Palindrome Master Services Agreement

This Master Services Agreement ("MSA") is between Palindrome Labs, Inc., with an address at 128 King St, Floor 3, San Francisco, California 94107 ("Palindrome"), and the entity identified as the customer in an Order Form ("Customer"). This MSA takes effect on the effective date of the first Order Form executed by both parties (the "Effective Date").

This MSA, each Order Form, the Data Processing and Security Addendum (the "DPA"), and any exhibit or schedule that the parties expressly incorporate form the "Agreement."

1. Definitions

1.1 Aggregated Data means data derived from Customer's use of the Services that Palindrome has aggregated or de-identified so that it does not identify and cannot reasonably be used to identify Customer, an Authorized User, or an individual.

1.2 Authorized User means an employee, contractor, or other individual whom Customer authorizes to access the Services under Customer's account.

1.3 Customer Data means data or content that Customer or an Authorized User submits to the Services or that the Services collect or ingest on Customer's behalf. Customer Data includes prompts, responses, transcripts, telemetry, source code, file and workspace content, tool inputs and outputs, account and organization identifiers, and other data submitted through an enabled integration.

1.4 Customer-Directed Service means a third-party product, model provider, MCP server, data source, or integration that Customer directs Palindrome to connect to the Services and that Palindrome does not provide as a Subprocessor.

1.5 Documentation means Palindrome's user documentation for the Services.

1.6 Order Form means an ordering document executed by Palindrome and Customer that identifies the Services, fees, Subscription Term, and other deal-specific terms.

1.7 Output means a recommendation, routing decision, savings estimate, budget signal, classification, report, or other result that the Services generate for Customer from Customer Data or Customer's use of the Services.

1.8 Security Incident has the meaning given in the DPA.

1.9 Services means the hosted observability, optimization, governance, and related applications, APIs, integrations, support, and professional services identified in an Order Form.

1.10 Subscription Term means the period stated in an Order Form during which Customer may use the applicable Services.

1.11 Affiliate means an entity that controls, is controlled by, or is under common control with a party. "Control" means direct or indirect ownership of more than 50% of the voting interests of an entity or the power to direct its management.

1.12 Intellectual Property Rights means patent, copyright, trademark, trade-secret, database, and other proprietary rights.

2. Order Forms and Access

2.1 Order Forms. Each Order Form forms part of the Agreement when both parties execute it. Customer and its Affiliates may purchase Services under separate Order Forms. An Affiliate that executes an Order Form becomes a Customer under that Order Form and is responsible for its obligations.

2.2 Access rights. During the Subscription Term and subject to the Agreement, Palindrome grants Customer a non-exclusive, non-transferable, non-sublicensable right to allow its Authorized Users to access and use the Services for Customer's internal business purposes.

2.3 Authorized Users. Customer controls its Authorized Users and is responsible for their compliance with the Agreement. Customer will provide accurate account information, safeguard credentials, and notify Palindrome at security@palindromelabs.ai of unauthorized use or suspected account compromise.

2.4 Service changes. Palindrome may update the Services during a Subscription Term. Palindrome will not materially reduce the core functionality of purchased Services during that Subscription Term. This commitment does not prevent Palindrome from changing a feature to address law, security, third-party service changes, or material technical risk.

2.5 Support and service levels. Palindrome will provide the support stated in the applicable Order Form. Palindrome makes no uptime or service-credit commitment unless the parties attach an SLA to that Order Form.

2.6 Evaluation services. Palindrome may provide a beta, pilot, proof-of-concept, or evaluation service identified in an Order Form as "Evaluation Services." Customer may use Evaluation Services only for internal evaluation during the stated period. Palindrome provides Evaluation Services without warranties, service levels, or Palindrome indemnification obligations, and either party may end them on written notice. Sections 3, 5 through 8, 10.1, 10.3, 11, 12, and 13 apply to Evaluation Services.

3. Customer Responsibilities and Restrictions

3.1 Customer responsibilities. Customer is responsible for its use of the Services, its Authorized Users, its systems and networks, its Customer Data, and its Customer-Directed Services. Customer will use the Services and Outputs in accordance with the Agreement and law.

