PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT
This memorandum is a privileged and confidential attorney-client communication and attorney work product. It is intended solely for the use of the addressee and those individuals identified on the distribution list. This memorandum contains the mental impressions, conclusions, opinions, and legal theories of attorneys. It is not intended for disclosure to any third party and should not be disclosed without the prior written consent of Calderwood & Harkness LLP.
PRELIMINARY CASE ASSESSMENT MEMORANDUM
May 30, 2023
MEMORANDUM
TO: Adriana Voss, General Counsel, Lumos Analytics Inc.
FROM: Linda Osei, Partner, and Simone Laroche, Senior Associate, Calderwood & Harkness LLP
DATE: May 30, 2023
RE: Preliminary Case Assessment — Pinnacle Financial Holdings LLC Breach-of-Contract Claim / SLA Credit Dispute
MATTER NO.: 1008-00007
CC: Priya Anand, Partner; Jeffrey Park, Associate
I. EXECUTIVE SUMMARY
Calderwood & Harkness LLP ("C&H") has been retained by Lumos Analytics Inc. ("Lumos" or the "Company") to defend against a breach-of-contract claim asserted by Pinnacle Financial Holdings LLC ("Pinnacle") arising from alleged failures to meet service level commitments under the Master Services Agreement dated January 15, 2021 (Agreement No. MSA-PFH-2021-0015) (the "MSA"). This memorandum sets forth our preliminary case assessment, identifies key legal and factual issues, evaluates Lumos's risk exposure, and provides strategic recommendations for the defense of this matter.
On May 1, 2023, Pinnacle's outside counsel, Hargrove, Tillman & Burch LLP (lead partner Katherine Hargrove), transmitted a formal demand letter to Lumos seeking $2,870,000 in total damages. The demand is predicated on four alleged service disruptions that occurred between October 2022 and March 2023, each of which Pinnacle contends constituted a breach of the uptime commitment set forth in Exhibit C to the MSA (the "Service Level Agreement" or "SLA").
Pinnacle's demand comprises four distinct components: (i) $120,000 in SLA credits under Exhibit C for four incidents, calculated under the graduated credit structure; (ii) $1,950,000 in alleged consequential and lost-revenue damages arising from delayed loan originations and missed trading windows purportedly caused by the service disruptions; (iii) $340,000 in internal remediation costs, including costs associated with manual workarounds, employee overtime, and temporary licensing of a competitor platform operated by TrueNorth Data Systems Inc.; and (iv) $460,000 in alleged reputational harm and client attrition, based on the estimated value of two wealth-management clients that Pinnacle claims to have lost as a direct result of the outages.
After a thorough review of the MSA, the Exhibit C SLA terms, Lumos's internal incident logs, third-party telemetry data maintained by Sentinel Uptime Services Inc. ("Sentinel"), Pinnacle's demand letter and supporting documentation, and applicable California law, it is our preliminary assessment that Lumos possesses strong contractual defenses that significantly limit its maximum realistic exposure. Specifically, we believe that the most likely exposure falls within a range of approximately $54,000 to $90,000 in SLA credits, with a best-case exposure as low as $30,000. Even in a worst-case scenario, total exposure should not exceed approximately $460,000. The vast majority of Pinnacle's demand—approximately $2,750,000 in non-credit claims—is, in our view, barred by the mutual consequential damages waiver set forth in MSA §11.3.
Based on this assessment, we recommend a defense strategy centered on the following pillars: (a) vigorous assertion of Lumos's contractual limitations on liability, including the consequential damages waiver, the SLA credit cap, and the aggregate liability cap; (b) disputing Pinnacle's inflated uptime measurements by relying on independently verifiable Sentinel telemetry data that records materially shorter outage durations; (c) raising affirmative defenses including the timeliness bar for one incident credit request, the third-party cause exclusion for another incident, and Pinnacle's failure to mitigate through available disaster-recovery failover; and (d) early engagement in settlement discussions leveraging the MSA's mandatory mediation clause (§14.3) to pursue a commercially reasonable resolution that preserves the ongoing business relationship between the parties.
This memorandum details our factual and legal analysis and presents our strategic recommendations in full below.
II. BACKGROUND AND FACTUAL SUMMARY
A. The Parties
Lumos Analytics Inc. Lumos is a Delaware corporation headquartered at 580 Howard Street, Suite 400, San Francisco, California 94105. Lumos operates an enterprise software-as-a-service ("SaaS") platform that provides real-time financial analytics, risk scoring, and regulatory compliance dashboards to banks, asset managers, insurance companies, and other financial institutions. As of fiscal year 2022, Lumos reported annual recurring revenue ("ARR") of approximately $127.4 million and employed approximately 620 individuals across its San Francisco headquarters, New York office, and remote workforce. Marcus Ellison serves as Chief Executive Officer. The Company's majority ownership stake is held by Ridgeline Capital Partners, LP, which acquired its position in 2021. The Pinnacle account represents one of Lumos's larger enterprise relationships, with an annual subscription value of $1,440,000—approximately 1.1% of total ARR.
Pinnacle Financial Holdings LLC. Pinnacle is a Delaware limited liability company with principal offices at 200 West Adams Street, Suite 3100, Chicago, Illinois 60606. Pinnacle operates as a mid-market commercial lending and wealth management platform, with approximately $4.2 billion in assets under management ("AUM"). Key personnel relevant to this matter include Gerald R. Worthington (Chief Executive Officer), Diana Cho (Chief Financial Officer), Naveen Mistry (Chief Technology Officer), and Sandra Keppler (Vice President of Vendor Management). Pinnacle is a sophisticated financial institution subject to extensive regulatory oversight and possessing significant in-house legal and technology capabilities. Pinnacle's use of the Lumos platform centers on real-time analytics supporting its loan origination workflows, portfolio risk scoring, and regulatory compliance reporting.
Pinnacle's Outside Counsel. Pinnacle is represented in this matter by Hargrove, Tillman & Burch LLP, a Chicago-based litigation firm with offices at 71 South Wacker Drive, Suite 4500, Chicago, Illinois 60606. The lead partner on the matter is Katherine "Kate" Hargrove, a well-known commercial litigation practitioner. She is assisted by Daniel Yun, an associate at the firm. Ms. Hargrove is known in the Chicago legal community for taking aggressive pre-litigation postures in commercial disputes but has also demonstrated a pragmatic approach to resolution in past matters. This profile is relevant to our settlement strategy analysis in Section VII below.
