attachmentAV Customer Terms

Version 1.0 – Effective 12 November 2026

These attachmentAV Customer Terms (the “Terms”) govern the provision of the attachmentAV products and services by widdix GmbH, Blumenstraße 17/1, 73669 Lichtenwald, Germany, registered with the commercial register of the Local Court (Amtsgericht) of Stuttgart under HRB 751512 (“widdix”, “we”, “us”) to the customer identified in the Order (“Customer”, “you”). widdix and Customer are each a “Party” and together the “Parties”.

The Terms consist of this main body, the Product-Specific Terms in Exhibit A, the Data Processing Agreement in Exhibit B (“DPA”), the Acceptable Use Policy in Exhibit C (“AUP”) and the Support Policy in Exhibit D. Capitalised terms are defined in Section 17.

1. The Agreement

1.1 Formation. The Terms become binding on the earlier of (a) Customer accepting the Terms by clicking a button or ticking a box labelled “I agree” (or similar), (b) Customer installing, enabling or configuring a Product, (c) Customer placing an Order, or (d) Customer using a Product (each, “Acceptance”). The Terms, the Order and any Marketplace Terms together form the agreement between the Parties (the “Agreement”).

1.2 Business customers only. The Products are offered exclusively to entrepreneurs within the meaning of Section 14 of the German Civil Code (Bürgerliches Gesetzbuch, “BGB”), i.e. natural or legal persons or partnerships with legal personality acting in the exercise of their trade, business or profession, as well as to legal persons under public law and special funds under public law. By accepting the Terms, Customer confirms that it is acting in that capacity and not as a consumer (Section 13 BGB).

1.3 Authority. The individual accepting the Terms represents that they are authorised to bind Customer. If an individual accepts the Terms on behalf of an entity that has not been identified, that individual is the Customer.

1.4 Order of precedence. In the event of a conflict, the following order of precedence applies: (a) the mandatory provisions of any Marketplace Terms that the operator of a Marketplace requires to take precedence; (b) a written amendment signed by both Parties; (c) the Order; (d) the DPA (for matters of data protection); (e) the Product-Specific Terms; (f) this main body; (g) the AUP and the Support Policy; (h) the Documentation.

1.5 No conflicting terms. Customer’s general terms and conditions, purchase order terms or similar documents do not apply, even if widdix does not expressly object to them or performs the Agreement without reservation.

1.6 Marketplaces. Where Customer obtains a Product through a Marketplace, (a) the Marketplace operator is not a party to the Agreement, except where the Marketplace Terms provide otherwise, (b) widdix is the licensor and provider of the Product, and (c) Customer’s rights and obligations towards the Marketplace operator (including payment, where the Marketplace operator collects Fees) are governed by the Marketplace Terms. The Product-Specific Terms describe the role of each Marketplace operator.

2. Products and Subscriptions

2.1 Products. widdix offers attachmentAV in several variants, each described in Exhibit A (each, a “Product”). The Products scan files for malware using an anti-malware engine and signature databases that are updated regularly, and return a scan result to Customer or to the Platform from which the file originates. The functionality of each Product is described in the Documentation.

2.2 Subscriptions. Customer subscribes to a Product for the Subscription Term set out in the Order. widdix will make the subscribed Product available to Customer in accordance with the Agreement and the Documentation for the Subscription Term.

2.3 Service description; no detection guarantee. The Products perform malware detection in accordance with the state of the art at the time of the scan, based on the detection capabilities of the Engine and its signature databases. Malware detection is a probabilistic process. Accordingly:

1. widdix does not owe, and the Products are not designed to provide, complete or error-free detection of all malware, nor the absence of false positives (files wrongly identified as malicious) or false negatives (malicious files not identified);
2. the scan result is a recommendation based on the Engine’s detection at the time of the scan; the decision on how to handle a scanned file (including any Action) remains with Customer;
3. the Products do not replace a layered security concept, backups or other security measures that Customer would reasonably be expected to maintain.

The contractual service owed by widdix is the performance of the scan as described in the Documentation, not a specific detection outcome. This Section 2.3 is a description of the service (Leistungsbeschreibung) and not a limitation of liability.

2.4 Actions. Depending on the Product, Customer may configure automated actions that are triggered by a scan result, such as tagging, notifying, quarantining or deleting a file (each, an “Action”). Unless the Documentation states otherwise, files are not deleted or altered by default. Where Customer configures an Action that deletes, blocks or alters files, Customer does so at its own discretion and is responsible for maintaining backups that allow it to restore files affected by an Action.

