Terms & Conditions

Platform Services Agreement

IMPORTANT, READ CAREFULLY: CUSTOMER’S USE OF AND ACCESS TO THE SERVICES OF COBALT LABS, INC. ARE CONTINGENT UPON CUSTOMER’S COMPLIANCE WITH, AND ACCEPTANCE OF THIS PLATFORM SERVICES AGREEMENT.  BY CUSTOMER BY EXECUTING A SALES ORDER OR SOW THAT REFERENCES THESE TERMS, CUSTOMER AGREES TO ALL OF THE TERMS AND CONDITIONS STATED HEREIN. 

These terms were last updated on April 1, 2025, and the Agreement shall be effective between Customer and Cobalt as of the Effective Date of the Sales Order executed by both parties.

Scope of this Agreement, Other Terms

This Platform Services Agreement, together with any Sales Order(s), SOW(s), Addenda, Supplemental Terms or Third-Party Terms, if any, form the “Agreement” and govern the access to, and use of the Services provided by Cobalt Labs, Inc., a Delaware corporation, with a principle place of business located at 575 Market Street, 4th Floor, San Francisco, CA 94105, USA, together with our Affiliates (“Cobalt”) to the entity identified on any applicable Sales Order or SOW as the Customer (the “Customer”). This Agreement shall be effective as of the date of last signature recorded on such Sales Order or SOW. Customer and Cobalt may be referred to collectively as “Parties” and individually as a “Party”. All other capitalized terms shall have the meaning ascribed to Section 1 or as defined elsewhere in the Agreement.

This Agreement makes reference to a number of other supplemental terms which Customer may also be agreeing to by accepting the terms of this Agreement, and which on this page’s Navigation Menu (the "Supplemental Terms").  Cobalt reserves the right to update the Supplemental Terms at any time. 

In the event of any inconsistency or conflict between the terms of this Agreement, any applicable Supplemental Terms, and any Sales Order(s) or SOW(s) executed hereunder, the terms of the Sales Order(s) or SOW(s) shall prevail over any conflicting terms in this Agreement or the Supplemental Terms. The terms of this Agreement shall prevail over any conflicting terms in the Supplemental Terms. The Supplemental Terms shall apply only to the extent that they do not conflict with any Sales Order(s), SOW(s), or the terms of this Agreement.

1. Definitions.

1.1 “Affiliate” shall mean any entity controlled by, controlling, or under common control with a Party to this Agreement during the period such control exists. For the purposes hereof “control” means the power to direct the operation, policies and management of an entity through the ownership of more than fifty percent (50%) of the voting securities of such entity, by contract, or otherwise.

1.2 “Applicable Laws” shall mean any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, directive, common law, judgment, decree or other requirement or rule of any federal, state, local or foreign government or political subdivision thereof, or any arbitrator, court or tribunal of competent jurisdiction applicable to a Party’s performance of its obligations or the exercise of its rights under this Agreement.

1.3 “Asset(s)” shall mean Customer’s (or a third-party’s) software applications, networks, systems, IP addresses, hardware, and or other assets that are to be tested via a Security Program.

1.4 “Cobalt Account” shall mean Customer’s account on the Platform.

1.5 “Cobalt Content” shall mean all Content that Cobalt makes available through the Platform, and includes without limitation any data, documents, screens, templates, and forms of reports. Cobalt Content expressly excludes Customer Data. 

1.6 “Content” shall mean text, graphics, images, music, software, audio, video, and other information. 

1.7 “Credit” shall mean the prepaid unit purchased by Customer which can be exchanged for Platform Services, Professional Services, or for other offerings as allowed by Cobalt. Each Credit corresponds to a particular level of effort by Cobalt.

1.8 “Customer Data” shall mean the Assets, any Content, data, documents, or any other information provided by Customer to Cobalt in connection with Customer’s use of the Platform.

1.9 “DAST Target” means a single, unique URL, application or website, owned by the Customer and running in a specified Customer environment, which is assigned to be scanned by Cobalt.

1.10 “Intellectual Property Rights” shall mean any and all registered and unregistered rights granted, applied for or otherwise now or hereafter in existence under or related to any patent, copyright, trademark, trade secret, database protection or other intellectual property rights laws, and all similar or equivalent rights or forms of protection, in any part of the world.

1.11 “Personal Information” shall mean any information relating to an identified or identifiable natural person or as otherwise defined under Applicable Laws, including without limitation, “personal data” as used under the EU’s General Data Protection Regulation and under the UK’s Data Protection Act of 2018, and “personal information” as used under applicable California law. 

1.12 “Platform” shall mean the platform provided by Cobalt to Customer in connection with the Services, which includes all related software, interfaces, tools, utilities, and other technologies (and any related intellectual property), where Customer is able to request the Services.

1.13 “Platform Services” shall mean the services available via the Platform, including, but limited to, Platform features that allow for connecting the Customer with Security Professionals providing Asset testing.

1.14 “Professional Services” shall mean cybersecurity services provided by Cobalt to Customer pursuant to a separately executed statement of work (“SOW”) or similar document, excluding the Platform Services and Platform itself. Professional Services are subject to the Cobalt Professional Services Addendum. SOWs shall commence on the Start Date and remain in effect until the occurrence of the End Date, each as defined in the SOW inself.

1.15 “Sales Order(s)” shall mean a transactional document referencing this Agreement, which has been agreed to by the Parties in a mutually signed writing for the purchase of Credits.

1.16 “Security Professional(s)” shall mean any individuals or third-parties who provide the Services on behalf of Cobalt.

1.17 “Security Program” shall mean the scope of Services listed on the Platform for Customer’s Asset(s) to be completed by Security Professional(s).

1.18 “Services” shall mean collectively, any of the Platform Services or Professional Services so ordered by the Customer under this Agreement.

1.19 “Third-Party Terms” means any end-user license agreement or pass-through terms and conditions that may govern or form portions of Cobalt’s Platform Service offerings. Such Third-Party Terms will be made available at the time of Customer’s ordering of such service offerings, and may be changed at any-time by Cobalt’s third-party partners or providers of such service offerings.

