01 Parties, Corporate Identification & B2B Commercial Status

1.1 Unification of Provider Identity. This Master Subscription Agreement and Terms of Service (the "Agreement" or "MSA") is a binding legal contract between Willis Brown Inc., a corporation incorporated in Canada operating its cybersecurity business and web properties under the trade name Codein Cybersecurity (including https://codein.ca) and providing the DetectMonkey software-as-a-service platform (collectively, "Willis Brown Inc.", "Codein", "Provider", "we", or "us"), and the corporation, partnership, Managed Service Provider (MSP), municipality, or commercial organization executing this Agreement via electronic clickwrap or Order Form ("Customer", "Subscriber", or "you").

1.2 Strictly Business-to-Business (B2B) Contract. Customer represents and warrants that it is entering into this Agreement strictly for commercial, business, or institutional purposes and not as a personal, household, or retail consumer. The individual accepting this Agreement represents that they have full corporate authority to bind Customer.

02 Electronic Clickwrap Execution & Cryptographic Audit Trail

2.1 Binding Assent. Pursuant to the New Brunswick Electronic Transactions Act (RSNB 2011, c 145) and applicable Canadian federal and provincial electronic commerce statutes, checking the acceptance boxes on the onboarding sign-up form and completing subscription checkout constitutes Customer's valid, binding electronic signature to this Agreement.

2.2 Immutable Evidentiary Record. Customer acknowledges that Willis Brown Inc. records an append-only, SHA-256 hash-chained audit entry (legal.accept) capturing the signatory's email address, organization, IP address, User-Agent, UTC timestamp, and the exact version identifier of this Agreement (MSA-v2026.12) prior to redirecting to Stripe payment processing or enabling access to the DetectMonkey console.

03 Scope of Service: Detection & Alerting Only (No Remediation)

3.1 What DetectMonkey Does. Subject to active subscription status and payment of fees, DetectMonkey ingests security telemetry streamed from Customer's configured collectors (such as Windows Sysmon, Linux auditd, Microsoft 365 / cloud identity logs, and perimeter firewalls), normalizes those events in-stream within Canadian infrastructure, evaluates them against detection rules and Complex Event Processing (CEP) correlation patterns, and emits alerts to Customer's designated notification channels and authenticated investigation console.

3.2 NO UNILATERAL REMEDIATION, ISOLATION, OR SYSTEM MODIFICATION. CUSTOMER EXPRESSLY ACKNOWLEDGES AND AGREES THAT DETECTMONKEY IS STRICTLY A DETECTION AND ALERTING SENSOR LAYER. UNLESS CUSTOMER SEPARATELY EXECUTES A WRITTEN INCIDENT RESPONSE RETAINER OR EXPLICITLY TRIGGERS AN AUTHORIZED CONTAINMENT WORKFLOW, WILLIS BROWN INC. / DETECTMONKEY DOES NOT AND WILL NOT REMEDIATE THREATS, QUARANTINE WORKSTATIONS OR SERVERS, BLOCK NETWORK TRAFFIC, TERMINATE PROCESSES, DISABLE ACCOUNTS, OR MODIFY CUSTOMER INFRASTRUCTURE IN ANY MANNER.

3.3 Customer Decision Authority. When DetectMonkey emits an alert, Customer (and/or Customer's internal IT team or designated Managed Service Provider) is solely responsible for investigating the alert, verifying its operational impact, and executing any containment, eradication, patching, credential rotation, or recovery actions.

04 No Guarantee of Threat Prevention or Exhaustive Detection

4.1 OBLIGATION OF MEANS, NOT SECURITY OUTCOME. CYBERSECURITY THREATS, RANSOMWARE OPERATORS, ZERO-DAY EXPLOITS, AND LIVING-OFF-THE-LAND TECHNIQUES EVOLVE CONTINUOUSLY. WILLIS BROWN INC. (CODEIN.CA / DETECTMONKEY) DOES NOT AND CANNOT ASCERTAIN, WARRANT, OR GUARANTEE THAT MALICIOUS THREATS, UNAUTHORIZED USERS, OR HOSTILE EVENTS WILL NOT TAKE PLACE ON CUSTOMER'S SYSTEMS, NOR THAT EVERY INTRUSION, ANOMALY, OR COMPROMISE WILL BE DETECTED OR ALERTED UPON.

4.2 False Positives and False Negatives. Telemetry-based threat detection inherently involves probabilistic rules and behavioral thresholds. Customer acknowledges that: (a) malicious activity may evade detection rules or occur outside monitored telemetry sources (false negatives); and (b) legitimate administrative or user activity may trigger alerts (false positives). Neither a false negative nor a false positive constitutes a breach of this Agreement or negligence by Willis Brown Inc.

