END USER LICENSE AGREEMENT This End User License Agreement ("Agreement") is a legally binding agreement. Please read it carefully. By clicking "I Agree," or installing or using the Lacework Service and Lacework Agent software and/or any updates to such software (collectively, the "Software") provided by Lacework, Inc. ("Lacework"), you agree to the following terms in sections 1-11 and Exhibit A on behalf of the Lacework customer with which you are employed, affiliated or associated ("Customer") and represent that you have authority to bind the Customer to these terms. If you do not have such authority, do not authorize this Agreement and do not download or use the Lacework Service or Lacework Agents. 1. DEFINITIONS (a) "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control" for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity. (b) "Agent Data" means electronic data, content and information collected by the Lacework Agent software and Service related to Customer's computing and network infrastructure. (c) "Lacework Service" or "Service" means Lacework's services provided to Customer in connection with this Agreement, and as further set forth on an applicable Order Form, and any Technology provided by Lacework in connection with the operation and/or provision of such products and/or services, including Lacework Agent software, excluding Agent Data. (d) "Platform" means Lacework's cloud workload security analytics platform, which may be made available to Customer as part of the Service if set forth in an Order Form. (e) "Technology" means all ideas, concepts, inventions, systems, platforms, software, interfaces, tools, utilities, templates, forms, documentation, content, training materials, techniques, methods, processes, algorithms, know-how, trade secrets and other technologies, implementations and information. (f) "User" means an individual who is authorized by Customer to use the Service. Users may include, for example, Customer's employees, consultants, contractors and agents, and third parties with which Customer transacts business. 2. USE OF THE SERVICE (a) Lacework Service. Subject to the terms and conditions of the Agreement, Lacework shall use commercially reasonable efforts to make the Lacework Service available to Customer. Customer may maintain User accounts for up to the number of Users set forth in the Order Form. Customer shall designate one User for each seat it purchases (and may reassign such seat to a new individual replacing one who no longer uses the Services). As set forth in the Order Form, Lacework will permit Customer to (i) store up to the amount of Agent Data; and (ii) store such Agent Data for the designated amount of time. If Customer attempts to store more data than designated, or store data for a longer period of time than set forth in the Order Form, the oldest data will be destroyed first. (b) Authorized Agents. Subject to the limitations set forth in the applicable Order Form and the terms and conditions set forth herein, Customer and its Users shall have the right to access and use the Lacework Service and to copy and deploy up to the number of Lacework Agents on computer hardware and software that Customer controls. A User's access credentials may not be shared with any other individual for purposes of using the Service. Customer is responsible for maintaining the security of its account, passwords (including, but not limited to, administrative and user passwords). Customer shall be responsible for acts, omissions or breaches hereunder by any of Customer's Users or any other individuals using Customer's account or credentials for the Service. (c) Usage Restrictions. Customer will not directly or indirectly (i) make the Service available to, or use the Service for the benefit of, anyone other than Customer; (ii) sell, resell, license, sublicense, distribute, rent or lease the Service, or include any Service in a service bureau or outsourcing offering; (iii) use the Service to store or transmit infringing, libelous, or otherwise unlawful, or tortious content, material or data; (iv) store or transmit material or data on or through the Service in violation of third-party rights, including without limitation privacy rights or any contract to which Customer is a party; (v) use the Service to store or transmit malicious or disruptive code; (vi) interfere with or disrupt the integrity or performance of the Service or third-party data contained therein; (vii) attempt to gain unauthorized access to the Service or its related systems or networks; (viii) permit direct or indirect access to or use of the Service in a way that circumvents a contractual usage limit; (ix) copy the Service or any part, feature, function or user interface thereof; (x) frame or mirror any part of any Service, other than framing on Customer's own internal intranets; (xi) access