Terms

Effective date: 9 November 2026. Last updated: 9 November 2026.

1. Acceptance and parties

1.1 Who these Terms are between

These Terms of Service (the "Terms") form a binding agreement between the contracting SwiftSafe Entity described below ("SwiftSafe", "we", "us" or "our") and the organisation that accepts them ("Customer" or "you"). They govern your access to and use of Prava AI (also "Prava"), including the website at https://prava.dev, the Platform, the Agents and all related Services.

Prava AI is developed and operated by SwiftSafe Cybersecurity Technologies India Pvt Ltd, a private limited company incorporated in India under the Companies Act, 2013, which is headquartered in India ("SwiftSafe India"), together with its United States office, SwiftSafe LLC, a limited liability company registered in Wyoming, USA ("SwiftSafe LLC"). The contracting SwiftSafe Entity is:

• SwiftSafe LLC, if the Customer is based in the Americas, meaning the United States, Canada, Mexico, Central and South America, and the Caribbean; or
• SwiftSafe India, if the Customer is based anywhere else, including India.

The Order Form names the contracting SwiftSafe Entity, and that naming applies. Only the contracting SwiftSafe Entity is a party to these Terms with the Customer, and references to "SwiftSafe" mean that entity unless a provision names SwiftSafe India or SwiftSafe LLC specifically.

1.2 How you accept

You accept these Terms, and they become a contract enforceable under the Indian Contract Act, 1872, at the earliest of the following: (a) you click "I agree", "Create account" or a similar button that refers to these Terms; (b) you create an account on the Platform; (c) you or anyone acting for you installs or deploys an Agent; (d) you sign an Order Form that refers to these Terms; or (e) you otherwise access or use the Services. If you do not agree, you must not create an account, install an Agent or use the Services.

1.3 Authority to bind your organisation

The Services are provided to organisations for business purposes, not to consumers. The individual who accepts these Terms confirms that they are at least 18 years old and that they have authority to bind the Customer. If that individual does not have that authority, they must not accept these Terms, and they may be personally responsible for any use of the Services made in reliance on their acceptance. Where an individual uses the Services in their own name for a business purpose (for example, as a sole proprietor or independent consultant), that individual is the Customer.

1.4 Affiliates

Your Affiliates may use the Services under your account or under their own Order Form. You are responsible for your Affiliates' compliance with these Terms when they use the Services under your account.

1.5 SwiftSafe Entities and performance through Affiliates

SwiftSafe India and SwiftSafe LLC are Affiliates of each other. The contracting SwiftSafe Entity may perform any of its obligations, and exercise any of its rights, under these Terms through the other SwiftSafe Entity or through its other Affiliates, for example to provide support, incident response or professional services. When it does so: (a) the contracting SwiftSafe Entity remains responsible to you for that performance as if it were its own; (b) any Affiliate that processes Personal Data in Customer Data does so as a sub-processor under the DPA, on terms no less protective than the DPA; and (c) the data residency commitment in section 6.4 continues to apply, so your data is stored and processed only in data centres in your Region, whichever SwiftSafe Entity performs the work. SwiftSafe LLC is an office, not a separate data location.

2. Definitions

In these Terms and in every document that incorporates them, the following capitalised terms have the meanings set out below. Other capitalised terms are defined where they first appear.

• "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where "control" means ownership of more than 50% of the voting interests or the power to direct management.
• "Agent" means any software agent, sensor, collector, connector, browser extension or other software component provided by SwiftSafe for installation on Customer devices, servers, networks, cloud accounts or other systems, including all updates.
• "Americas" means the United States, Canada, Mexico, the countries of Central and South America, and the Caribbean.
• "Applicable Law" means all laws, regulations, rules, directions, codes and binding regulatory guidance that apply to a party or to the relevant activity, including, where applicable, the Information Technology Act, 2000 and rules made under it, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 ("DPDP"), CERT-In directions issued under section 70B of the Information Technology Act, 2000, the EU and UK General Data Protection Regulation, and US state privacy laws.
• "Authorised User" means an employee, contractor or agent of the Customer or its Affiliates whom the Customer permits to access the Services under its account.
• "Confidential Information" has the meaning given in section 14.
• "Customer Data" means all data, content and materials that the Customer, its Authorised Users or its systems submit to, or that are collected by, the Services on the Customer's behalf, including Telemetry, logs, emails, files, malware samples submitted by the Customer, forensic evidence, configuration data and prompts entered into the Prava AI assistant. Customer Data does not include Service Data in de-identified, pseudonymised or aggregated form, or Threat Indicators as described in section 6.5.
• "Documentation" means SwiftSafe's then-current user guides, technical documentation and help materials for the Services.
• "Fees" means the amounts payable for the Services as shown on the pricing page or in an Order Form.
• "Modules" means the separately enabled capability modules of the Platform, which are: endpoint protection; application, server and cloud monitoring; IoT and OT device monitoring; AI-guided penetration testing and continuous attack-surface discovery; threat intelligence, including dark-web threat intelligence; phishing defence; malware analysis and reverse engineering; digital forensics and incident response ("DFIR"); compliance and policy management; and the Prava AI assistant and LLM, together with any modules we add later.
• "Order Form" means an ordering document, statement of work, quotation, scope document or online checkout signed or accepted by both parties that refers to these Terms and specifies the Services, plan, Fees and any special terms.
• "Outputs" means any content generated by the Services for the Customer, including alerts, detections, risk scores, triage decisions, investigation summaries, recommendations, reports, YARA and Sigma rules, scripts, queries, policies and responses from the Prava AI assistant.
• "Personal Data" means any data about an individual who is identifiable by or in relation to that data, and includes "personal data" and "personal information" as defined in Applicable Law.
• "Platform" means the Prava AI software-as-a-service platform, including its web console, APIs, Agents, proprietary large language model and other machine-learning models, and underlying infrastructure.
• "Region" means the geographic region selected for the Customer at onboarding or set out in the Order Form, in which SwiftSafe stores and processes that Customer's data under section 6.4, whichever SwiftSafe Entity contracts with the Customer.
• "Services" means the Platform, the Modules, the Agents, the Documentation and any professional, incident response, penetration testing or support services that SwiftSafe provides under these Terms or an Order Form.
• "Service Data" means data generated by or derived from the operation and use of the Services, including Telemetry metadata, usage analytics, performance and diagnostic data, detection results, model inputs and outputs, feedback on Outputs, and security signals.
• "SwiftSafe" means the contracting SwiftSafe Entity determined under section 1.1 and named in the Order Form: SwiftSafe LLC for Customers based in the Americas, and SwiftSafe India for all other Customers, including those in India.
• "SwiftSafe Entities" means SwiftSafe India and SwiftSafe LLC, and "SwiftSafe Entity" means either of them.
• "SwiftSafe India" means SwiftSafe Cybersecurity Technologies India Pvt Ltd, a private limited company incorporated in India, which is SwiftSafe's headquarters.
• "SwiftSafe LLC" means SwiftSafe LLC, a limited liability company registered in Wyoming, USA, which is SwiftSafe's United States office.
• "Telemetry" means technical data that Agents and integrations collect from monitored assets, such as process, file, registry, network, authentication, configuration, log and device data.
• "Threat Indicators" means indicators of compromise, malware samples and their hashes, malicious URLs, domains and IP addresses, attack patterns and techniques, file hashes, detection and vulnerability signatures, and threat-actor infrastructure, in each case only once stripped of Personal Data and Customer Confidential Information and to the extent they do not identify the Customer or any individual.

