Master Subscription Agreement (MSA)
Version: 1.0
Last updated: 30/10/2026
This is the then-current standard Master Subscription Agreement ("MSA") for the Nulink products. It is published for reference. The MSA that applies to a Client is the version that Client accepted, together with its Order Form.
This MSA is entered into by and between:
Nulink Security OOD ("Nulink"), a company registered in Bulgaria, registration number 208781115, with its headquarters at Bul. Svoboda 79, floor 4, Plovdiv 4001, Bulgaria, represented by its CEO, with full capacity to enter into this Agreement and duly authorized for the purpose thereof;
and
the company identified as the Client in the applicable Order Form (the "Client"), represented by its authorized signatory, with full capacity to enter into this Agreement and duly authorized for the purpose thereof;
referred to individually as "Party" and collectively as "Parties".
- Service Level Agreement — availability targets, support hours and response times
- Data Processing Agreement — processing of personal data
- Acceptable Use Policy — also reproduced as Section 7 below
- Privacy Policy
1. Purpose of the Agreement
1.1. This MSA governs the Client's access to and use of, and sets forth the Terms and Conditions for using, Nulink Products and Services.
1.2. This MSA governs the procurement of the Products and Services by the Client, including all Order Forms for Nulink Product subscriptions. The Client's own purchase orders or general terms do not apply, even if Nulink does not object to them.
1.3. In case of conflict between this MSA and an Order Form, the terms and conditions set in the Order Form prevail.
2. Definitions
2.1. "Product" means the Nulink Exposure Management or Nulink Cloud online information system and any related software, user interfaces, APIs, documentation and upgrades.
2.2. "Services" means any service that Nulink may, upon mutual agreement, deliver to the Client with or without connection to the Product, including but not limited to professional services, consulting, user training, Product troubleshooting, support and feedback gathering.
2.3. "Subscription Term" means the initial term and each renewal term, for which the Client has purchased, and Nulink has agreed to procure the Product.
2.4. "Subscription Plan" means a defined package of Product access levels, features and limits that the Client receives in exchange for the plan fees.
2.5. "Order Form" means the document or online form that identifies the Client, the Subscription Plan and Term, the fees and the billing cycle.
2.6. "Authorized Users" means the Client's employees, contractors and agents who are legally authorized and permitted by the Client to use the Product.
2.7. "Client Content" means all data and content that the Client or its Authorized Users enter or store in the Product, including any personal data.
2.8. "Documentation" means the then-current user guides, technical descriptions, flows, diagrams, videos and other documented information about the Product.
2.9. "Confidential Information" means any information, intellectual property, trade secrets or know-how, provided or disclosed by the "Disclosing Party" to the "Receiving Party" in any form whatsoever, whether orally or in writing, electronically or physically, (a) which is marked as "confidential", or (b) whose confidential nature has been made known by the Disclosing Party, or (c) which, due to its character, nature, or method of transmittal, a person with reasonable judgment, under like circumstances, would treat as confidential.
2.10. "Partner Agreement" means any Partner Agreement between Nulink and the Client.
3. Product and Licenses
3.1. The Product Nulink Exposure Management consists of a web-based application that maps the Client's external cybersecurity attack surface, continuously scans for exposures, vulnerabilities and threats, and provides related insights, alerts and analytics.
3.2. Subject to ongoing compliance with the MSA and Payment Terms, Nulink grants the Client a non-exclusive, non-transferable license for the Subscription Term to access and use the Product selected in the Order Form solely for legitimate business purposes and within the limits stated in the Order Form. Any resale, distribution or white-label use of the Product is permitted solely as authorized under, and subject to, a Partner Agreement. Access to the Product is limited to Authorized Users. Accounts must not be shared among multiple users.
4. Intellectual Property
4.1. Nulink retains full ownership, rights and titles to the Product, including any modifications, updates, customizations and add-ons, with the right to use and exploit them in any way and without limitation. No rights are granted to the Client except those expressly stated.
