MEMORANDUM
PRIVILEGED & CONFIDENTIAL ATTORNEY WORK PRODUCT
TO: Daniel Ostroff, Vice President, Legal & Compliance, Lumos Analytics Inc.
FROM: Howard Bellamy, Partner, and Leila Nazari, Associate, Calderwood & Harkness LLP
DATE: March 18, 2024
RE: Indemnification & Liability Cap Analysis — Channel Reseller Program Agreement between Lumos Analytics Inc. and Meridian Data Solutions GmbH
MATTER NO.: 1008-00010
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to provide Lumos Analytics Inc. ("Lumos") with a comprehensive analysis of the indemnification framework and liability cap structure negotiated in the Channel Reseller Program Agreement (the "Agreement") between Lumos and Meridian Data Solutions GmbH ("Meridian"). The Agreement governs the distribution and resale of the Lumos Prism™ AI-driven financial analytics and risk-modeling SaaS platform across the Europe, Middle East, and Africa ("EMEA") territory. This memorandum has been prepared at the request of Daniel Ostroff, Vice President, Legal & Compliance, in connection with Lumos's internal review and board-level reporting obligations prior to the Agreement's effective date.
The Agreement contemplates an aggregate Total Contract Value ("TCV") of $30,000,000 over a five-year initial term commencing on April 1, 2024, and ending on March 31, 2029. Given the magnitude of the financial commitment, the cross-border nature of the arrangement, and the regulatory complexity inherent in the EMEA distribution of an AI-driven financial technology platform, the indemnification and liability cap provisions are among the most commercially significant terms in the Agreement.
This memorandum addresses the following topics in detail:
(a) The mutual indemnification obligations of Lumos and Meridian, including the specific categories of third-party claims covered by each party's indemnification undertakings;
(b) The aggregate indemnification liability cap of $15,000,000, representing 50% of the TCV, together with an analysis of the cap's adequacy and market positioning;
(c) The carve-outs from the aggregate cap for specified categories of liability, including willful misconduct or fraud, breaches of confidentiality, and intellectual property infringement, each of which is treated as uncapped under the Agreement;
(d) The 5% escrow holdback mechanism administered by Evergreen Trust Company, N.A., including the quarterly holdback amounts, the payment flow, the escrow release mechanics, and the interaction between the escrow fund and the aggregate indemnification cap;
(e) The procedural requirements governing the assertion, defense, and settlement of indemnification claims, including notice obligations, rights to control the defense, consent-to-settlement provisions, and cooperation duties; and
(f) An overall risk assessment of the indemnification framework, together with specific recommendations for ongoing monitoring and risk mitigation.
The Agreement is governed by the laws of the State of California, without regard to conflict-of-laws principles. Disputes arising under the Agreement are subject to binding arbitration administered by JAMS in Los Angeles, California, with a carve-out permitting either party to seek injunctive or other equitable relief in the state or federal courts located in Santa Clara County, California.
Meridian was represented throughout the negotiation by Kessler Hartmann Rechtsanwälte PartG mbB, with Dr. Stefan Kessler serving as lead partner and Laura Pfeiffer serving as associate counsel. Kessler Hartmann's offices are located at Maximilianstraße 35, 80539 München, Germany. The negotiation proceeded over approximately four weeks and involved three substantive draft exchanges, resulting in the final form of the Agreement that is the subject of this analysis.
As set forth in greater detail below, it is our view that the indemnification and liability cap framework negotiated in the Agreement is commercially balanced, appropriately allocates risk between the parties, and is consistent with prevailing market standards for enterprise SaaS channel reseller agreements of comparable size and term length.
II. Background and Deal Structure
A. The Parties
Lumos Analytics Inc. Lumos is a Delaware C-Corporation with its principal offices located at 4700 Sandhill Road, Suite 300, Palo Alto, California 94304 (EIN: 84-3291056). Lumos is the developer and licensor of the Lumos Prism™ platform, a proprietary AI-driven financial analytics and risk-modeling SaaS solution designed for enterprise-grade financial institutions, asset managers, insurance carriers, and corporate treasury operations. The Lumos Prism™ platform incorporates machine-learning models, proprietary data pipelines, and advanced statistical algorithms to deliver real-time risk assessment, scenario modeling, and regulatory compliance analytics.
Lumos is majority-owned by Crestline Capital Partners, LP, a growth-equity private equity fund that holds approximately 62.3% of Lumos's outstanding equity on a fully diluted basis. Jonathan Whitfield serves as Managing Partner of Crestline Capital Partners, and Rebecca Solari serves as Portfolio Operations Partner with primary oversight of the Lumos portfolio investment. The Crestline ownership structure is relevant to this analysis because certain board-level reporting requirements and investment committee approvals apply to material indemnification and liability provisions in significant commercial agreements.
Meridian Data Solutions GmbH. Meridian is a German limited liability company (Gesellschaft mit beschränkter Haftung) registered at Leopoldstraße 78, 80802 München, Germany, with the Amtsgericht München under registration number HRB 274581 (VAT ID: DE319274105). Meridian operates as a multi-vendor enterprise software reseller and value-added distributor across the EMEA region, with a portfolio of over 40 vendor relationships spanning enterprise software, cloud infrastructure, data analytics, and cybersecurity solutions. Meridian's operational maturity and established EMEA distribution infrastructure were among the principal commercial rationales for Lumos's selection of Meridian as an authorized reseller for the Lumos Prism™ platform.
B. Agreement Type and Structure
The Agreement is structured as a Channel Reseller Program Agreement — a Technology Transactions instrument pursuant to which Lumos appoints Meridian as a non-exclusive authorized reseller of the Lumos Prism™ platform within the EMEA Territory. The appointment is non-exclusive in nature, and Lumos expressly retains the right to appoint additional resellers, distributors, or agents within the EMEA Territory and to sell the Lumos Prism™ platform directly to end users within the EMEA Territory without restriction. This non-exclusivity provision is significant from a risk-allocation perspective, as it limits Lumos's channel concentration risk and preserves strategic flexibility.
