Terms of Service

Effective Date: September 27, 2026
Last Updated: September 27, 2026

These Terms of Service ("Terms") are a legally binding agreement between you and Jutsu Inc., a Delaware corporation ("Jutsu," "we," "us," or "our"), governing your access to and use of Jutsu's websites, software, applications, the Jutsu security operations platform, APIs, integrations, documentation, AI-powered features, security monitoring and response services, compliance functionality, and related products and services.

Jutsu Inc.
2043 East St #627
Concord, CA 94520
United States
Email: legal@jutsu.ai

PLEASE READ THESE TERMS CAREFULLY. THEY INCLUDE IMPORTANT PROVISIONS REGARDING DISCLAIMERS OF WARRANTIES, CYBERSECURITY RISK, ARTIFICIAL INTELLIGENCE, AUTOMATED RESPONSE ACTIONS, LIMITATIONS OF LIABILITY, INDEMNIFICATION, A SHORTENED PERIOD FOR BRINGING CLAIMS, BINDING ARBITRATION, AND WAIVERS OF JURY TRIALS AND CLASS ACTIONS.

If you do not agree to these Terms, do not access or use the Services.

1. Definitions

For purposes of these Terms:

"Account" means an account used to access the Services.

"Agent Action" means any action that the Services take, initiate, or recommend through an AI agent, automated workflow, playbook, or integration, including a Response Action.

"Authorized User" means an employee, contractor, or agent of Customer (or of a Customer affiliate) whom Customer authorizes to access or use the Services on Customer's behalf.

"Customer" means the legal entity (or, where Section 2.3 permits, the individual acting in a business capacity) that purchases, registers for, evaluates, or uses the Services.

"Customer Data" means data, logs, events, telemetry, content, configuration information, files, records, evidence, prompts, instructions, and other information submitted to, transmitted to, collected by, or processed through the Services by or on behalf of Customer, including Output to the extent it contains such information. Customer Data excludes Usage Data, Aggregated Data, and Threat Indicators.

"Documentation" means Jutsu's then-current technical or user documentation for the Services.

"Evaluation Services" has the meaning given in Section 19.

"Jutsu Technology" means the Services, software, Documentation, systems, models, prompts, algorithms, agents, detections, workflows, playbooks, rules, APIs, interfaces, designs, methods, know-how, Usage Data, Aggregated Data, and other technology owned or licensed by Jutsu, and all improvements and derivatives of any of the foregoing, excluding Customer Data.

"Order Form" means an ordering document, online subscription selection, statement of work, or similar document, including one issued by a Partner, specifying Services purchased by or provided to Customer.

"Output" means alerts, investigations, summaries, reports, findings, recommendations, risk scores, and other content generated by the Services for Customer.

"Partner" means a reseller, distributor, managed security service provider ("MSSP"), or other channel partner authorized by Jutsu to resell or provide access to the Services.

"Personal Data" means information relating to an identified or identifiable individual that is protected as personal data or personal information under applicable law.

"Regulated Data" has the meaning given in Section 7.4.

"Response Action" means an action that affects Customer's systems or third-party systems, such as disabling accounts, revoking credentials, isolating assets, blocking traffic, or modifying configurations, as further described in Section 10.

"Security Incident" means a confirmed breach of Jutsu's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data in Jutsu's possession or control.

"Services" means Jutsu's websites and cybersecurity products and services, including the Jutsu platform, security monitoring, event ingestion, normalization, detection, investigation, threat analysis, security response, compliance evidence, reporting, integrations, AI agents, APIs, and related offerings.

"Subprocessor" means a third party that Jutsu engages to process Customer Data in providing the Services, including hosting providers and AI model providers.

"Threat Indicators" means technical indicators of malicious or suspicious activity, such as malicious IP addresses, domains, URLs, file hashes, malware signatures, and attacker tactics, techniques, and procedures, that do not identify Customer or any individual.

"Usage Data" means data and metadata about the operation, performance, configuration, and use of the Services (such as feature usage, event volumes, error logs, latency, and model performance metrics), excluding the content of Customer Data.

2. Agreement, Authority, and Business Use

2.1 Acceptance. You agree to these Terms by accessing or using the Services, creating an Account, clicking an acceptance button, executing an Order Form that references these Terms, or otherwise accepting these Terms.

2.2 Authority. If you use the Services on behalf of a company or other legal entity, you represent and warrant that you have authority to bind that entity, that these Terms apply to that entity, and that "you" and "Customer" refer to that entity.

2.3 Business Use Only. The Services are designed and offered exclusively for business, professional, and organizational security purposes. The Services are not offered to consumers, and you may not use them for personal, family, or household purposes. By accepting these Terms, you represent that you are acting in a trade, business, or professional capacity.

2.4 Eligibility. You must be at least 18 years old and legally capable of entering into a binding agreement.

2.5 Website Visitors. If you only browse Jutsu's websites without using the platform, Sections 13 (Acceptable Use), 24 (Intellectual Property), 32 (Disclaimer of Warranties), 33 (Limitation of Liability), and 44 through 49 (Governing Law and Dispute Resolution) apply to your use of the websites.

3. Relationship to Other Jutsu Agreements

3.1 Supplemental Agreements. These Terms may be supplemented by an Order Form, a Master Services Agreement ("MSA"), a Data Processing Addendum ("DPA"), a Service Level Agreement ("SLA"), a Statement of Work, a Business Associate Agreement ("BAA"), a Partner agreement, or another agreement signed by Jutsu.

3.2 Order of Precedence. If there is a conflict, the following order of precedence applies unless the applicable document expressly states otherwise: (1) a signed MSA or other negotiated agreement; (2) the DPA or BAA, but only for its subject matter; (3) the applicable Order Form; (4) the applicable SLA or Statement of Work; (5) these Terms; and (6) the Documentation.

3.3 Purchase Orders. Any terms in a Customer purchase order, vendor-registration portal, supplier code, or similar document that add to or conflict with these Terms are void and have no effect, even if Jutsu accepts or signs that document, unless Jutsu expressly agrees to them in a signed writing that specifically references this Section 3.3.

4. The Jutsu Services

Jutsu provides technology intended to help organizations collect and analyze security telemetry; monitor infrastructure and systems; detect potentially suspicious activity; investigate, correlate, and enrich security events; prioritize risks; conduct threat analysis; automate or assist security workflows; initiate or recommend Response Actions; generate security reports; collect, organize, and map compliance evidence to security frameworks; maintain security records; and support related security operations.

