Contract analysis

ARTICLE 1: DEFINITIONS As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Article 1 shall have the meanings assigned to them elsewhere in this Agreement. "Acceptable Use Policy" means the policy governing the permitted and prohibited uses of the Platform, attached hereto as Exhibit D and incorporated herein by reference. "Affiliate" m

ARTICLE 2: GRANT OF LICENSE; ACCESS AND USE

Section 2.1 — License Grant Subject to the terms and conditions of this Agreement, including Licensee's payment of all applicable fees and compliance with the restrictions set forth in Section 2.3, Skybridge hereby grants to Meridian a non-exclusive, non-transferable (except as expressly provided in Section 15.5), non-sublicensable right and license to access and use the SkyComply™ platform during the Term solely for

Section 2.2 — Scope of Use The license granted in Section 2.1 authorizes Meridian to access and use the Platform across Meridian's retail banking, commercial banking, and wealth management divisions for all lawful purposes consistent with the Platform's intended functionality as described in the Documentation. Meridian may use the Platform in connection with both its domestic United States operations and its internat

Section 2.3 — Restrictions on Use Licensee shall not, and shall not permit any Authorized User or third party to: (a) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, object code, algorithms, data structures, or underlying ideas or techniques of the Platform, except to the limited extent expressly permitted by applicable law notwithstanding a contractual restriction to the con

Section 2.4 — Reservation of Rights As between the Parties, Skybridge retains all right, title, and interest in and to the Platform, the Documentation, and all intellectual Property Rights embodied therein or related thereto, including all Updates, Upgrades, modifications, enhancements, and derivative works thereof. No rights are granted to Licensee hereunder except as expressly set forth in this Agreement. All right

Section 2.5 — Feedback If Licensee or any of its Authorized Users provides suggestions, enhancement requests, recommendations, ideas, comments, or other feedback regarding the Platform, its features, or its functionality (collectively, "Feedback"), Skybridge shall be free to use, incorporate, modify, and otherwise exploit such Feedback without restriction, obligation, or compensation to Licensee. Licensee hereby assi

ARTICLE 3: IMPLEMENTATION SERVICES

Section 3.1 — Implementation Skybridge shall perform the Implementation Services described in the Order Form during the Implementation Period, which shall commence on September 15, 2025 and end on February 28, 2026. The Implementation Services shall include, without limitation: (a) initial configuration and customization of the Platform to conform to Meridian's operational requirements and risk parameters; (b) integr

Section 3.2 — Go-Live The targeted Go-Live Date for the Platform is March 1, 2026. Achieving the Go-Live Date is contingent upon the successful completion of user acceptance testing in accordance with the acceptance criteria mutually agreed upon by the Parties and set forth in the Order Form. Upon successful completion of user acceptance testing, Meridian shall deliver a written notice of acceptance, and the Platform

Section 3.3 — Implementation Fee The one-time implementation and onboarding services fee shall be Three Million Six Hundred Thousand Dollars ($3,600,000), payable in the installments and on the schedule set forth in the Order Form. The implementation fee is subject to the volume discount applied across the total contract value as described in Section 4.1 of this Agreement.

Section 3.4 — Project Governance Each Party shall appoint a dedicated project manager to serve as such Party's primary point of contact for all matters relating to the Implementation Services during the Implementation Period. Skybridge's project lead shall be designated in writing within five (5) Business Days of the Effective Date. Meridian's project lead shall be designated in writing within five (5) Business Days

Section 4.1 — Fees Licensee shall pay to Licensor the fees set forth in the Order Form attached hereto. The Parties acknowledge and agree that the fee structure for the Initial Term of this Agreement is as follows: (a) Year 1 Total Fees (post-discount, rounded): Twelve Million Seven Hundred Thousand Dollars ($12,700,000), comprising the platform subscription fee, the implementation fee, and the support and managed se

Section 4.2 — Additional Users Licensee may add incremental Authorized Users beyond the thirty-two thousand (32,000) named users included in the initial Order Form at a rate of Two Hundred Seventy-Five Dollars ($275.00) per user per year. The volume discount described in Section 4.1 does not apply to fees for incremental Authorized Users. Additional Authorized Users shall be added via a supplemental Order Form execut

Section 4.3 — Payment Terms All fees under this Agreement are payable quarterly in advance. Skybridge shall deliver invoices to Meridian electronically to Meridian's designated billing contact not later than thirty (30) days prior to the commencement of each quarterly billing period. All invoices are due and payable within thirty (30) days from the date of the invoice (net thirty (30) days). Licensee shall make all p