Under the Agreement, Meridian is authorized to market, promote, demonstrate, and resell subscriptions to the Lumos Prism™ platform to qualified end users in the EMEA Territory, subject to compliance with the Trademark License & Brand Guidelines set forth in Exhibit D to the Agreement, the technical integration requirements set forth in Exhibit B, and the pricing and discount structures set forth in Exhibit A.
C. Pre-Approved Sub-Distributors
The Agreement authorizes Meridian to engage two pre-approved sub-distributors to assist with distribution activities in designated sub-regions of the EMEA Territory:
(i) Meridian Data Solutions UK Ltd — authorized for the United Kingdom and Ireland sub-territory. Meridian UK is a private limited company incorporated in England and Wales (Companies House No. 12847391), with Katarina Voss serving as Director.
(ii) Meridian Data Solutions SARL — authorized for the France, Belgium, Luxembourg, and French-speaking Switzerland sub-territory. Meridian France is a société à responsabilité limitée registered in France (SIREN: 912 483 057), with Jean-Philippe Moreau serving as Gérant.
As discussed further in Section XI below, the sub-distributors are not direct parties to the Agreement and are not directly bound by the indemnification provisions of the master Agreement, which creates a potential gap in Lumos's indemnification protection with respect to claims arising from sub-distributor activities.
D. Key Financial Terms
The following financial terms of the Agreement are relevant to the indemnification and liability cap analysis:
The Minimum Annual Commitment ("MAC") schedule, which governs the minimum purchase obligations of Meridian over the five-year initial term, is structured as follows:
The MAC schedule reflects a ramp structure in Years 1 through 3, with a plateau in Years 4 and 5, consistent with the anticipated timeline for Meridian to build market penetration and achieve steady-state revenue in the EMEA Territory. These MAC amounts serve as the basis for calculating the quarterly escrow holdback amounts discussed in Section VI below.
E. Execution and Effective Date
The Agreement was signed by both parties on March 22, 2024, and has an effective date of April 1, 2024.
III. Lumos's Indemnification Obligations
A. Scope of Indemnification
Pursuant to Section 10.1 of the Agreement, Lumos shall indemnify, defend, and hold harmless Meridian, its affiliates, and their respective officers, directors, employees, and agents (collectively, the "Meridian Indemnified Parties") against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of litigation or arbitration) arising from or related to third-party claims in the following categories:
1. Intellectual Property Infringement. Lumos is obligated to indemnify the Meridian Indemnified Parties against any third-party claim alleging that the Lumos Prism™ platform, as provided by Lumos under the Agreement and used by Meridian in accordance with the terms of the Agreement, infringes upon or misappropriates any third-party intellectual property rights, including patents, copyrights, trade secrets, and trademarks. This indemnification obligation is the broadest of Lumos's undertakings and is appropriately allocated to Lumos as the developer and owner of the underlying platform technology.
The IP infringement indemnification is subject to customary exclusions: it does not apply to the extent that an infringement claim arises from (a) modifications to the Lumos Prism™ platform made by Meridian or any third party without Lumos's prior written authorization, (b) combination of the Lumos Prism™ platform with third-party products, services, or technologies not approved or contemplated by Lumos, or (c) Meridian's continued use of an allegedly infringing version of the platform after Lumos has provided a non-infringing replacement or update. These exclusions are standard in technology licensing agreements and are consistent with prevailing California law on IP indemnification.
2. Data Protection Breach. Lumos is obligated to indemnify the Meridian Indemnified Parties against third-party claims arising from Lumos's breach of applicable data-protection laws, including Regulation (EU) 2016/679 (the "GDPR") and the UK General Data Protection Regulation (the "UK GDPR"), but only to the extent that such breach is solely caused by Lumos's acts or omissions. This "sole causation" limitation is a critical qualification that was the subject of significant negotiation with Kessler Hartmann.
The data-protection obligations of the parties are further governed by the Data Processing Agreement attached to the Agreement as Exhibit C (the "DPA"). The DPA incorporates Standard Contractual Clauses Module Two (Controller-to-Processor) for the transfer of personal data from the European Economic Area and the United Kingdom to the United States, consistent with the requirements of the European Commission's implementing decision on standard contractual clauses for the transfer of personal data to third countries. The Lumos Prism™ platform's primary data processing infrastructure for EMEA end-user data is hosted at the Stratos Cloud Services AG data center in Frankfurt, Germany, which provides a degree of data localization that mitigates, but does not eliminate, cross-border data transfer risks.
3. Death or Bodily Injury. Lumos is obligated to indemnify the Meridian Indemnified Parties against third-party claims for death or bodily injury caused by Lumos's gross negligence. While the likelihood of death or bodily injury claims arising from a SaaS financial analytics platform is low, this provision is included as a standard risk-allocation measure. The gross negligence threshold is higher than ordinary negligence and appropriately limits Lumos's exposure to circumstances involving a material departure from the standard of care.
B. Analysis of Risk Exposure
Of the three categories of Lumos's indemnification obligations, IP infringement presents the most significant risk exposure. The Lumos Prism™ platform operates in the AI-driven financial analytics space, which is characterized by an active and rapidly evolving patent landscape. The financial technology sector has experienced a marked increase in patent-assertion activity in recent years, both from operating-company competitors and from non-practicing entities (commonly referred to as "patent trolls"). The risk is further elevated by the fact that the Lumos Prism™ platform incorporates machine-learning algorithms and proprietary data-processing methodologies that may overlap with broadly drafted patent claims held by third parties.
Importantly, the IP infringement indemnification obligation is carved out from the $15,000,000 aggregate indemnification cap, as discussed in Section V.B below. This means that Lumos's exposure for IP infringement claims is uncapped under the Agreement. While this represents a potentially significant financial commitment, it is appropriate given that Lumos possesses superior knowledge and control of the underlying technology and is in the best position to evaluate, mitigate, and manage IP infringement risk through its own patent clearance, freedom-to-operate analyses, and product-development decisions.
