Doppel Platform Agreement

This Doppel Platform Agreement (“Agreement”) is a master agreement that covers all Doppel products and support but provisions regarding specific products are set forth in the applicable Exhibits and apply only to the extent you have purchased, accessed or used such products or services.

Definitions:

“Affiliate” means, with respect to any party, an entity that directly or indirectly is controlled by, controls, or is under common control with such party.

“AI Features” means artificial intelligence, machine learning, and other automated technologies, including generative and agentic AI.

“AUP” means Doppel’s Acceptable Use Policy available at doppel.com/legal/aup.

“Confidential Information” means non-public business, technical or financial information disclosed by or on behalf of one party to the other.

“Customer Data” means data or information in the form provided by Customer that is input into or stored in the Products or otherwise made available to Doppel in connection with the Products and Support.

“Documentation” means the technical user guide and related documentation included with the applicable Product.

“Doppel Data” means the data generated by the Products, including but not limited to, correlative and/or contextual data, and/or detections. Doppel Data does not include Customer Data.

“Evaluation” means access to the Products on a trial basis, free of charge.

“Inputs” means Customer Data, prompts, queries, instructions, configurations, triggers, or other information processed by an AI Feature.

“Order” means the applicable ordering document entered into by Doppel and Customer or purchase order(s) accepted by Doppel

“Outputs” means content, classifications, recommendations, or other results generated or curated by an AI Feature.

“Products” means any of Doppel’s cloud-based software or other products ordered by Customer as set forth in the relevant Order, the Doppel Data, any Documentation and any Updates thereto that may be made available to Customer from time to time by Doppel.

“Reseller” means a Doppel-authorized business partner.

“Support” means technical support for the Products.

“Term” means the term of Customer’s subscription license to the Products and/or Support as stated in an applicable Order.

“Threat Intelligence” means threat-related data collected from publicly available, third-party, and Customer-provided sources, including indicators, patterns, classifications, and insights used to provide, maintain, develop, or improve the Products and their threat detection, analysis, awareness and prevention capabilities. To the extent Threat Intelligence is derived from Customer Data, it will be de-identified so that it does not identify, or reasonably permit identification of, Customer or its Users.

“Usage Data” means statistical, analytical, and performance data relating to Customer’s use of the Products and Support.

“Users”means personnel of Customer or its Affiliates who are authorized by Customer to access or use the Products.

1. SAAS PRODUCTS AND SUPPORT

1.1 License. During the Term, and subject to payment of applicable fees and Customer’s compliance with this Agreement, Doppel grants to Customer a limited, non-exclusive, non-sublicensable and non-transferable (except as expressly provided in Section 11.9) license to access and use the Products solely for Customer’s internal business purposes in accordance with the Documentation. Customer’s access and use is limited to the quantity in the applicable Order. No rights are granted to the Products except as explicitly set forth in this Agreement, and all such other rights are expressly reserved by Doppel.

1.2. Authorized Access. Customer may permit its Affiliates to use the Products for their internal business purposes, subject to any Order restrictions, and remains responsible for their compliance with this Agreement. Customer may also permit a third party that manages Customer’s IT resources to use the Products on Customer’s behalf, provided Customer remains responsible for that third party’s compliance with this Agreement.

1.3 Orders. If Customer orders from a Reseller, final terms of the transaction (e.g., pricing, discounts, fees, payments and taxes) are solely subject to the agreement between Customer and its Reseller of choice. This Agreement will govern Doppel’s provision and Customer’s license to the Products whether Customer orders from Doppel or a Reseller. If Customer orders directly from Doppel, Customer will pay Doppel the fees for the subscription term set forth in the Order; provided, however, that Doppel reserves the right to change the fees and/or to institute new charges and fees applicable to any renewal Order by notifying Customer (email sufficient) of such change(s) at least sixty (60) days prior to the commencement of the applicable renewal term. Customer may be charged additional fees for usage that exceeds the applicable Product usage limits.

1.4 Support. Doppel will provide Support in accordance with the response times available at doppel.com/legal/support.

2. RESTRICTIONS AND RESPONSIBILITIES

2.1 Restrictions on Use. Customer will not, and will not permit any third party to: (a) resell, sublicense, distribute, or otherwise make the Products available to third parties except as expressly permitted by this Agreement; (b) copy, modify, create derivative works of, reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code or underlying components of the Products; (c) remove proprietary notices, introduce malicious code, or use the Products in violation of applicable law or third-party rights; (d) access or use the Products to benchmark, develop, train, improve, or commercialize a competing product or service, or to reverse engineer, scrape, replicate, or copy the Products’ features, functionality, content, or interfaces; or (e) use the Products for any deceptive, anticompetitive, or bad-faith purpose. Customer is responsible for ensuring that Users, Affiliates and any third parties managing Customer’s IT resources comply with this Agreement.

