Terms of Service
LAST UPDATED: JULY 11, 2024
These Terms of Service (this “Agreement”) forms a binding legal contract between DryRun Security Co., a Delaware corporation (“DryRun Security”), and you as a client of DryRun Security (“Client” or “you”) governing your use of the Services (as defined in Section 2 below). PLEASE READ THESE TERMS CAREFULLY. BY SIGNING AN ORDER FORM THAT REFERENCES THIS AGREEMENT, CLICKING THE “ACCEPT” BUTTON, OR OTHERWISE ACCESSING OR USING THE SERVICES, CLIENT AGREES TO BE BOUND BY THESE TERMS OF SERVICE. IF YOU DO NOT AGREE TO ANY OF THESE TERMS, THEN YOU MAY NOT ACCESS OR USE THE SERVICES.
1. GENERAL USE
- a. Eligibility. Client’s Authorized Users must be at least 18 years of age to access or use the Services. If Client is accessing or using the Services on behalf of a company or other legal entity, Client represents being authorized to accept and bind that company or legal entity to this Agreement.
- b. Updates. DryRun Security may make commercially reasonable updates to the Services from time to time. Any such updates will not result in a material adverse impact to Client’s use of the Services. DryRun Security may make changes to this Agreement from time to time. If DryRun Security makes changes, DryRun Security will use commercially reasonable efforts to provide advance notice of any material changes, and the amended Agreement will be posted to the DryRun Security website with an update to the “Last Updated” date above. DryRun Security may also attempt to notify Client by sending an email notification to the address associated with Client’s account or providing notice through the Services. Unless provided otherwise in a DryRun Security notice, the updated Agreement will be effective immediately, and Client’s continued access to and use of the Services will confirm Client’s acceptance of the changes.
2. DEFINITIONS Capitalized terms will have the meanings provided in this Section 2 or as otherwise defined in this Agreement.
- a. “Access Credentials” means passwords, user IDs, or other credentials and login information that have been provided by DryRun Security to Client or that are generated in connection with Client’s use of the Services.
- b. “Authorized Users” means individuals assigned by Client to use the Services with log-in rights and Access Credentials, which may include Client’s officers, employees, agents, and/or consultants performing services for Client or on Client’s behalf.
- c. “Client Content” means all information, data, software code, and/or files that Client (through its Authorized Users) transmits or uploads in association with Client’s use of the Services, including Personal Data of Authorized Users.
- d. “Documentation” means any user manuals or technical materials or information provided to Client via the DryRun Security website or other electronic form in connection with the Services, as may be updated by DryRun Security from time to time.
- e. “DryRun Security Solution” means the DryRun Security proprietary software, applications, algorithms, AI models, workflows, methodologies, processes, systems, dashboards, and other technology for DryRun Security software code security solution for identifying security vulnerabilities, code and issues.
- f. “Intellectual Property Rights” means all patents, copyrights, moral rights, trademarks, trade names, service marks, trade dress, trade secrets and any other form of intellectual property rights now or hereafter recognized in any jurisdiction, including applications and registrations for any of the foregoing.
- g. “Malicious Code” means any files, scripts, agents, code, or programs that are designed, intended to, or have the effect of disrupting, damaging, or interrupting the Services or the data contained therein, including any viruses, worms, time bombs, Trojan horses, and other malicious code.
- h. "Order Form” means the document executed between DryRun Security and Client that sets forth the specific Services ordered by Client and associated fees and links to this Agreement.
- i. “Personal Data” means any information that can be used to identify an individual, whether individually or in combination, such as name, email address, telephone number, address, or any other personally identifiable information.
- j. “Reports” means any results, reports, analyses, or other data output resulting or created from Client’s use of the Services, excluding any underlying Client Content.
- k. “Services” means, as applicable, (a) the modules for the DryRun Security Solution that DryRun Security makes available to customers as a cloud-hosted service that is accessed through a software application deployed in connection with a Source Code Management Provider, and (b) any websites or other online products or services provided by DryRun Security that link to this Agreement, including www.dryrun.security/ (“Sites”).
- l. “Source Code Management Provider” means a third-party cloud-hosted software development platform used by Client to store, track, and collaborate on software projects, such as GitHub.
