Version 1.0 | Last Updated: 09.22.2026
By clicking “I Agree,” executing an Order that references these Terms, or accessing or using the Service, you agree to these Master Subscription Terms (these “Terms”) on behalf of the entity you represent, and “Customer” means that entity. You represent that you have the authority to bind Customer and that Customer is entering into these Terms for business purposes and not as a consumer. If you do not have that authority, or if you do not agree to these Terms, do not accept these Terms and do not use the Service.
These Terms are an agreement between Discern Security, Inc., a Delaware corporation with its principal place of business in Sunnyvale, California (“Discern”), and Customer, and they take effect on the date Customer first accepts them (the “Effective Date”). These Terms, together with each Order, the DPA, the AI & Automation Addendum, the AUP, and the SLA, are collectively the “Agreement”.
1.1 “Aggregated Data” means data derived from Customer Data or from use of the Service that has been aggregated or de-identified so that it does not identify, and cannot reasonably be used to identify, Customer, any Authorized User, or any individual, device, account, or system of Customer.
1.2 “AI & Automation Addendum” means the Discern AI & Automation Addendum at https://www.discernsecurity.com/ai-automation-addendum, which governs Automated Actions and is part of these Terms.
1.3 “AUP” means the Discern Acceptable Use Policy at https://www.discernsecurity.com/acceptable-use-policy, which is part of these Terms.
1.4 “Authorized User” means an employee or individual contractor of Customer, or of an Affiliate named in an Order, whom Customer permits to use the Service under Customer’s account and who has agreed to use the Service in accordance with these Terms. “Affiliate” means an entity that controls, is controlled by, or is under common control with a party, where control means ownership of more than 50% of the voting interests.
1.5 “Automated Action” means an action that the Service takes in a Connected System or otherwise in Customer’s environment, including creating, modifying, or removing a configuration, policy, setting, ticket, or access assignment.
1.6 “Connected System” means a third-party system, tool, or service of Customer that Customer connects to the Service, such as endpoint, network, email, identity, or vulnerability-management tools.
1.7 “Customer Data” means data that Customer or its Authorized Users submit to the Service and data that the Service collects from Connected Systems on Customer’s behalf. Customer Data does not include Aggregated Data.
1.8 “Documentation” means Discern’s then-current user documentation for the Service
1.9 “DPA” means the Discern Data Processing Addendum at https://www.discernsecurity.com/data-processing-addendum, including its standard contractual clauses, which is part of these Terms.
1.10 “Order” means an order form or quote that references these Terms and is executed by both parties, or an online purchase flow through which Customer subscribes to the Service.
1.11 “Output” means a dashboard, score, assessment, report, query result, or remediation plan that the Service generates for Customer based on Customer Data.
1.12 “Security Incident” means unauthorized access to, or unauthorized acquisition, disclosure, or alteration of, Customer Data in Discern’s possession or control.
1.13 “Service” means Discern’s hosted security posture management platform and the related services identified in an Order, including its AI agents and integrations.
1.14 “SLA” means the Discern Service Level Agreement, which is part of these Terms.
1.15 “Subscription Term” means the subscription period stated in an Order, together with each renewal period under Section 9.1.
2.1 Access Right. Subject to these Terms, Discern grants Customer a non-exclusive, non-transferable right, without the right to sublicense, for Authorized Users to access and use the Service and Documentation during each Subscription Term, for Customer’s internal business purposes, up to the user counts and other usage limits stated in the applicable Order.
2.2 Affiliates. An Affiliate may use the Service only if the Order names it. Customer is responsible for each Affiliate’s and each Authorized User’s use of the Service and for their compliance with these Terms.
2.3 Accounts. Customer shall keep its registration information accurate and current, shall protect the confidentiality of its accounts, credentials, and API keys, and shall notify Discern promptly, and in any event within 48 hours, after becoming aware of unauthorized access to or use of its account.