2.2 Export Compliance and Government Use. Customer will not export or re-export the Products in violation of U.S. export laws or regulations. The Products and any software are “commercial items,” “commercial computer software” and “commercial computer software documentation” as defined under the applicable FAR and DFAR regulations, and any U.S. Government use or disclosure is governed solely by this Agreement and only as expressly permitted herein.

2.3 Customer Obligations. Customer is responsible for: (a) its and its Users’ use and configuration of the Products in accordance with the Documentation and AUP; (b) providing the Customer Data, cooperation, and assistance reasonably required for Doppel to provide the Products; and (c) ensuring that its collection and use of Customer Data, and its instructions to Doppel, comply with applicable law, including providing all required notices and obtaining all necessary rights and consents.

2.5 Evaluations. Doppel may provide Products for evaluation until the evaluation period ends, Customer purchases the applicable Products, or either party terminates the evaluation. Evaluations are provided without warranties, indemnities, service levels, or support, and are subject to the liability limits in this Agreement.

2.6 Feedback. To the extent Customer or its Users provide any feedback, including recommended changes and requests for new features regarding the Products or Support, Customer grants Doppel a perpetual, irrevocable, worldwide, royalty-free, sublicensable license to use, copy, modify, and otherwise exploit the foregoing for any business purpose without attribution or compensation. Feedback will not include Customer Data or Customer Confidential Information.

3. CUSTOMER DATA AND USAGE DATA

3.1 Right to Use Customer Data. Customer represents that it has all rights and permissions necessary for Doppel to use Customer Data as contemplated by this Agreement. During the Term, Customer grants Doppel a worldwide, non-exclusive, royalty-free license to use Customer Data as necessary to provide, maintain, improve the Products, provide Support and perform its obligations under this Agreement. Following termination, Doppel may retain Customer Data only as required by law or pursuant to its standard backup and deletion practices. Doppel may permit its Affiliates and representatives to use Customer Data for these purposes and remains responsible for their compliance with this Agreement.

3.2 Usage and Threat Intelligence Data. Doppel may collect and use Usage Data and Threat Intelligence, as well as de-identified insights derived from Inputs and Outputs, during and after the Term for diagnostics, analytics, model training, and development and improvement of the Products, including AI Features. Any insights derived from Inputs or Outputs will be de-identified so they do not identify, or reasonably permit identification of, Customer or its Users and, where practicable, aggregated across customers. Doppel will not disclose Usage Data or such insights in a manner that identifies Customer or its Users.

4. ARTIFICIAL INTELLIGENCE

4.1 Data Use. Doppel may process Inputs and Outputs to provide, maintain, secure and support Customer’s licensed use of the Products.

4.2 AI Features. The Products may incorporate AI Features to detect, analyze, correlate, classify, prioritize, and respond to threats; generate content, recommendations, and simulations; and automate Product workflows. Doppel may use its own technology and technology provided by third parties to provide AI Features, as more fully detailed in the Doppel AI FAQ document available at trust.doppel.com.

4.3 Inputs and Outputs. As between the parties, Customer retains its rights in Customer Data contained in Inputs or Outputs, and Doppel retains its rights in the Products, Doppel Data, Threat Intelligence, and other Doppel materials contained in Outputs. Subject to this Agreement, Customer may use Outputs for its internal business purposes in connection with the Products.

4.4 Model Training. Doppel will not use Customer Data to train AI models. Doppel will de-identify and anonymize Customer Data, Inputs, and Outputs before using them to train, evaluate, or improve its AI Features, and may use that de-identified and anonymized information for such purposes. Doppel will not permit any third-party AI provider to use Customer Data, Inputs, or Outputs to train or improve that provider’s AI models or services.

5. PRIVACY AND SECURITY

5.1 Doppel will process Customer Data in accordance with its Data Processing Addendum available at doppel.com/legal/support and applicable security documentation available at trust.doppel.com. The Data Processing Addendum is incorporated into this Agreement.

6. CONFIDENTIALITY; PROPRIETARY RIGHTS

6.1 Confidentiality. Doppel’s Confidential Information includes the Products and Support, and Customer’s Confidential Information includes Customer Data. Each party will: (a) protect the other party’s Confidential Information using at least reasonable care; (b) use it only to exercise its rights or perform its obligations under this Agreement; and (c) disclose it only to its employees, contractors, consultants and agents who need to know it and are bound by confidentiality obligations at least as protective as those in this Agreement. Each party is responsible for its recipients’ compliance with this Section.