1.20 “Usage Parameters” means the maximum number of permitted DAST scan Targets using Cobalt’s DAST solution as specified in Sales Order and any other parameters specified in the Sales Order. 

1.21 “User” shall mean an employee, contractor, or agent of Customer who is authorized by Customer to use the Platform. 

1.22 “Vulnerability Reports” shall mean a confidential report created by a Security Professional and provided to Customer via the Platform, containing security vulnerabilities found during the testing of the Asset(s) in scope for a given Security Program.

2.  Sales Orders, Invoicing and Payment.

2.1 Sales Orders. Credits are ordered via Sales Orders, each of which shall be deemed to be incorporated herein by reference. Each Sales Order shall specify, as applicable, the Credits Tier ordered, the quantity of Credits, the fees and the term of the Sales Order (“Service Period”). A Customer Affiliate may enter into a Sales Order pursuant to this Agreement, by which the Affiliate agrees to be bound by the terms and conditions of this Agreement; provided, that the Customer shall be responsible for any of its Affiliates’ compliance with the terms and conditions of this Agreement. Notwithstanding anything to the contrary in the remainder of the Agreement, in the event that any components of the Services necessary to provide any of the Services ceases to be available to Cobalt or is reduced in quality by a third-party provider, Cobalt may terminate such Services (or any portions thereof) by providing Customer with written notice of such termination.

2.2 Invoicing and Payment.  Cobalt will invoice Customer as set forth in the Sales Order. Customer will pay all fees within fifteen (15) days of the date of the invoice, unless otherwise set forth in the Sales Order; provided, that notwithstanding the Sales Order, if Credits are used in advance of full payment being made, Cobalt may invoice immediately. All fees shall be payable via automated clearing house payment (“ACH”) or wire transfer in accordance with the terms herein. Invoices will be sent by email to the address provided in the applicable Service Order or as otherwise provided by Customer in writing, and shall be deemed received when sent to such address. Unless otherwise stated, all fees specified on a Service Order or SOW do not include any local, state, federal, or other taxes or duties of any kind (“Taxes”). Customer shall be responsible for paying all Taxes, excluding any Taxes based on Cobalt’s or its Affiliates’ income. If Customer or any of its Affiliates has the legal obligation to pay or collect Taxes in any jurisdiction, Customer shall be responsible for such Taxes and the appropriate amount shall be invoiced to and paid by Customer, unless Customer provides to Cobalt a valid tax exemption certificate authorized by the appropriate taxing authority. Any overdue invoices will accrue late interest at the rate of one and one-half percent (1.5%) of the outstanding balance per month or the greatest amount allowed by Applicable Laws, whichever is lower, plus all expenses of collection.

2.3 Suspension of Service for Non-Payment. Cobalt may suspend access to the Platform and Services upon written notice of non-payment of any undisputed invoice. Cobalt will not suspend Customer’s access to the Platform or Services while the Parties are disputing the applicable charges in good faith, and are cooperating diligently to resolve the dispute. 

2.4 Price Changes. Future renewals or orders of any Credits or Services purchased will occur at the then-current price, except in the event of an auto-renewal pursuant to Section 2.5 where Cobalt does not provide notice to Customer of a price change.

2.5 Autorenewal. Each Sales Order shall remain in effect for the Service Period as specified in the applicable Sales Order, and will automatically renew for additional terms of one (1) year on an annual basis, or as otherwise provided for in the Sales Order, unless notice of non-renewal is provided at least sixty (60) days prior to the end of the then-current Service Period of the Sales Order (“Notice Period”). In the event of any price changes pursuant to an autorenewal, Cobalt will notify Customer at least thirty (30) days prior to the Notice Period.

3.  Services

3.1 Credits. Cobalt will scope Services based on projected level of effort as expressed in Credits. Credits will be added to Customer’s Cobalt Account after purchase via a Sales Order. The features associated with each Credit will vary depending on the applicable Tier, as defined herein, to which Customer has purchased. The price and Tier associated with a purchased Credit will be set forth in an applicable Sales Order. Credits must be used by the end of the applicable Service Period, or annual term within said Service Period. For the purposes of this Section, “used” means the completion of any Security Program for which the Credits are allocated.

3.2 Tiers. Access to Cobalt’s Services is provisioned across service levels that define the features and functionality associated with Customer’s Cobalt Account (“Tiers”). The features and functionality associated with each Tier is more fully set out on https://www.cobalt.io/pentest-pricing  or as further detailed in an engagement brief on the Platform. The Tier associated with Customer’s Cobalt Account will be selected on the applicable Sales Order. A Customer’s Cobalt Account may only be associated with one Tier at a time during the Service Period. Tiers may be upgraded, but not downgraded, prior to the end of the Service Period. 

3.3 Vulnerability Report. Cobalt will produce a Vulnerability Report detailing findings uncovered during performance of the Services. Vulnerability Reports are not customizable, except where Customer’s Credit Tier includes Vulnerability Report customization. Cobalt acts as a third-party assessor and possesses a degree of independence in formulating its findings (as articulated via a Vulnerability Report) and as such, Cobalt will not remove or minimize findings in a Vulnerability Report at a Customer’s request without a sufficient factual basis for so doing.

3.4 Security Professionals. Security Professionals are independent third-parties who are retained by Cobalt to assist in providing certain Services. Customer acknowledges that Security Professionals are not contingent workers engaged directly by the Customer. Customer may not enter into contracts directly with Security Professionals. Cobalt will not facilitate the exchange of, or execution of, any agreements directly between Security Professionals and Customer, including without limitation, any non-disclosure agreement, confidentiality agreement, or similar document.

