SOTERO SECURE AGENTOS
END USER LICENSE AGREEMENT
PLEASE READ THIS END USER LICENSE AGREEMENT (THIS “AGREEMENT”) CAREFULLY BEFORE INSTALLING, ACCESSING, OR USING THE SOTERO SECURE AGENTOS SOFTWARE (AS DEFINED BELOW) AND THE RELATED DOCUMENTATION. THIS AGREEMENT IS A LEGAL CONTRACT BETWEEN YOU (“YOU” OR “CUSTOMER”) AND SOTERO, INC., A DELAWARE CORPORATION WITH A BUSINESS ADDRESS AT 1500 DISTRICT AVE, BURLINGTON, MASSACHUSETTS 01803, USA (“SOTERO” OR “LICENSOR”).
THIS AGREEMENT IS PRESENTED TO YOU BEFORE YOU DOWNLOAD THE SOFTWARE AND BEFORE YOU ARE PERMITTED TO INSTALL, ACCESS, OR USE IT. BY CLICKING “I ACCEPT” (OR A SIMILAR AFFIRMATIVE BUTTON OR CHECKBOX) WHEN THIS AGREEMENT IS PRESENTED, OR BY OTHERWISE INSTALLING, ACTIVATING, ACCESSING, OR RUNNING THE SOFTWARE, YOU REPRESENT THAT YOU HAVE READ AND UNDERSTAND THIS AGREEMENT AND YOU AGREE TO BE BOUND BY ALL OF ITS TERMS. EACH TIME THE SOFTWARE IS RUN, YOUR CONTINUED USE CONSTITUTES YOUR ONGOING ACCEPTANCE OF THIS AGREEMENT AS THEN IN EFFECT.
IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT CLICK “I ACCEPT,” DO NOT COMPLETE INSTALLATION, AND DO NOT ACCESS OR USE THE SOFTWARE. YOU MUST DELETE ALL COPIES OF THE SOFTWARE IN YOUR POSSESSION OR CONTROL.
IF YOU ARE ACCEPTING THIS AGREEMENT ON BEHALF OF YOUR EMPLOYER OR ANOTHER ENTITY, YOU REPRESENT AND WARRANT THAT: (I) YOU HAVE FULL LEGAL AUTHORITY TO BIND THAT ENTITY TO THIS AGREEMENT; (II) YOU HAVE READ AND UNDERSTAND THIS AGREEMENT; AND (III) YOU AGREE TO THIS AGREEMENT ON BEHALF OF THE ENTITY YOU REPRESENT. IN THAT CASE, “YOU” MEANS THAT ENTITY.
THIS AGREEMENT GOVERNS THE COMMUNITY AND TEAM EDITIONS OF THE SOFTWARE ONLY. IF YOU OR YOUR ORGANIZATION HAVE ENTERED INTO A SEPARATE WRITTEN AGREEMENT WITH SOTERO (INCLUDING AN ENTERPRISE LICENSE AGREEMENT OR AN ORDER FORM), THAT WRITTEN AGREEMENT GOVERNS YOUR USE OF THE SOFTWARE AND TAKES PRECEDENCE OVER THIS AGREEMENT TO THE EXTENT OF ANY CONFLICT.
YOUR USE OF THE SOFTWARE REQUIRES A SOTERO ACCOUNT AND A VALID LICENSE TOKEN, AND THE SOFTWARE WILL NOT OPERATE WITHOUT THEM. THE SOFTWARE COMMUNICATES WITH SOTERO-HOSTED SYSTEMS AND TRANSMITS USAGE DATA AS DESCRIBED IN SECTION 9. SOTERO’S PRIVACY POLICY, AVAILABLE AT https://sotero.ai/privacy, IS INCORPORATED INTO THIS AGREEMENT BY REFERENCE.
1. DEFINITIONS
- "Active Agent"
- any Agent that is issued at least one credential by the Software during a given billing month.
- "Agent"
- a discrete autonomous or semi-autonomous software process, model instance, or workflow component that is registered with, or receives credentials, identity, or policy decisions from, the Software.
- "Community Edition"
- the edition of the Software made available by Sotero free of charge, subject to the Tier Limits applicable to that edition.
- "Customer Data"
- data submitted to, stored in, or processed through the Hosted Services by or on behalf of You, including agent identities and metadata, delegation chains and relationships, policy definitions, configuration, and audit log content. Customer Data does not include Usage Data.
- "Documentation"
- the user documentation that Sotero makes available for the Software, as updated from time to time.
