STIGrevolution End-User License Agreement

Version 1.1

This End-User License Agreement (this “Agreement”) is a legal agreement between STIG Solution LLC, a North Carolina limited liability company (“Licensor,” “we,” “us,” or “our”), and the individual or entity that accepts it (“Licensee,” “you,” or “your”). It governs your acquisition and use of the STIGrevolution software, in object-code form, together with any updates, upgrades, patches, supplements, documentation, and related support services we make available (collectively, the “Software”).

READ THIS AGREEMENT CAREFULLY. IT CONTAINS A DISCLAIMER OF WARRANTIES, A LIMITATION OF LIABILITY, AND A CHOICE OF LAW AND EXCLUSIVE FORUM.

1. Acceptance

You accept this Agreement by clicking “I Accept” (or a similar control), by executing an order or quote that references this Agreement, or by installing, accessing, or using the Software, whichever occurs first. If you do not agree, do not install, access, or use the Software.

If you accept this Agreement on behalf of a company, agency, or other legal entity, you represent and warrant that you have the authority to bind that entity, and “you” and “Licensee” refer to that entity. This Agreement applies whether you obtain the Software directly from us or through an authorized reseller or distributor (“Reseller”); however, your payment terms, order quantities, and delivery obligations are governed by your agreement with the Reseller.

We may present a revised version of this Agreement in connection with a new release, a renewal, or a new order. Revised terms apply prospectively from the date you accept them and do not retroactively change the terms governing a license you have already purchased for its then-current term.

2. License Grant

Subject to your compliance with this Agreement and payment of all applicable fees, Licensor grants you a limited, non-exclusive, non-transferable, non-sublicensable license, during the applicable license term, to:

(a) install, activate, and use the Software for your own internal business purposes on the number of devices authorized by your license key, which permits the number of concurrent activations stated in your order, subject to Section 8.4; and

(b) make a reasonable number of copies of the Software solely for backup, archival, and disaster-recovery purposes, provided that all proprietary notices are reproduced.

Your employees and your contractors may exercise this license solely on your behalf and for your internal business purposes, provided that you remain responsible for their compliance with this Agreement. Use of the Software to perform compliance, assessment, or consulting work for your own customers under your own contracts is permitted internal business use; operating the Software as a shared or hosted service for third parties is not (see Section 3).

You are responsible for ensuring your devices meet the minimum requirements published for the Software.

3. Restrictions

Except as expressly permitted in Section 2, and except to the extent a restriction below is prohibited by applicable law, you will not, and will not permit any third party to:

(a) sell, resell, rent, lease, lend, sublicense, distribute, or otherwise transfer the Software, or make it available to third parties on a service bureau, time-sharing, hosted, managed-service, or similar basis;

(b) modify, adapt, translate, or create derivative works of the Software, or incorporate the Software into other software, except as permitted by Section 4;

(c) decompile, disassemble, reverse engineer, or otherwise attempt to derive the source code, algorithms, or underlying structure of the Software, except to the extent this restriction is prohibited by applicable law (and in that case, only after providing us with prior written notice and a reasonable opportunity to supply the necessary interoperability information);

(d) remove, obscure, or alter any copyright, trademark, or other proprietary notice;

(e) circumvent or disable any license key, activation, seat limit, or other technical protection measure, or use the Software beyond the scope of the license you purchased;

(f) publish or disclose benchmark or performance results for the Software without our prior written consent;

(g) use the Software in violation of any applicable law or regulation, including export control and sanctions laws; or

(h) use the Software to develop a competing product.

4. Third-Party and Open-Source Components

The Software includes third-party and open-source components licensed under their own terms, identified in the NOTICE or THIRD-PARTY-NOTICES file distributed with the Software. Those terms govern those components and, to the extent they grant you broader rights than this Agreement, those broader rights control as to that component only. Third-party components are provided without warranty or indemnity from Licensor.

5. Fees, Term, Renewal, and Taxes

5.1 License model and term. The Software is licensed on a fixed twelve (12) month term basis. Each license term begins on the date stated in your order or license key and expires twelve (12) months later. Fees are as set forth in your order or on our published price list.

5.2 Payment. Unless your order states otherwise, fees are due within thirty (30) days of invoice, are non-refundable except as expressly stated in Section 5.5, and are payable in U.S. dollars.

