Master Services Agreement

SWORKSCYBER, LLC d/b/a Rovally

Cybersecurity, Compliance and IT Operations services

Service Provider Contact Information

<contact@rovally.com>

1111 6th Ave Ste 550, PMB 367700, San Diego, California 92101-5211

Version 2.0 — Last Updated: October 23, 2026

1. INTRODUCTION AND SCOPE

Summary: This section establishes who the parties are and how this agreement works with individual project scopes.

This Master Services Agreement ("Agreement" or "MSA") establishes the general terms and conditions under which SWORKSCYBER, LLC d/b/a Rovally ("Provider" or "Rovally") will provide cybersecurity, compliance, and IT services to clients ("Client"). This MSA is incorporated by reference into each Statement of Work ("SOW") executed between Rovally and Client. The Data Processing Agreement ("DPA") and the Service Level Agreement ("SLA"), in the versions identified in the applicable SOW (or, if the SOW does not identify a version, the versions published at the Published URLs on the SOW's effective date), are incorporated into and form part of this Agreement. Each SOW identifies by version number or date the version of this MSA, the DPA, and the SLA that governs it. "Published URLs" means www.rovally.com/master-services-agreement, www.rovally.com/data-processing-agreement, and www.rovally.com/service-level-agreement, or successor URLs that Provider notifies to Client in writing.

In the event of any conflict among these documents: (a) the DPA prevails with respect to data protection matters; (b) this MSA prevails over a SOW unless the SOW expressly states that it overrides a specific provision of this MSA; (c) a SOW prevails over the SLA for the Services covered by that SOW; and (d) this MSA prevails over the SLA.

Summaries. The italicized summaries at the beginning of each section of this Agreement, the DPA, the SLA, and Schedule B are provided for convenience only, are not part of the Agreement, and do not modify, limit, or expand the operative text.

2. SERVICES

Summary: This section defines what services Rovally provides, how they're delivered, and who does the work. Key points: services are defined in SOWs; we may use qualified subcontractors; all services are remote unless otherwise agreed.

2.1 Purpose

Provider will deliver to Client cybersecurity and IT solutions—including professional services, managed security services, third-party software and platform management, and any related products or devices (collectively, "Services"). The detailed nature, scope, pricing, and deliverables of these Services are set forth in the applicable Statement of Work.

2.2 Statements of Work

"Statement(s) of Work" or "SOWs" means a statement of work, ordering document, accepted proposal, or other agreed upon engagement document issued under this Agreement. Each SOW will incorporate this MSA by reference and will be governed by the terms and conditions of this Agreement. Statements of Work may set out certain "Deliverables", which include all written information (such as reports, specifications, designs, plans, or other technical or business information) that Provider prepares for Client in the performance of the Services.

2.3 Qualified Consultants

Provider will assign qualified personnel to perform the Services. Provider's warranties regarding the performance of the Services are set forth in Section 9.

2.4 Subcontractors and Third-Party Service Providers

Summary: Rovally may use vetted subcontractors (currently Alectrona, LLC for help desk and IT operations) without requiring your approval. We remain fully responsible for their work, and any subcontractor that handles personal data is listed as a Sub-processor in the DPA.

Use of Subcontractors

Provider performs all Services directly unless Provider determines that engaging a subcontractor best serves Client's specific needs. Provider reserves the right to engage qualified subcontractors, including but not limited to Alectrona, LLC, to perform certain Services under this Agreement when Provider determines that doing so is appropriate based on Client's requirements.

Provider's Responsibility for Subcontractors

Provider remains fully responsible and liable for all Services performed by subcontractors as if Provider had performed such Services directly. Client's sole recourse for any issues arising from subcontractor performance shall be against Provider, not the subcontractor. Provider shall ensure that all subcontractors:

• Are bound by written agreements containing confidentiality obligations at least as restrictive as those in this Agreement
• Maintain appropriate cybersecurity safeguards, controls, and best practices equivalent to or exceeding industry standards
• Maintain a security program appropriate to the Services they perform, with independent attestation where available
• Maintain professional liability insurance with coverage limits appropriate for the Services being performed
• Comply with all applicable data protection laws and regulations
• Adhere to the same service quality standards required of Provider under this Agreement

Insurance Coverage

Provider maintains technology errors and omissions and cyber liability insurance with limits of not less than one million U.S. dollars ($1,000,000) per claim, covering the Services it delivers under this Agreement, whether performed directly by Provider or through subcontractors. Provider will provide a certificate of insurance upon Client's written request.

Data Security and Compliance

Provider shall ensure that all subcontractors with access to Client data implement and maintain security measures, including encryption, access controls, and monitoring, that meet or exceed the standards described in the "Data Security" section of this Agreement. Provider will facilitate reasonable inquiries from Client regarding a subcontractor's security practices.

Disclosure

Provider will identify in the Statement of Work which Services, if any, are performed by subcontractors. As of the Last Updated date of this version, Provider engages Alectrona, LLC to perform help desk and IT operations Services. Subcontractors that Process Personal Data are listed as Sub-processors in the DPA.

2.5 Service Delivery

Remote Services: All services will be performed remotely, unless otherwise agreed upon in writing with the Client.

On-Site Services: Provider will provide on-site services, such as tabletop security exercises, executive or board meetings on an as needed basis, upon mutual agreement and at the expense of the Client.

After-Hours Requests: Standard support is provided during Business Hours as defined in the SLA. Outside Business Hours, Client may declare an incident through the after-hours channel designated in the SLA, and Provider will use commercially reasonable efforts to respond; Provider does not guarantee a response time outside Business Hours. Provider does not provide 24x7 monitoring or incident response services (see Section 2.7).

2.6 Service Levels

Service levels, Business Hours, support channels, and after-hours procedures are set forth in the SLA and the applicable SOW.

2.7 Excluded Services

Unless explicitly included in a Statement of Work, this Agreement does not cover:

• Support for personally owned equipment
• Home or cellular network issues
• Unsupported equipment and software
• Third-party owned equipment or software not explicitly covered
• Custom application development
• Training beyond basic system use and cyber security or compliance related content
• 24x7 monitoring, security operations center (SOC) services, and alert review outside Business Hours
• Incident response, digital forensics, breach investigation, ransomware negotiation, and recovery services (the breach-response panel under Client's cyber liability insurance, or an incident response firm separately retained by Client, is Client's resource for these services; see Section 6.13)
• Backup and data-recovery services
• Legal advice or legal opinions, and any guarantee of a compliance outcome, certification, or audit result (Section 2.8.5)

Provider reserves the right to deny support or charge additional fees for services outside the scope of this Agreement or the applicable SOW.

For clarity, practical compliance advisory, risk assessment, policy and procedure development, readiness, and virtual CISO services are Services when included in a SOW. Provider's own assessment reports and recommendations reflect Provider's professional judgment and are not audit opinions, attestations, or certifications, which are issued only by the independent third parties described in Section 2.8.10.

2.8 Third-Party Software and Services

Summary: Rovally manages various third-party tools on your behalf. We configure and administer these tools, but the vendors themselves are responsible for their platforms. We may substitute equivalent tools to meet SOW requirements.

2.8.1 Service Categories

Provider offers two categories of technology services:

The disclaimers and allocations of responsibility in this Section 2.8 and in Schedule B describe matters for which the applicable vendor, and not Provider, is responsible. They do not limit Provider's responsibility for its own performance of the Services under this Agreement and the DPA, which is governed by Sections 9, 10, and 10A, and every exclusion in this Section 2.8 and Schedule B is to be read as subject to that responsibility.

(a) Managed Third-Party Services: Software and services that Provider resells, implements, configures, and manages on Client's behalf, as specified in Schedule B (Third-Party Service Catalog) and the applicable SOW. These include security, compliance, and operational platforms where Provider maintains licensing or partner relationships with vendors and provides ongoing management services. Where the vendor permits, tenants and subscriptions are provisioned in Client's name, with Provider acting as managed service provider or delegated administrator.

(b) Client-Managed Applications: Software and services that Client procures, licenses, and manages independently. Provider bears NO responsibility or liability for Client-Managed Applications beyond advisory services if explicitly included in the Statement of Work.

2.8.2 Provider's Role with Managed Third-Party Services

For Managed Third-Party Services identified in the SOW, Provider's responsibilities are limited to:

• Vendor relationship management and license procurement at negotiated rates
• Initial implementation, configuration, and integration
• Ongoing administration, monitoring, and optimization
• Deployment coverage reporting as described in Section 2.8.11, where the SOW includes agent or policy deployment
• Technical support escalation and coordination with vendors
• Strategic recommendations for effective utilization

Provider does NOT:

• Develop, host, maintain, or control the underlying third-party platforms
• Guarantee third-party service uptime, availability, or performance
• Warrant third-party security practices, compliance certifications, or data handling
• Control third-party pricing, terms changes, or product roadmaps
• Provide legal advice or legal opinions regarding third-party services

2.8.3 Vendor Selection and Substitution Rights

Summary: The platforms used to deliver your Services are named in your SOW. We will not replace a core platform (GRC, EDR, MDM, identity, or enterprise browser) without your written consent, unless a vendor forces the change—in which case we give you 60 days' notice where practicable and help you migrate.

