Contract analysis

I. Executive Summary On January 16, 2024, Calderwood & Harkness LLP ("C&H" or the "Firm") conducted the underwriting diligence call (the "Underwriting Call") with Northfield Assurance Ltd. ("Northfield") in connection with the proposed buyer-side representation and warranty insurance policy (Policy No. NFA-TRI-2024-00487) for Solara Digital Infrastructure Fund VI LP's ("Solara" or the "Buyer") acquisition of Cloudium

II. Transaction Overview Presented to Underwriters At the outset of the Underwriting Call, C&H presented a comprehensive overview of the Transaction to Northfield's underwriting team. The following sections summarize the key information conveyed. A. Parties and Structure Buyer. Solara Digital Infrastructure Fund VI LP ("Fund VI") is a Delaware limited partnership with a 2022 vintage and $12.4 billion in committed cap

III. Diligence Workstream Summaries Presented C&H presented detailed summaries of each major diligence workstream to the Northfield underwriting team. The following sections reflect the substance of those presentations and the discussions that ensued. A. Corporate Organization and Subsidiaries C&H presented the corporate organizational structure of Cloudium and its subsidiaries. The organizational chart, capitalizati

1. Existing Credit Agreement with Atlas Commercial Lending Corp. (dated March 15, 2021). The credit agreement governing Cloudium's existing $820,000,000 in indebtedness contains a change-of-control mandatory prepayment clause. Upon the occurrence of a change of control (which includes the Transaction), all outstanding borrowings become immediately due and payable. No lender consent is required. The entire $820,000,00

2. Master SaaS Agreement with Aegis Federal Solutions Inc. Aegis Federal Solutions Inc. ("Aegis Federal") is a U.S. government contractor and Cloudium's largest single customer, with annual recurring revenue of $84,000,000. The Master SaaS Agreement requires Aegis Federal's prior written consent to any change of control of Cloudium. This is a consent requirement, not merely a notice requirement. C&H flagged this as a

3. Technology License Agreement with Helix Data Systems GmbH. The Technology License Agreement between Cloudium and Helix Data Systems GmbH ("Helix Data"), a Frankfurt-based analytics technology company, contains a termination-for-change-of-control clause. The license covers certain embedded analytics technology that Cloudium utilizes in its business intelligence module. The consent process has been initiated, and C&

4. Other Commercial Contracts. In addition to the three contracts identified above, C&H's review identified change-of-control provisions in approximately 35 additional commercial contracts. None of these contracts individually exceeds $10,000,000 in annual recurring revenue. Based on the review, all such contracts were assessed as low risk, either because (a) the change-of-control provision requires only notice (not

I. Insurance. C&H reviewed Cloudium's existing insurance program and presented a summary of findings to the underwriting team. Existing Coverage. Cloudium maintains a comprehensive insurance program, including directors' and officers' liability (D&O), errors and omissions / professional liability (E&O), cyber liability, general commercial liability, and property insurance. C&H reviewed the key policies and confirmed

IV. Northfield Underwriter Questions and C&H Responses A. Specific Questions Raised by Northfield Underwriters Following C&H's presentation of the diligence workstream summaries, Northfield's underwriting team raised a number of specific questions. The following is a comprehensive summary of the questions and C&H's responses.

1. Aegis Federal Consent Risk. Northfield's underwriters focused significant attention on the change-of-control consent required under Cloudium's Master SaaS Agreement with Aegis Federal Solutions Inc. Northfield asked for more detail on (a) the specific consent mechanism under the agreement, (b) the anticipated timeline for obtaining consent, and (c) the business impact if consent were ultimately withheld. C&H respo

2. Helix Data License Termination. Northfield asked about the scope of the embedded analytics technology covered by the Helix Data Systems GmbH license, the cost and timeline for developing a proprietary replacement, and whether any fallback intellectual property existed. C&H responded as follows: (a) Scope. The Helix Data analytics engine is used in Cloudium's business intelligence module to provide advanced data vi

3. Open-Source Compliance. Northfield asked whether any open-source license contamination risk could affect the valuation of Cloudium's intellectual property portfolio, particularly given the use of AGPL- and GPL-licensed components. C&H confirmed that Cloudium's open-source compliance framework — including code segregation practices, component-level tracking, and internal review processes — is designed to prevent vi

4. Cybersecurity Incident History. Northfield asked for additional details regarding the Q2 2022 data breach, including the nature of the compromised data, the timeline for remediation, the regulatory response, and the measures taken to prevent recurrence. C&H provided the following details: (a) The incident involved the unauthorized access to a database containing approximately 2,300 customer records. The affected r

5. Closing-Date Leverage. Northfield's underwriting team asked about the post-closing solvency of the surviving entity in light of the Transaction's leverage profile, noting that closing-date total leverage of approximately 9.24x LTM EBITDA (pre-synergies) is elevated. C&H responded as follows: (a) Pro forma adjusted EBITDA, including $110,000,000 in identified run-rate cost synergies, reduces total leverage to appro

6. Government Contracts and FedRAMP. Northfield asked whether Cloudium holds any classified government contracts or possesses any export-controlled technology subject to ITAR or EAR restrictions. C&H confirmed that Cloudium does not hold any classified government contracts and does not possess, develop, or export any technology that is controlled under the International Traffic in Arms Regulations (ITAR) or the Expor

7. UK Subsidiary Revenue Significance. Northfield asked about the relative importance of the UK subsidiary to the overall Cloudium group, in light of the fact that Cloudium Technologies UK Ltd. contributes approximately £312,000,000 (~$390,000,000) in revenue, representing approximately 24% of total group revenue. C&H confirmed the revenue contribution and noted that risks specific to UK operations — including post-B

V. Areas of Potential Coverage Exclusion Identified Based on the discussions during the Underwriting Call, Northfield flagged the following areas that may be subject to exclusion or limitation in the final R&W Policy. These items will be addressed in the binder agreement and final policy wording, and C&H will negotiate on behalf of Solara to minimize the scope of exclusions to the extent commercially reasonable.

