POSTQ SOFTWARE PRODUCT LICENSE AGREEMENT

Licensor: POSTQ SOFTWARE LABS PRIVATE LIMITED
Agreement version: 1.0.0-Beta
Revision date: 8 September 2026
Effective date: 8 September 2026
Classification: PostQ Code Scanner-Beta private invite-only evaluation release

1. Scope And Acceptance

This PostQ Software Product License Agreement (the Agreement) governs the installation, access,
and use of PostQ software identified in an Order by the customer identified in that Order
(Customer). PostQ means POSTQ SOFTWARE LABS PRIVATE LIMITED.

The Agreement applies only when an Order references it or when Customer validly accepts it through
an acceptance mechanism approved by PostQ. The individual accepting the Agreement represents that
the individual has authority to bind Customer. If Customer does not agree, or the individual lacks
authority, Customer must not install, access, or use the Product.

2. Definitions

Affiliate means an entity that directly or indirectly controls, is controlled by, or is under
common control with a party, where control means direct or indirect ownership of more than fifty
percent of the voting interests or the power to direct management and policies. No Affiliate has a
right to use the beta unless it is expressly named in the Order and individually approved by PostQ.

Authorized Environment means the repositories, projects, applications, systems, accounts,
networks, devices, instances, and deployment locations stated in the Order and controlled by
Customer or an expressly authorized Affiliate.

Authorized User means an employee or individual contractor whom Customer authorizes to use the
Product for Customer's internal business purposes and who is bound by confidentiality and use
restrictions appropriate to the Product.

Customer Content means source code, repositories, configuration, metadata, reports supplied by
Customer, credentials, logs, scan inputs, and other information submitted to or processed by the
Product on Customer's behalf. Customer Content does not include PostQ Materials.

Documentation means PostQ's then-current product, deployment, security, support, and technical
documentation supplied for the Product.

Entitlement means the authorized edition, term, metric, quantity, deployment model, environment,
Affiliate scope, support level, and other usage rights stated in an Order.

Order means an order form, entitlement schedule, quote accepted by PostQ, subscription
confirmation, or other signed or expressly accepted document that identifies Customer, Product,
Entitlement, and commercial terms.

PostQ Materials means, to the extent owned by or validly licensed to PostQ, the Product,
Documentation, proprietary rule packs, rule definitions, signatures, metadata, taxonomies,
classification models, mappings, scoring and assessment logic, recommendations, knowledge bases,
schemas, report structures and templates, user-interface elements, algorithms, methods, updates,
and related PostQ materials. PostQ Materials exclude Customer Content and Third-Party Components.

Product means PostQ software, rule packs, extensions, plug-ins, command-line tools, containers,
viewers, updates, and associated modules identified in the Order.

Reports means findings, inventories, assessments, exports, and other output generated by the
Product from Customer Content.

Third-Party Components means software or materials owned by third parties and included with,
invoked by, or used through the Product, including open-source software.

Usage Metric means the licensed measurement stated in the Order, such as repositories,
applications, projects, scan runners, scans, processing capacity, Authorized Users, instances, or
enterprise scope.

3. Agreement Structure And Precedence

Unless a signed document expressly states otherwise, the order of precedence is:

1. a signed negotiated master agreement or amendment;
2. the Order, for Entitlement and commercial details;
3. product-specific terms referenced by the Order;
4. this Agreement;
5. applicable support, privacy, security, services, and data-processing schedules; and
6. Documentation for operational detail.

Customer purchase-order or portal terms do not modify the Agreement unless PostQ expressly signs
them. An applicable third-party license governs its Third-Party Component to the extent it grants
rights directly to Customer or cannot lawfully be superseded. Nothing in the Agreement reduces a
right preserved by mandatory law or an applicable open-source license.

4. License Grant

Subject to payment of applicable fees and compliance with the Agreement, PostQ grants Customer a
limited, non-exclusive, non-sublicensable, non-transferable except under Section 24, worldwide right
during the Entitlement term to install, execute, access, and use the Product in object-code form in
the Authorized Environment, solely for Customer's internal business purposes and within the Usage
Metric.

Customer may permit Authorized Users and service providers acting solely for Customer to exercise
the licensed rights. Customer remains responsible for their compliance and must prevent
unauthorized access. Affiliate rights, if any, exist only when the Order identifies the Affiliate or
approved Affiliate class.

Customer may make a reasonable number of archival, backup, and disaster-recovery copies. Production,
non-production, testing, high-availability, and disaster-recovery rights are limited to the Order.
No unlimited, enterprise-wide, perpetual, Affiliate, or service-provider right is implied.

