ENTERPRISE + DISTRIBUTION EDGES ADDENDUM

Last Updated: December 1, 2021

This Enterprise+ Distribution Edges Addendum (“Addendum”) applies to the extent either as an individual, company or other legal entity (“you“) have an active Enterprise+ subscription which includes Distribution Edges (as defined below). If you want to verify whether your Enterprise+ subscription includes Distribution Edges, please refer to the specifications in your applicable order form or quote (“Order Form”).

If you are not willing to be bound by the terms and conditions of this Addendum, do not use Distribution Edges. By signing an Order Form that incorporates this Addendum or by using Distribution Edges, you hereby: (i) accept and agree to this Addendum; and (ii) represent that if you are acting on behalf of a company, organization or other legal entity, that you are authorized to bind such company, organization or legal entiy to the terms and conditions set forth herein.
You hereby waive any rights or requirements under any laws or regulations in any jurisdiction which require an original (non-electronic) signature or delivery or retention of non-electronic records, to the extent permitted under applicable law.

1. Definitions
   1. “Agreement” means the Artifactory End User Software License Agreement as amended or Enterprise + End User License Agreement by and between JFrog and you.
   2. “Distribution Edge(s)” means cloud hosted distribution edges instances managed by JFrog.
   3. “JFrog” means the legal entity within the JFrog group of companies which is a party to the Agreement.
2. General
   1. Terms not defined herein shall have the same meaning ascribed to them in the Agreement.
   2. THE TERMS OF THE AGREEMENT SHALL APPLY, AS APPLICABLE, TO THE USE OF THE DISTRIBUTION EDGES. TO THE EXTENT THAT IN CONNECTION WITH SUCH USE, THE TERMS OF THIS ADDENDUM CONFLICT WITH THE TERMS OF THE AGREEMENT, THE TERMS OF THIS ADDENDUM SHALL GOVERN WITH RESPECT TO THE CONFLICTING MATTER.
   3. This Addendum shall constitute an integral part of the Agreement.
3. License. Subject to the payment of the applicable Fees (as defined below) under an Order Form, JFrog hereby grants you, solely during the applicable Subscription Term, a limited, revocable (in accordance with the terms herein), nontransferable, non-sublicensable and nonexclusive license to access and use the number of Distribution Edges set forth in the applicable Order Form, for your internal use and in connection with the development of your proprietary software. Each Distribution Edge will be hosted on a cloud server hosted either by Amazon Web Services, Microsoft Azure or Google Cloud Platform (each, a “Cloud Platform”), selected at your option (according to certain limitations that may be set by JFrog at its sole discretion).
4. Restrictions. Except as expressly permitted in the Agreement or this Addendum, you shall not, nor permit anyone else to, directly or indirectly:
   1. allow any person or legal entity other than your employees or service providers to access or use the Distribution Edges, except that you may grant third parties with download only access to each Distribution Edge;
   2. circumvent, disable or otherwise interfere with security-related features of the Distribution Edges or features that enforce limitations on its use;
   3. use the Distribution Edges to transmit, distribute, or otherwise make available through or in connection with the Distribution Edges, any computer code, artifact, component or any software to any third party which is not yours or of your affiliates;
   4. transmit any malicious code, viruses, worms or other items of a destructive or deceptive nature into or in connection with the Distribution Edges;
   5. access or use the Distribution Edges for the purpose of bringing an intellectual property infringement claim against JFrog or for the purpose of creating a product or service competitive with the Distribution Edges;
   6. access or use the Distribution Edges in a manner that does not comply with the documentation and/or with JFrog’s specific instructions; or
   7. unless JFrog have entered into a separate agreement with you, use the Distribution Edges for any purpose or in any manner involving: (A) information relating to biometric or genetic data, health, racial or ethnic origin, political opinions, religious or philosophical beliefs, sex or sexual orientation, trade union membership, or personal payment or financial information; (B) consumer reports as defined in the Fair Credit Reporting Act, as amended (“FCRA”); (C) nonpublic personal information as defined under the Gramm-Leach-Bliley Act, as amended; (D) protected health information as defined under the Health Insurance Portability and Accountability Act, as amended (“HIPAA”) that has not been de-identified in compliance with HIPAA; or (E) special categories of personal data as defined in the General Data Protection Regulation, as amended (“GDPR”).
