Annex 3 — Support, maintenance and lifecycle policy

to the General Terms and Conditions of CanMe GmbH (Product) v2.1 Version 1.1 · Effective October 2026 · Published at https://www.canme.cloud/en/support

---

This annex is a convenience translation of the German original. In the event of any discrepancy, the German version prevails.

---

1. Scope and assignment

(1) This annex governs the commercial support packages, incident management and the product lifecycle. It specifies §§ 14 and 15 of the Terms.

(2) Support packages are booked per Tenant. For each active Tenant (consumption billing or Commitment Plan), the Customer chooses one of the packages Best Effort, Basic or Enterprise when ordering. The monthly Tenant price equals the price of the chosen package under the price list (Annex 7) and is billed monthly in arrears for the calendar month (§ 19(2a) of the Terms). The Customer may change a Tenant's package in myCanMe or in text form with effect from the first day of the following calendar month; for Best Effort, section 2(2) also applies.

(3) In accordance with § 14(1a) of the Terms, support requires an active, paid subscription and operation of the Software in accordance with the Documentation. There is no support entitlement during trials (§ 18 of the Terms); enquiries are answered as capacity allows.

---

2. Support packages

(1) Best Effort includes no support undertakings, in particular no response times, service hours or resolution undertakings (§ 14(1a) of the Terms). The Customer relies on self-help (Documentation, community); enquiries in the myCanMe portal are handled without any undertaking as capacity allows. The Tenant price for Best Effort is set out in Annex 7. Best Effort concerns support only; Commitment Plans (§ 19a of the Terms) may also be concluded for Tenants with Best Effort.

(2) Limit of 100 Identities; early warning; switch to Basic. Best Effort is available only for Tenants in which no more than one hundred (100) Identities are counted in the calendar month (counted under § 19b(2) and (4a) of the Terms; Links connected to the Tenant count as device Identities). If eighty (80) or more Identities are counted in a calendar month, the Customer receives an early warning by email. If more than one hundred (100) Identities are counted in a calendar month, CanMe informs the Customer in text form (e.g. by email) that the Tenant will be switched to the Basic package from the first day of the following calendar month, and switches it at that time; from then on the Tenant price for Basic under Annex 7 applies. The Customer may choose Enterprise instead with effect from the same date. A change back to Best Effort is possible under section 1(2) once the Tenant complies with the limit again.

---

3. Priorities and response times (Enterprise)

The priority of a ticket is proposed by the reporter when opening it in the myCanMe portal and is classified bindingly by CanMe on the basis of the definitions below. Over- or under-classifications are corrected with reasons.

(1) Priority 1 report (★★★): in addition to opening a ticket, by phone on +49 30 520041516. During priority 1 handling, the Customer provides a reachable, competent contact (§ 12(2) of the Terms).

(2) Response times run within the service hours of the booked package from receipt of a complete report (§ 12(3) of the Terms: description of symptoms, version levels, reproduction steps or log extracts).

---

4. Delimitations

(1) Response time ≠ resolution time. Response time is the time until CanMe's first qualified answer. Resolution times are not committed; CanMe works on priority 1 incidents continuously and with appropriate priority during service hours.

(2) Not covered by support (§ 14(3) of the Terms): the Customer Environment; third-party software, hardware and services; unapproved modifications; faults resulting from failure to apply updates; use outside the Documentation; set-up, configuration and operation of the CAN (for this: Professional Services, Module C).

(3) Support does not include any availability commitment for the CAN (§ 13 of the Terms).

---

5. Maintenance, versions, updates

(1) Updates independent of the support package: updates, including security updates and functional updates, are provided for every active, paid Tenant — with or without a Commitment Plan, irrespective of the support package chosen (Best Effort, Basic or Enterprise) (§ 14(1) of the Terms). The support packages govern ticket handling and response times only. Installation of updates is the Customer's responsibility.

(2) Version maintenance: the current major version (N) and the immediately preceding major version (N-1) are supported (§ 14(2) of the Terms).

(3) Customer's duty to update: security updates provided must be applied within a period appropriate to their criticality and, for updates classified as critical, within thirty (30) days (§ 14(5) of the Terms).

(4) Delivery channels: release notes and downloads via the myCanMe portal; security advisories via myCanMe and by email to the named security contacts; reporting point: security@canme.cloud (https://www.canme.cloud/en/security).

---

6. Product lifecycle and security update period

(1) Irrespective of the support package booked, CanMe provides security updates per product version for at least five (5) years from placing on the market (§ 14(4) of the Terms; Regulation (EU) 2024/2847).

(2) The dates applicable per product version are published here:

(3) The end of a security update period is announced at least twelve (12) months in advance via the myCanMe portal and by email to the named contacts.

---

7. Vulnerability reports

Security vulnerabilities — including those outside the support packages and those found by third parties — are to be reported to security@canme.cloud (§ 15 of the Terms). The response times of this annex do not apply to vulnerability reports; they are prioritised under the documented vulnerability handling process.

---

CanMe GmbH · Albert-Einstein-Strasse 1, 95028 Hof, Germany · hello@canme.cloud