All rights not expressly granted are reserved. No license is granted by implication, estoppel, or
otherwise.

5. Entitlement And Usage

Customer must not exceed its Usage Metric. Treatment of monorepositories, forks, branches, archived
repositories, temporary projects, CI/CD runners, non-production environments, contractors, and
Affiliates is determined by the Order and the approved measurement policy.

Customer must protect license keys, activation data, entitlement files, and access credentials and
notify PostQ of suspected misuse. PostQ may use technical controls that are described in the
Documentation and proportionate to the Entitlement. Such controls must not remove rights applicable
to Third-Party Components.

6. Restrictions

Except as expressly permitted by the Agreement, mandatory law, or an applicable Third-Party
Component license, Customer must not:

1. sell, resell, rent, lease, sublicense, distribute, publish, transfer, or make the Product
   available to a third party;
2. use the Product to provide a bureau, hosted, managed-scanning, outsourcing, or similar service for
   third parties unless the Order authorizes it;
3. copy, modify, translate, adapt, or create derivative works of PostQ proprietary code or materials
   except as expressly authorized;
4. reverse engineer, decompile, disassemble, or attempt to derive non-public PostQ source, rules,
   signatures, mappings, models, algorithms, or protection mechanisms;
5. bypass license, usage, security, encryption, signing, or technical controls;
6. remove or alter copyright, trademark, confidentiality, attribution, patent, or other notices;
7. extract, publish, redistribute, sublicense, or commercially reuse PostQ proprietary rule packs,
   rule text, signatures, taxonomies, mappings, assessment logic, recommendations, or knowledge-base
   relationships as a separate product, dataset, or service;
8. use protected PostQ Materials, Confidential Information, non-public rules, signatures, mappings,
   or assessment logic to create, train, validate, or improve a competing scanner or substantially
   equivalent proprietary detection library, except for independently developed material that does
   not use protected PostQ material and to the extent mandatory law permits the activity; or
9. use the Product unlawfully, without authority to scan the relevant code or systems, or to develop
   or introduce malicious code.

The reverse-engineering and circumvention restrictions do not apply where non-waivable law or an
applicable third-party/open-source license expressly preserves the activity, including modification
or debugging rights for an LGPL-covered component. Customer may independently develop products
without using PostQ Confidential Information or copying protected expression.

Internal validation and benchmarking for the approved evaluation are permitted subject to
confidentiality and security duties. Customer must not publish benchmark results, comparative
claims, screenshots, reports, performance measurements, or competitive evaluations concerning the
beta without PostQ's prior written approval for the specific publication.

7. Evaluation, Trial, Beta And Preview Use

Evaluation duration, metric, deployment, and conversion rights must be stated in an Order or
approved evaluation notice. Evaluation, trial, beta, preview, and early-access versions are limited
to non-production use unless PostQ expressly authorizes otherwise. They may be incomplete, may
change, and may be withdrawn.

To the maximum extent permitted by law, pre-release and no-fee materials are provided as-is without
service levels or warranties. Customer must independently validate them before relying on output.

8. Ownership

PostQ and its licensors retain all right, title, and interest in PostQ Materials and their
intellectual-property rights. Delivery of a copy does not transfer ownership. Third-Party Components
remain owned by their respective owners and are governed by their applicable licenses.

PostQ ownership claims apply only to material PostQ owns or is entitled to license. Repository
location, encryption, compilation, or distribution does not remove third-party rights or cure an
ownership defect.

9. Customer Content And Reports

Customer and its licensors retain ownership of Customer Content. Customer grants PostQ a limited,
non-exclusive right to process Customer Content only as necessary to provide, secure, support, and
perform the Product and Agreement, or as Customer otherwise instructs in writing.

Customer may use, reproduce, modify, and share Reports for its internal security, engineering,
compliance, audit, procurement, remediation, and governance purposes, including with Affiliates,
professional advisers, auditors, regulators, and service providers subject to appropriate duties.
The Order may grant broader distribution rights.

As between the parties, Customer retains customer-specific facts, Customer Content, and findings
describing Customer's environment. PostQ retains PostQ Materials underlying the Reports, including
generic report formats, templates, taxonomies, methods, and know-how. No clause transfers Customer's
source code or customer-specific facts to PostQ.

10. Feedback

Customer may provide feedback voluntarily. Subject to Customer's confidentiality obligations,
Customer grants PostQ a worldwide, perpetual, irrevocable, royalty-free right to use feedback to
improve PostQ products without identifying Customer or disclosing Customer Confidential Information.
Customer is not required to provide feedback.

