HX-Provenance End User License Agreement

This HX-Provenance End User License Agreement ("Agreement") governs your access to and use of HX-Provenance, a software appliance provided by Tigantic Holdings, LLC dba HolonomiX ("HolonomiX," "we," "us," or "our").

By deploying, accessing, or using HX-Provenance through Google Cloud Marketplace or any other authorized HolonomiX distribution channel, you agree to this Agreement. If you are using HX-Provenance on behalf of an organization, you represent that you have authority to bind that organization to this Agreement.

Order of precedence. If a separate written agreement, private offer, order form, or addendum applies to your use of HX-Provenance, that document controls to the extent of any conflict with this Agreement.

1. Product

HX-Provenance is a private software appliance for issuing, verifying, and exporting provenance receipts and evidence bundles for registered digital artifacts.

For the Google Cloud Marketplace version, HX-Provenance is delivered as a virtual machine appliance that runs inside the customer's Google Cloud project. The appliance may include APIs, command-line tools, offline verification components, documentation, configuration files, cryptographic verification material, and related software components.

2. License grant

Subject to this Agreement and payment of applicable fees, HolonomiX grants you a limited, non-exclusive, non-transferable, non-sublicensable license to deploy and use HX-Provenance for your internal business purposes.

For Google Cloud Marketplace deployments, the license applies to each running HX-Provenance appliance instance purchased or deployed through the Marketplace listing or an associated private offer.

3. Marketplace terms and infrastructure costs

If you acquire HX-Provenance through Google Cloud Marketplace, your purchase, billing, payment, tax handling, cancellation, and Marketplace account relationship may also be governed by applicable Google Cloud Marketplace terms.

You are responsible for all Google Cloud infrastructure charges associated with your deployment, including Compute Engine, disks, networking, logging, monitoring, storage, and any optional Google Cloud services you configure. HolonomiX software charges are separate from Google Cloud infrastructure charges unless otherwise stated in a private offer.

4. Permitted use

You may use HX-Provenance to:

• Issue signed provenance receipts for registered artifacts.
• Verify signed provenance receipts.
• Export evidence bundles.
• Perform offline verification.
• Integrate HX-Provenance with your internal applications, workflows, AI/ML pipelines, compliance systems, records systems, or operational tools.
• Retain receipts, public-key material, and evidence bundles in your own systems of record.
• Provide receipts or evidence bundles to auditors, reviewers, counterparties, regulators, or other authorized recipients.

5. Restrictions

You may not:

• Sell, resell, rent, lease, sublicense, or provide HX-Provenance as a third-party hosted service, managed service, bureau service, or commercial service offering for the benefit of unaffiliated third parties without HolonomiX's written consent.
• Reverse engineer, decompile, disassemble, or attempt to derive source code from HX-Provenance except to the extent permitted by applicable law.
• Remove or alter proprietary notices, license notices, product identifiers, or attribution notices.
• Circumvent license controls, usage controls, authentication controls, security controls, or access restrictions.
• Use HX-Provenance to violate law, infringe third-party rights, or process data in a manner prohibited by your legal obligations.
• Use HX-Provenance to create or distribute malware, spyware, unauthorized surveillance tools, credential theft tools, or other harmful systems.
• Misrepresent cryptographic receipts, evidence bundles, verification results, or provenance records generated by HX-Provenance.

This Agreement applies to the HX-Provenance private appliance product. Separate HolonomiX-hosted services, if offered, are governed by their own applicable terms.

6. Customer data and artifact custody

For private appliance deployments, HX-Provenance runs in your environment. You control the Google Cloud project, network configuration, access permissions, logs, retained receipts, evidence bundles, public-key policies, and artifact storage.

HX-Provenance may process artifact metadata, hash commitments, receipt requests, verification material, and evidence-bundle requests as part of appliance operation. You are responsible for determining what data you submit to the appliance and how you retain, protect, disclose, or delete receipts and evidence bundles.

HolonomiX does not require access to your customer data, artifacts, receipts, evidence bundles, signing keys, API keys, or Google Cloud environment during normal private-appliance operation.

7. API keys, signing keys, and verification material

You are responsible for protecting API keys, signing keys, private keys, administrative credentials, public-key pinning policies, and verification material associated with your deployment.

