Blocked, Redirected or Inconclusive from the Authorized Endpoint through the Tested Path. An Accessible result identifies potential exposure or a potential security-control coverage gap. It does not prove that an employee or other person accessed or used an AI application, communicated with an AI application, executed an AI agent, transmitted data, submitted a prompt, authenticated, or uploaded or downloaded a file.

Unless a separately licensed capability expressly states otherwise, the Scanner Service does not monitor actual employee traffic or inspect prompts, responses, content or files. The Scanner Service is not designed for exploitation, disruption, penetration testing or vulnerability testing of an external destination.

9. Limited Dataset Sample

The Scanner Service tests only a limited sample of destinations selected from Glasswing’s proprietary dataset and does not disclose or test 100% of that dataset. The number and selection may vary by Product Edition, entitlement, assessment configuration and Glasswing methodology. An application not included in an Assessment must not be interpreted as blocked, inaccessible, approved, absent or otherwise evaluated.

10. Result Definitions Risk Enrichment and Required Interpretation

Result	Required meaning
Accessible	The destination appeared reachable from the Tested Path; potential exposure, not proof of usage.
Blocked	Corroborated evidence indicated that an applicable control denied the tested connection. A timeout, DNS failure, connection error or unavailable destination is not, by itself, Blocked.
Redirected	The Tested Path appeared to send the request to a different destination or approved alternative.
Inconclusive	Available evidence did not support a reliable Accessible, Blocked or Redirected classification.

The End User Customer shall identify the tested endpoint, Tested Path, Assessment time, relevant configuration, confidence and limitations. End User Customer shall not represent results as proof of employee usage, proof of data transfer, regulatory certification, guaranteed control effectiveness or absence of risk.

Threat Reputation is time-sensitive, source-dependent and subject to false positives, false negatives, stale indicators, unavailable sources and changing domain ownership or infrastructure. “No current threat-reputation findings” does not mean “safe.” The End User Customer must independently investigate material findings before taking disciplinary, legal, compliance or public action.

The Scanner may use passive or offline threat-intelligence enrichment instead of actively connecting to a destination reported as malware, phishing, command-and-control or other harmful infrastructure. Glasswing may omit, suppress, simulate or safely classify such testing to avoid exposing the Authorized Endpoint or generating unnecessary security incidents. A decision not to make an active connection does not reduce the validity of a properly sourced threat-intelligence finding.

AI Application Risk, Finding Confidence, Control Effectiveness, Risk Explanation and Recommended Action are decision-support fields. They are not legal advice, regulatory certification, a warranty, a complete risk assessment or a substitute for review by qualified IT, Security, Privacy, Legal, Risk or Compliance personnel.

11. Product Output and Permitted Use

Glasswing owns the Product Output format, templates, methodologies, classifications, AI Application Risk information, Threat Reputation methods and enrichment, Finding Confidence methods, Control Effectiveness methods, scoring, Risk Explanations, Recommended Actions and embedded Protected AI Assets. End User Customer owns Customer Data embedded in Product Output. Subject to payment and compliance, End User Customer receives a limited, non-exclusive right to retain final Product Output generated for End User Customer and use it for End User Customer’s internal security, governance, risk, compliance and remediation purposes.

The End User Customer may share final Product Output confidentially with its board, employees, legal counsel, auditors, insurers, regulators and professional advisers who have a legitimate need to know and are bound by appropriate confidentiality obligations. End User Customer shall preserve Glasswing attribution and material report limitations and shall not publicly publish, resell, separately license, commercially exploit, alter out of context or use Product Output to make unsupported comparative claims or reconstruct Glasswing technology or intelligence.

12. Glasswing Ownership; Reservation of Rights

Glasswing and its licensors retain all right, title and interest in and to the Scanner Service, software, documentation, Product Output, Protected AI Assets, improvements, modifications, derivative works and all associated patents, copyrights, database rights, trademarks, trade secrets, know-how and other intellectual-property or proprietary rights. Except for rights expressly granted, no right is granted by implication, estoppel, exhaustion or otherwise.

The End User Customer shall not challenge, contest or assist another person in challenging Glasswing’s ownership or the validity or enforceability of Glasswing’s rights. End User Customer shall not file, register or seek any patent, copyright, trademark, service mark, domain name, database right or other proprietary right based upon, incorporating, derived from or confusingly similar to any Scanner Service component, Product Output or Protected AI Asset.

