ADAPTIVE AUTHENTICATION LICENSE SCHEDULE
for deployment in
CUSTOMER’S PREMISESFor Adaptive Authentication version 13 and above only*** IMPORTANT INFORMATION – PLEASE READ CAREFULLY ***This RSA Adaptive Authentication software uses computer programs and other proprietary material andinformation, the use of which is subject to and expressly conditioned upon acceptance of this Adaptive
Authentication License Schedule (the “License Schedule”).
This License Schedule is subject to the: (i) the End User License Agreement for RSA Products; and (ii)
Maintenance Agreement for RSA Products; all located at https://www.rsa.com/en-us/standard-formagreements and the terms of which are incorporated herein by reference (collectively referred to as the“Agreement”).
This License Schedule is a legally binding document between you (meaning the individual person or theentity that the individual represents that is subscribing to the Software for its internal productive use and notfor outright resale) (the “Customer”) and RSA (which means (i) If Customer is located in the United States,
Mexico or South America, then this is a legal agreement between the Customer and RSA with “RSA” meaning
RSA Security LLC. If Customer is located outside of the United States, Mexico or South America, then this is alegal agreement between the Customer and RSA, with “RSA” meaning (ii) the local RSA sales subsidiary, ifCustomer is located in a country in which RSA does business through a local RSA sales subsidiary; (iii) ifCustomer is located in a country in which RSA does not have a local sales subsidiary, the local Dell or EMC
entity authorized by RSA on the RSA Quote or other RSA ordering document; or (iv) RSA Security & Risk Ireland
Limited (if Customer is located in a country in which neither RSA Security LLC nor Dell EMC has a local salessubsidiary).
Unless RSA agrees otherwise in writing, this License Schedule governs Customer's use of the Software,
except to the extent all or any portion of the Software is: (a) the subject of a separate written agreement set
forth in a quotation issued by RSA; or (b) governed by a third party licensor’s terms and conditions.
Capitalized terms have meaning stated in the License Schedule.
By clicking on the “Agree” or “Accept” or similar button at the end of this License Schedule, or proceedingwith the installation, downloading, use or reproduction of the Software, or authorizing any other person to doso, you are representing to RSA that you are (i) authorized to bind the Customer; and (ii) agreeing on behalfof the Customer that the terms of this License Schedule shall govern the relationship of the parties withregard to the subject matter in this License Schedule and are waiving any rights, to the maximum extent
permitted by applicable law, to any claim anywhere in the world concerning the enforceability or validity ofthis License Schedule.
If you do not have authority to agree to the terms of this License Schedule on behalf of the Customer, or do
not accept the terms of this License Schedule on behalf of the Customer, click on the “Cancel” or “Decline”
or other similar button at the end of this License Schedule and/or immediately cease any further attempt toinstall, download or use this Software for any purpose, and remove any partial or full copies made from thisSoftware.
1.

Definitions.
The following terms shall have the definitions below or set forth elsewhere herein. All references to “Section”
shall refer to sections of this Schedule, unless otherwise specified herein.
“Active End User” means an account holder or other client of the Customer (an “End User”) whose identity has
been processed or profiled or scored or authenticated or otherwise verified by the Product at least once inthe course of the six (6) months immediately preceding the then current date.
“Active End User Ceiling” means the maximum number of Active End User which Customer is licensed to store
at any given time using the Product and as set out in applicable Quote.
“eFraudNetwork” database means a database owned and operated by RSA which contains information aggregatedby RSA, discovered by the parties as part of the performance of their obligations under this Schedule, obtained,
and/or procured from third parties and/or resulting from risk and fraud assessments carried out by RSA andPage 1
CONFIDENTIAL

includes without limitation IP addresses, device fingerprint and any other related data. “Exhibit” means Exhibits
A and B attached hereto, the terms of which are incorporated herein by reference; “Product” means (a) the RSA
consumer software suite described in Exhibit A and developed by RSA together
with any Software releases, fixes or patches delivered pursuant to the Maintenance Services, known as
the RSA Adaptive Authentication Web Protection System.
2.

