Master Service Agreement

Standard form · Last updated: June 2026 · Version 1.0

1. Definitions

"Agreement" means this MSA together with all Order Forms, the Data Processing Addendum, and the Service Level Agreement incorporated by reference. "Services" means the EVE AI Core platform and EVE CoreGuard governance services described in an Order Form. "Order Form" means an ordering document executed by the parties that specifies the Services, fees, term, and deployment model. "Customer Data" means data the Customer submits to the Services. "Documentation" means EVE's then-current published technical documentation. "Evidence Records" means the signed, tamper-evident decision and audit records the Services generate.

2. Services & Order Forms

EVE will provide the Services identified in each Order Form in accordance with this Agreement, the applicable SLA, and the Documentation. Each Order Form is governed by this MSA; if an Order Form conflicts with this MSA, the Order Form controls for that order only. EVE may update the Services provided it does not materially reduce the core functionality or security of a Service during a paid term. Available deployment models (SaaS, Customer VPC, Private Cloud, On-Prem) are described at /deployment.

3. Fees & Payment

Customer will pay the fees set out in the applicable Order Form. Unless stated otherwise, fees are invoiced annually in advance, due net 30 days from the invoice date, non-cancellable, and non-refundable except as expressly provided in this Agreement or the SLA (service credits). Fees are exclusive of taxes; Customer is responsible for applicable taxes other than taxes on EVE's net income. Undisputed overdue amounts may accrue interest at the lesser of 1.5% per month or the maximum permitted by law.

4. Term & Termination

This Agreement begins on the effective date of the first Order Form and continues while any Order Form is in effect. Each Order Form term auto-renews for successive equal periods unless either party gives written notice of non-renewal at least 30 days before the end of the then-current term. Either party may terminate for the other's material breach not cured within 30 days of written notice. On termination, Customer's right to use the Services ends, EVE will make Customer Data available for export for 30 days, and EVE will then delete Customer Data in accordance with the DPA. Sections that by their nature should survive (e.g., 3, 6, 7, 11, 12, 15) survive termination.

5. Customer Responsibilities

Customer is responsible for: (a) the accuracy and legality of Customer Data and for having the rights necessary to submit it; (b) configuring its governance policies and reviewing Evidence Records; (c) maintaining the confidentiality of its credentials and API keys; and (d) complying with the acceptable-use terms in EVE's Terms of Service. The Services support, but do not replace, the Customer's own legal and compliance obligations.

6. Intellectual Property

As between the parties, EVE owns all right, title, and interest in the Services, the Documentation, and EVE's underlying technology, including all intellectual property rights therein (EVE's portfolio is summarized at /ip). Customer owns its Customer Data and the Evidence Records generated from its decisions. EVE grants Customer a non-exclusive, non-transferable right to use the Services during the term per the Order Form. Customer grants EVE a limited license to process Customer Data solely to provide and support the Services. EVE may use aggregated, de-identified data that does not identify Customer or any individual to operate and improve the Services.

7. Confidentiality

Each party may receive the other's "Confidential Information." The receiving party will use it only to perform under this Agreement, protect it with at least reasonable care, and not disclose it except to personnel and advisors who need to know and are bound by confidentiality obligations. Confidential Information excludes information that is public through no fault of the receiving party, independently developed, or rightfully received from a third party. Either party may disclose Confidential Information as required by law, with prompt notice where permitted.

8. Data Protection & Security

The parties' data-protection obligations are set out in the Data Processing Addendum, which is incorporated into this Agreement. EVE maintains the technical and organizational security measures described in the DPA and at /security, and will notify Customer of a personal-data breach affecting Customer Data without undue delay and within 72 hours of becoming aware. Where an Order Form specifies a non-SaaS deployment, data residency and isolation are governed by that deployment model.

9. Service Levels & Support

EVE will provide the availability, latency, incident-response, and support commitments in the SLA for the tier purchased in the Order Form. Service credits described in the SLA are Customer's sole and exclusive remedy for EVE's failure to meet the committed availability levels.

10. Warranties

EVE warrants that the Services will perform materially in accordance with the Documentation during the term and that it will provide the Services in a professional and workmanlike manner. If the Services do not conform, EVE will use commercially reasonable efforts to correct the non-conformity; if it cannot within a reasonable period, Customer may terminate the affected Order Form and receive a pro-rata refund of pre-paid, unused fees. Except as expressly stated, the Services are provided "as is," and EVE disclaims all other warranties, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement. The Services produce governance evidence and enforcement; they are not legal, financial, or professional advice, and EVE does not warrant any specific regulatory outcome.

11. Indemnification

EVE will defend Customer against third-party claims that the Services, as provided, infringe a U.S. patent, copyright, or trademark, and will pay resulting damages finally awarded or agreed in settlement, provided Customer promptly notifies EVE, gives EVE control of the defense, and reasonably cooperates. EVE has no obligation for claims arising from Customer Data, Customer's combination of the Services with other items not provided by EVE, or use outside the Documentation. Customer will defend EVE against third-party claims arising from Customer Data or Customer's use of the Services in breach of this Agreement. These indemnities are each party's sole liability and exclusive remedy for the covered third-party claims.

12. Limitation of Liability

Except for the excluded matters below, each party's total aggregate liability arising out of or related to this Agreement will not exceed the fees paid or payable by Customer under the applicable Order Form in the 12 months preceding the event giving rise to the claim. Neither party will be liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or data, even if advised of the possibility. The cap and exclusions do not apply to: a party's confidentiality breach, Customer's payment obligations, either party's indemnification obligations, or liability that cannot be limited under applicable law. Enterprise Order Forms may negotiate a higher, super-cap for specific matters such as data-security breaches.

13. Insurance

EVE will maintain commercially reasonable insurance coverage appropriate to a company of its size and the Services it provides. Specific coverage types and limits (including technology errors-and-omissions and cyber liability) are confirmed in the Order Form or upon request during diligence; EVE will provide a certificate of insurance to Customer where required.

14. Publicity & References

Neither party will use the other's name or marks in publicity without prior written consent. The parties may separately agree, in an Order Form or in writing, to a reference relationship, a logo use, or a case study; any such use remains subject to the referencing party's prior approval of the specific materials.

15. General

This Agreement, including its Order Forms, DPA, and SLA, is the entire agreement between the parties on its subject matter and supersedes prior proposals. It may be amended only in writing signed by both parties (an Order Form may add terms for that order). Neither party may assign this Agreement without the other's consent, except to an affiliate or in connection with a merger or sale of substantially all assets, with notice. Neither party is liable for delays caused by events beyond its reasonable control (force majeure). This Agreement is governed by the laws of the State of Georgia, USA, excluding its conflict-of-laws rules, and the parties consent to the exclusive jurisdiction of the state and federal courts located there, unless otherwise agreed in an Order Form. If any provision is unenforceable, the remainder stays in effect. Notices must be in writing to the addresses in the Order Form. The parties are independent contractors.