- "Hosted Services"
- the Sotero-hosted backend services made available in connection with the Software, which may include account and authentication services, license issuance and validation, the hosted agent registry, hosted policy bundle management and delivery (including hosted OPA services for the Team Edition), centralized audit logging, dashboards, and version services.
- "License Token"
- the authentication token, license key, or signed license artifact issued by Sotero to You that encodes Your edition, entitlements, Tier Limits, and expiry, and that the Software validates as a condition of operation.
- "Personal Data"
- any information relating to an identified or identifiable natural person that is subject to applicable Data Protection Laws.
- "Data Protection Laws"
- all data protection and privacy laws applicable to the processing of Personal Data under this Agreement, including, as applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”).
- "Software"
- the Sotero Secure AgentOS software in compiled, binary, object-code form (including the locally installed daemon process), together with any updates, upgrades, patches, and modified versions made available to You by Sotero, and the Documentation.
"Subscription Term" means, for the Team Edition, the initial subscription period selected by You at purchase (which is an annual period unless otherwise stated at purchase) and each renewal period.
- "Team Edition"
- the paid edition of the Software made available on a subscription basis, together with the Hosted Services included in that edition as described in the Pricing Terms.
- "Pricing Terms"
- the then-current pricing, edition description, billing metric, and subscription terms presented by Sotero at the point of purchase or renewal.
- "Tier Limits"
- the usage limits, feature entitlements, and other restrictions applicable to Your edition of the Software, as described in Section 4, in the Pricing Terms, and as encoded in Your License Token.
- "Usage Data"
- data generated by or collected through Your account, the Software, and the Hosted Services concerning access to and use of the Software and Hosted Services, including account registration data, authentication and license validation events, download records, version check events, telemetry concerning agent counts, credential issuance events, delegation depth, feature usage, performance, and diagnostic and error data.
2. LICENSE GRANT AND SCOPE OF USE
2.1Community Edition License.
Subject to Your compliance with this Agreement and the applicable Tier Limits, Sotero grants You a limited, non-exclusive, non-transferable, non-sublicensable, revocable license, during the Term, to download, install, and run the Software in binary form on computers and servers that You own or control, solely for Your own internal business purposes or personal use. Use of the Community Edition for commercial and production purposes is permitted, provided that such use remains within the Community Edition Tier Limits and otherwise complies with this Agreement.
2.2Team Edition License.
Subject to Your compliance with this Agreement, Your timely payment of all applicable fees, and the applicable Tier Limits, Sotero grants You a limited, non-exclusive, non-transferable, non-sublicensable license, during the applicable Subscription Term, to download, install, and run the Software in binary form on computers and servers that You own or control, and to access and use the Hosted Services included in the Team Edition, solely for Your own internal business purposes.
2.3Internal Use Only; No Deployment for Third Parties.
The licenses granted in this Section 2 are for Your internal use only. Except with Sotero’s prior written consent or under a separate written agreement with Sotero, You shall not: (a) install or operate the Software on infrastructure owned or controlled by a third party for the benefit of that third party, or otherwise deploy or operate the Software on behalf of any third party, including as part of consulting, systems integration, outsourcing, hosting, or managed services; (b) embed, bundle, or otherwise incorporate the Software into any product, application, or service that You distribute, sell, license, or otherwise make available to third parties; or (c) permit any third party to access or use the Software or Hosted Services other than Your own employees and individual contractors acting on Your behalf and bound by obligations at least as protective as this Agreement, for whose acts and omissions You remain responsible. Organizations seeking redistribution, embedding, OEM, partner deployment, or multi-party rights should contact sales@sotero.ai regarding an Enterprise agreement.
2.4Installations and Copies.
You may install the Software on a reasonable number of machines that You own or control as needed for Your permitted use, and You may make a reasonable number of copies of the Software solely for backup and archival purposes, provided that all copies retain all proprietary notices. Each installed instance of the Software remains subject to Your account, Your License Token, and the Tier Limits.
2.5Reservation of Rights.
The Software is licensed, not sold. Sotero and its licensors reserve all rights not expressly granted in this Agreement. No rights are granted by implication, estoppel, or otherwise.
3. ACCOUNT, LICENSE TOKEN, AND CONNECTIVITY
3.1Account Registration.
Use of the Software requires a Sotero account. You agree to provide accurate, current, and complete registration information and to keep it updated. You are responsible for maintaining the confidentiality of Your account credentials and License Tokens and for all activity occurring under Your account. You will notify Sotero promptly of any unauthorized use of Your account or any other suspected breach of security.
3.2License Token Validation.