The specific third-party platforms used to deliver the Services are identified in the applicable SOW ("Designated Platforms"). Schedule B is a representative catalog of the vendors Provider supports and the role Provider plays with each. With respect to Designated Platforms:

• Provider will not replace a Designated Platform in the categories of compliance automation (GRC), endpoint detection and response, mobile device management, identity, or enterprise browser ("Core Platforms") without Client's prior written consent, which may be given by email.
• Where a replacement of a Core Platform is required because the vendor discontinues the platform or Provider's ability to resell or administer it, materially degrades it, or presents a security concern that Provider reasonably determines cannot be mitigated (a "Forced Substitution"), Provider will give Client at least sixty (60) days' written notice where practicable, propose a reasonably equivalent replacement, and assist with migration at no additional charge for up to thirty (30) days. Client's consent to a Forced Substitution will not be unreasonably withheld; if Client declines, Client may terminate the affected Service under Section 2.8.8.
• Provider may add, remove, or substitute tools that are not Core Platforms, and may use multiple vendors within a single service category, provided the functional and security requirements of the SOW continue to be met, on thirty (30) days' written notice where the change affects Client's day-to-day operations.
• Any vendor that will Process Personal Data is also subject to the Sub-processor notice and objection rights in the DPA.

Any vendor used to deliver Services—whether listed in Schedule B or not—is subject to the terms, limitations, and disclaimers set forth in this Section 2.8 and in Schedule B's General Provisions.

2.8.4 Client Acceptance of Third-Party Terms

Client acknowledges that use of Managed Third-Party Services creates a direct legal relationship between Client and each vendor. By purchasing Managed Third-Party Services through Provider, Client agrees to:

(a) Be bound by each vendor's Terms of Service, Acceptable Use Policy, Privacy Policy, and Data Processing Agreement as currently published and as may be updated from time to time;

(b) Comply with all vendor usage restrictions, requirements, and obligations;

(c) Accept that vendors may modify their terms, pricing, or discontinue services with or without notice;

(d) Accept the specific vendor terms and policies accessible at the URLs provided in Schedule B or as otherwise communicated by Provider.

Provider will provide Client with links to or copies of the applicable vendor terms for each Managed Third-Party Service before the SOW is executed or the service is activated, and Client acknowledges that it has had the opportunity to review them. Provider will provide reasonable notice of material vendor terms changes when informed by vendors, but Client remains responsible for monitoring vendor communications and terms updates.

2.8.5 Service-Specific Acknowledgments

Security and Monitoring Services (as cataloged in Schedule B):

Client acknowledges that cybersecurity tools reduce but do not eliminate security risks. Provider configures and monitors these tools but is NOT liable for:

• Malware, ransomware, or threats that evade detection by the third-party service
• Security breaches resulting from vulnerabilities in the third-party software itself
• Zero-day exploits or attacks occurring before threat signatures are available
• Security incidents resulting from Client's failure to implement Provider's written recommendations directly related to the incident
• Vendor service outages preventing real-time threat detection or response

Compliance and GRC Platforms (as cataloged in Schedule B):

Client acknowledges that compliance automation platforms are tools that facilitate compliance efforts but do NOT guarantee compliance or audit passage. Provider configures these platforms and provides technical guidance but does NOT:

• Provide legal advice or legal opinions
• Guarantee that use of these platforms will result in achieving or maintaining any certification (SOC 2, ISO 27001, HIPAA, etc.)
• Warrant that automated evidence collection captures all necessary compliance artifacts
• Bear responsibility for audit failures, compliance gaps, or regulatory penalties, except to the extent caused by Provider's failure to perform the Services

Client remains solely responsible for:

• Determining which compliance frameworks apply to Client's business
• Implementing policies, procedures, and controls necessary for compliance
• Engaging qualified legal counsel and compliance professionals
• Reviewing and validating all compliance evidence and documentation
• Maintaining compliance with all applicable regulations

Mobile Device Management (as cataloged in Schedule B):

Client acknowledges that MDM platforms provide device management and security enforcement capabilities. Provider configures and manages these platforms but is NOT liable for:

• Device compliance failures due to user actions or device modifications
• Data loss on managed devices resulting from user error or device failure
• Vendor platform outages affecting device management capabilities
• Limitations in vendor-supported device types or operating system versions

2.8.6 Liability Allocation for Third-Party Services

For issues arising directly from Managed Third-Party Services (vendor outages, software defects, data loss within vendor systems, security breaches of vendor infrastructure, vendor terms changes, vendor service discontinuation, vendor pricing increases), Client's SOLE REMEDY is against the vendor under their terms and conditions.

Provider has no liability for:

• Any failure, defect, bug, or limitation in third-party software or services
• Vendor security incidents, data breaches, or unauthorized access occurring within vendor-controlled systems
• Vendor service interruptions, degraded performance, or outages
• Data loss occurring within vendor systems or due to vendor actions
• Vendor's failure to meet their published service level agreements
• Changes to vendor pricing, terms, features, or service discontinuation
• Compatibility issues between different third-party services
• Vendor's failure to maintain compliance certifications or security standards
• Regulatory fines or penalties resulting from vendor compliance failures

Provider's liability is LIMITED TO Provider's own configuration, implementation, and management services (including Provider's deployment obligations under Section 2.8.11), and is subject to the aggregate cap and exclusions in Section 10 of this Agreement.

2.8.7 Client-Managed Applications

For any software, services, or systems that Client procures, licenses, or manages independently (Client-Managed Applications), Provider:

• Bears no responsibility or liability for performance, security, availability, or compliance, except to the extent caused by Provider's breach of this Agreement
• May provide advisory services only if explicitly included in the Statement of Work
• Is not responsible for integration failures between Client-Managed Applications and Managed Third-Party Services
• May decline to provide services that depend on Client-Managed Applications if Provider determines they are inadequately secured or maintained

Client must disclose all Client-Managed Applications to Provider and notify Provider of any changes, additions, or removals within fourteen (14) days.

2.8.8 Vendor Relationship Changes

Provider reserves the right to:

• Substitute third-party services in accordance with Section 2.8.3 (Core Platforms only with Client's consent or as a Forced Substitution)
• Discontinue reselling specific vendor services with ninety (90) days written notice
• Adjust pricing to reflect vendor cost changes with thirty (30) days written notice

Upon such changes, Client may:

• Accept the substitute service or price adjustment and continue service
• Terminate the affected service without penalty upon written notice
• Establish a direct relationship with the vendor (if vendor permits)

Provider will reasonably assist with transition to substitute services or direct vendor relationships at no additional charge for up to thirty (30) days following notice.

2.8.9 Vendor Communication and Support

Provider serves as the primary point of contact for technical support related to Managed Third-Party Services. However:

• Vendors may communicate directly with Client regarding account matters, billing (if applicable), terms changes, or security incidents
• Client authorizes Provider to communicate with vendors on Client's behalf for technical support and configuration matters
• Client may communicate directly with vendors for support if needed, but should coordinate with Provider to ensure consistency
• Provider is not responsible for vendor support quality, response times, or resolution effectiveness beyond Provider's escalation efforts

2.8.10 Independent Audit, Attestation, and Certification Engagements

Provider may coordinate and facilitate independent audit, attestation, certification, examination, and assessment engagements performed by third-party CPA firms, certification bodies, or assessors ("Third-Party Engagements"). Unless Client requests otherwise in writing, Client contracts directly with, and pays directly, the third-party firm for each Third-Party Engagement, and Provider's role is limited to coordination, scheduling, evidence preparation, and liaison. Where Client requests that Provider procure a Third-Party Engagement on its behalf, Provider will pass through the third party's fees at cost, itemized separately on Provider's invoice and without markup, and will disclose to Client in writing any referral fee, commission, or other compensation Provider receives from the third party in connection with the engagement. Provider does not itself issue audit opinions or certifications. Each third party retains sole professional responsibility for, and independence with respect to, its engagement and work product, and Provider does not perform, control, or influence any auditor's, assessor's, or certification body's opinion. Third-Party Engagements priced in a SOW executed before the Last Updated date of this version continue on the terms of that SOW until completed. The disclaimers and liability limitations of this Section 2.8 apply to Third-Party Engagements to the same extent as to Managed Third-Party Services.

2.8.11 Deployment Coverage and Client Responsibilities

Where a SOW includes the deployment and management of endpoint, device-management, identity, or browser agents or policies on Client's systems, Provider is responsible for deploying and maintaining those agents and policies on the devices and accounts that Client has enrolled or made available for enrollment, in accordance with the SOW and the vendor's documented practices. Client is responsible for: (a) disclosing all devices and accounts in its environment and presenting all in-scope devices and accounts for enrollment; (b) not disabling, removing, or bypassing agents, policies, or controls deployed by Provider, and not permitting its users to do so; and (c) remediating, or authorizing Provider to remediate, coverage gaps identified in Provider's coverage reports within the period stated in the report.

Provider will deliver to Client a coverage report at least monthly identifying the enrolled, unenrolled, and non-compliant devices and accounts known to Provider. Provider has no responsibility for devices or accounts that are not disclosed to Provider, that Client has not made available for enrollment, that are identified as unenrolled or non-compliant in a coverage report and not remediated within the period stated in the report, or on which Client or its users have disabled or removed Provider-deployed agents or controls. A SOW that does not include the deployment and management of such agents carries no endpoint or device responsibility on Provider's part.

2.9 Document Review and Advisory Services

Provider may, as part of the Services or as specified in a Statement of Work, assist Client with the review, redlining, or markup of Master Services Agreements, Data Processing Agreements, vendor contracts, and similar legal or contractual documents, as well as the preparation of responses to security questionnaires, vendor risk assessments, and due diligence requests (collectively, "Document Review Services").

Client acknowledges and agrees that all Document Review Services are provided on a best-effort, advisory basis only, based on Provider's general knowledge of Client's program, security posture, and operational environment at the time of review. Provider does NOT provide legal advice, and Document Review Services do not constitute legal counsel, regulatory guidance, or a guarantee of contractual or regulatory compliance.