Features may vary by subscription, deployment, geography, configuration, and service level. Jutsu may modify and improve the Services over time in accordance with Section 42.

5. Accounts and Authorized Users

5.1 Customer Responsibilities. Customer is responsible for: ensuring registration information is accurate; maintaining Account confidentiality; administering Authorized Users; restricting access to appropriate personnel; promptly removing users who should no longer have access; protecting passwords, API keys, tokens, credentials, and authentication mechanisms; and all activity performed through Customer's Accounts.

5.2 Authorized Users. Customer is responsible for each Authorized User's compliance with these Terms, and any act or omission of an Authorized User is deemed an act or omission of Customer.

5.3 Compromise. Customer must promptly notify Jutsu at security@jutsu.ai if Customer becomes aware of unauthorized Account access or credential compromise.

5.4 No Account Sharing. Customer may not share individual user Accounts except as expressly permitted by Jutsu.

5.5 Reliance on Instructions. Jutsu may rely on instructions, configurations, and approvals provided through an authenticated Customer Account or API credential as authorized by Customer.

6. Customer Systems and Authorization

6.1 Connected Systems. The Services may connect to Customer-controlled or Customer-authorized cloud environments, applications, identity providers, endpoints, networks, code repositories, APIs, databases, logging systems, SIEM and EDR systems, security products, ticketing systems, communication systems, and other infrastructure.

6.2 Customer Authorization. Customer represents and warrants that it has, and will maintain, all rights, permissions, notices, consents, and legal authority necessary to: (a) connect each system to the Services; (b) authorize Jutsu to access and process information from those systems; (c) provide Customer Data to Jutsu; (d) authorize the security monitoring and investigation performed through the Services; and (e) authorize any Response Actions and Agent Actions Customer enables.

6.3 Monitoring Laws. Without limiting Section 6.2, Customer is solely responsible for complying with laws that apply to monitoring its systems, networks, communications, and personnel, including employee-monitoring, electronic-communications, wiretap, privacy, data-protection, and labor laws, and any obligation to inform or consult employees, works councils, or employee representatives.

6.4 No Unauthorized Targets. Customer must not use the Services to access, test, monitor, attack, investigate, scan, modify, or interfere with systems that Customer does not own or is not legally authorized to access.

7. Customer Data

7.1 Ownership. As between Customer and Jutsu, Customer retains all right, title, and interest in Customer Data. These Terms do not transfer ownership of Customer Data to Jutsu.

7.2 License to Process Customer Data. Customer grants Jutsu and its Subprocessors a worldwide, non-exclusive, royalty-free license to host, copy, transmit, process, analyze, display, modify, and otherwise use Customer Data only as reasonably necessary to: provide, maintain, and secure the Services; provide support; prevent fraud and abuse; comply with law; enforce these Terms; create Usage Data, Aggregated Data, and Threat Indicators as permitted by Section 8; and perform activities otherwise authorized by Customer.

7.3 Customer Responsibility. Customer is responsible for: the accuracy, quality, and legality of Customer Data and the means by which Customer acquired it; determining which systems and data are connected; configuring appropriate permissions; maintaining appropriate notices and consents; responding to data-subject requests where Customer acts as controller; and ensuring Customer's use of the Services complies with applicable law.

7.4 Regulated Data. Unless Jutsu expressly agrees otherwise in a signed writing (such as a BAA), Customer will not submit to the Services, or configure the Services to collect: (a) protected health information governed by HIPAA; (b) full payment card numbers or other cardholder data governed by PCI DSS; (c) criminal justice information governed by the CJIS Security Policy; (d) classified information or technical data controlled under the International Traffic in Arms Regulations; or (e) any other data whose processing imposes data-specific legal obligations on a service provider beyond those in these Terms and the DPA (together, "Regulated Data"). Jutsu has no liability for Regulated Data submitted in breach of this Section, even if Jutsu becomes aware of it, and Customer will promptly remove such data at Jutsu's request. Customer acknowledges that security telemetry may incidentally contain fragments of such data and is responsible for configuring filtering and data minimization appropriate to its environment.

7.5 Data Location and Transfers. Unless an Order Form or DPA specifies a hosting region, Customer Data may be stored and processed in the United States and in any other country in which Jutsu, its affiliates, or its Subprocessors operate. Where required by applicable law, cross-border transfers of Personal Data will be governed by the transfer mechanisms in the DPA.

7.6 Jutsu Personnel Access. Jutsu personnel and contractors may access Customer Data only as needed to provide the Services, provide support, investigate security or operational issues, or comply with law, and only subject to confidentiality obligations at least as protective as those in these Terms.

8. Usage Data, Aggregated Data, and Threat Indicators

8.1 Usage Data. Jutsu may collect and use Usage Data to operate, secure, support, analyze, and improve the Services and Jutsu Technology. Jutsu owns Usage Data.

8.2 Aggregated and De-Identified Data. Jutsu may create aggregated or de-identified information derived from the use of the Services, provided the information does not reasonably identify Customer or any individual ("Aggregated Data"). Jutsu may use Aggregated Data for service analytics, security and threat research, benchmarking, capacity planning, detection improvement, product development, performance measurement, and improvement of Jutsu Technology. Jutsu will maintain Aggregated Data in de-identified form, will not attempt to re-identify it except where permitted by law for purposes such as validating de-identification techniques, and will contractually prohibit any recipient of Aggregated Data from attempting to re-identify it.

8.3 Threat Indicators. Jutsu may derive Threat Indicators from Customer Data and use and share them to detect, prevent, and respond to threats for the benefit of Jutsu, its customers, and the security community, including through threat-intelligence sharing arrangements. Jutsu will not attribute a Threat Indicator to Customer, and will not include Customer's name, Customer's non-public network information, or Personal Data, in any Threat Indicator it shares with third parties.

9. Artificial Intelligence and Automated Analysis

9.1 Use of AI. Certain Services use artificial intelligence, large language models, machine learning, statistical analysis, rules, heuristics, threat intelligence, automated agents, or combinations of these technologies to assist with detection, classification, alert triage, correlation, investigation, threat hunting, summarization, risk prioritization, recommended remediation, Response Actions, compliance analysis, evidence mapping, and reporting.