The Software validates Your License Token against Sotero’s backend systems, including at startup, and is designed not to operate without a valid License Token. License Tokens are issued by Sotero, remain the property of Sotero, are personal to You, and may not be shared, published, transferred, or sublicensed. You acknowledge that Your edition, entitlements, and Tier Limits are encoded in the License Token and enforced by the Software.
3.3Connectivity Requirements.
Operation of the Software requires network connectivity to the Hosted Services for purposes including account authentication, License Token validation, policy bundle retrieval and refresh, agent registry synchronization and cache invalidation, and version checks. Certain functionality may be unavailable, limited, or degraded when connectivity to the Hosted Services is unavailable. Offline and air-gapped operation, where offered, is available only under a separate Enterprise agreement.
3.4Suspension and Revocation.
Sotero may suspend or revoke Your License Token, suspend Your account, or suspend access to the Hosted Services, with notice where practicable, if: (a) You materially breach this Agreement; (b) any fees payable by You are overdue and remain unpaid following notice; (c) Sotero reasonably believes that Your use of the Software or Hosted Services poses a security risk to, or may adversely impact, Sotero, the Hosted Services, or any third party; or (d) suspension is required by applicable law or a governmental request. You acknowledge that upon revocation or expiry of Your License Token the Software will cease to operate. Sotero will restore suspended access promptly after the circumstances giving rise to the suspension are resolved.
4. TIER LIMITS AND USAGE MEASUREMENT
4.1Community Edition Limits.
The Community Edition is limited to a maximum of five (5) Active Agents and a maximum agent delegation depth of two (2), together with the feature entitlements described for the Community Edition in the Pricing Terms. Sotero may modify the Tier Limits applicable to the Community Edition prospectively upon reasonable notice, including notice published on Sotero’s website or surfaced in the Software.
4.2Team Edition Limits.
The Team Edition includes the agent counts, delegation depth, features, and Hosted Services entitlements described in the Pricing Terms as of the start of the applicable Subscription Term.
4.3Enforcement; No Circumvention.
Tier Limits are encoded in Your License Token and enforced by the Software. You shall not, and shall not permit or assist any third party to, circumvent, disable, bypass, or interfere with the License Token mechanism, Tier Limit enforcement, usage measurement, or any other license management, timing, or use restriction built into the Software or Hosted Services, including by manipulating agent identities, credential issuance, or telemetry to understate Active Agent counts.
4.4Measurement of Record.
You acknowledge and agree that usage telemetry collected by Sotero’s backend systems is the system of record for measuring Your use of the Software and Hosted Services, including the number of Active Agents in each billing month for the purposes of Tier Limit enforcement and the calculation of fees. Sotero’s measurements shall be presumed accurate absent manifest error. If You believe in good faith that Sotero’s measurement for a billing month is materially inaccurate, You must notify Sotero within thirty (30) days after the date of the applicable charge or invoice, and the parties will review the measurement in good faith; You shall continue to pay undisputed amounts when due.
5. TEAM EDITION AVAILABILITY AND FUTURE FEES
5.1Currently Free of Charge.
As of the Effective Date, both the Community Edition and the Team Edition described in this Agreement are made available free of charge, within the Tier Limits described in Section 4. No purchase, payment method, or payment authorization is required to use either edition under this Agreement.
5.2Future Paid Terms.
If Sotero later begins charging for the Team Edition or any Tier Limits described in this Agreement, Sotero will present the applicable fees, billing terms, and payment authorization to You at the point of purchase or upgrade, and those terms will require Your separate acceptance before any charge is made. Sotero will update this Agreement, the Pricing Terms, and the Software to reflect the terms of that offer before it takes effect.
6. UPDATES, VERSIONS, AND SUPPORT
6.1Updates and Version Checks.
The Software performs a version check against the Hosted Services at startup and may surface update notifications to You. Sotero may make updates, upgrades, and patches available from time to time. Updates the Software downloads or that You install become part of the Software and are governed by this Agreement.
6.2Required Updates; Version Support.
Sotero may require that You install an update as a condition of continued operation of the Software or continued access to the Hosted Services where Sotero reasonably determines the update is necessary for security, legal compliance, or compatibility with the Hosted Services. Sotero has no obligation to maintain or support prior versions of the Software.
6.3Changes to the Software and Hosted Services.
Sotero may modify the Software and Hosted Services from time to time, including by adding, changing, or removing features, provided that, during a paid Subscription Term, Sotero will not materially reduce the core functionality of the Team Edition. If Sotero materially reduces the core functionality of the Team Edition during a paid Subscription Term, You may terminate Your subscription on notice and receive, as Your sole and exclusive remedy, a pro-rata refund of prepaid fees for the remainder of the Subscription Term.
