Cooperative Computing Alliance LLC Terms of Service#

1. Overview and Acceptance

This Terms of Service Agreement (the “Agreement”) is a binding contract between Cooperative Computing Alliance, LLC, a Texas limited liability company (“CCA”), and each natural person who accesses or uses any resource, service, system, or benefit provided or administered by CCA (“Participant”).

This Agreement includes: (a) these General Terms; (b) any Program-Specific Terms; (c) published Policies; and (d) any Supplemental Terms presented on Resource access, enrollment, or order placement. By enrolling in any program, accessing a CCA system behind authentication, or using any resource administered by CCA, the Participant accepts this Agreement.

2. Eligibility, Enrollment, and Sponsorship

Participants must be at least 18 years old. A person who first accesses a resource before turning 18 and continues to use resources after turning 18 accepts this Agreement at that time. Enrollment may require identity verification, credential provisioning; or completion of the Federation Broker process, or any combination of these and any additional requirements set by CCA.

Each Participant must have one active Sponsor. A Sponsor may withdraw sponsorship for any lawful reason during the first year after a Participant’s enrollment. Sponsor withdrawal takes effect immediately and results in suspension pending acceptance of a new Sponsor.

3. Rights to Access and Use Resources

CCA grants Participants a personal, limited, revocable, nonexclusive, and nontransferable permission to access and use CCA resources solely for cooperative, educational, research, or community purposes allowed by Program Terms. Resources are provided on a licensed or loaned basis and are not sold.

Participants are responsible for all activity that occurs under their identity, account, or credentials. CCA may rely on any action taken through a Participant’s authenticated session as having been authorized by that Participant.

Participants must not:

- reverse engineer, decompile, or circumvent technical controls; - bypass access protections or usage restrictions;

- separate components intended to operate as a single system;

- share, delegate, lend, or sublicense access or credentials;

- provide managed, hosted, or similar services to third parties using CCA resources; or

- use resources or data derived from resources to directly or indirectly create, train, or improve any machine learning or artificial intelligence model that could create legal, operational, or security risk for CCA or a Resource Owner.

Participants may allow supervised use of resources by another person only if expressly permitted in Program Terms and only if all credential-sharing restrictions in Section 8 are followed.

4. Coordinating and Professional Services

Where CCA provides coordination, identity, consulting, or integration services, they are delivered subject to the Agreement and any service description issued by CCA. Fixes, scripts, or configurations supplied by CCA are licensed under the same terms as the underlying service.

Each party retains ownership of materials created outside this Agreement. Pre-existing materials may only be used as required to perform obligations and must remain confidential.

5. Duty of Care and Participant Responsibilities

Participants must handle all CCA resources with reasonable care, follow all qualification requirements, use resources only for intended purposes, and comply with law and program rules. Program Administrators may require training, certification, or insurance for participation in specified programs.

A Resource Owner may restrict any individual Participant from using its resources for any non-discriminatory reason.

5.1 Return of Tangible Resources

Participants must immediately return any tangible resource (including hardware, tools, equipment, and similar items) upon the earliest of:

a written or electronic demand from CCA;
the end of an authorized lending period;
the Participant’s suspension or termination; or
discontinuation of the applicable program.

CCA may demand return at any time for operational, legal, compliance, or security reasons. Participants bear the risk of loss until the resource is physically received by CCA or the Resource Owner. Failure to return resources on demand may result in replacement-cost assessments, recovery actions, and referral to law enforcement where appropriate.

6. Assessments, Offsets, and Financial Terms

CCA or a Resource Owner may assess the Participant for loss, damage, or material impairment of resources caused by negligence or malice, and for shared-cost programs where the Participant agreed to contribute to actual costs.

Assessments must be issued within 365 days after the incident or obligation became known or reasonably should have become known.

If any Sponsor, Entity, Resource Owner, or other creditor provides documentation acceptable to CCA showing that the Participant owes a financial obligation, CCA may offset, from any payment owed to the

Participant, an amount equal to the documented obligation. Offsets may apply to reimbursements, stipends, refunds, cost-shares, or any other payment due to the Participant.

CCA will issue written notice of any offset with supporting information. Participants must pay any undisputed amount within 30 days. Past-due balances accrue interest at 1.5% per month or the maximum allowed by law. CCA provides at least one no-fee payment method.

7. Modification, Suspension, Termination, and Participation Level CCA may update, modify, restrict, or discontinue any resource, feature, or program at any time for operational, security, legal, or business reasons. If a change materially reduces access to a paid program, CCA will use reasonable efforts to provide notice.

