SERVICE LEVEL AGREEMENT LUPASAFE SECURITY PLATFORM

Download this Service Level Agreement as PDF

Version 1.1, 25 September 2026

This Service Level Agreement ("SLA") between Skopos Security Labs BV ("Lupasafe"), and the user ("Customer") of Lupasafe Security Platform ("Cloud Service") sets forth the service level terms and conditions and is an integral part of the Agreement. This SLA defines the terms of Lupasafe's responsibility with respect to the Cloud Service that Lupasafe provides and Customer's remedies in the event that Lupasafe fails to meet these Cloud Service Commitments. This SLA set forth herein represent Lupasafe's sole obligation and Customer's sole remedy for failure to meet such Cloud Service Commitments. This SLA does not apply to the availability of Third Party Services (TPS) which are subject to the TPS Agreements. The SLA is binding only on the Customer and Lupasafe and does not apply to any Third Parties.

1. Definitions

The following are definitions of capitalized words used in this Agreement:

a. "Agreement" The Customer's use of and access to Cloud Service is governed by the Terms & Conditions, Service Level Agreement, Statement of Work and any other documents referenced herein (collectively, the "Agreement").

b. "Business Hours" means 9:00 AM to 6:00 PM (GMT+1), Monday through Friday, and, notwithstanding the foregoing, does not include times during Cloud Service.

c. "Cloud Service" Consisting of Software as a Service (SaaS), meaning the capability provided to the Customer to use the offered LUPASAFE Software applications running on a LUPASAFE provided cloud infrastructure. The Customer does not manage or control the underlying cloud infrastructure including network, servers, operating systems and storage. LUPASAFE's maintenance includes, without limitation, database rebuilding, hardware upgrades, software upgrades, and network upgrades, as applicable.

2. Term & Duration

This SLA will be valid and effective from 25th of September 2026 and will end with the end of the contracting period.

3. Responsibility of LUPASAFE

a. LUPASAFE will provide Cloud Service to Customer for the duration of this Agreement.

b. LUPASAFE grants Customer the right to give the licensed number of users access to and right to use the Cloud Service.

c. LUPASAFE does not guarantee that the Cloud Service performs flawlessly all the time. The internet connection between the Customer data center and the device of the end user is not part of the responsibility of LUPASAFE.

d. LUPASAFE will take the appropriate technical and organizational measures to protect the stored and/or exchanged information against loss and unlawful processing. These measures will be appropriate, taking into account the state of the technology and the costs involved. LUPASAFE will especially take great care to prevent that unauthorized persons are able to access Customer through Cloud Service.

e. In the case, LUPASAFE is using third party technologies or third-party services, the terms and conditions of the third party will apply. Excessive use of third-party components and services could result in additional charges. The Service depends on integrations with third-party systems including Microsoft 365, Microsoft Entra ID (formerly Azure AD), and other authentication providers. Lupasafe is not responsible for changes, disruptions, or discontinuation of these third-party services. While Lupasafe will make commercially reasonable efforts to maintain compatibility, the Customer acknowledges that modifications to these third-party systems may impact functionality.

f. LUPASAFE shall make a full backup copy of each database and file system daily and retain each such daily backup copy for seven (7) days. LUPASAFE retains backup and system log files for at least sixty (60) days. Application audit logs within the platform are retained for approximately three (3) months, as set out in Section 8.

4. Responsibility of LUPASAFE, Cloud Service Availability

a. Cloud Service Availability, General

LUPASAFE's goal is to provide Cloud Service Availability twenty-four hours per day, seven (7) days per week (referred to as "24x7 Availability") EXCEPT during times of maintenance as set forth in Section 4d herein. However, the parties recognize that 24x7 Availability is only a GOAL, and LUPASAFE cannot represent or guarantee that such goal can be achieved. As per our CLOUD SERVICE SUPPORT POLICY (show below), response time goals cover Production Cloud.

b. Cloud Service Availability Level Goals

LUPASAFE shall use reasonable efforts to achieve the monthly target Cloud Service Availability Goal of 99% network uptime, during business hours, except during scheduled maintenance. Notwithstanding the foregoing, Customer recognizes that the Internet is comprised of thousands upon thousands of autonomous systems that are beyond the control of LUPASAFE. Routing anomalies, asymmetries, inconsistencies and failures of the Internet outside of the control of LUPASAFE can and will occur, and such instances shall not be considered any failure of the 99% network uptime. While Customers are free to monitor network uptime on their systems and other monitoring services, LUPASAFE proactively monitors network uptime and the results of these monitoring systems shall provide the sole and exclusive determination of network uptime: https://status.lupasafe.com.