Provider's review and markup of any document reflects Provider's professional judgment regarding cybersecurity and compliance considerations but may not account for all legal, business, financial, or regulatory factors relevant to Client's specific situation. Provider is not responsible for identifying or addressing legal risks, contractual liabilities, or regulatory obligations outside the scope of cybersecurity and IT operations.

Client retains sole and final responsibility for reviewing, approving, and submitting all documents, whether or not such documents have been reviewed, redlined, or otherwise modified by Provider.

3. PAYMENT TERMS

Summary: Invoices are issued monthly and due net 15. Late payments accrue 12% annual interest. Invoice disputes must be raised in writing within 15 days and undisputed amounts paid on time. Third-party license commitments we make on your behalf are payable for their committed term regardless of use; your remedy for vendor issues is with the vendor, not Rovally.

3.1 Fees and Payment

Fees, payment terms, and billing schedules are specified in each Statement of Work. Unless otherwise stated in the SOW, Provider invoices monthly and payment is due fifteen (15) days from the invoice date.

3.2 Late Payment

If any invoice is not paid when due, interest will be added to and payable on all overdue amounts at 12 percent per year, or the maximum percentage allowed under applicable laws, whichever is less. Client shall pay all costs of collection, including without limitation, reasonable attorney fees.

3.2.1 Invoice Disputes

Client may dispute an invoice in good faith by written notice to Provider within fifteen (15) days after the invoice date, identifying the disputed amount and the basis for the dispute. Client shall pay the undisputed portion when due. The Parties will work in good faith to resolve the dispute within thirty (30) days. Provider will not suspend Services or charge interest on amounts disputed in good faith under this Section while the dispute is pending. Amounts not disputed within fifteen (15) days after the invoice date are deemed accepted.

3.3 Third-Party Software and Service Fees

3.3.1 Payment Structure

For Managed Third-Party Services listed in Schedule B, Provider maintains licensing and billing relationships with vendors. Client pays Provider for these services according to the pricing specified in the applicable Statement of Work. Provider's pricing includes:

• The vendor's license or subscription cost
• Provider's management and administration services

3.3.2 Payment Independence

Client must pay Provider for Managed Third-Party Services for the committed term stated in the applicable SOW regardless of:

• Client's satisfaction with the vendor's service performance
• Vendor service outages or interruptions
• Disputes between Client and the vendor
• Whether Client actively uses the service

This reflects that Provider enters into license and subscription commitments with vendors on Client's behalf for the committed term that Provider cannot cancel. Where the SOW does not state a committed term for a Managed Third-Party Service, the committed term is the then-current term of the SOW. Client's remedy for vendor performance issues is against the vendor under Section 2.8.6, not through withholding payment to Provider.

3.3.3 Vendor Price Changes

If a vendor increases pricing for their services, Provider will provide Client with thirty (30) days written notice. Client may:

• Accept the price increase and continue service
• Terminate the affected service without penalty upon written notice
• Work with Provider to negotiate with the vendor (no guarantee of success)

3.3.4 Client-Managed Application Costs

For Client-Managed Applications, Client is solely responsible for all costs, licensing, renewals, and vendor relationships. Provider may assist with procurement advisory services if explicitly included in the Statement of Work, but Provider has no payment obligations or liability related to Client-Managed Applications.

3.3.5 Implementation and Setup Fees

Initial implementation, configuration, and integration services for new Managed Third-Party Services may be billed separately as specified in the Statement of Work. These are one-time professional services fees in addition to ongoing monthly management fees.

3.3.6 Provider Compensation; Bundled Pricing

Client acknowledges that, in reselling Managed Third-Party Services, Provider earns a margin on the vendor's license or subscription cost, and that Provider's pricing for Managed Third-Party Services is presented on a bundled, all-in basis that Provider is not required to itemize. Third-Party Engagements are addressed in Section 2.8.10 and are not subject to markup.

Where a vendor increases its pricing (Section 3.3.3), Provider will, on request, provide the vendor's notice or other documentation of the increase, and the management-fee component of Provider's pricing will not increase as a result of a vendor price increase.

In reselling Managed Third-Party Services, Provider acts as an independent contractor for its own account and not as Client's agent, broker, or fiduciary, and the limited authority granted in Section 5.2 does not extend to procurement. Client remains free at all times to procure comparable products or services directly from third parties or through other providers.

3.4 Non-Payment; Suspension

If Client fails to pay any undisputed amount within fifteen (15) days after written notice of non-payment, Provider may, in addition to its rights under Section 4.4, suspend the affected Services upon a further five (5) days' written notice until the overdue amount is paid. Provider will not suspend Services for amounts disputed in good faith under Section 3.2.1. Suspension does not relieve Client of its payment obligations for the committed term.

4. TERM AND TERMINATION

Summary: Each SOW has a committed term (12 months unless the SOW says otherwise) and auto-renews for 12-month terms unless either party gives 30 days' notice of non-renewal. Neither party can terminate a SOW for convenience during its term. Either party has 30 days to cure a breach; breaches that can't be cured allow immediate termination. Non-payment has a 15-day cure period.

4.1 Initial Term and Renewal

The initial term of each SOW is specified in the SOW and is twelve (12) months if not specified. Unless otherwise stated in the SOW, each SOW automatically renews for successive twelve (12) month terms unless either Party gives written notice of non-renewal at least thirty (30) days before the end of the then-current term. Each SOW is a committed-term engagement, and neither Party may terminate a SOW for convenience during its term. Where the law of Client's jurisdiction requires a specific notice before an automatic renewal of a business services contract takes effect, Provider will give that notice.

4.2 Remedies and Cure for Breach

If either Party (the "Breaching Party") materially breaches this Agreement, the other Party (the "Non-Breaching Party") may invoke the following procedure:

• Notice of Breach: The Non-Breaching Party shall give written notice describing the breach in reasonable detail
• 30-Day Cure Period: The Breaching Party has thirty (30) calendar days from receipt of the notice to cure the breach in full. No cure period applies to a breach that is incapable of cure (which may include a material breach of Section 7 (Confidentiality) or of the DPA), and the Non-Breaching Party may terminate immediately on written notice for such a breach.
• Election to Terminate: If the breach is not fully cured within that period, the Non-Breaching Party may terminate the affected SOW or, where the breach is not limited to a particular SOW, this Agreement, by giving a second written notice, effective on the date specified in that notice (which may be immediate)

4.3 Termination for Cause

Without prejudice to any other rights or remedies to which the Parties may be entitled, but subject to Section 4.2, either Party may terminate this Agreement without liability to the other if:

• Material breach handled in accordance with the 'Remedies and Cure for Breach' clause above
• The other Party becomes the subject of a voluntary or involuntary bankruptcy, insolvency, receivership, or assignment for the benefit of creditors that is not dismissed within forty-five (45) days
• The other Party ceases to carry on business
• The other Party takes or suffers any similar or analogous action in any jurisdiction in consequence of debt

4.4 Payment Default

Notwithstanding the foregoing, if Client fails to pay any undisputed amount when due and does not cure within fifteen (15) days after receiving written notice, Provider may terminate immediately upon further written notice.

4.5 Effect of Termination

On termination or expiration of this Agreement, of a SOW, or of an affected Service (as applicable):

• Provider shall cease provision of the Services as of the effective date of termination, subject to the transition obligations in Section 4.6
• Client shall pay all fees accrued through the effective date of termination. Non-cancellable third-party license, subscription, or engagement commitments that Provider entered into on Client's behalf under a SOW are handled as follows for the remainder of their committed term: (i) where the SOW or Service expires, is not renewed, or is terminated for Client's breach, Client remains responsible for them; (ii) where Client terminates for Provider's uncured material breach, under Section 9.2 of the SLA, or "without penalty" under Section 2.8.3, 2.8.8, or 3.3.3, Schedule B, or Section 6.3 of the DPA, Provider will, at Client's election, transfer the commitment to Client at Provider's cost where the vendor permits, and otherwise Provider absorbs the remaining commitment after seeking cancellation or credit from the vendor. Any refund or credit a vendor provides for a cancelled commitment is passed through to the party that bore the cost. Where this Agreement or the DPA permits termination "without penalty", no early-termination fee applies and Provider's fees for the terminated Service cease to accrue as of the effective date of termination
• Each Party shall return and make no further use of any equipment, property, materials and other items (and all copies of them) belonging to the other Party
• The accrued rights of the Parties as at termination, or the continuation after termination of any provision expressly stated to survive or implicitly surviving termination, shall not be affected or prejudiced

4.6 Transition Assistance

Within ten (10) business days after the effective date of termination or expiration of a SOW, Provider will: (a) deliver to Client all administrative credentials, access keys, and recovery information for Client's accounts and tenants held by Provider for that SOW; (b) remove Provider's and its subcontractors' delegated administrative access to the Client systems and tenants used for that SOW, except access required for other SOWs then in effect, and confirm the removal in writing; (c) where Provider holds a managed-service-provider or reseller relationship for a Managed Third-Party Service provisioned in Client's name, cooperate with the vendor to transfer that relationship to Client or Client's designee to the extent the vendor permits; and (d) deliver, or make available for export in a standard format, Client's Deliverables and any Client data held in Provider's systems for that SOW.

For up to sixty (60) days after termination or expiration, Provider will provide reasonable transition assistance requested by Client at Provider's then-current time-and-materials rates, provided Client is current on all undisputed fees. Where Client terminated for Provider's uncured material breach, such assistance is provided at no charge for up to thirty (30) days. This Section 4.6 survives termination.

5. NOTIFICATIONS

Summary: Rovally will notify you within 24 hours of any suspected data breach. We can work with third parties on your behalf but won't sign contracts or make financial decisions without your approval.