2.4 Restrictions. Customer shall not, and shall not permit any third party to:
(a) sell, resell, rent, lease, sublicense, or otherwise make the Service available to any third party, or operate the Service for the benefit of any third party;
(b) copy, modify, or create derivative works of the Service or Documentation, or reverse engineer, decompile, or otherwise attempt to derive the source code, models, or architecture of the Service, except to the extent that applicable law prohibits this restriction;
(c) use the Service or any Output to develop, train, improve, or benchmark a product or service that competes with the Service, or to develop or train any artificial intelligence or machine learning model;
(d) publish or disclose to any third party any benchmark or performance evaluation of the Service without Discern’s prior written consent;
(e) circumvent usage limits, access controls, or security features of the Service, or introduce malicious code;
(f) access the Service by any means other than interfaces that Discern documents, or scrape or systematically extract data from the Service;
(g) use the Service in violation of applicable law, the AUP, or third-party rights, or to store or transmit unlawful material; or
(h) use the Service after expiration or termination of the applicable Subscription Term.
2.5 Changes to the Service. Discern may modify the Service, and delivers updates continuously to all customers. During a paid Subscription Term, no modification will materially reduce the core functionality of the Service that Customer has purchased. Discern shall provide reasonable advance notice of the permanent discontinuation of any material feature.
3.1 Orders. Each Order incorporates these Terms. If an Order conflicts with these Terms, the Order controls for that Order. The order of precedence among the documents that make up the Agreement is stated in Section 18.10.
3.2 Evaluations. If an Order identifies Customer’s access as a proof of concept, evaluation, pilot, or trial (an “Evaluation”), then, notwithstanding anything else in these Terms: (a) Customer may use the Service solely for internal evaluation to assess a full subscription, for the period stated in the Order or, if none is stated, [30] days; (b) Customer shall pay the Evaluation fees stated in the Order, and if none are stated the Evaluation is free of charge; (c) either party may end the Evaluation on [3] days’ notice; (d) the Service is provided during the Evaluation “as is,” and Sections 13.3 and 14.1 and the SLA do not apply; (e) Discern’s total liability arising out of the Evaluation will not exceed the greater of the fees paid for the Evaluation and $[1,000]; and (f) at the end of the Evaluation, Customer’s access ends unless the parties execute an Order for a paid subscription, and Section 9.4 applies to Customer Data. Sections 6 and 7 and the DPA apply in full during an Evaluation, including when Customer connects production Connected Systems.
3.4 Beta Features. Discern may offer features identified as beta, preview, or early access. These features are optional, are provided “as is,” may change or be withdrawn at any time, and are excluded from the SLA and from Sections 13.3 and 14.1.
4.1 Authorization. Customer controls which systems it connects to the Service and the scope of access it grants. By connecting a Connected System, Customer authorizes Discern to access it through the credentials, tokens, and permission scopes that Customer configures. The Service supports scoped, least-privilege access, and Customer may narrow or revoke access at any time through the Service or the Connected System.
4.2 Credential Protection. Discern shall (a) use the credentials, tokens, and keys for Connected Systems solely to provide the Service; (b) protect them using safeguards no less protective than those described in Section 7.1; and (c) on termination or expiration of the Agreement, or on Customer’s earlier request, revoke, delete, and cease using them.
4.3 Customer Responsibilities. Customer represents that it has the right to connect each Connected System and to grant Discern the access described in Section 4.1, including under Customer’s agreements with the providers of those systems. Customer is responsible for maintaining the security of its own environment and credentials, for keeping access scopes current, and for the accuracy of the configurations and policies in its Connected Systems.
4.4 Allocation. Each party is responsible for unauthorized access to a Connected System to the extent the access results from that party’s failure to perform its obligations under this Section 4.
5.1 Customer Authorization Required. The Service takes an Automated Action only within the action classes, scopes, and autonomy settings that Customer configures and authorizes through the Service’s authorization controls. The Service supports autonomy tiers for each action class, including recommend-only, approval-required, and autonomous execution, and Customer selects the tier for each action class. Customer’s authorizations are recorded in the Service.
