Source Code License Addendum
Version date: August 13, 2026
This Source Code License Addendum applies only when an Order Form signed by Valkyr Labs Inc. and Customer incorporates it. It supplements the Enterprise MSA. It does not apply to Customer-owned Generated Deliverables, which are governed by the MSA.
1. Licensed Source Code
"Licensed Source Code" means only the Valkyr-owned source files, repositories, branches, versions, build materials, and documentation specifically listed in the Order Form. It excludes Generated Deliverables, open-source software, third-party materials, credentials, signing keys, production data, and any Valkyr source not listed.
Subject to payment and the Agreement, Valkyr grants Customer a non-exclusive, non-transferable (except under the MSA), non-sublicensable license during the Source Term to access, copy, compile, test, and modify Licensed Source Code solely for the internal purpose and environments stated in the Order Form. Customer may permit named contractors to exercise those rights solely for Customer if they are bound by written confidentiality and use restrictions and Customer remains responsible.
No right to distribute, publish, sell, disclose, or use Licensed Source Code to provide a hosted or service-bureau offering is granted unless the Order Form expressly states otherwise. Customer may distribute Customer-owned Generated Deliverables under the MSA even if they were developed with the aid of Licensed Source Code, but may not include Licensed Source Code except under the MSA's embedded-technology license or an express distribution grant.
2. Ownership and modifications
Valkyr owns Licensed Source Code and Valkyr Technology. Customer owns Customer Materials and Customer-specific modifications that are separable from Licensed Source Code ("Customer Modifications"). Valkyr owns modifications to Valkyr Technology created by Valkyr. To the extent a Customer Modification necessarily derives from Licensed Source Code, Customer grants Valkyr a perpetual, worldwide, royalty-free license to use that Customer Modification in Valkyr Technology, excluding Customer Confidential Information and customer-specific business logic.
No contribution is assigned to Valkyr unless the contributor signs a separate contribution agreement that identifies the contribution and assignment. Feedback alone does not transfer Customer code.
3. Security and handling
Customer will protect Licensed Source Code as Valkyr Confidential Information using controls no less protective than those used for its own source code of similar sensitivity, including least privilege, multifactor authentication for repositories, logging, secure development practices, and prompt revocation. Customer will not place Licensed Source Code in a public repository or submit it to a third-party AI service unless the Order Form expressly authorizes that provider and use.
Customer will notify Valkyr promptly of unauthorized access or disclosure and cooperate in containment. Valkyr may provide security updates and Customer will apply critical fixes within a commercially reasonable period appropriate to risk.
4. Verification
No more than once annually, Valkyr may request a written compliance certification. A technical or on-site audit requires at least 30 days' notice and a reasonable basis for suspected material noncompliance, must occur during business hours, minimize disruption and access to unrelated Customer data, and be conducted by an independent auditor bound by confidentiality. Valkyr bears cost unless the audit confirms material unlicensed use.
5. Term and effect
The Order Form must state whether the source license is term-based or perpetual. For a term license, Customer will stop using and delete Licensed Source Code at expiration or termination, except one encrypted archival copy may be retained solely for legal compliance. For a perpetual paid license, rights survive unless terminated for an uncured material breach. At Valkyr's request, Customer will certify deletion. Customer-owned Generated Deliverables and rights granted for embedded Valkyr Technology survive under the MSA.
6. Warranty, indemnity, and liability
The MSA's warranties, IP indemnity, disclaimers, and liability limits apply. Source access does not expand Valkyr's IP indemnity to Customer Modifications or combinations not supplied or required by Valkyr. The Order Form must state whether source escrow, maintenance, vulnerability remediation, reproducible builds, or Generated Deliverable indemnity is included.