Optimus is offered on a monthly recurring subscription basis. As of the Effective Date, Optimus subscription tiers include the following:

*Unlimited subject to acceptable use, technical limits, abuse-prevention controls, provider limitations, and any restrictions stated in the Terms of Service, this Addendum, or the applicable order form.

Domain limits and Vendor Invite limits are enforced at the API layer based on the Enterprise Client's active Subscription Plan. Limits are stored per enterprise account record and cannot be exceeded through normal platform operation. ALCE may adjust tier limits, pricing, features, and configurable parameters from time to time. Changes to active subscription pricing will be communicated with reasonable notice as described in the Terms of Service.

Optimus subscriptions are billed monthly on a recurring basis beginning on the date of initial subscription. Payment is processed through Stripe. Enterprise Client authorizes ALCE and its payment processor to charge the designated payment method for recurring monthly fees, applicable taxes, and other charges associated with the active Subscription Plan. Payment terms, failed payment consequences, chargeback policy, and pricing change procedures are governed by the Terms of Service.

Access to Optimus platform features, including domain monitoring, vendor invite generation, CVE alerts, dashboard access, report history, and scan history, is conditioned on an active, paid subscription in good standing. ALCE may suspend or terminate access for non-payment, failed payment, chargeback, account misuse, unauthorized scanning risk, provider complaint, legal risk, security risk, abuse risk, or violation of these Terms or any applicable addendum as described in the Terms of Service.

Enterprise Client may cancel the Optimus subscription at any time. Upon cancellation, access to the Optimus platform will continue through the end of the then-current monthly billing period. Following the end of the final billing period, Enterprise Client access, Vendor access, monitoring workflows, vendor invite flows, CVE alerting, dashboard access, and report history access will cease. Enterprise Clients are responsible for exporting or downloading any scan history, reports, or records they require before access ends. ALCE is not responsible for data loss where Enterprise Client failed to export required data before access termination.

Before enabling continuous monitoring for any domain, Optimus requires Enterprise Client to complete a two-step authorization process:

(a) Authorization Acknowledgment. Enterprise Client must accept an authorization acknowledgment confirming that they own the domain or have legal authority to authorize automated security scanning of that domain and its publicly reachable subdomains. The acknowledgment timestamp and terms version are recorded in the domain_verifications table.

(b) DNS TXT Record Verification. Optimus generates a unique DNS Verification Token for each submitted domain. Enterprise Client must publish this token as a DNS TXT record in the domain's DNS configuration. Optimus verifies that the token is present before enabling monitoring. A domain status transitions from pending to verified only upon successful DNS TXT record verification.

DNS ownership verification is a technical safeguard designed to reduce the risk of unauthorized monitoring. It does not constitute ALCE's independent legal determination that Enterprise Client has all required legal, contractual, hosting-provider, or third-party permissions to authorize scanning. Enterprise Client remains solely responsible for ensuring that monitoring is lawfully authorized for each domain added to their account.

Before initiating each scheduled monthly scan, Optimus independently re-verifies that the DNS Verification Token remains published in the domain's DNS configuration. If the token has been removed, Optimus automatically marks the domain status as removed, sends a DNS removal notification email to the Enterprise Client, and does not initiate the scan. Monitoring for that domain remains suspended until the token is republished and verification is re-confirmed. This re-verification occurs at every scheduled scan cycle and is not waivable.

Automated monitoring scans run on the first day of each calendar month at 7:00 AM UTC for all domains with verified status belonging to active Enterprise Client accounts. Scans are not initiated for domains with pending, failed, or removed verification status, or for accounts with a canceled, past_due, or suspended subscription status at the time of the scheduled scan cycle. Each monthly monitoring scan executes the full 21-module Ghost scan against the Monitoring Domain.