2.5 Changes to the Products. widdix may modify the Products from time to time, in particular to improve them, to reflect changes in the Engine, in the Platforms or in applicable law, or for security reasons, provided that the core functionality of the subscribed Product described in the Documentation is not materially reduced during the Subscription Term. widdix will inform Customer of material changes with reasonable advance notice, except where this is not possible for security reasons.

2.6 Documentation and Support. widdix provides the Documentation and support for the Products in accordance with the Support Policy (Exhibit D).

2.7 Affiliates. Customer may permit its Affiliates to use a Product under Customer’s Subscription. Customer is responsible for the acts and omissions of its Affiliates and Users as if they were its own.

3. Customer Obligations

3.1 Account and access. Customer is responsible for all activities under its account, API keys, access tokens and Users. Customer will keep credentials confidential, use reasonable security measures to protect them, and notify widdix without undue delay of any known or suspected unauthorised use.

3.2 Compliance. Customer will use the Products only in accordance with the Agreement, the AUP, the Documentation and applicable law. Customer is responsible for ensuring that it has all rights, consents and legal bases required for the files it submits for scanning and for the Customer Data processed by the Products.

3.3 Configuration. Customer is responsible for the configuration of the Products in its environment, including the selection of Actions, scan scopes, exclusions and integrations with Platforms, and for reviewing scan results and notifications.

3.4 Backups. Customer will maintain backups of files submitted for scanning in accordance with good industry practice, so that files affected by a false positive, a configured Action or an Action of a Platform can be restored. widdix does not retain copies of scanned files (see Section 6.2).

3.5 Platforms and third-party services. The use of a Platform (such as Atlassian, Salesforce, GitHub, Make, n8n, WordPress or, for attachmentAV Self-Hosted on AWS, Amazon Web Services) is governed by the terms of the respective Platform provider. widdix is not responsible for the availability, security, functionality or changes of a Platform, nor for actions taken by a Platform in response to a scan result, except where the Product-Specific Terms expressly provide otherwise.

3.6 Prohibited use. Customer will not (a) use the Products to develop or test malware or to circumvent security measures of third parties, (b) use the Products in a manner that interferes with their operation or the operation of widdix’s infrastructure, (c) resell, sublicense or provide the Products as a service to third parties except as permitted in the Product-Specific Terms, (d) reverse engineer or attempt to extract the Engine, signature databases or source code of the Products, except to the extent permitted by Sections 69d and 69e of the German Copyright Act (Urheberrechtsgesetz), or (e) use the Products in High-Risk Activities.

3.7 Export control and sanctions. Customer will comply with applicable export control and sanctions laws. Customer represents that it is not, and is not owned or controlled by, a person listed on any applicable sanctions list, and that it will not use the Products in a country or territory subject to comprehensive sanctions.

4. Fees and Payment

4.1 Fees. Customer will pay the fees set out in the Order or, where no Order exists, the fees published on the Website or in the Marketplace at the time of Acceptance (“Fees”). Fees are stated net of VAT and other applicable taxes, duties and withholdings, which Customer will pay in addition where applicable.

4.2 Billing channels. Fees are invoiced and collected as set out in the Product-Specific Terms for the respective Product, either by widdix directly, by a Marketplace operator, or by a merchant of record acting on widdix’s behalf.

4.3 Payment terms. Unless the Order, the Marketplace Terms or the terms of the merchant of record provide otherwise, Fees are payable in advance for the Subscription Term and are due within 14 days of the invoice date. Usage-based Fees are invoiced monthly in arrears. Fees are payable in the currency stated in the Order or on the Website.

4.4 Late payment. If Customer fails to pay Fees when due, widdix may charge default interest at the statutory rate (Section 288 (2) BGB) and may suspend the Products in accordance with Section 8 after giving 10 days’ notice. Customer may set off claims or exercise a right of retention only with respect to counterclaims that are undisputed or have been finally determined by a court.

4.5 Price changes. widdix may change the Fees with effect from the next Renewal Term by giving Customer at least 30 days’ notice before the end of the then-current Subscription Term. If Customer does not agree to the change, Customer may terminate the affected Subscription with effect from the end of the current Subscription Term. Where a Product is obtained through a Marketplace, price changes are implemented in accordance with the Marketplace Terms.

4.6 Taxes. If Customer is required by law to withhold taxes from payments to widdix, Customer will gross up the payment so that widdix receives the full amount of the Fees, unless widdix can obtain a credit for the withheld amount.

5. Term, Renewal and Termination

5.1 Subscription Term. Each Subscription starts on the date stated in the Order or on Acceptance and continues for the initial term stated in the Order or, if none is stated, for one month (monthly plans) or twelve months (annual plans), as selected by Customer (the “Initial Term”).