6.2 Exclusions and Required Disclosures. Confidential Information does not include information that the recipient can demonstrate: (a) was lawfully known to it without restriction before disclosure; (b) was lawfully received from a third party without restriction; (c) was independently developed without using the other party’s Confidential Information; or (d) is or becomes publicly available through no breach of this Agreement. A party may disclose Confidential Information as required by law if it provides reasonable prior notice to the other party where legally permitted. Trade secrets will be protected for so long as they remain trade secrets, and all other Confidential Information will be protected for five years after disclosure.

6.3 Ownership. Subject to the rights and licenses granted under this Agreement, Customer retains all right, title and interest in Customer Data, and Doppel retains all right, title and interest in the Products and any software, technology, improvements, enhancements or modifications developed or provided by Doppel in connection with the Products or Support.

7. TERM AND FEES

7.1 Term of Agreement and Orders. This Agreement begins on the Effective Date and remains in effect until all Orders have expired or been terminated. Each Order remains in effect for the subscription term specified in that Order unless earlier terminated under this Agreement. Either party may terminate this Agreement upon written notice if no Orders are then in effect.

7.2 Termination. In addition to any other remedies it may have, either Party may terminate this Agreement, effective upon written notice to the other Party, if the other Party materially breaches this Agreement and such breach: (a) is incapable of cure; or (b) being capable of cure, remains uncured for thirty (30) days or more after the non-breaching Party provides the breaching Party with written notice of such breach.

7.3 Effect of Expiration or Termination. Upon expiration or termination of this Agreement, (a) the rights and License granted under this Agreement shall immediately cease (b) Customer and its Users will immediately cease use of the Products and (c) Doppel will delete or return all Customer Data in accordance with the terms of the DPA. Customer will pay in full any outstanding Fees owed under the applicable Order. All sections of this Agreement that, by their nature, should survive termination or expiration of this Agreement, will survive such termination or expiration.

8. WARRANTY AND DISCLAIMER

8.1 Limited Warranty. Doppel warrants that during the Term each appliable Product will conform in all material respects to its applicable Documentation and that Support will be performed in a professional and workmanlike manner. Customer will notify Doppel within thirty (30) days after the occurrence of the event giving rise to a warranty claim.

8.2 Disclaimer.TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION 8, THE PRODUCTS AND SUPPORT ARE PROVIDED “AS IS” AND “AS AVAILABLE.” CUSTOMER ACKNOWLEDGES THAT THE PRODUCTS AND SUPPORT MAY RELY ON THIRD-PARTY DATA SOURCES AND MAY CONTAIN INACCURACIES, OMISSIONS, OR ERRORS. DOPPEL DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND THOSE ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. DOPPEL DOES NOT WARRANT THAT THE PRODUCTS OR SUPPORT WILL BE ERROR-FREE OR THAT ANY RESULTS OBTAINED FROM THEIR USE WILL BE ACCURATE, COMPLETE, OR RELIABLE, AND DOPPEL SHALL NOT BE LIABLE FOR ANY LOSS, LIABILITY, OR DAMAGE OF ANY KIND RESULTING FROM SUCH ERRORS, OMISSIONS, INACCURACIES OR RESULTS. FOR THE AVOIDANCE OF DOUBT, THE FOREGOING DISCLAIMER DOES NOT LIMIT DOPPEL'S OBLIGATIONS WITH RESPECT TO ANY BREACH OF THE WARRANTIES OR INDEMNITIES EXPRESSLY SET FORTH IN THE AGREEMENT.

8.3 Warranty Remedies. THE SOLE AND EXCLUSIVE REMEDY FOR ANY BREACH OF THE FOREGOING WARRANTY SHALL BE THAT DOPPEL, IN RESPONSE TO WRITTEN NOTICE OF A WARRANTY CLAIM, SHALL, AT ITS OPTION AND OWN EXPENSE, EITHER: (A) CORRECT THE NON-CONFORMITY TO THE ABOVE STANDARD; OR (B) TERMINATE THE AGREEMENT AND REFUND ANY UNEARNED, PREPAID FEES.

8.4 Warranty Conditions and Exclusions. The foregoing warranties and remedies are contingent upon the proper installation and use of the Products as described in the Documentation and this Agreement. Doppel will have no responsibility or liability under the warranties in this Section resulting from (a) Customer’s misuse or mis-operation of the Products contrary to the Documentation or the AUP; or (b) any modification of the Products by Customer or any third party.

