API Addendum

(a) "Partner API" means the application programming interface Quotamation makes available at api.quotamation.com, together with its documentation.

(b) "API Credentials" means any client identifier, client secret, access token, or other credential issued to Customer for access to the Partner API.

(c) "Integrator" means any third party — including any developer, contractor, vendor, or software service — to whom Customer discloses API Credentials or on whose behalf Customer permits use of the Partner API.

(d) "Automated Agent" means any software that uses an artificial intelligence or machine learning model to determine, at the time of execution, which Partner API operations to invoke, in what sequence, or with what inputs, rather than executing a sequence of operations fixed in advance by a natural person. This includes, without limitation, tool-using language model applications, autonomous agent frameworks, and Model Context Protocol servers and clients.

(e) "Multi-Agency Integrator" means an Integrator that accesses the Partner API on behalf of more than one Customer or insurance agency.

Customer accepts this Addendum through the administrative interface Quotamation provides. Acceptance by any individual holding administrative access to Customer's account constitutes Customer's acceptance and binds Customer, and Customer is responsible for restricting administrative access accordingly. Quotamation records the version accepted, the date and time of acceptance, and the accepting individual.

Where Quotamation publishes a revised version of this Addendum, Customer will be required to accept the then-current version before creating further API Credentials. API Credentials already issued remain governed by the version in effect when they were issued and continue to function.

API Credentials are login and access credentials of an Authorized User for all purposes under Section 4 of the Agreement, and are Confidential Information of Quotamation under Section 6. Customer shall secure API Credentials with no less care than it applies to the passwords of its own personnel.

Customer is responsible for all activity conducted through its API Credentials, whether or not authorized by Customer and whether conducted by Customer, an Authorized User, an Integrator, or an Automated Agent. Customer shall not disclose API Credentials to any Integrator unless that Integrator is bound by written obligations of confidentiality and data protection at least as protective as those in the Agreement and this Addendum. Customer remains liable for each Integrator's acts and omissions as if they were Customer's own.

(a) Requests not directed by a person. Customer acknowledges that where API Credentials are used by an Automated Agent, the operations invoked, their sequence, their inputs, and the volume of requests are determined by a model at the time of execution, and may not correspond to any specific instruction given by Customer or any Authorized User. Customer is responsible for all such activity, and for all charges arising from it under Section 13, whether or not any natural person directed the particular requests.

(b) Third-party content. Customer acknowledges that data returned by the Partner API may include content submitted by or on behalf of Customer's clients and prospects, including free-text fields and the contents of uploaded documents, and that Quotamation does not verify such content. Customer further acknowledges that such content may, when processed by an Automated Agent, influence that agent's subsequent behavior, including which Partner API operations it invokes and with what inputs. Customer is responsible for implementing controls appropriate to that risk.

(c) Artificial intelligence service providers. Customer acknowledges that where an Automated Agent is used, data returned by the Partner API may be transmitted to and processed by third-party providers of artificial intelligence or machine learning services. Customer represents and warrants that it has obtained all rights, consents, and permissions necessary for that transmission and processing, and that it has entered into terms with such providers appropriate to the nature of the data. Quotamation is not a party to, and has no responsibility for, Customer's arrangements with such providers.

(d) Least privilege. Where Quotamation makes granular permission selection available, Customer shall grant API Credentials used by an Automated Agent only those permissions the agent's intended function requires.

(a) Separate credentials. A Multi-Agency Integrator shall obtain and use separate API Credentials in respect of each Customer on whose behalf it accesses the Partner API, and shall not use API Credentials issued in respect of one Customer to access the data of another.

(b) Authority. Each Customer that discloses API Credentials to a Multi-Agency Integrator represents that it has authorized that Integrator to access the Partner API on its behalf, and remains responsible for that Integrator's acts and omissions under Section 4.

(c) Segregation. A Multi-Agency Integrator shall not commingle data obtained in respect of one Customer with data obtained in respect of any other, and shall maintain controls sufficient to prevent the disclosure of one Customer's data to another.

(d) Direct agreement. Quotamation may enter into a separate written agreement with a Multi-Agency Integrator governing its access to the Partner API. Where such an agreement is in effect, it governs that Integrator's access, and this Section 6 applies only to the extent it is not inconsistent with that agreement.

Customer shall not, and shall not permit any Authorized User, Integrator, or Automated Agent to:

Customer shall notify Quotamation at support@quotamation.com within forty-eight (48) hours of becoming aware of any actual or suspected disclosure, loss, theft, or unauthorized use of API Credentials, and shall immediately rotate or revoke the affected credentials using the controls Quotamation provides.

Customer acknowledges that the Partner API returns nonpublic personal information relating to Customer's clients and prospects, which may include full name, date of birth, residential address, telephone number, email address, driver's license number, and insurance claims and violation history. Customer is solely responsible for safeguarding such information once it is transmitted to Customer, to an Integrator, or to any provider described in Section 5(c), and for its own compliance with the Gramm-Leach-Bliley Act and its Safeguards Rule, applicable state insurance data security laws, and any other applicable data protection Laws.

Quotamation may record requests made to the Partner API, including the API Credential used, the operation invoked, the time of the request, and the network address from which it originated. Quotamation may use any such records to operate and secure the Partner API, to calculate charges, to investigate suspected violations of this Addendum or the Agreement, and to comply with applicable Law. Any such records are retained in accordance with Quotamation's ordinary retention practices.

In addition to the suspension rights in Section 2(b) of the Agreement, Quotamation may suspend or revoke any API Credential immediately and without prior notice where Quotamation reasonably believes the credential has been compromised, is being used in violation of this Addendum, or is generating anomalous request volume. Quotamation will notify Customer promptly following any such suspension.

Quotamation may impose and modify rate limits, request quotas, and concurrency limits on the Partner API. Quotamation will use commercially reasonable efforts to give notice of any change that materially reduces an existing limit.

Certain Partner API operations — including data prefill lookups and carrier quote requests — incur third-party charges billed to Customer under Section 5 of the Agreement. Customer is responsible for all such charges incurred through its API Credentials, whether incurred by Customer, an Authorized User, an Integrator, or an Automated Agent, and whether or not the underlying use was authorized or directed by Customer.

Quotamation may release new versions of the Partner API and may deprecate and subsequently discontinue prior versions. Customer acknowledges that the Partner API is under active development, and that its operations, its request and response formats, and the versions available may change.

Quotamation will use commercially reasonable efforts to give Customer advance notice before discontinuing a version of the Partner API that Customer is then using, and to make the length of that notice proportionate to the impact of the change. Quotamation does not commit to any minimum notice period. Where a change is reasonably required to address a security vulnerability or to comply with applicable Law, Quotamation may make it without advance notice.

Quotamation may make backwards-compatible changes to the Partner API at any time and without notice, including adding operations, adding optional request fields, and adding fields to responses. Customer shall ensure that its integrations tolerate such changes.

On the expiration or earlier termination of the Agreement, all API Credentials issued to Customer are revoked, Customer's right to access the Partner API ceases, and Customer shall ensure that it and each of its Integrators ceases all use of the Partner API. Customer shall, and shall ensure that each Integrator shall, delete or destroy Customer Data obtained through the Partner API, except to the extent retention is required by applicable Law, and shall certify such deletion or destruction in writing on Quotamation's request. This Section survives termination.

Quotamation may revise this Addendum by publishing an updated version at this address, which takes effect on acceptance as described in Section 2. Continued use of API Credentials already issued is governed by the version in effect when they were issued.