c. Response Time to Error

LUPASAFE has internal notification tools for Cloud Service problems. Additionally, Customer may report problems to LUPASAFE Support (support@lupasafe.com). Once notified LUPASAFE Support will respond as per the CLOUD SERVICE SUPPORT POLICY (show below). Note that these guidelines specify the time to begin investigation of the problem, not the length of time within which such problem will be resolved.

d. Maintenance

i. The parties agree that LUPASAFE shall provide maintenance, which may cause errors as defined by the CLOUD SERVICE SUPPORT POLICY (show below). LUPASAFE shall use commercially reasonable efforts to limit maintenance, which causes Severity Level 1 Errors to four (4) hours per month. LUPASAFE shall notify named Customer contact by email prior to performing any maintenance which LUPASAFE predicts will cause a Severity 1 Error outside of standard Cloud Service Times.

ii. The Cloud Service Availability goals exclude any time Customer requests a Cloud be taken down for scheduled updates.

iii. LUPASAFE shall attempt to schedule maintenance during the times as specified in Table 1, Maintenance Times. However, the parties agree that it may be necessary for LUPASAFE to perform maintenance during times other than those specified in Table 1, LUPASAFE will notify Customer that maintenance is required outside the scheduled Maintenance Times.

Table 1, Maintenance Times

iv. Disclaimer of Actions Caused by and/or Under the Control of Third Parties. LUPASAFE DOES NOT AND CANNOT CONTROL THE FLOW OF DATA TO OR FROM LUPASAFE'S NETWORK AND OTHER PORTIONS OF THE INTERNET. SUCH FLOW DEPENDS IN LARGE PART ON THE PERFORMANCE OF INTERNET SERVICES PROVIDED OR CONTROLLED BY THIRD PARTIES. AT TIMES, ACTIONS OR INACTIONS OF SUCH THIRD PARTIES CAN IMPAIR OR DISRUPT CUSTOMER'S CONNECTIONS TO THE INTERNET (OR PORTIONS THEREOF). ALTHOUGH LUPASAFE WILL USE COMMERCIALLY REASONABLE EFFORTS TO TAKE ACTIONS IT DEEMS APPROPRIATE TO REMEDY AND AVOID SUCH EVENTS, LUPASAFE CANNOT GUARANTEE THAT SUCH EVENTS WILL NOT OCCUR. ACCORDINGLY, LUPASAFE DISCLAIMS ANY AND ALL LIABILITY RESULTING FROM OR RELATED TO SUCH EVENTS.

v. Limitations LUPASAFE cannot assume responsibility and shall not be liable for any impacts on Cloud Service Availability due to (i) any requests for non-standard environment or Customer machine access; (ii) any downtime caused by Customer produced code; or (iii) any changes to the Cloud Service by parties other than LUPASAFE. (iv) LUPASAFE cannot be held liable for unavailability of services caused by Microsoft for the Microsoft Azure services. LUPASAFE will make reasonable efforts to ensure that Cloud Service changes do not affect customers.

vi. SLA Changes LUPASAFE reserves the right to change this SLA at any time. LUPASAFE will notify Customer about the changes.

vii. Financial Penalties for SLA Violations. In the event that LUPASAFE fails to achieve the Monthly target Cloud Service Availability Goal of 99%, LUPASAFE will after receiving a written request of Customer within the first 20 days of the following calendar month, refund the following amount as specified in Table 2.

Table 2, Refund percentages

viii. All SLA claims should be communicated to customer support (support@lupasafe.com) within seven (7) days of the incident. The notice must include all relevant information, including Cloud name, IP address, full description of the incident, and any logs (if applicable). All SLA credits will be issued as credits against future invoices for services.

ix. In order to qualify for Service Credits, Customer must be current on all payment obligations, and not be in violation of the Terms & Conditions or any other policies and procedures of this Agreement.

x. No Service Credits will be given for service interruptions: (i) caused by the action or failure to act by Customer, (ii) due to failure of any equipment or software provided by Customer, (iii) which are the result of scheduled maintenance, (iv) due to a Force Majeure event, (v) for which Customer is entitled to a SLA Credit for the same or contemporaneous Cloud Service Commitment failure or (vi) resulting from Customer's breach of the Terms of Service, or any other policies and procedures of this Agreement.

xi. Total cumulative SLA Credits during any given month shall not exceed the Customer monthly fee for those Cloud Services affected.

