Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze the data security and privacy requirements applicable to the proposed Master Software-as-a-Service Agreement (the "MSA") between Skybridge Fintech Ltd. ("Skybridge" or "Licensor") and Meridian National Bank, N.A. ("Meridian" or "Licensee") for the deployment of SkyComply™, Skybridge's AI-driven anti-money laundering ("AML") and transaction-monitoring p

1. GLBA and NPI requirements;

2. State data breach notification laws;

4. Data residency restrictions;

5. Subprocessor approval obligations;

6. Security incident notification timing;

8. Data retention and deletion requirements; and

9. Background check requirements. In addition, the memorandum identifies and analyzes the key negotiation points between Skybridge and Meridian with respect to data security and privacy provisions. Meridian is represented in this transaction by Hargrove, Tully & Cascade Insurance Brokers, led by partner Douglas Krenshaw, with senior associate Megan Faircloth and associate Ryan Tso. We have received and reviewed two r

II. Background and Data Classification A. Nature of Data Processed Under the proposed MSA, the SkyComply™ Platform will process substantial volumes of Meridian's customer data in connection with AML screening, transaction monitoring, and BSA compliance operations. The nature and sensitivity of this data is central to the data security and privacy analysis set forth in the remainder of this memorandum. Based on the te

III. GLBA and Non-Public Personal Information Requirements A. Statutory Framework The Gramm-Leach-Bliley Act, Title V, Subtitle A (15 U.S.C. §§ 6801–6809) establishes the fundamental federal framework for the protection of consumer financial information. Section 6801(b) directs federal banking agencies and other relevant regulators to establish appropriate standards for financial institutions to protect the security

IV. State Data Breach Notification Laws A. Applicability All 50 states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted data breach notification laws that require entities to notify affected individuals (and, in many cases, state regulators and consumer reporting agencies) when a breach of security results in the unauthorized access to or acquisition of personal information. Give

V. Encryption Standards A. Data at Rest All Meridian data stored within the SkyComply™ Platform must be encrypted at rest using AES-256 (Advanced Encryption Standard with a 256-bit key length). AES-256 is the current industry-standard encryption algorithm for data at rest in financial services and other high-security environments. AES-256 is a symmetric-key encryption algorithm approved by the National Institute of S

1. AES-256 at Rest. Specification of AES-256 encryption as the minimum standard for all Meridian data at rest, implemented through FIPS 140-2/140-3 validated cryptographic modules, covering all data stores including primary databases, replicas, backups, archives, and disaster recovery copies.

2. TLS 1.2+ in Transit. Specification of TLS 1.2 as the minimum protocol version for all Meridian data in transit, with TLS 1.3 as the preferred protocol. Express prohibition of SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1.

3. HSM-Based Key Management. Specification of HSM-based key management as the default, with BYOK available as an optional configuration at Meridian's election and expense.

4. Technology Evolution Clause. Inclusion of a forward-looking provision requiring Skybridge to update encryption standards if stronger standards become industry-required or if current standards are identified as materially compromised. This provision should specifically contemplate the potential future adoption of post-quantum cryptographic standards (e.g., NIST's recently finalized post-quantum cryptographic algori

5. No Downgrade Without Consent. Express provision that Skybridge will not reduce the strength of encryption applied to Meridian data below the contractual minimums specified in the Security Exhibit without Meridian's prior written consent.

VI. Data Residency Restrictions A. Contractual Requirement Meridian has required, and Skybridge has agreed in principle, that all Meridian data must be stored and processed exclusively within the continental United States. This requirement reflects Meridian's regulatory obligations, institutional risk management policies, and the sensitive nature of the financial crimes and customer data processed by SkyComply™. The

VII. Subprocessor Approval Obligations A. Framework The DPA should establish a comprehensive framework governing Skybridge's use of subprocessors — i.e., third-party entities engaged by Skybridge that will have access to or process Meridian data in connection with the services. The subprocessor approval framework serves two principal purposes: (i) it provides Meridian with visibility into and control over the entitie

1. Security Standards. All subprocessors must maintain security standards that are materially equivalent to those required of Skybridge under the Security Exhibit (Exhibit B). This includes, at minimum, encryption standards (AES-256 at rest, TLS 1.2+ in transit), access controls, incident response capabilities, and employee background check requirements.

2. Data Residency. All subprocessors must comply with the data residency restrictions applicable to Meridian data, including the requirement that all Meridian data be stored and processed exclusively within the continental United States within the approved Orion Cloud regions (or, for non-hosting subprocessors, within the continental United States).

3. Confidentiality. All subprocessors must be bound by confidentiality obligations at least as protective as those imposed on Skybridge under the MSA.

4. Accountability. Skybridge remains fully responsible to Meridian for all acts and omissions of its subprocessors with respect to Meridian data. The DPA should include a clear statement that the engagement of subprocessors does not relieve Skybridge of any of its obligations under the MSA, DPA, or Security Exhibit. This is a critical provision from Meridian's perspective, as it ensures that Meridian's contractual re

VIII. Security Incident Notification Timing A. The Dispute The timing of security incident notification is one of the eight key open negotiation issues between Skybridge and Meridian. The parties' positions are as follows: • Skybridge Position: Skybridge will notify Meridian of any confirmed Security Incident affecting Meridian data within 24 hours of the point at which Skybridge's incident response team confirms tha