5.2 Renewal. Each Subscription renews automatically for successive periods of the same length as the Initial Term (each, a “Renewal Term”; the Initial Term and all Renewal Terms together, the “Subscription Term”) unless either Party gives notice of non-renewal at least 14 days (monthly plans) or 30 days (annual plans) before the end of the then-current term, or unless Customer cancels the Subscription through the Marketplace or the Website before the end of the then-current term.

5.3 Termination for cause. Either Party may terminate the Agreement or an affected Subscription for cause (aus wichtigem Grund) with immediate effect. Cause exists in particular if (a) the other Party materially breaches the Agreement and fails to remedy the breach within 30 days after receiving written notice, (b) Customer breaches the AUP or Section 3.6 and the breach is not remedied within 7 days after notice, (c) Customer fails to pay Fees that are more than 30 days overdue, or (d) the other Party becomes insolvent, enters liquidation or is subject to insolvency proceedings (to the extent permitted by law).

5.4 Effect of termination. Upon expiry or termination, (a) Customer’s right to use the affected Product ends and widdix may disable access, API keys and integrations, (b) Customer will cease use of the Product and, where applicable, uninstall the Product from the Platform, and (c) Sections 4 (for Fees accrued), 6.2, 9, 10, 11, 12, 14, 15, 16 and 17 survive. Fees already paid for the remaining Subscription Term are not refunded, except where Customer terminates for cause attributable to widdix or where the Agreement expressly provides for a refund.

5.5 Data. Because the Products do not retain scanned files (Section 6.2), no return of files is required upon termination. Scan logs and account data are deleted in accordance with the DPA and the Documentation.

6. Customer Data, Data Protection and Security

6.1 Customer Data. As between the Parties, Customer retains all rights in the Customer Data. Customer grants widdix a non-exclusive, worldwide, royalty-free licence to process the Customer Data solely to the extent necessary to provide the Products, support and related services, to comply with the Agreement and applicable law, and as described in the DPA.

6.2 Handling of scanned files. Files submitted for scanning are transmitted in encrypted form, stored only transiently and in encrypted form for the duration of the scan on infrastructure operated for widdix by its hosting provider in the processing region determined in accordance with Section 6.6 and are deleted immediately after the scan result has been produced. widdix does not retain copies of scanned files. widdix retains scan metadata and logs (such as file references, scan results, access and application logs and account data) for the periods stated in the DPA for the purposes of providing the Products, support, billing and security.

6.3 Hash-based reputation lookups. As part of the scan, the Engine may transmit a cryptographic hash (fingerprint) of a scanned file to the Engine vendor for comparison against the vendor’s threat intelligence. No file content is transmitted.

6.4 Data Processing Agreement. To the extent widdix processes personal data on behalf of Customer in providing the Products, the DPA in Exhibit B applies and forms part of the Agreement from Acceptance. No separate signature is required.

6.5 Security. widdix will maintain appropriate technical and organisational measures to protect Customer Data against unauthorised access, loss and alteration, as described in the DPA and the Security Documentation. widdix maintains an information security management system certified under ISO/IEC 27001:2022 and will make its certificate available to Customer on request.

6.6 Regions. Scanned files are processed in the EU (AWS region eu-west-1, Ireland) by default. Depending on the Product, Customer may select another processing region offered in the Documentation (currently the United States, Canada, India and Australia). Customer is responsible for that selection; the selection constitutes Customer’s instruction within the meaning of the DPA, and the DPA applies to any transfer of personal data resulting from it. For attachmentAV Self-Hosted on AWS, processing takes place in the AWS region selected by Customer in its own AWS account.

6.7 Usage data. widdix may collect and use technical and statistical information about the operation and use of the Products (such as scan volumes, file types, detection statistics and performance data) in aggregated or de-identified form that does not identify Customer or any individual, for the purposes of operating, securing, improving and marketing the Products.

7. Confidentiality

7.1 Definition. “Confidential Information” means information disclosed by one Party to the other in connection with the Agreement that is marked as confidential or that a reasonable person would understand to be confidential, including Customer Data, the non-public parts of the Products and Documentation, pricing and security information. Confidential Information does not include information that (a) is or becomes publicly available without breach of the Agreement, (b) was known to the receiving Party before disclosure without a duty of confidentiality, (c) is independently developed without use of the disclosing Party’s Confidential Information, or (d) is lawfully received from a third party without a duty of confidentiality.

7.2 Obligations. The receiving Party will (a) use Confidential Information only to perform the Agreement, (b) protect it with at least the same degree of care it uses for its own confidential information, and no less than reasonable care, and (c) disclose it only to its employees, Affiliates, contractors and advisers who need to know it and are bound by confidentiality obligations no less protective than these. The receiving Party may disclose Confidential Information to the extent required by law or court order, provided it gives the disclosing Party reasonable advance notice where legally permitted.

