Master Services Agreement

Status: Founder approved standard form. Version: 1.0 Effective date: September 14, 2026.

MASTER SERVICES AGREEMENT

This Master Services Agreement ("Agreement") is entered into between AtlaSent Systems, Inc., a Delaware corporation ("AtlaSent"), and the customer identified on the applicable Order Form ("Customer"). AtlaSent and Customer are each a "Party" and together the "Parties."

This Agreement takes effect on the date Customer first signs an Order Form referencing it (the "Effective Date") and governs Customer's use of the AtlaSent Service.

1. Definitions

"Affiliate" means any entity that controls, is controlled by, or is under common control with a Party, where "control" means ownership of more than 50% of the voting securities or equivalent ownership interest.

"AUP" means AtlaSent's Acceptable Use Policy, currently published at https://atlasent.io/legal/aup, as updated from time to time in accordance with this Agreement.

"BAA" means a Business Associate Agreement executed between the Parties under HIPAA, in AtlaSent's then-current form available at https://atlasent.io/legal/baa, where applicable.

"Confidential Information" has the meaning given in §8.

"Customer Data" means any data, content, or information submitted to the Service by Customer or any End User, including Customer Personal Data as defined in the DPA.

"Customer Personal Data" has the meaning given in the DPA.

"Documentation" means the user-facing documentation for the Service at https://docs.atlasent.io, as updated from time to time.

"DPA" means AtlaSent's Data Processing Agreement, available at https://atlasent.io/legal/dpa, incorporated into this Agreement by reference.

"End User" means any individual whom Customer authorizes to use the Service on Customer's behalf, including Customer's employees, contractors, and agents.

"Fees" means the fees payable by Customer under any Order Form.

"Order Form" means a written or electronic ordering document entered into between the Parties that references this Agreement and identifies the Service, the subscription term, the Fees, and any tier-specific terms.

"Permit Token" means a token issued by the Service representing an authorization decision.

"Service" means the AtlaSent execution-time authorization service, including the API, Console, SDKs, MCP server, GitHub Action, and any related services made available by AtlaSent and identified on an Order Form.

"SLA" means AtlaSent's Service Level Agreement, available at https://atlasent.io/legal/sla, applicable to the Service tier identified on the applicable Order Form.

"Subscription Term" means the initial term and any renewal term as set out on the Order Form.

2. The Service

2.1 Provision

Subject to this Agreement and the applicable Order Form, AtlaSent will make the Service available to Customer during the Subscription Term in accordance with the Documentation and the SLA.

2.2 Use rights

AtlaSent grants Customer a non-exclusive, non-transferable, worldwide right during the Subscription Term to access and use the Service for Customer's internal business operations, subject to this Agreement and the applicable Order Form. Customer may permit End Users to exercise these rights on Customer's behalf, and Customer is responsible for End User acts and omissions as if they were Customer's own.

2.3 Restrictions

Customer will not, and will not permit any End User or third party to:

1. resell, sublicense, or otherwise commercially redistribute the Service;
2. reverse engineer, decompile, or attempt to derive the source code of the Service, except to the extent applicable law permits this despite the restriction;
3. modify, create derivative works of, or remove proprietary notices from the Service;
4. use the Service in violation of the AUP, applicable law, or the Documentation;
5. use the Service to build a competing authorization-decision product;
6. introduce malicious code into the Service or attempt to interfere with the integrity of the Service or other customers' use of it; or
7. exceed the usage limits set out on the Order Form or in the published rate limits.

Violation of this §2.3 is a material breach of this Agreement.

2.4 Service changes

AtlaSent may improve and update the Service from time to time. AtlaSent will not, during a Subscription Term, (a) materially reduce the functionality of any feature identified on the Order Form, (b) materially reduce the security controls described in Annex II of the DPA, or (c) materially reduce the SLA commitments, except as required to comply with applicable law, to protect the security of the Service, or as otherwise agreed in writing. AtlaSent will give Customer not less than ninety (90) days' prior written notice of any change permitted by clauses (a)–(c) that is not security- or law-compelled. If a change permitted by the foregoing materially and adversely affects Customer's use of the Service, Customer may, within thirty (30) days of the effective date of the change, terminate the affected Order Form on written notice and receive a pro-rata refund of pre-paid Fees for the unused portion of the Subscription Term.

2.5 Beta features

AtlaSent may make beta, alpha, or preview features available to Customer. Beta features are provided "AS IS," without SLA or warranty, and may be modified or discontinued at any time. Customer's use of beta features is voluntary.

