Terms & Conditions

General

Last Updated on April 29, 2022

Introduction

PLEASE NOTE: These Terms of Use (together with the Policies, as further defined, named in Section 1, the “Agreement”) form a binding contract between Us and You; by using the Services, You are agreeing to enter into a legal contract with Us, and to comply with the terms and conditions described here, which govern any use of the Services.

If You do not agree to the terms presented in this Agreement, or if You do not meet the eligibility requirements described in Section 1 of this Agreement, You have no right to use the Services, and should terminate Your access, including use of the Cobalt website, immediately.

Please be aware that Cobalt reserves the right, at its sole discretion, to change this Agreement (and the Services, including any fees), at any time and without giving advance notice. If We change this Agreement, the Privacy Policy, the Terms for Running a Security Program and/or the Terms for Engaging in a test, We will post the change on the Site or Services or provide You with notice of the change. We will also update the "Last Updated Date" at the top of this Agreement. By continuing to access or use the Site or Services after We have posted such a change, or have provided You with notice of it, You are agreeing to be bound by the Agreement as updated. If the Agreement as updated is not acceptable to You, You should stop using the Services, as the new terms will govern regardless.

Please also be aware that disputes arising hereunder will be resolved by binding arbitration, and BY ACCEPTING THIS AGREEMENT, YOU AND COBALT ARE EACH WAIVING THE RIGHT TO A TRIAL BY JURY OR TO PARTICIPATE IN A CLASS ACTION. YOU AGREE TO GIVE UP YOUR RIGHT TO GO TO COURT to assert or defend Your rights under this contract (except for matters that may be taken to small claims court). Your rights will be determined by a NEUTRAL ARBITRATOR and NOT a judge or jury and Your claims cannot be brought as a class action. Please review the Arbitration Agreement in Section 9 below for the details regarding Your agreement to arbitrate any disputes with Cobalt.

1. Parties and Scope of Agreement

Parties, Authority, and Eligibility

“You” or “Your” or “Customer” refers to you as an end user of the Services, and, if you are accessing the Services on behalf of a legal organization, that legal organization; You agree that You have the authority to enter into this Agreement and to bind that legal organization to the terms of this Agreement. You further agree that You are 18 years of age or older (if You want to use the Services but You are under 18 years of age, please contact info@cobalt.io).

“Us”, “We”, “Our” or “Cobalt” means Cobalt Labs, Inc., a Delaware Corporation.

Scope of this Agreement, Other Agreements, and Definitions.

This Agreement makes reference to a number of other agreements which You may also be agreeing to by agreeing to this Agreement, and which You can find here (the “Policies”):

• Privacy Policy
• Terms for Running a Security Program
• Terms for Engaging in a Test

In the event that the terms of this Agreement conflict with the terms of any other agreement named here, the terms of this Agreement will govern (except with respect to a mutually executed Sales Order, in which case the terms of that Sales Order will govern in the event of conflict).

Finally, please note that, where not defined throughout this Agreement, capitalized terms having the meaning ascribed to the Definitions Section.

2. Feedback, Credits, Tiers, Reports, and Security Pentesters

Feedback
We welcome and encourage You to provide feedback, comments and suggestions for improvements to the Services ("Feedback"). You may submit Feedback by emailing Us at info@cobalt.io or through the about section of the Site. By submitting Feedback, you irrevocably transfer all ownership in such Feedback to Cobalt, and waive any and all rights, including intellectual property rights to the extent such attach to the Feedback under applicable law, in favor of Cobalt. 

Credits

Upon purchase, your Cobalt Account will be updated to reflect the amount of Credits purchased.  Cobalt will scope Services based on projected level of effort as expressed in Credits. The level of Services associated with each Credit will vary depending on the applicable Tier to which a Customer has subscribed. The price and other applicable details associated with a purchased Credit will be set forth on your Cobalt Sales Order. Please note that the Services for which Credits may be used excludes certain professional services offerings (such as, without limitation, red team services, IOT/device testing, etc.), unless otherwise expressly agreed to by Cobalt (and subject to such additional terms and conditions as Cobalt may require relative to performing professional services). Credits may only be consumed within the service period on an applicable Sales Order, of up to one calendar year, and may not be extended beyond said service period(i.e. “rolled over”) unless otherwise mutually agreed in writing, or unless the Tier of Services you have purchased provides for some degree of Credit roll over.

Tiers

Access to Cobalt’s Services is provisioned across tiers that define the features and functionality associated with your Cobalt Account (“Tiers”). The Tiers offered by Cobalt are Standard, Premium, and Enterprise. The features and functionality associated with each Tier is more fully set out here. The Tier associated with your Cobalt Account will be selected by you at the time you engage Cobalt to provide Services, and will be reflected on the applicable Sales Order. A Customer may only be affiliated with one Tier at a time during their subscription. Tiers may be upgraded, but not downgraded, prior to the end of your subscription period. Cobalt reserves the right, at its sole discretion, to modify, enhance, or remove features of the Tiers, at any time upon prior notice (electronically via the Site), provided that such modifications do not materially diminish the functionality of the Tier associated with Customer’s Cobalt Account.

Vulnerability Report

Cobalt will produce a Vulnerability Report detailing findings uncovered during performance of the Services. The contents and format of the Vulnerability Report will be determined by Cobalt at its discretion, and Vulnerability Reports are not customizable, except where the Tier you purchased includes customizable Vulnerability Reports. By using Cobalt’s Services, you are acknowledging that Cobalt acts as a third-party assessor and possesses a degree of independence in formulating its findings (as articulated via a Vulnerability Report) and as such, Cobalt will not remove or minimize findings in a Vulnerability Report at a Customer’s request without a sufficient factual basis for so doing. Customer may remove Cobalt’s logo and any other marks from a Vulnerability Report and use the Vulnerability Report for Customer’s own, non-commercial, business purposes.

Security Pentesters

Customer understands and agrees that the Security Pentesters are independent third parties who are retained by Cobalt to assist in providing Services. .  The Security Pentesters’ use of the Site and their performance of any testing at Customer’s request is governed by the General Terms found at https://www.cobalt.io/terms, including the “Supplemental Terms for Engaging in a Test.” These terms must be accepted and agreed to by a Security Pentester prior to engaging in any testing activities on an Application/Network or providing a Vulnerability Report.

Pentest Regions

Security Pentesters are globally distributed. Cobalt cannot guarantee that a particular Service will leverage only Security Pentesters from a specific country, region, or other geographic specification, except where the Tier that you purchased provides you with choice in Security Pentester region selection. Please be aware that, if you have Security Pentester region selection available per your Cobalt Tier features, Cobalt may require additional time to initiate a test beyond the period articulated in “Security Program Time Period.”

Customer acknowledges that Security Pentesters are not contingent workers engaged directly by the Customer. Security Pentesters provide Services through Cobalt and as such, do not and shall not enter into contracts directly with Customer. Cobalt will not facilitate the exchange of, or execution of, any agreements directly between a Security Pentester and Customer, including without limitation, any non-disclosure agreement or similar document. 