7.3 Duration. These obligations apply during the Agreement and for three (3) years after its end; for Customer Data and trade secrets within the meaning of the German Trade Secrets Act (Geschäftsgeheimnisgesetz), for as long as the information remains confidential.

8. Suspension

widdix may suspend Customer’s access to a Product in whole or in part, with immediate effect and after notice where reasonably practicable, if (a) Customer’s use of the Product poses a security risk to the Product, widdix’s infrastructure or third parties, (b) Customer materially breaches the AUP or Section 3.6, (c) Customer’s Fees are overdue as described in Section 4.4, or (d) suspension is required by law or by a Platform or Marketplace operator. widdix will limit the suspension to what is necessary and will restore access without undue delay once the reason for the suspension has been resolved. Suspension does not relieve Customer of its payment obligations unless the suspension was caused by widdix.

9. Intellectual Property

9.1 widdix IP. widdix and its licensors retain all rights, title and interest in the Products, the Engine, the Documentation, the Website and all related intellectual property. Except for the rights of use expressly granted in the Agreement, no rights are granted to Customer.

9.2 Rights of use. During the Subscription Term, widdix grants Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the subscribed Product for Customer’s internal business purposes in accordance with the Agreement and the Documentation. Additional rights of use for software components installed in Customer’s environment (such as plugins, SDKs or self-hosted images) are set out in the Product-Specific Terms.

9.3 Feedback. If Customer provides suggestions, ideas or feedback about the Products, widdix may use them without restriction or compensation, provided that widdix does not disclose Customer as the source without Customer’s consent.

9.4 Open-source components. The Products may include open-source components that are subject to their own licence terms, which are identified in the Documentation. Those licence terms take precedence over the Agreement with respect to the relevant components to the extent they conflict.

10. Warranty and Remedies

10.1 Performance warranty. widdix warrants that, during the Subscription Term, the subscribed Product will perform materially in accordance with the Documentation. The description of the service in Section 2.3 and the Product-Specific Terms defines the agreed quality of the Products (vereinbarte Beschaffenheit).

10.2 Defects. If a Product does not conform to the warranty in Section 10.1 (a “Defect”), Customer will notify widdix in writing with a description of the Defect without undue delay after discovering it. widdix will remedy the Defect within a reasonable period, at its option by correction or by providing a reasonable workaround. If widdix fails to remedy a material Defect within a reasonable period set by Customer, Customer may reduce the Fees for the affected Product proportionally for the period of the Defect or, where the Defect is material and persistent, terminate the affected Subscription for cause under Section 5.3 and receive a pro-rata refund of prepaid, unused Fees for that Subscription.

10.3 Exclusion of strict liability. The strict liability of widdix for Defects existing at the time of conclusion of the Agreement under Section 536a (1), first alternative, BGB is excluded.

10.4 Exclusions. The warranty does not apply to the extent a non-conformity results from (a) use of a Product contrary to the Agreement or the Documentation, (b) modifications not made by widdix, (c) a Platform, third-party software or Customer’s systems or network, (d) a Trial or Beta, or (e) the detection characteristics of the Engine described in Section 2.3.

10.5 No other warranties. Except as expressly stated in this Section 10 and in the Product-Specific Terms, widdix gives no warranties or guarantees (Garantien) of any kind, in particular no guarantee of complete malware detection, of the absence of false positives or of uninterrupted availability.

11. Liability

11.1 Unlimited liability. widdix is liable without limitation (a) for damages caused intentionally or by gross negligence, (b) for injury to life, body or health, (c) under the German Product Liability Act (Produkthaftungsgesetz), (d) for fraudulent concealment of a Defect, and (e) to the extent widdix has assumed a guarantee (Garantie).

11.2 Breach of material obligations. In the event of a slightly negligent breach of a material contractual obligation (wesentliche Vertragspflicht, i.e. an obligation whose fulfilment is essential to the proper performance of the Agreement and on whose fulfilment Customer regularly relies and may rely), widdix’s liability is limited to the damage that is typical for this type of agreement and was foreseeable at the time of conclusion of the Agreement.

11.3 Cap. Subject to Sections 11.1 and 11.2, widdix’s total liability under Section 11.2 and otherwise arising out of or in connection with the Agreement in any contract year is limited to the total Fees paid or payable by Customer for the affected Subscription in the twelve (12) months preceding the event giving rise to the claim, or EUR 100,000, whichever is higher.

