1008-00010 · Lumos Analytics Inc · Memos & Analyses

insurance-requirements-compliance-memo.docx DOCUMENT Funds

22 / 36 ← → ✕

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

TO: Howard Bellamy, Partner, Calderwood & Harkness LLP Daniel Ostroff, Vice President, Legal & Compliance, Lumos Analytics Inc.

FROM: Robert Jansen, Associate, Calderwood & Harkness LLP

DATE: March 20, 2024

RE: Insurance Requirements Compliance Review — Channel Reseller Program Agreement between Lumos Analytics Inc. and Meridian Data Solutions GmbH

MATTER NO.: 1008-00010

Right-click to update Table of Contents

I. Executive Summary

The purpose of this memorandum is to review and confirm compliance with all insurance requirements imposed under the Channel Reseller Program Agreement (the "Agreement") by and between Lumos Analytics Inc., a Delaware corporation ("Lumos"), and Meridian Data Solutions GmbH, a company organized under the laws of the Federal Republic of Germany ("Meridian"), dated March 22, 2024. The Agreement governs the non-exclusive resale of the Lumos Prism™ cloud-based analytics platform across the EMEA Territory (as defined therein to include the European Economic Area, the United Kingdom, Switzerland, and certain additional countries in the Middle East and Africa as specified in Schedule 1 to the Agreement).

The Agreement carries an aggregate deal value of approximately $30,000,000 over its initial five-year term commencing April 1, 2024 and expiring March 31, 2029. Given the magnitude of the transaction, the cross-border nature of the distribution arrangement, and the sensitivity of the data processed through the Lumos Prism™ platform — including personal data subject to the European Union General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and the United Kingdom General Data Protection Regulation ("UK GDPR") — robust insurance coverage for both parties is essential to mitigate the spectrum of contractual, regulatory, and operational risks inherent in the arrangement.

In preparing this memorandum, Calderwood & Harkness LLP has coordinated with Ridgepoint Insurance Brokers Inc. ("Ridgepoint"), Lumos's insurance broker of record. Our primary contact at Ridgepoint has been Sandra Nwosu, Account Executive, located at 200 Vesey Street, Suite 2400, New York, NY 10281. Ms. Nwosu has provided confirmation of Lumos's existing coverage under its errors and omissions / cyber liability policy issued by Atlas Mutual Insurance Company and has assisted with our assessment of the adequacy of that coverage relative to the contractual requirements and the risk profile of the EMEA channel distribution arrangement.

Additionally, Calderwood & Harkness has reviewed certificates of insurance furnished by Meridian, as well as representations made by Meridian's officer in the Officer's Certificate delivered at closing and correspondence from Meridian's outside counsel, Kessler Hartmann Rechtsanwälte PartG mbB.

Based on our review, we conclude that both parties' insurance programs satisfy the contractual requirements set forth in the Agreement, subject to certain monitoring recommendations and risk mitigation considerations described in detail in Sections VI, VII, and VIII of this memorandum. In particular, we recommend that Lumos explore the availability of excess or dedicated intellectual property indemnity insurance to address the uncapped IP infringement indemnification exposure under the Agreement, and that Lumos request certificates of insurance from Meridian's pre-approved sub-distributors to confirm coverage at the sub-distributor level.

II. Contractual Insurance Requirements

A. Insurance Provisions in the Agreement

Article 14 of the Agreement (entitled "Insurance") sets forth the insurance obligations applicable to each party. Section 14.1 imposes specific minimum coverage requirements on Meridian as the reseller, while Section 14.2 requires Lumos, as the platform provider, to maintain insurance coverage appropriate to its role in providing the Lumos Prism™ SaaS platform and supporting EMEA distribution activities. Section 14.3 addresses procedural requirements applicable to both parties, including the furnishing of certificates of insurance.

The insurance obligations under the Agreement apply from the Effective Date (defined as April 1, 2024) and continue throughout the initial five-year term of the Agreement and any renewal periods. Importantly, Section 14.4 provides that each party shall maintain the required insurance coverage for a tail period of not less than thirty-six (36) months following the expiration or earlier termination of the Agreement, ensuring that claims arising from activities conducted during the term but reported after termination are covered under the applicable policies.

Under Section 14.3, each party is required to furnish certificates of insurance to the other party prior to the closing date (March 22, 2024) as a condition precedent to the effectiveness of the Agreement. Thereafter, updated certificates of insurance must be provided annually, within thirty (30) days of each policy renewal, for the duration of the term and the post-termination tail period. The Agreement further requires that, where applicable, each party shall cause the other party to be named as an additional insured under its commercial general liability policy, and that certificates of insurance shall reflect such additional insured status. Waiver of subrogation endorsements are required on all applicable policies in favor of the other party.

