A. Definitions

• “Account” represents your legal relationship with Tacit. A “Personal Account” represents an individual User’s authorization to log in to and use the Service and serves as a User’s identity on Tacit. “Workspaces” are shared environments that may be associated with a single entity or with one or more Users, where multiple Users can collaborate on vulnerability monitoring, assessment, disclosure, and related workflows. A Personal Account can be a member of any number of Workspaces.

• “Agreement” refers, collectively, to all the terms, conditions, and notices contained in or referenced in this document (the “Terms of Service” or the “Terms”) and all other operating rules, policies (including the Tacit Privacy Notice, see tacit.now/pricacy), and procedures that we may publish from time to time on the Website.

• “Beta Features” mean software, services, or features identified as alpha, beta, preview, early access, evaluation, or words or phrases with similar meanings.

• “Content” refers to content featured, processed, generated, or displayed through the Website or Service, including without limitation vulnerability records, advisories, descriptions, SBOMs, VEX files, metadata, code, text, data, articles, images, photographs, graphics, software, applications, packages, designs, features, reports, audit logs, and other materials that are available on the Website or otherwise available through the Service. “Content” also includes outputs created by the Service based on inputs you provide (for example, generated reports or normalized vulnerability data). “User-Generated Content” is Content, written or otherwise, created, uploaded, submitted, or made available by Users. “Your Content” is Content that you create, own, or are authorized to submit.

• “Tacit,” “We,” and “Us” refer to Tacit now, a French simplified joint-stock company (société par actions simplifiée, “SAS”) registered with the Paris Trade and Companies Register (RCS Paris) under number 101 401 883, with its registered office at Bureau 326, 59 rue de Ponthieu, 75008 Paris, France., as well as our affiliates, directors, subsidiaries, contractors, licensors, officers, agents, and employees.

• “Service” refers to the applications, software, products, APIs, and services provided by Tacit, including any Beta Features.

• “User,” “You,” and “Your” refer to the individual person, company, or organization that has visited or is using the Website or Service; that accesses or uses any part of an Account; or that directs the use of an Account in the performance of its functions. A User must be at least the age of majority in their jurisdiction and otherwise capable of entering into a binding contract. Additional terms may apply for business, regulated, or government Users (if applicable).

• “Website” refers to Tacit’s website located at tacit.now and any Tacit-owned subdomains, and all content, services, and products provided by Tacit at or through them. Occasionally, websites or services operated by Tacit may provide different or additional terms of service. If those additional terms conflict with this Agreement, the more specific terms apply to the relevant page or service..

B. Accounts terms

1. Account Controls

• Personal Accounts. Subject to these Terms, you retain ultimate administrative control over your Personal Account and the Content within it.

• Workspaces. The “owner” (or administrator) of a Workspace has ultimate administrative control over that Workspace and the Content within it. Within the Service, an owner can manage User access, roles, permissions, watchlists/audience lists, disclosure visibility settings, integrations, and Workspace configuration. A Workspace may have multiple owners, but there must be at least one Personal Account designated as an owner. If you are the owner of a Workspace under these Terms, we consider you responsible for the actions performed on or through that Workspace.

2. Required Information

You must provide a valid email address to complete signup. Any other information requested (such as your real name) may be optional unless you are accepting these Terms on behalf of a legal entity (in which case we may need information about the legal entity) or you opt for a paid plan (in which case additional billing information will be necessary).

3. Account Requirements

• Human creation. You must be a human to create an Account. Accounts registered by “bots” or other automated methods are not permitted.

• Service accounts (optional). We may permit “service accounts” (sometimes called machine accounts) used exclusively for automated tasks (e.g., API-based ingestion or integrations), provided a human accepts the Terms on behalf of the account, provides a valid email address, and remains responsible for its actions. Multiple Users may direct a service account, but the designated owner is ultimately responsible.

• One Account rule (optional). One person or legal entity may maintain no more than one free Personal Account, unless otherwise permitted by the Service plan.

• Age. You must be at least 13 years old and meet any higher minimum age required by your country’s laws.

• Login sharing. Your login may only be used by one person. Workspace access must align with your subscription limits (if applicable).

• Legal compliance. You may not use the Service in violation of applicable laws or regulations, including sanctions/export control laws where applicable.

4. Account Security

You are responsible for keeping your Account secure while you use the Service. We may offer security features to help, but you remain responsible for:

• all Content posted and activity occurring under your Account (including actions by Users you authorize within your Workspace);

• maintaining the security of your password and authentication methods; and

• promptly notifying us at support@tacit.now if you become aware of any unauthorized use of, or access to, the Service through your Account.