11.4 Exclusion of other liability. Subject to Sections 11.1 and 11.2, widdix is not liable for slightly negligent breaches of non-material obligations. In particular, subject to Sections 11.1 and 11.2, widdix is not liable for loss of profit, loss of business, loss or corruption of data to the extent it could have been avoided by backups in accordance with Section 3.4, or for damage resulting from a false positive, a false negative or an Action configured by Customer.

11.5 Scope. The limitations in this Section 11 apply to all claims for damages and reimbursement of expenses, regardless of their legal basis, including liability in tort, and also for the benefit of widdix’s employees, representatives and agents.

11.6 Customer liability. Customer’s liability is governed by statutory law; Customer indemnifies widdix in accordance with Section 12.2.

11.7 Trials and Betas. Notwithstanding the foregoing, for Trials and Betas Section 13.3 applies.

12. Indemnification

12.1 By widdix. widdix will defend Customer against any claim by a third party alleging that the subscribed Product, when used in accordance with the Agreement, infringes that third party’s intellectual property rights in the European Union, the United Kingdom, Switzerland or the United States, and will pay damages and costs finally awarded against Customer or agreed in a settlement approved by widdix. If such a claim is made or appears likely, widdix may, at its option, (a) procure the right for Customer to continue using the Product, (b) modify or replace the Product so that it is non-infringing while providing materially equivalent functionality, or (c) terminate the affected Subscription and refund prepaid, unused Fees. widdix has no obligation for claims resulting from (i) Customer Data, (ii) modifications not made by widdix, (iii) combinations with products or data not provided by widdix where the claim would not have arisen without the combination, or (iv) use after widdix has notified Customer to cease use.

12.2 By Customer. Customer will defend widdix against any claim by a third party arising from (a) Customer Data or files submitted for scanning, (b) Customer’s use of the Products in breach of the Agreement, the AUP or applicable law, or (c) an Action configured by Customer, and will pay damages and costs finally awarded against widdix or agreed in a settlement approved by Customer.

12.3 Procedure. The indemnified Party will (a) notify the indemnifying Party of the claim without undue delay, (b) give the indemnifying Party sole control of the defence and settlement (provided that no settlement may impose obligations on the indemnified Party other than payment covered by the indemnity without its consent), and (c) provide reasonable assistance at the indemnifying Party’s expense. The indemnities in this Section 12 are the sole remedy of the indemnified Party for the covered third-party claims, without prejudice to Section 11.1.

13. Trials and Betas

13.1 Trials. widdix may offer Products free of charge for a limited period (“Trial”). A Trial ends automatically at the end of the trial period unless Customer purchases a Subscription. widdix may modify or discontinue a Trial at any time.

13.2 Betas. widdix may offer features or Products identified as beta, preview, early access or similar (“Beta”). Betas are provided for evaluation purposes, may be modified or discontinued at any time, and may contain errors.

13.3 Limited warranty and liability. Trials and Betas are provided as is. Sections 10 and 12.1 do not apply to Trials and Betas. widdix’s liability in connection with Trials and Betas is limited to the cases in Section 11.1; Section 11.2 applies with a cap of EUR 1,000 per Customer.

14. Changes to the Terms

14.1 Changes. widdix may change the Terms (including the Exhibits) with effect for the future where the change is necessary to reflect changes in law, regulatory requirements, court decisions, changes in the Products under Section 2.5, changes in the Platforms or Marketplaces, or security requirements, or where the change is otherwise reasonable for Customer taking into account the interests of both Parties. Changes to the main subject matter of the Agreement or to the Fees are governed by Sections 2.5 and 4.5 and are not made under this Section 14.

14.2 Notice and objection. widdix will notify Customer of changes at least 30 days before they take effect by email to the address associated with Customer’s account or through the Product or Marketplace. The changes are deemed accepted if Customer does not object in writing before the effective date, provided that widdix has specifically pointed out the consequences of not objecting in the notice. If Customer objects, the Terms continue to apply unchanged for the then-current Subscription Term, and either Party may terminate the affected Subscription with effect from the end of that term.

14.3 New versions on renewal. The version of the Terms published on the Website at the start of a Renewal Term applies to that Renewal Term, provided widdix has notified Customer of the new version in accordance with Section 14.2 before the renewal.

15. Governing Law and Jurisdiction

15.1 Governing law. The Agreement and any dispute arising out of or in connection with it are governed by the laws of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG) and the conflict-of-law rules.

15.2 Jurisdiction. The courts of Stuttgart, Germany, have exclusive jurisdiction for all disputes arising out of or in connection with the Agreement. widdix may also bring proceedings against Customer at Customer’s general place of jurisdiction.

15.3 Language. The Agreement is concluded in English. Terms in German given in brackets are for clarification of the legal meaning under German law.

