Corma

Corma Labs – Privacy Policy

Last Updated: September 2026

These Terms of Service (these “Terms”) govern access to and use of the Corma Platform and Services. These Terms are entered into between Corma Inc. or the applicable Affiliate of Corma Inc. identified in the applicable Order Form (“Corma”, “Company”, “we”, “our” or “us”), and the customer identified in such Order Form (“Customer”).

These Terms, together with each order form, purchase order or other ordering document issued by or accepted by Corma that expressly references and incorporates these Terms (each, an “Order Form”), and any exhibits or addenda expressly incorporated therein, constitute the agreement between Corma and Customer with respect to the applicable Platform and Services (collectively, the “Agreement”).

BY SIGNING AN ORDER FORM THAT REFERENCES THESE TERMS, OR BY ACCESSING OR USING THE PLATFORM OR SERVICES, INCLUDING FOLLOWING ACCEPTANCE OF SUCH ORDER FORM, CUSTOMER ACKNOWLEDGES THAT IT HAS READ AND AGREES TO BE BOUND BY THESE TERMS. THE INDIVIDUAL SIGNING OR ACCEPTING AN ORDER FORM ON BEHALF OF CUSTOMER REPRESENTS THAT HE OR SHE HAS AUTHORITY TO BIND CUSTOMER.

If Corma and Customer have entered into a separate written agreement, signed by both parties, that expressly governs Customer’s access to or use of the Platform or Services, such separate agreement will govern to the extent of any conflict with these Terms. Commercial terms expressly set forth in an Order Form will control over these Terms with respect to that Order Form. Any pre-printed, standard or additional terms contained in a purchase order, procurement portal or similar Customer document will not modify the Agreement unless expressly agreed in writing by Corma.

Definitions
1. “Affiliate” means, with respect to a party, any entity that directly or indirectly controls, is controlled by, or is under common control with such party, where “control” means ownership of more than fifty percent (50%) of the voting interests of such entity or the power to direct its management and policies.
2. “Authorized User” means an employee, contractor or other individual authorized by Customer to access and use the Platform on Customer’s behalf and within the scope permitted under the applicable Order Form.
3. “Customer Data” means data, information, files or materials submitted to, uploaded to, transmitted to, or otherwise made available for processing by, the Platform by or on behalf of Customer or its Authorized Users. Customer Data excludes Usage Data and Feedback.
4. “Documentation” means Corma’s then-current user documentation, technical documentation and usage instructions made available by Corma for the Platform.
5. “Intellectual Property Rights” means all worldwide intellectual property and proprietary rights, including patents, patent applications, copyrights, moral rights, database rights, trade secrets, know-how, trademarks, service marks, trade names and other similar rights, whether registered or unregistered.
6. “Order Form” has the meaning set forth above and includes the standard form attached as Exhibit A, as may be completed and executed by the parties from time to time.
7. “Outputs” means alerts, reports, findings, recommendations, responses, classifications, summaries or other results generated by or through the Platform for Customer.
8. “Platform” means Corma’s proprietary cloud-based cybersecurity platform identified in the applicable Order Form, including related software and Documentation made available by Corma.
9. “Services” means the services specified in the applicable Order Form, including access to the Platform and any support, implementation, onboarding, training or other services expressly identified therein.
10. “Usage Data” means technical, operational, statistical and usage information relating to the performance, operation and use of the Platform, provided that Usage Data does not identify Customer or any individual and does not include Customer Data in identifiable form.
Order Forms; Scope of Agreement
1. Each Order Form will specify the applicable Platform or Services, subscription term, fees, payment terms, usage limits and other commercial terms. An Order Form becomes binding when signed or otherwise accepted by authorized representatives of both parties, or as otherwise expressly stated in the Order Form.
2. Each Order Form is subject to and incorporates these Terms by reference. Customer’s signature on an Order Form that includes a link to these Terms constitutes acceptance of the version of these Terms identified or made available at that link as of the effective date of the Order Form. Unless expressly stated otherwise in an Order Form, each Order Form is a separate commitment and termination or expiration of one Order Form does not by itself terminate any other Order Form.
