Hadrian Nova Standalone Terms

These Hadrian Nova Standalone Terms ("Terms") apply between Hadrian and the customer named on the Order Form (together, the "Parties" and each a "Party"). By signing the Order Form, or otherwise accessing or using Nova, Customer acknowledges that Customer has read, understands, and agrees to be bound by these Terms. Where a reseller, service provider, consultant, contractor, or other permitted third party uses Nova on Customer's behalf, such party will be deemed to be Customer's agent and Customer will be deemed to have accepted these Terms as if Customer had directly accessed Nova. If Customer does not agree with these Terms, Customer is not authorised to access or use Nova for any purpose.

IT IS AGREED AS FOLLOWS:

1. Definitions

1.1 - In these Terms, capitalised words, phrases, and acronyms have the following meanings:

• "Affiliate" means any entity that controls, is controlled by, or is under common control with Hadrian Security B.V., where "control" means ownership of more than fifty percent (50%) of the voting interests.
• "Authorized User" means an individual who is authorised in accordance with these Terms by Customer to use Nova. Customer is only allowed to designate employees or contractors of Customer as an Authorized User.
• "Confidential Information" means all information disclosed by one Party to the other in connection with these Terms that is identified as confidential or that the receiving Party knows or should reasonably know is confidential.
• "Customer" means the customer named on the Order Form.
• "Customer Data" means all data and content submitted by or on behalf of Customer to Nova, including Customer Inputs and any data generated by Nova in respect of Customer's Targets.
• "Customer Inputs" means the Target URL, out-of-scope guidance, application context, test focus areas, credentials, and any other configuration data submitted by Customer to Nova.
• "Documentation" means the technical and user documentation for Nova made available by Hadrian.
• "DPA" means the Hadrian Data Processing Agreement at hadrian.io/dpa, as updated from time to time.
• "Effective Date" means the date on the first page of the Order Form.
• "Fees" means the fees set out in the Order Form.
• "Hadrian" means Hadrian Security B.V., a private limited liability company incorporated under the laws of the Netherlands, or its Affiliate that is identified as the contracting Hadrian entity in the applicable Order Form. References to "Hadrian" in these Terms and the Order Form are to the contracting Hadrian entity. Hadrian Security, Inc. (a Delaware corporation) is an Affiliate of Hadrian Security B.V. and may be the contracting Hadrian entity.
• "Hadrian Pentest Methodology" means Hadrian's proprietary methodology for conducting penetration testing, as updated from time to time.
• "Nova" means Hadrian's penetration testing service that uses software agents to conduct testing of Customer-nominated web application Targets.
• "Nova Output" means findings, validation evidence, reproduction steps, and the Pentest report produced by Nova in respect of a Pentest.
• "Order Form" means the order form executed by Customer (and by the Partner where applicable) under which Customer purchases access to Nova, which incorporates these Terms by reference.
• "Partner" means a reseller of Nova under a partner agreement with Hadrian, where applicable.
• "Pentest" means a single penetration test conducted using Nova against one Target, comprising discovery, fingerprinting, vulnerability identification, validation, and reporting.
• "Pentest Entitlement" means Customer's right to one Pentest of one Target, as set out in the Order Form.
• "Sub-processor List" means Hadrian's list of sub-processors published at hadrian.io/sub-processors, updated from time to time.
• "Subscription Period" means the period for which Customer is entitled to use Nova as set out in the Order Form.
• "Target" means one external web application identified by Customer in the Nova configuration interface, by reference to a single target URL.

2. Subject and scope

2.1 - These Terms set out the terms for the delivery of Nova by Hadrian to Customer and its Authorized Users.

2.2 - These Terms commence on the Effective Date and continue for the Subscription Period set out in the Order Form, unless terminated earlier in accordance with these Terms. Subscription Periods auto-renew for successive twelve-month periods unless either Party gives written notice of non-renewal at least thirty (30) days before the end of the then-current Subscription Period, or unless the Order Form specifies otherwise.