16. General

16.1 Entire agreement. The Agreement is the entire agreement between the Parties regarding its subject matter and supersedes all prior agreements and understandings regarding that subject matter.

16.2 Amendments; form. Amendments and supplements to the Agreement require text form (Textform, Section 126b BGB), unless the Agreement provides otherwise. This applies also to any amendment of this clause.

16.3 Assignment. Customer may not assign or transfer the Agreement or any rights under it without widdix’s prior consent in text form, except to an Affiliate or to a successor in connection with a merger, acquisition or sale of all or substantially all of its assets, provided the assignee assumes all obligations. widdix may assign the Agreement to an Affiliate or to a successor of its business, and may use subcontractors to perform the Agreement, subject to the DPA.

16.4 Notices. Notices under the Agreement are to be given in text form. Notices to widdix are to be sent to hello@attachmentav.com and notices to Customer to the email address associated with Customer’s account or Order. Notices are deemed received on the next business day after sending, unless an error message is received.

16.5 Force majeure. Neither Party is liable for a failure or delay in performance (other than payment) caused by circumstances beyond its reasonable control, such as natural disasters, war, terrorism, epidemics, labour disputes, governmental action, failures of public networks or of a Platform, or attacks on IT systems that could not have been prevented with reasonable care. The affected Party will notify the other Party and resume performance as soon as reasonably possible.

16.6 Severability. If any provision of the Agreement is or becomes invalid or unenforceable, the remaining provisions remain in effect. The Parties will replace the invalid or unenforceable provision with a valid provision that comes closest to its economic purpose.

16.7 No waiver. A failure or delay in exercising a right under the Agreement does not constitute a waiver of that right.

16.8 Independent contractors. The Parties are independent contractors. The Agreement does not create a partnership, joint venture, agency or employment relationship.

17. Definitions

“Action” has the meaning in Section 2.4.

“Affiliate” means an entity that controls, is controlled by or is under common control with a Party, where control means ownership of more than 50 % of the voting interests or the power to direct management.

“AUP” means the Acceptable Use Policy in Exhibit C.

“Beta” has the meaning in Section 13.2.

“Customer Data” means all data, files and content submitted by or on behalf of Customer to the Products for scanning or otherwise processed by widdix on Customer’s behalf under the Agreement, including personal data contained in such files, and account and configuration data provided by Customer.

“Documentation” means the technical documentation, help articles and product descriptions for the Products published by widdix at https://attachmentav.com/help/ as updated from time to time.

“DPA” means the Data Processing Agreement in Exhibit B.

“Engine” means the third-party anti-malware engine and associated signature and threat-intelligence services used by widdix to perform scans, currently provided by Sophos.

“Fees” has the meaning in Section 4.1.

“High-Risk Activities” means activities in which a failure of the Products could lead to death, personal injury or severe physical or environmental damage, such as the operation of nuclear facilities, aircraft navigation or communication systems, air traffic control, life-support systems or weapons systems.

“Marketplace” means an app store or marketplace operated by a third party through which a Product can be obtained, such as the Atlassian Marketplace, the Salesforce AppExchange, the AWS Marketplace, the GitHub Marketplace or the WordPress plugin directory, and a merchant-of-record platform such as FastSpring.

“Marketplace Terms” means the terms of a Marketplace operator that apply to Customer’s acquisition or use of a Product through that Marketplace.

“Order” means an order for a Subscription placed by Customer through the Website, a Marketplace or a written order form referencing the Terms, and specifying the Product, plan, Fees and Subscription Term.

“Platform” means a third-party software platform with which a Product integrates, such as Atlassian Jira or Confluence, Salesforce, GitHub, Make, n8n or WordPress.

“Product” has the meaning in Section 2.1 and includes the Product variants described in Exhibit A.

“Product-Specific Terms” means the terms for a particular Product in Exhibit A.

“Security Documentation” means widdix’s description of its security measures, as published at https://attachmentav.com/security or provided to Customer on request.

“Subscription” means Customer’s right to use a Product for the Subscription Term under an Order.

“Subscription Term”, “Initial Term” and “Renewal Term” have the meanings in Section 5.

“Support Policy” means the support terms in Exhibit D.

“Trial” has the meaning in Section 13.1.

“User” means an individual authorised by Customer to use a Product on Customer’s behalf, including employees, contractors and users of Customer’s Platform instance.

“Website” means https://attachmentav.com and its subpages.

Exhibit A – Product-Specific Terms

These Product-Specific Terms supplement the main body of the Terms for the respective Product. In the event of a conflict, the Product-Specific Terms prevail over the main body for that Product.

