End User Licence Agreement

NetVane · GRCSAC LLC · Version 1.0 · Effective 13 August 2026

1. Agreement

This End User Licence Agreement ("Agreement") is between you ("you") and GRCSAC LLC, a New Jersey limited liability company ("GRCSAC", "we", "us"), and governs your use of the NetVane software ("NetVane" or the "Software").

By installing, copying or using the Software you accept this Agreement. If you do not accept it, do not install or use the Software, and you may obtain a refund under §14.

If you are accepting on behalf of an organisation, you represent that you have authority to bind that organisation, and "you" means that organisation.

How your purchase is structured. Where you buy the Software through our merchant of record, that merchant is the seller of the transaction — it takes your payment, handles tax, invoicing, refunds and chargebacks, and its own terms govern the sale. GRCSAC remains the licensor of the Software, and this Agreement governs your use of it. The two operate together.

2. Definitions

• Covered Parties — GRCSAC; Doorvane LLC ("Doorvane"), with whom GRCSAC develops NetVane; and the members, officers, employees and agents of each. Doorvane is not a party to this Agreement and owes you no obligation under it; see §19.5.
• Free, Pro, Business — the editions of the Software described at https://netvane.doorvane.com/pricing/.
• Licence Key — the signed licence file we issue that unlocks a paid edition. It records the edition and, for Business, the number of authorised administrators ("seats").
• Trial — the 14-day period described in §4.
• Your Network — a computer network that you own, or that you are authorised by its owner to administer, assess or test. This definition matters; see §5.
• Remediation — a feature by which the Software changes the configuration of a device on Your Network at your request. See §6.

3. Licence grant

Subject to this Agreement, we grant you a perpetual, non-exclusive licence, subject to termination in accordance with §15, to install and use the Software as follows.

3.1 Free. You may use the Free edition indefinitely, at no charge, without a Licence Key and without registering an account. The Free edition is not time-limited and is not a trial.

3.2 Pro. Pro is licensed to one named individual. That individual may install and use the Software on any number of computers that they personally use.

There is deliberately no technical enforcement of this. The Software never contacts us to activate, contains no device limit, and does not identify your machines to us — we consider a licence that phones home to be incompatible with what NetVane is. We rely on this clause and on your good faith instead.

3.3 Business. Business is licensed to one organisation, for use by up to the number of authorised administrators specified in its Licence Key.

3.4 Transfer. Licence Keys are not transferable, except: (a) with GRCSAC's prior written consent; (b) to a successor in connection with a merger, acquisition or sale of substantially all of the assets of the licensed organisation, on written notice to us; or (c) where applicable law requires that a transfer be permitted. On any permitted transfer you must cease all use of the Software and destroy your copies of the Licence Key.

3.5 Reservation. All rights not expressly granted are reserved. This is a licence, not a sale of the Software itself.

4. Trial

On first run, the Software provides the full capability of the Business edition for 14 days, with no account, no payment details, and no obligation.

When the Trial ends, the Software reverts to the Free edition. It does not lock you out, and it does not delete anything. Your scan history, device names, notes and settings remain yours and remain accessible. Findings the Software has already identified stay visible to you.

5. Authorised networks only — your responsibility

5.1 You may use the Software only on Your Network, as defined in §2.

5.2 You acknowledge that the Software identifies devices, open ports, services and security weaknesses, and can change device configuration. Directed at a network you have no right to examine, that activity may be unlawful in your jurisdiction and may breach contracts you are subject to.

5.3 You are solely responsible for ensuring you have the necessary authority before scanning, assessing or changing any network, and for retaining evidence of that authority where you are acting for someone else. We do not verify, and cannot verify, that you have it.

5.4 You must not use the Software to scan, probe or modify any network or device without authorisation; to circumvent security controls you are not authorised to test; or in violation of any applicable law, including laws on unauthorised access to computer systems.

5.5 Indemnity. You will indemnify, defend and hold harmless the Covered Parties from and against any third-party claim, and any resulting loss, liability, damage, penalty, cost or expense (including reasonable attorneys' fees), arising out of your use of the Software on a network that was not Your Network, or otherwise in breach of §5 or §7. The indemnified party will give you prompt written notice of any such claim, reasonable cooperation at your expense, and control of the defence — provided that you may not settle any claim in a way that imposes an obligation or admission on a Covered Party, or that fails to unconditionally release it, without its prior written consent. A Covered Party may participate in the defence with counsel of its own choosing at its own expense.

6. Active remediation

6.1 Where the Software offers to fix a finding — for example, closing a port forwarded from the internet to a device on Your Network — it does so only on your explicit, per-action confirmation. Nothing is changed automatically, and no such change is made without you confirming that specific action.

