By purchasing a subscription or entering into a written quotation, order form, or similar document referencing this EULA (an "Order Form"), Customer acknowledges and agrees to be bound by these terms. Where Customer has also executed a separate Master Services Agreement ("MSA") and/or Data Processing Addendum ("DPA") with SAGEN, the terms of that signed agreement shall control over this EULA to the extent of any conflict. Customer is urged to carefully read this EULA before using the SAGEN Platform. This EULA constitutes a legally binding and enforceable contract between Customer and SAGEN.
1. Definitions
1.1 "Affiliate"
Any entity that directly or indirectly controls, is controlled by, or is under common control with a Party, where "control" means direct or indirect ownership of more than fifty percent (50%) of the voting interests.
1.2 "Applicable Data Protection Laws"
All applicable laws, regulations, and rules relating to privacy, personal data protection, and insurance-sector data security, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA); other U.S. state comprehensive privacy laws in effect from time to time (including, without limitation, the laws of Colorado, Connecticut, Delaware, Virginia, and Oregon); the Gramm-Leach-Bliley Act Safeguards Rule, to the extent SAGEN acts as a service provider to a Carrier or other GLBA-regulated financial institution; the NAIC Insurance Data Security Model Law as adopted by applicable states; and, where a specific Customer's data is subject to them, the EU General Data Protection Regulation ("GDPR") and the outsourcing and cross-border data circulars of the Swiss Financial Market Supervisory Authority ("FINMA").
1.3 "Authorized Users"
Employees, consultants, contractors, or vendors authorized by Customer - or, where applicable, by an MSSP Customer acting under an active Delegation Grant on a client tenant's behalf - to use the Software solely for the internal use of Customer and its Affiliates, subject to the terms and conditions of this EULA.
1.4 "SAGEN Platform" / "Software"
The SAGEN cyber-risk and compliance evidence platform, delivered as a multi-tenant SaaS product, including the Insured Portal, Broker Portal, Carrier Portal, MSSP Portal, and Admin Console (collectively, the "Portals"); the Questionnaire & Control Baseline Assessment module; the Evidence Record Service; Findings & Remediation; the Scoring Engine (readiness, exposure, and confidence scoring); Reporting & Disclosure Packages; the AI Orchestration Service; the Alerts Center; and, where Customer has deployed it, SAGEN's internal Wazuh-based Collector and associated agent software - together, in each case, with all related Documentation and services.
1.5 "Customer Data"
All data, information, content, and materials - including without limitation Evidence Records, questionnaire responses, security findings, and telemetry from any deployed Collector agent - submitted, uploaded, imported, generated, or transmitted by Customer or its Authorized Users to or through the Software.
1.6 "Subscription Term"
The period of time during which Customer is subscribed to the Software, as specified in an Order Form.
1.7 "Usage Limitations"
The capacity indicated on the Order Form, including the number of Authorized Users, tenant organizations, delegated MSSP portfolio entities, Portals, modules, and other entitlement measures.
1.8 "Delegation Grant"
The mechanism by which an MSSP Customer is granted scoped, revocable administrative access to one or more of its client tenants' data within the Software, as configured through the MSSP Portal and Admin Console, and which terminates automatically and immediately upon revocation.
1.9 "Evidence Record"
A discrete unit of security or compliance evidence - for example, a questionnaire answer, a Collector-sourced control observation, or a manually attested document - stored by the Software against Customer's tenant, together with its associated lifecycle state, confidence score, and control references.
1.10 "Documentation"
SAGEN's then-current user guides, help-center content, and technical documentation for the Software, as made available to Customer through the Software or upon request.
1.11 "Services"
Implementation, onboarding, training, technical support, and other professional or managed services SAGEN provides to Customer in connection with the Software, whether included with a subscription or purchased separately under an Order Form.
1.12 "Feedback"
Any suggestion, idea, enhancement request, correction, or other feedback about the Software or Services that Customer or an Authorized User provides to SAGEN.
1.13 "Representatives"
A party's employees, officers, directors, Affiliates, and professional advisors who have a need to know Confidential Information for purposes of this EULA and who are bound by confidentiality obligations at least as protective as those in Section 7.