3. Customer obligations

3.1 Account; credentials

Customer is responsible for the security of its account, API keys, and credentials, and for all activity that occurs through its account. Customer will notify AtlaSent at security@atlasent.io promptly upon becoming aware of any unauthorized access or use.

3.2 Compliance

Customer is responsible for its own compliance with laws applicable to its use of the Service, including the laws governing the underlying actions that Customer evaluates with the Service. AtlaSent's issuance of an allow decision is not an independent legal authorization for any underlying action.

3.2A Independent verification; no substitute for Customer controls

Customer acknowledges that:

(a) the Service evaluates Customer-defined policies against Customer- supplied inputs and Customer Data and produces decisions and Permit Tokens accordingly; (b) the Service is one control among many and is not designed or warranted to replace independent legal, regulatory, safety, or operational controls applicable to the underlying actions Customer evaluates; (c) AtlaSent makes no determination of the legality, propriety, or business appropriateness of any underlying action; (d) the issuance of an allow decision or Permit Token is not, and will not be relied upon by Customer as, (i) an independent legal authorization for any underlying action, (ii) a representation that the action complies with law, or (iii) a substitute for Customer's own controls; and (e) Customer remains solely responsible for (1) defining its policies, (2) the accuracy and lawfulness of context inputs, (3) honoring deny and hold decisions, and (4) the underlying actions taken (or not taken) following any decision.

3.3 Customer Data

Customer is responsible for the accuracy, content, and legality of Customer Data. As between the Parties, Customer retains all right, title, and interest in and to Customer Data. Customer grants AtlaSent a non-exclusive, worldwide, royalty-free license to use Customer Data solely to provide the Service to Customer in accordance with this Agreement, the DPA, and applicable law.

3.4 No prohibited data

Customer will not submit to the Service:

• Protected Health Information (PHI) governed by HIPAA, except under an executed Business Associate Agreement (BAA);
• payment-card data within the scope of PCI-DSS;
• export-controlled data without a written addendum covering the specific use case; or
• special categories of Personal Data as defined by GDPR Article 9 without prior written acknowledgment from AtlaSent.

4. Fees and payment

4.1 Fees

Customer will pay the Fees set out on the applicable Order Form. Unless otherwise specified, Fees are stated and invoiced in US dollars and are exclusive of taxes.

4.2 Invoicing

AtlaSent will invoice Customer in accordance with the Order Form (by default, annually in advance for subscription Fees). Invoices are due thirty (30) days from invoice date.

4.3 Late payment

Amounts not paid when due accrue interest at the lesser of 1.0% per month or the maximum permitted by law. AtlaSent may, after fifteen (15) days' notice of past-due amounts, suspend the Service until payment is received.

4.4 Taxes

Customer is responsible for all taxes associated with the Service other than taxes on AtlaSent's net income. If AtlaSent has a legal obligation to collect a tax, the tax will be invoiced to Customer unless Customer provides a valid tax exemption certificate.

4.5 Renewals

Unless otherwise specified on the Order Form, each Subscription Term renews automatically for successive terms equal to the initial term, unless either Party gives notice of non-renewal at least sixty (60) days before the end of the then-current term. AtlaSent may increase Fees on renewal by giving written notice at least sixty (60) days before renewal; if Customer objects in writing within that window, Customer may decline renewal.

5. SLA and support

The SLA applicable to Customer's Order Form is incorporated into this Agreement by reference. Support is provided in accordance with the SLA and the Documentation.

6. DPA and BAA

The DPA is incorporated into this Agreement by reference and governs the Processing of Customer Personal Data. If Customer's use of the Service requires the processing of PHI, Customer must execute a BAA with AtlaSent before submitting any PHI.

7. Intellectual property

7.1 AtlaSent IP

AtlaSent owns all right, title, and interest in and to the Service, including all related software, documentation, and trademarks, and any improvements, enhancements, or derivative works thereof. No rights are granted to Customer except as expressly set out in this Agreement.

7.2 Customer IP

Customer retains all right, title, and interest in and to Customer Data and Customer's own systems, products, and services.

7.3 Feedback

Customer may, but is not required to, provide AtlaSent suggestions or feedback about the Service. AtlaSent may use any such feedback freely without obligation to Customer.