Professional Services

The Services provided via the Site exclude Professional Services provided pursuant to an SOW. Cobalt Professional Services are not delivered via the Site or via work performed by Security Pentesters. Any provision of Professional Services will be scoped on a per engagement basis via SOW and shall be subject to additional terms set forth in the Cobalt Professional Services Addendum

Pentesting Types

Cobalt offers its Services through two distinct penetration testing types: (1) Comprehensive testing, constituting a traditional pentest (subject to the conditions and restrictions established herein and in related documentation ), and (2) Agile testing, which consists of a more limited pentest. Agile testing is designed for (a) feature changes or new features added to an asset that has previously been tested by Cobalt, or (b) where the asset sought to be tested has not previously been tested by Cobalt, a narrowly targeted test of an asset of limited size where specific context or knowledge of environment is not required to undertake the test. Cobalt has the discretion to determine whether a particular asset or test scope is appropriate for Agile testing or Comprehensive testing. Agile test Vulnerability Reports are automated and not subject to customization opportunities, even at Premium or Enterprise Tiers. Cobalt requires a three-credit minimum to obtain an Agile test and a five-credit minimum to obtain a Comprehensive test.

Customer Pentester Requests

At the Enterprise Tier, Cobalt will accommodate special requests regarding the pentesters performing Services for the Customer. This includes requests that Cobalt (a) staff a test with pentesters from a specific region or time zone, or (b) ensure that pentesters communicate with customer and/or perform testing at specified times. Other requests may be facilitated on a case-by-case basis. All custom requests are subject to Cobalt availability. Cobalt may not be able to accommodate more than one such request per test. Customers should check with their Cobalt-assigned CSM to determine whether a particular request may be accommodated.

3. Sales Orders, Invoicing and Payment.  

Sales Orders
If Customer wishes to order the Services, the parties shall enter into one or more Sales Orders, each of which shall be deemed to be incorporated herein by reference.  Each Sales Order shall specify, as applicable, the particular Services ordered (including a description thereof), the quantity of Service(s) ordered, the fees for the Service(s) and the term of the Sales Order (“Order Term”).  A Customer Affiliate may enter into a Sales Order pursuant to this Agreement and, in such case, by entering into the Sales Order, the Affiliate agrees to be bound by the terms and conditions of this Agreement with respect to such Sales Order and such Affiliate shall be considered to be the Customer, as such term is used herein, with respect to such Sales Order. The Customer entity signing the Sales Order shall be responsible for any of its Affiliates’ who use the Services compliance with the terms and conditions of this Agreement. 

Invoicing and Payment

Cobalt will invoice in accordance with the invoicing schedule set forth in the Sales Order. Customer will pay all fees within thirty (30) days of the date of the invoice unless otherwise set forth in the Sales Order.  All fees are stated as exclusive of taxes and Customer shall be responsible for the payment of all use, services, withholding or similar taxes on the use or sale of the Services. Any overdue invoices will accrue late interest at the rate of 1.5% of the outstanding balance per month or the greatest amount allowed by applicable laws, whichever is lower, plus all expenses of collection.

Price Changes

Customer acknowledges that future renewals of Services purchased under any particular Sales Order will occur at the then-current per-Credit price applicable at the time of such renewal. Cobalt reserves the right to change its per-Credit pricing at its discretion, such that future renewals of Services purchased under any particular Sales Order may reflect per-Credit price increases.

4. Account & Use

Creating an Account

In order to access certain features of the Services, You must register as a User on the Site and create a  Customer account and profile page ("Cobalt Account"). You may do so directly via the Site or as described in this section.

You can also register on the Site by logging into your Cobalt Account using certain third party social networking sites for which log-in support has been provided by Cobalt, including, but not limited to, Google (each a, “Third Party Service Provider”); each such account, a "Third Party Account", via the Site, as described below. As part of the functionality of the Site and Services, Customer can link a Cobalt Account with Third Party Accounts, by either: (i) providing the applicable Third Party Account login information to Cobalt through the Site or Services; or (ii) allowing Cobalt to access Customer’s Third Party Account, as is permitted under the applicable terms and conditions that govern the use of such Third Party Accounts. Customer represent that it is entitled to disclose Third Party Account login information to Cobalt and/or grant Cobalt access to such Third Party Accounts (including, but not limited to, for use for the purposes described herein), without breach of any of the terms and conditions that govern use of the applicable Third Party Accounts and without obligating Cobalt to pay any fees or making Cobalt subject to any terms and conditions imposed by such Third Party Service Providers. By granting Cobalt access to any Third Party Accounts, Customer understand that Cobalt may access, make available and store (if applicable) any Content that Customer has provided to and stored in such Third Party Accounts ("Third Party Content") so that it is available on and through the Site and Services via Customer’s Cobalt Account and Cobalt Account profile page. Unless otherwise specified in this Agreement, all Third Party Content, if any, will be considered to be Customer Data for the purposes of this Agreement. Depending on the Third Party Accounts Customer chooses, and subject to the privacy settings that Customer has set within such Third Party Accounts, personally identifiable information that Customer posts to such Third Party Accounts may be available on and through Customer’s Cobalt Account on the Site. If a Third Party Account or associated service becomes unavailable or Cobalt’s access to such Third Party Account is terminated by the Third Party Service Provider, then Third Party Content will no longer be available on and through the Site and Services. Customer has the ability to disable the connection between Customer’s Cobalt Account and any such Third Party Accounts, at any time, by accessing the "Settings" section of the Site.  CUSTOMER’S RELATIONSHIP WITH THE THIRD PARTY SERVICE PROVIDERS ASSOCIATED WITH THIRD PARTY ACCOUNTS IS GOVERNED SOLELY BY CUSTOMER’S AGREEMENT(S) WITH SUCH THIRD PARTY SERVICE PROVIDERS. Cobalt makes no effort to review any Third Party Content for any purpose, including but not limited to, for accuracy, legality or non-infringement and Cobalt is not responsible for any Third Party Content and is not responsible or liable for the acts or omissions of such Third Party Service Providers.

User Eligibility

Customer represents and warrants that each User is not: (a) a resident or national of any country subject to a United States embargo or other similar United States export restrictions; (b) on the United States Treasury Department’s list of Specifically Designated Nationals as defined under Applicable Laws; (c) on the United States Department of Commerce’s Denied Persons List or Entity List as defined under Applicable Laws; or (d) identified by the United States government as a prohibited end user of United States export controlled items or otherwise subject to sanctions or similar laws, regulations, or executive orders.

Suspension of Cobalt Services

Cobalt may, in its sole discretion, immediately suspend or terminate Customer’s Cobalt Account and/or access to or use of the Cobalt Services by Customer generally or as to any specific User if, in Cobalt’s reasonable judgment: (i) any information provided during the registration process or thereafter proves to be materially inaccurate, to the detriment of Cobalt; (ii)  the Cobalt Services or any component thereof may suffer a significant threat to security or functionality caused by continued access to or use of the Cobalt Services by Customer; or (iii) continued provision of the Services may have a deleterious effect on Cobalt or any other Customer. In the event Services are suspended pursuant to this paragraph, Cobalt shall endeavor to provide notice of the suspension and of the cause underlying the suspension as soon as practicable.  Cobalt shall use reasonable efforts to re-establish the affected Cobalt Services promptly after Cobalt determines, in its reasonable discretion, that the situation giving rise to the suspension has been cured. Where the cause underlying suspension of Services is a subject that Customer or a third party reasonably within the control of Customer is able to rectify, Cobalt may permanently terminate the Cobalt Services under a Sales Order if any of the foregoing causes of suspension is not cured within thirty (30) days after Cobalt’s initial notice to Customer thereof and such failure shall be deemed a material breach by Customer. Any suspension or termination by Cobalt under this Section will not excuse or release Customer from its obligation to make payment(s) under any Sales Orders in effect at the time of termination.