- m. “Term” means the period during which Client may access and use the Services under this Agreement as set forth on the Order Form.
- n. “Usage Data” means information gathered, prepared, computed, originated, or stored by DryRun Security resulting from the use or provision of the Services. Usage Data does not include Reports.
3. SERVICES PROVIDED
- a. Services. In order to access the Services for the DryRun Security Solution, Client must enable the installation of the DryRun Security application in its Source Code Management Provider. Subject to the terms of this Agreement, including Client’s payment of all fees, DryRun Security grants Client a limited, non-exclusive, revocable right to access and use (i) such Services set forth in the Order Form for the specified number of Authorized Users; (ii) the Documentation; and (iii) the Sites, all solely in accordance with this Agreement and for Client’s own internal business use. Client may not resell, transfer, assign, or sublicense Client’s rights under this Agreement to any third party (including any subsidiary or affiliate) or use the Services on a timesharing, service bureau, or similar arrangement, to run an outsourcing business, or to provide the Services for the benefit of any third party.
- b. Reports. Client’s use of the DryRun Security Solution Services allows for the generation of Reports that may identify security vulnerabilities or issues associated with the Client Content. Client may access, use, copy, and distribute Reports for its internal business purposes. Client acknowledges and agrees that DryRun Security may store, copy, and use the Reports and data contained therein to design, develop, improve, enhance, modify, and support its products and services.
4. CLIENT ACCOUNT
- a. Client Account. DryRun Security will provide Client with the capability of creating a client account to access the Services and Reports. Client will need Access Credentials to access its account. Only Authorized Users appointed by Client are entitled to access Client’s account and use the Services under the terms of this Agreement. Client will also need to establish an account with the Source Code Management Provider, and such account and any associated access credentials are separate from the DryRun Security account and subject to separate terms and privacy policies of such Source Code Management Provider.
- b. Access Credentials. Client is solely responsible for the access of the Client account and use of the Services by any other party through Client’s Access Credentials. Client is responsible for implementing security measures to safeguard Client’s Access Credentials and to prevent use and disclosure by unauthorized third parties. Client will promptly notify DryRun Security in writing of any unauthorized use of the Services or Reports that comes to Client’s attention.
5. CLIENT CONTENT
- a. Client Content License. Client acknowledges and agrees that Client (not DryRun Security) has control over Client Content transmitted in connection with the operation of the Services. Client hereby grants DryRun Security and its subsidiaries and affiliates a limited, non-exclusive, royalty-free license to use, access, temporarily store, display, and otherwise process any Client Content as necessary to provide the Services and Reports. Except as provided in the preceding sentence or with respect to Personal Data relating to Authorized Users, DryRun Security does not store Client Content and will not be responsible for any loss, alteration, modification, or damage to such Client Content. Client is solely responsible for ensuring it maintains backups for its Client Content. DryRun Security will, however, store the Reports and key data points in respect of your Client Content.
- b. Data Security. DryRun Security has established, and will maintain during the term of this Agreement, commercially reasonable administrative, physical, and technical safeguards to protect Client Content while in its possession. Those safeguards will include measures for preventing unauthorized access to Client Content. DryRun Security DISCLAIMS ANY LIABILITY FOR UNAUTHORIZED ACCESS, USE, OR RELEASE OF ANY CLIENT CONTENT, UNLESS SUCH ACCESS, USE, OR RELEASE RESULTS FROM FAILURE TO MEET ITS SECURITY OBLIGATIONS UNDER THIS PARAGRAPH.
6. CLIENT OBLIGATIONS
- a. Rights in Client Content and Compliance with Laws. Client represents and warrants to DryRun Security that it has the rights, licenses, and/or permissions necessary to grant the license in Section 5.a and to otherwise make available Client Content to DryRun Security in connection with Client’s use of the Services. Client will comply with all applicable laws and regulations in connection with Client’s use of the Services, including those laws related to data privacy and the transmission of Personal Data. Client will be solely responsible for ensuring that any processing of Client Content by DryRun Security and/or Client via the Services does not violate any applicable laws. Client will not upload, post, reproduce, or distribute any information, software, content, files, or other material that Client did not create, or which is protected by third-party copyright, privacy rights, or any other Intellectual Property Rights without first obtaining the permission of the owner of such rights. Without limiting the generality of the foregoing, Client will be solely responsible for: (i) ensuring that Client and DryRun Security, to the extent acting on Client’s behalf, have the right to collect, store, use, process, and share the Client Content in connection with the Services; and (ii) providing adequate notice to, and obtaining any necessary consents from, any individuals as required under applicable laws with respect to the Client Content collected, stored, used, processed, and shared in providing the Services.