7.4 Service Data

AtlaSent may collect and process data about the operation of the Service that does not, alone or in combination with other reasonably available data, identify Customer, any End User, or any Data Subject ("Service Data"), solely for the purposes of operating, securing, maintaining, troubleshooting, and improving the Service. AtlaSent will:

(a) treat Service Data in accordance with the technical and business-process safeguards required to meet the definitions of "deidentified information" under Cal. Civ. Code §1798.140(m) and "anonymous information" under GDPR Recital 26; (b) commit not to attempt to re-identify Service Data; (c) bind its personnel and contractors to the same; and (d) not publish or disclose Service Data in a form from which Customer, any End User, or any Data Subject can be identified.

AtlaSent will not use Customer Personal Data to train any general-purpose machine-learning or large-language model. Use of Customer Personal Data to train Customer-specific models, if offered, requires Customer's prior written opt-in.

8. Confidentiality

8.1 Definition

"Confidential Information" means non-public information disclosed by one Party (the "Discloser") to the other (the "Recipient") that is marked confidential or that the Recipient would reasonably understand to be confidential. Confidential Information includes the terms (but not the existence) of this Agreement and any Order Form, AtlaSent's technical and security designs, Customer Data, and Customer's business plans. Confidential Information does not include information that the Recipient can show (a) was already known without restriction, (b) becomes publicly available through no act of the Recipient, (c) was independently developed, or (d) was rightfully received from a third party without restriction.

8.2 Use and protection

The Recipient will use Confidential Information solely to perform under this Agreement and will protect it using at least the same degree of care it uses for its own confidential information, but no less than reasonable care. The Recipient will limit access to its personnel and advisors with a need to know who are bound by written confidentiality obligations.

8.3 Compelled disclosure

If the Recipient is required by law or court order to disclose Confidential Information, the Recipient may do so, provided that (where permitted) the Recipient gives prompt notice to the Discloser so the Discloser may seek a protective order.

9. Warranties; disclaimers

9.1 Mutual warranties

Each Party warrants that it has the right and authority to enter into this Agreement and that this Agreement is a binding obligation of that Party.

9.2 AtlaSent warranties

During the Subscription Term, AtlaSent warrants that:

1. the Service will perform materially in accordance with the Documentation;
2. AtlaSent will not materially diminish the security functionality of the Service; and
3. AtlaSent will perform the Service using personnel of suitable training and skill.

As Customer's sole and exclusive remedy and AtlaSent's entire liability for breach of §9.2(1), AtlaSent will use commercially reasonable efforts to correct the non-conformance; if AtlaSent cannot correct the non-conformance within thirty (30) days of Customer's written notice, Customer may terminate the affected portion of the Service and receive a pro-rata refund of pre-paid Fees for the unused portion of the Subscription Term.

9.3 Disclaimer

EXCEPT AS EXPRESSLY SET OUT IN §9.2, THE SERVICE IS PROVIDED "AS IS" AND ATLASENT DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. ATLASENT DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF HARMFUL COMPONENTS, OR THAT ANY DATA WILL BE SECURE OR NOT LOST OR ALTERED.

10. Indemnification

10.1 By AtlaSent

AtlaSent will defend Customer against any third-party claim alleging that Customer's use of the Service in accordance with this Agreement infringes such third party's patent, copyright, trademark, or trade secret (an "IP Claim"), and will pay any settlement amount agreed to by AtlaSent or damages finally awarded against Customer by a court of competent jurisdiction. AtlaSent's obligations do not apply to the extent the IP Claim arises from:

1. Customer Data;
2. modification of the Service not made by AtlaSent;
3. combination of the Service with products or services not provided by AtlaSent, to the extent the IP Claim would not have arisen but for the combination;
4. use of the Service in violation of this Agreement, the AUP, or the Documentation; or
5. Customer's continued use of an allegedly infringing version of the Service after (i) AtlaSent has made a substantially equivalent non-infringing alternative available to Customer at no additional charge and (ii) AtlaSent has given Customer not less than thirty (30) days' written notice and reasonable migration assistance to adopt such alternative.

If the Service is, or AtlaSent reasonably believes the Service may become, the subject of an IP Claim, AtlaSent may, at its option and expense: (a) procure for Customer the right to continue using the Service; (b) modify the Service to be non-infringing while maintaining substantially equivalent functionality; or (c) terminate the affected portion of the Service and refund any pre-paid Fees for the unused portion of the Subscription Term. This §10.1 states AtlaSent's entire liability and Customer's sole and exclusive remedy for any IP Claim.

10.2 By Customer

Customer will defend AtlaSent against any third-party claim arising from (a) Customer Data, (b) Customer's use of the Service in violation of this Agreement, the AUP, the DPA, or applicable law, or (c) the underlying actions that Customer evaluates or executes with the Service (a "Customer Claim"), and will pay any settlement amount agreed to by Customer or damages finally awarded against AtlaSent by a court of competent jurisdiction.

