DORA Addendum
Master Agreements
Supplemental Terms
Master Agreements
Supplemental Terms
Master Agreements
Supplemental Terms
This DORA Addendum (“Addendum”) supplements and forms part of the agreement between CodeRabbit Inc. (“CodeRabbit”) and the customer identified therein (“Customer”) for the provision of the Services.
This Addendum applies where Customer is a financial entity as defined in Article 2(2) of Regulation (EU) 2022/2554 (“DORA”) and takes effect upon the later of: (i) January 17, 2025; or (ii) the date of full execution date of this Addendum. Capitalized terms not defined herein have the meaning given to them in the Agreement or in DORA.
| DORA Ref. | Requirement | Addendum Section |
|---|---|---|
| Art. 30(2)(a) | Services & subcontracting | Section 4. a. |
| Art. 30(2)(b) | Data locations | Section 4. b. |
| Art. 30(2)(c) | Data protection | Section 4. c. |
| Art. 30(2)(d) | Access, recovery & return | Section 4. d. |
| Art. 30(2)(e) | Service levels | Section 4. e. |
| Art. 30(3)(f) | Exit strategy & transition | Section 4. f. |
| Art. 30(2)(f) | ICT incident assistance | Section 5 |
| Art. 30(2)(g) | Regulatory cooperation | Section 6 |
| Art. 30(2)(h) | Termination rights | Section 7 |
| Art. 30(2)(i) | Security awareness training | Section 8 |
2.1 “Agreement” the Order Form, Terms of Service, Master Services Agreement. or other written agreement between CodeRabbit and Customer governing Customer’s use of the Services, including any applicable data processing addendum.
2.2 “Critical or Important Function” a function of Customer, the disruption of which would materially impair the financial performance of Customer, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair Customer’s continuing compliance with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law.
2.3 “Customer Data” data uploaded to or generated by Customer’s use of the Services, as defined in the Agreement.
2.4 “DPA” the Data Processing Addendum between the Parties governing the processing of personal data in connection with the Services, incorporated by reference into the Agreement (available at https://coderabbit.ai/legal/dpa or as otherwise agreed in writing).
2.5 “ESAs” the European Supervisory Authorities: the EBA, ESMA and EIOPA.
2.6 “ICT-Related Incident” a single event or a series of linked events, unplanned by Customer, that compromises the security of CodeRabbit’s network and information systems and has an adverse impact on the availability, authenticity, integrity or confidentiality of Customer Data or on the Services provided to Customer.
2.7 “ICT Services” the digital and data services provided by CodeRabbit to Customer through CodeRabbit’s systems on an ongoing basis, constituting ICT services within the meaning of DORA.
2.8 “Insolvency Event” an event where CodeRabbit: (i) is unable to pay its debts as they fall due; (ii) passes a resolution for winding-up or dissolution (other than for a solvent reconstruction); or (iii) has a receiver, administrator or liquidator appointed over the whole or a material part of its assets.
2.9 “Regulatory Authority” a competent authority or resolution authority of Customer in the European Union with supervisory jurisdiction over Customer pursuant to DORA.
2.10 “Services” CodeRabbit’s AI-powered code review platform and related services as described in the Agreement.
2.11 “Sub-processors” third-party ICT providers engaged by CodeRabbit in connection with the delivery of the Services.
3.1 This Addendum applies to Customer where Customer qualifies as a financial entity under Article 2(2) of DORA and uses the Services as ICT services within the meaning of DORA.
3.2 The Parties acknowledge that CodeRabbit’s Services constitute ICT services within the meaning of DORA; however, the Services support software development functions only and, as such, do not directly support any Critical or Important Function of Customer as a financial entity.
3.3 This Addendum does not apply to any services provided by CodeRabbit that do not constitute ICT services, nor to any services that are ancillary or incidental to non-ICT services.
3.4 Where Customer engages or re-sells the Services on behalf of a third party that is itself a financial entity under DORA, Customer’s engagement of CodeRabbit constitutes sub-contracting for the purposes of DORA. Customer may not assign rights under this Addendum to any third party without CodeRabbit’s prior written consent.
4.1 Description of ICT Services; Art. 30(2)(a). A complete description of the ICT Services provided by CodeRabbit to Customer is set out in the Agreement. CodeRabbit may engage Sub-processors to assist in delivering the Services; a current list of Sub-processors is maintained and made available at https://trust.coderabbit.ai/ (or such other URL as CodeRabbit may notify Customer from time to time). CodeRabbit remains responsible for the performance of the Services under this Addendum, including where CodeRabbit engages Sub-processors to deliver the Services. Nothing in this Section modifies the limitations of liability set out in the Agreement or Section 11 of this Addendum.