3. The Services, Modules and related documents

3.1 Provision of the Services

Subject to these Terms and payment of the Fees, SwiftSafe grants the Customer a non-exclusive, non-transferable, non-sublicensable right during the subscription term to access and use the Services that it has subscribed to, and to install and run the Agents on systems it owns or is authorised to control, solely for its internal security, compliance and risk-management purposes and in line with the Documentation.

3.2 Modules

Each Module is enabled separately according to your plan or Order Form. Some Modules, including penetration testing, DFIR retainer and dark-web threat intelligence, carry additional conditions in the Module Terms. Penetration testing and some professional services are scoped and quoted separately in writing and do not begin until you have signed a scope and authorisation document.

3.3 Documents that form part of this agreement

The following documents are incorporated into these Terms by reference and form part of the agreement between us:

• any Order Form;
• the Data Processing Addendum (the "DPA");
• the Module Terms;
• the Acceptable Use Policy (the "AUP");
• the Privacy Policy;
• the AI and Data Use Policy; and
• the Cookie Policy, for use of our websites.

All of these are available from our Legal centre.

3.4 Order of precedence

If there is a conflict between these documents, the following order of precedence applies, highest first: (a) the Order Form, but only for the specific Services and only where it expressly states that it overrides a named provision; (b) the DPA, in relation to the processing of Personal Data; (c) the Module Terms, in relation to the relevant Module; (d) these Terms; and (e) the AUP, the Privacy Policy, the AI and Data Use Policy and other referenced policies.

3.5 Changes to the Services

We continually develop the Platform and may add, change or remove features. We will not make a change that materially reduces the core security functionality of a Module you have paid for during your current billing period. If we intend to withdraw a Module, we will give at least 30 days' notice and, if you have prepaid for it, refund the unused portion.

3.6 Support

We provide support as described for your plan. Max plan customers receive priority support. Ultra Max customers receive the dedicated team and any service levels set out in their Order Form. Security incidents can be reported to soc@prava.dev.

4. Accounts and Authorised Users

4.1 Account creation

You must provide accurate, current and complete information when you create an account and keep it up to date. You must designate at least one administrator who can manage Authorised Users, configuration and billing.

4.2 User limits

Your plan sets the maximum number of Authorised Users: up to 10 on Pro, up to 50 on Max, and the number agreed in your Order Form on Ultra Max. Accounts are for named individuals and may not be shared. You may reassign a seat when an Authorised User leaves.

4.3 Credentials and access

You are responsible for keeping credentials, API keys and Agent enrolment tokens confidential, for enabling multi-factor authentication where available, and for all activity under your account. You must notify us without undue delay at soc@prava.dev if you become aware of any unauthorised access to your account or Agents.

4.4 Responsibility for Authorised Users

You are responsible for the acts and omissions of your Authorised Users as if they were your own, and for ensuring they comply with these Terms and the AUP. You must promptly remove access for anyone who should no longer have it.

5. Customer responsibilities

5.1 Authority over monitored and tested assets

You must only deploy Agents on, connect integrations to, monitor, scan or test assets (including devices, networks, applications, cloud accounts, domains, email systems and IoT/OT systems) that you own or that you are lawfully authorised in writing to monitor or test. For assets owned or operated by third parties, such as hosting providers, managed service providers, clients or software-as-a-service vendors, you are responsible for obtaining any permission their terms require. The AUP sets out further rules, especially for penetration testing.

5.2 Notices and consents to monitored individuals

Many Modules process Personal Data about your employees, contractors, customers and other individuals, for example through endpoint Telemetry, email analysis, login records and forensic evidence. You are responsible for:

• identifying a lawful basis for that processing under Applicable Law, including the DPDP;
• giving clear, informed and specific notices to those individuals about the monitoring, its purposes and their rights, including workplace-monitoring notices where required;
• obtaining any consents that Applicable Law requires, in a form that is free, specific, informed, unconditional and unambiguous where consent is the basis relied on, and recording them;
• handling requests from individuals to withdraw consent, access, correct or erase their data, nominate another person to act for them, or raise a grievance, with our reasonable assistance as set out in the DPA; and
• complying with any employment law, works-council, collective-agreement or sector-specific requirement that applies to monitoring.

Nothing in these Terms waives or limits any statutory right of an individual. Where an individual withdraws consent, some Services may stop working for that individual's devices or accounts, and the withdrawal does not affect the lawfulness of processing carried out before it.

