WEBINAR
Learn how software development company Personio takes a strategic approach to pentesting.
REGISTER NOW
WEBINAR
Learn how software development company Personio takes a strategic approach to pentesting.
REGISTER NOW

Terms & Conditions

  • Platform Services Agreement

    IMPORTANT, READ CAREFULLY: CUSTOMER’S USE OF AND ACCESS TO THE SERVICES OF COBALT LABS, INC. ARE CONTINGENT UPON CUSTOMER’S COMPLIANCE WITH, AND ACCEPTANCE OF THIS PLATFORM SERVICES AGREEMENT.  BY CUSTOMER BY EXECUTING A SALES ORDER OR SOW THAT REFERENCES THESE TERMS, CUSTOMER AGREES TO ALL OF THE TERMS AND CONDITIONS STATED HEREIN. 

    These terms were last updated on April 1, 2025, and the Agreement shall be effective between Customer and Cobalt as of the Effective Date of the Sales Order executed by both parties.

    Scope of this Agreement, Other Terms

    This Platform Services Agreement, together with any Sales Order(s), SOW(s), Addenda, Supplemental Terms or Third-Party Terms, if any, form the “Agreement” and govern the access to, and use of the Services provided by Cobalt Labs, Inc., a Delaware corporation, with a principle place of business located at 575 Market Street, 4th Floor, San Francisco, CA 94105, USA, together with our Affiliates (“Cobalt”) to the entity identified on any applicable Sales Order or SOW as the Customer (the “Customer”). This Agreement shall be effective as of the date of last signature recorded on such Sales Order or SOW. Customer and Cobalt may be referred to collectively as “Parties” and individually as a “Party”. All other capitalized terms shall have the meaning ascribed to Section 1 or as defined elsewhere in the Agreement.

    This Agreement makes reference to a number of other supplemental terms which Customer may also be agreeing to by accepting the terms of this Agreement, and which on this page’s Navigation Menu (the "Supplemental Terms").  Cobalt reserves the right to update the Supplemental Terms at any time. 

    In the event of any inconsistency or conflict between the terms of this Agreement, any applicable Supplemental Terms, and any Sales Order(s) or SOW(s) executed hereunder, the terms of the Sales Order(s) or SOW(s) shall prevail over any conflicting terms in this Agreement or the Supplemental Terms. The terms of this Agreement shall prevail over any conflicting terms in the Supplemental Terms. The Supplemental Terms shall apply only to the extent that they do not conflict with any Sales Order(s), SOW(s), or the terms of this Agreement.

    1. Definitions.

    1.1 “Affiliate” shall mean any entity controlled by, controlling, or under common control with a Party to this Agreement during the period such control exists. For the purposes hereof “control” means the power to direct the operation, policies and management of an entity through the ownership of more than fifty percent (50%) of the voting securities of such entity, by contract, or otherwise.

    1.2 “Applicable Laws” shall mean any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, directive, common law, judgment, decree or other requirement or rule of any federal, state, local or foreign government or political subdivision thereof, or any arbitrator, court or tribunal of competent jurisdiction applicable to a Party’s performance of its obligations or the exercise of its rights under this Agreement.

    1.3 “Asset(s)” shall mean Customer’s (or a third-party’s) software applications, networks, systems, IP addresses, hardware, and or other assets that are to be tested via a Security Program.

    1.4 “Cobalt Account” shall mean Customer’s account on the Platform.

    1.5 “Cobalt Content” shall mean all Content that Cobalt makes available through the Platform, and includes without limitation any data, documents, screens, templates, and forms of reports. Cobalt Content expressly excludes Customer Data. 

    1.6 “Content” shall mean text, graphics, images, music, software, audio, video, and other information. 

    1.7 “Credit” shall mean the prepaid unit purchased by Customer which can be exchanged for Platform Services, Professional Services, or for other offerings as allowed by Cobalt. Each Credit corresponds to a particular level of effort by Cobalt.

    1.8 “Customer Data” shall mean the Assets, any Content, data, documents, or any other information provided by Customer to Cobalt in connection with Customer’s use of the Platform.

    1.9 “DAST Target” means a single, unique URL, application or website, owned by the Customer and running in a specified Customer environment, which is assigned to be scanned by Cobalt.

    1.10 “Intellectual Property Rights” shall mean any and all registered and unregistered rights granted, applied for or otherwise now or hereafter in existence under or related to any patent, copyright, trademark, trade secret, database protection or other intellectual property rights laws, and all similar or equivalent rights or forms of protection, in any part of the world.

    1.11 “Personal Information” shall mean any information relating to an identified or identifiable natural person or as otherwise defined under Applicable Laws, including without limitation, “personal data” as used under the EU’s General Data Protection Regulation and under the UK’s Data Protection Act of 2018, and “personal information” as used under applicable California law. 

    1.12 “Platform” shall mean the platform provided by Cobalt to Customer in connection with the Services, which includes all related software, interfaces, tools, utilities, and other technologies (and any related intellectual property), where Customer is able to request the Services.

    1.13 “Platform Services” shall mean the services available via the Platform, including, but limited to, Platform features that allow for connecting the Customer with Security Professionals providing Asset testing.

    1.14 “Professional Services” shall mean cybersecurity services provided by Cobalt to Customer pursuant to a separately executed statement of work (“SOW”) or similar document, excluding the Platform Services and Platform itself. Professional Services are subject to the Cobalt Professional Services Addendum. SOWs shall commence on the Start Date and remain in effect until the occurrence of the End Date, each as defined in the SOW inself.

    1.15 “Sales Order(s)” shall mean a transactional document referencing this Agreement, which has been agreed to by the Parties in a mutually signed writing for the purchase of Credits.

    1.16 “Security Professional(s)” shall mean any individuals or third-parties who provide the Services on behalf of Cobalt.

    1.17 “Security Program” shall mean the scope of Services listed on the Platform for Customer’s Asset(s) to be completed by Security Professional(s).

    1.18 “Services” shall mean collectively, any of the Platform Services or Professional Services so ordered by the Customer under this Agreement.

    1.19 “Third-Party Terms” means any end-user license agreement or pass-through terms and conditions that may govern or form portions of Cobalt’s Platform Service offerings. Such Third-Party Terms will be made available at the time of Customer’s ordering of such service offerings, and may be changed at any-time by Cobalt’s third-party partners or providers of such service offerings.

    1.20 “Usage Parameters” means the maximum number of permitted DAST scan Targets using Cobalt’s DAST solution as specified in Sales Order and any other parameters specified in the Sales Order. 

    1.21 “User” shall mean an employee, contractor, or agent of Customer who is authorized by Customer to use the Platform. 

    1.22 “Vulnerability Reports” shall mean a confidential report created by a Security Professional and provided to Customer via the Platform, containing security vulnerabilities found during the testing of the Asset(s) in scope for a given Security Program.

    2.  Sales Orders, Invoicing and Payment.

    2.1 Sales Orders. Credits are ordered via Sales Orders, each of which shall be deemed to be incorporated herein by reference. Each Sales Order shall specify, as applicable, the Credits Tier ordered, the quantity of Credits, the fees and the term of the Sales Order (“Service Period”). A Customer Affiliate may enter into a Sales Order pursuant to this Agreement, by which the Affiliate agrees to be bound by the terms and conditions of this Agreement; provided, that the Customer shall be responsible for any of its Affiliates’ compliance with the terms and conditions of this Agreement. Notwithstanding anything to the contrary in the remainder of the Agreement, in the event that any components of the Services necessary to provide any of the Services ceases to be available to Cobalt or is reduced in quality by a third-party provider, Cobalt may terminate such Services (or any portions thereof) by providing Customer with written notice of such termination.

    2.2 Invoicing and Payment.  Cobalt will invoice Customer as set forth in the Sales Order. Customer will pay all fees within fifteen (15) days of the date of the invoice, unless otherwise set forth in the Sales Order; provided, that notwithstanding the Sales Order, if Credits are used in advance of full payment being made, Cobalt may invoice immediately. All fees shall be payable via automated clearing house payment (“ACH”) or wire transfer in accordance with the terms herein. Invoices will be sent by email to the address provided in the applicable Service Order or as otherwise provided by Customer in writing, and shall be deemed received when sent to such address. Unless otherwise stated, all fees specified on a Service Order or SOW do not include any local, state, federal, or other taxes or duties of any kind (“Taxes”). Customer shall be responsible for paying all Taxes, excluding any Taxes based on Cobalt’s or its Affiliates’ income. If Customer or any of its Affiliates has the legal obligation to pay or collect Taxes in any jurisdiction, Customer shall be responsible for such Taxes and the appropriate amount shall be invoiced to and paid by Customer, unless Customer provides to Cobalt a valid tax exemption certificate authorized by the appropriate taxing authority. Any overdue invoices will accrue late interest at the rate of one and one-half percent (1.5%) of the outstanding balance per month or the greatest amount allowed by Applicable Laws, whichever is lower, plus all expenses of collection.

    2.3 Suspension of Service for Non-Payment. Cobalt may suspend access to the Platform and Services upon written notice of non-payment of any undisputed invoice. Cobalt will not suspend Customer’s access to the Platform or Services while the Parties are disputing the applicable charges in good faith, and are cooperating diligently to resolve the dispute. 

    2.4 Price Changes. Future renewals or orders of any Credits or Services purchased will occur at the then-current price, except in the event of an auto-renewal pursuant to Section 2.5 where Cobalt does not provide notice to Customer of a price change.

    2.5 Autorenewal. Each Sales Order shall remain in effect for the Service Period as specified in the applicable Sales Order, and will automatically renew for additional terms of one (1) year on an annual basis, or as otherwise provided for in the Sales Order, unless notice of non-renewal is provided at least sixty (60) days prior to the end of the then-current Service Period of the Sales Order (“Notice Period”). In the event of any price changes pursuant to an autorenewal, Cobalt will notify Customer at least thirty (30) days prior to the Notice Period.

    3.  Services

    3.1 Credits. Cobalt will scope Services based on projected level of effort as expressed in Credits. Credits will be added to Customer’s Cobalt Account after purchase via a Sales Order. The features associated with each Credit will vary depending on the applicable Tier, as defined herein, to which Customer has purchased. The price and Tier associated with a purchased Credit will be set forth in an applicable Sales Order. Credits must be used by the end of the applicable Service Period, or annual term within said Service Period. For the purposes of this Section, “used” means the completion of any Security Program for which the Credits are allocated.

    3.2 Tiers. Access to Cobalt’s Services is provisioned across service levels that define the features and functionality associated with Customer’s Cobalt Account (“Tiers”). The features and functionality associated with each Tier is more fully set out on https://www.cobalt.io/pentest-pricing  or as further detailed in an engagement brief on the Platform. The Tier associated with Customer’s Cobalt Account will be selected on the applicable Sales Order. A Customer’s Cobalt Account may only be associated with one Tier at a time during the Service Period. Tiers may be upgraded, but not downgraded, prior to the end of the Service Period. 

    3.3 Vulnerability Report. Cobalt will produce a Vulnerability Report detailing findings uncovered during performance of the Services. Vulnerability Reports are not customizable, except where Customer’s Credit Tier includes Vulnerability Report customization. Cobalt acts as a third-party assessor and possesses a degree of independence in formulating its findings (as articulated via a Vulnerability Report) and as such, Cobalt will not remove or minimize findings in a Vulnerability Report at a Customer’s request without a sufficient factual basis for so doing.

    3.4 Security Professionals. Security Professionals are independent third-parties who are retained by Cobalt to assist in providing certain Services. Customer acknowledges that Security Professionals are not contingent workers engaged directly by the Customer. Customer may not enter into contracts directly with Security Professionals. Cobalt will not facilitate the exchange of, or execution of, any agreements directly between Security Professionals and Customer, including without limitation, any non-disclosure agreement, confidentiality agreement, or similar document.

    3.4.1 Vetting and Selection of Security Professionals. Each Security Professional will have undergone a background check consisting of identity confirmation and criminal background screening (a “Background Check”) in advance of providing services to Cobalt. The Background Check will minimally cover criminal conduct over a period of time to be determined by Cobalt, in its sole discretion, but in all cases shall be limited to the time periods permissible under Applicable Laws. Security Professionals will not perform Services for a Customer without their first having satisfactorily passed the Background Check.

    3.4.2 Security Professional Eligibility. Security Professionals shall not be: (a) a resident or national of any country subject to a United States embargo or other similar United States export restrictions; (b) on the United States Treasury Department’s list of Specifically Designated Nationals as defined under Applicable Laws; (c) on the United States Department of Commerce’s Denied Persons List or Entity List as defined under Applicable Laws; or (d) identified by the United States government as a prohibited end-user of United States export controlled items or otherwise subject to sanctions or similar laws, regulations, or executive orders.

    3.4.3 Special Requests. For Customers at the Enterprise Tier, Cobalt will accommodate certain special requests regarding the Security Professionals performing Services for the Customer. Special requests are limited to: (a) staffing a test with Security Professionals from a specific region or time zone, and (b) ensuring that Security Professionals communicate with Customer and/or perform testing at specified times. Other special requests may be facilitated on a case-by-case basis, at Cobalt’s sole discretion. All special requests are subject to Cobalt’s availability and capacity. Cobalt may not be able to accommodate more than one (1) such request per engagement. Customers should communicate with their Cobalt-assigned CSM to determine whether a particular request may be accommodated.

    3.5 Professional Services. Any provision of Professional Services will be scoped, in advance, on a per engagement basis via an SOW and shall be additionally subject to terms set forth in the Cobalt Professional Services Addendum. The Professional Services Addendum will only be applicable in the event that Customer has ordered Professional Services via an SOW.

    3.6 Informational Support. During the Service Period, Cobalt will provide reasonable support to Customer relating to the use and operation of the Services.

    3.7 Cobalt Personnel, Platform and Services. Cobalt shall have sole discretion in staffing of Platform Services or Professional Services. Customer hereby acknowledges that certain Services may be performed by subcontractors, which may include Cobalt’s Affiliates or partners. Cobalt may change subcontractors at any time, in its sole discretion. Cobalt acknowledges that it is responsible and shall be liable for the performance of any such subcontractors pursuant to the terms of this Agreement. Cobalt reserves the right, at its sole discretion, to modify, enhance, or remove features of the Platform or Services; provided that such modifications do not materially diminish the functionality of the Services.

    4.  Customer Obligations.

    4.1 User Eligibility. Customer represents and warrants that each User is not: (a) residing in, or accessing the Services for the benefit of any person(s), entity(ies), or government of, any country subject to a United States embargo or other similar United States export restrictions; (b) on the United States Treasury Department’s list of Specifically Designated Nationals as defined under Applicable Laws; (c) on the United States Department of Commerce Denied Persons List or Entity List as defined under Applicable Laws; or (d) identified by the United States government as a prohibited end-user of United States export controlled items or otherwise subject to sanctions or similar laws, regulations, or executive orders. 

    4.2 Authorization. The Customer permits Cobalt to access the Customer's Assets and Customer Data to enable the Services, which constitutes authorization under the Computer Fraud and Abuse Act, the Computer Misuse Act 1990, Directive 2013/40/EU and similar laws and regulations as applicable to the Customer and/or the Services, and represents and warrants that it has the authority, and will maintain such authority, at all times throughout the Term of this Agreement, to give such permission. Customer is responsible for obtaining all necessary authorizations and permissions required or necessary for Cobalt to provide the Services. By submitting a Security Program for review, Customer represents and warrants that it has obtained any and all such authorizations and permissions, including, but not limited to, those from any cloud hosting providers, network owners, and any other relevant parties.

    4.3 DAST Customers Scanning Limits. Customer is subject to, and shall not exceed, the Usages Parameters associated with Customer’s DAST scan Sales Order. Customers should consult the text of their Sales Order to confirm the Usage Parameters applicable to their DAST subscription. Cobalt may, in the event of any usage overage, invoice Customer immediately for such overages, and suspend Customer’s access to the entire Platform until such amount are paid.

    5. Intellectual Property Rights.

    5.1 Cobalt Property. Customer acknowledges and agrees that Cobalt and/or its licensors own all right, title and interest to the Platform, Services and Cobalt Content, including without limitation any techniques, ideas, concepts, methods, processes, software, utilities, data, documents, directories, designs, user interfaces, know-how, graphics, video content or other data or information acquired, created, developed or licensed by Cobalt and/or its licensors and all modifications, improvements and derivative works thereof and all associated Intellectual Property Rights (collectively as “Cobalt Property”).

    5.2 Customer Property. The Parties acknowledge and agree that Customer and/or its licensors own all right, title and interest to the Assets and any Customer Data made available by the Customer through the Platform or Services and any findings contained in the Vulnerability Reports created specifically and uniquely for the Customer, but excluding any third-party intellectual property, Cobalt Property, and any Intellectual Property Rights therein.

    5.3 Proprietary Rights Notice. All trademarks, service marks, logos, trade names and any other proprietary designations of Cobalt used herein are trademarks or registered trademarks of Cobalt. Any other trademarks, service marks, logos, trade names and any other proprietary designations are the trademarks or registered trademarks of their respective Parties.

    6. License Grants.

    6.1 Cobalt Platform and Services License Grant. Cobalt grants Customer a limited, world-wide, non-exclusive, non-transferable, royalty-free, non-sublicensable right and license, during the Service Period  specified in a Sales Order, to (i) access and use the Platform and Services in accordance with the terms of this Agreement; and (ii) access and view any Cobalt Content contained on the Platform solely for Customer’s internal use in connection with Customer’s use of the Services. Except as provided herein, Customer shall have no right to make the Platform, Services or Cobalt Content available to, use the Platform, Services or Cobalt Content on behalf of, or for the benefit of any third-party without Cobalt’s express written authorization. Except for the rights expressly licensed to Customer hereunder, Cobalt and its licensors reserve and retain all right, title and interest to the Platform, Services and Cobalt Content.

    6.2 Statistical Data and Product Development. Customer consents to Cobalt’s collection of high-level, generic, anonymous, statistical and/or benchmarking data derived from portions of Customer Data and Customer’s usage of the Platform and the Services that will be aggregated with other findings, results and information derived from Cobalt’s other customer’s data and usage information (the “Statistical Data”). Cobalt shall adhere to the principle of data minimization, collecting only the portions Customer Data and Customer’s usage data that is directly relevant and necessary for the specified purposes of generating Statistical Data, benchmarking, the development of Product Derivatives, and for conducting Functionality Testing, as described and defined in this section. All such Statistical Data is the sole and exclusive intellectual property of Cobalt; provided, that Cobalt shall in all cases refrain from publishing any Statistical Data or any insights or work derived therefrom in a manner that reveals (directly or indirectly) any specific person, Customer, Customer Data, Customer Confidential Information or Asset. Further, Cobalt may prepare new and derivative products and/or services incorporating, and based upon, the usage activity, statistics, service configurations, and the Statistical Data, and that of Cobalt’s other customers (“Product Derivative(s)”) including, but not limited to, the development of certain machine language models (“MLMs”) and artificial intelligence (“AI”) tools. Cobalt may also utilize Statistical Data to test future functionality of Cobalt’s Services (the “Functionality Testing Right”); provided that, such Functionality Testing Right will not compromise Customer’s or Customer’s access to, or integrity of Customer Data within the Platform. Cobalt shall own all right, title and license in the results of any Product Derivative(s) and Functionality Testing Right results, which it may use in its own research, marketing and other commercial services, offerings or activities. 

    6.3 Customer Data License Grant. Customer grants to Cobalt a worldwide, non-exclusive, non-transferable, royalty-free license and right to, during the Service Period, (i) use, access, view, copy, display, transmit and store Customer Data on, through or by means of the Platform and Services solely to the extent necessary to operate, maintain, perform, and provide the Platform and Services, (ii) use, access, view, copy, and display, information relating to the Asset(s) solely to the extent necessary to engage in testing and/or create the Vulnerability Reports or otherwise perform tasks in connection with the Security Program; and (iii) create, view, display, transmit and store Vulnerability Reports. Customer acknowledges that this license grant extends, to the extent necessary to facilitate performance of the Services, to Cobalt’s personnel and Security Professionals. Except as expressly licensed herein, Customer shall retain all right, title and/or interest to Customer Data, the Asset(s) and all intellectual property rights therein, and except as expressly licensed herein, Cobalt shall obtain no right or license thereto.

    6.4 Vulnerability Report. Subject to the limitations set forth in Section 14.2 below, Cobalt grants Customer a limited, world-wide, non-exclusive, non-transferable, royalty-free, non-sublicensable right and license to use or share the Vulnerability Report(s) for Customer’s legitimate business purposes, provided that Customer is not acting as a reseller of Cobalt’s Services in this capacity.

    7. Confidentiality.

    7.1 Confidential Information. Throughout the term of the Agreement the Parties may need to exchange or make available confidential and proprietary information to the other Party in connection with this Agreement, whether disclosed in written, oral, electronic or visual form, which is identified as confidential at the time of disclosure or should reasonably be understood to be confidential given the nature of the information or the circumstances surrounding the disclosure, including without limitation business, operations, finances, technologies, products and services, pricing, personnel, customers and suppliers (“Confidential Information”). Without limiting the foregoing, (i) Cobalt Confidential Information shall include Cobalt Property; and (ii) Customer Confidential Information shall include Customer Data and the Asset(s), and findings in a Vulnerability Report. 

    7.2 Confidentiality. During the Term, and continuing after expiration or termination of the Agreement, each Party shall retain in confidence, and not use (except for the purposes described in this Agreement), the Confidential Information of the other Party. The receiving Party will use the same degree of care and discretion (but not less than reasonable care) to avoid disclosure, publication or dissemination of the disclosing Party’s Confidential Information as it uses with its own confidential or proprietary information of a similar nature. Except as authorized in this Agreement or a Sales Order, the receiving Party will not disclose the Confidential Information of the disclosing Party to a third-party other than Security Professionals, sub-contractors, or to its or its Affiliates’ employees, contractors, agents or advisors in connection with its performance of this Agreement who are bound by terms no less protective of a disclosing Party’s rights as those set forth in this Agreement and the receiving Party shall be liable to the disclosing Party for any violation of this Agreement by such persons. This Section 7 of the Agreement shall supersede and replace any confidentiality or non-disclosure agreement signed by the Parties prior to the Effective Date.

    7.3 Exclusions. Confidential Information shall not include information that (a) is publicly known at the time of disclosure, (b) is lawfully received from a third-party not bound in a confidential relationship with the disclosing Party, (c) is published or otherwise made known to the public by the disclosing Party, or (d) was or is generated independently without use of the disclosing Party’s Confidential Information. The receiving Party may disclose Confidential Information as required to comply with orders of governmental entities that have jurisdiction over it or as otherwise required by law, provided that the receiving Party (i) gives the disclosing Party reasonable advance written notice to allow the disclosing Party to seek a protective order or other appropriate remedy (except to the extent that compliance with the foregoing would cause it to violate an order of the governmental entity or other legal requirement), (ii) discloses only that portion of the Confidential Information as is required, and (iii) cooperates with the disclosing Party to obtain confidential treatment for any Confidential Information so disclosed. Notwithstanding anything herein to the contrary, provided that Cobalt does not use or disclose Customer Confidential Information, Cobalt shall be free to use, exploit and disclose its general skills, concepts, ideas, know-how, and expertise gained or learned during the course of this Agreement, and Cobalt shall not be restricted from creating output for other Customers which is similar to that provided to Customer.

    7.4 Remedies. Due to the unique nature of Confidential Information gained through the Services, the Parties acknowledge that the breach of this Section 7 could cause irreparable harm, which monetary damages would be insufficient to remedy and in the event of such a breach, or threatened breach, the non-breaching Party shall be entitled to seek injunctive relief, as well as any other remedy which may be available at law or in equity.

    8. Security.

    8.1 Cobalt Security Obligations. Cobalt agrees to take commercially reasonable technical and organizational measures designed to secure the Cobalt Platform from unauthorized access or use, including maintaining the security standards at https://www.cobalt.io/security/practices.