Security Program

Customer shall comply with the terms and obligations set forth in the Supplemental Terms “Running a Security Program.”

If for any reason the Security Program is not capable of running as planned, including infection by computer virus, bugs, tampering, unauthorized intervention, fraud, technical failures, or any other causes which corrupt or affect the administration, security, fairness, integrity, or proper conduct of the Security Program, Cobalt reserves the right at its sole discretion to cancel, terminate, modify or suspend the Security Program. Cobalt further reserves the right to disqualify any User who tampers with the submission process or any other part of the Security Program or Site. Any attempt by a User to deliberately damage any web site, including the Site, or undermine the legitimate operation of the Security Program is a violation of criminal and civil laws and should such an attempt be made, Cobalt reserves the right to seek damages from you to the fullest extent under Applicable law.

Acceptable Use

Prohibited Use. In connection with Your use of our Services, You agree that You will not:

• violate any Applicable Laws, including, without limitation, privacy laws;
• use manual or automated software, devices, scripts robots, other means or processes to access, "scrape," "crawl" or "spider" any web pages or other services contained in the Site, Services or Content;
• use the Services or Cobalt Content on behalf of for the benefit of any third party, including in a service bureau, time sharing or other arrangement, except where expressly authorized in writing by Cobalt, including without limitation, where undertaken pursuant to a valid Cobalt reseller agreement or similar agreement;
• copy, store, modify, prepare derivative works based upon, distribute, license, sell, transfer, publicly display, publicly perform, transmit, broadcast or otherwise exploit any software forming a part of the Site r the Cobalt Content except as expressly permitted under this Agreement or attempt to expose the source code of or attempt to recreate any software which forms a part of the Site;
• infringe the rights of any person or entity, including without limitation, their intellectual property, privacy, publicity or contractual rights;
• interfere with or damage Cobalt’s Site or Services, including, without limitation, through the use of viruses, cancel bots, Trojan horses, harmful code, flood pings, denial-of-service attacks, packet or IP spoofing, forged routing or electronic mail address information or similar methods or technology;
• contact a Security Pentester for any purpose other than communication related to a Security Program;
• attempt to probe, scan, or test the vulnerability of any Cobalt system or network or breach any security or authentication measures;
• avoid, bypass, remove, deactivate, impair, descramble, or otherwise circumvent any technological measure implemented by Cobalt or any of Cobalt’s providers or any other third party (including another User) to protect the Site, Services or Collective Content;
• forge any TCP/IP packet header or any part of the header information in any email or newsgroup posting, or in any way use the Site, Services or Collective Content to send altered, deceptive or false source-identifying information;(b) attempt to decipher, decompile, disassemble or reverse engineer any of the software used to provide the Services or Collective Content; (c) attempt to expose the software or use the software used to provide the Services to recreate such software; or advocate, encourage, or assist any third party in doing any of the foregoing;
• use the Site or Services in any way not contemplated by this Agreement.

A violation of any of the use restrictions and obligations set forth in this Section 3 shall constitute a material breach of this Agreement.  Customer acknowledges and agrees that Cobalt has no obligation to monitor Customer’s access to or use of the Services or Collective Content or to review or edit any Customer Data. Cobalt reserves the right, at any time and without prior notice, to remove or disable access to any Customer Data that Cobalt, at its sole discretion, considers to be objectionable, in violation of this Agreement or otherwise harmful to the Services.

Affirmative Obligations. In connection with Your use of the Services, You agree that:

• You are solely responsible for compliance with any and all Applicable Laws, rules, regulations, and tax obligations that may apply to Your use of the Site, Services and Content.
• You will provide accurate, current accurate, current and complete information during the registration process and to update such information to keep it accurate, current and complete.
• You are responsible for safeguarding Your password and other sensitive credentials and Content; You also agree that You will not disclose Your password to any third party and that You will take sole responsibility for any activities or actions under Your Cobalt Account, whether or not You have authorized such activities or actions.
• You are responsible for only using those Third Party Accounts that You deem to be secure for usage in connection with the Services, and You assume the risk of any privacy or security violations arising thereto.
• You are responsible for managing security permissions, and for deleting sensitive data in a timely fashion to mitigate the risk of security breaches.
• You will immediately notify Cobalt of any unauthorized use of Your Cobalt Account.
• If You interact with anyone who You feel is acting or has acted inappropriately, including but not limited to, anyone who (i) engages in offensive, violent or sexually inappropriate behavior, (ii) You suspect of stealing from You, or (iii) engages in any other disturbing conduct, You should immediately report such person to the appropriate authorities and then to Cobalt by contacting Us with Your police station and report number at info@cobalt.io; provided that Your report will not obligate Us to take any action beyond that required by law (if any) or cause Us to incur any liability to You.

Remedial Action

We may, in Our sole discretion and at any time, with or without cause, and with or without prior notice: (a) terminate or modify this Agreement, (b) terminate, modify or restrict Your access to the Services, (c) deactivate or cancel Your Cobalt Account, and (d) take other actions as We see fit in our sole discretion (collectively, such actions being “Remedial Actions”). In the event of Remedial Actions, You will remain liable for all amounts due hereunder, or under an applicable Sales Order.

Notwithstanding the foregoing, We will not cancel Your account if there is an active Sales Order in effect unless such termination is for Cause. Unless otherwise specified in the Sales Order, “Cause” shall mean (a) a material breach by You of this Agreement, including but not limited to any breach of the restrictions described herein, (b) a material breach of a Sales Order, where such breach is not cured within 30 days following Your receipt of e-mail or other notice of such breach, and (c) violation of any third party right or of Applicable Law, as determined in Our sole discretion.

Cancellation

You may cancel Your Cobalt Account at any time via the "Cancel Account" feature of the Services or by sending an email to info@cobalt.io, provided that any such cancellation by You shall not affect any obligations by You under an active Sales Order including any payment obligations unless otherwise expressly agreed by the parties in the Sales Order. Please note that if Your Cobalt Account is canceled, We do not have an obligation to delete or return to You any Customer DataYou have posted to the Services, including, but not limited to, any reviews or Feedback unless explicitly agreed in a Sales Order.

5. Privacy 

See Cobalt’s Privacy Policy, which is hereby incorporated by reference, and to which You agree to be bound.

