Frictionless B2B Legal & InfoSec Procurement Packet
Standard 2-Page Enterprise Order Form & Master Zero-Egress EULA
Designed so Enterprise InfoSec, Legal, and Procurement teams can review and approve CipherMap in a single pass. Fill in your organization details below and save directly as a clean 2-page PDF, download the plain Markdown template for legal redlines, or email licensing@ciphermap.io for same-day countersignature and Net-30 PO invoicing.
0 bytes of source code, keys, or PII leave your environment.ZLF7244KA7 & Microsoft Authenticode signed.Page 1 of 2 — Enterprise Commercial Order Schedule
Document Ref: CM-ORDER-EULA-2026.10 · Incorporates Master Zero-Egress Software License Terms (Page 2)
1A. Licensor (Vendor)
- Legal Entity:
- Ciphermap Technologies LLC
- Legal Notice Address:
- 1500 N Grant St, #11719, Denver, CO 80203, United States
- Licensing & Redlines Desk:
- licensing@ciphermap.io
- Signed Release Provenance:
- macOS
Developer ID Application: Ciphermap Technologies LLC (ZLF7244KA7)· Windows Authenticode · PublishedSHA-256&Ed25519.textseal
1B. Customer (Licensee)
2. Option A Commercial License Tier Selection (USD · Billed Annually)
| Select | Plan & SKU | Annual Fee | Licensed Allowance & Included Deliverables |
|---|---|---|---|
| Tier A — Standalone AuditorCM-TIER-A-AUDITOR | $4,999 / yr | 1 Repo · 1 Auditor Seat · Unlimited LOC ($0 per-LOC fees) — governed by Active Contributors + Repository Band. CycloneDX 1.6 CBOM, SPDX 2.3 & PQC OpenVEX 0.2.0 exports, detached Ed25519 + ML-DSA-65 (.pqc.sig) artifact signing, T0/T1 blame-separated diagnostics, and Gate 2 AST hash/cipher fixes (--zero-attestation). | |
| Tier B — Startup FleetCM-TIER-B-STARTUP | $9,999 / yr($7,499/yr Partner*) | Up to 25 Repos · Up to 10 Devs · Unlimited LOC ($0 per-LOC fees) — governed by Active Contributors + Repository Band. Includes 12-language Immunity Engine (immunity scan, 4-gate immunity extinguish --apply, fix --with-immunity --apply, signed CycloneDX 1.6 CISA IBOM & OpenVEX 0.2.0 via immunity attest, immunity ratchet), CI/CD PR gates (ci-review), ciphermap mcp local AI referee, and self-hosted ciphermap server CISO Web Console. | |
| Tier B — Growth FleetCM-TIER-B-GROWTH | $24,999 / yr($18,749/yr Partner*) | Up to 100 Repos · Up to 30 Devs · Unlimited LOC ($0 per-LOC fees) — governed by Active Contributors + Repository Band. Full Tier B Fleet platform (immunity scan, immunity extinguish --apply, fix --with-immunity --apply, immunity attest CISA IBOM, ciphermap mcp referee, .cursor/rules + CLAUDE.md policy ratchets, hybrid ML-KEM-768 + X25519 sidecars, Jira closure & zero-PII PRF_seat verification). | |
| Tier B — Scale FleetCM-TIER-B-SCALE | $49,999 / yr($37,499/yr Partner*) | Up to 250 Repos · Up to 100 Devs · Unlimited LOC ($0 per-LOC fees) — governed by Active Contributors + Repository Band. Full Tier B Multi-Repo Fleet platform across multi-business-unit portfolios with priority solutions engineering onboarding. | |
| Sovereign / Air-GappedCM-TIER-B-SOVEREIGN | Scoped Exhibit | >100 active contributors, dormant --legacy-archive estates, or air-gapped SCIF enclaves with offline LKG rulepacks & RFC 9180 HPKE ML-KEM-768 policy capsules. |
Express 30-Day 100% Fleet Upgrade Credit: 100% of fees paid for Tier A Standalone Auditor ($4,999) may be credited dollar-for-dollar toward an annual Tier B Multi-Repo Fleet Order executed within thirty (30) calendar days of the Tier A Effective Date. (*25% Founding Reference Partner annual rate applies only when mutually confirmed in writing with agreed pilot feedback and logo/case-study approval.)
Incorporation & Precedence: By executing this Order Form, the parties agree to be bound by this Commercial Order Schedule and the Master Zero-Egress Software License Terms (EULA) on Page 2, which together form the complete agreement and supersede any pre-printed terms on a Customer purchase order or vendor portal click-wrap unless expressly accepted in a countersigned writing.
Page 2 of 2 — Master Zero-Egress Software License Terms (EULA)
1. Zero Customer Data Processing & Air-Gap Architecture (DPA Exemption)
CipherMap is delivered as a statically compiled (CGO_ENABLED=0) local software binary designed for offline execution (--offline --no-telemetry). During normal operation, Licensor receives, accesses, stores, and processes zero (0) bytes of Customer source code, object code, cryptographic keys, X.509 certificates, repository file paths, secrets, or personal data. Because Licensor acts strictly as a local/on-premises software licensor and never as a cloud custodian, data processor, or subprocessor of Customer repository or production data, no SaaS Data Processing Addendum (DPA), Standard Contractual Clauses, or Subprocessor Schedule is required for software deployment.