The data-protection indemnification exposure is meaningfully limited by the sole-causation requirement negotiated by Calderwood & Harkness. Under this formulation, Lumos's indemnification obligation is triggered only when a data-protection breach is solely caused by Lumos's acts or omissions. Shared-fault scenarios — for example, situations in which a data breach results from a combination of Lumos's platform vulnerability and Meridian's failure to implement required security configurations — fall outside the scope of Lumos's indemnification obligation. This is a favorable outcome for Lumos and reflects a departure from the broader "arising from" formulation initially proposed by Kessler Hartmann in Meridian's first markup.
The gross negligence threshold for bodily injury claims imposes a higher standard of culpability than ordinary negligence, which further limits Lumos's exposure. Given the nature of the Lumos Prism™ platform as a software-as-a-service offering, the probability of bodily injury or death claims is remote, and this provision is primarily included for completeness in the risk-allocation framework.
IV. Meridian's Indemnification Obligations
A. Scope of Indemnification
Pursuant to Section 10.2 of the Agreement, Meridian shall indemnify, defend, and hold harmless Lumos, its affiliates, and their respective officers, directors, employees, and agents (collectively, the "Lumos Indemnified Parties") against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of litigation or arbitration) arising from or related to third-party claims in the following categories:
1. Marketing and Misrepresentation. Meridian is obligated to indemnify the Lumos Indemnified Parties against third-party claims arising from Meridian's marketing, promotion, or misrepresentation of the Lumos Prism™ platform to end users in the EMEA Territory. This obligation encompasses claims resulting from false, misleading, inaccurate, or unauthorized statements made by Meridian or its personnel regarding the capabilities, features, performance, regulatory compliance, or suitability of the Lumos Prism™ platform. It also extends to claims arising from marketing materials, presentations, demonstrations, or other promotional activities conducted by Meridian that are not in compliance with the Trademark License & Brand Guidelines set forth in Exhibit D to the Agreement.
2. Breach of Agreement or Applicable Law. Meridian is obligated to indemnify the Lumos Indemnified Parties against third-party claims arising from Meridian's breach of the Agreement or applicable law, including any local laws, regulations, directives, or administrative requirements applicable to Meridian's distribution and resale activities in the EMEA Territory. This is a broad catch-all indemnification that provides Lumos with protection against downstream regulatory and contractual exposure resulting from Meridian's non-compliance.
3. Unauthorized Modifications. Meridian is obligated to indemnify the Lumos Indemnified Parties against third-party claims arising from Meridian's unauthorized modifications, reverse-engineering, decompilation, disassembly, or creation of derivative works of the Lumos Prism™ platform. The Agreement's IP provisions expressly prohibit Meridian from engaging in any of these activities, and this indemnification obligation reinforces the prohibition by allocating the financial consequences of any violation to Meridian. This protection is critical to preserving Lumos's intellectual property rights and the integrity of the Lumos Prism™ platform.
4. Export Control and Sanctions Violations. Meridian is obligated to indemnify the Lumos Indemnified Parties against third-party claims arising from Meridian's failure to comply with applicable export-control and sanctions regulations. The scope of this obligation encompasses compliance with the following regulatory regimes:
(i) U.S. Export Administration Regulations (EAR), 15 C.F.R. Parts 730–774;
(ii) EU Dual-Use Regulation, Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021;
(iii) U.S. Office of Foreign Assets Control (OFAC) sanctions programs, including the Specially Designated Nationals and blocked Persons (SDN) List; and
(iv) EU sanctions programs, including Council Regulation (EC) No. 428/2009 and successor regulations, as well as country-specific restrictive measures adopted by the Council of the European Union.
The Agreement identifies the following restricted territories to which export or re-export of the Lumos Prism™ platform is prohibited: Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine. Any breach of the export-control and sanctions provisions of the Agreement constitutes an immediate termination event, entitling Lumos to terminate the Agreement without notice or cure period.
B. Analysis of Risk Exposure
Marketing Misrepresentation. Marketing misrepresentation is a significant and recurring risk category in channel distribution arrangements, particularly for complex technology products such as the Lumos Prism™ platform. While Meridian's portfolio of over 40 vendor relationships suggests a meaningful degree of operational maturity and experience with vendor compliance requirements, the AI-driven financial analytics nature of the Lumos Prism™ platform creates a heightened risk of overclaiming capabilities. Sales personnel may be tempted to overstate the platform's predictive accuracy, regulatory compliance features, or suitability for specific use cases in order to close deals, particularly in a competitive EMEA market. The misrepresentation indemnification is therefore a critical risk-mitigation tool for Lumos, and we recommend active monitoring of Meridian's marketing activities, as discussed in Section XI below.
Export Control and Sanctions. The export-control and sanctions indemnification addresses one of the most consequential categories of regulatory risk in the Agreement. Violations of export-control and sanctions regulations can result in severe penalties, including substantial civil and criminal fines, loss of export privileges, debarment from government contracting, and reputational harm. Given the breadth of the EMEA Territory and the inclusion of regions proximate to restricted territories (e.g., Turkey, the Balkans, the Middle East), the risk of inadvertent export-control or sanctions violations is not trivial. The immediate termination right for sanctions or export-control breaches provides Lumos with an important self-help remedy in addition to the indemnification protection.
Unauthorized Modifications. The unauthorized modifications indemnification protects Lumos's intellectual property ownership and platform integrity. If Meridian or its personnel were to reverse-engineer, decompile, or create derivative works of the Lumos Prism™ platform, the resulting products or modifications could create third-party liability exposure for Lumos, undermine the platform's security architecture, or compromise proprietary algorithms. The indemnification ensures that Meridian bears the financial consequences of any such unauthorized conduct.
Insurance Coverage. Meridian's indemnification obligations are backstopped by insurance coverage maintained with Rheinland Versicherung AG under Policy No. RV-2024-1148703. Pursuant to the Agreement's insurance requirements, Meridian is required to maintain the following minimum coverage levels:
These coverage levels are consistent with market standards for an enterprise software reseller of Meridian's size and scope and provide a meaningful insurance backstop for Meridian's indemnification obligations. However, as discussed further in Section VIII below, the insurance coverage operates as a secondary layer of protection, and Lumos should not rely upon the availability of insurance proceeds as a substitute for Meridian's direct contractual indemnification obligations.
