Overlook Government Supplemental Terms (FAR/DFARS)

These Government Supplemental Terms (the “Government Terms”) supplement and, where applicable, modify the agreement governing the purchase, access, deployment, licensing, support, professional services, or other use of Overlook products and services by or for a Government Customer. These Government Terms are intended to preserve Overlook’s commercial contracting model, proprietary software rights, trade secret protections, data rights, security allocation, and standard commercial limitations when Overlook products or services are acquired by a federal, state, local, tribal, territorial, public-sector, quasi-governmental, or government-contractor customer.

1. Scope; Incorporation; Covered Customers

1.1 These Government Terms are incorporated into, and form part of, the applicable Subscription and Software License Agreement, Commercial Software License, Order Form, Statement of Work, Professional Services Addendum, public Terms of Service, reseller order, government purchase order, marketplace order, or other written agreement under which Overlook makes Services, Software, Documentation, Professional Services, support, training, implementation, or related offerings available to a Government Customer (collectively, the “Agreement”).

1.2 For purposes of these Government Terms, “Government Customer” means: (a) the United States Government, including any federal executive agency, department, independent establishment, instrumentality, or other federal entity; (b) any state, local, tribal, territorial, municipal, public authority, public university, public hospital, or other public-sector entity; (c) any prime contractor, subcontractor, federally funded research and development center, grantee, recipient, reseller, integrator, consultant, or other entity that acquires or uses Overlook offerings for, on behalf of, or in support of a government or public-sector entity; and (d) any Authorized User acting under the account or authority of the foregoing.

1.3 These Government Terms apply only to the extent the Services or Software are acquired by or for a Government Customer. They do not, by themselves, obligate Overlook to accept government-unique obligations, security certifications, audit regimes, procurement clauses, source-code escrow, data-delivery obligations, or public-sector compliance obligations unless such obligations are expressly identified in an executed Order Form or written addendum signed by Overlook.

1.4 These Government Terms are intended to preserve the parties’ commercial agreement while recognizing government procurement requirements. If a Government Customer is a prime contractor, subcontractor, reseller, systems integrator, or other non-government entity, all payment, indemnity, liability, confidentiality, intellectual property, security, data protection, and dispute provisions in the Agreement remain enforceable against that entity except to the extent expressly modified in an executed written agreement signed by Overlook.

2. Definitions

2.1 “Commercial Computer Software” and “Commercial Computer Software Documentation” have the meanings given under applicable FAR, DFARS, or other procurement regulations and include the Software, Hosted Services functionality, Documentation, APIs, container images, deployment artifacts, machine images, installation materials, administrative tools, configuration files, and other executable or machine-readable materials made available by Overlook.

2.2 “Commercial Item” or “Commercial Product” means a commercial product, commercial service, commercially available off-the-shelf item, or other commercial offering as those terms are used in applicable procurement law, including FAR Part 2 and FAR Part 12, as applicable.

2.3 “Covered Defense Information,” “Controlled Unclassified Information,” “Federal Contract Information,” and similar government data categories have the meanings given under the applicable statute, regulation, contract clause, or ordering document that expressly applies to the Order.

2.4 “Government Data” means Customer Data provided by or on behalf of a Government Customer, including government-furnished information, Customer business information, Customer operational records, Customer AI Profile content, Customer-entered Canvas entries, Customer assessment responses, and other Customer Materials, but excluding Overlook Technology, Overlook Materials, Overlook methodologies, Overlook scoring logic, Overlook templates, Overlook training content, Overlook software, Overlook Documentation, Overlook de-identified analytics, and Overlook proprietary know-how.

2.5 “Overlook Technology” means the Services, Software, Documentation, Hosted Services, APIs, object code, source code, architecture, platform workflows, product designs, templates, business-led AI management methods, Business-led AI Management Assessment, Business-led AI Management Scorecard, scoring logic, weighting systems, Business-led AI Management Canvas design, facilitation methods, training materials, implementation methods, internal playbooks, professional-services delivery methods, non-public concepts, analytics methods, and all improvements, modifications, derivative works, and intellectual property rights therein.

3. Order of Precedence

3.1 If there is a direct conflict between these Government Terms and another part of the Agreement, the following order of precedence applies solely with respect to the affected Government Customer Order: (a) an Order Form or government-specific schedule executed by Overlook and expressly identifying the clause or requirement to be modified; (b) these Government Terms; (c) the Subscription and Software License Agreement or other master agreement; (d) the Commercial Software License for packaged Software; (e) the Data Processing Addendum, Security Addendum, Service Level Agreement, Professional Services Addendum, and Acceptable Use Policy, as applicable; and (f) any purchase order, task order, reseller form, marketplace form, government portal terms, or other customer-issued document, except to the extent Overlook has expressly accepted a conflicting term in a signed writing.