2. License Grant & Air-Gapped Enclave Rights
Subject to timely payment of applicable Order Form fees, Licensor grants Customer a worldwide, non-exclusive, non-transferable, non-sublicensable subscription license during the Subscription Term to install and execute the licensed CipherMap binary and rulepacks across Customer's internal developer workstations, self-hosted CI/CD runners, private VPC containers, and air-gapped or SCIF build enclaves up to the seat or active-contributor allowance selected on Page 1 (verifiable locally via zero-PII PRF_seat cryptographic nullifiers). Customer shall not decompile or reverse-engineer the software except to the non-waivable extent permitted by law, bypass cryptographic license verification, or host the software as a commercial service bureau for third parties without a separate written addendum.
3. Binary Provenance & Integrity
Licensor signs official macOS distributions with Apple Developer ID Application: Ciphermap Technologies LLC (ZLF7244KA7) (Apple-notarized), signs official Windows distributions via Microsoft Authenticode, and publishes deterministic SHA-256 archive digests together with Ed25519 .text binary integrity seals (ciphermap doctor --offline) for every production build.
4. Deterministic Verification & Customer Merge Authority
CipherMap remediation commands (ciphermap fix and immunity extinguish) execute syntax, compiler, and test-suite checks locally inside network-denied sandboxes with T0/T1 baseline fault isolation (PRE_EXISTING_REPO_ERROR / MISSING_HOST_DEPENDENCY), automatically rolling back failed candidates or wire-breaking protocol edits (declined_protocol_guardrail). Customer retains sole authority and engineering responsibility for reviewing, testing, approving, merging, and deploying code changes. Outputs provide scoped technical and audit evidence and do not constitute legal advice, a compliance determination, or third-party accreditation.
5. Optional Collective Herd Immunity (Strict Opt-In Zero-Code Boundary)
Collective Herd Immunity (ciphermap herd-immunity) is disabled by default. Even if explicitly opted into by Customer, any exported receipt contains solely anonymized 12-node AST token shapes and emits 0 source lines, 0 identifiers or variable names, 0 string literals, 0 file paths, and 0 Customer or repository identity.
6. Proprietary Rights & Confidentiality
Customer retains 100% right, title, and interest in and to its repositories, source code, generated remediation diffs, and exported CBOM, IBOM, OpenVEX, and SARIF reports. Licensor retains all right, title, and interest in and to the CipherMap software, rulepacks, documentation, and trademarks. Each party shall protect the other party's non-public Confidential Information using at least reasonable care and not disclose it except to bound personnel or advisors with a need to know for three (3) years from disclosure (and perpetually for trade secrets).
7. Warranties, IP Indemnification & Limitation of Liability
(a) Warranties: Licensor warrants during the Subscription Term that unmodified production software will conform in all material respects to published documentation and contain no malicious code, backdoors, or undocumented network egress (“phone-home”) routines; Customer's exclusive remedy for an uncured breach (30 days' notice) is termination and a pro-rata refund of prepaid, unused fees (all other implied warranties of merchantability or fitness are disclaimed). (b) IP Defense: Licensor will defend Customer against unaffiliated third-party claims alleging that authorized use of unmodified CipherMap software directly infringes a valid U.S. copyright, trademark, or patent, and pay final court-awarded damages or Licensor-approved settlements (subject to prompt notice and defense control). (c) Liability Cap: EXCEPT FOR BREACH OF SECTION 2 (LICENSE RESTRICTIONS), SECTION 6 (CONFIDENTIALITY), PAYMENT OBLIGATIONS, OR SECTION 7(b) INDEMNIFICATION, NEITHER PARTY SHALL BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, AND EACH PARTY'S AGGREGATE CUMULATIVE LIABILITY UNDER THIS AGREEMENT SHALL NOT EXCEED TWELVE (12) MONTHS OF FEES ACTUALLY PAID BY CUSTOMER UNDER THE APPLICABLE ORDER FORM PRECEDING THE CLAIM.
8. Term, Non-Auto-Renewing PO Option & Governing Law
Unless otherwise stated on Page 1, the Subscription Term is twelve (12) months from the Effective Date. Purchase-order / Net-30 invoice subscriptions do not auto-renew and renew solely upon execution of a mutual written renewal Order Form (card-billed subscriptions renew only if Customer affirmatively selects recurring card billing at checkout and may be cancelled prior to renewal). Either party may terminate for material breach uncured within thirty (30) days of written notice; exported Customer CBOM/IBOM/OpenVEX reports remain Customer's property perpetually. This Agreement is governed by the laws of the State of Delaware, excluding conflict-of-laws rules, with exclusive venue in the state and federal courts located in Delaware. Formal legal notices to Licensor shall be sent to licensing@ciphermap.io with a copy to Ciphermap Technologies LLC, 1500 N Grant St, #11719, Denver, CO 80203, United States.