3. Grant, scope of use, and operational scope

3.1 Grant. Subject to payment of the applicable Fees and Customer's compliance with these Terms, Hadrian grants Customer a non-exclusive, non-transferable, non-sublicensable right during the Subscription Period to use Nova in accordance with the Documentation, in respect of the Targets identified in Customer's Nova configuration. Customer may permit its Authorized Users to access and use Nova on Customer's behalf. Customer is responsible for the acts and omissions of its Authorized Users.

3.2 Pentest entitlements. Each Pentest consumes one Pentest Entitlement. Pentest Entitlements are consumed when a Pentest is initiated and may not be refunded once consumption has occurred, save where Hadrian has expressly suspended or aborted the Pentest in circumstances unrelated to Customer's configuration or use. Pentest Entitlements are issued for the contractual year specified in the Order Form and expire at the end of that contractual year if unused. Pentest Entitlements do not roll over from one contractual year to the next, including under multi-year Order Forms.

3.3 One Target per Pentest. Each Pentest covers one Target, defined by a single target URL. Nova may incidentally visit out-of-scope URLs in the course of executing a Pentest (for example, when following redirects or third-party authentication flows), but vulnerability testing is restricted to the Target.

3.4 Out-of-scope guidance. Customer may provide free-text out-of-scope guidance through the Nova configuration interface. This guidance is treated by Nova as guidance only and Hadrian does not warrant strict compliance with it. Customer is solely responsible for the accuracy and completeness of out-of-scope guidance.

3.5 Rate limiting. Customer may configure rate limiting through the Nova configuration interface, within the default and maximum thresholds set out in the Documentation. Customer acknowledges that lower rate limits reduce the risk of impact on the Target's performance but may extend the time taken to complete a Pentest.

3.6 Operational scope. Nova's operational scope, including supported languages, concurrency, supported authentication mechanisms, and feature availability, is set out in the Documentation, which Hadrian may update from time to time.

3.7 Internal use. Customer may only use Nova for its own organisation and only insofar as required for the use intended by these Terms. Customer may not allow third parties (other than Customer's Affiliates) to make use of Nova.

4. Customer responsibilities and warranties

4.1 Authority over Targets. Customer represents and warrants that, in respect of each Target, Customer either owns the Target or has secured all rights, consents, and authorisations necessary to permit penetration testing of the Target by Hadrian and Nova, including from any hosting providers, third-party service providers, owners of any underlying systems or assets, and, where the Target is or includes a multi-tenant or shared-tenancy environment, any other tenants or co-users of that environment whose data, accounts, or activity may be reached by the Pentest, including in the course of cross-user or cross-tenant testing.

4.2 Customer co-operation. Customer must (a) co-operate with Hadrian in all matters relating to the delivery of Nova; (b) provide Hadrian, in a timely manner, with such access, information, and Customer Inputs as are reasonably required for the delivery of Nova, and ensure that they are accurate and complete; (c) use Nova in compliance with all applicable laws and regulations; (d) where contractually or statutorily required, notify any third party that might be affected by the delivery of Nova; and (e) not allow any person other than a representative of Hadrian to modify, repair, or maintain any part of Nova.

