POSTQ SOFTWARE PRODUCT LICENSE AGREEMENT Licensor: POSTQ SOFTWARE LABS PRIVATE LIMITED Agreement version: 0.1.0-Beta Revision date: 19 August 2026 Effective date: 21 August 2026 Classification: PostQ Code Scanner-Beta private invite-only evaluation release 1. Scope And Acceptance This PostQ Software Product License Agreement (the Agreement) governs the installation, access, and use of PostQ software identified in an Order by the customer identified in that Order (Customer). PostQ means POSTQ SOFTWARE LABS PRIVATE LIMITED. The Agreement applies only when an Order references it or when Customer validly accepts it through an acceptance mechanism approved by PostQ. The individual accepting the Agreement represents that the individual has authority to bind Customer. If Customer does not agree, or the individual lacks authority, Customer must not install, access, or use the Product. 2. Definitions Affiliate means an entity that directly or indirectly controls, is controlled by, or is under common control with a party, where control means direct or indirect ownership of more than fifty percent of the voting interests or the power to direct management and policies. No Affiliate has a right to use the beta unless it is expressly named in the Order and individually approved by PostQ. Authorized Environment means the repositories, projects, applications, systems, accounts, networks, devices, instances, and deployment locations stated in the Order and controlled by Customer or an expressly authorized Affiliate. Authorized User means an employee or individual contractor whom Customer authorizes to use the Product for Customer's internal business purposes and who is bound by confidentiality and use restrictions appropriate to the Product. Customer Content means source code, repositories, configuration, metadata, reports supplied by Customer, credentials, logs, scan inputs, and other information submitted to or processed by the Product on Customer's behalf. Customer Content does not include PostQ Materials. Documentation means PostQ's then-current product, deployment, security, support, and technical documentation supplied for the Product. Entitlement means the authorized edition, term, metric, quantity, deployment model, environment, Affiliate scope, support level, and other usage rights stated in an Order. Order means an order form, entitlement schedule, quote accepted by PostQ, subscription confirmation, or other signed or expressly accepted document that identifies Customer, Product, Entitlement, and commercial terms. PostQ Materials means, to the extent owned by or validly licensed to PostQ, the Product, Documentation, proprietary rule packs, rule definitions, signatures, metadata, taxonomies, classification models, mappings, scoring and assessment logic, recommendations, knowledge bases, schemas, report structures and templates, user-interface elements, algorithms, methods, updates, and related PostQ materials. PostQ Materials exclude Customer Content and Third-Party Components. Product means PostQ software, rule packs, extensions, plug-ins, command-line tools, containers, viewers, updates, and associated modules identified in the Order. Reports means findings, inventories, assessments, exports, and other output generated by the Product from Customer Content. Third-Party Components means software or materials owned by third parties and included with, invoked by, or used through the Product, including open-source software. Usage Metric means the licensed measurement stated in the Order, such as repositories, applications, projects, scan runners, scans, processing capacity, Authorized Users, instances, or enterprise scope. 3. Agreement Structure And Precedence Unless a signed document expressly states otherwise, the order of precedence is: 1. a signed negotiated master agreement or amendment; 2. the Order, for Entitlement and commercial details; 3. product-specific terms referenced by the Order; 4. this Agreement; 5. applicable support, privacy, security, services, and data-processing schedules; and 6. Documentation for operational detail. Customer purchase-order or portal terms do not modify the Agreement unless PostQ expressly signs them. An applicable third-party license governs its Third-Party Component to the extent it grants rights directly to Customer or cannot lawfully be superseded. Nothing in the Agreement reduces a right preserved by mandatory law or an applicable open-source license. 4. License Grant Subject to payment of applicable fees and compliance with the Agreement, PostQ grants Customer a limited, non-exclusive, non-sublicensable, non-transferable except under Section 24, worldwide right during the Entitlement term to install, execute, access, and use the Product in object-code form in the Authorized Environment, solely for Customer's internal business purposes and within the Usage Metric. Customer may permit Authorized Users and service providers acting solely for Customer to exercise the licensed rights. Customer remains responsible for their compliance and must prevent unauthorized access. Affiliate rights, if any, exist only when the Order identifies the Affiliate or approved Affiliate class. Customer may make a reasonable number of archival, backup, and disaster-recovery copies. Production, non-production, testing, high-availability, and disaster-recovery rights are limited to the Order. No unlimited, enterprise-wide, perpetual, Affiliate, or service-provider right is implied. All rights not expressly granted are reserved. No license is granted by implication, estoppel, or otherwise. 