3.4.1 Vetting and Selection of Security Professionals. Each Security Professional will have undergone a background check consisting of identity confirmation and criminal background screening (a “Background Check”) in advance of providing services to Cobalt. The Background Check will minimally cover criminal conduct over a period of time to be determined by Cobalt, in its sole discretion, but in all cases shall be limited to the time periods permissible under Applicable Laws. Security Professionals will not perform Services for a Customer without their first having satisfactorily passed the Background Check.

3.4.2 Security Professional Eligibility. Security Professionals shall not be: (a) a resident or national of any country subject to a United States embargo or other similar United States export restrictions; (b) on the United States Treasury Department’s list of Specifically Designated Nationals as defined under Applicable Laws; (c) on the United States Department of Commerce’s Denied Persons List or Entity List as defined under Applicable Laws; or (d) identified by the United States government as a prohibited end-user of United States export controlled items or otherwise subject to sanctions or similar laws, regulations, or executive orders.

3.4.3 Special Requests. For Customers at the Enterprise Tier, Cobalt will accommodate certain special requests regarding the Security Professionals performing Services for the Customer. Special requests are limited to: (a) staffing a test with Security Professionals from a specific region or time zone, and (b) ensuring that Security Professionals communicate with Customer and/or perform testing at specified times. Other special requests may be facilitated on a case-by-case basis, at Cobalt’s sole discretion. All special requests are subject to Cobalt’s availability and capacity. Cobalt may not be able to accommodate more than one (1) such request per engagement. Customers should communicate with their Cobalt-assigned CSM to determine whether a particular request may be accommodated.

3.5 Professional Services. Any provision of Professional Services will be scoped, in advance, on a per engagement basis via an SOW and shall be additionally subject to terms set forth in the Cobalt Professional Services Addendum. The Professional Services Addendum will only be applicable in the event that Customer has ordered Professional Services via an SOW.

3.6 Informational Support. During the Service Period, Cobalt will provide reasonable support to Customer relating to the use and operation of the Services.

3.7 Cobalt Personnel, Platform and Services. Cobalt shall have sole discretion in staffing of Platform Services or Professional Services. Customer hereby acknowledges that certain Services may be performed by subcontractors, which may include Cobalt’s Affiliates or partners. Cobalt may change subcontractors at any time, in its sole discretion. Cobalt acknowledges that it is responsible and shall be liable for the performance of any such subcontractors pursuant to the terms of this Agreement. Cobalt reserves the right, at its sole discretion, to modify, enhance, or remove features of the Platform or Services; provided that such modifications do not materially diminish the functionality of the Services.

4.  Customer Obligations.

4.1 User Eligibility. Customer represents and warrants that each User is not: (a) residing in, or accessing the Services for the benefit of any person(s), entity(ies), or government of, any country subject to a United States embargo or other similar United States export restrictions; (b) on the United States Treasury Department’s list of Specifically Designated Nationals as defined under Applicable Laws; (c) on the United States Department of Commerce Denied Persons List or Entity List as defined under Applicable Laws; or (d) identified by the United States government as a prohibited end-user of United States export controlled items or otherwise subject to sanctions or similar laws, regulations, or executive orders. 

4.2 Authorization. The Customer permits Cobalt to access the Customer's Assets and Customer Data to enable the Services, which constitutes authorization under the Computer Fraud and Abuse Act, the Computer Misuse Act 1990, Directive 2013/40/EU and similar laws and regulations as applicable to the Customer and/or the Services, and represents and warrants that it has the authority, and will maintain such authority, at all times throughout the Term of this Agreement, to give such permission. Customer is responsible for obtaining all necessary authorizations and permissions required or necessary for Cobalt to provide the Services. By submitting a Security Program for review, Customer represents and warrants that it has obtained any and all such authorizations and permissions, including, but not limited to, those from any cloud hosting providers, network owners, and any other relevant parties.

4.3 DAST Customers Scanning Limits. Customer is subject to, and shall not exceed, the Usages Parameters associated with Customer’s DAST scan Sales Order. Customers should consult the text of their Sales Order to confirm the Usage Parameters applicable to their DAST subscription. Cobalt may, in the event of any usage overage, invoice Customer immediately for such overages, and suspend Customer’s access to the entire Platform until such amount are paid.

5. Intellectual Property Rights.

5.1 Cobalt Property. Customer acknowledges and agrees that Cobalt and/or its licensors own all right, title and interest to the Platform, Services and Cobalt Content, including without limitation any techniques, ideas, concepts, methods, processes, software, utilities, data, documents, directories, designs, user interfaces, know-how, graphics, video content or other data or information acquired, created, developed or licensed by Cobalt and/or its licensors and all modifications, improvements and derivative works thereof and all associated Intellectual Property Rights (collectively as “Cobalt Property”).

5.2 Customer Property. The Parties acknowledge and agree that Customer and/or its licensors own all right, title and interest to the Assets and any Customer Data made available by the Customer through the Platform or Services and any findings contained in the Vulnerability Reports created specifically and uniquely for the Customer, but excluding any third-party intellectual property, Cobalt Property, and any Intellectual Property Rights therein.

5.3 Proprietary Rights Notice. All trademarks, service marks, logos, trade names and any other proprietary designations of Cobalt used herein are trademarks or registered trademarks of Cobalt. Any other trademarks, service marks, logos, trade names and any other proprietary designations are the trademarks or registered trademarks of their respective Parties.

6. License Grants.

6.1 Cobalt Platform and Services License Grant. Cobalt grants Customer a limited, world-wide, non-exclusive, non-transferable, royalty-free, non-sublicensable right and license, during the Service Period  specified in a Sales Order, to (i) access and use the Platform and Services in accordance with the terms of this Agreement; and (ii) access and view any Cobalt Content contained on the Platform solely for Customer’s internal use in connection with Customer’s use of the Services. Except as provided herein, Customer shall have no right to make the Platform, Services or Cobalt Content available to, use the Platform, Services or Cobalt Content on behalf of, or for the benefit of any third-party without Cobalt’s express written authorization. Except for the rights expressly licensed to Customer hereunder, Cobalt and its licensors reserve and retain all right, title and interest to the Platform, Services and Cobalt Content.

