MazeVault License Terms

These license terms (the “License Terms” or the “Agreement”) govern the rights and obligations relating to the use of applications and related services for the centralized management of encryption keys, digital certificates, passwords and related security processes, whose developer, holder of the economic copyright and license provider is MAZEVAULT s.r.o., Company ID: 24517194, with its registered seat at Kubelíkova 1258/43, Žižkov, 130 00 Prague 3, registered in the Commercial Register kept by the Municipal Court in Prague, File No. C 441375 (“MV” or the “Provider”). Authorship and moral rights belong to natural persons under the Copyright Act.

The Partner (reseller) means an entrepreneur authorized, under an agreement with MV, to offer and resell the Applications to Customers and to provide them with support; the Partner presents these License Terms to the Customer and ensures their acceptance. The license to use the Application is granted to the Customer directly by MV upon acceptance of these License Terms.

The other contracting party is the Customer – the entrepreneur identified in the Order or in the account associated with this Agreement.

This Agreement is concluded under Section 2358 et seq. of the Civil Code and in accordance with Act No. 121/2000 Coll., the Copyright Act. It becomes effective at the moment the Customer expresses consent (by ticking a box, completing the order, installing, activating or first using the Application), whichever occurs first. If the Customer does not consent, it is not entitled to use the Application. The person accepting the Agreement on behalf of a legal entity represents that they are authorized to bind it.

The Applications are intended exclusively for entrepreneurs; consumer-protection provisions do not apply.

• “Application” (or “Product”) – computer programs and related service packages for the centralized management of encryption keys, digital certificates, passwords and other secrets (KMS and PKI infrastructure), whose economic copyright is exercised by MV, in all versions, modules, updates and add-ons.
• “License” – the Customer’s non-exclusive, time-limited and non-transferable right to use the Application for its own internal needs in accordance with the defined purpose of use.
• “Customer” – an entrepreneur using the Application in connection with its business activity.
• “User” – a person to whom the Customer allows the Application to be used (typically an employee).
• “Updates and fixes” – bug fixes, security updates and improvements released by MV.
• “Customer Data” – all data entered by the Customer or its Users into the Application or processed by it.
• “Personal Data” – as defined by Regulation (EU) 2016/679 (GDPR).
• “Security Assets” – digital certificates, private and encryption keys, API keys, access credentials, passwords, tokens, secrets, cryptographic materials, configuration data and other information whose compromise may endanger the security of the Customer’s systems.
• “Production / Non-production environment” – an environment for regular operation, or a development/testing/PoC environment, respectively.
• “Supported configuration” – a configuration operated in accordance with MV documentation and supported component versions.
• “Security Incident” – an event leading to or capable of leading to a breach of the confidentiality, integrity or availability of the Application or the Security Assets.

Grant of License. The Customer acquires a non-exclusive, non-transferable and time-limited right to use the Application solely for the internal needs of the Customer and its Users, to the extent and for the period set out in the Order, or for the duration of the paid Subscription, for the stated purposes. The License covers all versions, modules, updates and add-ons under the Order.

Nature of performance. The Agreement does not sell or assign copyright; the Customer acquires only the right to use the Application to the agreed extent.

License variants. The Application is offered in variants according to the Order/price list (in particular PoC, Small Business, Enterprise). The PoC (trial/pilot) license is provided free of charge and for a limited time, generally for no more than 3 months.

Subscription. The consideration for the grant of the License to the Application. The minimum paid Subscription period is 1 month. Unless stated otherwise, the paid Subscription automatically renews for an identical period as set out in the Order until terminated under Article X. A PoC does not renew automatically, nor does it convert into a paid Subscription.

Users. The Customer manages the access of its Users and is responsible for their conduct in accordance with this Agreement as for its own.

Operation and license control. The Customer is not provided with source code or super-admin administrative privileges. Operation and activation are subject to MV license control (MazeVault License Server). License variants may functionally, capacity-wise or technically limit the scope of functionality; circumventing these limits is a material breach of the Agreement. The Customer bears the costs of operation, security and infrastructure in all modes.

