License Agreement SaQura CertWatch

End User License Agreement (EULA) · SaQura CertWatch
English is binding; the German and Japanese versions are translations for convenience only (see Section 16). · Bindend ist die englische Fassung (siehe Ziffer 16). · 英語版が正本です（第16条参照）。

ENGLISH (binding version)

Effective: 28 October 2026 · Version 2.0 · applies to SaQura CertWatch from version 1.3.0 including the CertWatch Agent

1. Parties, Subject Matter, Scope, Acceptance
1.1 This License Agreement ("Agreement") is entered into between KyotoTech LLC (合同会社KyotoTech), Kyō-machi 2-237-202, Fushimi-ku, Kyoto 612-8083, Japan ("KyotoTech", "we") and the business named in the license or the order documents ("Customer", "you"). Where the Software is operated without a license (trial mode, Section 2.4), the Customer is the business for which it is installed or used.
1.2 The subject matter is the provision of the software "SaQura CertWatch", consisting of the server program, the CertWatch Agent (Section 4A), the signed license file (`.lic`), the documentation (operating guides, release notes and the notice files supplied) and any updates (together the "Software"). The Software is provided for self-hosting: you operate the server program and the agents on your own systems or on systems of your end customers. This Agreement does not oblige KyotoTech to operate any monitoring or renewal service. The license refresh (Section 2.9) and the version file (Section 13.2) are auxiliary functions without any committed availability. KyotoTech has no remote access to your Instance or your agents and cannot send commands to them; through the license refresh KyotoTech can only replace or revoke the license (Sections 2.9 and 2.10).
1.3 The Software is intended exclusively for businesses, public authorities and other organisations using it in the course of their trade, business or profession or to perform public tasks (B2B). Consumers are excluded from acquisition and use. By accepting, you represent that you acquire and use the Software solely for such purposes.
1.4 If, contrary to Section 1.3, the Software is used by a consumer, the mandatory consumer protection laws of the consumer's country of residence apply in the consumer's favour, and this Agreement applies only to the extent those laws permit.
1.5 Acceptance: This Agreement is accepted by express acceptance, in particular by ticking the acceptance box when ordering, when activating a license, in the customer portal or when first switching on automatic renewal (Section 4A.2), or by signing order documents that refer to this Agreement. Where no express acceptance has been requested (for example in trial mode), you accept this Agreement by installing or using the Software. If you do not agree, you must not install or use the Software. Installing an update does not change the version of this Agreement you have accepted; changes are governed exclusively by Section 14. The individual who accepts this Agreement on behalf of the Customer represents that he or she is authorised to do so.
1.6 Resellers: If you obtain the license through a distributor or reseller, this Agreement is nevertheless concluded directly between you and KyotoTech. Resellers are not authorised to make statements or representations on behalf of KyotoTech, to amend this Agreement or to grant additional rights; any such statements bind only the reseller. Prices, payment and delivery terms with the reseller are governed solely by your agreement with the reseller and do not affect this Agreement.
1.7 Order of precedence: In case of conflict the following order applies: (a) agreements signed by both parties that expressly amend this Agreement (in particular an Enterprise Addendum), (b) the order documents (in particular plan, quantity, term and price), (c) this Agreement, (d) KyotoTech's General Terms and Conditions to the extent they govern ordering and payment. For rights of use, duties in operation and renewal, warranty, liability, governing law and dispute resolution relating to SaQura CertWatch, this Agreement prevails over KyotoTech's General Terms and Conditions. The Customer's own terms of business or purchasing do not apply, even if KyotoTech does not expressly object to them or performs with knowledge of them.