5. Responsibility of LUPASAFE, Cloud Service Support Policy

a. Incident reports are handled via our support channel (support@lupasafe.com). We prioritize tickets by severity, and handle issues where a site is completely unavailable before tickets where a site is slow, and those before general questions about our service or general advice.

b. Shown below is a guide to the LUPASAFE Severity Levels. Note that the Ticket Response Goals specify the time to begin investigation of the problem, not the length of time within which such problem will be resolved:

Table 3, Severity Levels

c. The goal of the LUPASAFE Cloud Support Team is to provide specific support around the features and functionality of the Cloud Service. Our support team may review the implementation of the Cloud Service in a particular Cloud instance in an effort to diagnose problems, however, we cannot guarantee support for any functionality developed by the Customer (e.g. custom scripts, integrations or API workflows built by the Customer). We will do our best to help any Customer with their issues to the best of our abilities.

d. Paid commercial support and development services are available should you need it. Please contact your LUPASAFE Customer Success Manager to discuss this option.

e. For any customer-specific communications about site issues, security issues, scalability issues, and similar, we will use the contact information we have on file for you.

6. Responsibility of Customer

a. The Customer will determine which information will be stored and/or exchanged by/with the use of the Cloud Service.

b. The Customer is responsible that the information does not infringe upon rights of third parties. The Customer will indemnify LUPASAFE from claims of third parties who claim that their rights have been infringed upon as a result of storing and/or exchanging information by means of the Cloud Service.

c. The Customer is responsible for keeping the Login accounts confidential.

d. OT Environment Limitation: Customer acknowledges that Lupasafe's network scanning functionality is not specifically approved for use in Operational Technology (OT) environments, including but not limited to industrial control systems (ICS), SCADA systems, manufacturing systems, critical infrastructure, and other specialized industrial networks. Customer agrees to:

i. Use extreme caution when deploying any scanning or monitoring capabilities in or near OT environments;

ii. Obtain proper authorization and conduct appropriate risk assessments before using the Cloud Service in such environments;

iii. Accept full responsibility for any disruptions, outages, or damages that may occur from using the Cloud Service in OT environments;

iv. Indemnify and hold Lupasafe harmless from any claims, damages, or liabilities arising from Customer's use of the Cloud Service in OT environments against Lupasafe's recommendations.

e. Customer acknowledges that Domain & IP scanning and Network scanning features involve active testing of systems and networks. Customer warrants they have legal authorization to scan all systems submitted for analysis. Lupasafe is not liable for any disruptions, performance impacts, or security issues that may arise from such scanning activities.

f. Prohibited content in spearphishing modules: Customer agrees that when using spearphishing simulation modules, Customer shall not:

i. Use Microsoft Corporation's name, trademarks, logos, or other proprietary identifiers

ii. Impersonate Microsoft products, services, or communications

iii. Reference Microsoft-related keywords, branding, or intellectual property in phishing simulations

iv. Create content that could be mistaken for legitimate Microsoft communications

This restriction is intended to prevent potential trademark infringement and reduce legal risks associated with impersonating established technology companies.

g. Trademark Impersonation Restrictions: Customer further agrees that all spearphishing simulations shall not impersonate, reference, or utilize any third-party trademarks, trade names, logos, branding elements, or proprietary identifiers of any company, organization, or entity without:

i. Prior written consent from the trademark owner, AND

ii. Written authorization shared with and approved by Lupasafe

This restriction applies to all forms of trademark impersonation including but not limited to corporate identities, product names, service marks, logos, colour schemes, and distinctive branding elements. Violation of this clause may result in immediate suspension of services and Customer assumes full liability for any resulting trademark infringement claims.

7. Data privacy and GDPR compliance

a. Lupasafe maintains strict compliance with GDPR and applicable data protection regulations for all collected data, particularly concerning breached data, phishing test results, and employee awareness metrics. While Lupasafe stores data securely, the Customer remains the data controller and is responsible for ensuring they have appropriate legal basis for processing employee data through the platform. Personally identifiable information is only accessible to authorized administrators with appropriate authentication.

8. Data retention and deletion

a. During the contract Lupasafe keeps customer data for the duration of the contract; audit logs are automatically deleted after approximately 3 months and invoicing data is kept for 7 years (statutory retention). On request we delete data within 30 days. On termination Lupasafe removes customer data from the live production environment within 30 days (from the portal within approximately one business day) and fully from the encrypted backups within 2 months at the latest. Backups are stored within the EU (Microsoft Azure) and are restored only when strictly necessary. On request Lupasafe provides a written deletion confirmation on termination.

LUPASAFE

Signature

Name:

Title:

Date:

Customer

Signature

Name:

Title:

Date: