KEY TERMS AT A GLANCE
Convenience summary only; the clauses below govern if there is any conflict.
- What this covers: the standard legal terms for using the PENOPS AI penetration-testing and security-operations platform. Commercial details (prices, scope, SLAs) live in the Main Agreement.
- Your core promises: only test systems you own or are authorized to test (including active exploitation); supply valid, authorized credentials; decide approval requests promptly; use the Services lawfully.
- Our core promises: perform professionally, protect your data (GDPR/CCPA aligned, breach notice within 72 hrs), and keep your data in your chosen region.
- Money: metered in Credits (1 = USD 1.00); fees non-refundable except as stated; liability capped at the prior 12 months' fees/Credits.
- Ending it: 12-month term, auto-renewing; 60 days' notice to stop; either side may exit for uncured material breach.
1. DEFINITIONS
- Acceptable Use Policy - clause 4.
- Assets - the applications, domains, subdomains, IPs, cloud accounts and resources, LLM endpoints, source repositories, container images, services, and infrastructure Customer provides or authorizes for testing.
- Confidential Information - clause 8.1.
- Credits - the unit of consumption, where 1 Credit = USD 1.00 for pricing; funds the subscription and on-demand scans (clause 5).
- Customer Data - all data provided by Customer or collected by PENOPS through the Services, including Asset information, results, vulnerabilities, and Findings.
- DPA - the Data Processing Agreement under clause 9.4.
- Engagement - a discrete unit of testing configured by Customer (Web App, Cloud, LLM, or Secrets), defining what is tested and how deeply.
- Finding - a vulnerability, misconfiguration, exposure, or risk identified by the Services.
- Force Majeure Event - clause 13.
- Guardrails - Customer-configured constraints on what agents will not do without approval.
- Integrations - the central layer through which Customer supplies credentials referenced by Engagements.
- Platform - the PENOPS AI-driven penetration-testing and security-operations platform (software, AI agents and models, tools, infrastructure, services).
- Scan Policy - the testing configuration, schedule, depth, and scope Customer defines.
- Services - the services described in clause 2.2 and the Main Agreement.
- Subscription Fee / Subscription Period - the fees payable, and the term, as set out in the Main Agreement (Subscription Period per clause 12.1).
- User - a person Customer authorizes to access the Services.
- Wallet - Customer's prepaid Credit balance funding on-demand scans.
- Affiliate - an entity controlling, controlled by, or under common control (>50%) with a Party. Business Day - any day other than Saturday, Sunday, or a public holiday in [jurisdiction]. Personal Data - as defined in applicable data-protection law. Including - "including without limitation". Writing/Written - includes email and other durable electronic records.
2. THE SERVICES
2.1 These Standard Terms govern Customer's access to and use of the Platform.
2.2 Description. The Services provide credit-based access to the Platform, including: autonomous AI testing (a swarm of agents running reconnaissance, vulnerability discovery, controlled exploitation, and attack chains in parallel); human-in-the-loop oversight (approval gating plus Guardrails); the Engagement types Web App, Cloud (AWS/Azure/GCP), LLM and Agentic-AI red-teaming (OWASP LLM, OWASP Agentic, NIST AI RMF, MITRE ATLAS), and Secrets (GitHub/GitLab/S3/GCS/Docker); attack-surface and threat intelligence (incl. dark-web monitoring where subscribed); a findings-and-remediation workflow (Mitigate/Transfer/Avoid/Accept, risk register, SLA policy, audit log); dashboards and reporting; Integrations, a REST API, and webhooks; and configurable alerting. Features, Engagement counts, in-scope Assets, depth, cadence, support level, retention, and API limits vary by configuration and plan as set in the Main Agreement.
2.3 Users. Users are not a metered charge; the Services are metered in Credits based on testing consumption. Customer assigns role-based access and API tokens.
2.4 Credentials. User accounts are single-person and may be reassigned but not shared. Customer keeps credentials confidential and is responsible for all activity under its accounts.
2.5 Third-party users. Accounts may be assigned to Customer's employees or to third parties (consultants, MSSPs, outsourcers), provided the Services are used solely for Customer's benefit, Customer remains responsible for their compliance, and they are bound by confidentiality.
2.6 Scope. The number/scope of Assets and Engagements is defined in the Main Agreement and drives credit cost. Customer may change scope at any time; changes re-price the subscription (clause 5) and may increase consumption.
2.7 Availability. PENOPS will use commercially reasonable efforts to keep the Services available 24/7, subject to planned maintenance (48 hrs' notice, except emergencies) and Force Majeure.
2.8 Updates. PENOPS may update the Services (including AI agents and models); it will avoid materially impairing core functionality and give at least 14 days' notice of major changes where practicable.
2.9 Beta features. Beta/preview features are provided "as-is" for evaluation, without warranty, and are excluded from SLAs unless agreed in writing.
3. CUSTOMER RESPONSIBILITIES
3.1 Cooperation. Customer provides the access and information PENOPS reasonably needs, including ownership/authorization evidence, domain verification (web app), Engagement scope and depth, authorized credentials via Integrations, designated approvers, and timely responses.
3.2 Ownership and authorization (active testing). Customer represents it owns or has obtained all rights to conduct active security testing and controlled exploitation of every Asset it submits, and acknowledges the Services go beyond passive scanning (controlled exploitation, exploit chaining, authenticated access). Customer indemnifies PENOPS against claims arising from testing assets Customer did not own or was not authorized to test.
3.3 User management. Customer authenticates its Users, ensures their compliance with these terms and the AUP, promptly removes access no longer needed, and maintains appropriate internal access policies.
3.4 Unauthorized access. Customer takes reasonable steps to prevent unauthorized use and notifies PENOPS within 24 hours of any unauthorized access, breach, or credential compromise.
3.5 Testing environment. Customer acknowledges active testing can generate traffic, change data/system state during controlled exploitation, and trigger security controls. Customer is responsible for setting suitable schedules, depth, Scan Policies, and Guardrails; deciding approval requests promptly; whitelisting scanner IPs where external scanning is used; supplying valid, appropriately scoped credentials; notifying internal teams; and testing in non-production where practical.
3.6 Scope management. Customer keeps scope accurate and promptly tells PENOPS what to add or remove, and immediately flags anything that must not be tested (third-party, out-of-scope, decommissioned).
3.7 Remediation. PENOPS identifies, tests, and reports Findings and provides a remediation-tracking workflow, but does not itself remediate unless separately contracted. Prioritizing and fixing Findings is Customer's responsibility.
4. ACCEPTABLE USE POLICY
4.1 Restrictions. Customer will use the Services only lawfully and per these terms, the Main Agreement, and applicable law. Except where the law forbids these limits, Customer will not: (i) let non-authorized third parties access the Services; (ii) copy, mirror, scrape, or create derivative works other than for its own internal use; (iii) reverse engineer or attempt to extract source code, models, or algorithms; (iv) use the Services to build a competing product; (v) resell, sublicense, or otherwise commercially exploit the Services; (vi) test or exploit Assets it does not own or is not authorized to test; (vii) test Assets in embargoed countries or contrary to export controls; (viii) circumvent security, access controls, approval gating, Guardrails, or usage limits; (ix) impair PENOPS's infrastructure; (x) transmit malicious code; or (xi) infringe third-party rights.
4.2 Testing authorization. Customer will only test (and, where applicable, actively exploit) Assets it owns or is expressly authorized in writing to test, keeps documentation of that authorization, and provides it on request.
4.3 Prohibited targets. Without appropriate authorization, Customer will not use the Services against government/military systems, critical infrastructure, third-party systems, sanctioned/embargoed systems, or any system where testing is unlawful.
4.4 Responsible testing. Customer configures rate limits, throttling, and Guardrails to avoid harming target systems, and accepts that active/aggressive testing may cause disruption.
4.5 Data use. Customer uses Customer Data only to improve its own security; it will not sell or transfer vulnerability data, weaponize Findings against third-party systems, disclose vulnerabilities before affected parties can remediate (save legal/responsible-disclosure duties), or support offensive operations against non-owned assets.
4.6 Laws. Customer complies with applicable security-testing, data-protection, and computer-misuse laws (e.g., CFAA, GDPR, UK Computer Misuse Act, and equivalents).
4.7 Violations. PENOPS may investigate suspected AUP violations; Customer promptly reports any misuse.
5. FEES AND PAYMENT
5.1 Fees and Credits. Customer pays the Subscription Fee in the Main Agreement. The Services are metered in Credits (1 = USD 1.00): a subscription funds scheduled runs and platform access (billed monthly or annually; annual = monthly × 12 less the stated discount), and on-demand scans draw from the prepaid Wallet. Fees are in the agreed currency, exclusive of taxes (which Customer pays except taxes on PENOPS's net income). Paid fees and consumed Credits are non-refundable except as these terms state.
5.2 Annual adjustment. At each renewal PENOPS may increase fees and the rate card by the greater of CPI/HICP over the prior 12 months or 5%, on 90 days' written notice.
5.3 Other changes. For new/modified tiers, features, or scope, PENOPS may change fees on 60 days' notice, effective the next Subscription Period; continued use constitutes acceptance.
5.4 Payment. Net 30 days unless otherwise agreed; subscription billed monthly or annually in advance and top-ups in advance; via wire/ACH, card (processing fees may apply), or PO (enterprise only).
5.5 Late payment. Overdue amounts accrue interest at 1.5%/month (or the legal maximum), plus reasonable collection costs; PENOPS may suspend or terminate for non-payment per clause 6.
5.6 No set-off. Customer pays in full without set-off or deduction (except as required by law, grossed up).
5.7 Consumption and overages. Scheduled testing is funded by the subscription; on-demand scans by the Wallet (and will not start if the Wallet is short). If Customer's configuration increases scheduled consumption beyond the subscribed amount, PENOPS may adjust the subscription or charge the extra per the rate card. Purchased and promotional Credits may expire as stated at purchase/grant.
5.8 Free trial. PENOPS may offer trials or trial Credits with limited features/usage. Unless Customer cancels in writing before expiry, PENOPS may convert the trial to a paid subscription. Trials are "as-is" without warranty, and Customer indemnifies PENOPS without limit for damages from its trial use.
5.9 Payment information. Customer keeps payment, billing, and tax details current and provides valid exemption certificates where applicable; PENOPS may suspend if payment details are invalid.
6. SUSPENSION AND TERMINATION OF SERVICE
6.1 For breach. PENOPS may suspend access immediately if Customer materially breaches the AUP, uses the Services unlawfully, tests unauthorized third-party Assets, poses a security risk to PENOPS or others, or where required by legal order.
6.2 For non-payment. PENOPS may suspend on 72 hours' notice for overdue amounts (immediately if fraud is suspected); Services resume on payment of arrears plus late fees.
6.3 Effects. During suspension Customer loses access, fees keep accruing, SLAs pause, data is retained per policy, and all other terms continue.
6.4 Reinstatement. PENOPS reinstates once any breach is cured, arrears are paid, adequate assurances are given, and reinstatement is lawful; it may require additional conditions.
7. INTELLECTUAL PROPERTY
7.1 PENOPS IP. All Services content and materials (software, code, AI models and agent logic, interfaces, algorithms, methodologies, templates, documentation) are PENOPS's or its licensors' IP, protected by law.
7.2 License. Customer receives only a limited, non-exclusive, non-transferable, revocable right to use the Services during the Subscription Period, subject to these terms. No trademark or other rights are granted except as stated.
7.3 Third-party rights. PENOPS's rights are subject to any third-party IP in the Services, and PENOPS represents it holds the licenses needed to provide the Services.
7.4 IP indemnity. If a third party claims the Services infringe its IP, Customer notifies PENOPS within 10 business days, and PENOPS will (at its option) obtain continued-use rights, modify the Services, or terminate the affected Services and refund prepaid fees pro-rata. PENOPS controls the defense; Customer cooperates.
7.5 Indemnity exclusions. The clause 7.4 indemnity excludes claims from Customer's modification or non-PENOPS combinations, continued use after an infringement notice, or use in breach of these terms.
7.6 Customer Data. Customer owns Customer Data and grants PENOPS a limited license to use it to provide and improve the Services and meet legal obligations; the license ends on termination, subject to retention duties.
7.7 Feedback. PENOPS may use Customer Feedback without restriction or compensation; Customer assigns all rights in Feedback to PENOPS.
8. CONFIDENTIALITY
8.1 Definition. "Confidential Information" is information disclosed by a Party that is marked confidential, confidential by law, or reasonably understood as confidential, including these terms, the Main Agreement, Customer Data, business/financial/technical information, roadmaps, and security practices. It excludes information that is public (without breach), already known, received from a third party without breach, or independently developed.
8.2 Obligations. Each Party protects the other's Confidential Information with at least reasonable care, discloses it only to those with a need to know who are bound by comparable confidentiality, uses it only to perform or receive the Services, and returns or destroys it on request or termination.
8.3 Compelled disclosure. If legally compelled to disclose, the Party gives prior notice where permitted, cooperates with protective efforts, and discloses only what is required.
8.4 Duration. Confidentiality survives for 5 years after termination; trade secrets remain protected for as long as they qualify as such.
9. PRIVACY AND DATA PROTECTION
9.1 Roles. Each Party complies with applicable data-protection law (GDPR, UK GDPR, CCPA, and equivalents). For personal data the Parties exchange to administer the relationship, each acts as an independent controller.
9.2 Processing. Where PENOPS processes personal data on Customer's behalf, PENOPS is processor/service provider and Customer is controller/business; testing may incidentally capture personal data.
9.3 Limits. PENOPS accesses personal data only as needed to provide the Services and will not sell or share it, process it for other purposes, or combine it with other personal data.
9.4 DPA. Where PENOPS processes personal data for Customer, the Parties execute a DPA (incorporating SCCs or equivalent transfer mechanisms), which forms part of these terms.
9.5 Security measures. PENOPS maintains appropriate technical and organizational measures for Customer Data and credentials, consistent with current industry standards (incl. SOC 2 Type II or equivalent, where held), the data's sensitivity, and the risk: encryption in transit and at rest, access controls, network segmentation, monitoring and incident response, regular testing/audits, and staff training.
9.6 Breach notice. PENOPS notifies Customer without undue delay and no later than 72 hours after becoming aware of a confirmed or suspected breach of Customer Data, describing the breach, affected data, likely consequences, mitigation, and a contact; and cooperates with Customer's own notification duties.
9.7 Residency. Customer Data is stored/processed in the regions stated in the Main Agreement; PENOPS will not transfer it outside them without Customer's consent, except as required by law.
9.8 Subprocessors. PENOPS may use subprocessors (list at [URL]), with at least 30 days' notice of new ones; Customer may object on reasonable data-protection grounds, and the Parties will resolve in good faith or terminate the affected Services.
9.9 Data-subject requests. PENOPS promptly notifies Customer (where permitted) of data-subject requests and reasonably assists Customer in responding.
9.10 Retention and deletion. On termination, PENOPS makes Customer Data available for export for 30 days, deletes it within 60 days (certifying on request), and isolates any data it must retain by law until that period ends.
10. WARRANTIES AND DISCLAIMERS
10.1 PENOPS warranties. PENOPS warrants it has authority to contract, the Services do not infringe third-party IP, and it will deliver the Services materially per these terms and the Main Agreement, professionally and to industry standards (the "Service Warranty").
10.2 Warranty exclusions. The Service Warranty does not apply to issues caused by unauthorized use/modification, Customer's non-compliance, Customer's environment or supplied credentials, Customer's configuration of Engagements/depth/approvals/Guardrails, third-party acts, or Force Majeure.
10.3 Detection limits. PENOPS does not warrant it will detect all vulnerabilities. Testing is best-efforts and inherently limited by scope, depth, timing, attack sophistication, unknown zero-days, authentication and credential validity, and approvals/Guardrails/rate limits. AI-generated findings, exploit proposals, and attack-chain hypotheses may contain errors and are subject to Customer review.
10.4 Active-testing impact. Active testing may disturb Assets (traffic, resource use, changes to data/state during controlled exploitation, triggered controls). PENOPS recommends staging first, maintenance-window scheduling, and appropriate rate limits, approvals, and Guardrails. PENOPS disclaims liability for disruption, degradation, data/state changes, or availability impacts, except to the extent caused by its gross negligence or willful misconduct, or by acting outside the scope, approvals, and Guardrails Customer configured.
10.5 General disclaimer. Except as expressly stated, PENOPS disclaims all implied warranties to the maximum extent permitted by law, including merchantability, fitness for purpose, uninterrupted/error-free operation, satisfactory quality, and the accuracy or completeness of results.
10.6 Customer warranties. Customer warrants it has authority to contract; owns or is authorized to test and, where applicable, actively exploit all Assets; complies with applicable law; has obtained necessary personal-data consents; and that information and credentials it provides are accurate, valid, and authorized.
10.7 Exclusive remedy. For a Service Warranty breach notified within 30 days of discovery, Customer's sole remedy and PENOPS's entire liability is, at PENOPS's option, re-performance/repair or a pro-rated refund of fees for the deficient Services.
10.8 No other warranties. Except as expressly stated, each Party excludes all other warranties, whether express, implied, or statutory.
11. LIMITATION OF LIABILITY
11.1 No indirect damages. Neither Party is liable for indirect, special, incidental, consequential, or punitive damages, however arising, even if advised of the possibility.
11.2 Examples. Indirect damages include loss of data (except clause 11.7), goodwill, profit/revenue/savings, business interruption, substitute-service costs, third-party-claim losses, malware/cyberattack losses, and losses from disclosure of Confidential Information (except willful breach).
11.3 Testing-related. PENOPS is not liable for damages from production use; disruption, availability impacts, or data/state changes from active testing performed within the scope, approvals, and Guardrails Customer configured; false positives/negatives; Customer's reliance on results; exploitation of discovered vulnerabilities; or actions Customer or its approvers approved.
11.4 Security-incident. PENOPS is not liable for damages from being hacked, third-party unauthorized access, or vulnerabilities in third-party components, except where caused by its failure to implement the clause 9.5 security measures.
11.5 Cap. Each Party's aggregate liability (contract, tort, or otherwise, including indemnities) is capped at the total Subscription Fees and Credits Customer paid in the 12 months before the event giving rise to the claim.
11.6 Carve-outs. The clause 11.1/11.2/11.5 limits do not apply to willful misconduct or gross negligence; fraud; death or personal injury from negligence; IP violations; confidentiality breaches; Customer's indemnities under clauses 3.2 and 4.2; amounts owed for Subscription Fees and Credits; or liabilities that cannot be limited by law.
11.7 Data loss. For data loss caused by PENOPS's negligence, PENOPS will use commercially reasonable efforts to restore from backup; if restoration is impossible, liability is limited to the clause 11.5 cap.
12. TERM AND TERMINATION
12.1 Term. The Services begin on the Effective Date and run for the initial Subscription Period (typically 12 months), then auto-renew for equal periods unless either Party gives written non-renewal notice at least 60 days before the current term ends.
12.2 Customer convenience. Customer may terminate for convenience with 60 days' written notice before the end of the current Subscription Period; paid fees and purchased Credits are non-refundable except per clause 12.7.
12.3 PENOPS convenience. PENOPS may terminate for convenience with 90 days' notice, refunding prepaid subscription fees and unused, unexpired Credits pro-rata.
12.4 For cause. Either Party may terminate immediately for the other's uncured material breach (30 days after notice), insolvency, or cessation of business.
12.5 Unauthorized testing. PENOPS may terminate immediately without notice if Customer tests/exploits unauthorized third-party Assets or otherwise breaches clause 4.2 or 4.3.
12.6 Effects. On termination, licenses end, Customer stops using the Services, each Party returns/destroys the other's Confidential Information, PENOPS makes Customer Data available for export for 30 days, outstanding fees fall due, and clauses that should survive do (clauses 7, 8, 9, 10, 11, 14, 16).
12.7 Refunds. Except as stated, fees and consumed Credits are non-refundable; PENOPS may grant pro-rated refunds of prepaid subscription fees and unused, unexpired Credits for an uncured Service Warranty breach, its own termination for convenience (12.3), or by mutual agreement.
12.8 Transition help. On written request within 30 days of termination, PENOPS provides reasonable transition assistance (data export/conversion) at its then-current professional-services rates.
13. FORCE MAJEURE
13.1 Neither Party is liable for failure or delay caused by an event beyond its reasonable control (e.g., natural disasters, war/terrorism/civil unrest, government action or embargoes, broad internet-infrastructure attacks not targeting PENOPS specifically, third-party telecom/cloud failures, or qualifying labor disputes).
13.2 The affected Party promptly notifies the other, gives details and expected duration, mitigates, and keeps the other informed.
13.3 If a Force Majeure Event lasts more than 30 consecutive days, either Party may terminate without liability; Customer pays fees accrued to termination, PENOPS refunds prepaid fees and unused, unexpired Credits for undelivered Services, and payment for delivered Services remains due.
13.4 Force Majeure excludes payment failures, a Party's own labor disputes, cyberattacks specifically targeting a Party (which may be a breach if due to inadequate security), a Party's own infrastructure failures, and economic hardship.
14. ASSIGNMENT
14.1 Neither Party may assign without the other's prior written consent (not unreasonably withheld).
14.2 Either Party may assign without consent in a merger, sale of substantially all assets, change of control, or to an affiliate (assignor remaining jointly liable), on 30 days' notice.
14.3 Any other purported assignment is void.
14.4 These terms bind permitted successors and assigns.
15. CHANGES TO TERMS
15.1 PENOPS may update these Standard Terms and related policies, notifying Customers of material changes by email, in-dashboard notice, or website posting, at least 30 days before effect (60 days for changes that materially and adversely affect Customer's rights).
15.2 Changes take effect on the stated date; continued use constitutes acceptance.
15.3 If Customer objects to a material change, it may terminate on written notice within 30 days, effective at the end of the current Subscription Period, with a pro-rated refund of prepaid fees and unused, unexpired Credits.
15.4 PENOPS keeps a version history; the version in effect at the time of a dispute governs, except where law requires the current terms.
16. GOVERNING LAW AND DISPUTES
16.1 Governing law. The substantive laws of [England and Wales / Delaware, USA / UAE], without regard to conflicts principles.
16.2 Jurisdiction. Subject to 16.4, the courts of [Jurisdiction] have exclusive jurisdiction, and the Parties submit to them.
16.3 Jury waiver. To the extent permitted by law, each Party waives any right to a jury trial.
16.4 Informal resolution. Before formal proceedings (except emergency injunctive relief), the Parties negotiate in good faith; the disputing Party gives written notice, and authorized representatives meet within 30 days to try to resolve it.
16.5 Arbitration (optional). [If elected] Disputes unresolved within 60 days of notice may go to binding arbitration under [LCIA / AAA / DIFC-LCIA] rules, in English, in [City, Country]; the award is final and enforceable in any competent court.
16.6 Equitable relief. Either Party may seek injunctive relief in any competent court to protect IP or Confidential Information or prevent irreparable harm.
16.7 Costs. Each Party bears its own costs, except a prevailing Party may be awarded reasonable fees and costs as the court or arbitrator determines.
17. GENERAL PROVISIONS
17.1 Entire agreement. These terms, the Main Agreement, and incorporated documents (DPA, SLA, AUP) are the whole agreement and supersede prior understandings.
17.2 Severability. If a provision is unenforceable, it is severed and the rest continues; the Parties replace it in good faith with a valid provision of similar intent.
17.3 Waiver. No waiver is effective unless written and signed; no delay in exercising a right waives it.
17.4 Marketing. PENOPS may use Customer's name, logo, and marks in customer lists, case studies, press, presentations, and social/blog content; Customer may revoke by written notice, effective within 30 days. Customer grants a limited trademark license for this purpose.
17.5 Independent contractors. The Parties are independent contractors; these terms create no partnership, agency, or employment relationship.
17.6 Notices. Notices are in writing and deemed given on personal delivery, 3 business days after registered mail, 1 business day after overnight courier, or on confirmed email receipt to the Main Agreement addresses.
17.7 No third-party beneficiaries. These terms benefit only the Parties and their permitted successors and assigns.
17.8 Counterparts / e-signature. May be executed in counterparts; electronic signatures and PDFs have the same effect as originals.
17.9 Language. English governs; if translated, the English version prevails.
17.10 Ethical standards. PENOPS provides the Services consistent with international human-rights, labour, environmental, and anti-corruption standards, and neither PENOPS nor its subcontractors uses unlawful labor.
17.11 Export controls. The Services may be subject to export controls; Customer will not export or transfer them to any prohibited country, entity, or person without required authorization.
17.12 Government end users. For U.S. government customers, the Services are "Commercial Computer Software" and "Commercial Computer Software Documentation" (FAR 12.212 / DFARS 227.7202), provided with only the rights granted to other customers under these terms.
17.13 Survival. Clauses 1, 5 (for accrued amounts), 7, 8, 9, 10, 11, 14, 16, and 17 survive termination.
17.14 Construction. Headings are for convenience; "including" means "including without limitation"; clause references are to these terms unless stated.
17.15 Amendments. No amendment binds unless signed by both Parties, except PENOPS's updates under clause 15.