Section 4.4 — Annual Escalator Beginning in Year 3 of the Initial Term (i.e., effective as of the third anniversary of the Go-Live Date), the annual fees payable by Licensee under this Agreement (exclusive of the implementation fee, which is a one-time charge) shall increase by three percent (3.0%) per annum, reflecting a CPI-based escalation. Notwithstanding the foregoing, in no event shall the annual escalator exce

Section 4.5 — Taxes All fees stated in this Agreement and the Order Form are exclusive of, and Licensee shall be responsible for, all sales taxes, use taxes, value-added taxes, goods and services taxes, withholding taxes, and similar taxes, duties, levies, or governmental charges imposed in connection with this Agreement, excluding any taxes based on Skybridge's net income, gross receipts, capital, or franchise taxes

Section 4.6 — Late Payments Any amounts due under this Agreement that are not paid when due shall accrue interest at the rate of one and one-half percent (1.5%) per month (or, if lower, the maximum rate permitted by applicable law) from the date such payment was due until the date such payment is received by Skybridge. In addition, if Licensee fails to pay any undisputed amount when due and such failure continues for

Section 4.7 — SLA Credits Service level credits as set forth in the SLA Exhibit (Exhibit A) shall be Licensee's sole and exclusive financial remedy for Skybridge's failure to meet the uptime commitments specified therein. SLA credits shall be applied against future invoices and are not redeemable for cash, refundable, or transferable. The availability of SLA credits is without prejudice to Licensee's termination righ

Section 5.1 — SLA Exhibit The service level commitments, measurement methodologies, credit mechanisms, and incident response requirements applicable to the Platform are set forth in the SLA Exhibit attached hereto as Exhibit A. Skybridge shall use commercially reasonable efforts to maintain Platform availability at a rate of not less than [99.9%][99.95%] during each calendar month, measured exclusive of Scheduled Mai

Section 5.2 — SLA Credit Tiers Subject to the resolution of the uptime target in Section 5.1, the Parties have agreed upon the following framework for SLA credits: In the event that monthly uptime falls below 98.0% in three (3) of any consecutive six (6) months, Licensee shall have the right to terminate this Agreement upon thirty (30) days' written notice, without liability for early termination fees, and shall rece

Section 5.3 — SLA Credit Caps The Parties have agreed to cap SLA credits as follows: (a) Monthly Cap: Thirty percent (30%) of the monthly subscription fee. Based on the fee structure set forth in Section 4.1, this equates to a maximum monthly credit of approximately Three Hundred Seventeen Thousand Five Hundred Dollars ($317,500) in Year 1 and approximately Two Hundred Thirty-Three Thousand One Hundred Twenty-Five Do

Section 5.4 — Critical Incident Response Times Skybridge shall respond to critical incidents affecting the Platform in accordance with the following response time commitments: Skybridge shall assign severity levels in good faith in consultation with Meridian, and Meridian shall have the right to escalate the severity level in the event of a reasonable disagreement. All response time commitments are measured from the

Section 5.5 — Exclusive Remedy The SLA credits set forth in this Article 5 and the termination right set forth in Section 5.2 are Licensee's sole and exclusive remedies for Skybridge's failure to meet the uptime commitments specified in the SLA Exhibit, subject to the following qualification: nothing in this Section 5.5 shall prejudice or limit Licensee's rights under Article 9 (Indemnification) or Article 10 (Limita

Section 5.6 — Upstream Infrastructure The Parties acknowledge that Skybridge's ability to meet its uptime commitments under this Agreement is dependent in part on the availability and performance of the cloud infrastructure provided by Orion Cloud Services, Inc. ("Orion Cloud"), Skybridge's primary infrastructure-as-a-service provider. Orion Cloud currently maintains a platform service level agreement providing for 9

ARTICLE 6: SECURITY AND DATA PROTECTION

Section 6.1 — Security Obligations Skybridge shall implement and maintain, throughout the Term, administrative, technical, and physical safeguards designed to protect the security, confidentiality, integrity, and availability of Licensee Data and the Platform, in accordance with the security controls, standards, and requirements set forth in the Security Exhibit attached hereto as Exhibit B. Without limiting the gene

Section 6.2 — Encryption Standards The Parties have agreed upon the following encryption standards, which are further detailed in the Security Exhibit: (a) Data at Rest: All Licensee Data stored on Skybridge's systems and infrastructure shall be encrypted using Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256). (b) Data in Transit: All Licensee Data transmitted between Meridian's syst

Section 6.3 — Data Residency All Licensee Data shall be stored and processed exclusively within the continental United States. Hosting of the Platform and all Licensee Data shall be limited to Orion Cloud's US-East (Virginia) and US-West (Oregon) regions. No cross-border transfer of Licensee Data to any location outside of the continental United States shall occur without the prior written consent of Meridian, which

