Muster.
Start free

legal

Master Subscription Agreement

Draft. This document is pending legal review and may change before it takes effect. Questions? Contact us.

Effective Date: [DATE] · Version: 1.0 (draft)

This Master Subscription Agreement ("MSA") governs the procurement and use of Muster Products and Services. For customers on the free tier, this MSA operates as the terms and conditions of use; for paying customers, it governs together with the Sales Order or other ordering document that references it. A single copy of this MSA may govern multiple Sales Orders or free-tier subscriptions between [MUSTER LEGAL ENTITY NAME] ("Muster") and the Customer, including their respective Affiliates.

1. Products and Services

1.1. Description. The Products and Services consist of: (i) a cloud-based platform that discovers, analyzes, and prioritizes security exposures across the Customer's designated assets, including [smart contracts, cloud infrastructure, external attack surface, DNS, and identity posture — CONFIRM SCOPE]; and (ii) front-end clients (such as the web interface, integrations, and system connectors) that allow retrieval, presentation, distribution, and management of the Customer's findings and overall security posture. Details of current features and functionality are described in the Documentation. The Products and Services are updated and enhanced on a continuous-delivery basis during the Subscription Term. Customer's purchase is not contingent on the delivery of any future functionality or features, nor on any oral or written public statements Muster makes about future functionality or features.

1.2. Professional Services. If the Customer procures Professional Services, their specifics will be described in the applicable Sales Order on a per-project basis. Muster does not provide custom deliverables that would qualify as work-made-for-hire under this Agreement. Professional Services are performed remotely unless otherwise specified; where on-site work is agreed, Customer will be invoiced at cost for pre-approved, reasonable travel and out-of-pocket expenses properly incurred by Muster.

1.3. Technical Support. Muster's standard technical support is included at no additional charge during the Subscription Term. Online support resources at [SUPPORT URL] are available to all Authorized Users. Live technical support is available to Customer's designated support administrators during normal business hours ([DAYS/HOURS, TIME ZONE]).

2. License Grant and Restrictions

2.1. License Grant; Reservation of Rights. Subject to Customer's ongoing compliance with the Agreement, Muster grants Customer a non-exclusive, non-transferable license during the Subscription Term for its Authorized Users to access, install, implement, and use the Products and Services solely for Customer's direct beneficial business purposes. Customer's rights are limited to those expressly set out in the Agreement, including any license-type limitations in the Sales Order. Muster retains all right, title, and interest in and to the Products and Services and all related intellectual property, including all modifications, updates, customizations, and add-ons.

2.2. Restrictions and Acceptable Use. Except as expressly permitted under the Agreement, Customer must not: (i) use the Products and Services in violation of any applicable law or regulation; (ii) use them in a manner that creates a material risk to the security or operations of Muster or any of its other customers; (iii) disassemble, decompile, or reverse engineer them; (iv) redistribute, sell, rent, lease, or sub-license them to any third party; (v) remove, obscure, or alter any proprietary notices; or (vi) circumvent, disable, or stress test any security or other technological feature. If any use by Customer or its Authorized Users, in Muster's reasonable assessment, threatens the security, integrity, or availability of the Products and Services, Muster may suspend the Products and Services, using commercially reasonable efforts under the circumstances to give Customer prior notice of the suspension.

2.3. Authorized Users. Access is limited to Authorized Users. Customer may reassign Authorized User accounts, but accounts must not be shared among multiple individuals, and each Authorized User may not access the Products and Services from more than five (5) unique devices in any 30-day span. Customer will: (i) ensure its Authorized Users comply with the Agreement; (ii) promptly report to Muster any violation by an Authorized User and disable that user's access; and (iii) ensure no false or misleading personal information is used to create accounts. Customer is responsible for any breach of the Agreement by its Authorized Users.