B. The MSA and Service Level Agreement
The Master Services Agreement was executed on January 15, 2021 between Lumos and Pinnacle under Agreement No. MSA-PFH-2021-0015. The MSA governs Pinnacle's subscription to and use of the Lumos SaaS platform and establishes the foundational terms of the commercial relationship between the parties. The following provisions are most directly relevant to the instant dispute:
Term and Fees. The MSA provides for an initial term of three years, commencing on January 15, 2021 and expiring on January 14, 2024. Under MSA §4.1, the annual subscription fee is $1,440,000, payable in equal monthly installments of $120,000. The total initial-term contract value is $4,320,000. The agreement includes standard renewal provisions permitting extension upon mutual written agreement. We note that the initial term is scheduled to expire in approximately seven and a half months, which is a significant consideration for the commercial dynamics of this dispute and our settlement strategy.
Service Level Commitments — Exhibit C. The specific service level commitments at issue are set forth in Exhibit C to the MSA, titled "Service Level Agreement." Exhibit C establishes, among other things, the following key terms:
Uptime Commitment. Lumos commits to maintaining platform availability of 99.95% as measured on a calendar-month basis. Based on a 30-day month (720 hours), this commitment permits maximum allowable downtime of approximately 21.6 minutes per month.
Definition of Downtime. Section 1.3 of Exhibit C defines "Downtime" as the "complete inability to access the Platform's core functionality," expressly excluding "periods of degraded performance." This definition is critically important to our analysis of the uptime measurement dispute, as discussed in Section IV.A below.
P1 Incident Response Time. For Priority 1 incidents (complete service outage affecting all users), Lumos commits to providing an initial acknowledgment within 15 minutes and delivering a resolution or viable workaround within 2 hours.
SLA Credit Structure (Exhibit C, §3.2). In the event that Lumos fails to meet the 99.95% uptime commitment in any given calendar month, Pinnacle is entitled to SLA credits calculated on a graduated basis as follows:
• Monthly uptime of 99.90% to 99.94%: credit of 5% of the monthly subscription fee ($6,000)
• Monthly uptime of 99.50% to 99.89%: credit of 10% of the monthly subscription fee ($12,000)
• Monthly uptime of 99.00% to 99.49%: credit of 20% of the monthly subscription fee ($24,000)
• Monthly uptime below 99.00%: credit of 30% of the monthly subscription fee ($36,000)
Exclusive Remedy (Exhibit C, §3.1). The SLA credit mechanism is expressly designated as "Customer's sole and exclusive remedy for Provider's failure to meet the Uptime Commitment." This exclusive remedy provision is a critical element of Lumos's defense against Pinnacle's claims for remediation costs and other damages beyond SLA credits.
SLA Credit Cap (Exhibit C, §3.4). Maximum SLA credits available in any rolling twelve-month period are capped at 30% of the annual subscription fee, which equals $432,000. This cap represents an absolute ceiling on SLA credit exposure regardless of the number or severity of incidents.
Credit Request Procedure (Exhibit C, §3.5). To be eligible for SLA credits, the customer must submit a written credit request within 30 calendar days of the end of the affected calendar month. The request must specify the affected services and the observed downtime. This procedural requirement is a condition precedent to credit entitlement and forms the basis of one of our key affirmative defenses.
Exclusions from Uptime Calculation (Exhibit C, §2.3). Several categories of downtime are expressly excluded from the uptime calculation, including: (a) scheduled maintenance windows conducted in accordance with advance notification requirements; (b) downtime attributable to customer infrastructure or third-party services not provided by Lumos; and (c) force majeure events as defined in MSA §13.1.
Limitation of Liability Provisions. The MSA contains robust limitation of liability provisions that are central to Lumos's defense:
Aggregate Liability Cap (MSA §11.2). The total aggregate liability of either party under or in connection with the MSA is capped at the amount of fees actually paid by Pinnacle during the twelve-month period immediately preceding the event giving rise to the claim. Based on Pinnacle's monthly fee of $120,000, this cap equals $1,440,000.
Mutual Waiver of Consequential Damages (MSA §11.3). Both parties mutually waive all claims for "indirect, consequential, incidental, special, punitive, and lost-profits damages, including but not limited to loss of revenue, loss of data (except as covered under Provider's data recovery obligations), loss of goodwill, and business interruption, however caused and on any theory of liability." This provision is the single most important contractual defense available to Lumos in this matter, as it bars the vast majority of Pinnacle's $2,870,000 demand.
Governing Law and Dispute Resolution. MSA §14.1 designates the laws of the State of California as the governing law for the agreement, without regard to conflict-of-laws principles. MSA §14.3 establishes a mandatory mediation requirement before either party may initiate litigation, with mediation to be conducted in San Francisco, California. If mediation fails to produce a resolution within 60 days, either party may commence litigation in the state or federal courts located in San Francisco County, California, which the parties have agreed shall have exclusive jurisdiction.
C. The Alleged Incidents
Pinnacle's demand letter identifies four separate service disruptions that occurred between October 2022 and March 2023. For each incident, Pinnacle claims that the disruption resulted in monthly platform availability falling below the 99.95% uptime commitment, thereby entitling Pinnacle to SLA credits and, in Pinnacle's view, additional damages. The four incidents are summarized below based on Pinnacle's characterizations as set forth in its demand letter. Lumos's competing measurements are addressed in Section IV.A.
Incident INC-4471 (October 12–13, 2022). Pinnacle alleges a service disruption commencing at approximately 10:17 PM Central Time on October 12, 2022 and continuing until approximately 5:59 AM Central Time on October 13, 2022, for a total claimed duration of 7 hours and 42 minutes. Based on this claimed duration, Pinnacle calculates the monthly uptime for October 2022 at 98.93%, triggering the maximum credit tier of 30% of the monthly fee. Pinnacle's claimed credit for this incident is $36,000.
Incident INC-4602 (November 28, 2022). Pinnacle alleges a service disruption on November 28, 2022 lasting 3 hours and 18 minutes. Pinnacle calculates the monthly uptime for November 2022 at 99.54%, which under the graduated credit structure falls within the 99.50%–99.89% tier, triggering a credit of 10% of the monthly fee. Pinnacle's claimed credit for this incident is $12,000.