5.2 Logging. Discern shall maintain a log of every Automated Action, including the action taken, the target system, the authorization under which it was taken, and the time, and shall make the log available to Customer in the Service.
5.3 Suspension Controls. Customer may suspend some or all Automated Actions at any time through the Service, and suspension takes effect promptly. Discern may suspend Automated Actions if Discern reasonably believes they are being misused or present a security risk, and shall notify Customer promptly of any such suspension.
5.4 Nature of Automated Actions; Allocation. The Service uses probabilistic, machine-learning systems, and Automated Actions may vary for similar conditions. Discern shall apply reasonable care, testing, and guardrails in designing and operating Automated Actions. As between the parties, and subject to Discern’s obligations under this Section 5 and Section 13.3, Customer is responsible for the outcomes of Automated Actions performed within the action classes, scopes, and autonomy settings that Customer configured and authorized, and for determining that automated changes fit within Customer’s own change-management and compliance processes.
5.5 AI & Automation Addendum. The AI & Automation Addendum governs Automated Actions in further detail and controls over these Terms with respect to Automated Actions.
6.1 Ownership; License to Discern. Customer owns Customer Data. Customer grants Discern a non-exclusive license to host, process, transmit, and display Customer Data solely (a) to provide, secure, support, and maintain the Service; (b) to prevent or address service, security, or technical issues; and (c) to comply with applicable law. Discern acquires no other rights in Customer Data.
6.2 No Training; No Cross-Customer Use. Discern shall not (a) use Customer Data to train, fine-tune, or improve any artificial intelligence or machine learning model, except through Aggregated Data as permitted by Section 6.3; (b) disclose Customer Data to any other customer; or (c) sell Customer Data.
6.3 Aggregated Data. Discern may create Aggregated Data and may use it to operate, secure, and improve the Service and to provide benchmarking and trend features within the Service. Discern shall not attempt to re-identify any person, entity, device, or system from Aggregated Data.
6.4 Subprocessors. Discern may use subprocessors, including hosting and foundation-model providers, to provide the Service. Discern shall (a) maintain a current list of subprocessors; (b) provide a mechanism for notice of additions; (c) impose on each subprocessor data-protection obligations no less protective than those in these Terms and the DPA, including that no subprocessor may use Customer Data to train its models; and (d) remain responsible for its subprocessors’ performance.
6.5 DPA. The DPA governs the processing of personal data within Customer Data and controls over these Terms with respect to data protection.
6.6 Restricted Data. The Service is designed to process security posture and configuration data from Connected Systems. Customer shall not submit to the Service protected health information, payment card data, or other categories of regulated data that the Documentation does not identify as supported, unless the parties agree otherwise in an Order.
6.7 Retention. Discern shall retain Customer Data only as needed to provide the Service and as required by law, and shall handle Customer Data on termination in accordance with Section 9.4.
7.1 Security Program. Discern shall maintain an information security program with administrative, technical, and physical safeguards designed to protect Customer Data, as described in Discern’s security documentation. The program includes encryption of Customer Data in transit and at rest, access controls, personnel security, vulnerability management, and independent audits, and Discern shall maintain certifications or attestations at least as protective as SOC 2 Type II and ISO 27001 during each Subscription Term.
7.2 Tenant Isolation. Discern shall maintain logical isolation of each customer’s data and configurations and shall not permit any customer’s data to be accessed by or exposed to any other customer.
7.3 Incident Notice. Discern shall notify Customer without undue delay, and in any event within 72 hours, after Discern has reasonable grounds to believe that a Security Incident has occurred. The notice must describe, to the extent then known, the nature of the incident, the Customer Data affected, and the measures taken or planned. Discern shall investigate, mitigate, and remediate the incident and shall cooperate with Customer’s reasonable requests for information about it. Discern’s notice of a Security Incident is not an admission of fault.
7.4 Shared Responsibility. Customer is responsible for the security of its own environment, including its Connected Systems, endpoints, credentials, and personnel, and for its configuration choices within the Service.