4.3 CUSTOMER WARRANTY AND INDEMNIFICATION. NOVA, INCLUDING ANY (PEN)TEST CONDUCTED USING NOVA, IS DELIVERED AT THE EXPRESS REQUEST AND WITH EXPLICIT CONSENT OF CUSTOMER. CUSTOMER REPRESENTS, COVENANTS, AND WARRANTS THAT IT IS ENTITLED TO INITIATE EACH PENTEST AGAINST EACH NOMINATED TARGET AND THAT IT HAS DULY NOTIFIED ANY THIRD PARTY THAT IS REQUIRED BY STATUTE OR AGREEMENT TO BE NOTIFIED. CUSTOMER AGREES TO DEFEND, INDEMNIFY, AND HOLD HADRIAN HARMLESS FROM AND AGAINST ANY AND ALL CLAIMS, ACTIONS, INVESTIGATIONS (INCLUDING CRIMINAL OR REGULATORY INVESTIGATIONS, AND INVESTIGATIONS IN CONNECTION WITH CHARGES OF COMPUTER INTRUSION, SYSTEM INTERFERENCE, ILLEGAL INTERCEPTION, COMPUTER SABOTAGE, OR DATA INTERFERENCE), ENQUIRIES, DEMANDS, FINES, PENALTIES, JUDGMENTS, SETTLEMENTS, DAMAGES, LOSSES, LIABILITIES, COSTS, AND EXPENSES (INCLUDING LEGAL FEES ON A FULL INDEMNITY BASIS), ARISING FROM OR RELATED TO: (A) CUSTOMER'S LACK OF AUTHORITY OVER A TARGET, INCLUDING IN RELATION TO ANY MULTI-TENANT OR SHARED-TENANCY ENVIRONMENT THAT MAY BE REACHED BY THE PENTEST; (B) ANY PENTEST INITIATED BY CUSTOMER, INCLUDING ANY SELF-SERVE PENTEST CONFIGURED AND LAUNCHED BY CUSTOMER THROUGH THE NOVA INTERFACE, AGAINST A TARGET CUSTOMER IS NOT ENTITLED TO TEST; (C) CUSTOMER INPUTS (INCLUDING OUT-OF-SCOPE GUIDANCE) BEING INACCURATE OR INCOMPLETE; (D) CUSTOMER'S USE OF NOVA OUTPUT IN A MANNER INCONSISTENT WITH THESE TERMS; OR (E) ANY BREACH BY CUSTOMER OF THESE TERMS OR APPLICABLE LAW IN CONNECTION WITH NOVA. THIS INDEMNITY IS UNCAPPED, APPLIES REGARDLESS OF THE FORM OF ACTION, AND SURVIVES TERMINATION OR EXPIRATION OF THESE TERMS.

4.4 Configuration responsibility. Customer is responsible for the accuracy of all Customer Inputs.

4.5 Credentials. Where Customer supplies credentials for authenticated testing (including username and password combinations, TOTP secrets, or other shared-secret authentication factors): (a) Customer warrants that it is entitled to share those credentials with Hadrian for the purpose of the Pentest; (b) Customer is responsible for the scope of access associated with those credentials; (c) Customer should rotate or revoke those credentials following completion of the Pentest, and in respect of TOTP secrets Customer acknowledges that the secret will permit Hadrian to generate authentication codes for the duration of the Pentest; and (d) Hadrian handles supplied credentials in accordance with the technical and organisational measures set out in the DPA and the Documentation.

4.6 Acceptable use. Customer must not use Nova: (a) against any system, network, application, or asset that Customer is not entitled to test; (b) in a manner intended to disrupt the availability or integrity of the Target beyond the testing inherent in penetration testing; or (c) in any manner that breaches these Terms or applicable law.

5. Hadrian responsibilities

5.1 Conduct of Pentests. Hadrian conducts each Pentest in accordance with the Hadrian Pentest Methodology.

5.2 Hadrian-controlled configuration. Hadrian determines the technical configuration of Nova, including methodology coverage, agent strategy, safety architecture, and report structure. These elements are not configurable by Customer.

5.3 No guarantee of comprehensiveness. Penetration testing is inherently dependent on the configuration, behaviour, and state of the Target at the time of testing. Hadrian does not warrant that Nova will identify every vulnerability, weakness, or misconfiguration affecting the Target.

6. AI and machine learning

6.1 Use of AI. Customer acknowledges that Nova uses artificial intelligence and machine learning techniques, including techniques implemented by means of third-party foundation models, to plan, conduct, and report on Pentests. Hadrian determines, and is responsible for, the technical configuration of those techniques.

6.2 Sub-processors. The third-party providers of foundation models and other AI services used in providing Nova are listed on the Sub-processor List. Hadrian gives Customer at least fifteen (15) days' prior notice of material additions to the Sub-processor List before Customer Data is processed by the new sub-processor. If Customer reasonably objects within that period, Hadrian and Customer will work in good faith to resolve the objection, including by making available alternative arrangements or, where this is not possible, allowing Customer to terminate the affected Services without penalty.

6.3 No training of third-party models. Hadrian configures its arrangements with foundation model providers so that Customer Inputs, Customer Data, prompts, target metadata, credentials, and Nova Output are not used to train, fine-tune, retrain, or improve any third-party model. Hadrian may use such data to train, fine-tune, or improve Hadrian-owned models only with Customer's prior written consent (which may be given in the Order Form).