B. Lumos's Required Coverage

The Agreement imposes the following insurance requirements on Lumos as the platform provider:

Errors & Omissions (E&O) / Technology Professional Liability. Section 14.2(a) requires Lumos to maintain errors and omissions insurance, also referred to as technology professional liability insurance, with coverage limits adequate to the scope of the Lumos Prism™ SaaS platform and the EMEA distribution activities contemplated by the Agreement. The Agreement does not specify a fixed dollar minimum for Lumos's E&O coverage but instead requires that coverage be "commercially reasonable and consistent with industry practice for technology companies of comparable size and scope." This formulation provides flexibility but also requires a market benchmarking analysis, which we have conducted in coordination with Ridgepoint (as discussed in Section V below).

Cyber Liability / Network Security Insurance. Section 14.2(b) requires Lumos to maintain cyber liability and network security insurance, including coverage for data breach response, privacy liability, and network security events. This requirement is particularly important given the GDPR and UK GDPR compliance obligations applicable to the processing of EMEA customer data and the hosting of such data at the Stratos Cloud Services AG data center located in Frankfurt am Main, Germany (the "Frankfurt Data Center"), as specified in the Data Processing Addendum attached to the Agreement as Exhibit E. The cyber liability coverage must address, at a minimum, regulatory defense costs, consumer notification costs, credit monitoring expenses, forensic investigation costs, and third-party claims arising from unauthorized access to or disclosure of personal data processed through the Lumos Prism™ platform.

Commercial General Liability. Section 14.2(c) requires Lumos to maintain commercial general liability ("CGL") insurance providing standard coverage for third-party bodily injury and property damage claims. While the CGL requirement is less central to the risk profile of a SaaS distribution arrangement than the E&O and cyber liability requirements, it remains a standard contractual requirement and provides coverage for premises liability, products-completed operations, and personal and advertising injury claims that may arise in connection with Lumos's marketing and support activities in the EMEA Territory.

C. Meridian's Required Coverage

The Agreement imposes more specific and quantified insurance requirements on Meridian as the reseller. Section 14.1 of the Agreement requires Meridian to maintain the following minimum coverage:

Commercial General Liability (CGL). Meridian is required to maintain commercial general liability insurance with a minimum coverage limit of not less than €5,000,000 per occurrence. This coverage must include standard protection for third-party bodily injury, property damage, personal and advertising injury, and products-completed operations liability. The CGL policy must name Lumos as an additional insured with respect to claims arising out of or in connection with Meridian's performance under the Agreement.

Professional Indemnity (PI). Meridian is required to maintain professional indemnity insurance (the European equivalent of errors and omissions coverage) with a minimum coverage limit of not less than €10,000,000 per occurrence. This coverage must address claims arising from acts, errors, or omissions in Meridian's provision of reseller services, including the implementation, configuration, and first-line support services that Meridian is authorized to perform under the Agreement with respect to the Lumos Prism™ platform.

Cyber Liability. Meridian is required to maintain cyber liability insurance with a minimum coverage limit of not less than €5,000,000 per occurrence. This coverage must address data breach, privacy liability, and network security claims, including regulatory defense costs and third-party claims arising from the processing of customer data in connection with Meridian's resale and support activities. Given that Meridian will have access to certain categories of personal data as a processor or sub-processor under the GDPR framework, this coverage is essential to the overall risk allocation architecture of the Agreement.

Carrier Quality Requirement. Section 14.1(d) of the Agreement requires that all of Meridian's insurance policies be maintained with reputable carriers rated at least "A-" (A minus) by a recognized rating agency, such as A.M. Best, Standard & Poor's, or an equivalent European rating organization. This requirement ensures that the insurance backing Meridian's obligations is issued by financially stable and creditworthy carriers capable of paying claims.

Certificate Delivery. Meridian is required to provide certificates of insurance to Lumos at closing (March 22, 2024) and upon each annual renewal thereafter, as described in Section 14.3 of the Agreement.

III. Lumos's Insurance Program — Current Coverage

A. E&O / Cyber Liability Policy

Calderwood & Harkness has reviewed the certificate of insurance and policy summary for Lumos's primary errors and omissions / cyber liability policy, with the following key terms confirmed through Ridgepoint Insurance Brokers Inc.:

Carrier: Atlas Mutual Insurance Company, One Liberty Plaza, Hartford, CT 06103. Atlas Mutual is a well-established carrier in the technology errors and omissions and cyber liability markets, with an A.M. Best rating of "A" (Excellent), Financial Size Category XII, and a long-standing track record of providing coverage to enterprise software and SaaS companies.