License; Ownership.
A.
RSA hereby grants Customer a perpetual, non-exclusive, nontransferable license to run and use thosecomponents of the Product as selected an RSA issued Quote, for Customer's own use for the purpose ofprocessing Active End User authentication information on its web portals, online services, and/or its
electronic transaction clearing systems. Such license shall be subject always to the Active End User
Ceiling as further detailed in this Schedule.
B.
Additional Software License Restrictions. Customer will not directly or indirectly use the Product for its
internal enterprise authentication purposes. For the purpose of the Schedule, “internal enterpriseauthentication” means authenticating a login request (which request may originate either remotely or fromCustomer or an Affiliate's premises) of an employee, consultant, or an agent of Customer (or an Affiliate)
for the purpose of granting the requestor access to Customer (or an Affiliate's) computer networks for thepurpose of performing their assigned work.
C.
Ownership and/or License of the eFraudNetwork database information. RSA shall retain and own all right,
title and interest and all intellectual property rights (including but not limited to copyrights, trade secrets,
trademarks and patent rights) to all information which is collected, submitted to and made available on theeFraudNetwork in the course of the performance by either party of their obligations under this Schedule (orwhere such title cannot be granted or otherwise transferred to RSA then Customer agrees to grant RSA an
unconditional, unlimited, unrestricted, royalty free license to use, distribute and/or otherwise make available
such information). Information regarding international payees that is submitted to RSA must minimallybe hashed with SHA 2 (or as described in the Documentation).
D.
RSA Trademark License. For so long as this Schedule remains in force RSA grants Customer the right touse the “Secured by RSA” trademark (the “RSA Mark”) solely for the purpose of displaying the RSA Markon the End User facing web based log in pages of its online services. Customer’s use of the RSA Markwill conform at all times with RSA’s quality and usage requirements and will be subject to review andapproval by RSA. Customer will not seek to register any trademarks of RSA in any country in the world.
Any use of the RSA Mark shall be in accordance with RSA’s brand guidelines and reasonable
policies regarding advertising and trademark usage as established from time to time.

3.

Billing Files.
Customer will provide RSA with the billing files as generated by the billing utility component of the Product (asfurther detailed in the Documentation) at the end of each calendar month for the purpose of evidencing its
ongoing compliance with the Active User Ceiling from time to time and subject to RSA’s audit rights under theAgreement.

4.

Product Delivery.
RSA Software shall be delivered to the Customer at the email address specified in the Quotation.

5.

Authorized Active End Users; Active End User Ceiling Increases.
Customer may increase the authorized Active End User Ceiling from time to time by way of a purchase orderreferencing this Schedule. Where Customer has exceeded its then authorized Active End User Ceiling,Customer will promptly (and in any event in not less than thirty (30) days from the date the Active End User
Ceiling is first exceeded) procure an increase to its then licensed authorized Active End User Ceiling, for thefees and in the minimum increments set out in a Quote so as to meet or exceed its actual use of the Product.
Such increases will be procured by way of a purchase order referencing the Quote. Where Customer has
upgraded the authorized Active End User Ceiling, RSA will invoice Customer the adjusted Maintenance
Services fees on a pro-rata basis for the Maintenance Services year then in progress on the date of such
upgrade in a Quote.

6Maintenance Services:Customer hereby purchases the Enhanced Support and Data Services as further described in Exhibit B for theProducts ordered under this Schedule for a term of one (1) year (the “Initial Maintenance Term”) commencingon the date the Product is first made electronically available for download. Thereafter, Maintenance Services
shall renew on an annual basis, subject to Customer’s payment of RSA’s invoice for the applicable Maintenance
Services fees. RSA may increase the Maintenance Services fee, to be effective at the commencement of any
future annual period, provided that RSA notifies Customer, in writing, of such fee increase at least thirty(30) days prior to the end of the previous annual period.

CONFIDENTIAL

Page 2

EXHIBIT A
Description of Base Product:
The Product (without Additional Features) is available for the license fees detailed in a signed Quote.
RSA Adaptive Authentication Components – Login
Risk Based Authentication at Login (web-channel device. This can be applied only during account login)
Back office applications suit to manage policy rules, cases, configuration and web reports and Raw Data Reports(RDR) as described in the product documentation
Secondary Authentication: Challenge Questions. (Challenge Questions, including enrollment to collect challenge
questions and answers.)
RSA eFraudNetwork Access. Customer’s access to the eFraudNetwork is contingent on Customer’s submissionof nonidentifiable fraud data via log files for inclusion in RSA eFraudNetwork’s aggregated database and subject toCustomer’s ongoing subscription to the Enhanced Support and Data Services.

