Yubico Support Services Agreement
Updated January 1, 2021
Yubico Support Services Agreement
Yubico agrees to provide Yubico maintenance and technical support services (“Support Services”) to the customer (“Customer”) who has purchased such Support Services based on the following terms and conditions of this Yubico Support Services Agreement (“Support Services Agreement”). “Yubico” means: Yubico, Inc., 530 Lytton Avenue, Suite 301, Palo Alto, CA 94301, U.S.A. if Customer is acquiring the Support Services in the Americas; and Yubico AB, Kungsgatan 44, Third floor, 111 35 Stockholm, Sweden if Customer is acquiring the Support Services outside of the Americas. References to the “parties” or a “party” shall mean Customer and Yubico, as applicable.
- Scope. This Support Services Agreement shall govern Yubico’s provisioning of Support Services. The purchase and licensing of Yubico products (“Products”) shall be governed by the Yubico Sale and License Agreement or other written purchase agreement separately agreed upon by the parties (“Purchase Agreement”) and not this Support Services Agreement.
- Performance of Services. Subject to Customer’s payment of the applicable Support Services fees, Yubico will perform the Support Services specified in the Yubico sales order form (“Order Form”) in accordance with the terms and conditions of this Support Services Agreement, and as further specified in the Support Services Exhibit, attached.
- Discretionary Support. If Customer has purchased Support Services pursuant to an Order Form, then this Section is not applicable. If Customer has not purchased Support Services pursuant to an Order Form, then Yubico will have no obligation to provide Support Services to Customer. If Yubico, in its sole discretion elects to provide support to Customer, it shall not be subject to this Support Services Agreement and is provided on an “as is” basis without any warranties, service levels or obligations; similarly, in no event shall Yubico be liable for any damage arising from providing such discretionary support.
- Designated Contacts. Each party will designate one or more individuals who will serve as the point(s) of contact between the parties for all matters relating to Support Services to be performed thereunder. A party may designate new contacts by written notice to the other party.
- Relationship of the Parties. Yubico is performing Support Services as an independent contractor and nothing in this Support Services Agreement will be construed as establishing an employment, agency, partnership or joint venture relationship between Customer and Yubico or any Yubico personnel.
- Fees. For Yubico’s performance of the Support Services, Customer will pay Yubico fees as specified in the Order Form.
- Interest. All past due amounts will incur interest at a rate of 1.5% per month or the maximum rate permitted by law, whichever is greater. Customer will reimburse Yubico for all reasonable costs and expenses incurred (including reasonable attorneys’ fees) in collecting any overdue amounts.
- Payment Terms and Taxes. Fees for Support Services will be invoiced upfront and Customer will pay such invoice no later than 30 days from the invoice date, provided that Yubico reserves the right to require prepayment if Customer has exhibited questionable credit worthiness or has failed to adhere to payment terms for prior Yubico purchases. Customer will pay all amounts due under this Support Services Agreement in U.S. currency. All fees, expenses and other amounts payable to Yubico hereunder are net amounts and are payable in full, and do not include any sales, use, withholding, value added or other applicable taxes, tariffs, duties, or out-of-pocket expenses, payment of which will be the sole responsibility of Customer (excluding any taxes based on Yubico’s net income). Customer will promptly reimburse Yubico for any such amounts that Yubico pays on Customer’s behalf.
- Definition. “Confidential Information” means: (a) all aspects of the Product and Services; (b) all documentation marked “Do Not Copy” or “Yubico Confidential;” (c) any business or technical information of Yubico or Customer that, if disclosed in writing, is marked “confidential” or “proprietary” at the time of disclosure, or, if disclosed orally, is identified as “confidential” or “proprietary” at the time of disclosure, and is summarized in a writing sent by the disclosing party to the other party within 30 days of such disclosure; (d) the specific terms and pricing set forth in this Support Services Agreement and any corresponding Statements of Work; (e) Customer Materials and Yubico Materials; and (f) any information that, due to its nature or under the circumstances of its disclosure, the receiving party knows or has reason to know should be treated as confidential or proprietary.
