Effective Date: July 1, 2026
(A) Please read these Terms of Use (“Terms of Use” or “Terms”) carefully before accessing the Finite State Platform (“Platform”) or using the services available thereon (“Services”) operated by Finite State, Inc. (“Finite State”).
(B) Any party accessing the Platform and/or using the Services (“Customer”) is subject to compliance with these Terms. By accessing the Platform or using the Services, Customer (and anyone representing Customer) agrees to be bound by these Terms. If any Customer (or their representative) disagrees with any part of these Terms, then that party may neither access the Platform nor use the Services.
(A) “Feedback” means Customer’s comments, ideas, suggestions, or proposals provided to Finite State.
(B) “Finite State Platform” or “Platform” means the Finite State software used to analyze Customer-provided Firmware images.
(C) “Finite State Raw Data” means the raw data Finite State produces from the analysis of Customer-provided Firmware images using the Platform.
(D) “Firmware” means the third-party or Customer-owned software, configuration files, or operating system associated with a particular make and model of a single, physical device. For purposes of these Terms and Conditions, a single Firmware image typically has a size of less than 2GB.
(E) “Intellectual Property Rights” means all intellectual property rights, including patents, copyrights, trademarks, and trade secrets.
(F) “Services” means (a) access to and use of the Finite State Platform; and (b) professional and managed services delivered by Finite State to Customer pursuant to an applicable Order Form.
(G) “Deliverables” means outputs, documents, reports, or other work product produced specifically for Customer by Finite State in the course of performing professional or managed services under an applicable Order Form.
(H) “Order Form” means a written ordering document executed by both Parties that specifies the services, fees, scope, and term, and that incorporates these Terms and Conditions by reference.
(A) Customer represents and warrants that:
(i) It has full power and authority to engage Finite State, to use the Finite State Platform with all elements of the Customer-provided Firmware;
(ii) It will access the Platform and use the Services in accordance with these Terms and all applicable laws and regulations, to include export controls;
(iii) It will only use the Platform for purposes of lawful cybersecurity diagnosis and defense of Customer’s own network, devices, products, or Firmware used in Customer’s devices;
(iv) It will not (a) license, sublicense, sell, resell, rent, lease, transfer, distribute, or otherwise similarly exploit the Platform; or (b) copy, create a derivative work of, reverse engineer, reverse assemble, disassemble, decompile, or otherwise attempt to discover any source code or modify the Platform except as otherwise expressly permitted by law; and
(v) To the extent Customer uploads Firmware to the Finite State Platform, Customer represents and warrants that all content contained in the Customer-provided Firmware complies with these Terms and our Privacy Policy, and that Customer has obtained all rights, consents, and permissions — including from any third parties — necessary to submit the Firmware to Finite State for the analysis contemplated by the applicable Order Form.
(vi) Customer is responsible for the accuracy and completeness of the materials and information it provides to Finite State, and Finite State’s performance obligations are conditioned on the accuracy and completeness of such Customer-provided inputs.
(vii) Upon the termination or expiration of the Term, Customer will immediately discontinue use of the Services and delete or destroy all copies of the Services in its possession or control.
(B) Finite State represents and warrants that it will perform its obligations under these Terms and Conditions:
(i) In a professional and workmanlike manner with due care and diligence and to the highest standards of quality as is customary in Finite State’s industry;
(ii) In accordance with all applicable professional standards for the field of expertise; and
(iii) In compliance with all applicable laws, treaties, rules, regulations and conventions.
(C) EXCEPT FOR THE WARRANTIES GIVEN BY FINITE STATE IN THESE TERMS AND CONDITIONS, FINITE STATE MAKES NO OTHER WARRANTIES, EXPRESS OR IMPLIED. FINITE STATE HEREBY SPECIFICALLY DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE OR ANY WARRANTY WITH RESPECT TO THE QUALITY, PERFORMANCE, ACCURACY OR FUNCTIONALITY OF THE PLATFORM OR THAT THE FUNCTION OF THE PLATFORM IS OR WILL BE ERROR FREE, WILL IDENTIFY ALL VULNERABILITIES IN A PRODUCT, OR WILL ACCOMPLISH ANY PARTICULAR RESULT.
(A) Finite State grants Customer rights to access the Platform and use the Services as outlined in any applicable Order Form solely for Customer’s own internal, product security, and Firmware analysis purposes. Included in this grant, Finite State agrees to process Customer-provided Firmware images in accordance with any applicable Order Form.
(B) Except for the rights expressly granted under these Terms and Conditions, Finite State retains all rights (including Intellectual Property Rights) in and to the Platform, Finite State Raw Data, Feedback, and any related documentation, including updates and enhancements thereto, as well as all underlying methodologies, templates, and tools used in performing the Services. Customer will not delete or in any manner alter the copyright, trademark, or other proprietary notices of Finite State.
(C) Customer owns all Deliverables produced specifically for Customer under an applicable Order Form.
(D) Finite State’s assessments, analyses, and Deliverables are analytical and technical inputs only. They do not constitute legal advice, regulatory advice, or a representation that Customer’s products or practices comply with any applicable law, regulation, or standard. Where Deliverables inform determinations that carry legal or regulatory significance, Customer is solely responsible for making all such final determinations, including by engaging its own qualified legal, engineering, or security personnel as appropriate.
(E) Finite State’s pre-existing materials, methodologies, frameworks, and tools — including those incorporated into Deliverables — remain Finite State’s sole property. Customer’s ownership of Deliverables under Section 4(C) applies to the Customer-specific content of such Deliverables only and does not extend to such underlying Finite State materials.
(A) Changes to any Order Form require a written change order executed by both Parties before taking effect. Either Party may initiate a change order discussion by written notice. Neither Party is obligated to execute a change order until both Parties have signed it. In the event of a conflict between a change order and the applicable Order Form, the change order controls for the matter addressed therein.
(B) Until a change order is executed by both Parties, the Parties shall continue performing under the most recently executed Order Form, and Finite State is not obligated to perform work outside the scope of such Order Form.
(A) “Confidential Information” means all confidential or proprietary information of a Party (“Disclosing Party”) disclosed to the other Party (“Receiving Party”), whether orally or in writing, that is either designated as confidential or reasonably should be understood to be confidential given the nature of information and the circumstances of disclosure. Confidential Information shall not include information that, as demonstrated by contemporaneous written records or other competent evidence, (i) is or becomes publicly available without a breach of any obligation owed to the Disclosing Party, (ii) is already known to the Receiving Party at the time of its disclosure by the Disclosing Party, without a breach of any obligation owed to the Disclosing Party, (iii) following its disclosure to the Receiving Party, is received by the Receiving Party from a third party without breach of any obligation owed to Disclosing Party, or (iv) is independently developed by Receiving Party without reference to or use of the Disclosing Party’s Confidential Information.
(B) The Receiving Party shall use the same degree of care used to protect the confidentiality of its own Confidential Information of like kind (but in no event less than reasonable care), and, except with Disclosing Party’s written consent, shall (i) restrict use of any Confidential Information of Disclosing Party only for purposes expressly authorized by or necessary for the performance of these Terms and Conditions (to include security research and development of new and derivative products and services) and (ii) limit access to Confidential Information of Disclosing Party to those of its and its affiliates’ employees, contractors and agents (“Representatives”) who need such access for purposes consistent with these Terms and Conditions and who have a duty or obligation of confidentiality no less stringent than that set forth herein, provided that any breach of this Section 6 by a Representative will be deemed to be a breach by the Receiving Party.
(C) Notwithstanding any other provision in these Terms and Conditions, during the course of working together, each Party may further develop its general knowledge, skills, and experience, and these Terms and Conditions shall not restrict such Party from using, disclosing, and employing any generalized ideas, concepts, know-how, methods, discoveries, techniques or skills gained or learned, including in connection with its use of its own confidential or proprietary information, provided that such use or disclosure does not otherwise violate the confidentiality obligations of this Section 6 or applicable data protection law.