5. Entitlement And Usage Customer must not exceed its Usage Metric. Treatment of monorepositories, forks, branches, archived repositories, temporary projects, CI/CD runners, non-production environments, contractors, and Affiliates is determined by the Order and the approved measurement policy. Customer must protect license keys, activation data, entitlement files, and access credentials and notify PostQ of suspected misuse. PostQ may use technical controls that are described in the Documentation and proportionate to the Entitlement. Such controls must not remove rights applicable to Third-Party Components. 6. Restrictions Except as expressly permitted by the Agreement, mandatory law, or an applicable Third-Party Component license, Customer must not: 1. sell, resell, rent, lease, sublicense, distribute, publish, transfer, or make the Product available to a third party; 2. use the Product to provide a bureau, hosted, managed-scanning, outsourcing, or similar service for third parties unless the Order authorizes it; 3. copy, modify, translate, adapt, or create derivative works of PostQ proprietary code or materials except as expressly authorized; 4. reverse engineer, decompile, disassemble, or attempt to derive non-public PostQ source, rules, signatures, mappings, models, algorithms, or protection mechanisms; 5. bypass license, usage, security, encryption, signing, or technical controls; 6. remove or alter copyright, trademark, confidentiality, attribution, patent, or other notices; 7. extract, publish, redistribute, sublicense, or commercially reuse PostQ proprietary rule packs, rule text, signatures, taxonomies, mappings, assessment logic, recommendations, or knowledge-base relationships as a separate product, dataset, or service; 8. use protected PostQ Materials, Confidential Information, non-public rules, signatures, mappings, or assessment logic to create, train, validate, or improve a competing scanner or substantially equivalent proprietary detection library, except for independently developed material that does not use protected PostQ material and to the extent mandatory law permits the activity; or 9. use the Product unlawfully, without authority to scan the relevant code or systems, or to develop or introduce malicious code. The reverse-engineering and circumvention restrictions do not apply where non-waivable law or an applicable third-party/open-source license expressly preserves the activity, including modification or debugging rights for an LGPL-covered component. Customer may independently develop products without using PostQ Confidential Information or copying protected expression. Internal validation and benchmarking for the approved evaluation are permitted subject to confidentiality and security duties. Customer must not publish benchmark results, comparative claims, screenshots, reports, performance measurements, or competitive evaluations concerning the beta without PostQ's prior written approval for the specific publication. 7. Evaluation, Trial, Beta And Preview Use Evaluation duration, metric, deployment, and conversion rights must be stated in an Order or approved evaluation notice. Evaluation, trial, beta, preview, and early-access versions are limited to non-production use unless PostQ expressly authorizes otherwise. They may be incomplete, may change, and may be withdrawn. To the maximum extent permitted by law, pre-release and no-fee materials are provided as-is without service levels or warranties. Customer must independently validate them before relying on output. 8. Ownership PostQ and its licensors retain all right, title, and interest in PostQ Materials and their intellectual-property rights. Delivery of a copy does not transfer ownership. Third-Party Components remain owned by their respective owners and are governed by their applicable licenses. PostQ ownership claims apply only to material PostQ owns or is entitled to license. Repository location, encryption, compilation, or distribution does not remove third-party rights or cure an ownership defect. 9. Customer Content And Reports Customer and its licensors retain ownership of Customer Content. Customer grants PostQ a limited, non-exclusive right to process Customer Content only as necessary to provide, secure, support, and perform the Product and Agreement, or as Customer otherwise instructs in writing. Customer may use, reproduce, modify, and share Reports for its internal security, engineering, compliance, audit, procurement, remediation, and governance purposes, including with Affiliates, professional advisers, auditors, regulators, and service providers subject to appropriate duties. The Order may grant broader distribution rights. As between the parties, Customer retains customer-specific facts, Customer Content, and findings describing Customer's environment. PostQ retains PostQ Materials underlying the Reports, including generic report formats, templates, taxonomies, methods, and know-how. No clause transfers Customer's source code or customer-specific facts to PostQ. 