- Exclusions. Confidential Information does not include information that: (a) is or becomes generally known to the public through no fault of or breach of this Support Services Agreement by the receiving party; (b) is rightfully known by the receiving party at the time of disclosure without an obligation of confidentiality; (c) is independently developed by the receiving party without use of the disclosing party’s Confidential Information; or (d) the receiving party rightfully obtains from a third party without restriction on use or disclosure.
- Use and Disclosure Restrictions. Each party will not use the other party’s Confidential Information except as necessary for the performance of this Support Services Agreement and will not disclose such Confidential Information to any third party except to those of its employees and subcontractors that need to know such Confidential Information for the purpose of performing this Support Services Agreement, provided that each such employee and subcontractor is subject to a written agreement that includes binding use and disclosure restrictions that are at least as protective as those set forth herein. Each party will use all reasonable efforts to maintain the confidentiality of all such Confidential Information in its possession or control, but in no event less than the efforts that such party uses with respect to its own proprietary information of similar nature and importance.
- Compelled Disclosures. The foregoing obligations will not restrict either party from disclosing Confidential Information of the other party: (a) pursuant to the order or requirement of a court, administrative agency, or other governmental body, provided that the party required to make such a disclosure, to the extent permissible under applicable law, gives reasonable notice to the other party to contest such order or requirement; and (b) on a confidential basis to its legal or financial advisors. In addition, each party may disclose the terms and conditions of this Support Services Agreement: (x) as required under applicable securities regulations; and (y) on a confidential basis to present or future providers of venture capital and/or potential private investors in or acquirers of such party.
EXCEPT FOR THE LIMITED WARRANTIES AS SET FORTH IN THIS SUPPORT SERVICES AGREEMENT, YUBICO DISCLAIMS ALL OTHER WARRANTIES, REPRESENTATIONS OR CONDITIONS, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED FROM YUBICO OR ELSEWHERE WILL CREATE ANY WARRANTY NOT EXPRESSLY STATED IN THIS SUPPORT SERVICES AGREEMENT.
- Limitation of Liability
IN NO EVENT WILL YUBICO BE LIABLE TO CUSTOMER OR TO ANY THIRD PARTY FOR ANY SPECIAL, INCIDENTAL, PUNITIVE, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING LOSS OF USE, DATA, BUSINESS OR PROFITS) OR FOR COSTS OF PROCURING SUBSTITUTE SUPPORT SERVICES, ARISING OUT OF OR IN CONNECTION WITH THIS SUPPORT SERVICES AGREEMENT OR THE SUPPORT SERVICES, OR THE USE OR PERFORMANCE OF THE SUPPORT SERVICES, HOWEVER CAUSED A/ND REGARDLESS OF THE THEORY OF LIABILITY, EVEN IF YUBICO HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YUBICO’S TOTAL LIABILITY TO CUSTOMER, FROM ALL CAUSES OF ACTION AND ALL THEORIES OF LIABILITY, WILL BE LIMITED TO AND WILL NOT EXCEED THE AMOUNTS PAID TO YUBICO BY CUSTOMER UNDER THE STATEMENT OF WORK GIVING RISE TO ANY LIABILITY HEREUNDER.
During the term of this Support Services Agreement and for a period of 12 months thereafter, Customer will not recruit or otherwise solicit for employment any Yubico employees or subcontractors who participated in the performance of Support Services without Yubico’s express prior written approval.
- Term and Termination
- Term. This Support Services Agreement will commence on the Effective Date and, unless terminated earlier in accordance with the terms of this Support Services Agreement, will remain in force and effect for as long as Yubico is performing Support Services pursuant to any Order Form and/or Statement of Work.
- Termination. Either party may terminate this Support Services Agreement (including all related Support Services subscriptions in Order Forms) if the other party breaches any material term of this Support Services Agreement and fails to cure such breach within 30 days after receipt of written notice of such breach. Termination of the Purchase Agreement will terminate this Support Services Agreement and related Support Services subscriptions in Order Forms.
- Effect of termination; Survival. Upon termination of this Support Services Agreement: (a) Customer will promptly (i) return to Yubico the applicable portions of the Support Services not owned by Customer and all related copies and portions; and (ii) return or destroy all Confidential Information of Yubico to Yubico;; and (iii) Customer will, within 30 days after receipt of Yubico’s invoice, pay all accrued and unpaid fees and expenses and (b) Yubico will promptly (i) return to Customer all Customer Materials, and (ii) return or destroy all Confidential Information of Customer to Customer. The rights and obligations of the parties contained in Sections 2, 3, 4, 5, 6, 7, 8.2 and 8.3 will survive the expiration or termination of this Agreement or any Statement of Work.
- Assignment. Neither party may assign this Support Services Agreement, in whole or in part, without the other party’s express prior written consent, such consent not to be unreasonably withheld, except that either party may assign this Support Services Agreement in connection with a merger with or into a third party or to an acquirer of all or substantially all of its stock, business or assets to which this Support Services Agreement pertains. Any attempt to assign this Support Services Agreement, without such consent, will be null and of no effect. Subject to the foregoing, this Support Services Agreement will bind and inure to the benefit of each party’s successors and permitted assigns.
- Governing Law and Jurisdiction. This Agreement shall be deemed to have been made in, and shall be construed pursuant to the laws of: (i) the State of California, U.S.A. if you obtained the Support Services from Yubico, Inc.; and (ii) Sweden if you obtained the Support Services from Yubico AB. In either event, the choice of law shall be without regard to the conflict of laws provisions thereof. Furthermore, both parties consent to the exclusive jurisdiction of the courts located in the State of California when California law applies and the courts located in Sweden when the laws of Sweden apply.
- Severability and Waiver. If any provision of this Agreement is held invalid or unenforceable by a court of competent jurisdiction, then such provision shall be deemed severed from this Support Services Agreement and shall not affect the other remaining provisions. The failure by either party to enforce any provision of this Support Services Agreement will not constitute a waiver of future enforcement of that or any other provision.
- Notices. All notices required or permitted under this Support Services Agreement will be in writing and delivered by courier or overnight delivery services, by email, or by certified mail, and in each instance will be deemed given upon receipt. All communications will be sent to the addresses set forth above or to such other address as may be specified.
- Entire Agreement. This Support Services Agreement, together with all Order Forms, constitutes the complete agreement and understanding of the parties with respect to its subject matter and supersedes all prior understandings and agreements, whether written or oral, with respect to its subject matter. No term of any Order Form will be deemed to amend the terms of this Support Services Agreement unless the Order Form references a specific provision in this Support Services Agreement and provides that the Order Form is amending only that specific provision of this Support Services Agreement and only with respect to the Services performed pursuant to such Order Form. Any waiver, modification or amendment of any provision of this Support Services Agreement will be effective only if in writing and signed by the parties.
- Force Majeure. Neither party will be responsible for any failure or delay in its performance under this Support Services Agreement (except for any payment obligations) due to causes beyond its reasonable control, including, but not limited to, labor disputes, strikes, lockouts, shortages of or inability to obtain labor, energy, raw materials or supplies, war, acts of terror, riot, acts of God or governmental action.
Support Services Exhibit
The terms of this Support Services Exhibit (“Support Exhibit”) will only apply if and when Customer has ordered Support Services pursuant to an Order Form.
- Support Plans Offered
Yubico shall provide Support Services in accordance with the Support Plan purchased in the Order Form. The offerings of each Support Plan are set in the table, below:
|Priority Support Problem Reporting and related Support||YubiKey, YubiHSM, YubiHSM KSP, YubiKey Smart Card Minidriver, Yubico PIV Tool, YubiKey Manager, Yubico Authenticator|
|Validation Service (YubiCloud) Support||Only available for purchase as an add-on to one of the Support Plans|
Term: Each Support Plan is based on 12-month terms. The Support Plan start date shall be the first ship date of the associated Product, provided that, if Customer has purchased Professional Services, then the start date shall be set at the end of the Professional Services engagement (to be determined by the Yubico Professional Services personnel). Each Support Plan shall end 12 months after the start date.