5.1 Data Breach Notifications

Provider will notify Client within twenty-four (24) hours after becoming aware of a confirmed or reasonably suspected security incident involving unauthorized access to or disclosure of Client's data, including incidents occurring at a subcontractor or Sub-processor. Notification of Personal Data Breaches is governed by the DPA, which applies the same twenty-four (24) hour standard.

5.2 Authority with Third-Party Services

Provider may need to contact third parties to resolve cybersecurity-related issues. Client authorizes Provider to communicate with vendors and other third parties on Client's behalf for technical support, configuration, and incident-coordination matters in connection with the Services. Provider will not sign any agreement or contract on behalf of Client, make any financial commitment on Client's behalf, or procure products or services on Client's behalf, without Client's written authorization, which may be given in a SOW.

6. CLIENT OBLIGATIONS

Summary: You need to designate contacts, provide scoped access to systems, maintain proper licenses, notify us of employee changes (14 days for onboarding, 5 days for departures), and carry at least $1M in cyber insurance—which is also your resource for incident response.

6.1 Authorized Representative

Client will designate at least one person as an Authorized Representative for the purpose of this Agreement. Client's Authorized Representative(s) will be the point of contact for providing services, technology planning, changes in access to privileged information, and provide access to secure information (including payment information). Provider will take the Authorized Representatives' directions as authorized by the Client.

6.2 Safe Work Environment

Client will provide a safe environment for Provider's staff. Provider will not permit its staff to be subjected to dangerous, threatening, or perilous situations, locations, and equipment. Client will take action to remedy any apparent hazards (such as toxic materials, unsafe machinery, or exposed electrical wiring) in the workplace, before requesting Provider's service.

6.3 Professional Behavior

Both Parties agree personnel will be courteous and respectful towards each other.

6.4 Access

Provider will be granted access to the devices, systems, networks, and offices relevant to the performance of the Services, scoped to the applicable SOW and on a least-privilege basis. Provider may use dedicated administrative or service accounts for its personnel, provided those accounts are protected by multi-factor authentication, used only by Provider personnel (including Provider's subcontractors performing their designated Services), and logged. At Client's election, Client may instead require named accounts for Provider personnel, provided Client provisions and maintains them for all assigned Provider personnel without undue delay; delay in provisioning is an SLA exclusion. Provider maintains a register of its access and credentials, stores credentials in an enterprise password manager with access logging, and will provide the register on request.

6.5 Supported Software & Devices

Provider does not support unlicensed or counterfeit software of any kind. Client agrees to only use licensed software and is responsible for maintaining current software licenses and hardware warranties unless otherwise specified in this Agreement or SOW.

6.6 Employee Records and Personnel Changes

Client will make available to Provider a working directory of all Client's active personnel, their role within the organization, and advance notice (as best possible) of employee onboardings and departures. Client agrees to submit a request at least 14 business days in advance of a new employee's start date and at least 5 business days in advance of an employee's end date, if known in advance by Client.

6.7 Vendor Notification

Client will notify Provider of all other vendors with current or recent access to devices, services, or systems within Client's technology environment. This includes, but is not limited to, former employees, current and former independent contractors, previous technology support vendors, repair technicians, and any other third party granted access by Client or the personnel of Client. Notification will include appropriate contact information for the vendors. Failure to notify Provider of these vendors (and their access to Client's environment) will be viewed as a violation of Client's duties and repeated violations of this will be considered a material breach of this Agreement.

6.8 Environment Changes

Client will notify Provider at least fourteen (14) days in advance of any planned changes to their technology environment that may affect the services provided under this Agreement.

6.9 Staff Training

Client agrees to ensure that its employees participate in any necessary training provided by Provider to facilitate effective service delivery.

6.10 Risk Assessment and Mitigation

Client agrees to participate in annual risk assessment exercises conducted by the Provider. These assessments will identify potential vulnerabilities in Client's technology infrastructure and operations. Client commits to working collaboratively with Provider to implement agreed-upon risk mitigation strategies.

6.11 Personal Information Warranty

Client warrants that any Personal Data furnished or made accessible to Provider has been collected and is provided to Provider in compliance with applicable data protection and privacy laws, and that Client has obtained any consents or authorizations required for Provider to Process it as contemplated by the DPA.

6.12 Scope of Agency

Provider Processes Personal Data furnished or accessible to Provider by Client as Client's service provider and processor under the DPA. Client acknowledges that Provider does not independently determine the purposes or means of such Processing and that Client is responsible for the lawfulness of its instructions. Capitalized terms used in this Section 6 and not defined in this Agreement have the meanings given in the DPA, and "Personal Information" in this Agreement means "Personal Data" as defined in the DPA.

6.13 Cybersecurity Insurance

Client agrees to maintain cyber liability insurance with minimum limits of one million U.S. dollars ($1,000,000) per incident. Client acknowledges that Provider does not provide incident response, forensic, or breach-recovery services (Section 2.7), and that the breach-response panel available under Client's cyber liability policy, or an incident response firm separately retained by Client, is Client's resource for those services. Provider will cooperate with Client's incident response provider as described in the SLA.

7. CONFIDENTIALITY

Summary: Each party keeps the other's information confidential. Obligations continue for 3 years after the agreement ends—and indefinitely for trade secrets and security information such as credentials, vulnerabilities, and incident details. We'll return or destroy your information when our relationship concludes.

7.1 General Confidentiality Obligations

Each Party will hold the other Party's Confidential Information in strict confidence, will use it only as necessary to perform or receive the Services, and will not disclose it to any third party except as permitted by this Section 7. Provider's obligations extend to all Provider personnel and subcontractors, and no one at Provider or its subcontractors will use Client's information in an unauthorized manner or for personal gain.

When Client's agreement with Provider expires or terminates (and is not renewed), Provider will return to Client all notes, records, documentation, and other items containing proprietary information. Those items that cannot be returned, or which the Client will not accept, will be destroyed.

Provider and its agents, including subcontractors, will not use or disclose Client information, except as necessary to or consistent with providing the contracted services and will protect against unauthorized use.

7.2 Definition of Confidential Information

"Confidential Information" of a Party means all non-public information disclosed by or on behalf of that Party that is marked or identified as confidential, or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure. Client's Confidential Information includes all Client data, security and system information, and Deliverables, whether or not marked.

7.3 Exclusions from Confidential Information

The following information shall not be considered Confidential Information:

• Information that is or becomes generally known within the relevant industry through no wrongful act or omission or breach of obligations under this Agreement
• Information which can be established and documented by contemporaneous written proof was in possession or known prior to receipt, without any obligation of confidentiality
• Information that is rightfully disclosed by a third party with no obligation of confidentiality
• Information which is independently developed without use of or reference to Confidential Information, with the burden of proving such independent development

7.4 Use and Disclosure Restrictions

Confidential Information may not be used except in the performance of obligations under this Agreement. Each Party shall maintain the confidentiality of the other Party's Confidential Information and shall not disclose it to any person or entity except (a) to its personnel, subcontractors, and professional advisors who need to know it for the purposes of this Agreement and are bound by confidentiality obligations at least as protective as this Section 7, or (b) as otherwise provided in this Agreement.

7.5 Required Disclosure

To the extent a Party is required to disclose the other Party's Confidential Information pursuant to any court or regulatory order, the disclosing Party shall promptly notify the other Party in writing (to the extent legally permitted) of the existence, terms, and circumstances surrounding such disclosure so that the other Party may seek a protective order or other appropriate remedy from the proper authority, and shall cooperate with the other Party in seeking such order or remedy. If required to disclose Confidential Information, the disclosing Party shall furnish only that portion that is legally required and shall exercise all reasonable efforts to obtain reliable, written assurances that confidential treatment shall be accorded to the Confidential Information.

7.6 Return of Confidential Information

Provider shall return to Client or destroy, within thirty (30) days, all correspondence, memoranda, papers, files, records, and other tangible or electronic materials embodying Client's Confidential Information, including all copies, extracts, or other reproductions thereof, when Provider no longer needs such Confidential Information to perform its obligations under the applicable SOW or when Client requests its return, whichever occurs first, and shall certify destruction in writing on request. Return or destruction is subject to the retention exceptions in Section 4.6 of the DPA (records required to be retained by law, legal holds, and data in backup systems that is deleted in the ordinary course), and retained materials remain subject to this Section 7 until deleted.

7.7 Subcontractor Confidentiality

Provider shall ensure that all subcontractors are bound by confidentiality obligations at least as restrictive as those set forth in this section. Provider remains fully liable for any breach of confidentiality by its subcontractors.

7.8 Post-Term Confidentiality Obligations

Notwithstanding the termination or expiration of this Agreement, each Party's obligations under this Section 7 continue for three (3) years following termination or expiration; provided that such obligations continue (a) for so long as the information remains a trade secret under applicable law, with respect to trade secrets, and (b) indefinitely with respect to Security Information. "Security Information" means credentials, access keys, encryption keys, system and network architecture and configurations, vulnerability and penetration-test findings, security incident details, and Personal Data. These obligations survive termination, except where disclosure is required by law in accordance with Section 7.5, and extend to all subcontractors engaged by Provider.

8. INTELLECTUAL PROPERTY AND DATA

Summary: Your data and materials remain yours, and you own the deliverables we create for you. Rovally does not host your data; our responsibility is for our own devices, accounts, and credentials and for configuring the platforms we manage correctly. Backups and the content of your systems are your responsibility.

8.1 Client Materials

Any materials or data provided by Client remain the property of Client. Client grants Provider a limited license to use such materials solely for the purpose of providing the Services under this Agreement. This license extends to Provider's subcontractors solely as necessary for performance of their designated Services.