4.2 Locations for the Provision of ICT Services; Art. 30(2)(b). The regions and countries from which the ICT Services are provided, and the locations where Customer Data is stored and processed (including Sub-processor locations), are listed at: https://trust.coderabbit.ai/ (or such other URL as CodeRabbit may notify Customer from time to time). CodeRabbit will provide Customer with reasonable advance notice before making any material change to the data processing or storage locations.
4.3 Availability, Authenticity, Integrity and Confidentiality of Data; Art. 30(2)(c). CodeRabbit implements and maintains technical and organisational security measures designed to protect the availability, authenticity, integrity and confidentiality of Customer Data, as set out in the Agreement and the DPA. CodeRabbit’s security certifications and attestations are available at: https://coderabbit.ai/security..
4.4 Access, Recovery and Return of Customer Data; Art. 30(2)(d). Customer Data retained by CodeRabbit in accordance with the DPA is accessible to Customer through the CodeRabbit web application during the term of the Agreement. Upon termination or expiry of the Agreement, or upon an Insolvency Event or discontinuation of the Services, CodeRabbit will delete Customer Data in accordance with the Agreement and the DPA. Customer is responsible for exporting any Customer Data it wishes to retain prior to termination. Further details of CodeRabbit’s data retention and deletion practices, including applicable retention periods, are set out in the DPA.
4.5 Service Levels; Art. 30(2)(e). Service level descriptions, response times, uptime commitments and related performance metrics applicable to the Services are set out in the Agreement and any service level agreement incorporated therein (available at https://coderabbit.ai/sla or as otherwise agreed in writing). Updates to service levels will be communicated in accordance with the Agreement.
4.6 Exit Strategy and Transition Period. CodeRabbit recognises that Regulated Entities must be able to migrate away from the Services without undue disruption to their operations or regulatory compliance. Accordingly, upon written request from Customer submitted prior to or at the time of termination or expiry of the Agreement, CodeRabbit will, subject to agreement of a transition order or statement of work, continue to make the Services available for a pre-defined transition period (the “Transition Period”) to enable Customer to migrate to an alternative provider or to an in-house solution. The duration and conditions of the Transition Period (including any applicable fees, which shall be payable by Customer at the then-current subscription rates, and any data portability or migration assistance) shall be agreed in writing between the Parties prior to the commencement of the Transition Period. CodeRabbit is under no obligation to provide the Services beyond the agreed Transition Period. During the Transition Period, all terms of the Agreement (including payment obligations) shall continue to apply.
5.1 When an ICT-Related Incident occurs that relates to, or may otherwise affect, the ICT Services provided to Customer, CodeRabbit will, without undue delay:
5.1.1 notify Customer of the ICT-Related Incident;
5.1.2 provide Customer with information CodeRabbit reasonably holds regarding the nature, scope and impact of the incident; and
5.1.3 provide Customer with reasonably requested information on the steps CodeRabbit is taking or has taken to address the incident.
5.2 Cost of assistance.
5.2.1 Where an ICT-Related Incident is attributable solely to the acts or omissions of CodeRabbit, CodeRabbit will provide the assistance described in Section 5. a. at no additional cost to Customer.
5.2.2 Where the cause of an ICT-Related Incident cannot be determined, or where the incident is attributable (in whole or in part) to Customer’s acts, omissions or configurations, any additional assistance provided by CodeRabbit beyond the notifications in Section 5. a. shall be charged at CodeRabbit's then-current professional services rates (or as otherwise agreed in writing prior to the performance of such assistance), such rates constituting the ex-ante cost determination within the meaning of DORA Article 30(2)(f).
5.2.3 Any assistance that goes beyond the scope of Section 5. a. (including bespoke investigation, forensic support, or assistance with Customer’s own incident reporting obligations to its Regulators) shall be provided by CodeRabbit at its then-current professional services rates or as otherwise agreed in writing.
5.3 Nothing in this Section 5 requires CodeRabbit to disclose information that is legally privileged, subject to a duty of confidentiality owed to a third party, or that CodeRabbit reasonably considers would prejudice the security or integrity of its systems or other customers’ data.
6.1 To the extent required by applicable law, CodeRabbit will fully cooperate with the Regulatory Authority of Customer, including persons duly appointed by such authority, in relation to the ICT Services provided to Customer under the Agreement. Such cooperation will be limited to:
6.1.1 matters directly related to the ICT Services;
6.1.2 matters strictly necessary to address Customer’s compliance obligations under DORA; and
6.1.3 requests that do not place an undue operational, technical or administrative burden on CodeRabbit.