10. Feedback Customer may provide feedback voluntarily. Subject to Customer's confidentiality obligations, Customer grants PostQ a worldwide, perpetual, irrevocable, royalty-free right to use feedback to improve PostQ products without identifying Customer or disclosing Customer Confidential Information. Customer is not required to provide feedback. 11. Third-Party And Open-Source Software PostQ identifies distributed Third-Party Components in release-specific notices and includes applicable license texts and source information with the distribution. An applicable third-party license governs the relevant component where its terms cannot lawfully be superseded or grant rights directly to Customer. PostQ proprietary restrictions do not independently apply to a Third-Party Component where that would conflict with its license. Where a license requires corresponding source, modification source, relinking material, installation information, attribution, or a written offer, PostQ will provide or identify that material in the release legal package. Third-party licensors do not endorse PostQ. Customer is responsible for separately obtained tools, customer-supplied plug-ins, and optional third-party services it enables. 12. Data Handling, Privacy, Telemetry And External Services The reviewed self-managed Product processes source and reports in Customer-controlled environments unless Customer configures an external integration. No telemetry, hosted processing, external AI transmission, or PostQ access should be represented as enabled unless the applicable Product version, Documentation, and Order establish that behavior. If PostQ processes personal data or Customer Content outside Customer's environment, the parties will apply an approved data-processing, privacy, security, retention, and deletion schedule. PostQ will not use Customer Content to train a general-purpose or shared machine-learning model unless Customer expressly agrees in writing. Customer is responsible for lawful authority to scan and process Customer Content and for avoiding submission of secrets or regulated data to integrations not approved for that data class. 13. Nature And Limits Of Scanner Results The Product performs automated static analysis and related deterministic assessments. Results may contain false positives, false negatives, incomplete traces, unresolved parameters, and findings affected by language support, build configuration, generated code, obfuscation, binaries, runtime behavior, unavailable dependencies, reflection, environment values, or custom cryptography. The Product and Reports are decision-support tools. They do not replace secure development, architecture review, threat modelling, penetration testing, cryptographic engineering, legal or regulatory advice, accredited testing, certification, or independent validation. A FIPS-related result is not a FIPS 140 validation, NIST certification, accredited-laboratory determination, or government approval. A post-quantum, quantum-readiness, migration, or crypto-agility result does not guarantee that an application is secure, compliant, quantum safe, or free of vulnerable cryptography. PostQ does not warrant that every cryptographic asset, vulnerability, policy issue, dependency, or remediation requirement will be detected. Customer is responsible for validating findings, deciding remediation, testing changes, managing cryptographic risk, and obtaining required professional advice or certification. 14. Support, Maintenance, Updates And Upgrades Support tier, response objectives, maintenance period, update rights, and supported versions are only those stated in the Order or an incorporated support schedule. Customer must maintain supported operating systems, runtimes, and Product versions and provide reasonably required diagnostic data. Updates to an entitled Product are governed by the Agreement unless supplied under separate terms. New editions, modules, hosted services, or material functionality may require a new Order. 15. Confidentiality Confidentiality obligations in a signed master agreement control. If no signed confidentiality agreement applies, each recipient will use the other party's non-public information only for the Agreement, protect it with at least reasonable care, and disclose it only to personnel and advisers with a need to know and corresponding duties. Confidential Information excludes information the recipient can document is public without breach, lawfully known without restriction, lawfully received from another source without duty, or independently developed without use of the discloser's information. PostQ Confidential Information includes non-public code, proprietary rules, signatures, mappings, algorithms, roadmaps, security information, license controls, pricing, and protected Documentation. Customer Confidential Information includes Customer Content, non-public Reports, credentials, architecture, and security findings. A recipient may disclose information when legally compelled, after notice where lawful and reasonable assistance. Each party acknowledges that unauthorized use or disclosure of Confidential Information may cause harm for which monetary damages are inadequate. The affected party may seek injunctive or other equitable relief from a court with jurisdiction, in addition to available remedies, without this sentence creating a contractual liability for PostQ. 