V. Indemnification Liability Cap
A. Aggregate Cap: $15,000,000
Section 10.4 of the Agreement establishes an aggregate indemnification liability cap of $15,000,000 for each party. This cap represents 50% of the Total Contract Value ($30,000,000 × 50% = $15,000,000) and limits the maximum aggregate liability of each party for indemnification claims (other than claims falling within the uncapped carve-out categories described in Section V.B below) over the entire term of the Agreement.
The $15,000,000 cap applies on a per-party basis, meaning that each party's aggregate indemnification liability is independently limited at $15,000,000. The cap is not a shared or joint cap. Accordingly, the maximum mutual indemnification exposure under the Agreement — in a theoretical worst-case scenario in which both parties simultaneously exhaust their respective caps — would be $30,000,000 in the aggregate.
From an industry benchmarking perspective, a cap set at 50% of TCV is within the standard range for enterprise SaaS reseller agreements. Based on Calderwood & Harkness's experience with comparable transactions and published industry surveys (including the American Bar Association's Technology Transactions survey and the SaaStr Annual Benchmarking Report), indemnification caps in enterprise SaaS channel reseller agreements typically range from 25% to 100% of TCV, with the median falling in the 50%–75% range. The 50% level reflects a balanced risk allocation that is appropriate for a deal of this magnitude ($30,000,000 TCV) and term length (five years). A lower cap (e.g., 25% of TCV, or $7,500,000) would have provided insufficient coverage relative to the potential scale of claims, while a higher cap (e.g., 100% of TCV, or $30,000,000) would have imposed disproportionate financial exposure on both parties.
B. Carve-Outs from the Cap (Uncapped Liabilities)
Section 10.5 of the Agreement expressly excludes the following categories of liability from the $15,000,000 aggregate cap. Liabilities falling within these categories are uncapped and are not subject to any aggregate limitation:
1. Willful Misconduct or Fraud. Any losses, damages, or liabilities arising from the intentional acts or fraudulent conduct of either party are excluded from the aggregate cap and are therefore uncapped. This carve-out is essential to prevent moral hazard — i.e., to ensure that a party cannot engage in deliberate wrongdoing and then rely upon the cap to limit its financial exposure. The willful misconduct and fraud carve-out is standard in California-governed commercial agreements and is consistent with the public policy of the State of California, which does not permit parties to contractually limit their liability for their own fraud or intentional misconduct. See Cal. Civ. Code § 1668 (providing that contracts purporting to exempt a party from responsibility for its own fraud or willful injury to another person are against the policy of the law).
2. Breaches of Confidentiality. Any losses, damages, or liabilities arising from the unauthorized disclosure, use, or misuse of confidential information by either party are excluded from the aggregate cap and are therefore uncapped. This carve-out reflects the heightened sensitivity of the information exchanged under the Agreement, which includes proprietary technology, financial analytics data, pricing structures, customer lists, and personal data processed through the Lumos Prism™ platform. Given the cross-border data flows involved in the Agreement (EEA/UK to U.S. under Standard Contractual Clauses) and the regulatory consequences of unauthorized disclosure of personal data under the GDPR and UK GDPR, confidentiality breaches could result in substantial damages that significantly exceed the $15,000,000 cap. The uncapped treatment of confidentiality breaches is therefore appropriate and commercially justified.
3. Intellectual Property Infringement. Third-party claims of intellectual property infringement by the Lumos Prism™ platform are excluded from the aggregate cap and are therefore uncapped. This carve-out is appropriate because IP infringement claims are inherently unpredictable in magnitude — a single patent infringement verdict or settlement can result in damages that far exceed the TCV of any individual commercial agreement. As the licensor and developer of the Lumos Prism™ platform, Lumos is in the best position to manage and mitigate IP infringement risk through its own patent clearance, freedom-to-operate analyses, design-around strategies, and licensing negotiations. Accordingly, it is appropriate for Lumos to bear the full, uncapped exposure for IP infringement claims related to its own technology.
We note that while the IP infringement carve-out is drafted as a mutual provision (i.e., neither party's IP infringement liability is subject to the cap), as a practical matter, this carve-out primarily benefits Meridian, since Lumos is the party that bears the IP infringement indemnification obligation for the Lumos Prism™ platform. Meridian's IP infringement exposure under the Agreement is limited to claims arising from its unauthorized modifications or derivative works, which would fall under Meridian's separate indemnification obligation for unauthorized modifications.
C. Negotiation History
The following summarizes the negotiation history of the indemnification liability cap, which is relevant to understanding the final agreed-upon structure and may be useful for future reference in the event of a dispute:
Meridian's First Markup (February 23, 2024). Kessler Hartmann submitted Meridian's first markup of the Agreement on February 23, 2024. In this markup, Meridian proposed reducing the aggregate indemnification cap from Lumos's initial draft position of $15,000,000 (50% of TCV) to $10,000,000 (33.3% of TCV). Kessler Hartmann argued that a cap at one-third of TCV was more consistent with European market norms for technology distribution agreements and that the higher cap imposed disproportionate risk on Meridian given Meridian's role as a non-exclusive reseller with limited control over the underlying technology.
Calderwood & Harkness's Revised Draft (March 4, 2024). Calderwood & Harkness circulated a revised draft on March 4, 2024, maintaining Lumos's position at a $15,000,000 aggregate cap. Our response explained that the 50% of TCV formulation was consistent with U.S. market standards for enterprise SaaS channel agreements, that the non-exclusivity of Meridian's appointment did not warrant a reduction in the cap, and that the uncapped carve-outs for fraud/willful misconduct and IP infringement provided meaningful protections that offset the higher cap amount.
Meridian's Second Markup (March 11, 2024). Kessler Hartmann submitted Meridian's second markup on March 11, 2024, reiterating the request for a $10,000,000 cap but proposing, as an alternative, the addition of a confidentiality breach carve-out to the list of uncapped liabilities. Kessler Hartmann reasoned that if the cap were to remain at $15,000,000, the uncapped treatment of confidentiality breaches would provide Meridian with additional protection against the most commercially sensitive category of risk.