3. Customer Content, Privacy, and Security

3.1. Ownership and Permitted Use. As between Muster and Customer, all Customer Content — including repositories, codebases, contracts, cloud infrastructure data, and asset records submitted for analysis — is Customer's property. Muster will process, reproduce, display, copy, transmit, host, and otherwise use Customer information solely (i) to the extent necessary to perform its obligations or enforce its rights under the Agreement, or (ii) where required or authorized by law.

3.2. Security. Muster will establish and maintain appropriate administrative, technical, and physical safeguards and controls to: (i) ensure the ongoing confidentiality, integrity, availability, and resilience of the Products and Services and Customer Content; (ii) restore availability of and access to Customer Content in a timely manner following a physical or technical incident; and (iii) maintain a process for regularly testing, assessing, and evaluating the effectiveness of its technical and organizational measures.

3.3. Compliance with Privacy Laws. Muster will comply with applicable privacy and data protection laws governing its processing and storage of Personal Data in its role under the Agreement. The Muster Privacy Policy applies in the limited scenarios where Muster is the data controller, as explained in that policy. If Customer's use of the Products and Services requires a data processing agreement, the Muster DPA published at [DPA URL] is incorporated into the Agreement by reference, unless the parties have executed a separate data processing agreement.

3.4. Muster's Remediation of Unauthorized Disclosures. If unauthorized disclosure of or access to Personal Data is caused by Muster's breach of the Agreement, Muster shall pay the reasonable and documented costs incurred by Customer for: (a) any required forensic investigation to determine the cause of the breach; (b) notifying applicable government and industry self-regulatory agencies, the media (if required by applicable law), and affected individuals; (c) where banking or payment card data is involved, providing one (1) year of credit monitoring to affected individuals who elect it, measured from the date those individuals were notified; and (d) operating a communications channel appropriate to the scope of the disclosure (e.g., web page, email address, or call center) for one (1) year from the date affected individuals were notified. Notwithstanding the foregoing, Muster has no obligation to pay remediation costs to the extent they result from the negligence, willful misconduct, or fraud of Customer or its employees, agents, contractors, or Authorized Users.

3.5. Customer Responsibilities Regarding Customer Content.

4. Fees, Payments, and Taxes

4.1. Payments and Fees. Customer must pay the Fees according to the payment terms and in the currency stated in the Sales Order. Invoices are delivered electronically using the billing and contact information Customer provides. Customer will clearly indicate with each payment which invoices (or portions) the payment applies to, or email those details to [BILLING EMAIL] no later than the payment date.

4.2. Failure to Pay. If Customer fails to pay any amount when due, Muster will send a reminder notice. If Customer has not paid within fifteen (15) days of the reminder notice, Muster may, in its sole discretion, suspend or restrict the Products and Services. Muster may charge interest on overdue amounts at the lesser of 1% per month or the maximum rate permitted by applicable law, from the due date until paid in full.

4.3. Billing Disputes. If Customer believes it has been billed incorrectly, Customer must notify Muster in writing within thirty (30) days of the invoice date, specifying the claimed error. Customer may not offset or deduct amounts from any invoice unless (i) Customer has properly notified Muster of the dispute and (ii) the dispute is made in good faith.

4.4. Taxes. Customer is responsible for all applicable Taxes. If Muster is legally obligated to collect or pay Taxes, it will add them to the applicable invoice and Customer will pay them, unless Customer provides a valid exemption certificate from the appropriate taxing authority. If a taxing authority later pursues Muster for Taxes that were Customer's responsibility and unpaid, Muster may invoice Customer, and Customer will pay such Taxes (to Muster or the authority directly) plus applicable interest, penalties, and charges.

5. Intellectual Property Indemnification

5.1. Muster's Obligations. Muster will (i) defend at its expense, and (ii) pay any damages finally awarded by a court of competent jurisdiction (or settlement amounts Muster agrees to in writing) for, third-party Claims alleging that the Products and Services directly infringe the third party's patent, copyright, or trademark.