1. Known Matters / Specific Disclosures. Any matter specifically disclosed in the seller disclosure schedules to the Merger Agreement will be excluded from coverage under the standard known-loss exclusion. This is a market-standard provision in buyer-side R&W insurance policies and reflects the principle that the policy is designed to cover unknown breaches of representations, not matters of which the buyer is alread

2. Aegis Federal Consent. If the written consent of Aegis Federal Solutions Inc. under the Master SaaS Agreement has not been obtained prior to the binding date of January 19, 2024, Northfield may impose a specific exclusion for losses arising from the Aegis Federal change-of-control consent issue. C&H noted that this is primarily a timing issue — the consent process has been initiated, and consent is expected within

3. Helix Data License. Similarly, if the consent of Helix Data Systems GmbH under the Technology License Agreement has not been resolved at the time of binding, Northfield may impose a specific exclusion for losses arising from the Helix Data change-of-control termination right. C&H will negotiate the scope of any such exclusion and will seek reinstatement language.

4. Forward-Looking Tax Matters. Northfield indicated that the standard exclusion for forward-looking tax matters will apply. This exclusion covers losses arising from post-closing tax restructuring, intellectual property migration, transfer pricing adjustments attributable to post-closing changes in intercompany arrangements, and other prospective tax planning activities. This exclusion does not extend to breaches of

5. Cyber / Data Privacy Claims. Northfield indicated that the standard market approach will apply to data privacy and cybersecurity claims. The Policy will provide coverage for breaches of data-privacy-related representations and warranties as of the closing date. However, Northfield noted the potential for a sub-limit or specific exclusion with respect to claims arising from the known Q2 2022 data breach incident. C

6. Asbestos / Environmental / Product Liability. Northfield's standard blanket exclusion for asbestos-related claims, environmental liabilities, and product liability claims will apply. This exclusion is not a meaningful concern for the Transaction, given Cloudium's software-only business model and the absence of any manufacturing, industrial, or environmental exposure.

7. Pension Underfunding. The standard exclusion for defined-benefit pension underfunding liabilities will apply. This exclusion is not applicable to the Transaction, as Cloudium maintains only defined-contribution pension plans across all jurisdictions.

8. Purchase Price Adjustments. Losses arising from post-closing working capital true-up disputes will be excluded from R&W Policy coverage. This is a market-standard exclusion reflecting the principle that purchase price adjustment mechanisms are a contractual matter between the buyer and seller, not an insurable risk under an R&W policy.

9. Covenant Breaches. The R&W Policy covers only breaches of the seller's representations and warranties as set forth in Article IV of the Merger Agreement. Breaches of interim-period operating covenants (Article VI), closing conditions, or other contractual obligations of the seller are excluded from coverage. This is standard for buyer-side R&W insurance policies, which are designed to insure the accuracy of the re

VI. Subrogation and Fraud Provisions C&H discussed the subrogation and fraud provisions of the R&W Policy with Northfield's underwriting team. Subrogation Waiver. Northfield confirmed that the R&W Policy will include the standard buyer-side subrogation waiver. Under this provision, the insurer waives its right to pursue subrogation claims against Cloudium, its former officers and directors, and the selling stockholde

VII. Policy Terms and Premium Confirmation The following table summarizes the key commercial terms of the R&W Policy, as confirmed during the Underwriting Call and consistent with Northfield's non-binding indication dated January 14, 2024: The premium of $13,600,000, representing a rate of 2.0% on the $680,000,000 policy limit, is within the expected market range for a transaction of this size and risk profile. The b

VIII. Next Steps and Action Items The following action items were identified during and following the Underwriting Call:

1. Supplemental Diligence Materials. Northfield requested that C&H provide the following supplemental diligence materials to complete its underwriting file: (a) The due diligence summary memorandum (dated January 5, 2024); (b) The change-of-control provisions diligence memorandum (dated January 8, 2024); (c) Summaries of the intellectual property diligence workstream; and (d) The Target's disclosure schedules to the

2. Draft Binder Agreement. Timothy Gallagher of Peregrine Advisory Group LLC will circulate a draft binder agreement by January 17, 2024, for concurrent review by C&H and Northfield.

3. C&H Review of Draft Binder and Policy Exclusion Language. Upon receipt of the draft binder agreement, C&H will conduct a thorough review with particular focus on the following negotiation points: (a) Q2 2022 Cyber Incident: Ensuring that the fully remediated Q2 2022 data breach, for which no enforcement action was taken, is not specifically excluded from coverage; (b) Aegis Federal and Helix Data Consent Exclusion

4. Binding. The target binding date is January 19, 2024, which is three business days before the scheduled signing of the Merger Agreement on January 22, 2024. The premium of $13,600,000 will be wired by Solara to Northfield at binding.

5. No-Claims Declaration. C&H will prepare the form of no-claims declaration for Solara's signature at closing. The no-claims declaration will confirm that