6.4Support.
The Community Edition is provided without any support entitlement; community resources and Documentation may be made available at Sotero’s discretion. For the Team Edition, Sotero will provide the support described in the Pricing Terms or other support terms presented and accepted at the point of purchase. Support inquiries may be submitted to support@sotero.ai.
7. RESTRICTIONS
You shall not, and shall not permit or assist any third party to:
decompile, disassemble, reverse engineer, or otherwise attempt to reconstruct, derive, identify, or discover any source code, underlying ideas, algorithms, file formats, protocols, or non-public APIs of the Software, or extract any embedded keys or license verification materials, except to the limited extent that applicable law expressly prohibits such restriction notwithstanding this contractual limitation, and then only after prior written notice to Sotero;
copy (except as expressly permitted in Section 2.4), modify, adapt, translate, or create derivative works of the Software or Documentation;
distribute, sell, resell, sublicense, rent, lease, lend, transfer, assign, publish, or otherwise make the Software, the Documentation, or any License Token available to any third party, or use the Software for timesharing, hosting, or service bureau purposes, except as expressly permitted in Section 2;
circumvent or attempt to circumvent any License Token mechanism, Tier Limit, usage measurement, or other technical restriction in the Software or Hosted Services, as further described in Section 4.3;
remove, alter, or obscure any proprietary notices on or in the Software or Documentation;
access or use the Software, Documentation, or Hosted Services to develop, or assist anyone else in developing, a product or service that competes with the Software or Hosted Services, or for competitive analysis or benchmarking, or publicly disseminate performance information or analysis of the Software, in each case without Sotero’s prior written consent;
use the Software or Hosted Services in violation of applicable law, to infringe or misappropriate the rights of any third party, or to create, train, deploy, or operate Agents that do any of the foregoing; or
use the Software or Hosted Services in any application or environment where failure of the Software could reasonably be expected to result in death, personal injury, or severe physical or environmental damage, including life-support systems, emergency services, nuclear facilities, aircraft operation, and weapons systems. The Software is not designed, intended, or certified for such use.
8. OWNERSHIP; FEEDBACK
8.1Ownership.
The Software and Documentation are the proprietary intellectual property of Sotero and its licensors, contain trade secrets of Sotero, and are protected by copyright and other intellectual property laws. Sotero retains sole and exclusive ownership of all right, title, and interest in and to the Software, the Documentation, the Hosted Services, and Usage Data, including all enhancements, modifications, corrections, and derivative works of any of the foregoing, all of which are considered part of the Software for purposes of this Agreement. As between the parties, You retain all right, title, and interest in and to Customer Data.
8.2Feedback.
You may, in Your sole discretion, provide Sotero with suggestions, enhancement requests, recommendations, or other feedback relating to the Software, the Documentation, or the Hosted Services (“Feedback”). You hereby assign to Sotero all right, title, and interest in and to any Feedback, including all intellectual property rights therein, and Sotero may use Feedback without restriction or obligation.
9. PRIVACY AND DATA PROTECTION
9.1Privacy Policy.
Sotero’s collection, use, and disclosure of Personal Data relating to You and Your authorized users in connection with Your account and Your use of the Software and Hosted Services (including account registration data and Usage Data that constitutes Personal Data) is described in, and governed by, Sotero’s Privacy Policy at https://sotero.ai/privacy. With respect to such data, Sotero acts as an independent controller (or the equivalent under applicable Data Protection Laws).
9.2Usage Data; Telemetry.
You acknowledge and agree that the Software and Hosted Services collect and transmit Usage Data to Sotero, including authentication and license validation events at startup, download records associated with Your account, version check events, and usage telemetry such as agent counts, credential issuance events, delegation depth, feature usage, and diagnostic and error data. Sotero uses Usage Data to provide, operate, secure, and improve the Software and Hosted Services, to enforce Tier Limits and this Agreement, to measure usage and calculate fees as described in Section 4.4, to communicate with You about the Software, and for analytics and product development. Sotero may use and disclose Usage Data in aggregated or de-identified form that does not identify You or any natural person.
9.3Customer Data and the Hosted Services.
Where You use Hosted Services that store or process Customer Data (including the hosted agent registry, hosted policy management, and centralized audit logging available in the Team Edition), You are the controller of any Personal Data contained in Customer Data and Sotero processes such Personal Data as Your processor (or service provider under the CCPA) in accordance with the Data Processing Addendum attached as Exhibit A (the “DPA”), which is incorporated into this Agreement. To the extent of any conflict between the DPA and the body of this Agreement with respect to the processing of Personal Data in Customer Data, the DPA controls.