13. Acceptable Use and Restricted Activities

The End User Customer shall not, directly or indirectly, and shall not permit or assist another person to:

• copy, reproduce, modify, translate, adapt, emulate, mirror, distribute, sell, resell, license, sublicense, rent, lease, lend, publish, disclose, transfer, commercialize, host, time-share or provide the Scanner Service or Protected AI Assets as a service except as expressly authorized;
• reverse engineer, decompile, disassemble, decode, analyze, inspect or otherwise attempt to derive source code, object-code structure, architecture, algorithms, models, methods, rules, logic, workflows, interfaces, functionality, composition or trade secrets;
• scrape, crawl, spider, mine, harvest, enumerate, download, export, extract, record or capture nonpublic destination lists, domain or SNI information, metadata, classifications, taxonomies, scores, methods or other Protected AI Assets;
• circumvent or defeat authentication, access controls, rate limits, account limits, license controls, safeguards, encryption, geographic controls, destination limits, logging, watermarking, telemetry or integrity controls;
• create or assist in creating a substitute, replica, derivative dataset, classifier, taxonomy, scoring system, detection system, knowledge base, application inventory, destination inventory or competitive intelligence product;
• benchmark, conduct competitive analysis, compare vendor coverage or performance, publish testing results, or use the Scanner Service or Product Output to evaluate, validate, improve, support, market or develop a competing or substantially similar product or service;
• remove, obscure or alter proprietary, copyright, trademark, confidentiality, attribution, limitation or watermark notices;
• share accounts or credentials, use false identities, introduce malicious code, disrupt operations, attempt unauthorized access or exceed the authorized Assessment scope; or
• misrepresent Scanner findings, remove material limitations or present Tested Path results as organization-wide proof.

14. AI, Machine-Learning and Automated-System Restrictions

The End User Customer shall not use, submit, disclose or make available the Scanner Service, Product Output, Protected AI Assets or Glasswing Confidential Information to train, fine-tune, reinforce, align, optimize, test, validate, evaluate, benchmark, distill, extract or improve any artificial-intelligence, machine-learning or automated system, whether commercial, internal, open-source or third-party.

Prohibited activities include use with large language models, generative-AI systems, retrieval-augmented generation systems, vector databases, embedding systems, knowledge graphs, autonomous agents, synthetic datasets, prompt libraries, model-extraction systems or similar technologies. End User Customer shall not upload protected material to a third-party AI service, code assistant or content-analysis service without Glasswing’s prior written authorization.

15. No Dataset Reconstruction

The End User Customer shall not combine, correlate, aggregate or compare Product Output, Assessment results, API responses, repeated queries, repeated Assessments, multiple accounts, multiple devices, multiple Product Editions or information obtained from other customers or persons to identify, infer, reconstruct, approximate or substitute for any Glasswing dataset, destination list, taxonomy, classification, scoring methodology, testing methodology or Protected AI Asset.

16. Accounts, Security and Security Incidents

The End User Customer is responsible for its Authorized User, Authorized Endpoint, credential security and all activity under each license, seat and account. Before installation or operation, the End User Customer must obtain required IT, Information Security, application-control, endpoint-security and network approvals. The End User Customer must not disable endpoint protection or assume that a security warning is a false positive. Any approved allow-list exception must be narrowly scoped to the authentic Glasswing-provided executable, verified version, file hash, publisher identity when available, installation path or other identifiers supplied by Glasswing. The End User Customer shall promptly notify Glasswing if the Authorized User leaves the organization, changes responsibilities, no longer requires access, or if credentials, activation information, the installer or the Authorized Endpoint may have been compromised. The End User Customer shall maintain safeguards appropriate to the sensitivity of the information, including least-privilege access, multi-factor authentication where available, secure credential management, encryption in transit and at rest, endpoint protection, timely security updates, retrievable logging, secure backups and secure deletion.

The End User Customer shall notify Glasswing without undue delay and in no event later than twenty-four (24) hours after becoming aware of an actual or reasonably suspected Security Incident. End User Customer shall promptly contain and investigate the incident, preserve evidence and logs, mitigate harm, prevent recurrence, provide reasonable updates and cooperate with Glasswing’s investigation, legal obligations, customer communications and remediation.

17. Customer Data, Telemetry and Privacy

The End User Customer retains ownership of Customer Data and grants Glasswing a limited right to host, Process, transmit, copy and use Customer Data as reasonably necessary to provide, secure, support and administer the Scanner Service, comply with law and enforce these Terms. Product improvement using identifiable Customer Personal Data is permitted only as stated in the DPA or another express agreement. End User Customer represents that it has all rights, notices, lawful bases, assessment authorizations and permissions required to provide Customer Data and authorize the Processing.