5. JFrog may suspend your access to the Distribution Edges if JFrog reasonably believes that your use of the Distribution Edges is in breach of the restrictions set forth in Section 3, or if it may cause damage to your server on a Cloud Platform. JFrog will use reasonable efforts to notify you of such suspension in advance and JFrog may provide reasonable assistance to assist you in the remediation of such violation or to mitigate such risk to the Distribution Edges.
6. Customer Data. Provision of access to the Distribution Edges hereunder requires JFrog to monitor traffic and content (including encrypted content) transmitted by your networks (collectively, the “Customer Data”) and requires you to provide, upload, transmit, or make accessible to JFrog such Customer Data. You hereby agree that JFrog will collect, monitor, store and use the Customer Data, on your behalf, to provide the Distribution Edges to you in accordance with this Addendum. You will control the access to the Customer Data and have full administrative control over such data, including the right to view or modify it. As between you and JFrog, you own and will retain all right, title and interest of any nature, including Intellectual Property Rights, in and to the Customer Data. You hereby grant JFrog a non-exclusive, sub-licensable, royalty-free license to use the Customer Data solely to provide the Distribution Edges during the Subscription Term and in accordance with any applicable laws. Except as set forth herein, nothing in this Addendum shall be construed as transferring any rights, title or interests in the Customer Data to JFrog or to any third party.
7. Fees. You shall pay JFrog the fees applicable to the Distribution Edges as set forth in the applicable Order Form. The fees comprise of both fixed fees associated with the license to Distribution Edges (the “Fixed Fees”), and fees for periodic consumption of System Resources throughout the Subscription Term (the “Usage Fees”, and together with the Fixed Fees, the “Fees”). “System Resources” means the metric by which usage and consumption of Distribution Edges is billed as set forth on an Order Form, including, but not limited to, amount of storage of Customer Data and amount of data transfer of Customer Data.
   1. In connection with the Fees the following shall apply: (i) the Fees set forth in the Order Form will be invoiced upon the commencement of the Subscription Term; (ii) the Fees are nonrefundable and will be allocated to your account (“Account”) associated with the relevant Subscription; (iii) your Account’s credits will be available for use during the applicable Subscription Term; (iv) at the end of each month during the Subscription Term, the applicable portion of the Fees representing your committed Fixed and Usage Fees for such month, as well as any excess usage of System Resources, will be deducted from your Account; (vi) to the extent you exhaust all of your prepaid Account credits prior to the lapse of the Subscription Term, you will be invoiced for the periodic committed Fixed and Usage Fees set forth in the Order Form, and for any excess usage of System Resources, for the remaining Subscription Term. JFrog will issue you with an invoice at the end of each month with respect to such Fees.
   2. In addition to other remedies available to JFrog, JFrog expressly reserves the right to suspend or terminate the license and access to the Distribution Edges in the event you fail to pay the Fees on a timely manner. You further agree and acknowledge that JFrog has no obligation to retain Customer Data and that it may be deleted if you fail to pay any outstanding Fees when due.
8. Data Security. JFrog will maintain a security and privacy program which will be in all material aspects in accordance with the relevant industry standards and is designed to (i) ensure the security and integrity of Customer Data; (ii) protect against threats or hazards to the security or integrity of Customer Data; and (iii) prevent unauthorized access to Customer Data.
   1. As part of this program, JFrog will:
      1. Implement appropriate environmental and physical security measures to prevent unauthorized physical access to restricted information and the systems managing it.
      2. Manage and restrict access solely to the resources necessary for users (application, database, network, and system administrators) to perform authorized functions.
      3. Require strong authentication and encryption that meet the industry security standards for any remote access to Confidential Information and JFrog’s network.
      4. Conduct an annual penetration test on the Distribution Edges by external third party; executive report of such penetration test may be shared with you following the receipt of a written request.
      5. Employ appropriate measures of identification and access controls to JFrog’s systems and data.
      6. Provide all JFrog employees with an appropriate level of periodical training concerning organizational security and privacy measures.
