The Keyfactor End User License Agreement is the standard contract for Keyfactor software. It is a legal agreement between Keyfactor, Inc., a Delaware corporation, and the customer, effective as of the date of the initial Order Form between them.[1] By operating, downloading, installing or otherwise using the software, the customer represents that it bought the software from an approved source and agrees to be bound.[1] “Software” means each software product or module described in an Order Form, so the EULA does not itself list products or metrics; those come from the Order Form.[1]
Order Forms and metrics
An Order Form is the applicable order form, quote, statement of work or other ordering document agreed in writing between the customer and Keyfactor or a Keyfactor-authorized reseller. Under the EULA the parties enter into an Order Form describing the software, hardware, professional services, license metrics, fees and other details, and each Order Form references the EULA and becomes part of it once both parties execute it. In a conflict the Order Form takes precedence over the EULA, but only for that Order Form.[1] Terms on a customer’s purchase order are not binding on Keyfactor unless signed by an authorized representative of both parties.[1] Catalog proof: Order Form takes precedence over the EULA; Order Form license metric.
For the asset manager this means that every counting rule starts at the Order Form. The EULA names the kinds of metric it expects: the number of licences or instances of the software used, the number of environments, the number of digital certificates issued or managed, and the number of endpoints monitored or managed.[1] Product documentation then defines how a given metric is measured, for example actioned certificates for Keyfactor Command, which is covered in Keyfactor Command licensing and actioned certificates.
Licence grant and restrictions
Subject to payment of fees and the license metrics on the Order Form, Keyfactor grants a revocable, non-exclusive, non-transferable, limited licence to access and use the software and documentation solely for the customer’s internal business purposes, during the applicable Subscription Term, and in accordance with the documentation and the EULA.[1] The EULA lists restrictions on the customer and on anyone it permits. They include copying, modifying or creating derivative works of the software; renting, leasing, selling, sublicensing, assigning, distributing or otherwise making the software available or commercially exploiting it; reverse engineering; removing proprietary notices; using it in a way that infringes rights or violates law; introducing malicious code; and gathering intelligence about the software for a competitive offering.[1] The customer remains responsible for all uses that arise from its provision of access, whether or not permitted, and is liable for any violation by an Authorized User.[1] Catalog proof: EULA licence is revocable, limited and for the Subscription Term; EULA bars sublicensing and making the Software available to others; Customer is liable for Authorized Users.
Authorized Users
An “Authorized User” is an employee, consultant, contractor or agent of the customer who is authorized to access the software and for whom access has been purchased. For software specifically designed to let the customer’s own customers, suppliers or other third parties interact with the customer, those third parties are Authorized Users.[1] This is relevant where a certificate portal or enrollment service is exposed to external parties. Catalog proof: Third parties can be Authorized Users for externally facing Software.
Vendor Review: usage reporting and excess use
For software that Keyfactor does not host, Keyfactor may ask, no more than once per calendar quarter, for a complete and accurate report of the customer’s monthly usage over the prior 12 months, in a format Keyfactor reasonably specifies and in line with the Order Form metrics. The EULA’s examples are licences or instances used, environments, digital certificates issued or managed, and endpoints monitored or managed.[1] If the reports show use beyond the licence granted by the EULA or the Order Form, Keyfactor invoices the excess at its then current list price for the software.[1] The clause has no stated audit right of entry to premises, no notice period for the request and no threshold above which the customer bears Keyfactor’s costs, so those points would need to be read from the Order Form. Catalog proof: Quarterly usage report on request for non-hosted Software; Usage report may cover certificates, endpoints, instances and environments; Excess use is invoiced at current list price.
Customers can keep the evidence needed for this report from within the products: Keyfactor Command, for instance, can download a usage log that contains the licence features and the actioned certificate counts.[2]
Payment, resellers and hardware
Fees are paid under the pricing and terms on the Order Form. If the customer buys through a Keyfactor-authorized reseller it pays the reseller under that contract.[1] Fees are net amounts payable without deduction for taxes or duties, and the customer bears taxes other than those on Keyfactor’s net income or employees.[1] Hardware appears on an Order Form under a separate Hardware Addendum incorporated by reference, and professional services are provided under the Professional Services Terms and Conditions.[1] Catalog proof: Reseller purchases are paid to the reseller; Hardware and professional services are governed by separate terms.
Term, renewal and price increases
The EULA remains in effect until terminated. Each Order Form has an Initial Term and renews automatically under its own terms or, if none are stated, for successive one-year Renewal Terms, unless either party gives written notice of termination at least 60 days before the end of the term. The Initial Term and Renewal Terms together are the “Subscription Term”. For a Renewal Term, unless the Order Form designates the pricing as one-time, per-unit pricing under a multi-year subscription increases by 3% annually on a compounded basis, while a one-year subscription renews at an 8% increase over the price for the prior term.[1] These figures apply by default when the Order Form is silent; a negotiated Order Form can differ. Catalog proof: Order Forms renew automatically unless 60 days’ notice is given; Renewal uplift is 3% a year for multi-year and 8% for one-year subscriptions; Multi-year renewal uplift compounds at 3%.
Termination, suspension and survival
Keyfactor may terminate the EULA or any Order Form on written notice if the customer breaches its obligations under the access and use article, and has no liability for resulting loss. Either party may terminate for the other’s material breach that cannot be cured or remains uncured 30 days after notice, or on insolvency events.[1] Keyfactor may also suspend access to part or all of the software if the customer breaches the access and use article or the customer’s or an Authorized User’s access is the source of a threat or attack on Keyfactor or another client, and it resumes access after the cause is cured.[1] On termination of the EULA all licences end and the customer must stop using the software and documentation, while termination of one Order Form leaves the EULA in place for the others.[1] Catalog proof: Keyfactor may terminate for breach of the access and use article; Keyfactor may suspend access for breach or threat.
Liability, indemnity and governing law
Each party’s aggregate liability is capped at the total paid to Keyfactor under the EULA in the twelve months before the event giving rise to the claim. The cap does not apply to indemnification obligations, to a party’s breach of the access and use article or the confidentiality article, or to fraud, gross negligence or wilful misconduct. Indemnification liability is capped separately at one million dollars.[1] So, although the general cap resembles other vendors’ terms, unlicensed use that breaches the access and use article sits outside it. Keyfactor indemnifies the customer against third-party claims that the software infringes intellectual property rights, with exclusions for combinations, use outside the authorized scope and failure to apply updates, and it may modify, replace or terminate the affected software.[1] The EULA is governed by the laws of the State of Ohio, with exclusive jurisdiction in the federal courts or the courts of the State of Ohio located in Cleveland and Cuyahoga County.[1] Catalog proof: Liability cap excludes breach of the access and use article.
Assignment and affiliates
Neither party may assign the EULA or any right under it without the other’s consent, which is not to be unreasonably withheld or delayed, except that either party may assign with prompt written notice in connection with a sale of all or substantially all of its assets.[1] Customer or Keyfactor affiliates can adopt the EULA by signing an Order Form that references it.[1] Catalog proof: Assignment needs consent.
Out of scope
This article does not cover the Hardware Addendum, the Professional Services Terms and Conditions, the data processing terms or Keyfactor’s technical and organizational measures. It does not address the open-source licences of EJBCA and SignServer Community, which are in EJBCA and SignServer licensing.