9. INDEMNIFICATION

9.1 Doppel Indemnity. Doppel will indemnify, defend and hold harmless Customer, its Affiliates and their respective officers, directors, employees and agents from any damages, liabilities, costs and expenses, including reasonable attorneys’ fees, arising from a third-party claim alleging that: (a) the Products or Support infringe or misappropriate a third party’s intellectual property rights; or (b) Doppel engaged in gross negligence or intentional misconduct.

9.2 Remedies. If Customer’s use of the affected Product is enjoined by reason of a claim under Section 9.1(a), Doppel’s sole obligation shall be to procure the right for Customer to continue using the affected Product, or if such remedy is not available on a commercially reasonable basis, Doppel will refund any prepaid unused fees, and access to the affected Product shall terminate without further liability of Doppel.

9.3 Indemnity Exclusions. Doppel shall have no obligation under Section 9.1 to the extent that any claim is based on or related to (i) Customer Data, (ii) use of the affected Product in a manner not specified in applicable Documentation, (iii) use of the affected Product in violation of law, this Agreement, or the AUP, or (iv) the combination of the affected Product with other programs, software, data, hardware or materials not provided by Doppel. Sections 9.1 through 9.3 state Doppel’s full liability and Customer’s sole remedy for infringement claims under Section 9.1(a). Doppel has no other implied indemnification obligations.

9.4 Customer Indemnity. Customer will indemnify, defend and hold harmless Doppel, its Affiliates and their respective officers, directors, employees and agents from any damages, liabilities, judgments, settlements, costs and expenses, including reasonable attorneys’ fees, arising from a third-party claim relating to: (a) Customer Data, including any allegation that Customer Data infringes or violates a third party’s rights; and (b) Customer’s use of the Products in violation of this Agreement, the AUP or applicable law.

9.5 Procedure. A party seeking indemnification will: (a) promptly notify the other party of the applicable claim, although a delay will relieve the other party of its obligations only to the extent the delay materially prejudices the defense; (b) provide reasonable cooperation at the other party’s expense; and (c) allow the other party to control the defense and settlement of the claim. The party controlling the defense may not settle a claim in a manner that admits fault by, imposes obligations on or fails to fully release the party seeking indemnification without that party’s prior written consent. The party seeking indemnification may participate in the defense with counsel of its choice at its own expense.

10. LIMITATION OF LIABILITY

10.1 Exclusion of Damages. TO THE FULLEST EXTENT PERMITTED BY LAW, EXCEPT FOR EXCLUDED CLAIMS IN SECTION 10.3 BELOW, FOR WHICH THERE WILL BE NO CAP ON LIABILITY, NEITHER PARTY NOR ITS REPRESENTATIVES SHALL BE RESPONSIBLE OR LIABLE TO THE OTHER PARTY FOR ANY (I) CONSEQUENTIAL, INDIRECT, INCIDENTAL, EXEMPLARY, PUNITIVE OR SPECIAL DAMAGES, (II) PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR (III) LOSS OF USE, DATA, BUSINESS, OR PROFITS, IN EACH CASE WITH RESPECT TO ANY SUBJECT MATTER ARISING OUT OF OR RELATED TO THE AGREEMENT, UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE AND STRICT LIABILITY), EVEN IF THE PARTY WAS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND WHETHER OR NOT SUCH LOSSES OR DAMAGES WERE OTHERWISE FORESEEABLE.

10.2 Total Liability. To the fullest extent permitted by law, except for Excluded Claims (for which there shall be no cap on liability) or Special Claims (which are subject to the Enhanced Liability Cap set forth in Section 10.4), neither party’s aggregate liability under this Agreement will exceed the amount paid or payable by Customer to Doppel during the twelve (12) months prior to the event giving rise to liability.

10.3 Excluded Claims. “Excluded Claims” means: (i) any intentional misconduct, fraud or gross negligence by either party; (ii) any amounts payable to third parties pursuant to Doppel’s IP Indemnity obligations under Section 9.1(a); or (iii) any amounts payable to third parties pursuant to Customer’s indemnification obligations hereunder.

10.4 Special Claims. “Special Claims” means any breach by Doppel of its right to use Customer Data hereunder or breach of its privacy, confidentiality and security obligations resulting in unauthorized disclosure or misuse of Customer Data. For any and all Special Claims, Doppel’s aggregate liability shall be subject to an enhanced liability cap not to exceed three times (3x) the amount paid or payable by Customer to Doppel during the twelve months prior to the event giving rise to liability (the “Enhanced Liability Cap”).