11. Third-Party And Open-Source Software

PostQ identifies distributed Third-Party Components in release-specific notices and includes
applicable license texts and source information with the distribution. An applicable third-party
license governs the relevant component where its terms cannot lawfully be superseded or grant
rights directly to Customer.

PostQ proprietary restrictions do not independently apply to a Third-Party Component where that
would conflict with its license. Where a license requires corresponding source, modification source,
relinking material, installation information, attribution, or a written offer, PostQ will provide or
identify that material in the release legal package.

Third-party licensors do not endorse PostQ. Customer is responsible for separately obtained tools,
customer-supplied plug-ins, and optional third-party services it enables.

12. Data Handling, Privacy, Telemetry And External Services

The reviewed self-managed Product processes source and reports in Customer-controlled environments
unless Customer configures an external integration. No telemetry, hosted processing, external AI
transmission, or PostQ access should be represented as enabled unless the applicable Product version,
Documentation, and Order establish that behavior.

If PostQ processes personal data or Customer Content outside Customer's environment, the parties
will apply an approved data-processing, privacy, security, retention, and deletion schedule. PostQ
will not use Customer Content to train a general-purpose or shared machine-learning model unless
Customer expressly agrees in writing.

Customer is responsible for lawful authority to scan and process Customer Content and for avoiding
submission of secrets or regulated data to integrations not approved for that data class.

13. Nature And Limits Of Scanner Results

The Product performs automated static analysis and related deterministic assessments. Results may
contain false positives, false negatives, incomplete traces, unresolved parameters, and findings
affected by language support, build configuration, generated code, obfuscation, binaries, runtime
behavior, unavailable dependencies, reflection, environment values, or custom cryptography.

The Product and Reports are decision-support tools. They do not replace secure development,
architecture review, threat modelling, penetration testing, cryptographic engineering, legal or
regulatory advice, accredited testing, certification, or independent validation.

A FIPS-related result is not a FIPS 140 validation, NIST certification, accredited-laboratory
determination, or government approval. A post-quantum, quantum-readiness, migration, or
crypto-agility result does not guarantee that an application is secure, compliant, quantum safe, or
free of vulnerable cryptography. PostQ does not warrant that every cryptographic asset,
vulnerability, policy issue, dependency, or remediation requirement will be detected.

Customer is responsible for validating findings, deciding remediation, testing changes, managing
cryptographic risk, and obtaining required professional advice or certification.

14. Support, Maintenance, Updates And Upgrades

Support tier, response objectives, maintenance period, update rights, and supported versions are
only those stated in the Order or an incorporated support schedule. Customer must maintain supported
operating systems, runtimes, and Product versions and provide reasonably required diagnostic data.

Updates to an entitled Product are governed by the Agreement unless supplied under separate terms.
New editions, modules, hosted services, or material functionality may require a new Order.

15. Confidentiality

Confidentiality obligations in a signed master agreement control. If no signed confidentiality
agreement applies, each recipient will use the other party's non-public information only for the
Agreement, protect it with at least reasonable care, and disclose it only to personnel and advisers
with a need to know and corresponding duties.

Confidential Information excludes information the recipient can document is public without breach,
lawfully known without restriction, lawfully received from another source without duty, or
independently developed without use of the discloser's information.

PostQ Confidential Information includes non-public code, proprietary rules, signatures, mappings,
algorithms, roadmaps, security information, license controls, pricing, and protected Documentation.
Customer Confidential Information includes Customer Content, non-public Reports, credentials,
architecture, and security findings.

A recipient may disclose information when legally compelled, after notice where lawful and
reasonable assistance. Each party acknowledges that unauthorized use or disclosure of Confidential
Information may cause harm for which monetary damages are inadequate. The affected party may seek
injunctive or other equitable relief from a court with jurisdiction, in addition to available
remedies, without this sentence creating a contractual liability for PostQ.

16. Compliance Verification

Customer will maintain records reasonably sufficient to verify its Usage Metric. Certification,
audit frequency, notice, confidentiality, cost allocation, record retention, and protection against
access to Customer source code are governed by this section. During the beta, PostQ may request no
more than one written compliance certification on ten business days' notice, except when PostQ has
a reasonable basis to suspect unauthorized distribution, production use, sanctions risk, or a
material scope breach. Customer will retain entitlement, authorized-user, installation, and
delivery records until six months after beta expiry. Each party bears its own verification costs.

No verification right permits PostQ to access Customer source code, production systems, personal
data, or privileged material without an express written agreement and appropriate safeguards.