05 Customer Shared Responsibility & Telemetry Dependencies

DetectMonkey can only evaluate telemetry that actually reaches Willis Brown Inc.'s Canadian ingestion brokers in a valid, supported format. Willis Brown Inc. shall have zero responsibility or liability for any delayed, missed, or incomplete detection arising from:

• Unmonitored Assets or Log Sources: Endpoints, servers, shadow IT, BYOD devices, cloud tenants, or firewalls where edge collectors (e.g., Vector, Sysmon, auditd) have not been installed, configured, or kept running by Customer.
• Telemetry Dropouts & Network Path Failures: Local power outages, firewall egress blocks, expired mTLS certificates, revoked API keys, or upstream ISP disruptions preventing events from streaming to DetectMonkey.
• Customer Alert Fatigue or Inaction: Failure of Customer's personnel to monitor their designated email, Slack, webhook, or console channels, or failure to take timely containment and remediation steps after an alert is emitted.
• Baseline Security Hygiene: Customer's failure to maintain endpoint protection (EDR/AV), multi-factor authentication (MFA), timely OS/application patching, network segmentation, and offline immutable backups.

06 Not an Insurance Policy; Mandatory Customer Cyber Insurance & Backups

6.1 Software Subscription, Not Insurance. Willis Brown Inc. is a software and security telemetry provider, not an insurance company or financial guarantor. The subscription fees charged for DetectMonkey ($150.00 CAD per month for Monitoring, including up to 10 monitored seats) reflect the economic value of an automated streaming alert feed and would be orders of magnitude higher if Willis Brown Inc. assumed any financial risk for Customer's business losses or cyber incidents.

6.2 Customer Duty to Insure and Backup. Customer covenants that it will maintain: (a) daily, tested, offline/immutable backups of all critical business data and systems; and (b) commercially adequate first-party and third-party Cyber Liability and Business Interruption insurance covering its own organization.

07 Subscription Billing, Stripe Processing & Console Access Gate

7.1 Stripe Merchant of Record. All subscription payments on codein.ca are processed in Canadian Dollars (CAD) via Stripe under Willis Brown Inc.'s merchant account (acct_1RsbeNCxWb9Qb1gR). DetectMonkey Monitoring is billed monthly at $150.00 CAD per month (up to 10 monitored seats included), plus optional add-ons if selected.

7.2 Strict Subscription Gate to Authenticated Console. Access to the authenticated DetectMonkey console (/console) and collector ingestion credentials is strictly conditioned upon: (a) prior execution of this Agreement; and (b) verified confirmation from Stripe that Customer's subscription status is active (or valid trialing where explicitly authorized). Upon cancellation, non-payment, or chargeback, console access and telemetry ingestion are suspended automatically.

08 Disclaimer of Warranties ("AS-IS" and "AS-AVAILABLE")

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE CANADIAN LAW, THE DETECTMONKEY PLATFORM, CODEIN.CA WEBSITE, RULESETS, ALERTS, AND ALL RELATED SERVICES ARE PROVIDED BY WILLIS BROWN INC. STRICTLY ON AN "AS-IS" AND "AS-AVAILABLE" BASIS. WILLIS BROWN INC. EXPRESSLY DISCLAIMS ALL WARRANTIES, REPRESENTATIONS, AND CONDITIONS OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR COLLATERAL, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, MERCHANTABLE QUALITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, COMPATIBILITY, OR THAT THE PLATFORM OR ALERTS WILL BE UNINTERRUPTED, TIMELY, COMPLETE, OR ERROR-FREE.

09 Exclusion of Consequential Damages & Limitation of Liability Cap

9.1 EXCLUSION OF INDIRECT, CONSEQUENTIAL, AND CYBER BREACH DAMAGES. IN NO EVENT SHALL WILLIS BROWN INC. (INCLUDING ITS DIRECTORS, OFFICERS, FOUNDERS, EMPLOYEES, ANALYSTS, SUBCONTRACTORS, AND AFFILIATES OPERATING AS CODEIN CYBERSECURITY OR DETECTMONKEY) BE LIABLE TO CUSTOMER OR ANY THIRD PARTY UNDER ANY LEGAL OR EQUITABLE THEORY (WHETHER IN CONTRACT, TORT, NEGLIGENCE, GROSS NEGLIGENCE, STRICT LIABILITY, STATUTE, OR OTHERWISE) FOR ANY: (A) INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES; (B) RANSOMWARE EXTORTION PAYMENTS, CRYPTOCURRENCY TRANSFERS, OR WIRE FRAUD / BUSINESS EMAIL COMPROMISE LOSSES; (C) LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF BUSINESS, OR BUSINESS INTERRUPTION / DOWNTIME; (D) LOSS, CORRUPTION, OR EXFILTRATION OF DATA OR COST OF DATA RESTORATION / FORENSIC INVESTIGATION; OR (E) REGULATORY FINES, PENALTIES, OR THIRD-PARTY LITIGATION COSTS (INCLUDING UNDER PIPEDA, QUEBEC LAW 25, GDPR, OR PROVINCIAL PRIVACY STATUTES), EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