11. MISCELLANEOUS

11.1 Entire Agreement; Order of Precedence. This Agreement constitutes the entire agreement between the parties regarding its subject matter and supersedes all prior or contemporaneous agreements, communications and understandings regarding that subject matter. Any trade secrets or other confidential information disclosed under an existing confidentiality or nondisclosure agreement will remain protected in accordance with its terms. If an Order conflicts with this Agreement, this Agreement will control unless the Order expressly identifies the provision of this Agreement that it overrides.

11.2 Severability. If any provision of this Agreement is invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable consistent with the parties’ original intent. If it cannot be modified, it will be removed. The remaining provisions will continue in effect.

11.3 No Third-Party Beneficiaries. This Agreement does not grant any rights or remedies to any third party.

11.4 Waiver. A waiver must be in writing and signed by the party granting it. A waiver on one occasion will not waive any other provision or the same provision on another occasion.

11.5 Relationship of the Parties. The parties are independent contractors. Neither party has authority to bind the other or incur obligations on the other’s behalf.

11.6 Notices. Notices under this Agreement must be in writing and sent to the applicable contact information provided in the Order or signature block. Notices will be effective upon receipt if delivered personally, by certified or registered mail or by nationally recognized overnight courier. Notices of indemnification, breach, default or litigation may not be delivered solely by email.

11.7 Governing Law and Disputes. This Agreement is governed by California law without regard to its conflict-of-law principles. Before initiating litigation, a party will give the other party written notice of the dispute, and the parties will attempt in good faith to resolve it through representatives with authority to settle the dispute. Either party may initiate litigation if the dispute is not resolved within 45 days after notice. The prevailing party in any action to enforce this Agreement may recover its reasonable costs and attorneys’ fees.

11.8 Force Majeure. Neither Party will be responsible for any delay or failure to perform, other than payment of amounts owed, caused by circumstances beyond its reasonable control (including, but not limited to, acts of God, pandemics, power failures, acts of war or terror), provided that the affected Party promptly notifies the other Party, uses commercially reasonable efforts to mitigate the effects, and resumes performance as soon as reasonably practicable.

11.9 Assignment. Either party may assign this Agreement without the other’s consent in connection with a merger, reorganization or sale of all or substantially all of its business or assets. Any other assignment by Customer requires Doppel’s prior written consent, not to be unreasonably withheld. Upon providing 30 days prior notice, Doppel may assign this Agreement without Customer’s consent. This Agreement will bind and benefit the parties and their permitted successors and assigns.

11.10 Publicity. Doppel may use Customer’s name and logo to identify Customer as a Doppel customer on Doppel’s public website, doppel.com. Doppel may also include Customer in customer lists and other sales materials subject to Customer’s prior written approval, not to be unreasonably withheld. Customer will provide approval or feedback within seven business days after receiving the proposed use, after which it will be deemed approved. If mutually agreed, Doppel may develop case studies and other promotional content regarding Customer’s use of the Products or Support, and Customer will reasonably cooperate in their creation.

Exhibit A - DOPPEL DIGITAL RISK PROTECTION TERMS

Applicability. These Product-specific terms apply only if Customer purchases, accesses or uses Doppel’s digital risk protection Products under an Order (the “DRP Products”). DRP Products include Doppel’s Brand Protection and Executive Protection Products and any related monitoring, detection, analysis, investigation and remediation capabilities purchased under an Order. Capitalized terms not defined in this Exhibit have the meanings given in the Agreement. If this Exhibit conflicts with the Agreement, this Exhibit controls only with respect to the DRP Products.

1. DRP PRODUCTS

1.1 Monitoring and Analysis. The DRP Products monitor supported external sources and digital channels for suspected impersonation, phishing, fraud, infringement, credential exposure, doxxing and other digital or physical threat indicators involving Customer’s brands, names, domains, trademarks, executives, other designated individuals, accounts and other assets identified for protection. The DRP Products may analyze, enrich, classify, prioritize and correlate detected activity and may identify related infrastructure or campaigns. The specific coverage, quantities and features purchased by Customer are set forth in the applicable Order.

1.2 Results. Threat detection and analysis depend on available data, Customer’s configuration and the access and technical limitations of external sources. The DRP Products may not identify every threat and may identify legitimate activity as suspicious. Customer is responsible for reviewing available evidence and deciding whether suspected activity is unauthorized before directing Doppel to take remedial action.

2. CUSTOMER ASSETS, INFORMATION AND INSTRUCTIONS

2.1 Customer Assets. Customer will identify the assets to be monitored and will provide accurate and current information reasonably requested by Doppel. Customer will not submit a domain, trademark, name, account, individual or other asset for monitoring or enforcement unless Customer owns or legally controls that asset or is authorized to act for the owner or rights holder.