Technical Integration Support: the type of Technical Integration Support depends on the complexity of the planned technical integration. For the purposes of illustration, a Basic integration might be OTP with a partner; Intermediate being FIDO U2F/FIDO2 with an integrated partner; and Advanced being Windows SmartCard or Mac OS Smartcard (no CMS). Customer shall purchase the Support Plan applicable to its planned technical integration; Yubico will not provide Technical Integration Support for higher complexity integrations than the applicable complexity level corresponding to the Support Plan Customer purchased.
Technical Integration Support Hours: usage of such hours shall be deducted in 15-minute increments. Customer must use any Technical Integration Support hours included in a Support Plan within the 12-month Support Plan term; there are no roll-over of hours and any remaining hours at the end date of the Support Plan term shall expire. Any remote live hours must be scheduled in advance with Yubico. Customer may purchase additional hours after the allotted hours have been utilized.
Severity Levels and Response Times: Yubico’s Support Services availability and response time is dependent on the applicable Severity Level and is set in the table, below:
|SEVERITY LEVELS||SEV 4||SEV 3||SEV 2||SEV 1|
|Support Available||Business Hours 5am-5pm||Business hours 5am-5pm||24/7 365 days/year||24/7 365 days/year|
|Initial Response Time – Acknowledgement of the issue reported (other than Technical Integration Support)||2 Business Days||1 Business Day||2 Hours||15 min|
|Initial Response Time for Technical Integration Support||2 Business Days||1 Business Day||N/A||N/A|
|Support Request Update Frequency (when Customer reports issue)||N/A||4 Business Hours (updates during business hours)||1h|
|Incident Analysis Reporting to Support Customer (Validation Service(YubiCloud) Only)*||N/A||Provided within 20 Business Days after issue resolution|
* The last two rows of the table are only applicable to Customers who have purchased Validation Service (YubiCloud) Support
Severity levels are defined as:
Severity 1 or “Sev 1” means:
- Validation Service is unavailable
- The Product or Validation Service is in a critical state and is actively impacting a large number of customers or users with no possible Workaround
- Functionality of the Product has been severely impacted
- A Customer-data-exposing security vulnerability has come to our attention
- Sev 1 is not an applicable severity level for Technical Integration Support.
Severity 2 or “Sev 2” means:
- Product or Validation Service experiencing severe performance degradation for most/all users with no practical or easily implementable Workaround.
- Any other event to which a Yubico employee deems necessary of incident response
- Monitoring of Yubico systems for major incident conditions is impaired
- Sev 2 is not an applicable severity level for Technical Integration Support.
Severity 3 or “Sev 3” means:
- The issue is not affecting the majority of customers or users and a practical Workaround exists.
- Something that has the likelihood of becoming an SEV-2 if nothing is done.
- No redundancy in a Yubico Validation Service (failure of 1 more node will cause an outage).
- Individual Yubico host failure (i.e. one node out of a cluster).
Severity 4 or “Sev 4” means:
- General questions relating to the Product or Validation Service and or functionality, including technical integration questions, requests for enhancements.
Business Days and Business Hours: Are based on the Yubico entity from which you are acquiring Support Services. If Yubico, Inc., then Business Days and Business Hours are local to Palo Alto, California, U.S.A., if Yubico AB then local to Stockholm Sweden. Yubico, may, in its sole discretion, provide Support Services from its various worldwide office locations.
- Additional Definitions. Unless otherwise defined herein, defined terms have the same meaning as in the Support Services Agreement and Purchase Agreement.
- “Customer Support Contact(s)” means individuals designated by Customer who are trained on the use of the Product and authorized by Yubico to report Problems and make Support Services inquiries to Yubico Support Contacts.
- “Error” means that the Products (or any part thereof) when used in the operating environment and otherwise according to the instructions of Yubico, do not operate as defined in published specifications in a material respect. Defects or non-conformities causing minor and trivial deviations therefrom are not considered as Errors.
- “Error Corrections” means patches and bug fixes developed by Yubico to correct Errors.
- “Problem” means a problem or error encountered in the reasonable and authorized use of the Software or Product that (i) degrades the performance of the Software or Product as compared to the published specifications applicable to such Software or Product, or (ii) renders one or more features of the Software or Product wholly or partly inoperable.