9.2 MAXIMUM AGGREGATE LIABILITY CAP. SUBJECT TO SECTION 9.1, THE TOTAL CUMULATIVE AND AGGREGATE LIABILITY OF WILLIS BROWN INC. (D/B/A CODEIN CYBERSECURITY / DETECTMONKEY) ARISING OUT OF OR RELATING TO THIS AGREEMENT, THE PLATFORM, OR ANY MISSED, DELAYED, OR INACCURATE ALERT SHALL NOT EXCEED THE LESSER OF: (I) THE TOTAL SUBSCRIPTION FEES ACTUALLY PAID BY CUSTOMER TO WILLIS BROWN INC. FOR THE DETECTMONKEY MONITORING SERVICE DURING THE SIX (6) MONTHS IMMEDIATELY PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY; OR (II) FIVE HUNDRED CANADIAN DOLLARS ($500.00 CAD) IF THE EVENT OCCURS DURING ANY FREE PILOT, EARLY ACCESS, OR UNPAID EVALUATION PERIOD.

9.3 Essential Basis of the Bargain (Supreme Court of Canada Tercon Allocation). The Parties expressly acknowledge that the disclaimers in Sections 3, 4, and 8 and the exclusions and liability caps in this Section 9 represent a deliberate, commercially reasonable allocation of risk between sophisticated commercial entities under Canadian law, and that Willis Brown Inc. would not provide DetectMonkey at the stated subscription pricing without these limitations.

10 Customer Indemnification

Customer agrees to defend, indemnify, and hold harmless Willis Brown Inc., its officers, directors, founders, employees, and agents from and against any and all third-party claims, lawsuits, demands, regulatory investigations, damages, settlements, liabilities, and reasonable legal fees arising out of or relating to: (a) any cyberattack, data breach, ransomware event, or unauthorized access occurring on Customer's systems or networks (or those of Customer's end-clients if Customer is an MSP); (b) Customer's deployment of telemetry collectors or failure to obtain necessary consents to stream telemetry to DetectMonkey; or (c) Customer's breach of this Agreement or applicable law.

11 Canadian Data Sovereignty, Privacy & Telemetry Retention

11.1 Canadian Processing & Residency. DetectMonkey is a self-hosted platform. Willis Brown Inc. operates the DetectMonkey service on private servers owned and operated by Codein in the Province of New Brunswick, Canada, and processes and stores all Customer security telemetry on that same private infrastructure. No Customer telemetry is processed or stored in a public cloud, and no public cloud provider hosts the DetectMonkey service. Customer retains ownership of its raw telemetry data and grants Willis Brown Inc. a limited license to ingest, normalize, evaluate, store, and display such telemetry solely to provide and improve the DetectMonkey service.

11.2 PIPEDA & Provincial Privacy Compliance. Customer is the data controller of any personal information (such as usernames, employee email addresses, or IP addresses) contained within security logs and warrants that it has lawful authority under PIPEDA and applicable provincial privacy laws to transmit such security telemetry for threat detection purposes. Willis Brown Inc. acts as the processor of that personal information, processing it on Customer's behalf and in accordance with Customer's documented instructions for the purposes set out in Section 3 and Section 11.1, and retains it only for as long as required to provide the DetectMonkey service and meet applicable legal obligations. Willis Brown Inc. applies appropriate technical and organizational safeguards to protect that personal information in transit and at rest, and does not sell, rent, or otherwise disclose it to third parties.

12 Governing Law, Exclusive Venue & Severability

12.1 New Brunswick Law & Venue. This Agreement and any dispute or claim arising out of or in connection with it shall be governed by and construed exclusively in accordance with the laws of the Province of New Brunswick and the federal laws of Canada applicable therein, without regard to conflict of law principles. The Parties irrevocably attorn to the exclusive jurisdiction of the courts of the Province of New Brunswick sitting in the Judicial District of Moncton or Saint John.

12.2 Severability & Entire Agreement. If any provision of this Agreement is held invalid or unenforceable, that provision shall be enforced to the maximum extent permissible and the remaining provisions shall remain in full force and effect. This Agreement constitutes the entire agreement between Willis Brown Inc. and Customer regarding DetectMonkey and supersedes all prior marketing materials, proposals, or oral statements.