2.2 Rights and Authority. Customer represents and warrants that it owns, controls or has obtained all rights and authority necessary for Doppel to monitor the assets identified by Customer, process the information Customer provides and carry out Customer’s takedown or remediation instructions. Customer is responsible for obtaining any notices, permissions and consents required for Doppel to provide the DRP Products as contemplated by the Agreement and this Exhibit.

2.3 Confirmations and Instructions. Customer is responsible for each confirmation, approval and instruction provided through the DRP Products or otherwise by or on behalf of Customer. Customer will not direct Doppel to submit a takedown or other remediation request unless Customer has a good-faith basis to believe the targeted asset or content is unauthorized, unlawful or infringes rights that Customer is authorized to enforce.

3. TAKEDOWNS AND OTHER REMEDIATION

3.1 No Legal Advice. Doppel does not provide legal advice or determine whether content submitted to Doppel hereunder violates applicable law. Customer solely is responsible for directing any takedown or remediation action.

3.2 Appointment as Agent. Customer appoints Doppel as Customer’s agent for the limited purpose of enforcing Customer’s intellectual property rights, including submitting takedown requests and related communications, as set forth in the Letter of Authorization separately executed by Customer and Doppel. In performing those activities, Doppel will act based on information, materials and instructions provided by or on behalf of Customer. Doppel is not responsible for independently confirming the accuracy or completeness of materials supplied by Customer and may rely on them in carrying out those activities. Customer is responsible for providing any documentation reasonably requested by Doppel to show that Doppel is authorized to request the removal of online assets or content and pursue other remedial measures.

3.3 Use and Disclosure of Customer Data. Customer authorizes Doppel to use and disclose Customer Data, including evidence, rights-holder information, contact information and supporting materials, to registrars, hosting providers, social networks, marketplaces, search engines, advertising networks, telecommunications providers and other third parties as reasonably necessary to investigate suspected threats, submit or support takedown and remediation requests and communicate about those requests.

3.4 Third-Party Decisions. Doppel may submit and follow up on takedown and other remediation requests, but the applicable third party controls whether, when and how it responds. Doppel does not guarantee that a request will be accepted or that an asset, account, domain, advertisement, telephone number or item of content will be removed, suspended, blocked or otherwise remediated within any particular period.

3.5 Doppel Safeguards. Doppel may decline, pause, modify or withdraw a request if Doppel reasonably believes that the request lacks adequate support, conflicts with applicable law or a third party’s requirements, creates material legal or security risk or is based on inaccurate or incomplete information. Doppel will notify Customer of a material action taken under this Section when reasonably practicable. Customer will reasonably assist with questions, counter-notices, disputes and other communications arising from a request made on Customer’s behalf.

4. THIRD-PARTY PLATFORMS AND INTEGRATIONS

4.1 External Services. The DRP Products may collect information from, submit information to or interoperate with third-party platforms and services. Doppel does not endorse and is not responsible for the operation, security, data or functionality of those services. Customer is responsible for complying with any terms that apply to Customer’s use of a third-party service, including any separate fees or account requirements.

4.2 Changes to Availability. Third parties may change or discontinue access, interfaces, policies or enforcement processes at any time. Doppel may modify or discontinue an integration, data source or remediation method if continued use is no longer reasonably available, lawful or commercially practicable.

5. AI-ASSISTED ANALYSIS

5.1 Threat Classification and Summaries. The DRP Products may use AI Features to assist in analyzing, enriching, correlating, classifying and prioritizing alerts involving websites, domains, accounts, advertisements, communications and other external digital assets. These technologies may evaluate indicators such as similarity to Customer’s assets, signs of malicious or unauthorized activity, the presence of Customer brand elements and the apparent nature of a potential threat. The DRP Products may also generate human-readable summaries of alerts or campaigns. A summary reflects the applicable classification when generated and is not a continuously updated description of all underlying evidence or later developments.

5.2 AI Outputs. AI-generated or AI-assisted outputs may be probabilistic, incomplete or inaccurate. They are intended to assist Customer’s security review and should be considered together with the other data, evidence and functionality available through the DRP Products. Customer remains responsible for decisions and actions based on those outputs.

