Skip to content

🚀 Launch Alert: Akeyless introduces Runtime Authority for AI Agents

Data Act Addendum

Last Updated: March 4th, 2026

This Data Act Addendum (“Addendum”) amends and supplements the End User License Agreement or Master Service Agreement, together with any applicable ordering documents and any other agreement(s) governing the Customer’s access to and use of the Services (collectively, the “Agreement”), between Akeyless Security Ltd. and its subsidiaries (“Akeyless” or “Company”) and the Customer. This Addendum applies solely to the Data Processing Service identified herein and only to Customers that are headquartered in the European Union and subject to Regulation (EU) 2023/2854 of the European Parliament and of the Council on harmonized rules on fair access to and use of data (“Data Act”).

Capitalized terms used but not defined in this Addendum have the meanings given to them in the Agreement or the Data Act.

This Addendum sets out the parties’ rights and obligations under Chapter VI of the Data Act and forms an integral part of the Agreement. This Addendum is deemed accepted by the Customer upon the earliest of: (i) indicating acceptance; (ii) signing, or otherwise acknowledging acceptance of, this Addendum in a separate document; or (iii) referencing or incorporating this Addendum into the Agreement. The Customer agrees that this Addendum is incorporated by reference into its Agreement with Akeyless.

In the event of any conflict between this Addendum and any other contractual terms or documents, this Addendum will prevail to the extent of the conflict, but solely with respect to the subject matter addressed in this Addendum.

