VitaRemote Agent End User Licence Agreement

This VitaRemote Agent End User Licence Agreement (the "Agreement") is between Vitabyte, Inc., a New York corporation with its principal office at 3525 30th Ave, Suite 306, Astoria, NY 11103 ("Vitabyte", "we", "us"), and the organization on whose behalf it is accepted (the "Customer", "you").

VitaRemote is a remote monitoring and management service. It includes:

• the VitaRemote agents for Windows, macOS, Linux and Android, their installers, updaters and helper services (the "Agents");
• the VitaRemote web console, including remote sessions, the terminal and run-command feature, file transfer, device inventory, patching, scripts and alerts (the "Console");
• enrollment tokens, device certificates, licence checks and the protocols the Agents use to reach our services; and
• the documentation we publish for any of the above.

Together these are the "Software".

This Agreement is an addendum to the Vitabyte Terms of Service (the "Terms"), and the Acceptable Use Policy applies to all use of the Software. The Terms govern everything this Agreement does not address, including governing law, venue, limits of liability, liquidated damages, injunctive relief and acceptance records. If this Agreement and the Terms conflict on a subject this Agreement covers, this Agreement controls on that subject.

This Agreement is accepted once, by an administrator of your organization, when the organization first enrolls a device or creates an enrollment token. The administrator ticks the unchecked acceptance box and types their full name and title. That typed name and title is an electronic signature that binds the organization.

That acceptance covers every Agent enrolled under your organization, now and later, including Agents enrolled by other administrators or by an installer you distribute. Individual device users are not asked to accept separately; you are responsible for them under Section 4.

We record each acceptance with the document version, a SHA-256 hash of the text shown, the time, the IP address and the user agent, in an append-only log. You agree these records are reliable evidence of acceptance.

Subject to your compliance with this Agreement, the Terms and payment of the applicable fees, Vitabyte grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence, for the term of your subscription, to:

• install and run the Agents, in object code form only, on the number of devices covered by your subscription (the "Licensed Devices"); and
• use the Console to monitor and manage those Licensed Devices,

solely for your internal business purposes or, if your subscription is a managed-service plan, to provide managed IT services to your own clients under Section 5.

Licences are counted per device. A device counts while its Agent is enrolled, until you remove it in the Console. Re-imaging or cloning a device does not create a new licence; a cloned Agent identity must be re-enrolled.

We license the Software; we do not sell it. Vitabyte and its licensors keep all right, title and interest in the Software and all copies, updates and derivative works. All rights not expressly granted are reserved.

By enrolling a device, the administrator represents and warrants, on behalf of the Customer, that:

1. the Customer owns the device, or is authorized by its owner to install the Agent and manage it in the ways the Console allows;
2. the Customer has given every notice, and obtained every consent, that applicable law requires from the people who use the device, before the Agent collects data or anyone connects to it;
3. the Customer will keep those notices and consents current while the Agent is installed; and
4. the Customer will not enroll a device that belongs to a person or organization that has not authorized it.

Employee monitoring laws. Some laws require an employer to give written notice before monitoring employees' telephone, email or internet use, or before accessing an employee's device. For example, New York Civil Rights Law §52-c requires a New York employer that monitors employee electronic communications or internet usage to give prior written notice on hiring, obtain an acknowledgment, and post the notice in a conspicuous place. Other states and countries have similar or stricter rules, and some protect personal devices, private communications or works councils. Compliance with these laws is your responsibility. Vitabyte does not know who uses your devices and does not give these notices for you.

Personal devices. If you enroll a device that an employee or contractor owns, you must obtain that person's express written authorization first, limit your access to what that authorization covers, and remove the Agent when the authorization ends.

You will defend and indemnify Vitabyte against any claim arising from a breach of this Section, as described in the Terms.

If your plan allows you to manage devices for your own clients, you also represent that each client has authorized you to do so in writing, that you have passed on the obligations in Section 4 to that client, and that you remain responsible to Vitabyte for every device you enroll and every act taken through your Console. Your clients receive no licence from Vitabyte and have no rights against Vitabyte under this Agreement.