8.1.1 Deliverables and Provider Materials

Upon payment of the fees due under the applicable SOW, Provider assigns to Client all right, title, and interest in the Deliverables, excluding Provider Materials. "Provider Materials" means Provider's pre-existing or independently developed templates, methodologies, tools, know-how, policy and procedure frameworks, and other materials that are not specific to Client, and any improvements to them; Provider Materials never include Client's Confidential Information or Personal Data. To the extent Provider Materials are incorporated into a Deliverable, Provider grants Client a perpetual, non-exclusive, royalty-free license to use, copy, and modify them as part of the Deliverable for Client's business purposes, including sharing the Deliverable with Client's customers, prospects, auditors, regulators, insurers, and professional advisers for its intended purpose; Client may not sell, license, or distribute Provider Materials separately from the Deliverables. Provider retains the right to use its general knowledge, skills, and experience and the Provider Materials in providing services to others, provided it does not disclose Client's Confidential Information. Provider's personnel use AI-assisted tools in preparing certain Deliverables as described in the DPA; all Deliverables are reviewed by Provider's personnel before delivery.

8.2 Data Security - Storage & Transmission

All Provider devices with access to Client systems are managed, encrypted, protected by endpoint detection and response, and secured with multi-factor authentication. Provider accesses Client systems through a managed enterprise browser and stores credentials in an enterprise password manager with access logging. All access by Provider personnel to Client's systems and proprietary information is logged and auditable. Provider's technical and organizational measures are described in Annex II of the DPA.

Provider does not host Client data on infrastructure of its own. Client data may be stored incidentally in the business systems identified as Sub-processors in the DPA (such as ticketing, documentation, and collaboration tools) while the Services are delivered.

As between the Parties, Client owns and is solely responsible for its data, its backups, and the content of its systems. Provider is not a backup or data-recovery provider and, unless a SOW expressly includes backup management, has no responsibility for the backup or recovery of Client data in any system. Provider's data-security responsibility is limited to (a) Provider's own devices, accounts, and credentials used to access Client systems; (b) configuring and managing Managed Third-Party Services in accordance with the SOW and the vendor's documented practices, including Provider's deployment obligations under Section 2.8.11; and (c) the Security Measures in Annex II of the DPA.

Client is wholly responsible for delivering data to Provider in a secure manner. Provider is not responsible for the insecure transmission and storage of data by Client or Client personnel. Provider will provide assistance to any and all Client employees who request assistance encrypting or otherwise securing their data for transmission to Provider.

Where Provider manages a device-management platform on Client's behalf, device recovery keys are escrowed in that platform in accordance with the vendor's documented practices, and Client is responsible for maintaining its own administrative access to that platform. Client is solely responsible for encryption keys for devices and systems not enrolled in a Provider-managed platform.

Client is solely responsible and liable for the content of Client's data. Provider is not responsible or liable for any data provided by Client to Provider or a third party for any purpose, and will not screen or monitor any content of Client's data stored on Provider's servers.

8.2.1 Third-Party Service Data Security

When Client's data is stored in or processed by Managed Third-Party Services, Client acknowledges that:

(a) The vendor's security controls, encryption standards, access management, and data protection practices govern data security within their systems;

(b) Provider does not control the vendor's security infrastructure, practices, or certifications;

(c) Provider will configure security settings available within each third-party service according to industry best practices and Client's requirements;

(d) Provider is NOT liable for security breaches, unauthorized access, or data loss occurring within vendor-controlled systems or resulting from vendor security failures, except to the extent caused by Provider's failure to configure or manage the service in accordance with this Agreement and the applicable SOW;

(e) Client should review each vendor's security documentation, certifications (SOC 2, ISO 27001, etc.), and data processing agreements independently;

(f) Provider will assist with vendor security incident response but cannot guarantee vendor responsiveness or outcomes.

Provider's Security Responsibilities:

Provider remains fully responsible for securing:

• Provider's own systems used to manage or access Client's environment
• Credentials and access keys for Client's third-party services in Provider's custody
• Configuration backups and documentation stored on Provider systems
• Communications and data transmission between Provider and Client

Security incidents involving Provider's systems that may affect Client data are notified under Section 5.1, and Provider will cooperate with Client in any required breach notifications to regulators or affected parties.

8.3 Subcontractor Data Security

Provider shall ensure that all subcontractors implement and maintain data security measures that meet or exceed the standards described in this section, including encryption, access controls, monitoring, and audit capabilities. Provider shall verify subcontractor compliance with these standards and remains fully responsible for any data security incidents involving subcontractors.

8.4 Data Loss

Provider will advise Client on data protection practices, recommend solutions, encourage comprehensive backup and data protection practices, and configure Managed Third-Party Services in accordance with Section 8.2.

Provider does not guarantee against data loss. Subject to Section 10, Provider is responsible for data loss to the extent caused by Provider's failure to perform the Services in accordance with this Agreement, and is not responsible for data loss resulting from hardware failure, user action, or the acts or omissions of third-party service providers (including vendors of Managed Third-Party Services), except to the extent caused by Provider's breach of this Agreement. Client acknowledges that data loss risks are inherent in the use of third-party services and that maintaining backups is Client's responsibility.

9. WARRANTIES AND DISCLAIMERS

Summary: We warrant that our services will be performed professionally, in line with industry standards and your SOW; if they aren't, we re-perform them or refund the fees for the nonconforming work. We don't guarantee third-party software, that security tools will catch every threat, or compliance outcomes.

SERVICES WARRANTY:

Provider warrants that (a) the Services will be performed in a professional and workmanlike manner, by qualified personnel, consistent with generally accepted industry standards for comparable services; (b) the Services will conform in all material respects to the applicable SOW; (c) Provider will comply with laws applicable to Provider's performance of the Services; and (d) Provider will not knowingly introduce any virus, malware, or malicious code into Client's systems.

Client's exclusive remedy, and Provider's sole obligation, for breach of the warranty in this Section is that Provider will re-perform the nonconforming Services at no additional charge. If Provider is unable to cure the nonconformity through re-performance within thirty (30) days after Client's written notice (which must be given within thirty (30) days after the nonconforming Services were performed), Provider will refund the fees paid for the nonconforming Services. This remedy does not limit Client's rights under Sections 4.2, 7, 10, and 10A or under the DPA.

HARDWARE AND SOFTWARE:

EXCEPT AS EXPRESSLY STATED IN THIS SECTION 9, PROVIDER MAKES NO WARRANTIES OF ANY KIND, EXPRESSED OR IMPLIED, REGARDING THE FUNCTIONALITY OF HARDWARE OR SOFTWARE, BUT INSTEAD RELIES ON THE WARRANTIES PROVIDED BY THE MANUFACTURER OF EACH SUCH PRODUCT.

THIRD-PARTY SOFTWARE AND SERVICES DISCLAIMERS:

PROVIDER RESELLS AND MANAGES THIRD-PARTY SOFTWARE AND SERVICES BUT DOES NOT DEVELOP, MANUFACTURE, OR CONTROL THESE PRODUCTS. PROVIDER MAKES NO WARRANTIES WHATSOEVER REGARDING THIRD-PARTY SERVICES LISTED IN SCHEDULE B OR UTILIZED PURSUANT TO SECTION 2.8.3, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, SECURITY, AVAILABILITY, UPTIME, DATA INTEGRITY, COMPLIANCE WITH REGULATIONS, OR NON-INFRINGEMENT.

CLIENT ACKNOWLEDGES THAT THIRD-PARTY SERVICES ARE PROVIDED BY THEIR RESPECTIVE VENDORS "AS IS" AND SUBJECT TO THE VENDOR'S TERMS, WARRANTIES (IF ANY), AND DISCLAIMERS. PROVIDER'S SOLE WARRANTY REGARDING THIRD-PARTY SERVICES IS THAT PROVIDER WILL USE COMMERCIALLY REASONABLE EFFORTS TO IMPLEMENT, CONFIGURE, AND MANAGE SUCH SERVICES PROFESSIONALLY.

FOR COMPLIANCE AND GRC PLATFORMS (AS CATALOGED IN SCHEDULE B), PROVIDER SPECIFICALLY DISCLAIMS ANY WARRANTY THAT USE OF THESE PLATFORMS WILL RESULT IN ACHIEVING OR MAINTAINING ANY COMPLIANCE CERTIFICATION, PASSING ANY AUDIT, OR SATISFYING ANY REGULATORY REQUIREMENT.

FOR SECURITY SERVICES (AS CATALOGED IN SCHEDULE B), PROVIDER SPECIFICALLY DISCLAIMS ANY WARRANTY THAT THESE SERVICES WILL DETECT OR PREVENT ALL SECURITY THREATS, MALWARE, UNAUTHORIZED ACCESS, OR DATA BREACHES. CLIENT ACKNOWLEDGES THAT NO SECURITY SOLUTION PROVIDES ABSOLUTE PROTECTION AND THAT CYBERSECURITY REQUIRES LAYERED DEFENSES AND ONGOING VIGILANCE.

FOR MOBILE DEVICE MANAGEMENT SERVICES (AS CATALOGED IN SCHEDULE B), PROVIDER SPECIFICALLY DISCLAIMS ANY WARRANTY THAT THESE SERVICES WILL PREVENT ALL DEVICE SECURITY INCIDENTS, DATA LOSS, OR COMPLIANCE FAILURES ON MANAGED DEVICES.