4.2. The Client retains full ownership of its Client Content and grants Nulink a limited, non-exclusive, non-transferable license to host, process, copy and transmit Client Content data solely for the purposes of providing the Product and related Services to the Client.
4.3. The Client grants Nulink a perpetual, irrevocable, royalty-free license to use any feedback about the Product and feature suggestions, without obligation to the Client.
5. Nulink Obligations
5.1. Nulink will engineer and build the Product with reasonable skill and care, in line with the industry standards and best practices.
5.2. Nulink will provide the Client with the features and benefits of the Product, depending on the selected Subscription Plan.
5.3. Nulink will enable the Client to create user accounts and establish access to the Product for its Authorized Users.
5.4. Nulink will ensure the ongoing availability and resilience of the Product, and apply appropriate technical and physical measures to safeguard the Client Content.
5.5. Nulink will comply with applicable privacy and personal data protection laws, as related to the storage and processing of personal data.
5.6. Nulink may update, improve or modify the Product from time to time. All changes must be applied through release and version control.
5.7. Nulink will provide technical support and issue resolution according to the Service Level Agreement and the selected Subscription Plan.
6. Client Obligations
6.1. The Client is responsible for all activity under its accounts and for its Authorized Users' compliance with this MSA.
6.2. The Client will keep login credentials confidential, use reasonable security measures such as strong passwords and 2-factor authentication, and notify Nulink without undue delay of any suspected unauthorized access.
6.3. The Client will have full control over the usage of the Product and will be responsible for the integrity and completeness of its Client Content.
6.4. The Client will comply with the Acceptable Use Policy (AUP).
7. Acceptable Use Policy (AUP)
The Client agrees to use the Product solely for its intended purpose and in compliance with all applicable laws and regulations. The Client further agrees not to engage in any unlawful, harmful, deceptive, or unauthorized activity in connection with, or directed at, the Product.
The Client agrees not to:
7.1. Redistribute, sell, sub-license or lease the Product to any third party, unless the Client has entered into a separate Partner Agreement with Nulink that authorizes such resale or white-label distribution, in which case such activity is permitted solely within the scope of, and subject to, that Partner Agreement.
7.2. Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Product.
7.3. Attempt to gain unauthorized access to, interfere with, damage, or disrupt the Product, its servers, systems or networks.
7.4. Circumvent, disable, or interfere with security features, authentication mechanisms or access controls of the Product or any related systems.
7.5. Upload, distribute, or transmit malware, spyware or other harmful or malicious code, including any code designed to disrupt, damage or gain unauthorized access.
7.6. Engage in any activity that could harm or exploit users, including phishing, social engineering or other fraudulent practices.
7.7. Collect, access, use or share sensitive personal data without proper authorization and lawful basis, or in violation of applicable data protection laws.
7.8. Use the Product to engage in deceptive, misleading or abusive behavior, including impersonation or misrepresentation of affiliation.
7.9. Use the Product to send spam, unsolicited communications or promotional content in violation of applicable laws.
7.10. Access or attempt to access accounts, systems or data belonging to others without authorization.
8. Fees and Payment
8.1. Fees. The Client will pay the subscription fees according to the terms and by the due dates stated in the Order Form or the invoice. The fees will include VAT / sales tax where applicable, and will be exclusive of any other taxes that may be charged by the Client's country of domicile or operation, which the Client will pay according to the local legislation.
8.2. Billing and payment. Subscription fees are billed (i) monthly in advance of the usage period for annual and monthly Subscription Plans and/or (ii) based on the incurred actual usage during the previous month for pay-as-you-go Subscription Plans. All invoices will be delivered electronically, using the contact information provided by the Client. Payments are due within 14 days of the invoice date, by bank transfer, card or direct debit, as agreed between Nulink and the Client. Payments must include a reference to the invoice number issued by Nulink.
8.3. Late payment or failure to pay. If an invoice amount becomes overdue, Nulink will send an electronic reminder notice to the specified Client contact(s). If the Client does not pay the due amount within 10 days after the reminder notice date, Nulink may charge statutory late-payment interest and suspend access to the Product until the overdue amount, including applicable interest, is paid in full.