Section 6.4 — Penetration Testing The Parties have agreed upon the following framework for penetration testing of the Platform: (a) Skybridge-Conducted Testing: Skybridge shall, at its own expense, engage a qualified independent third-party security firm to conduct an annual penetration test of the Platform and its supporting infrastructure. Skybridge shall share the results of each such penetration test, including i

Section 6.5 — Security Incident Notification In the event Skybridge discovers or is made aware of a confirmed Security Incident affecting Licensee Data, Skybridge shall notify Meridian in writing within [24 hours][12 hours] of discovery. [OPEN ISSUE: The Security Incident notification window remains under negotiation. Skybridge proposes notification within twenty-four (24) hours of discovery of a confirmed Security I

Section 6.6 — Audit Rights Meridian may audit Skybridge's compliance with the security controls and data protection obligations set forth in this Agreement and the Security Exhibit, subject to the following terms: (a) Frequency: Meridian may conduct such audits no more than once per calendar year, upon thirty (30) Business Days' prior written notice to Skybridge. (b) Satisfaction of Audit Requests: Skybridge may sati

Section 6.7 — Subprocessor Approvals Skybridge shall provide Meridian with at least thirty (30) days' advance written notice before engaging any new Subprocessor that will process, store, or have access to Licensee Data. Such notice shall include the identity of the proposed Subprocessor, the nature of the processing to be performed, the categories of Licensee Data involved, and the location(s) where processing will

Section 6.8 — Background Checks All Skybridge personnel, including employees, contractors, and agents, who are granted access to Licensee Data or to Meridian's systems in connection with the performance of Skybridge's obligations under this Agreement shall undergo background checks prior to being granted such access. Such background checks shall be consistent with the standards and guidelines established by the Feder

Section 6.9 — Data Processing Addendum The Data Processing Addendum attached hereto as Exhibit C governs Skybridge's processing of Licensee Data, including NPI under the Gramm-Leach-Bliley Act and PII, and is incorporated herein by reference. The DPA sets forth the Parties' respective roles and responsibilities with respect to data processing, including the scope and purposes of processing, data subject rights, inter

ARTICLE 7: DATA RETENTION AND DELETION

Section 7.1 — During Term During the Term, Skybridge shall retain Licensee Data only as necessary to perform its obligations under this Agreement and as directed by Meridian in writing. Skybridge shall not retain Licensee Data for any purpose other than the performance of its obligations under this Agreement and shall not use Licensee Data for its own purposes, including product development, analytics, benchmarking,

Section 7.2 — Post-Termination Upon the termination or expiration of this Agreement for any reason: (a) Data Export: Within thirty (30) days of the effective date of termination or expiration, Skybridge shall provide Meridian with a complete export of all Licensee Data in a commonly used, machine-readable, non-proprietary format (such as CSV, JSON, or XML), together with such documentation as may be reasonably necess

Section 8.1 — Definition of Confidential Information "Confidential Information" means all information disclosed by or on behalf of one Party (the "Disclosing Party") to the other Party (the "Receiving Party"), whether orally, in writing, electronically, or in any other form or medium, that: (a) is marked, designated, or otherwise identified as "confidential," "proprietary," or with a similar legend at the time of dis

Section 8.2 — Obligations The Receiving Party shall: (a) use the Disclosing Party's Confidential Information solely for the purpose of performing its obligations or exercising its rights under this Agreement, and for no other purpose; (b) protect the Disclosing Party's Confidential Information using at least the same degree of care that it uses to protect its own confidential information of like kind, but in no event

Section 8.3 — Exclusions The obligations set forth in Section 8.2 shall not apply to any information that: (a) is or becomes publicly available through no fault, act, or omission of the Receiving Party or any person to whom the Receiving Party has disclosed such information; (b) was rightfully known to or in the possession of the Receiving Party prior to the time of disclosure by the Disclosing Party, as evidenced by

Section 8.4 — Compelled Disclosure Notwithstanding the foregoing, the Receiving Party may disclose Confidential Information of the Disclosing Party to the extent required by applicable law, regulation, rule, or legal process, including any examination, inquiry, information request, subpoena, civil investigative demand, or similar process by any federal banking regulator (including the OCC, the Federal Reserve, and th

Section 8.5 — Equitable Relief Each Party acknowledges and agrees that any breach or threatened breach of this Article 8 may cause the non-breaching Party irreparable harm for which monetary damages alone would be an inadequate remedy. Accordingly, in addition to any other remedies available at law or in equity, the non-breaching Party shall be entitled to seek temporary, preliminary, and permanent injunctive relief