8.1 Fees. Customer shall pay the fees stated in each Order. Unless the Order states otherwise, fees are billed [annually in advance] and are due [30] days from the invoice date. Except as expressly stated in these Terms, fees are non-refundable and usage commitments cannot be decreased during a Subscription Term.
8.2 Late Payment; Suspension. Undisputed amounts not paid when due bear interest at the lesser of 1.5% per month and the maximum lawful rate. If an undisputed amount remains unpaid [10] days after Discern gives notice of non-payment, Discern may suspend the Service until the amount is paid. Fees continue to accrue during a suspension for non-payment, and Discern shall restore the Service promptly after payment.
8.3 Taxes. Fees are exclusive of taxes. Customer is responsible for all sales, use, value-added, and similar taxes on the transactions under these Terms, other than taxes on Discern’s income. If law requires Customer to withhold taxes from a payment, Customer shall increase the payment so that Discern receives the amount it would have received without the withholding, and shall provide evidence of the withheld payment on request.
8.4 Fee Changes. Discern may change the fees for a renewal Subscription Term by giving notice at least [90] days before the renewal date. Fee changes do not apply during a then-current paid Subscription Term.
9.1 Term; Renewal. These Terms apply from the Effective Date for as long as any Order is in effect. Each Subscription Term renews for successive one-year periods unless either party gives notice of non-renewal at least 60 days before the end of the then-current Subscription Term.
9.2 Termination for Cause. Either party may terminate the Agreement, or the affected Order, on notice if the other party (a) materially breaches the Agreement and does not cure the breach within 30 days after notice of it, or within 10 days after notice in the case of Customer’s non-payment; or (b) becomes the subject of a bankruptcy, insolvency, receivership, liquidation, or assignment for the benefit of creditors. A notice of non-payment under this Section 9.2 may state that the affected Order terminates automatically if the amount is not paid within the 10-day period. If an undisputed amount remains unpaid [60] days after its due date, Discern may terminate the affected Order immediately, whether or not Discern gave notice of non-payment, and without any further notice or cure period.
9.3 No Mid-Term Termination for Convenience. Customer may not terminate an Order for convenience during a Subscription Term, and its payment obligations for the Subscription Term are not affected by its non-use of the Service. Discern may terminate an Order for convenience on at least [60] days’ notice, in which case Discern shall refund the prepaid fees for the period after the effective date of termination.
9.4 Effect of Termination. When an Order expires or terminates:
(a) Access. Customer’s access right under that Order ends.
(b) Export. For 30 days after expiration or termination, Discern shall make Customer Data available for export in a commonly used, machine-readable format at no additional charge.
(c) Deletion. After the export period, Discern shall delete Customer Data within [30] days, and shall delete it from backup media in the ordinary rotation of backups and in any event within [90] days, except to the extent law requires retention.
(d) Certification. Discern shall confirm the deletion in writing on Customer’s request.
(e) Credentials. Discern shall revoke and delete all credentials, tokens, and keys for Customer’s Connected Systems.
(f) Fees. Termination does not relieve Customer of the obligation to pay fees accrued before the effective date of termination, and if Customer terminates for Discern’s uncured material breach, Discern shall refund the prepaid fees for the period after the effective date of termination.
9.5 Survival. Sections 1, 2.4, 6, 8 (with respect to accrued amounts), 9.4, 9.5, 11, 12, 13.4, 14, 15, 16, and 18 survive expiration or termination of the Agreement, together with any other provision that by its nature is intended to survive.
10.1 Grounds. Discern may suspend Customer’s access to all or part of the Service immediately if Discern reasonably believes that (a) Customer’s use violates the AUP or Section 2.4 in a manner that is material; (b) continued access presents a security risk to the Service, to Discern, or to any third party; or (c) suspension is required by law or governmental order. Section 8.2 governs suspension for non-payment.
10.2 Notice; Restoration. Discern shall notify Customer of a suspension within 48 hours unless law prohibits notice, shall limit the suspension in scope and duration to what the circumstances reasonably require, and shall restore access promptly after the ground for suspension is resolved. Discern is not liable for a suspension made in good faith under this Section 10.