CCA may modify or restrict a Participant’s participation level, access scope, or use rights at any time if necessary for operational, security, compliance, or business reasons. CCA may suspend a Participant immediately if:

the Participant violates this Agreement, Program Terms, or Policies;
credentials or authenticated sessions are suspected to be compromised or misused;
a Sponsor withdraws sponsorship;
identity verification or required checks are incomplete; or
CCA determines that urgent operational, legal, or security risks require immediate action.

Suspension may include immediate return of tangible resources and may result in technical safeguards such as shortened session durations, restricted device access, or strengthened authentication.

CCA may impose corrective or educational conditions for reinstatement, including written acknowledgments, apologies, pledges, security training, reverification of contact information, or agreement to increased authentication controls. CCA may permanently restrict access to particular resources if CCA determines that risks are ongoing.

CCA may terminate enrollment for repeated violations, serious misuse, fraud, or conduct inconsistent with program rules. Voluntary termination does not relieve a Participant of prior obligations. Appeals (excluding Sponsor withdrawals) must be mailed within 30 days of notice to the Administrative Redress address. Sanctions remain in effect during appeal unless CCA states otherwise.

8. Confidentiality

“Confidential Information” means nonpublic information that a reasonable person would consider confidential, including authentication credentials, session tokens, multi-factor secrets, security configurations, audit logs, internal operational information, and unpublished terms of this Agreement.

Confidential Information does not include information that becomes public without breach, is independently developed, is received lawfully from a third party, or is feedback voluntarily provided about CCA services.

Each party must protect the other party’s Confidential Information using reasonable safeguards, use it only for the relationship, and disclose it only to representatives who have a need to know and who are bound by confidentiality obligations at least as protective as this Agreement.

Participants must maintain exclusive control over all authentication materials associated with their account, including but not limited to passwords, authentication factors, tokens, session keys, and device-based credentials. Participants must use only devices and accounts that they control when initiating authenticated sessions and must ensure that no other person can access CCA resources through their authenticated state. Any action or omission that allows, enables, or results in another individual obtaining access, whether directly through disclosure or indirectly through an active session or unsecured device, constitutes unauthorized access. Such unauthorized access is a serious violation of this Agreement and may result in immediate suspension, access restrictions, credential resets, or termination of enrollment.

Participants must promptly notify CCA if they suspect misuse, compromise, or unauthorized access related to credentials, authentication devices, or sessions.

Confidentiality obligations last for seven years, except obligations relating to credentials and security information, which continue as long as the information remains sensitive (i.e. when a credential or derivate can no longer be used to access any Resource).

9. Data Handling and Privacy

CCA may collect and retain identifying information, operational logs, authentication data, usage information, and program-administration records as required for security, compliance, and cooperative operations. CCA shares personal data only with Resource Owners for asset recovery and with service providers under confidentiality obligations.

CCA does not transfer, disclose, or make personal data available to third parties for monetary or other valuable consideration, except as permitted under this Agreement or required for security, compliance, operational integrity, or asset-recovery purposes, including for use in industry fraud protection data sharing programs.

10. Verification, Inspection, and Compliance Audits

CCA may verify, investigate, or audit a Participant’s compliance with this Agreement at any time and at CCA’s sole discretion. Except where immediate action is required for security, operational, or legal reasons, CCA will provide notice when reasonably practicable; however, advance notice is not required.

CCA may conduct verification activities using any lawful method, including but not limited to:

reviewing account activity, authentication events, logs, device identifiers, and session metadata;
requesting documentation, attestations, or explanations related to Participant activity, resource usage, or
return obligations;
inspecting devices, configurations, or environments used to access CCA resources, limited to what is
necessary to confirm compliance;
requiring Participants to participate in identity reverification, security checks, or reauthentication measures; and
engaging independent auditors, investigators, or security professionals under confidentiality obligations.

Participants must fully cooperate with any verification request, including providing timely responses, records, device information, or other materials CCA reasonably requires. Failure to cooperate constitutes a material breach.

If verification identifies noncompliance, including misuse, enabling Unauthorized Access, credential risks, inaccurate information, or unreturned resources, CCA may, at its sole discretion:

impose suspension or access restrictions;
require mandatory security measures, training, reverification, or written acknowledgments;
recover or reset credentials, sessions, devices, or access tokens;
assess costs directly related to the verification or investigation, including reasonable fees for third-party
services; and
pursue any other remedy available under this Agreement.

