Contract analysis

I. Purpose This memorandum summarizes the new engagement opened today on behalf of our longstanding client, Northgate Telecommunications PLC ("Northgate" or "NTP"), through its wholly owned United States subsidiary Northgate Americas, Inc. ("Northgate Americas" or "NAI"), for the negotiation and execution of a Master Services Agreement ("MSA") with Cedarpoint Systems Integration, Inc. ("Cedarpoint" or "CSI"). The MSA

II. Client Information A. Northgate Telecommunications PLC (Ultimate Parent) Northgate Telecommunications PLC is a United Kingdom-headquartered public telecommunications and software-as-a-service (SaaS) company listed on the London Stock Exchange under the ticker symbol NTP.L. Northgate's corporate headquarters are located at 45 Threadneedle Court, London EC2R 8AH, United Kingdom. Northgate reported full-year 2022 re

III. Counterparty Information A. Cedarpoint Systems Integration, Inc. Cedarpoint Systems Integration, Inc. is a Delaware corporation headquartered at 11400 Commerce Park Drive, Suite 600, Reston, VA 20191. Cedarpoint's Employer Identification Number is 52-4178503. Cedarpoint was founded in 2009 by Rajiv Sundaram and Teresa Cho. The company specializes in managed network infrastructure services, software-defined wide-

IV. Transaction Summary A. Overview. The contemplated transaction involves the negotiation and execution of a Master Services Agreement (Technology Transactions) between Northgate Americas, Inc. (as licensee and recipient of managed network services) and Cedarpoint Systems Integration, Inc. (as service provider and licensor). The MSA will be governed by the laws of the State of New York, without regard to its conflic

1. Managed WAN Services. Cedarpoint will assume responsibility for the management and operation of Northgate Americas' wide-area network across approximately 340 enterprise nodes located in 28 United States states and 3 Canadian provinces. This encompasses all aspects of day-to-day network operations, including provisioning, configuration management, fault resolution, capacity planning, and performance optimization.

2. SD-WAN Deployment and Optimization. Cedarpoint will deploy its proprietary ArcMesh platform (version 4.2) as the core SD-WAN orchestration layer across Northgate Americas' network. This includes initial deployment, configuration, and ongoing optimization of the SD-WAN environment to meet Northgate Americas' performance, reliability, and security requirements. 3. 24×7 Network Operations Center (NOC) Monitoring. Ced

4. Legacy Infrastructure Migration. A critical component of the engagement is the migration of Northgate Americas' existing network infrastructure from the legacy MPLS platform currently provided by the prior vendor, Greystone Halcyon Software (headquartered at 8300 Greensboro Drive, Suite 400, McLean, VA 22102), to Cedarpoint's SD-WAN platform. The migration is planned to be completed in three distinct phases over a

5. Cybersecurity Monitoring, Threat Detection, and Incident Response. Cedarpoint will provide cybersecurity monitoring and threat detection services for the managed network perimeter, including real-time monitoring, anomaly detection, alerting, and coordinated incident response procedures. The scope and specifics of these cybersecurity obligations, including data breach notification timelines and remediation responsi

6. Quarterly Network Performance Reviews. Cedarpoint will deliver quarterly network performance review reports and optimization recommendations to Northgate Americas, covering network utilization, performance trends, incident summaries, and forward-looking capacity planning assessments.

7. Dedicated Service Delivery Manager. Cedarpoint will assign a dedicated service delivery manager to the Northgate Americas account. This individual will serve as Northgate Americas' primary point of contact for all operational matters and will be responsible for ensuring adherence to the service level commitments, coordinating escalations, and facilitating the quarterly performance reviews. E. Escrow Deposit To pro

V. Engagement Team and Roles The following table sets forth the composition of the firm's engagement team, together with each member's role, practice group affiliation, and primary responsibilities for this matter: The cross-practice composition of this team reflects the multidisciplinary nature of the engagement. While the core drafting and negotiation work will fall primarily to Christy Bauer under my overall super

VI. Key Negotiation Issues The following sections identify and analyze the principal negotiation issues that we anticipate will arise during the drafting and negotiation of the MSA. Each team member should review these sections carefully, as they will inform our initial drafting approach and our strategy for the redline exchange process with Whitfield Graves & Morrow. The discussion below is not intended to be exhaus

1. Definition of "Comparable Volume." Cedarpoint is likely to push for a narrower definition of comparability that accounts not only for the number of managed nodes but also for the geographic distribution, complexity, and service mix of each customer engagement. We should be prepared to negotiate the criteria that constitute a "comparable" customer while preserving the protective purpose of the MFN clause.