16. Compliance Verification Customer will maintain records reasonably sufficient to verify its Usage Metric. Certification, audit frequency, notice, confidentiality, cost allocation, record retention, and protection against access to Customer source code are governed by this section. During the beta, PostQ may request no more than one written compliance certification on ten business days' notice, except when PostQ has a reasonable basis to suspect unauthorized distribution, production use, sanctions risk, or a material scope breach. Customer will retain entitlement, authorized-user, installation, and delivery records until six months after beta expiry. Each party bears its own verification costs. No verification right permits PostQ to access Customer source code, production systems, personal data, or privileged material without an express written agreement and appropriate safeguards. 17. Product Warranty The beta is free evaluation software and carries no product warranty, conformity commitment, service level, correction obligation, replacement obligation, refund right, or fitness commitment. PostQ may, in its discretion, provide an update, workaround, replacement build, or withdrawal notice. Any such action does not create a continuing warranty or support obligation. 18. Warranty Disclaimer EXCEPT FOR AN EXPRESS WARRANTY IN AN APPROVED SIGNED AGREEMENT, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE PRODUCT, REPORTS, DOCUMENTATION, THIRD-PARTY COMPONENTS, SUPPORT, AND RELATED MATERIALS ARE PROVIDED AS-IS AND AS-AVAILABLE. POSTQ DISCLAIMS OTHER EXPRESS, IMPLIED, STATUTORY, AND COMMON-LAW WARRANTIES, INCLUDING MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, QUIET ENJOYMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. POSTQ DOES NOT WARRANT UNINTERRUPTED OR ERROR-FREE OPERATION, COMPLETE DETECTION, COMPLETE PARAMETER RESOLUTION, COMPLETE REMEDIATION GUIDANCE, OR THAT THE PRODUCT WILL MEET EVERY REQUIREMENT. CUSTOMER IS RESPONSIBLE FOR BACKUPS, CHANGE CONTROL, TESTING, AND SAFE USE OF REPORTS. 19. Indemnification PostQ provides no defense, indemnity, contribution, reimbursement, or hold-harmless obligation for the free beta, Product, Reports, Documentation, Third-Party Components, support, or Customer's use. Customer will defend, indemnify, and hold harmless PostQ, its directors, officers, and personnel from third-party claims, proceedings, losses, and reasonable costs arising from Customer's unlawful or unauthorized scanning, production use, redistribution, Customer Content, violation of another party's rights, or material breach of the Agreement. PostQ will give reasonable notice and permit Customer to control the defense, provided Customer may not admit fault by PostQ or settle a claim against PostQ without PostQ's prior written approval. 20. Limitation Of Liability POSTQ HAS NO CONTRACTUAL LIABILITY ARISING FROM OR RELATED TO THE FREE BETA, PRODUCT, REPORTS, DOCUMENTATION, THIRD-PARTY COMPONENTS, SUPPORT, SUSPENSION, WITHDRAWAL, USE, OR INABILITY TO USE. POSTQ IS NOT LIABLE FOR DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, CONSEQUENTIAL, RELIANCE, COVER, LOSS-OF-PROFIT, LOSS-OF-REVENUE, LOSS-OF-DATA, LOSS-OF-GOODWILL, BUSINESS- INTERRUPTION, SECURITY, COMPLIANCE, REMEDIATION, OR PROCUREMENT DAMAGES OR CLAIMS, WHETHER BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, STATUTE, OR ANOTHER THEORY, EVEN IF ADVISED OF THEIR POSSIBILITY. POSTQ'S AGGREGATE LIABILITY IS ZERO. CUSTOMER ACCEPTS THIS RISK ALLOCATION AS A CONDITION OF ACCESS TO THE FREE, PRE-RELEASE EVALUATION. 21. Term, Suspension And Termination The Entitlement term is stated in the Order. Subscription rights expire unless renewed. Perpetual rights, if offered, continue subject to the Agreement, while support and updates expire as stated in the Order. The beta expires automatically at the end of the Entitlement term without renewal or conversion. Customer may stop use at any time. PostQ may suspend or terminate access immediately for production use, unauthorized distribution, unlawful scanning, sanctions/export concern, security risk, material breach, or product recall, and may otherwise terminate the free beta on written notice. Because the beta is free and pre-release, PostQ has no termination-assistance obligation. On expiration or termination, Customer must stop using and delete the affected PostQ proprietary Product and license material, subject to approved backup-retention rules. Customer may retain Reports and Customer Content. Termination of PostQ proprietary rights does not terminate rights Customer received directly under an applicable third-party license. 22. Compliance With Law, Export And Sanctions Each party will comply with law applicable to its performance. Customer is responsible for authority to scan relevant repositories, systems, and code and for applicable employment, privacy, monitoring, computer-misuse, import, export, sanctions, and cryptography requirements. Customer must not export, re-export, transfer, or use the Product in violation of applicable trade controls or for prohibited parties or end uses. Customer represents that it, its beneficial owners, Authorized Users, destination countries, and intended end uses have been accurately disclosed for PostQ's screening. Customer must not use or transfer the Product for prohibited military, intelligence, weapons, surveillance, malicious cyber, sanctioned, or unlawful purposes. Each party will comply with anti-bribery and anti-corruption law applicable to its conduct. PostQ may reject, suspend, or revoke access when screening, authorization, or legal requirements are not satisfied. 