Access to and Use of the Platform
1. Subject to Customer’s compliance with the Agreement, including payment of applicable fees, Corma grants Customer, during the applicable subscription term, a limited, non-exclusive, non-transferable and non-sublicensable right to permit its Authorized Users to access and use the Platform solely for Customer’s internal business purposes and in accordance with the applicable Order Form and Documentation.
2. Customer is responsible for the acts and omissions of its Authorized Users and for maintaining the confidentiality and security of access credentials. Customer will promptly notify Corma of any known or suspected unauthorized access to the Platform through Customer’s accounts.
3. Corma may use contractors and service providers in connection with the Services, provided that Corma remains responsible for their performance to the same extent as if performed by Corma, subject to the terms of the Agreement.
Restrictions on Use
1. Except as expressly permitted under the Agreement, Customer will not, and will not permit any third party to: (a) copy, modify, translate, create derivative works of, reverse engineer, decompile or disassemble the Platform, except to the extent such restriction is prohibited by applicable law; (b) bypass or circumvent any technical or security measure of the Platform; (c) access or use the Platform for the purpose of developing, training or improving a competing product, service or model; (d) sell, resell, sublicense, distribute, rent or lease the Platform, or make it available to a third party other than Authorized Users; (e) remove proprietary notices from the Platform or Documentation; (f) use the Platform in violation of applicable law or third-party rights; or (g) knowingly introduce malicious code into the Platform.
2. Corma may suspend affected access to the Platform to the extent reasonably necessary to prevent a material security risk, unlawful use, or material harm to the Platform or other customers. Where practicable, Corma will provide advance notice and will restore access promptly after the relevant issue is resolved.
Customer Responsibilities
1. Customer is responsible for determining whether the Platform and Services are appropriate for its intended use and for its systems, configurations, policies and security decisions. Customer will provide information, access and cooperation reasonably required for Corma to provide the Services. Customer represents and warrants that it has all rights, permissions and lawful bases necessary to provide Customer Data to Corma for processing in accordance with the Agreement. Customer will use the Platform and Outputs in accordance with applicable laws and regulations and will not use the Platform to engage in unlawful, harmful or abusive activity or to violate the rights of any third party.
Artificial Intelligence Features and Outputs
1. Certain features of the Platform use artificial intelligence, machine learning, generative AI or other automated techniques to identify patterns, generate Outputs or assist Customer in assessing cybersecurity-related information.
2. Customer acknowledges that AI-generated or automated Outputs may not be unique and may contain errors, omissions, false positives, false negatives or other inaccuracies. Corma does not warrant that every Output will be accurate or complete or that the Platform will identify, prevent or remediate every threat, vulnerability or security event. Outputs are intended to assist Customer’s personnel and are not a substitute for appropriate human review and judgment. Customer is responsible for evaluating Outputs in the context of its environment and for determining whether and how to act on them. Corma remains responsible for providing the Platform and Services in accordance with the express warranties and obligations set forth in the Agreement.
3. Corma will not use Customer Data to train, develop or improve general-purpose or cross-customer artificial intelligence or machine-learning models without Customer’s prior written consent. For clarity, Corma may process Customer Data as necessary to provide, secure, support and maintain the Services for Customer and may use Usage Data in accordance with Section ‎8.5.
4. As between the parties and subject to Corma’s rights in the Platform and Corma Technology, Customer owns Outputs generated specifically for Customer. Customer acknowledges that Outputs may not be unique and that the Platform may generate the same or similar outputs, suggestions or information for Corma or other customers.
Corma Obligations
1. Corma will provide the Platform and Services in material accordance with the applicable Order Form and Documentation and will use commercially reasonable efforts to maintain the availability, security and operation of the Platform, subject to planned maintenance, emergency maintenance and circumstances beyond Corma’s reasonable control.
2. Corma will maintain commercially reasonable administrative, technical and organizational safeguards designed to protect Customer Data in Corma’s possession or control against unauthorized access, use, disclosure, alteration or destruction, taking into account the nature of the Services and the sensitivity of the Customer Data.