or use the Service for benchmarking or similar competitive analysis purposes or in order to build a competitive product or service; (xii) modify, translate, or create derivative works based on the Service or any underlying software or (xiii) decompile, disassemble, decipher or reverse engineer the Service, or otherwise attempt to derive any source code or underlying ideas or algorithms of any part of the Service, (except to the extent such restriction is expressly prohibited by applicable statutory law). (d) Affiliates. An Affiliate may receive Service under this Agreement provided that such Affiliate directly enters into an Order Form. By entering into an Order Form hereunder, an Affiliate agrees to be bound by the terms of this Agreement as if it were an original party hereto. Customer will be responsible for its Affiliates' compliance with this Agreement. (e) License to Agent Data. Customer hereby grants Lacework a non-exclusive, worldwide, royalty-free, fully paid-up right and license to use, copy, access, process, reproduce, perform, display, modify, distribute and transmit the Agent Data on the Platform and in connection with providing the Service to Customer as set forth in this Agreement. Customer agrees that (i) the quality of the Service and the Platform depend on the complete and continuous collection of Agent Data by the Service, and (ii) Lacework will not assume any responsibility for, or undertake to verify, the accuracy or completeness of the Agent Data. (f) Limitations. Lacework will not be responsible or liable for any failure in the Platform or Service resulting from or attributable to (i) failure to collect Agent Data, including completeness and integrity of the data; (ii) failures in any telecommunications, network or other service or equipment outside of Lacework's facilities; (iii) Customer's or any third party's products, services, negligence, willful misconduct, breach of this Agreement or other unauthorized access or use; or (iv) any force majeure or other cause beyond Lacework's reasonable control. 3. TERMINATION (a) Termination. If either party materially breaches any of its duties or obligations under this Agreement or an Order Form, and such breach is not cured within thirty (30) calendar days of the non-breaching party providing the breaching party of written notice of the breach, the non-breaching party may terminate this Agreement or the applicable Order Form, as applicable. (b) Data Portability and Deletion. Upon request by Customer, which must be made within thirty (30) calendar days after the effective date of termination or expiration of this Agreement, Lacework will use commercially reasonable efforts to make the Agent Data available to Customer for export or download. After that 30-day period, Lacework will have no obligation to maintain or provide Agent Data, and may thereafter delete or destroy all copies of Agent Data in Lacework's systems or otherwise in Lacework's possession or control, unless legally prohibited. (c) Surviving Provisions. The sections and subsections titled "Data Portability and Deletion," "Disclaimers," "Confidential Information," "Proprietary Rights," "Mutual Indemnification," "Limitation of Liability," and "General Provisions" will survive any termination or expiration if this Agreement. 4. REPRESENTATIONS AND WARRANTIES (a) Representations and Warranties. Each party represents and warrants that: (i) it is a corporation duly organized and validly existing under the laws of the jurisdiction in which it is incorporated; (ii) it has full corporate power and authority, and has obtained all corporate approvals, permissions and consents necessary, to enter into this Agreement and to perform its obligations hereunder; (iii) this Agreement is legally binding upon it and enforceable in accordance with its terms; and (iv) the execution, delivery and performance of this Agreement does not and will not conflict with any agreement, instrument, judgment or understanding, oral or written, to which it is a party or by which it may be bound. (b) Customer Warranties. Customer represents, warrants and covenants that (i) all Lacework Agents will be installed by or on behalf of Customer in accordance with all applicable laws, rules and regulations; (ii) it has all necessary rights to install the Lacework Agents and to permit the collection and transmission of Agent Data contemplated by this Agreement; and (iii) it shall only use Service in accordance with all applicable laws, rules and regulations and this Agreement and any relevant documentation provided by Lacework. (c) Disclaimers. EXCEPT AS EXPRESSLY PROVIDED HEREIN, NEITHER PARTY MAKES ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND EACH PARTY SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW AND ANY WARRANTIES ARISING OUT OF COURSE OF DEALING, COURSE OF PERFORMANCE OR USAGE IN TRADE. LACEWORK MAKES NO REPRESENTATIONS OR WARRANTIES (A) REGARDING THE SUITABILITY OR COMPLETENESS OF THE SERVICE, (B) THE RESULTS CUSTOMER MAY OBTAIN BY USING THE SERVICE, OR (C) THAT THE SERVICE WILL MEET CUSTOMER'S REQUIREMENTS. 