The Scanner Service may collect operational telemetry including Scanner version; installation, activation and update events; operating-system, endpoint, device, license and entitlement identifiers; configuration; scan timing and completion status; errors; DNS resolver and Tested Path context; permitted DNS, TCP, TLS/SNI and HTTP observations; tested destinations; result classifications; technical measurements; and activity needed to secure, administer, troubleshoot and support the Scanner Service. The base Scanner is not designed to collect prompt content, response content, uploaded or downloaded customer files, passwords, authentication tokens or unrelated network payloads. Glasswing may use Deidentified Data that does not reasonably identify End User Customer or an individual, subject to the DPA. Glasswing shall not use identifiable Customer Personal Data, Scanner results, prompts, files or communications to train or fine-tune a third-party general-purpose AI model unless expressly authorized by a written agreement or valid consent. Processing on End User Customer’s behalf is governed by the DPA; Glasswing’s independent Processing is governed by the Privacy Policy.

18. Feedback

The End User Customer may provide feedback, bug reports, test observations, enhancement requests, ideas, corrections and recommendations (“Feedback”). To the extent legally permitted, End User Customer assigns to Glasswing all right, title and interest in Feedback relating specifically to the Scanner Service or Protected AI Assets. If an assignment is ineffective, End User Customer grants Glasswing a perpetual, irrevocable, worldwide, transferable, sublicensable and royalty-free license to use, reproduce, modify, distribute, commercialize and otherwise exploit the Feedback without restriction or compensation. Feedback does not transfer ownership of Customer Data or End User Customer’s independently developed pre-existing technology.

19. Records; Audit and Cooperation

The End User Customer shall maintain records reasonably sufficient to demonstrate compliance, including the Authorized User, the Authorized Endpoint, Assessment dates, authorized scope, corporate environment, Tested Path, Product Output, Security Incidents and deletion status. The End User Customer shall retain those records for at least three years unless law or an executed agreement requires longer.

Upon reasonable notice, Glasswing may verify compliance no more than once in a twelve-month period and additionally following a suspected material violation, unauthorized Assessment, Security Incident, regulator request or credible dataset-extraction concern. Verification shall be reasonably scoped, conducted during normal business hours when practicable and designed to minimize unnecessary disruption and exposure of unrelated information. End User Customer shall promptly correct material noncompliance.

20. Third-Party Services and Security Controls

The Scanner Service may interoperate with third-party DNS providers, antivirus and endpoint-detection products, browsers, VPNs, Zero Trust/SSE services, CASBs, firewalls, proxies, secure web gateways, cloud platforms, threat-intelligence providers and other systems. Third-party services are governed by their own terms and are not controlled by Glasswing. End User Customer authorizes the Scanner Service to exchange data with third-party services End User Customer configures for an Assessment or that form part of the Tested Path.

Glasswing is not responsible for third-party availability, policy accuracy, API changes, enforcement failures, logging gaps or acts and omissions. A third party’s name or interoperability does not imply sponsorship, certification or endorsement.

21. Service Changes, Support and Availability

Glasswing may update the Scanner Service, supported destinations, methodology, datasets, classifications and features for security, accuracy, performance or compliance. Glasswing will not materially reduce purchased core functionality during a paid term without reasonable notice, except for a security, legal or third-party dependency issue. Support, service levels, maintenance and end-of-life commitments apply only if stated in an Order Form, MSSA or incorporated support policy.

22. Fees, Term, Renewal and Cancellation

Fees, quantities, currency, payment terms and the subscription or Assessment period are stated in the Order Form or purchase flow. Fees are non-cancelable and non-refundable except as expressly stated or required by law. End User Customer is responsible for applicable transaction taxes, excluding taxes on Glasswing’s net income.

A subscription renews automatically only if the Order Form or purchase flow states the renewal period, price or pricing method, notice period and cancellation procedure and End User Customer affirmatively agrees. Cancellation stops future renewal but does not retroactively refund committed fees unless expressly stated.

23. Suspension

Glasswing may immediately suspend access for unauthorized scanning, dataset extraction, competitive misuse, credential compromise, a security threat, unlawful activity, sanctions exposure, intentional misrepresentation or circumvention of licensing or technical controls. For nonpayment, administrative violations, scope misunderstandings or other correctable account problems, Glasswing will provide notice and a reasonable opportunity to cure when practicable. Glasswing will restore access within a commercially reasonable period after the condition causing suspension has been resolved.

