Terms and Conditions for Participation in the Vulnerability Testing Environment Program
The Vulnerability Testing Environment Program (the “Program”) provided by Cybozu, Inc.
(“Cybozu”), is a system that provides a vulnerability test environment (“Test Environment”) to
participants in the Program (“Participants”) for the purposes set forth in Article 1. Participants must
agree to these terms and conditions before participating in the Program.

Article 1 Purpose
The purposes of the Program are as follows:
1. Verification of Cybozu products and services (collectively, “Cybozu Products”)(1) To use the vulnerability information provided by Participants to improve the quality of the Cybozu
Products;(2) To expand recognition by Participants of Cybozu Products and build and maintain amicable
relationships with Participants; and(3) To increase the confidence of Participants in Cybozu Products by verifying vulnerabilities andenabling the confirmation of security.
2. Verification of plug-ins and customizations (collectively, “Plug-ins”) that work with Cybozu
Products.
(1) To contribute to the development of Plug-ins by Participants by providing a safe environment that
does not affect the actual usage environment; and(2) To encourage Participants’ use of Plug-ins by verifying vulnerabilities and enabling theconfirmation of security.

Article 2 Period
1.

The Test Environment will be provided from February 2014 until the time specified by Cybozu.

2.

Cybozu will give notice of termination of the Program, at least three (3) months prior to thetermination date, on the Program’s dedicated website (“Dedicated Website”).

▼Dedicated Website:
https://cybozu.co.jp/en/company/products/testing-environment/

Article 3 Applicable Products
For details of the Cybozu Products to be provided as part of the Program, please refer to theVulnerability Testing Environment Program section of the Dedicated Website.

Article 4 Eligibility for Participation
For details of eligibility for participation in the Program, please refer to the Application Requirements
listed in the Vulnerability Testing Environment Program section of the Dedicated Website.

Article 5 Application
1.

Participants should apply as described in the Vulnerability Testing Environment Program sectionof the Dedicated Website.

2.

Cybozu will provide access to the Test Environment to applicants in turn. If the number ofParticipants is significantly greater than expected, Cybozu may not be able to provide applicants
access to the Test Environment due to insufficient resources.

Article 6 Use
1.

The Test Environment may change due to periodic maintenance to ensure the stable operation ofCybozu Products or other reasons.

2.

When verifying Plug-ins provided by a third party in the Test Environment, Participants may only
use Plug-ins that meet all of the conditions listed in each of the following items:(1) Plug-ins for which Participants know who to contact for vulnerability information andunderstand the need to make contact;(2) Plug-ins which Participants legally have the right to reproduce or otherwise use in the Test

Environment; and(3) Plug-ins for which the terms and conditions of use of said Plug-ins permit vulnerability testing.
3.

Regardless of whether verifying the vulnerability of Cybozu Products or Plug-ins, Participants areresponsible for obtaining prior permission from the provider of the integrated service or software
before conducting the verification if, when conducting verification, the integration functions witha third party service or software are likely to affect the integrated service or software.

4.

Participants should use a vulnerability reporting form or the reporting site to report vulnerabilities
relating to Cybozu Products. Please see the Dedicated Website for details.

5.

Participants are responsible for contacting third parties directly regarding vulnerabilities related
to Plug-ins provided by third parties. Cybozu cannot accept reports on such vulnerabilities.

6.

Inquiries regarding the Program should be sent to the dedicated inquiry e-mail address provided
on the Dedicated Website. Cybozu does not accept inquiries by telephone.

7.

Cybozu does not accept inquiries regarding the use of Plug-ins or contact information. In addition,
Cybozu does not guarantee that Plug-ins will work as expected in the Test Environment.

Article 7

Suspension of Provision

Cybozu may immediately suspend provision of the Test Environment in any of the following cases:(1) If any failure occurs in the Test Environment or any other systems required to provide the TestEnvironment (the “Test Environment, etc.”) or telecommunications equipment;(2) If for maintenance of the Test Environment, etc. or maintenance of, or work on,telecommunications equipment;(3) If Cybozu determines that it is difficult or impractical to provide a normal Test Environment due
to a significant load on, or failure of, the Test Environment, etc.;(4) If Cybozu recognizes that a Participant or third party may suffer significant damages as a result ofproviding the Test Environment;(5) If provision of telecommunications services by telecommunications service providers ortelecommunications suppliers in Japan or overseas, power supply services by power suppliers, andany other public services are suspended, thereby making it difficult to provide the TestEnvironment;(6) In the event of an earthquake, tsunami, typhoon, lightning or other natural disaster, war, civil war,enactment, revision or abolition of laws and regulations, or other force majeure, or in the event ofa threat of such an emergency; or(7) In any other cases where Cybozu deems it necessary to stop providing the Test Environment.

Article 8 Termination of Provision
After providing the Test Environment to a Participant, if the Participant does not reach a certain accesslevel for a certain period of time, Cybozu may consider that the Participant has not conductedverification and may terminate provision of the Test Environment.

Article 9 Prohibitions
1.