6. DRP-SPECIFIC INDEMNITY

6.1 Customer Responsibility. Customer’s indemnification obligations under Section 9.4 of the Agreement apply to any third-party claim arising from (a) a takedown or other remediation request submitted by Doppel based on Customer’s confirmation, approval or instruction, (b) an allegation that Customer did not own, control or have authority to enforce the rights asserted in such a request or (c) inaccurate, incomplete or misleading information or materials supplied by or on behalf of Customer for use with the DRP Products. This Section does not apply to the extent the claim results from Doppel’s failure to follow Customer’s authorized written instructions or Doppel’s gross negligence or willful misconduct.

Exhibit B - DOPPEL HUMAN RISK MANAGEMENT TERMS

Applicability. These Product-specific terms apply only if Customer purchases, accesses or uses Doppel’s human risk management Products under an Order (the “HRM Products”). HRM Products include Doppel’s Security Awareness Training and Simulation Products and any related training, testing, campaign management, reporting and risk-analysis capabilities purchased under an Order. Capitalized terms not defined in this Exhibit have the meanings given in the Agreement. If this Exhibit conflicts with the Agreement, this Exhibit controls only with respect to the HRM Products.

Definitions:

“Applicable Laws” means all applicable laws, including, without limitation, those governing data privacy and protection, security, and electronic communications, the Federal Trade Commission Act and any state equivalent telemarketing and Do Not Call laws and rules, the CCPA, and the TCPA.

“Customer Data” means all information provided by or created by Customer or collected by Users in connection with the HRM Products.

“HRM Products” means Doppel’s human risk management and security awareness training services consisting of (i) cybersecurity incident and phishing simulation services and (ii) courses and training materials for academic learning on security awareness.

“Third Party Marks” means trademarks, copyrights, trade names, internet domain names, social media accounts, and usernames or handles owned by a person or entity other than Doppel or Customer.

1. No Training on Customer Data.

Notwithstanding anything to the contrary in the Agreement, Doppel will not use Customer Data processed through the HRM Products to train any artificial intelligence or machine-learning model.

2. Third Party Marks.

Customer is not obligated, but may choose, to utilize certain Third Party Marks when utilizing the HRM Products. Customer acknowledges that (a) all such Third Party Marks are registered or unregistered trademarks of their respective owners, (b) Doppel does not have an express license to use the Third Party Marks in the HRM Products, and (c) any Third Party Marks in the HRM Products are provided solely to create realistic training simulations and such provision does not imply any endorsement or license by the owners of the Third Party Marks. Customer is solely responsible for determining whether such use is authorized or otherwise permitted and represents and warrants that it has obtained all rights, consents, and authorizations necessary for Doppel to use such materials as directed by Customer.

3. Customer Responsibilities.

In addition to its obligations under the Agreement, Customer is responsible for configuring and managing its and its Users’ use of the HRM Products. Customer will provide any notices and obtain and maintain any consents and authorizations required to conduct its training and simulation campaigns. Customer will ensure that its campaigns comply with Applicable Law, applicable third-party platform terms and third-party rights, including by honoring valid opt-out requests. Customer will not use information generated by the HRM Products as the sole basis for making employment decisions about a User.

4. Third-Party Marks Disclaimer.

DOPPEL MAKES NO REPRESENTATION OR WARRANTY THAT CUSTOMER’S USE OF THIRD PARTY MARKS THROUGH THE HRM PRODUCTS IS AUTHORIZED, NON-INFRINGING OR COMPLIANT WITH APPLICABLE LAW.

5. HRM-Specific Indemnity.

Customer’s indemnification obligations under the Agreement apply to any third-party claim arising from: (a) Customer’s failure to provide any required notice or obtain any consent or authorization necessary for its use of the HRM Products; (b) Customer’s use of the HRM Products in violation of applicable law or applicable third-party terms; or (c) Customer-provided data, materials or instructions in connection with the HRM Products, including any allegation that they infringe, misappropriate or otherwise violate a third party’s intellectual property, privacy, publicity or other rights. This Section does not apply to the extent the claim results from Doppel’s material deviation from the campaign parameters expressly approved by Customer or Doppel’s gross negligence or willful misconduct.

Exhibit C - DOPPEL EMAIL SECURITY TERMS

Applicability. These Product-specific terms apply only if Customer purchases, accesses or uses Doppel’s email security Products under an Order (the “Email Security Products”). Email Security Products include Doppel’s Email Security and Phishing Triage Products and any related email analysis, detection, classification, reporting, investigation and remediation capabilities purchased under an Order. Capitalized terms not defined in this Exhibit have the meanings given in the Agreement. If this Exhibit conflicts with the Agreement, this Exhibit controls only with respect to the Email Security Products.