2. Scope of Services Included in Pricing Comparison. Cedarpoint may argue that the MFN comparison should be limited to identical service configurations and exclude bundled or blended pricing that reflects different service mixes. Northgate Americas' position should be that the comparison should encompass all managed network services of a substantially similar nature, regardless of minor configurational differences.

3. Treatment of Bespoke and Custom Engagements. Cedarpoint will likely seek to carve out custom or bespoke engagements from the MFN comparison entirely, on the theory that non-standard pricing for unique projects should not establish a benchmark. While some degree of carve-out may be reasonable, we should resist any carve-out so broad that it would render the MFN provision ineffective.

4. Confidentiality of Cedarpoint's Customer Pricing. Cedarpoint will have legitimate concerns about the confidentiality of its pricing arrangements with other customers. We should expect Cedarpoint to propose that MFN audits be conducted by an independent third-party auditor subject to confidentiality obligations, with only pass/fail results (and, if applicable, the amount of the required credit) disclosed to Northga

1. Scope of Uncapped Carve-Outs. Cedarpoint and its counsel at Whitfield Graves & Morrow will almost certainly resist the breadth of the uncapped carve-outs, particularly the uncapped treatment of data breach and IP infringement. We should expect counterproposals to either eliminate certain carve-outs or to impose a separate, higher cap on these categories (e.g., 3× or 4× annual fees) rather than leaving them fully u

2. Defense and Control of Claims. The mechanics of claim defense, including which party has the right to select and direct defense counsel, the circumstances under which the indemnifying party may settle without the indemnified party's consent, and the indemnified party's right to participate in the defense, will require careful drafting. These provisions should be modeled on the firm's standard technology transactio

3. Notice Requirements. Both parties will want clear and enforceable notice requirements as a condition to the obligation to indemnify. We should ensure that the notice provisions are reasonable but that a failure to provide timely notice does not result in a forfeiture of indemnification rights except to the extent the indemnifying party is actually prejudiced by the delay.

4. Mitigation Obligations. We should include reciprocal obligations to mitigate damages and to cooperate in the defense of indemnified claims.

5. Interaction with Insurance Requirements. The indemnification provisions should be drafted to work in tandem with the insurance requirements set forth in Section IV.G. In particular, the uncapped carve-out for data breach claims should be evaluated against Cedarpoint's $25 million per-occurrence / $50 million aggregate cyber liability coverage to assess whether the available insurance is adequate to support the ind

1. Breadth of the Board-Turnover Prong. Item (iv) is likely to be the most contested element of the change of control definition. Cedarpoint and Ridgeline may argue that board composition changes are a normal incident of private equity ownership and that the board-turnover prong is overly broad, particularly where board changes are made in the ordinary course of Ridgeline's governance of its portfolio company. We sho

3. Interplay with Ridgeline's Exit Planning. Ridgeline's investment horizon and exit strategy will inevitably influence the negotiation of this provision. We should obtain as much publicly available information as possible regarding Ridgeline's fund lifecycle, investment vintage, and any public statements about its investment thesis for Cedarpoint. This intelligence will help us anticipate the timing and likely form

4. Escrow Release Mechanics. The interaction between the change of control termination right and the wind-down escrow must be carefully coordinated. We need to ensure that the escrow release conditions are clearly defined and that Northgate Americas has unambiguous access to the escrowed funds in any termination-for-change-of-control scenario. D. IP and Licensing Terms The licensing of Cedarpoint's ArcMesh platform (

1. Ownership of Customizations and Derivative Works. During the course of the engagement, Cedarpoint may develop customizations, configurations, or derivative works based on the ArcMesh platform that are specific to Northgate Americas' network environment. The ownership of these works will need to be clearly addressed. Northgate Americas' preference is to own (or at minimum retain a perpetual, irrevocable license to)