Incident INC-4815 (January 9–10, 2023). Pinnacle alleges a service disruption commencing on January 9, 2023 and extending into January 10, 2023, for a total claimed duration of 11 hours and 5 minutes. Pinnacle calculates the monthly uptime for January 2023 at 98.47%, placing it in the below-99.00% tier and triggering the maximum credit of 30% of the monthly fee. Pinnacle's claimed credit for this incident is $36,000.
Incident INC-5033 (March 3–5, 2023). Pinnacle alleges the most severe of the four disruptions, commencing on March 3, 2023 and extending through March 5, 2023, with a total claimed duration of 26 hours and 31 minutes. Pinnacle calculates the monthly uptime for March 2023 at 96.32%, triggering the maximum credit of 30% of the monthly fee. Pinnacle's claimed credit for this incident is $36,000.
In total, Pinnacle claims SLA credits of $120,000 across the four incidents. Beyond the SLA credits, Pinnacle asserts additional damages of $2,750,000, broken down as follows: $1,950,000 in lost revenue from delayed loan originations and missed trading windows; $340,000 in internal remediation costs including manual workarounds, overtime compensation for employees, and temporary licensing fees paid to TrueNorth Data Systems Inc. for use of its competing analytics platform during the outage periods; and $460,000 in estimated reputational harm and client attrition costs, representing the purported value of two wealth-management clients that Pinnacle claims departed its platform due to service unreliability.
The grand total of Pinnacle's demand is $2,870,000.
D. Demand Letter and Engagement Timeline
The relevant procedural and engagement timeline is as follows:
May 1, 2023: Pinnacle's outside counsel, Hargrove, Tillman & Burch LLP, transmitted a formal demand letter to Lumos, addressed to the attention of Adriana Voss, General Counsel. The demand letter is thirteen pages in length and sets forth Pinnacle's factual allegations, legal theories, and claimed damages in the amount of $2,870,000. The letter demands a response within 30 business days and references the mandatory mediation provision in MSA §14.3. A copy of the demand letter is attached as Appendix C.
May 15, 2023: Lumos retained C&H to defend the matter. An engagement letter was executed on this date, and the matter was assigned internal Matter No. 1008-00007. A litigation hold memorandum was issued to all relevant Lumos personnel on the same date, directing preservation of all documents, data, and communications related to the Pinnacle relationship, the four identified incidents, and the MSA.
May 18, 2023: The Pinnacle claim was tendered to Meridian Specialty Insurance Company ("Meridian") under Lumos's Technology Errors & Omissions / Cyber Liability Policy, Policy No. MSI-TECH-2022-07841. The tender was submitted through Lumos's insurance broker, Velthorn Risk Advisors LLC.
We note that no formal litigation has been commenced as of the date of this memorandum. The matter remains at the pre-litigation demand and response stage, and the mandatory mediation requirement under MSA §14.3 must be satisfied before either party may file suit.
III. ANALYSIS OF PINNACLE'S CLAIMS
We turn now to a detailed analysis of each component of Pinnacle's demand, assessing the merits, applicable defenses, and risk of liability for each category of claimed damages.
A. Breach of Contract — SLA Credit Claims ($120,000)
Pinnacle's core contractual claim rests on the allegation that Lumos breached its uptime commitment of 99.95% in four separate calendar months and that Pinnacle is therefore entitled to SLA credits under the graduated credit structure set forth in Exhibit C §3.2. This represents the most straightforward element of Pinnacle's claim and the area where Lumos faces the clearest potential exposure.
Even taking Pinnacle's claimed uptime percentages at face value—which we dispute, as addressed in detail in Section IV.A below—the total SLA credits calculated under the contractual formula would be $120,000. This figure, while not insignificant, is well within the $432,000 annual SLA credit cap established by §3.4 and far below the $1,440,000 aggregate liability cap set forth in §11.2. The contractual framework thus contemplates that SLA credit obligations of this magnitude may arise in the ordinary course of the parties' relationship and has provided clear mechanisms for addressing them.
We note that the SLA credit structure was the product of negotiation between sophisticated commercial parties. The graduated tiers reflect a deliberate allocation of risk in which both parties agreed that specific, formulaic credits—rather than open-ended damages—would compensate the customer for uptime shortfalls. This negotiation history supports our position that the SLA credits represent Pinnacle's exclusive remedy for the uptime failures at issue.
However, as discussed in Section IV.A below, Lumos's own telemetry data—gathered and maintained by its independent third-party monitoring vendor, Sentinel Uptime Services Inc.—records materially shorter outage durations for each of the four incidents. When the Sentinel data is applied to the Exhibit C credit formula, the resulting total credits would be only $90,000, a difference of $30,000 from Pinnacle's calculations. Furthermore, additional affirmative defenses regarding the timeliness of Pinnacle's credit request for INC-4471 and the third-party causation of INC-5033 could further reduce this amount to as low as $30,000. These defenses are analyzed in detail in Section IV below.
B. Consequential and Lost-Revenue Damages ($1,950,000)
The largest single component of Pinnacle's demand is $1,950,000 in lost-revenue damages, which Pinnacle attributes to delayed loan originations and missed trading windows during the four service disruptions. According to the demand letter, Pinnacle's commercial lending division was unable to process certain loan applications during the outage periods, causing delays that resulted in borrowers taking their business to competing lenders. Similarly, Pinnacle's wealth management division allegedly missed certain time-sensitive trading windows, resulting in foregone trading profits and client dissatisfaction.
This claim falls squarely within the category of "indirect, consequential, incidental, special, and lost-profits damages" that are mutually waived under MSA §11.3. Lost revenue, delayed business operations, and foregone profits are textbook examples of consequential damages under well-established California law. The California Commercial Code and extensive case law recognize that lost profits and revenue represent the paradigmatic form of consequential damages, flowing indirectly from a breach rather than constituting the direct and natural consequence of non-performance of the specific contractual obligation.
Under California law, mutual waivers of consequential damages in negotiated commercial agreements between sophisticated parties are generally enforceable and are routinely upheld by courts. California courts have consistently held that such provisions represent a valid exercise of the parties' freedom to contract and allocate risk. The enforceability of consequential damages waivers is well-established in the technology and software licensing context, where such provisions are standard commercial terms.