8.4. Disputed invoices. The Client must notify Nulink of any invoice errors, incorrectly billed amounts or any other good-faith dispute before the invoice due date. The Parties will work to resolve the dispute promptly, and Nulink will issue a corrected invoice, if applicable. The Client must not deduct any amounts from the original invoice.
8.5. Price changes. Nulink may change the fees for a renewal Subscription Term by giving at least 60 days' written notice before the Subscription Term renewal date for annual plans, and 30 days' written notice for monthly and pay-as-you-go plans. If the Client does not accept the change, the Client may cancel the subscription before renewal.
8.6. No refunds. Fees are non-refundable. Prepaid periods are not refunded on cancellation.
8.7. Spending cap (pay-as-you-go plans).
A pay-as-you-go Subscription Plan has a maximum monthly fee stated in the Order Form (the "Spending Cap"). Usage-based fees will not exceed the Spending Cap in any calendar month.
When usage-based fees reach the Spending Cap, Nulink will stop scanning and monitoring the Client's assets and will not collect new data until the Spending Cap is increased or the next calendar month begins.
For 30 days after scanning stops, the Client's existing Client Content remains visible in the Product in read-only mode. If the Spending Cap has not been increased by the end of that period, Nulink will delete all Client Content collected by scanning from its active systems. Deleted Client Content cannot be restored.
The Client may increase the Spending Cap at any time through its account settings. Scanning resumes promptly after the increase takes effect, and the increased cap applies from the calendar month in which it is increased.
Stopping scanning under this Section is not a suspension under Section 9.5 or a breach of this MSA. Nulink is not responsible for exposures that arise or go undetected while scanning is stopped (see Section 12.4). Fees accrued up to the Spending Cap remain payable.
9. Term, Renewal and Termination
9.1. MSA Term. This MSA applies and is effective from the Subscription Start Date of the first Order Form, and continues until all Order Forms have expired or been terminated.
9.2. Subscription Term. The Subscription Term is set during the sign-up process and is specified in the applicable Order Form.
9.3. Automatic renewal. Unless the Order Form states otherwise, each Subscription Term renews automatically for successive periods equal to the initial term, unless either Party gives notice of non-renewal or the Client cancels the subscription through the Product account settings at least 15 days before the end of the current Subscription Term.
9.4. Termination for cause. Either Party may terminate this MSA or an Order Form by written notice if the other Party (a) has materially breached it and fails to remedy the breach within 30 days of written notice describing the nature and basis of the breach, or (b) becomes bankrupt or insolvent, enters liquidation or ceases its business operations.
9.5. Suspension. Nulink may suspend access immediately and without liability if the Client's use poses a security risk to the Product or other clients, or violates applicable law or the Acceptable Use Policy. Nulink may restore access once the issue is resolved.
9.6. Effect of termination or expiration. On expiry or termination: (a) the Client's license to use the Product is terminated and all use of the Product must immediately cease; (b) the Client remains liable for the fees accrued before termination; (c) if the agreement is terminated for Nulink's unremedied material breach, Nulink will refund to the Client any prepaid but unused fees for the period after termination.
9.7. Data return and deletion. For 30 days after termination, the Client may retrieve or receive a copy of its Client Content upon request. Nulink will delete Client Content from its active systems within 90 days after termination, unless the applicable data protection law stipulates a different retention period.
9.8. Survival. The termination or expiration of this MSA will not affect any provisions which, by their nature, survive termination or expiration: 2. Definitions, 4. Intellectual Property, 9.6 Effect of termination or expiration, 9.7 Data return and deletion, 11. Confidentiality, 12. Warranties and Disclaimers, 14. Limitation of Liability, 15. General Provisions, and any data protection, confidentiality and outstanding payment obligations.
10. Data Protection and Security
10.1. Nulink processes personal data as an independent controller in accordance with its Privacy Policy: https://docs.nulinksec.com/docs/legal/privacy.