5.3 No automatic renewal. Licenses do not renew automatically. Your license and your right to use the Software expire at the end of the twelve (12) month term unless you purchase a renewal. No cancellation is required and no charge will be made after the term ends. We may, as a courtesy, send an expiration reminder, but you are responsible for tracking your own expiration date. Renewal is at our then-current prices and terms.

5.4 Effect of expiration. On expiration of the license term, the Software will cease to function until a valid renewal license key is applied. Your Data remains on your systems in its existing file formats, is not deleted, locked, encrypted, or rendered inaccessible by expiration, and remains readable by other tools that support those formats. Expiration does not give Licensor any right to access, disable, or delete Your Data. Licensor recommends exporting any work product you may need before your term ends.

5.5 Refunds. Because a free trial is available before purchase, all fees are non-refundable except as follows: if this is your first purchase of the Software, you may request a full refund within thirty (30) days of the purchase date by written request to mail@stigsolution.com. Refunds are not available for renewal terms, for additional activations added to an existing license, or after the first thirty (30) days of an initial term. On issuing a refund, Licensor will deactivate the associated license key, and you must cease all use of the Software and uninstall it. If you purchased through a Reseller, the Reseller’s refund terms govern and you must direct refund requests to the Reseller.

5.6 Taxes. Fees exclude sales, use, VAT, and similar taxes, which are your responsibility, other than taxes on our net income.

6. Free Trial

If we make a free trial available, this Agreement governs it. The trial runs for fourteen (14) days from activation unless we state otherwise, is limited to evaluation of the Software, and may be modified or discontinued at any time. NOTWITHSTANDING ANY OTHER PROVISION, SOFTWARE PROVIDED ON A TRIAL, EVALUATION, BETA, OR NO-CHARGE BASIS IS PROVIDED “AS IS” WITH NO WARRANTY, NO SUPPORT COMMITMENT, AND NO INDEMNITY, AND OUR AGGREGATE LIABILITY ARISING FROM SUCH USE WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US$100). At the end of a trial, the Software will cease to function unless you purchase a license. Data you created locally during the trial remains on your systems; we do not delete, retain, or retrieve it.

7. Support and Updates

7.1 Support. During an active license term, support is available by email at mail@stigsolution.com on a commercially reasonable efforts basis during U.S. business hours. Licensor does not commit to any specific response or resolution time. Support does not include on-site services, custom development, or assistance with third-party products.

7.2 Updates. Licensor publishes updates to the Software on its website at https://stigsolution.com/stigrevolution/ for download by licensees with an active license term. Licensor may, but is not obligated to, issue updates, upgrades, or new versions. Any update or upgrade we provide is part of the Software and governed by this Agreement unless accompanied by separate terms.

8. Your Data and Software Behavior

8.1 Your data. You retain all right, title, and interest in the checklists, scan results, artifacts, configurations, and other data you process with the Software (“Your Data”). We claim no ownership of Your Data.

8.2 Local processing. The Software processes STIG checklists, Nessus scan files, eMASS package artifacts, and related data locally on the systems where you install it. Licensor does not receive, transmit, store, or access Your Data, and has no ability to retrieve it.

8.3 Sensitive data. You acknowledge that Your Data may include Controlled Unclassified Information (CUI), vulnerability data, system configuration data, or other sensitive information. You are solely responsible for handling Your Data in accordance with your organization’s security policies and all applicable laws, regulations, and contractual obligations, including where applicable DFARS 252.204-7012 and NIST SP 800-171, and for the security of the systems on which you install the Software.

8.4 License activation and telemetry. The Software requires license activation. To activate, and to confirm on an ongoing basis that a license remains valid, the Software transmits to Licensor: (i) your license key; (ii) a machine fingerprint consisting of a one-way cryptographic hash of hardware and system identifiers of the device on which the Software is installed; and (iii) the Software version. The fingerprint is used solely to identify that device for activation-limit enforcement. Licensor does not receive the underlying identifiers and cannot reconstruct them, does not collect an inventory of your hardware or installed software, and does not receive your device name, hostname, IP address, domain, or user identity through this process.

Licensor stores the license key, the machine fingerprint hash, and the date and time of each activation and validation check, and retains that record for the license term plus twelve (12) months, after which it is deleted.