5.3 Roles under data-protection law

For Customer Data, you are generally the Data Fiduciary (or controller) and SwiftSafe acts as your Data Processor (or processor), as set out in the DPA. SwiftSafe is the Data Fiduciary (or controller) for account data, website data, billing data and its own usage analytics, as described in the Privacy Policy. Section 6 explains how SwiftSafe uses Service Data for its own purposes.

5.4 Configuration and operation

You are responsible for configuring the Services appropriately for your environment, including detection policies, automated response rules, exclusions, integrations and user permissions; for keeping your systems compatible with the Agents; for maintaining backups of your systems and data; and for acting on alerts and Outputs.

5.5 Lawful content

You must not submit Customer Data that you do not have the right to submit. You are responsible for the accuracy, quality and legality of Customer Data and the means by which you acquired it.

5.6 Your own regulatory obligations

Prava AI can help you meet regulatory obligations, such as CERT-In incident reporting or RBI, SEBI or IRDAI cybersecurity guidance, but you remain responsible for your own compliance, including deciding whether and when to report an incident and to whom.

6. Data processing, analytics and model improvement

This section summarises how SwiftSafe processes and uses data. The AI and Data Use Policy and the DPA give full details. By accepting these Terms, creating an account, installing an Agent or using the Services, you agree on behalf of the Customer to the processing described in this section.

6.1 Real-time processing to deliver the Services

Prava AI works by collecting and analysing Customer Data and Telemetry continuously and in real time. You authorise SwiftSafe to collect, transmit, store, analyse, correlate and otherwise process Customer Data and Telemetry as needed to provide, secure and support the Services, including detection, investigation, automated response, threat intelligence correlation and reporting.

6.2 Usage analytics

SwiftSafe collects analytics about how the Platform is used, such as feature usage, performance, errors, Agent health and session information, to operate, maintain, secure, support and improve the Services and for billing and capacity planning.

6.3 Improving and training our models

You agree that SwiftSafe may use Service Data to operate, secure, improve and develop Prava AI, including training, fine-tuning and evaluating its large language model and other machine-learning models. When we do this:

• training, fine-tuning and evaluation that use your Customer Data, Telemetry, Personal Data or other Service Data take place only on infrastructure located in your Region, in line with section 6.4;
• we de-identify, pseudonymise or aggregate the data where reasonably possible before it is used for model improvement;
• we apply technical and organisational safeguards to prevent models from reproducing Customer Confidential Information or identifiable Personal Data in Outputs given to other customers;
• we never disclose your Confidential Information, or Personal Data in identifiable form, to other customers; and
• we process Personal Data only in line with Applicable Law, the Privacy Policy and the DPA.

Customers on an Order Form, including Ultra Max customers, may negotiate further restrictions, such as opting out of the use of their Customer Data content for model training. Any such restriction applies only if it is set out in an Order Form or the DPA.

6.4 Data residency

SwiftSafe stores and processes each Customer's data, including Customer Data, Telemetry, Personal Data and Service Data relating to that Customer, only in data centres located in the Customer's Region. The Region is selected at onboarding or set out in the Order Form, and it cannot be changed without the Customer's written instruction. This commitment covers storage, real-time analysis, backups and model training and fine-tuning. The only data that may be used or stored outside the Customer's Region is:

• non-personal security artefacts, such as Threat Indicators, file hashes, detection signatures and malicious infrastructure (for example, attacker IP addresses, domains and URLs), and only after they have been stripped of Personal Data and Customer Confidential Information, as described in section 6.5; and
• anonymised, aggregated model parameters (such as model weight updates) that do not contain or allow the reconstruction of Customer Data, Personal Data or Customer Confidential Information.

6.5 Threat Indicators and collective defence

Some security artefacts lose their value if they are altered too far, such as malware samples, indicators of compromise, file hashes, detection signatures, malicious URLs and domains, attack patterns and threat-actor infrastructure. You agree that SwiftSafe may retain Threat Indicators and use them across its customer base and across Regions, and share them with trusted security partners and computer emergency response teams, to detect and prevent threats for all customers. Before any such use outside your Region or any such sharing, we strip Threat Indicators of Personal Data and Customer Confidential Information and of anything that identifies you. Where an artefact cannot be stripped in this way (for example, a malicious document built from one of your real files), only the indicators extracted from it, and not the artefact itself, leave your Region.

6.6 Individuals' rights

Individuals whose Personal Data is processed through the Services keep all their rights under Applicable Law. The Privacy Policy explains how to exercise them, and section 27 gives the contact details of our Grievance Officer.

6.7 Sub-processors and transfers

SwiftSafe uses the sub-processors listed at [Sub-processor list], which may include the other SwiftSafe Entity, mainly for support, as described in section 1.5 and the DPA. Sub-processors that host or process Customer Data do so only in data centres in the Customer's Region, in line with section 6.4. Where Applicable Law treats any permitted processing as a cross-border transfer of Personal Data, for example remote support access that you have authorised, we comply with that law, including, where relevant, Standard Contractual Clauses or the UK International Data Transfer Addendum, as set out in the DPA.

7. Customer Data

7.1 Ownership

As between the parties, the Customer owns all rights in Customer Data. SwiftSafe does not acquire any ownership of Customer Data under these Terms.

7.2 Licence to SwiftSafe

The Customer grants SwiftSafe and its sub-processors a non-exclusive, royalty-free licence, exercisable in the Customer's Region in line with section 6.4 except as that section permits, for the term of the agreement and any retention period permitted by these Terms, to host, copy, transmit, process, analyse and display Customer Data as needed to provide, secure and support the Services, to comply with Applicable Law, and for the purposes described in section 6.

7.3 Restrictions on our use

We will not sell Customer Data, use it for advertising, or disclose it to third parties except as permitted by these Terms, the DPA or Applicable Law, or with your instructions.