6. Confidentiality

Definition

During the Term the parties may need to exchange or make available confidential and proprietary information to the other party in connection with this Agreement, whether disclosed in written, oral, electronic or visual form, which is identified as confidential at the time of disclosure or should reasonably be understood to be confidential given the nature of the information or the circumstances surrounding the disclosure, including without limitation business, operations, finances, technologies, products and services, pricing, personnel, customers and suppliers (“Confidential Information”). Without limiting the foregoing, (i) Cobalt Confidential Information shall include Cobalt Property; and (ii) Customer Confidential Information shall include Customer Data and the Applications/Networks except to the extent Customer posts Customer Data on the Site for the purpose of making it available to Cobalt, Security Pentesters, or any other User.

Non-Use

During the Term, and continuing after expiration or termination of the Agreement, each party shall retain in confidence, and not use (except for the purposes described in this Agreement), the Confidential Information of the other party. The receiving party will use the same degree of care and discretion (but not less than reasonable care) to avoid disclosure, publication or dissemination of the disclosing party’s Confidential Information as it uses with its own confidential or proprietary information of a similar nature.  Except as authorized in this Agreement or a Sales Order, the receiving party will not disclose the Confidential Information of the disclosing party to a third party other than to its or its Affiliates’ employees, contractors, agents or advisors in connection with its performance of this Agreement who are bound by terms no less protective of a disclosing party’s rights as those set forth in this Agreement and the receiving party shall be liable to the disclosing party for any violation of this Agreement by such persons. 

Exclusions

Confidential Information shall not include information that (a) is publicly known at the time of disclosure, (b) is lawfully received from a third party not bound in a confidential relationship with the disclosing party, (c) is published or otherwise made known to the public by the disclosing party, or (d) was or is generated independently without use of the disclosing party’s Confidential Information.  The receiving party may disclose Confidential Information as required to comply with orders of governmental entities that have jurisdiction over it or as otherwise required by law, provided that the receiving party (i) gives the disclosing party reasonable advance written notice to allow the disclosing party to seek a protective order or other appropriate remedy (except to the extent that compliance with the foregoing would cause it to violate an order of the governmental entity or other legal requirement), (ii) discloses only that portion of the Confidential Information as is required, and (iii) cooperates with the disclosing party to obtain confidential treatment for any Confidential Information so disclosed.  Notwithstanding anything herein to the contrary, provided that Cobalt does not use or disclose Customer Confidential Information, Cobalt shall be free to use, exploit and disclose its general skills, concepts, ideas, know-how, and expertise gained or learned during the course of this Agreement, and Cobalt shall not be restricted from creating output for other Customers which is similar to that provided to Customer.

Remedies

Due to the unique nature of Confidential Information gained through the Services, the Parties acknowledge that the breach of this Section 6 could cause irreparable harm, which monetary damages would be insufficient to remedy. Accordingly, the Parties agree and acknowledge that any such violation or threatened violation may cause irreparable injury to Us, Security Pentesters, or to third parties, and that, in addition to any other remedies available at law, such other Parties shall be entitled to seek injunctive relief against the threatened or continuing breach of this Agreement.

7. Intellectual Property

Cobalt Rights, Licenses

The Services, and Collective Content are protected by copyright, trademark, and other laws of the United States of America and foreign countries.

Cobalt Property Ownership: You acknowledge and agree that Cobalt and/or its licensors own all right, title and interest to the Site, Services and Cobalt Content, including without limitation any techniques, ideas, concepts, methods, processes, software, utilities, data, documents, directories, designs, user interfaces, know-how, graphics, video content or other data or information acquired, created, developed or licensed by Cobalt prior to or outside the scope of the Services and all modifications, improvements and derivative works thereof and all associated Intellectual Property Rights (collectively as “Cobalt Property”).

Cobalt License. Subject to Your compliance with the terms and conditions of this Agreement, Cobalt grants You a limited, world-wide, non-exclusive, non-transferable, non-sublicensable right and license, during the subscription term specified in a Sales Order, to (i) access and use the Site and Services in accordance with the terms of this Agreement; and (ii) access and view any Cobalt Content contained on the Site solely for Your internal use in connection with Your use of the Services. Except as provided herein, You shall have no right to make the Site, Services or Cobalt Content available to, use the Site, Services or Cobalt Content on behalf of, or for the benefit of any third party without Cobalt’s express written authorization.  Except for the rights expressly licensed to You hereunder, Cobalt and its licensors reserve and retain all right, title and interest to the Site, Services and Cobalt Content. You shall not (i) remove or alter any proprietary notices included on the Services(s) and/or Cobalt Content; or (ii) modify or attempt to expose the source code of or attempt to recreate any software which forms a part of the Site. 

No title, licenses, or other rights or interests are granted to You by implication or otherwise under any intellectual property rights owned or controlled by Cobalt or its licensors, except for the licenses and rights expressly granted in this Agreement.

Customer Rights, Licenses

The parties acknowledge and agree that You and/or Your licensors own all right, title and interest to the Applications/Networks and any Customer Data made available by the You through the Site or Services and any findings contained in the Vulnerability Reports created specifically and uniquely for the You, but excluding Security Pentester Property (as defined below) and any Intellectual Property Rights therein.

Customer License Grants

Statistical Data

You acknowledge and agree that (i) Cobalt has the right to  collect and create high level, generic, anonymous, statistical and/or benchmarking data derived from Customer’s use of the Site and the Services  that is aggregated with other findings, results and information (the “Statistical Data”), (ii) all such Statistical Data is the sole and exclusive intellectual property of Cobalt, except to the extent such Statistical Data includes Customer Data, and (iii) to the extent such Statistical Data includes any Customer Data, Customer hereby grants to Cobalt a perpetual, worldwide, irrevocable license to use, reproduce, store, modify, create derivative works of, exploit, publish, license and transmit such Customer Data; provided, that Cobalt shall in all cases refrain from publishing any Statistical Data, Customer Data, or any insights or work derived therefrom in a manner that reveals or   allows to be inferred the identity of identify any specific person, Customer’s name, Customer Data, Application, Customer Confidential Information or Network.  Except as expressly licensed herein, Customer shall retain all right, title and/or interest to the Customer Data and Customer Confidential Information and all intellectual property rights therein, and except as expressly licensed herein, Cobalt shall obtain no right or license thereto.

You understand and agree that Cobalt shall have the right to share Customer contact details with third party partners and service providers in connection with the delivery of the Services and enabling such partners to offer other software and/or services as related to the Services.

Customer Data License Grant

You grant to Cobalt a worldwide, non-exclusive, non-transferable (except by assignment or as otherwise expressly permitted under this Agreement), royalty-free license and right to, during the Order Term, (i) use, access, view, copy, display, transmit and store Customer Data on, through or by means of the Site and Services solely to the extent necessary to operate, maintain, perform, and provide the Site and Services, (ii) use, access, view, copy,  and display, information relating to the Applications/Networks solely to the extent necessary to engage in testing and/or create the Vulnerability Reports or otherwise perform tasks in connection with the Security Program; and (iiii) create, view, display, transmit and store Vulnerability Reports relating to the Applications/Networks. You acknowledge that this license grant extends, to the extent necessary to facilitate performance of the Services, to Cobalt’s personnel and Security Pentesters. Except as expressly licensed herein, You shall retain all right, title and/or interest to the Applications/Network and all intellectual property rights therein, and except as expressly licensed herein, Cobalt shall obtain no right or license thereto.