1.14 "Party" / "Parties"
SAGEN and Customer individually ("Party") or collectively ("Parties").
2. Software License Grant
2.1 License Grant
Subject to Customer's compliance with this Agreement and the Order Form, SAGEN grants Customer, during the Subscription Term, a non-exclusive, non-transferable, non-sublicensable, limited, revocable license to access and use the Software solely for Customer's internal business purposes - including, for an MSSP Customer, delegated administration of its client tenants strictly within the scope of an active Delegation Grant - in accordance with the Documentation, and within the specified Usage Limitations.
2.2 Evaluation and Pilot Licenses
If Customer is using a free trial, pilot, or beta version of the Software (a "Pilot"), such Pilot is available for thirty (30) days or the term specified in the applicable Order Form or pilot charter. SAGEN provides Pilots "as is" without any warranties, and Customer acknowledges that Pilot-stage evidence, scoring, and reporting outputs may rely on an incomplete control mapping or a partially onboarded tenant. Customer's sole remedy for dissatisfaction with a Pilot is termination of the Pilot.
2.3 Restrictions on Access and Use
Customer shall not, directly or indirectly:
- Modify, decompile, reverse engineer, or create derivative works based upon the Software, including any Collector agent or Collector configuration;
- Assign, sell, resell, distribute, rent, lease, or sublicense rights granted under this EULA to any third party;
- Circumvent any Software security feature, access control, or tenant-isolation control;
- Use the Software for competitive analysis or to build a competing cyber-risk, compliance, or evidence-management product;
- Exceed subscribed Usage Limitations, Authorized Users, or other entitlement measures;
- Use the Software for any unlawful purpose or to store unlawful data;
- Attempt to gain unauthorized access to the Software, or perform unauthorized security or penetration testing of the Software, except under a separate written agreement with SAGEN expressly authorizing such testing;
- Treat any output of the Scoring Engine or the AI Orchestration Service as a substitute for independent professional, legal, security, or insurance-underwriting judgment.
2.4 Reservation of Rights
The Software is only licensed (and not sold). Any rights not expressly granted herein are reserved by SAGEN and its licensors.
3. Fees and Payment Terms
3.1 Direct Purchases
Subscription fees, transacted currency, and payment terms shall be agreed upon under applicable Order Forms. Unless otherwise specified, Customer shall pay all fees net thirty (30) days from invoice date. All Subscription fees are non-cancelable and non-refundable except as specifically described herein. Non-payment shall be deemed a material breach of this EULA.
3.2 Taxes
All fees stated in an Order Form are exclusive of applicable taxes or other charges. Customer will be responsible for all applicable VAT, sales taxes, duties, or additional charges concerning the license and use of the Software.
4. Limited Warranty; Disclaimer
4.1 Software Warranty
SAGEN warrants to Customer that the Software will perform during the paid Subscription Term substantially in accordance with published Software specifications. If the Software does not conform and Customer promptly notifies SAGEN, SAGEN's entire liability shall be, at SAGEN's election: (a) return of fees paid during the last three months; or (b) repair or replacement of the non-conforming Software component.
4.2 Disclaimers
EXCEPT FOR THE LIMITED WARRANTY IN SECTION 4.1, THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. SAGEN DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, ACCURACY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. THE SOFTWARE, INCLUDING ANY OUTPUT OF THE SCORING ENGINE OR THE AI ORCHESTRATION SERVICE, IS A TOOL TO ASSIST CYBER RISK ASSESSMENT, COMPLIANCE EVIDENCE MANAGEMENT, AND INSURANCE UNDERWRITING WORKFLOWS. IT IS NOT A SUBSTITUTE FOR PROFESSIONAL JUDGMENT, INDEPENDENT SECURITY OR LEGAL REVIEW, OR HUMAN OVERSIGHT, AND DOES NOT CONSTITUTE A GUARANTEE OF ANY PARTICULAR SECURITY POSTURE, REGULATORY CERTIFICATION, OR INSURABILITY DETERMINATION. ANY OUTPUT OF THE AI ORCHESTRATION SERVICE IS ADVISORY ONLY AND REMAINS IN A DRAFT / PENDING-REVIEW STATE UNTIL EXPRESSLY ACCEPTED BY A HUMAN REVIEWER.