5.2. Customer's Obligations. Customer will (i) defend at its expense, and (ii) pay any damages finally awarded by a court of competent jurisdiction (or settlement amounts Customer agrees to in writing) for, third-party Claims alleging that Customer Content directly infringes the third party's patent, copyright, or trademark.

5.3. Conditions. The indemnification obligations in this Section are conditioned on the indemnified Party: (i) promptly giving written notice of the Claim to the indemnifying Party; (ii) giving the indemnifying Party sole control of the defense, negotiation, and settlement of the indemnified portion of the Claim; and (iii) providing all reasonable assistance required to defend the Claim effectively.

5.4. IP Exceptions.

5.5. IP Remedies. In the defense or settlement of any third-party IP infringement claim, Muster may, at its sole option and expense: (i) procure for Customer the right to continue using the Products and Services as anticipated by the Agreement; (ii) replace or modify the allegedly infringing Products and Services to avoid the infringement at no additional cost to Customer; or (iii) terminate Customer's license to the Products and Services (or the infringing part) and refund any prepaid unused Fees as of the termination date. The remedies in this Section 5 are Muster's sole and exclusive liability, and Customer's sole and exclusive remedy, for third-party IP infringement Claims.

6. Limitation of Liability

6.1. Disclaimer of Indirect Damages. To the extent permitted by law, neither Party will, under any circumstances, be liable to the other Party or any third party for indirect, consequential, incidental, special, or exemplary damages, or for lost profits or loss of business, arising out of or related to the Agreement, even if apprised of the likelihood of such damages.

6.2. Cap on Liability. To the extent permitted by law, under no circumstances will either Party's total aggregate liability of all kinds arising out of or related to the Agreement — regardless of forum and whether based on contract, tort (including negligence), or otherwise — exceed the total amounts paid or payable by Customer under the Agreement during the twelve (12) months immediately preceding the event giving rise to the Claim. The limitations in Sections 6.1 and 6.2 do not apply to claims based on: (i) death or personal injury caused by negligence; (ii) fraud or fraudulent misrepresentation; (iii) either Party's IP indemnification obligations under Section 5; (iv) either Party's misappropriation of the other Party's intellectual property; (v) Muster's data privacy remediation obligations under Section 3.4; or (vi) Customer's payment obligations.

6.3. Third-Party Products. The Agreement does not govern Customer's use of Third-Party Products used in connection with the Products and Services; those are governed solely by the terms between Customer and the third-party developer. Muster makes no commitments regarding the security, confidentiality, or performance of Third-Party Products and disclaims all liability for them. Customer acknowledges that Third-Party Products: (i) are activated and used at Customer's sole risk; (ii) are not warranted, supported, or endorsed by Muster; and (iii) may degrade the performance of the Products and Services beyond Muster's reasonable control. To the extent a Third-Party Product accesses, processes, or gathers Personal Data, the applicable third party is Customer's direct data processor and is not acting as a subprocessor of Muster.

7. Term and Termination

7.1. Term. The Subscription Term is established during sign-up for the free tier, or in the applicable Sales Order for paid tiers. This MSA applies to each Sales Order into which it is incorporated until expiration of the Subscription Term, as modified by any extension or early termination.

7.2. Renewal. The Subscription Term automatically extends for a subsequent period of equal length (each an "Extended Term") at the end of the Subscription Term and each Extended Term. Customer may give thirty (30) calendar days' written notice before the end of the then-current term to terminate this MSA at the end of that term.

7.3. Termination for Cause. If either Party commits a material breach of the Agreement, the non-breaching Party may give written notice describing the nature and basis of the breach. If the breach is not cured within thirty (30) days of the notice date, the non-breaching Party may immediately terminate the Agreement in whole or in part.

7.4. Effect of Termination or Expiration.

7.5. Survival. Termination or expiration does not affect provisions that by their nature survive, including: definitions, payment obligations, confidentiality, term and termination, effect of termination, intellectual property, license compliance, limitation of liability, privacy, content monitoring, and the General Provisions section.