5. Additional Terms

In some situations, third-party terms may apply to your use of Tacit (for example, third-party integrations you enable, identity providers you use to authenticate, or services you connect via API). While these Terms are our full agreement with you for Tacit, third-party terms govern their relationships with you.

C. Acceptable Use

Your use of the Website and Service must not violate any applicable laws, including intellectual property laws, data protection laws, export control/sanctions laws, or other laws in your jurisdiction.

You are responsible for ensuring that your use of the Service complies with laws and any applicable regulations.

Without limiting the above, you agree not to misuse the Service to:

• unlawfully access, exfiltrate, or disclose third-party confidential information;

• publish or distribute misleading, fraudulent, or deceptive security information;;

• publish or distribute malicious payloads, exploit code, or instructions intended for wrongdoing (except where expressly permitted for legitimate security research and lawful disclosure workflows);

• harass, threaten, or impersonate others; or

• attempt to disrupt, overload, or circumvent security measures of the Service.

D. User-Generated Content

1. Responsibility for User-Generated Content

You may create or upload User-Generated Content while using the Service (including vulnerability disclosures, advisories, status updates, SBOMs, VEX, evidence, attachments, and related metadata). You are solely responsible for Your Content and for any harm resulting from any Content you post, upload, link to, or otherwise make available via the Service, regardless of its form. We are not responsible for any public display or misuse of Your Content caused by your configuration choices (including disclosure visibility settings and audience rules).

2. Tacit May Remove Content

We have the right to refuse or remove any User-Generated Content that, in our sole discretion, violates any laws, these Terms, or our policies, or that poses a security, legal, or operational risk.

3. Ownership of Content, Right to Post, and License Grants

You retain ownership of and responsibility for Your Content. If you submit anything you did not create yourself or do not own, you agree that you are responsible for the Content you submit, that you will only submit Content you have the right to submit, and that you will comply with any third-party licenses or obligations that apply.

Because you retain ownership of Your Content, you need to grant us certain legal permissions so we can provide the Service.

4. License Grant to Us

You grant Tacit and our legal successors the right to host, store, process, archive, parse, index, analyze, and display Your Content, and to make incidental copies (including backups), as necessary to provide, maintain, secure, and improve the Service.

This includes the right to:

• store Your Content in our databases and backups;

• display it to you and to Users you authorize (including via Workspace roles, access rules, and watchlists);

• process it to create outputs you request (e.g., normalized vulnerability data, reports, audit trails, disclosure pages, or notifications);

• perform security and integrity checks; and

• troubleshoot and provide support.

This license does not grant Tacit the right to sell Your Content. Tacit will not use Your Content outside the provision of the Service except as permitted by these Terms, your instructions/configurations, or applicable law.

5. License Grant to Other Users

If you configure certain Content to be shared with other Users (for example, by publishing a statement to a defined audience or making it publicly accessible), you grant those Users a nonexclusive, worldwide license to access, view, and use that Content through the Service, subject to the visibility and permission model you choose and any additional terms you attach (if the Service supports it).

You are responsible for ensuring you have the rights to share Content with others under the permissions you select.

6. Contributions Under Workspace or Project Terms

If the Service supports collaborative editing or contributions inside a Workspace (for example, multiple Users contributing to a statement), then contributions may be governed by the Workspace’s rules and any additional agreements in place between Workspace members.

7. Moral Rights

To the extent permitted by applicable law, you waive and agree not to assert moral rights against us, solely to enable us to exercise the rights granted in Section D.4 (for example, formatting or transforming Content to display it properly, or generating machine-readable outputs). This does not affect your ownership of Your Content.

8. Automated Access and Scraping

You agree not to use automated means to access, collect, or scrape the Service or Content in a way that:

• violates these Terms or our policies,

• bypasses access controls,

• imposes an unreasonable load on the Service, or

• extracts Content at scale for commercial purposes without authorization.

If you want to integrate programmatically, use our APIs and comply with Section H.

E. Private Workspaces and Confidential Content

1. Control of Private Content

Some Accounts may have private Workspaces that allow the Workspace owner to control access to Content.

2. Confidentiality

Tacit treats Content stored in private Workspaces and any Content configured as non-public as confidential to you. Tacit will protect such Content from unauthorized access, use, or disclosure using a reasonable standard of care and security measures appropriate to the Service.

3. Access by Tacit

Tacit personnel may access non-public Content only when necessary to:

• provide support at your request,

• maintain and secure the Service,

• investigate abuse or security incidents,

• comply with legal obligations, or

• with your consent.