Where an Order Form applies the Data Processing Agreement, Nulink acts as processor in respect of Client Content containing personal data, and as independent controller only for the data it processes for its own purposes. See Section 1 of the DPA. Per Section 1.3 above, the Order Form prevails.
10.2. Nulink will maintain appropriate technical and organizational measures designed to protect Client Content against unauthorized access, loss, alteration or corruption.
10.3. Nulink will notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a confirmed data breach affecting the Client Content.
10.4. For EU clients, any data transfer outside European Economic Area (EEA) will comply with GDPR.
11. Confidentiality
11.1. Each Party will maintain the other Party's Confidential Information in complete and strictest confidence, and will take reasonable security measures at least as great as the measures it takes to protect its own Confidential Information, and in any event, no less than reasonable care.
11.2. The Parties will: (a) use the Confidential Information exclusively for the purpose of this Agreement, (b) take all reasonable precautions to protect the Confidential Information from unauthorized disclosure, (c) grant access to only those of its Representatives who need to know such information for the purpose of this Agreement, (d) not copy, alter, modify, disassemble, reverse engineer or decompile the Confidential Information or any part thereof.
11.3. Neither Party will disclose, transfer or otherwise make available any of such Confidential Information to any third party, unless the Receiving Party has, prior to any such disclosure, obtained written consent to do so from the Disclosing Party.
11.4. The Receiving Party may disclose Confidential Information to state authorities if legally required, in cases including but not limited to court orders, regulatory obligations or enforced sanctions.
12. Warranties and Disclaimers
12.1. Mutual warranties. Each Party warrants that it has the legal authority to enter into this Agreement and will comply with applicable law in performing it.
12.2. Nulink warranty. Nulink warrants that (a) the Product will perform materially in accordance with the specifications and Documentation, (b) the functionality and capabilities of the Product will not be materially decreased during the Subscription Term. If the Product does not perform as stated, the Client's exclusive remedy is for Nulink to correct the non-conformity, or, if it cannot do so within a reasonable time, for the Client to terminate the affected Order Form and receive a pro-rata refund of the prepaid fees.
12.3. Product disclaimer. To the maximum extent permitted by law, the Product is provided "as is". Nulink will apply reasonable effort to provide the Product with minimal errors and interruptions. Except for the warranties expressly stated herein, Nulink disclaims all other warranties, including implied warranties of merchantability, fitness for a particular purpose and non-infringement. Nulink does not warrant that the Product and related service will be uninterrupted or error-free, or that it will meet the Client's specific requirements.
12.4. Professional disclaimer. The Product is a tool and does not constitute legal, information security or other professional advice. It does not guarantee that all possible known and unknown exposures and vulnerabilities will be identified, and that successful outcomes or resolutions will be achieved when malicious agents have already taken action as a result of the exposure, or when adequate and timely actions or responses are required by the Client's employees, contractors, agents or providers.
13. Indemnity
13.1. To the extent permitted by law, the Client's exclusive remedy arising out of or in connection with a breach of warranty is limited to (a) the correction or replacement of the non-conforming Product or re-performance of the non-conforming Service, or (b) agreement termination, as applicable.
13.2. Nulink will protect the Client against third-party claims alleging that the Product, as provided by Nulink, infringes that third party's trademarks, copyrights or intellectual property rights, and will pay damages and costs finally awarded or agreed in settlement. If such a claim arises or is likely, Nulink may procure the right to use the third party's claimed intellectual property, modify the Product to be non-infringing, or terminate the affected Order Form and refund prepaid fees for the remaining term. Nulink has no obligation to the extent the claim arises from Client Content, modifications not made by Nulink, combination with other products, or Product use in breach of this MSA.
13.3. The Client will protect Nulink against third-party claims arising from (a) Client Content, including its collection and use in the Product without proper legal basis, or (b) the Client's breach of the Acceptable Use Policy, and will pay damages and costs finally awarded or agreed in settlement.