    8.2 Customer Security Obligations. Customer shall maintain appropriate security for the Customer Data in transit and shall be responsible for backing up Customer Data stored on Customer’s computer systems. 

    8.3 PII. Customer acknowledges that it will endeavor to preclude or limit to the greatest extent possible, the exposure of Security Professionals to any personally identifiable information, except as necessary for Customer’s establishment of its Cobalt Account, any patient, medical or other protected health information regulated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) or any similar federal or state laws, rules or regulations or any other information subject to regulation or protection under Applicable Laws such as, without limitation, the Gramm-Leach-Bliley Act (or related rules or regulations) (collectively, “PII”), in Asset(s) tested via the Services. Where any PII will be present in Asset(s) tested via the Services, Customer will advise Cobalt and the Security Professionals of that fact through the Security Program. Where Customer is subject to laws or regulations requiring PII processing activities be addressed via a data processing agreement, service provider agreement or similar (such as, without limitation, GDPR, CCPA, and like legislation and implementing regulations), any processing activities will be subject to a Cobalt Data Processing Agreement, pursuant to Section 8.4 below.

    8.4 DPA. Unless otherwise requested and specifically agreed to in a Sales Order, Customer Data will be warehoused in Cobalt’s North American Data Center (“NADC”). If Customer will provide Cobalt with access to any PII or other similar protected information, Customer agrees to the terms of Cobalt’s Standard Data Processing Agreement (“DPA-NA”), which is hereby incorporated by reference into the terms of this Agreement. If Customer so elects to be warehoused in the Cobalt’s European Data Center (“EUDC”) in a Sales Order, and Customer will provide Cobalt with access to any PII or other similar protected information, Customer shall agree to the terms of Cobalt’s European Data Processing Agreement (“DPA-EU”), which must be signed prior to the granting of access to such PII by Customer, and which, once executed by both Parties, shall hereby incorporated by reference into the terms of this Agreement. 

    8.5 BAA. If Customer is a Covered Entity, as defined by HIPAA, and will be providing Cobalt with access to Protected Health Information (“PHI”), Customer agrees to the terms of Cobalt’s Business Associate Agreement (“BAA”), which, once executed by both Parties, shall be incorporated by reference into the terms of this Agreement.

    9. Warranties.

    9.1 Customer Warranty. Customer warrants that: (i) Customer either is the sole and exclusive owner of all Customer Data and Asset(s) made available or accessed through the Platform or Services or Customer has obtained all necessary legal rights, licenses, consents, permissions, approvals and releases to grant to Cobalt and its Security Professionals the rights to such Customer Data and Asset(s), as contemplated under this Agreement; (ii) neither the Customer Data nor Customer’s posting, uploading, publication, sublicensing, submission or transmittal of any Customer Data or Cobalt’s or Security Professionals’ use of or access to the Customer Data (or any portion thereof) or Asset(s) on, through or by means of the Platform and the Services will infringe, misappropriate or violate any third-party Intellectual Property Rights, contractual rights or rights of publicity or privacy, or result in the violation of any Applicable Laws; and (iii) Customer shall comply with all Applicable Laws relating to its performance under this Agreement.

    9.2 Cobalt Warranty. Cobalt warrants that: (i) Cobalt either is the sole and exclusive owner of all Cobalt Content and the Platform or Cobalt has obtained all necessary legal rights, licenses, consents, permissions, approvals and releases to grant to Customer the right to such Cobalt Content and the Platform, as contemplated under this Agreement; (ii) Cobalt shall comply with all Applicable Laws relating to its performance under this Agreement; (iii) Cobalt shall provide the Platform Services in a professional manner and will provide a standard of care consistent with that used by service providers similar to Cobalt, and that Cobalt shall deliver the Platform Services substantially in conformity with this Agreement; and (iv) the Security Professionals have the general skills and expertise necessary to perform the Services. In order to state a claim for breach of Section 9.2 (iii) or (iv), Customer must provide notice of such non-compliance within the thirty (30) day period following the delivery of a Vulnerability Report, specifying the details of such noncompliance. If Customer provides Cobalt with the required notice, as Customer’s sole and exclusive remedy and Cobalt’s sole and exclusive liability for breach under this Section 9.2 (iii) or (iv), Cobalt shall, at the Customer’s request and option, either extend the period of testing to perform additional testing or reperform the Platform Services using different Security Professionals. This Section 9.2 (iii) and (iv) shall not apply during any trial license period.

    9.3 Disclaimers. 

    9.3.1 EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH ABOVE, THE PLATFORM AND SERVICES ARE PROVIDED "AS IS", WITHOUT ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT LIMITING THE FOREGOING, COBALT EXPLICITLY DISCLAIMS ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, AND ANY WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE. COBALT MAKES NO WARRANTY THAT THE SERVICES WILL MEET CUSTOMER’S REQUIREMENTS OR BE AVAILABLE ON AN UNINTERRUPTED, SECURE, OR ERROR-FREE BASIS. COBALT DOES NOT GUARANTEE THAT THE SERVICES WILL REVEAL ALL SECURITY VULNERABILITIES, OR MALICIOUS CODE IN CUSTOMER’S ASSETS. NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED FROM COBALT OR THROUGH THE PLATFORM OR SERVICES, WILL CREATE ANY WARRANTY NOT EXPRESSLY MADE HEREIN.

    9.3.2 ANY AND ALL WARRANTIES PROVIDED BY COBALT HEREIN ARE VOID TO THE EXTENT THE SERVICES (I) FAILS TO CONFORM TO ANY OR ALL SUCH WARRANTIES AS A RESULT OF THE SERVICES’ USE WITH ANY THIRD-PARTY SOFTWARE OTHER THAN AS EXPRESSLY AUTHORIZED BY COBALT; OR (II) IS USED OTHER THAN IN ACCORDANCE WITH PUBLISHED DOCUMENTATION OR OTHERWISE IS USED IN BREACH OF THIS AGREEMENT.

    10. Indemnification

    10.1 Mutual Indemnification. Each Party (the “Indemnifying Party”) will indemnify, defend and hold harmless the other Party and its Affiliates, subsidiaries, permitted successors in interests and assigns and its and their respective officers, directors, employees, and agents, from and against any and all third-party claims, actions, demands or lawsuits arising out of performance of this Agreement, and any resulting judgments, damages, liabilities, fines, penalties, losses, costs and expenses (including reasonable attorneys’ fees) or any amounts paid in settlement thereof (collectively “Claim(s)”) subject to the conditions herein, to the extent arising out of or relating to: (i) the gross negligence or willful misconduct of the Indemnifying Party; or (ii) any act or omission by the Indemnifying Party that results in personal injury or death.

    10.2 Customer Indemnity. Customer agrees to defend, indemnify, and hold Cobalt and its Affiliates and their officers, directors, employees, contractors, and agents harmless from and against any Claims arising out of any third-party claim arising out of (i) Customer’s collection, processing, or submission of Customer Data; (ii) Customer’s infringement, misappropriation or violation of any third-party Intellectual Property Rights, contractual rights or rights of publicity or privacy; or (iii) Customer’s actions resulting in Services being performed on an unauthorized Asset.


    10.3 Cobalt Indemnity. Cobalt agrees to defend, indemnify, and hold Customer and its Affiliates (only to the extent such Affiliates have entered into Sales Orders hereunder) and their officers, directors, employees and agents harmless from and against any Claims,  arising out of any third-party claim arising out of the infringement or violation of the Platform of the Intellectual Property Rights of a third-party; provided that Cobalt shall not be responsible to provide any such indemnity for any Claim to the extent arising out of (i) Customer Data; or (ii) use of the Platform or Services in an unauthorized manner.

    10.4 Indemnity Process. The indemnifying Party shall conduct and have sole control of the defense and settlement of any claim for which it has agreed to provide indemnification; provided that no settlement shall require the indemnified to admit liability. The indemnified Party shall have the right to provide for its separate defense at its own expense. The indemnified Party shall give prompt notice of all claims for which indemnity is sought and shall cooperate in defending against such claims, at the expense of the indemnifying Party. The rights and remedies set forth in this Section 10 state each Party’s exclusive liability and exclusive rights and remedies with regard to claims made by a third-party for intellectual property infringement or violation of a third-party’s intellectual property rights.

    11. Limitations and Exclusions of Liability and Damages.  

    11.1 Limitations of Liability. EXCEPT FOR EACH PARTY’S OBLIGATIONS UNDER SECTIONS 7 AND 10.1 ABOVE,  AND FOR CUSTOMER’S OBLIGATIONS UNDER SECTIONS 4, 6, AND 10.2 ABOVE, IN NO EVENT SHALL EITHER PARTY’S, OR ITS AFFILIATES’ AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, EXCEED THE LESSER OF: (I) THE NON-BREACHING PARTY’S ACTUAL DIRECT DAMAGES; OR (II) THE AGGREGATE AMOUNTS PAID AND PAYABLE BY CUSTOMER TO COBALT IN THE TWELVE (12) MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO THE LIABILITY.

    11.2 Exclusion of Consequential and Related Damages. IN NO EVENT SHALL EITHER PARTY, NOR THEIR AFFILIATES’ HAVE ANY LIABILITY TO THE OTHER FOR ANY LOST PROFITS, REVENUES (EXCEPT FOR ANY FEES OWED PURSUANT TO THIS AGREEMENT), LOSS OF USE, LOSS OF OR DAMAGE TO SOFTWARE OR DATA OR LOSS OF GOODWILL, SERVICE INTERRUPTION, COMPUTER DAMAGE OR SYSTEM FAILURE, COSTS OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, GOODWILL ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE SERVICES, FROM ANY COMMUNICATIONS OR INTERACTIONS WITH OTHER USERS OF THE PLATFORM OR SERVICES OR FOR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE OR CONSEQUENTIAL DAMAGES (COLLECTIVELY, “INDIRECT DAMAGES”) HOWEVER CAUSED AND WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, WHETHER OR NOT THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH INDIRECT DAMAGES.

    11.3 Super Cap.  NOTWITHSTANDING ANYTHING HEREIN TO THE CONTRARY, THE LIMITATIONS AND EXCLUSIONS OF LIABILITY SET FORTH IN SECTIONS 11.1 OR 11.2 HEREOF SHALL NOT APPLY TO EITHER PARTY’S (I) INDEMNIFICATION OBLIGATIONS HEREUNDER, (II) BREACH OF CONFIDENTIALITY (SECTION 7) OR DATA SECURITY OBLIGATIONS HEREUNDER; (III) VIOLATION OR INFRINGEMENT OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS (THE “EXCLUDED CLAIMS”); PROVIDED THAT NEITHER PARTY’S TOTAL AGGREGATE LIABILITY FOR THE EXCLUDED CLAIMS SHALL NOT EXCEED THE LESSER OF: (I) THE NON-BREACHING PARTY’S ACTUAL DIRECT DAMAGES; (II) FIVE HUNDRED THOUSAND US DOLLARS ($500,000 USD), OR (III) THREE TIMES (3X) THE AGGREGATE AMOUNTS PAID AND PAYABLE BY CUSTOMER TO COBALT IN THE TWELVE (12) MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO THE LIABILITY.

    12. Term and Termination.

    12.1 Term of Agreement.  This Agreement shall commence on the Effective Date and will continue thereafter until (i) the furthermost end date of the Service Period in the last to expire Sales Order or SOW; or (ii) where applicable, the date of termination for material breach as effectuated under Section 12.2 (the “Term”). Each Sales Order and/or SOW shall remain in effect for the Service Period (or in the case of an SOW, until the occurrence of the End Date) and the Services will be provided by Cobalt only during such time-period. 

    12.2 Termination for Cause.

    12.2.1 Either Party may terminate this Agreement for cause: (i) upon thirty (30) calendar days’ written notice of a material breach (other than non-payment) to the other party if such breach remains uncured at the expiration of such period; or (ii) with immediate effect by giving written notice to the other party, if the other party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership or liquidation or makes an assignment for the benefit of creditors. During any such cure period, Cobalt reserves the right to deactivate Customer’s passwords and/or login credentials and/or to block access to the Platform Services, whereby the fees will remain due for the period during which access was blocked and/or passwords and log-ins were deactivated, and Customer will be solely responsible for any and all consequences resulting from such blocking and/or deactivation, without recourse against or liability from Cobalt or any third-party service provider.

    12.2.2 Cobalt may terminate this Agreement with immediate effect upon written notice if, at any time, Customer becomes or is acquired by a competitor of Cobalt’s or any of its Affiliates’.

    12.2.3 Each Party shall have the right to terminate this Agreement, and all Sales Orders or SOWs subject to this Agreement, in their entirety upon written notice to the other Party if such Party materially breaches its obligations under this Agreement and, after receiving written notice identifying such material breach in reasonable detail, fails to cure such material breach within thirty (30) days from the date of such notice; provided, that Cobalt may terminate this Agreement immediately upon written notice where a breach or violation is not capable of cure. During any such cure period, Cobalt reserves the right to deactivate Customer’s passwords and/or login credentials and/or to block access to the Platform Services, whereby the fees will remain due for the period during which access was blocked and/or passwords and log-ins were deactivated, and Customer will be solely responsible for any and all consequences resulting from such blocking and/or deactivation, without recourse against or liability from Cobalt or any third-party service provider.

    12.3 Term and Termination of a Sales Order or SOW for Breach. An individual Sales Order or SOW shall not be subject to termination, except that a Sales Order or SOW may be terminated (in whole but not in part) by a Party solely if the other Party fails to cure a material breach thereof, or of this Agreement as it relates to such Sales Order or SOW, within thirty (30) days after receiving written notice of the breach from the non-breaching Party or immediately if a material breach is not capable of cure. 

    12.4 Effect of Termination. Upon any termination or expiration of this Agreement, all rights and obligations of the Parties shall end, other than their rights and obligations which are intended to survive termination. 

    12.5 Retention and Destruction of Data.  Upon any expiration or termination of this Agreement, Cobalt shall delete any Customer Data or Customer Confidential Information relating to Customer upon request, unless prohibited by law from doing so. Customer will be able to access the Platform for fourteen (14) days in order to export any reports, Customer Data, or Customer Confidential Information using the functionality within the Platform. The fourteen (14) day period may be extended by mutual agreement, on a case-by-case basis, if a longer time period is needed.

    12.6 Transition Assistance. Commencing sixty up to (60) calendar days prior to the expiration of this Agreement or any Sales Order thereof, or commencing upon any notice of termination of the Agreement or Sales Order, as applicable (except for a termination for cause by Cobalt), Cobalt shall provide to Customer termination assistance and/or migration services to facilitate Customer’s orderly transition from the Services to Customer’s alternate service provider as designated by Customer (“Transition Assistance”). Such Transition Assistance will be provided to Customer on a time and materials basis, at Cobalt’s then current billing rates for such services.

    13. FORCE MAJEURE. If the performance of any obligation hereunder is interfered with by reason of any circumstances beyond a Party’s reasonable control, including but not limited to acts of God, disease, epidemic, pandemic, labor strikes and other labor disturbances, power surges or failures mandatory government shutdowns, quarantines, lockouts, riots, acts of war, acts of insurrection, terrorism, earthquake, fire, explosions, or the act or omission of any third-party, the Party shall be excused from such performance to the extent necessary during the term of any force majeure event, provided the Party shall use reasonable efforts to remove such causes of nonperformance. If an event of force majeure prevents either Party from performing its responsibilities under this Agreement for a period of more than thirty (30) days, the other Party may terminate this Agreement and any outstanding Sales Order immediately upon written notice.

    14. PUBLICITY, REFERENCE, USE OF REPORTS, AND TRADEMARKS. 

    14.1 Customer agrees that Cobalt may use Customer’s name(s), tradename(s), trademark(s) and/or logo(s) (“Marks”) as a commercial reference, in Cobalt’s promotional materials, RFP responses, presentations, and on Cobalt’s website and/or in a customer list identifying all or a material representation of Cobalt’s or its Affiliates’ customers.  Cobalt agrees not to alter the name, tradename(s), trademark(s) or logo(s) of Customer, nor to state or imply any endorsement of Cobalt by Customer without the express written permission of Customer.


    14.2 Customer may (i) list Cobalt in Customer’s list of vendors; and (ii) utilize any of Cobalt name(s), tradename(s), trademark(s) or logo(s)) in promotion of itself utilizing Cobalt’s Vulnerability Reports on their website(s) or in any promotional materials. Customer agrees not to alter Cobalt’s name, tradename(s), trademark(s), logo(s), or the Vulnerability Report(s) produced by Cobalt for Customer, nor to state or imply any endorsement of Customer by Cobalt without the express written permission of Customer.

    15. MISCELLANEOUS.

    15.1 Insurance. Cobalt shall maintain, at all times during this Agreement, insurance coverages in at least the following minimum amounts: (i) General Liability Insurance in the amount of two million dollars ($2,000,000); (ii) Technology Errors and Omissions in the amount of five million dollars ($5,000,000); (iii) Excess Liability in the amount of five million dollars ($5,000,000). Customer may request in writing a current Certificate of Insurance during the Term.

    15.2 Assignment and Related Matters.  Except as otherwise set forth herein, neither Party may assign, transfer, or delegate this Agreement or any rights or obligations under this Agreement, in whole or in part, without the other Party’s prior written consent. Any attempt by either Party to assign, transfer, or delegate this Agreement or any rights or obligations hereunder, without such consent, will be null and of no effect. Notwithstanding the foregoing, Cobalt may assign or transfer this Agreement, without Customer’s consent, to an Affiliate or to a successor-in-interest resulting from a merger, sale of substantially all of its assets, a change of control, or by operation of law. Subject to the foregoing, this Agreement will bind and inure to the benefit of the Parties, their successors and any permitted assigns.

    15.3 Survival. Except as expressly set in this Agreement, the rights and obligations set forth in Section 2 (Sales Orders, Invoicing and Payment), Section 5 (Intellectual Property Rights), Section 6 (License Grants), Section 7 (Confidentiality), Section 9 (Warranties), Section 10 (Indemnification), Section 11 (Limitation of Liability), Section 15.4 (Governing Law), Section 15.6 (Independent Parties, Third-Party Beneficiaries), and Section 15.7 (Entire Agreement, Amendment, and Waiver) shall survive the expiration or termination of this Agreement.

    15.4 Governing Law.  The United Nations Convention on Contracts for the International Sale of Goods does not apply to the transactions contemplated by this Agreement. The Uniform Computer Information Transactions Act (“UCITA”) will not apply to this Agreement regardless of when and howsoever adopted, enacted and further amended under the governing state laws. Any claim before a court in connection with this Agreement may only be initiated by either signatory, within one (1) year of the date on which the facts giving rise to such claim are known or should have been known by the claimant.

    15.4.1 For customers located in the Americas: This Agreement and any dispute(s) or Claim(s) (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation (collectively “Dispute(s)”) shall be governed by the laws of the State of Delaware, without regard to its conflict-of-law provisions. The Parties irrevocably agree to submit to the personal jurisdiction of the Chancery Court located in New Castle County, Delaware, or the United States District Court for the State of Delaware, for any Dispute or actions for which the Parties retain the right to seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation or violation of a Party’s copyrights, trademarks, trade secrets, patents, or other intellectual property rights (“Actions”). 

    15.4.2 For customers located in the DACH region: This Agreement and any Dispute shall be governed by and construed in accordance with the laws of the Federal Republic of Germany, without regard to its conflict-of-law provisions. The parties irrevocably agree to submit to the personal jurisdiction of Kammergericht Court for the city-state of Berlin, Germany for any Dispute or Actions.

    15.4.3 For customers located anywhere else in the world: This Agreement, and any Dispute shall be governed by, and construed in accordance with, the laws of England and Wales, without regard to its conflict-of-law provisions. The Parties irrevocably agree to submit to the personal jurisdiction of Chancery Division of the High Court located in London, England for any Dispute or Actions.

    15.5 Notices.  Notices shall be sent to each Party at the address first set forth above or via e-mail. E-mail notices to Cobalt shall be sent to info@cobalt.io; with a copy to legal@cobalt.io. Email notices to Customer shall be sent to an email address listed in any Sales Order or SOW signed by such Customer.  Notices shall be deemed to be delivered (i) one day after delivery with a reputable overnight carrier, (ii) three days after deposit with US Postal Service sent first class mail, return receipt requested, or (iii) the day an e-mail is transmitted without an error or bounce-back message. 

    15.6 Independent Parties, Third-Party Beneficiaries. The relationship of the Parties is that of independent contracting Parties and Cobalt shall not be construed to be an employee, partner or agent of Customer. There are no third-party beneficiaries to this Agreement.

    15.7 Entire Agreement, Amendment and Waiver.  The terms and conditions of this Agreement (including any applicable schedules, referenced documents, rules for Running a Security Program, Sales Orders, or SOWs entered into pursuant hereto) provide the complete understanding of the Parties with regard to the subject matter hereof and supersede all previous communications, agreements, proposals or representations related to the subject matter hereof. Except as otherwise expressly provided for herein, any waiver, amendment, or modification of any right or remedy, in whole or in part under this Agreement, or any additional or different terms in, acknowledgments or other documents, will not be effective unless expressly agreed to in writing and signed by the authorized representatives the Parties. In the event of any inconsistency or conflict between the terms of this Agreement, and any terms contained within a Sales Order, SOW, or other supplemental agreement terms (including any addenda) (“Other Terms”), such Other Terms shall control. It is expressly agreed that no additional terms and conditions contained in Customer’s purchase order, internet procurement portal or other non-Cobalt document shall apply to the Platform, Services, or to this Agreement.

    This Agreement may be executed in counterparts, which, taken together, will constitute one and the same instrument. The exchange of a fully executed Agreement (in counterparts or otherwise) by electronic means or in writing shall be sufficient to bind the Parties to the terms and conditions of this Agreement and to any Sales Order or SOW.

    15.8 Feedback/Reviews. Customer agrees that Cobalt, its Affiliates, or any of their agents, may freely use, disclose, reproduce, license, distribute or otherwise exploit in any manner any feedback, comments, reviews or suggestions Customer may post in any forums or otherwise provide to Cobalt or its Affiliates about the Platform, Products, and/or Services without any obligation to Customer, without restrictions of any kind (including on account of any intellectual property rights), and without any obligation of compensation to Customer and/or any third-party.

    15.9 Subject Headings. The subject headings of this Agreement are included for purposes of convenience only and shall not affect the construction or interpretation of any of its provision. 

    15.10 Signature.  The Parties agree to the execution of this Agreement using electronic signatures. The Parties agree, to the extent necessary, that such signatures will be regarded as an original of the document. The Parties agree to use a third-party electronic signature platform designated by Cobalt; provided, that such platform conforms with any applicable framework, regulation or legislation applicable to electronic signatures. Each Party represents that the person signing the Sales Order and/or Agreement has all right, power and authority to sign this Agreement on behalf of such Party.


    _

    Archive 

    Platform Services Agreement (March 5th, 2024 - March 31st, 2025)

  • Running a Security Program
    Last updated on April 5, 2023


    IMPORTANT - READ BEFORE USING THE SITE OR SERVICES FOR RUNNING A SECURITY PROGRAM.


    These Running a Security Program terms (“Supplemental Terms”) form a part of the General Terms and you agree that you are a User of the Site and Services and you therefore have already agreed to and accepted the General Terms and Privacy Policy for being a User on the Site and Services. Terms not otherwise defined herein, shall have the meaning set forth in the General Terms.

    Security Program Time Period

    The Security Program initiates when it is listed on the Site and Services and has the status Live.

    The Security Program will run until a written deadline agreed between You  and Cobalt. This deadline will be listed on the Security Program.

    Security Pentesters can only engage in testing on programs that are in status Live and the Security Pentesters have been invited to. When a program is past the test deadline, Security Pentesters are not allowed to engage in test activities other than re-testing / Patch verification specifically requested by You.