9.2 Output Is Not Guaranteed. Customer acknowledges that AI and automated systems are probabilistic and may produce inaccurate, incomplete, outdated, inconsistent, or unexpected results, including false positives and false negatives. Output may not be unique, and similar Output may be generated for other customers. Jutsu does not warrant that any Output is correct, complete, or appropriate for Customer's particular environment.

9.3 Human Review. Customer is responsible for applying appropriate human review and professional judgment before relying on Output for material decisions, particularly decisions involving account suspension, credential revocation, system isolation, deletion of resources, blocking traffic, terminating processes, modifying firewall or access policies, legal determinations, employment or disciplinary decisions, regulatory reporting, or other high-impact actions. Customer will not use Output as the sole basis for any decision that produces legal or similarly significant effects on an individual.

9.4 Rights in Output. As between the parties, and subject to Jutsu's rights in Jutsu Technology, Customer may use Output for its internal business and security purposes.

9.5 AI Model Training. Jutsu will not use Customer Data to train or fine-tune any AI or machine-learning model that is made available to any other customer or third party, unless Customer expressly agrees in writing. Jutsu may use Customer Data to configure, tune, and baseline the Services for Customer's own environment (for example, customer-specific detections and behavioral baselines). This Section does not restrict Jutsu's use of Usage Data, Aggregated Data, or Threat Indicators under Section 8.

9.6 Third-Party AI Providers. Jutsu may use third-party AI model providers as Subprocessors. Jutsu will use commercially reasonable efforts to engage such providers only on terms that prohibit them from using Customer Data to train their models.

10. Security Response and Automated Actions

10.1 Response Actions. Some Services may recommend or, where configured and authorized by Customer, initiate Response Actions, which may include disabling or restricting accounts; revoking sessions or tokens; blocking IP addresses or domains; modifying access controls; isolating assets; triggering workflows; creating tickets; notifying personnel; invoking third-party APIs; or executing other Customer-configured actions.

10.2 Customer Control. Customer controls which integrations, permissions, playbooks, and actions it enables, and whether an action requires human approval. Where human approval is configured, Jutsu will use commercially reasonable efforts to require that approval before executing the relevant action. Jutsu may require human approval for, or disable, certain categories of action by default.

10.3 Deemed Authorization. Any Agent Action taken within the scope of the permissions, integrations, playbooks, and approval settings that Customer has enabled is deemed authorized by Customer.

10.4 Acknowledgments. Customer acknowledges that: (a) response decisions may involve incomplete or incorrect information; (b) automated or approved actions may cause service interruptions, lockouts, data unavailability, or other operational consequences; (c) third-party systems may behave unexpectedly; (d) integrations may change without Jutsu's control; and (e) Customer remains responsible for determining which Response Actions are appropriate for its environment and for maintaining the ability to reverse them.

CUSTOMER ASSUMES RESPONSIBILITY FOR THE BUSINESS AND TECHNICAL CONSEQUENCES OF RESPONSE ACTIONS AND AGENT ACTIONS IT AUTHORIZES OR CONFIGURES.

11. Cybersecurity Is Not Guaranteed

Customer acknowledges that cybersecurity inherently involves evolving threats and uncertainty. Jutsu does not represent, warrant, or guarantee that the Services will identify every attack, threat, vulnerability, or compromised credential; prevent every security incident, unauthorized access, malware, ransomware, or data loss; eliminate false positives or false negatives; satisfy every regulatory requirement; or make Customer's systems secure.

The Services are intended to form part of Customer's broader security program and are not a substitute for appropriate access controls, backups, patching, vulnerability management, secure configuration, employee training, incident-response planning, business continuity, professional security judgment, and other reasonable safeguards.

Jutsu is a cybersecurity technology provider. Jutsu is not an insurer or guarantor against cyber incidents or losses.

12. Compliance and Evidence Features

Jutsu may provide tools intended to help Customer organize compliance activities, identify potentially relevant controls, collect evidence, map evidence to frameworks, track security tasks, prepare reports, answer questionnaires, and prepare for assessments.

Such functionality does not constitute legal or accounting advice, an audit, an attestation, a certification, assurance services, or a guarantee of regulatory or contractual compliance. Jutsu is not a CPA firm, law firm, certification body, or independent auditor. A regulator, auditor, customer, insurer, bank, partner, or other third party may reach conclusions different from Jutsu's automated analysis. Customer remains responsible for determining its legal and regulatory obligations and obtaining appropriate professional advice.

13. Acceptable Use

Customer and Authorized Users may not use the Services to, or attempt to:

1. violate applicable law;
2. gain unauthorized access to systems, accounts, networks, or data;
3. conduct attacks against systems without authorization;
4. distribute malware or malicious code;
5. facilitate ransomware, credential theft, phishing, fraud, or extortion;
6. conduct surveillance or tracking of individuals for purposes unrelated to legitimate security operations;
7. interfere with or disrupt the Services;
8. circumvent rate limits, usage restrictions, authentication, or security controls;
9. reverse engineer, decompile, disassemble, or otherwise attempt to derive source code or discover non-public components of the Services, except to the extent applicable law expressly permits it notwithstanding this restriction;
10. manipulate, jailbreak, or inject instructions into the Services' AI components to cause them to bypass safeguards, exceed configured permissions, or act outside their intended purpose;
11. extract model weights, system prompts, detection logic, or playbooks from the Services;
12. scrape or systematically extract Jutsu content except through authorized APIs;
13. resell, sublicense, or provide the Services to third parties except under an authorized Partner agreement;
14. use the Services, Output, or Jutsu Confidential Information to build, train, or benchmark a competing product or service, or publish benchmark or performance results without Jutsu's prior written consent;
15. perform penetration testing, vulnerability scanning, or load testing against Jutsu without authorization;
16. upload content that infringes third-party rights or submit Regulated Data in breach of Section 7.4; or
17. use the Services in a manner reasonably likely to harm Jutsu, its customers, or third parties.

Good-faith security research conducted under a published Jutsu vulnerability-disclosure or bug-bounty policy, if available, is not prohibited when performed in compliance with that policy.

14. Restrictions on High-Risk Uses

Unless expressly approved by Jutsu in writing, Customer may not use the Services as the sole control for systems where a failure of the Services could reasonably be expected to directly cause death or serious bodily injury; operation of weapons; emergency dispatch failures; aviation or autonomous-vehicle control failures; nuclear facility control failures; medical device or life-support failures; or other comparable safety-critical consequences. Customer will not enable Response Actions against operational technology or industrial control systems without Jutsu's prior written approval.