You are responsible for backing up signing keys if signer continuity is required. Loss of signing keys may affect your ability to issue future receipts under the same signer identity. Previously issued receipts remain verifiable when the corresponding public key and receipt material are retained.

You should retain public keys and signer fingerprints for as long as you need to verify historical receipts.

8. Evidence and compliance use

HX-Provenance provides cryptographic provenance receipts, verification outputs, and evidence-bundle functionality. You are responsible for determining how those materials are used in your legal, regulatory, compliance, audit, procurement, security, or operational processes.

HX-Provenance does not by itself guarantee compliance with any specific law, regulation, certification framework, evidentiary rule, contractual requirement, agency requirement, or industry standard. Compliance depends on your deployment, configuration, controls, operating procedures, evidence-retention practices, and legal review.

9. Support

HolonomiX may provide product support according to the applicable Marketplace listing, private offer, order form, support policy, or written agreement.

Support may cover deployment questions, appliance startup, health checks, API access, receipt issuance, verification, evidence-bundle export, offline verification, product-related troubleshooting, and configuration guidance.

Do not send HolonomiX secrets, private keys, signing keys, API keys, regulated records, confidential evidence artifacts, sensitive customer data, or unsanitized logs unless HolonomiX has established an approved secure support channel for that material.

10. Updates

HolonomiX may make updates, patches, maintenance releases, security fixes, or new versions available through Google Cloud Marketplace or another authorized distribution channel.

You are responsible for deciding whether and when to apply updates to your deployment. Some updates may require redeployment, service restart, configuration review, migration steps, or validation before production use.

11. Third-party and open-source software

HX-Provenance may include third-party or open-source software components. Those components may be subject to separate license terms. To the extent required by applicable licenses, HolonomiX will provide notices, attributions, or license information with the product or related documentation.

This Agreement does not limit rights you may have under applicable open-source licenses.

12. Ownership

HolonomiX and its licensors retain all rights, title, and interest in and to HX-Provenance, including all software, documentation, designs, interfaces, workflows, schemas, trademarks, service marks, know-how, inventions, and intellectual property rights.

You retain ownership of your data, artifacts, receipts, evidence bundles, configurations, logs, and customer-controlled materials, subject to the rights granted to HolonomiX only as necessary to provide support or services you request.

13. Feedback

If you provide suggestions, improvements, ideas, or feedback relating to HX-Provenance, you grant HolonomiX a perpetual, irrevocable, worldwide, royalty-free license to use that feedback without restriction or compensation, provided that HolonomiX does not disclose your confidential information in doing so.

14. Confidentiality

Each party may receive confidential information from the other. The receiving party will use reasonable care to protect confidential information and will use it only for purposes related to this Agreement.

Confidential information does not include information that is publicly available, already known without restriction, independently developed without use of the other party's confidential information, or rightfully received from a third party without confidentiality obligations.

15. Security

You are responsible for securing your HX-Provenance deployment, including Google Cloud IAM, firewall rules, network exposure, administrative access, API keys, signing keys, backups, logs, monitoring, and support-bundle review.

You must promptly remediate known security issues in your deployment and apply security updates according to your organization's risk-management policies.

Report suspected product security issues to: [email protected]

16. Export control and restricted use

You are responsible for complying with all applicable export control, sanctions, procurement, government-contracting, and restricted-use laws and regulations.

You may not use, export, re-export, transfer, or make HX-Provenance available in violation of applicable law.

17. Government users

HX-Provenance is commercial computer software and commercial computer software documentation. If acquired by or on behalf of a U.S. Government entity, use, duplication, disclosure, modification, and transfer are subject to the restrictions and license terms applicable to commercial computer software and this Agreement, unless a separate written agreement states otherwise.

18. Warranty disclaimer

HX-Provenance is provided "as is" and "as available," except to the extent a separate written agreement expressly states otherwise.

To the maximum extent permitted by law, HolonomiX disclaims all warranties, whether express, implied, statutory, or otherwise, including warranties of merchantability, fitness for a particular purpose, title, non-infringement, availability, accuracy, security, uninterrupted operation, and error-free performance.

HolonomiX does not warrant that HX-Provenance will meet every customer requirement, prevent every security incident, satisfy any specific compliance obligation, or produce legally sufficient evidence for any specific proceeding.