8. Warranties, Disclaimers, and Remedies

8.1. Products and Services Warranty (paying customers only). Muster warrants that (i) the Products and Services as delivered will materially conform to the Documentation and the specifications in the applicable Sales Order, and (ii) the overall functionality of the Products and Services will not be materially decreased during the Subscription Term. Muster further warrants that Professional Services will be performed in a professional and workmanlike manner. Customer must notify Muster of a warranty claim within thirty (30) days of the date the underlying condition first appears.

8.2. Remedies (paying customers only). To the extent permitted by law, Customer's sole and exclusive remedy for breach of warranty is replacement of the non-conforming Products and Services or re-performance of the Professional Service, as applicable. If, in Muster's sole discretion, replacement or re-performance is not commercially reasonable, Muster may terminate the applicable portion of the Sales Order and refund any prepaid unused Fees for the affected Products and Services.

8.3. Implied Warranties (paying customers only). To the maximum extent permitted by law and except for the express warranties in this Section, Muster provides the Products and Services "as is." Muster disclaims all other representations and warranties of any kind, express, implied, or statutory (including merchantability, title, non-infringement, accuracy, and fitness for a particular purpose). Customer acknowledges that Muster does not control, and is not responsible for, interruptions, delays, cancellations, delivery failures, data loss, content corruption, packet loss, or other damage arising from: (i) Customer equipment or the transfer of data over communication networks and devices (including the Internet); (ii) limitations and problems inherent in the use of such networks and devices outside Muster's control; or (iii) Customer's failure to properly install appropriate security updates and patches on networks and devices within its control.

9. Confidentiality

9.1. Use and Protection. The receiving Party will use Confidential Information only for the purposes of the Agreement, and will not reproduce, disseminate, or disclose it to any person except its employees and authorized representatives (such as temporary staff, consultants, and contractors) who need to know it for the purposes of the Agreement and who are bound by confidentiality obligations at least as restrictive as this Section. The receiving Party will treat Confidential Information with the same degree of care it applies to its own information of similar sensitivity, and never less than reasonable care. The obligations in this Section survive for three (3) years following expiration or termination of the Agreement; Confidential Information retained in backup media remains subject to this Section until deleted.

9.2. Permitted Disclosure. The receiving Party may disclose Confidential Information: (i) as approved in writing and signed by the disclosing Party; (ii) as necessary to comply with law or a valid order of a court or governmental body; or (iii) as necessary to establish the rights of either Party — provided that, in the case of (ii) and (iii), the receiving Party promptly notifies the disclosing Party of the required disclosure and gives all reasonably required assistance so the disclosing Party may seek to prevent the disclosure or ensure it occurs under an appropriate obligation of confidence.

10. General Provisions

10.1. Relationship. Muster acts as an independent contractor, not as Customer's agent or representative. The Agreement creates no partnership, franchise, joint venture, agency, or fiduciary relationship.

10.2. Notices. Notices under the Agreement must be in writing and delivered by email to: [LEGAL/NOTICES EMAIL] (to Muster) and the primary billing email in the Sales Order (to Customer), or to alternative addresses either Party provides in writing. Notices are deemed delivered on the second business day after sending.

10.3. Feedback and Metadata. Customer may provide feedback about the Products and Services (support input, suggestions, enhancement requests) and generates metadata (anonymous, aggregated, non-personal technical data from the Products and Services). Metadata does not include Personal Data. Muster may develop, modify, and improve the Products and Services based on Customer's feedback and metadata, and reserves the right to use, publish, and otherwise exploit metadata and feedback without restriction.