We may be compelled by law to disclose Content. Where permitted, we will provide notice regarding legal requests affecting your non-public Content.

F. Copyright Infringement

If you believe that Content on the Website or in the Service infringes your copyright, please contact us at legal@tacit.now with sufficient information for us to investigate. We may remove Content and, where appropriate, suspend or terminate repeat infringers.

G. Intellectual Property Notice

1. Tacit’s Rights

Tacit and our licensors retain ownership of all intellectual property rights related to the Website and Service, including software, designs, and trademarks. We reserve all rights not expressly granted to you under this Agreement.

You may not duplicate, copy, or reuse any portion of the Service (including HTML/CSS, JavaScript, visual design elements, or product concepts) without our express written permission, except as permitted by law.

2. Trademarks and Logos

Use of Tacit trademarks, logos, and brand assets must comply with our brand guidelines (if published) or with written permission from Tacit.

H. API Terms

If you use Tacit APIs (including via a third-party product that accesses Tacit), you agree to these Terms and this Section H.

• Abuse or excessively frequent requests to Tacit via the API may result in temporary or permanent suspension of your Account’s API access. Tacit will determine abuse or excessive usage in its sole discretion, and we will make a reasonable attempt to warn you via email prior to suspension where practicable.

• You may not share API tokens to circumvent rate limits or subscription constraints.

• You may not use the API to download data or Content for spamming purposes or unlawful profiling, including the sale of Users’ personal information.

All API use is subject to these Terms and the Tacit Privacy Notice.

Tacit may offer subscription-based access for higher throughput or commercial use cases.

I. Additional Product Terms

Some Service features may be subject to additional terms specific to that feature or product, as set forth in “Additional Product Terms” or similar supplemental documentation. By accessing or using those features, you also agree to the applicable supplemental terms.

J. Beta Features

1. Subject to Change

Beta Features may not be supported and may be changed or discontinued at any time without notice. Beta Features may not be subject to the same security measures and auditing as generally available features. By using a Beta Feature, you do so at your own risk.

2. Confidentiality

If you receive non-public information about a private Beta Feature (“Confidential Information”), you agree to:

• use it only to test and evaluate the Beta Feature,

• protect it with reasonable care, and

• not disclose it to third parties unless permitted by Tacit.

Confidential Information does not include information that becomes public without your breach, was known to you before disclosure, was independently developed by you without breach, or was disclosed with Tacit’s permission. If you are required by law to disclose Confidential Information, you will provide notice to Tacit when legally permitted.

3. Feedback

If you provide suggestions or feedback (“Feedback”), you grant Tacit a royalty-free, fully paid-up, worldwide, transferable, sublicensable, irrevocable, and perpetual license to implement, use, modify, commercially exploit, and incorporate the Feedback into our products and services.

K. Payment

1. Pricing and Plans

Pricing, plan features, and billing frequency are described on the Website here and/or in the applicable order form, quote, or subscription page (the “Order”). If there is any conflict, the Order will prevail for commercial terms (pricing, term, and billing cadence).

Unless otherwise stated, prices are exclusive of taxes (including VAT), duties, and similar governmental assessments, which will be added where applicable.

2. Subscription Term and Renewal

Subscriptions are purchased for the term indicated in the Order (the “Subscription Term”), typically monthly or annual.

Unless otherwise stated in the Order, subscriptions automatically renew for successive terms of the same length at the then-current price, unless either party gives notice of non-renewal at least 30 days before the end of the current Subscription Term.

3. Upgrades, Downgrades, and Plan Changes

You may change your plan or subscription level through the Service (or as otherwise agreed in an Order):

• Upgrades. If you upgrade, the change may take effect immediately. We may charge (i) the full price of the upgraded plan immediately, or (ii) a prorated amount for the remainder of the current billing period, depending on what the Service supports and/or what is stated in the Order.

• Downgrades. If you downgrade, the change may take effect at the end of the current billing period, unless otherwise stated in the Service or Order. Downgrading may reduce or remove access to certain features, capacity, service levels (including support/SLA), and historical data retention beyond the limits of the downgraded plan.

4. Billing and Payment Authorization

You agree to provide accurate billing information and a valid payment method. By subscribing to a paid plan, you authorize Tacit to charge your payment method for:

• recurring subscription fees (monthly or annual, as applicable),

• usage-based fees (if any), and

• applicable taxes,

in accordance with the pricing displayed at the time of purchase and/or the Order.

If your payment method fails, we may retry payment and/or request an updated payment method.