9.4Your Responsibilities.
You are responsible for Customer Data and for Your Agents and the data they access, process, and transmit, including ensuring that You have all rights, consents, and lawful bases required to process such data through the Software and Hosted Services. You shall not submit to the Hosted Services any Personal Data of a sensitive or special category (including health, biometric, or payment card data) except to the extent the Documentation expressly contemplates it and You have all required rights and consents. You will comply with all Data Protection Laws applicable to Your use of the Software and Hosted Services.
9.5GDPR and CCPA Compliance.
Each party will comply with its respective obligations under applicable Data Protection Laws, including the GDPR and the CCPA, in connection with this Agreement. Sotero does not “sell” or “share” Personal Data contained in Customer Data within the meaning of the CCPA, and with respect to such data Sotero acts as a “service provider” as further described in the DPA.
10. CONFIDENTIALITY
10.1Confidential Information.
Each party shall maintain as confidential, and shall not disclose or use for purposes other than the performance of this Agreement, any non-public information disclosed by the other party that relates to the disclosing party’s business affairs, trade secrets, technology, research, development, security architecture, pricing, or the terms of this Agreement (“Confidential Information”). The Software, the Documentation, License Tokens, and non-public information about the Hosted Services are Confidential Information of Sotero. Each party may disclose Confidential Information to its employees, contractors, accountants, attorneys, advisors, and service providers with a need to know in connection with this Agreement who are bound by obligations of confidentiality at least as protective as this Section, and each party remains responsible for their compliance. Each party will protect the other party’s Confidential Information with at least the same degree of care it uses for its own Confidential Information, and not less than reasonable care.
10.2Exclusions; Compelled Disclosure.
Confidential Information does not include information that: (a) was already known to the recipient without obligation of confidentiality before disclosure; (b) is or becomes publicly known through no breach of this Agreement; (c) is independently developed without use of the disclosing party’s Confidential Information, as evidenced by records; or (d) is rightfully obtained from a third party without obligation of confidentiality. A party may disclose Confidential Information to the extent required by law or court order, provided that it gives the other party prompt notice where legally permitted and cooperates with reasonable efforts to limit or protect the disclosure.
10.3Equitable Relief.
Breach of this Section 10 may cause irreparable harm for which monetary damages are an inadequate remedy. In addition to all other remedies available at law or in equity, the disclosing party is entitled to seek equitable and injunctive relief for any breach or threatened breach of this Section.
11. WARRANTY DISCLAIMER
THE SOFTWARE, THE DOCUMENTATION, AND THE HOSTED SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, SOTERO AND ITS LICENSORS MAKE NO AND DISCLAIM ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NONINFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. WITHOUT LIMITING THE FOREGOING, SOTERO DOES NOT WARRANT THAT THE SOFTWARE OR HOSTED SERVICES WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR FREE, THAT DEFECTS WILL BE CORRECTED, OR THAT THE SOFTWARE OR HOSTED SERVICES WILL DETECT, PREVENT, OR MITIGATE ALL SECURITY THREATS, ATTACKS, UNAUTHORIZED ACCESS, POLICY VIOLATIONS, OR DATA LOSS. THE SOFTWARE IS A SECURITY CONTROL THAT SUPPLEMENTS, AND DOES NOT REPLACE, YOUR OWN SECURITY PROGRAM, JUDGMENT, AND CONTROLS, AND YOU REMAIN SOLELY RESPONSIBLE FOR THE DESIGN, OPERATION, AND SECURITY OF YOUR AGENTS, APPLICATIONS, AND SYSTEMS. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES, SO SOME OF THE ABOVE EXCLUSIONS MAY NOT APPLY TO YOU.
12. LIMITATION OF LIABILITY
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW: (A) THE CUMULATIVE LIABILITY OF SOTERO AND ITS SUPPLIERS TO YOU FOR ALL CLAIMS ARISING UNDER OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, SHALL NOT EXCEED THE GREATER OF (I) THE TOTAL AMOUNT OF FEES PAID OR PAYABLE BY YOU TO SOTERO UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, AND (II) ONE HUNDRED U.S. DOLLARS (US $100); AND (B) IN NO EVENT WILL SOTERO OR ITS SUPPLIERS BE LIABLE TO YOU OR ANY OTHER PARTY FOR ANY LOSS OF DATA, LOST PROFITS, LOSS OF BUSINESS OR GOODWILL, COST OF SUBSTITUTE GOODS OR SERVICES, OR ANY INDIRECT, SPECIAL, INCIDENTAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT, EVEN IF SOTERO HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A REMEDY FAILS OF ITS ESSENTIAL PURPOSE. THE FOREGOING LIMITATIONS DO NOT EXCLUDE OR LIMIT ANY LIABILITY THAT CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW. THE PARTIES ACKNOWLEDGE THAT THE FEES REFLECT THE ALLOCATION OF RISK IN THIS SECTION AND THAT SOTERO WOULD NOT MAKE THE SOFTWARE AVAILABLE ON THESE TERMS WITHOUT THESE LIMITATIONS.