Final Agreement (March 18, 2024). After further negotiation, Meridian accepted the $15,000,000 cap in the final form agreed on March 18, 2024, in exchange for the inclusion of the confidentiality breach carve-out, which Meridian had proposed and Lumos accepted. The final agreed structure — a $15,000,000 cap with uncapped carve-outs for willful misconduct/fraud, confidentiality breaches, and IP infringement — reflects a commercially balanced outcome that is acceptable to both parties and appropriately allocates risk given the nature and scale of the transaction.
VI. Escrow Holdback Mechanism
A. Structure. Section 10.6 of the Agreement establishes a 5% escrow holdback mechanism designed to provide a readily accessible fund for the satisfaction of indemnification claims without requiring Meridian to make additional out-of-pocket payments at the time a claim is asserted. Under this mechanism, 5% of each quarterly payment made by Meridian pursuant to the MAC schedule is held back from the payment otherwise due to Lumos and is deposited into an escrow account administered by Evergreen Trust Company, N.A., acting as escrow agent.
The escrow arrangements are governed by a separate Escrow Agreement executed on March 22, 2024, among Lumos, Meridian, and Evergreen Trust Company, N.A. The Escrow Agreement designates Maria Gutierrez as the responsible Escrow Officer, with Evergreen Trust's offices located at 400 South Hope Street, Suite 1100, Los Angeles, California 90071. The Escrow Agreement incorporates the standard terms and conditions of Evergreen Trust Company, N.A. for commercial escrow accounts, with modifications negotiated to align with the indemnification framework of the Agreement.
The purpose of the escrow holdback is to serve as a liquidity mechanism for the satisfaction of indemnification claims. Rather than requiring a party to fund indemnification payments from operating cash flow or to pursue collections against the other party after an indemnification determination, the escrow fund provides a pre-funded source of payment that can be accessed upon the resolution of a covered claim.
B. Quarterly Holdback Amounts
The following table sets forth the quarterly holdback amounts for each year of the initial term, calculated as 5% of each quarterly MAC payment:
The total potential holdback over the five-year initial term is $1,500,000, representing 5% of the $30,000,000 TCV. This amount is approximately 10% of the $15,000,000 aggregate indemnification cap and is intended to provide a meaningful but not excessive escrow fund for claim satisfaction.
C. Payment Flow
The payment flow for the quarterly MAC payments, including the escrow holdback, is as follows:
(i) Meridian remits the full quarterly MAC payment from its account at Zarvenische Handelsbank AG (Thomas Weidner, Relationship Manager; Promenadeplatz 12, 80333 München, Germany) via wire transfer.
(ii) Ninety-five percent (95%) of the quarterly MAC payment is directed to Lumos's account at Pinnacle National Bank, N.A. (David Okonkwo, Relationship Manager; 555 California Street, San Francisco, California 94104).
(iii) Five percent (5%) of the quarterly MAC payment is directed to the escrow account at Evergreen Trust Company, N.A.
The allocation and routing of funds are governed by the Funds Flow Memorandum executed in connection with the closing of the Agreement. The Funds Flow Memorandum specifies the wire transfer instructions, account numbers, and reference information for each payment recipient. The parties have agreed that Meridian shall initiate each quarterly payment as a single wire transfer, with the funds allocation between Lumos's operating account and the escrow account to be effected by the receiving bank or the escrow agent in accordance with the standing instructions set forth in the Funds Flow Memorandum.
D. Escrow Release
Unreleased escrow funds — i.e., escrow funds that have not been applied to the satisfaction of indemnification claims during the term of the Agreement — are released to Meridian 12 months after the expiration or termination of the Agreement, net of any amounts attributable to pending indemnification claims that remain unresolved as of the release date.
This 12-month post-termination holdback period was the subject of negotiation between the parties. Kessler Hartmann initially proposed an escrow release at 6 months post-termination, arguing that a shorter holdback period was consistent with European commercial practice and that the 24-month indemnification survival period (discussed in Section X below) already provided Lumos with an extended window in which to assert claims. Calderwood & Harkness maintained the 12-month period on behalf of Lumos, reasoning that a 6-month release window would not provide adequate time for the identification, investigation, and resolution of indemnification claims arising near the end of the term, particularly in light of the complexity of cross-border claims involving EMEA end users and the procedural requirements for claim assertion under the Agreement. The 12-month period was ultimately accepted by Meridian in the final form of the Agreement.
Any indemnification claims that have been formally asserted during the 12-month post-termination holdback period reduce the amount of escrow funds available for release. Specifically, upon the assertion of a claim, the escrow agent is instructed to reserve an amount equal to the claimed amount (or, if the claimed amount is not determinable, an amount reasonably estimated by the indemnified party) from the escrow fund, and such reserved amount is not eligible for release until the claim has been resolved.
E. Interaction with Indemnification Cap
The escrow holdback mechanism interacts with the $15,000,000 aggregate indemnification cap as follows:
(i) The escrow holdback is a source of funds for the satisfaction of indemnification claims. It does not increase or decrease the $15,000,000 aggregate cap.
(ii) Indemnification claims satisfied from escrow funds are credited against the applicable party's aggregate cap. For example, if Lumos asserts an indemnification claim against Meridian and $500,000 is paid from the escrow fund in satisfaction of that claim, the $500,000 payment reduces Meridian's remaining aggregate cap from $15,000,000 to $14,500,000.
(iii) The escrow fund provides a liquidity mechanism for claim satisfaction but is not a substitute for the indemnifying party's direct indemnification obligations. If the escrow balance is insufficient to satisfy a valid indemnification claim — whether because the escrow has been depleted by prior claims or because the claim amount exceeds the available escrow balance — the indemnifying party remains directly liable for the excess amount, up to the applicable aggregate cap (or without limitation, for uncapped claim categories).
This structure ensures that the escrow holdback operates as a practical convenience for claim administration and does not alter the substantive economic allocation of risk reflected in the indemnification cap.
VII. Indemnification Procedural Requirements
A. Notice Requirement
Section 10.7(a) of the Agreement requires the indemnified party to provide written notice to the indemnifying party within 30 days of becoming aware of a claim or potential claim giving rise to an indemnification obligation. The notice must include a reasonably detailed description of the claim, the facts and circumstances giving rise to the claim, the legal basis for the claim (to the extent known), and an estimate of the amount of losses or damages involved (to the extent reasonably ascertainable).