6.4 Inference location. All foundation model inference for Nova is performed within the European Union. Customer Data does not leave the European Union for the purposes of foundation model inference.

6.5 AI-generated output. Customer acknowledges that AI-generated output may contain errors or omissions. Save for Hadrian's express obligations under these Terms, Hadrian does not warrant that Nova Output is free of error.

7. Data, privacy, and confidentiality

7.1 Personal data. Processing of personal data in connection with Nova is governed by the DPA, which is incorporated by reference into these Terms. By signing the Order Form, Customer agrees to the DPA. Where Customer requires a counter-signed DPA, Hadrian will provide one on request.

7.2 Data residency. All Customer Data is stored and processed within the European Union. Foundation model inference for Nova is performed within the European Union as set out in clause 6.4.

7.3 Customer data deletion. Following delivery of a Pentest report, Customer may request deletion of the Pentest data (including Nova Output associated with that Pentest) by written notice to Hadrian. Hadrian will delete that data within thirty (30) days of receipt of the request, save to the extent retention is required by law or for the establishment, exercise, or defence of legal claims.

7.4 Confidentiality. Each Party will hold the other Party's Confidential Information in confidence and will use it only for the purposes of these Terms. Each Party will protect the other Party's Confidential Information using at least the same degree of care it uses to protect its own Confidential Information of similar sensitivity, and in any case no less than reasonable care. The obligations in this clause survive termination for three (3) years, save that for trade secrets, the obligations continue for so long as the relevant information remains a trade secret. Nova Output, the Hadrian Pentest Methodology, and the technical configuration of Nova are Confidential Information of Hadrian. Customer Inputs and Customer Data are Confidential Information of Customer.

8. Intellectual property

8.1 Hadrian IP. All intellectual property rights in Nova, the Hadrian Pentest Methodology, the technical configuration of Nova, the Pentest report template, and any other materials provided by Hadrian, including without limitation any software, websites, data files, databases, training, testing, examination materials, analyses, designs, documentation, and reports, are and remain held exclusively by Hadrian, its licensors, or its suppliers. Customer is granted only the rights of use expressly set out in these Terms. Customer acknowledges that nothing in these Terms transfers any intellectual property right of Hadrian to Customer.

8.2 Customer Data. Customer retains all right, title, and interest in Customer Data and Customer Inputs. Hadrian uses them only to provide Nova to Customer in accordance with these Terms.

8.3 Nova Output. Customer owns the findings, validation evidence, and reproduction steps in respect of Customer's Targets. Customer may use Nova Output as set out in clause 9. Hadrian retains rights in the Hadrian Pentest Methodology, the report template, and any aggregated, anonymised, non-Customer-identifying analytics derived from Hadrian's operation of Nova.

8.4 Customer name and logo. Customer grants Hadrian a non-exclusive, non-transferable, worldwide right to refer to Customer by name and logo as a customer of Hadrian, including on Hadrian's website, in marketing materials, and in customer reference lists. Customer may withdraw this right by written notice to Hadrian, in which case Hadrian will cease using the Customer name and logo within thirty (30) days, save in respect of historical materials already published.

8.5 Feedback. Customer grants Hadrian a perpetual, irrevocable, royalty-free licence to use any feedback Customer provides about Nova for any purpose, including improving Hadrian products and services, provided that Hadrian does not identify Customer as the source.

9. Use of Nova Output

9.1 Public disclosure. Customer must not publish Nova Output (in whole or in part) in publicly accessible form without Hadrian's prior written consent, save to the extent disclosure is required by law or by a competent regulator.

10. Performance, warranties, and disclaimers

10.1 Compliance frameworks. Hadrian's marketing references to compliance frameworks (including SOC 2, ISO 27001, NIS2, and DORA) are descriptive of the controls Nova helps Customer evidence in respect of penetration testing controls and are not a representation that Nova itself is certified under any such framework.