(D) Following termination or expiration of an Order Form, Finite State will, upon Customer's request and at Customer's election, return or securely destroy Customer's Confidential Information (including Customer-provided Firmware) in its possession or control, other than records Finite State is required to retain by law or under the CRA Annex and copies contained in routine backups that are deleted in the ordinary course. Finite State will certify such destruction in writing upon Customer's request.
(A) For the duration of any applicable Order Form, Customer grants Finite State a license to reverse engineer and make copies of Customer-provided Firmware, including both static and dynamic analysis, for the purpose of performing security research to assess risks associated with Customer-provided Firmware.
(B) Customer authorizes Finite State to circumvent any technical measures necessary to gain full access to Customer-provided Firmware, software, data, and metadata stored in Customer-provided Firmware images for the sole purpose of performing security research to assess risks associated with Customer-provided Firmware, as agreed in an Order Form.
(A) NEITHER FINITE STATE NOR CUSTOMER SHALL BE LIABLE TO THE OTHER PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES ARISING IN CONNECTION WITH THESE TERMS AND CONDITIONS, WHETHER IN AN ACTION IN CONTRACT, TORT, STRICT LIABILITY OR NEGLIGENCE, OR OTHER ACTIONS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
(B) NEITHER PARTY’S TOTAL LIABILITY FOR ALL CLAIMS ARISING OUT OF THESE TERMS AND CONDITIONS, WHETHER IN CONTRACT, TORT OR OTHERWISE, SHALL EXCEED THE AMOUNT OF FEES PAID OR PAYABLE BY CUSTOMER TO FINITE STATE PURSUANT TO THESE TERMS AND CONDITIONS IN THE 12 MONTHS PRECEDING THE CLAIM.
(C) Indemnification.
(i) Finite State (Intellectual Property). Finite State will defend Customer against any third-party claim alleging that the Platform or any Deliverable, as provided by Finite State to Customer under these Terms and Conditions without modification by Customer, infringes a third party’s Intellectual Property Rights, and will indemnify Customer against damages and costs finally awarded by a court of competent jurisdiction or agreed in settlement. This Section 8(C)(i) does not apply to claims arising from (a) Customer’s modification of the Platform or any Deliverable, (b) combination of the Platform or any Deliverable with products, data, or materials not provided by Finite State, or (c) Customer’s use of the Platform or any Deliverable in a manner not authorized by these Terms and Conditions.
(ii) Remedies for Infringement. If the Platform or any Deliverable is held to infringe, or if Finite State reasonably believes it is likely to, Finite State may, at its option and expense: (a) procure for Customer the right to continue using it; (b) modify or replace it to be non-infringing with substantially equivalent functionality; or (c) if neither is commercially reasonable, terminate the affected Services or Order Form and refund prepaid fees for the post-termination period. THE FOREGOING STATES FINITE STATE'S ENTIRE LIABILITY AND CUSTOMER'S SOLE AND EXCLUSIVE REMEDY FOR ANY IP INFRINGEMENT CLAIM.
(iii) Mutual (Breach of Representations and Warranties). Each Party (in such capacity, the “Indemnifying Party”) will defend the other Party and its affiliates, officers, directors, and employees (the “Indemnified Party”) against any third-party claim to the extent arising from the Indemnifying Party’s breach of its representations and warranties in Section 3, and will indemnify the Indemnified Party against damages and costs finally awarded by a court of competent jurisdiction or agreed in settlement.
(iv) Procedure. The indemnification obligations in this Section 8(C) are subject to: (a) the indemnified party providing the indemnifying party with prompt written notice of the claim; (b) the indemnifying party having sole control over the defense and settlement, provided that no settlement imposing any obligation or admission on the indemnified party will be entered into without the indemnified party’s prior written consent (not to be unreasonably withheld); and (c) the indemnified party providing reasonable cooperation at the indemnifying party’s expense.