7.4 Aggregated and de-identified data

SwiftSafe may create and use data that has been aggregated or de-identified so that it no longer identifies the Customer or any individual. Such data is not Customer Data, and SwiftSafe owns it, provided that SwiftSafe does not attempt to re-identify it. Such data stays in the Customer's Region unless it falls within the categories that section 6.4 permits to be used across Regions.

8. Outputs and AI limitations

8.1 Your use of Outputs

Subject to these Terms, you may use, copy and modify Outputs for your internal business purposes, including sharing reports with your auditors, insurers, regulators and advisers. As between the parties, and to the extent SwiftSafe has rights in them, SwiftSafe assigns to you its rights in Outputs that are specific to your environment, but not in the underlying Platform, models, templates, generic rules or Threat Indicators, which remain SwiftSafe's.

8.2 Outputs are probabilistic

Prava AI relies on machine-learning models, including a large language model. Outputs are generated probabilistically and may be inaccurate, incomplete, out of date or inconsistent. Prava AI can produce false positives (flagging harmless activity) and false negatives (missing malicious activity). Similar Outputs may be given to other customers.

8.3 Human review required

You must have appropriately qualified people review Outputs before relying on them for any material decision, including disciplinary or employment action against an individual, reports to regulators or law enforcement, legal proceedings, deployment of generated rules, scripts or policies to production, or statements made to customers or the public. You remain responsible for decisions you make using Outputs.

8.4 No legal or compliance advice

Compliance mappings, policy drafts and audit evidence produced by the Services help you prepare for audits and assessments. They are not legal advice, a certification or an audit opinion, and they do not guarantee that you comply with any framework or law.

8.5 Limits on use of Outputs

You must not use Outputs to develop a competing model or product, or in breach of the AUP.

9. Autonomous actions

9.1 What autonomous actions are

Some Modules can take automated actions on your systems without real-time human approval, such as isolating a host from the network, terminating processes, quarantining or deleting files, blocking IP addresses, domains or senders, disabling user accounts, revoking sessions or tokens, and rolling back changes ("Autonomous Actions").

9.2 Your configuration choices

You decide which Autonomous Actions are enabled, on which assets, under which conditions, and whether human approval is required. You are responsible for those configuration choices, including excluding business-critical, safety-critical, medical or operational technology systems where an automated action could cause harm or disruption. We recommend starting in a detect-only or approval-required mode and testing in a non-production environment.

9.3 Consequences of Autonomous Actions

Autonomous Actions may interrupt business operations, cause loss of unsaved work or affect availability of systems. Except to the extent caused by SwiftSafe's breach of these Terms, gross negligence or wilful misconduct, SwiftSafe is not responsible for the consequences of an Autonomous Action that was carried out in accordance with your configuration. We provide tools to reverse most containment actions, and you can contact soc@prava.dev for help.

9.4 OT and safety-critical environments

The IoT and OT Module is designed primarily for passive monitoring. You must not enable active response or active scanning against industrial control, medical or other safety-critical systems unless the Module Terms permit it and you have completed your own safety assessment.

10. Third-party integrations

10.1 Integrations you enable

The Services can connect to third-party products and services, such as cloud providers, identity providers, email platforms, ticketing tools and security tools ("Third-Party Services"). When you enable an integration, you authorise SwiftSafe to access and exchange data with that Third-Party Service on your behalf as needed for the integration to work.

10.2 Third-party terms

Your use of a Third-Party Service is governed by your agreement with its provider. SwiftSafe does not control Third-Party Services and is not responsible for their availability, security, accuracy or changes to their APIs that affect an integration.

10.3 Third-party threat data

Threat intelligence Modules draw on open, commercial, deep-web and dark-web sources that SwiftSafe does not control. We do not guarantee the completeness or accuracy of information from those sources.

11. Plans, fees and billing

11.1 Plans

Our current plans are described on our pricing page. At the effective date they are: Pro, at US$199 per month for up to 10 Authorised Users; Max, at US$499 per month for up to 50 Authorised Users with priority support; and Ultra Max, at a custom price set out in an Order Form, with unlimited Authorised Users and a dedicated team. Penetration testing and certain professional services are scoped and quoted separately in writing.

11.2 Currency

SwiftSafe LLC invoices in US dollars (USD). SwiftSafe India invoices in Indian rupees (INR) or USD, as shown at checkout or in your Order Form. Where we convert prices, the converted amount shown at checkout applies.

11.3 Taxes

Fees exclude taxes. You must pay all applicable taxes, other than taxes on SwiftSafe's income. Where SwiftSafe India is the contracting SwiftSafe Entity, Goods and Services Tax ("GST") applies as required, and Indian customers should provide their GSTIN so that we can issue a valid tax invoice. Where SwiftSafe LLC is the contracting SwiftSafe Entity, US federal, state and local taxes may apply, including state and local sales and use taxes depending on your location and the Services, and you should give us any valid exemption certificate before we invoice you. If you are required by law to withhold tax, you must gross up the payment so that we receive the full amount we would have received without the withholding, unless the Order Form says otherwise, and you must provide the withholding certificate promptly.

11.4 Monthly billing and renewal

Self-serve plans are billed monthly in advance and renew automatically at the start of each monthly billing period until cancelled. There is no annual lock-in. You authorise us and our payment processor to charge your chosen payment method for each renewal. Invoiced Order Forms are payable within 30 days of the invoice date unless the Order Form states otherwise.

11.5 Upgrades and downgrades

You can upgrade at any time; the higher Fee applies from the upgrade, pro-rated for the remainder of the billing period. Downgrades take effect at the start of the next billing period. A downgrade may reduce features, users or data retention, and you are responsible for exporting data you wish to keep before it takes effect.

11.6 Cancellation

You can cancel a monthly plan at any time from the console or by writing to hello@prava.dev. Cancellation takes effect at the end of the current billing period, and you keep access until then. Order Forms with a fixed term may be cancelled only as they provide.

11.7 Price changes

We may change our prices by giving you at least 30 days' notice. The new price applies from your next billing period after the notice period ends. If you do not agree, you may cancel before the new price takes effect.