Upon scan completion, Optimus writes a summary record to the Enterprise Client's scan_history table and sends the Enterprise Client the full scan report PDF by email along with a monthly summary email. The full report JSON is retained in the scan_jobs table for up to seven (7) days following confirmed delivery, after which it is deleted from active production systems. ALCE does not guarantee uninterrupted monitoring, scan completion by any particular time, or continued availability of any particular scan module.

In addition to monthly full-scope scans, Optimus monitors SSL certificate expiry for verified Monitoring Domains using TLS handshake checks. Certificate expiry warnings are generated and delivered to Enterprise Client as the certificate approaches expiration. Certificate monitoring is automated and informational only. ALCE does not guarantee detection of all certificate issues, real-time certificate status monitoring, or alert delivery during platform outages or email delivery failures.

Optimus retains summary-level scan metadata in the scan_history table for the life of the active Enterprise Client account. Summary metadata includes domain, score, grade, critical, high, and medium finding counts, scan timestamp, and trigger type. The full scan report JSON is not stored in scan_history. Full report JSON is retained in the scan_jobs table for up to seven (7) days following confirmed delivery or scan completion, after which it is deleted from active production systems. Enterprise Clients are responsible for downloading and retaining full reports during the applicable seven-day window. ALCE is not responsible for report loss after the seven-day retention period expires.

Enterprise Clients may generate Vendor Invites through the Optimus dashboard. Each Vendor Invite is associated with a specific Designated Domain selected by the Enterprise Client at the time of invite creation. The platform generates a unique, cryptographically random 48-character hexadecimal token for each invite. The invite token is single-use. Once a Vendor accepts the invite and the scan is initiated, the invite status changes from pending to completed and the token is permanently consumed. Any subsequent attempt to use the same token returns an HTTP 400 error. Revoked invites cannot be reactivated.

The Designated Domain associated with each Vendor Invite is enforced server-side through the platform's access control list at the API layer. When a Vendor submits a domain through the vendor scan workflow, the submitted domain is validated against the allowed_domain field of the corresponding invite record using exact string matching, stripping leading www prefixes. Any submission that does not exactly match the ACL-designated domain is rejected with an HTTP 403 error and no scan is initiated. There is no mechanism through which a Vendor can modify, expand, substitute, or circumvent the Designated Domain. The ACL enforcement is not dependent on client-side controls and cannot be overridden by the Vendor.

When a Vendor accesses a Vendor Invite link, the Optimus platform presents the Vendor with the Designated Domain pre-filled and non-editable. Before the scan can be initiated, the Vendor must complete three required acknowledgments:

(a) Authorization Acknowledgment. Vendor confirms that they have legal authority to authorize automated security scanning of the Designated Domain, that such authorization covers the active technical testing described in the Ghost Product Addendum and this Addendum, and that such use complies with all applicable laws, contracts, hosting agreements, and third-party policies.

(b) Terms Acceptance. Vendor independently agrees to the ALCE Consulting LLC Terms of Service, this Addendum, and the Ghost Product Addendum. The Vendor's acceptance constitutes a separate, independent agreement between the Vendor and ALCE, distinct from the Enterprise Client's agreement with ALCE.

(c) Report-Sharing Acknowledgment. Vendor acknowledges that scan results, report summaries, scores, grades, finding counts, risk indicators, completion status, and related metadata will be made available to the Enterprise Client that initiated the invite through dashboards, email notifications, and other product workflows.

All three acknowledgments must be affirmatively completed before the platform initiates the scan. The platform does not allow partial completion or bypass of any acknowledgment.

At the moment of Vendor acceptance and scan initiation, Optimus writes a Vendor Consent Record to a dedicated database table that is separate from the scan_jobs table. Vendor Consent Records are not subject to the seven-day scan job deletion schedule. The database foreign key from Vendor Consent Records to vendor invite records is configured to set the invite reference to null on invite deletion rather than cascade-delete the consent record. As a result, Vendor Consent Records are not subject to the seven-day scan job deletion schedule or the thirty-day post-cancellation enterprise account deletion schedule.