3. Corma will restrict access to Customer Data to personnel and service providers who require such access to provide, support, secure or maintain the Services and who are subject to appropriate confidentiality obligations.
4. Corma will not access, process or otherwise use Customer Data except as necessary to provide, support, secure and maintain the Services, to comply with applicable law, or as otherwise instructed or authorized by Customer under the Agreement.
5. If Corma becomes aware of a Security Incident involving Customer Data, Corma will notify Customer without undue delay and will provide information reasonably available to Corma regarding the nature and scope of the Security Incident. “Security Incident” means unauthorized access to, acquisition of, disclosure of, alteration of, or loss of Customer Data in Corma’s possession or control. Security Incident does not include unsuccessful attempts that do not result in unauthorized access to Customer Data.
6. If Corma processes personal data on behalf of Customer in connection with the Services and applicable law requires a data processing agreement, the parties will enter into Corma’s then-current data processing addendum or another mutually agreed data processing agreement (“DPA”). In the event of a conflict between the Agreement and the DPA regarding the processing of personal data, the DPA will control.
Customer Data; Usage Data; Feedback
1. As between the parties, Customer retains all right, title and interest in and to Customer Data. Customer grants Corma a non-exclusive, worldwide right to host, copy, transmit, process and otherwise use Customer Data solely as necessary to provide, support, secure and maintain the Services, to comply with applicable law, and as otherwise permitted under the Agreement. Corma will not sell Customer Data or disclose Customer Data to third parties except to Corma’s service providers as necessary to provide the Services, as authorized by Customer, or as required by applicable law.
2. Upon expiration or termination of the applicable Order Form, Corma will, upon Customer’s written request and subject to Corma’s standard retention and backup practices and applicable law, make Customer Data available for export in a commercially reasonable format or delete Customer Data, as applicable.
3. Corma may collect and use Usage Data to operate, secure, support, analyze and improve the Platform and Services, provided that Usage Data does not identify Customer or any individual and does not disclose Customer Data in identifiable form.
4. Customer may provide comments, suggestions or other feedback regarding the Platform or Services (“Feedback”). Customer grants Corma a worldwide, perpetual, irrevocable, royalty-free, sublicensable and transferable license to use and incorporate such Feedback for any purpose, provided that Corma does not use or disclose Customer Confidential Information or Customer Data in doing so.
Support; Changes to the Services
1. Corma will provide support services as specified in the applicable Order Form or Documentation. Any service levels expressly agreed in an Order Form or service level agreement will apply only to the Services identified therein. Corma may update or modify the Platform from time to time, including to improve functionality, security or performance. Corma will not materially reduce the core functionality of the Platform purchased by Customer during an active subscription term, except where reasonably necessary for security, legal or regulatory reasons or where replaced by substantially equivalent functionality.
Fees and Payment
1. Customer will pay the fees set forth in the applicable Order Form. Unless otherwise stated in the Order Form, fees are invoiced in advance and are due within thirty (30) days from the invoice date.
2. Except as expressly provided in the Agreement, fees are non-cancellable and non-refundable. Amounts not paid when due may accrue interest at the lesser of one percent (1%) per month or the maximum rate permitted by law, commencing after Corma provides written notice of non-payment and the amount remains unpaid for ten (10) days thereafter.
3. If an undisputed amount remains unpaid for thirty (30) days after its due date, Corma may suspend the affected Services after providing at least ten (10) days’ prior written notice. Corma will not suspend Services for amounts subject to a good-faith payment dispute, provided Customer timely pays all undisputed amounts.
4. Fees are exclusive of applicable sales, use, value-added and similar transaction taxes. Customer is responsible for such taxes, except taxes based on Corma’s net income. If Customer is required by law to withhold taxes from payments, the parties will reasonably cooperate regarding applicable documentation and withholding requirements.
Title; Intellectual Property Rights
1. Corma and its licensors retain all right, title and interest, including all Intellectual Property Rights, in and to the Platform, Documentation, underlying models, algorithms, software, know-how, methodologies, interfaces, improvements, modifications, derivatives and related technology (collectively, “Corma Technology”). No ownership of Corma Technology is transferred to Customer under the Agreement. Except for the limited rights expressly granted under the Agreement, all rights in and to the Corma Technology are reserved by Corma and its licensors.