10.2 WARRANTY DISCLAIMER. HADRIAN DOES NOT WARRANT THAT NOVA WILL BE UNINTERRUPTED OR ERROR FREE; NOR DOES IT MAKE ANY WARRANTY AS TO COMPLETENESS, ACCURACY, AVAILABILITY, OR TIMELINESS OF (THE RESULTS OF) NOVA. EXCEPT AS EXPRESSLY SET FORTH IN THESE TERMS, NOVA IS PROVIDED "AS IS" AND HADRIAN DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY LAW.

10.3 Service availability. Hadrian uses commercially reasonable efforts to maintain Nova's availability. No service-level credits are payable for failure to meet any specific availability target.

10.4 Maintenance. Hadrian may carry out scheduled maintenance with reasonable prior notice and will use reasonable endeavours to minimise disruption.

11. Pentest abort and re-test

11.1 Aborted Pentests. If Hadrian aborts a Pentest in circumstances unrelated to Customer's configuration or use, no Pentest Entitlement is consumed and Customer's entitlement balance is restored.

11.2 Re-tests. Re-tests are provided in accordance with the Documentation.

12. Fees, invoicing, and suspension for non-payment

12.1 Fees. Customer pays the Fees set out in the Order Form. Except as expressly provided in these Terms, all payment obligations are non-cancellable and all Fees paid are non-refundable.

12.2 Invoicing. Hadrian invoices Customer in accordance with the Order Form. Unless stated otherwise in the Order Form, Customer pays each invoice within thirty (30) days of the invoice date.

12.3 Late payment. Amounts not paid by the due date accrue default interest at one percent (1%) per month on the outstanding sum, without a demand for payment or notice of default being required.

12.4 Annual price adjustment. Hadrian may increase the Fees annually on or after each anniversary of the Effective Date in line with the percentage increase in the Harmonised Index of Consumer Prices (HICP) as published by Eurostat.

12.5 Currency. All prices stated by Hadrian are in the currency stated in the Order Form. Customer makes all payments in that currency.

12.6 Taxes. All Fees are exclusive of taxes, levies, duties, or similar governmental assessments of any nature, including value-added, sales, use, or withholding taxes. Customer is responsible for paying all such taxes, excluding taxes based on Hadrian's net income or property.

12.7 Suspension for non-payment. Hadrian may suspend Customer's access to Nova for non-payment after thirty (30) days' written notice and an opportunity to cure.

13. Term, renewal, and termination

13.1 Term. These Terms commence on the Effective Date and continue for the Subscription Period set out in the Order Form, unless terminated earlier in accordance with these Terms.

13.2 Termination for cause. Either Party may terminate these Terms for material breach by the other Party that remains uncured thirty (30) days after written notice. Customer's payment obligations apply in all cases as material obligations under these Terms.

13.3 Termination for insolvency. Either Party may terminate these Terms with immediate effect, in whole or in part, on written notice if the other Party is granted a suspension of payments (whether or not provisional), a petition for bankruptcy is filed against the other Party, or the other Party is liquidated or dissolved (other than for restructuring or merger).

13.4 Termination for change of control. Hadrian may also terminate these Terms with immediate effect, in whole or in part, on written notice if a direct or indirect change occurs in the decisive control of Customer's organisation. Hadrian is not obliged to repay any amount already received as a result of termination under this clause.

13.6 Effect of termination. On termination of these Terms, unused Pentest Entitlements expire and Customer's access to Nova ceases. Customer has seven (7) days following termination to download all information from Nova that it needs and store this in a secure location of its own. Customer must pay all of Hadrian's outstanding unpaid invoices and, in respect of services supplied but not yet invoiced, Hadrian may submit an invoice that is payable immediately on receipt. Customer must cease all use of Nova and return or destroy all copies of Hadrian's Confidential Information.

14. Hadrian AI Indemnity

14.1 AI Indemnity. Hadrian will defend Customer against any third-party claim alleging that Nova Output, as delivered by Hadrian to Customer and used by Customer in accordance with these Terms, infringes the third party's intellectual property rights, and will indemnify Customer for damages finally awarded against Customer or agreed by Hadrian in settlement of such a claim, subject to: (a) Customer giving Hadrian prompt written notice of the claim; (b) Customer giving Hadrian sole control of the defence and any settlement; (c) Customer providing reasonable assistance at Hadrian's expense; and (d) Customer not making any admission or settlement without Hadrian's prior written consent.