3.2 Restrictions. Customer will not, and will not permit another person to:

• copy, modify, translate, or create derivative works of the Services;
• reverse engineer, decompile, or attempt to derive source code or underlying models, except where law prohibits this restriction;
• rent, lease, sell, sublicense, or make the Services available to a third party except to Authorized Users;
• bypass or disable a security, rate-limiting, or access-control feature;
• use scraping, crawlers, bots, or automated means except through documented APIs within applicable limits;
• use the Services to build a competing product or benchmark the Services for a competitor;
• upload malware or use the Services to violate law or a third-party right; or
• interfere with the integrity, security, or performance of the Services.

3.3 Usage limits. Customer will comply with the quantities and limits in each Order Form. Palindrome may work with Customer to reduce excess use or invoice Customer for additional use at the rates in the Order Form. Palindrome will not suspend Customer for excess use without notice and a reasonable opportunity to purchase additional capacity, except where use creates a security, legal, or service-integrity risk.

4. Fees and Payment

4.1 Fees. Customer will pay the fees in each Order Form. Except as the Agreement states, payment obligations are non-cancelable and fees are non-refundable.

4.2 Invoices. Unless an Order Form states otherwise, Palindrome will invoice fees in advance and Customer will pay each undisputed invoice within 30 days after the invoice date. Customer must dispute an invoice in good faith within 15 days after receipt and pay the undisputed portion on time. The parties will work in good faith to resolve a dispute.

4.3 Late payment. Palindrome may charge interest on an overdue undisputed amount at the lesser of 1.0% per month or the maximum rate law permits. Customer will reimburse reasonable collection costs for an overdue undisputed amount.

4.4 Taxes. Fees exclude sales, use, value-added, withholding, and similar taxes. Customer is responsible for taxes associated with its purchases, except taxes based on Palindrome's net income. If law requires Customer to withhold tax, Customer will provide a valid receipt and cooperate with Palindrome in claiming an available exemption or credit.

4.5 Purchase orders. A purchase order supports Customer's internal administration. A purchase order does not amend the Agreement, and a term printed on it has no effect.

5. Customer Data, Outputs, and Aggregated Data

5.1 Customer ownership. As between the parties, Customer retains all right, title, and interest in Customer Data.

5.2 Processing license. Customer grants Palindrome a non-exclusive, worldwide license during the Agreement to host, process, transmit, reproduce, display, and use Customer Data only to:

• provide, secure, maintain, support, and improve the functionality and performance of the Services for Customer;
• follow Customer's documented instructions and configuration choices;
• prevent or address fraud, abuse, Security Incidents, and technical problems;
• comply with law; and
• exercise Palindrome's rights and perform its obligations under the Agreement.

Palindrome will not use Customer Data to train or fine-tune a general-purpose machine-learning or artificial-intelligence model.

5.3 Customer obligations. Customer represents that it has the rights, permissions, notices, consents, and lawful bases needed to submit Customer Data and authorize the processing described in the Agreement. Customer is responsible for the accuracy, legality, and configuration of Customer Data and for its instructions to Palindrome.

5.4 Outputs. As between the parties and subject to third-party rights, Customer owns Outputs generated for Customer from Customer Data. Palindrome assigns to Customer any right that Palindrome may have in those Outputs. Customer receives no ownership interest in the Services, Documentation, Palindrome technology, or third-party models that an Output may reflect.

5.5 AI and automated outputs. Automated and statistical methods may produce inaccurate or incomplete Outputs. Customer will review Outputs before acting on them and will not use an Output as the sole basis for a material financial, employment, legal, or operational decision without independent review.

5.6 Aggregated Data. Palindrome may create and use Aggregated Data to operate, secure, analyze, improve, and benchmark the Services, conduct capacity planning, and develop statistics and industry insights. Palindrome will not attempt to re-identify Aggregated Data or disclose it in a form that identifies Customer, an Authorized User, or an individual. Palindrome may retain Aggregated Data after deleting Customer Data. Palindrome will not use Aggregated Data to train a general-purpose generative model to reproduce Customer content.

6. Data Protection, Security, and Third-Party Services

6.1 DPA. The DPA forms part of the Agreement and governs Palindrome's processing of Personal Data in Customer Data and the security, retention, return, and deletion of Customer Data.