- b. Malicious Code. Client will not introduce any Malicious Code into the Services. DryRun Security may immediately suspend Client’s access to the Services if DryRun Security detects Malicious Code or reasonably suspects that Malicious Code was introduced by Client or through the use of Client’s Access Credentials.
- c. Restrictions. Client agrees that the Services and DryRun Security Solution contain trade secrets and other valuable proprietary information and Intellectual Property Rights belonging to DryRun Security. Client will not: (i) alter, copy, modify, translate, or make derivative works of, or permit the alteration, copying, modification, translation, or making derivative works of, the Services, DryRun Security Solution, or any component thereof; (ii) attempt to derive the source code or object code for the Services or DryRun Security Solution, including by reverse engineering, decompiling, disassembling, or similar means; (iii) seek to acquire any ownership interest in or to the Services or DryRun Security Solution; (iv) copy, frame, scrape, license, offer, sell, transfer, rent, or lease the Services or DryRun Security Solution or attempt any of the foregoing; (v) remove, alter, or obfuscate any copyright, trademark, or other proprietary rights notices included with the Services, Reports, or DryRun Security Solution; (vi) access the Services or use the DryRun Security Solution in order to develop or build a similar product or competitive product; (vii) use any data mining, robots, or data gathering or extraction methods; (viii) enable access to the Services by anyone other than an Authorized User; (ix) develop any scripts or software applications that interact with or integrate with the Services unless first authorized in writing by DryRun Security; (x) circumvent or modify any security technologies designed to prevent unauthorized access to the Services; and (xi) use or access the Services in a manner that Client would have reason to know would damage, disable, overburden, or impair any servers or networks used by DryRun Security to provide the Services.
- d. Acceptable Use. Client will not use the Services, and will ensure that Authorized Users do not use the Services, to: (i) infringe on, violate, dilute, or misappropriate the Intellectual Property Rights of any third party or any rights of publicity or privacy of any person; (ii) store, send, or post defamatory, inflammatory, trade libelous, threatening, abusive, hateful, harassing, obscene, pornographic, or indecent content or data; (iii) interfere with or attempt to interfere with or disrupt the integrity, security, functionality, or proper working of the Services or any other customer’s use and enjoyment of the Services; (iv) attempt to discover, access, read, alter, destroy, or damage any programs, data, or other information utilized in connection with the Services; or (v) upload or transmit any content that constitutes unsolicited or unauthorized advertising promotional materials, commercial activities, or any other form of solicitation.
7. OWNERSHIP RIGHTS
- a. Ownership by DryRun Security. Subject to the use rights granted under this Agreement, as between the parties, DryRun Security exclusively owns and retains all right, title, and interest in and to the Services, Documentation, DryRun Security Solution, the DryRun Security name, trademarks, service marks, and logos, and any improvements, modifications, enhancements, or derivatives of the foregoing, and all Intellectual Property Rights relating to any of the foregoing. This Agreement does not convey to Client any rights of ownership in or related to the Services, Documentation, or DryRun Security Solution. Except for the rights expressly granted in this Agreement, no other rights are granted to Client, whether by implication, estoppel, waiver, or otherwise.
- b. Ownership by Client. Subject to the license granted to DryRun Security in this Agreement, Client owns and retains all right, title, and interest in and to the Client Content.
- c. Usage Data. Notwithstanding anything to the contrary in this Agreement, DryRun Security may generate, collect, store, use, transfer, and/or disclose to third parties Usage Data and use Usage Data to perform data analytics; to monitor, improve, and support the Services; to design, develop, and offer DryRun Security products and services; and for any other lawful purposes. DryRun Security owns and retains all rights to Usage Data, and no rights are granted to Client, whether by implication, estoppel, waiver, or otherwise in or to any Usage Data.