Several factors strongly support enforceability of §11.3 in this case. First, Pinnacle is a $4.2 billion AUM financial institution with access to sophisticated legal counsel—indeed, Pinnacle was represented by counsel during the MSA negotiation process. Second, the MSA was negotiated over a multi-week period with active participation by both sides, including redline exchanges and commercial discussions. There is no indication that §11.3 was imposed on a take-it-or-leave-it basis or that Pinnacle failed to appreciate its significance. Third, the waiver is mutual—both parties agreed to forego consequential damages claims against the other—which further supports its enforceability and negates any argument that the provision is one-sided or unconscionable. Fourth, there are no indicia of either procedural unconscionability (surprise, oppression, or unequal bargaining power) or substantive unconscionability (unreasonably one-sided terms) that could provide a basis for a court to decline to enforce the provision.
We assess the probability that a California court would enforce §11.3 to bar Pinnacle's $1,950,000 lost-revenue claim as very high—in the range of 85% to 90%. The primary risk of non-enforcement arises in limited scenarios involving willful misconduct, fraud, or gross negligence, where some courts have held that public policy precludes enforcement of contractual liability limitations. However, there is no evidence suggesting that any of these heightened culpability standards apply to the incidents at issue. The service disruptions appear to have resulted from technical failures and, in at least one case, from a third-party configuration change—not from any intentional or reckless conduct by Lumos.
C. Internal Remediation Costs ($340,000)
Pinnacle claims $340,000 in costs incurred to remediate the effects of the service disruptions. According to the demand letter, these costs include: expenses associated with implementing manual workarounds to continue loan processing and risk scoring during the outage periods; overtime compensation paid to employees who worked extended hours to manage the disruptions; and temporary licensing fees paid to TrueNorth Data Systems Inc. for use of its competing analytics platform as a stopgap solution during and after the March 2023 incident (INC-5033).
The characterization of these costs presents a more nuanced analytical challenge than the lost-revenue claim. These remediation costs are arguably characterized in one of two ways: (a) as direct damages flowing from the breach, representing the costs of cover and mitigation that Pinnacle was required to incur to address the service failures; or (b) as consequential damages, representing downstream economic losses that are indirect in nature.
If characterized as consequential damages, the remediation costs are barred by §11.3 under the same analysis set forth above. However, Pinnacle may argue—with some plausible support in the case law—that costs of cover and mitigation are properly classified as direct damages. Under this theory, the temporary licensing of TrueNorth's platform represents a "cover" purchase analogous to a buyer's procurement of substitute goods under UCC §2-712, and the overtime and workaround costs represent the direct cost of substituting for the contracted service during periods of non-availability.
Even if a court were to characterize some or all of the remediation costs as direct damages, Pinnacle's recovery would remain subject to important contractual limitations. First, the $1,440,000 aggregate liability cap in §11.2 would apply, and the remediation costs would be aggregated with any SLA credits awarded. Second, and more significantly, the exclusive remedy provision in Exhibit C §3.1 provides a strong argument for preclusion. Section 3.1 expressly designates the SLA credit mechanism as "Customer's sole and exclusive remedy for Provider's failure to meet the Uptime Commitment." If the remediation costs arise from the same uptime failures that trigger SLA credits, a strong argument exists that the exclusive remedy clause channels Pinnacle's recovery into the credit structure and precludes separate recovery of additional direct damages for the same underlying service level failures.
California law generally enforces exclusive remedy provisions in negotiated commercial contracts, provided they do not entirely fail of their essential purpose. Here, the SLA credit mechanism provides meaningful compensation for uptime shortfalls through a graduated structure that increases credit amounts as uptime declines. The remedy has not failed of its essential purpose, and Pinnacle has in fact claimed and received SLA credits under this structure. The exclusive remedy provision should therefore be given full effect to bar the separate remediation cost claim.
Our risk assessment for this claim component is moderate. There is some risk that a court might allow recovery of certain direct remediation costs over and above SLA credits—particularly the TrueNorth licensing fees, which have the most compelling characterization as cover costs—but strong arguments exist for preclusion under both the exclusive remedy clause and the consequential damages waiver. We estimate the probability that Pinnacle could recover the full $340,000 in remediation costs at approximately 20% to 30%, with a more likely outcome being either complete preclusion or recovery of only a modest portion of the claimed amount.
D. Reputational Harm and Client Attrition ($460,000)
The final component of Pinnacle's demand is $460,000 in damages attributed to reputational harm and client attrition. Specifically, Pinnacle asserts that two of its wealth-management clients terminated their relationships with Pinnacle during or shortly after the period of service disruptions, and that these departures were caused by the unreliability of Pinnacle's platform—which, in turn, Pinnacle attributes to the Lumos outages. Pinnacle estimates the combined value of these two lost client relationships at $460,000.
This claim is clearly consequential and indirect in nature. Lost customer relationships, client attrition, and reputational harm are paradigmatic examples of consequential damages under California law. Such damages are, by definition, the downstream effects of a breach rather than the direct and immediate consequence of non-performance. They are precisely the type of damages that §11.3 was designed to waive, and they fall squarely within the provision's express language barring claims for "loss of goodwill" and "business interruption."
The claim is therefore barred by §11.3 and subject to the same enforceability analysis set forth in Section III.B above. In addition to the contractual bar, Pinnacle would face significant evidentiary challenges in proving causation even if the consequential damages waiver were not enforced. To prevail on this claim, Pinnacle would need to demonstrate that the two wealth-management clients departed specifically because of service disruptions attributable to the Lumos platform, as opposed to any number of other potential reasons for client attrition—including competitive pricing, relationship management issues, changes in the clients' own business needs, market conditions, or dissatisfaction with aspects of Pinnacle's services unrelated to the Lumos platform. Client attrition in the financial services industry is attributable to a complex set of factors, and isolating the Lumos outages as the proximate cause of these specific departures would be a difficult evidentiary burden for Pinnacle to carry.
Our risk assessment for this claim component is very low. We estimate the probability of any material liability on this element at less than 10%, given both the contractual bar under §11.3 and the significant causation challenges Pinnacle would face.
IV. LUMOS'S AFFIRMATIVE DEFENSES
In addition to the contractual limitations on liability analyzed above, Lumos has several affirmative defenses that could further reduce its exposure. We address each in turn.