5. CONFIDENTIAL INFORMATION (a) Definition of Confidential Information. "Confidential Information" means all information disclosed by a party ("Disclosing Party") to the other party ("Receiving Party"), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Customer's Confidential Information includes Agent Data; Lacework's Confidential Information includes the Service, and Confidential Information of each party includes the terms and conditions of this Agreement and all Order Forms (including pricing), as well as business and marketing plans, technology and technical information, product plans and designs, and business processes disclosed by such party. However, Confidential Information of a Disclosing Party does not include any information that (i) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party; (ii) was rightfully known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any obligation owed to the Disclosing Party; (iii) is rightfully received from a third party without breach of any obligation owed to the Disclosing Party or (iv) was independently developed by the Receiving Party without use of or reference to the Confidential Information of the Disclosing Party. (b) Protection of Confidential Information. The Receiving Party will use the same degree of care that it uses to protect the Confidential Information of the Disclosing Party as it uses to protect the confidentiality of its own confidential information of like kind (but not less than reasonable care). The Receiving Party will (i) not use any Confidential Information of the Disclosing Party for any purpose outside the scope of this Agreement, and (ii) except as otherwise authorized by the Disclosing Party in writing, only disclose Confidential Information of the Disclosing Party to those of its and its Affiliates' employees and contractors who (A) need that access for purposes consistent with this Agreement and (B) have confidentiality obligations with respect to the Disclosing Party's Confidential Information consistent with those contained herein. Neither party will disclose the terms of this Agreement or any Order Form to any third party other than (1) its Affiliates, legal counsel and accountants or (2) in connection with a bona fide due diligence inquiry for a financing, acquisition or similar transaction, in each case subject to confidentiality obligations consistent with this Agreement, without the other party's prior written consent. A Receiving Party shall be responsible for any breaches of confidentiality obligations hereunder by any third party to whom it discloses the Disclosing Party's Confidential Information. Notwithstanding anything to the contrary set forth herein, Lacework may collect and use data regarding the use and performance of the Service in anonymized and aggregated form, to analyze and improve the Service and for distribution in general benchmarking data and industry reports, provided that any reported user data is aggregated and anonymized such that no personally identifying information of Customer or its users is revealed. (c) Compelled Disclosure. The Receiving Party may disclose Confidential Information of the Disclosing Party to the extent compelled by law, provided the Receiving Party gives the Disclosing Party prior notice of the compelled disclosure (to the extent legally permitted) and reasonable assistance, at the Disclosing Party's cost, if the Disclosing Party wishes to contest the disclosure. 6. PROPRIETARY RIGHTS (a) Agent Data. As between the parties, except for the licenses set forth herein, all right, title and interest in and to the Agent Data shall be and remain the sole and exclusive property of Customer. (b) Lacework. As between the parties, all right, title and interest in and to the Platform, Lacework Service and Lacework Agents and all copies, modifications and derivative works thereof shall be and remain the sole and exclusive property of Lacework. (c) No License. Except as expressly set forth herein, no license or other right, title or interest is granted by either party to the other with respect the Confidential Information, Platform, Service, Lacework Agents or Agent Data. 7. INFORMATION SECURITY Lacework shall be responsible for establishing and maintaining a commercially reasonable information security program that is designed to: (a) protect the security and confidentiality of the Agent Data; (b) protect against anticipated threats or hazards to the security or integrity of the Service, Lacework Agents or Agent Data; (c) protect against unauthorized access to or use of the Service and Agent Data and (d) require that all subcontractors of Lacework who will be accessing the Agent Data, if any, comply with the foregoing. Customer shall use commercially reasonable security, including sufficient User authentication methods and deploy anti-virus measures when accessing and using the Service and to prevent unauthorized access to, or use of, the Service, and shall notify Lacework promptly of any such unauthorized access or use of which it becomes reasonably aware. 