A.1 attachmentAV Virus and Malware Scan API (SaaS)

A.1.1 Description. The API is a hosted web service through which Customer submits files (or references to files) for scanning and receives a scan result. Customer integrates the API into its own applications using the Documentation and, optionally, the SDKs provided by widdix.

A.1.2 System boundary. Customer is responsible for its own application, for the transmission of files to the API, for handling the scan result and for any action its application takes based on the result. widdix’s responsibility begins with the receipt of a file at the API endpoint and ends with the delivery of the scan result.

A.1.3 Use in Customer’s products. Customer may use the API as part of applications or services it provides to its own customers, provided that (a) Customer remains responsible to widdix for such use, (b) Customer does not expose the API as a stand-alone malware scanning service that competes with the Products, and (c) Customer’s agreements with its own customers do not impose obligations on widdix.

A.1.4 SDKs. widdix provides SDKs under the open-source licence stated in the respective repository. The SDKs are not part of the Product and are provided without warranty beyond the terms of that licence.

A.1.5 Limits. File size limits, rate limits and supported file types are stated in the Documentation and in the plan selected by Customer.

A.1.6 Billing. Subscriptions are sold through FastSpring, acting as merchant of record. Customer’s contract of sale for the Subscription is with FastSpring and is subject to FastSpring’s terms; the licence to the Product and the provision of the API service are governed by the Agreement with widdix.

A.2 attachmentAV for Atlassian (Jira, Jira Service Management, Confluence)

A.2.1 Description. The Atlassian apps scan attachments uploaded to Customer’s Atlassian Cloud site. Upon upload, the app transmits the attachment to the API for scanning; the scan result is stored in the Atlassian site as a property or tag of the attachment.

A.2.2 Marketplace. The apps are distributed through the Atlassian Marketplace. The Atlassian Marketplace Terms of Use and, as applicable, Atlassian’s Marketplace Partner terms apply to Customer’s acquisition of the app and to billing. Atlassian collects the Fees on widdix’s behalf. widdix is the licensor of the app; Atlassian is not a party to the Agreement.

A.2.3 Actions. Available Actions (such as adding a comment, notifying the uploader, or deleting the attachment) are described in the Documentation. The default Action is to notify and tag; deletion of attachments occurs only if configured by Customer. Deleted attachments can be restored only to the extent the Atlassian product allows it; Customer is responsible for backups.

A.2.4 System boundary. widdix is responsible for the app’s scanning function and the API. Customer and Atlassian are responsible for the Atlassian site, its availability, user management and the storage of attachments and scan results within the site.

A.2.5 Scan region. Attachments are scanned in the region selected by Customer in the settings of the app; if Customer has not selected a region, attachments are scanned in the EU. Atlassian data residency settings for Customer’s site do not by themselves determine the scan region.

A.3 attachmentAV for Salesforce

A.3.1 Description. The Salesforce app scans files uploaded to Customer’s Salesforce org. Upon upload (and, if configured, in scheduled full scans), the app transmits the file to the API for scanning; the scan result is stored in the org as a tag or field of the file.

A.3.2 Marketplace. The app is listed on the Salesforce AppExchange. Salesforce’s AppExchange terms apply to the listing; the Agreement between Customer and widdix governs the app. Fees are invoiced either by widdix directly or by FastSpring acting as merchant of record, as stated in the Order. Where FastSpring acts as merchant of record, Section A.1.6 applies accordingly.

A.3.3 Actions and system boundary. Sections A.2.3 and A.2.4 apply accordingly, with Salesforce in place of Atlassian.

A.3.4 Scan region. Files are scanned in the region selected by Customer in the app configuration; if Customer has not selected a region, files are scanned in the EU.

A.4 attachmentAV for GitHub

A.4.1 Description. The GitHub integration is open-source software provided under the MIT licence, which Customer finds and installs through the GitHub Marketplace and integrates into its workflows. It scans build artifacts, release assets or repository content, as configured by Customer, before they are published or delivered. The MIT licence applies to the integration code; the Agreement governs the API service. The GitHub Marketplace is used for distribution only; Subscriptions are sold through FastSpring (Section A.4.3).

A.4.2 System boundary. Customer is responsible for its workflows, repositories and release processes and for any action taken by its workflow based on the scan result.

A.4.3 Billing. Section A.1.6 applies accordingly.

A.5 attachmentAV for Make and n8n

A.5.1 Description. The Make and n8n modules provide a step that submits a file passing through Customer’s workflow to the API and returns the scan result to the workflow. The modules are obtained through the integration directories of Make and n8n; Subscriptions are sold through FastSpring (Section A.5.3). All configuration, including any action based on the scan result, is performed by Customer within the workflow.

A.5.2 System boundary. widdix is responsible only for the module and the API. The workflow platform, the surrounding workflow and all downstream actions are Customer’s responsibility.

