AXXON LABS INC.
Customer Contract Package
Master Services Agreement
Schedule A — Data Processing Agreement
Schedule B — Roles, Decision Authority & No-Advice Allocation
Schedule C — Service Levels
Schedule D — Acceptable Use Policy
Master Services Agreement
This Master Services Agreement (the “Agreement”) is entered into as of the Effective Date by and between Axxon Labs Inc., an Ontario corporation (“Axxon”), and the customer identified on the applicable Order Form (“Customer”). Axxon and Customer are each a “Party” and together the “Parties.”
Definitions and Interpretation
1.1 “Service” means the software-as-a-service platform made available to Customer by Axxon that helps Customer collect, organize, and validate information from Customer’s Applicants, including AI-assisted Validation. “Validation” means an automated check of whether submitted information appears present and complete against the criteria Customer defines; it does not include, and is not a representation as to, the truth, authenticity, legal sufficiency, or regulatory adequacy of any information or document, which remains the Customer’s responsibility (“Verification”).
1.2 “Customer Data” means all data, documents, and information submitted to the Service by or on behalf of Customer, Customer’s Applicants, or Contributors, including personal information.
1.3 Order of precedence. If there is a conflict, the following order controls: (a) the applicable Order Form; (b) this Agreement; (c) the Schedules.
1.4 “Documentation” means Axxon’s then-current published user documentation for the Service.
1.5 “Applicant” means a borrower, business, individual, or other third party from whom Customer collects information using the Service, including individual consumers where Customer’s use case involves individuals.
1.6 “Contributor” means a third party who is not the Applicant but is invited, by Customer or an Applicant, to supply one or more specific requirements on an Applicant’s file (for example, an accountant, a spouse, or a title officer). A Contributor accesses the Service through a claim link valid for 14 days and may act only with respect to the specific requirement(s) assigned to that Contributor.
The Service; License
2.1 Provision. Subject to this Agreement, Axxon will make the Service available to Customer during the Subscription Term.
2.2 License grant. Axxon grants Customer a non-exclusive, non-transferable right to access and use the Service for Customer’s internal business purposes during the Subscription Term, subject to the terms and conditions of this Agreement.
2.3 Restrictions. Customer will not (a) resell or provide the Service to third parties except its own Applicants and Contributors as intended; (b) reverse engineer the Service; (c) use the Service in violation of the Acceptable Use Policy (Schedule D).
Nature of the Service; No Advice; Customer Decision Authority
3.1 Assistive function only. The Service assists Customer by validating whether submitted information appears present and complete against criteria Customer defines, and by surfacing those Validation results to Customer. The Service does not verify the truth, authenticity, legal sufficiency, or regulatory adequacy of any information or document.
3.2 Customer retains all decision authority. Customer is solely responsible for reviewing, accepting, rejecting, and acting upon any Applicant, document, or information. No output of the Service constitutes an approval, Verification, or decision by Axxon. Any “Approved” status or equivalent sign-off within the Service is solely an action taken by a Customer operator, recorded with that person’s name and date, and is never set by the Service.
3.3 No legal, compliance, or regulatory advice. Axxon does not provide legal, compliance, underwriting, or regulatory advice, and nothing in the Service is a substitute for Customer’s own professional judgment or advisors.
3.4 AI-assisted output. AI-assisted results may be incomplete or incorrect. Customer acknowledges the inherent limitations of AI-assisted output and assumes all risk arising from its use of or reliance on such output. Customer will not rely on them as the sole basis for any decision and will apply its own review. The Service surfaces on-screen notices reminding users that output is AI-generated, may be incorrect, is informational only, and is not advice or Verification; Axxon maintains a versioned log of the notices and instructions in force, and Customer will not suppress, alter, or circumvent those notices.
Customer Responsibilities
4.1 Provide accurate account and configuration information and define the completeness criteria it wishes the Service to apply. Axxon may make available a catalog of sample or template criteria; any such criteria are starting points only, and Customer is solely responsible for reviewing, adapting, and adopting them as its own before use.
4.2 Obtain all consents and provide all notices required for Axxon to process Customer Data, including the personal information of Applicants and Contributors (see Schedule A), and provide all notices and obtain all consents required to invite a Contributor and share the relevant requirement with them.
4.3 Make all onboarding, lending, compliance, and other business decisions itself and maintain its own regulatory program.
4.4 Keep credentials secure and ensure authorized users comply with this Agreement.
Fees, Payment, and Taxes
5.1 Fees. Customer will pay the fees set out in the applicable Order Form.
5.2 Invoicing and payment. Fees are invoiced on the billing cycle stated in the Order Form (monthly or annual) in advance and due net 30 unless the Order Form states otherwise. Late amounts may accrue interest at the lesser of 1.5%/month or the maximum permitted by law. If any amount remains unpaid for more than 15 days after the due date, Axxon may, on written notice, suspend Customer’s access to the Service until payment is received, without prejudice to any other remedy.
5.3 Taxes. Fees are exclusive of applicable taxes (including HST), which Customer is responsible for except for taxes on Axxon’s income.
Term and Termination
6.1 Term. This Agreement begins on the Effective Date and continues for the Subscription Term stated in the Order Form, renewing as stated there.
6.2 Termination for cause. Either Party may terminate for the other’s material breach not cured within 30 days of written notice; provided that the cure period does not apply (and termination may be immediate upon written notice) if the breach involves unauthorized use or disclosure of Confidential Information, violation of Section 8.3 (No Model Training), or a breach of Schedule D (Acceptable Use Policy) that threatens the security or integrity of the Service.
6.3 Effect. On termination, Customer’s access ends and Axxon will, on request, delete or return Customer Data as set out in Schedule A, subject to Schedule A8 retention reconciliation. Termination does not relieve Customer of any payment obligation that accrued before the effective date of termination. If Axxon terminates for Customer’s material breach, all fees for the remainder of the then-current Subscription Term become immediately due and payable.
6.4 Survival. Sections 3, 7–12, and 13 survive termination.
Confidentiality
7.1 “Confidential Information” means non-public information disclosed by or on behalf of a Party in connection with this Agreement, whether orally, in writing, or electronically, that is designated as confidential or that a reasonable person would understand to be confidential given the nature of the information and circumstances of disclosure. Confidential Information includes each Party’s technology, business plans, pricing, and product roadmap. Customer Data is Customer’s Confidential Information. Each Party will protect the other’s Confidential Information with reasonable care and use it only to perform under this Agreement.
7.2 Exclusions: information that is public, independently developed, or rightfully received without restriction. Disclosure compelled by law is permitted with notice where lawful.
Intellectual Property; Data Use; No Model Training
8.1 Axxon IP. Axxon owns the Service and all related IP, including any improvements not derived from Customer Data.
8.2 Customer Data. As between the Parties, Customer owns Customer Data. Customer grants Axxon a limited license to process Customer Data solely to provide and support the Service. For clarity, the requirement definitions and validation criteria that Customer configures (which document types are required and the rules for checking them) are not Customer Data. Axxon may use that configuration, in aggregated and de-identified form containing no documents and no personal information, to operate and improve the Service, including to improve how document types are recognized and validated. In addition, Axxon may create, use, and commercialize aggregated and de-identified analytics, benchmarks, and statistical insights derived from Customer Data (for example, aggregate processing times and workflow bottlenecks), provided that such analytics: (a) are irreversibly anonymized such that they no longer constitute personal information under applicable privacy law, including PIPEDA, and cannot reasonably be re-identified; (b) contain no personal information and no documents; and (c) are not presented at a level of granularity that could identify Customer, any Applicant, or any Contributor. As between the Parties, Axxon owns such aggregated and de-identified analytics. This permission does not modify Section 8.3 (No Model Training).
8.3 No model training. Axxon will not use Customer Data to train, fine-tune, or improve any machine-learning model, and will contractually require its AI sub-processor(s) not to do so.
8.4 Feedback. If Customer provides suggestions, ideas, or other feedback about the Service (“Feedback”), Customer assigns to Axxon all right, title, and interest in such Feedback, and Axxon may use it without restriction or obligation of any kind.
Data Protection and Security
9.1 Schedule A (Data Processing Agreement) governs the processing of personal information and is incorporated by reference. Axxon will maintain administrative, technical, and physical safeguards appropriate to the sensitivity of Customer Data.
Warranties and Disclaimers
10.1 Mutual. Each Party warrants it has authority to enter this Agreement.
10.2 Limited service warranty. Axxon warrants the Service will perform materially in accordance with the Documentation. Customer’s exclusive remedy for breach is correction or, if Axxon cannot correct, termination and a pro-rata refund of prepaid fees.
10.3 Disclaimer. Except as expressly stated, the Service is provided “as is.” Axxon disclaims all implied warranties, including without limitation any implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, to the fullest extent permitted by law. Axxon does not warrant that AI-assisted output is accurate or complete, or that use of the Service will satisfy any legal or regulatory obligation of Customer.
Limitation of Liability
11.1 Cap. Except for the Excluded Claims, each Party’s aggregate liability under this Agreement will not exceed the fees paid or payable by Customer in the 12 months before the event giving rise to liability.
11.2 Consequential damages. Neither Party is liable for indirect, incidental, special, or consequential damages, or lost profits, even if advised of the possibility. This exclusion does not apply to Customer’s payment obligations under the applicable Order Form or to damages arising from a Party’s breach of Section 7 (Confidentiality) or Schedule D (Acceptable Use Policy).
11.3 Excluded Claims. The cap in 11.1 does not apply to (a) Customer’s payment obligations under the applicable Order Form; (b) either Party’s indemnification obligations under 12; (c) a Party’s breach of its confidentiality obligations under 7; (d) Axxon’s breach of the no-model-training commitment in 8.3; and (e) liability arising from a Party’s gross negligence or willful misconduct (the “Excluded Claims”). Notwithstanding the foregoing, and except for items (a) and (e), each Party’s aggregate liability for Excluded Claims will not exceed three (3) times the fees paid or payable by Customer in the 12 months before the event giving rise to liability. For clarity, and notwithstanding the confidentiality carve-out in (c), each Party’s aggregate liability arising out of or relating to a security incident or any unauthorized access to, or disclosure of, Customer Data is subject to the cap in 11.1.
Indemnification
12.1 By Axxon. Axxon will defend Customer against third-party claims that the Service, as provided by Axxon and used in accordance with this Agreement, infringes IP rights, and pay resulting costs finally awarded, provided Axxon has no obligation under this Section to the extent a claim arises from (i) Customer’s modification of the Service; (ii) combination of the Service with non-Axxon products or data; (iii) Customer’s continued use after notice to discontinue; or (iv) Customer Data. If the Service becomes, or in Axxon’s opinion is likely to become, the subject of an infringement claim, Axxon may, at its option: (A) procure the right for Customer to continue using the Service; (B) modify the Service to make it non-infringing; or (C) terminate Customer’s access to the infringing component and refund prepaid fees for the remainder of the Subscription Term.
12.2 By Customer. Customer will defend Axxon against third-party claims arising from (a) Customer Data, (b) Customer’s decisions or actions based on or relating to the Service’s output, (c) Customer’s breach of law in operating its business, or (d) Customer’s representation to any person that Axxon has verified, approved, or made any decision in respect of an Applicant or document.
12.3 Procedure. The indemnified Party will (a) give prompt written notice of the claim (provided that failure to give notice will not relieve the indemnifying Party except to the extent materially prejudiced); (b) grant the indemnifying Party sole control of the defense and settlement (except that the indemnifying Party may not settle in a manner that imposes obligations on, or admits fault by, the indemnified Party without its prior written consent); and (c) provide reasonable cooperation at the indemnifying Party’s expense.
12.4. Mutuality; data breach. The indemnities in this Section are mutual as set out in 12.1 and 12.2. No separate, uncapped data-breach indemnity is provided; any liability of either Party arising from a security incident or unauthorized access to, or disclosure of, Customer Data is subject to the limitation of liability in 11, including the cap in 11.1.
General
13.1 Governing law and forum. This Agreement is governed by the laws of the Province of Ontario and the federal laws of Canada applicable there, and the Parties submit to the exclusive jurisdiction of the courts of Ontario.
13.2 Assignment. Neither Party may assign without consent, not to be unreasonably withheld, except that Axxon may assign this Agreement without Customer’s consent to a successor in a merger or sale of substantially all assets. Customer may assign to a successor in a merger or sale of substantially all assets with 30 days’ prior written notice to Axxon, provided the assignee is not a direct competitor of Axxon.
13.3 Entire agreement; amendment. This Agreement and its Schedules and Order Forms are the entire agreement and may be amended only in writing.
13.4 Notices. All notices must be in writing and delivered to the addresses set out in the Order Form. Notice is effective upon receipt.
13.5 Severability. If any provision is held unenforceable, it will be modified to the minimum extent necessary, and the remaining provisions will continue in full force.
13.6 Waiver. No waiver is effective unless in writing; failure to enforce a provision is not a waiver of it.
13.7 Force majeure. Neither Party is liable for failure to perform (other than payment obligations) to the extent caused by circumstances beyond its reasonable control, including acts of God, natural disasters, pandemics, labour disputes, governmental actions, Internet or telecommunications failures, or third-party hosting or infrastructure outages. The affected Party will give prompt notice and use reasonable efforts to mitigate the impact.
13.8 Acceptance. Customer accepts this Agreement by executing an Order Form or by click-through acceptance at sign-up, with acceptance logged (tenant, version, timestamp, user). Where the item accepted is an Order Form, the specific values accepted by Customer (including Customer name, Effective Date, fees, plan/tier, usage limits, and notice period) are captured and stored immutably as part of the acceptance record, and together with the frozen Order Form template constitute the Order Form agreed between the Parties.
13.9. Publicity. Neither Party will use the other’s name or marks without prior written consent, except Axxon may identify Customer in a customer list with Customer’s prior approval.
Agreed by the Parties (execution of this signature block is optional and provided for negotiated Order Forms; Customer may instead accept by click-through acceptance under Section 13.8):
- AXXON LABS INC.
CUSTOMER - Signature: ______________________
Signature: ______________________ - Name:
Name: - Title:
Title: - Date:
Date:
Schedule A — Data Processing Agreement
A1. Roles
Customer is the organization with primary responsibility for the personal information of its Applicants. Axxon processes that personal information as a service provider acting on Customer’s instructions and for the purpose of providing the Service.
A2. Scope and Purpose
Axxon will process personal information only to provide, secure, and support the Service, and per Customer’s documented instructions. Categories: identification documents, business and financial information, and contact details of Applicants (who may be individuals or businesses), their representatives, and Contributors.
A3. Customer Obligations
Customer is responsible for the lawful basis for processing, including obtaining consents and providing notices to Applicants and Contributors. Customer warrants it has the right to provide the personal information of Applicants and Contributors to Axxon, and to invite Contributors and share the relevant requirement(s) with them.
A4. Axxon Obligations
Process only on Customer’s instructions and for the stated purpose.
Ensure persons authorized to process are bound by confidentiality.
Implement appropriate technical and organizational security measures (A9).
Assist Customer, to the extent reasonable, with data-subject requests and with security-incident obligations.
A5. Sub-processors
Axxon uses sub-processors in the following categories to provide the Service and remains responsible for their performance: cloud hosting, database/storage, AI processing, and transactional email. A current list of the specific sub-processors is maintained by Axxon and made available to Customer on request. Axxon will give Customer at least 15 days' prior notice of any new or replacement sub-processor, during which Customer may object on reasonable data-protection grounds. If the Parties cannot resolve Customer’s objection within 15 days, Customer may, as its sole remedy, terminate the affected Service component on written notice and receive a pro-rata refund of prepaid fees for the terminated component. The current sub-processors are:
- Sub-processor
Function / Location - Supabase
Database, storage & authentication — outside Canada - Vercel
Cloud hosting - outside Canada - Anthropic
AI processing - outside Canada - Resend
Transactional email — outside Canada
A6. No Secondary Use; No Model Training
Axxon will not sell personal information, will not use it for its own purposes, and will not use Customer Data to train or improve machine-learning models. This mirrors MSA §8.3 and must be consistent with it. Notwithstanding the foregoing, Axxon may create, use, and commercialize aggregated and de-identified analytics and benchmarks as permitted under MSA 8.2, provided that such analytics are irreversibly anonymized such that they no longer constitute personal information under applicable privacy law, including PIPEDA, contain no personal information and no documents, and are not presented at a level of granularity that could identify Customer, any Applicant, or any Contributor. For clarity, nothing in this exception permits the sale of personal information or the use of Customer Data to train, fine-tune, or improve any machine-learning model.
A7. Cross-Border Transfers
Personal information may be stored and processed outside Canada by sub-processors as described in A5, and may therefore be subject to access by foreign authorities. Customer acknowledges and consents to these cross-border flows and, where required, will disclose them to Applicants and obtain any necessary consents from Applicants for such transfers.
A8. Retention and Deletion
On termination or Customer request, Axxon will delete or return Customer Data within 30 days, except where retention is required by law. Customer (not Axxon) is responsible for any statutory or regulatory record-retention obligations applicable to its business; Axxon acts as a service provider and does not assume those duties. This Section reconciles with MSA §6.3 so that deletion and any retention obligations do not conflict.
A9. Security Measures
Encryption of data in transit and at rest.
Role-based access controls and least-privilege administration.
Row-level security isolating each Customer’s data.
Logging, monitoring, and regular backups.
A10. Security Incidents
Axxon will notify Customer within 72 hours after becoming aware of a security incident affecting Customer Data and will provide information reasonably needed for Customer to meet its own notification obligations.
A11. California Consumer Privacy (Service Provider Terms)
Where Customer is subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), and discloses personal information of California residents to Axxon, Axxon acts as a “service provider” and processes such personal information solely on Customer’s behalf for the business purpose of providing the Service. Axxon will not: (a) sell or share such personal information (as those terms are defined in the CCPA); (b) retain, use, or disclose it for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship between the Parties; or (c) combine it with personal information received from or on behalf of any third party, or collected from Axxon’s own interactions, except as permitted by the CCPA. Axxon certifies that it understands and will comply with these restrictions. Axxon will assist Customer, to the extent reasonable, in responding to verifiable consumer requests. This Section supplements the remainder of this Schedule and, to the extent of any conflict on CCPA matters, controls.
Schedule B — Roles, Decision Authority & No-Advice Allocation
B1. Axxon’s Role
Provides software that collects and organizes information from Customer’s Applicants.
Runs AI-assisted checks of whether submitted information appears present and complete against criteria the Customer configures.
Surfaces results to the Customer for the Customer’s review.
Assists operators, Applicants, and Contributors while they complete or work the form by answering their questions about what is being requested and prompting them for missing or follow-up items, to help them submit complete information. This assistance is informational only and does not include legal, financial, or compliance advice.
Tracks commitments and open items that a Customer operator or an Applicant makes during the process and reminds the relevant stakeholder to follow up, maintaining a record of what each side said it would do. This follow-up activity is administrative and informational only, does not include legal, financial, or compliance advice, and does not make or communicate any decision on Customer’s behalf.
B2. What Axxon Does Not Do
Does not verify identity, authenticity, or the truth of any document or statement.
Does not approve, reject, or make any lending, underwriting, credit, or other business decision.
Does not perform the Customer’s regulatory or compliance program, and does not act as the Customer’s agent or mandatary for any compliance function.
Does not provide legal, compliance, or regulatory advice.
B3. Customer’s Retained Authority and Responsibility
The Customer retains sole and final authority over every decision about an Applicant or document. The Customer is responsible for its own regulatory obligations and for determining whether any information is sufficient for its purposes. Any completeness signal from the Service is an input to — never a substitute for — the Customer’s own review and judgment.
B3.1 Communications on Customer’s behalf. Customer acknowledges and authorizes that the Service, including its AI assistant and follow-up functions, communicates with Applicants and Contributors in connection with Customer’s process and in Customer’s name, and that Applicants and Contributors may reasonably understand such communications to originate from Customer. As between the Parties, Customer is responsible for those communications as its own, including the content of any AI-generated messages. Axxon is not liable for any inaccuracy, incompleteness, or misstatement in AI-generated communications to Applicants or Contributors. Axxon does not thereby act as Customer’s agent or mandatary for any decision-making, regulatory, or advisory function, and such communications are informational only and do not constitute legal, financial, or compliance advice.