Importantly, the Agreement provides that a failure to provide timely notice does not relieve the indemnifying party of its indemnification obligations, except to the extent that the indemnifying party is materially prejudiced by the delay. This "prejudice-based" exception is a favorable provision for the indemnified party (whether Lumos or Meridian, depending on the circumstances) because it prevents the indemnifying party from invoking a late-notice defense as a technicality to avoid its substantive indemnification obligations. Under California law, courts have generally held that indemnification notice requirements are conditions precedent to the indemnification obligation only where the agreement expressly states that failure to provide timely notice constitutes a forfeiture or waiver of the indemnification right. See, e.g., Marlowe Casualty Group v. Sparks Constr., Inc., 114 Cal. App. 4th 1135 (2004). The prejudice-based formulation adopted in the Agreement is consistent with the majority approach in California commercial practice and reduces the risk of technicality-based indemnification defenses.
B. Right to Control Defense
Section 10.7(b) of the Agreement grants the indemnifying party the right to assume control of the defense of any third-party claim for which indemnification is sought, including the right to select defense counsel, direct the litigation strategy, and manage all aspects of the defense. This right is subject to the following conditions:
(i) The indemnifying party must notify the indemnified party in writing of its election to assume control of the defense within 15 business days of receipt of the indemnification notice.
(ii) The indemnified party has the right to participate in the defense of the claim at its own expense, including the right to retain separate counsel. However, the indemnified party may not take any action in connection with the defense of the claim that is inconsistent with the indemnifying party's defense strategy without the indemnifying party's prior written consent.
(iii) The indemnifying party may not settle any claim in a manner that (a) imposes any non-monetary obligation on the indemnified party, (b) admits liability on the part of the indemnified party, or (c) fails to include a full and unconditional release of the indemnified party from all liability with respect to the claim, in each case without the prior written consent of the indemnified party.
The right-to-control-defense provision is a standard feature of commercial indemnification clauses and serves the important purpose of ensuring that the party bearing the financial risk of a claim (the indemnifying party) also has the ability to manage that risk through its control of the defense strategy.
C. Consent to Settlement
Section 10.7(c) of the Agreement provides that consent to any settlement of an indemnification claim shall not be unreasonably withheld, conditioned, or delayed by either party. This standard is consistent with the implied covenant of good faith and fair dealing under California law, which requires contracting parties to exercise their contractual discretion in good faith and in a manner that does not deprive the other party of the benefits of the agreement. See Cal. Civ. Code §§ 1654, 3548; Carma Developers (Cal.), Inc. v. Marathon Dev. Cal., Inc., 2 Cal. 4th 342, 371–72 (1992). California courts have generally enforced reasonable consent requirements in commercial agreements and have held that a party's refusal to consent to a settlement may be unreasonable if the proposed settlement is within the range of reasonable outcomes and the refusing party cannot articulate a legitimate basis for its refusal.
D. Cooperation. Section 10.7(d) of the Agreement requires the indemnified party to cooperate with the indemnifying party in the defense of any indemnification claim. The cooperation obligation includes, without limitation, providing the indemnifying party with reasonable access to relevant documents, records, communications, and data; making personnel available for interviews, depositions, testimony, and other discovery-related activities; and taking such other actions as may be reasonably requested by the indemnifying party to facilitate the defense of the claim. The indemnified party's cooperation obligation is subject to the indemnifying party's reimbursement of the indemnified party's reasonable out-of-pocket costs and expenses incurred in providing such cooperation.
VIII. Interaction with Insurance Requirements
The indemnification framework operates in conjunction with the insurance requirements set forth in Section 8 of the Agreement. Both parties are required to maintain specified minimum insurance coverage throughout the term of the Agreement, which provides a secondary layer of financial protection in the event of indemnification claims.
Lumos Insurance. Lumos maintains errors and omissions ("E&O") and cyber liability insurance coverage with Atlas Mutual Insurance Company under Policy No. AML-TECH-2024-07829. The policy provides coverage of $10,000,000 per occurrence and $20,000,000 in the aggregate. The coverage is brokered through Ridgepoint Insurance Brokers Inc. (Sandra Nwosu, Account Executive; 200 Vesey Street, Suite 2400, New York, New York 10281). The E&O and cyber liability coverage is designed to respond to professional liability claims and data-breach-related losses that may arise from the operation and delivery of the Lumos Prism™ platform.
Meridian Insurance. Meridian is contractually required to maintain the following minimum insurance coverage levels throughout the term of the Agreement:
Per the representations made by Kessler Hartmann during the negotiation, Meridian's insurance is underwritten by Rheinland Versicherung AG under Policy No. RV-2024-1148703. Calderwood & Harkness has not independently verified the terms, conditions, or scope of Meridian's insurance coverage, and our analysis relies upon the representations made by Meridian's counsel.
Primary vs. Secondary Coverage. It is important to note that the insurance coverage maintained by the parties operates as a secondary layer of protection. The indemnification obligations set forth in the Agreement are primary obligations and do not depend upon the availability of insurance proceeds. An indemnifying party may not assert the unavailability, exhaustion, or denial of insurance coverage as a defense to its indemnification obligations under the Agreement. Conversely, recovery of indemnification payments from insurance proceeds does not reduce or eliminate the indemnified party's right to full indemnification under the Agreement.
Recommendation. We recommend that Lumos require Meridian to provide certificates of insurance on an annual basis and upon each policy renewal, together with evidence of premium payment, to verify Meridian's continued compliance with the insurance requirements of the Agreement. The Agreement currently requires Meridian to maintain the specified coverage levels but does not expressly require the submission of periodic certificates of insurance. We recommend that this requirement be addressed through a side letter or amendment at the earliest practical opportunity.
IX. Interaction with Limitation of Liability
The Agreement contains a separate general limitation of liability provision in Section 11, which is distinct from the indemnification cap set forth in Section 10.4. The general limitation of liability provision excludes each party's liability for consequential, incidental, special, indirect, exemplary, and punitive damages, regardless of whether such damages are foreseeable and regardless of the theory of liability (contract, tort, strict liability, or otherwise).