    The date on which your test will start may depend on the Tier associated with your account. Each Tier permits test start dates within a defined minimum advance notice, measured in Business Days (“Minimum Notice Period”). For purposes of calculating the applicable period associated with your Tier, a “Business Day” falls within Cobalt Business Hours and excludes holidays and weekends, provided that a test must be assigned a test to “Planned” prior to 11 AM Pacific Standard Time of the first day of the Minimum Notice Period. “Cobalt Business Hours” are: for customers in EMEA, 8 AM - 5 PM Central European Standard Time; for customers in the Americas, 8 AM Eastern Time- 5 PM Pacific Time.  Cobalt’s commitment to initiate a test within a certain period only begins when a test is listed as “Planned” and a start date is selected. Services must be scheduled to be completed within the applicable annualized period of the Order Term. When Services that are scheduled to begin within thirty (30) days of the expiration of the one-year period associated with the applicable Credit(s), test coverage may be reduced and retesting may be precluded due to time and resource constraints. 

    Third Party Integrations

    Services may be configured to facilitate integration with certain third party software products or services leveraged by Cobalt Yous. The availability of such integrations is dependent on the specific Tier assigned to a Customer.

    Notwithstanding the foregoing, Cobalt reserves the right to deprecate any particular third party integration at its discretion.

    By accessing or using Cobalt’s third party integrations, Customerrepresents and warrants that it has obtained all necessary licenses, credentials, or other rights to facilitate Customer leveraging such third-party integrations.

    Cobalt hereby disclaims any and all obligations relative to such third party’s privacy or security posture.

    Customer uses such third party integrations at its own risk. Cobalt does not make any warranty for and shall not be held liable or accept any liability, obligation, or responsibility for any loss or damage in connection with any third party integration. Cobalt has no control over such third parties and we are not responsible for the content of their services. Cobalt provides You with third party integrations only for Your convenience. 

    Retesting

    Cobalt may offer retesting of vulnerabilities, depending on the Tier you purchased, as further described in Cobalt’s Tiers FAQ. Retesting consists of Cobalt Pentesters re-engaging via the same or similar methodologies in testing of specified vulnerabilities that were originally identified in a Cobalt Vulnerability Report. Retesting is applicable only to those vulnerabilities that you have taken steps to remediate and the intent of retesting is to validate the efficacy of your remediation efforts. Timing for retesting is at Cobalt's sole discretion. Customer cooperation with Cobalt operational requests (including without limitation, providing access to credentials and environments) is a condition to Cobalt’s retesting obligations. Cobalt Customers must request a retest by at least ten (10) days prior to the expiration of their Services term (unless Customer has executed a renewal). Retesting is subject to all terms and conditions otherwise applicable to the provision of Services by Cobalt.

    Security Program Responsibilities and Liabilities
    • You agree that you authorize Cobalt to list your program on the Site and Services.
    • You agree that you authorize invited Security Pentesters to perform tests on the Application(s)/Network(s) mentioned in scope in the Security Program.
    • You agree to take the full liability and responsibility, and release Cobalt from any liability, if anyone who is not a  Security Pentester, or other non-Cobalt personnel, is engaged in testing of the Security Program.
    • You agree that the scope, rules and all other information on the Security Program  is the entire scope, rules and information which you expect the Security Pentesters to follow if engaging in activities related to your Security Program.
    • You agree that Cobalt only provides a best practice set of rules as an example and that you as a User are fully responsible and liable for the coverage of the scope and the rules written in the Security Program.
    • You agree that you are responsible for contacting and getting, if needed, acceptance from any and all related third parties who potentially will be impacted by the activities related to the Security Program. This includes but is not limited to hosting providers.
    • You agree that you understand when you initiate the Security Program you will start receiving Vulnerability Report Submissions on the Site and Services. This means that Cobalt will store these Vulnerability Reports on the Site and Services, any vulnerability/Bug submitted against your Security Program will only be visible to You, the Security Pentesters participating in the Program and Authorized staff at Cobalt.
    • In the event your program has responsible disclosure you agree that you are responsible for informing the Security Pentesters on when he/she can disclose a given vulnerability to the public.
    Privacy

    You agree and acknowledge that the personal data you provide to us may be processed for the purpose of providing our services to you. Each Party shall maintain appropriate technical and organizational safeguards for protection of the associated personal data that is collected and/or processed through your use of the Services. 

    For more information on our data privacy practices, please see our Privacy Policy or contact us at privacy@cobalt.io

    Any false information provided within the context of the Security Program by Customer concerning identity, mailing address, telephone number, email address, ownership of right or non-compliance with these terms and conditions or the like may result in the immediate termination of the Security Program.

    Insurance/Backup

    Cobalt recommends that you obtain appropriate insurance and backup for your Application(s)/Network(s) and its content. Please review any insurance policy that you may have for your Application(s)/Network(s) and its content carefully, and in particular please make sure that you are familiar with and understand any exclusions to, and any deductibles that may apply for, such insurance policy.

    Complete Agreement and Order of Precedence

    All of the terms set forth in the General Terms, or another master agreement entered into between You and Cobalt, shall apply to these Supplemental Terms including without limitation confidentiality, liability, controlling law and jurisdiction, dispute resolution and arbitration and costs. In the event of a conflict between the General Terms, or other master agreement terms, and these Supplemental Terms, the Supplemental Terms shall apply.

     

  • Professional Services Addendum

    BY CLICKING TO SIGN IN ON-LINE TO USE THE COBALT SITE AND SERVICES AND BY USING THE SITE AND SERVICES FOR PROFESSIONAL SERVICES, YOU (OR “CUSTOMER”) AGREE TO COMPLY WITH AND BE LEGALLY BOUND BY THESE SUPPLEMENTAL TERMS (“SUPPLEMENTAL TERMS”). THESE SUPPLEMENTAL TERMS ARE INCORPORATED INTO AND FORM A PART OF THE GENERAL TERMS FOUND AT COBALT.IO/TERMS (“AGREEMENT” or  “GENERAL TERMS”) AND GOVERN YOUR ACCESS TO AND USE OF THE SITE, SERVICES, AND PROFESSIONAL SERVICES AND CONSTITUTE A BINDING LEGAL AGREEMENT BETWEEN YOU, COBALT AND THE SECURITY PENTESTER. IF YOU DO NOT AGREE TO THESE SUPPLEMENTAL TERMS, YOU HAVE NO RIGHT TO USE THE SITE, SERVICES, OR PROFESSIONAL SERVICES.

    1. PROFESSIONAL SERVICES ​

    “Professional Services” shall include certain security testing, consulting, training, and other similar services, inclusive of any deliverable associated therewith, performed by Cobalt as identified with specificity under the terms of a Cobalt Sales Order or SOW, with such services to be undertaken by Cobalt personnel or contractors. “Professional Services” excludes the offering of penetration testing Services delivered via the Cobalt Site (app.cobalt.io)

    2. SCOPE

    a. Scope. Cobalt will perform the Professional Services and deliver the software and/or documents specified as deliverables in the applicable Sales Order or SOW for Professional Services (the “Deliverables”) in accordance with the requirements in the Sales Order or SOW. Any specific scope or limits to the provision of Professional Services shall be set forth in the Sales Order or SOW, in the absence of which Cobalt shall have the discretion to establish the scope and limits of any such Professional Services. Where specific networks, code, systems, devices or objects are the subject of Professional Services, the such networks, code, systems, devices or objects will be identified by Customer in the Sales Order or SOW with specificity. Cobalt shall have the discretion to select applicable methodologies for conducting Professional Services.

    b. Changes. At any time prior to completion of the Professional Services under a Sales Order or SOW, Customer may request or Cobalt may recommend modifications to the Sales Order or SOW. Cobalt will advise Customer of the likely impact of any such change, including any effect on the fees and time for completion of the Professional Services. The parties will respond in writing or will meet to discuss any such proposed changes as soon as practicable, but (subject to Section 2.4) neither party will be obligated to agree to any such change, and until such time as any change is agreed to in a writing specifying, inter alia, any change to the fees, time for completion or completion criteria, Cobalt will continue to provide the Professional Services as if such change had not been requested or recommended.

    c. Resources. Cobalt will provide appropriately qualified personnel to perform the Professional Services and will use commercially reasonable efforts to minimize changes in such personnel. Cobalt reserves the right to engage independent contractors to perform some or all of the Professional Services, provided that Cobalt remains responsible for the performance of the Professional Services in accordance with this Professional Services Addendum. 

    d. Schedule. Cobalt and Customer shall mutually agree to a schedule for provision of Professional Services, which shall be identified in the Sales Order or SOW. In the absence of a particular schedule, Cobalt shall have discretion to determine the time and place of any Professional Services hereunder. Any delay in meeting the applicable Professional Services schedule caused by Customer may require execution of a change order or revision and payment of additional fees at Cobalt's sole discretion. 

    3. CUSTOMER’S OBLIGATIONS ​

    a. Access. For any Professional Services where access to Customer’s systems, office sites, devices or other objects, or third party systems is necessary, Customer will take all steps necessary to ensure that Cobalt obtains all required credentials or permissions.Where Professional Services concern a particular device or object, such device or object will be delivered to Cobalt at a location to be determined by the parties via courier or similar delivery service, with Customer to retain liability over the condition of such device or object until its delivery to Cobalt.

    b. On-Site. Where Professional Services provided hereunder require Cobalt to be physically present at Customer’s location, Customer shall be responsible for ensuring Cobalt is provided with sufficient space and resources to perform the Professional Services. Customer will be responsible for providing a safe environment where Cobalt personnel and/or contractors are present, and shall obtain adequate insurance to protect Cobalt and its personnel against any physical injury occurring on Customer’s premises.

    c. Customer Personnel. Where Professional Services require engagement of Customer’s personnel, Customer will take all necessary steps to provide Cobalt with reasonable access to such personnel, whether in person or via standard communications tools (i.e. email, Zoom, teleconference, etc.).

    d. Failure to Fulfill Obligations. Failure of Customer to timely fulfill the obligations set forth in this Section 3 may preclude timely provision of Professional Services and may require an adjustment of the Professional Services schedule under Section 2.4 and/or suspension of performance by Cobalt.

    4. ​PAYMENT

    a. Fees In consideration for the Professional Services and Deliverables, Customer will pay Cobalt the fees specified in the applicable Sales Order or SOW.

    b. Expenses. Customer will reimburse Cobalt for all reasonable expenses incurred by Cobalt in performing the Professional Services, including travel, lodging, per-diem and out of pocket expenses, subject to Customer’s pre-approval. In general, expenses will only be incurred for provision of the Professional Services at locations other than Cobalt’s offices, unless otherwise specified in the appliCable Sales Order or SOW.

    c. Invoices. Cobalt shall submit invoices on a monthly basis for all fees, charges and expenses relating to the performance of the Professional Services under the applicable Sales Order or SOW. Payments shall be made in U.S. Dollars, or, if different, the applicable currency as set forth in the Sales Order or SOW, within thirty (30) days of receipt of invoice. Unless otherwise specified in the applicable Sales Order or SOW, the payment terms and conditions shall be as set forth in the payment terms provision of the Agreement.

    5. ​SECURITY AND PRIVACY.

    The parties agree that Cobalt will not be provided access to any production data processed by the Customer through the provision of Professional Services (“PS Customer Data”), whether by way of transfer of PS Customer Data to Cobalt’s systems, access to Customer’s systems or exposure to PS Customer Data through shared screens, screen shots, etc., other than sample, hashed or anonymized data used for development and testing purposes. If and to the extent it is agreed by the parties that Customer will grant Cobalt access to PS Customer Data, Cobalt shall employ and maintain commercially reasonable safeguards to protect the security and confidentiality of PS Customer Data. Those safeguards will include, but will not be limited to, measures for preventing unauthorized access to or disclosure of PS Customer Data. Cobalt will not use or disclose PS Customer Data except (a) as required to provide Professional Services, (b) as required by law, or (c) as Customer expressly permits Cobalt in writing. Customer shall be solely responsible for ensuring that granting Cobalt access to PS Customer Data as set forth in this Section 5 does not violate applicable laws governing the use of PS Customer Data, including but not limited to the rights of data subjects whose information is included in the PS Customer Data. If required, Customer shall be responsible for removing or redacting data subject to security restrictions or anonymizing personally identifiable information. 

    6. OWNERSHIP

    a. Deliverables. All Deliverables and all intellectual property rights in the Deliverables will be the sole and exclusive property of Cobalt, whether or not specifically recognized or perfected under the laws of the jurisdiction in which the Professional Services are used or licensed. No work product of Cobalt shall be construed as or deemed to be a “work made for hire”. Accordingly, Customer acknowledges that Cobalt retains sole and exclusive ownership of all right, title and interest to all Deliverables. Cobalt shall own all rights in any copy, translation, modification, adaptation or derivation of the Deliverables, including any improvement or development thereof. At no time will Customer dispute or contest Cobalt’s exclusive ownership rights in any Deliverables. Notwithstanding the above, Cobalt grants to Customer a perpetual, worldwide, non-exclusive license in the Deliverables for Customer’s internal use only. Cobalt shall have no obligation to provide support services or otherwise maintain any Deliverables delivered hereunder.

    b. Materials. Cobalt may furnish Customer with reports, analyses or other such materials (the "Materials"). Customer understands and agrees that any such Materials will be furnished solely for its internal use and may not be furnished in whole or in part to any other person other than its directors, officers, employees or advisors without the prior written consent of Cobalt. Cobalt grants to Customer a perpetual, irrevocable, nontransferable, paid-up right and license to use and copy such Materials and prepare derivative works based on such Materials for its internal use, subject to the terms of this Section. All other rights in such Materials, excluding any Confidential Information of Customer, remain in and/or are assigned to Cobalt.

    c. Cooperation. The parties will cooperate with each other and execute such other documents as may be appropriate to achieve the objectives of this Section.

    7. WARRANTY​
    a. Warranty. Cobalt warrants that it shall use commercially reasonable efforts in performing the Professional Services. Cobalt further warrants that any Deliverable provided through the Professional Services shall substantially conform to the specification for such Deliverable as set out in the applicable Sales Order or SOW. If Customer notifies Cobalt that Professional Services or any Deliverable fails to conform to the aforestated warranties within thirty (30) days of the acceptance of the Deliverable, Cobalt shall (as Customer’s sole and exclusive remedy), re-perform the Professional Services and/or correct any defects with the Deliverable in question. 

    b. Disclaimer. COBALT’S OBLIGATION UNDER THE ABOVE WARRANTY SHALL BE ITS SOLE LIABILITY AND IT SHALL HAVE NO OTHER LIABILITY WHATSOEVER WITH RESPECT TO THE QUALITY, FITNESS FOR A PARTICULAR PURPOSE OR MERCHANTABILITY OF THE PROFESSIONAL SERVICES OR ANY DELIVERABLES AND ALL OTHER REPRESENTATIONS, STATUTORY OR OTHERWISE ARE EXCLUDED. 
  • Pentest Management Platform Pilot

    These terms and conditions (the “Pilot T&Cs”) constitute the sole and entire agreement of Cobalt Labs, Inc (“Cobalt”). and its customer (the “Customer”) concerning the use of and evaluation of the Cobalt Pentest Management Platform (“PMP”), and supersede all prior or contemporaneous understandings, agreements, negotiations, representations and warranties, and communications, both written and oral.  These Pilot T&Cs prevail over any terms or conditions contained in any other documentation. To the extent not directly contradictory herewith, all other Cobalt Terms and Conditions (including without limitation, the Cobalt Privacy Policy) continue to apply with full force and effect.

    Access to Platform.  During the Pilot Term,  Cobalt will provide the Customer access to and use of the PMP, in accordance with these Pilot T&Cs. All use of the PMP will be for the purpose of Customer managing and administering pentests for Customer’s benefit alone. By using the PMP, Customer represents that it has obtained all rights and/or licenses necessary to undertake any and all pentests for which PMP is leveraged. Customer is prohibited from using the PMP in any way that violates applicable law, regulation, contract, or in any way injures the rights of any third party.

    Pilot Term. The period for which Customer may access the PMP (the “Pilot Term”) shall be determined by and between Cobalt and each Customer.  Cobalt reserves the right to terminate the Pilot at any time and for any reason, with notice to Customer.  Cobalt will delete or return, at Customer’s discretion, all data created and stored on the PMP after the conclusion of the PMP; provided, that in the Cobalt has (at such time as the Pilot Term ends) developed a paid version of PMP and Customer desires to transition to such paid version, Cobalt and Customer may provide for continued access to, use of and storage of Customer PMP data on terms and conditions to be agreed upon by and between Cobalt and Customer at such time.

    Restrictions on Use. Customer shall not (a) demonstrate, copy, sell, rent, lease, lend, sublicense, distribute, or otherwise transfer or provide access to the PMP to any third party; (b) publish or otherwise disclose information relating to the performance, quality, or capability of PMP to any third party; (c) modify, reuse, disassemble, decompile, reverse engineer or otherwise translate any software contained within the PMP or any portion thereof; or (d) create derivative works based on the PMP.

    Legal Compliance.  Customer and Cobalt shall each comply with all applicable laws and regulations with respect to the use of the PMP.  Cobalt may suspend Customer’s access to the PMP, in its sole discretion, for: (i) use of the PMP in a way that violates applicable laws and regulations or these Pilot T&Cs, or (ii) any instance of posting or uploading material that infringes or is alleged to infringe on the copyright or trademark rights of any person or entity.

    Intellectual Property.  Cobalt owns and shall retain all right, title and interest in and to all intellectual property rights embodied in and appertaining to the PMP, including, without limitation, all such rights in the software and content, together with all improvements, enhancements, developments, derivative works, and other modifications thereto.  As between Customer and PMP,  Customer will own and retain all rights to its own materials and previously existing intellectual property, including confidential and proprietary information and data.

    Feedback. Customer may give feedback on the performance and utility of the PMP. Customer hereby grants to Cobalt a perpetual, irrevocable, worldwide license to such feedback, and Customer expressly acknowledges that any product modifications, upgrades, features or functionality made by Cobalt that incorporate such feedback are the sole intellectual property of Cobalt.

    Disclaimer.  EXCEPT AS SPECIFICALLY SET FORTH HEREIN, COBALT PROVIDES THE PMP “AS IS” WITHOUT WARRANTY OF ANY KIND.  COBALT MAKES NO OTHER WARRANTY, EXPRESS OR IMPLIED, WITH RESPECT TO THE PMP, AND ALL OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED, ARE HEREBY DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

    Limitations on Liability.  To the extent permitted by law, in no event shall either Cobalt or Customer be liable for any indirect, punitive, or consequential damages, including lost profits or business opportunities.

  • Beta Products Terms and Conditions

    Cobalt Labs, Inc. Beta Products Terms and Conditions

    These terms and conditions (the “Beta T&Cs”) constitute the sole and entire agreement of Cobalt Labs, Inc (“Cobalt”). and its customer (the “Customer”) concerning the use of and evaluation of Cobalt Beta Products,  and supersede all prior or contemporaneous understandings, agreements, negotiations, representations and warranties, and communications, both written and oral.  These Beta T&Cs prevail over any terms or conditions contained in any other documentation. To the extent not directly contradictory herewith, all other Cobalt Terms and Conditions (including without limitation, the Cobalt Privacy Policy) continue to apply with full force and effect.

    “Beta Product” shall mean those Cobalt products or in-platform features which are designated as beta, pilot, or pre-release versions and are provided to Customer during the term hereof. Beta Products include, without limitation:

    • Cobalt Pentest Management Platform (“PMP”) Pilot.
    • Cobalt Vulnerability Scanner Open Beta.

    Access.  During the Beta Term,  Cobalt will provide the Customer access to and use of the Beta Product(s),  in accordance with these Beta T&Cs. All use of the Beta Product will be for the Customer’s benefit alone. By using the Beta Product, Customer represents that it has obtained all rights and/or licenses necessary to undertake any and all activity for which the Beta Product is leveraged. Customer is prohibited from using the Beta Product in any way that violates applicable law, regulation, contract, or in any way injures the rights of any third party.

    Beta Term. The period for which Customer may access the Beta Product (the “Beta Term”) shall be determined by and between Cobalt and each Customer.  Cobalt reserves the right to terminate access to the Beta Product at any time and for any reason, with notice to Customer.  Cobalt will delete or return, at Customer’s discretion, all data created and stored via the Beta Product after the conclusion of Beta access; provided, that in the Cobalt has (at such time as the Beta Term ends) developed a paid version of Beta Product, and Customer desires to transition to such paid version, Cobalt and Customer may provide for continued access to, use of and storage of Customer data on terms and conditions to be agreed upon by and between Cobalt and Customer at such time.

    Restrictions on Use. Customer shall not (a) demonstrate, copy, sell, rent, lease, lend, sublicense, distribute, or otherwise transfer or provide access to the Beta Products to any third party; (b) publish or otherwise disclose information relating to the performance, quality, or capability of Beta Products to any third party; (c) modify, reuse, disassemble, decompile, reverse engineer or otherwise translate any software contained within the Beta Products or any portion thereof; (d) create derivative works based on the Beta Products; or (e) use Beta Products to conduct scanning, testing, or like activity against the assets of a third party. 

    Legal Compliance.  Customer and Cobalt shall each comply with all applicable laws and regulations with respect to the use of the Beta Products.  Cobalt may suspend Customer’s access to the Beta Products, in its sole discretion, for: (i) use of the Beta Products in a way that violates applicable laws and regulations or these Beta T&Cs, or (ii) any instance of posting or uploading material that infringes or is alleged to infringe on the copyright or trademark rights of any person or entity.

    Intellectual Property.  Cobalt owns and shall retain all right, title and interest in and to all intellectual property rights embodied in and appertaining to the Beta Products, including, without limitation, all such rights in the software and content, together with all improvements, enhancements, developments, derivative works, and other modifications thereto.  As between Customer and Cobalt,  Customer will own and retain all rights to its own materials and previously existing intellectual property, including confidential and proprietary information and data.

    Feedback. Customer may give feedback on the performance and utility of the Beta Products. Customer hereby grants to Cobalt a perpetual, irrevocable, worldwide license to such feedback, and Customer expressly acknowledges that any product modifications, upgrades, features or functionality made by Cobalt that incorporate such feedback are the sole intellectual property of Cobalt.

    Disclaimer.  EXCEPT AS SPECIFICALLY SET FORTH HEREIN, COBALT PROVIDES THE BETA PRODUCTS  “AS IS” WITHOUT WARRANTY OF ANY KIND.  COBALT MAKES NO OTHER WARRANTY, EXPRESS OR IMPLIED, WITH RESPECT TO THE BETA PRODUCTS, AND ALL OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED, ARE HEREBY DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

    Limitations on Liability.  To the extent permitted by law, in no event shall either Cobalt or Customer be liable for any indirect, punitive, or consequential damages, including lost profits or business opportunities. The total liability arising out of or related to this Beta T&Cs, and the provision of access to and use of Beta Products thereunder, shall not exceed $100.

  • Hak5 Pineapple Bundle Terms

    If you are purchasing a pentest through the Hak5/Cobalt bundle offer, these terms supplement the Cobalt Terms of Use. All applicable terms of the Cobalt Terms of Use remain effective except, where contradictory, the terms of this Hak5 Pineapple Test Supplement govern in lieu of such other terms.

    Services Description

    The Hak5/Cobalt bundle includes a limited, four-credit pentest of your Hak5 Pineapple device (a “Hak5 Pentest”). The Hak5 Pentest is non-customizable. Cobalt has sole discretion to determine the appropriate scope of a Hak5 Pentest. While findings derived from a Hak5 Pentest will be delivered via the Cobalt Platform, no report will be provided.  Cobalt will notify you when your Hak5 Pentest has concluded.

    Device

    By purchasing the Hak5 Pentest, you acknowledge that Cobalt does not manufacture, design, or deliver Hak5 devices.  Failure to select an appropriate or compatible device, failure of a Hak5 device to operate per specifications, or non-delivery of a Hak5 device you may have purchased, may interfere with your ability to receive a Hak5 Pentest. Cobalt does not make any representation or warranty concerning the quality, fitness, compatibility, or deliverability of the Hak5 device you have purchased.

    Timing

    Cobalt’s obligation to undertake a Hak5 Pentest is contingent upon your successful installation and configuration of the applicable Hak5 device.  After completion of device installation and configuration, your Hak5 Pentest may take up to two (2) weeks to schedule.

