Contract analysis

I. Executive Summary The purpose of this memorandum is to assess whether Solara Digital Infrastructure Fund VI LP ("Fund VI"), acting through Stratos Merger Sub Inc. ("Merger Sub"), should file a voluntary notice with the Committee on Foreign Investment in the United States ("CFIUS") in connection with the proposed acquisition of Cloudium Technologies plc ("Cloudium" or the "Target") via a reverse triangular merger (

II. Background: Transaction Overview A. Parties and Structure Buyer. The buyer in the Transaction is Solara Digital Infrastructure Fund VI LP ("Fund VI"), a Delaware limited partnership with a 2022 vintage and approximately $12.4 billion in total committed capital. Fund VI is part of the broader Solara Digital Infrastructure LP ("Solara") platform, which manages approximately $38 billion in assets under management ac

III. Legal Framework: CFIUS Jurisdiction A. Overview of CFIUS Authority CFIUS is an interagency committee of the United States government, chaired by the Secretary of the Treasury, that is authorized to review certain transactions involving foreign investment in the United States for national security implications. CFIUS derives its authority from Section 721 of the Defense Production Act of 1950, as amended (50 U.S.

IV. Analysis: Acquirer "Foreign Person" Status A. Solara's Organizational Structure The determination of whether the acquirer in a CFIUS-reviewable transaction is a "foreign person" requires examination of the entire chain of ownership and control, from the acquiring entity up through its ultimate parent and controlling persons. Under 31 C.F.R. § 800.224, a "foreign person" is defined as any foreign national, foreign

V. Analysis: TID U.S. Business Status of Cloudium Even though the foreign-person threshold is not met — and the Transaction therefore falls outside CFIUS's jurisdiction as a covered transaction — we have conducted a comprehensive belt-and-suspenders analysis of whether Cloudium constitutes a "TID U.S. business." This analysis serves several purposes: (i) it provides a complete record of the regulatory assessment in t

1. Definition. The term "critical technologies" is defined in 31 C.F.R. § 800.215 by reference to several enumerated categories of controlled items, technologies, and materials. These include: (a) Defense articles or defense services included on the United States Munitions List ("USML") set forth in the International Traffic in Arms Regulations ("ITAR") at 22 C.F.R. Parts 120-130; (b) Items included on the Commerce C

2. Application to Cloudium Cloudium's products are commercial cloud-native ERP, CRM, and business-intelligence SaaS platforms designed for enterprise and mid-market customers. The company's technology is software-based and does not involve the production, design, testing, manufacture, fabrication, or development of defense articles, defense services, controlled items on the Commerce Control List, nuclear equipment or

3. Aegis Federal Relationship We have given particular attention to Cloudium's relationship with Aegis Federal Solutions Inc. in the context of the critical-technologies analysis. While the Aegis Federal relationship involves the provision of cloud services to a U.S. government contractor, the following facts are dispositive: • Cloudium provides Aegis Federal with access to its commercial ERP and CRM platform on a su

4. Conclusion on Critical Technologies Cloudium does not produce, design, test, manufacture, fabricate, or develop "critical technologies" as defined in 31 C.F.R. § 800.215. The company's products are commercial, unclassified SaaS platforms that are not subject to export controls beyond EAR99 classification. The Aegis Federal relationship involves the provision of unclassified commercial cloud services and does not a

1. Definition. Under 31 C.F.R. § 800.214, "critical infrastructure" refers to systems and assets, whether physical or virtual, that are so vital to the United States that the incapacity or destruction of such systems or assets would have a debilitating impact on national security. The regulations identify 28 specific critical-infrastructure sectors and subsectors in Appendix A to 31 C.F.R. Part 800, along with the sp

2. Application to Cloudium Cloudium provides commercial cloud-based software solutions (ERP, CRM, and BI) to enterprise and mid-market customers. Cloudium does not own, operate, supply, or service any critical infrastructure within the meaning of the 28 sectors and subsectors identified in Appendix A to 31 C.F.R. Part 800. Specifically: • Cloudium does not own or operate telecommunications infrastructure, including i