6.2 Before making a change, the Software records the prior configuration, and afterwards it re-reads the device to verify the change took effect. It keeps an append-only record of what it did, and offers to undo it.

6.3 Undo is best-effort and is not guaranteed. A device that is later reset, replaced, or reconfigured — or that has the relevant protocol disabled — may refuse to accept the restoration. The Software tells you this before you confirm.

6.4 You remain responsible for the consequences of changes you authorise. Closing an exposed port may stop something working that you relied on. The Software describes the likely effect of each action before you confirm it, but it cannot know everything about your network.

6.5 Do not use Remediation on any network where a configuration change could affect medical, industrial, safety-critical or life-sustaining systems.

6.6 We make no representation that Remediation cannot disrupt a service, or that any change will achieve a particular outcome.

7. Permitted and prohibited use

7.1 Consultants, MSPs and security professionals (Business). A Business licensee may use the Software on client networks — including for assessment, monitoring and Remediation — where the client has authorised that work, and where the person using the Software is an authorised administrator of the licensed organisation counted against its seats.

This permission is subject to §5 in full: the licensed organisation is responsible for obtaining the network owner's authority, and nothing here reduces that obligation.

7.2 What that permission does not include. It does not permit you to: sublicense or resell the Software; provide the Software to a client as a hosted, managed or multi-tenant service in which the client operates it; give a client a copy of the Software or of your Licence Key; or represent that a client holds a licence.

7.3 Otherwise, you must not: reverse engineer, decompile or disassemble the Software except to the extent applicable law expressly permits despite this restriction; rent, lease or lend it; remove or alter any proprietary notice; forge, tamper with, or attempt to manufacture a Licence Key; or use the Software to develop a competing product.

8. Licence Keys

8.1 Licence Keys are issued by us after purchase, ordinarily within 24 hours, to the email address given at purchase. Because the Trial (§4) gives full capability from first run, you are not without the Software while waiting.

8.2 Licence Keys are verified entirely on your computer, against a key built into the Software. Activating a Licence Key generates no network traffic and works on a computer that has never been connected to the internet.

8.3 Keep your Licence Key confidential. We may decline to reissue a key we have reason to believe has been shared or published.

8.4 Removing a Licence Key from the Software removes only the Licence Key. It does not remove your scan history, devices, notes or settings.

9. Updates and intelligence services

9.1 The Software may check for updates and, in paid editions, periodically download vulnerability and device-fingerprint intelligence. §10 describes what those requests contain.

9.2 These are services, and we may modify or discontinue them. Your licence to use the version of the Software you hold is perpetual and is unaffected. "Perpetual" refers to your right to keep using the licensed Software — it is not a commitment to operate intelligence feeds, update infrastructure or other online services indefinitely.

9.3 If a feed is discontinued, the Software continues to work using the data already available to it locally, and will tell you the data is no longer being refreshed rather than silently going stale.

9.4 Updates are cryptographically signed. The Software refuses any update that does not verify.

10. Privacy — what leaves your computer, and what does not

This section is a commitment, not a description of current practice that we may change.

10.1 We operate no account system, collect no analytics, and receive no telemetry. NetVane does not transmit to GRCSAC — or to any third party except as you direct under §10.2(d) — any of: your device inventory, your network topology or addressing, your scan results, your findings or vulnerabilities, your device names or notes, or any record of how you use the Software.

The only exceptions are the specifically described connections in §10.2 and the support report in §10.3, which you choose to send.

10.2 The Software makes outbound network connections only for the following, and it records every one of them in an in-product ledger you can inspect:

a. Update checks — retrieving a signed version file from our distribution hosts. The request contains no information about you or your network beyond what any HTTPS request necessarily reveals to the host serving the file, namely your IP address. b. Intelligence refresh (paid editions) — downloading vulnerability and fingerprint data files. These are downloads: we send you data, you send us none about your network. c. Internet connection quality checks — where you use that feature, the Software measures latency and throughput against public endpoints. d. Alerts you configure — if you set up webhook alerting, the Software sends alert content to the destination you specify. That destination is yours, not ours, and what it receives is documented in the product's alerting guide before you enable it. e. A support report, only if you send one — see §10.3.

10.3 If you ask us for help, you may send a diagnostic report. It is user-initiated behind an explicit consent control, it is redacted before it leaves (IP addresses and MAC addresses stripped, no scan contents included), and it is recorded in the ledger like any other outbound request. Nothing is sent unless you click send.

10.4 We process the email address you give at purchase, and the name on your licence, to issue and support your licence. Our privacy notice is at https://netvane.doorvane.com/privacy/. The merchant of record processes your payment; we never see your card details.