19. Limitation of liability

To the maximum extent permitted by law, HolonomiX will not be liable for indirect, incidental, special, consequential, exemplary, punitive, or enhanced damages, including lost profits, lost revenue, lost data, business interruption, loss of goodwill, or cost of substitute goods or services.

To the maximum extent permitted by law, HolonomiX's total aggregate liability arising out of or relating to this Agreement or HX-Provenance will not exceed the amounts paid to HolonomiX for the applicable HX-Provenance product during the twelve months preceding the event giving rise to the claim.

The limitations in this section apply regardless of the theory of liability, whether in contract, tort, strict liability, negligence, warranty, statute, or otherwise, and even if a remedy fails of its essential purpose.

20. Indemnity

You will defend, indemnify, and hold harmless HolonomiX, its affiliates, officers, directors, employees, contractors, and agents from and against any third-party claims, damages, liabilities, losses, costs, and expenses, including reasonable attorneys' fees, arising from or relating to:

• your data, artifacts, systems, configurations, or deployment environment;
• your use of HX-Provenance in violation of this Agreement or applicable law;
• your use of receipts, verification outputs, evidence bundles, or provenance records in legal, regulatory, contractual, procurement, security, or operational proceedings;
• your modification of HX-Provenance or combination of HX-Provenance with systems, data, software, or materials not provided by HolonomiX;
• your failure to secure API keys, signing keys, credentials, infrastructure, logs, backups, or customer-controlled materials.

HolonomiX will defend you against a third-party claim alleging that HX-Provenance, as provided by HolonomiX and used in accordance with this Agreement, directly infringes that third party's U.S. patent, copyright, or trademark, and HolonomiX will pay damages and costs finally awarded by a court or agreed in settlement for that claim.

HolonomiX's indemnity obligations do not apply to claims arising from:

• customer data, artifacts, receipts, evidence bundles, or customer-provided materials;
• modifications not made by HolonomiX;
• combinations with products, services, data, hardware, software, or processes not provided by HolonomiX;
• use outside the scope of this Agreement or documentation;
• continued use after HolonomiX provides a non-infringing replacement, modification, or termination instruction;
• open-source components governed by separate open-source licenses.

If HX-Provenance becomes, or in HolonomiX's opinion is likely to become, subject to an infringement claim, HolonomiX may, at its option: procure the right for you to continue using the product, modify the product to make it non-infringing, replace it with a substantially similar non-infringing product, or terminate the affected license and provide any refund required by applicable Marketplace terms or the applicable order.

HolonomiX's obligations under this section are subject to your prompt written notice of the claim, reasonable cooperation, and HolonomiX's control of the defense and settlement. HolonomiX will not settle any claim in a manner that admits fault by you or imposes non-monetary obligations on you without your consent.

This section states each party's exclusive remedy and entire liability for third-party infringement and indemnity claims, subject to the limitation of liability in this Agreement unless a separate written agreement states otherwise.

21. Termination

This Agreement remains in effect while you use HX-Provenance.

HolonomiX may suspend or terminate your license if you materially breach this Agreement and do not cure the breach within a reasonable period after notice, or immediately if continued use would create legal, security, or operational risk.

Upon termination, you must stop using HX-Provenance and uninstall or delete the software unless you are legally required to retain specific records. Termination does not affect your ownership of your retained receipts, evidence bundles, public-key materials, logs, or customer data.

22. Changes to this Agreement

HolonomiX may update this Agreement from time to time. Updates will be posted at this URL or another HolonomiX legal page. The updated Agreement applies to future deployments, renewals, updates, or continued use after the effective date stated on the updated page.

Where a separate written agreement, private offer, order form, or addendum applies, that document controls over a posted update to the extent of any conflict, in accordance with the order of precedence stated above.

23. Governing law

This Agreement is governed by the laws of the State of North Carolina, without regard to conflict-of-law principles, unless applicable law requires otherwise.

The parties consent to the exclusive jurisdiction and venue of the state and federal courts located in North Carolina for disputes arising out of or relating to this Agreement, unless applicable law requires another forum.

24. Contact

Legal notices should be sent to:

Website: holonomx.com
Support: [email protected]
Security: [email protected]