11.1 Discern IP. Discern owns the Service, the Documentation, and all software, models, algorithms, interfaces, and know-how used to provide them, together with all modifications and improvements and all intellectual property rights in them, including learnings embodied in Aggregated Data. Except for the rights expressly granted in these Terms, Discern reserves all rights in the Service, and Customer receives no implied rights.
11.2 Outputs. As between the parties, Customer owns the Outputs generated for Customer, excluding the Discern property described in Section 11.1 that may be embodied in them, and Discern grants Customer a license to use Outputs for its internal business purposes after the Subscription Term. Discern may host, process, and display Outputs as needed to provide the Service. The Service may generate similar outputs for other customers, and Discern makes no representation that any Output is unique to Customer.
11.3 Feedback. If Customer provides suggestions, ideas, or other feedback about the Service, Customer assigns to Discern all right, title, and interest in the feedback, and Discern may use it without restriction or compensation. This section does not transfer any rights in Customer Data.
11.4 Publicity. Discern may identify Customer by name and logo as a Discern customer on Discern’s website and in customer lists and marketing materials, consistent with any brand guidelines Customer provides. Customer may opt out, or withdraw a prior opt-in, at any time by notice to [email]. Within 30 days after an opt-out, Discern shall remove Customer’s name and logo from its website and other digital materials and shall not include them in new materials, but Discern is not required to recall or destroy materials already printed or distributed. Neither party may issue a press release about the relationship without the other party’s prior written consent.
12.1 Definition. “Confidential Information” means non-public information disclosed by a party (“Discloser”) to the other party (“Recipient”) in connection with the Agreement that is identified as confidential or that a reasonable person would understand to be confidential from its nature or the circumstances of disclosure. Customer’s Confidential Information includes Customer Data. Discern’s Confidential Information includes the Service, its architecture and models, its security documentation, and its pricing. Confidential Information does not include information that (a) is or becomes publicly available through no fault of the Recipient; (b) the Recipient knew without restriction before disclosure; (c) the Recipient receives from a third party without breach of an obligation of confidentiality; or (d) the Recipient develops independently without use of the Discloser’s Confidential Information.
12.2 Obligations. The Recipient shall (a) use the Discloser’s Confidential Information only to exercise its rights and perform its obligations under the Agreement; (b) not disclose it except to employees, contractors, Affiliates, and professional advisors who need to know it and are bound by obligations at least as protective as this Section 12; and (c) protect it with at least the care it uses for its own similar information, and no less than reasonable care. The Recipient is responsible for any breach of this Section 12 by anyone to whom it discloses Confidential Information.
12.3 Compelled Disclosure. If law or legal process requires the Recipient to disclose Confidential Information, the Recipient shall, to the extent legally permitted, give the Discloser prompt notice and reasonable cooperation to seek protective treatment, and shall disclose only what is required.
12.4 Return; Duration. On the Discloser’s request, the Recipient shall return or destroy the Discloser’s Confidential Information, except copies retained in routine backups or as required by law, which remain subject to this Section 12. The obligations in this Section 12 continue for 5 years after disclosure, except that obligations for Customer Data continue for as long as Discern holds it and obligations for trade secrets continue for as long as the information remains a trade secret.
12.5 Equitable Relief. A breach of this Section 12 may cause harm that damages alone cannot remedy, and the Discloser may seek injunctive relief in addition to other remedies.
13.1 Mutual. Each party represents that it is duly organized and validly existing, that it has the authority to enter into the Agreement, and that its performance does not conflict with any other obligation binding on it.
13.2 Customer. Customer represents that (a) it has all rights and consents necessary to submit Customer Data to the Service and to connect each Connected System; (b) its use of the Service complies with applicable law; (c) neither Customer nor any Authorized User is located in an embargoed jurisdiction or named on a restricted-party list described in Section 18.4; and (d) the individual who accepted these Terms on Customer’s behalf had the authority to bind Customer.