3.2 No government purchase order, invoice instruction, procurement portal term, online marketplace term, reseller flow-down, security questionnaire, certification request, agency-specific standard term, or other unilateral document will amend the Agreement or impose government-unique obligations on Overlook unless expressly accepted in writing by an authorized signatory of Overlook.

4. Commercial Nature of Overlook Offerings

4.1 The Services, Software, Documentation, Professional Services, support, training, and related offerings are commercial offerings developed at private expense. Unless expressly stated otherwise in an executed Order Form, Overlook provides only commercial access, commercial subscription rights, commercial object-code software license rights, commercial documentation rights, and commercial support rights customarily provided to similarly situated non-government customers.

4.2 No Order grants the Government Customer unlimited rights, government purpose rights, source-code rights, manufacturing rights, distribution rights, reseller rights, data-delivery rights, training-rights in Overlook methodologies, or rights to disclose Overlook Technology to third parties except as expressly stated in the Agreement.

4.3 The parties agree that Overlook does not perform custom software development for the Government Customer, does not assign intellectual property to the Government Customer, and does not develop deliverables at government expense unless an executed Statement of Work expressly states otherwise and is signed by Overlook.

5. U.S. Government Rights in Commercial Computer Software and Documentation

5.1 If the Software, Services, or Documentation are acquired by or for the U.S. Government, they are commercial computer software and commercial computer software documentation developed exclusively at private expense. The U.S. Government receives only the rights expressly granted in the Agreement, the Commercial Software License, these Government Terms, and the applicable Order Form, consistent with FAR 12.212, FAR 52.227-19 where applicable, DFARS 227.7202-3, DFARS 252.227-7015, and successor provisions or agency supplements addressing commercial computer software and commercial technical data.

5.2 The Government Customer may use the Software and Documentation only for the number of Authorized Users, AI Profiles, Agent Messages, environments, deployment scopes, support entitlements, subscription periods, and other usage metrics specified in the applicable Order Form. Any use by another agency, office, command, contractor, subcontractor, affiliate, instrumentality, or other government component requires additional rights unless expressly authorized in the Order Form.

5.3 The Government Customer may not use, reproduce, modify, distribute, disclose, transfer, sublicense, publish, reverse engineer, decompile, disassemble, benchmark, or make derivative works of the Software, Services, Documentation, Overlook Technology, or Overlook Materials except as expressly permitted in the Agreement or as required by non-waivable law. The Government Customer may not remove proprietary notices or use Overlook Technology to create or support a competing product, assessment, scorecard, canvas, service framework, or methodology.

5.4 If FAR 52.227-19, DFARS 252.227-7015, or similar clauses are included in an applicable government contract, the parties intend that those clauses operate consistently with, and not in expansion of, the commercial license rights expressly granted by Overlook. To the extent a clause permits the parties to specify license restrictions, the restrictions in the Agreement, the Commercial Software License, and these Government Terms are deemed specified license restrictions.

6. No Source Code; No Escrow; No Technical Data Delivery

6.1 Unless an executed Order Form signed by Overlook expressly states otherwise, Overlook will not deliver source code, build scripts, non-public architecture materials, model weights, scoring formulas, weighting systems, vulnerability reports, penetration-test results, internal policies, internal playbooks, trade secrets, or other non-public technical information. Any disclosure of security, architecture, or compliance materials will be subject to Overlook’s confidentiality, security, and responsible disclosure requirements.

6.2 No provision of the Agreement will be interpreted to require Overlook to provide software escrow, source-code access, technical data packages, unlimited rights deliverables, government purpose rights deliverables, rights in successful proposals, or other data-rights deliverables unless expressly agreed in a separate written agreement signed by Overlook.

7. Government Data; Customer Data; Overlook Intellectual Property

7.1 Government Customer retains its ownership rights in Government Data and Customer Data, subject to the Agreement. Overlook receives only the rights necessary to provide, secure, support, operate, maintain, and improve the purchased offerings; comply with law; enforce the Agreement; and exercise rights expressly granted under the Agreement, including rights to use aggregated, anonymized, or de-identified information where permitted by the Agreement and applicable law.