(A) Governing Law and Jurisdiction. These Terms and Conditions shall be governed and construed in accordance with the laws of the State of Ohio, excluding its conflicts of law rules.
(B) Arbitration. Any dispute or controversy arising under or in connection with these Terms and Conditions shall be settled exclusively by arbitration, conducted before a panel of three arbitrators in Columbus, Ohio, in accordance with the rules of the American Arbitration Association then in effect. Judgment may be entered on the arbitrator’s award in any court having jurisdiction; the expense of such arbitration shall be shared equally by the Parties. Before initiating arbitration, the Parties shall first attempt in good faith to resolve any dispute as follows: (i) the Parties’ designated points of contact (as named in the applicable Order Form) shall meet within five (5) business days of written notice of the dispute; and (ii) if unresolved, each Party’s designated executive sponsor (as named in the applicable Order Form) shall meet within ten (10) business days thereafter.
(C) Renewal. At the end of the initial period of engagement (“Initial Term”) or any Renewal Term, these Terms and Conditions, along with any applicable Order Forms, will automatically renew for a period of time equal to the Initial Term (the “Renewal Term”) unless either Party elects not to renew by notifying the other Party in writing of their intent to non-renew no less than 30 calendar days prior to the end of the Initial Term or the then-current Renewal Term. If no duration is specified for the Initial Term or a Renewal Term, the default duration will be 12 months. The Initial Term, combined with any Renewal, shall be referred to as the “Term.”
(D) True-Up. If, during the Initial Term or any Renewal Term, Customer exceeds the allotted number of scans/uploads in an existing Order Form or purchase order, Customer agrees to pay an additional fee (on a pro-rata basis) for each scan and/or upload beyond the allotted number(s). Finite State may invoice Customer for such additional fees at the end of the quarter in which such additional fees were incurred.
(E) Fees. Fees are payable in USD. Payments on all invoices are due within thirty (30) days. Any dispute to charges must be communicated to Finite State within thirty (30) days of the date of receipt of invoice.
(F) Late Payment. All outstanding amounts owing past the due date under these Terms and Conditions will incur interest at the lower of: (1) a rate of 1.5 percent per month, or (2) the maximum interest rate permitted by applicable laws, commencing on the due date, calculated monthly, until such time as they are paid in full. To the extent permitted by law, Customer will pay all reasonable costs of collection, including court costs and reasonable attorneys' fees. If any undisputed amount remains unpaid more than fifteen (15) days after written notice, Finite State may suspend Customer's access to the Platform and Services until paid in full, without liability and without relieving Customer of its payment obligations or terminating any Order Form. This right does not apply to amounts disputed in good faith under Section 9(E) and does not transfer to Finite State any of Customer's regulatory or compliance obligations, including under the CRA Annex.
(G) Taxes. Customer is solely responsible for payment of any goods and services taxes, sales taxes, value added taxes, and excise taxes, as applicable resulting from Customer’s use of the Services (excluding any taxes attributable to Finite State’s income).
(H) Notices. All notices hereunder shall be in writing and shall be deemed to have been duly given if: (i) delivered by hand on the date of delivery, or (ii) mailed by certified or registered mail with postage prepaid, on the third business day after the date on which it is so mailed, in either case to the address listed in the relevant Order Form.
(I) Relationship of the Parties. The Parties are independent contractors. These Terms do not create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the Parties.
(J) No Third-Party Beneficiaries. There are no third-party beneficiaries to these Terms.
(K) Waiver. No failure or delay by either Party in exercising any right under these Terms shall constitute a waiver of that right.
(L) Import and Export Compliance. Each Party shall comply with all applicable import, re-import, export and re-export control laws, treaties, agreements, and regulations.
(M) Force Majeure. Neither Party shall be liable under these Terms for delays or failures due to causes beyond its reasonable control.
(N) Publicity. Neither Party will make existence or terms of these Terms public nor have any right to use the names, logos, symbols and/or any other trademarks of the other party, without prior written permission from such other party, except that Finite State is authorized to disclose the fact of the engagement (but not the details thereof) with Customer on its website or in promotional materials.