11.8 Late payment and suspension

If any undisputed amount is overdue, we may charge interest at 1% per month or the maximum rate permitted by law, whichever is lower, from the due date until payment. If an amount remains unpaid for 15 days after we give you written notice that it is overdue, we may suspend the Services until it is paid. During suspension we will continue to store your Customer Data in line with section 20.

11.9 Disputed invoices

If you dispute an invoice in good faith, you must tell us in writing within 15 days of the invoice date, giving reasons, and pay the undisputed portion. We will work with you to resolve the dispute promptly, and we will not suspend the Services for a disputed amount while we are doing so.

11.10 Refunds

Fees are non-refundable except: (a) where these Terms provide for a refund, including where we withdraw a Module (section 3.5) or terminate for convenience (section 19.3); (b) where you terminate because of our uncured material breach, in which case we refund prepaid Fees for the period after termination; or (c) where Applicable Law requires a refund. Fees for scoped services are governed by the relevant Order Form.

12. Trials, beta and preview features

12.1 Trials

We may offer free or discounted trials. A trial lasts for the period we specify. At the end of the trial, the Services stop unless you choose a paid plan. We may delete Customer Data from a trial account 30 days after the trial ends unless you convert to a paid plan.

12.2 Beta and preview features

We may make features available that are labelled alpha, beta, preview, early access or similar ("Beta Features"). Beta Features are provided for evaluation, may be changed or withdrawn at any time, may be less reliable, and are not covered by any service level.

12.3 No warranty for trials and Beta Features

To the maximum extent permitted by Applicable Law, trials and Beta Features are provided "as is" without any warranty or indemnity, and SwiftSafe's total liability for them is limited to INR 10,000 (or the equivalent in USD). Nothing in this section limits liability that cannot be limited by law.

13. Intellectual property and feedback

13.1 SwiftSafe's rights

SwiftSafe, its Affiliates and their licensors own all rights, title and interest, including all intellectual property rights, in the Platform, Agents, models (including model weights, architectures and training pipelines), Documentation, Threat Indicators, generic detection content and all improvements and derivatives of them, whether made using Service Data or otherwise. Except for the limited rights expressly granted in these Terms, no rights are granted to you, by implication or otherwise.

13.2 Restrictions

You must not, and must not allow anyone else to: (a) copy, modify or create derivative works of the Platform or Agents except as permitted by Applicable Law; (b) reverse engineer, decompile, disassemble or attempt to extract the source code, model weights, prompts or training data of the Platform, except to the extent that Applicable Law expressly permits despite this restriction; (c) sell, resell, sublicense, rent or provide the Services to third parties except under a written partner agreement with us; (d) use the Services or Outputs to build a competing product or train a competing model; (e) remove proprietary notices; or (f) use the Services in breach of the AUP.

13.3 Benchmarking

You may not publish benchmarks or comparative tests of the Services without our prior written consent, which we will not unreasonably withhold where the methodology is fair and disclosed.

13.4 Feedback

If you give us suggestions, ideas, ratings of Outputs or other feedback about the Services ("Feedback"), you grant SwiftSafe a perpetual, irrevocable, worldwide, royalty-free licence to use it for any purpose without obligation to you. We will not identify you publicly as the source of Feedback without your consent.

13.5 Publicity

We will not use your name or logo in marketing materials without your prior written consent.

14. Confidentiality

14.1 Meaning of Confidential Information

"Confidential Information" means non-public information disclosed by one party ("Discloser") to the other ("Recipient") in connection with these Terms that is marked as confidential or that a reasonable person would understand to be confidential. Customer Data, vulnerability findings, penetration test reports, incident details and security configurations are the Customer's Confidential Information. The Platform, non-public pricing, product roadmaps, model details and the terms of any Order Form are SwiftSafe's Confidential Information.

14.2 Exclusions

Confidential Information does not include information that: (a) is or becomes public through no fault of the Recipient; (b) the Recipient already knew without a duty of confidentiality; (c) the Recipient lawfully receives from a third party without a duty of confidentiality; or (d) the Recipient independently develops without using the Discloser's Confidential Information. Threat Indicators handled in line with section 6.5 are not the Customer's Confidential Information.

14.3 Obligations

The Recipient must: (a) use the Discloser's Confidential Information only to perform its obligations or exercise its rights under these Terms; (b) protect it with at least the same care it uses for its own confidential information of a similar nature, and no less than reasonable care; and (c) disclose it only to its and its Affiliates' employees, contractors, sub-processors and professional advisers who need to know it and are bound by confidentiality obligations at least as protective as these.

14.4 Compelled disclosure

The Recipient may disclose Confidential Information where required by Applicable Law or by a court, regulator or government authority, provided that, where legally permitted, it gives the Discloser prompt notice and reasonable assistance to seek a protective order, and discloses only what is legally required. Section 22 applies to requests for Customer Data.

14.5 Duration

These obligations last during the agreement and for five years after it ends, and indefinitely for trade secrets and for Customer Data.

15. Security

15.1 Our commitments

SwiftSafe maintains a written information security programme with administrative, technical and physical safeguards appropriate to the nature of the Services and the data processed, designed to meet the standard of reasonable security practices and procedures under section 43A of the Information Technology Act, 2000 and the DPDP. These include encryption of Customer Data in transit and at rest, role-based access control and least privilege, multi-factor authentication for staff access to production systems, logging and monitoring, vulnerability management, secure development practices, background checks for personnel where lawful, and business continuity and backup arrangements. Further details are in the DPA.

15.2 Regional hosting

As a security measure as well as a data-protection commitment, Customer Data, Telemetry, Personal Data and backups are stored and processed only in data centres in the Customer's Region, as set out in section 6.4, whichever SwiftSafe Entity contracts with the Customer. Where personnel of either SwiftSafe Entity, or sub-processors, need access for support or incident response, access is controlled, logged and limited to what is necessary, and data is not copied out of the Region except as section 6.4 permits.