7.2 Overlook retains all right, title, and interest in Overlook Technology. Without limiting the foregoing, Overlook retains ownership of the Business-led AI Management Assessment, Business-led AI Management Scorecard, scoring logic, weighting systems, Business-led AI Management Canvas design, training materials, workshop methods, facilitation methods, implementation methods, professional services playbooks, documentation, internal concepts, product workflows, templates, and all improvements, modifications, and derivative works of any of the foregoing.

7.3 Customer-specific entries, responses, assessment inputs, completed Canvas entries, AI Profile records, Customer business-context information, Customer operating-area descriptions, Customer ownership fields, Customer priorities, Customer-specific continuation plans, and other Customer-specific content entered into the Services or produced during Professional Services are Customer Data to the extent they do not include Overlook Technology or Overlook Materials. Customer may use such Customer Data for Customer’s internal government or business purposes in accordance with the Agreement.

7.4 Government Customer may not use assessment results, readiness insights, scorecard results, Canvas outputs, workshop observations, training materials, or other Services outputs to reverse engineer, derive, replicate, benchmark, or create a competing assessment, scorecard, canvas, operating model, methodology, professional services offering, or software product.

8. Professional Services; Training; Assessment and Canvas Engagements

8.1 Professional Services provided to or for Government Customers are governed by the Professional Services Addendum, the applicable Services Schedule, and the Order Form. Professional Services are designed to support product adoption, product configuration, business-led AI management setup, training, and guided use of the platform, and are not intended to provide legal, compliance, audit, certification, engineering, model-development, security-assessment, or government accreditation services unless expressly agreed in a signed Statement of Work.

8.2 Government Customer may use Overlook-provided training materials, workshop materials, templates, scorecard-related outputs, and canvas-related materials solely for internal use in connection with the purchased Services and during the applicable subscription term, unless the Order Form expressly states otherwise. Government Customer may not record workshops, redistribute training materials, train third-party consultants, or publish non-public Overlook materials without Overlook’s prior written consent.

8.3 Completion of Professional Services does not constitute a certification, security authorization, authority to operate, legal opinion, compliance determination, audit attestation, validation of an AI system, or guarantee of AI readiness, business impact, risk reduction, return on investment, or operational outcome.

9. Security; GovCloud; FedRAMP; CUI; CDI; Public-Sector Data

9.1 Overlook’s security obligations are governed by the Agreement, the Security Addendum, the Data Processing Addendum, and any express security commitments stated in the applicable Order Form. References to AWS GovCloud, FedRAMP, NIST, Impact Level, CMMC, FISMA, or other government frameworks do not constitute a representation that Overlook has obtained any particular authorization, assessment, certification, or agency sponsorship unless the Order Form expressly states that authorization, assessment, certification, or sponsorship status.

9.2 Unless expressly stated in an executed Order Form, Customer may not submit Controlled Unclassified Information, Covered Defense Information, Federal Contract Information requiring government-unique safeguarding, export-controlled technical data, classified information, national security information, ITAR-controlled data, criminal justice information, HIPAA-regulated protected health information, payment card data, or other restricted government information requiring specialized handling.

9.3 If an Order Form expressly authorizes Covered Defense Information, Controlled Unclassified Information, Federal Contract Information, or similar regulated government data, the Order Form must identify the applicable data category, system boundary, hosting environment, security standard, incident-reporting obligations, flow-down requirements, and any applicable FAR, DFARS, agency, or grant clauses. Overlook will not be responsible for government data categories, markings, dissemination controls, or handling obligations that Customer fails to identify before submission.

9.4 For customer-managed, contractor-managed, on-premises, air-gapped, or Government-controlled deployments, Government Customer is responsible for infrastructure security, physical security, operating systems, identity providers, network controls, monitoring, boundary protection, patching of customer-managed components, backup administration, security accreditation, authority to operate, continuous monitoring, configuration choices, data classification, user access, and lawful operation, except to the extent a written Order Form expressly assigns a responsibility to Overlook.

9.5 If DFARS 252.204-7012, CMMC requirements, or similar cyber clauses are expressly included in an applicable Order, Overlook’s obligations apply only to the covered systems, covered information, services, and performance scope expressly identified in the Order. Overlook may condition acceptance of such obligations on a mutually agreed implementation plan, system boundary, pricing, security responsibilities matrix, subprocessor list, and incident-reporting procedure.

10. Mandatory Flow-Down Clauses; Excluded and Non-Commercial Terms

10.1 Overlook will comply with mandatory FAR, DFARS, agency, state, or local clauses that are required by law to apply to the specific Order, but only to the extent such clauses are validly included in the applicable contract, are applicable to Overlook’s actual performance, and are not inconsistent with mandatory law or Overlook’s commercial rights preserved in these Government Terms.