Unattended access is your choice. The Software can let Console users connect to a device, run commands and transfer files without a person at the device approving each session. Whether to enable unattended access, for which devices and for which Console users, is your decision and your responsibility. If you enable it, you accept the risks of access without a local prompt, including access while a user is present and unaware.

Agents run with elevated privileges. To perform inventory, patching, scripting and remote control, Agents run as a system service with administrator or root rights. A command run through the Console can change or erase anything on the device. You are responsible for:

• deciding who holds Console accounts and what roles and device groups each may reach;
• requiring strong authentication for every Console user, including multi-factor authentication where offered;
• removing Console access promptly when a person leaves or changes role;
• reviewing scripts and commands before you run them, especially across groups of devices; and
• every action taken through your Console accounts, whether or not you authorized it.

You must not, and must not allow anyone to:

1. reverse engineer, decompile, disassemble or attempt to derive the source code, structure or algorithms of the Agents, installers, updaters, Console code or the protocols they use, except only to the extent applicable law expressly forbids this restriction, and then only after a written request sent by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103 that we have not answered within a reasonable time;
2. modify, repackage, re-sign or redistribute an Agent or installer, or run a modified build;
3. extract, copy, publish or reuse an enrollment token, device certificate, signing key, API credential or session key, or enroll a device with a token issued for a different organization;
4. intercept, proxy or alter traffic between an Agent and our services, or impersonate an Agent or our services;
5. use the Software to access, monitor or control any device, network or account without the authority of its owner, or beyond the authority you were given;
6. use the Software to conceal your presence from a device's user where the law requires notice, or to collect credentials, keystrokes or private communications unlawfully;
7. use the Software to deploy malware, ransomware, cryptominers or any code designed to harm, or to evade security tools other than with the device owner's authority;
8. use the Software, its output, or information learned from it to build, train, design or improve a competing remote monitoring and management product;
9. publish or disclose benchmarks, performance tests or comparisons of the Software without our prior written consent;
10. rent, lease, sell, sublicense or provide the Software to a third party other than as allowed in Section 5; or
11. use the Software in breach of law or the Acceptable Use Policy.

Enrollment tokens, device certificates, Agent identity, licence checks and per-device counts are technological measures that control access to the Software and protect our copyrighted works. Circumventing, disabling, spoofing or replaying them, or helping anyone else do so, may violate 17 U.S.C. §1201 in addition to this Agreement. We reserve every remedy available under that statute and under the Terms.

Vitabyte will:

• sign Agent builds and updates, and have Agents verify signatures before installing them;
• encrypt traffic between Agents, the Console and our services in transit;
• authenticate each Agent with its own device identity and let you revoke it;
• keep an audit log of Console sign-ins, remote sessions, commands and file transfers, available to your administrators;
• maintain reasonable administrative, technical and physical safeguards for our services, as described in the Terms and the Data Processing Addendum; and
• notify you without undue delay after we confirm a security incident affecting your data.

You will:

• keep enrollment tokens secret, set them to expire, and revoke any that may have been exposed;
• protect Console credentials and enforce strong authentication for your users;
• keep enrolled devices' operating systems supported and protected;
• review audit logs and respond to alerts; and
• tell us in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103, sent within 24 hours of learning that a Console account, enrollment token or Agent identity of yours may have been compromised.

Agents collect and send to our services data needed to provide VitaRemote, which may include:

• hardware and software inventory, installed applications, patch status and configuration;
• telemetry such as performance, health, uptime and event logs;
• remote session records, including who connected, when and for how long;
• commands and scripts run, and their output; and
• files you choose to transfer.

This data may contain personal data about device users. As between the parties, it is your Customer Data. We process it on your instructions as your processor under the Data Processing Addendum and our Privacy Policy, and retain it according to your settings and our retention schedule. You are responsible for having a lawful basis to collect it and for not directing the Agents to collect more than you need.

We also collect information about the Agents themselves, such as version, platform, enrollment status, errors and licence usage, to operate, secure and improve the Software and to measure licence counts.

Agents update themselves. You agree that we may deliver updates, security fixes and configuration changes automatically. You may choose an update channel or schedule where the Console offers one, but we may require an update that fixes a security issue, and we may stop an outdated Agent from connecting until it updates.