8. FEES AND PAYMENT TERMS
- a. Fees. Client will pay DryRun Security the fees for the Services as set forth in the Order Form.
- b. Taxes. Client is responsible for any taxes (including sales, and use taxes), charges, tariffs, and duties arising under this Agreement for Client’s use of the Service, excluding taxes based on DryRun Security income.
- c. Payments. All fees payable under this Agreement will be payable by Client in accordance with the Order Form. If not stated in the Order Form, all fees are due within 30 days of Client’s execution of the Order Form. All payments pursuant to this Agreement: (i) are nonrefundable unless otherwise expressly stated in this Agreement and (ii) will be made in U.S. dollars.
9. TERM, TERMINATION, AND SUSPENSION
- a. Term. This Agreement will continue for the Term unless earlier terminated as permitted under this Agreement.
- b. Termination for Cause. Either Client or Company may terminate this Agreement: (i) upon written notice to the other party if such other party commits a material breach of this Agreement and fails to cure such breach within 30 days of having received noticed of the breach; or (ii) immediately if the other party becomes insolvent, makes an assignment for the benefit of its creditors, appoints a receiver for the whole or part of its assets, if there is a filing of voluntary bankruptcy petition by such other party or the filing against such other party of an involuntary bankruptcy petition that is not stayed or dismissed within 60 days, or there is an issuance of any order or the passing of a resolution for the winding-up of such other party’s business.
- c. Suspension of Services. DryRun Security may suspend or limit access to the Services at any time: (i) if DryRun Security determines that Client is using the Services in violation of applicable law or in connection with any fraudulent activity; (ii) if DryRun Security reasonably determines that Client’s use of the Services adversely affects or interferes with the normal operation of the Services, the DryRun Security Solution, or any service to others in a material manner; (iii) if DryRun Security is prohibited by an order of a court or other governmental agency from providing the Services; or (iv) if DryRun Security reasonably believes there exists a security incident that threatens the security of the Services or Client Content. DryRun Security will have no liability for any damages, liabilities, or losses as a result of any suspension or limitation of Client’s use of the Services in accordance with this paragraph.
- d. Effect of Expiration or Termination. Upon any expiration or termination of this Agreement, all fees incurred but unpaid by Client up to and including the effective date of expiration or termination will become immediately due and payable. Further, all rights granted to Client under this Agreement and Company’s obligations will immediately cease, except the following provisions will survive: Sections 2 (Definitions), 3.2 (Reports), 6.3 (Restrictions), 7 (Ownership Rights), 8 (Fees and Payment Terms), 9.4 (Effect of Expiration or Termination), 10 (Confidentiality) 11 (Indemnity), 12 (Disclaimers), 13 (Limitation of Liability) and 14 (General Terms).
10. CONFIDENTIALITY
- a. Protection. The parties acknowledge that each party may be exposed to or receive certain information that is not generally known to the public and is marked as confidential or proprietary, or which, under the circumstances ought to be treated as confidential by the receiving party (“Confidential Information”). Each party agrees that if a party is exposed to or receives the other party’s Confidential Information, the receiving party: (i) will protect Confidential Information from unauthorized disclosure using at least a commercially reasonable degree of care; (ii) will not disclose Confidential Information to any third party (provided that DryRun Security may disclose Client’s Confidential Information to any of its subsidiaries or affiliates or to any contractor bound by confidentiality obligations at least as protective as those contained in this Agreement as is necessary for the provision of Services); and (iii) will use the Confidential Information solely for the purpose of performing or exercising its rights under this Agreement. Client will not disclose the terms or conditions of any Order Form, including pricing information, to any third party. The obligations set forth in this Section 10 will survive until five years from the date of the disclosure of such Confidential Information.
- b. Exceptions. A party will not be liable for disclosure or use of any information which: (i) rightfully becomes publicly available other than by a breach of a duty owed to the disclosing party; (ii) is rightfully received from a third party without any obligation of confidentiality; or (iii) is independently developed by the receiving party without use or reference to the disclosing party’s Confidential Information. A party may disclose Confidential Information of the disclosing party if required by law or court order, on the condition that the receiving party promptly notifies the disclosing party of such law or court order and upon request, reasonably cooperates with the disclosing party to limit the scope of disclosure and/or obtain a protective order.