      7. Conduct risk assessment processes to regularly assess information security risks.
   2. Compliance, Audit and Certification. JFrog shall validate compliance with its security and privacy program annually. Audits of controls and infrastructure shall occur in line with the risk level, JFrog’s policies and procedures, legal and regulatory requirements and generally accepted industry practices.
   3. Data Breach. JFrog will notify you without undue delay in case of a confirmed Data Breach unless such notification is delayed due to an act or order of any governmental agency or other similar authority. JFrog will provide you with a description of the nature of the Data Breach, including a description of the measures taken to address the Data Breach (and if applicable measures to mitigate its) and likely consequences of the Data Breach. JFrog will reasonably assist you with conducting investigations and analysis required by you. JFrog shall take all necessary steps consistent with good industry practice, and taking into account the severity of the risk, to resolve such Data Breach as quickly as possible and to prevent its recurrence. For the purposes of this section, a “Data Breach” shall mean any unauthorized, accidental or unlawful destruction, loss, alteration, disclosure of, or access to Customer Data.
   4. JFrog will maintain a security and privacy program which will be in all material aspects in accordance with the relevant industry standards and is designed to (i) ensure the security and integrity of Customer Data; (ii) protect against threats or hazards to the security or integrity of Customer Data; and (iii) prevent unauthorized access to Customer Data.
9. DOWN TIME COMPENSATION.
   1. If the Distribution Edges (excluding any third party services used in conjunction with the Distribution Edges) will not be operational and available to you at least 99.9% of the time in any calendar month, you will be eligible to receive the Service Credits as described below.
   2. This Down Time Compensation provision states your sole and exclusive remedy for any failure of JFrog to preserve the operation and/or availability of the Distribution Edges.
   3. Definitions: The following definitions shall apply to the Down Time Compensation provision.
      1. “Downtime” means, for Distribution Edges(s), if there is more than a five percent user error rate. Downtime is measured based on JFrog’s server-side error rate. “Downtime” does not include the period of a Cloud Migration in which some or all of the Customer Data may be unavailable for use.
      2. “Downtime Period” means, for a domain, a period of ten consecutive minutes of Downtime, excluding any Scheduled Downtime. Intermittent Downtime for a period of less than ten (10) minutes will not be counted towards any Downtime Periods.
      3. “Monthly Uptime Percentage” means total number of minutes in a calendar month minus the number of minutes of Downtime suffered from all Downtime Periods in a calendar month, divided by the total number of minutes in a calendar month.
      4. “Scheduled Downtime” means those times where JFrog notifies its customers of periods of Downtime prior to the commencement of such Downtime. Scheduled Downtime is not considered Downtime for purposes of this Down Time Compensation provision and will not be counted towards any Downtime Periods.
      5. “Service Credit” means the following:

         Monthly Uptime Percentage	Calendar Days of free use of the Distribution Edges to be added to the end of the Subscription Term
         < 99.9% – ≥ 99.0%	1
         < 99.0% – ≥ 90.0%	7
         < 90.0%	30

      6. You Must Request Service Credit. To receive any of the Service Credits described above, you must notify JFrog within thirty (30) days from the time you become eligible to receive a Service Credit. Failure to comply with this requirement will forfeit your right to receive a Service Credit.
10. Upon termination or expiration of this Addendum or the Agreement: (i) JFrog will cease from providing the Distribution Edges, the licenses granted to you under this Addendum shall expire, and you shall discontinue all further use of the Distribution Edges; and (ii) JFrog shall delete, within up to sixty (60) days, all Customer Data provided by you pursuant to this Addendum, provided that JFrog will retain any Analytical Data. Upon termination or expiration of this Addendum or the Agreement, you will lose all access to any Customer Data that JFrog may be storing. You are responsible for downloading Customer Data prior to the termination or expiration of this Addendum or the Agreement. JFrog will not have any obligation to retain Customer Data following the termination of this Addendum or the Agreement.
11. This Addendum will remain in force and effect during the period specified in the applicable Order Form, unless earlier terminated in accordance with the terms of the Agreement.