A. Disputed Uptime Measurements — Sentinel Telemetry Data
A critical factual dispute exists regarding the actual duration of the four service disruptions. Pinnacle's demand letter relies on uptime measurements that, based on our preliminary analysis, appear to overstate the duration of each outage relative to Lumos's independent monitoring data.
Lumos's infrastructure monitoring vendor, Sentinel Uptime Services Inc. ("Sentinel"), maintains independent telemetry logs for all Lumos platform infrastructure on a continuous, automated basis. Sentinel is a well-known third-party monitoring provider headquartered at 2200 Mission College Blvd, Suite 100, Santa Clara, California 95054. The primary contact for this matter is Brenda Hale, Director of Client Engineering. Sentinel's monitoring methodology employs synthetic transaction monitoring, endpoint health checks, and real-time alerting to measure platform availability, and its data is captured and stored independently of both Lumos's and Pinnacle's internal systems.
Sentinel's telemetry data records materially shorter outage durations for each of the four incidents than those claimed by Pinnacle. The following table summarizes the discrepancies:
Based on Sentinel's data, the total SLA credits would be calculated as follows: $24,000 (INC-4471) + $6,000 (INC-4602) + $24,000 (INC-4815) + $36,000 (INC-5033) = $90,000. This represents a $30,000 reduction from Pinnacle's claimed credits of $120,000.
The discrepancy between the two data sets appears to stem from a fundamental difference in measurement methodology. Our preliminary analysis indicates that Pinnacle has been measuring "impacted availability" from the perspective of end-user experience, which includes periods of degraded performance—such as slow response times, intermittent connectivity, and partial functionality limitations—that may not constitute full unavailability of the platform's core functionality. In contrast, Sentinel measures binary up/down status at the platform infrastructure level, recording downtime only when the platform is completely inaccessible.
This distinction is critically important because the contractual definition of "Downtime" in Exhibit C §1.3 expressly defines downtime as the "complete inability to access the Platform's core functionality" and explicitly excludes "periods of degraded performance." Sentinel's measurement methodology is therefore consistent with the contractual definition, while Pinnacle's broader measurement methodology captures periods that do not qualify as "Downtime" under the MSA.
To maximize the evidentiary value of the Sentinel data, we recommend the following steps: First, obtain a formal certification from Brenda Hale at Sentinel confirming the monitoring methodology used, the integrity of the data capture and storage processes (including chain of custody), and the specific outage start and end timestamps recorded for each of the four incidents. Second, prepare a detailed comparative analysis of the Sentinel data against Pinnacle's claimed measurements, identifying the specific periods of "degraded performance" that Pinnacle appears to have incorrectly included in its downtime calculations. Jeffrey Park is currently preparing this detailed uptime data analysis memorandum and expects to have a preliminary draft available for review by June 9, 2023.
B. Late Credit Request — INC-4471 (October 2022 Incident)
A procedural defense with substantial merit exists with respect to Pinnacle's credit request for the October 2022 incident (INC-4471). Exhibit C §3.5 establishes a mandatory procedural requirement that the customer must submit a written credit request within 30 calendar days of the end of the affected calendar month, specifying the affected services and observed downtime. This requirement is framed as a condition precedent to credit eligibility, not merely an aspirational guideline.
The relevant timeline is as follows: INC-4471 occurred on October 12–13, 2022. The affected calendar month was October 2022, which ended on October 31, 2022. Adding the 30-calendar-day submission window, the deadline for Pinnacle to submit a written credit request was November 30, 2022. However, our records indicate that Pinnacle did not submit its credit request for INC-4471 until December 14, 2022—44 days after the end of October and 14 days beyond the contractual deadline.
Lumos contends that this credit request is time-barred by the plain terms of §3.5 and that Pinnacle has forfeited its right to receive a credit for INC-4471. If this defense is sustained, it would eliminate the $36,000 credit claim for INC-4471 (under Pinnacle's calculation) or the $24,000 credit (under the Sentinel-based calculation), thereby reducing Lumos's total SLA credit exposure.
Under California law, contractual notice and claim deadlines are generally enforceable as conditions precedent to recovery, particularly in negotiated commercial agreements between sophisticated parties. Courts have consistently held that compliance with contractual notice provisions is a prerequisite to the recovery of contractual remedies, and that failure to comply within the specified timeframe results in forfeiture of the right to claim the remedy. This principle is well-established in the context of insurance policies, construction contracts, and commercial service agreements, all of which frequently include time-limited notice requirements analogous to §3.5.
The principal risk to this defense is the possibility that Pinnacle could argue waiver or course of dealing. Specifically, if Lumos has in the past accepted late credit requests from Pinnacle or from other customers without objection, Pinnacle could argue that Lumos's prior conduct constituted a waiver of strict compliance with the 30-day deadline or established a course of dealing that modified the contractual requirement. Under California Civil Code §1697, a contract in writing may be modified by an executed oral agreement or by the conduct of the parties. Similarly, if Lumos's customer success team routinely processed credit requests submitted after the 30-day window, a court might find an implied waiver or modification.
To assess this risk, we urgently need to confirm with Rachel Dominguez, Lumos's Vice President of Customer Success, whether Lumos has ever previously accepted late credit requests from Pinnacle or from any other customer. If Lumos has a consistent practice of enforcing the 30-day deadline and rejecting or noting late submissions, this defense is substantially strengthened. If, conversely, there is a history of accepting late requests without comment, additional analysis will be required to determine whether the waiver argument can be overcome—for example, by demonstrating that acceptance of late requests was discretionary rather than obligatory, or that Lumos reserved its right to enforce the deadline.
We assess this as a strong defense, with an estimated probability of success of approximately 70% to 75%, subject to the outcome of the factual investigation regarding prior course of dealing.
C. SLA Credit Cap — §3.4
Even if all four of Pinnacle's credit claims are deemed valid and calculated at Pinnacle's higher claimed amounts, the total SLA credit obligation of $120,000 remains well within the $432,000 cap established by §3.4 for any rolling twelve-month period. The credit cap is therefore not currently operative as a binding constraint on the specific credits at issue. However, the cap serves two important strategic purposes in Lumos's defense.
First, the cap functions as an absolute ceiling on Lumos's SLA credit exposure. In the worst case, even if additional incidents were to arise during the remaining months of the MSA term, Lumos's maximum SLA credit obligation in any twelve-month period cannot exceed $432,000. This provides important certainty and risk limitation.