10.3 Procedure

The indemnifying Party's obligations are conditioned on the indemnified Party (a) giving prompt written notice of the claim, (b) allowing the indemnifying Party sole control of the defense and settlement (provided that no settlement requiring the indemnified Party to admit fault or pay money requires the indemnified Party's consent), and (c) providing reasonable cooperation at the indemnifying Party's expense.

11. Limitation of liability

11.1 Exclusion of consequential damages

EXCEPT FOR THE UNCAPPED MATTERS IN §11.2B, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, OR COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, REGARDLESS OF THE THEORY OF LIABILITY AND WHETHER OR NOT THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

11.2 General Cap

Except as provided in §§11.2A and 11.2B, each Party's aggregate liability arising out of or relating to this Agreement, whether in contract, tort (including negligence), or otherwise, will not exceed the Fees paid or payable by Customer to AtlaSent under the affected Order Form during the twelve (12) months immediately preceding the first event giving rise to liability (the "General Cap").

11.2A Enhanced Cap

Each Party's aggregate liability for the following matters will not exceed two times (2×) the General Cap (the "Enhanced Cap"):

(a) breach of §8 (Confidentiality); (b) breach of the DPA or BAA, or any breach of applicable Data Protection Laws by a Party in the performance of this Agreement, except to the extent that liability is uncapped under §11.2B; and (c) breach of the IP indemnity in §10.

The Enhanced Cap is in lieu of, and not in addition to, the General Cap for matters to which it applies.

11.2B Uncapped matters

No cap applies to:

(a) Customer's payment obligations under §4; (b) either Party's liability for gross negligence, willful misconduct, fraud, or fraudulent misrepresentation; (c) infringement by a Party of the other Party's Intellectual Property Rights, except as already capped within the IP indemnity in §10.1; (d) any administrative fine or regulatory penalty imposed on a Party for which liability cannot be limited under applicable law (provided that any claim by the other Party for indemnification or contribution arising from such fines or penalties remains subject to §11.2A); and (e) liabilities that cannot be limited or excluded under applicable law.

11.4 Basis of the bargain

The Parties acknowledge that the foregoing limitations are a material part of the consideration for this Agreement and that the Fees reflect these limitations.

12. Term and termination

12.1 Term

This Agreement begins on the Effective Date and continues until all Order Forms have expired or been terminated.

12.2 Termination for cause

Either Party may terminate this Agreement and any Order Form on written notice if the other Party materially breaches this Agreement and fails to cure within thirty (30) days of written notice describing the breach. AtlaSent may terminate immediately for an uncurable breach of §2.3 (Restrictions) or the AUP that AtlaSent reasonably determines threatens the security or integrity of the Service.

Either Party may terminate this Agreement immediately if the other becomes insolvent, makes a general assignment for the benefit of creditors, or has a receiver or similar appointed.

12.3 Effect of termination

On termination of an Order Form:

0. Export window. For a period of thirty (30) days following the effective date of termination, AtlaSent will provide Customer reasonable access to the Service solely to export Customer Data, including the complete audit-chain content attributable to Customer, in the formats described in the Documentation. AtlaSent may charge its then-current professional-services rates only for export assistance beyond self-service export tooling.
1. Customer's right to use the Service under the terminated Order Form ends after the export window, and AtlaSent may disable access.
2. Customer remains liable for any Fees due for the period up to the effective date of termination.
3. If Customer terminated for AtlaSent's uncured material breach, AtlaSent will refund Customer's pre-paid Fees for the unused portion of the Subscription Term.
4. AtlaSent will return or delete Customer Data in accordance with the DPA. Within thirty (30) days after completion of deletion under the DPA, AtlaSent will, on Customer's request, provide a written certification, signed by an officer of AtlaSent, attesting to the deletion and identifying any Customer Data retained under permitted legal exceptions and the legal basis for such retention.

On termination of the Agreement (i.e., once all Order Forms are terminated or expired), the provisions that by their nature should survive will survive, including §2.3 (Restrictions), §3.2A (Independent Verification), §3.3 (Customer Data), §4 (Fees, for accrued amounts), §7 (IP), §8 (Confidentiality), §9.3 (Disclaimer), §10 (Indemnification), §11 (Limitation of Liability), this §12.3, and §13 (General).