6.2 Security program. Palindrome will maintain the safeguards described in the DPA. Palindrome's security program is currently independently audited against the SOC 2 Type II standard; a current report will be available under NDA through its Trust Center.

6.3 Customer-Directed Services. Customer authorizes Palindrome to exchange Customer Data with a Customer-Directed Service as Customer directs. The third-party provider's terms govern Customer's use of that service. Palindrome is not responsible for a Customer-Directed Service or loss caused by it, except to the extent Palindrome caused the loss through its breach of the Agreement.

7. Intellectual Property

7.1 Palindrome technology. Palindrome and its licensors own the Services, Documentation, models, designs, software, technology, and related Intellectual Property Rights. The Agreement grants Customer no rights except those it states.

7.2 Feedback. If Customer gives Palindrome feedback or suggestions, Customer grants Palindrome a perpetual, irrevocable, worldwide, royalty-free license to use them without restriction or obligation.

8. Confidentiality

8.1 Confidential Information. "Confidential Information" means non-public information that one party (the "Disclosing Party") discloses to the other (the "Receiving Party") and that a reasonable person would understand to be confidential given its nature or the circumstances of disclosure. Customer Data is Customer's Confidential Information. The Services, Documentation, security reports, non-public pricing, and product plans are Palindrome's Confidential Information.

8.2 Protection and use. The Receiving Party will use Confidential Information only to exercise its rights and perform its obligations under the Agreement. It will protect the information with at least reasonable care and disclose it only to personnel, contractors, professional advisers, and Affiliates who need it for the Agreement and have confidentiality obligations.

8.3 Exclusions. Confidential Information does not include information that the Receiving Party can show: (a) became public without breach of the Agreement; (b) it knew without restriction before disclosure; (c) it developed independently without use of the Disclosing Party's Confidential Information; or (d) it received lawfully from a third party without confidentiality restriction.

8.4 Required disclosure. The Receiving Party may disclose Confidential Information when law requires it. If law permits, the Receiving Party will give advance notice and reasonable assistance, at the Disclosing Party's expense, if the Disclosing Party seeks a protective order.

8.5 Equitable relief. Unauthorized use or disclosure of Confidential Information may cause harm that monetary damages cannot remedy. The Disclosing Party may seek equitable relief in addition to other remedies.

9. Warranties and Disclaimers

9.1 Mutual authority. Each party represents that it has authority to enter into the Agreement and perform its obligations.

9.2 Palindrome warranty. Palindrome warrants that the purchased Services will perform in material conformity with the Documentation during the Subscription Term. Customer must notify Palindrome of a breach with enough detail for Palindrome to reproduce it. Palindrome will use reasonable efforts to correct the nonconformity. If Palindrome cannot correct it within a reasonable period, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused terminated period. This Section states Customer's exclusive remedy for breach of this warranty.

9.3 Professional services. Palindrome warrants that it will perform professional services in a professional and workmanlike manner. Customer must notify Palindrome of a breach within 30 days after performance. Palindrome will reperform the affected services or refund the fees paid for them.

9.4 Disclaimers. EXCEPT FOR THE EXPRESS WARRANTIES IN THIS SECTION, PALINDROME PROVIDES THE SERVICES, OUTPUTS, AND EVALUATION SERVICES "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT LAW PERMITS, PALINDROME DISCLAIMS ALL IMPLIED AND STATUTORY WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. PALINDROME DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE OR THAT AN OUTPUT WILL BE ACCURATE.

10. Indemnification

10.1 By Customer. Customer will defend Palindrome and its Affiliates, officers, directors, and employees against a third-party claim arising from: (a) Customer Data; (b) Customer's use of the Services in violation of the Agreement or law; or (c) Customer's violation of a third-party right. Customer will indemnify those parties for damages finally awarded, settlements that Customer approves, and reasonable external legal fees resulting from the covered claim.

10.2 By Palindrome for IP claims. Palindrome will defend Customer against a third-party claim alleging that the Services, as provided by Palindrome and used under the Agreement, infringe or misappropriate that third party's Intellectual Property Rights. Palindrome will indemnify Customer for damages finally awarded, settlements that Palindrome approves, and reasonable external legal fees resulting from the covered claim.