- c. Return. After any expiration or termination of this Agreement, upon request from the disclosing party, the receiving party will, within 30 days of such request, return or destroy (at disclosing party’s reasonable direction) all materials or media containing any Confidential Information of the disclosing party that is in the receiving party’s possession or under its control.
- d. Injunctive Relief. DryRun Security and Client expressly acknowledge and agree that no adequate remedy exists at law for an actual or threatened breach of this Section 10 and that in such event the non-breaching party will be entitled to seek immediate injunctive and other equitable relief, without waiving any other rights or remedies available to it.
- e. Feedback. Client may from time to time voluntarily provide suggestions, enhancements, recommendations, requests for features or functionality, comments, or other feedback (“Feedback”) to DryRun Security regarding the Services or Documentation. Feedback, even if designated as “confidential” or “proprietary” by Client, will not create any confidentiality or other obligation for DryRun Security, and Client hereby grants DryRun Security a royalty-free, fully paid-up, worldwide, transferable, sublicensable, irrevocable, perpetual license to copy, disclose, use, or otherwise exploit such Feedback for any purpose.
11. INDEMNITY Client will indemnify, defend, and hold harmless DryRun Security, its affiliates, and its and their officers, employees, and agents harmless against any damages, liabilities, losses, costs, or expenses (including reasonable attorneys’ fees) based upon any third-party claim (a) alleging that any Client Content infringes or violates any third-party right, including Intellectual Property Rights, right to privacy or publicity rights, or data privacy rights or laws; (b) arising from Client’s breach of any of its obligations under Section 6 (Client Obligations); or (c) arising in connection with the operation of Client’s business.
12. DISCLAIMERS THE SERVICES, DOCUMENTATION, AND REPORTS ARE PROVIDED "AS IS," AND TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, DRYRUN SECURITY HEREBY EXPRESSLY DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES WITH RESPECT THERETO, WHETHER STATUTORY, EXPRESS, IMPLIED, OR THROUGH A COURSE OF DEALING, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. DRYRUN SECURITY DOES NOT WARRANT, AND SPECIFICALLY DISCLAIMS, THAT THE SERVICES WILL OPERATE UNINTERRUPTED, BE ERROR-FREE, OR THAT ALL DEFECTS WILL BE CORRECTED. DRYRUN SECURITY MAKES NO WARRANTY CONCERNING TIMELINESS, ACCURACY, PERFORMANCE, QUALITY, RELIABILITY, OR COMPLETENESS OF ANY INFORMATION OR RESULTS OBTAINED OR DERIVED THROUGH THE USE OF THE SERVICES OR THE REPORTS.
13. LIMITATION OF LIABILITY UNDER NO CIRCUMSTANCES WILL (A) DRYRUN SECURITY BE LIABLE FOR ANY CONSEQUENTIAL, INDIRECT, SPECIAL, EXEMPLARY, PUNITIVE, OR INCIDENTAL DAMAGES, OR LOSS PROFITS OR LOSS OF DATA, REGARDLESS OF THE FORM IN WHICH THE ACTION IS BROUGHT (INCLUDING NEGLIGENCE), ARISING OUT OF OR RELATING TO THIS AGREEMENT, WHETHER OR NOT DRYRUN SECURITY HAS BEEN ADVISED OF THE POSSIBILITY OF ANY SUCH DAMAGES, OR (B) DRYRUN SECURITY’S TOTAL LIABILITY UNDER THIS AGREEMENT, REGARDLESS OF LEGAL THEORY (INCLUDING NEGLIGENCE), EXCEED, IN THE AGGREGATE, THE FEES PAID TO DRYRUN SECURITY FOR THE SERVICES AT ISSUE. THE PARTIES ACKNOWLEDGE THAT THIS SECTION 13 REFLECTS THE AGREED UPON ALLOCATION OF RISK BETWEEN THE PARTIES AND THAT NEITHER PARTY WOULD ENTER INTO THIS AGREEMENT WITHOUT THESE LIMITATIONS ON ITS LIABILITY. THIS LIMITATION ON LIABILITY WILL APPLY DESPITE THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY SET FORTH IN THIS AGREEMENT.