Pentester Rights, Licenses

The parties acknowledge and agree that as between the parties, the Security Pentesters and/or their licensors reserve all right, title and interest to any techniques, methods, processes, or technical information contained in any Customer Data acquired, created, developed or licensed by the Security Pentester prior to, independently of, and outside the scope of of Your specific Security Program and Vulnerability Report(s) thereto, and any intellectual property rights therein (“Security Pentester Property”), except as described in this Agreement.

All Parties

We may, in our sole discretion, permit Users to post, upload, publish, submit or transmit Customer Data, including Security Program(s). This License grant section covers the license grant for Customer Data.

Subject to the license rights and restrictions otherwise expressly provided for in this Agreement and the Cobalt Privacy Policy, by making available any Customer Data on or through the Services, You hereby grant to Cobalt a worldwide, irrevocable, perpetual, non-exclusive, transferable, royalty-free license, with the right to sublicense, to use, view, copy, adapt, modify, distribute, license, sell, transfer, publicly display, publicly perform, transmit, stream, broadcast, access, view, and otherwise exploit such Customer Data on, through, or by means of the Services, for the purpose of providing or enjoying the Services and pursuant to the terms of this Agreement.

Except as provided for in this Agreement, Cobalt does not claim any ownership rights in any such Customer Data and nothing in this Agreement will be deemed to restrict any rights that You may have to use and exploit any such Customer Data that You are otherwise entitled to use and exploit.

Other Third Party Rights, Licenses

Links. The Services may contain links to third-party websites or resources. You acknowledge and agree that Cobalt is not responsible or liable for: (i) the availability or accuracy of such websites or resources; or (ii) the content, products, or services on or available from such websites or resources. Links to such websites or resources do not imply any endorsement by Cobalt of such websites or resources or the content, products, or services available from such websites or resources. You acknowledge sole responsibility for and assume all risk arising from Your use of any such websites or resources or the Content, products or services on or available from such websites or resources.

Proprietary Rights Notice. All trademarks, service marks, logos, trade names and any other proprietary designations of Cobalt used herein are trademarks or registered trademarks of Cobalt. Any other trademarks, service marks, logos, trade names and any other proprietary designations are the trademarks or registered trademarks of their respective parties.

Digital Millennium Copyright Act. If You believe that Your copyrighted work has been copied in a way that constitutes copyright infringement and is accessible via the Services, please notify our copyright agent, as set forth in the Digital Millennium Copyright Act of 1998 ("DMCA"). For Your complaint to be valid under the DMCA, You must provide the following information in writing to info@cobalt.io:

• An electronic or physical signature of a person authorized to act on behalf of the copyright owner;
• Identification of the copyrighted work that You claim has been infringed;
• Identification of the material that is claimed to be infringing and where it is located on the Service;
• Information reasonably sufficient to permit Us to contact You, such as Your address, telephone number, and, e-mail address;
• A statement that You have a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or law; and
• A statement, made under penalty of perjury, that the above information is accurate, and that You are the copyright owner or are authorized to act on behalf of the owner.

Use of Customer Name and Logo.  Cobalt may use Customer's name and logo to identify Customer as a customer of Cobalt, unless you object in writing to Cobalt's use thereof.  Cobalt's use of the name and logo does not create any ownership right therein and all rights not granted to Cobalt are preserved by Customer.

8. Representations & Warranties

Warranty

Your Warranty. You acknowledge and agree that You are solely responsible for (a) all activity occurring through Your Cobalt Account, whether authorized or not, and (b) all Customer Data that You make available through the Services. Accordingly, You represent and warrant that: (i) You either are the sole and exclusive owner of all Customer Data that You make available through the Services or You have all necessary legal rights, licenses, consents and releases to grant to Cobalt its Security Pentesters the rights in such Customer Data, as contemplated under this Agreement, and that You have a process to manage alleged infringements of third party rights thereto, including processes to ensure compliance with the DMCA; and (ii) neither the Customer Data nor Your posting, uploading, publication, sublicensing, submission or transmittal of the Customer Data or Cobalt’s or Security Pentester’s use of the Customer Data(or any portion thereof) on, through or by means of the Site and the Services will infringe, misappropriate or violate any third party patent, copyright, trademark, trade secret, moral rights or other proprietary or intellectual property rights, or rights of publicity or privacy, or result in the violation of any Applicable Law. 

Cobalt Warranty

Cobalt represents and Warrants that: (i) Cobalt either is the sole and exclusive owner of all Cobalt Content and the Site or Cobalt has obtained all necessary legal rights, licenses, consents, permissions, approvals and releases to grant You the right to such Cobalt Content and the Site, as contemplated under this Agreement; and (ii) Cobalt shall comply with all applicable laws relating to its performance under this Agreement.

Express Waivers of Warranties

YOU ACKNOWLEDGE AND AGREE THAT EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE SERVICES ARE PROVIDED "AS IS", WITHOUT ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT LIMITING THE FOREGOING, COBALT EXPLICITLY DISCLAIMS ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT, AND ANY WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE. COBALT MAKES NO WARRANTY THAT THE SERVICES, INCLUDING, BUT NOT LIMITED TO, THE SECURITY PROGRAMS OR ANY VULNERABILITY REPORTS WILL MEET YOUR REQUIREMENTS, BE EXHAUSTIVE IN DOCUMENTING SECURITY RISKS, OR BE AVAILABLE ON AN UNINTERRUPTED, SECURE, OR ERROR-FREE BASIS. COBALT MAKES NO WARRANTY REGARDING THE QUALITY OF ANY SECURITY PROGRAMS AND VULNERABILITY REPORTS, THE SERVICES, OR THE ACCURACY, TIMELINESS, TRUTHFULNESS, COMPLETENESS OR RELIABILITY OF ANY SECURITY PROGRAMS, VULNERABILITY REPORTS OR OTHER COLLECTIVE CONTENT OBTAINED THROUGH THE SITE OR SERVICES.

NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED FROM COBALT OR THROUGH THE SITE, SERVICES OR COLLECTIVE CONTENT, WILL CREATE ANY WARRANTY NOT EXPRESSLY MADE HEREIN.

COBALT MAKES NO GUARANTEE AGAINST ANY MALFUNCTION OF THE ENTIRE SECURITY PROGRAM SITE OR ANY LATE, LOST, DAMAGED, MISDIRECTED, INCOMPLETE, ILLEGIBLE, UNDELIVERABLE, OR DESTROYED VULNERABILITY REPORT SUBMISSIONS DUE TO SYSTEM ERRORS, FAILED, INCOMPLETE OR DISTORTED COMPUTER OR OTHER TELECOMMUNICATION TRANSMISSION MALFUNCTIONS, HARDWARE OR SOFTWARE FAILURES OF ANY KIND, LOST OR UNAVAILABLE NETWORK CONNECTIONS, TYPOGRAPHICAL OR SYSTEM/HUMAN ERRORS AND FAILURES, TECHNICAL MALFUNCTION(S) OF ANY TELEPHONE NETWORK OR LINES, CABLE CONNECTIONS, SATELLITE TRANSMISSIONS, SERVERS OR PROVIDERS, OR COMPUTER EQUIPMENT, TRAFFIC CONGESTION ON THE INTERNET OR AT THE SITE, OR ANY COMBINATION THEREOF, INCLUDING OTHER TELECOMMUNICATION, CABLE, DIGITAL OR SATELLITE MALFUNCTIONS WHICH MAY LIMIT THE PERIOD A PROGRAM IS LISTED ON THE SITE.