15. Third-Party Services and Integrations

The Services may interoperate with products or services provided by third parties, including cloud providers, identity providers, security vendors, AI providers, code repositories, ticketing systems, and communication platforms. Customer acknowledges that third-party services are not controlled by Jutsu; third parties may modify their APIs or functionality; integrations may become unavailable; third-party terms may apply; Customer may need a separate third-party account or license; and Jutsu is not responsible for third-party products except to the extent expressly stated in a written agreement signed by Jutsu.

Jutsu may suspend or discontinue an integration where the third-party service changes, becomes unavailable, creates security risk, or is no longer commercially reasonable to support.

16. Privacy, Data Processing, and Subprocessors

16.1 Privacy Policy. Jutsu's collection and use of Personal Data for its own purposes (such as Account administration and marketing) is described in the Jutsu Privacy Policy.

16.2 DPA. Where Jutsu processes Personal Data on behalf of Customer, Jutsu acts as Customer's processor or service provider, and the DPA governs that processing. Jutsu will make its standard DPA available on request, and where applicable data-protection law requires a DPA, the DPA is incorporated into these Terms upon Customer's request.

16.3 Subprocessors. Jutsu may engage Subprocessors to provide the Services. Jutsu will maintain a list of its Subprocessors, will impose on them data-protection obligations consistent with these Terms and the DPA, and remains responsible for their performance of Jutsu's obligations to the extent required by the DPA.

16.4 Customer Obligations. Customer acknowledges that Customer Data may contain information about Authorized Users, employees, contractors, customers, or other individuals. Customer is responsible for providing legally required notices and obtaining legally required rights or consents before providing such information to Jutsu.

17. Security

Jutsu maintains administrative, organizational, physical, and technical safeguards designed to protect Customer Data, which may include controls relating to access management, encryption, authentication, vulnerability management, logging, monitoring, incident response, secure software development, personnel security, infrastructure security, and vendor management.

However, no cybersecurity system, cloud environment, network, software service, or method of transmission is completely secure, and Jutsu does not guarantee that unauthorized third parties will never circumvent security controls. Any specific security commitments, security addenda, audit rights, or certifications applicable to a Customer must be stated in a written agreement signed by Jutsu.

18. Security Incidents

If Jutsu becomes aware of a Security Incident, Jutsu will notify Customer without undue delay and in any event within any period required by applicable law or the DPA. Jutsu will provide information reasonably available to it to help Customer meet its own notification obligations and will take reasonable steps to contain and remediate the Security Incident.

Customer is responsible for maintaining accurate security-contact information. Jutsu's notification of, or response to, a Security Incident is not an acknowledgment of fault or liability.

19. Free Services, Trials, Proofs of Concept, Design Partner Programs, and Beta Features

19.1 Scope. "Evaluation Services" means any Service, or any portion of a Service, that Jutsu provides free of charge or at no cost to Customer (including free subscriptions, trials, proofs of concept, pilots, and design partner programs), and any preview, experimental, early-access, or beta feature, whether or not a fee applies to other Services.

19.2 Terms. Unless Jutsu expressly agrees otherwise in a signed writing: Evaluation Services may be modified, suspended, or discontinued at any time; no SLA applies; functionality may be incomplete; support may be limited; Customer Data may be deleted at the end of the evaluation period; Jutsu's indemnification obligations do not apply; and Evaluation Services are provided "AS IS" and "AS AVAILABLE."

19.3 Liability. TO THE MAXIMUM EXTENT PERMITTED BY LAW, JUTSU'S AGGREGATE LIABILITY ARISING FROM OR RELATING TO EVALUATION SERVICES WILL NOT EXCEED US $100.

Customer should not rely on Evaluation Services as its sole means of protecting production systems.

20. Purchases Through Partners

If Customer purchases the Services through a Partner: (a) fees, payment terms, and invoicing are governed by Customer's agreement with the Partner; (b) Customer's use of the Services remains subject to these Terms; (c) the Partner is not Jutsu's agent and has no authority to bind Jutsu or to modify these Terms, and any commitment made by the Partner that is not in a writing signed by Jutsu is solely the Partner's obligation; (d) Jutsu may suspend or terminate the Services if Jutsu does not receive payment from the Partner for Customer's subscription, after giving Customer reasonable notice and an opportunity to pay Jutsu directly; and (e) where the Partner administers Customer's Account or accesses Customer Data on Customer's behalf, Customer authorizes that access and Jutsu is not responsible for the Partner's acts or omissions. For purposes of any liability cap under Section 33, fees paid by the Partner to Jutsu for Customer's subscription are treated as fees paid by Customer.

21. Fees and Payment

21.1 Pricing. Paid Services are subject to the pricing stated on the applicable Order Form, during online checkout, or in another written agreement.

21.2 Payment Terms. Unless otherwise stated: fees are quoted and payable in U.S. dollars; invoiced fees are due within thirty (30) days after the invoice date; fees are non-refundable except as expressly provided in these Terms or an Order Form; and payment obligations are non-cancelable during an applicable committed subscription term.

21.3 Payment Methods. Jutsu may use third-party payment processors. Customer authorizes Jutsu and its payment providers to charge the payment method provided for amounts due.

21.4 Late Payment. Overdue amounts accrue interest at the lesser of one percent (1%) per month or the maximum rate permitted by law, from the due date until paid. Customer will reimburse Jutsu's reasonable costs of collection, including attorneys' fees, for amounts that are more than thirty (30) days overdue.

21.5 Disputed Amounts. If Customer disputes an invoice in good faith, Customer must notify Jutsu in writing with reasonable detail within thirty (30) days after the invoice date and pay the undisputed portion when due. Jutsu will not exercise its late-payment or suspension rights for amounts disputed in good faith while the parties work diligently to resolve the dispute.

21.6 Price Changes. Jutsu may change pricing for any renewal term by giving Customer notice at least thirty (30) days before the end of the then-current term.

22. Subscription Renewal

If Customer purchases a subscription that is identified at purchase as automatically renewing, the subscription will renew for the renewal period identified in the applicable Order Form or checkout process unless either party gives notice of non-renewal as specified there. Jutsu will comply with applicable laws relating to automatic renewal and cancellation. Negotiated subscriptions renew according to the applicable Order Form or negotiated agreement.