6.2 Statistical Data and Product Development. Customer consents to Cobalt’s collection of high-level, generic, anonymous, statistical and/or benchmarking data derived from portions of Customer Data and Customer’s usage of the Platform and the Services that will be aggregated with other findings, results and information derived from Cobalt’s other customer’s data and usage information (the “Statistical Data”). Cobalt shall adhere to the principle of data minimization, collecting only the portions Customer Data and Customer’s usage data that is directly relevant and necessary for the specified purposes of generating Statistical Data, benchmarking, the development of Product Derivatives, and for conducting Functionality Testing, as described and defined in this section. All such Statistical Data is the sole and exclusive intellectual property of Cobalt; provided, that Cobalt shall in all cases refrain from publishing any Statistical Data or any insights or work derived therefrom in a manner that reveals (directly or indirectly) any specific person, Customer, Customer Data, Customer Confidential Information or Asset. Further, Cobalt may prepare new and derivative products and/or services incorporating, and based upon, the usage activity, statistics, service configurations, and the Statistical Data, and that of Cobalt’s other customers (“Product Derivative(s)”) including, but not limited to, the development of certain machine language models (“MLMs”) and artificial intelligence (“AI”) tools. Cobalt may also utilize Statistical Data to test future functionality of Cobalt’s Services (the “Functionality Testing Right”); provided that, such Functionality Testing Right will not compromise Customer’s or Customer’s access to, or integrity of Customer Data within the Platform. Cobalt shall own all right, title and license in the results of any Product Derivative(s) and Functionality Testing Right results, which it may use in its own research, marketing and other commercial services, offerings or activities. 

6.3 Customer Data License Grant. Customer grants to Cobalt a worldwide, non-exclusive, non-transferable, royalty-free license and right to, during the Service Period, (i) use, access, view, copy, display, transmit and store Customer Data on, through or by means of the Platform and Services solely to the extent necessary to operate, maintain, perform, and provide the Platform and Services, (ii) use, access, view, copy, and display, information relating to the Asset(s) solely to the extent necessary to engage in testing and/or create the Vulnerability Reports or otherwise perform tasks in connection with the Security Program; and (iii) create, view, display, transmit and store Vulnerability Reports. Customer acknowledges that this license grant extends, to the extent necessary to facilitate performance of the Services, to Cobalt’s personnel and Security Professionals. Except as expressly licensed herein, Customer shall retain all right, title and/or interest to Customer Data, the Asset(s) and all intellectual property rights therein, and except as expressly licensed herein, Cobalt shall obtain no right or license thereto.

6.4 Vulnerability Report. Subject to the limitations set forth in Section 14.2 below, Cobalt grants Customer a limited, world-wide, non-exclusive, non-transferable, royalty-free, non-sublicensable right and license to use or share the Vulnerability Report(s) for Customer’s legitimate business purposes, provided that Customer is not acting as a reseller of Cobalt’s Services in this capacity.

7. Confidentiality.

7.1 Confidential Information. Throughout the term of the Agreement the Parties may need to exchange or make available confidential and proprietary information to the other Party in connection with this Agreement, whether disclosed in written, oral, electronic or visual form, which is identified as confidential at the time of disclosure or should reasonably be understood to be confidential given the nature of the information or the circumstances surrounding the disclosure, including without limitation business, operations, finances, technologies, products and services, pricing, personnel, customers and suppliers (“Confidential Information”). Without limiting the foregoing, (i) Cobalt Confidential Information shall include Cobalt Property; and (ii) Customer Confidential Information shall include Customer Data and the Asset(s), and findings in a Vulnerability Report. 

7.2 Confidentiality. During the Term, and continuing after expiration or termination of the Agreement, each Party shall retain in confidence, and not use (except for the purposes described in this Agreement), the Confidential Information of the other Party. The receiving Party will use the same degree of care and discretion (but not less than reasonable care) to avoid disclosure, publication or dissemination of the disclosing Party’s Confidential Information as it uses with its own confidential or proprietary information of a similar nature. Except as authorized in this Agreement or a Sales Order, the receiving Party will not disclose the Confidential Information of the disclosing Party to a third-party other than Security Professionals, sub-contractors, or to its or its Affiliates’ employees, contractors, agents or advisors in connection with its performance of this Agreement who are bound by terms no less protective of a disclosing Party’s rights as those set forth in this Agreement and the receiving Party shall be liable to the disclosing Party for any violation of this Agreement by such persons. This Section 7 of the Agreement shall supersede and replace any confidentiality or non-disclosure agreement signed by the Parties prior to the Effective Date.

7.3 Exclusions. Confidential Information shall not include information that (a) is publicly known at the time of disclosure, (b) is lawfully received from a third-party not bound in a confidential relationship with the disclosing Party, (c) is published or otherwise made known to the public by the disclosing Party, or (d) was or is generated independently without use of the disclosing Party’s Confidential Information. The receiving Party may disclose Confidential Information as required to comply with orders of governmental entities that have jurisdiction over it or as otherwise required by law, provided that the receiving Party (i) gives the disclosing Party reasonable advance written notice to allow the disclosing Party to seek a protective order or other appropriate remedy (except to the extent that compliance with the foregoing would cause it to violate an order of the governmental entity or other legal requirement), (ii) discloses only that portion of the Confidential Information as is required, and (iii) cooperates with the disclosing Party to obtain confidential treatment for any Confidential Information so disclosed. Notwithstanding anything herein to the contrary, provided that Cobalt does not use or disclose Customer Confidential Information, Cobalt shall be free to use, exploit and disclose its general skills, concepts, ideas, know-how, and expertise gained or learned during the course of this Agreement, and Cobalt shall not be restricted from creating output for other Customers which is similar to that provided to Customer.

7.4 Remedies. Due to the unique nature of Confidential Information gained through the Services, the Parties acknowledge that the breach of this Section 7 could cause irreparable harm, which monetary damages would be insufficient to remedy and in the event of such a breach, or threatened breach, the non-breaching Party shall be entitled to seek injunctive relief, as well as any other remedy which may be available at law or in equity.