YOU ARE SOLELY RESPONSIBLE FOR ALL OF YOUR COMMUNICATIONS AND INTERACTIONS WITH OTHER USERS OF THE SERVICES, WITH OTHER PERSONS WITH WHOM YOU COMMUNICATE OR INTERACT AS A RESULT OF YOUR USE OF THE SITE OR SERVICES. YOU UNDERSTAND THAT COBALT DOES NOT MAKE ANY ATTEMPT TO VERIFY THE STATEMENTS OF USERS OF THE SITE OR SERVICES OR TO VERIFY ANY SECURITY PROGRAMS OR VULNERABILITY REPORTS, OR THE SECURITY OF ANY THIRD PARTY ACCOUNT USAGE. YOU AGREE TO TAKE REASONABLE PRECAUTIONS IN ALL COMMUNICATIONS AND INTERACTIONS WITH OTHER USERS OF THE SITE OR SERVICES AND WITH OTHER PERSONS WITH WHOM YOU COMMUNICATE OR INTERACT AS A RESULT OF YOUR USE OF THE SITE OR SERVICES, INCLUDING, BUT NOT LIMITED TO, SECURITY PENTESTERS.

YOU UNDERSTAND AND AGREE THAT THE NATURE OF PENETRATION TESTING MAY CAUSE SIGNIFICANT HARM OR DISRUPTION TO PROGRAM(S) AND YOUR BUSINESS, AND YOU ASSUME SUCH RISK, TOGETHER WITH THE RISK OF AN INCOMPLETE OR UNRELIABLE VULNERABILITY REPORT.

Limited Warranties

Cobalt represents and warrants that (i) it shall provide the Services in a professional manner and will provide a standard of care consistent with that used by service providers similar to Cobalt; and (ii) that the Security Pentesters have the general skills and expertise necessary to perform the Services. In order to state a claim for breach of the foregoing warranty, You must provide notice of such non-compliance within the thirty (30) day period following the delivery of a Vulnerability Report, specifying the details of such noncompliance. If You provides Cobalt with the required notice, as Your sole and exclusive remedy and Cobalt’s sole and exclusive liability for breach of warranty, Cobalt shall, at the Your request and option, either extend the period of testing to perform additional testing or provide a reperform the Services using a different Security Pentester. This warranty shall not apply during any trial license period. 

9. Indemnification

You agree to release, indemnify, and hold Cobalt and its affiliates and subsidiaries, and their officers, directors, employees and agents, harmless from and against any third party claims, liabilities, damages, losses, and expenses, including, without limitation, reasonable legal and accounting fees, arising out of or in any way connected with (i) Your access to or use of the Site or Services; (ii) Customer Data, including without limitation Customer Data that violates third party rights, including intellectual property rights; (iii) Your breach of representations, warranties and/or obligations under this Agreement (iv) Your improper or unlawful interaction with any other persons who access the Site; (v) Your misrepresentation, negligence, or willful misconduct in connection with the performance of this Agreement and (vi) Your violation of Applicable law (collectively the “Indemnified Claims”).

10. Limitation of Liability

Except as otherwise expressly provided in this Agreement, by using the Services, You agree that any legal remedy or liability that You seek to obtain for any acts or omissions of, any individuals or other third parties will be limited to a claim against the particular individuals or other third parties who caused You harm and You agree not to attempt to impose any liability on, or seek any legal remedy from Cobalt with respect to the acts or omissions of other individuals or third parties.

YOU ACKNOWLEDGE AND AGREE THAT, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER COBALT NOR ITS LICENSORS, SUPPLIERS, OR CONTRACTORS WILL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, INCLUDING LOST PROFITS, LOSS OF DATA OR LOSS OF GOODWILL, SERVICE INTERRUPTION, COMPUTER DAMAGE OR SYSTEM FAILURE OR THE COST OF SUBSTITUTE PRODUCTS OR SERVICES, OR FOR ANY DAMAGES FOR PERSONAL OR BODILY INJURY OR EMOTIONAL DISTRESS ARISING OUT OF OR IN CONNECTION WITH THE TERMS, THE USE OF OR INABILITY TO USE THE SITE, SERVICES OR COLLECTIVE CONTENT, FROM ANY COMMUNICATIONS OR INTERACTIONS WITH OTHER USERS OF THE SITE OR SERVICES, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT COBALT HAS BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGE, EVEN IF A LIMITED REMEDY SET FORTH HEREIN IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NO EVENT WILL COBALT’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO WITH THE TERMS AND YOUR USE OF THE SITE AND SERVICES INCLUDING, BUT NOT LIMITED TO, FROM YOUR LISTING OF YOUR SECURITY PROGRAM OR VULNERABILITY REPORT VIA THE SERVICES EXCEED THE TOTAL OF THE AMOUNTS YOU HAVE PAID IN RELATION TO A SPECIFIC SECURITY PROGRAM VIA THE SERVICES AS A CUSTOMER DURING THE TWELVE (12) MONTH PERIOD PRECEDING THE EVENT GIVING RISE TO THE LIABILITY OCCURRED, OR IF YOU ARE A SECURITY PENTESTER, THE AMOUNTS PAID BY COBALT TO YOU IN THE TWELVE (12) MONTH PERIOD PRECEDING THE EVENT GIVING RISE TO THE LIABILITY, OR ONE HUNDRED DOLLARS ($100) IF NO SUCH PAYMENTS HAVE BEEN MADE OR ARE OWED, AS APPLICABLE. **THE LIMITATIONS OF DAMAGES SET FORTH ABOVE ARE FUNDAMENTAL ELEMENTS OF THE BASIS OF THE BARGAIN BETWEEN COBALT AND YOU. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THE ABOVE LIMITATION MAY NOT FULLY APPLY TO YOU, IN WHICH CASE YOU AGREE THIS PROVISION SHOULD BE APPLIED TO THE MAXIMUM EXTENT PERMITTED BY LAW.

YOU UNDERSTAND AND AGREE THAT THE NATURE OF PENTESTING MAY CAUSE HARM OR DISRUPTION TO PROGRAM(S) AND THAT NEITHER COBALT NOR ANY SECURITY PENTESTER SHALL HAVE ANY LIABILITY OF ANY KIND ARISING OUT OF SUCH TESTING ACTIVITIES, UNLESS THE SECURITY PENTESTER HAS COMMITTED GROSS NEGLIGENCE OR COMMITTED WILLFUL MISCONDUCT IN THE PERFORMANCE OF SUCH TESTING.

11. Miscellaneous

Test Drive

PLEASE NOTE: By signing up for a Test Drive (as defined herein) of the Cobalt platform, You are agreeing to the following terms and conditions, which will govern Your Test Drive. Except where expressly contradicted by the following, the applicable provisions of this Agreement remain fully effective.