13.3 Limited Warranty. Discern warrants that during a paid Subscription Term (a) the Service will conform in all material respects to the Documentation, and (b) Discern will provide the Service in a professional and workmanlike manner. If the Service does not conform and Customer notifies Discern of the non-conformity, Discern shall correct it at no charge. If Discern does not correct a material non-conformity within 30 days after notice, Customer may terminate the affected Order, and Discern shall refund the prepaid fees for the period after the effective date of termination. This Section 13.3 states Customer’s exclusive remedy, and Discern’s entire liability, for breach of the warranty in this Section 13.3.
PLEASE READ THIS SECTION 13.4 CAREFULLY. IT LIMITS WHAT DISCERN PROMISES ABOUT THE SERVICE.
13.4 Disclaimers. Except as expressly stated in Section 13.3, the Service, the Documentation, and all Outputs are provided “as is,” and Discern disclaims all other warranties, whether express, implied, statutory, or otherwise, including any implied warranty of merchantability, fitness for a particular purpose, title, or non-infringement, and any warranty arising from course of dealing or usage of trade. Without limiting the preceding sentence: (a) Discern does not warrant that the Service will identify, detect, assess, prevent, or remediate every vulnerability, misconfiguration, threat, or risk in Customer’s environment, or that any Output is complete or accurate; (b) the Service uses probabilistic, machine-learning systems, and Outputs and Automated Actions may vary and may contain errors, and Customer is responsible for review of Outputs by qualified personnel before relying on them for significant decisions; (c) Discern does not warrant that the Service will be uninterrupted or error-free; and (d) the Service is a tool that supports Customer’s security program, and Customer, not Discern, remains responsible for Customer’s own security program, compliance obligations, and the protection of its systems and data.
14.1 By Discern. Discern shall defend Customer against any third-party claim alleging that the Service, as provided by Discern and used in accordance with the Agreement, infringes the claimant’s copyright, trademark, trade secret rights, or United States patent, and shall indemnify Customer against the damages, costs, and reasonable attorneys’ fees finally awarded on the claim or agreed in settlement. This obligation does not apply to a claim arising from (a) Customer Data or a Connected System; (b) Customer’s modification of the Service or combination of the Service with items not provided by Discern, if the claim would not have arisen without the modification or combination; or (c) use of the Service in violation of the Agreement or after Discern notified Customer to stop the use because of the claim. If the Service becomes, or in Discern’s reasonable opinion is likely to become, the subject of an infringement claim, Discern may, at its option and expense, (i) procure the right for Customer to continue using the Service; (ii) modify or replace the Service so that it is non-infringing without materially reducing its functionality; or (iii) terminate the affected Order and refund the prepaid fees for the period after the effective date of termination. This Section 14.1 states Customer’s exclusive remedy, and Discern’s entire liability, for third-party infringement claims relating to the Service.
14.2 By Customer. Customer shall defend Discern against any third-party claim arising from (a) Customer Data, including a claim that Customer lacked the rights or consents required by Section 13.2(a); (b) Customer’s use of the Service in violation of law or the Agreement; or (c) an Automated Action performed within the action classes, scopes, and autonomy settings that Customer configured and authorized, except to the extent the claim arises from Discern’s breach of the Agreement, and Customer shall indemnify Discern against the damages, costs, and reasonable attorneys’ fees finally awarded on the claim or agreed in settlement.
14.3 Procedure. The indemnified party shall give the indemnifying party prompt notice of the claim (except that late notice relieves the indemnifying party of its obligations only to the extent it is prejudiced by the delay), sole control of the defense and settlement of the claim, and reasonable cooperation at the indemnifying party’s expense. The indemnifying party shall not settle a claim in a way that imposes any liability, admission, or obligation on the indemnified party without the indemnified party’s prior written consent. The indemnified party may participate in the defense with its own counsel at its own expense.
PLEASE READ THIS SECTION 15 CAREFULLY. IT LIMITS EACH PARTY’S LIABILITY.
15.1 No Indirect Damages. Neither party is liable to the other for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenues, goodwill, or anticipated savings, under any theory of liability, even if advised of the possibility of those damages and even if a limited remedy fails of its essential purpose.