23. Taxes

Fees do not include taxes unless stated otherwise. Customer is responsible for all applicable sales, use, value-added, goods and services, withholding, and similar taxes arising from its purchase or use of the Services, excluding taxes imposed on Jutsu's net income. If Customer is required by law to withhold any amount from a payment, Customer will increase the payment so that Jutsu receives the full amount it would have received absent the withholding, unless the parties agree otherwise in writing, and will provide appropriate documentation and cooperate reasonably regarding available exemptions or credits.

24. Intellectual Property

24.1 Jutsu Ownership. Jutsu and its licensors retain all right, title, and interest in and to Jutsu Technology, including software, platform architecture, detection logic, rules, models, prompts, algorithms, agents, workflows, playbooks, user interfaces, Documentation, APIs, designs, trademarks, trade secrets, patents, know-how, and all improvements to and derivatives of the foregoing, regardless of whether such improvements arise from Customer's use of the Services or from Feedback. Except for rights expressly granted under these Terms, no rights are granted to Customer, by implication, estoppel, or otherwise.

24.2 Customer License. Subject to Customer's compliance with these Terms and payment of applicable fees, Jutsu grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the applicable subscription term to permit Authorized Users to access and use the Services for Customer's internal business and security purposes, in accordance with the Documentation and any usage limits in the Order Form. Partners and MSSPs may receive different rights under a written Partner agreement.

25. Feedback

If Customer provides suggestions, ideas, recommendations, enhancement requests, or other feedback about the Services ("Feedback"), Customer grants Jutsu a perpetual, irrevocable, worldwide, royalty-free, fully paid, transferable, and sublicensable right to use, disclose, and incorporate the Feedback into Jutsu Technology without restriction, attribution, or obligation. Feedback does not include Customer Data merely because Customer Data is processed through the Services, and Jutsu will not identify Customer as the source of Feedback without Customer's consent.

26. Confidentiality

26.1 Separate NDA. If Jutsu and Customer have entered into a separate confidentiality or nondisclosure agreement, that agreement controls its subject matter to the extent it conflicts with this Section.

26.2 Obligations. Each party receiving non-public information of the other party that is marked confidential or that reasonably should be understood as confidential ("Confidential Information") will: (a) use it only to exercise rights and perform obligations relating to the Services; (b) protect it using at least reasonable care; and (c) disclose it only to its and its affiliates' personnel, advisers, contractors, Subprocessors, and service providers who have a need to know and are bound by confidentiality obligations at least as protective as these.

26.3 Exclusions. Confidential Information does not include information that the receiving party can demonstrate: is or becomes publicly available without breach; was lawfully known to it without confidentiality obligations; was lawfully received from a third party without confidentiality restrictions; or was independently developed without using the other party's Confidential Information.

26.4 Compelled Disclosure. A receiving party may disclose Confidential Information where required by law or legal process, after giving the disclosing party prompt notice where legally permitted and reasonable cooperation, at the disclosing party's expense, in seeking a protective order.

26.5 Designations. Customer Data is Customer's Confidential Information. Jutsu Technology, pricing, non-public Documentation, and non-public information regarding the Services are Jutsu's Confidential Information.

26.6 Duration and Remedies. These obligations continue during the relationship and for five (5) years after it ends, and for trade secrets and Customer Data, for as long as they remain protected under applicable law or in the receiving party's possession. Unauthorized use or disclosure of Confidential Information may cause irreparable harm for which damages are an inadequate remedy, and the disclosing party may seek injunctive relief in addition to other remedies.

27. Support and Service Availability

Support, onboarding, uptime commitments, and response times, if any, are determined by Customer's applicable subscription, Documentation, SLA, Order Form, or negotiated agreement. Unless a specific SLA expressly applies, Jutsu does not guarantee uninterrupted availability. The Services may be temporarily unavailable because of maintenance, upgrades, security events, third-party outages, internet or infrastructure failures, emergency changes, circumstances outside Jutsu's reasonable control, or other operational reasons. Any SLA credits are Customer's sole and exclusive remedy for unavailability covered by that SLA.

28. Suspension

Jutsu may temporarily suspend Customer's access to some or all Services where Jutsu reasonably determines suspension is necessary to: prevent or contain a security risk; prevent unauthorized activity; comply with law or legal process; prevent harm to Jutsu, Customer, or third parties; address nonpayment of undisputed amounts more than fifteen (15) days after notice of nonpayment; address a material violation of these Terms; or protect the integrity or availability of the Services.

Jutsu will limit any suspension in scope and duration to what is reasonably necessary. Where reasonably practicable, Jutsu will provide notice and work with Customer to restore access after the issue is resolved. Jutsu is not required to provide advance notice where doing so could increase security risk, violate law, or materially impair Jutsu's ability to protect the Services. Customer remains responsible for fees during a suspension caused by Customer.

29. Term and Termination

29.1 Term. These Terms remain effective while Customer accesses or uses the Services.

29.2 Subscriptions. Each subscription continues for the term stated in the applicable Order Form. Either party may terminate a subscription as permitted by the applicable Order Form.

29.3 Termination for Breach. Either party may terminate the affected subscription by written notice if the other party materially breaches these Terms and, where the breach is capable of cure, fails to cure it within thirty (30) days after receiving written notice describing the breach.

29.4 Immediate Termination by Jutsu. Jutsu may terminate immediately by notice where: Customer's use creates a material security risk; Customer engages in illegal or malicious activity; continued service would violate law; Customer or its owners become subject to sanctions prohibiting the relationship; Customer becomes insolvent or subject to bankruptcy or similar proceedings (to the extent permitted by law); or continued access could materially harm Jutsu or third parties.

29.5 Evaluation Services. Jutsu may terminate Evaluation Services at any time, with or without notice.

29.6 Refund on Customer Termination for Jutsu's Breach. If Customer terminates a subscription under Section 29.3 for Jutsu's uncured material breach, Jutsu will refund any prepaid fees covering the remainder of the terminated subscription term after the effective date of termination.

30. Effect of Termination

30.1 General. Upon termination or expiration: Customer's right to use the applicable Services ends; all unpaid fees for the committed term become due, except where Customer terminated for Jutsu's uncured material breach; and Jutsu may disable integrations and Response Actions.

30.2 Data Export and Deletion. For thirty (30) days after termination or expiration of a paid subscription, Jutsu will, on Customer's request, make Customer Data available for export through the Services' standard export functionality, where available. After that period, Jutsu has no obligation to maintain Customer Data and will delete it within ninety (90) days in accordance with its retention procedures, except for Customer Data that Jutsu must retain by law and Customer Data residing in backups, which will be deleted in the ordinary course of backup rotation and remain protected by these Terms until deleted. Customer Data from Evaluation Services may be deleted at any time after the evaluation ends.

