Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze and assess the indemnification framework negotiated in the draft Master Services Agreement ("MSA") between Northgate Americas, Inc. ("Northgate Americas" or "Customer") and Cedarpoint Systems Integration, Inc. ("Cedarpoint" or "Service Provider"). This analysis is based on the first draft MSA circulated on April 3, 2023, as modified by Cedarpoint's red

II. Background and Parties A. Northgate Americas, Inc. Northgate Americas, Inc. is a Delaware corporation and the US contracting entity for Northgate Telecommunications PLC's North American procurement activities. Its registered agent is Calvert Corporate Services, Inc., located at 1209 Orange Street, Wilmington, Delaware 19801. Northgate Americas maintains its principal office at 1700 Market Street, Suite 2400, Phil

III. Cedarpoint's Indemnification Obligations Cedarpoint's indemnification obligations under the MSA are organized into four principal categories, each of which is analyzed below. These obligations collectively represent the primary risk-shifting mechanisms in favor of Northgate Americas and reflect the fundamental principle that, as the service provider and technology licensor, Cedarpoint bears primary responsibilit

IV. Northgate Americas' Indemnification Obligations Northgate Americas' indemnification obligations under the MSA are more limited in scope than Cedarpoint's, reflecting the fundamental asymmetry of the service provider/customer relationship. Northgate Americas' obligations are organized into two principal categories. A. Misuse of ArcMesh Platform Outside Licensed Scope Under Section 12.2(a) of the draft MSA, Northga

V. Aggregate Indemnification Caps The MSA establishes an asymmetric cap structure that limits each party's aggregate indemnification liability, subject to express carve-outs for certain high-risk categories of claims. The cap structure is analyzed below. A. Cedarpoint's Aggregate Cap Cedarpoint's aggregate indemnification liability under the MSA is capped at 200% of the aggregate fees paid by Northgate Americas durin

1. Intellectual Property Infringement. Cedarpoint's obligation to indemnify, defend, and hold harmless Northgate Americas against third-party IP infringement claims under Section 12.1(a) of the MSA (as described in Section III.A above) is uncapped. This carve-out is critical given Northgate Americas' inability to independently assess or mitigate intellectual property risk in the ArcMesh platform, and the potentially

2. Willful Misconduct. Indemnification obligations arising from the willful misconduct of either party are uncapped. This is a standard carve-out reflecting the well-established public policy principle that a party should not be permitted to cap its liability for intentional wrongdoing. Under New York law, provisions purporting to limit liability for willful misconduct are generally unenforceable, making this carve-o

3. Data Breach. Cedarpoint's obligation to indemnify Northgate Americas against data breaches caused by Cedarpoint's negligence or willful misconduct under Section 12.1(b) of the MSA (as described in Section III.B above) is uncapped. This carve-out reflects the potentially catastrophic scope of a network-wide data breach affecting Northgate Americas' 340-node managed network, which could give rise to regulatory fines

4. Confidentiality Breach. Indemnification obligations arising from either party's unauthorized disclosure of confidential information exchanged under the MSA are uncapped. This carve-out protects against the unauthorized disclosure of trade secrets, proprietary technology specifications, business plans, financial data, and other confidential information shared between the parties under the MSA and the predecessor Mu

VI. Procedural Mechanics for Indemnification Claims The MSA establishes detailed procedural requirements governing the assertion, defense, and resolution of indemnification claims. These mechanics are set forth in Section 12.3 of the draft MSA and are summarized and analyzed below. A. Notice Requirements The indemnified party must provide prompt written notice to the indemnifying party of any third-party claim for wh

VII. Insurance Requirements — Interplay with Indemnification A. Required Coverage The MSA, through Exhibit F (Insurance Requirements), requires Cedarpoint to maintain the following minimum insurance coverage throughout the initial term and any renewal periods: These coverage levels were negotiated based on the total contract value, the scope of Cedarpoint's cybersecurity responsibilities, the geographic breadth of th

VIII. Risk Assessment A. Strengths of the Current Indemnification Framework The indemnification framework negotiated in the MSA provides Northgate Americas with several significant protections:

1. Asymmetric caps favor Northgate Americas. The 200% cap on Cedarpoint's aggregate indemnification liability versus the 100% cap on Northgate Americas' liability reflects the appropriate allocation of risk in a service provider/technology licensor relationship. Cedarpoint, as the party contributing proprietary technology, cybersecurity services, and on-site personnel, bears the greater indemnification burden. This a

2. Broad uncapped carve-outs. The four uncapped carve-outs—IP infringement, willful misconduct, data breach, and confidentiality breach—protect Northgate Americas against the most significant risk categories in the engagement. These carve-outs ensure that the aggregate cap does not function as a ceiling on Cedarpoint's liability in precisely the scenarios where Northgate Americas' exposure is greatest.

3. Duty to defend for IP infringement. Cedarpoint's obligation to defend, not merely indemnify, against IP infringement claims shifts the burden of litigation management, counsel selection, and cost advancement to Cedarpoint. This is a materially stronger protection than a simple indemnification obligation and is particularly valuable in the context of complex patent litigation.