Second, and perhaps more important for the current dispute, the credit cap serves as a powerful framing tool when responding to Pinnacle's $2,870,000 demand. The parties negotiated and agreed that the maximum available SLA credit remedy in any twelve-month period would be $432,000. Pinnacle's demand for $2,870,000—nearly seven times the annual credit cap—dramatically exceeds the contractually agreed framework for addressing service level failures and underscores the extent to which Pinnacle's claim relies on consequential and other extra-contractual damages that are barred by §11.3. The gap between the negotiated credit cap and Pinnacle's demand effectively illustrates that the vast majority of the claim seeks recovery that falls outside the parties' bargained-for allocation of risk.
D. Mutual Waiver of Consequential Damages — §11.3
As analyzed in Sections III.B through III.D above, the mutual waiver of consequential damages in §11.3 represents Lumos's single most powerful defense. This provision bars $2,750,000 of Pinnacle's $2,870,000 total demand—comprising the $1,950,000 lost-revenue claim, the $340,000 remediation cost claim (to the extent characterized as consequential damages), and the $460,000 reputational harm and client attrition claim.
California law provides strong support for the enforceability of mutual consequential damages waivers in negotiated commercial contracts between sophisticated parties. The California Civil Code, augmented by extensive case law, establishes that parties to a commercial agreement are free to allocate risk through contractual limitations on liability, including waivers of consequential damages, provided that the provisions are not unconscionable and do not violate public policy. Courts have consistently enforced such provisions in the technology and software licensing context, recognizing that they serve important commercial purposes by providing certainty, limiting tail risk, and enabling parties to price their services based on a known risk profile.
The factors favoring enforceability in this case are overwhelming. The MSA was negotiated at arms' length between sophisticated commercial parties, both of which were represented by counsel. The waiver is mutual—applying equally to both Lumos and Pinnacle—which negates any argument of one-sidedness. The provision uses clear, unambiguous language that specifically enumerates the categories of damages being waived, including "loss of revenue" and "loss of goodwill," which directly correspond to Pinnacle's lost-revenue and reputational harm claims. There are no facts suggesting fraud, willful misconduct, or gross negligence by Lumos that could provide a basis for a court to override the provision on public policy grounds. And Pinnacle, as a multi-billion-dollar financial institution, cannot credibly argue that it lacked the sophistication or bargaining power to understand and negotiate the consequential damages waiver.
Even the $340,000 remediation cost claim, which presents the most nuanced characterization issue, is likely barred under either §11.3 (as consequential damages) or Exhibit C §3.1 (as damages precluded by the exclusive remedy provision). The combination of these two contractual provisions creates a robust defense against any attempt by Pinnacle to recover damages beyond the SLA credit structure.
E. Third-Party Cause — INC-5033 (March 2023 Incident)
An important affirmative defense exists with respect to the most severe of the four incidents—INC-5033, the March 3–5, 2023 disruption that Pinnacle claims lasted 26 hours and 31 minutes (or 14 hours and 8 minutes per Sentinel data). An investigation conducted by Thomas Kwan, Lumos's Director of Site Reliability Engineering, and his engineering team has identified that the root cause of INC-5033 was a configuration change implemented within Pinnacle's own cloud infrastructure environment hosted by Brindoval Cloud Infrastructure LLC ("Brindoval"), Pinnacle's infrastructure-as-a-service ("IaaS") provider.
Specifically, the investigation determined that Brindoval executed a network routing configuration change affecting the virtual private cloud ("VPC") peering connections between Pinnacle's Brindoval-hosted environment and the Lumos platform. This configuration change disrupted the connectivity pathway between Pinnacle's infrastructure and Lumos's services, causing the platform to become inaccessible from Pinnacle's environment. The disruption was not caused by any failure of the Lumos platform itself, which remained fully operational and accessible to other customers throughout the incident period.
This finding directly implicates the exclusion set forth in Exhibit C §2.3, which expressly excludes from the uptime calculation any downtime "attributable to customer infrastructure or third-party services not provided by [Lumos]." Brindoval Cloud Infrastructure LLC is Pinnacle's vendor, not Lumos's. The MSA between Lumos and Pinnacle does not include Brindoval's services within the scope of Lumos's obligations. Accordingly, downtime caused by a Brindoval configuration change falls squarely within the §2.3 exclusion and should be excluded from the uptime calculation for March 2023.
If this defense is sustained, the entirety of INC-5033 is excluded from the uptime calculation, which would eliminate the $36,000 credit claim under both parties' calculations and further reduce Lumos's total SLA credit exposure. Combined with the timeliness defense for INC-4471, successful assertion of the third-party cause defense would reduce total credits to $30,000 (per Sentinel data) or $48,000 (per Pinnacle's measurements).
To support this defense, we need to obtain and preserve the following categories of evidence: (i) the complete root cause analysis documentation prepared by Thomas Kwan's team, including all supporting technical data, network logs, and analysis memoranda; (ii) any communications between Pinnacle's IT department and Brindoval Cloud Infrastructure LLC regarding the configuration change, which may be obtainable through discovery if this matter proceeds to litigation; (iii) Lumos platform availability data for other customers during the INC-5033 timeframe, which would demonstrate that the platform remained operational for all customers other than Pinnacle; and (iv) any Brindoval change management records or notifications related to the March 2023 configuration change.
We assess this as a strong defense on the merits, though its ultimate success will depend on the strength of the evidentiary record. The principal risk is that Pinnacle may argue that even if the Brindoval configuration change triggered the incident, Lumos should have designed its platform to be resilient to such changes, or that Lumos bore some responsibility for the connectivity pathway between Pinnacle's environment and the Lumos platform. We estimate the probability of success for this defense at approximately 65% to 70%, which could improve as we develop the evidentiary record.
F. Failure to Mitigate — Disaster Recovery Failover
A supplemental defense exists based on Pinnacle's failure to activate available disaster-recovery capabilities during the two longest-duration incidents. Under the MSA, Pinnacle had access to Lumos's designated disaster-recovery environment, identified as US-West-2, as a failover option in the event of a primary service disruption. The MSA documentation and onboarding materials provided to Pinnacle include instructions for initiating failover to the US-West-2 environment, and Pinnacle's technical team was trained on the failover procedure during the implementation phase.