Hosting of activation records. The licensing service operates on Microsoft Azure, and activation records are stored there. Microsoft Corporation acts as Licensor’s hosting provider for this purpose. Licensor does not sell, rent, or disclose activation records to any other third party, except as required by law. Because no Licensee data other than the license key, fingerprint hash, and validation timestamps is transmitted, no Your Data — and no Controlled Unclassified Information — is stored in or transmitted through the licensing service.

The Software does not transmit STIG checklist content, Nessus scan results, eMASS package data, POA&M or finding content, hostnames, IP addresses, asset names, or any other system, configuration, or vulnerability data to Licensor or any third party. Licensor does not receive, store, or have any ability to access Your Data.

Connected activation. Activation requires outbound HTTPS access on port 443 to licensing.stigsolution.com. A successful activation or validation authorizes the Software for fourteen (14) days. The Software attempts to revalidate every seven (7) days. If it cannot reach the licensing service, it continues to operate normally until the fourteen (14) day authorization window lapses, providing approximately seven (7) days of tolerance for network outages. If the window lapses without a successful validation, the Software will stop functioning until it can revalidate. Licensor uses commercially reasonable efforts to keep the licensing service available but does not guarantee uninterrupted availability; if an outage attributable to Licensor prevents validation, contact mail@stigsolution.com for an offline authorization.

Disconnected and air-gapped environments. The activation process described above requires periodic network access. If you intend to deploy the Software in a disconnected, classified, or air-gapped environment, contact mail@stigsolution.com before purchase. Licensor may, at its sole discretion, offer alternative licensing arrangements for such environments under separate written terms, which will govern that deployment to the extent they conflict with this Section. Licensor makes no commitment to provide, support, or continue any such arrangement, and nothing in this Agreement obligates you to connect any system to an external network.

Activation limits and deactivation. Your license key authorizes the number of concurrent activations stated in your order. Activations are tied to the specific license key under which they were purchased and may not be pooled, combined, aggregated, or transferred across separate license keys, orders, or entities, whether or not those keys are held by the same Licensee. You may release an activation at any time using the deactivation function in the Software before uninstalling, reimaging, or decommissioning a device. If a device becomes unavailable before it can be deactivated, contact mail@stigsolution.com and Licensor will reset the activation within a commercially reasonable time. Licensor will not unreasonably withhold activation resets attributable to ordinary system maintenance, reimaging, or hardware replacement.

8.5 Support data. If you voluntarily send us files, logs, or screenshots in connection with a support request, you are responsible for redacting or sanitizing any CUI, classified, or otherwise restricted information before sending. We will use such materials solely to provide support and will delete them on request.

8.6 Privacy. Our handling of any personal information is described in our Privacy Policy at https://stigsolution.com/privacy/, which is incorporated by reference.

9. Intellectual Property and Ownership

The Software is licensed, not sold. Licensor and its licensors retain all right, title, and interest in and to the Software, including all copyrights, patents, trademarks, trade secrets, and other intellectual property rights, and all modifications, enhancements, and derivative works of it, regardless of who creates them. No rights are granted except as expressly stated in this Agreement. Licensor reserves the right to license the Software to third parties.

Feedback. If you provide suggestions, feature requests, or other feedback, you grant Licensor a perpetual, irrevocable, worldwide, royalty-free license to use and incorporate it into the Software without obligation or attribution. Feedback is provided voluntarily and is not your confidential information.

10. Non-Affiliation and Trademarks

STIG Solution LLC is an independent company. The Software is not affiliated with, endorsed by, sponsored by, certified by, or approved by the United States Department of Defense, the Defense Information Systems Agency (DISA), the National Institute of Standards and Technology, Tenable, Inc., or any other government agency or third party. “STIG,” “eMASS,” “DISA,” “Nessus,” and other third-party names are the trademarks or registered trademarks of their respective owners and are used solely for descriptive and interoperability purposes under nominative fair use. Security Technical Implementation Guides and related content published by DISA are U.S. Government works used in accordance with their published terms; the Software does not modify their authoritative meaning, and the authoritative source remains DISA.

Nothing in this Agreement grants you any right to use Licensor’s trademarks, logos, or product names except to accurately identify the Software.