13. INDEMNIFICATION BY YOU
You will defend, indemnify, and hold harmless Sotero and its officers, directors, employees, and agents from and against any third-party claims, and all resulting damages, liabilities, costs, and expenses (including reasonable attorneys’ fees), arising out of or related to: (a) Customer Data, or the data accessed, processed, or transmitted by Your Agents; (b) Your applications, Agents, products, or services; (c) Your use of the Software or Hosted Services in violation of this Agreement or applicable law; or (d) Your breach of Section 7 (Restrictions) or Section 9.4 (Your Responsibilities). Sotero will provide You with prompt notice of any such claim and reasonable cooperation at Your expense, and Sotero may participate in the defense with counsel of its own choosing. You may not settle any claim in a manner that imposes any obligation or admission on Sotero without Sotero’s prior written consent.
14. TERM AND TERMINATION
14.1Term.
This Agreement takes effect when You first accept it as described above and continues until terminated in accordance with this Section 14 (the “Term”). If Sotero begins offering the Team Edition on a paid basis, Team Edition subscriptions will run for the applicable Subscription Term and renew as described in the terms presented at the point of purchase, as contemplated by Section 5.2.
14.2Termination by You.
You may terminate this Agreement at any time by cancelling any active subscription, ceasing all use of the Software and Hosted Services, and deleting all copies of the Software in Your possession or control. Termination by You does not entitle You to any refund except as expressly provided in this Agreement.
14.3Termination by Sotero.
Sotero may terminate this Agreement: (a) if You breach this Agreement and fail to cure the breach within ten (10) days after notice from Sotero; (b) immediately upon notice if You breach Section 2 (License Grant and Scope of Use), Section 7 (Restrictions), or Section 10 (Confidentiality), or if Your breach is incapable of cure; and (c) with respect to the Community Edition only, for convenience upon thirty (30) days’ notice, including notice given through the Software or to Your account email, in connection with Sotero’s discontinuation of, or changes to, the Community Edition.
14.4Effect of Termination.
Upon termination or expiration of this Agreement: (a) all licenses granted to You terminate and You must immediately cease all use of the Software and Hosted Services and delete all copies of the Software; (b) Sotero may deactivate Your License Tokens and Your account; and (c) each party will return or destroy the other party’s Confidential Information upon request, except as retained pursuant to standard backup procedures or as required by law. For thirty (30) days following termination or expiration of a Team Edition subscription, Sotero will, upon Your written request, make Customer Data then held in the Hosted Services available for export in a commonly used format, after which Sotero will delete Customer Data in accordance with the DPA.
14.5Survival.
Sections 1, 4.4 (with respect to amounts accrued), 5 (with respect to amounts accrued), 7, 8, 9, 10, 11, 12, 13, 14.4, 14.5, 15, and 16 survive any termination or expiration of this Agreement.
15. EXPORT CONTROL; SANCTIONS; GOVERNMENT USE
15.1Export Compliance.
The Software incorporates encryption and may be subject to U.S. export control laws, including the U.S. Export Administration Regulations, and to sanctions programs administered by the U.S. Office of Foreign Assets Control, as well as applicable export and import laws of other jurisdictions. You shall not export, re-export, transfer, or make available the Software, directly or indirectly, in violation of such laws, including to any embargoed or sanctioned country or region, or to any person or entity on any applicable restricted party list. You represent that You are not located in, organized under the laws of, or ordinarily resident in any embargoed or sanctioned jurisdiction and are not a restricted party.
15.2 U.S. Government Use. The Software and Documentation are “commercial computer software” and “commercial computer software documentation” as defined in applicable U.S. government acquisition regulations. Any use, duplication, or disclosure by or for the U.S. government is subject solely to the terms of this Agreement to the extent permitted by FAR 12.212 and DFARS 227.7202.
16. GENERAL
16.1Entire Agreement; Order of Precedence.