Despite the availability of this failover capability, Pinnacle did not activate failover to US-West-2 during either INC-4815 (the January 9–10, 2023 incident, with a Sentinel-measured duration of 6 hours 22 minutes) or INC-5033 (the March 3–5, 2023 incident, with a Sentinel-measured duration of 14 hours 8 minutes). These were the two longest-duration incidents and represent the periods during which Pinnacle claims to have suffered the most significant business impact. Had Pinnacle activated the failover capability, the total downtime experienced for these incidents would have been materially reduced, as the US-West-2 environment was operational and available throughout both incident periods.
Under California law, a party claiming breach of contract has a duty to take reasonable steps to mitigate its damages. Failure to mitigate does not bar a claim entirely but reduces the recoverable damages to the extent that reasonable mitigation efforts would have avoided or reduced the harm. California Civil Code §3300 and related case law establish that a plaintiff cannot recover damages that could have been avoided through the exercise of reasonable diligence.
This defense is most directly relevant to Pinnacle's consequential and remediation damages claims, which we believe are already barred by §11.3 in any event. However, the failure-to-mitigate argument could also affect the SLA credit calculation if Pinnacle's uptime measurement includes time during which a contractually available workaround remained unused. Additionally, the failure-to-mitigate defense serves as useful leverage in settlement negotiations, as it highlights Pinnacle's own role in exacerbating the impact of the service disruptions.
We assess this as a moderate defense. It is useful as a supplemental argument and as settlement leverage, but it is less clear-cut as a standalone litigation defense for SLA credit purposes, given that the SLA credit structure is mechanical in nature and does not expressly incorporate a mitigation requirement.
V. RISK EXPOSURE ASSESSMENT
Based on the foregoing analysis, we present the following assessment of Lumos's potential exposure across a range of scenarios.
A. Best Case Scenario
In the best case, all of Lumos's defenses are successful:
• All consequential damages ($2,750,000) are barred by the mutual waiver in §11.3, eliminating the lost-revenue, remediation, and reputational harm claims in their entirety.
• The INC-4471 credit request is held time-barred under §3.5, eliminating the credit claim for that incident ($24,000 per Sentinel data).
• INC-5033 is excluded from the uptime calculation under §2.3 as attributable to a third-party cause (Brindoval configuration change), eliminating the credit claim for that incident ($36,000 under both parties' calculations).
• The remaining credits for INC-4602 and INC-4815 are calculated using Sentinel's telemetry data, yielding credits of $6,000 and $24,000, respectively.
Best case total exposure: approximately $30,000.
B. Moderate / Most Likely Scenario
In the scenario we consider most likely based on the current state of the evidence and applicable law:
• All consequential damages ($2,750,000) are barred by §11.3. We assess the probability of this outcome at 85% to 90%.
• The INC-4471 timeliness defense succeeds, eliminating the credit for that incident. We assess the probability of success at 70% to 75%, subject to the results of our investigation into prior course of dealing.
• The INC-5033 third-party cause defense is partially successful or is used effectively as leverage in settlement negotiations to reduce or eliminate the credit for that incident. The probability of complete success on the merits is estimated at 65% to 70%.
• SLA credits for the remaining incidents are calculated using Sentinel data, which more accurately reflects the contractual definition of "Downtime."
Most likely exposure range: approximately $54,000 to $90,000 in SLA credits.
The lower end of this range ($54,000) reflects the scenario in which both the INC-4471 timeliness defense and the INC-5033 third-party cause defense succeed, and credits for INC-4602 and INC-4815 are calculated at Sentinel levels ($6,000 + $24,000 = $30,000), plus a modest additional amount for potential partial concessions on INC-5033 in a mediated settlement. The upper end ($90,000) reflects the scenario in which the INC-5033 defense does not fully succeed but Sentinel data is used for all calculations.
C. Worst Case Scenario
In the worst case—which we emphasize remains well below Pinnacle's $2,870,000 demand—the following occurs:
• Section 11.3 is enforced, barring all consequential damages. However, all four SLA credit claims are held valid at Pinnacle's asserted uptime levels (i.e., Sentinel data is not accepted or the court defers to Pinnacle's measurements).
• The INC-4471 timeliness defense fails on waiver or course-of-dealing grounds.
• The INC-5033 third-party cause defense is unsuccessful.
• The $340,000 in remediation costs is characterized as direct damages not barred by §11.3 or the exclusive remedy clause, and Pinnacle is awarded the full claimed amount.
Under this scenario, total exposure would be $120,000 (SLA credits at Pinnacle's levels) plus $340,000 (remediation costs) = $460,000. This amount remains well below the $1,440,000 aggregate liability cap under §11.2. We note that the $432,000 SLA credit cap under §3.4 would not independently limit the total in this scenario if the remediation costs are treated as a separate category of damages distinct from SLA credits.
Worst case exposure: approximately $460,000.
We also note, for completeness, a catastrophic scenario in which §11.3 is held unenforceable—which we assess as highly unlikely given the strength of the enforceability arguments. Even in that remote scenario, the aggregate liability cap of $1,440,000 under §11.2 would serve as an absolute ceiling on Lumos's exposure, reducing Pinnacle's $2,870,000 demand to no more than $1,440,000. This represents the maximum theoretical exposure under any combination of adverse outcomes.
D. Summary Risk Matrix
The following table summarizes the exposure analysis across all scenarios:
*Theoretical maximum if §11.3 deemed unenforceable; total limited by §11.2 aggregate liability cap of $1,440,000.
The probability-weighted expected exposure, based on the foregoing analysis, is approximately $80,000 to $140,000.
VI. INSURANCE COVERAGE CONSIDERATIONS
On May 18, 2023, Lumos tendered the Pinnacle claim to Meridian Specialty Insurance Company ("Meridian") under its Technology Errors & Omissions / Cyber Liability insurance policy, Policy No. MSI-TECH-2022-07841. The tender was submitted through Lumos's insurance broker, Velthorn Risk Advisors LLC (primary contact: Neil Frazier, Senior Vice President).
The relevant policy parameters are as follows:
Policy Period: July 1, 2022 through July 1, 2023. All four of the incidents identified in Pinnacle's demand either occurred during or straddle this policy period. Specifically, INC-4471 (October 12–13, 2022) and INC-4602 (November 28, 2022) occurred entirely within the policy period. INC-4815 (January 9–10, 2023) and INC-5033 (March 3–5, 2023) also occurred within the policy period. Pinnacle's demand letter, which constitutes the first formal claim, was transmitted on May 1, 2023—also within the policy period. Accordingly, all temporal coverage requirements should be satisfied.