Reservation of rights. All rights not expressly granted are reserved to MV. Where necessary and in cases of breach of the License terms, MV is entitled to limit, suspend or cancel part of the Application’s functions or the Application as a whole.

Prohibited conduct. The Customer is not entitled to, and must not allow a third party to:

• reverse engineer, decompile or otherwise attempt to discover the source code of the Application, unless expressly permitted by law (Section 66 of the Copyright Act);
• reproduce, modify, alter, translate or create derivative works without MV’s written consent;
• circumvent, disrupt or disable technical protection measures or licensing, audit or security mechanisms;
• distribute, sub-license, sublicense, rent, lend, sell or provide the Application to third parties, or use it to provide hosting, outsourcing, managed-service, certification, PKI/KMS or similar services to third parties without an express arrangement;
• use the Application contrary to legal regulations, the Agreement, the documentation or its purpose, or in a manner endangering security;
• install third-party software in a manner that would subject the Application to further license terms (in particular copyleft) requiring disclosure or restriction of MV’s rights;
• perform penetration tests, load tests, security scans or similar interventions without MV’s or the Partner’s prior written consent, unless they take place exclusively in the Customer’s environment with no impact on third-party rights;
• remove, alter or obscure authorship notices, trademarks, license information, security warnings or audit records.

Changes and modifications. The Customer must not modify the Application, its components, container images, installation packages, binaries, database schema, or licensing, audit or security functions. Modifications may be made exclusively by MV or persons authorized by MV; satisfying a modification request is at MV’s discretion and may be charged for.

Third-party components are provided under the terms of their publishers; the Customer must comply with those terms and must not modify the components in a way that impairs the functionality, security or license of the Application. Neither MV nor the Partner is liable beyond mandatory legal provisions.

Character of the Application. The Customer acknowledges that the Application serves to manage highly sensitive Security Assets and must be operated and protected as a critical security system; the Customer must adapt its technical, organizational, procedural and physical measures accordingly. The Customer is responsible for its own organizational and technical measures at the level of its enterprise.

The Application may be operated in particular: (i) in a cloud environment operated by the Customer or the Partner, (ii) on-premise / in the Customer’s private server container environment, (iii) in Azure AKS or another Kubernetes environment.

Operation of the Application at the Customer is the sole responsibility of the Partner and/or the Customer depending on the chosen mode; all related relationships are exclusively between the Partner and the Customer and exclude MV’s obligations and liability towards the Customer beyond these License Terms.

Minimum technical requirements and supported configurations are set out in MV technical documentation; operation in an unsupported configuration excludes warranties and SLA (if agreed) on the part of both the Provider and the Partner.

Technical support is provided to the Customer by the Partner, and upstream product support to the Partner by MV; the full parameters may be arranged by the parties in a separate SLA document (Annex No. 1a). In matters of Incident classification, response times, product escalation, updates and lifecycle, the SLA prevails where one is agreed.

CRL/OCSP availability. A Customer using an internal certification authority is responsible for setting certificate parameters (CRL validity, OCSP nextUpdate) so that a short outage during planned maintenance does not cause validation failures in dependent systems; MV recommends setting the CRL nextUpdate to at least 4× the expected maintenance duration. The Partner announces planned maintenance affecting OCSP/CRL at least 72 hours in advance, and at least 4 hours in advance for an urgent security fix. Neither MV nor the Partner is liable for outages caused by the Customer’s settings or infrastructure, or for planned outages in accordance with the License Terms.

End of support for base Application versions (e.g. 1.X.Y to 2.X.Y). MV is entitled to end support for a specific version upon at least 3 months’ prior notice; thereafter there is no obligation to provide fixes, updates or support for that version.