8. Security.

8.1 Cobalt Security Obligations. Cobalt agrees to take commercially reasonable technical and organizational measures designed to secure the Cobalt Platform from unauthorized access or use, including maintaining the security standards at https://www.cobalt.io/security/practices.

8.2 Customer Security Obligations. Customer shall maintain appropriate security for the Customer Data in transit and shall be responsible for backing up Customer Data stored on Customer’s computer systems. 

8.3 PII. Customer acknowledges that it will endeavor to preclude or limit to the greatest extent possible, the exposure of Security Professionals to any personally identifiable information, except as necessary for Customer’s establishment of its Cobalt Account, any patient, medical or other protected health information regulated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) or any similar federal or state laws, rules or regulations or any other information subject to regulation or protection under Applicable Laws such as, without limitation, the Gramm-Leach-Bliley Act (or related rules or regulations) (collectively, “PII”), in Asset(s) tested via the Services. Where any PII will be present in Asset(s) tested via the Services, Customer will advise Cobalt and the Security Professionals of that fact through the Security Program. Where Customer is subject to laws or regulations requiring PII processing activities be addressed via a data processing agreement, service provider agreement or similar (such as, without limitation, GDPR, CCPA, and like legislation and implementing regulations), any processing activities will be subject to a Cobalt Data Processing Agreement, pursuant to Section 8.4 below.

8.4 DPA. Unless otherwise requested and specifically agreed to in a Sales Order, Customer Data will be warehoused in Cobalt’s North American Data Center (“NADC”). If Customer will provide Cobalt with access to any PII or other similar protected information, Customer agrees to the terms of Cobalt’s Standard Data Processing Agreement (“DPA-NA”), which is hereby incorporated by reference into the terms of this Agreement. If Customer so elects to be warehoused in the Cobalt’s European Data Center (“EUDC”) in a Sales Order, and Customer will provide Cobalt with access to any PII or other similar protected information, Customer shall agree to the terms of Cobalt’s European Data Processing Agreement (“DPA-EU”), which must be signed prior to the granting of access to such PII by Customer, and which, once executed by both Parties, shall hereby incorporated by reference into the terms of this Agreement. 

8.5 BAA. If Customer is a Covered Entity, as defined by HIPAA, and will be providing Cobalt with access to Protected Health Information (“PHI”), Customer agrees to the terms of Cobalt’s Business Associate Agreement (“BAA”), which, once executed by both Parties, shall be incorporated by reference into the terms of this Agreement.

9. Warranties.

9.1 Customer Warranty. Customer warrants that: (i) Customer either is the sole and exclusive owner of all Customer Data and Asset(s) made available or accessed through the Platform or Services or Customer has obtained all necessary legal rights, licenses, consents, permissions, approvals and releases to grant to Cobalt and its Security Professionals the rights to such Customer Data and Asset(s), as contemplated under this Agreement; (ii) neither the Customer Data nor Customer’s posting, uploading, publication, sublicensing, submission or transmittal of any Customer Data or Cobalt’s or Security Professionals’ use of or access to the Customer Data (or any portion thereof) or Asset(s) on, through or by means of the Platform and the Services will infringe, misappropriate or violate any third-party Intellectual Property Rights, contractual rights or rights of publicity or privacy, or result in the violation of any Applicable Laws; and (iii) Customer shall comply with all Applicable Laws relating to its performance under this Agreement.

9.2 Cobalt Warranty. Cobalt warrants that: (i) Cobalt either is the sole and exclusive owner of all Cobalt Content and the Platform or Cobalt has obtained all necessary legal rights, licenses, consents, permissions, approvals and releases to grant to Customer the right to such Cobalt Content and the Platform, as contemplated under this Agreement; (ii) Cobalt shall comply with all Applicable Laws relating to its performance under this Agreement; (iii) Cobalt shall provide the Platform Services in a professional manner and will provide a standard of care consistent with that used by service providers similar to Cobalt, and that Cobalt shall deliver the Platform Services substantially in conformity with this Agreement; and (iv) the Security Professionals have the general skills and expertise necessary to perform the Services. In order to state a claim for breach of Section 9.2 (iii) or (iv), Customer must provide notice of such non-compliance within the thirty (30) day period following the delivery of a Vulnerability Report, specifying the details of such noncompliance. If Customer provides Cobalt with the required notice, as Customer’s sole and exclusive remedy and Cobalt’s sole and exclusive liability for breach under this Section 9.2 (iii) or (iv), Cobalt shall, at the Customer’s request and option, either extend the period of testing to perform additional testing or reperform the Platform Services using different Security Professionals. This Section 9.2 (iii) and (iv) shall not apply during any trial license period.

9.3 Disclaimers. 

9.3.1 EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH ABOVE, THE PLATFORM AND SERVICES ARE PROVIDED "AS IS", WITHOUT ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT LIMITING THE FOREGOING, COBALT EXPLICITLY DISCLAIMS ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, AND ANY WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE. COBALT MAKES NO WARRANTY THAT THE SERVICES WILL MEET CUSTOMER’S REQUIREMENTS OR BE AVAILABLE ON AN UNINTERRUPTED, SECURE, OR ERROR-FREE BASIS. COBALT DOES NOT GUARANTEE THAT THE SERVICES WILL REVEAL ALL SECURITY VULNERABILITIES, OR MALICIOUS CODE IN CUSTOMER’S ASSETS. NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED FROM COBALT OR THROUGH THE PLATFORM OR SERVICES, WILL CREATE ANY WARRANTY NOT EXPRESSLY MADE HEREIN.