    Staffing

    Cobalt reserves the right to staff your Hak5 Pentest with personnel from (a) the Core Community, or (b) other qualified professionals, including but not limited to Cobalt employees and/or contractors.

    Methodology

    Hak5 Pentests will follow a standard methodology based on the Penetration and Testing Execution Standard (PTES) and National Institute of Standards and Technology (NIST) Technical Guide to Information Security Testing and Assessment (NIST 800-115).

    Pricing and Tier

    The price and Cobalt Tier associated with a Hak5 Pentest will be determined by whether the Customer is a new or existing Cobalt Customer, as follows: (a) for new Cobalt Customers, the price associated with each Cobalt Credit is itemized on the Hak5 page where you purchased the Hak5/Cobalt bundle, and the Tier associated with your Hak5 Pentest is “Standard,” and (b) for existing Cobalt Customers, the price associated with each Cobalt Credit is the per-Credit price to which you have previously agreed, and the Tier associated with your Hak5 Pentest is the Tier associated with your existing Cobalt subscription.” Notwithstanding Cobalt Tier offerings, Hak5 Pentests exclude the following features (a) the selection of pentesters based on location, (b) retesting, and (c) customer attestation.

  • Privacy Policy

    Effective Date: March 31, 2023

    1. INTRODUCTION

    This Privacy Policy is intended for all Cobalt products and services, including our website (www.cobalt.io); our applications; and our marketing and promotional content (collectively, the “Services”). 

    We are Cobalt Labs, Inc., a Delaware corporation, doing business at 575 Market St, 4th Floor, San Francisco, CA 94105-USA, together with our affiliates (referred to herein as “Cobalt”, “us”, “our” or “we”). 

    For the purposes of EU GDPR, Cobalt acts as a Data Controller for the data we process for our own business purposes. If you have any questions relating to this Privacy Policy, please contact us by email at privacy@cobalt.io.

    2. PURPOSE OF THIS POLICY 

    At Cobalt, we are committed to safeguarding and maintaining your personal data, in line with all applicable data protection laws and regulations, including laws and regulations of the European Union, the European Economic Area and their member states (“EU GDPR”), Switzerland, the United Kingdom (Data Protection Act 2018 (“UK GDPR”)) and the United States federal and/or state data protection or privacy statutes including but not limited to the California Consumer Protection Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”).

    This policy aims to promote transparency and facilitate you in making informed decisions about your personal data. In some circumstances, where we process personal data for a new purpose not contained herein, we may provide additional or revised privacy policies so that you fully understand the reason for and purpose of the new activity. 

    Cobalt maintains this policy on a regular basis and updates it where necessary. You are encouraged to check back regularly, however, if we make a substantial amendment to the current version, we will keep you informed and where you are our customer, we may notify you by email.

    3. WHAT DATA DO WE COLLECT

    Cobalt’s products and services are designed and intended for use by businesses and their representatives. We do not provide services or products that are aimed at individuals or consumers in a personal capacity.

    When we refer to ‘personal information’ or ‘personal data’ in this Privacy Policy, we mean information that identifies or which could be reasonably used to identify any individual. We process different categories of personal data and this will depend on our relationship with you or your organization.

    Information you provide to us

    Contact Data: Any personal data you share when you contact us, for example, by sending us an email, by attending or engaging with us at an event, or through our website using live chat, contact forms or downloading content and can include any information shared by you.

    Account Data: If you have a Cobalt account or where you are our prospective or actual customer, we collect first name, last name, job title/function, work email address, work phone number, user identifier and password.

    Marketing Data: Your instructions as to whether you wish to receive email marketing, newsletters and other promotional material from Cobalt, including your marketing permissions and opt-in status. 

    Transactional Data: Where you are our Customer, or one of our vendors, or otherwise establish a relationship with us that involves financial transactions, we collect information relating to those transactions. This may include data like credit/debit card information, account and authentication information, tax identifiers and other billing, delivery and invoice details. For automated/digital transactions, we may outsource this activity to one of our selected third-party payment card processors, all of which maintain PCI-DSS compliance.

    Organizational Data: When you engage with us on our website, or are our customer, we may collect non-personal data relating to your organization, including but not limited to number of employees, industry type, company name and size, growth trends, registered business address, location (city, state, country).

    Information we collect automatically

    Technical and Analytical Data: 
    - Information about how you use our services, such as, content downloaded or requested, intent data, Cobalt services or products searched, viewed or used, page response times, website performance analytics, download errors, timestamp of visit or interaction, length of visits or sessions, referral site or source, email activity (opens/clicks), page interaction information (such as scrolling, clicks, and mouse-overs); and

    - Information about your device, such as, IP address, browser version, browser language, operating system and version, unique device identifiers, geo-location (city, state/province, country), operating system and platform, marketing cookie permissions.

    Where accepted by you - we use cookies and similar tracking technologies to collect some of the information listed above; for more information, please see the Cookies and Tracking Technologies section below. 

    Data from other sources: We combine data that you provide to us (and that we may collect across our services) with information that we receive from third parties, including but not limited to B2B lead generation and professional Linkedin profiles. We may use demographic information about you in your professional capacity, such as your job title or function (that Cobalt obtains from sources like Linked-in) which is used for segmenting and profiling for B2B marketing purposes. You can opt-out of having your data used in this way at any time.   

    Please note that if you provide Personal Information to us about any individual other than yourself, you represent and warrant that you are legally authorized to provide such Personal Information to us for our use and disclosure as described in this Policy.

    4. THE SOURCE OF THE PERSONAL DATA

    If the personal data we process about you has not been given to us directly by you, Cobalt may obtain it from the following sources:

    • From your organization, on your behalf;
    • From yourself directly;
    • From publicly available sources, such as public websites, the internet;
    • From social media platforms such as Linkedin.
    • From organizations we work with who are specialists in B2B lead generation, B2B intent data, who have obtained your permission to share some of your organization's data with us, such as B2B data clearinghouses. 
    • From website analytical data that is collected automatically by cookies and other similar technologies when you use our services.

    5. THE PURPOSE OF OUR DATA PROCESSING

    Cobalt is permitted to process personal data only where we have identified a lawful basis for doing so. The main lawful bases upon which Cobalt relies are: 

    Legitimate interests: the processing is necessary for the purpose of the legitimate interest pursued by us or our third parties. For example, we may have a legitimate interest in processing Personal Information to send B2B marketing communications and promote our business.

    Consent: Where the data subject (you) has freely given your consent to the processing taking place. If you've provided us with your express consent for our processing of your Personal Information, we may process your Personal Information based on such consent, until such time where that processing is no longer necessary or your consent is withdrawn.

    Legal Obligation: Where the processing is necessary for us to comply with a legal obligation to which we are subject as data controller. For example, if you have purchased our services and we are required by applicable law to process Personal Information to meet certain tax obligations, we may process your Personal Information to comply with such legal obligations;

    Contract: Where the processing is necessary for the performance of a contract to which we are a party. For example, when you purchase our services, you enter into a contract with us and in such circumstances, we process your Personal Information in order to perform this contact or to take required measures prior to entering into the contract

    We process personal data for the following purposes and rely on the following legal bases:

    Processing purpose
    Lawful Basis 
    Category of personal data

    To manage or establish a relationship with you, such as:

    • Respond to any enquiry, comment or request submitted by you;

    • To provide you with alerts and services messages, notifying you about material changes to our services and our terms, policies and notices.

    • Provide downloadable content to you, as requested on our website.

    • Where you engage with us at an event where we are participating.
    • Performance of a contract (including negotiation)

    • Legal obligation (updates to terms and policies)

    • Legitimate Interests (networking at events, provide downloadable content)
    • Contact Data
    • Account Data
    • Organizational Data

    Creating and maintaining your Cobalt account and providing services as requested, including:

    • Administering services access

    • Processing order forms and contractual agreements

    • Facilitating integrations, as requested

    • Password and 2FA management

    • Personalize our online services at your selection
    • Performance of a contract (including negotiation)
    • Contact Data
    • Account Data
    • Technical and Analytical data
    • Subscription Data
    • Organizational Data

    To review, monitor and protect the performance of our services, including:

    • Troubleshooting and error management
    • System maintenance
    • Security monitoring and reporting
    • System performance analysis
    • Analyzing trends and usage
    • Legitimate Interests

    • Legal Obligation (system security)
    • Contact Data
    • Technical and Analytical data
    • Account Data
    • Organizational Data

    Where we have a financial relationship with you, to process payments for services and settle invoices payable.
    • Performance of a contract
    • Contact Data
    • Account Data
    • Subscription Data
    • Organizational Data

    To maintain our existing relationship with established customers and to promote our products and services and identify new-customer opportunities. 


    We may use public information about you, in combination with other personal information we may have about you, to identify products and services that we believe may be of interest to your business.

    You may opt-out of receiving these emails at any time by clicking “unsubscribe” found in the emails we send you or by clicking here. 
    • Legitimate Interests 
    • Contact Data
    • Account Data
    • Marketing Data
    • Technical and Analytical data
    • Data from other sources
    • Organizational Data

    Cobalt uses a combination of firmographic data to perform segmentation on the organizations of our customers based on various factors for sales and promotional purposes.

    To identify organizations who may be interested in working with Cobalt, including: 

    • Using firmographic information about prospective organizations, such as, industry specialism, size of company, location of country. Please see ‘Non-personal data’ above. 
    • Using firmographic data to identify organizations who are in our target market and who we believe may be interested in Cobalt products and services.
    • Legitimate Interests
    • Contact Data
    • Account Data
    • Marketing Data
    • Technical and Analytical Data
    • Organizational Data

    To share data with third party organizations who process data on our behalf as a data processor or subprocessor, and enable us to provide our services. For example, data hosting providers, CRMs, payment card processors and vendors who deliver technical services to us. 
    • Performance of a contract

    • Legitimate Interests
    • Contact Data
    • Account Data
    • Marketing Data
    • Technical and Analytical data
    • Data from other sources
    • Organizational Data

     

    6. RECIPIENTS OF PERSONAL DATA

    We will share data with and receive data through Cobalt’s Partners who lead in the cybersecurity space. For example, Cobalt may assist them in providing their services or Partners may assist Cobalt in generating new business opportunities.

    Cobalt engages third party service providers to assist us in providing our services and conducting our business, which means any service provider may process personal data on our behalf, depending on the nature of the services supplied. These organizations deliver to us specific functionality on which we rely to do business.  We require every organization that processes personal data on our behalf to ensure its security, adhere to confidentiality requirements equal to those herein, and only in accordance with our strict instructions. These organizations may be located or have servers which are located outside of the EU, and Cobalt has entered into strict data protection agreements to safeguard personal data when transferred out of the EU or EEA. 

    You or your organization may choose to add new integrations or change the functionality of the services by using third party apps within the services.  This means giving third-party apps access to your account and information like your name, email address, and any content you elect or are required to provide in connection with those apps. 

    To third parties providing services to us or on our behalf who require access to personal information (e.g., our professional advisors, including but not limited to auditors, insurers, legal counsel) to protect our business interests. 

    In the event we are involved in a merger, reorganization, acquisition or other fundamental corporate change, or if all or part of our assets are acquired by a third party, we may be required to share your personal data with relevant third parties involved in the transaction. We will endeavor to notify you of any transfer of personal data in this event and the recipient will be informed of the requirement to protect your personal data as per the terms of this Policy. 

    7. INTERNATIONAL DATA TRANSFERS

    Cobalt is a global organization. This means that when you engage with us, your personal data may be transferred to or stored in countries that may not have equivalent privacy and data protection laws to the country where you are based. Cobalt hosts all data in the United States. Third-party vendors and service providers Cobalt works with may also be based in countries outside of the European Economic Area, including but not limited to the US. 

    Cobalt makes use of Standard Contractual Clauses, approved by the European Commission (and the equivalent Standard Contractual Clauses for the UK, where applicable) to safeguard restricted transfers made to countries without an adequacy decision. 

    8. HOW WE KEEP YOUR DATA SECURE

    Cobalt is a security-centric company. This means that the security and integrity of your personal data is our paramount concern. We have heavily invested in our security infrastructure to ensure that we have appropriate technical and organizational measures to protect the personal data we process, and keep it from being accidentally lost, used or accessed, altered or disclosed in an unauthorized way.

    For more information on how Cobalt keeps data secure, please see our security practices and certifications here. 

    9. HOW LONG DO WE STORE YOUR DATA

    As part of our commitment to purpose limitation, Cobalt only retains personal data for as long as it is required for the purpose in which it was originally collected. For example, if you are an active customer of ours, we will retain your personal data, in connection with the services, for the duration of our agreement or relationship with you. 

    Cobalt has incorporated retention policies and schedules into our business to ensure that the data we retain is relevant to its purpose and is limited to only the data necessary to achieve said purpose. 

    You may request the deletion of some or all of your personal data by contacting privacy@cobalt.io or by clicking here. However, please note that this is not an absolute right and only where certain circumstances are satisfied, and we may need to retain certain information for record keeping purposes, to complete transactions or to comply with a legal obligation.

    10. MARKETING

    To promote our business to new and existing customers and promote services that we believe may be of interest to your organization, we occasionally share marketing communications and promotional material with our B2B customers. For example, when you engage with us on our website by completing a form or downloading content, or where you have told us you would like to receive it.

    You have the right to opt-out of receiving marketing communications at any time by clicking the ‘unsubscribe’ link in the footer of any promotional email from us. Alternatively, you can request this by email at privacy@cobalt.io.

    Please note that this will not affect Services Messages which we are required to communicate to you, for example when we update our terms and conditions, or where we make material changes to our existing services that impact functionality or user experience. 

    11. CHILDREN UNDER 13

    Our site and services are not directed to or intended to be used by individuals under the age of 13 and we do not knowingly collect Personal Information from children under 13. If you become aware or reasonably suspect that we have collected Personal Information from any child under the age of 13, please contact us at privacy@cobalt.io and we will seek to delete such Personal Information as soon as possible.

    12. COOKIES AND TRACKING TECHNOLOGIES

    Cobalt relies on cookies, web beacons and other similar tracking technologies to customize and improve our websites and services, personalize and enhance user experience, to understand the usage and performance levels of our services, determine what content is being engaged with and the levels of engagement. We also use cookies and other tracking technologies to determine things about our website visitor’s interests, based on things like browsing activity, interactions and preferences.

    You have the right to reject the use of cookies on our Website for marketing purposes, however functional and essential cookies are used to make our website function or offer our services. These cookies cannot be switched off. You will be served with a prompt to accept, reject or configure cookies when you visit our website on a desktop or mobile. You can also reject marketing cookies at any time by clicking ‘My Privacy Settings’ on our website’s footer.

    Cookies

    Web Beacons

    Device recognition technology

    Like many websites, we use cookies on a user's hard drive to collect information. A cookie is a small piece of information that is placed on your device when you visit the site and other websites. We use cookies to identify your authenticated interaction with the site, to enable certain features of the site, to better understand how you interact with the site, and to monitor aggregate usage by site users and web traffic routing on the site. you can instruct your browser to stop accepting cookies or to prompt you before accepting a cookie from the websites you visit. However, if you do not accept cookies, that may limit your use of certain features of the site.

    Our site may contain electronic images known as Web beacons (sometimes called single-pixel gifs) and are used along with cookies to compile aggregated statistics to analyze how our site is used and may be used in some of our emails to let us know which emails and links have been opened by recipients. This allows us to gauge the effectiveness of our customer communications and marketing campaigns. As with cookies, you may disable web beacons by changing your browser settings or the settings in your email services/program.

    Device detection technology recognizes the devices being used to access a website, app, or mobile network, using the User-Agent or other HTTP request headers. These headers include detailed information across hundreds of categories, including device model, operating system, processing power, browser type, screen resolution, 


    Websites and apps enhanced with device detection can make smarter decisions (in real-time) about what content to send to a given device.

     

    13. LINKS TO OTHER SITES

    Our site may include links to third party websites. We do not endorse or recommend such third party websites or the content therein and we are not responsible for the privacy practices of the operators of such websites. Please be aware that when you access links on our site to a third party website, you are bound by the privacy policies and practices of that third party. We encourage you to read the privacy policies governing your use of any third party website.

    14. YOUR RIGHTS UNDER GDPR

    As defined under the EU GDPR, included as retained by the UK (“UK GDPR”) individuals are granted eight (8) individual rights over the personal data:

    • Right to be informed: you have the right to be informed about the collection and use of your personal data. you also have the right to be provided with certain information including: our purposes for processing your personal data, our retention periods for that personal data, and who we will share with.

    • Right of Access: you have the right to request confirmation that data about you is being processed, and receive a copy of some or all of the personal data processed about you from a Data Controller. 

    • Right to Rectification: you have the right to request the rectification of any personal data that is inaccurate or incomplete;

    • Right to Erasure (or the ‘right to be forgotten’): you have the right to request the erasure of your personal data from the Data Controller’s records, including back-ups. This is not an absolute right and can only be fulfilled if one of the grounds under Article 17(1) GDPR apply;

    • Right to Restriction of Processing: you have the right to request the restriction of processing of your personal data. This is not an absolute right, and can only be fulfilled if one of the grounds under Article 18(1) GDPR apply; 

    • Right to Data Portability: you have the right to receive the personal data concerning you, as provided to the Data Controller, in a structured, commonly used and machine-readable format, and have the right to transmit those data to another controller without hindrance from the first controller.

    • Right to Object: you have the right to object to an organization processing (using) your personal data at any time. This effectively means that you can stop or prevent the organization from using your data. An objection may be in relation to some or all of the personal data. The right to object only applies in certain circumstances outlined by Article 21 GDPR, including where processing is based exclusively on your consent, or processed for the purposes of direct marketing.

    • Automated decision making and profiling: you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similar effects on you. Automated individual decision-making is a decision made by automated means without any human involvement. Cobalt does not use, in connection with our services, automated decision-making in a way that produces legal effects concerning you or that significantly affect you.

    You have the right to make any of the above requests at any time. To do so, please complete our Privacy Request Form or contact us at privacy@cobalt.io. Upon receiving your request, we will confirm receipt and aim to action your request without undue delay and no later than one month from the date we receive your request.

    Please note that in order to fulfill your request, we may need to request identification from you (or your appointed representative) to confirm your identity or their authorization to make the request. We will inform you of any necessary identification checks after we receive your request. If for any reason we are unable to fulfill your request, we will inform you of our decision in writing and any further rights available to you. 

    15. YOUR RIGHTS UNDER CCPA

    The California Consumer Privacy Act ("CCPA") provides certain rights to individuals who reside in California ("Consumers"). Below is a description of Consumers' rights concerning their Personal Information and Cobalt's practices regarding the collection, use, disclosure and sale of Personal Information about Consumers.

    Consumers have the right to request that we disclose what Personal Information we collect, use, disclose and sell. A Consumer may exercise the following rights:

    • Right to Know: Consumers may request that businesses disclose what personal information they have collected, used, shared, or sold about you in the last 12 months, and why they collected, used, shared, or sold that information. Specifically, you may request:
      - The categories of personal information collected;
      - Specific pieces of personal information collected
      - The categories of sources from which the business collected personal information
      - The purposes for which the business uses the personal information
      - The categories of third parties with whom the business shares the personal information
      - The categories of information that the business sells or discloses to third parties

    • Right to Delete: Consumers have the right to request the deletion of personal information that a business holds on the consumer. However, this right does not apply where the business needs to retain the personal information in order to do any of the following:
      - Provide goods or services to the consumer
      - Detect or resolve issues security or functionality-related issues
      - Comply with the law
      - Conduct research in the public interest
      - Safeguard the right to free speech

    • Right to opt-out: Consumers have the right to opt out of their personal information being sold by a Company. you can do so by emailing privacy@cobalt.io, or by clicking do not sell my info.

    The right to non-discrimination: Consumers have the right not to be discriminated against for having exercised their rights under the CCPA.

    As of January 2023, Consumers are granted the following additional rights under the California Privacy Rights Act (“CPRA”):

    • The right to request that inaccurate personal information be corrected by the Company responsible. This type of request should be fulfilled within 45 days however, where necessary, an additional 45 days may be necessary. If the deadline changes to 90 days, we will inform you without delay and explain our reasoning.
    • The right to limit the use and disclosure of sensitive personal information collected about them. This means you can direct businesses to only use your sensitive personal information (for example, your social security number, financial account information, your precise geolocation data, or your genetic data) for limited purposes, such as providing you with the services you requested. Please note that Cobalt does not process sensitive personal data about you for any purpose.

    You may exercise your Consumer Rights at any time by emailing privacy@cobalt.io or clicking here.

    We will confirm receipt of any consumer rights request within 10 days, and move to action your request within 45 days following initial receipt (except when the deadline has been properly extended, in which case the timeframe is 90 days).

    Please note that we will need to verify your identity or your Authorized Agent’s (which may be a person or a business entity registered with the California Secretary of State) permission to submit the request on your behalf. We will inform you of additional information we require (if any) to verify your identity after we have received your request. If for any reason we are unable to fulfill your request, we will inform you of our decision in writing. 

    In no event will Cobalt discriminate against any Consumer for exercising their CCPA rights.

    Sale, collection & use of Personal Information about Consumers

    Please be advised that Cobalt engages in limited data transfers to third parties that may be considered a data sale under applicable law. Such transfers occur only in the context of presentations, panels, and other events arranged or sponsored by Cobalt, that may be presented or co-sponsored with other third parties. In such cases, event attendees will be prompted to provide certain identifying information to register for the event in question.
    Such information will be shared for marketing purposes with all parties presenting or sponsoring the event, including third parties with whom the attendee may not have a pre-existing relationship. Such third parties will be identified in materials accompanying any prompt to provide information. 

    You have the right to opt out of your data being shared in this manner. you can do so by emailing privacy@cobalt.io, or by clicking here: do not sell my info.

    CCPA: Descriptions of processing

    The table below includes information on the categories of Consumers' Personal Information we collected within the last twelve (12) months, categories of sources from which such Personal Information was collected and the business or commercial purpose for which the Personal Information was collected:

    Category of Personal Information we Collected

    Category of Source from which Personal Information was Collected

    Business or Commercial Purpose for which Personal Information was Collected

    Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, etc.

    • the Consumer directly;

    • data analytics providers;

    • operating systems and platforms;

    • social networks; and

    • data brokers

    Performing services for the Consumer, including maintaining or servicing accounts, providing customer services and verifying customer information and fulfilling orders and transactions

    Commercial information, such as records of services purchased

    • the Consumer directly

    Processing payments; fulfilling orders and transactions; providing financial documents

    Internet or other electronic network activity information, including information regarding a Consumer’s interaction with our site

    • the Consumer directly;

    • data analytics providers;

    • operating systems and platforms;

    • social networks; and

    • data brokers

    Providing advertising or marketing services; for analytics activities

     

    The table below describes the categories of Personal Information about Consumers we have disclosed to third parties for a business purpose and the corresponding categories of third parties to whom such Personal Information was disclosed within the last twelve (12) months:

    Category of Personal Information we Disclosed for a Business Purpose

    Category of Third Party to whom Personal Information was Disclosed

    Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, etc.

    Cobalt's vendors who assist us in providing our products and services, including access to the services

    Commercial information, such as records of services purchased

    Cobalt’s vendors who assist us in providing our products and services, including completing transactions and for accounting purposes. 

    Internet or other electronic network activity information, including information regarding a Consumer's interaction with our site

    Cobalt’s vendors who assist us in providing our products and services, including promotion and marketing activities. 


    16. AI USE IN THE CHATBOT

    Cobalt’s chatbot uses a third party LLM. The LLM is a RAG model from openAI gpt 4. User data is is utilized for support purposes, however it is not used for future training of the LLM . Data inputted into the chatbot is shared with and stored by the third party providing the LLM.

    17. CHANGES TO THIS POLICY

    Cobalt reserves the right to update and amend this Policy from time to time, in order to reflect any changes to our data processing activities or advancements in laws and regulations. Any changes we may make to our Policy in the future will be published on this page. Please review this page frequently to check for any updates or changes to our Policy.