Palindrome has no obligation for a claim arising from Customer Data, Customer's violation of the Agreement, a Customer-Directed Service, modification not made by Palindrome, or combination with anything that Palindrome did not provide. If a covered claim may prevent Customer's use of the Services, Palindrome may procure continued use, modify the Services to avoid infringement, or terminate the affected Services and refund prepaid fees for the unused terminated period. This Section states Palindrome's entire liability for an infringement claim.

10.3 Procedure. The indemnified party will give prompt notice of a claim, allow the indemnifying party to control the defense and settlement, and provide reasonable cooperation at the indemnifying party's expense. A notice delay relieves the indemnifying party only to the extent the delay materially prejudices the defense. The indemnifying party may not settle a claim in a manner that admits fault by, imposes liability on, or requires non-monetary performance from the indemnified party without its prior written consent. The indemnified party will not unreasonably withhold that consent.

10.4 By Palindrome for Security Incidents. Palindrome will defend Customer and its directors, officers, and employees against a third-party claim or regulatory proceeding and indemnify them for Covered Losses to the extent directly caused by a Security Incident resulting from Palindrome's material breach of its written Customer Data security obligations under the DPA.

"Covered Losses" means: (a) damages finally awarded by a court; (b) settlement amounts that Palindrome approves; (c) reasonable external attorneys' fees incurred to defend the covered claim; (d) regulatory fines and penalties to the extent law permits indemnification; and (e) reasonable, documented, out-of-pocket costs that Customer must incur by law for forensic investigation, notifications, and credit or identity monitoring. Covered Losses exclude lost profits, lost revenue, loss of goodwill, internal personnel costs, and amounts recovered from insurance or another third party.

Palindrome has no obligation under this Section to the extent a Security Incident or Covered Loss resulted from: (i) an act or omission of Customer or an Authorized User; (ii) compromised credentials that Palindrome did not cause; (iii) Customer systems, configurations, instructions, or modifications; (iv) a Customer-Directed Service; or (v) Customer's failure to take reasonable steps to mitigate the Security Incident or Covered Loss.

Section 10.3 applies to this Section 10.4. Customer will not incur costs or enter a settlement for which it seeks indemnification without Palindrome's prior written consent, except for legally required emergency measures when advance consent is not practicable. Section 11.4 governs all liability under this Section 10.4. This Section states Customer's exclusive monetary remedy for a Security Incident, without limiting a termination or injunctive right under the Agreement.

11. Limitation of Liability

11.1 Excluded damages. TO THE MAXIMUM EXTENT LAW PERMITS, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES OR FOR LOST PROFITS, REVENUE, DATA, OR GOODWILL ARISING OUT OF OR RELATING TO THE AGREEMENT OR SERVICES, EVEN IF ADVISED OF THE POSSIBILITY.

11.2 General cap. Except as Sections 11.3 and 11.4 provide, each party's total aggregate liability arising out of or relating to the Agreement will not exceed the fees paid or payable by Customer for the Services during the 12 months preceding the event giving rise to the claim, or USD $100 if Customer paid no fees.

11.3 Exclusions from the general cap. Subject to Section 11.4, Sections 11.1 and 11.2 do not apply to: (a) a party's indemnification obligations; (b) a party's breach of Section 8; (c) Customer's breach of Section 3 or infringement or misappropriation of Palindrome's Intellectual Property Rights; (d) Customer's payment obligations; (e) fraud or willful misconduct established by a final, non-appealable judgment; or (f) liability that law does not permit a party to limit.

11.4 Security claims. Palindrome's total aggregate liability arising from a Security Incident, whether asserted under indemnification, confidentiality, contract, tort, statute, or another theory, will not exceed the greater of: (a) USD $100,000; or (b) two times the fees paid or payable by Customer for the Services during the 12 months preceding the Security Incident. This Section does not limit liability for fraud or willful misconduct established by a final, non-appealable judgment.

12. Term, Suspension, and Termination

12.1 MSA term. This MSA starts on the Effective Date and continues until all Order Forms have expired or terminated.

12.2 Order Form term. Each Order Form begins and renews as it states. If an Order Form does not state a renewal period, it does not renew automatically.