9.3.2 ANY AND ALL WARRANTIES PROVIDED BY COBALT HEREIN ARE VOID TO THE EXTENT THE SERVICES (I) FAILS TO CONFORM TO ANY OR ALL SUCH WARRANTIES AS A RESULT OF THE SERVICES’ USE WITH ANY THIRD-PARTY SOFTWARE OTHER THAN AS EXPRESSLY AUTHORIZED BY COBALT; OR (II) IS USED OTHER THAN IN ACCORDANCE WITH PUBLISHED DOCUMENTATION OR OTHERWISE IS USED IN BREACH OF THIS AGREEMENT.

10. Indemnification

10.1 Mutual Indemnification. Each Party (the “Indemnifying Party”) will indemnify, defend and hold harmless the other Party and its Affiliates, subsidiaries, permitted successors in interests and assigns and its and their respective officers, directors, employees, and agents, from and against any and all third-party claims, actions, demands or lawsuits arising out of performance of this Agreement, and any resulting judgments, damages, liabilities, fines, penalties, losses, costs and expenses (including reasonable attorneys’ fees) or any amounts paid in settlement thereof (collectively “Claim(s)”) subject to the conditions herein, to the extent arising out of or relating to: (i) the gross negligence or willful misconduct of the Indemnifying Party; or (ii) any act or omission by the Indemnifying Party that results in personal injury or death.

10.2 Customer Indemnity. Customer agrees to defend, indemnify, and hold Cobalt and its Affiliates and their officers, directors, employees, contractors, and agents harmless from and against any Claims arising out of any third-party claim arising out of (i) Customer’s collection, processing, or submission of Customer Data; (ii) Customer’s infringement, misappropriation or violation of any third-party Intellectual Property Rights, contractual rights or rights of publicity or privacy; or (iii) Customer’s actions resulting in Services being performed on an unauthorized Asset.

10.3 Cobalt Indemnity. Cobalt agrees to defend, indemnify, and hold Customer and its Affiliates (only to the extent such Affiliates have entered into Sales Orders hereunder) and their officers, directors, employees and agents harmless from and against any Claims,  arising out of any third-party claim arising out of the infringement or violation of the Platform of the Intellectual Property Rights of a third-party; provided that Cobalt shall not be responsible to provide any such indemnity for any Claim to the extent arising out of (i) Customer Data; or (ii) use of the Platform or Services in an unauthorized manner.

10.4 Indemnity Process. The indemnifying Party shall conduct and have sole control of the defense and settlement of any claim for which it has agreed to provide indemnification; provided that no settlement shall require the indemnified to admit liability. The indemnified Party shall have the right to provide for its separate defense at its own expense. The indemnified Party shall give prompt notice of all claims for which indemnity is sought and shall cooperate in defending against such claims, at the expense of the indemnifying Party. The rights and remedies set forth in this Section 10 state each Party’s exclusive liability and exclusive rights and remedies with regard to claims made by a third-party for intellectual property infringement or violation of a third-party’s intellectual property rights.

11. Limitations and Exclusions of Liability and Damages.  

11.1 Limitations of Liability. EXCEPT FOR EACH PARTY’S OBLIGATIONS UNDER SECTIONS 7 AND 10.1 ABOVE,  AND FOR CUSTOMER’S OBLIGATIONS UNDER SECTIONS 4, 6, AND 10.2 ABOVE, IN NO EVENT SHALL EITHER PARTY’S, OR ITS AFFILIATES’ AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, EXCEED THE LESSER OF: (I) THE NON-BREACHING PARTY’S ACTUAL DIRECT DAMAGES; OR (II) THE AGGREGATE AMOUNTS PAID AND PAYABLE BY CUSTOMER TO COBALT IN THE TWELVE (12) MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO THE LIABILITY.

11.2 Exclusion of Consequential and Related Damages. IN NO EVENT SHALL EITHER PARTY, NOR THEIR AFFILIATES’ HAVE ANY LIABILITY TO THE OTHER FOR ANY LOST PROFITS, REVENUES (EXCEPT FOR ANY FEES OWED PURSUANT TO THIS AGREEMENT), LOSS OF USE, LOSS OF OR DAMAGE TO SOFTWARE OR DATA OR LOSS OF GOODWILL, SERVICE INTERRUPTION, COMPUTER DAMAGE OR SYSTEM FAILURE, COSTS OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, GOODWILL ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE SERVICES, FROM ANY COMMUNICATIONS OR INTERACTIONS WITH OTHER USERS OF THE PLATFORM OR SERVICES OR FOR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE OR CONSEQUENTIAL DAMAGES (COLLECTIVELY, “INDIRECT DAMAGES”) HOWEVER CAUSED AND WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, WHETHER OR NOT THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH INDIRECT DAMAGES.

11.3 Super Cap.  NOTWITHSTANDING ANYTHING HEREIN TO THE CONTRARY, THE LIMITATIONS AND EXCLUSIONS OF LIABILITY SET FORTH IN SECTIONS 11.1 OR 11.2 HEREOF SHALL NOT APPLY TO EITHER PARTY’S (I) INDEMNIFICATION OBLIGATIONS HEREUNDER, (II) BREACH OF CONFIDENTIALITY (SECTION 7) OR DATA SECURITY OBLIGATIONS HEREUNDER; (III) VIOLATION OR INFRINGEMENT OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS (THE “EXCLUDED CLAIMS”); PROVIDED THAT NEITHER PARTY’S TOTAL AGGREGATE LIABILITY FOR THE EXCLUDED CLAIMS SHALL NOT EXCEED THE LESSER OF: (I) THE NON-BREACHING PARTY’S ACTUAL DIRECT DAMAGES; (II) FIVE HUNDRED THOUSAND US DOLLARS ($500,000 USD), OR (III) THREE TIMES (3X) THE AGGREGATE AMOUNTS PAID AND PAYABLE BY CUSTOMER TO COBALT IN THE TWELVE (12) MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO THE LIABILITY.