    18. CONTACT US

    If you have any questions, comments or feedback about this privacy policy, or the ways in which we collect and process your personal information, or wish to exercise your rights under GDPR or CCPA please do not hesitate to contact us at privacy@cobalt.io.

    Last updated: March 2023

  • Licenses

     

    Name License Homepage
    The OWASP Foundation License Homepage
    Bugcrowd VRT License Homepage
    CWE Common Weakness Enumeration License Homepage

     

Platform Services Agreement

IMPORTANT, READ CAREFULLY: CUSTOMER’S USE OF AND ACCESS TO THE SERVICES OF COBALT LABS, INC. ARE CONTINGENT UPON CUSTOMER’S COMPLIANCE WITH, AND ACCEPTANCE OF THIS PLATFORM SERVICES AGREEMENT.  BY CUSTOMER BY EXECUTING A SALES ORDER OR SOW THAT REFERENCES THESE TERMS, CUSTOMER AGREES TO ALL OF THE TERMS AND CONDITIONS STATED HEREIN. 

These terms were last updated on April 1, 2025, and the Agreement shall be effective between Customer and Cobalt as of the Effective Date of the Sales Order executed by both parties.

Scope of this Agreement, Other Terms

This Platform Services Agreement, together with any Sales Order(s), SOW(s), Addenda, Supplemental Terms or Third-Party Terms, if any, form the “Agreement” and govern the access to, and use of the Services provided by Cobalt Labs, Inc., a Delaware corporation, with a principle place of business located at 575 Market Street, 4th Floor, San Francisco, CA 94105, USA, together with our Affiliates (“Cobalt”) to the entity identified on any applicable Sales Order or SOW as the Customer (the “Customer”). This Agreement shall be effective as of the date of last signature recorded on such Sales Order or SOW. Customer and Cobalt may be referred to collectively as “Parties” and individually as a “Party”. All other capitalized terms shall have the meaning ascribed to Section 1 or as defined elsewhere in the Agreement.

This Agreement makes reference to a number of other supplemental terms which Customer may also be agreeing to by accepting the terms of this Agreement, and which on this page’s Navigation Menu (the "Supplemental Terms").  Cobalt reserves the right to update the Supplemental Terms at any time. 

In the event of any inconsistency or conflict between the terms of this Agreement, any applicable Supplemental Terms, and any Sales Order(s) or SOW(s) executed hereunder, the terms of the Sales Order(s) or SOW(s) shall prevail over any conflicting terms in this Agreement or the Supplemental Terms. The terms of this Agreement shall prevail over any conflicting terms in the Supplemental Terms. The Supplemental Terms shall apply only to the extent that they do not conflict with any Sales Order(s), SOW(s), or the terms of this Agreement.

1. Definitions.

1.1 “Affiliate” shall mean any entity controlled by, controlling, or under common control with a Party to this Agreement during the period such control exists. For the purposes hereof “control” means the power to direct the operation, policies and management of an entity through the ownership of more than fifty percent (50%) of the voting securities of such entity, by contract, or otherwise.

1.2 “Applicable Laws” shall mean any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, directive, common law, judgment, decree or other requirement or rule of any federal, state, local or foreign government or political subdivision thereof, or any arbitrator, court or tribunal of competent jurisdiction applicable to a Party’s performance of its obligations or the exercise of its rights under this Agreement.

1.3 “Asset(s)” shall mean Customer’s (or a third-party’s) software applications, networks, systems, IP addresses, hardware, and or other assets that are to be tested via a Security Program.

1.4 “Cobalt Account” shall mean Customer’s account on the Platform.

1.5 “Cobalt Content” shall mean all Content that Cobalt makes available through the Platform, and includes without limitation any data, documents, screens, templates, and forms of reports. Cobalt Content expressly excludes Customer Data. 

1.6 “Content” shall mean text, graphics, images, music, software, audio, video, and other information. 

1.7 “Credit” shall mean the prepaid unit purchased by Customer which can be exchanged for Platform Services, Professional Services, or for other offerings as allowed by Cobalt. Each Credit corresponds to a particular level of effort by Cobalt.

1.8 “Customer Data” shall mean the Assets, any Content, data, documents, or any other information provided by Customer to Cobalt in connection with Customer’s use of the Platform.

1.9 “DAST Target” means a single, unique URL, application or website, owned by the Customer and running in a specified Customer environment, which is assigned to be scanned by Cobalt.

1.10 “Intellectual Property Rights” shall mean any and all registered and unregistered rights granted, applied for or otherwise now or hereafter in existence under or related to any patent, copyright, trademark, trade secret, database protection or other intellectual property rights laws, and all similar or equivalent rights or forms of protection, in any part of the world.

1.11 “Personal Information” shall mean any information relating to an identified or identifiable natural person or as otherwise defined under Applicable Laws, including without limitation, “personal data” as used under the EU’s General Data Protection Regulation and under the UK’s Data Protection Act of 2018, and “personal information” as used under applicable California law. 

1.12 “Platform” shall mean the platform provided by Cobalt to Customer in connection with the Services, which includes all related software, interfaces, tools, utilities, and other technologies (and any related intellectual property), where Customer is able to request the Services.

1.13 “Platform Services” shall mean the services available via the Platform, including, but limited to, Platform features that allow for connecting the Customer with Security Professionals providing Asset testing.

1.14 “Professional Services” shall mean cybersecurity services provided by Cobalt to Customer pursuant to a separately executed statement of work (“SOW”) or similar document, excluding the Platform Services and Platform itself. Professional Services are subject to the Cobalt Professional Services Addendum. SOWs shall commence on the Start Date and remain in effect until the occurrence of the End Date, each as defined in the SOW inself.

1.15 “Sales Order(s)” shall mean a transactional document referencing this Agreement, which has been agreed to by the Parties in a mutually signed writing for the purchase of Credits.

1.16 “Security Professional(s)” shall mean any individuals or third-parties who provide the Services on behalf of Cobalt.

1.17 “Security Program” shall mean the scope of Services listed on the Platform for Customer’s Asset(s) to be completed by Security Professional(s).

1.18 “Services” shall mean collectively, any of the Platform Services or Professional Services so ordered by the Customer under this Agreement.

1.19 “Third-Party Terms” means any end-user license agreement or pass-through terms and conditions that may govern or form portions of Cobalt’s Platform Service offerings. Such Third-Party Terms will be made available at the time of Customer’s ordering of such service offerings, and may be changed at any-time by Cobalt’s third-party partners or providers of such service offerings.

1.20 “Usage Parameters” means the maximum number of permitted DAST scan Targets using Cobalt’s DAST solution as specified in Sales Order and any other parameters specified in the Sales Order. 

1.21 “User” shall mean an employee, contractor, or agent of Customer who is authorized by Customer to use the Platform. 

1.22 “Vulnerability Reports” shall mean a confidential report created by a Security Professional and provided to Customer via the Platform, containing security vulnerabilities found during the testing of the Asset(s) in scope for a given Security Program.

2.  Sales Orders, Invoicing and Payment.

2.1 Sales Orders. Credits are ordered via Sales Orders, each of which shall be deemed to be incorporated herein by reference. Each Sales Order shall specify, as applicable, the Credits Tier ordered, the quantity of Credits, the fees and the term of the Sales Order (“Service Period”). A Customer Affiliate may enter into a Sales Order pursuant to this Agreement, by which the Affiliate agrees to be bound by the terms and conditions of this Agreement; provided, that the Customer shall be responsible for any of its Affiliates’ compliance with the terms and conditions of this Agreement. Notwithstanding anything to the contrary in the remainder of the Agreement, in the event that any components of the Services necessary to provide any of the Services ceases to be available to Cobalt or is reduced in quality by a third-party provider, Cobalt may terminate such Services (or any portions thereof) by providing Customer with written notice of such termination.

2.2 Invoicing and Payment.  Cobalt will invoice Customer as set forth in the Sales Order. Customer will pay all fees within fifteen (15) days of the date of the invoice, unless otherwise set forth in the Sales Order; provided, that notwithstanding the Sales Order, if Credits are used in advance of full payment being made, Cobalt may invoice immediately. All fees shall be payable via automated clearing house payment (“ACH”) or wire transfer in accordance with the terms herein. Invoices will be sent by email to the address provided in the applicable Service Order or as otherwise provided by Customer in writing, and shall be deemed received when sent to such address. Unless otherwise stated, all fees specified on a Service Order or SOW do not include any local, state, federal, or other taxes or duties of any kind (“Taxes”). Customer shall be responsible for paying all Taxes, excluding any Taxes based on Cobalt’s or its Affiliates’ income. If Customer or any of its Affiliates has the legal obligation to pay or collect Taxes in any jurisdiction, Customer shall be responsible for such Taxes and the appropriate amount shall be invoiced to and paid by Customer, unless Customer provides to Cobalt a valid tax exemption certificate authorized by the appropriate taxing authority. Any overdue invoices will accrue late interest at the rate of one and one-half percent (1.5%) of the outstanding balance per month or the greatest amount allowed by Applicable Laws, whichever is lower, plus all expenses of collection.

2.3 Suspension of Service for Non-Payment. Cobalt may suspend access to the Platform and Services upon written notice of non-payment of any undisputed invoice. Cobalt will not suspend Customer’s access to the Platform or Services while the Parties are disputing the applicable charges in good faith, and are cooperating diligently to resolve the dispute. 

2.4 Price Changes. Future renewals or orders of any Credits or Services purchased will occur at the then-current price, except in the event of an auto-renewal pursuant to Section 2.5 where Cobalt does not provide notice to Customer of a price change.

2.5 Autorenewal. Each Sales Order shall remain in effect for the Service Period as specified in the applicable Sales Order, and will automatically renew for additional terms of one (1) year on an annual basis, or as otherwise provided for in the Sales Order, unless notice of non-renewal is provided at least sixty (60) days prior to the end of the then-current Service Period of the Sales Order (“Notice Period”). In the event of any price changes pursuant to an autorenewal, Cobalt will notify Customer at least thirty (30) days prior to the Notice Period.

3.  Services

3.1 Credits. Cobalt will scope Services based on projected level of effort as expressed in Credits. Credits will be added to Customer’s Cobalt Account after purchase via a Sales Order. The features associated with each Credit will vary depending on the applicable Tier, as defined herein, to which Customer has purchased. The price and Tier associated with a purchased Credit will be set forth in an applicable Sales Order. Credits must be used by the end of the applicable Service Period, or annual term within said Service Period. For the purposes of this Section, “used” means the completion of any Security Program for which the Credits are allocated.

3.2 Tiers. Access to Cobalt’s Services is provisioned across service levels that define the features and functionality associated with Customer’s Cobalt Account (“Tiers”). The features and functionality associated with each Tier is more fully set out on https://www.cobalt.io/pentest-pricing  or as further detailed in an engagement brief on the Platform. The Tier associated with Customer’s Cobalt Account will be selected on the applicable Sales Order. A Customer’s Cobalt Account may only be associated with one Tier at a time during the Service Period. Tiers may be upgraded, but not downgraded, prior to the end of the Service Period. 

3.3 Vulnerability Report. Cobalt will produce a Vulnerability Report detailing findings uncovered during performance of the Services. Vulnerability Reports are not customizable, except where Customer’s Credit Tier includes Vulnerability Report customization. Cobalt acts as a third-party assessor and possesses a degree of independence in formulating its findings (as articulated via a Vulnerability Report) and as such, Cobalt will not remove or minimize findings in a Vulnerability Report at a Customer’s request without a sufficient factual basis for so doing.

3.4 Security Professionals. Security Professionals are independent third-parties who are retained by Cobalt to assist in providing certain Services. Customer acknowledges that Security Professionals are not contingent workers engaged directly by the Customer. Customer may not enter into contracts directly with Security Professionals. Cobalt will not facilitate the exchange of, or execution of, any agreements directly between Security Professionals and Customer, including without limitation, any non-disclosure agreement, confidentiality agreement, or similar document.

3.4.1 Vetting and Selection of Security Professionals. Each Security Professional will have undergone a background check consisting of identity confirmation and criminal background screening (a “Background Check”) in advance of providing services to Cobalt. The Background Check will minimally cover criminal conduct over a period of time to be determined by Cobalt, in its sole discretion, but in all cases shall be limited to the time periods permissible under Applicable Laws. Security Professionals will not perform Services for a Customer without their first having satisfactorily passed the Background Check.

3.4.2 Security Professional Eligibility. Security Professionals shall not be: (a) a resident or national of any country subject to a United States embargo or other similar United States export restrictions; (b) on the United States Treasury Department’s list of Specifically Designated Nationals as defined under Applicable Laws; (c) on the United States Department of Commerce’s Denied Persons List or Entity List as defined under Applicable Laws; or (d) identified by the United States government as a prohibited end-user of United States export controlled items or otherwise subject to sanctions or similar laws, regulations, or executive orders.

3.4.3 Special Requests. For Customers at the Enterprise Tier, Cobalt will accommodate certain special requests regarding the Security Professionals performing Services for the Customer. Special requests are limited to: (a) staffing a test with Security Professionals from a specific region or time zone, and (b) ensuring that Security Professionals communicate with Customer and/or perform testing at specified times. Other special requests may be facilitated on a case-by-case basis, at Cobalt’s sole discretion. All special requests are subject to Cobalt’s availability and capacity. Cobalt may not be able to accommodate more than one (1) such request per engagement. Customers should communicate with their Cobalt-assigned CSM to determine whether a particular request may be accommodated.

3.5 Professional Services. Any provision of Professional Services will be scoped, in advance, on a per engagement basis via an SOW and shall be additionally subject to terms set forth in the Cobalt Professional Services Addendum. The Professional Services Addendum will only be applicable in the event that Customer has ordered Professional Services via an SOW.

3.6 Informational Support. During the Service Period, Cobalt will provide reasonable support to Customer relating to the use and operation of the Services.

3.7 Cobalt Personnel, Platform and Services. Cobalt shall have sole discretion in staffing of Platform Services or Professional Services. Customer hereby acknowledges that certain Services may be performed by subcontractors, which may include Cobalt’s Affiliates or partners. Cobalt may change subcontractors at any time, in its sole discretion. Cobalt acknowledges that it is responsible and shall be liable for the performance of any such subcontractors pursuant to the terms of this Agreement. Cobalt reserves the right, at its sole discretion, to modify, enhance, or remove features of the Platform or Services; provided that such modifications do not materially diminish the functionality of the Services.

4.  Customer Obligations.

4.1 User Eligibility. Customer represents and warrants that each User is not: (a) residing in, or accessing the Services for the benefit of any person(s), entity(ies), or government of, any country subject to a United States embargo or other similar United States export restrictions; (b) on the United States Treasury Department’s list of Specifically Designated Nationals as defined under Applicable Laws; (c) on the United States Department of Commerce Denied Persons List or Entity List as defined under Applicable Laws; or (d) identified by the United States government as a prohibited end-user of United States export controlled items or otherwise subject to sanctions or similar laws, regulations, or executive orders. 

4.2 Authorization. The Customer permits Cobalt to access the Customer's Assets and Customer Data to enable the Services, which constitutes authorization under the Computer Fraud and Abuse Act, the Computer Misuse Act 1990, Directive 2013/40/EU and similar laws and regulations as applicable to the Customer and/or the Services, and represents and warrants that it has the authority, and will maintain such authority, at all times throughout the Term of this Agreement, to give such permission. Customer is responsible for obtaining all necessary authorizations and permissions required or necessary for Cobalt to provide the Services. By submitting a Security Program for review, Customer represents and warrants that it has obtained any and all such authorizations and permissions, including, but not limited to, those from any cloud hosting providers, network owners, and any other relevant parties.

4.3 DAST Customers Scanning Limits. Customer is subject to, and shall not exceed, the Usages Parameters associated with Customer’s DAST scan Sales Order. Customers should consult the text of their Sales Order to confirm the Usage Parameters applicable to their DAST subscription. Cobalt may, in the event of any usage overage, invoice Customer immediately for such overages, and suspend Customer’s access to the entire Platform until such amount are paid.

5. Intellectual Property Rights.

5.1 Cobalt Property. Customer acknowledges and agrees that Cobalt and/or its licensors own all right, title and interest to the Platform, Services and Cobalt Content, including without limitation any techniques, ideas, concepts, methods, processes, software, utilities, data, documents, directories, designs, user interfaces, know-how, graphics, video content or other data or information acquired, created, developed or licensed by Cobalt and/or its licensors and all modifications, improvements and derivative works thereof and all associated Intellectual Property Rights (collectively as “Cobalt Property”).

5.2 Customer Property. The Parties acknowledge and agree that Customer and/or its licensors own all right, title and interest to the Assets and any Customer Data made available by the Customer through the Platform or Services and any findings contained in the Vulnerability Reports created specifically and uniquely for the Customer, but excluding any third-party intellectual property, Cobalt Property, and any Intellectual Property Rights therein.

5.3 Proprietary Rights Notice. All trademarks, service marks, logos, trade names and any other proprietary designations of Cobalt used herein are trademarks or registered trademarks of Cobalt. Any other trademarks, service marks, logos, trade names and any other proprietary designations are the trademarks or registered trademarks of their respective Parties.

6. License Grants.

6.1 Cobalt Platform and Services License Grant. Cobalt grants Customer a limited, world-wide, non-exclusive, non-transferable, royalty-free, non-sublicensable right and license, during the Service Period  specified in a Sales Order, to (i) access and use the Platform and Services in accordance with the terms of this Agreement; and (ii) access and view any Cobalt Content contained on the Platform solely for Customer’s internal use in connection with Customer’s use of the Services. Except as provided herein, Customer shall have no right to make the Platform, Services or Cobalt Content available to, use the Platform, Services or Cobalt Content on behalf of, or for the benefit of any third-party without Cobalt’s express written authorization. Except for the rights expressly licensed to Customer hereunder, Cobalt and its licensors reserve and retain all right, title and interest to the Platform, Services and Cobalt Content.

6.2 Statistical Data and Product Development. Customer consents to Cobalt’s collection of high-level, generic, anonymous, statistical and/or benchmarking data derived from portions of Customer Data and Customer’s usage of the Platform and the Services that will be aggregated with other findings, results and information derived from Cobalt’s other customer’s data and usage information (the “Statistical Data”). Cobalt shall adhere to the principle of data minimization, collecting only the portions Customer Data and Customer’s usage data that is directly relevant and necessary for the specified purposes of generating Statistical Data, benchmarking, the development of Product Derivatives, and for conducting Functionality Testing, as described and defined in this section. All such Statistical Data is the sole and exclusive intellectual property of Cobalt; provided, that Cobalt shall in all cases refrain from publishing any Statistical Data or any insights or work derived therefrom in a manner that reveals (directly or indirectly) any specific person, Customer, Customer Data, Customer Confidential Information or Asset. Further, Cobalt may prepare new and derivative products and/or services incorporating, and based upon, the usage activity, statistics, service configurations, and the Statistical Data, and that of Cobalt’s other customers (“Product Derivative(s)”) including, but not limited to, the development of certain machine language models (“MLMs”) and artificial intelligence (“AI”) tools. Cobalt may also utilize Statistical Data to test future functionality of Cobalt’s Services (the “Functionality Testing Right”); provided that, such Functionality Testing Right will not compromise Customer’s or Customer’s access to, or integrity of Customer Data within the Platform. Cobalt shall own all right, title and license in the results of any Product Derivative(s) and Functionality Testing Right results, which it may use in its own research, marketing and other commercial services, offerings or activities. 

6.3 Customer Data License Grant. Customer grants to Cobalt a worldwide, non-exclusive, non-transferable, royalty-free license and right to, during the Service Period, (i) use, access, view, copy, display, transmit and store Customer Data on, through or by means of the Platform and Services solely to the extent necessary to operate, maintain, perform, and provide the Platform and Services, (ii) use, access, view, copy, and display, information relating to the Asset(s) solely to the extent necessary to engage in testing and/or create the Vulnerability Reports or otherwise perform tasks in connection with the Security Program; and (iii) create, view, display, transmit and store Vulnerability Reports. Customer acknowledges that this license grant extends, to the extent necessary to facilitate performance of the Services, to Cobalt’s personnel and Security Professionals. Except as expressly licensed herein, Customer shall retain all right, title and/or interest to Customer Data, the Asset(s) and all intellectual property rights therein, and except as expressly licensed herein, Cobalt shall obtain no right or license thereto.

6.4 Vulnerability Report. Subject to the limitations set forth in Section 14.2 below, Cobalt grants Customer a limited, world-wide, non-exclusive, non-transferable, royalty-free, non-sublicensable right and license to use or share the Vulnerability Report(s) for Customer’s legitimate business purposes, provided that Customer is not acting as a reseller of Cobalt’s Services in this capacity.

7. Confidentiality.

7.1 Confidential Information. Throughout the term of the Agreement the Parties may need to exchange or make available confidential and proprietary information to the other Party in connection with this Agreement, whether disclosed in written, oral, electronic or visual form, which is identified as confidential at the time of disclosure or should reasonably be understood to be confidential given the nature of the information or the circumstances surrounding the disclosure, including without limitation business, operations, finances, technologies, products and services, pricing, personnel, customers and suppliers (“Confidential Information”). Without limiting the foregoing, (i) Cobalt Confidential Information shall include Cobalt Property; and (ii) Customer Confidential Information shall include Customer Data and the Asset(s), and findings in a Vulnerability Report. 

7.2 Confidentiality. During the Term, and continuing after expiration or termination of the Agreement, each Party shall retain in confidence, and not use (except for the purposes described in this Agreement), the Confidential Information of the other Party. The receiving Party will use the same degree of care and discretion (but not less than reasonable care) to avoid disclosure, publication or dissemination of the disclosing Party’s Confidential Information as it uses with its own confidential or proprietary information of a similar nature. Except as authorized in this Agreement or a Sales Order, the receiving Party will not disclose the Confidential Information of the disclosing Party to a third-party other than Security Professionals, sub-contractors, or to its or its Affiliates’ employees, contractors, agents or advisors in connection with its performance of this Agreement who are bound by terms no less protective of a disclosing Party’s rights as those set forth in this Agreement and the receiving Party shall be liable to the disclosing Party for any violation of this Agreement by such persons. This Section 7 of the Agreement shall supersede and replace any confidentiality or non-disclosure agreement signed by the Parties prior to the Effective Date.

7.3 Exclusions. Confidential Information shall not include information that (a) is publicly known at the time of disclosure, (b) is lawfully received from a third-party not bound in a confidential relationship with the disclosing Party, (c) is published or otherwise made known to the public by the disclosing Party, or (d) was or is generated independently without use of the disclosing Party’s Confidential Information. The receiving Party may disclose Confidential Information as required to comply with orders of governmental entities that have jurisdiction over it or as otherwise required by law, provided that the receiving Party (i) gives the disclosing Party reasonable advance written notice to allow the disclosing Party to seek a protective order or other appropriate remedy (except to the extent that compliance with the foregoing would cause it to violate an order of the governmental entity or other legal requirement), (ii) discloses only that portion of the Confidential Information as is required, and (iii) cooperates with the disclosing Party to obtain confidential treatment for any Confidential Information so disclosed. Notwithstanding anything herein to the contrary, provided that Cobalt does not use or disclose Customer Confidential Information, Cobalt shall be free to use, exploit and disclose its general skills, concepts, ideas, know-how, and expertise gained or learned during the course of this Agreement, and Cobalt shall not be restricted from creating output for other Customers which is similar to that provided to Customer.

7.4 Remedies. Due to the unique nature of Confidential Information gained through the Services, the Parties acknowledge that the breach of this Section 7 could cause irreparable harm, which monetary damages would be insufficient to remedy and in the event of such a breach, or threatened breach, the non-breaching Party shall be entitled to seek injunctive relief, as well as any other remedy which may be available at law or in equity.

8. Security.

8.1 Cobalt Security Obligations. Cobalt agrees to take commercially reasonable technical and organizational measures designed to secure the Cobalt Platform from unauthorized access or use, including maintaining the security standards at https://www.cobalt.io/security/practices.