15.2 General Cap. Except as stated in Sections 15.3 and 15.4, each party’s total liability arising out of or relating to the Agreement will not exceed the fees paid or payable by Customer for the Service in the [12] months before the event giving rise to the liability.
15.3 Enhanced Caps. (a) Discern’s total liability for claims arising out of a Security Incident caused by Discern’s breach of Section 6 or Section 7 will not exceed [2] times the amount described in Section 15.2. (b) Each party’s total liability under Section 14 will not exceed [3] times the amount described in Section 15.2. Each enhanced cap in this Section 15.3 is a substitute for, and not in addition to, the cap in Section 15.2 for the claims it covers.
15.4 Exceptions. Nothing in this Section 15 limits (a) Customer’s obligation to pay fees; (b) liability arising from a party’s infringement or misappropriation of the other party’s intellectual property; (c) liability arising from a party’s fraud or willful misconduct; or (d) liability that cannot be limited under applicable law.
15.5 Basis of the Bargain. The limitations in this Section 15 allocate risk between the parties, form an essential basis of the bargain, and apply regardless of the number of claims.
16.1 Governing Law. These Terms are governed by the laws of the State of California, excluding its conflict of laws rules. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act do not apply.
16.2 Informal Resolution. Before filing a claim, a party shall give the other party notice of the dispute, and the parties shall attempt in good faith to resolve it for [15] business days. Either party may seek injunctive relief at any time without following this Section 16.2.
PLEASE READ SECTIONS 16.3 AND 16.4 CAREFULLY. THEY REQUIRE THAT DISPUTES BE RESOLVED BY BINDING ARBITRATION ON AN INDIVIDUAL BASIS.
16.3 Arbitration. Subject to Section 16.2, and except for the proceedings described in Sections 16.5 and 16.6, any dispute arising out of or relating to the Agreement or the Service will be resolved by final and binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator, with its seat in Santa Clara County, California. The Federal Arbitration Act governs the interpretation and enforcement of this Section 16.3. The arbitrator, and not a court, has exclusive authority to resolve any dispute about the interpretation, applicability, or enforceability of this arbitration agreement, except that only a court may decide the enforceability of the class action waiver in Section 16.4. Judgment on the award may be entered in any court of competent jurisdiction. The parties shall keep the existence, content, and result of the arbitration confidential, except as necessary to enforce or challenge the award or as required by law. If [25] or more demands for arbitration raising similar claims are filed against either party by the same or coordinated counsel, the demands will be administered in batches of up to [25], with one arbitrator and one set of administrative fees per batch.
16.4 Class Action Waiver. Each party may bring a claim against the other only in its individual capacity, and not as a plaintiff or member of a class or in any consolidated or representative proceeding, and the arbitrator may not consolidate the claims of more than one customer or preside over any form of class or representative proceeding. If a court determines that this Section 16.4 is unenforceable as to a particular claim, that claim, and only that claim, is to proceed in the courts described in Section 16.6, and all other claims remain subject to arbitration.
16.5 Injunctive Relief. A breach of Section 2.4, Section 11, or Section 12 may cause irreparable harm, and the non-breaching party may seek injunctive relief for such a breach without posting a bond.
16.6 Courts; Excepted Proceedings; Jury Waiver. Either party may bring a claim that qualifies in small claims court, and Discern may bring an action to collect unpaid fees in court. For those proceedings, for a claim described in the last sentence of Section 16.4, for injunctive relief under Section 16.5, and for a proceeding to confirm, modify, vacate, or enforce an arbitration award, each party consents to the exclusive jurisdiction and venue of the state and federal courts located in Santa Clara County, California, except that a small-claims action may be brought in any small claims court of competent jurisdiction. To the extent a dispute proceeds in court, each party waives its right to a trial by jury to the fullest extent permitted by law. The waiver in Section 16.4 applies to any proceeding in court under this Section 16.6 to the fullest extent permitted by law.