10.4. Beta Products and Services. Muster may make features available that are subject to further testing and development, marked as alpha, beta, demo, evaluation, trial, early access, preview, or similar ("Beta Products and Services"). Customer acknowledges that Beta Products and Services may not function as intended and agrees not to use them unless it accepts the risks of pre-release technology. They are experimental, create no obligation for Muster to continue developing or supporting them, and are provided "as is" without express or implied warranty. In no event will Muster or its suppliers be liable for any damages arising out of the use of, or inability to use, Beta Products and Services.

10.5. References. Customer authorizes Muster to make public reference to Customer as a Muster customer and to use Customer's name and logo (which remain Customer's trademarks) on its website for that purpose only, without disclosing any Confidential Information. Muster may publish the collaboration on LinkedIn after the Agreement is signed. Other public references require Customer's prior consent. After a successful setup, Muster may contact Customer to participate in reports, blog posts, testimonials/videos, and reference calls (maximum two per calendar quarter).

10.6. Waiver; Modification. No failure or delay in exercising any right constitutes a waiver of that right. Except as expressly stated, remedies are cumulative. The Agreement may not be modified, nor rights waived, except in a writing signed by the Parties.

10.7. Severability. If any provision is held illegal, unenforceable, or invalid, it may be interpreted by the court to best accomplish its original objectives to the fullest extent permitted by law, and the remainder of the Agreement remains in full force and effect.

10.8. Independent Allocations of Risk. Each provision limiting liability, disclaiming warranties, or excluding damages allocates the risks of the Agreement between the Parties. This allocation is reflected in Muster's pricing and is an essential element of the basis of the bargain.

10.9. Assignment. Neither Party may assign its rights or obligations without the other Party's prior written consent (not to be unreasonably withheld or delayed), except that either Party may assign the Agreement in its entirety without consent in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets not involving a direct competitor of the other Party. Any purported assignment in violation of this Section is void. The Agreement binds and benefits the Parties and their respective successors and permitted assigns.

10.10. Force Majeure. Neither Party is liable for, or in breach on account of, any delay or failure to perform resulting from unforeseeable or exceptional circumstances beyond its reasonable control, provided the non-performing Party (i) did not cause the situation through its own negligent acts or omissions and (ii) exercised due diligence and commercially reasonable efforts to avoid the situation and mitigate its impact.

10.11. No Third-Party Beneficiaries. There are no third-party beneficiaries to the Agreement, including Authorized Users.

10.12. Entire Agreement. The Agreement contains the entire understanding of the Parties relating to its subject matter and supersedes all earlier agreements, understandings, proposals, discussions, negotiations, representations, and warranties, written and oral. No modification is effective unless in writing and signed by the Party against whom it is asserted.

10.13. Customer's Purchase Order. Terms in Customer's purchase order or related documents do not form part of the Agreement and are void unless expressly agreed in a writing signed by the Parties.

10.14. Counterparts. The Agreement (or any component) may be executed in counterparts, which together form one legal instrument.

10.15. Anti-Corruption and Compliance. Customer confirms it has not received or been offered any illegal or improper bribe, kickback, payment, gift, or thing of value from Muster's employees or agents in connection with the Agreement (reasonable ordinary-course gifts and entertainment excepted), and will use reasonable efforts to promptly notify Muster of any violation it learns of. Each Party will comply with applicable trade-control laws. For US Government end users: the Products and Services are "Commercial Items" as defined at 48 C.F.R. § 2.101, consisting of "Commercial Computer Software" and "Commercial Computer Software Documentation" as used in 48 C.F.R. § 12.212 or § 227.7202, as applicable.

10.16. Governing Law, Venue, and Disputes. The Agreement is governed by and construed under the laws of [GOVERNING LAW JURISDICTION], without regard to conflict-of-law rules and excluding the United Nations Convention on Contracts for the International Sale of Goods. The Parties irrevocably submit to the exclusive jurisdiction of the courts of competent jurisdiction in [VENUE]. The Parties will first attempt to settle any dispute amicably through good-faith negotiations before seeking enforcement from a court.

11. Definitions