8.2 Customer Security Obligations. Customer shall maintain appropriate security for the Customer Data in transit and shall be responsible for backing up Customer Data stored on Customer’s computer systems. 

8.3 PII. Customer acknowledges that it will endeavor to preclude or limit to the greatest extent possible, the exposure of Security Professionals to any personally identifiable information, except as necessary for Customer’s establishment of its Cobalt Account, any patient, medical or other protected health information regulated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) or any similar federal or state laws, rules or regulations or any other information subject to regulation or protection under Applicable Laws such as, without limitation, the Gramm-Leach-Bliley Act (or related rules or regulations) (collectively, “PII”), in Asset(s) tested via the Services. Where any PII will be present in Asset(s) tested via the Services, Customer will advise Cobalt and the Security Professionals of that fact through the Security Program. Where Customer is subject to laws or regulations requiring PII processing activities be addressed via a data processing agreement, service provider agreement or similar (such as, without limitation, GDPR, CCPA, and like legislation and implementing regulations), any processing activities will be subject to a Cobalt Data Processing Agreement, pursuant to Section 8.4 below.

8.4 DPA. Unless otherwise requested and specifically agreed to in a Sales Order, Customer Data will be warehoused in Cobalt’s North American Data Center (“NADC”). If Customer will provide Cobalt with access to any PII or other similar protected information, Customer agrees to the terms of Cobalt’s Standard Data Processing Agreement (“DPA-NA”), which is hereby incorporated by reference into the terms of this Agreement. If Customer so elects to be warehoused in the Cobalt’s European Data Center (“EUDC”) in a Sales Order, and Customer will provide Cobalt with access to any PII or other similar protected information, Customer shall agree to the terms of Cobalt’s European Data Processing Agreement (“DPA-EU”), which must be signed prior to the granting of access to such PII by Customer, and which, once executed by both Parties, shall hereby incorporated by reference into the terms of this Agreement. 

8.5 BAA. If Customer is a Covered Entity, as defined by HIPAA, and will be providing Cobalt with access to Protected Health Information (“PHI”), Customer agrees to the terms of Cobalt’s Business Associate Agreement (“BAA”), which, once executed by both Parties, shall be incorporated by reference into the terms of this Agreement.

9. Warranties.

9.1 Customer Warranty. Customer warrants that: (i) Customer either is the sole and exclusive owner of all Customer Data and Asset(s) made available or accessed through the Platform or Services or Customer has obtained all necessary legal rights, licenses, consents, permissions, approvals and releases to grant to Cobalt and its Security Professionals the rights to such Customer Data and Asset(s), as contemplated under this Agreement; (ii) neither the Customer Data nor Customer’s posting, uploading, publication, sublicensing, submission or transmittal of any Customer Data or Cobalt’s or Security Professionals’ use of or access to the Customer Data (or any portion thereof) or Asset(s) on, through or by means of the Platform and the Services will infringe, misappropriate or violate any third-party Intellectual Property Rights, contractual rights or rights of publicity or privacy, or result in the violation of any Applicable Laws; and (iii) Customer shall comply with all Applicable Laws relating to its performance under this Agreement.

9.2 Cobalt Warranty. Cobalt warrants that: (i) Cobalt either is the sole and exclusive owner of all Cobalt Content and the Platform or Cobalt has obtained all necessary legal rights, licenses, consents, permissions, approvals and releases to grant to Customer the right to such Cobalt Content and the Platform, as contemplated under this Agreement; (ii) Cobalt shall comply with all Applicable Laws relating to its performance under this Agreement; (iii) Cobalt shall provide the Platform Services in a professional manner and will provide a standard of care consistent with that used by service providers similar to Cobalt, and that Cobalt shall deliver the Platform Services substantially in conformity with this Agreement; and (iv) the Security Professionals have the general skills and expertise necessary to perform the Services. In order to state a claim for breach of Section 9.2 (iii) or (iv), Customer must provide notice of such non-compliance within the thirty (30) day period following the delivery of a Vulnerability Report, specifying the details of such noncompliance. If Customer provides Cobalt with the required notice, as Customer’s sole and exclusive remedy and Cobalt’s sole and exclusive liability for breach under this Section 9.2 (iii) or (iv), Cobalt shall, at the Customer’s request and option, either extend the period of testing to perform additional testing or reperform the Platform Services using different Security Professionals. This Section 9.2 (iii) and (iv) shall not apply during any trial license period.

9.3 Disclaimers. 

9.3.1 EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH ABOVE, THE PLATFORM AND SERVICES ARE PROVIDED "AS IS", WITHOUT ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT LIMITING THE FOREGOING, COBALT EXPLICITLY DISCLAIMS ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, AND ANY WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE. COBALT MAKES NO WARRANTY THAT THE SERVICES WILL MEET CUSTOMER’S REQUIREMENTS OR BE AVAILABLE ON AN UNINTERRUPTED, SECURE, OR ERROR-FREE BASIS. COBALT DOES NOT GUARANTEE THAT THE SERVICES WILL REVEAL ALL SECURITY VULNERABILITIES, OR MALICIOUS CODE IN CUSTOMER’S ASSETS. NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED FROM COBALT OR THROUGH THE PLATFORM OR SERVICES, WILL CREATE ANY WARRANTY NOT EXPRESSLY MADE HEREIN.

9.3.2 ANY AND ALL WARRANTIES PROVIDED BY COBALT HEREIN ARE VOID TO THE EXTENT THE SERVICES (I) FAILS TO CONFORM TO ANY OR ALL SUCH WARRANTIES AS A RESULT OF THE SERVICES’ USE WITH ANY THIRD-PARTY SOFTWARE OTHER THAN AS EXPRESSLY AUTHORIZED BY COBALT; OR (II) IS USED OTHER THAN IN ACCORDANCE WITH PUBLISHED DOCUMENTATION OR OTHERWISE IS USED IN BREACH OF THIS AGREEMENT.

10. Indemnification

10.1 Mutual Indemnification. Each Party (the “Indemnifying Party”) will indemnify, defend and hold harmless the other Party and its Affiliates, subsidiaries, permitted successors in interests and assigns and its and their respective officers, directors, employees, and agents, from and against any and all third-party claims, actions, demands or lawsuits arising out of performance of this Agreement, and any resulting judgments, damages, liabilities, fines, penalties, losses, costs and expenses (including reasonable attorneys’ fees) or any amounts paid in settlement thereof (collectively “Claim(s)”) subject to the conditions herein, to the extent arising out of or relating to: (i) the gross negligence or willful misconduct of the Indemnifying Party; or (ii) any act or omission by the Indemnifying Party that results in personal injury or death.

10.2 Customer Indemnity. Customer agrees to defend, indemnify, and hold Cobalt and its Affiliates and their officers, directors, employees, contractors, and agents harmless from and against any Claims arising out of any third-party claim arising out of (i) Customer’s collection, processing, or submission of Customer Data; (ii) Customer’s infringement, misappropriation or violation of any third-party Intellectual Property Rights, contractual rights or rights of publicity or privacy; or (iii) Customer’s actions resulting in Services being performed on an unauthorized Asset.


10.3 Cobalt Indemnity. Cobalt agrees to defend, indemnify, and hold Customer and its Affiliates (only to the extent such Affiliates have entered into Sales Orders hereunder) and their officers, directors, employees and agents harmless from and against any Claims,  arising out of any third-party claim arising out of the infringement or violation of the Platform of the Intellectual Property Rights of a third-party; provided that Cobalt shall not be responsible to provide any such indemnity for any Claim to the extent arising out of (i) Customer Data; or (ii) use of the Platform or Services in an unauthorized manner.

10.4 Indemnity Process. The indemnifying Party shall conduct and have sole control of the defense and settlement of any claim for which it has agreed to provide indemnification; provided that no settlement shall require the indemnified to admit liability. The indemnified Party shall have the right to provide for its separate defense at its own expense. The indemnified Party shall give prompt notice of all claims for which indemnity is sought and shall cooperate in defending against such claims, at the expense of the indemnifying Party. The rights and remedies set forth in this Section 10 state each Party’s exclusive liability and exclusive rights and remedies with regard to claims made by a third-party for intellectual property infringement or violation of a third-party’s intellectual property rights.

11. Limitations and Exclusions of Liability and Damages.  

11.1 Limitations of Liability. EXCEPT FOR EACH PARTY’S OBLIGATIONS UNDER SECTIONS 7 AND 10.1 ABOVE,  AND FOR CUSTOMER’S OBLIGATIONS UNDER SECTIONS 4, 6, AND 10.2 ABOVE, IN NO EVENT SHALL EITHER PARTY’S, OR ITS AFFILIATES’ AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, EXCEED THE LESSER OF: (I) THE NON-BREACHING PARTY’S ACTUAL DIRECT DAMAGES; OR (II) THE AGGREGATE AMOUNTS PAID AND PAYABLE BY CUSTOMER TO COBALT IN THE TWELVE (12) MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO THE LIABILITY.

11.2 Exclusion of Consequential and Related Damages. IN NO EVENT SHALL EITHER PARTY, NOR THEIR AFFILIATES’ HAVE ANY LIABILITY TO THE OTHER FOR ANY LOST PROFITS, REVENUES (EXCEPT FOR ANY FEES OWED PURSUANT TO THIS AGREEMENT), LOSS OF USE, LOSS OF OR DAMAGE TO SOFTWARE OR DATA OR LOSS OF GOODWILL, SERVICE INTERRUPTION, COMPUTER DAMAGE OR SYSTEM FAILURE, COSTS OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, GOODWILL ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE SERVICES, FROM ANY COMMUNICATIONS OR INTERACTIONS WITH OTHER USERS OF THE PLATFORM OR SERVICES OR FOR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE OR CONSEQUENTIAL DAMAGES (COLLECTIVELY, “INDIRECT DAMAGES”) HOWEVER CAUSED AND WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, WHETHER OR NOT THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH INDIRECT DAMAGES.

11.3 Super Cap.  NOTWITHSTANDING ANYTHING HEREIN TO THE CONTRARY, THE LIMITATIONS AND EXCLUSIONS OF LIABILITY SET FORTH IN SECTIONS 11.1 OR 11.2 HEREOF SHALL NOT APPLY TO EITHER PARTY’S (I) INDEMNIFICATION OBLIGATIONS HEREUNDER, (II) BREACH OF CONFIDENTIALITY (SECTION 7) OR DATA SECURITY OBLIGATIONS HEREUNDER; (III) VIOLATION OR INFRINGEMENT OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS (THE “EXCLUDED CLAIMS”); PROVIDED THAT NEITHER PARTY’S TOTAL AGGREGATE LIABILITY FOR THE EXCLUDED CLAIMS SHALL NOT EXCEED THE LESSER OF: (I) THE NON-BREACHING PARTY’S ACTUAL DIRECT DAMAGES; (II) FIVE HUNDRED THOUSAND US DOLLARS ($500,000 USD), OR (III) THREE TIMES (3X) THE AGGREGATE AMOUNTS PAID AND PAYABLE BY CUSTOMER TO COBALT IN THE TWELVE (12) MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO THE LIABILITY.

12. Term and Termination.

12.1 Term of Agreement.  This Agreement shall commence on the Effective Date and will continue thereafter until (i) the furthermost end date of the Service Period in the last to expire Sales Order or SOW; or (ii) where applicable, the date of termination for material breach as effectuated under Section 12.2 (the “Term”). Each Sales Order and/or SOW shall remain in effect for the Service Period (or in the case of an SOW, until the occurrence of the End Date) and the Services will be provided by Cobalt only during such time-period. 

12.2 Termination for Cause.

12.2.1 Either Party may terminate this Agreement for cause: (i) upon thirty (30) calendar days’ written notice of a material breach (other than non-payment) to the other party if such breach remains uncured at the expiration of such period; or (ii) with immediate effect by giving written notice to the other party, if the other party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership or liquidation or makes an assignment for the benefit of creditors. During any such cure period, Cobalt reserves the right to deactivate Customer’s passwords and/or login credentials and/or to block access to the Platform Services, whereby the fees will remain due for the period during which access was blocked and/or passwords and log-ins were deactivated, and Customer will be solely responsible for any and all consequences resulting from such blocking and/or deactivation, without recourse against or liability from Cobalt or any third-party service provider.

12.2.2 Cobalt may terminate this Agreement with immediate effect upon written notice if, at any time, Customer becomes or is acquired by a competitor of Cobalt’s or any of its Affiliates’.

12.2.3 Each Party shall have the right to terminate this Agreement, and all Sales Orders or SOWs subject to this Agreement, in their entirety upon written notice to the other Party if such Party materially breaches its obligations under this Agreement and, after receiving written notice identifying such material breach in reasonable detail, fails to cure such material breach within thirty (30) days from the date of such notice; provided, that Cobalt may terminate this Agreement immediately upon written notice where a breach or violation is not capable of cure. During any such cure period, Cobalt reserves the right to deactivate Customer’s passwords and/or login credentials and/or to block access to the Platform Services, whereby the fees will remain due for the period during which access was blocked and/or passwords and log-ins were deactivated, and Customer will be solely responsible for any and all consequences resulting from such blocking and/or deactivation, without recourse against or liability from Cobalt or any third-party service provider.

12.3 Term and Termination of a Sales Order or SOW for Breach. An individual Sales Order or SOW shall not be subject to termination, except that a Sales Order or SOW may be terminated (in whole but not in part) by a Party solely if the other Party fails to cure a material breach thereof, or of this Agreement as it relates to such Sales Order or SOW, within thirty (30) days after receiving written notice of the breach from the non-breaching Party or immediately if a material breach is not capable of cure. 

12.4 Effect of Termination. Upon any termination or expiration of this Agreement, all rights and obligations of the Parties shall end, other than their rights and obligations which are intended to survive termination. 

12.5 Retention and Destruction of Data.  Upon any expiration or termination of this Agreement, Cobalt shall delete any Customer Data or Customer Confidential Information relating to Customer upon request, unless prohibited by law from doing so. Customer will be able to access the Platform for fourteen (14) days in order to export any reports, Customer Data, or Customer Confidential Information using the functionality within the Platform. The fourteen (14) day period may be extended by mutual agreement, on a case-by-case basis, if a longer time period is needed.

12.6 Transition Assistance. Commencing sixty up to (60) calendar days prior to the expiration of this Agreement or any Sales Order thereof, or commencing upon any notice of termination of the Agreement or Sales Order, as applicable (except for a termination for cause by Cobalt), Cobalt shall provide to Customer termination assistance and/or migration services to facilitate Customer’s orderly transition from the Services to Customer’s alternate service provider as designated by Customer (“Transition Assistance”). Such Transition Assistance will be provided to Customer on a time and materials basis, at Cobalt’s then current billing rates for such services.

13. FORCE MAJEURE. If the performance of any obligation hereunder is interfered with by reason of any circumstances beyond a Party’s reasonable control, including but not limited to acts of God, disease, epidemic, pandemic, labor strikes and other labor disturbances, power surges or failures mandatory government shutdowns, quarantines, lockouts, riots, acts of war, acts of insurrection, terrorism, earthquake, fire, explosions, or the act or omission of any third-party, the Party shall be excused from such performance to the extent necessary during the term of any force majeure event, provided the Party shall use reasonable efforts to remove such causes of nonperformance. If an event of force majeure prevents either Party from performing its responsibilities under this Agreement for a period of more than thirty (30) days, the other Party may terminate this Agreement and any outstanding Sales Order immediately upon written notice.

14. PUBLICITY, REFERENCE, USE OF REPORTS, AND TRADEMARKS. 

14.1 Customer agrees that Cobalt may use Customer’s name(s), tradename(s), trademark(s) and/or logo(s) (“Marks”) as a commercial reference, in Cobalt’s promotional materials, RFP responses, presentations, and on Cobalt’s website and/or in a customer list identifying all or a material representation of Cobalt’s or its Affiliates’ customers.  Cobalt agrees not to alter the name, tradename(s), trademark(s) or logo(s) of Customer, nor to state or imply any endorsement of Cobalt by Customer without the express written permission of Customer.


14.2 Customer may (i) list Cobalt in Customer’s list of vendors; and (ii) utilize any of Cobalt name(s), tradename(s), trademark(s) or logo(s)) in promotion of itself utilizing Cobalt’s Vulnerability Reports on their website(s) or in any promotional materials. Customer agrees not to alter Cobalt’s name, tradename(s), trademark(s), logo(s), or the Vulnerability Report(s) produced by Cobalt for Customer, nor to state or imply any endorsement of Customer by Cobalt without the express written permission of Customer.

15. MISCELLANEOUS.

15.1 Insurance. Cobalt shall maintain, at all times during this Agreement, insurance coverages in at least the following minimum amounts: (i) General Liability Insurance in the amount of two million dollars ($2,000,000); (ii) Technology Errors and Omissions in the amount of five million dollars ($5,000,000); (iii) Excess Liability in the amount of five million dollars ($5,000,000). Customer may request in writing a current Certificate of Insurance during the Term.

15.2 Assignment and Related Matters.  Except as otherwise set forth herein, neither Party may assign, transfer, or delegate this Agreement or any rights or obligations under this Agreement, in whole or in part, without the other Party’s prior written consent. Any attempt by either Party to assign, transfer, or delegate this Agreement or any rights or obligations hereunder, without such consent, will be null and of no effect. Notwithstanding the foregoing, Cobalt may assign or transfer this Agreement, without Customer’s consent, to an Affiliate or to a successor-in-interest resulting from a merger, sale of substantially all of its assets, a change of control, or by operation of law. Subject to the foregoing, this Agreement will bind and inure to the benefit of the Parties, their successors and any permitted assigns.

15.3 Survival. Except as expressly set in this Agreement, the rights and obligations set forth in Section 2 (Sales Orders, Invoicing and Payment), Section 5 (Intellectual Property Rights), Section 6 (License Grants), Section 7 (Confidentiality), Section 9 (Warranties), Section 10 (Indemnification), Section 11 (Limitation of Liability), Section 15.4 (Governing Law), Section 15.6 (Independent Parties, Third-Party Beneficiaries), and Section 15.7 (Entire Agreement, Amendment, and Waiver) shall survive the expiration or termination of this Agreement.

15.4 Governing Law.  The United Nations Convention on Contracts for the International Sale of Goods does not apply to the transactions contemplated by this Agreement. The Uniform Computer Information Transactions Act (“UCITA”) will not apply to this Agreement regardless of when and howsoever adopted, enacted and further amended under the governing state laws. Any claim before a court in connection with this Agreement may only be initiated by either signatory, within one (1) year of the date on which the facts giving rise to such claim are known or should have been known by the claimant.

15.4.1 For customers located in the Americas: This Agreement and any dispute(s) or Claim(s) (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation (collectively “Dispute(s)”) shall be governed by the laws of the State of Delaware, without regard to its conflict-of-law provisions. The Parties irrevocably agree to submit to the personal jurisdiction of the Chancery Court located in New Castle County, Delaware, or the United States District Court for the State of Delaware, for any Dispute or actions for which the Parties retain the right to seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation or violation of a Party’s copyrights, trademarks, trade secrets, patents, or other intellectual property rights (“Actions”). 

15.4.2 For customers located in the DACH region: This Agreement and any Dispute shall be governed by and construed in accordance with the laws of the Federal Republic of Germany, without regard to its conflict-of-law provisions. The parties irrevocably agree to submit to the personal jurisdiction of Kammergericht Court for the city-state of Berlin, Germany for any Dispute or Actions.

15.4.3 For customers located anywhere else in the world: This Agreement, and any Dispute shall be governed by, and construed in accordance with, the laws of England and Wales, without regard to its conflict-of-law provisions. The Parties irrevocably agree to submit to the personal jurisdiction of Chancery Division of the High Court located in London, England for any Dispute or Actions.

15.5 Notices.  Notices shall be sent to each Party at the address first set forth above or via e-mail. E-mail notices to Cobalt shall be sent to info@cobalt.io; with a copy to legal@cobalt.io. Email notices to Customer shall be sent to an email address listed in any Sales Order or SOW signed by such Customer.  Notices shall be deemed to be delivered (i) one day after delivery with a reputable overnight carrier, (ii) three days after deposit with US Postal Service sent first class mail, return receipt requested, or (iii) the day an e-mail is transmitted without an error or bounce-back message. 

15.6 Independent Parties, Third-Party Beneficiaries. The relationship of the Parties is that of independent contracting Parties and Cobalt shall not be construed to be an employee, partner or agent of Customer. There are no third-party beneficiaries to this Agreement.

15.7 Entire Agreement, Amendment and Waiver.  The terms and conditions of this Agreement (including any applicable schedules, referenced documents, rules for Running a Security Program, Sales Orders, or SOWs entered into pursuant hereto) provide the complete understanding of the Parties with regard to the subject matter hereof and supersede all previous communications, agreements, proposals or representations related to the subject matter hereof. Except as otherwise expressly provided for herein, any waiver, amendment, or modification of any right or remedy, in whole or in part under this Agreement, or any additional or different terms in, acknowledgments or other documents, will not be effective unless expressly agreed to in writing and signed by the authorized representatives the Parties. In the event of any inconsistency or conflict between the terms of this Agreement, and any terms contained within a Sales Order, SOW, or other supplemental agreement terms (including any addenda) (“Other Terms”), such Other Terms shall control. It is expressly agreed that no additional terms and conditions contained in Customer’s purchase order, internet procurement portal or other non-Cobalt document shall apply to the Platform, Services, or to this Agreement.

This Agreement may be executed in counterparts, which, taken together, will constitute one and the same instrument. The exchange of a fully executed Agreement (in counterparts or otherwise) by electronic means or in writing shall be sufficient to bind the Parties to the terms and conditions of this Agreement and to any Sales Order or SOW.

15.8 Feedback/Reviews. Customer agrees that Cobalt, its Affiliates, or any of their agents, may freely use, disclose, reproduce, license, distribute or otherwise exploit in any manner any feedback, comments, reviews or suggestions Customer may post in any forums or otherwise provide to Cobalt or its Affiliates about the Platform, Products, and/or Services without any obligation to Customer, without restrictions of any kind (including on account of any intellectual property rights), and without any obligation of compensation to Customer and/or any third-party.

15.9 Subject Headings. The subject headings of this Agreement are included for purposes of convenience only and shall not affect the construction or interpretation of any of its provision. 

15.10 Signature.  The Parties agree to the execution of this Agreement using electronic signatures. The Parties agree, to the extent necessary, that such signatures will be regarded as an original of the document. The Parties agree to use a third-party electronic signature platform designated by Cobalt; provided, that such platform conforms with any applicable framework, regulation or legislation applicable to electronic signatures. Each Party represents that the person signing the Sales Order and/or Agreement has all right, power and authority to sign this Agreement on behalf of such Party.


_

Archive 

Platform Services Agreement (March 5th, 2024 - March 31st, 2025)

Running a Security Program
Last updated on April 5, 2023


IMPORTANT - READ BEFORE USING THE SITE OR SERVICES FOR RUNNING A SECURITY PROGRAM.


These Running a Security Program terms (“Supplemental Terms”) form a part of the General Terms and you agree that you are a User of the Site and Services and you therefore have already agreed to and accepted the General Terms and Privacy Policy for being a User on the Site and Services. Terms not otherwise defined herein, shall have the meaning set forth in the General Terms.

Security Program Time Period

The Security Program initiates when it is listed on the Site and Services and has the status Live.

The Security Program will run until a written deadline agreed between You  and Cobalt. This deadline will be listed on the Security Program.

Security Pentesters can only engage in testing on programs that are in status Live and the Security Pentesters have been invited to. When a program is past the test deadline, Security Pentesters are not allowed to engage in test activities other than re-testing / Patch verification specifically requested by You.