- “Problem Report” means a reasonable description of a Problem encountered by Customer or its users, including: the User who encountered the Problem, the date and time the Problem was encountered, the operating environment the problem occurred in, the functions the User was attempting, the steps taken by the Customer Support Contact to resolve the problem prior to submitting a Problem Report and a reproducible test case.
- “Update” means Error Corrections, minor enhancements and patches and other minor changes to the Software that are generally made available by Yubico to its Customers at no additional cost pursuant to the Support Services. Updates do not include enhancements to or new versions of Software that provide substantial new, enhanced or different features, functions or performance.
- “Upgrade” means any new functional releases of the Products (including new or additional functionality) provided pursuant to the Support Services. Upgrades will not include any release, options or future products to which Yubico generally grants licenses separately from a license to the Products (such as new YubiKeys).
- “Updated Hardware” means a replacement Product (that is Hardware) designed to correct an identified critical security issue in an existing Product (that is Hardware).
- “Yubico Support Contacts” are those individuals designated by Yubico to assist Customer with Problems. Customer Support Contacts shall communicate with Yubico Support Contacts in order to report and resolve a Problem and respond to inquiries.
- “Workaround” means a change in the procedures followed or data supplied by Customer to avoid an Error without substantially impairing Customer’s use of the Products.
- Standard Offerings. Yubico may provide the following standard offerings to all Customers that have purchased Support Services:
- Web support: Access to Yubico’s online resources, offering the Customer the ability, on a 24×7 basis (24 hours a day, seven days a week), to download documentation, available patches and known bug fixes, incompatibilities, Updates and Workarounds for the Products licensed to Customer.
- Email access to Helpdesk: Email support for general questions related to the use of the Products.
- Hardware Support Services
- Scope of Support Services for Hardware. Subject to the terms in this Support Services Exhibit and the Services Agreement, Yubico will make available to Customer Updated Hardware when Yubico has become aware of a critical security vulnerability with a previous version of a Product (that is Hardware) that could materially adversely affect the security of Customer’s data. The determination of whether a critical security vulnerability exists that could materially adversely affect a Customer’s data shall be made by Yubico in its sole discretion.
- Prompt Replacement of Existing Products. Customer agrees to use commercially reasonable efforts to promptly replace the compromised existing Products (that is Hardware) with the Upgraded Hardware and provide evidence of the destruction of the compromised Products (that is Hardware) to Yubico if requested.
- Software Support Services
- Scope of Support Services. Yubico will provide the following Support Services with respect to the Software:(a) Make available Updates as such Updates become generally available; and(b) Depending upon the Support Plan selected and paid for by Customer, Yubico will work to correct Problems with the Software by e-mail, telephone or electronically from Yubico’s remote support center, or charge an additional fee for onsite support.
- Updates. As permanent solutions are developed for known Errors in the Software, they will be incorporated from time to time in planned Updates. Yubico will make available to Customer, free of additional charge, with such Updates as they are released. Yubico will make available documentation that Yubico considers reasonably necessary to assist in a smooth transition for mitigating the errors.
- Installation of Updates. All Updates will be made available to Customer electronically via secure download from Yubico’s designated site. Customer agrees to use commercially reasonable efforts to promptly download and install all Updates supplied hereunder in order to maintain the Software at the most current revision level. Yubico will only be obligated to provide Support Services for the Software only (i) for the current revision level of the Software, and (ii) for the pre-updated version of the Software for six months following the release of an Update. Customer is solely responsible for all costs of installation of Updates. Notwithstanding anything to the contrary in this Agreement, Yubico disclaims any and all warranties in the Software to the extent Customer does not install any Updates made available by Yubico.
- Problem Reporting. Prior to submitting a Problem Report, Customer shall make all reasonable efforts to resolve the Problem without assistance from Yubico. Customer Support Contacts shall attempt to reproduce any problems reported to them by Customer’s users and only report reproducible Problems to Yubico. For Problems that Customer is unable to resolve itself, Customer Support Contacts shall report the Problem to Yubico by submitting a Problem Report to Customer’s designated Yubico Support Contact. All communications concerning Problem identification and resolution shall occur between Customer Support Contacts and Yubico Support Contacts. Valid Problem Reports must be submitted to Yubico in English.