Vendor Consent Records are retained for a minimum of three (3) years from the date of acceptance, unless a longer period is required or reasonably necessary for legal compliance, fraud prevention, abuse prevention, provider complaint response, dispute resolution, enforcement, or claim defense.

Vendor Consent Records include without limitation: timestamp of acceptance, IP address of the accepting device, user agent, session identifier, Vendor email address, Designated Domain accepted, Vendor Invite identifier, authorization acknowledgment status, report-sharing acknowledgment status, the version of the ALCE Consulting LLC Terms of Service accepted; the version of this Addendum accepted; and the version of the Ghost Product Addendum accepted. Each version is recorded in a separate dedicated field within the Vendor Consent Record.

If a Vendor accepts a Vendor Invite and authorizes scanning of the Designated Domain without having legal authority to do so, the Vendor bears full responsibility for any resulting claim, damage, regulatory action, provider complaint, third-party complaint, contractual dispute, or legal consequence. ALCE's reliance on the Vendor's authorization representation is commercially reasonable given the technical controls in place, and ALCE shall not be liable for claims arising from a Vendor's false, inaccurate, incomplete, or unauthorized authorization representation to the maximum extent permitted by applicable law.

Enterprise Clients are responsible for ensuring that the Vendors they invite are appropriate parties for assessment of the Designated Domains, have legal authority to accept the scope of scanning described in this Addendum and the Ghost Product Addendum, and will comply with the Terms of Service, this Addendum, the Ghost Product Addendum, and all applicable laws. Enterprise Clients assume responsibility for Vendor conduct on the platform to the extent such conduct was authorized, facilitated, configured, or enabled by the Enterprise Client.

Scan results generated for a Vendor's Designated Domain are made available to the Enterprise Client that initiated the invite through dashboards, email notifications, and other product workflows. Enterprise Clients own the scan results generated for their invited Vendors within the context of their enterprise account. Vendors may access their own scan results through the platform during the applicable retention period. Vendor scan data is not shared with other Enterprise Clients, used to improve scanning for unrelated engagements, or sold to third parties, except as necessary to operate the platform, prevent fraud and abuse, comply with law, respond to legal process, enforce applicable terms, or defend against claims.

If an Enterprise Client's relationship with a Vendor ends, the Enterprise Client may revoke or archive the Vendor's invite record within the platform to the extent such functionality is available. Vendor scan records in scan_history are retained for the life of the active Enterprise Client account. Full report JSON is retained for up to seven (7) days following delivery and then deleted from active production systems. Vendor Consent Records are retained for a minimum of three (3) years from acceptance as described in Section 6.4.

Optimus performs automated daily CVE cross-referencing for all active Enterprise Client accounts. The process runs daily at 6:00 AM UTC. For each active enterprise account, Optimus reads all technology stack records stored in the domain_tech_stacks table for that account's Monitoring Domains and performs matching against ALCE's internal CVE database using technology name and version prefix matching logic. The CVE database used for matching is an internal Supabase database table maintained by ALCE. No domain data, technology stack data, user data, or account data is transmitted to external CVE data providers, external vulnerability databases, or third-party enrichment services as part of the CVE matching process.

When a new CVE match is identified, Optimus inserts a CVE alert record in the cve_alerts table and sends an email notification to the Enterprise Client. If a previously identified CVE match that was marked as resolved is still present in the current technology stack data, the alert is automatically re-opened and the Enterprise Client is notified. CVE alert records persist for the life of the active Enterprise Client account and are deleted as part of the post-cancellation data deletion process described in Section 9.4.