14.2 AI Indemnity exclusions and sub-cap. The indemnity in clause 14.1 does not apply to any claim: (a) arising from Customer's modification of Nova Output; (b) arising from the combination, integration, or use of Nova Output with materials, services, or systems not provided by Hadrian, where the claim would not have arisen but for that combination; (c) arising from Customer's use of Nova Output outside the scope of these Terms; (d) relating to or arising from the data or content used to train any third-party foundation model used in providing Nova; or (e) where Hadrian has notified Customer to cease using affected Nova Output and Customer has not done so. Hadrian's aggregate liability under clause 14.1 is sub-capped at the greater of EUR 100,000 (one hundred thousand euros) and the Fees paid or payable by Customer to Hadrian in the twelve (12) months immediately preceding the event giving rise to the claim. Clause 14.1 sets out Customer's sole and exclusive remedy in respect of any claim of the kind described.

15. Liability

15.1 HADRIAN'S TOTAL LIABILITY FOR AN ATTRIBUTABLE FAILURE IN THE PERFORMANCE OF THESE TERMS OR ARISING FROM ANY OTHER LEGAL BASIS WHATSOEVER, EXPRESSLY INCLUDING FAILURES TO MEET A WARRANTY OR INDEMNIFICATION OBLIGATION AGREED BETWEEN THE PARTIES, IS LIMITED TO THE COMPENSATION OF DAMAGES AS DESCRIBED IN MORE DETAIL IN THIS CLAUSE.

15.2 HADRIAN'S MAXIMUM AGGREGATE LIABILITY FOR DIRECT DAMAGES IS LIMITED TO THE GREATER OF (A) EUR 250,000 (TWO HUNDRED FIFTY THOUSAND EUROS) AND (B) THE FEES PAID OR PAYABLE BY CUSTOMER TO HADRIAN UNDER THESE TERMS DURING THE TWELVE (12) MONTHS' PERIOD PRECEDING THE INCIDENT THAT GAVE RISE TO THE CLAIM.

15.3 LIABILITY FOR INDIRECT DAMAGE, CONSEQUENTIAL LOSS, LOSS OF PROFITS, LOST SAVINGS, REDUCED GOODWILL, LOSS DUE TO BUSINESS INTERRUPTION, LOSS AS A RESULT OF CLAIMS OF CUSTOMER'S CUSTOMER, LOSS ARISING FROM THE USE OF GOODS, MATERIALS OR SOFTWARE OF THIRD PARTIES PRESCRIBED BY CUSTOMER TO HADRIAN, AND ANY DAMAGE OR LOSS ARISING FROM CONTRACTING SUPPLIERS CUSTOMER HAS RECOMMENDED TO HADRIAN, IS EXCLUDED. LIABILITY FOR CORRUPTION, DESTRUCTION, OR LOSS OF DATA OR DOCUMENTS IS ALSO EXCLUDED.

15.4 THE EXCLUSIONS AND LIMITATIONS IN CLAUSES 15.2 AND 15.3 CEASE TO APPLY IF AND INSOFAR AS THE DAMAGE IS CAUSED BY INTENT OR DELIBERATE RECKLESSNESS ON THE PART OF HADRIAN'S MANAGEMENT.

15.5 UNLESS PERFORMANCE BY HADRIAN IS PERMANENTLY IMPOSSIBLE, HADRIAN IS LIABLE FOR AN ATTRIBUTABLE FAILURE IN THE PERFORMANCE OF THESE TERMS ONLY IF CUSTOMER PROMPTLY SERVES HADRIAN WITH A WRITTEN NOTICE OF DEFAULT, GRANTING HADRIAN A REASONABLE PERIOD (BEING NOT LESS THAN THIRTY (30) DAYS) TO REMEDY THE BREACH, AND HADRIAN STILL ATTRIBUTABLY FAILS TO FULFIL ITS OBLIGATIONS AFTER THIS TERM HAS PASSED. THE NOTICE OF DEFAULT MUST DESCRIBE THE BREACH AS COMPREHENSIVELY AND IN AS MUCH DETAIL AS POSSIBLE.

