Common use of Product License Clause in Contracts

Product License. Azul grants Customer a perpetual, worldwide, nonexclusive right to use the Product; provided that certain Third-Party Software is instead licensed pursuant to the relevant terms set forth below in the Third-Party Software Licenses. Software Services: Time-based Support Services for the Product. Support Services Additions: In addition to the Support Services as described in Exhibit B of the Agreement, Azul will use commercially reasonable efforts to: • update the JDK component of the Product for a given update release within the timeframe as specified below after the update is released for General Availability (GA) by the associated OpenJDK project as follows: Support Tier 48 hours1 / 15 days 7 days1 / 15 days 15 days1 / 30 days 7 days1 / 15 days 15 days 30 days Platinum Premium Standard Security fixes that have an identified CVE Security fixes that have an identified CVE, bug fixes, and other updates − 1 Limited to builds of the Zulu JDK/JRE for 64-bit Java versions 7 onward running on x86 processors on Linux, Windows and macOS operating systems − Common Vulnerabilities and Exposures (“CVE”) is as defined by the NIST National Vulnerability Database (reference xxxxx://xxx.xxxx.xxx/vuln); and • update the non-JDK components of the Product for a given update release no later than thirty (30) days after the update is released for General Availability (GA) by the OpenJDK project; and • backport security fixes that have an identified CVE from newer supported Java Major Releases to older supported Java Major Releases in accordance with the timeframes in the table above; and • ensure that the Product delivered to Customer has passed the OpenJDK Technology Compatibility Kit (TCK) available for a given major release of Java; and

Product License. Azul grants Customer a perpetual, worldwide, nonexclusive right to use the Product; provided that certain Third-Party Software is instead licensed pursuant to the relevant terms set forth below in the Third-Party Software Licenses. Software Services: Time-based Support Services for the Product. Support Services Additions: In addition to the Support Services as described in Exhibit B of the Agreement, Azul will use commercially reasonable efforts to: • update the JDK component of the Product Zulu Enterprise JDK/JRE for a given update release within the timeframe as specified below after the update is released for General Availability (GA) by the associated OpenJDK project as follows: Support Tier 48 hours1 / 15 days 7 days1 / 15 days 15 days1 / 30 days 7 days1 / 15 days 15 days 30 days Platinum Premium Standard Security fixes that have an identified CVE Security fixes that have an identified CVE, bug fixes, and other updates − 1 Limited to builds of the Zulu Enterprise JDK/JRE for 64-bit Java versions 7 onward running on x86 processors on Linux, Windows and macOS operating systems − Common Vulnerabilities and Exposures (“CVE”) is as defined by the NIST National Vulnerability Database (reference xxxxx://xxx.xxxx.xxx/vuln); and • update ZuluFX, Zulu Mission Control, and the non-JDK components of the Product for a given update release no later than thirty (30) days after the update is released for General Availability (GA) by the OpenJDK project; and • backport security fixes that have an identified CVE from newer supported Java Major Releases to older supported Java Major Releases in accordance with the timeframes in the table above; and • ensure that the Product delivered to Customer has passed the OpenJDK Technology Compatibility Kit (TCK) available for a given major release of Java; and

Product License. Azul grants Customer a perpetual, worldwide, nonexclusive right to use the Product; provided that certain Third-Party Software is instead licensed pursuant to the relevant terms set forth below in the Third-Party Software Licenses. Software Services: Time-based Support Services for the Product. Support Services Additions: In addition to the Support Services as described in Exhibit B of the Agreement, Azul will use commercially reasonable efforts to: • update the JDK component of the Product Zulu Enterprise JDK/JRE for a given update release within the timeframe as specified below after the update is released for General Availability (GA) by the associated OpenJDK project as follows: Support Tier Platinum Premium Standard Security fixes that have an identified CVE 48 hours1 / 15 days 7 days1 / 15 days 15 days1 / 30 days 7 days1 / 15 days 15 days 30 days Platinum Premium Standard Security fixes that have an identified CVE Security fixes that have an identified CVE, bug fixes, and other updates 7 days1 / 15 days 15 days 30 days − 1 Limited to builds of the Zulu Enterprise JDK/JRE for 64-bit Java versions 7 onward running on x86 processors on Linux, Windows and macOS operating systems − Common Vulnerabilities and Exposures (“CVE”) is as defined by the NIST National Vulnerability Database (reference xxxxx://xxx.xxxx.xxx/vuln); and • update ZuluFX, Zulu Mission Control, and the non-JDK components of the Product for a given update release no later than thirty (30) days after the update is released for General Availability (GA) by the OpenJDK project; and • backport security fixes that have an identified CVE from newer supported Java Major Releases to older supported Java Major Releases in accordance with the timeframes in the table above; and • ensure that the Product delivered to Customer has passed the OpenJDK Technology Compatibility Kit (TCK) available for a given major release of Java; and

Product License. Azul grants Customer a perpetual, worldwide, nonexclusive right to use the Product; provided that certain Third-Party Software is instead licensed pursuant to the relevant terms set forth below in the Third-Party Software Licenses. Software Services: Time-based Support Services for the Product. Support Services Additions: In addition to the Support Services as described in Exhibit B of the Agreement, Azul will use commercially reasonable efforts to: •  update the JDK component of the Product for a given update release within the timeframe as specified below after the update is released for General Availability (GA) by the associated OpenJDK project as follows: Support Tier Platinum Premium Standard Security fixes that have an identified CVE 48 hours1 / 15 days 7 days1 / 15 days 15 days1 / 30 days 7 days1 / 15 days 15 days 30 days Platinum Premium Standard Security fixes that have an identified CVE Security fixes that have an identified CVE, bug fixes, and other updates − 7 days1 / 15 days 15 days 30 days  1 Limited to builds of the Zulu JDK/JRE for 64-bit Java versions 7 onward running on x86 processors on Linux, Windows and macOS operating systems −  Common Vulnerabilities and Exposures (“CVE”) is as defined by the NIST National Vulnerability Database (reference xxxxx://xxx.xxxx.xxx/vuln); and •  update the non-JDK components of the Product for a given update release no later than thirty (30) days after the update is released for General Availability (GA) by the OpenJDK project; and •  backport security fixes that have an identified CVE from newer supported Java Major Releases to older supported Java Major Releases in accordance with the timeframes in the table above; and •  ensure that the Product delivered to Customer has passed the OpenJDK Technology Compatibility Kit (TCK) available for a given major release of Java; and