13.4. In case of any claim by a third party, each Party to this MSA agrees to provide prompt written notice to the Party which is affected and reasonably expected to defend against the claim, and provide reasonable cooperation at the defending Party's expense.
14. Limitation of Liability
14.1. Exclusion of indirect loss. To the maximum extent permitted by law, neither Party is liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, business, goodwill or anticipated savings, however arising.
14.2. Liability cap. Each Party's total aggregate liability arising out of or relating to this MSA in any 12-month period is limited to the fees paid or payable by the Client under the relevant Order Form in the 12 months preceding the event giving rise to the claim. This cap does not apply to liability for intent or gross negligence, death or personal injury, fraud, and breach of confidentiality obligations.
14.3. The Parties agree that these limitations reflect a reasonable allocation of risk and are reflected in the fees.
15. General Provisions
15.1. Relationship between the Parties. The Parties will act as independent contractors. This MSA does not create a partnership, franchise, agency or joint venture relationship between the Parties.
15.2. Governing law. This Agreement and any non-contractual obligations arising from it are governed by the laws of the Republic of Bulgaria, excluding its conflict-of-laws rules and the UN Convention on Contracts for the International Sale of Goods.
15.3. Dispute resolution. The Parties will first try to resolve any dispute through good-faith negotiation for 60 days. Failing that, disputes will be submitted to the exclusive jurisdiction of the competent courts of Bulgaria.
15.4. Force majeure. Neither Party is liable for failure or delay in performance, other than payment obligations, caused by events beyond its reasonable control, including natural disasters, war, terrorism, strikes, utility or internet outages not caused by or related to the actions of the affected Party, government action, or failures of third-party cloud hosting providers. If the event continues for more than 30 days, either Party may terminate the affected Order Form.
15.5. Assignment. Neither Party may assign this MSA without the other Party's prior written consent, except that either Party may assign it to an affiliate or a successor in a merger, acquisition or sale of substantially all of its assets, upon written notice.
15.6. Subcontractors. Nulink may use subcontractors and sub-processors. In case a decision to use a subcontractor or sub-processor is made, Nulink will notify the Client in advance and will assume responsibility for their performance. Sub-processors of personal data are governed by the Data Processing Agreement.
15.7. Notices. Notices must be in writing and sent by email to the addresses in the Order Form, or via the Product for operational notices.
15.8. Changes to this MSA. Nulink may update this MSA for current or future Subscription Terms. Updates will be delivered to the Client for acknowledgement and acceptance. If the Client disagrees with the MSA changes, the Client may choose to (a) not accept the change for the current Subscription Term and keep using the Product until its expiration, (b) terminate or non-renew the affected Order Form and receive a pro-rata refund of the prepaid fees. The Client must accept the MSA change to continue using the Product into a future Subscription Term.
15.9. Export and sanctions compliance. Each Party will comply with applicable sanctions and export control laws. The Client represents that it is not subject to sanctions and will not use the Product in violation of them.
15.10. Anti-bribery. Each Party will comply with applicable anti-corruption and anti-bribery laws.
15.11. Entire agreement. This MSA, with the Order Forms and documents incorporated into it, is the entire agreement between the Parties on its subject and supersedes all earlier discussions and understandings.
15.12. Severability. If any provision of this MSA is held by competent jurisdiction to be invalid or unenforceable, the remaining provisions will remain in full force and effect. Failure to enforce a right is not a waiver.
16. Acceptance and Signatures
By signing an Order Form, or by accepting this Master Subscription Agreement electronically, each Party confirms that it has read, understands and agrees to this MSA, and that the person signing is authorized to represent and bind the Party.
Nulink Security OOD
Bul. Svoboda 79, floor 4, Plovdiv 4001, Bulgaria
Registration number: 208781115 · VAT ID: BG208781115
Notices and contract enquiries: legal@nulinksec.com
Contact
| Purpose | Contact |
|---|---|
| Contracts and notices | legal@nulinksec.com |
| Data protection | privacy@nulinksec.com |
| Support | support@nulinksec.com |
| General enquiries | info@nulinksec.com |