15.3 Personnel access

SwiftSafe personnel access Customer Data only where needed to provide, support or secure the Services, to investigate abuse, or to comply with Applicable Law, and they are bound by confidentiality obligations. SwiftSafe's human responders in DFIR engagements access Customer Data as the engagement requires.

15.4 Security incidents

If SwiftSafe becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data, we will notify you without undue delay, and within the time set out in the DPA, and give you the information you reasonably need to meet your own notification obligations, including under the DPDP and CERT-In directions.

15.5 Agent integrity

Agents are signed, and updates are delivered through authenticated channels. You must not tamper with Agents or install them from unofficial sources.

15.6 Vulnerability reports

If you find a vulnerability in the Platform, please report it in line with our responsible disclosure policy to security@prava.dev.

16. Warranties and disclaimers

16.1 Mutual warranties

Each party warrants that it is validly existing, has full power and authority to enter into these Terms, and will comply with Applicable Law in performing them.

16.2 SwiftSafe's warranties

SwiftSafe warrants that: (a) the Services will perform materially in accordance with the Documentation during the subscription term; (b) it will provide professional services with reasonable skill and care in line with good industry practice; and (c) it will use industry-standard measures designed to prevent the Agents from containing malicious code (other than code you intentionally submit for analysis). If the Services do not conform to warranty (a), you must notify us within 30 days, and your remedy, and our entire liability, is for us to use reasonable efforts to correct the non-conformity or, if we cannot do so within a reasonable time, for either party to terminate the affected Services and for us to refund prepaid Fees for the unused period.

16.3 Customer warranties

You warrant that: (a) you have all rights, authorisations and consents needed for SwiftSafe to process Customer Data as described in these Terms; (b) you have given all notices and obtained all consents required under section 5.2; and (c) you own or are authorised to monitor and test every asset you bring into scope.

16.4 No guarantee of detection or prevention

No security product can detect or prevent every threat. SwiftSafe does not warrant that the Services will detect, prevent or contain every attack, intrusion, vulnerability, malware, phishing message or data leak, that the Services will be uninterrupted or error-free, that Outputs will be accurate or complete, or that use of the Services will make your systems secure or compliant. The Services are one layer of a defence-in-depth strategy and do not replace your own security controls, backups, staff and judgement.

16.5 Disclaimer

Except as expressly stated in these Terms and to the maximum extent permitted by Applicable Law, the Services and Outputs are provided "as is" and "as available", and SwiftSafe disclaims all other warranties and conditions, whether express, implied or statutory, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement.

17. Indemnities

17.1 Indemnity by SwiftSafe

SwiftSafe will defend the Customer against any claim by a third party alleging that the Customer's authorised use of the Platform infringes that third party's intellectual property rights, and will pay the damages, costs and reasonable legal fees finally awarded against the Customer or agreed by SwiftSafe in settlement. This indemnity does not apply to claims arising from Customer Data, Outputs modified by you, Third-Party Services, combination of the Services with items not supplied by SwiftSafe, use in breach of these Terms, or Beta Features. If the Services are, or in SwiftSafe's opinion are likely to be, subject to such a claim, SwiftSafe may procure the right for you to continue using them, modify them so they are non-infringing without material loss of functionality, or terminate the affected Services and refund prepaid Fees for the unused period. This section states SwiftSafe's entire liability for intellectual property infringement claims.

17.2 Indemnity by the Customer

The Customer will defend SwiftSafe, its Affiliates and their officers, employees and contractors against any claim, proceeding or regulatory action by a third party or an authority, and will pay the damages, fines, penalties, costs and reasonable legal fees finally awarded or agreed in settlement, to the extent it arises from:

• scanning, penetration testing, monitoring or other use of the Services against any asset that the Customer did not own or was not authorised in writing to test or monitor, or outside an agreed scope;
• monitoring of individuals without the notices, consents or other lawful basis required by Applicable Law, or other failure to comply with section 5.2;
• Customer Data, including a claim that Customer Data infringes third-party rights or was collected unlawfully;
• use of the Services in breach of the AUP; or
• Autonomous Actions carried out in accordance with the Customer's configuration that affect a third party's systems or data.

17.3 Procedure

The indemnified party must: (a) notify the indemnifying party promptly in writing of the claim (a delay only relieves the indemnifying party to the extent it is prejudiced); (b) give the indemnifying party sole control of the defence and settlement, provided that no settlement may impose any admission or obligation on the indemnified party without its consent, which must not be unreasonably withheld; and (c) give reasonable cooperation at the indemnifying party's expense. The indemnified party may take part with its own counsel at its own cost.

18. Limitation of liability

18.1 Exclusion of indirect losses

To the maximum extent permitted by Applicable Law, neither party is liable to the other, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, business, goodwill or anticipated savings, or for any loss or corruption of data (except the cost of restoring data from backups where SwiftSafe caused the loss), even if advised that such loss was possible.

18.2 Cap

To the maximum extent permitted by Applicable Law, each party's total aggregate liability arising out of or in connection with these Terms and the Services is limited to the total Fees paid and payable by the Customer to SwiftSafe for the Services in the 12 months immediately preceding the event giving rise to the claim.

18.3 Exceptions

The limits in sections 18.1 and 18.2 do not apply to: (a) the Customer's obligation to pay Fees; (b) a party's indemnity obligations under section 17; (c) the Customer's breach of section 5.1, section 13.2 or the AUP; (d) liability for fraud, gross negligence or wilful misconduct; or (e) any liability that cannot be limited or excluded under Applicable Law.

18.4 Basis of the bargain

The parties agree that these limitations are reasonable, reflect the allocation of risk between them, and are reflected in the Fees. Each provision excluding or limiting liability is separate and applies even if another is found unenforceable.

19. Term, suspension and termination

19.1 Term

These Terms start when you accept them and continue until all subscriptions and Order Forms have ended or been terminated.

