# Awake Security Addendum

## Commercial Terms

Parties and main agreement: [names/version]. Covered systems/data: [scope]. Security and incident contacts: [contacts]. Control evidence/date: [register]. Notification period: [hours after awareness]. Review cadence and change process: [terms]. Responsibility allocation: [schedule].

## 1. Controls

Complete controls for least-privilege access, multifactor authentication, access review, encryption in transit/at rest, secure development, dependency tracking, logging, vulnerability remediation and personnel training. Describe actual practices and exceptions; do not assert a certification not held. Company-approved AI tools and data-handling rules apply to covered information.

## 2. Operations and resilience

Document patch priorities and response targets, backup frequency, restoration testing, recovery objectives and responsibility for cloud dependencies. Identify customer configuration duties. Security obligations do not create an unstated availability warranty; reference a separate SLA where applicable.

## 3. Incidents

Notify the other party through agreed contacts within the completed period after awareness of a covered incident. Supply available scope, affected information, mitigation and updates, preserve relevant evidence and coordinate lawful notification. Do not publish credentials or sensitive exploit details. Cost and third-party investigation allocation: [terms].

## 4. Verification and changes

Provide agreed reports or confidential evidence with reasonable limits protecting other customers. Audits use scope, notice and remediation terms [details]. Material reduction in contracted controls requires the agreed notice/approval process. On termination remove access and delete/return data under the DPA and main agreement.

## General terms

Formal notices go to the contacts and delivery methods in the Commercial Terms. Governing law: [state and country]; dispute forum: [court and venue, or separately completed arbitration provision], subject to mandatory law. The parties will first meet in good faith within [days] after a dispute notice; this does not delay urgent relief or a filing deadline. This document and the signed schedules listed here constitute the agreement on this subject. Changes require a writing signed by the affected parties. A schedule overrides another document only by identifying the provision and the agreed replacement. No provision silently amends an existing equity, financing, or employment instrument. Severability applies to the extent lawful. Neither party may transfer this agreement without the other's written consent except to a successor acquiring the relevant business that assumes its obligations in writing, subject to any expressly agreed restrictions. Counterparts and electronic signatures are permitted.

## Signatures

Party A: [full legal name]. Authorized signature: [signature]. Name and title: [name and title]. Date: [date].

Party B: [full legal name]. Authorized signature: [signature]. Name and title: [name and title]. Date: [date].

Signed schedules and implementing documents: [list, dates, and versions, or none].