(O) Severability. If any provision of these Terms is held by a court of competent jurisdiction to be invalid, the provision shall be modified so as best to accomplish the objectives of the original provision to the fullest extent permitted by law, and the remaining provisions of these Terms shall remain in effect.
(P) Termination for Material Breach. Either Party may terminate these Terms and Conditions or any affected Order Form upon thirty (30) days’ written notice to the other Party describing the alleged material breach in reasonable detail, provided that the breaching Party has not cured such breach within the thirty (30)-day notice period.
(Q) Survival. All provisions of the Terms which, by their nature, should survive termination of the Terms shall survive.
(R) Assignment. Neither Party may assign its rights and obligations hereunder, either in whole or in part, whether by operation of law or otherwise, without the prior written consent of the other Party (which consent will not be unreasonably withheld). Notwithstanding the foregoing, either Party may assign these Terms in its entirety (including all Order Forms), without consent of the other Party, to its affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets not involving a direct competitor of the other Party.
(S) Entire Agreement. These Terms, along with the Finite State Privacy Policy (available at https://finitestate.io/privacy-policy) and any applicable Order Form(s) and service-specific annexes incorporated by reference therein, constitute the entire agreement between the Parties as it relates to the subject matter and supersedes all prior and contemporaneous agreements, proposals or representations, written or oral, concerning or relating to the same. In the event of a conflict between these Terms and Conditions and any Order Form, incorporated service annex, or the Privacy Policy, these Terms and Conditions prevail, unless such Order Form, service annex, or the Privacy Policy expressly states that it controls with respect to a specific matter.
(T) Modification, Amendment, Waiver. Finite State reserves the right from time to time to modify these Terms and Conditions. If Finite State makes a material change to any of the Terms and Conditions, then Finite State will notify Customer either by email or by posting the updated version to https://finitestate.io/customerterms.
This Annex supplements the Finite State Customer Terms and Conditions (the “Agreement”) and applies solely to Cyber Resilience Act (“CRA”) Compliance Managed Services provided under an applicable Order Form. Capitalized terms have the meanings given in the Agreement. In the event of conflict, this Annex controls with respect to CRA Compliance Managed Services only.
This Annex governs CRA Compliance Managed Services as described in the applicable Order Form. The Agreement continues to apply in full to all other Finite State services and is not modified with respect to platform access, SaaS services, or any service not covered by an Order Form referencing this Annex.
In addition to Customer’s general responsibilities under the Agreement, the following responsibilities apply specifically to CRA Compliance Managed Services:
A. Exploitability and Active Exploitation Determinations.
Where the Order Form includes a pre-market exploitability assessment, Finite State’s findings represent its analytical conclusions as of the date performed and do not constitute a certification that the Customer’s product is free of exploitable vulnerabilities. Customer is solely responsible for determining whether a vulnerability is actively exploited for purposes of CRA Article 14 reporting obligations, and for all decisions regarding market placement.
B. Substantial Modification.
It is Customer’s sole responsibility to determine whether a product change constitutes a “substantial modification” within the meaning of CRA Article 3(31), triggering renewed conformity obligations. Finite State may flag potential triggers in its deliverables, but such flags are analytical inputs only and do not constitute a legal determination.
C. Conformity Assessment and Declaration of Conformity.
Finite State’s role in assembling the Technical Documentation Package and drafting a Declaration of Conformity template does not constitute independent certification, third-party attestation, or regulatory approval of Customer’s product or its conformity assessment. Neither Party will represent it as such to any regulatory authority, notified body, market surveillance authority, or third party.
D. Article 14 Reporting.
Customer is solely responsible for all CRA Article 14 notifications and reports to applicable regulatory authorities. Finite State’s platform capabilities and analytical support inform but do not substitute for Customer’s own reporting obligations and decisions.