Description of Additional Features:
These components of the Product are available for extra fees as detailed in a signed Quote.
Transaction Monitoring
Assessment, analysis and scoring of post-login transactions activities
Mobile Protection
Risk assessment, analysis and scoring of end users activities originated from a mobile device (both mobile
browser and/or applications).
Authentication Methods
OneTime Password (“OTP”). OTP generated by Adaptive Authentication and sent by Customer to the End User.
Transaction Signing. An out of band step up validation method for payment transactions. A validation method tothe integrity and authenticity of payment transactions. Transaction Signing has two components: (i) a software
component and (ii) a messaging component. The messaging component can use either the Customer’s or RSA’s
third party messaging infrastructure. ** RSA’s warranties and/or indemnities do not extend to nor apply to themessaging infrastructure.
Out of band phone call. Out-of-band phone call (telephone confirmation using telephone numbers stored inCustomer’s systems). **Out-of-band SMS. One Time Password generated by Adaptive Authentication and sent by RSA to end user via
SMS. **The out-of-band feature (phone call and/or SMS messages) involves set up costs and fees to send the call/SMS(one time third party set up; onetime RSA set up fee; and a per call/message fee) (“OOB”). OOB is provided via
third parties on infrastructure not owned/controlled by RSA. Delivery of OOB or the timing of delivery is notguaranteed. RSA’s warranties and/or indemnities do not extend to nor apply to OOB.
**RSA’s messaging infrastructure and OOB service are available only as long as Customer is subscribing
for the Maintenance Services for Adaptive Authentication. The initial term of the service and the firstannual renewal thereof shall be co-terminus with the term of the Maintenance Services.

Omni Channel
Omni channel fraud prevention enabling risk-based authentication across multiple selected channels (web, mobile,call center, IVR, ATM, branch or custom).

CONFIDENTIAL

Page 3EXHIBIT B
Enhanced Support and Data Services

Customer acknowledges that the Basic Support Services (as described on the Support Website) are not available for
the Product licensed under this Schedule.
In addition to then current Enhanced Support Services which will be provided as detailed on the Support Website, theCustomer will also receive the Data Services described hereunder.
1.
Definitions.
In addition to those defined terms of the Agreement and the Schedule, the following definitions shall be used for
purposes of this Exhibit B.
A.
“Data Services” means, the delivery by RSA on an ongoing basis of (i) the Information; and (ii) updates tothe eFraudNetwork.
B.
“Geo-Location Service” means the geo-location component made available with the Product.
C.
“Information” means the data and information derived from the Geo-Location Service and/or other third
party data services made available with the Product (as described in the Documentation).
D.
“Support Website” means RSA’s on-line support resource currently located athttps://www.rsa.com/en-us/services/rsa-product-and-customer-support.
2.
RSA Data feeds for Adaptive Authentication.
Customer will receive the following:A.
Delivery of eFraudNetwork database updates. Updates to the eFraudNetwork database will be madeavailable to Customer by RSA via Internet protocol from RSA hosted servers. Where configured in accordancewith the Documentation, the Product will automatically download the updates on a periodic basis andload them into a local data store, which is used for run-time analysis of inbound transactions.
B.
Delivery of Information. Information updates will be made available by RSA to Customer via Internet
protocol from RSA hosted servers. Customer will download the updates on a periodic basis and load theInformation into the Product for run-time analysis of inbound transactions
All Data Services are licensed for use solely in conjunction with the Customer’s use of the licensed Product. All otheruse is expressly prohibited. RSA’s warranties and/or indemnities do not extend to nor apply to the Information.
3.
Enhancements to Maintenance Services.
Customer may purchase enhancements to the Maintenance Services, including the Personalized Support options
Services, as described on the Support Website.
4.
A.

B.

Additional Customer Obligations.
Network and Device Forensics. In addition to those obligations set out on the Support Website, Customer
shall provide to RSA daily scrubbed data activity logs, the case log file and the forensic data logs as further
described in the Documentation. RSA will review these logs in order to provide the Maintenance Services
hereunder and to improve forensic analysis of future Software Releases of the Product. Customer shall nottransmit, send or otherwise provide, directly or indirectly, to EMC any data that is considered personallyidentifiable under the laws of the jurisdictions applicable to Customer’s installation and use of the Productand Customer’s operations, and shall indemnify EMC for all third party claims arising as a result of Customer’s
breach of this obligation.
Restrictions on use of the Geolocation Service and Information. Customer will not (a) reproduce or
distribute the Geo-Location Service in a manner that allows its users to access the Geo-Location Service inany way other than through aggregate reports generated by the Product (as described in theDocumentation); or (b) use the Information to create or otherwise support the transmission of unsolicitedcommercial email.

CONFIDENTIAL

Page 4