B3.2 In-app disclaimers. The no-advice and assistive-only positioning in this Schedule is reinforced by on-screen notices shown to operators and Applicants (including in the AI assistant, on results/criteria screens, and at any operator sign-off), stating that output is AI-generated, may be incorrect, is informational only, and is not legal, financial, or compliance advice or Verification. These notices are layered controls supporting, and not a substitute for, the allocation of responsibility in the Agreement and this Schedule. Axxon versions and logs the notices in force so the applicable wording can be identified for any given interaction.
B4. Effect of AI-Assisted Output
A “complete” or “pass” indication means only that the configured presence/completeness criteria appear satisfied. It is not a representation that a document is genuine, valid, current, or legally adequate. The Customer will not represent to any regulator, Applicant, or third party that Axxon has verified or approved anything.
Schedule C — Service Levels
C1. Availability
Target monthly uptime of 99.5% for the production Service, excluding scheduled maintenance and force-majeure events.
C2. Support
- Severity
Target initial response - Critical (Service down)
8 business hours - High (major feature impaired)
2 business days - Normal / question
5 business days
C3. Maintenance
Axxon will use reasonable efforts to schedule maintenance outside business hours and to give advance notice of planned downtime.
C4. Remedies
No service credits apply at this stage; the targets in this Schedule are objectives, not guarantees. Axxon will use reasonable efforts to meet them and will revisit a service-credit schedule once the product is proven.
Schedule D — Acceptable Use Policy
Customer and its users will not:
Use the Service unlawfully or to infringe third-party rights.
Upload malware or attempt to breach, probe, or disrupt the Service or its security.
Reverse engineer, scrape, or build a competing product from the Service.
Submit personal information without the rights and consents required under Schedule A.
Use the Service to make decisions that law requires a human to make, while representing those decisions as Axxon’s.
Exceed configured usage limits or share credentials with unauthorized users.
Axxon may suspend access for a material or security-threatening breach of this Policy, with notice where practicable.
Order Form (Template)
This Order Form is entered into under and incorporates the Master Services Agreement between Axxon Labs Inc. (“Axxon”) and the customer identified below (“Customer”). Capitalized terms not defined here have the meanings given in the Agreement. In the event of a conflict, the order of precedence in Section 1.3 of the Agreement applies.
1. Parties and Effective Date. Customer legal name: ____________________. Address: ____________________. Effective Date: ____________________.
2. Subscription Plan. Plan name / tier: ____________________. Description of Service and included modules: ____________________.
3. Fees and Currency. Subscription fee: US$__________ per month. All fees are stated and payable in U.S. dollars (USD), including for Customers located in Canada. Fees are exclusive of applicable taxes as set out in Section 5.3 of the Agreement.
4. Billing Cycle and Payment. Billing cycle: monthly, in advance. Payment terms: net 30 unless otherwise stated here. Payment method: ____________________.
5. Subscription Term and Renewal. Initial Subscription Term: one (1) month commencing on the Effective Date. The Subscription Term renews automatically for successive one-month periods unless either Party gives notice of non-renewal at least ______ days before the end of the then-current term.
6. Usage Limits. Included usage (e.g., seats, Applicants, files, or transactions): ____________________. Overage handling / additional-usage pricing: ____________________.
7. Updated Order Form Terms. Axxon may update plans, prices, and usage limits from time to time. Axxon will present updated Order Form terms to Customer through an in-app prompt, and the updated terms will apply to the next renewal term upon Customer’s acceptance (logged with tenant, version, timestamp, and user, consistent with Section 13.8). If Customer declines the updated terms, the current terms continue until the end of the then-current term, after which the Subscription will not renew and Customer’s access will end at expiry, without prejudice to fees already accrued.
8. Notices. Customer notice address (Section 13.4): ____________________. Axxon notice address: ____________________.
9. Special Terms. ____________________.
Accepted by Customer by executing this Order Form or by click-through acceptance under Section 13.8 of the Agreement.