11. U.S. Government End Users

11.1 Restricted rights. The Software is “commercial computer software” and the documentation is “commercial computer software documentation” as those terms are used in FAR 2.101, FAR 12.212, and DFARS 227.7202. Consistent with FAR 12.212 and DFARS 227.7202-1 through 227.7202-4, if the Software is acquired by or on behalf of any agency or instrumentality of the U.S. Government, the Government acquires only those rights in the Software and documentation customarily provided to the public under this Agreement, and no greater rights. Any use, duplication, disclosure, modification, or distribution beyond those rights is prohibited. Unpublished rights are reserved under the copyright laws of the United States. The commercial computer software rights legend at FAR 52.227-19 and the restricted-rights notices at DFARS 252.227-7014 and 252.227-7202 apply as applicable.

11.2 Federal supremacy. If Licensee is an agency or instrumentality of the U.S. Government, then to the extent any provision of this Agreement is inconsistent with federal law, federal law controls and that provision does not apply. Without limiting the foregoing, the following provisions do not apply to such a Licensee: the governing law and forum provisions of Section 17 (federal law and the exclusive jurisdiction provisions applicable to the United States apply instead); any obligation of Licensee to indemnify, defend, or hold harmless (to the extent it would violate the Anti-Deficiency Act, 31 U.S.C. § 1341, or exceed the authority of the contracting officer); any automatic renewal or obligation extending beyond funds appropriated and available; any jury-trial waiver; and any provision imposing interest or penalties inconsistent with the Prompt Payment Act. All other terms remain in effect.

12. Export Control and Sanctions

You represent that you are not located in, organized under the laws of, or ordinarily resident in a country or region subject to comprehensive U.S. sanctions, and that you are not identified on any U.S. government restricted- party list. You will comply with the U.S. Export Administration Regulations and all other applicable export control and sanctions laws, and will not export, re-export, or transfer the Software in violation of them.

13. Verification

If we have a reasonable, good-faith basis to believe your use exceeds the license you purchased, you will, on no less than thirty (30) days’ written notice and no more than once per twelve (12) month period, provide a written report of your installations and seat counts, certified by an authorized officer. Any shortfall will be invoiced at our then-current list price. This Section does not entitle us to access your systems, networks, or Your Data.

14. Indemnification by Licensee

To the extent permitted by applicable law, and subject to Section 11.2, you will defend, indemnify, and hold harmless Licensor and its members, officers, and employees from any third-party claim arising out of your use of the Software in violation of this Agreement or applicable law. This Section does not apply to any Licensee that is an agency or instrumentality of the U.S. Government.

15. Disclaimer of Warranties

THE SOFTWARE AND ALL RELATED DOCUMENTATION AND SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, LICENSOR EXPRESSLY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE, OR USAGE OF TRADE.

LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, THAT DEFECTS WILL BE CORRECTED, OR THAT THE SOFTWARE WILL MEET YOUR REQUIREMENTS. WITHOUT LIMITING THE FOREGOING, LICENSOR DOES NOT WARRANT THAT USE OF THE SOFTWARE WILL RESULT IN COMPLIANCE WITH, OR A FAVORABLE ASSESSMENT, AUTHORIZATION, OR ACCREDITATION UNDER, ANY STANDARD, FRAMEWORK, OR REGULATORY REQUIREMENT, INCLUDING THE RISK MANAGEMENT FRAMEWORK, NIST SP 800-53, DISA SECURITY TECHNICAL IMPLEMENTATION GUIDES, OR ANY eMASS OR AUTHORIZING-OFFICIAL REQUIREMENT. THE SOFTWARE IS A TOOL AND IS NOT A SUBSTITUTE FOR THE INDEPENDENT PROFESSIONAL JUDGMENT OF QUALIFIED SECURITY PERSONNEL. ALL OUTPUT MUST BE INDEPENDENTLY REVIEWED AND VALIDATED BEFORE RELIANCE. THE ENTIRE RISK ARISING OUT OF USE OR PERFORMANCE OF THE SOFTWARE REMAINS WITH YOU.

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES, SO SOME OF THE ABOVE EXCLUSIONS MAY NOT APPLY TO YOU.