Confidentiality
1. “Confidential Information” means non-public information disclosed by or on behalf of one party (“Disclosing Party”) to the other (“Receiving Party”) that is designated as confidential or that reasonably should be understood to be confidential given its nature and the circumstances of disclosure. Corma’s Confidential Information includes the Platform, Documentation, non-public technical information and non-public information regarding the operation of the Platform. Customer’s Confidential Information includes Customer Data.
2. Confidential Information does not include information that the Receiving Party can demonstrate: (a) is or becomes publicly available through no breach of the Agreement; (b) was lawfully known to the Receiving Party without restriction before disclosure; (c) is lawfully received from a third party without confidentiality obligation; or (d) is independently developed without use of the Disclosing Party’s Confidential Information.
3. The Receiving Party will use Confidential Information only as necessary to exercise its rights or perform its obligations under the Agreement and will protect it using at least reasonable care. The Receiving Party may disclose Confidential Information to its personnel, affiliates, professional advisors and service providers who have a need to know and are subject to confidentiality obligations at least as protective as those set forth herein.
4. If disclosure is required by law, subpoena or court order, the Receiving Party may disclose the required Confidential Information, provided that, to the extent legally permitted, it gives prompt notice to the Disclosing Party and reasonably cooperates, at the Disclosing Party’s expense, in seeking protective treatment.
5. The obligations under this Section will continue for five (5) years after expiration or termination of the Agreement, except that trade secrets will remain protected for so long as they qualify as trade secrets under applicable law.
Limited Warranty; Disclaimer
1. Corma warrants that, during the applicable subscription term, the Platform will perform in all material respects in accordance with the Documentation when used in accordance with the Agreement. If Customer notifies Corma of a material breach of this warranty, Corma will use commercially reasonable efforts to correct the non-conformity.
2. The warranty in Section 13.1 does not apply to issues caused by: (a) use of the Platform contrary to the Agreement or Documentation; (b) modification by Customer or a third party not acting under Corma’s direction; (c) Customer systems, data, networks or third-party products not controlled by Corma; or (d) trial, beta or no-charge functionality expressly identified as such.
3. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN THE AGREEMENT, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE PLATFORM AND SERVICES ARE PROVIDED “AS IS” AND CORMA DISCLAIMS ALL IMPLIED OR STATUTORY WARRANTIES, INCLUDING IMPLIED WARRANTIES OF ACCURACY, COMPLETENESS, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. CORMA DOES NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT IT WILL IDENTIFY, PREVENT OR REMEDIATE EVERY CYBERSECURITY THREAT OR EVENT.
Indemnification
1. Corma will defend Customer against any third-party claim alleging that Customer’s authorized use of the Platform infringes such third party’s patent, copyright or trademark, or misappropriates its trade secret, and will pay damages finally awarded against Customer by a court of competent jurisdiction or agreed in a settlement approved by Corma.
2. Corma will have no obligation under Section 14.1 to the extent a claim arises from: (a) Customer Data; (b) Customer’s use of the Platform in violation of the Agreement or Documentation; (c) modifications not made by Corma; or (d) combination of the Platform with products, systems or materials not provided or approved by Corma, where the claim would not have arisen but for such combination.
3. If the Platform becomes, or Corma reasonably believes it is likely to become, subject to an infringement claim, Corma may, at its expense: (a) procure the right for Customer to continue using the affected Platform; (b) modify or replace the affected functionality with substantially equivalent functionality; or, if neither is commercially reasonable, (c) terminate the affected Order Form and refund prepaid fees for the affected Services covering the period after termination.
4. Customer will defend Corma against any third-party claim arising from Customer Data or Customer’s unlawful use of the Platform, in each case to the extent the claim would not have arisen from Corma’s breach of the Agreement, and will pay damages finally awarded against Corma or agreed in a settlement approved by Customer.