Per-Occurrence Limit: $5,000,000.
Aggregate Limit: $10,000,000.
Self-Insured Retention (SIR): $250,000 per claim. The SIR must be exhausted by Lumos before Meridian's indemnity obligations are triggered. Importantly, defense costs—including C&H's fees—erode and apply against the SIR.
On June 2, 2023, Meridian issued a reservation of rights letter acknowledging coverage of the Pinnacle claim subject to the SIR and reserving its rights with respect to certain policy conditions and exclusions. The claims contact at Meridian is Patricia Engel, Senior Claims Examiner. We have reviewed the reservation of rights letter and note that Meridian's reservations relate primarily to standard coverage conditions (timely notice, cooperation, and consent-to-settle requirements) rather than substantive coverage exclusions. We do not currently anticipate a coverage dispute with Meridian, but we will continue to monitor the situation.
From a practical standpoint, the relationship between the SIR and our exposure assessment merits careful consideration. Given our assessment that total exposure in the most likely scenario is $54,000 to $90,000—and even in the worst case is approximately $460,000—the practical significance of the insurance coverage may be limited. The SIR of $250,000 alone may exceed the ultimate resolution amount in the most likely scenario, meaning that Lumos would bear the full cost of resolution without triggering Meridian's indemnity obligations. Even in the worst-case scenario ($460,000), only $210,000 in indemnity payments would exceed the SIR.
However, the SIR also encompasses defense costs. Based on our fee estimates (discussed in Section VIII below), defense costs through mediation and settlement could range from $175,000 to $250,000. If combined with a settlement payment or judgment in the most likely range of $54,000 to $90,000, total costs could approach or exceed the $250,000 SIR, potentially triggering Meridian's obligation to fund additional defense costs and indemnity payments.
We recommend the following with respect to insurance matters:
1. Maintain regular communication with Meridian and Patricia Engel regarding the status and progress of the matter, consistent with the policy's cooperation and reporting obligations.
2. Keep Velthorn Risk Advisors LLC and Neil Frazier informed of material developments.
3. Comply with all consent-to-settle requirements under the policy before entering into any settlement agreement.
4. Track and document all defense costs and indemnity-related expenses against the SIR.
5. Evaluate whether a settlement structured as service credits (rather than cash payments) may fall outside the scope of covered "loss" under the policy, and if so, whether that affects Lumos's strategic calculus regarding the form of any resolution.
VII. STRATEGIC RECOMMENDATIONS
Based on the foregoing analysis, we recommend the following strategic approach to the defense and resolution of this matter.
A. Immediate Actions
The following actions should be completed on an expedited basis:
1. Complete Evidence Preservation. We must finalize implementation of the litigation hold issued on May 15, 2023 and verify that all relevant data and documents are being preserved. This includes, without limitation: Sentinel Uptime Services telemetry data and monitoring logs for the period September 2022 through April 2023; Lumos's internal incident management records, including incident tickets, root cause analyses, post-mortem reports, and engineering communications for all four incidents; Brindoval Cloud Infrastructure LLC change logs and configuration records relevant to INC-5033 (to the extent within Lumos's possession or accessible through Pinnacle); all correspondence between Lumos and Pinnacle regarding the four incidents, including email communications, support tickets, and account management records; and all internal Lumos communications regarding the Pinnacle relationship, service level performance, and the incidents at issue. Jeffrey Park is overseeing the litigation hold implementation and should provide a compliance certification by June 12, 2023.
2. Sentinel Data Certification. We should promptly obtain a formal written certification from Brenda Hale at Sentinel Uptime Services Inc. confirming: (a) the monitoring methodology used to measure Lumos platform availability; (b) the data integrity and chain-of-custody protocols governing the capture, storage, and retrieval of telemetry data; (c) the specific outage start and end timestamps recorded for each of the four incidents; and (d) a statement confirming that Sentinel's monitoring methodology measures binary platform availability consistent with the contractual definition of "Downtime" in Exhibit C §1.3, excluding periods of degraded performance. This certification will be essential both for purposes of responding to Pinnacle's demand and, if necessary, for use as evidence in mediation or litigation.
3. Root Cause Documentation for INC-5033. We should work with Thomas Kwan and his site reliability engineering team to compile a comprehensive root cause analysis package for INC-5033, documenting the Brindoval Cloud Infrastructure LLC configuration change as the triggering cause of the March 2023 incident. This package should include: (a) a written root cause analysis narrative; (b) supporting network logs, configuration change records, and technical data; (c) a timeline of events showing the sequence of the Brindoval change and the resulting service disruption; (d) data showing that the Lumos platform remained fully operational and accessible to all other customers during the INC-5033 timeframe; and (e) any communications between Lumos's engineering team and Pinnacle's IT staff during the incident that may corroborate the third-party cause finding. This documentation package should be completed by June 16, 2023.
4. Historical Credit Request Review. We must confirm with Rachel Dominguez, Lumos's Vice President of Customer Success, whether Lumos has ever accepted late credit requests from Pinnacle or from any other customer. This investigation is essential to assess the viability of the INC-4471 timeliness defense and to evaluate the risk of a waiver or course-of-dealing argument. Ms. Dominguez should be asked to review Lumos's records of all SLA credit requests received from any customer over the past three years, noting: (a) the date each request was received; (b) whether each request was timely under the applicable contractual deadline; (c) whether any late requests were accepted; and (d) whether any late requests were rejected with reference to the contractual deadline. Simone Laroche will coordinate this inquiry.
B. Response to Demand Letter
We recommend preparing and transmitting a detailed written response to Hargrove, Tillman & Burch LLP rejecting Pinnacle's $2,870,000 demand and setting forth Lumos's principal defenses. The response should address the following points:
• State clearly that Lumos rejects the demand in its entirety as lacking merit under the express terms of the MSA.
• Identify and assert the mutual consequential damages waiver in §11.3 as barring the $1,950,000 lost-revenue claim, the $460,000 reputational harm claim, and the $340,000 remediation cost claim (to the extent characterized as consequential damages).
• Asse