12. Term and Termination.

12.1 Term of Agreement.  This Agreement shall commence on the Effective Date and will continue thereafter until (i) the furthermost end date of the Service Period in the last to expire Sales Order or SOW; or (ii) where applicable, the date of termination for material breach as effectuated under Section 12.2 (the “Term”). Each Sales Order and/or SOW shall remain in effect for the Service Period (or in the case of an SOW, until the occurrence of the End Date) and the Services will be provided by Cobalt only during such time-period. 

12.2 Termination for Cause.

12.2.1 Either Party may terminate this Agreement for cause: (i) upon thirty (30) calendar days’ written notice of a material breach (other than non-payment) to the other party if such breach remains uncured at the expiration of such period; or (ii) with immediate effect by giving written notice to the other party, if the other party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership or liquidation or makes an assignment for the benefit of creditors. During any such cure period, Cobalt reserves the right to deactivate Customer’s passwords and/or login credentials and/or to block access to the Platform Services, whereby the fees will remain due for the period during which access was blocked and/or passwords and log-ins were deactivated, and Customer will be solely responsible for any and all consequences resulting from such blocking and/or deactivation, without recourse against or liability from Cobalt or any third-party service provider.

12.2.2 Cobalt may terminate this Agreement with immediate effect upon written notice if, at any time, Customer becomes or is acquired by a competitor of Cobalt’s or any of its Affiliates’.

12.2.3 Each Party shall have the right to terminate this Agreement, and all Sales Orders or SOWs subject to this Agreement, in their entirety upon written notice to the other Party if such Party materially breaches its obligations under this Agreement and, after receiving written notice identifying such material breach in reasonable detail, fails to cure such material breach within thirty (30) days from the date of such notice; provided, that Cobalt may terminate this Agreement immediately upon written notice where a breach or violation is not capable of cure. During any such cure period, Cobalt reserves the right to deactivate Customer’s passwords and/or login credentials and/or to block access to the Platform Services, whereby the fees will remain due for the period during which access was blocked and/or passwords and log-ins were deactivated, and Customer will be solely responsible for any and all consequences resulting from such blocking and/or deactivation, without recourse against or liability from Cobalt or any third-party service provider.

12.3 Term and Termination of a Sales Order or SOW for Breach. An individual Sales Order or SOW shall not be subject to termination, except that a Sales Order or SOW may be terminated (in whole but not in part) by a Party solely if the other Party fails to cure a material breach thereof, or of this Agreement as it relates to such Sales Order or SOW, within thirty (30) days after receiving written notice of the breach from the non-breaching Party or immediately if a material breach is not capable of cure. 

12.4 Effect of Termination. Upon any termination or expiration of this Agreement, all rights and obligations of the Parties shall end, other than their rights and obligations which are intended to survive termination. 

12.5 Retention and Destruction of Data.  Upon any expiration or termination of this Agreement, Cobalt shall delete any Customer Data or Customer Confidential Information relating to Customer upon request, unless prohibited by law from doing so. Customer will be able to access the Platform for fourteen (14) days in order to export any reports, Customer Data, or Customer Confidential Information using the functionality within the Platform. The fourteen (14) day period may be extended by mutual agreement, on a case-by-case basis, if a longer time period is needed.

12.6 Transition Assistance. Commencing sixty up to (60) calendar days prior to the expiration of this Agreement or any Sales Order thereof, or commencing upon any notice of termination of the Agreement or Sales Order, as applicable (except for a termination for cause by Cobalt), Cobalt shall provide to Customer termination assistance and/or migration services to facilitate Customer’s orderly transition from the Services to Customer’s alternate service provider as designated by Customer (“Transition Assistance”). Such Transition Assistance will be provided to Customer on a time and materials basis, at Cobalt’s then current billing rates for such services.

13. FORCE MAJEURE. If the performance of any obligation hereunder is interfered with by reason of any circumstances beyond a Party’s reasonable control, including but not limited to acts of God, disease, epidemic, pandemic, labor strikes and other labor disturbances, power surges or failures mandatory government shutdowns, quarantines, lockouts, riots, acts of war, acts of insurrection, terrorism, earthquake, fire, explosions, or the act or omission of any third-party, the Party shall be excused from such performance to the extent necessary during the term of any force majeure event, provided the Party shall use reasonable efforts to remove such causes of nonperformance. If an event of force majeure prevents either Party from performing its responsibilities under this Agreement for a period of more than thirty (30) days, the other Party may terminate this Agreement and any outstanding Sales Order immediately upon written notice.

14. PUBLICITY, REFERENCE, USE OF REPORTS, AND TRADEMARKS. 

14.1 Customer agrees that Cobalt may use Customer’s name(s), tradename(s), trademark(s) and/or logo(s) (“Marks”) as a commercial reference, in Cobalt’s promotional materials, RFP responses, presentations, and on Cobalt’s website and/or in a customer list identifying all or a material representation of Cobalt’s or its Affiliates’ customers.  Cobalt agrees not to alter the name, tradename(s), trademark(s) or logo(s) of Customer, nor to state or imply any endorsement of Cobalt by Customer without the express written permission of Customer.

14.2 Customer may (i) list Cobalt in Customer’s list of vendors; and (ii) utilize any of Cobalt name(s), tradename(s), trademark(s) or logo(s)) in promotion of itself utilizing Cobalt’s Vulnerability Reports on their website(s) or in any promotional materials. Customer agrees not to alter Cobalt’s name, tradename(s), trademark(s), logo(s), or the Vulnerability Report(s) produced by Cobalt for Customer, nor to state or imply any endorsement of Customer by Cobalt without the express written permission of Customer.

15. MISCELLANEOUS.

15.1 Insurance. Cobalt shall maintain, at all times during this Agreement, insurance coverages in at least the following minimum amounts: (i) General Liability Insurance in the amount of two million dollars ($2,000,000); (ii) Technology Errors and Omissions in the amount of five million dollars ($5,000,000); (iii) Excess Liability in the amount of five million dollars ($5,000,000). Customer may request in writing a current Certificate of Insurance during the Term.