16. Limitation of Liability

16.1 Exclusion of indirect damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL LICENSOR OR ITS MEMBERS, OFFICERS, EMPLOYEES, CONTRACTORS, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL, DATA, OR ANTICIPATED SAVINGS, OR FOR ANY COST OF SUBSTITUTE PRODUCTS OR SERVICES, ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE SOFTWARE, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

16.2 Cap. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, LICENSOR’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE SOFTWARE, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, WILL NOT EXCEED THE GREATER OF (A) THE FEES ACTUALLY PAID BY YOU TO LICENSOR FOR THE SOFTWARE IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS (US$100).

16.3 Exceptions. Nothing in this Agreement limits liability for fraud, fraudulent misrepresentation, or any other liability that cannot be limited or excluded under applicable law. Some jurisdictions do not allow the limitation or exclusion of liability for certain damages, so some of the above may not apply to you.

16.4 Allocation of risk. You acknowledge that the fees reflect the allocation of risk in this Agreement and that Licensor would not provide the Software on these terms without these limitations, which are an essential basis of the bargain.

17. Term, Termination, and Effect

17.1 Term. This Agreement is effective on your acceptance and continues until the applicable license term expires or this Agreement is terminated.

17.2 Termination. You may terminate at any time by ceasing all use of the Software and providing written notice to us. We may terminate this Agreement or suspend the license if you materially breach it and fail to cure the breach within thirty (30) days after written notice, or immediately for a breach of Section 3 (Restrictions) or Section 12 (Export Control) that is not curable.

17.3 Effect. On termination, all licenses granted end, and you must stop using the Software, uninstall and delete all copies, and, on request, certify in writing that you have done so. Termination does not entitle you to a refund except as expressly stated in Section 5.5 or where we terminate without cause. Your Data stored locally on your systems is unaffected and remains yours.

17.4 Survival. Sections 3, 4, 5 (as to accrued fees), 8.1, 9, 10, 11, 12, 14, 15, 16, 17.3, 17.4, and 18 survive termination.

18. Governing Law, Forum, and General Terms

18.1 Governing law. This Agreement and any dispute arising out of or relating to it or the Software are governed by the laws of the State of North Carolina, without regard to its conflict of laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

18.2 Exclusive forum. The state and federal courts located in Buncombe County, North Carolina have exclusive jurisdiction and venue over any dispute arising out of or relating to this Agreement, and each party consents to personal jurisdiction there and waives any objection based on inconvenient forum.

18.3 Injunctive relief. Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property rights, without posting bond.

18.4 Limitations period. Except for claims for non-payment or infringement, no action arising out of this Agreement may be brought more than one (1) year after the cause of action accrues.

18.5 Assignment. You may not assign or transfer this Agreement or the license, in whole or in part, by operation of law or otherwise, without our prior written consent, except to a successor to all or substantially all of your business or assets that is not a competitor of Licensor and that agrees in writing to be bound by this Agreement. We may assign this Agreement freely. Any attempted assignment in violation of this Section is void.

18.6 Entire agreement. This Agreement, together with your order and any documents expressly incorporated by reference, is the entire agreement between the parties regarding the Software and supersedes all prior or contemporaneous proposals, communications, and agreements. Any conflicting or additional terms in your purchase order or vendor portal are rejected and have no effect unless signed by an authorized representative of Licensor.

18.7 Amendment and waiver. Except as provided in Section 1, this Agreement may be amended only in a writing signed by both parties. No failure or delay in exercising a right waives it, and no waiver of one breach waives any other.

18.8 Severability. If any provision is held unenforceable, it will be modified to the minimum extent necessary to make it enforceable, or if that is not possible, severed, and the remaining provisions remain in full force.

18.9 Independent contractors. The parties are independent contractors. This Agreement creates no partnership, joint venture, agency, or employment relationship.

18.10 Force majeure. Neither party is liable for any delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control.

18.11 Third-party beneficiaries. There are no third-party beneficiaries to this Agreement.

18.12 Notices. Notices to Licensor must be in writing and sent to the address below, with a copy by email, and are effective on receipt. Notices to you may be sent to the email or postal address associated with your account or order.

18.13 Headings. Headings are for convenience only and do not affect interpretation.

19. Contact

STIG Solution LLC
27 Applegate Ln
Asheville, NC 28803
mail@stigsolution.com