CVE alerts are automated informational outputs generated from technology fingerprint matching and may include false positives, false negatives, incomplete version matches, outdated CVE references, missed technologies, incorrect technology fingerprints, reopened alerts for resolved issues, or duplicate alerts. A CVE alert does not mean the affected domain or system is exploited, actively vulnerable, breached, unpatched, or legally noncompliant. Enterprise Clients are solely responsible for independently validating all CVE alerts before taking remediation, procurement, contractual, legal, insurance, compliance, or vendor-management action. ALCE has no duty to manually review CVE matches, confirm exploitability, validate patches, or provide remediation guidance.

All scans initiated through Optimus use the full 21-module Ghost scanning engine. The complete list of technical actions, active probing techniques, scan methods, module descriptions, and scan limitations is set forth in the Ghost Product Addendum and incorporated into this Addendum by reference.

Authorization for a Monitoring Domain or Designated Domain includes publicly reachable subdomains under the same registrable domain, including subdomains identified through DNS queries, certificate-transparency lookups, or common-prefix enumeration conducted as part of the scan. Enterprise Clients and Vendors represent and warrant that their authorization covers such publicly reachable subdomains. Authorization does not extend to unrelated third-party domains, third-party SaaS platforms, internal networks, private IP ranges, authenticated systems, or systems outside the expressly designated scope.

Optimus independently rejects scan requests resolving to private, loopback, link-local, or reserved IP address ranges at both submission time and scan initiation. This dual validation is implemented independently in both the API layer at domain submission and in the Celery task worker at scan initiation, closing the window between submission and execution. This safeguard operates automatically and cannot be disabled by Enterprise Clients or Vendors.

Optimus does not authenticate into or log in to any system, exploit vulnerabilities, inject payloads or execute malicious code, modify data on target systems, brute force credentials or session tokens, perform denial-of-service testing, conduct social engineering, perform recursive directory crawling, scan internal or private IP ranges, access email message content, store, validate, or attempt to exploit exposed credentials detected during scanning, or perform any technique designed to compromise, bypass, or damage target systems. Email security assessment is limited to DNS record analysis, including SPF, DKIM, and DMARC records.

For active Enterprise Client accounts, the following retention periods apply unless a longer retention period is required or reasonably necessary for legal compliance, fraud prevention, abuse prevention, provider complaint response, dispute resolution, enforcement, or claim defense:

• Scan report JSON for vendor scans and monthly monitoring scans: up to seven (7) days following confirmed delivery or scan completion, then deleted
• scan_history metadata (score, grade, finding counts, scan timestamp, trigger type): retained for the life of the active Enterprise Client account
• domain_tech_stacks records (technology fingerprint data): retained for the life of the active Enterprise Client account
• cve_alerts records: retained for the life of the active Enterprise Client account
• vendor_invites records (invite summary data, status, completed_at timestamp, and related vendor assessment metadata): retained for the life of the active Enterprise Client account
• domain_verifications records (ownership verification records, DNS verification token status, authorization acknowledgments, and verification timestamps): retained for the life of the active Enterprise Client account
• enterprise_accounts records: retained for the life of the active Enterprise Client account
• Vendor Consent Records: retained for a minimum of three (3) years from the date of Vendor acceptance, in a separate dedicated table, not subject to the seven-day scan report deletion schedule or the thirty-day post-cancellation enterprise account deletion schedule

The scan_history table stores summary-level metadata only. It does not store full scan report JSON. Full scan report JSON is stored exclusively in the scan_jobs table and is subject to the seven-day deletion schedule described in Section 5.5 and the Ghost Product Addendum. Enterprise Clients requiring long-term retention of full report content are responsible for downloading reports within the applicable seven-day window.

Vendor Consent Records are stored in a dedicated database table that is operationally and structurally separate from the scan_jobs table. The seven-day scan job deletion task does not access, modify, or delete Vendor Consent Records. The database foreign key from Vendor Consent Records to vendor invite records is configured to set the invite reference to null on invite deletion rather than cascade-delete the consent record. As a result, Vendor Consent Records survive deletion of dashboard data, scan history, vendor invite records, and enterprise account records and are retained independently for the duration specified in Section 6.4.