FOR HELP DESK AND SUPPORT SERVICES, RESOLUTION TARGETS IN THE SLA ARE OBJECTIVES AND NOT GUARANTEES, AND PROVIDER SPECIFICALLY DISCLAIMS ANY WARRANTY REGARDING FIRST-CALL RESOLUTION RATES OR USER SATISFACTION.

CLIENT'S EXCLUSIVE REMEDIES FOR DEFECTS, FAILURES, OR ISSUES WITH THIRD-PARTY SERVICES ARE AGAINST THE RESPECTIVE VENDORS UNDER THEIR TERMS AND CONDITIONS.

EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, PROVIDER DOES NOT MAKE, AND HEREBY DISCLAIMS, ALL OTHER EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, INTEROPERABILITY, AND TITLE, AND ANY WARRANTIES ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. PROVIDER DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR FREE, OR THAT THE SERVICES WILL PREVENT ALL SECURITY INCIDENTS, DATA LOSS, OR UNAUTHORIZED ACCESS TO OR DISCLOSURE OF DATA; CLIENT ACKNOWLEDGES THAT NO SECURITY SERVICE PROVIDES ABSOLUTE PROTECTION. ALL WARRANTIES PROVIDED HEREIN ARE PERSONAL TO, AND INTENDED SOLELY FOR THE BENEFIT OF, CLIENT, AND DO NOT EXTEND TO ANY THIRD PARTY. NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN, CLIENT ACKNOWLEDGES THAT PROVIDER SHALL BEAR NO RESPONSIBILITY FOR THE PERFORMANCE, REPAIR, OR WARRANTY OF ANY OF CLIENT'S SOFTWARE, HARDWARE PRODUCTS, OR SERVICES PROVIDED TO CLIENT BY A THIRD PARTY, UNLESS OTHERWISE SET FORTH HEREIN. THESE WARRANTY DISCLAIMERS APPLY TO SERVICES PROVIDED DIRECTLY BY PROVIDER AND SERVICES PROVIDED BY PROVIDER'S SUBCONTRACTORS.

10. LIMITATION OF LIABILITY

Summary: Each party's liability is capped at the greater of the fees paid under the affected SOW in the prior 12 months or $25,000, and neither party is liable for indirect damages. The cap doesn't apply to fraud, willful misconduct, gross negligence, or your payment obligations. Rovally has no liability for third-party vendor failures; your remedy for those is with the vendor.

EXCEPT FOR THE EXCLUDED CLAIMS, NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOSS OF DATA, BUSINESS INTERRUPTION, OR LOSS OF PROFITS, ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE SERVICES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

EXCEPT FOR THE EXCLUDED CLAIMS, TO THE FULLEST EXTENT PERMITTED BY LAW, THE TOTAL AGGREGATE LIABILITY OF EACH PARTY TO THE OTHER FOR ALL CLAIMS, LOSSES, COSTS, AND DAMAGES OF ANY NATURE ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE SERVICES, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, SHALL NOT EXCEED THE GREATER OF (A) THE FEES PAID OR PAYABLE BY CLIENT TO PROVIDER UNDER THE SOW GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) TWENTY-FIVE THOUSAND U.S. DOLLARS ($25,000). THIS LIMITATION APPLIES TO ALL SERVICES PROVIDED UNDER THIS AGREEMENT, WHETHER PERFORMED DIRECTLY BY PROVIDER OR THROUGH SUBCONTRACTORS, AND PROVIDER SHALL REMAIN SOLELY LIABLE TO CLIENT FOR ANY CLAIMS ARISING FROM SUBCONTRACTOR PERFORMANCE.

"EXCLUDED CLAIMS" MEANS (I) A PARTY'S FRAUD, GROSS NEGLIGENCE, OR WILLFUL MISCONDUCT; (II) CLIENT'S OBLIGATION TO PAY FEES FOR THE SERVICES AND MANAGED THIRD-PARTY SERVICES, INCLUDING NON-CANCELLABLE THIRD-PARTY COMMITMENTS UNDER SECTION 4.5 AND COSTS OF COLLECTION UNDER SECTION 3.2 (BUT NOT INDEMNIFICATION OBLIGATIONS, WHICH REMAIN SUBJECT TO THE CAP); AND (III) ANY LIABILITY THAT CANNOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. THE LIMITATIONS IN THIS SECTION 10 DO NOT APPLY TO EXCLUDED CLAIMS. ARBITRATION FEES AWARDED UNDER SECTION 12.1 ARE NOT SUBJECT TO, AND DO NOT COUNT TOWARD, THE CAP. THE CAP APPLIES SEPARATELY TO EACH SOW: A PARTY'S AGGREGATE LIABILITY FOR ALL CLAIMS ARISING UNDER OR RELATING TO A SOW SHALL NOT EXCEED THE AMOUNT CALCULATED FOR THAT SOW, AND CLAIMS NOT ATTRIBUTABLE TO A PARTICULAR SOW ARE SUBJECT TO A SINGLE CAP CALCULATED ON THE FEES UNDER ALL SOWS.

ADDITIONAL LIMITATIONS FOR THIRD-PARTY SERVICES:

NOTWITHSTANDING ANY OTHER PROVISION IN THIS AGREEMENT, BUT EXCEPT TO THE EXTENT CAUSED BY PROVIDER'S FAILURE TO PERFORM THE SERVICES IN ACCORDANCE WITH THIS AGREEMENT AND THE APPLICABLE SOW, PROVIDER SHALL HAVE NO LIABILITY FOR ANY CLAIMS, DAMAGES, LOSSES, OR EXPENSES ARISING FROM OR RELATED TO:

(A) THIRD-PARTY SERVICE FAILURES: Any failure, defect, error, bug, outage, degraded performance, or limitation of any Managed Third-Party Service listed in Schedule B or utilized pursuant to Section 2.8.3, regardless of cause;

(B) VENDOR SECURITY INCIDENTS: Any security breach, unauthorized access, data loss, ransomware, malware, or other security incident occurring within vendor-controlled systems or resulting from vulnerabilities in third-party software;

(C) VENDOR BUSINESS DECISIONS: Any change to third-party service pricing, terms, features, functionality, discontinuation of service, or vendor's cessation of business operations;

(D) COMPLIANCE OUTCOMES: Any failure to achieve or maintain compliance certifications, audit failures, regulatory penalties, or fines, except to the extent caused by Provider's failure to perform the Services in accordance with the applicable SOW;

(E) UNDETECTED THREATS: Any security threats, malware, or attacks that evade detection by security tools, except to the extent the failure to detect results from Provider's failure to deploy, configure, or manage those tools in accordance with the applicable SOW and Section 2.8.11;

(F) VENDOR TERMS DISPUTES: Any disputes between Client and vendors regarding interpretation or enforcement of vendor terms of service;

(G) CLIENT-MANAGED APPLICATIONS: Any issues, failures, security incidents, or losses involving Client-Managed Applications that Client procures or manages independently.

FOR THE AVOIDANCE OF DOUBT, PROVIDER'S TOTAL AGGREGATE LIABILITY UNDER THIS AGREEMENT, INCLUDING FOR CLAIMS RELATED TO PROVIDER'S IMPLEMENTATION, CONFIGURATION, OR MANAGEMENT OF THIRD-PARTY SERVICES, REMAINS SUBJECT TO THE CAP SET FORTH ABOVE. CLIENT'S SOLE REMEDY FOR ISSUES WITH THIRD-PARTY SERVICES THEMSELVES IS AGAINST THE APPLICABLE VENDOR.

THE LIMITATIONS OF LIABILITY IN THIS SECTION APPLY REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, AND WILL APPLY EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE PARTIES AGREE THAT THESE LIMITATIONS REFLECT A REASONABLE ALLOCATION OF RISK AND ARE AN ESSENTIAL BASIS OF THE BARGAIN.

10A. INDEMNIFICATION

Summary: Rovally will defend you against third-party claims that our deliverables infringe someone's intellectual property, or that arise from our gross negligence, willful misconduct, or breach of confidentiality or the DPA. You'll defend us against claims arising from your data, your use of vendor services in breach of their terms, or your violation of law. The indemnifying party controls the defense.

10A.1 Indemnification by Provider

Provider will defend Client against any claim brought by a third party, and pay the damages and costs finally awarded against Client or agreed by Provider in settlement, to the extent the claim arises from: (a) an allegation that a Deliverable authored by Provider, as delivered, infringes a third party's United States copyright or trademark or misappropriates a third party's trade secret, excluding Client Materials, Managed Third-Party Services and other third-party or open-source components, and any modification or combination not made by Provider; (b) Provider's gross negligence or willful misconduct; or (c) Provider's breach of Section 7 (Confidentiality) or of the DPA.

10A.2 Indemnification by Client

Client will defend Provider against any claim brought by a third party, and pay the damages and costs finally awarded against Provider or agreed by Client in settlement, to the extent the claim arises from: (a) Client Materials or Client data, including any allegation that Provider's Processing of them in accordance with this Agreement violates applicable law or a third party's rights; (b) Client's use of Managed Third-Party Services in breach of the applicable vendor terms; or (c) Client's violation of applicable law.

10A.3 Procedure

The indemnified Party shall give the indemnifying Party prompt written notice of the claim (provided that delay relieves the indemnifying Party of its obligations only to the extent it is prejudiced by the delay), tender sole control of the defense and settlement of the claim to the indemnifying Party, and provide reasonable cooperation at the indemnifying Party's expense. The indemnifying Party shall not settle a claim in a manner that admits fault on behalf of, or imposes obligations on, the indemnified Party without the indemnified Party's written consent, not to be unreasonably withheld. The indemnified Party may participate in the defense with its own counsel at its own expense.

