veriQU END USER LICENSE AGREEMENT Seller: The Cloud Catalysts Version 1.0 - effective 2026-10-16 1. THE AGREEMENT 1.1 This agreement governs Buyer's use of veriQU, bought through AWS Marketplace from The Cloud Catalysts ("Seller"). It consists of: (a) the Standard Contract for AWS Marketplace, version 2022-07-14 (the "Standard Contract"), published by AWS at https://s3.amazonaws.com/aws-mp-standard-contracts/Standard-Contact-for-AWS-Marketplace-2022-07-14.pdf, which is incorporated by reference; and (b) the veriQU Terms in Sections 2 to 8 below. 1.2 Where the veriQU Terms conflict with the Standard Contract, the veriQU Terms control. Capitalized terms not defined here have the meaning given in the Standard Contract. 1.3 These terms apply to every veriQU listing and offer, including the free scan. Sections 5 and 7.2 apply only to paid subscriptions. 2. DEFINITIONS 2.1 "Buyer Account" means an AWS account that is owned or controlled by Buyer or a Buyer Affiliate and that hosts, or is used to build, operate or secure, a product or workload of Buyer or a Buyer Affiliate. 2.2 "Affiliate" means an entity that controls, is controlled by, or is under common control with Buyer, where "control" means ownership of more than 50% of the voting interests. 2.3 "Output" means any assessment, report, finding, verdict, remediation guide, remediation plan, one-click remediation, draft Well-Architected review or other material veriQU produces. 2.4 "Account Slot" means one unit of the account quantity Buyer purchased. 3. PERMITTED USE 3.1 Buyer may connect veriQU only to Buyer Accounts, and may use veriQU and its Output only for Buyer's internal business purposes, including preparing Buyer's own products for the AWS Foundational Technical Review and AWS Marketplace. 3.2 Buyer may let its employees and individual contractors operate veriQU on Buyer's behalf, against Buyer Accounts only. Buyer is responsible for their compliance with this agreement. 4. RESTRICTIONS Buyer will not, and will not allow anyone else to: (a) connect veriQU to, or assess, any AWS account that is not a Buyer Account, including an account owned or controlled by a client, customer or other third party of Buyer; (b) use veriQU or its Output to provide assessment, readiness, remediation, consulting or managed services to any third party; (c) resell, sublicense, lease, timeshare or otherwise make veriQU or its Output available to a third party, or operate veriQU as a service bureau; (d) share an Account Slot between more than one AWS account at a time, or rotate Account Slots across AWS accounts in a way that makes one Account Slot cover more accounts than Section 5 allows; (e) open several subscriptions to the free scan to obtain more scans than one subscription allows; or (f) use veriQU or its Output to build or train a competing product or service. 5. ACCOUNT SLOTS (PAID SUBSCRIPTIONS) 5.1 Each Buyer Account connected to veriQU uses one Account Slot. 5.2 When Buyer removes a connected account after veriQU has produced a report for it, that Account Slot cannot be used for a different account for 90 days. Reconnecting the same account releases the slot at once. Removing an account before any report is produced frees its slot at once. 6. CONSULTANTS AND PARTNERS Consulting firms, systems integrators and managed service providers that want to use veriQU for their clients must contact Seller at info@thecloudcatalysts.com for a separate written agreement or private offer. This agreement grants no partner or reseller rights. 7. REMEDIES 7.1 If Buyer breaches Section 4 or 5, Seller may, after giving Buyer written notice and 10 days to cure where the breach can be cured, suspend Buyer's access to veriQU. 7.2 For a paid subscription, Buyer will also pay Seller, for each AWS account used in breach, the then-current list price for one Account Slot for the full contract term. 7.3 These remedies are in addition to Seller's other rights under the Standard Contract. 8. ACCESS TO BUYER ACCOUNTS 8.1 veriQU reads Buyer Accounts only through the read-only IAM role Buyer creates from Seller's published CloudFormation template. Buyer may revoke that access at any time by deleting the role's stack. 8.2 A one-click remediation runs only when Buyer reviews and approves it, and only in Buyer's own account. Buyer is responsible for deciding whether to apply it.