1. EMAIL SECURITY PRODUCTS

1.1 Functionality. The Email Security Products may analyze inbound, outbound or User-reported electronic communications and associated content, attachments, links, headers and metadata to detect, investigate, classify and respond to phishing, spam, malware, fraud, abuse and other suspicious or malicious activity. Depending on the features purchased and Customer’s configuration, the Email Security Products may block, quarantine, remove, replace, defang or otherwise remediate messages and may provide alerts, recommendations, summaries and related security information. The specific coverage, quantities and features purchased by Customer are set forth in the applicable Order.

1.2 Results. Email threat detection and classification may be probabilistic and depend on available data, Customer’s configuration and the access and technical limitations of Customer’s email environment and third-party services. The Email Security Products may not identify every malicious message and may classify legitimate messages as suspicious or malicious. Customer is responsible for reviewing available evidence and configuring any actions that require Customer approval.

2. PROCESSING OF EMAIL CONTENT

2.1 Processing Instructions. Customer instructs Doppel to access, process and analyze the electronic communications and associated content, attachments, links, headers and metadata made available to the Email Security Products as necessary to provide, support and secure the Email Security Products, investigate and respond to threats and perform Customer’s authorized configurations and instructions. Such information is Customer Data under the Agreement.

2.2 Threat Intelligence and Model Training. Doppel may derive de-identified indicators, signatures, patterns, features, classifications and other Threat Intelligence from Customer Data as permitted by the Agreement. Nothing in this Exhibit modifies either party’s rights related to model training in the Agreement.

3. CUSTOMER CONFIGURATION AND AUTHORIZED ACTIONS

3.1 Email Environment. Customer is responsible for connecting and configuring its email environment in accordance with the Documentation, limiting access to authorized Users and mailboxes and maintaining any permissions, credentials and third-party accounts required for the Email Security Products. Customer represents that it has authority to provide Doppel access to each connected mailbox and the Customer Data processed through it.

3.2 Automated Remediation. Customer authorizes Doppel to take the message-level actions enabled or approved by Customer through the Email Security Products, including blocking, quarantining, removing, replacing or defanging messages. Customer is responsible for its configurations and policies, which Doppel may rely on when acting on Customer’s behalf.

3.3 Classification Changes. If Customer changes the classification of a message, Customer authorizes Doppel to access and analyze that message and related content, attachments, links, headers and metadata, regardless of whether Customer separately escalates or submits the message to Doppel. Customer may disable this access through the applicable configuration setting in the Email Security Products.

3.4 Customer Responsibilities. In addition to its obligations under the Agreement, Customer will provide any notices and obtain any rights, permissions and consents required for Doppel to access and process communications and other Customer Data through the Email Security Products. Customer will use the Email Security Products in compliance with applicable law, applicable third-party terms, the Documentation and the AUP.

3.5 Usage Terms. The Email Security Volume Usage Terms identified in the applicable Order apply to Customer’s use of the Email Security Products.

4. AI-ASSISTED INSIGHTS AND ACTIONS

4.1 Security Insights. The Email Security Products may use AI Features to analyze and classify messages, recommend or automate response actions and generate narrative insights regarding Customer’s aggregated email-security data. These insights may summarize and contextualize malicious email activity, threat categories and other email-security metrics over supported reporting periods. The Email Security Products may use rule-based methods when AI-generated insights are unavailable.

4.2 AI Outputs. AI-generated or AI-assisted classifications, recommendations, summaries and other outputs may be probabilistic, incomplete or inaccurate. They are intended to assist Customer’s review and should be considered together with the other data, evidence and functionality available through the Email Security Products.

5. THIRD-PARTY EMAIL SERVICES

5.1 External Services. The Email Security Products may interoperate with Customer’s email provider and other third-party platforms and services. Doppel does not control and is not responsible for the operation, security, availability, data or functionality of those services. Customer is responsible for complying with any terms that apply to its use of a third-party service, including any separate fees or account requirements.

5.2 Changes to Availability. A third party may change or discontinue access, interfaces, permissions or functionality at any time. Doppel may modify or discontinue an integration if continued use is no longer reasonably available, lawful or commercially practicable.

6. EMAIL SECURITY-SPECIFIC INDEMNITY

6.1 Customer Responsibility. Customer’s indemnification obligations under Section 9.4 of the Agreement apply to any third-party claim arising from (a) Customer’s failure to obtain the rights, permissions or consents necessary for Doppel to access a connected email environment or process communications through the Email Security Products or (b) an action taken by Doppel through the Email Security Products based on Customer’s configuration, approval or instruction. This Section does not apply to the extent the claim results from Doppel taking a message-level action not enabled or approved by Customer through the Email Security Products or from Doppel’s gross negligence or willful misconduct.