6.2 CodeRabbit will not be required to cooperate with Regulatory Authorities to the extent that doing so would: (a) require disclosure of information that is legally privileged, confidential, or proprietary to CodeRabbit; (b) threaten the security or integrity of CodeRabbit’s systems or other customers’ data; or (c) impose obligations on CodeRabbit beyond those set out in this Addendum or required by applicable law.
6.3 Where cooperation with a Regulatory Authority places an undue burden on CodeRabbit (as determined by CodeRabbit acting reasonably), CodeRabbit may charge Customer a reasonable cost for such cooperation, to be agreed in good faith between the Parties prior to CodeRabbit incurring such costs (except where the urgency of the request makes prior agreement impracticable, in which case CodeRabbit shall provide Customer with reasonable advance notice of anticipated costs).
6.4 Customer is responsible for coordinating any requests from Regulatory Authorities to CodeRabbit. CodeRabbit shall not be required to communicate directly with Regulatory Authorities without Customer’s prior written approval except as required by applicable law.
6.5 CodeRabbit will notify Customer in writing without undue delay, and in no event later than within three (3) Business Days of receiving any communication from a Regulatory Authority that relates to the ICT Services provided to Customer under this Addendum. “Business Days” means days other than Saturdays, Sundays and public holidays in the state of California, USA.
7.1 In addition to any termination rights set out in the Agreement, Customer may terminate this Addendum and the Agreement (as it relates to the ICT Services) by providing written notice to CodeRabbit if any of the following circumstances occurs:
7.1.1 CodeRabbit materially breaches applicable law or a material obligation under this Addendum;
7.1.2 circumstances are identified, whether through monitoring of ICT third-party risk or otherwise, that Customer acting reasonably deems capable of materially adversely altering the performance of the ICT Services, including material changes to CodeRabbit’s situation;
7.1.3 there are evidenced material weaknesses in CodeRabbit’s ICT risk management in particular with respect to maintaining the availability, authenticity, integrity and confidentiality of Customer Data; or
7.1.4 such termination is expressly required by a Regulatory Authority of Customer with binding authority to require it.
7.2 Cure Period. Customer may only exercise the termination right under Sections 7 a. i., ii., or iii. after: (i) providing CodeRabbit with written notice describing the basis for the proposed termination in reasonable detail; and (ii) CodeRabbit having failed to cure or take demonstrable remediation steps within thirty (30) Business Days of receipt of such notice. Minimum Notice Period. Any notice of termination under this Section 7 must be given with a minimum of thirty (30) Business Days’ prior written notice; notwithstanding the foregoing, where termination is required pursuant to Section 7. a. iv. (Regulatory Authority instruction), no cure period applies and Customer may terminate with immediate effect upon written notice. Customer acknowledges that a shorter notice period may not allow CodeRabbit sufficient time to wind down the ICT Services in an orderly manner.
7.3 Effect of Termination. Upon termination or expiry of the Agreement for any reason, the provisions of the Agreement relating to data return, payment of outstanding fees, confidentiality and limitation of liability shall continue in full force and effect. Customer will remain liable for and must promptly pay all outstanding fees for Services rendered up to and including the effective date of termination. CodeRabbit will issue a final invoice for such fees, payable in accordance with the Agreement.
8.1 CodeRabbit operates an internal ICT security awareness program and requires relevant personnel to complete digital operational resilience training at least annually.
8.2 If Customer wishes CodeRabbit’s relevant personnel to participate in Customer’s own ICT security awareness program or digital operational resilience training, such participation is subject to the following conditions:
8.2.1 Customer must give CodeRabbit at least thirty (30) Business Days’ prior written notice;
8.2.2 participation is limited to once per calendar year;
8.2.3 participation will be conducted virtually (remote attendance only); CodeRabbit does not operate on-site at Customer's premises and has no obligation to attend in person under any circumstances;
8.2.4 training must be directly relevant to the cloud-delivered ICT Services provided by CodeRabbit under the Agreement; participation is not required in respect of any on-site, infrastructure-level or physical security matters that do not relate to the cloud-delivered Services;
8.2.5 all costs and expenses incurred by CodeRabbit in connection with such participation will be borne by Customer; and
8.2.6 participation will not require CodeRabbit to disclose proprietary, confidential or commercially sensitive information, nor create any obligations beyond those already set out in this Addendum or the Agreement.
| The obligations in this Section 9 are enhanced obligations under Article 30(3) of DORA. They apply only where the conditions in subsection 9. b. (Customer written notification + CodeRabbit written agreement) have been satisfied. Until that point, only Sections 2–8 and 10–12 of this Addendum apply. |
|---|
9.1 CodeRabbit’s Services are AI-powered code review and developer workflow tooling. They are not directly integrated into the delivery of financial services to Customer’s end clients, and a disruption to the Services would not by itself impair the soundness or continuity of Customer’s regulated financial activities. Accordingly, as of the Effective Date, the Parties confirm that the Services do not support a Critical or Important Function of Customer.