19.2 Suspension

SwiftSafe may suspend all or part of the Services, or any Authorised User's access, if: (a) it reasonably believes your use breaches the AUP or section 5.1, or poses a security risk to the Platform, other customers or third parties; (b) required to do so by Applicable Law or a lawful order of a court or authority; or (c) payment is overdue as described in section 11.8. Where practicable, we will give you prior notice and an opportunity to fix the problem, limit the suspension to what is necessary, and restore the Services promptly once the reason has been resolved. Suspension does not relieve you of the obligation to pay Fees, except where the suspension was not justified.

19.3 Termination for convenience

You may terminate a monthly subscription at any time under section 11.6. SwiftSafe may terminate a monthly subscription for convenience by giving at least 30 days' notice, and will refund any prepaid Fees for the period after termination.

19.4 Termination for cause

Either party may terminate these Terms or an affected Order Form by written notice if the other party: (a) materially breaches them and does not cure the breach within 30 days of written notice; or (b) becomes insolvent, enters liquidation or an insolvency resolution process under the Insolvency and Bankruptcy Code, 2016 or an equivalent law, or ceases to carry on business. SwiftSafe may terminate immediately on notice if you seriously breach the AUP, for example by using the Services to attack third parties.

19.5 Effect of termination

On termination: (a) your right to use the Services ends; (b) you must uninstall all Agents, and the Agents may be remotely deactivated; (c) unpaid Fees for the period up to termination become due; and (d) each party must return or destroy the other's Confidential Information, subject to section 20 and to legal retention requirements. Sections 2, 6.5, 7.4, 8.3, 13, 14, 16.4, 16.5, 17, 18, 19.5, 20, 24 and 26, and any other provisions that by their nature should survive, survive termination.

20. Data export and deletion

20.1 Export

During the subscription term, and for 30 days after it ends (the "Export Window"), you may export Customer Data using the export features of the Platform or by asking us at hello@prava.dev. We will provide reasonable assistance. Assistance beyond standard export tools may be charged at our then-current rates.

20.2 Deletion

After the Export Window, we will delete Customer Data from our active systems within 60 days, and from backups within a further 90 days as backup cycles complete, unless Applicable Law requires us to keep it. You can ask us to delete Customer Data earlier by written request.

20.3 Retention required by law

We may keep Customer Data, account data and logs for as long as Applicable Law requires, including logs of SwiftSafe's own systems that must be retained for 180 days within India under CERT-In directions where those directions apply, records required for tax and accounting purposes, and data subject to a legal hold. Retained data stays subject to the confidentiality and security obligations in these Terms, and Customer Data retained under this section stays in the Customer's Region.

20.4 Data that is not deleted

De-identified or aggregated data and Threat Indicators described in sections 6.5 and 7.4, and model improvements already made using Service Data, are not deleted on termination, because they do not identify you or any individual. Personal Data is never retained in identifiable form for model improvement after the deletion periods above, except as required by law.

20.5 Forensic evidence

Where SwiftSafe holds forensic evidence under a DFIR engagement, we will return or destroy it as agreed in the engagement scope, keeping chain-of-custody records as required.

21. Compliance with laws, export controls and sanctions

21.1 Compliance with laws

Each party will comply with Applicable Law in connection with these Terms, including laws on data protection, computer misuse (including sections 43 and 66 of the Information Technology Act, 2000), anti-bribery and anti-corruption (including the Prevention of Corruption Act, 1988 and, where applicable, the US Foreign Corrupt Practices Act and UK Bribery Act 2010).

21.2 Export controls

The Services, including penetration testing, malware analysis and encryption capabilities, may be subject to the export control laws of India (including the SCOMET list), the United States (including the Export Administration Regulations ("EAR") administered by the US Department of Commerce's Bureau of Industry and Security), the European Union, the United Kingdom and other countries. You must not export, re-export or transfer the Services, Outputs or technical data in breach of those laws, including to any destination, end user or end use that those laws prohibit or restrict without a licence.

21.3 Sanctions

You represent that neither you nor any of your Authorised Users or owners is the subject or target of sanctions imposed by the United Nations, India, the United States (including sanctions administered by the US Department of the Treasury's Office of Foreign Assets Control ("OFAC") and the Specially Designated Nationals and Blocked Persons List), the European Union or the United Kingdom, or is named on a US export restriction list such as the Entity List, or is located in, organised under the laws of, or ordinarily resident in a comprehensively sanctioned territory. You must not use the Services for the benefit of any such person or territory. We may suspend or terminate the Services immediately if this representation becomes untrue.

22. Regulatory cooperation and legal requests

22.1 CERT-In

As a service provider in India, SwiftSafe India complies with directions issued by the Indian Computer Emergency Response Team ("CERT-In") under section 70B of the Information Technology Act, 2000, including the directions of 28 April 2022. These include reporting specified cyber incidents affecting our own systems to CERT-In within six hours of noticing them, maintaining logs of our systems within India for 180 days, synchronising our system clocks with NTP time sources as directed, and providing information to CERT-In when lawfully requested. Where SwiftSafe LLC is the contracting SwiftSafe Entity, these directions apply to the extent that Indian law makes them apply to the systems and services concerned, and compliance with them does not move Customer Data out of the Customer's Region except as section 6.4 permits. You agree that the SwiftSafe Entities may make such reports and provide such information. Where an incident affects your systems, you are responsible for any reporting that applies to you; the Services can help you prepare such reports.

22.2 Law enforcement and government requests

If SwiftSafe receives a request from a law enforcement agency, court, regulator or other government authority for Customer Data, it will: (a) check that the request is legally valid and, where possible, redirect the authority to request the data from you directly; (b) unless legally prohibited, notify you promptly so that you can seek a protective order or other remedy; (c) disclose only the minimum data legally required; and (d) keep a record of the request. SwiftSafe may challenge requests it considers unlawful or overbroad.

22.3 Your cooperation

You will cooperate reasonably with SwiftSafe in responding to any regulatory enquiry about your use of the Services, and SwiftSafe will cooperate reasonably with you in responding to regulatory enquiries about the Services, including audits by your sectoral regulators where your Order Form or Applicable Law requires.