This Agreement, together with the Privacy Policy, the Pricing Terms, the DPA, and the terms presented at the point of any purchase, constitutes the complete and exclusive agreement between the parties regarding its subject matter and supersedes all prior or contemporaneous proposals, agreements, and communications, oral or written, regarding that subject matter. In the event of a conflict, the following order of precedence applies: (a) a separately negotiated written agreement signed by Sotero (including any Enterprise agreement or Order Form); (b) the DPA, with respect to the processing of Personal Data in Customer Data; (c) the body of this Agreement; and (d) the policies and terms incorporated by reference. Any terms in a purchase order or similar document issued by You are for convenience only and have no effect.
16.2Changes to this Agreement.
Sotero may update this Agreement from time to time. Sotero will provide notice of material changes, including by presenting the updated Agreement in the Software, posting it on Sotero’s website, or notifying Your account email, at least thirty (30) days before the changes take effect, except that changes required by law or addressing security may take effect sooner. Material changes that are adverse to You will not apply to a paid Subscription Term until its next renewal. Your continued installation, access, or use of the Software after the effective date of an updated Agreement constitutes Your acceptance of it. If You do not agree to an updated Agreement, You must stop using the Software and may cancel as described in Section 14.2.
16.3Assignment.
You may not assign or transfer this Agreement, in whole or in part, without Sotero’s prior written consent, and any attempted assignment in violation of this Section is void. Sotero may assign this Agreement to an affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. This Agreement binds and benefits the parties and their permitted successors and assigns.
16.4Waiver; Severability.
Any waiver or modification of this Agreement is effective only if in writing and signed by the party against whom it is to be enforced; provided that Sotero may update this Agreement as described in Section 16.2. A party’s failure or delay in exercising any right is not a waiver of that right or any other right. If any provision of this Agreement is held invalid, illegal, or unenforceable, that provision will be enforced to the maximum extent permissible and the remaining provisions remain in full force and effect.
16.5Independent Contractors.
The parties are independent contractors. Neither party may make any commitment or incur any obligation in the name of the other party, and nothing in this Agreement creates any agency, partnership, joint venture, or employment relationship.
16.6Notices.
Notices to Sotero must be in writing and delivered by U.S. certified mail (return receipt requested, postage prepaid) or by overnight courier to Sotero, Inc., 1500 District Ave, Burlington, Massachusetts 01803, USA, Attn: Legal Counsel, with a copy by email to legal@sotero.ai. Sotero may provide notices to You by email to the address associated with Your account, through the Software, or by posting to Sotero’s website, and such notices are effective when sent or posted. Notices delivered physically are effective upon receipt.
16.7Force Majeure.
Neither party is responsible for any failure or delay in performance (other than payment obligations) due to causes beyond its reasonable control, including acts of God, terrorism, war, riot, embargoes, fire, floods, earthquakes, strikes, internet or utility failures, or governmental action, provided that the affected party gives prompt notice to the other party. The time for performance will be extended for a period equal to the duration of the event.
16.8Governing Law; Venue.
This Agreement and any dispute arising under or relating to it are governed by the laws of the Commonwealth of Massachusetts, without regard to its conflict of laws principles, and the United Nations Convention on Contracts for the International Sale of Goods does not apply. The parties consent to the exclusive jurisdiction and venue of the federal and state courts located in Boston, Massachusetts, except that either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information.
16.9Interpretation.
Section headings are for convenience only. “Including” and its variants mean “including without limitation.” No rule of construction applies against the drafting party.
EXHIBIT A
DATA PROCESSING ADDENDUM
This Data Processing Addendum (“DPA”) forms part of the Agreement and applies to the extent Sotero processes Personal Data contained in Customer Data on Your behalf in connection with the Hosted Services. Capitalized terms not defined in this DPA have the meanings given in the Agreement. The terms “controller,” “processor,” “data subject,” “processing,” and “personal data breach” have the meanings given in applicable Data Protection Laws.
A.1Roles and Scope.
You are the controller (or, where You act on behalf of another controller, a processor) of Personal Data contained in Customer Data, and Sotero is Your processor (or sub-processor). Sotero will process such Personal Data only on Your documented instructions, including as set out in the Agreement and this DPA and as necessary to provide, secure, and support the Hosted Services, unless processing is required by applicable law, in which case Sotero will inform You of that legal requirement before processing where legally permitted. This DPA does not apply to Usage Data or account data that Sotero processes as a controller under the Privacy Policy.
A.2Details of Processing.