3. Conclusion on Critical Infrastructure Cloudium does not perform functions with respect to "critical infrastructure" as designated under Appendix A to 31 C.F.R. Part 800. The company is a provider of commercial enterprise software and does not own, operate, manufacture, supply, or service any critical infrastructure. This prong of the TID U.S. business analysis is not satisfied. C. Sensitive Personal Data

1. Definition. Under 31 C.F.R. § 800.241, "sensitive personal data" includes the following categories of personally identifiable information of U.S. persons, subject to certain minimum-volume thresholds: (a) Genetic test results (including data derived from genetic sequencing); (b) Biometric enrollment data (e.g., facial recognition templates, fingerprint data, iris scans, voiceprints); (c) Personal financial data, i

2. Application to Cloudium Cloudium collects and processes business contact information and enterprise-level operational data in the ordinary course of providing its ERP, CRM, and BI services. This data includes business names, employee names, business email addresses, phone numbers, job titles, and transactional data related to the customer's business operations (e.g., sales orders, purchase orders, inventory levels

3. Conclusion on Sensitive Personal Data Cloudium does not maintain or collect "sensitive personal data" within the meaning of 31 C.F.R. § 800.241 at levels triggering TID U.S. business status. The company processes business contact information and enterprise operational data in a B2B context, none of which falls within the enumerated categories of sensitive personal data or meets the applicable volume thresholds. Th

1. Cloudium does not produce, design, test, manufacture, fabricate, or develop "critical technologies."

2. Cloudium does not perform "covered functions" with respect to "critical infrastructure."

3. Cloudium does not maintain or collect "sensitive personal data" at qualifying levels. Accordingly, even if the acquirer were determined to be a foreign person (which, as analyzed in Part IV, it is not), no mandatory declaration would be required under 31 C.F.R. § 800.401, and the Transaction would not constitute a "covered investment" under 31 C.F.R. § 800.211 (which applies only to non-controlling investments in

VI. Analysis: Covered Real Estate Under 31 C.F.R. Part 802, CFIUS has jurisdiction to review certain transactions by or with a foreign person that involve the purchase or lease by, or concession to, a foreign person of "covered real estate." Covered real estate is defined as real estate that is located within, or functions as a part of, an air or maritime port; or is located within specified geographic proximity (gen

VII. Risk Assessment: Voluntary Filing Considerations Although we have concluded that the Transaction is not a covered transaction and does not trigger a mandatory CFIUS declaration, we have considered whether it would nonetheless be advisable for the parties to submit a voluntary CFIUS notice in order to obtain the benefit of a CFIUS "safe harbor." The safe harbor provides that, once CFIUS has concluded its review (

1. LP Composition Monitoring. Continue to monitor the limited partner composition of Fund VI through closing to confirm that no material change in foreign-person control occurs. Any proposed assignment or transfer of LP interests to foreign-government-affiliated investors, or any change in the governance structure of Solara Fund VI GP LLC that could introduce foreign-person control, should be reported to counsel imme

2. Regulatory Developments. Monitor for any expansion of mandatory CFIUS declaration requirements by regulation or executive order between now and closing, particularly with respect to sectors relevant to Cloudium's business (e.g., artificial intelligence, cloud computing, data services, or SaaS platforms). The Biden Administration has signaled interest in expanding CFIUS's reach with respect to data-related transact

3. Government Contract Developments. Monitor for any material changes in Cloudium's government-contract relationships, including any new contracts involving classified work, facility security clearances, or FedRAMP High authorization, any of which could alter the TID U.S. business analysis.

VIII. Conclusion and Recommendation Based on the analysis set forth in this memorandum, our recommendation is as follows: We do not recommend that the parties file a voluntary CFIUS notice in connection with the proposed acquisition of Cloudium Technologies plc by Solara Digital Infrastructure Fund VI LP. The Transaction does not constitute a "covered transaction" within the meaning of 31 C.F.R. § 800.210 because the

IX. Distribution and Confidentiality Notice This memorandum constitutes attorney work product prepared in anticipation of litigation and in the course of rendering legal advice, and is protected by the attorney-client privilege and the work product doctrine. It is strictly confidential and is intended solely for the use of the individuals and entities identified below. This memorandum should not be disclosed to any p