Verification findings are final and may be used by CCA for any operational, security, compliance, or administrative purpose.

11. Intellectual Property and Feedback

Participants retain ownership of their content. CCA retains all rights to its services, systems, marks, and documentation. No rights are granted by implication.

Feedback may be used by CCA without limitation under a perpetual, worldwide, royalty-free license.

12. Disclaimers

Except as expressly provided in Program Terms, CCA resources are provided as is and as available. CCA disclaims all implied, statutory, and express warranties, including merchantability, fitness for a particular purpose, title, non-infringement, and uninterrupted or error-free operation.

13. Indemnification

Participants must indemnify, defend, and hold harmless CCA and Resource Owners against third-party claims arising from the Participant’s acts, omissions, breach of this Agreement, violations of law, or failure to properly use or return resources.

14. Limitation of Liability

CCA is not liable for indirect, incidental, consequential, special, exemplary, or punitive damages, or for lost profits, revenue, goodwill, data, or business interruption, even if foreseeable.

For all claims arising out of or relating to this Agreement, whether in contract, tort, or any other theory, CCA’s total aggregate liability to any Participant is limited to five United States dollars (US $5.00).

This limitation applies to all programs, paid or free, and is not increased by multiple events or claims. If any remedy fails its essential purpose, this limitation still applies. This Section does not limit the Participant’s indemnification obligations.

15. Export and Sanctions Compliance

Resources may be subject to export and sanctions laws. Participants must comply with all applicable restrictions. CCA may suspend or terminate access if compliance risk arises.

16. Changes to Terms

CCA may update this Agreement at any time. Material changes that adversely affect a paid program take effect upon renewal unless earlier acceptance is required. Continued use of resources constitutes acceptance of updates.

17. Miscellaneous

Texas law governs this Agreement. Exclusive venue lies in Dallas County, Texas. Participants may not assign this Agreement without CCA’s written consent. CCA may assign it as part of a merger, reorganization, or transfer. Severability, non-waiver, and independent-contractor status apply. Neither party is liable for failure to perform due to causes beyond reasonable control, except payment obligations.

18. Definitions

For purposes of this Agreement, the following terms have the meanings below. These definitions apply

wherever the terms appear in this Agreement or in Program Terms unless expressly stated otherwise.

Administrator means a CCA-designated role responsible for managing systems, programs, or resources, including access control and operational decisions.

Confidential Information has the meaning set forth in Section 8. Credential means any authentication factor issued or recognized by CCA, including passwords, passkeys, tokens, certificates, session identifiers, device-bound credentials, or any mechanism used to authenticate or authorize access to CCA resources.

Entity means a legally organized business, nonprofit, governmental body, or other juridical organization registered with CCA and issued an Entity Member Control Identifier.

Federation Broker means the CCA-operated identity, authentication, and authorization system or its successor used to provision and manage Participant identity, device trust, and access to resources.

Participant means any natural person who completes CCA’s enrollment process or knowingly accesses any CCA resource that is behind a login or on a private or controlled-access network.

Program Administrator means the individual or team designated by CCA to manage a specific program, resource category, or service offering, and to establish program-specific rules, qualification requirements, and usage conditions.

Program Terms means rules and requirements governing specific programs, published by CCA, that

supplement this Agreement.

Resource means any property, service, system, access right, or benefit provided, owned, sponsored, or

administered by CCA or a Resource Owner, including:

tangible items such as hardware, equipment, tools, and similar movable goods;
intangible resources such as identity and access services, software licenses, cloud or hosted services,

public IP address space, routing, datacenter services, licensed frequencies, applications, and online platforms.

Resource Owner (or Resource Sponsor) means a Participant or Entity recognized by CCA as owning, sponsoring, or providing a Resource and granting CCA authority to administer or lend that Resource.

Sponsor means an active Participant who has agreed to sponsor another Participant’s enrollment and who may withdraw sponsorship in accordance with Section 2.

Unauthorized Access means any access, attempted or actual, by any person who (a) is not currently enrolled as a Participant; (b) lacks written authorization from CCA; (c) uses credentials or sessions issued to another person; (d) uses a device, token, card, network, or account not controlled by the Participant for the purpose or effect of granting access to others; or (e) exceeds the scope of permissions granted by CCA, a Resource Owner, Policies, or Program Terms.

19. Acknowledgment. Acknowledgment

By accessing or using any CCA resource, the Participant acknowledges and agrees to be bound by this Agreement.