Finite State's services under this Annex are limited to identifying gaps in Customer's update delivery and patch management capabilities as part of the applicable risk assessment. Determining, declaring, communicating to buyers, and operating a security update support period that satisfies CRA Article 13(8), including its duration, is Customer's sole responsibility and is not included in Finite State's ongoing managed services.
Finite State’s analytical support in connection with incident investigation is limited to providing platform-derived findings, including vulnerability analysis and component-level data, in support of Customer’s own incident response activities. Such support does not constitute incident response execution, forensic investigation, malware analysis, root cause analysis, or patch development, each of which remains Customer’s sole responsibility. Organizations requiring comprehensive incident response support may engage Finite State’s PSIRT-as-a-Service offering under a separate agreement.
Finite State’s live professional services are performed during standard business hours (Monday through Friday, 9:00 AM – 5:00 PM U.S. Eastern Time, excluding Finite State-observed holidays) unless otherwise agreed in writing. Outside of standard business hours, Finite State will provide automated platform capabilities to assist with CRA Article 14 reporting obligations, but these do not substitute for live analyst review and are not guaranteed to satisfy Article 14 notification content requirements. Customer remains solely responsible for all regulatory filings. Live analyst support outside business hours may be available upon request and may be subject to additional fees.
For clarity, Customer’s CRA Article 14 notification obligations attach upon Customer’s confirmed awareness of the triggering conditions under Article 14(1) or 14(3), and not upon detection of a potential indicator alone.
In addition to the general change order mechanism in Section 5 of the Agreement, the following circumstances specific to CRA Compliance Managed Services may give rise to a change order request by either Party:
A. Harmonized Standards Adoption.
The formal adoption by the European Commission or relevant European Standardisation Organisations of harmonized standards under the CRA may require modifications to service scope, deliverable content, or the standards and specifications relied upon in the conformity assessment.
B. Changes to CRA Implementing Guidance.
The issuance of binding implementing acts, delegated acts, or official guidance materially affecting the interpretation of CRA obligations — including Article 14 reporting procedures, Annex I essential requirements, Annex VII technical documentation requirements, or conformity assessment procedures — may require corresponding modifications to services.
C. Product Reclassification.
A determination that Customer’s product falls within a different CRA product category (Default, Important Class I or II, or Critical) than assumed in the Order Form may require changes to the applicable conformity assessment procedure, documentation requirements, or service scope.
D. Substantial Modification.
A Customer determination that a product change constitutes a substantial modification within the meaning of CRA Article 3(31), triggering renewed conformity obligations, may require additional services beyond those described in the Order Form.
E. Volume or Scope Changes.
Changes in product binary volume, vulnerability disclosure volume, number of enrolled products, or other scope parameters specified in the Order Form.
A. Incorporation of Agreement Limitations.
The limitations of liability in Section 8 of the Agreement apply in full to CRA Compliance Managed Services, including the aggregate cap at twelve months of fees paid under the applicable Order Form.
B. Regulatory Penalties.
Finite State shall not be liable for any regulatory fines, penalties, enforcement costs, or remediation costs arising from Customer’s CRA compliance obligations, regardless of whether such costs arise from reliance on Finite State’s deliverables, assessments, or analytical outputs. Customer acknowledges that regulatory compliance is its sole responsibility as manufacturer and that Finite State’s services are an input to, not a substitute for, Customer’s own compliance program.
C. No Certification Liability.
Neither Party will assert a claim against the other arising solely from the fact that a regulatory authority, notified body, or market surveillance authority has reached a compliance determination contrary to the findings in Finite State’s deliverables, provided that Finite State has performed its services consistent with the performance standard in Section 3(B) of the Agreement.
Finite State reserves the right from time to time to modify this Annex. If Finite State makes a material change to this Annex, Finite State will notify Customer either by email or by posting the updated version to the URL specified in the applicable Order Form.
Finite State shall retain records of Deliverables and underlying analytical findings for a minimum of five (5) years following expiration or termination of the applicable Order Form, or such longer period as required by law.
© 2026 Finite State. All rights reserved.