14. GENERAL TERMS
- a. Audit. During the Term and for six months thereafter, Client will permit DryRun Security or its representatives to review Client’s relevant books and records, no more than once every 12-month period, to verify Client’s compliance with the terms and conditions of this Agreement in respect of its access and use of the Services, including with respect to the number of permitted Authorized Users. Client will cooperate and promptly respond to requests from DryRun Security regarding the same. Such audit will be conducted (i) on reasonable advance written notice to Client; (ii) during Client’s standard business hours; and (iii) in such a manner to minimize disruption to Client’s operations. If DryRun Security determines that Client has exceeded the number of Authorized Users in the Order Form, Client will promptly pay to DryRun Security the pro-rata amount for such usage upon receipt of the invoice for the same.
- b. Entire Agreement. This Agreement together with the Order Form constitutes the entire understanding of the parties with respect to its subject matter and supersedes all prior or contemporaneous proposals, understandings, and agreements.
- c. Assignment. Neither party may assign or transfer this Agreement or any of its rights or obligations under it without the other party’s prior written consent, except that DryRun Security may assign this Agreement without Client’s consent to its subsidiaries or affiliates, in connection with the sale of all or substantially all of its assets or business related to this Agreement, or a sale or other transfer of a controlling interest in DryRun Security, whether by merger, consolidation, sale of equity, or other legal means. Any attempted assignment in violation of this paragraph will be null and void. Subject to the foregoing, this Agreement is binding upon and inures to the benefit of the parties and their respective successors and permitted assigns.
- d. Severability. If a court finds any term of this Agreement to be invalid or unenforceable, that term will be enforced to the maximum extent permissible so as to reflect the parties’ intent, and the remainder of this Agreement will remain in full force and effect.
- e. Waiver. Either party’s delay or failure to exercise any right under this Agreement or any law does not mean a party waives that right or any other rights under this Agreement in the future. No waiver of any provision of this Agreement, or any rights or obligations of either party under this Agreement, will be effective except pursuant to a written instrument signed by the party against whom the waiver is sought.
- f. Independent Contractors. DryRun Security and Client are independent contractors. Nothing contained in this Agreement will be construed to create a joint venture or partnership between the parties. Neither party is authorized as an agent or legal representative of the other party. Neither party will have the right or authority to bind or create any obligation on the other party.
- g. Force Majeure. Each party is excused from the performance of this Agreement (other than for any payments due from Client) and will not be liable for any delay in whole or in part caused by an event or circumstance beyond the reasonable control of a party, including natural catastrophes, governmental acts or orders, war, terrorism, pandemics or epidemics, labor strikes or difficulties, interruptions or failure of the Internet, failures of third-party software, networks, or connections, failures or defects in third-party equipment or hardware, or service outages of third-party service providers.
- h. No Third-Party Beneficiary. Nothing contained in this Agreement will be deemed to create, or be construed as creating, any third-party beneficiary right of action upon any third party in any manner whatsoever.
- i. Governing Law and Venue. This Agreement will be governed in all respects in accordance with the laws of the State of California, without regard to conflict of law principles that would cause the laws of any other jurisdiction to apply. Client expressly agrees that federal and state courts located in San Francisco, California will have exclusive jurisdiction over any action or claim arising out of or relating to this Agreement. Each party expressly consents to personal jurisdiction in any such court and hereby irrevocably waives any objection to or claim of lack of jurisdiction or forum non conveniens.
- j. Interpretation. The headings of this Agreement are for reference only and will not be used to interpret the meaning of this Agreement. Any reference to “includes” or “including” will be understood to be exemplary and not limiting and followed by “but not limited to.” Each party has had the opportunity to review this Agreement with legal counsel, and there will be no presumption that ambiguities will be construed or interpreted against the drafter.
- k. Notices. All notices under this Agreement must be in writing and will be deemed to have been duly given upon: (i) personal delivery; (ii) three days after sending via certified, registered mail, or deposit with a recognized courier to the address set forth in the Order Form; or (iii) receipt of email sent to the other party’s designated email address without any out-of-office notification or bounce-back message. DryRun Security may provide all communications regarding the Services or use thereof via email or through Client’s account.