The exclusion of consequential damages is subject to the same carve-outs that apply to the indemnification cap under Section 10.5. Specifically, the consequential damages exclusion does not apply to losses arising from:
(a) Willful misconduct or fraud by either party;
(b) Breaches of confidentiality by either party; and
(c) intellectual property infringement by the Lumos Prism™ platform.
This dual structure — combining an aggregate indemnification cap (Section 10.4) with a general consequential damages exclusion (Section 11) — provides layered protection for both parties. The indemnification cap limits the total quantum of indemnification liability (subject to uncapped carve-outs), while the consequential damages exclusion limits the types of damages recoverable (subject to the same carve-outs). Together, these provisions create a comprehensive liability framework that constrains each party's maximum financial exposure while preserving full recourse for the most consequential categories of wrongdoing.
We note that the alignment of the carve-outs across the indemnification cap and the consequential damages exclusion is an important structural feature that ensures consistency and avoids gaps or conflicts in the liability framework. During the drafting process, Calderwood & Harkness ensured that the carve-out categories in Section 10.5 (indemnification cap) and Section 11.2 (consequential damages exclusion) are identical and defined using the same terminology, thereby eliminating the risk of interpretive disputes regarding whether a particular category of liability is capped, uncapped, or subject to the consequential damages exclusion.
X. Post-Termination Considerations
A. Survival of Indemnification Obligations
Section 10.8 of the Agreement provides that the indemnification obligations set forth in Sections 10.1 and 10.2 survive the expiration or termination of the Agreement for any reason, regardless of the cause or manner of termination. This survival provision ensures that indemnification protection remains available for claims arising from events that occurred during the term of the Agreement, even if such claims are not asserted or discovered until after the Agreement has expired or been terminated.
B. Survival Period
Indemnification claims may be brought for a period of 24 months following the effective date of expiration or termination of the Agreement (the "Survival Period"). Any indemnification claim not asserted in writing within the 24-month Survival Period is deemed waived and may not thereafter be pursued. The 24-month Survival Period is consistent with market standards for enterprise SaaS agreements, which typically provide for survival periods ranging from 12 to 36 months.
C. Post-Termination Wind-Down
The Agreement provides that, upon expiration or termination, Meridian may continue to fulfill existing end-user subscription agreements for a period of up to 12 months following the effective date of expiration or termination (the "Wind-Down Period"). During the Wind-Down Period, Meridian's obligations under the Agreement remain in full force and effect with respect to the existing end-user subscriptions being fulfilled, including Meridian's indemnification obligations. Lumos's indemnification obligations likewise remain in effect during the Wind-Down Period with respect to the Lumos Prism™ platform as deployed to end users under the existing subscriptions.
D. Gap Between Escrow Release and Survival Period
An important structural feature to note is the temporal gap between the 12-month escrow release period and the 24-month indemnification Survival Period. As discussed in Section VI.D above, unreleased escrow funds are released to Meridian 12 months after expiration or termination. However, indemnification claims may be asserted for up to 24 months after expiration or termination. This creates a 12-month window (from months 12 through 24 post-termination) during which indemnification claims may be asserted but the escrow fund is no longer available as a source of payment.
For claims arising during this 12-month gap period, Lumos would need to pursue direct indemnification from Meridian without the benefit of the escrow backstop. While Meridian remains contractually obligated to satisfy such claims (subject to the aggregate cap and uncapped carve-outs), the absence of the escrow fund during this period increases the practical collection risk for Lumos. We discuss this risk and our recommendations for mitigation in Section XI below.
XI. Risk Assessment and Recommendations
A. Overall Assessment
In our assessment, the indemnification framework negotiated in the Agreement is commercially balanced and consistent with market standards for enterprise SaaS channel reseller agreements of comparable size and complexity. The $30,000,000 TCV places this Agreement squarely within the range of significant enterprise technology transactions, and the indemnification and liability cap provisions reflect a level of sophistication and detail appropriate for a deal of this magnitude.
The $15,000,000 aggregate indemnification cap (50% of TCV) provides meaningful protection for both parties while limiting tail risk. The cap level is within the standard market range and reflects the balanced nature of the risk allocation: Lumos bears the primary technology and IP risk, while Meridian bears the primary distribution, marketing, and regulatory compliance risk.
The uncapped carve-outs for IP infringement, willful misconduct/fraud, and confidentiality breaches appropriately address the highest-risk categories of liability — categories in which the potential magnitude of damages is inherently unpredictable and in which capping liability could create perverse incentives or inadequate deterrence.
The 5% escrow holdback mechanism provides a practical and efficient claims-satisfaction tool, and the procedural requirements for indemnification claims are well-structured and consistent with California law.
B. Key Strengths
We identify the following key strengths in the indemnification framework:
1. Sole-Causation Limitation on Data Protection Indemnification. Lumos's data-protection indemnification obligation is limited to scenarios in which the breach is solely caused by Lumos's acts or omissions. This is a favorable limitation that shields Lumos from shared-fault claims, which are the most common type of data-protection claim in SaaS distribution arrangements.
2. Escrow Holdback. The 5% escrow holdback provides a readily accessible liquidity pool for indemnification claims, reducing the practical risk associated with pursuing direct indemnification from a counterparty domiciled in a foreign jurisdiction.
3. Prejudice-Based Notice Exception. The 30-day notice requirement is coupled with a prejudice-based exception (rather than a strict forfeiture rule), which reduces the risk that a party will lose its indemnification rights due to a procedural technicality. This is a borrower-friendly formulation that benefits whichever party is in the indemnified position.
4. Non-Exclusivity. Lumos's retention of the right to appoint additional resellers and to sell directly in the EMEA Territory limits channel concentration risk and ensures that Lumos is not unduly dependent on Meridian for EMEA market access.