15.2 Assignment and Related Matters.  Except as otherwise set forth herein, neither Party may assign, transfer, or delegate this Agreement or any rights or obligations under this Agreement, in whole or in part, without the other Party’s prior written consent. Any attempt by either Party to assign, transfer, or delegate this Agreement or any rights or obligations hereunder, without such consent, will be null and of no effect. Notwithstanding the foregoing, Cobalt may assign or transfer this Agreement, without Customer’s consent, to an Affiliate or to a successor-in-interest resulting from a merger, sale of substantially all of its assets, a change of control, or by operation of law. Subject to the foregoing, this Agreement will bind and inure to the benefit of the Parties, their successors and any permitted assigns.

15.3 Survival. Except as expressly set in this Agreement, the rights and obligations set forth in Section 2 (Sales Orders, Invoicing and Payment), Section 5 (Intellectual Property Rights), Section 6 (License Grants), Section 7 (Confidentiality), Section 9 (Warranties), Section 10 (Indemnification), Section 11 (Limitation of Liability), Section 15.4 (Governing Law), Section 15.6 (Independent Parties, Third-Party Beneficiaries), and Section 15.7 (Entire Agreement, Amendment, and Waiver) shall survive the expiration or termination of this Agreement.

15.4 Governing Law.  The United Nations Convention on Contracts for the International Sale of Goods does not apply to the transactions contemplated by this Agreement. The Uniform Computer Information Transactions Act (“UCITA”) will not apply to this Agreement regardless of when and howsoever adopted, enacted and further amended under the governing state laws. Any claim before a court in connection with this Agreement may only be initiated by either signatory, within one (1) year of the date on which the facts giving rise to such claim are known or should have been known by the claimant.

15.4.1 For customers located in the Americas: This Agreement and any dispute(s) or Claim(s) (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation (collectively “Dispute(s)”) shall be governed by the laws of the State of Delaware, without regard to its conflict-of-law provisions. The Parties irrevocably agree to submit to the personal jurisdiction of the Chancery Court located in New Castle County, Delaware, or the United States District Court for the State of Delaware, for any Dispute or actions for which the Parties retain the right to seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation or violation of a Party’s copyrights, trademarks, trade secrets, patents, or other intellectual property rights (“Actions”). 

15.4.2 For customers located in the DACH region: This Agreement and any Dispute shall be governed by and construed in accordance with the laws of the Federal Republic of Germany, without regard to its conflict-of-law provisions. The parties irrevocably agree to submit to the personal jurisdiction of Kammergericht Court for the city-state of Berlin, Germany for any Dispute or Actions.

15.4.3 For customers located anywhere else in the world: This Agreement, and any Dispute shall be governed by, and construed in accordance with, the laws of England and Wales, without regard to its conflict-of-law provisions. The Parties irrevocably agree to submit to the personal jurisdiction of Chancery Division of the High Court located in London, England for any Dispute or Actions.

15.5 Notices.  Notices shall be sent to each Party at the address first set forth above or via e-mail. E-mail notices to Cobalt shall be sent to info@cobalt.io; with a copy to legal@cobalt.io. Email notices to Customer shall be sent to an email address listed in any Sales Order or SOW signed by such Customer.  Notices shall be deemed to be delivered (i) one day after delivery with a reputable overnight carrier, (ii) three days after deposit with US Postal Service sent first class mail, return receipt requested, or (iii) the day an e-mail is transmitted without an error or bounce-back message. 

15.6 Independent Parties, Third-Party Beneficiaries. The relationship of the Parties is that of independent contracting Parties and Cobalt shall not be construed to be an employee, partner or agent of Customer. There are no third-party beneficiaries to this Agreement.

15.7 Entire Agreement, Amendment and Waiver.  The terms and conditions of this Agreement (including any applicable schedules, referenced documents, rules for Running a Security Program, Sales Orders, or SOWs entered into pursuant hereto) provide the complete understanding of the Parties with regard to the subject matter hereof and supersede all previous communications, agreements, proposals or representations related to the subject matter hereof. Except as otherwise expressly provided for herein, any waiver, amendment, or modification of any right or remedy, in whole or in part under this Agreement, or any additional or different terms in, acknowledgments or other documents, will not be effective unless expressly agreed to in writing and signed by the authorized representatives the Parties. In the event of any inconsistency or conflict between the terms of this Agreement, and any terms contained within a Sales Order, SOW, or other supplemental agreement terms (including any addenda) (“Other Terms”), such Other Terms shall control. It is expressly agreed that no additional terms and conditions contained in Customer’s purchase order, internet procurement portal or other non-Cobalt document shall apply to the Platform, Services, or to this Agreement.

This Agreement may be executed in counterparts, which, taken together, will constitute one and the same instrument. The exchange of a fully executed Agreement (in counterparts or otherwise) by electronic means or in writing shall be sufficient to bind the Parties to the terms and conditions of this Agreement and to any Sales Order or SOW.

15.8 Feedback/Reviews. Customer agrees that Cobalt, its Affiliates, or any of their agents, may freely use, disclose, reproduce, license, distribute or otherwise exploit in any manner any feedback, comments, reviews or suggestions Customer may post in any forums or otherwise provide to Cobalt or its Affiliates about the Platform, Products, and/or Services without any obligation to Customer, without restrictions of any kind (including on account of any intellectual property rights), and without any obligation of compensation to Customer and/or any third-party.

15.9 Subject Headings. The subject headings of this Agreement are included for purposes of convenience only and shall not affect the construction or interpretation of any of its provision. 

15.10 Signature.  The Parties agree to the execution of this Agreement using electronic signatures. The Parties agree, to the extent necessary, that such signatures will be regarded as an original of the document. The Parties agree to use a third-party electronic signature platform designated by Cobalt; provided, that such platform conforms with any applicable framework, regulation or legislation applicable to electronic signatures. Each Party represents that the person signing the Sales Order and/or Agreement has all right, power and authority to sign this Agreement on behalf of such Party.

_

Archive 

Platform Services Agreement (March 5th, 2024 - March 31st, 2025)