5. The indemnified party will provide prompt written notice of the claim, reasonable cooperation at the indemnifying party’s expense, and control of the defense and settlement to the indemnifying party; provided that the indemnifying party may not settle a claim in a manner that imposes liability, an admission of wrongdoing or non-monetary obligations on the indemnified party without its prior written consent, not to be unreasonably withheld.
Limitation of Liability
1. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE OR CONSEQUENTIAL DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, BUSINESS OPPORTUNITY OR GOODWILL, ARISING OUT OF OR RELATING TO THE AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
2. EXCEPT FOR THE EXCLUDED CLAIMS IN SECTION ‎15.3, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.
3. The limitations in Section ‎15.2 will not apply to: (a) Customer’s payment obligations; (b) either party’s infringement or misappropriation of the other party’s Intellectual Property Rights; (c) either party’s breach of confidentiality obligations; or (d) liability that cannot be limited under applicable law. For clarity, the exclusion of indirect damages in Section 15.1 will apply to the foregoing claims to the extent permitted by applicable law.
Term and Termination
1. These Terms become effective as between Corma and Customer on the effective date of the first Order Form that incorporates them and remain in effect for so long as any Order Form remains in effect. Each Order Form will continue for the subscription term stated therein. Renewal terms, if any, will be as set forth in the applicable Order Form.
2. Either party may terminate an affected Order Form for material breach if the other party fails to cure such breach within thirty (30) days after written notice describing the breach. Either party may terminate an affected Order Form immediately upon written notice if the other party becomes subject to bankruptcy, insolvency, receivership or similar proceedings that are not dismissed within sixty (60) days.
3. Upon expiration or termination of an Order Form: (a) Customer’s rights to access and use the affected Platform and Services will end; (b) each party will remain responsible for amounts and obligations accrued before termination; and (c) each party will, upon request, return or destroy the other party’s Confidential Information, subject to routine backups, legal retention obligations and Section ‎8.4.
4. Sections that by their nature are intended to survive expiration or termination will survive, including Sections ‎6.5, ‎8, ‎11, ‎12, ‎14, ‎15, ‎16.4 and ‎17.
General Terms
1. The Agreement is governed by the laws of the State of New York, without regard to conflict-of-law principles. The state and federal courts located in New York County, New York will have exclusive jurisdiction over disputes arising out of or relating to the Agreement, and each party consents to such jurisdiction. Notwithstanding the foregoing, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its Intellectual Property Rights or Confidential Information.
2. Neither party may assign the Agreement without the other party’s prior written consent, not to be unreasonably withheld; provided that either party may assign the Agreement without consent to an affiliate or in connection with a merger, reorganization, change of control, or sale of all or substantially all of its business or assets to which the Agreement relates. Any other attempted assignment is void.
3. The parties are independent contractors. Nothing in the Agreement creates a partnership, joint venture, agency, fiduciary or employment relationship.
4. Neither party may issue a press release regarding the relationship or use the other party’s name or marks in public marketing materials without the other party’s prior written consent, except that Corma may include Customer’s name in a factual customer list with Customer’s prior consent.
5. The Agreement constitutes the entire agreement between the parties regarding its subject matter and supersedes prior or contemporaneous understandings regarding that subject matter. In the event of conflict, the following order of precedence applies unless expressly stated otherwise: (a) a mutually executed amendment or separate agreement; (b) the applicable Order Form; (c) an applicable DPA solely with respect to personal-data processing; and (d) these Terms.
6. Corma may update these Terms from time to time. Unless required by law or expressly agreed otherwise, updates will not apply to an existing Order Form during its then-current subscription term and will apply only upon renewal or execution of a new Order Form, unless the parties agree otherwise in writing.
7. Legal notices under the Agreement must be in writing and sent by email with confirmation of receipt, nationally recognized courier, or certified mail to the addresses stated in the applicable Order Form, with a copy to any legal-notice address identified therein. Notices are deemed received when delivered.
8. If any provision is held unenforceable, it will be modified to the minimum extent necessary to make it enforceable and the remaining provisions will remain in effect. A waiver must be in writing and will not constitute a waiver of any later breach.
9. Order Forms and amendments may be executed in counterparts and by electronic signature, each of which will be deemed an original and all of which together constitute one instrument.