10A.4 Infringement Remedies

If a Deliverable is, or in Provider's opinion is likely to become, the subject of an infringement claim, Provider may at its option and expense modify or replace it so that it is non-infringing without material loss of functionality, obtain the right for Client to continue using it, or, if neither is commercially reasonable, accept return of the Deliverable and refund the fees paid for it. Provider has no obligation under Section 10A.1(a) for claims arising from Client's modification of a Deliverable, continued use after Provider has provided a non-infringing alternative, or combination of a Deliverable with materials not provided by Provider.

10A.5 Relationship to Section 10

The obligations in this Section 10A are subject to the limitations in Section 10, except to the extent a claim constitutes an Excluded Claim.

11. FORCE MAJEURE

Summary: Neither party is liable for delays caused by events outside reasonable control (natural disasters, pandemics, wars, acts of God, etc.). If such an event persists, either party may terminate.

If performance of this Agreement or any obligation under this Agreement is prevented, restricted, or interfered with by causes beyond either Party's reasonable control ("Force Majeure"), and if the Party unable to carry out its obligations gives the other Party prompt written notice of such event, then the obligations of the Party invoking this provision shall be suspended to the extent necessary by such event. The term Force Majeure shall include, without limitation, acts of God, epidemic, pandemic, fire, explosion, vandalism, storm or other similar occurrence, orders or acts of military or civil authority, or by national emergencies, insurrections, riots, or wars, or strikes, lock-outs, work stoppages, or supplier failures. The excused Party shall use reasonable efforts under the circumstances to avoid or remove such causes of non-performance and shall proceed to perform with reasonable dispatch whenever such causes are removed or ceased. An act or omission shall be deemed within the reasonable control of a Party if committed, omitted, or caused by such Party, or its employees, officers, agents, or affiliates. If a Force Majeure event continues for thirty (30) consecutive days, either Party may terminate the affected Services upon written notice to the other Party.

12. DISPUTE RESOLUTION

Summary: Disputes over $1,000 go to arbitration in Orange County, CA under California law. This is instead of going to court—it's typically faster and less expensive for both parties.

12.1 Arbitration

All disputes exceeding USD $1,000 that are not exclusively within the jurisdiction of California small-claims court shall be settled by arbitration by the American Arbitration Association.

Arbitration shall be in accordance with the Commercial Arbitration Rules of the American Arbitration Association, using a single arbitrator format regardless of the amount in dispute, and judgment on the award rendered by the arbitrator may be entered in any court having jurisdiction thereof. The prevailing Party in any such dispute shall be entitled to an award inclusive of reimbursement of any fees paid to the arbitrator, and any case filing fees or case management fees paid to the arbitration association. This arbitration procedure is in lieu of any right that might otherwise exist to a trial by jury. Notwithstanding the foregoing, either Party may seek temporary, preliminary, or permanent injunctive or other equitable relief in any court of competent jurisdiction to protect its Confidential Information or intellectual property, without first submitting the matter to arbitration.

12.2 Governing Law

The terms of this Agreement shall be governed by and construed in accordance with the laws of the State of California without resort to conflict of law rules. The United States Arbitration Act shall govern the interpretation, enforcement, and proceedings pursuant to the arbitration clause in this agreement. The place of arbitration shall be Orange County, California.

13. ADDITIONAL PROVISIONS

Summary: Standard legal provisions including: don't poach each other's employees, this agreement survives mergers, this document is the complete agreement, each SOW is governed by the version it identifies, updates apply at renewal, and neither party uses the other's name without consent.

13.1 Mutual Non-Solicitation of Personnel

During the term of this Agreement and for twelve (12) months thereafter, neither Party will directly solicit for employment or engagement any employee of the other Party who was directly involved in providing or receiving the Services, without the other Party's written consent. General advertisements and responses to them are not solicitation.

13.2 Merger, Transfer of Assets, or Dissolution

This Agreement will not be terminated by any voluntary or involuntary dissolution of either Client or Provider resulting from either a merger or consolidation in which the affected Party is not the consolidated or surviving entity named under this Agreement, or a transfer of all or substantially all of the assets of the affected Party.

In the event of any such merger or consolidation or transfer of assets of either Party, the rights, benefits, and obligations hereunder may be assigned to the surviving or resulting entity or the transferee of the Party's assets.

13.3 Entire Agreement

This Agreement, together with the DPA, the SLA, Schedule B, and all SOWs, contains the entire agreement of the Parties, and there are no other promises or conditions in any other agreement whether oral or written concerning the subject matter of this Agreement. This Agreement supersedes any prior written or oral agreements between the Parties. The version of this Agreement, the DPA, and the SLA that governs a SOW is the version identified in that SOW by version number or date; if the SOW does not identify a version, the version published at the Published URLs on the SOW's effective date governs.

13.4 Construction

This Agreement shall be interpreted as if Client and Provider jointly prepared it, and any uncertainty and ambiguity in the Agreement shall not be construed or interpreted against either Party individually.

13.5 Severability

If any provision of this Agreement will be held to be invalid or unenforceable for any reason, the remaining provisions will continue to be valid and enforceable. If a court finds that any provision of this Agreement is invalid or unenforceable, but that by limiting such provision it would become valid and enforceable, then such provision will be deemed to be written, construed, and enforced as so limited.

13.6 Amendment

This Agreement may be modified or amended in a writing signed by both Parties. Provider may publish updated versions of this Agreement, the DPA, the SLA, and Schedule B at the Published URLs from time to time and will give Client at least thirty (30) days' written notice of an updated version. An updated version applies to a SOW only upon the renewal of that SOW, or upon execution of a new or amended SOW, after the notice; except that (a) updates to Schedule B that add vendors or services, and (b) updates that do not reduce Client's rights or increase Client's obligations, apply to existing SOWs thirty (30) days after notice. Sub-processor changes are governed by the DPA. Each published version states its version number and effective date, and prior versions are available from Provider upon request.

13.7 Notice

Any notice or communication required or permitted under this Agreement shall be sufficiently given if delivered in person, by certified mail (return receipt requested), or by email to the notice address set forth in the applicable Statement of Work (or, for Provider, contact@rovally.com), or to such other address as one Party may have furnished to the other in writing. Notice by email is effective when sent, provided the sender does not receive an automated notice of non-delivery; notice by certified mail is effective three (3) business days after mailing; and notice delivered in person is effective on delivery.

13.8 Waivers

The failure of either Party to enforce any provision of this Agreement shall not be construed as a waiver or limitation of that Party's right to subsequently enforce and compel strict compliance with every provision of this Agreement.

13.9 Publicity

Neither Party will use the other Party's name, logo, or trademarks in any publicity, marketing materials, or customer list without the other Party's prior written consent, which may be given by email and withdrawn on written notice.

This Master Services Agreement is effective as of the date specified in the applicable Statement of Work.

SCHEDULE B — THIRD-PARTY SERVICE CATALOG

Summary: This schedule lists the vendors Rovally supports and what we do and don't take responsibility for with each. The platforms used for your Services are named in your SOW, and we don't swap core platforms without your consent.

This schedule identifies representative Managed Third-Party Services that Provider may resell and manage on Client's behalf and describes Provider's role with each. The Designated Platforms for Client are identified in the applicable SOW, and substitution is governed by Section 2.8.3 of this Agreement.

1. IDENTITY AND CLOUD DETECTION AND RESPONSE

Representative Vendor: ClearVector, Inc.

Category: Identity-driven detection and response for cloud and SaaS environments

Vendor Terms: Provided upon request

Provider's Role:

• Workspace setup and integration with Client's cloud and identity providers
• Configuration of detection policies and alerting
• Triage of security alerts during Business Hours (as defined in the SLA), with containment actions available within the platform
• Escalation of confirmed incidents to Client and, where applicable, Client's incident response provider
• First-line support, with escalation to the vendor for platform issues
• Regular review and tuning of detection coverage

Provider is NOT Responsible For:

• Platform availability, uptime, or performance
• Threats that evade the platform's detection capabilities
• Security incidents in environments not integrated with the platform
• Data retention policies or data loss within vendor systems
• Changes to vendor pricing, features, or terms of service
• Vendor security breaches or unauthorized access to vendor systems

2. ENDPOINT DETECTION AND RESPONSE (EDR)

Representative Vendors: CrowdStrike, Inc. (Falcon); SentinelOne, Inc.; Jamf Software, LLC (Jamf Protect)

Category: Endpoint Detection and Response for workstations and servers

Vendor Terms:

• CrowdStrike: Provided upon request
• SentinelOne: <https://www.sentinelone.com/legal/master-subscription-agreement/>
• Jamf Protect: <https://www.jamf.com/trust-center/terms-of-service/>

Provider's Role:

• Deployment of EDR agents to Client endpoints
• Configuration of protection policies and response actions
• Review of endpoint security alerts and threats during Business Hours (as defined in the SLA)
• Triage of detected threats and containment actions available within the platform (such as host isolation), with escalation to Client and Client's incident response provider
• Quarterly review of protection efficacy and policy optimization
• Coordination with vendor support for complex incidents
• Where included in the SOW, procurement of the vendor's managed detection and response service (such as CrowdStrike Falcon Complete or SentinelOne Vigilance), which provides 24x7 monitoring and response under the vendor's service terms

Provider is NOT Responsible For:

• Platform availability, uptime, or agent functionality
• Malware or threats that evade detection engines
• Zero-day exploits before threat signatures are available
• Security of unmanaged or unprotected endpoints
• Endpoints where Client has disabled or removed EDR agents
• Vendor security breaches or vulnerabilities in vendor software
• Changes to vendor pricing, features, or licensing models
• Monitoring or response outside Business Hours, unless a vendor managed detection and response service is included in the SOW

Critical Client Acknowledgment: No endpoint security solution provides 100% protection. Client acknowledges that sophisticated threats may evade detection and that endpoint security is one layer of a comprehensive security strategy.

