Enterprise Terms of Use

Last Updated: May 26, 2026

This Enterprise Services Agreement (“Agreement”) is entered into between PreVeil, Inc., a Delaware corporation with offices at 53 State Street, Boston, MA (“PreVeil”), and the entity identified as Customer in the applicable Order Form (“Customer”).

This Agreement is effective as of the effective date stated in the applicable Order Form (“Effective Date”).

This Agreement, together with the applicable Order Form, the Service Level Agreement located at https://www.preveil.com/sla (“SLA”), and any referenced exhibits including the Data Processing Addendum (https://www.preveil.com/dpa/), and Virtual Desktop Infrastructure Service Addendum constitutes the complete agreement between the parties.

1. DEFINITIONS

Authorized Users means individual employees, contractors and other users that are authorized by Customer to access and use the Services.

Customer Content means all data, files, messages, body of emails, documents, and other content processed through the Services by or on behalf of Customer.

Services means the PreVeil software platform, PreVeil Compliance Content and related services described in the applicable Order Form.

PreVeil Compliance Content means compliance templates, policies, documentation, and related materials provided by PreVeil.

Security Incident means unauthorized access to or acquisition of Customer Content stored within PreVeil systems.

Order Form means an ordering document executed by the parties describing the Services, subscription term, and applicable fees.

Term means the subscription period beginning on the Effective Date and continuing for the duration specified in the Order Form unless terminated earlier in accordance with this Agreement.

2. SERVICES

PreVeil will provide the Services to Customer during the Term in accordance with this Agreement and the applicable Order Form.

Customer is granted a limited, revocable, non-exclusive, non-transferable right to permit its Authorized Users to access and use the Services specified in the Order Form during the Term.

PreVeil may make updates or improvements to the Services from time to time provided such updates do not materially reduce core functionality during the Term.

The Service Level Agreement located at https://www.preveil.com/sla is incorporated by reference and forms part of this Agreement.

3. DATA PROCESSING

To the extent that PreVeil processes Personal Data on behalf of Customer in connection with the Services, the parties agree that the Data Processing Addendum (“DPA”), once executed, will apply and is incorporated into this Agreement by reference.

4. OWNERSHIP

4.1 Customer Ownership

As between the parties, Customer retains all right, title, and interest in and to Customer Content.

PreVeil does not acquire any ownership rights in Customer Content.

4.2 PreVeil Ownership

PreVeil retains all right, title, and interest, including all intellectual property rights, in and to:

• the Services, including
• the PreVeil platform; and
• PreVeil Compliance Content

4.3 Metadata Usage

PreVeil may collect and process metadata generated in connection with the operation of the Services, including:

• email addresses/system generated structured data
• message routing information
• system usage metrics
• performance data

Such metadata may be used for:

• operation of the Services
• security monitoring
• fraud prevention
• Services improvement
• aggregated analytics

5. CONFIDENTIALITY

Each party (“Receiving Party”) may receive Confidential Information from the other party (“Disclosing Party”).

Confidential Information means non-public information disclosed under this Agreement that is designated confidential or that reasonably should be understood to be confidential given the nature of the information.

The Receiving Party will:

• use Confidential Information solely to perform under this Agreement;
• protect it using the same measures it uses to protect its own Confidential information (but in no event less than reasonable care);
• not disclose it except to employees, contractors, or advisors who have a need to know and who are bound by confidentiality obligations.

Confidential Information does not include information that:

• becomes publicly available without breach of this Agreement;
• was known prior to disclosure;
• is independently developed without use of the Confidential Information;
• is lawfully obtained from a third party.

These confidentiality obligations survive termination for five (5) years, except trade secrets, which remain protected as long as they qualify as trade secrets.

6. SECURITY AND BREACH NOTIFICATION

PreVeil maintains reasonable administrative, physical, and technical safeguards designed to protect Customer Content.

Security Incident Notification

PreVeil will notify Customer within twenty-four (24) hours after discovering a Security Incident.

The notification will include, to the extent known at the time:

• the nature of the Security Incident
• categories of data affected
• corrective actions taken or planned

PreVeil will provide reasonable cooperation and updates as additional information becomes available.

Notification under this section does not constitute an admission of fault or liability.

Security Documentation and Compliance Reports

Upon Customer’s reasonable written request, PreVeil will make available to Customer:

its then-current SOC 2 report (or equivalent third-party security certification), and/or

its FedRAMP Body of Evidence package (if applicable),

in each case subject to reasonable confidentiality obligations and any access restrictions required by PreVeil, its auditors or applicable regulatory frameworks.

PreVeil may require Customer to enter into a non-disclosure and confidentiality agreement or access such Confidential Information through a secure portal. Customer agrees to use such materials solely for purposes of evaluating PreVeil’s compliance and security posture under this section and not for any other purpose.

7. FEES AND PAYMENT

Customer will pay the fees specified in the applicable Order Form.

Unless otherwise stated in the Order Form:

• invoices are due within thirty (30) days of the date of the invoice
• fees are exclusive of applicable taxes
• Customer is responsible for applicable taxes other than taxes on PreVeil’s net income.