2. Source Code Escrow. In light of the critical importance of the ArcMesh platform to Northgate Americas' network operations, we should negotiate for a source code escrow arrangement. Under this arrangement, the source code for ArcMesh 4.2 (and any subsequent versions deployed under the MSA) would be deposited with a mutually agreed-upon escrow agent and released to Northgate Americas upon the occurrence of specified

3. Scope of Licensed Use. The precise scope of Northgate Americas' right to use the ArcMesh platform will need to be carefully defined, including any limitations on the number of users, the number of managed nodes, geographic restrictions, and the right to sublicense or permit use by affiliates. E. Data Security and Privacy Given that Cedarpoint will be monitoring and managing Northgate Americas' network infrastructu

1. Encryption Standards. The MSA should specify minimum encryption standards for data in transit and data at rest, consistent with current industry best practices (e.g., AES-256 encryption for data at rest, TLS 1.3 for data in transit).

2. Breach Notification Timelines. Cedarpoint must be obligated to notify Northgate Americas of any actual or suspected data breach within a specified timeframe. We will propose a 24-hour notification window for confirmed breaches and a 72-hour window for suspected breaches, with detailed requirements for the content and format of breach notifications.

3. Data Localization. Given the cross-border nature of the managed services (US and Canada), the parties will need to address data localization requirements, including any restrictions on the storage or processing of Northgate Americas' data outside of the United States and Canada, and compliance with applicable cross-border data transfer mechanisms.

4. Audit Rights. Northgate Americas should have the right to audit Cedarpoint's data security practices, including the right to conduct on-site inspections of Cedarpoint's NOC facilities and to review Cedarpoint's SOC 2 Type II reports and other security certifications.

5. Interaction with Indemnification. The data security provisions must be coordinated with the indemnification provisions, particularly the uncapped carve-out for data breach claims discussed in Section VI.B. The definition of "data breach" should be consistent across both provisions.

6. Applicable Law Compliance. The data security and privacy provisions must ensure compliance with applicable data protection laws in both the United States and Canada, including but not limited to state-level data breach notification statutes, the California Consumer Privacy Act (CCPA), and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA). F. Transition and Migration The migration f

1. Coordination with Greystone Network Solutions. The migration will necessarily involve a period during which both Greystone and Cedarpoint are providing services to Northgate Americas. The side letter should address the coordination mechanisms between the two vendors, including communication protocols, escalation procedures, and the delineation of responsibilities during the overlap period.

2. Parallel-Run Requirements. For each migration phase, there should be a defined parallel-run period during which the legacy MPLS infrastructure and the new SD-WAN infrastructure operate concurrently. This provides a safety net and allows for comparative performance testing before the legacy infrastructure is decommissioned at each node or group of nodes.

3. Rollback Procedures. The side letter should include detailed rollback procedures that can be invoked if a migration phase fails acceptance testing or if critical performance degradation is observed during the parallel-run period. The rollback procedures should define the triggers for rollback, the process for reverting to the legacy infrastructure, and the allocation of costs associated with any rollback.

4. Acceptance Testing. Each migration phase should be subject to formal acceptance testing criteria, including performance benchmarks, connectivity verification, and security validation. The criteria should be defined in advance and should be objective and measurable.

5. Notice and Consent from Greystone. We will need to review the existing agreement between Northgate Americas and Greystone Network Solutions to determine whether Northgate Americas is required to provide notice to or obtain consent from Greystone in connection with the migration. If the existing agreement contains any exclusivity provisions, minimum commitment obligations, or termination notice requirements that co

1. State Sales and Use Tax. The characterization of the managed services fees and the ArcMesh software licensing fees for state sales and use tax purposes varies significantly across the 28 US states in which Northgate Americas operates. In particular, the treatment of SaaS and cloud-based software licensing for sales tax purposes remains unsettled in a number of jurisdictions. Garrett should assess whether the fee a

2. Canadian GST/HST. Services delivered from Cedarpoint's Winnipeg, Manitoba NOC facility will have Canadian goods and services tax (GST) and harmonized sales tax (HST) implications. The interplay between Canadian GST/HST and US sales tax on cross-border service deliveries will need to be analyzed, including the application of any available exemptions or input tax credits.