The Software is not designed or licensed for use in high-risk environments where a failure, delay or unexpected command could lead to death, personal injury, or serious physical or environmental damage. You must not install Agents on, or use the Software to control:

• life-support, medical treatment or patient-monitoring equipment;
• the control systems of critical infrastructure, including power generation and distribution, water treatment, gas pipelines, air traffic, rail signalling or nuclear facilities;
• industrial control systems or safety instrumented systems; or
• weapons or emergency dispatch systems.

Office and administrative computers within such an organization are not excluded, provided the Software is not used to control the equipment itself.

The Agents report enrollment and device counts to us automatically, and we may rely on those reports for billing. In addition, not more than once in any 12-month period and on at least 30 days' written notice, we or an independent auditor bound by confidentiality may review your records reasonably needed to verify device counts and compliance with this Agreement, during normal business hours. If you used more devices than you paid for, you will pay the shortfall at our then-current rates within 30 days, and if the shortfall exceeds 5% of the fees due for the period reviewed, you will also reimburse our reasonable costs of the review.

We may suspend an Agent, an enrollment token, a Console account or your organization's access, with or without notice, if we reasonably believe the Software is being used without authority over a device, in breach of Section 7 or 8, in a way that threatens the security of any person or system, or if fees are overdue as described in the Terms. We may also act on a credible report from a device owner that it did not authorize management. We will restore access once the cause is resolved.

This Agreement lasts as long as you have an active VitaRemote subscription, unless ended earlier under the Terms. We may end it immediately on written notice if you materially breach Section 4, 7 or 8.

When this Agreement ends, or when you stop managing a device:

1. your licence for the affected devices ends and you must stop using the Console for them;
2. you must uninstall each Agent, using the Console's uninstall command or the documented local uninstaller, from every device enrolled under your organization;
3. we may revoke Agent identities and enrollment tokens, after which remaining Agents stop working and may remove themselves on their next contact;
4. you may export Customer Data for the period stated in the Terms, after which we may delete it under our retention schedule; and
5. on request, an officer will certify in writing that you have done the above.

Sections 3 (ownership), 4, 5, 6, 7, 8, 10, 12, 13, 15, 16 and 17 survive termination, together with any accrued payment obligations.

Except as expressly stated in the Terms, the Software is provided "as is" and "as available". To the fullest extent permitted by law, Vitabyte disclaims all implied warranties, including merchantability, fitness for a particular purpose, title and non-infringement. Vitabyte does not warrant that a patch, script or command will succeed or will not affect a device adversely.

The limits and exclusions of liability in the Terms apply. Without limiting them, Vitabyte is not liable for the results of commands, scripts, patches or file transfers that you or your Console users run, for unattended access you enable, for your failure to give notice or obtain consent under Section 4, or for use in breach of Section 12.

A breach of Section 4, 7 or 8 could cause Vitabyte, device users and third parties irreparable harm for which money damages alone would not be adequate. Vitabyte may seek injunctive relief, specific performance and other equitable relief in addition to any other remedy, without posting a bond where the law allows. The liquidated damages provisions of the Terms apply to unauthorized use, circumvention and over-deployment of the Software, in addition to the fees owed for that use.

The Software may be subject to US export control and sanctions laws. You must not export, re-export or provide access to the Software, or install an Agent on a device located, in violation of those laws, including in any embargoed country or region or for any person on a US government restricted list.

The Agents and Console include open-source components. A list of them and their licences is available in the Console and on request in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103. Where an open-source licence grants rights this Agreement would otherwise restrict for that component, that licence controls for that component only.

You may not assign this Agreement without our written consent. If any provision is held unenforceable, it will be enforced to the maximum extent permitted and the rest remains in effect. A failure to enforce is not a waiver. We may update this Agreement with notice of any material change, and an administrator will be asked to accept the new version before it applies, except where a change is required by law or for security.

Questions and notices about this Agreement: in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103

Signed for Vitabyte, Inc.: George Karabelas, Chief Executive Officer, Vitabyte, Inc.