- Problem Resolution. Yubico shall address reported Problems in accordance with the severity level assigned to such Problem by Yubico, the Support Plan purchased and paid for by Customer. Yubico shall exert good faith, commercially reasonable efforts to achieve the response times set forth in Severity Level table, above. However, Customer acknowledges and agrees that Yubico may not be able to achieve such response times at all times and under all circumstances.
- Exclusions from Support Services
- Customer Errors. Yubico will have no obligation of any kind to provide Support Services of any kind for problems in the operation or performance of Products or Software to the extent caused by any of the following (each, a “Customer-Generated Error”): (a) non-Yubico software or hardware products or use of the Software or Product in conjunction therewith; (b) modifications to the Software or Product made by any party other than Yubico; (c) Customer’s use of the Software or Product other than in a reasonable manner and as authorized by Yubico; and (d) Customer’s use of other than the most current Product and the most current version of the Software or any Error Corrections or Updates made available by Yubico (or pre-updated version of the Software for six months following the release of an Update).
- Single Support Plan. Customer will select and pay Support Services Fees for a single Support Plan (i.e., Gold or Silver) for all of the Products and Software it has acquired. Yubico will not provide Support Services for only a subset of Customer’s Products and Software, and Yubico will not provide Customer with different Support Plans for different Products and Software. Customer may purchase additional hours to its existing Support Plan.
- Warranty and Disclaimer
- Updated Hardware Warranty. The warranty for any Updated Hardware shall persist for the longer of the remaining period of the original one-year Product warranty as described in the Master Agreement or 90 days from the date Yubico ships the Updated Hardware to Customer.
- Support Services Warranty. Yubico warrants that the Support Services will be performed in a workmanlike manner by qualified personnel familiar with the Software and its operations. This warranty will be in effect for a period of 30 days from completion of Yubico’s performance of the affected Support Services.
- Sole Remedy. Except solely as set forth in this Section, Fees for Support Services are non-refundable. As Customer’s sole and exclusive remedy and Yubico’s entire liability for any breach of the warranty set forth in Section 7.2 regarding Yubico’s provision of Software Support Services, Yubico will, at its option: (a) promptly re-perform the Support Services in an attempt to correct any Errors; (b) provide Customer with a reasonable procedure to circumvent the nonconformity; or (c) refund to Customer an equitable portion of the fees paid if the Problem cannot be resolved.
- Disclaimer. Yubico does not warrant that the Updated Products, Updates, Error Corrections, Workarounds and Support Services provided or made available pursuant to this Services Agreement will meet Customer’s requirements, or that the Updated Products, Updates, Error Corrections and Workarounds will work in the combinations that Customer may select, or that the operation of the Updated Products, Updates, Error Corrections, Workarounds and Support Services will be error-free or that all errors in the Products and/or Software will be corrected. Yubico will have no obligation or liability for any Customer-Generated Errors. EXCEPT AS EXPRESSLY SET FORTH HEREIN, (I) ALL UPDATED HARDWARE ARE SUBJECT TO THE SAME TERMS AND CONDITIONS THE PARTIES AGREED TO WITH RESPECT TO THE ORIGINAL PRODUCTS THAT ARE REPLACED BY THE UPDATED HARDWARE, AND (II) ALL UPDATES ARE SUBJECT TO THE SAME TERMS AND CONDITIONS THE PARTIES AGREED TO WITH RESPECT TO THE SOFTWARE MODIFIED OR REPLACED BY THE UPDATES
Subject to the terms and conditions of the Yubico Purchase Agreement and Services Agreement, Customers’ implementing OTP validation using YubiCloud shall:
- Reasonably limit the combined request rate of OTP validation sessions from all YubiCloud clients sharing the Client ID to prevent disruptions to the integrity or performance of the Validation Service;
- Not conduct benchmarking, performance or comparison tests, or security/vulnerability test of the Validation Service in any manner;
- Ensure YubiCloud clients have an up-to-date list of certificate authorities to trust;
- Comply with additional YubiCloud usage requirements made available to Customer from Yubico including but not limited to User Guides.