3. Transfer Pricing. Although this is a transaction between two US corporations (NAI, EIN 84-3291067, and CSI, EIN 52-4178503), the ultimate parent entity is a UK-headquartered public company. To the extent that any portion of the service fees flows upstream to Northgate Telecommunications PLC or that the pricing between NAI and CSI is influenced by or coordinated with the Northgate group's global transfer pricing po

4. Withholding Tax. Any upstream payments from NAI to Northgate Telecommunications PLC (the UK parent) will need to be analyzed under the US-UK income tax treaty to determine applicable withholding obligations, if any. The characterization of such payments — whether as service fees, royalties, dividends, or other categories — will affect the applicable withholding rate. Garrett Simmons will prepare a separate, detail

VII. Conflict Check A comprehensive conflict check was completed on March 14, 2023, in connection with the opening of this matter. The conflict check was run against all relevant parties and their key personnel, including the following: • Northgate Telecommunications PLC • Northgate Americas, Inc. • Cedarpoint Systems Integration, Inc. • Ridgeline Capital Partners, LP • Rajiv Sundaram (CEO and Co-Founder, Cedarpoint)

VIII. Anticipated Timeline The following table sets forth the anticipated timeline for the negotiation and execution of the MSA. These dates are targets and are subject to adjustment based on the pace of negotiations with Cedarpoint and its counsel: This timeline contemplates an approximately three-month negotiation process from the circulation of the initial draft to execution. Based on our experience with MSA negot

IX. Document List (Anticipated Deliverables) The following is a comprehensive list of the documents and deliverables that we anticipate will be required in connection with this engagement: Primary Agreement: • Master Services Agreement (execution version) Exhibits to the MSA: • Exhibit A — Statement of Work / Service Descriptions • Exhibit B — Service Level Agreement • Exhibit C — Pricing Schedule and Fee Structure •

X. Administrative Matters The following administrative items apply to this engagement and should be observed by all team members: • Matter Number: 1022-00008. All time entries, disbursements, and document filings must reference this matter number. • Billing Partner: Elaine Forsythe. All billing inquiries, rate questions, and invoicing matters should be directed to Elaine. • Billing Rates: As set forth in the engageme

XI. Next Steps The following action items are to be initiated immediately following distribution of this memorandum:

1. Christy Bauer to begin drafting the initial MSA, using the firm's standard technology transactions template as a starting point and incorporating the transaction-specific terms described in this memorandum. The target date for circulation of the first draft to Cedarpoint and Whitfield Graves & Morrow is early April 2023.

2. Garrett Simmons to commence tax analysis for the multi-state and cross-border fee structure, with particular attention to state sales and use tax treatment, Canadian GST/HST implications, transfer pricing considerations, and withholding tax obligations under the US-UK treaty. Garrett should target completion of the initial tax structuring memorandum by mid-April 2023 so that the tax analysis can inform the fee str

3. Colette Whitman to schedule a kickoff call with Marcus Harcourt, Deirdre Kwan, and Katrina Bosch to confirm the client's commercial parameters, negotiation priorities, and any constraints or sensitivities that should inform our drafting and negotiation approach. The kickoff call should be scheduled within the next two weeks.

4. Christy Bauer to review the existing mutual Non-Disclosure Agreement between Northgate Americas and Cedarpoint, dated February 22, 2023, for adequacy in light of the contemplated MSA negotiation. Christy should confirm the scope of permitted disclosures, the definition of confidential information, the term and survival provisions, and any limitations that might constrain the parties' ability to share information n

5. All team members to review publicly available information on Cedarpoint Systems Integration, Inc. and Ridgeline Capital Partners, LP to inform our negotiation strategy, with particular attention to (a) Ridgeline's fund lifecycle, investment vintage, and any public statements regarding its investment thesis or exit strategy for Cedarpoint; (b) Cedarpoint's competitive position in the managed services and SD-WAN mar