24. Termination and Effect

Either party may terminate as permitted by an applicable Order Form or executed MSSA. Glasswing may terminate for an uncured material breach after thirty days’ written notice, immediately for an incurable breach, or immediately for unauthorized scanning, intentional security abuse, dataset extraction, reverse engineering, competitive reconstruction, fraud, willful misconduct or infringement of Glasswing’s rights.

Upon expiration or termination, End User Customer shall stop use, uninstall the Scanner Service where required, disable credentials and return or securely delete Protected AI Assets and nonpublic materials, except that End User Customer may retain final Product Output as expressly permitted by Section 11 and any legally required archival copy. Legally retained material remains protected and inaccessible for unrelated use. Upon request, End User Customer shall certify deletion. Personal-data return and deletion are governed by the DPA.

25. Confidentiality

Each party shall protect the other party’s nonpublic Confidential Information using at least reasonable care, use it only to perform or receive the Scanner Service and disclose it only to personnel and advisers with a need to know who are bound by appropriate confidentiality obligations. Product Output, nonpublic documentation, security information, destination information, Scanner methodologies, datasets and Protected AI Assets are Glasswing Confidential Information, except for Customer Data embedded in Product Output.

Standard public-information, prior-knowledge, independent-development and lawful-receipt exclusions apply when established through written records. A receiving party may disclose information when legally required after providing notice where legally permitted and disclosing only the portion required. General confidentiality obligations survive five years after disclosure or termination; trade-secret and Protected AI Asset duties continue while protected by applicable law; and Customer Data duties continue for as long as Glasswing retains the data.

26. Compliance with Law; Export and Sanctions

The End User Customer shall comply with laws applicable to network testing, computer access, privacy, employment and workplace monitoring, cybersecurity, telecommunications, intellectual property, export controls, sanctions, anti-bribery and anti-corruption. End User Customer shall not access, export, re-export, release or provide the Scanner Service to an embargoed jurisdiction, prohibited person or prohibited end use or contrary to a Glasswing geographic restriction. Scanner findings are not legal advice, an audit opinion, regulatory certification or guarantee of compliance.

27. Warranties and Disclaimers

Each party represents that it has authority to enter these Terms. End User Customer represents that it has legally sufficient authorization for every Assessment. TO THE MAXIMUM EXTENT PERMITTED BY LAW, EXCEPT FOR EXPRESS WARRANTIES IN AN EXECUTED MSSA OR ORDER FORM, THE SCANNER SERVICE AND PRODUCT OUTPUT ARE PROVIDED “AS IS” AND “AS AVAILABLE.” GLASSWING DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

GLASSWING DOES NOT WARRANT THAT THE SCANNER SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE; IDENTIFY EVERY APPLICATION, AGENT, DOMAIN, CONTROL, THREAT OR EXPOSURE; PRODUCE THE SAME RESULT FROM ANOTHER ENDPOINT OR PATH; OR ESTABLISH ACTUAL USAGE, DATA TRANSFER, COMPLIANCE, SECURITY OR ABSENCE OF RISK. AI APPLICATION RISK, THREAT REPUTATION, FINDING CONFIDENCE, CONTROL EFFECTIVENESS, RISK EXPLANATIONS AND RECOMMENDED ACTIONS MAY CHANGE AS DATA, SOURCES, INFRASTRUCTURE AND METHODS CHANGE. CUSTOMER REMAINS RESPONSIBLE FOR INDEPENDENT VALIDATION AND DECISIONS.

28. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE OR CONSEQUENTIAL DAMAGES, OR LOST PROFITS, REVENUE, BUSINESS, GOODWILL, DATA OR OPPORTUNITY, ARISING FROM THE SCANNER SERVICE, EVEN IF ADVISED OF THE POSSIBILITY.

EXCEPT FOR LIABILITY THAT CANNOT LAWFULLY BE LIMITED AND ANY DIFFERENT CAP IN AN EXECUTED MSSA, GLASSWING’S AGGREGATE LIABILITY ARISING FROM THE SCANNER SERVICE WILL NOT EXCEED THE FEES PAID OR PAYABLE FOR THE AFFECTED SCANNER SERVICE DURING THE TWELVE MONTHS PRECEDING THE EVENT. ANY CAP OR DAMAGES EXCLUSION APPLICABLE TO CUSTOMER DOES NOT LIMIT CUSTOMER’S PAYMENT OR INDEMNIFICATION OBLIGATIONS, BREACH OF CONFIDENTIALITY, MISUSE OF PROTECTED AI ASSETS, INTELLECTUAL-PROPERTY INFRINGEMENT, UNAUTHORIZED ACCESS OR TESTING, FRAUD, GROSS NEGLIGENCE, WILLFUL MISCONDUCT OR GLASSWING’S RIGHT TO EQUITABLE RELIEF.