23. Government Use Government bodies, public-sector entities, state-owned entities acting under public procurement, and their contractors are not eligible for this first beta unless PostQ management and qualified counsel separately approve the entity, country, procurement terms, government-rights language, and exact Entitlement in writing before delivery. 24. Assignment Customer must not assign, transfer, delegate, sublicense, or make the Agreement, Entitlement, or Product available to another entity, Affiliate, contractor, successor, or acquirer without PostQ's prior written approval. An unauthorized assignment is void and may result in immediate revocation. PostQ may assign the Agreement to an Affiliate or in connection with a merger, reorganization, financing, sale of substantially all relevant assets, or change of control, provided the assignee assumes PostQ's applicable obligations. The Agreement binds permitted successors and assigns. 25. Force Majeure Neither party is responsible for delay caused by events beyond its reasonable control, except obligations that should not be excused under the approved commercial position. The affected party must promptly notify the other party where practicable and use reasonable efforts to mitigate and resume performance. Because the beta is free, no payment adjustment applies. Either party may end the affected beta participation if the event continues for more than thirty days. This section does not excuse confidentiality, security, deletion, export-control, or unauthorized-use obligations. 26. Notices Formal notices must use the methods and contacts stated in the Order. Notices to PostQ must also be sent to: POSTQ SOFTWARE LABS PRIVATE LIMITED Registered office: C 708 Sargam, Nanded City, Pune- 411068, Maharashtra, India CIN: U62010PN2026PTC252785 Legal notices: contact@postqsoftwarelabs.com Formal notices may be sent by email to the notice address in the Order and, for termination, dispute, or legal-process notices, also by tracked courier to the registered or business address in the Order. Email notice is received on the next business day after transmission if no delivery- failure message is received. Courier notice is received on documented delivery. A party must give at least five business days' notice of a changed notice address. Routine support messages are not formal legal notices. 27. Governing Law And Disputes The Agreement is governed by the laws of India without giving effect to conflict-of-law principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply. Before filing a non-urgent claim, authorized representatives of the parties will attempt in good faith to resolve the dispute for fifteen business days after written notice. The courts having jurisdiction in Pune, Maharashtra, India have exclusive jurisdiction, and each party submits to those courts. Proceedings and notices will be in English. Either party may seek urgent interim or injunctive relief from a court with jurisdiction when necessary to protect confidential information, intellectual property, security, or prevent unauthorized use. 28. General The approved Agreement and incorporated documents constitute the entire agreement for the Product and supersede prior proposals on that subject. Amendments must follow the approved written-change process. Failure to enforce a provision is not a waiver. If a provision is unenforceable, it will be handled under the approved severability rule without expanding restricted rights. The parties are independent contractors. The Agreement creates no partnership, joint venture, agency, fiduciary, franchise, or employment relationship. Headings are for convenience. The approved language and interpretation rules control. Electronic signatures and counterparts are effective to the extent permitted by law. No person is a third-party beneficiary except where an applicable third-party license or approved agreement expressly provides otherwise. 29. Electronic Acceptance Electronic acceptance is effective only through a mechanism approved for the applicable sales and deployment channel. The mechanism must present the exact agreement version and retain appropriate evidence. Download, extraction, installation, image pull, or unattended execution must not be represented as affirmative acceptance unless counsel has approved that model. 30. Survival Accrued payment, ownership, restrictions, confidentiality, third-party rights, warranty disclaimer, liability, dispute, retained Report rights, and other provisions that by nature should survive will survive as stated in the approved final agreement. --- Corporate identification: POSTQ SOFTWARE LABS PRIVATE LIMITED, CIN U62010PN2026PTC252785. GSTIN 27AAQCP7811H1Z0 may be included in an Order where required. Copyright notice for verified PostQ-owned material: Copyright (c) 2026 POSTQ SOFTWARE LABS PRIVATE LIMITED. All rights reserved.