For clarity, Vendor Consent Records are not subject to the seven-day scan job deletion schedule or the thirty-day post-cancellation enterprise account deletion schedule. Vendor Consent Records may be retained beyond enterprise account deletion to the extent reasonably necessary for legal compliance, fraud prevention, abuse prevention, provider complaint response, dispute resolution, enforcement, or claim defense.

Following cancellation of an Optimus subscription, all enterprise account data is retained in active production systems for up to thirty (30) days beginning on the effective date of cancellation. The delete_after date is set at the time of cancellation and is enforced by an automated Celery task running daily at 5:00 AM UTC. Upon reaching the delete_after date, enterprise data is hard-deleted from active production systems in the following cascading order: CVE alerts, technology stack data, scan history metadata, vendor invite records, domain verification records, and enterprise account records.

The thirty-day post-cancellation retention period begins on the effective date of cancellation regardless of the remaining billing period. Enterprise Clients are responsible for exporting required data before the delete_after date. ALCE is not responsible for data loss after the hard-delete date. Post-cancellation deletion does not include Vendor Consent Records, payment records, Stripe billing records, abuse-prevention records, legal records, tax records, accounting records, provider complaint records, security logs, or other operational records retained for legitimate business, legal, security, compliance, fraud-prevention, abuse-prevention, dispute-resolution, or claim-defense purposes.

Deletion from active production systems does not require immediate deletion from encrypted backups, disaster-recovery systems, Supabase database-level logs, SendGrid email delivery logs, Stripe payment records, Redis task records, Render.com application logs, or other operational systems maintained by ALCE or its service providers. Such residual records are retained, overwritten, or anonymized according to the applicable retention cycles for those systems. ALCE does not use residual backup or log data to recreate Reports or enterprise account data for ordinary business purposes.

Enterprise Client access to the Optimus platform is managed through Supabase Auth. Enterprise Clients authenticate using email and password credentials managed by Supabase. Session tokens are managed by Supabase Auth JS client. Inactivity auto-logout is implemented in the Optimus frontend.

Vendor access to the Optimus platform is token-based. Vendors do not create Supabase Auth accounts. Vendor access is scoped exclusively to the specific Vendor Invite workflow associated with their invite token and cannot be expanded to other platform features, Enterprise Client dashboard data, other vendor records, or other scan results.

Optimus enforces row-level security on all enterprise data tables. Enterprise Client users can only access records belonging to their own enterprise account. Cross-account data access through normal platform operation is not possible. Vendor invite records are subject to a deny-all policy -- all vendor invite access is routed exclusively through the FastAPI service role, and direct client-side database queries against the vendor_invites table are blocked to protect raw invite tokens.

Access to scan report JSON and PDF reports is restricted to HMAC-SHA256 signed access tokens derived from the scan identifier and a server-side secret key. Unauthenticated access to report content is not permitted. Report access tokens are generated at scan completion and are valid only for the duration of the applicable report retention period.

Optimus API endpoints are subject to rate limiting and abuse-prevention controls as appropriate to the applicable endpoint and operational environment. Rate limits are applied per endpoint and per identifier to reduce abuse risk. ALCE may adjust rate limits for operational, security, or abuse-prevention reasons.

Enterprise Client data, including scan records, domain verification records, vendor invite records, CVE alerts, and technology stack data, is logically isolated within the platform through row-level security policies. One Enterprise Client's data is not accessible to another Enterprise Client through normal platform operation. Data transmitted between users and the Optimus platform is encrypted using TLS. Data stored in Optimus's primary database infrastructure is encrypted at rest using the encryption controls provided by Supabase and ALCE's infrastructure providers.

No security practice, authentication control, encryption, access control, or technical safeguard eliminates all risk. ALCE cannot guarantee that the Optimus platform is immune from unauthorized access, disclosure, alteration, loss, or misuse despite these measures.