12.3 Termination for cause. Either party may terminate this MSA or an affected Order Form if the other party materially breaches the Agreement and does not cure the breach within 30 days after written notice. A party may terminate on written notice if the other party becomes subject to bankruptcy or insolvency proceedings that are not dismissed within 60 days, ceases business without a successor, or makes an assignment for the benefit of creditors.

12.4 Suspension. Palindrome may suspend affected Services if: (a) Customer does not pay an undisputed amount within 10 days after written notice of delinquency; (b) Customer materially breaches Section 3; (c) Palindrome reasonably believes suspension is needed to prevent harm, a security risk, or a legal violation; or (d) law requires suspension. Palindrome will limit suspension to the scope and duration needed and will restore access after Customer resolves the cause.

12.5 Effect of termination. Customer will pay fees accrued through termination. If Customer terminates for Palindrome's uncured material breach, Palindrome will refund prepaid fees for the unused terminated period. If Palindrome terminates for Customer's uncured material breach, Customer will pay committed fees for the remainder of the Subscription Term. The DPA governs export, retention, return, and deletion of Customer Data.

12.6 Survival. Sections 4, 5.1, 5.4, 5.6, 7, 8, 10, 11, 12.5, 12.6, and 13 survive expiration or termination. The DPA survives for as long as Palindrome processes Customer Data.

13. General

13.1 Compliance with law. Each party will comply with law in performing the Agreement. Customer will not use the Services in violation of export controls, sanctions, or anti-corruption laws.

13.2 Assignment. Customer may not assign the Agreement without Palindrome's prior written consent. Palindrome may assign the Agreement in connection with a merger, acquisition, reorganization, or sale of all or substantially all assets relating to the Agreement. Any other assignment requires the other party's prior written consent. An attempted assignment that violates this Section is void.

13.3 Force majeure. Neither party is liable for delay or failure caused by an event beyond its reasonable control, excluding payment obligations. The affected party will use reasonable efforts to reduce the effect of the event and resume performance.

13.4 Notices. Legal notices must be in writing. Notices to Palindrome must be sent to legal@palindromelabs.ai and to Palindrome Labs, Inc., 128 King St, Floor 3, San Francisco, California 94107. Notices to Customer must be sent to the legal contact or address in the applicable Order Form. Email notice is effective on receipt. A notice of breach, indemnity claim, or termination must also be sent by nationally recognized overnight courier, and is effective on confirmed delivery.

13.5 Governing law and venue. California law governs the Agreement without regard to conflict-of-law rules. The parties consent to exclusive jurisdiction in the state and federal courts located in San Francisco County, California, and waive objections to venue.

13.6 Order of precedence. The DPA, including its Security Measures schedule, controls with respect to Personal Data processing and Customer Data security. An Order Form controls with respect to the applicable Services, quantities, fees, and Subscription Term. An Order Form modifies another provision of this MSA only if it identifies the MSA section and states the amendment. This MSA controls in all other conflicts. The public Website Terms do not apply to Services governed by this MSA. The Privacy Policy and Cookie Policy are notices and do not form part of the Agreement.

13.7 Entire agreement and amendments. The Agreement is the entire agreement between the parties concerning its subject matter and supersedes prior or contemporaneous agreements on that subject. A waiver or amendment must be in writing and signed by authorized representatives of both parties, except that an Order Form may amend this MSA as Section 13.6 permits.

13.8 Independent contractors. The parties are independent contractors. The Agreement does not create a partnership, joint venture, fiduciary, franchise, or agency relationship.

13.9 No third-party beneficiaries. Except for an indemnified party identified in Section 10, the Agreement creates no third-party beneficiary rights.

13.10 Severability and waiver. If a court finds a provision unenforceable, it will modify that provision to the minimum extent needed and enforce the remaining provisions. A failure to enforce a provision is not a waiver.

13.11 Counterparts and electronic signatures. The parties may execute an Order Form in counterparts and through electronic signatures. Each counterpart is an original, and all counterparts form one instrument.

13.12 Interpretation. Headings do not affect interpretation. "Including" means "including without limitation." A reference to writing includes email where the Agreement permits email notice.

Signatures

The parties enter into this MSA through an Order Form that incorporates it. The first executed Order Form establishes the Effective Date.