30.3 Survival. Sections 1, 7.3, 7.4, 8, 9.2, 9.3, 10.3, 10.4, 11, 12, 13, 19.3, 21 (for amounts accrued), 23, 24.1, 25, 26, 30, 32 through 38, and 44 through 58, and any other provision that by its nature is intended to survive, will survive termination or expiration.

31. Warranties

31.1 Mutual. Each party represents and warrants that it has the legal power and authority to enter into these Terms.

31.2 Limited Service Warranty. Jutsu warrants to Customer that, during the applicable subscription term, paid Services will perform materially in accordance with the applicable Documentation. To make a claim under this warranty, Customer must notify Jutsu in writing with reasonable detail within thirty (30) days after the nonconformity first appears.

31.3 Exclusive Remedy. Customer's exclusive remedy, and Jutsu's sole obligation, for a breach of the warranty in Section 31.2 is for Jutsu to use commercially reasonable efforts to correct the nonconformity. If Jutsu cannot materially correct the nonconformity within a reasonable time, either party may terminate the affected Service, and Jutsu will refund prepaid fees covering the terminated portion of the remaining subscription term.

31.4 Exclusions. The warranty in Section 31.2 does not apply where the issue results from Customer systems, third-party services, misuse, unauthorized modifications, unsupported configurations, Customer instructions or configurations, internet or infrastructure conditions outside Jutsu's control, or Evaluation Services.

32. DISCLAIMER OF WARRANTIES

EXCEPT FOR THE EXPRESS WARRANTIES IN SECTION 31 OR IN A WRITTEN AGREEMENT SIGNED BY JUTSU, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES, OUTPUT, AND ALL RELATED MATERIALS ARE PROVIDED "AS IS" AND "AS AVAILABLE."

JUTSU AND ITS AFFILIATES, LICENSORS, SUBPROCESSORS, SERVICE PROVIDERS, OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS DISCLAIM ALL EXPRESS, IMPLIED, STATUTORY, AND OTHER WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, AND QUIET ENJOYMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

WITHOUT LIMITING THE FOREGOING, JUTSU DOES NOT WARRANT THAT: THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE; ALL SECURITY EVENTS WILL BE DETECTED; ALL THREATS WILL BE INVESTIGATED CORRECTLY; THE SERVICES WILL PREVENT A SECURITY INCIDENT; ALL OUTPUT WILL BE ACCURATE; ALL RECOMMENDATIONS OR AGENT ACTIONS WILL BE APPROPRIATE; CUSTOMER WILL ACHIEVE ANY PARTICULAR SECURITY OUTCOME; CUSTOMER WILL ACHIEVE OR MAINTAIN COMPLIANCE OR PASS AN AUDIT OR SECURITY REVIEW; OR THIRD-PARTY SERVICES WILL REMAIN AVAILABLE.

NO ORAL OR WRITTEN INFORMATION OR ADVICE PROVIDED BY JUTSU, ITS PERSONNEL, OR ANY PARTNER CREATES A WARRANTY UNLESS EXPRESSLY INCLUDED IN A WRITTEN AGREEMENT SIGNED BY JUTSU.

33. LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

33.1 Exclusion of Certain Damages. NEITHER JUTSU NOR ITS AFFILIATES, LICENSORS, SUBPROCESSORS, SERVICE PROVIDERS, OFFICERS, DIRECTORS, EMPLOYEES, OR AGENTS WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES; LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL, OR ANTICIPATED SAVINGS; LOSS OR CORRUPTION OF DATA; BUSINESS INTERRUPTION; COSTS OF PROCUREMENT OF SUBSTITUTE SERVICES; LOSS ARISING FROM A CYBERSECURITY INCIDENT AFFECTING CUSTOMER'S SYSTEMS; OR LOSS ARISING FROM UNAUTHORIZED ACCESS TO CUSTOMER SYSTEMS, REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF ADVISED THAT SUCH DAMAGES WERE POSSIBLE.

33.2 Aggregate Liability Cap. JUTSU'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICES, THESE TERMS, AND ALL ORDER FORMS WILL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER (OR BY A PARTNER ON CUSTOMER'S BEHALF) TO JUTSU FOR THE SERVICES GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT FIRST GIVING RISE TO LIABILITY. FOR EVALUATION SERVICES, SECTION 19.3 APPLIES.

33.3 Application. THE LIMITATIONS IN THIS SECTION 33 APPLY REGARDLESS OF THE FORM OF ACTION, WHETHER THE CLAIM IS BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, STATUTE, OR ANOTHER THEORY, AND EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE. MULTIPLE CLAIMS WILL NOT ENLARGE THE CAP. THE PARTIES AGREE THAT THE PRICING OF THE SERVICES REFLECTS THIS ALLOCATION OF RISK AND THAT THESE LIMITATIONS ARE AN ESSENTIAL BASIS OF THE BARGAIN.

33.4 Liability That Cannot Be Limited. NOTHING IN THESE TERMS EXCLUDES OR LIMITS LIABILITY FOR FRAUD, GROSS NEGLIGENCE, OR WILLFUL MISCONDUCT, OR ANY OTHER LIABILITY, TO THE EXTENT SUCH LIABILITY CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW.

34. Cybersecurity-Specific Allocation of Risk

Without limiting Section 33, Customer acknowledges that Jutsu's fees are not calculated as insurance premiums and do not reflect the potential value of Customer's systems, intellectual property, Customer Data, revenue, reputation, or operations, or potential losses arising from a cyberattack. Customer is responsible for maintaining appropriate cyber insurance and other risk-transfer mechanisms based on its own risk profile.

Jutsu does not assume responsibility for the consequences of: undetected attacks; zero-day vulnerabilities; compromised Customer or third-party credentials; misconfigured or unsupported Customer systems or software; failure to install patches; Customer's failure to act on security findings; attacks occurring before monitoring is enabled; telemetry Customer does not provide; integrations Customer disables; third-party outages; inaccurate third-party threat intelligence; actions of malicious third parties; or Response Actions and Agent Actions authorized by Customer.