10.2 Clauses or requirements that are not mandatory for the applicable procurement, that materially conflict with Overlook’s commercial licensing model, or that impose non-commercial obligations are excluded unless expressly accepted by Overlook in a signed writing. Excluded terms may include, without limitation, unlimited rights in data, source-code delivery, audit access beyond records directly relevant to the Order, broad most-favored-customer terms, open-ended indemnities, patent indemnities broader than the Agreement, public disclosure rights in Overlook Technology, unlimited security obligations, custom development obligations, government ownership of Overlook Technology, or obligations to comply with agency policies not identified in the Order.

10.3 If a prime contractor, reseller, integrator, or other intermediary attempts to flow down government clauses to Overlook, only clauses that are applicable to Overlook’s actual role, deliverables, data access, and performance under the applicable Order will apply. The intermediary remains responsible for determining which clauses are legally required and for ensuring that its agreement with the Government is consistent with the commercial rights granted by Overlook.

11. Public Disclosure; FOIA; Open Records

11.1 Government Customer acknowledges that Overlook Technology, pricing that is not publicly posted, security materials, non-public documentation, professional-services materials, assessment methods, scorecard logic, Canvas design, trade secrets, confidential business information, vulnerability information, and proprietary technical information are confidential and may be exempt from disclosure under applicable Freedom of Information Act, open records, procurement integrity, trade secret, security, or similar laws.

11.2 If Government Customer receives a public-records request, FOIA request, subpoena, audit demand, or similar request seeking Overlook Confidential Information, Government Customer will, to the extent legally permitted, promptly notify Overlook and provide reasonable cooperation so Overlook may seek confidential treatment, protective order, redaction, or other appropriate protection. Government Customer shall not voluntarily disclose Overlook Confidential Information beyond what applicable law requires.

12. Publicity; No Government Endorsement

12.1 Neither party may use the other party’s name, seal, insignia, official emblem, logo, or endorsement in publicity, marketing, press releases, case studies, or public announcements except as permitted by the Agreement, procurement law, and applicable agency rules. No Government Customer’s use of the Services constitutes an endorsement of Overlook unless expressly authorized by the Government Customer in writing and permitted by applicable law.

13. Payments; Purchase Orders; Appropriations

13.1 Fees, payment terms, taxes, invoicing, renewals, service credits, and subscription metrics are governed by the Agreement and Order Form, subject to any mandatory payment terms applicable to a direct contract with the U.S. Government. For non-government entities purchasing for government use, the payment terms in the Agreement remain fully applicable.

13.2 Customer-issued purchase orders are for administrative convenience only and do not modify the Agreement. Overlook may reject or suspend performance under any purchase order that attempts to impose additional or conflicting legal terms, expand usage rights, expand data rights, or require performance not stated in the Order Form.

13.3 If an Order is subject to availability of appropriated funds or statutory funding limitations, such limitation applies only to the Government Customer legally subject to that limitation and does not excuse payment obligations of any prime contractor, subcontractor, reseller, integrator, or other non-government entity unless expressly required by the Order.

14. Indemnity; Government Constraints

14.1 Nothing in these Government Terms requires a U.S. federal agency to provide indemnification beyond what is permitted by applicable federal law. Where the Government Customer is not legally permitted to indemnify Overlook, the Customer’s indemnification obligations are deemed limited to the maximum extent permitted by applicable law. The limitation in this Section does not limit indemnification obligations of prime contractors, subcontractors, resellers, integrators, or other non-government entities.

14.2 Nothing in these Government Terms expands Overlook’s indemnity obligations beyond those expressly stated in the Agreement. Overlook will not indemnify a Government Customer for claims arising from Government Data, Customer Materials, third-party software not supplied by Overlook, customer-managed environments, modifications not made by Overlook, use outside the licensed scope, government specifications, or combination with items not provided by Overlook except to the extent expressly stated in the Agreement.

15. Audit; Records; Inspection

15.1 Overlook will maintain records required by applicable law and mandatory clauses validly incorporated into an Order. Unless an executed Order Form expressly states otherwise, audit and inspection rights are limited to records directly relevant to the specific Order and do not include access to Overlook source code, trade secrets, security systems, internal controls unrelated to the Order, other customers’ information, privileged materials, or non-public methodologies.

15.2 Any audit, inspection, or assessment must be conducted during normal business hours, on reasonable advance notice, in a manner that does not unreasonably interfere with Overlook’s business or security, and subject to confidentiality and security restrictions reasonably required by Overlook.