The date on which your test will start may depend on the Tier associated with your account. Each Tier permits test start dates within a defined minimum advance notice, measured in Business Days (“Minimum Notice Period”). For purposes of calculating the applicable period associated with your Tier, a “Business Day” falls within Cobalt Business Hours and excludes holidays and weekends, provided that a test must be assigned a test to “Planned” prior to 11 AM Pacific Standard Time of the first day of the Minimum Notice Period. “Cobalt Business Hours” are: for customers in EMEA, 8 AM - 5 PM Central European Standard Time; for customers in the Americas, 8 AM Eastern Time- 5 PM Pacific Time.  Cobalt’s commitment to initiate a test within a certain period only begins when a test is listed as “Planned” and a start date is selected. Services must be scheduled to be completed within the applicable annualized period of the Order Term. When Services that are scheduled to begin within thirty (30) days of the expiration of the one-year period associated with the applicable Credit(s), test coverage may be reduced and retesting may be precluded due to time and resource constraints. 

Third Party Integrations

Services may be configured to facilitate integration with certain third party software products or services leveraged by Cobalt Yous. The availability of such integrations is dependent on the specific Tier assigned to a Customer.

Notwithstanding the foregoing, Cobalt reserves the right to deprecate any particular third party integration at its discretion.

By accessing or using Cobalt’s third party integrations, Customerrepresents and warrants that it has obtained all necessary licenses, credentials, or other rights to facilitate Customer leveraging such third-party integrations.

Cobalt hereby disclaims any and all obligations relative to such third party’s privacy or security posture.

Customer uses such third party integrations at its own risk. Cobalt does not make any warranty for and shall not be held liable or accept any liability, obligation, or responsibility for any loss or damage in connection with any third party integration. Cobalt has no control over such third parties and we are not responsible for the content of their services. Cobalt provides You with third party integrations only for Your convenience. 

Retesting

Cobalt may offer retesting of vulnerabilities, depending on the Tier you purchased, as further described in Cobalt’s Tiers FAQ. Retesting consists of Cobalt Pentesters re-engaging via the same or similar methodologies in testing of specified vulnerabilities that were originally identified in a Cobalt Vulnerability Report. Retesting is applicable only to those vulnerabilities that you have taken steps to remediate and the intent of retesting is to validate the efficacy of your remediation efforts. Timing for retesting is at Cobalt's sole discretion. Customer cooperation with Cobalt operational requests (including without limitation, providing access to credentials and environments) is a condition to Cobalt’s retesting obligations. Cobalt Customers must request a retest by at least ten (10) days prior to the expiration of their Services term (unless Customer has executed a renewal). Retesting is subject to all terms and conditions otherwise applicable to the provision of Services by Cobalt.

Security Program Responsibilities and Liabilities
  • You agree that you authorize Cobalt to list your program on the Site and Services.
  • You agree that you authorize invited Security Pentesters to perform tests on the Application(s)/Network(s) mentioned in scope in the Security Program.
  • You agree to take the full liability and responsibility, and release Cobalt from any liability, if anyone who is not a  Security Pentester, or other non-Cobalt personnel, is engaged in testing of the Security Program.
  • You agree that the scope, rules and all other information on the Security Program  is the entire scope, rules and information which you expect the Security Pentesters to follow if engaging in activities related to your Security Program.
  • You agree that Cobalt only provides a best practice set of rules as an example and that you as a User are fully responsible and liable for the coverage of the scope and the rules written in the Security Program.
  • You agree that you are responsible for contacting and getting, if needed, acceptance from any and all related third parties who potentially will be impacted by the activities related to the Security Program. This includes but is not limited to hosting providers.
  • You agree that you understand when you initiate the Security Program you will start receiving Vulnerability Report Submissions on the Site and Services. This means that Cobalt will store these Vulnerability Reports on the Site and Services, any vulnerability/Bug submitted against your Security Program will only be visible to You, the Security Pentesters participating in the Program and Authorized staff at Cobalt.
  • In the event your program has responsible disclosure you agree that you are responsible for informing the Security Pentesters on when he/she can disclose a given vulnerability to the public.
Privacy

You agree and acknowledge that the personal data you provide to us may be processed for the purpose of providing our services to you. Each Party shall maintain appropriate technical and organizational safeguards for protection of the associated personal data that is collected and/or processed through your use of the Services. 

For more information on our data privacy practices, please see our Privacy Policy or contact us at privacy@cobalt.io

Any false information provided within the context of the Security Program by Customer concerning identity, mailing address, telephone number, email address, ownership of right or non-compliance with these terms and conditions or the like may result in the immediate termination of the Security Program.

Insurance/Backup

Cobalt recommends that you obtain appropriate insurance and backup for your Application(s)/Network(s) and its content. Please review any insurance policy that you may have for your Application(s)/Network(s) and its content carefully, and in particular please make sure that you are familiar with and understand any exclusions to, and any deductibles that may apply for, such insurance policy.

Complete Agreement and Order of Precedence

All of the terms set forth in the General Terms, or another master agreement entered into between You and Cobalt, shall apply to these Supplemental Terms including without limitation confidentiality, liability, controlling law and jurisdiction, dispute resolution and arbitration and costs. In the event of a conflict between the General Terms, or other master agreement terms, and these Supplemental Terms, the Supplemental Terms shall apply.

 

Professional Services Addendum

BY CLICKING TO SIGN IN ON-LINE TO USE THE COBALT SITE AND SERVICES AND BY USING THE SITE AND SERVICES FOR PROFESSIONAL SERVICES, YOU (OR “CUSTOMER”) AGREE TO COMPLY WITH AND BE LEGALLY BOUND BY THESE SUPPLEMENTAL TERMS (“SUPPLEMENTAL TERMS”). THESE SUPPLEMENTAL TERMS ARE INCORPORATED INTO AND FORM A PART OF THE GENERAL TERMS FOUND AT COBALT.IO/TERMS (“AGREEMENT” or  “GENERAL TERMS”) AND GOVERN YOUR ACCESS TO AND USE OF THE SITE, SERVICES, AND PROFESSIONAL SERVICES AND CONSTITUTE A BINDING LEGAL AGREEMENT BETWEEN YOU, COBALT AND THE SECURITY PENTESTER. IF YOU DO NOT AGREE TO THESE SUPPLEMENTAL TERMS, YOU HAVE NO RIGHT TO USE THE SITE, SERVICES, OR PROFESSIONAL SERVICES.

1. PROFESSIONAL SERVICES ​

“Professional Services” shall include certain security testing, consulting, training, and other similar services, inclusive of any deliverable associated therewith, performed by Cobalt as identified with specificity under the terms of a Cobalt Sales Order or SOW, with such services to be undertaken by Cobalt personnel or contractors. “Professional Services” excludes the offering of penetration testing Services delivered via the Cobalt Site (app.cobalt.io)

2. SCOPE

a. Scope. Cobalt will perform the Professional Services and deliver the software and/or documents specified as deliverables in the applicable Sales Order or SOW for Professional Services (the “Deliverables”) in accordance with the requirements in the Sales Order or SOW. Any specific scope or limits to the provision of Professional Services shall be set forth in the Sales Order or SOW, in the absence of which Cobalt shall have the discretion to establish the scope and limits of any such Professional Services. Where specific networks, code, systems, devices or objects are the subject of Professional Services, the such networks, code, systems, devices or objects will be identified by Customer in the Sales Order or SOW with specificity. Cobalt shall have the discretion to select applicable methodologies for conducting Professional Services.

b. Changes. At any time prior to completion of the Professional Services under a Sales Order or SOW, Customer may request or Cobalt may recommend modifications to the Sales Order or SOW. Cobalt will advise Customer of the likely impact of any such change, including any effect on the fees and time for completion of the Professional Services. The parties will respond in writing or will meet to discuss any such proposed changes as soon as practicable, but (subject to Section 2.4) neither party will be obligated to agree to any such change, and until such time as any change is agreed to in a writing specifying, inter alia, any change to the fees, time for completion or completion criteria, Cobalt will continue to provide the Professional Services as if such change had not been requested or recommended.

c. Resources. Cobalt will provide appropriately qualified personnel to perform the Professional Services and will use commercially reasonable efforts to minimize changes in such personnel. Cobalt reserves the right to engage independent contractors to perform some or all of the Professional Services, provided that Cobalt remains responsible for the performance of the Professional Services in accordance with this Professional Services Addendum. 

d. Schedule. Cobalt and Customer shall mutually agree to a schedule for provision of Professional Services, which shall be identified in the Sales Order or SOW. In the absence of a particular schedule, Cobalt shall have discretion to determine the time and place of any Professional Services hereunder. Any delay in meeting the applicable Professional Services schedule caused by Customer may require execution of a change order or revision and payment of additional fees at Cobalt's sole discretion. 

3. CUSTOMER’S OBLIGATIONS ​

a. Access. For any Professional Services where access to Customer’s systems, office sites, devices or other objects, or third party systems is necessary, Customer will take all steps necessary to ensure that Cobalt obtains all required credentials or permissions.Where Professional Services concern a particular device or object, such device or object will be delivered to Cobalt at a location to be determined by the parties via courier or similar delivery service, with Customer to retain liability over the condition of such device or object until its delivery to Cobalt.

b. On-Site. Where Professional Services provided hereunder require Cobalt to be physically present at Customer’s location, Customer shall be responsible for ensuring Cobalt is provided with sufficient space and resources to perform the Professional Services. Customer will be responsible for providing a safe environment where Cobalt personnel and/or contractors are present, and shall obtain adequate insurance to protect Cobalt and its personnel against any physical injury occurring on Customer’s premises.

c. Customer Personnel. Where Professional Services require engagement of Customer’s personnel, Customer will take all necessary steps to provide Cobalt with reasonable access to such personnel, whether in person or via standard communications tools (i.e. email, Zoom, teleconference, etc.).

d. Failure to Fulfill Obligations. Failure of Customer to timely fulfill the obligations set forth in this Section 3 may preclude timely provision of Professional Services and may require an adjustment of the Professional Services schedule under Section 2.4 and/or suspension of performance by Cobalt.

4. ​PAYMENT

a. Fees In consideration for the Professional Services and Deliverables, Customer will pay Cobalt the fees specified in the applicable Sales Order or SOW.

b. Expenses. Customer will reimburse Cobalt for all reasonable expenses incurred by Cobalt in performing the Professional Services, including travel, lodging, per-diem and out of pocket expenses, subject to Customer’s pre-approval. In general, expenses will only be incurred for provision of the Professional Services at locations other than Cobalt’s offices, unless otherwise specified in the appliCable Sales Order or SOW.

c. Invoices. Cobalt shall submit invoices on a monthly basis for all fees, charges and expenses relating to the performance of the Professional Services under the applicable Sales Order or SOW. Payments shall be made in U.S. Dollars, or, if different, the applicable currency as set forth in the Sales Order or SOW, within thirty (30) days of receipt of invoice. Unless otherwise specified in the applicable Sales Order or SOW, the payment terms and conditions shall be as set forth in the payment terms provision of the Agreement.

5. ​SECURITY AND PRIVACY.

The parties agree that Cobalt will not be provided access to any production data processed by the Customer through the provision of Professional Services (“PS Customer Data”), whether by way of transfer of PS Customer Data to Cobalt’s systems, access to Customer’s systems or exposure to PS Customer Data through shared screens, screen shots, etc., other than sample, hashed or anonymized data used for development and testing purposes. If and to the extent it is agreed by the parties that Customer will grant Cobalt access to PS Customer Data, Cobalt shall employ and maintain commercially reasonable safeguards to protect the security and confidentiality of PS Customer Data. Those safeguards will include, but will not be limited to, measures for preventing unauthorized access to or disclosure of PS Customer Data. Cobalt will not use or disclose PS Customer Data except (a) as required to provide Professional Services, (b) as required by law, or (c) as Customer expressly permits Cobalt in writing. Customer shall be solely responsible for ensuring that granting Cobalt access to PS Customer Data as set forth in this Section 5 does not violate applicable laws governing the use of PS Customer Data, including but not limited to the rights of data subjects whose information is included in the PS Customer Data. If required, Customer shall be responsible for removing or redacting data subject to security restrictions or anonymizing personally identifiable information. 

6. OWNERSHIP

a. Deliverables. All Deliverables and all intellectual property rights in the Deliverables will be the sole and exclusive property of Cobalt, whether or not specifically recognized or perfected under the laws of the jurisdiction in which the Professional Services are used or licensed. No work product of Cobalt shall be construed as or deemed to be a “work made for hire”. Accordingly, Customer acknowledges that Cobalt retains sole and exclusive ownership of all right, title and interest to all Deliverables. Cobalt shall own all rights in any copy, translation, modification, adaptation or derivation of the Deliverables, including any improvement or development thereof. At no time will Customer dispute or contest Cobalt’s exclusive ownership rights in any Deliverables. Notwithstanding the above, Cobalt grants to Customer a perpetual, worldwide, non-exclusive license in the Deliverables for Customer’s internal use only. Cobalt shall have no obligation to provide support services or otherwise maintain any Deliverables delivered hereunder.

b. Materials. Cobalt may furnish Customer with reports, analyses or other such materials (the "Materials"). Customer understands and agrees that any such Materials will be furnished solely for its internal use and may not be furnished in whole or in part to any other person other than its directors, officers, employees or advisors without the prior written consent of Cobalt. Cobalt grants to Customer a perpetual, irrevocable, nontransferable, paid-up right and license to use and copy such Materials and prepare derivative works based on such Materials for its internal use, subject to the terms of this Section. All other rights in such Materials, excluding any Confidential Information of Customer, remain in and/or are assigned to Cobalt.

c. Cooperation. The parties will cooperate with each other and execute such other documents as may be appropriate to achieve the objectives of this Section.

7. WARRANTY​
a. Warranty. Cobalt warrants that it shall use commercially reasonable efforts in performing the Professional Services. Cobalt further warrants that any Deliverable provided through the Professional Services shall substantially conform to the specification for such Deliverable as set out in the applicable Sales Order or SOW. If Customer notifies Cobalt that Professional Services or any Deliverable fails to conform to the aforestated warranties within thirty (30) days of the acceptance of the Deliverable, Cobalt shall (as Customer’s sole and exclusive remedy), re-perform the Professional Services and/or correct any defects with the Deliverable in question. 

b. Disclaimer. COBALT’S OBLIGATION UNDER THE ABOVE WARRANTY SHALL BE ITS SOLE LIABILITY AND IT SHALL HAVE NO OTHER LIABILITY WHATSOEVER WITH RESPECT TO THE QUALITY, FITNESS FOR A PARTICULAR PURPOSE OR MERCHANTABILITY OF THE PROFESSIONAL SERVICES OR ANY DELIVERABLES AND ALL OTHER REPRESENTATIONS, STATUTORY OR OTHERWISE ARE EXCLUDED. 
Pentest Management Platform Pilot

These terms and conditions (the “Pilot T&Cs”) constitute the sole and entire agreement of Cobalt Labs, Inc (“Cobalt”). and its customer (the “Customer”) concerning the use of and evaluation of the Cobalt Pentest Management Platform (“PMP”), and supersede all prior or contemporaneous understandings, agreements, negotiations, representations and warranties, and communications, both written and oral.  These Pilot T&Cs prevail over any terms or conditions contained in any other documentation. To the extent not directly contradictory herewith, all other Cobalt Terms and Conditions (including without limitation, the Cobalt Privacy Policy) continue to apply with full force and effect.

Access to Platform.  During the Pilot Term,  Cobalt will provide the Customer access to and use of the PMP, in accordance with these Pilot T&Cs. All use of the PMP will be for the purpose of Customer managing and administering pentests for Customer’s benefit alone. By using the PMP, Customer represents that it has obtained all rights and/or licenses necessary to undertake any and all pentests for which PMP is leveraged. Customer is prohibited from using the PMP in any way that violates applicable law, regulation, contract, or in any way injures the rights of any third party.

Pilot Term. The period for which Customer may access the PMP (the “Pilot Term”) shall be determined by and between Cobalt and each Customer.  Cobalt reserves the right to terminate the Pilot at any time and for any reason, with notice to Customer.  Cobalt will delete or return, at Customer’s discretion, all data created and stored on the PMP after the conclusion of the PMP; provided, that in the Cobalt has (at such time as the Pilot Term ends) developed a paid version of PMP and Customer desires to transition to such paid version, Cobalt and Customer may provide for continued access to, use of and storage of Customer PMP data on terms and conditions to be agreed upon by and between Cobalt and Customer at such time.

Restrictions on Use. Customer shall not (a) demonstrate, copy, sell, rent, lease, lend, sublicense, distribute, or otherwise transfer or provide access to the PMP to any third party; (b) publish or otherwise disclose information relating to the performance, quality, or capability of PMP to any third party; (c) modify, reuse, disassemble, decompile, reverse engineer or otherwise translate any software contained within the PMP or any portion thereof; or (d) create derivative works based on the PMP.

Legal Compliance.  Customer and Cobalt shall each comply with all applicable laws and regulations with respect to the use of the PMP.  Cobalt may suspend Customer’s access to the PMP, in its sole discretion, for: (i) use of the PMP in a way that violates applicable laws and regulations or these Pilot T&Cs, or (ii) any instance of posting or uploading material that infringes or is alleged to infringe on the copyright or trademark rights of any person or entity.

Intellectual Property.  Cobalt owns and shall retain all right, title and interest in and to all intellectual property rights embodied in and appertaining to the PMP, including, without limitation, all such rights in the software and content, together with all improvements, enhancements, developments, derivative works, and other modifications thereto.  As between Customer and PMP,  Customer will own and retain all rights to its own materials and previously existing intellectual property, including confidential and proprietary information and data.

Feedback. Customer may give feedback on the performance and utility of the PMP. Customer hereby grants to Cobalt a perpetual, irrevocable, worldwide license to such feedback, and Customer expressly acknowledges that any product modifications, upgrades, features or functionality made by Cobalt that incorporate such feedback are the sole intellectual property of Cobalt.

Disclaimer.  EXCEPT AS SPECIFICALLY SET FORTH HEREIN, COBALT PROVIDES THE PMP “AS IS” WITHOUT WARRANTY OF ANY KIND.  COBALT MAKES NO OTHER WARRANTY, EXPRESS OR IMPLIED, WITH RESPECT TO THE PMP, AND ALL OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED, ARE HEREBY DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Limitations on Liability.  To the extent permitted by law, in no event shall either Cobalt or Customer be liable for any indirect, punitive, or consequential damages, including lost profits or business opportunities.

Beta Products Terms and Conditions

Cobalt Labs, Inc. Beta Products Terms and Conditions

These terms and conditions (the “Beta T&Cs”) constitute the sole and entire agreement of Cobalt Labs, Inc (“Cobalt”). and its customer (the “Customer”) concerning the use of and evaluation of Cobalt Beta Products,  and supersede all prior or contemporaneous understandings, agreements, negotiations, representations and warranties, and communications, both written and oral.  These Beta T&Cs prevail over any terms or conditions contained in any other documentation. To the extent not directly contradictory herewith, all other Cobalt Terms and Conditions (including without limitation, the Cobalt Privacy Policy) continue to apply with full force and effect.

“Beta Product” shall mean those Cobalt products or in-platform features which are designated as beta, pilot, or pre-release versions and are provided to Customer during the term hereof. Beta Products include, without limitation:

  • Cobalt Pentest Management Platform (“PMP”) Pilot.
  • Cobalt Vulnerability Scanner Open Beta.

Access.  During the Beta Term,  Cobalt will provide the Customer access to and use of the Beta Product(s),  in accordance with these Beta T&Cs. All use of the Beta Product will be for the Customer’s benefit alone. By using the Beta Product, Customer represents that it has obtained all rights and/or licenses necessary to undertake any and all activity for which the Beta Product is leveraged. Customer is prohibited from using the Beta Product in any way that violates applicable law, regulation, contract, or in any way injures the rights of any third party.

Beta Term. The period for which Customer may access the Beta Product (the “Beta Term”) shall be determined by and between Cobalt and each Customer.  Cobalt reserves the right to terminate access to the Beta Product at any time and for any reason, with notice to Customer.  Cobalt will delete or return, at Customer’s discretion, all data created and stored via the Beta Product after the conclusion of Beta access; provided, that in the Cobalt has (at such time as the Beta Term ends) developed a paid version of Beta Product, and Customer desires to transition to such paid version, Cobalt and Customer may provide for continued access to, use of and storage of Customer data on terms and conditions to be agreed upon by and between Cobalt and Customer at such time.

Restrictions on Use. Customer shall not (a) demonstrate, copy, sell, rent, lease, lend, sublicense, distribute, or otherwise transfer or provide access to the Beta Products to any third party; (b) publish or otherwise disclose information relating to the performance, quality, or capability of Beta Products to any third party; (c) modify, reuse, disassemble, decompile, reverse engineer or otherwise translate any software contained within the Beta Products or any portion thereof; (d) create derivative works based on the Beta Products; or (e) use Beta Products to conduct scanning, testing, or like activity against the assets of a third party. 

Legal Compliance.  Customer and Cobalt shall each comply with all applicable laws and regulations with respect to the use of the Beta Products.  Cobalt may suspend Customer’s access to the Beta Products, in its sole discretion, for: (i) use of the Beta Products in a way that violates applicable laws and regulations or these Beta T&Cs, or (ii) any instance of posting or uploading material that infringes or is alleged to infringe on the copyright or trademark rights of any person or entity.

Intellectual Property.  Cobalt owns and shall retain all right, title and interest in and to all intellectual property rights embodied in and appertaining to the Beta Products, including, without limitation, all such rights in the software and content, together with all improvements, enhancements, developments, derivative works, and other modifications thereto.  As between Customer and Cobalt,  Customer will own and retain all rights to its own materials and previously existing intellectual property, including confidential and proprietary information and data.

Feedback. Customer may give feedback on the performance and utility of the Beta Products. Customer hereby grants to Cobalt a perpetual, irrevocable, worldwide license to such feedback, and Customer expressly acknowledges that any product modifications, upgrades, features or functionality made by Cobalt that incorporate such feedback are the sole intellectual property of Cobalt.

Disclaimer.  EXCEPT AS SPECIFICALLY SET FORTH HEREIN, COBALT PROVIDES THE BETA PRODUCTS  “AS IS” WITHOUT WARRANTY OF ANY KIND.  COBALT MAKES NO OTHER WARRANTY, EXPRESS OR IMPLIED, WITH RESPECT TO THE BETA PRODUCTS, AND ALL OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED, ARE HEREBY DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Limitations on Liability.  To the extent permitted by law, in no event shall either Cobalt or Customer be liable for any indirect, punitive, or consequential damages, including lost profits or business opportunities. The total liability arising out of or related to this Beta T&Cs, and the provision of access to and use of Beta Products thereunder, shall not exceed $100.

Hak5 Pineapple Bundle Terms

If you are purchasing a pentest through the Hak5/Cobalt bundle offer, these terms supplement the Cobalt Terms of Use. All applicable terms of the Cobalt Terms of Use remain effective except, where contradictory, the terms of this Hak5 Pineapple Test Supplement govern in lieu of such other terms.

Services Description

The Hak5/Cobalt bundle includes a limited, four-credit pentest of your Hak5 Pineapple device (a “Hak5 Pentest”). The Hak5 Pentest is non-customizable. Cobalt has sole discretion to determine the appropriate scope of a Hak5 Pentest. While findings derived from a Hak5 Pentest will be delivered via the Cobalt Platform, no report will be provided.  Cobalt will notify you when your Hak5 Pentest has concluded.

Device

By purchasing the Hak5 Pentest, you acknowledge that Cobalt does not manufacture, design, or deliver Hak5 devices.  Failure to select an appropriate or compatible device, failure of a Hak5 device to operate per specifications, or non-delivery of a Hak5 device you may have purchased, may interfere with your ability to receive a Hak5 Pentest. Cobalt does not make any representation or warranty concerning the quality, fitness, compatibility, or deliverability of the Hak5 device you have purchased.

Timing

Cobalt’s obligation to undertake a Hak5 Pentest is contingent upon your successful installation and configuration of the applicable Hak5 device.  After completion of device installation and configuration, your Hak5 Pentest may take up to two (2) weeks to schedule.