35. Indemnification by Customer

Customer will defend, indemnify, and hold harmless Jutsu, its affiliates, and their respective officers, directors, employees, and agents from and against third-party claims, and all resulting damages, judgments, penalties, fines, losses, liabilities, costs, and reasonable attorneys' fees, arising from or relating to:

1. Customer Data, including a claim that Customer Data or its collection or processing through the Services infringes or violates third-party rights or applicable law;
2. Customer's or its Authorized Users' unlawful use of the Services;
3. Customer's unauthorized monitoring of or access to systems, networks, communications, or personnel;
4. Customer's breach of Section 6, Section 7.4, or Section 13;
5. a Response Action or Agent Action that Customer configured, instructed, approved, or authorized; or
6. Customer's material breach of its representations or warranties under these Terms,

except, in each case, to the extent the claim arises from Jutsu's gross negligence, willful misconduct, or breach of these Terms.

36. Intellectual Property Indemnification by Jutsu

36.1 Defense. For paid Services, Jutsu will defend Customer against a third-party claim alleging that Customer's authorized use of the Services in accordance with these Terms directly infringes a United States patent, copyright, or trademark, or misappropriates a trade secret, and will pay damages finally awarded or settlements approved by Jutsu.

36.2 Exclusions. Jutsu has no obligation for claims arising from Customer Data; Output generated from Customer Data or Customer instructions; Customer modifications; combinations with products, services, or data not supplied by Jutsu; continued use after Jutsu provides a non-infringing alternative; use outside the Documentation or in breach of these Terms; third-party services; or Evaluation Services.

36.3 Mitigation. If an infringement claim appears likely, Jutsu may, at its option: (a) obtain the right for Customer to continue using the affected Service; (b) modify or replace it with substantially equivalent functionality; or (c) terminate the affected Service and refund prepaid fees attributable to the unused portion of the terminated subscription.

THIS SECTION 36 STATES JUTSU'S ENTIRE LIABILITY AND CUSTOMER'S EXCLUSIVE REMEDY FOR THIRD-PARTY INTELLECTUAL PROPERTY INFRINGEMENT AND MISAPPROPRIATION CLAIMS.

37. Indemnification Procedure

A party seeking indemnification will: (a) provide the indemnifying party with reasonably prompt written notice of the claim (although delay relieves the indemnifying party of its obligations only to the extent the delay causes it material prejudice); (b) give the indemnifying party sole control of the defense and settlement; and (c) provide reasonable cooperation at the indemnifying party's expense. The indemnified party may participate with its own counsel at its own expense. The indemnifying party may not settle a claim in a manner that admits fault by, or imposes non-monetary obligations on, the indemnified party without the indemnified party's prior written consent, which will not be unreasonably withheld.

38. Export Controls and Sanctions

38.1 Compliance. The Services, including their security and encryption functionality, may be subject to U.S. export-control and economic-sanctions laws, including the Export Administration Regulations and regulations administered by the U.S. Treasury Department's Office of Foreign Assets Control, and to the export-control and sanctions laws of other applicable jurisdictions, including the European Union and its Member States and the United Kingdom. Customer will not use, export, re-export, transfer, or make the Services available in violation of those laws.

38.2 Representations. Customer represents and warrants that neither Customer nor any of its owners, officers, or, to Customer's knowledge, Authorized Users: (a) is located in, organized under the laws of, or ordinarily resident in a country or region subject to comprehensive U.S. sanctions; or (b) is identified on, or owned or controlled by a person identified on, a U.S., EU, UK, or UN restricted-party list, including the Specially Designated Nationals and Blocked Persons List and the Entity List.

38.3 Prohibited End Uses. Customer will not use the Services for any end use prohibited by applicable export-control law, including military end uses or uses relating to weapons of mass destruction where prohibited, or to develop offensive intrusion capabilities.

38.4 Changes in Law. Jutsu may suspend or terminate access to the Services, without liability, to the extent Jutsu reasonably determines necessary to comply with export-control or sanctions laws, including laws that change after Customer's purchase.

39. Government Use

If Customer is a U.S. government entity, the Services constitute "commercial products," "commercial computer software," and "commercial computer software documentation" and are provided with only those rights customarily provided to commercial customers under these Terms, consistent with FAR 12.212 and DFARS 227.7202, except where applicable law requires otherwise.

40. Publicity

Jutsu will not use Customer's name or logo in public marketing materials without Customer's permission, except where Customer has expressly provided permission, an applicable Order Form permits such use, or Customer has already publicly announced the relationship. Customer may revoke prospective marketing permission by contacting Jutsu, subject to any applicable agreement.

41. Force Majeure

Neither party will be liable for delay or failure to perform caused by circumstances beyond its reasonable control, including natural disasters, war, terrorism, civil unrest, labor disputes, widespread internet failures, utility failures, cloud-provider outages, telecommunications failures, governmental actions (including export controls and sanctions), epidemics, cyberattacks of extraordinary scale, or similar events. This Section does not excuse Customer's obligation to pay amounts due. The affected party will use commercially reasonable efforts to mitigate the impact.

42. Changes to the Services

Jutsu may modify the Services over time, including to improve functionality, respond to security threats, comply with law, update integrations or AI models, add features, remove obsolete functionality, or change technical architecture. For paid Services, Jutsu will not materially reduce the core functionality of the purchased Service during the applicable subscription term without providing substantially equivalent functionality, except where necessary for security, legal compliance, the unavailability of a third-party service, or circumstances outside Jutsu's reasonable control.

43. Changes to These Terms

Jutsu may update these Terms from time to time. If Jutsu makes material changes, Jutsu will provide at least thirty (30) days' notice through the Services, by email to an Account administrator, on its website, or by another reasonable method, except where a shorter period is required by law or necessary to address an immediate security issue. The revised Terms become effective on the stated effective date.

For an existing committed paid subscription, materially adverse changes will take effect at the start of the next renewal term unless required by law, necessary to address an immediate security issue, or otherwise agreed by the parties. Changes to Sections 44 through 49 will not apply to any dispute of which Jutsu had actual notice before the change became effective.

Continued use of the Services after updated Terms become effective constitutes acceptance of the updated Terms. If Customer does not agree, Customer must stop using the Services and may give notice of non-renewal.

44. Governing Law

These Terms, and any dispute arising out of or relating to them or the Services, are governed by the laws of the State of Delaware, without regard to its conflict-of-law principles, except that Section 46 is governed by the U.S. Federal Arbitration Act. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act do not apply.