3. THREAT DETECTION AND INTELLIGENCE

Representative Vendor: Jamf Software, LLC (Jamf Radar)

Category: Threat Detection, Phishing Prevention, and Security Intelligence for Apple Devices

Vendor Terms: <https://www.jamf.com/trust-center/terms-of-service/>

Provider's Role:

• Implementation and configuration of threat detection policies
• Setup of phishing and malicious content protection
• Review of threat intelligence alerts and indicators during Business Hours (as defined in the SLA)
• Triage of detected threats and suspicious activity, with escalation to Client
• Regular review and tuning of detection sensitivity

Provider is NOT Responsible For:

• Platform availability, uptime, or detection engine performance
• Phishing attacks or threats that evade detection
• User actions that bypass security warnings
• Accuracy or completeness of threat intelligence feeds
• Vendor security breaches or service interruptions

4. GOVERNANCE, RISK, AND COMPLIANCE (GRC) PLATFORMS

Representative Vendors: Secureframe, Inc.; Drata, Inc.; Vanta, Inc.

Category: Compliance Automation Platform

Supported Frameworks: SOC 2, ISO 27001, ISO 42001, HIPAA, PCI-DSS, GDPR, CMMC, and others

Vendor Terms:

• Secureframe: <https://secureframe.com/terms>
• Drata: <https://drata.com/legal>
• Vanta: <https://www.vanta.com/legal/terms>

Provider's Role (Applies to all GRC platforms):

• Platform selection based on Client's compliance requirements
• Initial implementation and integration with Client's technology stack
• Configuration of compliance frameworks and control mappings
• Connection of evidence sources (cloud providers, HR systems, etc.)
• Training Client personnel on platform usage
• Ongoing monitoring of compliance posture and control gaps
• Preparation of evidence packages for audits
• Coordination with Client's auditors (information requests only)

Provider is NOT Responsible For:

• Determining which compliance frameworks apply to Client's business
• Guaranteeing achievement or maintenance of any compliance certification
• Guaranteeing audit passage or favorable audit outcomes
• Legal interpretation of regulatory requirements
• Approving policies and procedures (Provider may create, Client must review/approve)
• Ensuring completeness or accuracy of automated evidence collection
• Platform availability, uptime, or data integrity
• Vendor security breaches or compliance failures
• Changes to vendor pricing, features, or supported frameworks

CRITICAL COMPLIANCE DISCLAIMER: Provider configures GRC platforms and provides implementation and compliance advisory services as described in the SOW. Provider DOES NOT provide legal advice or legal opinions and does not guarantee any compliance outcome. Client must engage qualified legal counsel where legal advice is required, determine applicable compliance requirements with Provider's input, review and approve all policies, procedures, and controls, validate all compliance evidence before submitting to auditors, and maintain ultimate responsibility for achieving and maintaining compliance.

Client acknowledges that GRC platforms are tools that facilitate compliance efforts but do not guarantee compliance outcomes. Many factors outside the platform's scope affect compliance, including organizational culture, employee training, policy enforcement, and management commitment.

5. MOBILE DEVICE MANAGEMENT (MDM)

Representative Vendors: Addigy, Inc.; Jamf Software, LLC (Jamf Pro)

Category: Mobile Device Management, Endpoint Management, and IT Operations

Vendor Terms:

• Addigy: Provided upon request
• Jamf Pro: <https://www.jamf.com/trust-center/terms-of-service/>

Provider's Role:

• Initial MDM platform setup and configuration
• Device enrollment and provisioning workflows
• Configuration of security policies, restrictions, and compliance rules
• Application deployment and management
• Operating system update management and patching
• Device inventory and compliance monitoring
• Remote device management actions (lock, wipe, locate)
• Integration with identity providers and security tools

Provider is NOT Responsible For:

• Platform availability, uptime, or performance
• Device compliance failures due to user actions or device modifications
• Data loss on managed devices resulting from user error or device failure
• Hardware failures or physical damage to managed devices
• Limitations in vendor-supported device types or operating system versions
• User satisfaction with enforced security policies
• Vendor security breaches or service interruptions
• Changes to vendor pricing, features, or supported platforms

6. HELP DESK AND IT SUPPORT SERVICES

Delivery: Performed by Provider directly or through Provider's subcontractor, Alectrona, LLC (see Section 2.4). Provider remains fully responsible for these Services.

Category: Help Desk Support, IT Support Services, and End-User Technical Assistance

Provider's Role:

• Help desk and end-user technical assistance through Client's communication channels (Slack, email, etc.)
• Ticketing workflows and escalation procedures
• User onboarding, offboarding, and access administration in accordance with the SLA
• Service level monitoring and quality assurance
• Escalation path management for complex issues
• Regular service review and optimization recommendations

Provider is NOT Responsible For:

• Availability of third-party ticketing, communication, or collaboration platforms
• Resolution targets, which are objectives and not guarantees as described in the SLA
• End-user satisfaction with support interactions
• Issues requiring hardware replacement or on-site intervention
• Problems with Client-Managed Applications outside Provider's scope
• User training beyond basic issue resolution

7. CLIENT-MANAGED APPLICATIONS

Definition: Any software, service, system, or technology that Client procures, licenses, pays for, and manages independently without Provider involvement in vendor relationship or ongoing management.

Examples May Include:

• Productivity suites (Microsoft 365, Google Workspace)
• Industry-specific applications
• Custom developed software
• Legacy systems
• Applications procured before engaging Provider
• Any service where Client maintains direct vendor relationship and billing

Provider's Role:

• May provide advisory services if explicitly included in SOW
• May provide integration support to connect with Managed Third-Party Services
• NO ongoing management, monitoring, or administration unless explicitly contracted

Provider is NOT Responsible For:

• Availability, performance, or functionality
• Security of Client-Managed Applications
• Data loss or breaches involving Client-Managed Applications
• Licensing compliance or renewal management
• Vendor relationship or support coordination
• Configuration or optimization
• Integration failures between Client-Managed Applications and Managed Services
• Any issues, incidents, or failures of any kind

Client Obligations:

Client must:

• Disclose all Client-Managed Applications to Provider within 14 days
• Notify Provider of additions, changes, or removals within 14 days
• Maintain adequate security controls on Client-Managed Applications
• Not expect Provider to support or troubleshoot Client-Managed Applications
• Accept that Provider may decline to integrate with inadequately secured Client-Managed Applications

8. ENTERPRISE BROWSER

Representative Vendor: Island Technology, Inc.

Category: Enterprise browser for secure access to SaaS applications and Client systems, including by Provider personnel

Vendor Terms: Provided upon request

Provider's Role:

• Tenant setup, policy configuration, and user enrollment
• Configuration of data protection, access, and isolation policies
• Ongoing administration and policy tuning
• Coordination with vendor support for platform issues

Provider is NOT Responsible For:

• Platform availability, uptime, or performance
• User actions that bypass or disable browser policies
• Security incidents in applications accessed outside the enterprise browser
• Vendor security breaches or service interruptions
• Changes to vendor pricing, features, or terms of service

GENERAL PROVISIONS APPLICABLE TO ALL SERVICES

Relationship to Provider's Own Performance

The limitations in this Schedule B describe matters for which the vendor is responsible. They do not limit Provider's responsibility for its own configuration, implementation, and management services, or for its obligations under the DPA, which is governed by Sections 9, 10, and 10A of the Agreement.

Designated Platforms

The vendors listed in this Schedule B are representative examples. The Designated Platforms for Client are identified in the applicable SOW, and substitution is governed by Section 2.8.3 of the Agreement (Core Platforms only with Client's consent or as a Forced Substitution). Any vendor utilized—whether listed in this Schedule or not—is subject to the terms, limitations, and disclaimers set forth in Section 2.8 of the Agreement and this Schedule B.

Vendor Terms Updates

Vendors may update their terms of service, privacy policies, or acceptable use policies at any time. Provider will make commercially reasonable efforts to notify Client of material changes when informed by vendors, but Client remains responsible for:

• Monitoring vendor communications and terms updates independently
• Reviewing updated terms and determining if continued use is acceptable
• Notifying Provider of any vendor terms that conflict with Client's requirements

Client may terminate any specific Managed Third-Party Service upon sixty (60) days written notice if Client does not accept updated vendor terms.

Service Substitution

If a Forced Substitution (as defined in Section 2.8.3) is required, Provider will:

• Provide sixty (60) days notice of proposed substitution where practicable
• Offer reasonably equivalent replacement service
• Assist with migration to substitute service at no additional charge for up to 30 days

Client may:

• Accept the substitute service
• Decline and terminate the affected service without penalty
• Establish direct relationship with original or substitute vendor

Evidence of Terms Acceptance

By executing a Statement of Work that includes any Managed Third-Party Service, Client certifies that:

• Client has had the opportunity to review the applicable vendor terms provided by Provider
• Client accepts and agrees to be bound by those vendor terms
• Client authorizes Provider to procure licenses and configure services on Client's behalf
• Client understands Provider's limited role and liability as described in this Schedule

Schedule Updates

This Schedule B may be updated by Provider from time to time to:

• Add new third-party services offered by Provider
• Remove services Provider no longer offers
• Update vendor terms URLs or review dates
• Clarify Provider's role or limitations

Updates to this Schedule apply in accordance with Section 13.6 of the Agreement. Additions of new services and clarifications that do not reduce Client's rights apply to existing SOWs thirty (30) days after written notice.

End of Agreement