8. MUTUAL INDEMNIFICATION (a) Indemnification by Lacework. Lacework will defend Customer against any claim, demand, suit or proceeding ("Claim") made or brought against Customer by a third party alleging that Customer's use of the Service in accordance with this Agreement infringes or misappropriates such third party's intellectual property rights, and will indemnify and hold harmless Customer from any damages, attorney fees and costs finally awarded to such third parties as a result of, or for any amounts paid by Lacework under a settlement of, such Claim made in accordance with the terms of Section 9(d)(Indemnification Procedure). The foregoing obligations do not apply with respect to any Claim based on or arising from (i) the Agent Data; (ii) the Service or portions or components thereof (A) used not strictly in accordance with this Agreement or in an environment or on a platform or with devices for which it was not designed or contemplated; (B) made in whole or in part in accordance with Customer specifications; (C) modified, altered, combined or enhanced by a party other than Lacework or (D) combined with other products, services, processes, content or materials not supplied by Lacework where the alleged infringement would not have occurred without such combination. The foregoing obligations also do not apply to (E) any continuing allegedly infringing activity after being notified thereof or provided modifications that would have avoided the alleged infringement, or (F) any Claims based on or arising out of Customer's, Customer's Affiliates, or Customer's Users breach of this Agreement or an applicable Order Form ((A) through (F) collectively, the "Excluded Claims"). (b) Infringement. If Lacework receives information about an infringement or misappropriation claim arising directly out of the Service (and not arising out of an Excluded Claim), Lacework may in its discretion and at no cost to Customer (i) modify the Service so that they no longer infringe or misappropriate; (ii) obtain a license for Customer's continued use of the Service in accordance with this Agreement or (iii) if (i) and (ii) are not practicable despite Lacework's reasonable efforts, then Lacework may terminate Customer's subscription for the Service and refund Customer a pro-rated amount of any prepaid fees covering the remainder of the term of the terminated subscriptions. Sections 9(a) and 9(b) state Lacework's sole liability, and the Customer's exclusive remedy, for any infringement or misappropriation of third-party intellectual property rights with respect to the Service. (c) Indemnification by Customer. Customer will defend Lacework against any Claim made or brought against Lacework by a third party (i) alleging that Customer's use of the Service in breach of this Agreement, violates, infringes or misappropriates such third party's intellectual property or other proprietary or privacy rights or violates applicable law, order, rule or regulation or (ii) any Excluded Claims, and will indemnify and hold harmless Lacework from any damages, attorney fees and costs finally awarded to such third parties as a result of, or for any amounts paid by Lacework under a settlement of, such Claim made in accordance with the terms of Section 9(d)(Indemnification Procedure). (d) Indemnification Procedure. Any claim for indemnification hereunder requires that the indemnified party (i) promptly give the indemnifying party written notice of the Claim; (ii) give the indemnifying party sole control of the defense and settlement of the Claim, provided that the indemnifying party may participate in the defense of the Claim with counsel of its choosing at its own expense and further provided that the indemnified party shall not be responsible for any settlement that it does not approve in writing, such approval not to be unreasonably withheld and (iii) give the indemnifying party all reasonable assistance, at indemnifying party's expense. 