13. General

13.1 Governing law and forum

This Agreement is governed by the laws of the State of Delaware without regard to its conflict of laws rules. The Parties consent to the exclusive jurisdiction of the state and federal courts located in New Castle County, Delaware for any dispute arising under this Agreement, except that either Party may seek injunctive relief in any court of competent jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

13.2 Notices

Notices under this Agreement must be in writing and are deemed given when delivered by hand, by registered mail, or by email to the address on the Order Form (or such other address as a Party notifies the other). Legal notices to AtlaSent must additionally be emailed to legal@atlasent.io.

13.3 Assignment

Neither Party may assign this Agreement without the prior written consent of the other, except that either Party may assign this Agreement, on written notice but without consent, in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, provided that the assignee is not, at the time of the proposed assignment, a Direct Competitor of the non- assigning Party. "Direct Competitor" means an entity whose principal commercial offering is execution-time authorization or policy-evaluation infrastructure substantially equivalent to the Service. A Party's good-faith determination that an entity is a Direct Competitor must be supported by reference to that entity's published product offerings as of the date of determination.

13.4 Force majeure

Neither Party is liable for any failure or delay in performance (other than payment obligations) due to causes beyond its reasonable control, including acts of God, war, terrorism, civil unrest, pandemic, government action, internet or telecommunications failure, and labor disputes ("Force Majeure").

13.5 Independent contractors

The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship.

13.6 No third-party beneficiaries

There are no third-party beneficiaries to this Agreement.

13.7 Publicity

Neither Party may use the other's name or logo in publicity without the other's prior written consent, except that AtlaSent may list Customer's name and logo in customer lists with Customer's consent on the Order Form.

13.8 Waiver; severability

Failure to enforce any provision is not a waiver of the right to enforce it later. If any provision is held unenforceable, the rest remains in full force and effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.

13.9 Entire agreement; order of precedence

This Agreement, together with the DPA, BAA (if applicable), AUP, SLA, and any Order Forms, is the entire agreement between the Parties regarding its subject matter and supersedes all prior or contemporaneous agreements. In the event of conflict, the order of precedence is:

(1) the DPA's incorporated EU SCCs and UK IDTA; (2) the BAA, but only as to the treatment of Protected Health Information; (3) the DPA; (4) the Order Form; (5) this Agreement; (6) the SLA; (7) the AUP; (8) the Documentation.

13.10 Amendment

This Agreement may be amended only by a writing signed by both Parties, except that AtlaSent may update the AUP and Documentation as set out in those documents and may update the SLA in accordance with §11 of the SLA.

13.11 Counterparts; electronic signatures

This Agreement may be executed in counterparts and by electronic signature.

13.12 Compliance with trade controls

Each Party will comply with all applicable export-control, economic-sanctions, and anti-corruption laws, including the US Export Administration Regulations (EAR), the International Traffic in Arms Regulations (ITAR), the regulations administered by the US Office of Foreign Assets Control (OFAC), the UK Sanctions and Anti-Money Laundering Act 2018, EU Council Regulations on restrictive measures, the US Foreign Corrupt Practices Act, and the UK Bribery Act 2010. Customer represents and warrants that neither Customer, nor any End User to whom Customer permits use of the Service, is (a) located in, organized under the laws of, or ordinarily resident in any country or territory subject to comprehensive US, UK, EU, or UN sanctions, or (b) listed on any US, UK, EU, or UN restricted-party list, including the OFAC Specially Designated Nationals and Blocked Persons list, the Entity List, the Denied Persons List, or the EU Consolidated List.

13.13 Insurance

If an Order Form states insurance requirements, AtlaSent will maintain the specified coverage during that Order Form and provide a certificate of insurance on written request. Unless an Order Form expressly states otherwise, no fixed minimum insurance limits are incorporated into this Agreement.

13.14 Government data requests

If AtlaSent receives a subpoena, court order, search warrant, or other compulsory legal process for Customer Data, including the audit chain content attributable to Customer, AtlaSent will, unless legally prohibited from doing so, (a) promptly notify Customer to enable Customer to seek a protective order or other appropriate remedy; (b) treat Customer as the producing party where legally permitted; and (c) not respond to non-compulsory law-enforcement requests for Customer audit-chain content without Customer's prior written consent. AtlaSent will challenge any legal process that is overbroad, unlawful, or inconsistent with the protections of this Agreement and the DPA.

IN WITNESS WHEREOF, the Parties have executed this Agreement on the dates indicated on the Order Form that incorporates this Agreement by reference.

[Signature blocks: see Order Form.]