45. Informal Dispute Resolution and Time Limit for Claims

45.1 Notice and Negotiation. Before initiating formal proceedings, a party must provide written notice describing the dispute, the relevant facts, the relief requested, and contact information. Notices to Jutsu must be sent to legal@jutsu.ai. The parties will attempt in good faith to resolve the dispute for at least thirty (30) days after receipt of the notice.

45.2 Interim Relief. Either party may seek temporary or preliminary injunctive relief at any time where necessary to prevent immediate or irreparable harm.

45.3 Time Limit. To the extent permitted by law, any claim arising out of or relating to these Terms or the Services must be initiated within one (1) year after the claim accrues, except for claims for nonpayment of fees and claims for infringement or misappropriation of a party's intellectual property.

46. Binding Arbitration

46.1 Agreement to Arbitrate. Except for matters excluded in Section 46.4, any dispute, claim, or controversy arising out of or relating to these Terms or the Services that is not resolved under Section 45 will be resolved by binding arbitration rather than in court.

46.2 Rules and Procedure. The arbitration will be administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules then in effect. The arbitration will be conducted by one arbitrator, in English, with remote participation permitted unless the arbitrator determines otherwise, and will result in a reasoned written decision. The legal seat of arbitration will be San Francisco, California, unless the parties agree otherwise. Except as required by law or to enforce an award, the parties will keep the arbitration and any award confidential.

46.3 Authority of the Arbitrator. The arbitrator will decide all issues of arbitrability and the scope, validity, and enforceability of this Section 46, except that a court will decide any dispute regarding the enforceability of Section 47. The arbitrator may award any remedy available in court that is consistent with these Terms but may not award relief prohibited by these Terms. Judgment on an award may be entered in any court having jurisdiction.

46.4 Exclusions. Nothing in this Section 46 prevents either party from seeking in court: injunctive relief relating to intellectual property; relief relating to unauthorized access to or misuse of systems or the Services; relief necessary to protect Confidential Information; or relief in small-claims court where the claim qualifies.

47. CLASS ACTION AND JURY TRIAL WAIVER

TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY AGREES THAT CLAIMS WILL BE BROUGHT ONLY IN AN INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF, CLASS MEMBER, OR REPRESENTATIVE IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. THE ARBITRATOR MAY NOT CONSOLIDATE CLAIMS OF MULTIPLE PARTIES OR PRESIDE OVER ANY REPRESENTATIVE PROCEEDING WITHOUT THE WRITTEN CONSENT OF ALL PARTIES.

IF THE CLASS WAIVER IN THIS SECTION IS FOUND UNENFORCEABLE AS TO A PARTICULAR CLAIM, THAT CLAIM WILL BE SEVERED FROM THE ARBITRATION AND HEARD ONLY IN THE COURTS DESCRIBED IN SECTION 49, AND WILL BE STAYED PENDING COMPLETION OF ANY INDIVIDUAL ARBITRATION.

TO THE EXTENT A DISPUTE IS PERMITTED TO PROCEED IN COURT, EACH PARTY KNOWINGLY AND VOLUNTARILY WAIVES ANY RIGHT TO A TRIAL BY JURY.

48. Arbitration Opt-Out

An individual accepting these Terms directly, rather than under a separately negotiated agreement, may opt out of Section 46 by sending written notice to legal@jutsu.ai within thirty (30) days after first accepting these Terms. The notice must include the individual's name, Account email, organization (if applicable), and a clear statement that the individual elects to opt out of arbitration. Opting out does not affect any other provision of these Terms.

49. Court Venue Where Arbitration Does Not Apply

For any dispute that is not subject to arbitration, the parties consent to the exclusive jurisdiction and venue of the state and federal courts located in San Francisco County, California, except where applicable law requires otherwise. Either party may seek to enforce an arbitration award or a judgment in any court of competent jurisdiction.

50. Notices

Jutsu may provide notices to Customer through the Services, by email to an Account administrator or Order Form contact, or by another reasonable electronic method. Notices are effective when sent by email or posted in the Services. Notices to Jutsu concerning legal disputes, indemnification, termination for breach, or Security Incidents must be sent to legal@jutsu.ai (and, for Security Incidents or Account compromise, also to security@jutsu.ai), and are effective upon receipt.

51. Assignment and Subcontracting

Customer may not assign or transfer these Terms without Jutsu's prior written consent, except, on written notice to Jutsu, in connection with a merger, reorganization, or sale of all or substantially all of Customer's assets where the assignee is not a competitor of Jutsu, is not subject to applicable sanctions, and agrees in writing to assume Customer's obligations. Jutsu may assign these Terms without consent in connection with a merger, corporate reorganization, financing, sale of assets, acquisition, or transfer to an affiliate. Jutsu may use subcontractors and Subprocessors to perform its obligations and remains responsible for their performance under these Terms. Any attempted assignment in violation of this Section is void. Subject to the foregoing, these Terms bind and benefit the parties and their permitted successors and assigns.

52. Independent Contractors

The parties are independent contractors. These Terms do not create a partnership, joint venture, fiduciary relationship, franchise, employment relationship, or agency relationship. Neither party may bind the other except as expressly authorized.

53. No Third-Party Beneficiaries

Except for the indemnified persons under Sections 35 and 36 and the persons expressly benefiting from Sections 32 and 33, no third party has rights under these Terms.

54. Waiver

Failure to enforce a provision does not waive the right to enforce that provision later. A waiver is effective only if in writing and signed by the party granting it.

55. Severability

If a provision of these Terms is held invalid or unenforceable, that provision will be enforced to the maximum extent permitted by law, or modified to the minimum extent necessary to make it enforceable, and the remaining provisions will remain in effect.

56. Interpretation

Headings are for convenience only. "Including" means "including without limitation." Any ambiguity will not be interpreted against a party because that party drafted the provision. Electronic records, communications, and signatures may be used to form and evidence agreements relating to the Services, and Customer consents to receive communications from Jutsu electronically. If these Terms are translated, the English version controls.

57. Entire Agreement

These Terms, together with any applicable Order Forms, DPAs, BAAs, SLAs, Statements of Work, MSAs, and other written agreements signed by Jutsu that incorporate them, constitute the entire agreement between the parties concerning their subject matter and supersede all prior or contemporaneous proposals, representations, and understandings concerning that subject matter.

58. Contact

Questions concerning these Terms may be directed to:

Jutsu Inc.
2043 East St #627
Concord, CA 94520
United States

Legal: legal@jutsu.ai
Security: security@jutsu.ai

© 2026 Jutsu Inc. All rights reserved.