5. Usage-Based Charges (If Applicable)

Some features may be billed based on usage (for example, volume-based processing, additional seats, storage, API throughput, or other metered features). Where applicable:

• usage metrics and pricing rules will be described on the Website and/or in the Order,

• usage-based fees are billed in arrears on a periodic basis (typically monthly), and

• you are responsible for monitoring your usage and any resulting charges.

6. Invoicing (If Applicable)

If you are approved for invoicing, invoices will be issued as stated in the Order. Unless otherwise specified, invoices are payable within 30 days of the invoice date, in euro or US dollar, without deduction or setoff.

Late payments may accrue interest at the maximum rate permitted by law, and you agree to reimburse reasonable costs of collection.

7. Taxes

Prices are exclusive of applicable taxes (including VAT), which will be added to invoices where required by law.

If you are established in the European Union and provide a valid VAT ID, we will apply the relevant EU VAT rules (including, where applicable, reverse charge / VAT self-assessment).

8. No Refunds; Exceptions

Fees are non-refundable and non-cancellable once paid, except where required by applicable law or as expressly stated in the Order.

For clarity:

• we do not provide refunds or credits for partial subscription periods, unused capacity, or downgrades, and

• cancellation stops future renewals but does not retroactively refund amounts already paid for the current Subscription Term.

9. Suspension for Non-Payment

If payment is overdue or we are unable to collect fees, we may (after providing notice where practicable):

• suspend or limit access to the Service (including API access),

• downgrade the Service level (including support/SLA), and/or

• terminate the subscription for material breach,

until amounts due are paid in full.

10. Billing Disputes

If you believe an invoice or charge is incorrect, you must contact us at billing@tacit.now within 30 days of the charge or invoice date and provide reasonable details. If you do not raise a dispute within that period, the charge will be deemed accepted, except where prohibited by applicable law.

L. Cancellation and Termination

1. Account Cancellation

You are responsible for properly canceling your Account using the cancellation functionality provided in the Service (if available). We are not required to cancel Accounts in response to an email or phone request.

2. Upon Cancellation

We will retain and use information as necessary to comply with legal obligations, resolve disputes, and enforce agreements.

Upon request, we will make reasonable efforts to provide an Account owner with a copy/export of lawful, non-infringing Account contents after cancellation, termination, or downgrade, if supported by the Service. Requests must be made within 30 days.

3. Tacit May Terminate

Tacit may suspend or terminate your access to all or any part of the Website or Service at any time, with or without cause, with or without notice, effective immediately, including for violations of these Terms or risk to the Service or other Users.

4. Survival

All provisions which, by their nature, should survive termination will survive termination, including ownership provisions, warranty disclaimers, indemnities, and limitations of liability.

M. Communications with Tacit

1. Electronic Communication Required

For contractual purposes, you consent to receive communications from us electronically via the email address you submit or via the Service, and you agree that electronic communications satisfy legal requirements for written notices, subject to your non-waivable rights.

2. Legal Notice Must Be in Writing

Service messages and support emails do not necessarily constitute legal notice where formal notice is required. Legal notice to Tacit must be in writing and served at Tacit postal address.

3. No Phone Support (optional)

Tacit may provide support via email and in-Service communications. Unless we explicitly offer it, we do not provide telephone support.

N. Disclaimer of Warranties

THE WEBSITE AND SERVICE ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, SECURITY, ACCURACY, AND NON-INFRINGEMENT.

WE DO NOT WARRANT THAT THE SERVICE WILL MEET YOUR REQUIREMENTS, BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, OR THAT INFORMATION PROVIDED THROUGH THE SERVICE WILL BE ACCURATE OR RELIABLE. YOU ASSUME ALL RISK ARISING FROM YOUR USE OF THE SERVICE.

O. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, TACIT WILL NOT BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY LOSS OF PROFITS, USE, GOODWILL, OR DATA, OR FOR ANY INCIDENTAL, INDIRECT, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, HOWEVER ARISING, INCLUDING DAMAGES RESULTING FROM:

• the use, disclosure, or display of Your Content;

• your use or inability to use the Service;

• any modification, price change, suspension, or discontinuance of the Service;

• the Service generally or the software/systems that make the Service available;

• unauthorized access to or alterations of your transmissions or data;

• statements or conduct of any third party on the Service;

• any user interactions you input or receive through your use of the Service; or

• any other matter relating to the Service.

OUR LIABILITY IS LIMITED EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A REMEDY FAILS OF ITS ESSENTIAL PURPOSE. WE WILL HAVE NO LIABILITY FOR FAILURE OR DELAY DUE TO MATTERS BEYOND OUR REASONABLE CONTROL.