9.2 Where Customer believes that the Services support, or may in the future support, a Critical or Important Function, Customer must notify CodeRabbit in writing, specifying its basis for such determination. The enhanced obligations under Article 30(3) of DORA (including audit rights, business continuity obligations, TLPT participation and exit strategy requirements) will apply only if:
9.2.1 Customer provides such written notification with reasonable detail; AND
9.2.2 CodeRabbit expressly agrees in writing that the Services support a Critical or Important Function.
9.3 The Parties will negotiate in good faith the terms of any enhanced obligations under Section 9. b. (including any additional fees payable by Customer for such additional obligations) within a commercially reasonable timeframe. Until such agreement is reached in writing, only the obligations set out in Sections 2 through 8 and 10 through 12 of this Addendum shall apply.
9.4 Threat-Led Penetration Testing (TLPT). Where the Parties have agreed in writing pursuant to Section 9. b. that the Services support a Critical or Important Function, and where Customer is required under DORA to conduct threat-led penetration testing (“TLPT”) in connection with the Services, CodeRabbit will participate in such TLPT subject to the following conditions:
9.4.1 TLPT must be carried out by a third-party provider appointed by CodeRabbit (acting reasonably), whose identity and scope have been agreed in advance with CodeRabbit in writing;
9.4.2 TLPT is limited to once per calendar year and must be scheduled with at least sixty (60) Business Days’ prior written notice;
9.4.3 the scope of TLPT is limited to systems and components that are directly relevant to the delivery of the Services to Customer;
9.4.4 TLPT must not threaten the security, integrity or availability of CodeRabbit's systems or other customers' data; and
9.4.5 all costs of TLPT, including CodeRabbit's reasonable costs of participation and the appointed third-party provider's fees, will be borne by Customer.
10.1 The existence and terms of this Addendum, and all information, documentation and responses provided by either Party in connection with this Addendum (including in connection with any regulatory cooperation under Section 6 or security training under Section 8), constitute Confidential Information of the disclosing Party and are subject to the confidentiality obligations in the Agreement.
10.2 Nothing in this Section prevents disclosure of this Addendum or its terms to a Regulatory Authority where required by applicable law, provided that the disclosing Party uses reasonable efforts to obtain confidential treatment of any proprietary information before making such disclosure and notifies the other Party as soon as reasonably practicable (to the extent permitted by law).
11.1 Customer’s sole and exclusive remedy for any breach by CodeRabbit of its obligations under this Addendum is: (i) to require CodeRabbit to cure the breach in accordance with the cure period in Section 7. a.; or (ii) to terminate this Addendum and the applicable Agreement in accordance with Section 7. Nothing in this Addendum creates any right to damages, credits or other remedies in addition to those set out in the Agreement.
11.2 The limitations of liability and exclusions set out in the Agreement apply in full to this Addendum. In no event shall CodeRabbit’s aggregate liability under or in connection with this Addendum exceed the limitations specified in the Agreement.
12.1 Order of Precedence. This Addendum supplements and forms part of the Agreement. To the extent of any conflict or inconsistency between this Addendum and the Agreement, this Addendum shall prevail with respect to the DORA-specific obligations set out herein. Except as expressly amended by this Addendum, the Agreement remains in full force and effect.
12.2 Governing Law. This Addendum is governed by and construed in accordance with the governing law specified in the Agreement. To the extent that DORA mandates specific legal requirements that conflict with the governing law of the Agreement, those DORA requirements shall apply to the extent and only to the extent so mandated.
12.3 Entire Agreement. This Addendum (together with the Agreement) constitutes the complete and exclusive agreement between the Parties with respect to DORA compliance in connection with the Services and supersedes all prior representations, discussions and agreements relating to the same subject matter.
12.4 Amendments. No amendment to this Addendum is effective unless made in writing and signed by authorised representatives of both Parties. CodeRabbit reserves the right to update this Addendum to reflect changes in applicable law or regulatory requirements; any such updates will be notified to Customer with reasonable advance notice and will not materially reduce CodeRabbit’s obligations under this Addendum.
12.5 Severability. If any provision of this Addendum is held invalid, illegal or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.
12.6 Relationship of Parties. Nothing in this Addendum creates a partnership, joint venture, employment or agency relationship between the Parties.