Subject matter and nature: hosting and processing of agent identity and registry data, delegation relationships, policy definitions, and audit log content in connection with the Hosted Services. Duration: the Term of the Agreement plus the post-termination export and deletion period. Categories of data subjects: Your personnel, contractors, and end users whose Personal Data appears in Customer Data. Categories of Personal Data: identifiers and metadata appearing in agent names, registry entries, configuration, policies, and audit logs (for example, usernames, email addresses, and IP addresses). The parties do not intend for special categories of Personal Data to be processed, and You agree not to submit such data except as expressly contemplated in the Documentation.
A.3Confidentiality and Personnel.
Sotero will ensure that persons authorized to process Personal Data under this DPA are bound by appropriate obligations of confidentiality and process Personal Data only as needed to perform under the Agreement.
A.4Security.
Sotero will implement and maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, appropriate to the risk, including measures relating to encryption in transit, access controls, tenant isolation in multi-tenant systems, logging, and personnel security. Sotero may update its security measures from time to time provided the updates do not materially reduce the overall protection of Personal Data.
A.5Subprocessors.
You provide general authorization for Sotero to engage subprocessors to process Personal Data under this DPA, including hosting and infrastructure providers. Sotero will provide its current subprocessor list upon request submitted to privacy@sotero.ai and will provide a mechanism for You to receive notice of additions or replacements. You may object on reasonable, documented data protection grounds within fifteen (15) days of notice, in which case the parties will discuss in good faith a resolution; if none is reasonably available, You may terminate the affected Hosted Services and receive a pro-rata refund of prepaid fees for the unused portion. Sotero will impose data protection obligations on subprocessors that are no less protective than those in this DPA and remains responsible for their performance.
A.6Assistance.
Taking into account the nature of the processing, Sotero will provide reasonable assistance to You, through appropriate technical and organizational measures and at Your expense where assistance is material, in fulfilling Your obligations to respond to data subject requests and Your obligations regarding security, breach notification, data protection impact assessments, and prior consultation under applicable Data Protection Laws. If Sotero receives a request from a data subject relating to Personal Data processed under this DPA, Sotero will direct the data subject to You where appropriate and will not respond except as instructed by You or required by law.
A.7Personal Data Breach.
Sotero will notify You without undue delay after becoming aware of a personal data breach affecting Personal Data processed under this DPA and will provide information reasonably available to Sotero to assist You in meeting Your breach notification obligations, including the nature of the breach, the categories and approximate volume of data and data subjects concerned, the likely consequences, and the measures taken or proposed. Sotero’s notification of a breach is not an acknowledgment of fault or liability.
A.8International Transfers.
To the extent the processing of Personal Data under this DPA involves a transfer from the European Economic Area, the United Kingdom, or Switzerland to a country not recognized as providing an adequate level of protection, the parties agree that such transfer will be governed by the European Commission’s Standard Contractual Clauses (Module Two where You are a controller and Sotero is a processor, or Module Three where You are a processor and Sotero is a sub-processor), which are incorporated into this DPA by reference and completed with the details set out in this DPA, together with the UK International Data Transfer Addendum and Swiss adaptations, as applicable. If another lawful transfer mechanism applies to a transfer, Sotero may rely on that mechanism for as long as it remains valid.
A.9CCPA Service Provider Terms.
To the extent the CCPA applies, Sotero acts as a “service provider” with respect to Personal Data in Customer Data. Sotero will not: (a) sell or share such Personal Data; (b) retain, use, or disclose it for any purpose other than performing the Hosted Services under the Agreement or as otherwise permitted by the CCPA; or (c) retain, use, or disclose it outside of the direct business relationship between the parties. Sotero certifies that it understands and will comply with the restrictions in this Section.
A.10Audits and Reports.
Upon Your written request, no more than once per twelve (12) month period, Sotero will make available information reasonably necessary to demonstrate compliance with this DPA, which may include summaries of third-party audit reports and security certifications and responses to reasonable written security questionnaires. To the extent applicable Data Protection Laws grant You a mandatory audit right that cannot be satisfied by the foregoing, any audit will be subject to reasonable advance notice, confidentiality obligations, normal business hours, and a scope agreed in advance, at Your expense.
A.11Return and Deletion.
Upon termination or expiration of the Agreement or the applicable Hosted Services, Sotero will, at Your election made within the export window described in Section 14.4 of the Agreement, return Customer Data in a commonly used format or delete it, and thereafter delete remaining copies of Personal Data processed under this DPA, except to the extent retention is required by applicable law or the data resides in routine backups, in which case Sotero will continue to protect it under this DPA and delete it in the ordinary course.
Sotero, Inc. | Secure AgentOS End User License Agreement | Community and Team Editions
Version 1.0 (Binary Distribution) | Effective Date: 10 Aug 2026 | First public release