2. License Grant
2.1 KyotoTech grants you a simple (non-exclusive), non-transferable, non-sublicensable right, limited to the license term, to install, operate and use the Software within the licensed scope (Section 2.8) for your own business purposes and, as permitted by Sections 2.5 and 2.6, for your end customers.
2.2 License end and Grace Period: The license ends automatically on the expiry date stated in the `.lic` unless it is replaced beforehand by a renewed `.lic`. For fourteen (14) days after the expiry date ("Grace Period") you may continue to use the Software to the same extent, so that renewal of your subscription or an orderly transition remains possible; during the Grace Period the Software operates as with a valid license. The Grace Period neither extends the term nor creates any claim to updates or support. After the Grace Period the Software creates no new certificate renewal jobs and no new tenants; jobs created before may still be completed, and existing tenants remain unaffected. In case of revocation of the license, Section 2.10 applies.
2.3 Continued operation after license end: After the Grace Period the Software continues the checks and alerts for the addresses already registered. KyotoTech tolerates this continued operation free of charge until KyotoTech withdraws such tolerance in writing with fourteen (14) days' notice. In case of termination for cause (Section 11.3) or a breach of Section 3 or 10, the tolerance ends upon receipt of the notice. The tolerance does not include automatic certificate renewal, updates, support or the creation of new tenants; existing tenants remain unaffected, and you may add new addresses only within the limit of trial mode. Sections 7.5 and 8.7 apply to continued operation. There is no claim to the continuation of the tolerance.
2.4 Trial mode without license: The Software can be operated without a license file for a limited number of monitored addresses and with at most two (2) tenants in total (the default tenant and one test tenant) ("trial mode"). If the license file is missing, damaged, incorrectly signed or manipulated, the Software treats the creation of new tenants as in trial mode (at most two (2) tenants in total); existing tenants remain unaffected. In trial mode automatic renewal is limited to test runs against the certificate authority's staging environment; test certificates issued there are not suitable for production. Trial mode is provided free of charge for evaluation and internal assessment. There is no claim to particular functions, updates, availability or support; KyotoTech may change or discontinue trial mode in future versions. Otherwise this Agreement applies, in particular Sections 3, 4, 4A, 7.5 and 8.7.
2.5 Instances, agents, tenants: An "Instance" is one installation of the server program. The license covers the number of Instances stated in the `.lic` or the order documents, failing which one Instance. You may install agents on any number of target servers, provided they are connected exclusively to a licensed Instance. Within a licensed Instance you may use the tenant and branding functions within the licensed scope, including to monitor systems of your end customers and, where your license includes automatic renewal, to renew certificates on systems of your end customers. Under the MSP plan the number of tenants is limited to the quota stated in the `.lic` or the order documents. If you reduce the quota, you shall deactivate or delete surplus tenants by the time the reduction takes effect; the Software does not enforce this, and its continued operation is not consent by KyotoTech.
2.6 End customers: If you use the Software for end customers: (a) KyotoTech's contracting party remains you alone; end customers acquire no rights in the Software and no claims against KyotoTech. (b) You may give end customers access to reports, alerts and results, but not to the Software, the `.lic` or administrative access to the Instance. (c) Before monitoring and before any automatic renewal you obtain the end customer's consent under Sections 4.1 and 4A.4. (d) You do not grant your end customers any rights in the Software or against KyotoTech that go beyond this Agreement, and you make no statements or commitments on behalf of KyotoTech. (e) You are liable for acts and omissions of your end customers in connection with the Software as for your own.
2.7 Affiliates: Use by affiliates of the Customer is permitted only if they are expressly named in the `.lic` or the order documents; their acts are attributed to the Customer as its own.
2.8 Licensed scope: The licensed scope (in particular plan, term, Instances, tenant quota and add-on features) results from the order documents together with the `.lic` issued by KyotoTech. If the `.lic` deviates from the order documents, the order documents prevail and KyotoTech issues a corrected `.lic`. Automatic certificate renewal (Section 4A) is licensed only to the extent the `.lic` includes it; currently it is included in the MSP plan and in the Self-Host plan only as an expressly stated add-on.
2.9 License file and license refresh: The Software verifies the `.lic` by its signature locally on your system. In all licensed plans license refresh is enabled by default: the Software asks KyotoTech's license service up to once a day (with a further attempt after network errors) whether a renewed, changed or revoked license exists, and installs a renewed or changed license. Trial mode does not use license refresh. The data transmitted is set out in Section 9.2 (e). You may disable license refresh; you then place new license files yourself, and Section 2.10 applies to revocation. You must not modify the `.lic`, pass it to third parties or use it for unlicensed Instances.
2.10 Revocation: (a) KyotoTech may revoke the license only if (i) a due payment, including a payment charged back or reversed, remains unpaid more than fourteen (14) days after a reminder in writing; (ii) there is serious misuse, namely the `.lic` has been disclosed to third parties or made public, or the Software is used in material breach of Section 3.1 (h), 4.1 or 4A.4 for checks or renewals of systems or domains without authorisation; or (iii) Section 10 requires it. (b) KyotoTech announces the revocation in writing, stating the reason, at least fourteen (14) days in advance and does not revoke if the reason has been remedied within this period. KyotoTech may revoke without prior notice only where waiting would expose KyotoTech or third parties to acute danger (in particular where the `.lic` is publicly available or unauthorised use against systems of third parties is ongoing) or where laws under Section 10 require immediate action or prohibit notice; KyotoTech then informs you without undue delay. (c) Revocation reaches the Software only through license refresh. If license refresh is disabled, revocation takes technical effect only on the expiry date of the installed `.lic`; its contractual effect is unaffected. (d) From the time revocation takes effect in the Software, the Software creates no new renewal jobs and no new tenants and may abort pending jobs before deployment; checks and alerts continue, and existing tenants and certificates remain unaffected. You are then responsible for renewing your certificates in time by other means. KyotoTech lifts a revocation by issuing a new `.lic` once the reason has ceased. (e) If the Agreement ends before the expiry date of the `.lic` (Section 11), the license ends with the Agreement and Sections 2.2 and 2.3 apply from that date. (f) KyotoTech's liability for a revocation that is not justified under this Section 2.10 is governed by Section 8, including the cap in Section 8.2.
2.11 Mandatory user rights: You may make a backup copy of the Software to the extent necessary for future use, and observe, study and test the functioning of the Software, to the extent mandatory law within the meaning of Section 15.3 or mandatory copyright law at the place of installation permits (for example Articles 30-4 and 47-3 of the Japanese Copyright Act, Sections 69d and 69e of the German Copyright Act or Articles 5 and 6 of Directive 2009/24/EC). Section 3 does not affect these rights.
2.12 All rights not expressly granted remain with KyotoTech.

