AI Features Addendum

This AI Features Addendum (“Addendum”) forms part of the applicable Master Subscription Agreement or End User License Agreement (“Principal Agreement”) between “Cyolo” and “Customer”.

In consideration of the mutual obligations set out herein, the Parties hereby agree that the terms and conditions set out below shall be added as an Addendum to the Principal Agreement. Except where the context requires otherwise, references in this Addendum to the Principal Agreement are to the Principal Agreement as amended by, and including, this Addendum. In the event of any conflict between this Addendum and the Principal Agreement, this Addendum will control solely with respect to the AI Features, and the Principal Agreement will otherwise remain in full force and effect. Except as modified below, the terms of the Principal Agreement shall remain in full force and effect.

AI Processing. Certain Products or Services may include optional artificial intelligence features ("AI Features") that process Customer Data (including, where applicable, session recordings, keystrokes, mouse movements, network traffic data, communication patterns, system configuration data, access-control settings, policies, logs, and other telemetry or operational data) to provide automated transcription, session intelligence, analysis, or other functionalities (including an AI assistant). By enabling and using such AI Features, Customer authorizes Cyolo to process Customer Data through AI models and systems, including enterprise-grade AI models (e.g., Google Vertex AI, Claude and Gemini) and their associated infrastructure. Cyolo will use Customer Data solely for the purpose of providing the specific AI Feature to Customer. Cyolo will not use Customer Data or any generated output to train or improve any AI models.

Data Retention. All Customer Data processed by AI Features that is transmitted, uploaded, or otherwise made available to Cyolo and/or its third-party subprocessors in cloud environments solely for purposes of AI processing will be deleted from such cloud environments within twenty-four (24) hours after completion of processing, unless Customer configures a specific, limited retention period for operational purposes, after which all such data will be permanently deleted. For clarity, this Section 4 does not apply to, and does not require deletion of: (i) Customer Data stored or retained in Customer’s own systems or Customer-controlled environments; (ii) Customer Data stored in Cyolo’s platform databases pursuant to the Principal Agreement; or (iii) operational, security, prompts, Outputs or audit logs generated in connection with the AI Features, which Cyolo may retain for security monitoring, debugging, compliance with laws, enforce its rights, and audit purposes in accordance with Cyolo's applicable data retention policies.

Customer’s Responsibilities and Restrictions. Customer (and when applicable, the Users) is solely responsible for:

1. reviewing, verifying, and approving the Outputs before any reliance, use, or exposure to Users, including by evaluating their accuracy, completeness, and appropriateness for intended purpose (e.g., cyber incident investigation, operational analysis); For the purpose of this Addendum, "Output" means any content or data generated by the AI Features based on Customer Data;

2. ensuring that its use of the AI Features and Outputs complies with all applicable laws and regulations, including without limitation laws relating to employee monitoring, workplace privacy, Data Protection Laws, and intellectual property rights;

3. ensuring that Outputs and their use are consistent with Customer’s industry and internal standards;

4. ensuring that it has provided all notices and obtained all rights, permissions, and consents necessary for the submission and processing of Customer Data, prompts, and related information in connection with the AI Features and any third-party AI providers used to deliver them; and

5. complying with all restrictions on the use of the Products and Services as set forth in the ‘General Restrictions’ clause of the Principal Agreement, and any additional restrictions published by Cyolo or its subprocessors (e.g., Google’s Prohibited Use Policy for Generative AI Services) that are applicable to the AI Features. Customer shall not use the AI Features to submit or generate unlawful, infringing, defamatory, abusive, or malicious content, to introduce malware or harmful code, to circumvent security or access controls, or to test, exploit, or abuse the underlying models or related systems.

AI Limitations and Disclaimers.

1. Customer acknowledges that due to the inherent nature of artificial intelligence, Outputs may contain inaccuracies and omissions, and that the same or similar Outputs may be generated for Cyolo’s other customers or other users. Outputs are provided on an “as is” and “as available” basis for informational purposes only and should not be relied upon for critical decisions without independent human review and verification. Outputs, summaries, and responses generated by the AI Features are assistive tools only and are not a substitute for Customer’s own review, system records, audit logs, or administrative judgment. The AI Features are not designed for clinical, financial, or other regulated uses. Cyolo does not guarantee the accuracy, completeness, reliability, availability, or timeliness of any Output, and Customer must not rely on Outputs without independent verification.

2. As between the parties, and subject to the Principal Agreement and applicable third-party rights, Customer may use Outputs generated for Customer through the AI Features for its internal business purposes.

3. When using any agentic services made available in the context of the AI Features, Customer is solely liable and responsible for the actions and tasks performed by the service, such as determining whether the service is appropriate for Customer’s use case, authorizing the service's access and connection to data, applications, and systems, and exercising judgment and supervision when and if the service is used in live environments. You will not automatically bypass any requests for human confirmation.

4. Cyolo may modify, limit, suspend, or discontinue any AI Feature, in whole or in part, were reasonably necessary due to third-party provider limitations, legal or regulatory requirements, security concerns, abuse prevention, excessive usage, or material changes in the applicable AI models or services.

Sensitive Data. Customer shall not submit to the AI Features any data containing health information, government identifiers, financial details, or other sensitive Personal Data unless legally necessary and appropriately secured, and Customer acknowledges that the AI Features are not designed for HIPAA, PCI-DSS, or other regulated data. Customer acknowledges that the AI Features may process information generated through Customer’s own use of the Products, and that such information may reflect the activities or content accessed by Customer or its Users. Customer is solely responsible for how the Products are used, for any information captured or recorded through such use, and for ensuring that its configuration and operation of the AI Features comply with applicable laws and its internal policies.

Subprocessors. Cyolo uses third-party AI and cloud service providers, including providers of large language models and related infrastructure, to provide or support the AI Features, such as Google Cloud Platform (including Vertex AI/Gemini) and Anthropic/Claude. Cyolo will make information regarding applicable subprocessors available to Customer in accordance with the Principal Agreement or applicable data processing terms.