In addition to any other rights available to PreVeil under this Agreement, PreVeil may suspend Services if Customer fails to pay all fees and applicable taxes within such thirty (30) day period.

User Licenses and Overage

Customer is responsible for ensuring that the number of Authorized Users accessing the Services does not exceed the number of licenses purchased under the applicable Order Form.

PreVeil may monitor Customer’s usage to determine the number of users. If Customer exceeds its licensed user count (“Excess Users”), PreVeil will notify Customer of such overage.

If Excess Users are not removed or additional licenses are not purchased within fifteen (15) days after notice, PreVeil will invoice Customer for the Excess Users at the same per-user rate set forth in the applicable Order Form (or, if not specified, PreVeil’s then-current pricing);

co-terminus with the existing subscription term specified in the Order Form; and

included in subsequent renewal periods unless reduced in accordance with a new Order Form.

Customer will not receive refunds or credits for licenses covering Excess Users that are subsequently removed after being invoiced.

8. MUTUAL REPRESENTATIONS AND AUTHORITY

Each party represents and warrants that:

• it is duly organized and validly existing under applicable law;
• it has full corporate authority to enter into this Agreement;
• this Agreement constitutes a valid and binding obligation; and
• the individual signing the Order Form has authority to bind the party.

OTHER THAN AS EXPRESSLY PROVIDED HEREIN, THE SERVICES PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS.  COMPANY AND ITS THIRD-PARTY PROVIDERS SPECIFICALLY DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, WITH RESPECT TO THE SERVICES INCLUDING, BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE OR THOSE WARRANTIES ARISING FROM A COURSE OF PERFORMANCE, A COURSE OF DEALING OR TRADE USAGE.

9. INSURANCE

PreVeil will maintain during the Term:

• Errors and Omissions / Cyber Liability Insurance with limits of not less than $5,000,000 per claim, and
• Commercial General Liability Insurance with limits of not less than $1,000,000 per occurrence and $2,000,000 aggregate.

Upon reasonable request, PreVeil will provide certificates of insurance evidencing such coverage.

10. INDEMNIFICATION

10.1 Customer Indemnification

Customer will defend, indemnify, and hold harmless PreVeil and its officers, directors, employees, and agents from and against any third-party claims arising out of:

• allegations that Customer Content infringes a third party’s intellectual property rights;
• Customer’s use of the Services in violation of applicable law or this Agreement;
• Customer’s violation of export control or sanctions laws; or
• Customer’s gross negligence or willful misconduct.

10.2 PreVeil Indemnification

PreVeil will defend and indemnify Customer against third-party claims alleging that the Services infringe a U.S. intellectual property right, subject to exclusions for modifications not provided by PreVeil or combination with third-party products.

11. LIMITATION OF LIABILITY

11.1 Exclusion of Certain Damages

Except for Excluded Claims, neither party will be liable for indirect, incidental, consequential, special, or punitive damages, including loss of profits, revenue, goodwill, data or business interruption EVEN IF THE PARTY HAS BEEN PREVIOUSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE.

11.2 General Liability Cap

Except for Enhanced Claims and Excluded Claims, each party’s aggregate liability arising out of or related to this Agreement will not exceed the fees paid or payable by Customer during the twelve (12) months preceding the event giving rise to the claim.

11.3 Enhanced Liability Cap

Liability for Enhanced Claims will not exceed two (2) times the fees paid or payable by Customer during the twelve (12) months preceding the claim.

Enhanced Claims include:

• breach of confidentiality obligations
• breach of data protection obligations
• Security Incidents involving Customer Content
• indemnification obligations

11.4 Excluded Claims (Uncapped)

The above limitations do not apply to:

• fraud or fraudulent misrepresentation
• willful misconduct
• Customer’s payment obligations.

12. TERM AND TERMINATION

This Agreement will become effective on the Effective Date and remains in effect as long as any Order Form is in effect until the Agreement is terminated (“Term”).

Either party may terminate the Agreement:

• if no Order Forms are in effect, upon thirty (30) days written notice,
• for material breach not cured within thirty (30) days following written notice of breach, or
• if the other party becomes insolvent or subject to bankruptcy proceedings.

13. DATA RETURN

Upon termination or expiration of the Services:

Customer will have sixty (60) days to retrieve Customer Content.

During this period PreVeil will provide reasonable export functionality to allow Customer to transfer its data.

After sixty (60) days PreVeil may securely delete Customer Content.

14. AMENDMENTS

This Agreement may be amended only:

• by mutual written agreement signed by both parties, or
• with respect to new Order Forms only specifying the amendments to this Agreement, in which case revised terms apply solely to those new Orders.

15. MISCELLANEOUS

This Agreement is governed by the laws of the Commonwealth of Massachusetts, without regard to Conflicts of Laws principles.

Neither party may assign this Agreement without the other party’s written consent, except in connection with a merger or sale of substantially all assets.

Neither party will be liable for failure to perform due to events beyond reasonable control.

No waiver on the part of either party to this Agreement to exercise any right, remedy, or privilege shall preclude or limit any other right or further exercise of such rights or the exercise of another right, remedy, or privilege.

If any provision of this Agreement is held unenforceable, the remaining provisions will remain in effect.