3. Restrictions
3.1 You must not: (a) reverse engineer, decompile or disassemble the Software or attempt to circumvent protection measures such as obfuscation or signature verification, except as permitted by Section 2.11; if you wish to rely on such a right to achieve interoperability, you first request the required interface information from KyotoTech in writing, and KyotoTech provides it, where available, within a reasonable time on reasonable terms; (b) pass on, rent, lend, publish, copy beyond Section 2.11 or make available to third parties the Software or the `.lic`; (c) circumvent license or copy protection or manipulate or share the `.lic`; (d) remove copyright or proprietary notices; (e) use the Software to develop a competing product; (f) publish or disclose results of benchmark, performance or comparative tests of the Software without KyotoTech's prior consent in writing, except as permitted by Section 3.3; (g) provide the Software or administrative access to it to third parties as your own product or service, except under Sections 2.5 and 2.6; (h) use automatic renewal for domains or systems for which no authorisation under Section 4A.4 exists, or to circumvent rate limits or terms of a certificate authority; (i) use the Software for unlawful purposes; (j) modify the agent, replace or imitate it with your own programs, connect it to unlicensed Instances or use its connection or permissions for purposes other than deploying certificates under Section 4A.
3.2 Use beyond the licensed scope: If the `.lic` is disclosed to third parties or the Software is used outside the licensed scope, (a) the Customer shall pay license fees for the period and extent of the actual use at KyotoTech's list prices in force when the over-use began, and (b) KyotoTech may additionally claim compensation for further damage it proves, to the extent the Customer is responsible for the disclosure or over-use. Payments under (a) and under Section 15.7 (b) are owed only once for the same over-use. Tolerated continued operation under Section 2.3 is not use outside the licensed scope.
3.3 Security testing: Notwithstanding Section 3.1 (f), you may test the security of the Software within your own installation, report suspected vulnerabilities to KyotoTech (support@kyototech.co.jp) and share test results confidentially with competent authorities, auditors and advisors who are bound to confidentiality. You may publish details of a vulnerability only with KyotoTech's consent, or after KyotoTech has published a fix, or ninety (90) days after your report, whichever is earliest, and in each case without code that enables attacks on other users. Section 3.1 (a) remains unaffected.

4. Customer Obligations · Authorisation · High-Risk Use · Indemnity
4.1 Authorisation: The Software connects to the addresses you register and checks certificates, protocols and revocation status there (including TLS handshakes, mail and other ports). You represent that you register only addresses and systems that you own or for whose checking you are demonstrably and expressly authorised. You are solely responsible for selecting and approving monitoring targets and for compliance with all applicable laws (such as Sections 202a et seq. and 303b of the German Criminal Code, the Japanese Act on the Prohibition of Unauthorized Computer Access, 18 U.S.C. § 1030 or equivalent provisions).
4.2 Indemnity: You shall indemnify and hold harmless KyotoTech, its officers, employees and agents from all third-party claims (including those of your end customers and of certificate authorities), fines and costs, including reasonable legal defence costs, to the extent they arise from circumstances within your sphere of responsibility, namely from (a) a breach of your representations under Sections 1.3, 4.1, 4A.4 or 10; (b) any other use of the Software contrary to this Agreement or the law for which you, your employees, agents or end customers are responsible, including use by third parties who obtained access to your Instance, your agents or your credentials, to the extent you did not comply with Sections 4.3 and 4A.5 to 4A.7; or (c) claims of your end customers against KyotoTech to the extent they result from your services or commitments to the end customer, from your breach of Section 2.6 or from your configuration, selection of targets or operation of the Software. The indemnity does not apply to the extent the claim is caused by a defect of the Software or a breach of duty by KyotoTech; KyotoTech's liability is then governed by Section 8. KyotoTech informs you promptly of any claim and makes no admissions without consulting you. At KyotoTech's request you take over the defence at your own cost; KyotoTech may participate at its own cost. The indemnity is not subject to the limitations in Section 8. This Section survives termination.
4.3 Operation and reachability: You are responsible for operating the Instance and the agents, their reachability, protecting access to the interface and the server, backing up your data and systems, and configuring outgoing mail (SMTP), webhooks and recipients. Before every update back up the data folder of the Instance, which contains the database, and the installation key. Depending on the operating system the installation key is stored in the data folder (on Windows bound to the computer on which it was created), in the keychain (macOS) or as a systemd credential (Linux); back it up as described in the documentation. Without the installation key, stored credentials cannot be used after a restore. Alerts and reports reach you only if your delivery channels work; KyotoTech is not responsible for them.
4.4 Organisational embedding: The Software reports findings. It renews certificates only where you have set up and enabled automatic renewal for a target under Section 4A; it does not remedy other findings. You ensure that for each monitored or automatically renewed certificate someone is responsible who follows the alerts and can act manually in case of failure.
4.5 Cooperation: To analyse reported defects you provide KyotoTech with the necessary information (such as version, error messages and log excerpts); Section 9.4 remains unaffected.
4.6 High-risk use: The Software is not designed or tested to be the sole or last safeguard of systems whose failure or malfunction could lead to death, personal injury, significant damage to property or the environment or a danger to public safety (for example medical, emergency call, control-centre, traffic control, energy and water supply systems or controls of industrial plants; "High-Risk Systems"). If you use the Software for High-Risk Systems, you ensure through your own measures independent of the Software (in particular your own expiry monitoring and a manual renewal procedure) that an omission, error or delay of checking or renewal cannot lead to such damage. Use contrary to the preceding sentence is at your own risk and constitutes contributory fault under Section 8.8; Section 4.2 applies accordingly. Section 8.1 remains unaffected.