23. Force majeure

Neither party is liable for any failure or delay in performing its obligations (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, epidemics, war, terrorism, riots, government action, failure of public utilities or telecommunications networks, failures of cloud infrastructure providers, and large-scale internet attacks not directed specifically at the affected party ("Force Majeure Event"). A cyber attack does not count as a Force Majeure Event where it succeeded because the affected party failed to maintain the security measures required by these Terms. The affected party must notify the other promptly and use reasonable efforts to reduce the effect. If a Force Majeure Event continues for more than 30 days, either party may terminate the affected Services on written notice, and SwiftSafe will refund prepaid Fees for the unused period.

24. Governing law and dispute resolution

24.1 Governing law

These Terms and any dispute or claim arising out of or in connection with them, including non-contractual disputes, are governed by the laws of India. This applies whichever SwiftSafe Entity is the contracting SwiftSafe Entity, including where SwiftSafe LLC contracts with a Customer based in the Americas.

24.2 Good-faith negotiation

Before starting arbitration, a party must give the other written notice of the dispute, and senior representatives of both parties must try in good faith to resolve it within 30 days of that notice.

24.3 Arbitration

Any dispute that is not resolved under section 24.2 will be finally resolved by arbitration under the Arbitration and Conciliation Act, 1996. The tribunal will consist of a sole arbitrator appointed by agreement of the parties or, failing agreement within 30 days, in accordance with that Act. The seat and venue of arbitration will be [Arbitration seat city], India, whichever SwiftSafe Entity is a party. The arbitration will be conducted in English, and may be held by video conference where the parties agree. The award will be final and binding on the parties. The proceedings and award are confidential.

24.4 Courts and interim relief

Subject to section 24.3, the courts at [Arbitration seat city] have exclusive jurisdiction, including for interim relief under section 9 of the Arbitration and Conciliation Act, 1996. Nothing in this section prevents a party from seeking urgent injunctive relief to protect its intellectual property or Confidential Information.

25. Notices

Notices from you to SwiftSafe about legal matters, including breach, termination or claims, must be sent by email to legal@prava.dev, and are effective only when sent to that address. SwiftSafe may give notices to you by email to the administrator email address on your account, through the Platform console, or by post to the address in your Order Form. Notices by email are treated as received on the next business day after sending, unless the sender receives a delivery failure message. Operational notices, including service updates and billing reminders, may be given through the Platform.

26. General provisions

26.1 Assignment

Neither party may assign or transfer its rights or obligations under these Terms without the other party's prior written consent, which must not be unreasonably withheld, except that either party may assign these Terms in full, on written notice, to an Affiliate or to a successor in connection with a merger, acquisition, corporate reorganisation or sale of all or substantially all of its assets or business to which these Terms relate, provided the assignee is not a competitor of the other party and agrees in writing to be bound.

26.2 Subcontracting

SwiftSafe may use subcontractors and sub-processors to provide the Services. SwiftSafe remains responsible for their performance and for their compliance with obligations equivalent to those in these Terms and the DPA. The DPA explains how we notify you of new sub-processors and your right to object.

26.3 Entire agreement

These Terms, together with the documents incorporated under section 3.3, are the entire agreement between the parties about their subject matter and replace all prior proposals, agreements and representations. Terms in your purchase orders or vendor portals do not apply, even if accepted electronically, unless expressly agreed in an Order Form signed by SwiftSafe. Nothing in this section excludes liability for fraudulent misrepresentation.

26.4 Severability

If any provision of these Terms is held invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions continue in full effect.

26.5 Amendments

We may update these Terms from time to time. For material changes, we will give at least 30 days' notice by email to your administrator or through the Platform before the change takes effect, unless the change is required sooner by Applicable Law or to address a security risk, in which case we will give as much notice as is reasonably possible. Changes do not apply retrospectively. If you do not agree to a material change, you may cancel before it takes effect, and we will refund any prepaid Fees for the period after cancellation. Your continued use of the Services after the effective date of a change means you accept it. Non-material changes, such as clarifications and corrections, take effect when published. An Order Form can only be amended in writing signed by both parties. We keep previous versions of these Terms available on request.

26.6 Waiver

A failure or delay in exercising a right is not a waiver of it. A waiver is effective only if it is in writing.

26.7 Relationship

The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, fiduciary or employment relationship.

26.8 Third-party rights

Except for the persons indemnified under section 17, no one other than the parties has any right to enforce these Terms.

26.9 Electronic execution and language

These Terms may be accepted electronically and Order Forms may be signed electronically in accordance with the Information Technology Act, 2000. These Terms are written in English. If they are translated, the English version prevails.

26.10 Interpretation

Headings are for convenience only. "Including" means "including without limitation". References to a law include that law as amended or replaced.

27. Grievance Officer and contact

In accordance with the Information Technology Act, 2000, the rules made under it and the DPDP, SwiftSafe India has appointed a Grievance Officer, who acts for both SwiftSafe Entities, to address complaints about the Services and the processing of Personal Data:

• Grievance Officer: grievance@prava.dev

We will acknowledge a grievance within 24 hours and aim to resolve it within the period required by Applicable Law, and in any event within 30 days. If you are an individual and are not satisfied with our response to a grievance about your Personal Data, you may complain to the Data Protection Board of India or another competent authority.

Other contacts:

• Legal notices and contract questions: legal@prava.dev
• Privacy and data protection: privacy@prava.dev
• Security incidents and operations: soc@prava.dev
• Vulnerability reports: security@prava.dev
• General enquiries, billing and cancellation: hello@prava.dev

28. Company details

• Headquarters (India): SwiftSafe Cybersecurity Technologies India Pvt Ltd, a private limited company incorporated in India
• United States office: SwiftSafe LLC, a limited liability company registered in Wyoming, USA, serving customers in the Americas
• Product: Prava AI
• Legal: legal@prava.dev
• Privacy: privacy@prava.dev
• Grievance Officer: grievance@prava.dev
• Security: security@prava.dev