Participants must not engage in any of following activities:(1)

Activities which use the Test Environment for purposes other than the purposes set out in
Article 1;(2)

Accessing the data of another user;(3)

Activities that breach Article 11;(4)

Testing activities that put a significant load on the environment or conducting tests intended
to put a significant load on the environment;(5)

Activities which cause or may cause detriment or damage to Cybozu or third parties;(6)

Activities which are contrary to public order and good morals;(7)

Activities that violate laws and regulations, criminal activities, and activities that aid and abetor may aid and abet these activities;(8)

Activities that interfere with or may interfere with the operation of the Program and any of

the services provided by Cybozu;(9)

Activities that harm or may harm the credibility, reputation or the like of the Program andany of the services provided by Cybozu; or(10) Any other activities deemed inappropriate by Cybozu.
2.

If a Participant engages in any of the activities listed in the preceding paragraphs, Cybozu shall beentitled to block the Participant’s access and take any other measures deemed necessary byCybozu without providing prior notice to the Participant.

3.

Cybozu shall not be liable for the direct, indirect, or any other damages arising from taking themeasures described in the preceding paragraph.

4.

In the event a Participant breaches the provisions of Paragraph 1, the Participant shall be liable tocompensate Cybozu for any damages suffered by Cybozu due to the said breach. In addition, inthe event Cybozu compensates a third party or bears any other damages or expenses arising fromthe said breach, Cybozu shall be entitled to seek reimbursement from the Participant for theamount borne.

Article 10 Outsourcing
Participants may outsource work related to the purposes set forth in Article 1 to a third party(“Contractor”).

Article 11 Handling of Confidential Information
1.

Participants should treat vulnerability information pertaining to Cybozu Products as confidentialinformation not only during implementation of the Program but also after termination of theProgram and may not disclose, divulge or publish vulnerability information pertaining to Cybozu
Products to any third party until Cybozu publishes the said vulnerability information.

2.

Participants are responsible for contacting third-party providers directly regarding thevulnerability information relating to the provider’s Plug-ins in accordance with the provisions ofArticle 6, and should follow instructions from the third party regarding the handling ofvulnerability information relating to the said Plug-ins.
3.

Participants should treat the Program’s Test Environment domain and the password to theenvironment provided by Cybozu to the Participant as confidential information and may notdisclose, divulge, publish or lend the domain and password to any third party, except a Contractor,
not only during implementation of the Program, but also after termination of the Program.

4.

Participants may inform third parties, including in social media posts, that they are participatingin the Program and their impressions during participation. However, Participants may not disclose
any confidential information set forth in this Article to any third party.

Article 12 DISCLAIMER
1.

PARTICIPANTSSHALLPARTICIPATEINTHE

PROGRAMATTHEIROWNRESPONSIBILITY AND CYBOZU SHALL NOT BE LIABLE FOR ANY DAMAGESINCURRED BY PARTICIPANTS DUE TO PARTICIPATION IN THE PROGRAM.
2.

CYBOZU SHALL NOT BE INVOLVED IN ANY DISPUTES AMONG PARTICIPANTS ORWITH A THIRD PARTY CONCERNING THE PROGRAM, AND PARTICIPANTS SHALLRESOLVE ANY DISPUTES, INCLUDING, BUT NOT LIMITED TO, DAMAGES INCURREDBY THIRD PARTIES CAUSED BY THE BREACH OF THE PRECEDING ARTICLE, AT THE
RESPONSIBILITY AND EXPENSE OF THE PARTICIPANT.

Article 13 Handling of Personal Information
1.

Cybozu may use personal information of a Participant for the implementation, management, andoperation of the Program.

2.

If a Participant wishes to correct, delete, or discontinue the use of the Participant’s own personal
information, Cybozu will comply with the request. To make a request to correct, delete, ordiscontinue the use of personal information, please contact the Cy-PSIRT Office(productsecurity@cybozu.co.jp).

3.

Cybozu will also handle participants' personal information appropriately in accordance with its
Privacy Policy.

▼Privacy Policy:
https://cybozu.co.jp/en/privacy/privacy-policy/pdf/privacy_policy.pdf

Article 14 Changes to these Terms and Conditions
1.

Cybozu reserves the right to change these Terms and Conditions at any time, regardless ofwhether or not the Participant is aware of such change.

2.

Cybozu shall notify the Participant of any material changes to these Terms and Conditions. The
Participant’s continued participation in the Program after such changes shall be deemed toconstitute acceptance of the amended Terms and Conditions; provided, however, that Cybozu
may omit such notice to a Participant if Cybozu determines the content of the amendment is minorand would not cause any disadvantage to the Participant, such as correction of wording.

Article 15 Governing Law and Jurisdiction
1.

These Terms and Conditions shall be governed by and construed in accordance with the laws ofJapan, without giving effect to its conflict of law principles.

2.

In the event of any dispute arising in connection with these Terms and Conditions, the Tokyo
Summary Court or Tokyo District Court shall be the court of exclusive jurisdiction in the first
instance, depending on the amount in controversy.

End of Document