4A. Automatic Renewal and CertWatch Agent
4A.1 Function: Where automatic renewal is licensed and enabled, the Software requests new certificates from an ACME certificate authority (default: Let's Encrypt), proves control of the domain via DNS records (as described in the documentation; currently via Cloudflare or Azure DNS, including zones at these providers to which validation is delegated by CNAME) and hands the certificate to the CertWatch Agent, which deploys it into the web server on the target server (as described in the documentation; currently nginx on Linux and IIS on Windows). The Software then checks from outside whether the new certificate is being served. Which certificate authorities, DNS providers, web servers and operating systems are supported results solely from the documentation of the respective version.
4A.2 Enabling per tenant: Automatic renewal is off for every tenant until you switch it on. KyotoTech does not switch it on, including by an update; updates preserve the switches per tenant and per target and the instance-wide emergency stop set as described in the documentation. You switch renewal on for a tenant only once the requirements of Sections 4A.3 to 4A.9 are met for its targets. Switching it on for the first time requires your express acceptance of this version of the Agreement (Section 1.5), unless you have already given it. You may use the emergency stop and the switches per tenant and per target at any time.
4A.3 Certificate authority: The applicant and holder of the certificate vis-à-vis the certificate authority is you or your end customer, not KyotoTech. You accept the certificate authority's terms (such as its Subscriber Agreement) yourself in the interface per tenant and you comply with them. Whether, when and with which content a certificate is issued, refused or revoked is decided solely by the certificate authority; it may change rate limits, validity periods, procedures and terms at any time. Certificate authorities publish issued certificates with all names they contain in public Certificate Transparency logs. Therefore do not request certificates for names you do not want published.
4A.4 Authorisation: You represent that you use automatic renewal only for domains, DNS zones and servers that you or your end customer are entitled to control. For domains, zones and servers of your end customers you represent that you have obtained their prior express consent in writing covering the request of certificates, the modification of DNS records and the operation of the agent.
4A.5 Credentials: You provide credentials for DNS providers and, where applicable, the certificate authority. You restrict their permissions to what is necessary (for example to the records of the affected zones needed for validation), protect them, rotate them on suspicion of misuse and revoke them when no longer needed. The Software stores these credentials in your installation and transmits them only to the respective provider, not to KyotoTech. Anyone with access to the interface or the server of the Instance can trigger renewals and deploy certificates to connected target servers; you restrict such access accordingly.
4A.6 Network and firewall: The agent opens the connection to the server outbound. The server accepts agents on a dedicated port (default TCP 5443); this port is active only while automatic renewal is switched on (see documentation). You set up the necessary firewall rules yourself, restrict the reachability of that port to the networks of your agents and are responsible for the network paths between agents and server.
4A.7 Agent and target servers: The agent requires permissions to write certificates and keys and to reload the web server, on Windows administrator rights. You decide on the user, permissions and continuous operation of the agent, keep its permissions as low as the documentation allows and are responsible for the security, availability and configuration of the target servers and upstream systems such as load balancers and CDNs. According to the documentation the agent generates the private key on the target server and transmits only the signing request to the server.
4A.8 Checking results: You follow the alerts of the external check (Section 4A.1) and the job messages of renewal and act on errors. You ensure that renewal alerts have recipients. You release a target blocked by the agent only after you have checked it manually.
4A.9 Backups: Before first switching renewal on and before every update you back up the data folder and the installation key of the Instance (Section 4.3) and the certificates, keys and configuration of the affected target servers. The backups the agent creates during deployment are temporary and do not replace your data backup.
4A.10 Restoration: If a deployment or the subsequent check fails, the agent restores the previous certificate only under the conditions set out in the documentation (including a backup matching the target and a remaining validity of the backed-up certificate of at least 24 hours); otherwise it blocks the target. KyotoTech does not owe restoration in every case.
4A.11 Updates: Update the Instance first and the agents afterwards. After every update check the renewal settings.
4A.12 No renewal: In particular, the Software does not renew if the license does not include the function, the Grace Period has expired, the license has been revoked, renewal is switched off for the tenant or target or the emergency stop is set, no agent is assigned or reachable, a target is blocked, credentials are missing or invalid, or the certificate authority or DNS provider does not execute the request. The Software points out such states as described in the documentation; whether a notice reaches you depends on your delivery channels. Renewing your certificates in time remains your task. Automatic renewal supports you in this task; it does not take it over.
4A.13 Changes by third parties: If a certificate authority, a DNS provider or the maker of a web server or operating system changes interfaces, procedures or terms, automatic renewal may fail in whole or in part until KyotoTech provides an update. KyotoTech may change or discontinue support for individual third-party providers in updates.

5. Intellectual Property
5.1 The Software, its structure, algorithms and trademarks are and remain the property of KyotoTech or its licensors and are protected by copyright and other rights. You receive only the rights of use set out in Section 2.
5.2 If you send KyotoTech suggestions, ideas or other feedback on the Software, you grant KyotoTech a free, irrevocable, transferable, sublicensable right to use it without limitation in time or territory for all types of use, and you do not exercise moral rights in it against KyotoTech, to the extent permitted by applicable law. There is no obligation to use it and no remuneration claim arises. Mandatory rights of employees and authors remain unaffected.

6. Third-Party Components / Open Source
The Software contains third-party components (including the .NET runtime, the SQLite database library and libraries for the ACME protocol and for cryptography) that are subject to their own license terms; for those components these terms prevail over this Agreement. Nothing in this Agreement restricts rights these licenses grant you in the respective components. A list is contained in the enclosed file `THIRD-PARTY-NOTICES.txt`.