5. Limitation of Liability
5.1 No Consequential Damages
IN NO EVENT SHALL EITHER PARTY HAVE ANY LIABILITY FOR LOSS OF PROFITS, REVENUES, GOODWILL, OR FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES ARISING OUT OF OR IN CONNECTION WITH THIS EULA, HOWEVER CAUSED, WHETHER IN CONTRACT, TORT, WARRANTY, OR ANY OTHER LEGAL THEORY.
5.2 Maximum Liability
EXCEPT AS NOTED, NEITHER PARTY'S MAXIMUM AGGREGATE LIABILITY UNDER THIS EULA SHALL EXCEED THE TOTAL AMOUNT PAID OR PAYABLE BY CUSTOMER TO SAGEN IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. THIS CAP DOES NOT APPLY TO: (I) INTELLECTUAL PROPERTY RIGHTS VIOLATIONS; (II) EXPRESS INDEMNIFICATION OBLIGATIONS; OR (III) BREACHES OF CONFIDENTIALITY OR DATA PROTECTION OBLIGATIONS.
6. Intellectual Property Rights
SAGEN retains all rights, title, and interest in the Software - including the Scoring Engine's methodologies, the Evidence Record schema, questionnaire and control-baseline content, and the Collector's rule mappings - the Documentation, the Services, and all related Intellectual Property Rights. Customer shall have no rights beyond the limited license rights expressly granted in this EULA. Any Feedback provided by Customer to SAGEN may be implemented by SAGEN in its sole discretion and shall be the exclusive property of SAGEN.
7. Confidentiality
7.1 Definition
"Confidential Information" means all information provided by the Disclosing Party that is not generally known to the public, including business information, products, services, source code, security methodologies, and any information designated as confidential - including, without limitation, Evidence Records, security findings, vulnerability data, scoring methodologies, and Collector configuration data classified as Confidential or Restricted under SAGEN's Data Classification & Retention Policy.
7.2 Protection
The Receiving Party may only use Confidential Information to fulfill the purposes of this EULA. Each party agrees not to disclose the other's Confidential Information to third parties except to Representatives on a need-to-know basis bound by equivalent confidentiality obligations.
7.3 Duration
Confidentiality obligations survive termination for five (5) years. Obligations regarding trade secrets continue in perpetuity.
8. Security and Data Protection
8.1 Customer Data Ownership and Processing Roles
Customer owns all right, title, and interest in Customer Data. As between the parties: (a) SAGEN acts as a processor / service provider with respect to personal data appearing within Evidence Records and other Customer Data, processing such data solely on Customer's documented instructions and for the purpose of providing, managing, and improving the Software; and (b) SAGEN acts as a controller with respect to SAGEN's own direct account, billing, and contact data about Customer's business contacts and portal-login identities. Where Customer is an MSSP acting on behalf of a delegated client tenant, that client tenant - not the MSSP - is the controller for that tenant's Evidence Records, unless the parties agree otherwise in writing.
8.2 Applicable Data Protection Laws
SAGEN processes personal data in accordance with Applicable Data Protection Laws, including applicable U.S. state privacy laws and, where applicable, the GLBA Safeguards Rule and the NAIC Insurance Data Security Model Law. SAGEN shall notify Customer of any confirmed unauthorized access to Customer Data without undue delay, in accordance with Applicable Data Protection Laws and the notification timeframe set out in the applicable DPA.
8.3 GDPR / International
For Customers located in the EU or Switzerland, or otherwise processing personal data of EU or Swiss data subjects, a Data Processing Addendum ("DPA") reflecting GDPR Article 28 processor obligations - and, where applicable, FINMA outsourcing and cross-border data-transfer expectations - shall be executed by the parties before such processing begins.
8.4 Security Measures
SAGEN maintains administrative, physical, and technical measures designed to protect the security, confidentiality, integrity, and tenant-level isolation of Customer Data, consistent with SAGEN's published security policies (including its Encryption & Key Management, Access Control, and Secure SDLC & Change Management policies) and any then-current SOC 2 and/or ISO/IEC 27001 certification or report SAGEN has obtained. SAGEN shall not materially diminish the level of security controls during the applicable Term.