9. LIMITATION OF LIABILITY EXCEPT FOR EITHER PARTY'S INDEMNIFICATION OBLIGATIONS UNDER SECTION 9, OR EITHER PARTY'S BREACH OF CONFIDENTIALITY UNDER SECTION 6, IN NO EVENT SHALL EITHER PARTY BE LIABLE CONCERNING THE SUBJECT MATTER OF THIS AGREEMENT, REGARDLESS OF THE FORM OF ANY CLAIM OR ACTION (WHETHER IN CONTRACT, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE), FOR ANY (A) INTERRUPTION OF USE, LOSS OR INACCURACY OF THE SERVICE, OR COST OF PROCURING SUBSTITUTE TECHNOLOGY, GOODS OR SERVICE; (B) INDIRECT, PUNITIVE, INCIDENTAL, RELIANCE, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING, BUT NOT LIMITED TO, LOSS OF BUSINESS, REVENUES, PROFITS AND GOODWILL OR (C) DAMAGES, IN THE AGGREGATE, IN EXCESS OF THE AMOUNTS PAID TO IT (IN THE CASE OF LACEWORK) OR PAYABLE BY IT (IN THE CASE OF CUSTOMER) HEREUNDER DURING THE PREVIOUS TWELVE (12) MONTHS, EVEN IF IT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THESE LIMITATIONS ARE INDEPENDENT FROM ALL OTHER PROVISIONS OF THIS AGREEMENT AND SHALL APPLY NOTWITHSTANDING THE FAILURE OF ANY REMEDY PROVIDED HEREIN. 11. GENERAL PROVISIONS (a) Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of California and the federal laws of the United States of America, excluding those laws relating to conflicts of law. EACH PARTY HEREBY WAIVES ANY RIGHT IT MAY HAVE TO A TRIAL BY JURY IN ANY LITIGATION COMMENCED UNDER OR IN CONNECTION TO THIS AGREEMENT. (b) Force Majeure. Neither party shall be liable for delays or any failure to perform the Service or this Agreement due to causes beyond its reasonable control. Such delays include, but are not limited to, fire, explosion, flood or other natural catastrophe, governmental legislation, acts, orders, or regulation, strikes or labor difficulties, to the extent not occasioned by the fault or negligence of the delayed party. Any such excuse for delay shall last only as long as the event remains beyond the reasonable control of the delayed party. However, the delayed party shall use commercially reasonable efforts to minimize the delays caused by any such event beyond its reasonable control. This provision shall not excuse the payment of fees due under this Agreement, provided that Lacework continues to provide the Service as set forth herein. (c) No Waiver. The failure of either party at any time to require performance by the other party of any provision of this Agreement shall in no way affect that party's right to enforce such provisions, nor shall the waiver by either party of any breach of any provision of this Agreement be taken or held to be a waiver of any further breach of the same provision. (d) Notices. Any notice given pursuant to this Agreement shall be in writing and delivered to the parties at their respective addresses stated on an applicable Order Form or at such other address designated by written notice hereunder. Notices will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if sent by email or facsimile; the day after being sent, if sent for next day delivery by recognized overnight delivery service; or upon receipt, if sent by certified or registered mail, return receipt requested. (e) Publicity. Customer hereby consents to inclusion of its name and logo in client lists that may be published as part of Lacework's marketing and promotional efforts. (f) Assignment. Neither party may assign any of its rights or obligations hereunder, whether by operation of law or otherwise, without the other party's prior written consent (not to be unreasonably withheld); provided, however, either party may assign this Agreement in its entirety (including all Order Forms), upon providing notice to the other party, but without the other party's consent, to its Affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. (g) Counterparts; Execution. This Agreement may be executed electronically and in one or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same Agreement. The parties agree that an electronic or facsimile signature may substitute for and have the same legal effect as the original signature. (h) Entire Agreement. This Agreement (including any Order Forms and applicable Exhibits) is the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous and contemporaneous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement, and shall control over any different or additional terms of any purchase order, acknowledgement or other non-Lacework ordering document, and no terms included in any such purchase order, acknowledgement or other non-Lacework ordering document shall apply to the Service. This Agreement may only be amended by an instrument in writing signed by the parties. (i) Severability. If any provision of this Agreement is held by a court of competent jurisdiction to be contrary to law, the provision will be deemed null and void, and the remaining provisions of this Agreement will remain in effect. Exhibit A Service Level Agreement 1. Up-Time and Reliability. Lacework will use reasonable commercial efforts to make the Service available to Customer for 99% of all Scheduled Availability Time, calculated on a monthly basis (the "Uptime Guarantee"). "Scheduled Availability Time" shall be defined as 24 hours a day, 7 days a week, excluding: (i) scheduled maintenance; (ii) downtime due to acts of Customer, its vendor(s), or other service providers, or any third party connections, utilities, or equipment; or (iii) downtime related to any other forces beyond the reasonable control of Lacework (such as internet outages or outages with respect to Customer's network or internet access). All scheduled maintenance will be conducted following at least 72 hours advance notice. Lacework shall use commercially reasonable efforts to minimize any disruption, inaccessibility and/or inoperability of the Service in connection with outages, whether scheduled or not. 2. Remedy. If Lacework fails to meet the Uptime Guarantee in any month during the Term, Customer shall be entitled to a credit equal to !