7. Characteristics · Limited Warranty · No Guarantee · No Advice
7.1 The characteristics of the Software result exclusively from the documentation of the version provided. Public statements, advertising or statements of third parties (including resellers) create no agreed characteristics. KyotoTech gives a guarantee only if it is expressly designated as a "guarantee" in a document signed by KyotoTech; the limited warranty in Section 7.2 is not a guarantee.
7.2 Limited warranty: KyotoTech warrants that during the term the Software substantially conforms to the documentation of the version provided. This also applies to automatic renewal to the extent it is licensed.
7.3 Defects must be notified to KyotoTech without undue delay, at the latest within thirty (30) days after they were discovered or, in proper operation, should have been discovered, in writing with a comprehensible description; there are no claims for defects notified later unless KyotoTech knew of the defect and did not disclose it. KyotoTech remedies defects at its option by repair, update, reasonable workaround or replacement. If remedy has failed twice within a reasonable period, you may reduce the fee or terminate the affected license; Section 11.5 applies to refunds. Damages for defects require fault of KyotoTech and are governed exclusively by Section 8.
7.4 Third-party intellectual property rights: (a) KyotoTech defends you at its own cost against claims of third parties that the contractual use of the Software infringes their copyright, trademark or trade secret rights or a patent granted in Japan, a Member State of the European Union or the United States, and indemnifies you against damages and costs finally awarded against you or agreed by KyotoTech in a settlement. (b) This requires that you inform KyotoTech in writing without undue delay, make no admissions, leave KyotoTech sole control of the defence and of any settlement, and support KyotoTech reasonably at its cost. (c) If such a claim is made or likely, KyotoTech may at its option procure the necessary right of use, modify or replace the Software so that it no longer infringes while its essential functions are preserved, or, if neither is possible on reasonable terms, terminate the affected license and refund prepaid fees pro rata for the remaining term. (d) KyotoTech has no obligation under this Section 7.4 to the extent the claim results from your modification of the Software, its combination with products, data or processes not supplied by KyotoTech, use contrary to this Agreement or the documentation, use of an older version where the current version would have avoided the infringement, third-party components under Section 6, or provision free of charge (Sections 2.3 and 2.4). (e) KyotoTech's obligations under (a) are subject to the cap in Section 8.2; Section 8.1 remains unaffected. This Section 7.4 sets out your sole remedies for the infringement of third-party rights.
7.5 For Software provided free of charge, in particular in trial mode (Section 2.4) and in continued operation under Section 2.3, claims for defects exist only in case of intent or gross negligence or where KyotoTech knew of the defect and did not disclose it.
7.6 Monitoring: The Software performs a methodical, recurring check of the registered addresses. KyotoTech does not warrant that it detects or correctly assesses every expiry, misconfiguration or weakness. It is no reachability or uptime monitoring and does not replace operational monitoring. Detection depends on reachability, response behaviour and configuration of the checked systems, on the availability of public logs and revocation services and on the delivery of your alerts. Results and grades are informational.
7.7 Automatic renewal: Beyond Section 7.2, KyotoTech does not warrant that a certificate is issued, deployed or served on time, at all or without error to the extent the result depends on circumstances outside KyotoTech's control, in particular on the certificate authority, DNS provider, network, target server, upstream systems, your configuration, your credentials and your license.
7.8 The sealed reports and the continuous audit chain show technically that a report has not changed since it was created. They do not replace an audit or attestation by a third party, are no legal advice and do not assure that requirements of BSI, NIS2, GDPR or other rules are met. You make security decisions on your own responsibility.
7.9 DISCLAIMER OF OTHER WARRANTIES: EXCEPT FOR THE LIMITED WARRANTY EXPRESSLY GIVEN IN SECTION 7.2, KYOTOTECH MAKES NO WARRANTY, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE OR NON-INFRINGEMENT AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. THE REMEDIES UNDER THIS SECTION 7 ARE YOUR SOLE REMEDIES FOR DEFECTS; SECTION 8.1 REMAINS UNAFFECTED.

8. Liability
8.1 KyotoTech is liable without limitation (a) for intent and gross negligence, (b) for injury to life, body or health, (c) for defects KyotoTech knew of and did not disclose, (d) under a guarantee expressly designated as such under Section 7.1 (the limited warranty in Section 7.2 is not such a guarantee), (e) under the Japanese Product Liability Act or other product liability law that applies mandatorily within the meaning of Section 15.3, and (f) in other cases in which mandatory law within the meaning of Section 15.3 does not permit a limitation.
8.2 In all other cases KyotoTech is liable only for direct damage typically foreseeable in contracts of this kind. KYOTOTECH'S TOTAL LIABILITY FOR ALL DAMAGE EVENTS IN A CONTRACT YEAR IS LIMITED TO AN AMOUNT EQUAL TO TWELVE (12) MONTHLY LICENSE FEES FOR THE AFFECTED LICENSE (FOR ANNUAL BILLING, THE ANNUAL FEE), BASED ON THE NET FEES APPLICABLE AT THE TIME OF THE FIRST EVENT GIVING RISE TO DAMAGE. If the license was acquired through a reseller, the net fees KyotoTech receives for that license are decisive.
8.3 IN THE CASES OF SECTION 8.2 KYOTOTECH IS NOT LIABLE FOR INDIRECT, CONSEQUENTIAL OR SPECIAL DAMAGES, LOST PROFITS, LOST SAVINGS, LOSS OF REVENUE, BUSINESS INTERRUPTION, DAMAGE TO REPUTATION OR THIRD-PARTY CLAIMS, EVEN IF KYOTOTECH HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Within the cap under Section 8.2, the reasonable and proven costs of manually issuing and installing replacement certificates and of restoring the affected configuration remain recoverable, as do amounts owed under Section 7.4.
8.4 Unless Section 8.1 applies, KyotoTech is not liable for damage resulting from (a) acts, omissions, outages, misissuance, refusals, rate limits or revocations of certificate authorities; (b) outages or changes of DNS providers, Certificate Transparency logs, revocation services, mail, network and other third-party services; (c) expired, revoked, misissued or misconfigured certificates of third parties; (d) your configuration, target servers and upstream systems, firewalls, credentials or backups, unless the damage is caused by a defect of the Software; (e) the absence of a renewal in the cases of Section 4A.12, including license end, end of the Grace Period and a revocation justified under Section 2.10; (f) your disregard of documentation, notices, alerts or updates; (g) use of a version older than the current or immediately preceding version where an available update would have prevented the damage; (h) unauthorised access to your Instance, your agents, your target servers or your credentials, unless it is caused by a defect of the Software for which KyotoTech is responsible.
8.5 To the extent KyotoTech's liability is limited or excluded, this also applies to the personal liability of its officers, employees and vicarious agents and to KyotoTech's licensors and suppliers.
8.6 In case of data loss, liability is limited to the recovery effort that would have been required had the Customer made proper, regular backups.
8.7 For provision free of charge (trial mode under Section 2.4 and continued operation under Section 2.3) KyotoTech is liable only under Section 8.1.
8.8 Contributory fault of the Customer, in particular a breach of its duties under Sections 4, 4.6 and 4A, reduces KyotoTech's liability in proportion to the Customer's contribution to the damage; where the damage was caused solely by such a breach, KyotoTech is not liable.
8.9 This Section 8 applies to all claims against KyotoTech on whatever legal ground, in particular in contract and in tort.
8.10 Each provision of this Section 8 is severable. If one of them is wholly or partly invalid, the others remain valid; in particular the exclusions in Sections 8.3 and 8.4 are unaffected by any invalidity of the cap in Section 8.2 and vice versa.