C. Recommendations. Based on our analysis, we recommend the following actions to optimize Lumos's position under the indemnification framework and to mitigate identified risks:
1. Monitor Meridian's Marketing Materials and Co-Branded Content. Lumos should establish a systematic process for reviewing Meridian's marketing materials, presentations, website content, and co-branded collateral for compliance with the Trademark License & Brand Guidelines set forth in Exhibit D to the Agreement. Given the AI-driven and financial-technology nature of the Lumos Prism™ platform, there is a heightened risk that Meridian's sales and marketing personnel may overstate the platform's capabilities, predictive accuracy, or regulatory compliance features. Regular monitoring will enable Lumos to identify and correct potential misrepresentations before they give rise to third-party claims, thereby reducing the likelihood of indemnification claims under Section 10.2(a) of the Agreement.
2. Require Quarterly Export-Control and Sanctions Certifications. Given the breadth of the EMEA Territory and the proximity of certain EMEA sub-regions to the restricted territories identified in the Agreement (Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine), Lumos should require Meridian to provide quarterly certifications confirming its continued compliance with all applicable export-control and sanctions regulations. The certifications should confirm that Meridian has not exported, re-exported, or otherwise transferred the Lumos Prism™ platform or any related technology to any restricted territory, entity, or individual, and that Meridian has maintained and implemented adequate screening procedures against the OFAC SDN List, the EU Consolidated List of Sanctions, and other applicable restricted-party lists.
3. Inform Financial Advisors and Auditors. Lumos should ensure that its financial advisory and audit teams are informed of the indemnification and escrow structure for purposes of financial reporting and transfer pricing documentation. Specifically, Caldwell & Pryce Advisory LLC (Ingrid Svensson, engagement lead) and Whitmore Paige & Co. LLP (Gregory Chen, Audit Partner) should be provided with copies of the relevant provisions of the Agreement and the Escrow Agreement so that the escrow holdback amounts can be properly accounted for and disclosed in Lumos's financial statements. The escrow holdback may also have transfer pricing implications, as it effectively reduces the net payment received by Lumos from Meridian in any given period, and the treatment of the holdback should be addressed in Lumos's intercompany transfer pricing documentation.
4. Coordinate GDPR/UK GDPR Compliance Monitoring. Lumos should coordinate with Thornbridge Whitaker LLP (Alistair Drummond, lead partner) on ongoing monitoring of GDPR and UK GDPR compliance in connection with the Lumos Prism™ platform's processing of EMEA end-user data. While Lumos's data-protection indemnification is limited to sole-causation scenarios, proactive compliance monitoring will minimize the likelihood of any data-protection breach attributable to Lumos's acts or omissions and will reduce the overall indemnification exposure. Thornbridge Whitaker should be specifically asked to review the Standard Contractual Clauses implementation, the data localization arrangements at the Stratos Cloud Services AG Frankfurt data center, and the data-breach notification procedures set forth in the DPA.
5. Consider Requesting a Parent or Affiliate Guarantee. As noted in Section II.C above, the Agreement authorizes Meridian to engage two pre-approved sub-distributors: Meridian Data Solutions UK Ltd and Meridian Data Solutions SARL. However, these sub-distributors are not direct parties to the Agreement and are not directly bound by the indemnification provisions of the master Agreement. If sub-distributor activities generate significant claim exposure — for example, if Meridian UK makes misrepresentations to UK-based end users that result in third-party claims against Lumos — Lumos's recourse would be limited to its indemnification claim against Meridian GmbH under the master Agreement, with no direct claim against the sub-distributor. To address this gap, Lumos should consider requesting a parent or affiliate guarantee from Meridian (or, alternatively, requiring Meridian to include indemnification back-to-back provisions in its sub-distribution agreements that are enforceable by Lumos as a third-party beneficiary).
6. Calendar Key Post-Termination Dates. Lumos should calendar the following key dates to ensure timely assertion of any indemnification claims in connection with the expiration or termination of the Agreement:
(a) Escrow Release Date: 12 months after expiration or termination of the Agreement. Any indemnification claims that Lumos intends to satisfy from escrow funds must be formally asserted before this date.
(b) Indemnification Survival Deadline: 24 months after expiration or termination of the Agreement. Any indemnification claims not asserted in writing before this deadline will be deemed waived and may not thereafter be pursued.
(c) Gap Period: Lumos should be particularly vigilant during the period between months 12 and 24 post-termination, during which the escrow fund will have been released but the indemnification survival period remains in effect. Claims arising during this gap period will need to be satisfied through direct indemnification from Meridian, without the escrow backstop.
XII. Conclusion
Based on our analysis, the indemnification and liability cap framework in the Channel Reseller Program Agreement between Lumos Analytics Inc. and Meridian Data Solutions GmbH is well-structured, commercially reasonable, and consistent with the requirements of California law. The key structural features — the $15,000,000 aggregate indemnification cap (50% of TCV), the uncapped carve-outs for intellectual property infringement, willful misconduct and fraud, and confidentiality breaches, and the 5% quarterly escrow holdback with Evergreen Trust Company, N.A. — together provide a comprehensive and balanced risk-allocation framework that protects Lumos's interests while maintaining commercial viability for the channel reseller relationship.
The mutual indemnification structure appropriately assigns technology and IP risk to Lumos as the platform developer and licensor, while allocating distribution, marketing, regulatory compliance, and export-control risk to Meridian as the authorized reseller. The procedural requirements for claim assertion and defense are well-drafted and include borrower-friendly features, such as the prejudice-based notice exception, that reduce the risk of technicality-based defenses to valid indemnification claims.
We recommend implementation of the six specific risk-mitigation measures identified in Section XI.C above, including monitoring of Meridian's marketing materials, quarterly export-control certifications, coordination with financial advisors and GDPR counsel, consideration of a parent or affiliate guarantee, and calendaring of post-termination deadlines.
Calderwood & Harkness is available to address any questions regarding this analysis, to assist with the implementation of the recommendations set forth herein, or to provide further analysis on any specific aspect of the indemnification and liability cap framework.
XIII. Contact Information
Howard Bellamy Partner, Antitrust & Competition Calderwood & Harkness LLP 801 South Figueroa Street, Suite 4200 Los Angeles, California 90017
Leila Nazari Associate, Tax Calderwood & Harkness LLP 801 South Figueroa Street, Suite 4200 Los Angeles, California 90017
Matter No.: 1008-00010
This memorandum is protected by the attorney-client privilege an