16. Export Controls; Sanctions; Restricted End Uses

16.1 Government Customer shall comply with applicable export control, sanctions, anti-boycott, procurement integrity, and trade laws. Customer may not use, export, re-export, transfer, or permit access to the Services or Software in violation of the Export Administration Regulations, sanctions administered by the Office of Foreign Assets Control, International Traffic in Arms Regulations if applicable, or other applicable trade restrictions.

16.2 Unless expressly authorized in writing by Overlook, the Services and Software may not be used for prohibited end uses, restricted weapons-related uses, prohibited surveillance uses, unlawful discrimination, classified operations, or any activity that would require Overlook to obtain a license, registration, authorization, facility clearance, or government approval not expressly identified in the applicable Order.

17. Suspension; Termination; Transition

17.1 Overlook may suspend access or performance to the extent permitted by the Agreement for non-payment, security risk, misuse, violation of the Acceptable Use Policy, violation of export controls or sanctions, unauthorized data submission, use outside the licensed scope, or material breach. For direct U.S. Government contracts, any termination rights are subject to mandatory law and clauses validly included in the Order.

17.2 Upon expiration or termination, Customer’s rights to access the Services or use the Software cease except as expressly stated in the Agreement or Order Form. Customer must delete or return packaged Software, Documentation, and Overlook Materials as required by the Commercial Software License and Agreement, subject to legally required retention obligations and confidentiality requirements.

18. Disputes; Governing Law

18.1 For direct contracts with the United States Government where the Contract Disputes Act or other mandatory federal dispute regime applies, disputes will be handled in accordance with the mandatory dispute provisions applicable to that contract. For all other disputes, including disputes with prime contractors, subcontractors, resellers, integrators, state or local entities to the extent permitted by law, and non-government entities, the governing law and dispute-resolution provisions in the Agreement apply.

18.2 Nothing in these Government Terms waives sovereign immunity, the Anti-Deficiency Act, the Contract Disputes Act, the Tucker Act, mandatory procurement protest procedures, or any other mandatory law applicable to a Government Customer. Nothing in these Government Terms waives Overlook’s rights in its intellectual property, trade secrets, confidential information, or equitable remedies.

19. Updates

19.1 Overlook may update these Government Terms from time to time. For an existing executed Order, updates will not materially diminish Overlook’s express commitments during the then-current Order term unless required by law, required for security, or agreed by the parties. Updated Government Terms may apply to renewals, new Orders, additional deployments, additional usage rights, new professional services, or new support terms.

20. Notices

20.1 Notices to Overlook under these Government Terms must be sent to legal@overlookai.com and to Overlook AI, Inc., 8 The Green STE B, Dover, DE 19901, unless the applicable Order Form states a different notice address. Security notices should also be sent to support@overlookai.com or any security contact designated by Overlook.

Schedule 1 - Commercial Software Rights Notice

The Software, Hosted Services functionality, Documentation, training materials, assessment materials, scorecard materials, Canvas materials, templates, APIs, deployment artifacts, container images, and related materials are commercial computer software, commercial computer software documentation, commercial technical data, and proprietary materials developed exclusively at private expense. Use, reproduction, modification, distribution, disclosure, or transfer by or for the U.S. Government is subject only to the rights expressly granted in the Agreement, the Commercial Software License, these Government Terms, and the applicable Order Form. All other rights are reserved by Overlook AI, Inc.

Contractor / Licensor: Overlook AI, Inc., 8 The Green STE B, Dover, DE 19901.

Schedule 2 - Government Order Configuration Checklist

Each government or public-sector Order should identify, as applicable, the Government Customer, contracting vehicle, prime contractor or reseller, applicable agency or public-sector entity, contracting officer or authorized procurement contact, deployment model, authorized environment, data categories authorized for submission, security requirements, GovCloud or dedicated-environment requirements, FedRAMP or other authorization status if applicable, support tier, service level, professional-services scope, usage metrics, software-license scope, renewal structure, and any mandatory FAR, DFARS, agency, grant, state, or local clauses that the parties agree apply to Overlook’s performance.

Schedule 3 - Public Sector Data Restrictions

Unless an Order Form expressly authorizes the relevant category and states the applicable security obligations, Customer may not submit classified information, Controlled Unclassified Information, Covered Defense Information, Federal Contract Information requiring government-unique safeguards, export-controlled technical data, ITAR-controlled data, criminal justice information, protected health information, payment card data, biometric identifiers, or other regulated information requiring specialized safeguards. Customer is responsible for correctly classifying and marking Government Data and for ensuring that it has authority to provide such Government Data to Overlook.