Obligation to apply security updates. The Customer must apply updates within the following periods from their release:

Operating a version with an unpatched critical/high vulnerability beyond these periods is considered a breach of the duty of professional care; in such a case neither MV nor the Partner is liable for damage resulting from exploitation of the vulnerability. Regulated entities (NIS2, DORA, the Cybersecurity Act) may be required to meet stricter deadlines under the applicable law, which prevails. Where a legal regulation sets stricter deadlines, such deadlines apply in preference to the arrangements in these License Terms.

Updates and security fixes. MV performs regular security updates of the Application and, without undue delay after their identification, evaluates and fixes critical defects. There is no entitlement to the development of new functionality or modifications beyond the agreed scope; such activities may be provided for a fee by agreement.

Planned and operational restrictions. MV and/or the Partner is entitled to temporarily limit, cancel, interrupt or suspend the provision of the Application or its functions in order to perform updates, ensure security or for other operational reasons. Restrictions will be carried out with regard to the Customer’s interests so as to disrupt its normal operation as little as possible. The Customer will generally be informed of planned restrictions with reasonable advance notice through the Application or by the Provider, except for urgent security measures.

Restrictions upon breach of terms. MV and/or the Partner is entitled to limit, cancel or prevent access to the Application if the Customer breaches this Agreement or the License rights, breaches the usage restrictions under Article III, is in default with payment of the price, or if there is a threat to cybersecurity, or other important reasons giving rise to a right to suspend/interrupt the Application.

The Application enables the operation of an internal certification authority to issue X.509 certificates exclusively for the Customer’s internal needs.

This function does not constitute a qualified trust service (QTSP) within the meaning of Regulation (EU) No 910/2014 (eIDAS) or Regulation (EU) 2024/1183 (eIDAS2). The Customer is responsible for assessing the admissibility and legal sufficiency of the issued certificates for a specific purpose; neither MV nor the Partner provides legal advice in this respect. Where the Application is deployed at the Customer, the Customer is fully responsible for assessing compliance with the security and other standards required for its operation under the law.

The processing of personal data is governed by the GDPR and Act No. 110/2019 Coll.; details are governed by a separate DPA (Annex No. 2), if this processing regime is adopted by the parties. MV has no standard technical access to the Customer’s environment, data or personal data; it may process limited diagnostic data or temporary access only during a duly authorized escalation, to the extent and in the role set out in the DPA.

Third-party consents. The Customer is responsible for the legal basis for entering third-party personal data into the Application.

Customer Data remains at the Customer’s disposal. MV processes only technical license-server metadata (installation identifier, license status, version, activation timestamps) under the principle of minimization; this metadata is neither Customer Data nor Security Assets. Data residency under DORA (Regulation (EU) 2022/2554), NIS2 or sector regulations is the sole responsibility of the Customer.

Security of Security Assets. The Customer is responsible for the lawfulness of their entry, permission settings, classification, choice of operating mode and appropriate protection measures, as well as for configuring operational resilience.

Backup and recovery. Unless expressly agreed otherwise, the Customer alone is responsible for backing up the Application, Security Assets, Customer Data, databases, configurations and for the recoverability of operations. Neither MV nor the Partner is liable for data loss, corruption or any interference, in particular related to the absence or insufficiency of backups on the Customer’s side.

Control of encryption keys. The encryption keys used to protect the Customer’s environment, database and Security Assets are generated, owned and controlled by the Customer or an operator expressly authorized by it. MV has no standard access to these keys or to the unencrypted content of the Security Assets.

Confidential information – non-public information with economic value, in particular source code, technical documentation, internal architecture, security measures, test results, the terms of the Agreement and know-how; it may constitute a trade secret under Section 504 of the Civil Code.

Duration of confidentiality – for the term of the Agreement and 5 years after its termination; for source code, technical documentation, security mechanisms and information constituting a trade secret, without time limit.

Ownership of rights. All copyright and other intellectual property rights to the Application, its parts, documentation and updates belong to MV; the Agreement does not effect their transfer. Modifications of the Application at the Customer’s request give the Customer no rights beyond the agreed license arrangements.