(a) If You sign up for a Test Drive, Cobalt will make certain features of the Cobalt platform available to you on a trial basis only, free of charge, until the earlier of (a) ten days following You signing up for the Test Drive, (b) the start date of any Services subscription purchased by You, or (c) termination of the Test Drive by Cobalt in its sole discretion (the "Trial Period"). A Trial Period may be extended upon mutual agreement between You and Cobalt. Notwithstanding anything to the contrary in this Agreement, a Test Drive is provided "AS IS." Cobalt makes no commitment to maintain the availability of a particular feature or functionality of the Cobalt platform for the duration of a Test Drive. COBALT MAKES NO REPRESENTATION OR WARRANTY AND SHALL HAVE NO INDEMNIFICATION OBLIGATIONS WITH RESPECT TO ANY Test Drive. COBALT SHALL HAVE NO LIABILITY OF ANY TYPE WITH RESPECT TO A Test Drive, UNLESS SUCH EXCLUSION OF LIABILITY IS NOT ENFORCEABLE UNDER APPLICABLE LAW IN WHICH CASE COBALT'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO ANY Test Drive IS $100.00. BY PARTICIPATING IN A COBALT Test Drive, YOU AGREE TO REFRAIN FROM USING THE Test Drive IN A MANNER THAT VIOLATES APPLICABLE LAW AND YOU WILL BE FULLY LIABLE FOR ANY DAMAGES CAUSED BY YOUR USE OF A Test Drive.

(b) You acknowledge that, at the end of the Trial Period, Your access to the Test Drive will be automatically terminated, with or without notice, unless You agree to purchase a paid subscription to the Services pursuant to the applicable provisions of this Agreement. Any data entered by You into the Cobalt platform in connection with Your Test Drive may be permanently lost upon termination of the Test Drive unless you subscribe to the Services.

(c) "Test Drive" means access to the certain features of the Cobalt Platform that are made available to a prospective customer to facilitate the evaluation of potentially purchasing the Services, which is provided to You at no additional charge, and which is designated as a "Trial," "Test Drive," or similar description. A Test Drive does not include performance of a penetration test or other cybersecurity services, the identification of any security vulnerabilities, the provision of a report relative to Your security vulnerabilities or other aspects of Your security posture, or any other part of the Services offered by Cobalt other than access to the specific platform features that Cobalt, in its sole discretion, chooses to include in the Test Drive. You acknowledge and agree that a Test Drive is for Your internal business purposes only.

Assignment

You may not assign, transfer, delegate or subcontract this Agreement or any of Your rights or obligations under this Agreement, in whole or in part, by sale of assets, merger, operation of law or otherwise, without Cobalt’s prior written consent. Any attempt by You to assign, transfer, delegate or subcontract this Agreement or any of Your rights or obligations under this Agreement, without such consent, will be null and of no effect and in such event, and Cobalt shall have the right to immediately terminate Your rights under this Agreement and seek any remedies available to it at law or in equity. Cobalt may assign or transfer this Agreement, at its sole discretion, without restriction. Cobalt has the right to use subcontractors in connection with providing the Services. Subject to the foregoing, this Agreement will bind and inure to the benefit of the parties, their successors and permitted assigns.

Notices

Any notices or other communications permitted or required hereunder, including those regarding modifications to this Agreement, will be in writing and given by Cobalt (i) via email (in each case to the address that You provide) or (ii) by posting to the Site. Notices to Cobalt shall be sent to info@cobalt.io. For notices made by e-mail, the date of receipt will be deemed the date on which such notice is transmitted.

Force Majeure

If the performance of any obligation hereunder is interfered with by reason of any circumstances beyond a party’s reasonable control, including but not limited to acts of God, labor strikes and other labor disturbances, power surges or failures, or the act or omission of any third party, the party shall be excused from such performance to the extent necessary during the term of any force majeure event, provided the party shall use reasonable efforts to remove such causes of nonperformance.  If an event of force majeure prevents either party from performing its responsibilities under this Agreement for a period of more than thirty (30) days, the other party may terminate this Agreement and any outstanding Sales Order immediately upon written notice.

Controlling Law and Jurisdiction

This Agreement will be interpreted in accordance with the laws of the State of California and the United States of America, without regard to its conflict-of-law provisions. You and We agree to submit to the personal jurisdiction of a state court or arbitrator located in San Francisco County, San Francisco, California or a United States District Court, Northern District of California located in San Francisco, California for any actions for which the parties retain the right to seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation or violation of a party’s copyrights, trademarks, trade secrets, patents, or other intellectual property rights, as set forth in the Dispute Resolution provision below.

Arbitration & Dispute Resolution

You and Cobalt agree that any dispute, claim or controversy arising out of or relating to this Agreement or the breach, termination, enforcement, interpretation or validity thereof, or to the use of the Services or use of the Site (collectively, "Disputes") will be settled by binding arbitration, except that each party retains the right to seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation or violation of a party’s copyrights, trademarks, trade secrets, patents, or other intellectual property rights. You acknowledge and agree that You and Cobalt are each waiving the right to a trial by jury or to participate as a plaintiff or class member in any purported class action or representative proceeding. Further, unless both You and Cobalt otherwise agree in writing, the arbitrator may not consolidate more than one person's claims, and may not otherwise preside over any form of any class or representative proceeding. If this specific paragraph is held unenforceable, then the entirety of this "Dispute Resolution" section will be deemed void. Except as provided in the preceding sentence, this "Dispute Resolution" section will survive any termination of this Agreement.

Arbitration Rules and Governing Law**.** The arbitration will be administered by the American Arbitration Association ("AAA") in accordance with the Commercial Arbitration Rules and the Supplementary Procedures for Consumer Related Disputes (the "AAA Rules") then in effect, except as modified by this "Dispute Resolution" section. (The AAA Rules are available at http://www.adr.org/arb_med or by calling the AAA at 1-800-778-7879.) The Federal Arbitration Act will govern the interpretation and enforcement of this section.

Arbitration Process**.** A party who desires to initiate arbitration must provide the other party with a written Demand for Arbitration as specified in the AAA Rules. (The AAA provides a form Demand for Arbitration at http://www.adr.org/aaa/ShowPDF?doc=ADRSTG_004175 and a separate form for California residents at http://adr.org/aaa/ShowPDF?doc=ADRSTG_004314.) The arbitrator will be either a retired judge or an attorney licensed to practice law in the state of California and will be selected by the parties from the AAA’s roster of consumer dispute arbitrators. If the parties are unable to agree upon an arbitrator within seven (7) days of delivery of the Demand for Arbitration, then the AAA will appoint the arbitrator in accordance with the AAA Rules.

Arbitration Procedure**.** If Your claim does not exceed $10,000, then the arbitration will be conducted solely on the basis of documents You and Cobalt submit to the arbitrator, unless You request a hearing or the arbitrator determines that a hearing is necessary. If Your claim exceeds $10,000, Your right to a hearing will be determined by the AAA Rules. Subject to the AAA Rules, the arbitrator will have the discretion to direct a reasonable exchange of information by the parties, consistent with the expedited nature of the arbitration.