17. Product Warranty

The beta is free evaluation software and carries no product warranty, conformity commitment,
service level, correction obligation, replacement obligation, refund right, or fitness commitment.
PostQ may, in its discretion, provide an update, workaround, replacement build, or withdrawal
notice. Any such action does not create a continuing warranty or support obligation.

18. Warranty Disclaimer

EXCEPT FOR AN EXPRESS WARRANTY IN AN APPROVED SIGNED AGREEMENT, AND TO THE MAXIMUM EXTENT PERMITTED BY
LAW, THE PRODUCT, REPORTS, DOCUMENTATION, THIRD-PARTY COMPONENTS, SUPPORT, AND RELATED MATERIALS ARE
PROVIDED AS-IS AND AS-AVAILABLE. POSTQ DISCLAIMS OTHER EXPRESS, IMPLIED, STATUTORY, AND COMMON-LAW
WARRANTIES, INCLUDING MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE,
TITLE, NON-INFRINGEMENT, ACCURACY, QUIET ENJOYMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR
USAGE OF TRADE.

POSTQ DOES NOT WARRANT UNINTERRUPTED OR ERROR-FREE OPERATION, COMPLETE DETECTION, COMPLETE PARAMETER
RESOLUTION, COMPLETE REMEDIATION GUIDANCE, OR THAT THE PRODUCT WILL MEET EVERY REQUIREMENT. CUSTOMER
IS RESPONSIBLE FOR BACKUPS, CHANGE CONTROL, TESTING, AND SAFE USE OF REPORTS.

19. Indemnification

PostQ provides no defense, indemnity, contribution, reimbursement, or hold-harmless obligation for
the free beta, Product, Reports, Documentation, Third-Party Components, support, or Customer's use.

Customer will defend, indemnify, and hold harmless PostQ, its directors, officers, and personnel
from third-party claims, proceedings, losses, and reasonable costs arising from Customer's unlawful
or unauthorized scanning, production use, redistribution, Customer Content, violation of another
party's rights, or material breach of the Agreement. PostQ will give reasonable notice and permit
Customer to control the defense, provided Customer may not admit fault by PostQ or settle a claim
against PostQ without PostQ's prior written approval.

20. Limitation Of Liability

POSTQ HAS NO CONTRACTUAL LIABILITY ARISING FROM OR RELATED TO THE FREE BETA, PRODUCT, REPORTS,
DOCUMENTATION, THIRD-PARTY COMPONENTS, SUPPORT, SUSPENSION, WITHDRAWAL, USE, OR INABILITY TO USE.
POSTQ IS NOT LIABLE FOR DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, CONSEQUENTIAL,
RELIANCE, COVER, LOSS-OF-PROFIT, LOSS-OF-REVENUE, LOSS-OF-DATA, LOSS-OF-GOODWILL, BUSINESS-
INTERRUPTION, SECURITY, COMPLIANCE, REMEDIATION, OR PROCUREMENT DAMAGES OR CLAIMS, WHETHER BASED ON
CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, STATUTE, OR ANOTHER THEORY, EVEN IF ADVISED OF THEIR
POSSIBILITY. POSTQ'S AGGREGATE LIABILITY IS ZERO. CUSTOMER ACCEPTS THIS RISK ALLOCATION AS A
CONDITION OF ACCESS TO THE FREE, PRE-RELEASE EVALUATION.

21. Term, Suspension And Termination

The Entitlement term is stated in the Order. Subscription rights expire unless renewed. Perpetual
rights, if offered, continue subject to the Agreement, while support and updates expire as stated in
the Order.

The beta expires automatically at the end of the Entitlement term without renewal or conversion.
Customer may stop use at any time. PostQ may suspend or terminate access immediately for production
use, unauthorized distribution, unlawful scanning, sanctions/export concern, security risk,
material breach, or product recall, and may otherwise terminate the free beta on written notice.
Because the beta is free and pre-release, PostQ has no termination-assistance obligation.

On expiration or termination, Customer must stop using and delete the affected PostQ proprietary
Product and license material, subject to approved backup-retention rules. Customer may retain Reports
and Customer Content. Termination of PostQ proprietary rights does not terminate rights Customer
received directly under an applicable third-party license.

22. Compliance With Law, Export And Sanctions

Each party will comply with law applicable to its performance. Customer is responsible for authority
to scan relevant repositories, systems, and code and for applicable employment, privacy, monitoring,
computer-misuse, import, export, sanctions, and cryptography requirements.