Protection of know-how. MV is entitled to use the Customer’s suggestions for improving the Application without limitation and free of charge in further development.

Functionality. In a Supported configuration, the Application will function in material respects in accordance with MV documentation. The Application is software operated in the Customer’s or Partner’s infrastructure; MV does not guarantee continuous availability of that infrastructure or of the Application as a whole. The terms of technical support and product escalation are set by the SLA, if agreed.

Rights arising from defects are governed by the Civil Code; the Customer must report defects without undue delay, otherwise they will not be taken into account.

Exclusion of further warranties. To the extent permitted by law, the Application is provided “as is”. As the direct License provider, MV is liable to the Customer for the authorization to use and for defects of the Product to the extent of these License Terms; the Partner is liable to the Customer for support, implementation, configuration and any operation to the extent of the Partner’s agreement with the Customer.

Exclusion of certain types of damage. To the extent permitted by law, neither MV nor the Partner is liable for indirect, consequential or special damage, in particular lost profit, loss of data, business opportunities or interruption of Application operation.

Limitation of the amount of compensation. Aggregate liability is limited to the amount paid by the Customer for the License in the 12 months preceding the decisive event. This limitation does not apply (full liability) to: (a) damage caused intentionally or by gross negligence; (b) damage to a person’s natural rights; (c) breach of confidentiality or protection of Confidential Information; (d) infringement of the intellectual property rights of MV or third parties by the Customer (in particular reproduction, modification, reverse engineering, decompilation or creation of a derivative work contrary to Article III); (e) use of the Application beyond the granted License, circumvention, disruption or disabling of licensing, audit or security mechanisms (in particular the MazeVault License Server); (f) the Customer’s monetary obligations; and (g) cases where the limitation is prohibited by mandatory law.

Exclusion of liability for the Customer’s environment. Neither MV nor the Partner is liable for damage arising from insufficient security of the Customer’s environment, misconfiguration, account misuse, third-party attack, malware/ransomware or compromise of Security Assets, unless caused exclusively by a defect of the Application.

Security certification – status. In its base configuration the Application is certified under FIPS 140-2/140-3, unless agreed otherwise in writing. Use of the Application does not, in itself, guarantee compliance with NIS2, DORA, the Cybersecurity Act, PCI DSS or HIPAA.

Regulatory compliance. Deployment of the Application does not establish the Customer’s compliance with the NIS2 Directive (Directive (EU) 2022/2555), DORA (Regulation (EU) 2022/2554) or the Cybersecurity Act, and does not replace the Customer’s own risk analysis and security program. Neither MV nor the Partner is a regulatory compliance advisor for the Customer, unless agreed otherwise in writing.

The Subscription period is set out in the Order; if no period is stated, the paid Subscription renews for an identical period unless the Customer or the Partner delivers a notice of non-renewal at least 30 days before the end of the period. A PoC expires upon the agreed period without renewal and the Customer ceases to use the Application; continuation requires a new paid Order.

A party may terminate the Agreement (Subscription) for a material breach by the other party not remedied within a reasonable period of at least 30 days from a written notice.

Termination does not affect rights arising up to the date of termination or the entitlement to payment for performance already provided.

After termination, the Customer must remove the Application, encryption keys and Service data from its systems in accordance with the administrator documentation (deleting the entire virtual machine is deemed sufficient) and cease using the Application.

If the Customer discovers a security incident or a vulnerability of the Application, it must report it without delay, no later than 72 hours from identification, to the Partner and to MV’s single communication e-mail info@mazevault.com, and must not disclose it until remediation (responsible disclosure).

The Agreement is governed by the law of the Czech Republic, in particular the Civil Code and the Copyright Act.

MV is entitled to amend these License Terms unilaterally. MV notifies the Customer of a change at least 30 days before it takes effect. If the Customer disagrees with a change to the License Terms, it may terminate the affected Orders in writing with effect as of the day preceding the effective date of the new License Terms. If the Customer does not serve such notice within this period, the new License Terms become binding for all existing and new Orders as of their effective date. A change to the Partner’s support obligations requires the Partner’s prior consent. The Partner is not entitled to change license entitlements, usage restrictions or MV’s rights.