Arbitrator’s Decision. The arbitrator will render an award within the time frame specified in the AAA Rules. The arbitrator’s decision will include the essential findings and conclusions upon which the arbitrator based the award. Judgment on the arbitration award may be entered in any court having jurisdiction thereof. The arbitrator’s award damages must be consistent with the terms of the "Limitation of Liability" section above as to the types and the amounts of damages for which a party may be held liable. The arbitrator may award declaratory or injunctive relief only in favor of the claimant and only to the extent necessary to provide relief warranted by the claimant’s individual claim. If You prevail in arbitration You will be entitled to an award of attorneys’ fees and expenses, to the extent provided under Applicable Law. Cobalt will not seek, and hereby waives all rights it may have under Applicable Law to recover, attorneys’ fees and expenses if it prevails in arbitration.

Fees. Your responsibility to pay any AAA filing, administrative and arbitrator fees will be solely as set forth in the AAA Rules. However, if Your claim for damages does not exceed $75,000, Cobalt will pay all such fees unless the arbitrator finds that either the substance of Your claim or the relief sought in Your Demand for Arbitration was frivolous or was brought for an improper purpose (as measured by the standards set forth in Federal Rule of Civil Procedure 11(b)).

Changes**.** Notwithstanding the provisions of the "Modification" section above, if Cobalt changes this "Dispute Resolution" section after the date You first accepted this Agreement (or accepted any subsequent changes to this Agreement), You may reject any such change by sending Us written notice (including by email to info@cobalt.io) within 30 days of the date such change became effective, as indicated in the "Last Updated Date" above or in the date of Cobalt’s email to You notifying You of such change. By rejecting any change, You are agreeing that You will arbitrate any Dispute between You and Cobalt in accordance with the provisions of this "Dispute Resolution" section as of the date You first accepted this Agreement (or accepted any subsequent changes to this Agreement).

Independent Parties

The relationship of the parties is that of independent contracting parties and Cobalt shall not be construed to be an employee, partner or agent of Customer. 

Entire Agreement and Amendment

The terms and conditions of this Agreement (including any applicable schedules, referenced documents, or Sales Orders entered into pursuant hereto) provide the complete understanding of the parties with regard to the subject matter hereof and supersede all previous communications, agreements, proposals or representations related to the subject matter hereof.  Except as otherwise expressly provided for herein, any waiver, amendment, or modification of any right or remedy, in whole or in part under this Agreement, or any additional or different terms in, acknowledgments or other documents, will not be effective unless expressly agreed to in writing and signed by the authorized representatives the parties.  Unless the Sales Order expressly amends this Agreement and except as otherwise expressly provided herein, the terms and conditions of this Agreement shall take precedence over any conflicting terms in a Sales Order.  It is expressly agreed that no additional terms and conditions contained in Your purchase order, internet procurement portal or other non-Cobalt document shall apply to the Services ordered.

Waiver

The failure of Cobalt to enforce any right or provision of this Agreement will not constitute a waiver of future enforcement of that right or provision. The waiver of any such right or provision will be effective only if in writing and signed by a duly authorized representative of Cobalt. Except as expressly set forth in this Agreement, the exercise by either party of any of its remedies under this Agreement will be without prejudice to its other remedies under this Agreement or otherwise. If for any reason an arbitrator or a court of competent jurisdiction finds any provision of this Agreement invalid or unenforceable, that provision will be enforced to the maximum extent permissible and the other provisions of this Agreement will remain in full force and effect.

Definitions

Affiliate - Any entity controlled by, controlling, or under common control with a party to this Agreement during the period such control exists.  For the purposes hereof “control” means the power to direct the operation, policies and management of an entity through the ownership of more than fifty percent (50%) of the voting securities of such entity, by contract, or otherwise.

Applicable Law(s) - Any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, directive, common law, judgment, decree or other requirement or rule of any federal, state, local or foreign government or political subdivision thereof, or any arbitrator, court or tribunal of competent jurisdiction applicable to a party’s performance of its obligations or the exercise of its rights under this Agreement.

Application(s) - A software application (including a web enabled application, desktop, or mobile application), involved directly or indirectly (through a test system) in a Security Program.

Cobalt Content - Means all Content that Cobalt makes available through the Services, and includes without limitation any data, documents, screens, templates, and forms of reports.  Cobalt Content expressly excludes Customer Content.

Collective Content - Customer Data and Cobalt Content.

Content - Text, graphics, images, music, software, audio, video, information or other materials.

Credit - The prepaid unit purchased by Customer which can be exchanged for Cobalt Services. Each Credit corresponds to a particular level of effort by one Security Pentester.

Customer Data - Any Content or information relating to the Applications/Networks, the Applications/Networks and any other data, documents, information or content provided by or made accessible by Customer to Cobalt in connection with Customer’s use of the Services.

Intellectual Property Rights - Any and all registered and unregistered rights granted, applied for or otherwise now or hereafter in existence under or related to any patent, copyright, trademark, trade secret, database protection or other intellectual property rights laws, and all similar or equivalent rights or forms of protection, in any part of the world.

Network(s) - Interconnected computers, servers, mainframes, network devices, peripherals, or other devices that share software and hardware resources between many users.

Personal Information - Any information relating to an identified or identifiable natural person or otherwise defined to be personal information under Applicable Law, including without limitation, “personal data” as used under the EU’s General Data Protection Regulation.

Professional Services - Cybersecurity services provided by Cobalt to Customer pursuant to a separately executed statement of work (“SOW”) or similar document, excluding penetration testing services provided via the Services and Site. Professional Services are subject to the Cobalt Professional Services Addendum.

Sales Order - A transactional document (either an order form or statement of work) referencing this Agreement, which has been mutually agreed to by the parties either (i) in a mutually signed writing on Cobalt’s template Sales Order form  or (ii) by a Customer issued purchase order expressly referencing a Cobalt provided Sales Order form (either electronically or in writing as provided above); provided that if Customer purchases the Services through a Cobalt reseller, the Sales Order shall be the transactional document entered into between Cobalt and the Cobalt reseller for Customer’s use.

Security Pentester - An individual who offers by signing up and/or is invited to be a Security Pentester on the Site in order to engage in testing of an Application/Network within the scope of a Security Program and to submit a Vulnerability Report confidentially to Customer via the Site.

Security Program - The scope of Services listed on the Site for Customer’s Application(s)/Network(s) to be completed by Security Pentester(s).

Services - The Cobalt online platform accessible via the Site (including the Site and all Cobalt Content on the Site) connecting Customers with Security Pentesters for Applications/Network testing, and the ensuing cybersecurity testing performed leveraging the Site and the Security Pentesters. The Services specifically exclude all Applications/Network(s) and Customer Data.

Site - The Cobalt websites where the Services are made available located at cobalt.io.

User - An employee or contractor of Customer who is authorized by Customer to use the Services via Customer’s Cobalt Account by provisioning access to the Site via the assignable roles associated with use of the Services.

Vulnerability Report - A confidential report submitted and listed by a Security Pentester containing security vulnerabilities found during the testing of the Application(s)/Network(s) in scope for a given Security Program.