11. Third-party components

The Software includes open-source components licensed by their respective authors. Those components and their licences are listed in the notices accompanying the Software — installed as NOTICES.txt beside the program, and published at https://netvane.doorvane.com/notices/. Those licences govern those components, and nothing in this Agreement limits any right you have under them.

12. Disclaimer of warranties

THE SOFTWARE IS PROVIDED BY THE COVERED PARTIES "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement. Every disclaimer in this §12 is made by, and for the benefit of, each of the Covered Parties.

Specifically, and importantly for a security product:

12.1 We do not warrant that the Software will identify every vulnerability, every device, every exposure or every risk on Your Network. No such tool can. A device may be missed, a service misidentified, a vulnerability unknown, or intelligence data out of date or wrong.

12.2 The Software is not a substitute for professional security assessment, and is not a certification, audit, or attestation of security or of compliance with any standard.

12.3 A clean result from the Software does not mean Your Network is secure.

12.4 We do not warrant that the Software will be uninterrupted or error-free, or that any change it makes at your request (§6) will achieve any particular outcome.

13. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

13.1 No Covered Party is liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, lost data, business interruption, loss of goodwill, or the cost of substitute products, however caused and on any theory of liability, even if advised of the possibility.

13.2 The total aggregate liability of the Covered Parties under or relating to this Agreement will not exceed the greater of (a) the amount you actually paid for the licence of the Software giving rise to the claim, or (b) one hundred US dollars ($100).

This is a single, combined cap across all Covered Parties taken together — not a separate cap for each. Claims against more than one of them, or against the same one on more than one theory, do not increase it.

13.3 Nothing in this Agreement excludes or limits liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, or for fraud.

13.4 Some jurisdictions do not allow certain exclusions or limitations, so parts of §12 and §13 may not apply to you. In that case they apply to the fullest extent permitted. Where the mandatory consumer law of your jurisdiction gives you rights greater than this Agreement provides, those rights control, and nothing in this Agreement is intended to waive them.

14. Refunds

If the Software is not right for you, tell us within 14 days of purchase and we will refund you in full. You do not need to give a reason.

Refunds are processed by our merchant of record in accordance with its terms. This policy is in addition to any right you have under applicable consumer law — including any statutory cancellation or withdrawal right — which this Agreement does not affect.

15. Term and termination

15.1 This Agreement takes effect when you first install or use the Software and continues until terminated.

15.2 It terminates automatically if you materially breach it, in particular §5 or §7.

15.3 On termination you must stop using the Software and remove it. §4's protections survive: uninstalling does not require you to surrender your own data, and we never have it in the first place.

15.4 §§5.5, 10, 11, 12, 13, 16, 17 and 19.5 survive termination.

16. Changes to this Agreement

We may update this Agreement for future versions of the Software. Changes do not apply retroactively to a version you have already licensed — the terms you accepted continue to govern that version. If you install a later version, the Agreement accompanying it governs that version, and you will be shown it.

17. Governing law and disputes

This Agreement is governed by the laws of the State of New Jersey, United States, without regard to conflict-of-laws rules.

The exclusive venue for any dispute is the state courts located in Monmouth County, New Jersey, and the United States District Court for the District of New Jersey, as applicable, and each party consents to that jurisdiction.

The UN Convention on Contracts for the International Sale of Goods does not apply.

18. Export and government use

You may not use or export the Software in violation of United States export laws. The Software is "commercial computer software" as defined in FAR 2.101; US Government use is subject to this Agreement.

19. General

19.1 Entire agreement. This Agreement is the entire agreement between you and GRCSAC about your use of the Software, superseding prior communications about it. It does not supersede the separate terms of the merchant of record through whom you purchased, which govern the sale itself.

19.2 Severability. If a provision is unenforceable, it is modified to the minimum extent necessary, or severed, and the rest remains in effect.

19.3 No waiver. A failure to enforce a provision is not a waiver of it.

19.4 Assignment. You may not assign this Agreement except as §3.4 permits. We may assign it in connection with a merger, acquisition, or sale of assets.

19.5 Third-party beneficiary. NetVane is developed by GRCSAC in collaboration with Doorvane LLC. GRCSAC is the sole licensor of the Software and your only counterparty under this Agreement.

The parties expressly intend that Doorvane be a third-party beneficiary of §5.5 (indemnity), §12 (disclaimer of warranties) and §13 (limitation of liability), and that Doorvane may enforce those provisions directly against you as if it were a party to them.

For the avoidance of doubt: Doorvane owes you no obligation under this Agreement, makes no warranty and provides no support, and is not liable to you for the Software except as §13's combined cap allows. No person other than the Covered Parties has any right to enforce any term of this Agreement.

20. Contact

GRCSAC LLC 918 8th Street, Union Beach, New Jersey 07735, United States netvane@grcsac.com