% of the fees actually paid by Customer to Lacework pursuant to the Agreement for the affected Service for such month, for each 1% reduction in Service availability (each credit, a "Service Credit"). Provided, however, that in no event shall total Service Credits in any calendar month exceed 25% of the monthly fees paid for the affected Service for the given month. Service Credits, if applicable, shall be applied to Customer's next invoice after the month in which the Service Credit was accrued. Customer must request the applicable Service Credit within 10 business days following the end of the calendar month in which the failure occurred. If Customer receives Service Credits in 3 consecutive months, or in any 3 of 6 consecutive months, Customer may terminate this Agreement with respect to the affected Services upon written notice to Lacework. The remedies set forth in this section shall be Lacework's sole obligation and Customer's exclusive remedy with respect to any failure by Lacework to meet the Uptime Commitment. Any Customer right to terminate created due to Service Provider's material failure to provide the Service as set forth in the General Service Level Support Terms identified in this Exhibit A, if not exercised within thirty (30) days of Customer reasonably becoming aware of such failure, will be deemed to have been waived. 3. Maintenance and Support. During the Term, Lacework will make available to Customer as part of the Service all generally available updates and bug fixes to the Service received by Customer. For technical information, technical advice and technical consultation regarding Customer's use of the Service, Customer can reach Lacework at support@Lacework.net, and Lacework will use commercially reasonable efforts to respond to support issues from 8 am ET to 8 pm ET, Monday through Friday, excluding Lacework-observed holidays ("Support Hours"). 4. Customer Responsibility. In addition to other responsibilities contained herein, Customer will be responsible for the maintenance, management and accuracy of its customer account data, as well as all software, hardware and services it uses to access the Service. Customer shall provide to Lacework, and keep current, a list of designated contacts and contact information (the "Support List") for Lacework to contact for support services. Such Support List shall include (i) the first person to contact for the answer or assistance desired, and (ii) the persons in successively more responsible or qualified positions to provide the answer or assistance desired. 5. Classification of Problems. Lacework shall classify each problem reported by Customer according to the following definitions and will use commercially reasonable efforts to address the problem in accordance with such classification according to the table below. Priority code Priority description Response Times Target Resolution Times P1 Mission Critical. Core/essential services are down, causing critical impact to business operations; no workaround available. Lacework will provide a status update by email within 1 hour of receiving notification from Customer of the P1 issue and status updates every 1 hour thereafter. 48 Hours P2 High. Core/essential services are significantly degraded and/or impacting significant aspects of business operations; no commercially reasonable work around available. Lacework will provide a status update by e-mail within 2 hours of receiving notification from Customer of the P2 issue and status updates every 6 hours. 5 Business Days P3 Medium. Significantly slow response or delays; core/essential service performance is impaired but still materially functional. Lacework will provide a status update by e-mail, within 4 hours of receiving notification from Customer of the P3 issue. 30 calendar days P4 Low. No material Customer impact; documentation errors or exclusions or cosmetic or other non-substantive service or user interface issues; core/essential services are unaffected. Lacework will use commercially reasonable efforts to provide a status update by e-mail 24 hours of receiving notification from Customer of the P4 issue. As otherwise agreed to by the parties Version 2017-08-08 GDSVF&H\2367213.6 Lacework Confidential 1 GDSVF&H\2367213.6