P. Release and Indemnification

If you have a dispute with one or more Users, you agree to release Tacit from any and all claims, demands, and damages (actual and consequential) arising out of or connected with such disputes.

You agree to indemnify, defend, and hold harmless Tacit from and against any and all claims, liabilities, and expenses (including reasonable attorneys’ fees) arising out of your use of the Website or Service, including your violation of this Agreement, provided that Tacit:

1. promptly gives you written notice of the claim,

2. gives you sole control of the defense and settlement (you may not settle unless the settlement unconditionally releases Tacit), and

3. provides reasonable assistance at your expense.

Q. Changes to These Terms

We reserve the right, in our sole discretion, to amend these Terms at any time. We will update the Terms on the Website in the event of amendments.

We will notify Users of material changes (including price increases) at least 30 days before they take effect by posting a notice on the Website or sending an email to the primary email address on the Account. Continued use of the Service after that period constitutes acceptance of the revised Terms.

We may also modify or discontinue the Website or Service (or any part of it) temporarily or permanently, with or without notice.

R. Miscellaneous

1. Governing Law

Except where mandatory law provides otherwise, these Terms are governed by the laws of France. Any dispute arising out of or in connection with these Terms shall be submitted to the exclusive jurisdiction of the courts of Paris, France.

2. Non-Assignability

Tacit may assign or delegate these Terms, in whole or in part, to any person or entity at any time. You may not assign or delegate any rights or obligations under these Terms without Tacit’s prior written consent, and any unauthorized assignment is void.

3. Section Headings

Section headings are for convenience only and are not legally binding.

4. Severability; No Waiver; Survival

If any part of this Agreement is held invalid or unenforceable, that portion will be construed to reflect the parties’ original intent to the extent possible. The remaining portions remain in full force and effect. Failure to enforce a provision is not a waiver. Rights and obligations that should survive termination will survive.

5. Amendments; Complete Agreement

This Agreement may only be modified by a written amendment signed by an authorized representative of Tacit or by posting a revised version in accordance with Section Q. These Terms, together with the Tacit Privacy Notice and any incorporated policies, represent the complete and exclusive agreement between you and Tacit regarding the Service and supersede prior proposals and agreements.

APPENDIX 1: SLA & Customer Support

Tacit provides Customer Support in accordance with the Subscription levels outlined below, subject to Customer compliance with Customer Support procedures. If Customer does not reasonably comply with written specifications or instructions from Tacit’s Customer Support engineers, regarding any support issue or request (including without limitation, failure to make backups of Customer Content or versions of Software) (each, a “Support Issue”), Tacit may suspend support for that issue until Customer provides necessary information.

Service Level Agreement (SLA)

This SLA applies to paid subscriptions only. Tacit commits to make the Tacit web application (the “Covered Experience”) available with a Monthly Uptime Percentage of at least 99.9% during each calendar month (the “SLA”) to paid subscriptoins. “Monthly Uptime Percentage” means the total number of minutes in a calendar month minus the number of minutes of Downtime, divided by the total number of minutes in that month, expressed as a percentage. “Downtime” means the Covered Experience is unavailable to Customer, excluding (i) Scheduled Maintenance (with at least 48 hours’ notice where practicable), (ii) emergency/unscheduled maintenance required for security or stability, (iii) issues caused by Customer’s systems, configuration, or third-party integrations, and (iv) outages or disruptions attributable to third-party providers or events outside Tacit’s reasonable control. Where the Covered Experience is unavailable generally (i.e., not limited to a specific Workspace), all Workspaces are considered affected. Monthly Uptime Percentage will be measured by Tacit’s monitoring systems.

If Tacit fails to meet the Monthly Uptime Percentage in a given calendar month, Customer may be eligible to receive service credits (the “Service Credits”), which will be applied as a credit against future subscription fees. Service Credits are Customer’s sole and exclusive remedy for any failure to meet the SLA.

Service Credits are available only for paid subscriptions and only if the Monthly Uptime Percentage falls below 99.0% in the applicable calendar month. In that case, Service Credits will be calculated based on the monthly subscription fees for the affected Workspace (excluding taxes and any usage-based charges) as follows:

• Monthly Uptime Percentage < 99.0% and ≥ 95.0%: 5% Service Credit

• Monthly Uptime Percentage < 95.0%: 10% Service Credit

Service Credits are capped at 10% of the monthly subscription fees for the affected Workspace for the applicable month.

To receive Service Credits, Customer must submit a written request to support@tacit.now within 30 days after the end of the month in which the SLA was not met, including sufficient information for Tacit to validate the claim. Service Credits will not be granted if Customer is in arrears or otherwise in material breach of the Agreement.