9. Data Protection and Data Flows
9.1 The Software runs entirely on your systems. Inventory, check results, reports, audit chain, logs, settings, recipients and credentials arise and remain there; they are not transmitted to KyotoTech.
9.2 The Software makes outbound connections only to: (a) the monitoring targets you register; (b) public Certificate Transparency logs (currently crt.sh and, as a fallback, Cert Spotter) for inventory discovery, to which it transmits the domain name searched; (c) the revocation services (OCSP/CRL) and the issuing locations for intermediate certificates (AIA) named in the checked certificates, to which it transmits the identifier of the checked certificate or requests the intermediate certificate; (d) up to once a day a version file provided by KyotoTech, to point out new versions; it sends none of your data, and the request can be disabled; (e) if license refresh is enabled (default in all licensed plans), up to once a day KyotoTech's license service; transmitted are the product identifier, a hash (SHA-256) of the license number, the issue date of the installed license and your setting on license e-mails, not the license number itself; (f) if automatic renewal is enabled, the certificate authority you choose, to which it transmits the signing request with the names to be certified and the account data needed for the ACME protocol; (g) the DNS providers you set up, to which it transmits your credentials and the validation records, and, to verify validation, directly the authoritative name servers of the affected zones and the resolvers configured on your system (DNS queries); (h) your outgoing mail server (SMTP) and the webhook targets you register. Agents connect exclusively to your Instance, where configured via a local HTTP proxy. In each of these connections the remote side sees the IP address of your system, as with any request on the internet.
9.3 You are the controller for personal data in your installation (such as recipient addresses, user names, addresses and names in certificates). KyotoTech has no access to your installation and is not your processor in that respect. For data on license, order and license service KyotoTech is controller in accordance with its privacy notice.
9.4 Send KyotoTech personal data in support only to the extent necessary for analysing the issue, and remove or shorten it beforehand where possible. If processing of personal data on your behalf becomes necessary, KyotoTech provides a data processing agreement on request, which the parties conclude before the processing. Transfers to KyotoTech in Japan are covered by the European Commission's adequacy decision for Japan to the extent it applies.
9.5 Details are set out in the product privacy notice (`PRIVACY.txt`) of the respective version.

10. Export Control and Sanctions
10.1 The Software may be subject to export control and sanctions laws (including the Japanese Foreign Exchange and Foreign Trade Act, Regulation (EU) 2021/821, EU sanctions regulations and US (re-)export law). You represent that you will not use, export or pass on the Software contrary to applicable law, in particular not to embargoed countries or territories, not to listed persons or entities, not to military end users and not for military or other prohibited end uses where applicable law prohibits this or requires a permit not obtained, and that you are not listed yourself and not owned or controlled by listed persons.
10.2 KyotoTech may refuse deliveries, updates, license refresh and support, revoke the license and terminate the Agreement without notice to the extent necessary to comply with such laws. If your representation under Section 10.1 was incorrect, prepaid fees are not refunded; otherwise Section 11.5 applies. You have no further claims against KyotoTech as a result.

11. Term and Termination
11.1 Term: The Agreement runs for the term stated in the `.lic` and the order documents: one year under the Self-Host plan; one month or one year under the MSP plan, depending on the order. The subscription renews automatically for a further term of equal length unless cancelled by the end of the current term. The Customer cancels via the customer portal or in writing. For annual terms KyotoTech reminds you of the upcoming renewal in writing at least thirty (30) days before the end of the term.
11.2 Ordinary termination by KyotoTech: KyotoTech may terminate the subscription in writing with ninety (90) days' notice to the end of an annual term and with thirty (30) days' notice to the end of a monthly term.
11.3 Termination for cause: Each party's right to terminate for cause remains unaffected. Cause for KyotoTech exists in particular in case of a material breach of Sections 3, 4.1, 4A.4 or 10 or if the Customer is more than thirty (30) days in default with a due payment despite a reminder.
11.4 Effects of termination: Upon expiry or termination your rights of use end; the Grace Period under Section 2.2 and the tolerated continued operation under Section 2.3 remain unaffected according to their terms. Automatic renewal ends with the Grace Period; ensure beforehand that your certificates are renewed in time by other means. If the tolerance under Section 2.3 also ends, you must uninstall the Software and agents and delete existing copies. Your own data (inventory, reports, logs) is unaffected and remains with you. At KyotoTech's request you confirm complete uninstallation and deletion within fourteen (14) days in writing. Sections 2.3, 2.6 (d) and (e), 3.2, 3.3, 4.2, 4.6, 5, 7, 8, 9, 10, 11.4, 11.5, 12, 15 and 16 survive termination.
11.5 Refunds: (a) If the Agreement or a license ends before the end of a prepaid term for a reason for which the Customer is not responsible, KyotoTech refunds prepaid fees pro rata for the period after the end; this applies in particular to termination by the Customer for cause (Section 11.3), after failed remedy (Section 7.3) or because of a change (Section 14.2), and to termination by KyotoTech under Section 7.4, 10.2 (unless the Customer's representation under Section 10.1 was incorrect), 11.2 or 14.2. (b) If KyotoTech terminates for a cause for which the Customer is responsible, prepaid fees are not refunded; further claims of KyotoTech remain unaffected. (c) Cancellation by the Customer to the end of a term gives no right to a refund.
11.6 Price changes: KyotoTech announces price changes for running subscriptions in writing at least thirty (30) days before they take effect; they apply from the next term. You may cancel the subscription until the change takes effect.