Staffing

Cobalt reserves the right to staff your Hak5 Pentest with personnel from (a) the Core Community, or (b) other qualified professionals, including but not limited to Cobalt employees and/or contractors.

Methodology

Hak5 Pentests will follow a standard methodology based on the Penetration and Testing Execution Standard (PTES) and National Institute of Standards and Technology (NIST) Technical Guide to Information Security Testing and Assessment (NIST 800-115).

Pricing and Tier

The price and Cobalt Tier associated with a Hak5 Pentest will be determined by whether the Customer is a new or existing Cobalt Customer, as follows: (a) for new Cobalt Customers, the price associated with each Cobalt Credit is itemized on the Hak5 page where you purchased the Hak5/Cobalt bundle, and the Tier associated with your Hak5 Pentest is “Standard,” and (b) for existing Cobalt Customers, the price associated with each Cobalt Credit is the per-Credit price to which you have previously agreed, and the Tier associated with your Hak5 Pentest is the Tier associated with your existing Cobalt subscription.” Notwithstanding Cobalt Tier offerings, Hak5 Pentests exclude the following features (a) the selection of pentesters based on location, (b) retesting, and (c) customer attestation.

Privacy Policy

Effective Date: March 31, 2023

1. INTRODUCTION

This Privacy Policy is intended for all Cobalt products and services, including our website (www.cobalt.io); our applications; and our marketing and promotional content (collectively, the “Services”). 

We are Cobalt Labs, Inc., a Delaware corporation, doing business at 575 Market St, 4th Floor, San Francisco, CA 94105-USA, together with our affiliates (referred to herein as “Cobalt”, “us”, “our” or “we”). 

For the purposes of EU GDPR, Cobalt acts as a Data Controller for the data we process for our own business purposes. If you have any questions relating to this Privacy Policy, please contact us by email at privacy@cobalt.io.

2. PURPOSE OF THIS POLICY 

At Cobalt, we are committed to safeguarding and maintaining your personal data, in line with all applicable data protection laws and regulations, including laws and regulations of the European Union, the European Economic Area and their member states (“EU GDPR”), Switzerland, the United Kingdom (Data Protection Act 2018 (“UK GDPR”)) and the United States federal and/or state data protection or privacy statutes including but not limited to the California Consumer Protection Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”).

This policy aims to promote transparency and facilitate you in making informed decisions about your personal data. In some circumstances, where we process personal data for a new purpose not contained herein, we may provide additional or revised privacy policies so that you fully understand the reason for and purpose of the new activity. 

Cobalt maintains this policy on a regular basis and updates it where necessary. You are encouraged to check back regularly, however, if we make a substantial amendment to the current version, we will keep you informed and where you are our customer, we may notify you by email.

3. WHAT DATA DO WE COLLECT

Cobalt’s products and services are designed and intended for use by businesses and their representatives. We do not provide services or products that are aimed at individuals or consumers in a personal capacity.

When we refer to ‘personal information’ or ‘personal data’ in this Privacy Policy, we mean information that identifies or which could be reasonably used to identify any individual. We process different categories of personal data and this will depend on our relationship with you or your organization.

Information you provide to us

Contact Data: Any personal data you share when you contact us, for example, by sending us an email, by attending or engaging with us at an event, or through our website using live chat, contact forms or downloading content and can include any information shared by you.

Account Data: If you have a Cobalt account or where you are our prospective or actual customer, we collect first name, last name, job title/function, work email address, work phone number, user identifier and password.

Marketing Data: Your instructions as to whether you wish to receive email marketing, newsletters and other promotional material from Cobalt, including your marketing permissions and opt-in status. 

Transactional Data: Where you are our Customer, or one of our vendors, or otherwise establish a relationship with us that involves financial transactions, we collect information relating to those transactions. This may include data like credit/debit card information, account and authentication information, tax identifiers and other billing, delivery and invoice details. For automated/digital transactions, we may outsource this activity to one of our selected third-party payment card processors, all of which maintain PCI-DSS compliance.

Organizational Data: When you engage with us on our website, or are our customer, we may collect non-personal data relating to your organization, including but not limited to number of employees, industry type, company name and size, growth trends, registered business address, location (city, state, country).

Information we collect automatically

Technical and Analytical Data: 
- Information about how you use our services, such as, content downloaded or requested, intent data, Cobalt services or products searched, viewed or used, page response times, website performance analytics, download errors, timestamp of visit or interaction, length of visits or sessions, referral site or source, email activity (opens/clicks), page interaction information (such as scrolling, clicks, and mouse-overs); and

- Information about your device, such as, IP address, browser version, browser language, operating system and version, unique device identifiers, geo-location (city, state/province, country), operating system and platform, marketing cookie permissions.

Where accepted by you - we use cookies and similar tracking technologies to collect some of the information listed above; for more information, please see the Cookies and Tracking Technologies section below. 

Data from other sources: We combine data that you provide to us (and that we may collect across our services) with information that we receive from third parties, including but not limited to B2B lead generation and professional Linkedin profiles. We may use demographic information about you in your professional capacity, such as your job title or function (that Cobalt obtains from sources like Linked-in) which is used for segmenting and profiling for B2B marketing purposes. You can opt-out of having your data used in this way at any time.   

Please note that if you provide Personal Information to us about any individual other than yourself, you represent and warrant that you are legally authorized to provide such Personal Information to us for our use and disclosure as described in this Policy.

4. THE SOURCE OF THE PERSONAL DATA

If the personal data we process about you has not been given to us directly by you, Cobalt may obtain it from the following sources:

  • From your organization, on your behalf;
  • From yourself directly;
  • From publicly available sources, such as public websites, the internet;
  • From social media platforms such as Linkedin.
  • From organizations we work with who are specialists in B2B lead generation, B2B intent data, who have obtained your permission to share some of your organization's data with us, such as B2B data clearinghouses. 
  • From website analytical data that is collected automatically by cookies and other similar technologies when you use our services.

5. THE PURPOSE OF OUR DATA PROCESSING

Cobalt is permitted to process personal data only where we have identified a lawful basis for doing so. The main lawful bases upon which Cobalt relies are: 

Legitimate interests: the processing is necessary for the purpose of the legitimate interest pursued by us or our third parties. For example, we may have a legitimate interest in processing Personal Information to send B2B marketing communications and promote our business.

Consent: Where the data subject (you) has freely given your consent to the processing taking place. If you've provided us with your express consent for our processing of your Personal Information, we may process your Personal Information based on such consent, until such time where that processing is no longer necessary or your consent is withdrawn.

Legal Obligation: Where the processing is necessary for us to comply with a legal obligation to which we are subject as data controller. For example, if you have purchased our services and we are required by applicable law to process Personal Information to meet certain tax obligations, we may process your Personal Information to comply with such legal obligations;

Contract: Where the processing is necessary for the performance of a contract to which we are a party. For example, when you purchase our services, you enter into a contract with us and in such circumstances, we process your Personal Information in order to perform this contact or to take required measures prior to entering into the contract

We process personal data for the following purposes and rely on the following legal bases:

Processing purpose
Lawful Basis 
Category of personal data

To manage or establish a relationship with you, such as:

  • Respond to any enquiry, comment or request submitted by you;

  • To provide you with alerts and services messages, notifying you about material changes to our services and our terms, policies and notices.

  • Provide downloadable content to you, as requested on our website.

  • Where you engage with us at an event where we are participating.
  • Performance of a contract (including negotiation)

  • Legal obligation (updates to terms and policies)

  • Legitimate Interests (networking at events, provide downloadable content)
  • Contact Data
  • Account Data
  • Organizational Data

Creating and maintaining your Cobalt account and providing services as requested, including:

  • Administering services access

  • Processing order forms and contractual agreements

  • Facilitating integrations, as requested

  • Password and 2FA management

  • Personalize our online services at your selection
  • Performance of a contract (including negotiation)
  • Contact Data
  • Account Data
  • Technical and Analytical data
  • Subscription Data
  • Organizational Data

To review, monitor and protect the performance of our services, including:

  • Troubleshooting and error management
  • System maintenance
  • Security monitoring and reporting
  • System performance analysis
  • Analyzing trends and usage
  • Legitimate Interests

  • Legal Obligation (system security)
  • Contact Data
  • Technical and Analytical data
  • Account Data
  • Organizational Data

Where we have a financial relationship with you, to process payments for services and settle invoices payable.
  • Performance of a contract
  • Contact Data
  • Account Data
  • Subscription Data
  • Organizational Data

To maintain our existing relationship with established customers and to promote our products and services and identify new-customer opportunities. 


We may use public information about you, in combination with other personal information we may have about you, to identify products and services that we believe may be of interest to your business.

You may opt-out of receiving these emails at any time by clicking “unsubscribe” found in the emails we send you or by clicking here. 
  • Legitimate Interests 
  • Contact Data
  • Account Data
  • Marketing Data
  • Technical and Analytical data
  • Data from other sources
  • Organizational Data

Cobalt uses a combination of firmographic data to perform segmentation on the organizations of our customers based on various factors for sales and promotional purposes.

To identify organizations who may be interested in working with Cobalt, including: 

  • Using firmographic information about prospective organizations, such as, industry specialism, size of company, location of country. Please see ‘Non-personal data’ above. 
  • Using firmographic data to identify organizations who are in our target market and who we believe may be interested in Cobalt products and services.
  • Legitimate Interests
  • Contact Data
  • Account Data
  • Marketing Data
  • Technical and Analytical Data
  • Organizational Data

To share data with third party organizations who process data on our behalf as a data processor or subprocessor, and enable us to provide our services. For example, data hosting providers, CRMs, payment card processors and vendors who deliver technical services to us. 
  • Performance of a contract

  • Legitimate Interests
  • Contact Data
  • Account Data
  • Marketing Data
  • Technical and Analytical data
  • Data from other sources
  • Organizational Data

 

6. RECIPIENTS OF PERSONAL DATA

We will share data with and receive data through Cobalt’s Partners who lead in the cybersecurity space. For example, Cobalt may assist them in providing their services or Partners may assist Cobalt in generating new business opportunities.

Cobalt engages third party service providers to assist us in providing our services and conducting our business, which means any service provider may process personal data on our behalf, depending on the nature of the services supplied. These organizations deliver to us specific functionality on which we rely to do business.  We require every organization that processes personal data on our behalf to ensure its security, adhere to confidentiality requirements equal to those herein, and only in accordance with our strict instructions. These organizations may be located or have servers which are located outside of the EU, and Cobalt has entered into strict data protection agreements to safeguard personal data when transferred out of the EU or EEA. 

You or your organization may choose to add new integrations or change the functionality of the services by using third party apps within the services.  This means giving third-party apps access to your account and information like your name, email address, and any content you elect or are required to provide in connection with those apps. 

To third parties providing services to us or on our behalf who require access to personal information (e.g., our professional advisors, including but not limited to auditors, insurers, legal counsel) to protect our business interests. 

In the event we are involved in a merger, reorganization, acquisition or other fundamental corporate change, or if all or part of our assets are acquired by a third party, we may be required to share your personal data with relevant third parties involved in the transaction. We will endeavor to notify you of any transfer of personal data in this event and the recipient will be informed of the requirement to protect your personal data as per the terms of this Policy. 

7. INTERNATIONAL DATA TRANSFERS

Cobalt is a global organization. This means that when you engage with us, your personal data may be transferred to or stored in countries that may not have equivalent privacy and data protection laws to the country where you are based. Cobalt hosts all data in the United States. Third-party vendors and service providers Cobalt works with may also be based in countries outside of the European Economic Area, including but not limited to the US. 

Cobalt makes use of Standard Contractual Clauses, approved by the European Commission (and the equivalent Standard Contractual Clauses for the UK, where applicable) to safeguard restricted transfers made to countries without an adequacy decision. 

8. HOW WE KEEP YOUR DATA SECURE

Cobalt is a security-centric company. This means that the security and integrity of your personal data is our paramount concern. We have heavily invested in our security infrastructure to ensure that we have appropriate technical and organizational measures to protect the personal data we process, and keep it from being accidentally lost, used or accessed, altered or disclosed in an unauthorized way.

For more information on how Cobalt keeps data secure, please see our security practices and certifications here. 

9. HOW LONG DO WE STORE YOUR DATA

As part of our commitment to purpose limitation, Cobalt only retains personal data for as long as it is required for the purpose in which it was originally collected. For example, if you are an active customer of ours, we will retain your personal data, in connection with the services, for the duration of our agreement or relationship with you. 

Cobalt has incorporated retention policies and schedules into our business to ensure that the data we retain is relevant to its purpose and is limited to only the data necessary to achieve said purpose. 

You may request the deletion of some or all of your personal data by contacting privacy@cobalt.io or by clicking here. However, please note that this is not an absolute right and only where certain circumstances are satisfied, and we may need to retain certain information for record keeping purposes, to complete transactions or to comply with a legal obligation.

10. MARKETING

To promote our business to new and existing customers and promote services that we believe may be of interest to your organization, we occasionally share marketing communications and promotional material with our B2B customers. For example, when you engage with us on our website by completing a form or downloading content, or where you have told us you would like to receive it.

You have the right to opt-out of receiving marketing communications at any time by clicking the ‘unsubscribe’ link in the footer of any promotional email from us. Alternatively, you can request this by email at privacy@cobalt.io.

Please note that this will not affect Services Messages which we are required to communicate to you, for example when we update our terms and conditions, or where we make material changes to our existing services that impact functionality or user experience. 

11. CHILDREN UNDER 13

Our site and services are not directed to or intended to be used by individuals under the age of 13 and we do not knowingly collect Personal Information from children under 13. If you become aware or reasonably suspect that we have collected Personal Information from any child under the age of 13, please contact us at privacy@cobalt.io and we will seek to delete such Personal Information as soon as possible.

12. COOKIES AND TRACKING TECHNOLOGIES

Cobalt relies on cookies, web beacons and other similar tracking technologies to customize and improve our websites and services, personalize and enhance user experience, to understand the usage and performance levels of our services, determine what content is being engaged with and the levels of engagement. We also use cookies and other tracking technologies to determine things about our website visitor’s interests, based on things like browsing activity, interactions and preferences.

You have the right to reject the use of cookies on our Website for marketing purposes, however functional and essential cookies are used to make our website function or offer our services. These cookies cannot be switched off. You will be served with a prompt to accept, reject or configure cookies when you visit our website on a desktop or mobile. You can also reject marketing cookies at any time by clicking ‘My Privacy Settings’ on our website’s footer.

Cookies

Web Beacons

Device recognition technology

Like many websites, we use cookies on a user's hard drive to collect information. A cookie is a small piece of information that is placed on your device when you visit the site and other websites. We use cookies to identify your authenticated interaction with the site, to enable certain features of the site, to better understand how you interact with the site, and to monitor aggregate usage by site users and web traffic routing on the site. you can instruct your browser to stop accepting cookies or to prompt you before accepting a cookie from the websites you visit. However, if you do not accept cookies, that may limit your use of certain features of the site.

Our site may contain electronic images known as Web beacons (sometimes called single-pixel gifs) and are used along with cookies to compile aggregated statistics to analyze how our site is used and may be used in some of our emails to let us know which emails and links have been opened by recipients. This allows us to gauge the effectiveness of our customer communications and marketing campaigns. As with cookies, you may disable web beacons by changing your browser settings or the settings in your email services/program.

Device detection technology recognizes the devices being used to access a website, app, or mobile network, using the User-Agent or other HTTP request headers. These headers include detailed information across hundreds of categories, including device model, operating system, processing power, browser type, screen resolution, 


Websites and apps enhanced with device detection can make smarter decisions (in real-time) about what content to send to a given device.

 

13. LINKS TO OTHER SITES

Our site may include links to third party websites. We do not endorse or recommend such third party websites or the content therein and we are not responsible for the privacy practices of the operators of such websites. Please be aware that when you access links on our site to a third party website, you are bound by the privacy policies and practices of that third party. We encourage you to read the privacy policies governing your use of any third party website.

14. YOUR RIGHTS UNDER GDPR

As defined under the EU GDPR, included as retained by the UK (“UK GDPR”) individuals are granted eight (8) individual rights over the personal data:

  • Right to be informed: you have the right to be informed about the collection and use of your personal data. you also have the right to be provided with certain information including: our purposes for processing your personal data, our retention periods for that personal data, and who we will share with.

  • Right of Access: you have the right to request confirmation that data about you is being processed, and receive a copy of some or all of the personal data processed about you from a Data Controller. 

  • Right to Rectification: you have the right to request the rectification of any personal data that is inaccurate or incomplete;

  • Right to Erasure (or the ‘right to be forgotten’): you have the right to request the erasure of your personal data from the Data Controller’s records, including back-ups. This is not an absolute right and can only be fulfilled if one of the grounds under Article 17(1) GDPR apply;

  • Right to Restriction of Processing: you have the right to request the restriction of processing of your personal data. This is not an absolute right, and can only be fulfilled if one of the grounds under Article 18(1) GDPR apply; 

  • Right to Data Portability: you have the right to receive the personal data concerning you, as provided to the Data Controller, in a structured, commonly used and machine-readable format, and have the right to transmit those data to another controller without hindrance from the first controller.

  • Right to Object: you have the right to object to an organization processing (using) your personal data at any time. This effectively means that you can stop or prevent the organization from using your data. An objection may be in relation to some or all of the personal data. The right to object only applies in certain circumstances outlined by Article 21 GDPR, including where processing is based exclusively on your consent, or processed for the purposes of direct marketing.

  • Automated decision making and profiling: you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similar effects on you. Automated individual decision-making is a decision made by automated means without any human involvement. Cobalt does not use, in connection with our services, automated decision-making in a way that produces legal effects concerning you or that significantly affect you.

You have the right to make any of the above requests at any time. To do so, please complete our Privacy Request Form or contact us at privacy@cobalt.io. Upon receiving your request, we will confirm receipt and aim to action your request without undue delay and no later than one month from the date we receive your request.

Please note that in order to fulfill your request, we may need to request identification from you (or your appointed representative) to confirm your identity or their authorization to make the request. We will inform you of any necessary identification checks after we receive your request. If for any reason we are unable to fulfill your request, we will inform you of our decision in writing and any further rights available to you. 

15. YOUR RIGHTS UNDER CCPA

The California Consumer Privacy Act ("CCPA") provides certain rights to individuals who reside in California ("Consumers"). Below is a description of Consumers' rights concerning their Personal Information and Cobalt's practices regarding the collection, use, disclosure and sale of Personal Information about Consumers.

Consumers have the right to request that we disclose what Personal Information we collect, use, disclose and sell. A Consumer may exercise the following rights:

  • Right to Know: Consumers may request that businesses disclose what personal information they have collected, used, shared, or sold about you in the last 12 months, and why they collected, used, shared, or sold that information. Specifically, you may request:
    - The categories of personal information collected;
    - Specific pieces of personal information collected
    - The categories of sources from which the business collected personal information
    - The purposes for which the business uses the personal information
    - The categories of third parties with whom the business shares the personal information
    - The categories of information that the business sells or discloses to third parties

  • Right to Delete: Consumers have the right to request the deletion of personal information that a business holds on the consumer. However, this right does not apply where the business needs to retain the personal information in order to do any of the following:
    - Provide goods or services to the consumer
    - Detect or resolve issues security or functionality-related issues
    - Comply with the law
    - Conduct research in the public interest
    - Safeguard the right to free speech

  • Right to opt-out: Consumers have the right to opt out of their personal information being sold by a Company. you can do so by emailing privacy@cobalt.io, or by clicking do not sell my info.

The right to non-discrimination: Consumers have the right not to be discriminated against for having exercised their rights under the CCPA.

As of January 2023, Consumers are granted the following additional rights under the California Privacy Rights Act (“CPRA”):

  • The right to request that inaccurate personal information be corrected by the Company responsible. This type of request should be fulfilled within 45 days however, where necessary, an additional 45 days may be necessary. If the deadline changes to 90 days, we will inform you without delay and explain our reasoning.
  • The right to limit the use and disclosure of sensitive personal information collected about them. This means you can direct businesses to only use your sensitive personal information (for example, your social security number, financial account information, your precise geolocation data, or your genetic data) for limited purposes, such as providing you with the services you requested. Please note that Cobalt does not process sensitive personal data about you for any purpose.

You may exercise your Consumer Rights at any time by emailing privacy@cobalt.io or clicking here.

We will confirm receipt of any consumer rights request within 10 days, and move to action your request within 45 days following initial receipt (except when the deadline has been properly extended, in which case the timeframe is 90 days).

Please note that we will need to verify your identity or your Authorized Agent’s (which may be a person or a business entity registered with the California Secretary of State) permission to submit the request on your behalf. We will inform you of additional information we require (if any) to verify your identity after we have received your request. If for any reason we are unable to fulfill your request, we will inform you of our decision in writing. 

In no event will Cobalt discriminate against any Consumer for exercising their CCPA rights.

Sale, collection & use of Personal Information about Consumers

Please be advised that Cobalt engages in limited data transfers to third parties that may be considered a data sale under applicable law. Such transfers occur only in the context of presentations, panels, and other events arranged or sponsored by Cobalt, that may be presented or co-sponsored with other third parties. In such cases, event attendees will be prompted to provide certain identifying information to register for the event in question.
Such information will be shared for marketing purposes with all parties presenting or sponsoring the event, including third parties with whom the attendee may not have a pre-existing relationship. Such third parties will be identified in materials accompanying any prompt to provide information. 

You have the right to opt out of your data being shared in this manner. you can do so by emailing privacy@cobalt.io, or by clicking here: do not sell my info.

CCPA: Descriptions of processing

The table below includes information on the categories of Consumers' Personal Information we collected within the last twelve (12) months, categories of sources from which such Personal Information was collected and the business or commercial purpose for which the Personal Information was collected:

Category of Personal Information we Collected

Category of Source from which Personal Information was Collected

Business or Commercial Purpose for which Personal Information was Collected

Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, etc.

  • the Consumer directly;

  • data analytics providers;

  • operating systems and platforms;

  • social networks; and

  • data brokers

Performing services for the Consumer, including maintaining or servicing accounts, providing customer services and verifying customer information and fulfilling orders and transactions

Commercial information, such as records of services purchased

  • the Consumer directly

Processing payments; fulfilling orders and transactions; providing financial documents

Internet or other electronic network activity information, including information regarding a Consumer’s interaction with our site

  • the Consumer directly;

  • data analytics providers;

  • operating systems and platforms;

  • social networks; and

  • data brokers

Providing advertising or marketing services; for analytics activities

 

The table below describes the categories of Personal Information about Consumers we have disclosed to third parties for a business purpose and the corresponding categories of third parties to whom such Personal Information was disclosed within the last twelve (12) months:

Category of Personal Information we Disclosed for a Business Purpose

Category of Third Party to whom Personal Information was Disclosed

Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, etc.

Cobalt's vendors who assist us in providing our products and services, including access to the services

Commercial information, such as records of services purchased

Cobalt’s vendors who assist us in providing our products and services, including completing transactions and for accounting purposes. 

Internet or other electronic network activity information, including information regarding a Consumer's interaction with our site

Cobalt’s vendors who assist us in providing our products and services, including promotion and marketing activities. 


16. AI USE IN THE CHATBOT

Cobalt’s chatbot uses a third party LLM. The LLM is a RAG model from openAI gpt 4. User data is is utilized for support purposes, however it is not used for future training of the LLM . Data inputted into the chatbot is shared with and stored by the third party providing the LLM.

17. CHANGES TO THIS POLICY

Cobalt reserves the right to update and amend this Policy from time to time, in order to reflect any changes to our data processing activities or advancements in laws and regulations. Any changes we may make to our Policy in the future will be published on this page. Please review this page frequently to check for any updates or changes to our Policy.

18. CONTACT US

If you have any questions, comments or feedback about this privacy policy, or the ways in which we collect and process your personal information, or wish to exercise your rights under GDPR or CCPA please do not hesitate to contact us at privacy@cobalt.io.

Last updated: March 2023

Licenses

 

Name License Homepage
The OWASP Foundation License Homepage
Bugcrowd VRT License Homepage
CWE Common Weakness Enumeration License Homepage