Section 9.1 — Indemnification by Skybridge (Licensor) Skybridge shall indemnify, defend, and hold harmless Meridian, Meridian Financial Group, Inc., and their respective officers, directors, employees, agents, successors, and assigns (collectively, the "Meridian Indemnitees") from and against any and all third-party claims, demands, actions, suits, proceedings, damages, losses, liabilities, costs, and expenses (inclu

Section 9.2 — Indemnification by Meridian (Licensee) Meridian shall indemnify, defend, and hold harmless Skybridge and its officers, directors, employees, agents, successors, and assigns (collectively, the "Skybridge Indemnitees") from and against any and all Losses arising from or related to: (a) Acceptable Use Policy Breach: Any third-party claim arising from Meridian's breach of the Acceptable Use Policy attached

Section 9.3 — Indemnification Caps The indemnification obligations of the Parties under this Article 9 are subject to the following caps: (a) IP Indemnification (Section 9.1(a)): Skybridge's indemnification obligations with respect to intellectual property infringement claims under Section 9.1(a) are uncapped, consistent with industry standard practice for intellectual property indemnification in enterprise software-

Section 9.4 — Indemnification Procedures The indemnification obligations set forth in this Article 9 are subject to the following procedural requirements: (a) Notice: The indemnified party shall provide the indemnifying party with prompt written notice of any claim, demand, action, suit, or proceeding for which indemnification is sought. Failure to provide timely notice shall not relieve the indemnifying party of its

Section 9.5 — Exclusive Remedy for IP Infringement If Skybridge reasonably determines that the Platform, or any portion thereof, is or may become the subject of an infringement or misappropriation claim or an injunction or other order prohibiting Meridian's use, Skybridge shall, at its option and expense: (a) procure for Meridian the right to continue using the Platform (or the affected portion thereof) in accordance

ARTICLE 10: LIMITATION OF LIABILITY

Section 10.1 — Exclusion of Consequential Damages EXCEPT AS EXPRESSLY SET FORTH IN SECTION 10.2, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY, OR TO ANY THIRD PARTY CLAIMING THROUGH OR ON BEHALF OF SUCH PARTY, FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES OF ANY KIND, INCLUDING DAMAGES FOR LOST PROFITS, LOST REVENUE, LOST BUSINESS OPPORTUNITIES, LOSS OF GOODWILL, LOST DATA,

Section 10.2 — Carve-Outs from Consequential Damages Exclusion The exclusion of consequential and other damages set forth in Section 10.1 shall not apply to: (a) either Party's breach of its confidentiality obligations under Article 8; (b) Skybridge's IP indemnification obligations under Section 9.1(a); (c) either Party's breach of its data security obligations under Article 6; and [(d) regulatory fines, penalties, a

Section 10.3 — Aggregate Liability Cap EXCEPT AS EXPRESSLY SET FORTH IN SECTION 10.4, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER ARISING IN CONTRACT, TORT, STRICT LIABILITY, NEGLIGENCE, OR ANY OTHER LEGAL OR EQUITABLE THEORY, SHALL NOT EXCEED TWO TIMES (2×) THE ANNUAL FEES PAID OR PAYABLE BY LICENSEE IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE FIRST EVENT

Section 10.4 — Exclusions from Aggregate Liability Cap The Aggregate Liability Cap set forth in Section 10.3 shall not apply to: (a) Skybridge's IP indemnification obligations under Section 9.1(a), which are uncapped; (b) either Party's liability for breaches of confidentiality obligations under Article 8 and data security obligations under Article 6, which are subject to a separate super-cap equal to three times (3×

Section 10.5 — Essential Basis THE PARTIES ACKNOWLEDGE AND AGREE THAT THE LIMITATIONS AND EXCLUSIONS OF LIABILITY SET FORTH IN THIS ARTICLE 10 REFLECT A FAIR AND REASONABLE ALLOCATION OF RISK BETWEEN THE PARTIES IN LIGHT OF THE FEES PAYABLE UNDER THIS AGREEMENT AND THE NATURE OF THE SERVICES PROVIDED, AND THAT SUCH LIMITATIONS AND EXCLUSIONS FORM AN ESSENTIAL BASIS OF THE BARGAIN BETWEEN THE PARTIES. THE PARTIES FURT

ARTICLE 11: TERM AND TERMINATION

Section 11.1 — Initial Term This Agreement shall have an initial term of five (5) years commencing on the Go-Live Date (targeted as March 1, 2026) and expiring on February 28, 2031 (the "Initial Term"), unless earlier terminated in accordance with this Article 11. The Initial Term, together with any renewal terms, shall constitute the "Term."