29. End User Customer Indemnification

The End User Customer shall defend Glasswing, its affiliates, licensors and their officers, directors and personnel from a third-party claim and indemnify them for covered damages, settlements, penalties and reasonable costs to the extent arising from End User Customer’s unauthorized or out-of-scope Assessment; unlawful use; Customer Data or instructions that infringe rights or cause harm; privacy, employment or workplace-monitoring violation; material misrepresentation or unauthorized publication or alteration of Product Output; dataset extraction or competitive misuse; or End User Customer’s gross negligence, willful misconduct or fraud.

Glasswing shall provide prompt notice, reasonable cooperation at End User Customer’s expense and permit End User Customer to control the defense with qualified counsel. End User Customer may not settle in a manner that admits Glasswing fault, imposes liability or requires Glasswing action without prior written consent, not to be unreasonably withheld. If End User Customer fails to assume or diligently conduct the defense, Glasswing may defend or settle and recover reasonable covered costs.

30. Equitable Relief

The End User Customer acknowledges that unauthorized access, disclosure, copying, reconstruction, competitive use or misuse of Confidential Information or Protected AI Assets may cause immediate and irreparable harm for which monetary damages are inadequate. Glasswing may seek temporary, preliminary and permanent injunctive relief, specific performance, preservation of evidence and other equitable remedies without limiting other rights or remedies and, to the extent permitted by law, without proving actual damages or posting bond.

31. Electronic Acceptance and Records

The End User Customer agrees to transact electronically. The acceptance interface should identify these Terms, the applicable DPA and the Privacy Policy, provide conspicuous links, use an unchecked affirmative-acceptance control, permit download or printing and prevent operation until required acceptance. Glasswing may retain End User Customer’s legal name, accepting user and business email, authority representation, UTC timestamp, IP address, user agent, document versions, entitlement, immutable copies or hashes and related audit evidence. Glasswing will make an accepted copy available to End User Customer.

32. Governing Law; Venue

These Terms are governed by Delaware law, without regard to conflict-of-law principles. Subject to Glasswing’s right to seek temporary, injunctive or equitable relief in any court of competent jurisdiction, the parties consent to the exclusive jurisdiction and venue of the state courts located in Delaware and the United States District Court for the District of Delaware.

33. General Provisions

The End User Customer may not assign these Terms without Glasswing’s consent. Glasswing may assign in connection with a merger, acquisition, reorganization or sale of substantially all relevant assets. The parties are independent contractors. These Terms create no partnership, agency, fiduciary, franchise or employment relationship. Neither party is liable for delay caused by events beyond reasonable control, excluding payment obligations.

If a provision is unenforceable, it will be enforced to the maximum lawful extent and the remainder remains effective. Failure to enforce is not a waiver. These Terms, the applicable Order Form, DPA and executed MSSA constitute the entire agreement concerning the Scanner Service. The Privacy Policy applies to Glasswing’s independent Processing and related notices but does not alter the commercial or license terms. A later click-through version may amend these Terms prospectively after affirmative acceptance but does not amend an Order Form, DPA or MSSA except as that document permits or the parties separately agree in writing.

Provisions concerning accrued payments, Customer Data, Product Output, Protected AI Assets, confidentiality, acceptable use, restrictions, records, disclaimers, liability, indemnification, equitable relief, law and venue, and provisions that by nature should survive will survive expiration or termination.

34. Notices and Contact

Operational notices may be sent through the Scanner Service, End User Customer account or registered email. Legal notices to End User Customer may be sent to its account administrator or address in the Order Form or MSSA. Notices to Glasswing must be sent to IPivot, Corp. d/b/a Glasswing AI, Attn: Legal, 31241 North Star Way, Valley Center, CA 92082, with a copy to legal@ipivot.ai. End User Customer is responsible for maintaining current contact information.

Click-Through Acceptance Record

End User Customer legal name	Captured electronically
Authorized representative	Captured electronically
Title	Captured electronically
Business email	Captured electronically
Acceptance action	I ACCEPT
End User Customer Terms version	1.8 — October 25, 2026
DPA version	Applicable version presented at acceptance
Date/time and audit ID	Captured electronically
Privacy Policy version	Applicable version presented or linked at acceptance