  1. DEFINITIONS
    1. “Customer Data and Assets” means any and all data, information, metadata, and other inputs provided by or on behalf of Customer, as well as any reports or other data generated directly for or by Customer through Customer’s use of the Data Processing Service, in each case to the extent processed as part of the Data Processing Service.
    2. “Data Processing Service” has the meaning ascribed to it under the Data Act and refers to the applicable portions of the Services (as defined in the Agreement).
    3. “Exportable Data” means the subset of Customer Data and Assets that (i) can be extracted under this Addendum; and (ii) does not contain, and cannot be extracted without disclosing, Akeyless intellectual property rights, trade secrets, or other protected information. Exportable Data does not include Usage Data (as defined in the Agreement) or any equivalent telemetry, analytics, or service performance data collected or generated by Akeyless.
    4. “Provider” means a data processing service provider other than Akeyless, as contemplated by the Data Act.
    5. “Switching” has the meaning given in Article 2(34) of the Data Act and means the process of extracting, transforming, and uploading the Exportable Data and transferring it to a Provider or to Customer’s on-premises ICT, in each case pursuant to a Switching Request (as defined below).
    6. “Transition Period” means the Initial Transition Period (as defined below) or, if applicable, the Alternative Period (as defined below), whichever is then in effect.
  2. REQUEST PROCESS
    1. During the Term (as defined in the Agreement), Customer may submit a written request with at least two (2) months’ prior notice (“Notice Period”) to either: (a) switch and migrate the applicable Exportable Data to a Provider or to Customer’s on-premises ICT infrastructure, including by specifying the destination and applicable technical specifications (a “Switching Request”); or (b) delete the Exportable Data (a “Deletion Request”).
    2. A Switching Request or Deletion Request must be submitted in the form attached as Annex A and sent to: [email protected].
    3. Sixty (60) days following Akeyless’ receipt of a Switching Request, the “Initial Transition Period” will commence and will be completed within thirty (30) calendar days, unless extended in accordance with this Addendum.
    4. Within fourteen (14) business days after receiving a Switching Request, Akeyless will inform Customer if completion within the Initial Transition Period is technically unfeasible and will provide a reasonable explanation of the technical limitations and propose an alternative transition period that will not exceed the applicable timeframes set forth in the Data Act (“Alternative Period”).
    5. During the Initial Transition Period or the Alternative Period, Customer may request, in writing and no more than once, an extension of the Transition Period, subject to payment of any applicable fees permitted under the Data Act, as set out in this Addendum (an “Extended Transition Period”).
  3. DELETION PROCESS
    1. Akeyless will support Customer’s Deletion Request to the extent permitted by applicable law by deleting the Exportable Data in accordance with the procedures and timeframes specified in the Agreement and, in any event, no later than the end of the Notice Period.
  4. SWITCHING PROCEDURE
    1. During the Transition Period (and any Extended Transition Period), Akeyless will: (i) provide reasonable assistance to Customer to enable Switching (“Switching Assistance”); (ii) subject to Customer’s continued payment obligations, continue providing the Services in accordance with the Agreement during the Switching process (including maintaining the security levels described in the Agreement); and (iii) provide Customer with information reasonably needed to effect Switching.
    2. Akeyless hereby informs Customer that the following Services and/or data sets are explicitly excluded from Switching under this Addendum (“Excluded Services and Data”):
      1. Usage Data and any data or information owned, developed, or derived by Akeyless, including aggregated or anonymized analytics, insights, predictions, or other analytics generated through proprietary algorithms, and any data the disclosure of which would reveal Akeyless’ trade secrets or intellectual property rights;
      2. Trial, beta, evaluation, proof-of-concept, or other limited-access offerings (to the extent defined or described as such under the Agreement);
      3. Static technical information (documents not generated by the Services, such as manuals, instructions, and invoices).
      4. Services or features for which enabling export or transfer would reasonably risk the continuity, integrity, availability, or security of the Services; and
    3. Customer will promptly notify Akeyless in writing upon successful completion of Switching. Customer is responsible for testing and validating Switching before providing such confirmation. If Customer does not provide confirmation, Akeyless may request it in writing, and if Customer fails to provide such confirmation within ten (10) business days after Akeyless request, Akeyless may deem Switching to have been successfully completed.
  5. RETRIEVAL PERIOD
    1. Upon Customer’s written request, Akeyless will retain the Exportable Data for up to thirty (30) days following completion of the Transition Period (or Extended Transition Period), as applicable (“Retrieval Period”). Customer will continue to pay all charges in accordance with the Agreement during any Retrieval Period. Upon expiration of the Retrieval Period, Akeyless may delete the Exportable Data in accordance with its standard data deletion practices, except to the extent required by applicable law.
  6. TERMINATION
    1. The applicable Order(s) and the Agreement will automatically terminate: (i) in the case of a Switching Request, when Switching is deemed successful in accordance with Section 4.3; or (ii) in the case of a Deletion Request, when Akeyless confirms deletion of the relevant Exportable Data or upon expiration of the Notice Period (each, the “Termination Date”).
    2. Akeyless will continue to provide the Services in accordance with the Agreement until the Termination Date.
    3. For the avoidance of doubt, Customer acknowledges that pricing for annual or multi-year subscription terms and minimum spend commitments is generally lower than pricing for comparable services purchased without such commitments. Customer further acknowledges that it could have elected to purchase the Services on a month-to-month basis at a higher rate. Accordingly, early termination under this Addendum will not relieve Customer of its obligation to pay all fees due under the applicable Order(s). Customer must pay any outstanding subscription fees for the remainder of the term of the relevant Order(s), and any applicable annual fees and minimum commitments (“Early Termination Fee”).
    4. Each invoice is due and payable upon receipt by Customer and will include, without limitation, any then-current subscription fees, unless otherwise specified in the Agreement.
  7. OBLIGATIONS OF THE PARTIES
    1. The parties will cooperate in good faith to facilitate Switching, ensure the timely transfer of Exportable Data, and maintain continuity of the Data Processing Service.
    2. As between the parties, Customer is responsible for importing the Exportable Data into Customer’s systems or the Provider’s systems, as applicable.
    3. All obligations under the Agreement that, by their nature, are intended to survive (including confidentiality obligations) will remain in full force and effect during the Switching process.
    4. Customer represents and warrants that it has all rights and permissions necessary to submit Switching Requests and/or Deletion Requests and to instruct Akeyless to transfer or delete Exportable Data. Customer is solely responsible for the consequences of Switching or Deletion for any affected parties, including Customer’s users, employees, and Affiliates (collectively, “Impacted Parties”), and will indemnify and hold harmless Akeyless from and against any claim, demand, suit, or proceeding brought by an Impacted Party alleging that Customer’s Switching Request or Deletion Request infringes such Impacted Party’s rights or licenses.
    5. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL AKEYLESS OR ITS AFFILIATES BE LIABLE TO CUSTOMER OR ANY IMPACTED PARTY UNDER THIS ADDENDUM FOR ANY DAMAGES, LOSSES, COSTS, OR EXPENSES ARISING OUT OF OR RELATING TO A SWITCHING REQUEST OR A DELETION REQUEST. THIS EXCLUSION OF LIABILITY INCLUDES, WITHOUT LIMITATION, ANY ISSUES RELATING TO EXPORTABLE DATA INTEGRITY OR LOSS, SYSTEM DOWNTIME, COMPATIBILITY ISSUES, OR ANY OTHER DISRUPTIONS OR FAILURES THAT MAY OCCUR DURING OR AS A RESULT OF SWITCHING OR A DELETION REQUEST.

Annex A

Request Formatting

Switching Request

[Date]

To: [Company name and address for communications]

Customer Contact Information: [Name], [Email]

Customer Authorized Representative Information (if applicable): [Name], [Email]

Agreement: [name and details of Agreement]

Switching Option:

☐ Data Processing Provider other than the Company
    New Provider Name: […]
    New Provider Contact Information: […]

☐ On-premises ICT infrastructure

Preferred Exportable Data: […]

Destination and technical specifications for new Provider/ Customer on-premises infrastructure: […]

[Signature of Customer’s authorized representative]

Deletion Request

[Date]

To: [Company name and address for communications]

Customer Contact Information: [Name], [Email]

Customer Authorized Representative Information (if applicable): [Name], [Email]

Agreement: [name and details of Agreement]

Exportable Data: [All covered by the Agreement] or [provide explicit Data or Digital Assets subject to deletion]

Preferred Deletion Date: […]

[Signature of Customer’s authorized representative]

Download
Subscribe to Newsletter
  • PrivilegedAccessManagement(PAM)_BestSupport_QualityOfSupport
  • PrivilegedAccessManagement(PAM)_UsersMostLikelyToRecommend_Nps
  • PasswordManagers_EasiestToUse_Enterprise_EaseOfUse
  • EncryptionKeyManagement_Leader_Enterprise_Leader