Disputes are primarily resolved amicably.

The parties first resolve disputes amicably for 90 days from delivery of a written invitation to negotiate; this period does not prevent an application for interim or protective measures. All property disputes arising from or in connection with this Agreement, including disputes about its formation, validity, interpretation, performance or termination, will be finally decided by the Arbitration Court attached to the Czech Chamber of Commerce and the Agricultural Chamber of the Czech Republic under its Rules by three arbitrators appointed under those rules. The place of proceedings is Prague and the language is Czech. The parties maintain the confidentiality of the proceedings, submissions, evidence and decision, except for disclosure required by law or necessary to enforce or review the decision.

Neither party may assign this Agreement without the other party’s prior written consent. Consent is not required for assignment to an entity in the same group or to a legal successor within a transformation or transfer of a business establishment, provided the acquirer assumes all obligations in writing, is capable of fulfilling them and is not a direct competitor of the other party; the assigning party notifies the change in advance where legally and factually possible. The parties exclude the application of Section 1793 (unfair reduction) and Section 1796 (usury) to legal relationships connected with or arising in connection with this Agreement. The parties further exclude the application of the provisions on adhesion contracts under Section 1798 et seq. of the Civil Code.

For the term of the Agreement and 12 months after its termination, the parties refrain from directly and deliberately soliciting employees or long-term collaborators of the other party who materially participated in the performance of the Agreement, for the purpose of terminating their relationship and moving to the soliciting party.

For the term of the Agreement, each party maintains, at its own cost, liability insurance proportionate to the nature and scope of the risks it bears under the Agreement. The Provider maintains, in particular, professional and product liability insurance in the area of software development; the Partner, in particular, professional liability insurance for implementation, configuration, support and any management of the Customer’s environment. Where a party’s activity involves the processing of personal data or cyber risks, it also maintains corresponding coverage of those risks where available on commercially reasonable terms. Upon a justified request, a party provides confirmation of insurance. Insurance does not extend contractual liability or the agreed compensation limits.

If any provision of this Agreement proves to be invalid, ineffective or unenforceable, or becomes so in the future, such invalidity, ineffectiveness or unenforceability will not affect the other provisions of this Agreement. In place of such an invalid or ineffective provision, the other provisions of this Agreement will be interpreted reasonably so as to achieve, within the limits of the law, as much of the meaning and purpose of the Agreement and of the said provision according to the parties’ original intent as possible.

A failure to exercise a right or a delay in its exercise is not deemed a waiver of that right.

The Agreement constitutes the entire arrangement between the Provider and the Customer regarding its subject. The documents apply according to the relationship and the matter they govern: the SLA prevails only in matters of Incident classification, response times, product escalation, updates, lifecycle and the scope of technical support; the DPA prevails only in matters of personal data processing between the parties that concluded it; the technical documentation specifies operating procedures but cannot change contractual rights and obligations. In the event of an irremovable conflict, the document with the narrower subject-matter scope applies, provided it does not thereby override license restrictions, intellectual property rights, confidentiality, liability, personal data protection, governing law or dispute resolution.

Negotiation memos, working versions, presentations and other preparatory communication are not part of the Agreement or an interpretation rule unless expressly incorporated by a signed amendment.

Termination of the Agreement does not extinguish provisions that by their nature are to survive, in particular intellectual property, liability and confidentiality.

The parties acknowledge that, in relation to the personal data of natural persons, they act as controllers in accordance with Regulation (EU) 2016/679 (GDPR) of 27 April 2016 and accompanying legislation. The parties confirm that they are familiar with the rights and obligations arising from personal data protection regulations and undertake to handle the personal data received only to the necessary extent, in the format received, and in the manner and for the purpose for which the personal data were entrusted.