A.5.3 Billing. Section A.1.6 applies accordingly.

A.6 attachmentAV for WordPress

A.6.1 Description. The WordPress plugin scans files uploaded through forms on Customer’s WordPress site. The plugin transmits uploads to the API and applies the Action configured by Customer in the WordPress backend.

A.6.2 Plugin licence. The plugin is installed in Customer’s environment. widdix grants Customer, for the Subscription Term, a non-exclusive, non-transferable right to install and use the plugin on the number of sites covered by Customer’s Subscription. To the extent the plugin is distributed under the GPL through the WordPress plugin directory, the GPL applies to the plugin code; the Agreement governs the API service.

A.6.3 Billing. Subscriptions are sold through FastSpring, acting as merchant of record. Customer’s contract of sale for the Subscription is with FastSpring and is subject to FastSpring’s terms; the licence to the Product and the provision of the API service are governed by the Agreement with widdix.

A.7 attachmentAV Self-Hosted on AWS

A.7.1 Description. The self-hosted variant is software (an Amazon Machine Image and related deployment templates) that Customer deploys and operates in its own AWS account. Scanning takes place entirely within Customer’s AWS environment; no files, hashes or scan results are transmitted to widdix, except as described in A.7.5.

A.7.2 Marketplace. The self-hosted variant is obtained through the AWS Marketplace and is licensed under the Standard Contract for AWS Marketplace (SCMP) designated in the AWS Marketplace listing. The SCMP governs the licence, warranty, liability, governing law and jurisdiction for the self-hosted variant and takes precedence over the Agreement. The Agreement applies only to matters not addressed in the SCMP, in particular updates and support (Section A.7.4 and Exhibit D). AWS collects the Fees in accordance with the AWS Marketplace terms.

A.7.3 Licence. Subject to the SCMP, widdix grants Customer, for the Subscription Term, a non-exclusive, non-transferable right to deploy and use the software in Customer’s AWS account for Customer’s internal business purposes. Customer may not distribute the software or make it available to third parties. The Engine is licensed to widdix by the Engine vendor; Customer acquires no rights in the Engine beyond the right to use it as part of the software.

A.7.4 Operation. Customer is responsible for the deployment, configuration, operation, security, availability, updates and backups of the software and of the AWS resources it uses, and for AWS charges. widdix provides updates to the software and signature updates through the mechanism described in the Documentation during the Subscription Term.

A.7.5 Telemetry; no data processing. The self-hosted software does not transmit scanned files to widdix. Because widdix does not process Customer Data on Customer’s behalf in the self-hosted variant, the DPA does not apply to it unless widdix provides support services that involve access to Customer Data.

Exhibit B – Data Processing Agreement

The Data Processing Agreement is set out in a separate document, “attachmentAV Data Processing Agreement, Version 1.0”, which forms part of the Agreement in accordance with Section 6.4 of the Terms.

Exhibit C – Acceptable Use Policy

Customer will not, and will not permit any User or third party to, use the Products to:

1. develop, store, distribute or test malware, except for the submission of files for scanning as intended by the Products;
2. submit files that Customer is not entitled to process or disclose, or that contain content whose processing is unlawful;
3. attempt to gain unauthorised access to the Products, widdix’s infrastructure or the systems of other customers;
4. probe, scan or test the vulnerability of the Products without widdix’s prior written consent, except through a coordinated disclosure process published by widdix;
5. circumvent usage limits, rate limits or access controls, or share API keys with third parties outside Customer’s organisation;
6. use the Products to build or train a competing malware detection service, or to benchmark the Engine for publication without widdix’s consent;
7. use the Products in High-Risk Activities; or
8. use the Products in violation of applicable law, including export control and sanctions law.

widdix may investigate suspected violations and may suspend the Products in accordance with Section 8 of the Terms.

Exhibit D – Support Policy

D.1 Scope. widdix provides support for the Products by email at hello@attachmentav.com and through the Documentation. Support covers questions about the installation, configuration and use of the Products and the reporting of Defects. Support does not cover the Platforms, Customer’s applications or workflows, or custom development.

D.2 Response times. widdix will respond to support requests no later than the next business day in Germany (Monday to Friday, excluding public holidays in Baden-Württemberg) following receipt. Response times are targets; a response confirms receipt and, where possible, provides a solution or workaround or a plan for resolution.

D.3 No availability commitment. widdix operates the Products with the aim of high availability but does not commit to a specific availability level. Planned maintenance will be announced in advance where reasonably possible. The current operational status of the Products is published at https://status.attachmentav.com.

D.4 Security incidents. Security incidents affecting Customer Data are handled in accordance with the DPA.