17.1 Updates. Discern may update these Terms from time to time. Discern shall post each updated version at https://www.discernsecurity.com/terms-of-service with a new version number and “Last Updated” date and shall maintain an archive of prior versions.
17.2 Notice; Effectiveness. For a change that materially reduces Customer’s rights or increases Customer’s obligations, Discern shall give at least 30 days’ advance notice by email or through the Service, and the change takes effect for Customer at the start of Customer’s next Subscription Term. All other changes take effect for Customer on posting. If Customer objects to a material change, Customer may decline renewal under Section 9.1. Continued use of the Service after a change takes effect constitutes acceptance of the change. No change applies retroactively to a claim that arose before the change took effect.
18.1 Notices. Every notice under these Terms must be in writing. Discern may give Customer notices by email to the address associated with Customer’s account or through the Service. Customer shall give Discern legal notices by email to [legal email] and, simultaneously, by mail to [address]. An emailed notice is deemed received 24 hours after it is sent, unless the sender receives an automated notice of delivery failure, in which case the sender must deliver the notice by another method in this Section 18.1. A party may change its notice address by notice given under this Section 18.1.
18.2 Assignment. Customer may not assign the Agreement, in whole or in part, without Discern’s prior written consent, and a change of control of Customer is an assignment for this purpose. Discern may assign the Agreement to an Affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, provided the assignee assumes Discern’s obligations. A purported assignment in violation of this Section 18.2 is void. The Agreement binds and benefits the parties and their permitted successors and assigns.
18.3 Force Majeure. Neither party is liable for a delay or failure to perform, other than a failure to pay, caused by an event beyond its reasonable control, including a natural disaster, act of war or terrorism, labor dispute, governmental action, epidemic, utility or internet failure, or denial-of-service or similar attack. The affected party shall notify the other party promptly and use reasonable efforts to resume performance. If the event continues for more than 60 consecutive days, either party may terminate the affected Order on notice, and Discern shall refund the prepaid fees for the period after the effective date of termination.
18.4 Export; Sanctions. Each party shall comply with applicable export control and economic sanctions laws, including the Export Control Reform Act of 2018, the Export Administration Regulations, and the sanctions programs administered by the Office of Foreign Assets Control. Customer shall not permit access to the Service from an embargoed jurisdiction or by a person on a restricted-party list, and shall not use the Service for an end use prohibited by those laws.
18.5 Anti-Corruption. Each party shall comply with applicable anti-bribery and anti-corruption laws in connection with the Agreement.
18.6 Relationship. The parties are independent contractors. The Agreement does not create a partnership, joint venture, agency, or employment relationship.
18.7 No Third-Party Beneficiaries. The Agreement is for the benefit of the parties and their permitted successors and assigns, and no other person has any rights under it.
18.8 Severability; Waiver. If a provision of the Agreement is held unenforceable, it is to be modified to the minimum extent necessary to make it enforceable, and the remaining provisions remain in effect. A waiver is effective only if it is in a writing signed by the waiving party, and applies only to the specific matter and instance for which it is given. A party’s failure or delay in exercising a right is not a waiver of it, and a partial exercise of a right does not prevent a later exercise of it.
18.9 Electronic Contracting. The parties may enter into and sign Orders and other documents under these Terms electronically, including by click-through acceptance, and shall not dispute the validity of an electronic signature or acceptance on the ground that it is electronic.
18.10 Entire Agreement; Precedence. The Agreement is the entire agreement of the parties about the Service and supersedes all prior and contemporaneous agreements and understandings about it, including any earlier terms of service or end user license agreement. A term in a Customer purchase order or similar document is void, even if the document is accepted or processed. If the documents conflict, the order of precedence is: (a) the Order; (b) the DPA, for data-protection matters; (c) the AI & Automation Addendum, for matters relating to Automated Actions; (d) these Terms; and (e) the AUP and the SLA.
18.11 Interpretation. Headings do not affect interpretation. “Including” means “including without limitation.” These Terms are not to be construed against either party as the drafter.