12. Confidentiality
12.1 The Software (including non-public modes of operation, interfaces and protocols), the `.lic` and non-public information of KyotoTech are confidential. You treat them with the care you apply to your own confidential information, but at least with reasonable care, and make them accessible only to employees and agents who need them for contractual use and are bound to confidentiality.
12.2 KyotoTech treats non-public information you submit in support (such as log excerpts and configurations) as confidential and uses it only to handle your request; KyotoTech may use findings from it to improve the Software only in anonymised and aggregated form.
12.3 Information is not confidential if it is or becomes public without breach of contract, was already lawfully known to the receiving party, is disclosed to it by an authorised third party without confidentiality obligation or was developed by it independently. Statutory or regulatory disclosure duties remain unaffected; the party concerned informs the other beforehand where permitted.
12.4 The obligations under this Section survive for five (5) years after the end of the Agreement, and without time limit for source code, protection mechanisms and other trade secrets of KyotoTech.

13. Updates and Support
13.1 Updates are provided as new program versions according to the plan acquired and only during the term. The Software does not update itself; you update the Instance and the agents yourself (Section 4A.11).
13.2 The Software loads a version file from KyotoTech up to once a day to point out new versions. This request can be disabled; monitoring then continues unchanged.
13.3 KyotoTech may develop, change or replace functions in updates provided the essential contractual functionality (recurring checks, alerting and reports) is preserved; for automatic renewal Section 4A.13 applies in addition.
13.4 Support is provided by e-mail to support@kyototech.co.jp and requires the Customer to use the current or the immediately preceding version. There is a claim to particular functions, updates or response times only if expressly agreed.
13.5 Where mandatory law requires security updates to be provided (for example Regulation (EU) 2024/2847, once and to the extent it applies), KyotoTech provides them to the extent required there; Section 13.1 does not limit such obligations. Security updates are never conditional on the acceptance of a changed version of this Agreement.

14. Changes to this Agreement
14.1 During a paid term the version of this Agreement accepted at purchase or at the last renewal applies. Installing an update, including a security update, does not change it. A new version applies only (a) from the next renewal, if KyotoTech has notified it to you in writing at least thirty (30) days before the end of the current term; you may cancel the subscription by the end of the term; (b) during the term under Section 14.2; or (c) upon your express acceptance (Section 1.5), for example when you first switch on automatic renewal (Section 4A.2) or purchase a new license.
14.2 KyotoTech may change this Agreement during the term only if (a) the change is solely to your benefit, or (b) it does not contradict the purpose of the Agreement and is reasonable in light of its necessity (for example due to changes in law, case law, terms of certificate authorities or other third-party providers, security requirements or functionality), the appropriateness of its content and this change provision (Article 548-4 of the Japanese Civil Code). KyotoTech announces the change, its content and its effective date on its website and notifies you in writing at least thirty (30) days before the effective date, pointing out your rights under this Section and the consequence set out in its last sentence. Until the effective date you may (i) object in writing; the previous version then continues to apply to you until the end of the current term, but if the change is required by law or by the terms of a certificate authority, KyotoTech may terminate the affected subscription with thirty (30) days' notice; or (ii) cancel the subscription with effect from the effective date. In both cases of termination prepaid fees are refunded pro rata (Section 11.5). Regardless of whether this Agreement is a standard-form contract (teikei yakkan), the change is deemed accepted if you neither object nor cancel and continue to use the Software after the effective date.
14.3 On request KyotoTech provides you with the current version without delay in writing.
14.4 Transition: For Customers who accepted an earlier version of this Agreement, this version applies from the next renewal under Section 14.1 (a) or from their express acceptance under Section 14.1 (c), whichever is earlier, and then replaces the earlier version for the future. Section 15 then also applies to disputes about facts before that time, unless proceedings are already pending.