15.6 Customer-controlled risk. Hadrian is not liable for: (a) impact on the Target or any related system arising from rate limiting Customer has configured; (b) impact on third-party systems arising from Customer's nomination of a Target Customer was not entitled to test; (c) Customer's use of, or reliance on, Nova Output in breach of clauses 4.6 or 9.1; or (d) consequences of Customer providing inaccurate Customer Inputs.

15.7 For the avoidance of doubt, Customer's indemnity obligations under clause 4.3, and Customer's payment obligations, are not subject to the limitations in this clause 15.

16. Force majeure

16.1 Neither Party is obliged to fulfil any obligation, including any statutory or agreed warranty obligation, if it is prevented from doing so by circumstances beyond its reasonable control ("force majeure"), including (i) defects in items, equipment, software, or materials of third parties the use of which was prescribed to Hadrian by Customer; (ii) government measures; (iii) power failures; (iv) internet, data network, or telecommunication facilities failures (including failures of hyperscaler cloud providers); (v) cyber-crime, cyber-vandalism, war, terrorism, and natural calamities. Either Party may terminate these Terms in writing if a force majeure situation persists for more than sixty (60) days. In such event, all that has been performed under these Terms is paid for on a proportional basis, with nothing further due by either Party.

17. Governing law and dispute resolution

17.1 Governing law. If the contracting Hadrian entity is Hadrian Security B.V., these Terms are governed by the laws of the Netherlands and the courts of Amsterdam, the Netherlands, have exclusive jurisdiction. If the contracting Hadrian entity is Hadrian Security, Inc., these Terms are governed by the laws of the State of Delaware, USA (excluding its conflicts-of-laws principles), and the state and federal courts located in Wilmington, Delaware, have exclusive jurisdiction. The Parties may agree a different governing law in the Order Form, limited to either the laws of England and Wales (with the courts of London) or the laws of the State of New York (with the courts of New York, USA). The United Nations Convention on Agreements for the International Sale of Goods (CISG) does not apply.

17.2 Amicable resolution. Any disputes that may arise are first resolved by amicable resolution between the Parties. If not resolved within one (1) month, the Parties escalate the dispute to senior management. If senior management cannot resolve the dispute within one (1) month, the Parties may start regular court proceedings in the applicable jurisdiction.

18. Notices

18.1 Notices to Hadrian must be sent to legal@hadrian.io with a copy to the address on the Order Form. Notices to Customer may be sent to the email address Customer registered with Hadrian or set out in the Order Form. Notices are deemed received on transmission if no bounce-back is received.

19. Assignment and transfer

19.1 Customer may not assign or transfer these Terms or any of its rights or obligations under these Terms without Hadrian's prior written consent (not to be unreasonably withheld), save that Customer may assign to an Affiliate or to a successor in connection with a merger, acquisition, or sale of all or substantially all of its assets, on written notice to Hadrian.

19.2 Hadrian may assign or transfer these Terms or any of its rights or obligations under these Terms to an Affiliate or to a successor in connection with a merger, acquisition, or sale of all or substantially all of its assets, on written notice to Customer. Hadrian may also assign or transfer any claim it has to payment of any sums due to a third party.

20. General

20.1 Entire agreement. These Terms (together with the Order Form, the DPA, and the Sub-processor List) constitute the entire agreement between the Parties in respect of Nova and supersede all prior agreements and understandings.

20.2 Variation. Any amendment to these Terms is valid only if agreed in writing and signed by Hadrian's and Customer's authorised representatives.

20.3 Severability. If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions remain in full force and effect.

20.4 Survival. Provisions that by their nature are intended to survive termination, including those regarding payment, warranties, indemnities (including Customer's indemnity in clause 4.3 and Hadrian's AI Indemnity in clause 14), limitations of liability, intellectual property, and confidentiality, will survive the expiration or termination of these Terms.

20.5 No third-party rights. Save as expressly stated, no person other than the Parties has any right under these Terms.

20.6 No exclusion of customer terms. The applicability of any of Customer's purchase or other terms and conditions is expressly excluded.

20.7 Order of precedence. In the event of a conflict between the Order Form and these Terms, the Order Form prevails.