Customer must not export, re-export, transfer, or use the Product in violation of applicable trade
controls or for prohibited parties or end uses. Customer represents that it, its beneficial owners,
Authorized Users, destination countries, and intended end uses have been accurately disclosed for
PostQ's screening. Customer must not use or transfer the Product for prohibited military,
intelligence, weapons, surveillance, malicious cyber, sanctioned, or unlawful purposes. Each party
will comply with anti-bribery and anti-corruption law applicable to its conduct. PostQ may reject,
suspend, or revoke access when screening, authorization, or legal requirements are not satisfied.

23. Government Use

Government bodies, public-sector entities, state-owned entities acting under public procurement,
and their contractors are not eligible for this first beta unless PostQ management and qualified
counsel separately approve the entity, country, procurement terms, government-rights language, and
exact Entitlement in writing before delivery.

24. Assignment

Customer must not assign, transfer, delegate, sublicense, or make the Agreement, Entitlement, or
Product available to another entity, Affiliate, contractor, successor, or acquirer without PostQ's
prior written approval. An unauthorized assignment is void and may result in immediate revocation.
PostQ may assign the Agreement to an Affiliate or in connection with a merger, reorganization,
financing, sale of substantially all relevant assets, or change of control, provided the assignee
assumes PostQ's applicable obligations. The Agreement binds permitted successors and assigns.

25. Force Majeure

Neither party is responsible for delay caused by events beyond its reasonable control, except
obligations that should not be excused under the approved commercial position. The affected party
must promptly notify the other party where practicable and use reasonable efforts to mitigate and
resume performance. Because the beta is free, no payment adjustment applies. Either party may end
the affected beta participation if the event continues for more than thirty days. This section does
not excuse confidentiality, security, deletion, export-control, or unauthorized-use obligations.

26. Notices

Formal notices must use the methods and contacts stated in the Order. Notices to PostQ must also be
sent to:

POSTQ SOFTWARE LABS PRIVATE LIMITED
Registered office: C 708 Sargam, Nanded City, Pune- 411068, Maharashtra, India
CIN: U62010PN2026PTC252785
Legal notices: contact@postqsoftwarelabs.com

Formal notices may be sent by email to the notice address in the Order and, for termination,
dispute, or legal-process notices, also by tracked courier to the registered or business address in
the Order. Email notice is received on the next business day after transmission if no delivery-
failure message is received. Courier notice is received on documented delivery. A party must give
at least five business days' notice of a changed notice address. Routine support messages are not
formal legal notices.

27. Governing Law And Disputes

The Agreement is governed by the laws of India without giving effect to conflict-of-law principles.
The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Before filing a non-urgent claim, authorized representatives of the parties will attempt in good
faith to resolve the dispute for fifteen business days after written notice. The courts having
jurisdiction in Pune, Maharashtra, India have exclusive jurisdiction, and each party submits to
those courts. Proceedings and notices will be in English. Either party may seek urgent interim or
injunctive relief from a court with jurisdiction when necessary to protect confidential
information, intellectual property, security, or prevent unauthorized use.

28. General

The approved Agreement and incorporated documents constitute the entire agreement for the Product
and supersede prior proposals on that subject. Amendments must follow the approved written-change
process. Failure to enforce a provision is not a waiver. If a provision is unenforceable, it will be
handled under the approved severability rule without expanding restricted rights.

The parties are independent contractors. The Agreement creates no partnership, joint venture,
agency, fiduciary, franchise, or employment relationship. Headings are for convenience. The approved
language and interpretation rules control. Electronic signatures and counterparts are effective to
the extent permitted by law.

No person is a third-party beneficiary except where an applicable third-party license or approved
agreement expressly provides otherwise.

29. Electronic Acceptance

Electronic acceptance is effective only through a mechanism approved for the applicable sales and
deployment channel. The mechanism must present the exact agreement version and retain appropriate
evidence. Download, extraction, installation, image pull, or unattended execution must not be
represented as affirmative acceptance unless counsel has approved that model.

30. Survival

Accrued payment, ownership, restrictions, confidentiality, third-party rights, warranty disclaimer,
liability, dispute, retained Report rights, and other provisions that by nature should survive will
survive as stated in the approved final agreement.

---

Corporate identification: POSTQ SOFTWARE LABS PRIVATE LIMITED, CIN
U62010PN2026PTC252785. GSTIN 27AAQCP7811H1Z0 may be included in an Order where required.

Copyright notice for verified PostQ-owned material: Copyright (c) 2026 POSTQ SOFTWARE LABS
PRIVATE LIMITED. All rights reserved.