8.5 AI Orchestration Service - Human-in-the-Loop
The AI Orchestration Service is used only for narrative summarization, evidence-gap detection assistance, and remediation-guidance drafting, and does not independently determine, certify, or finalize a control status, a finding's disposition, or any compliance or insurability position. Every AI-generated output is DRAFT / advisory only and cannot become part of an Accepted Evidence Record, or any customer-facing report or disclosure package, without explicit acceptance by a human reviewer. SAGEN will not use Customer Data to train any AI model for the benefit of third parties without Customer's prior written consent.
8.6 Data Retention and Deletion
Following termination or expiration of the applicable Order Form, SAGEN will retain Customer Data for sixty (60) days - or such longer period as required by an active legal hold or Applicable Data Protection Laws - after which SAGEN will render Customer Data permanently unreadable, including through cryptographic key destruction ("crypto-shredding") of Customer's tenant-scoped encryption keys, consistent with SAGEN's Data Classification & Retention Policy.
9. Term & Termination
9.1 Term
This EULA is effective upon Customer's first access to the Software and remains in force during the Subscription Term. The Initial Term automatically renews for successive one (1) year periods unless either Party provides written notice of non-renewal at least sixty (60) days prior to expiration.
9.2 Termination
Either Party may terminate immediately upon written notice if the other Party: (a) becomes subject to insolvency proceedings; or (b) materially breaches this EULA and fails to cure the breach within thirty (30) days of written notice.
9.3 Effect of Termination
Upon termination: (i) all licenses granted terminate immediately, including any outstanding Delegation Grant; (ii) Customer must cease all use of the Software; and (iii) SAGEN will retain and then delete Customer Data in accordance with Section 8.6 above.
10. Indemnification
10.1 By SAGEN
If the Software becomes subject to a third-party IP infringement claim, SAGEN will defend and indemnify Customer against finally awarded third-party claims resulting directly from the infringement, provided the Software was used in accordance with this EULA.
10.2 By Customer
Customer shall defend, indemnify, and hold harmless SAGEN and its Affiliates against any third-party claims arising from: (i) alleged infringement by Customer Data; (ii) Customer's use of the Software in violation of applicable law; (iii) unauthorized use, access, or testing of third-party systems using the Software; or (iv) any use of a Delegation Grant by an MSSP Customer beyond the scope authorized by the delegating client tenant.
11. Technical Support and Professional Services
SAGEN shall make available technical support to Customer in accordance with the support tier and response-time commitments set out in the applicable Order Form and SAGEN's Customer SLA Framework then in effect. Support requests may be submitted through sagen-tech.com or to [email protected].
12. General Provisions
12.1 Governing Law
This EULA is governed by the laws of the State of Delaware, without regard to conflict-of-laws principles. The Parties submit to the exclusive jurisdiction of the state and federal courts located in Delaware, regardless of Customer's location.
12.2 Entire Agreement
This EULA, together with any executed MSA and/or DPA referenced in the preamble, supersedes all prior agreements and representations between the Parties regarding the subject matter hereof.
12.3 Modifications
SAGEN may modify the terms of this EULA by posting a revised version on the SAGEN website or within the Software. Customer's continued use of the Software after any modification constitutes acceptance of the modified terms.
12.4 Assignment
Customer may not assign or transfer this EULA without the prior written consent of SAGEN. SAGEN may assign this EULA without consent in connection with a merger, acquisition, or sale of substantially all assets.
12.5 Severability
If any provision of this EULA is held invalid or unenforceable, such provision shall be enforced to the maximum extent permissible, and the remaining provisions shall not be affected.
12.6 Export Control
Customer acknowledges the Software may be subject to export control laws, including those of the United States and the EU. Customer agrees not to export or transfer the Software in violation of such laws.
12.7 Contact
For legal notices, contact SAGEN at: [email protected] | sagen-tech.com. SAGEN's principal place of business is: Sagen Technologies Inc., 21255 Burbank Blvd, Woodland Hills, Los Angeles, CA 91367, United States. SAGEN's Delaware registered agent for service of process is located at 16192 Coastal Highway, Lewes, Sussex County, Delaware 19958.
Contact us
Questions about this EULA may be sent to [email protected].