4. Strong insurance backstop. The $100,000,000 in aggregate insurance limits across three policy types, with Braeburn Mutual Insurance Company as the underwriting carrier, provides a substantial financial backstop for Cedarpoint's indemnification obligations. The insurance requirements ensure that Cedarpoint's contractual commitments are supported by institutional capital, reducing the risk of uncollectible indemnifi

5. Regulatory penalty indemnification. The inclusion of regulatory penalty indemnification—rare in many technology services agreements—recognizes the unique risk profile of this engagement, in which Cedarpoint's managed network services are integral to Northgate Americas' operations as a regulated telecommunications company. This provision ensures that Cedarpoint bears the financial consequences of its own regulatory

1. First-year cap calculation ambiguity. As discussed in Section V.A above, the trailing 12-month cap calculation produces a materially lower effective cap during the first 12 months of the MSA term. If applied literally, Cedarpoint's effective cap after Month 3 would be only $7,500,000 (200% × $3,750,000), rather than the intended $30,000,000 cap. This gap is particularly concerning because the first 12 months coinc

2. Negligence qualifier on data breach indemnification. The data breach indemnification under Section 12.1(b) requires a showing of Cedarpoint's negligence or willful misconduct as a trigger. This qualifier creates a potential gap: a data breach caused by a sophisticated third-party cyberattack exploiting a zero-day vulnerability—without any negligence on Cedarpoint's part—would arguably fall outside the scope of Ced

3. Cedarpoint's financial capacity beyond insurance. While Cedarpoint's FY2022 revenue of $420,000,000 suggests a substantial enterprise, Northgate Americas has not conducted financial diligence on Cedarpoint's balance sheet, liquidity, or ability to satisfy uncapped indemnification obligations (particularly a catastrophic IP infringement judgment that could exceed insurance limits). Ridgeline Capital Partners' 62% o

4. Subcontractor liability. The MSA should expressly confirm that Cedarpoint's indemnification obligations extend to the acts and omissions of Cedarpoint's subcontractors. Cedarpoint is expected to utilize subcontractors during the migration from Greystone Network Solutions' legacy MPLS infrastructure, and potentially on an ongoing basis for specialized services at certain network node locations. If Cedarpoint's inde

5. Regulatory penalty narrowing language. As noted in Section III.D above, Cedarpoint's April 21 redline proposed limiting the regulatory penalty indemnification to penalties "directly and solely caused by Cedarpoint's acts or omissions." This narrowing language would significantly reduce the practical scope of the provision. The "directly and solely" standard would require Northgate Americas to demonstrate that (a)

IX. Recommendations Based on the analysis set forth above, we recommend the following actions in preparation for the next round of negotiations with Whitfield Graves & Morrow LLP and the circulation of the second draft MSA, currently targeted for May 5, 2023:

1. Confirm annualized cap calculation for first 12 months. Add express language to Section 12.4 of the MSA providing that, for claims arising during the first 12 months of the initial term, each party's aggregate indemnification cap shall be calculated based on the annualized annual contract value (i.e., $15,000,000 for Northgate Americas' fee obligations) rather than the aggregate fees actually paid during the prece

2. Resist Cedarpoint's narrowing of regulatory penalty indemnification. Maintain the "arising from" causation standard in Section 12.1(d) and reject Cedarpoint's proposed "directly and solely caused by" formulation. The narrowing language would introduce an unworkably high burden of proof and would effectively nullify the regulatory penalty indemnification in many realistic scenarios involving contributing causes. If

3. Confirm subcontractor coverage. Ensure that Cedarpoint's indemnification obligations under Section 12.1 expressly cover the acts and omissions of Cedarpoint's employees, agents, contractors, and subcontractors. This is particularly important given Cedarpoint's anticipated use of subcontractors during the migration from Greystone Network Solutions' legacy MPLS infrastructure. Proposed language: "Cedarpoint's indemn

4. Evaluate data breach causation gap. Schedule a discussion with Colette Whitman and the Northgate Americas client team (Deirdre Kwan and Katrina Bosch) to evaluate whether to propose a broader data breach trigger in the next draft. Options include: (a) strict liability for any breach occurring within Cedarpoint's systems regardless of fault (our original position, which was previously rejected by Cedarpoint); (b) a

5. Require advance notice of insurance changes. Add a provision to Exhibit F requiring Cedarpoint to provide 30 days' advance written notice to Northgate Americas of any material reduction in coverage, change of carrier, or cancellation of any required insurance policy. This notice requirement ensures that Northgate Americas has an opportunity to assess the impact of any change in the insurance backstop and, if neces

6. Financial diligence on Cedarpoint. Given the uncapped carve-outs for IP infringement, willful misconduct, data breach, and confidentiality breach, we recommend that Northgate Americas' finance team—through the Dunmore & Pratt LLP audit engagement led by Helen Treadway—obtain and review Cedarpoint's most recent audited financial statements. The review should focus on Cedarpoint's balance sheet, liquidity position,

7. Coordinate with Garrett Simmons on tax indemnity. Confirm that the general indemnification framework under Section 12 does not conflict with or duplicate the specific tax indemnity provisions being developed separately by Garrett Simmons for the MSA. The tax indemnity provisions are expected to address sales and use tax obligations, withholding tax requirements, and cross-border tax obligations arising from Cedarp

8. Preserve all four uncapped carve-outs. The carve-outs for IP infringement, willful misconduct, data breach, and confidentiality breach represent the core risk-allocation protections in the indemnification framework. These carve-outs should not be conceded or narrowed in further negotiations with Whitfield Graves & Morrow LLP. If WGM proposes caps or sub-limits on any of the carved-out categories, we should respond

X. Conclusion The indemnification framework in the draft MSA provides Northgate Americas with robust protections that are commensurate with the $75,000,000 total contract value, the embedded ArcMesh technology licensing component, and the cybersecurity risk profile of a 340-node managed network spanning 28 US states and 3 Canadian provinces. The asymmetric cap structure—200% of trailing 12-month fees for Cedarpoint v