15. Final Provisions
15.1 Governing law: This Agreement and all non-contractual claims in connection with it are governed exclusively by the laws of Japan, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). Only internationally mandatory provisions (overriding mandatory provisions) of another state remain unaffected, to the extent the arbitral tribunal or a competent court must apply them notwithstanding this choice of law.
15.2 Dispute resolution: All disputes arising out of or in connection with this Agreement, including its validity, shall be finally settled by arbitration under the Commercial Arbitration Rules of the Japan Commercial Arbitration Association (JCAA) in force at the time of commencement. The seat of arbitration is Kyoto, Japan; the language is English; the tribunal consists of a sole arbitrator; the expedited procedures under those rules apply where their requirements are met. The arbitral proceedings and their content are confidential. CLAIMS MAY BE BROUGHT ONLY INDIVIDUALLY; CLASS, COLLECTIVE OR REPRESENTATIVE PROCEEDINGS ARE EXCLUDED TO THE EXTENT PERMITTED BY LAW. The tribunal awards the prevailing party its reasonable costs, including attorneys' fees; in case of partial success it apportions them. Each party remains entitled to seek interim relief from any competent state court.
KyotoTech may, at its option, bring (i) claims for payment of fees and (ii) claims for injunctive relief for breach of Section 3, 5 or 12 before the competent state courts at the Customer's seat or in Kyoto instead of arbitration. In such proceedings the Customer shall not invoke this arbitration agreement; counterclaims of the Customer remain subject to arbitration. The choice of a state court for one claim does not waive the arbitration agreement in other respects.
The parties conclude this arbitration agreement by express electronic acceptance (acceptance box when ordering, when activating a license, in the customer portal or when first switching on automatic renewal) or by signing order documents that refer to this Agreement; the stored acceptance constitutes an agreement in writing within the meaning of applicable law and of Article II of the New York Convention. Where no valid arbitration agreement has been concluded with a Customer, the courts in Kyoto, Japan, have exclusive jurisdiction (Kyoto District Court at first instance), without prejudice to KyotoTech's option under the preceding paragraph, and BOTH PARTIES WAIVE TRIAL BY JURY TO THE EXTENT PERMITTED BY LAW.
15.3 Mandatory law: "Mandatory law" within the meaning of this Agreement means the mandatory provisions of Japanese law, overriding mandatory provisions under Section 15.1 sentence 2 and, only for consumers contrary to Section 1.3, the provisions under Section 1.4. Provisions on standard business terms of another state are not mandatory law within this meaning. Rights under mandatory law remain unaffected.
15.4 Severability: If any provision is wholly or partly invalid or unenforceable, the remainder of the Agreement remains valid. To the extent permitted by applicable law, the provision continues to apply with the permissible content closest to its economic purpose; otherwise it is replaced by a valid provision coming closest to that purpose. The same applies to gaps. Sentence 2 does not apply to Section 8; an invalid provision of Section 8 is replaced by the statutory provisions.
15.5 Assignment: You may transfer rights and obligations under this Agreement only with KyotoTech's prior consent in writing, which KyotoTech will not unreasonably withhold. Without such consent you may transfer the Agreement as a whole to a successor by merger, company split or transfer of the business in which the Software is used, provided you notify KyotoTech in writing and Section 10 does not prevent the transfer. KyotoTech may transfer the Agreement to an affiliate or to a successor in the business of the Software and notifies you of the transfer in writing.
15.6 Force majeure: Neither party is liable for delays or failures due to circumstances beyond its reasonable control, in particular natural events, epidemics, war, terrorism, cyber attacks on third parties or on systems of KyotoTech (provided KyotoTech had taken reasonable protective measures in line with the state of the art), failures of power, network and communication services, outages or measures of certificate authorities, DNS providers and other third-party services, and acts of authorities. Payment obligations remain unaffected.
15.7 License compliance: (a) KyotoTech may verify contractual use at most once per contract year with reasonable notice; first by a written self-declaration of the Customer (such as on the number of Instances, agents and tenants), confirmed by a representative authorised to represent the Customer, together on request with extracts of the counts of Instances, agents and tenants kept by the Software, and in case of justified doubt by an audit during normal business hours, preserving confidentiality and the Customer's legitimate secrecy interests. (b) If the verification reveals use beyond the licensed scope, the Customer shall promptly purchase licenses for the period and extent of over-use at KyotoTech's list prices in force when the over-use began. (c) If the over-use exceeds five percent (5 %) of the licensed scope, the Customer additionally bears the reasonable costs of the verification. (d) KyotoTech's further rights (in particular under Section 3.2 (b), termination under Section 11.3 and injunctive relief) remain unaffected.
15.8 Entire agreement: This Agreement, together with the product privacy notice and the order documents, constitutes the entire agreement on its subject matter and supersedes prior arrangements; the order of precedence is set out in Section 1.7. Agreements of the Customer with resellers do not become part of this Agreement. Amendments and supplements must be made in writing; Section 14 remains unaffected.
15.9 Set-off and retention: The Customer may set off only undisputed or finally established claims. The Customer has rights of retention only for counterclaims arising from the same contractual relationship. Sentence 1 does not apply to counterclaims for defects under this Agreement.
15.10 Time limit for claims: Claims of the Customer against KyotoTech must be brought in court or arbitration within twelve (12) months from the time the Customer became aware or, without gross negligence, should have become aware of the circumstances giving rise to the claim; thereafter they are excluded. This does not apply in the cases of Section 8.1 or where the law mandatorily provides longer periods.
15.11 Place of performance: The place of performance for all obligations under this Agreement is KyotoTech's seat.
15.12 Injunctive relief: The Customer acknowledges that breaches of Sections 3, 5 and 12 may cause KyotoTech irreparable or hardly reparable harm for which damages alone are not adequate. In such cases KyotoTech may, in addition to all other rights, seek injunctive and interim relief before any competent court; Section 15.2 does not prevent this.
15.13 Reference: KyotoTech may name the Customer as a customer in reference lists and sales materials, using its name and logo, only with the Customer's prior consent in writing. The Customer may withdraw its consent at any time in writing with effect for future materials. Statements on the content of the use require the Customer's separate prior approval.
15.14 Notices and written form: Notices and declarations under this Agreement must be made in writing. "In writing" in this Agreement includes e-mail and other electronic records; a handwritten signature is required only where this Agreement expressly requires a signed document. Notices to KyotoTech go to support@kyototech.co.jp, notices to the Customer to the e-mail address stated in the license or the order documents. The Customer keeps this address up to date.
15.15 Third-party rights: Third parties acquire no rights under this Agreement, except the persons named in Sections 4.2 and 8.5.

16. Language
The English version is binding. The German and Japanese versions are translations for convenience only; in case of conflict or doubt, the English version prevails. Terms in the English version are construed under Japanese law; common-law terms (such as "warranty", "indemnify", "consequential damages") have the meaning given in this Agreement and not the meaning under any other legal system.