Policy Number: AML-TECH-2024-07829.

Coverage Limits: $10,000,000 per occurrence / $20,000,000 annual aggregate.

Scope of Coverage: The policy provides comprehensive coverage for errors and omissions arising from the provision of the Lumos Prism™ SaaS platform, including but not limited to technology professional liability for claims alleging failure to perform, defects in software functionality, system downtime, data loss, and misrepresentation of platform capabilities. The policy also provides cyber liability coverage, including data breach response costs (notification, credit monitoring, public relations), privacy liability for claims arising from unauthorized access to or disclosure of personal data, network security liability for claims arising from failure to prevent unauthorized access, transmission of malicious code, or denial-of-service events, and regulatory defense costs for proceedings initiated by data protection authorities in any jurisdiction worldwide.

Policy Period: The current annual policy period runs through the next renewal date, which is to be confirmed with Ridgepoint upon the approaching renewal cycle. Ms. Nwosu has indicated that the current policy period is expected to renew without material changes to terms or limits, subject to final underwriting review by Atlas Mutual.

Territorial Scope: The policy provides worldwide coverage, including coverage for claims arising in the EMEA Territory. This territorial scope has been confirmed as adequate for the EMEA distribution activities contemplated under the Agreement. The worldwide territory covers not only claims brought in EMEA jurisdictions but also defense costs incurred in responding to regulatory proceedings initiated by EMEA data protection authorities, which is critical given the GDPR and UK GDPR compliance framework applicable to the Lumos Prism™ platform's processing of EMEA customer data at the Frankfurt Data Center.

Deductible / Self-Insured Retention: The policy includes a self-insured retention, the amount of which has been confirmed by Sandra Nwosu of Ridgepoint Insurance Brokers Inc. as consistent with market norms for companies of Lumos's size and risk profile. The self-insured retention applies to each covered claim and is the responsibility of Lumos as the named insured before the policy responds.

Broker of Record: Ridgepoint Insurance Brokers Inc., Sandra Nwosu, Account Executive, 200 Vesey Street, Suite 2400, New York, NY 10281. Ridgepoint serves as Lumos's insurance broker of record for all technology-related lines of coverage and has been Lumos's broker since 2019.

B. Adequacy Assessment

We have assessed the adequacy of Lumos's E&O / cyber liability coverage relative to the contractual requirements, the risk profile of the EMEA distribution arrangement, and prevailing market practices. Our assessment is as follows:

Limits Relative to Market Practice. The $10,000,000 per occurrence / $20,000,000 aggregate limits maintained by Lumos under the Atlas Mutual policy are consistent with market practice for SaaS and financial technology companies with Lumos's revenue profile. Lumos reported annual recurring revenue ("ARR") of $187.4 million for the fiscal year ended December 31, 2023. Based on benchmarking data provided by Ridgepoint, companies in the enterprise SaaS / fintech sector with ARR in the $150M–$250M range typically maintain E&O / cyber liability coverage with per-occurrence limits ranging from $5,000,000 to $15,000,000 and aggregate limits ranging from $15,000,000 to $30,000,000. Lumos's coverage falls comfortably within this range and, at the $10M/$20M level, is positioned at or slightly above the median for its peer group.

Coverage Scope Relative to Key Risk Areas. The scope of the Atlas Mutual policy addresses the key risk areas relevant to the Agreement, including the following:

IP Infringement Defense. The policy includes coverage for defense costs and damages arising from claims of intellectual property infringement, which supports Lumos's indemnification obligations under Section 12.1(a) of the Agreement (requiring Lumos to indemnify, defend, and hold harmless Meridian against third-party claims alleging that the Lumos Prism™ platform infringes a third party's patents, copyrights, trademarks, or trade secrets). As discussed further in Section VI.A below, the uncapped nature of this indemnification obligation warrants additional attention.

Data Protection Liability. The policy provides comprehensive coverage for privacy and data protection claims, aligned with the GDPR and UK GDPR compliance obligations set forth in the Data Processing Addendum (Exhibit E to the Agreement) and the data hosting arrangements at the Frankfurt Data Center operated by Stratos Cloud Services AG. This coverage addresses claims by data subjects, regulatory fines and penalties (to the extent insurable under applicable law), defense costs in regulatory proceedings, and breach notification expenses.

Technology Errors. The core E&O coverage addresses claims arising from failures in the Lumos Prism™ platform's performance, including claims for financial losses suffered by end users as a result of platform errors, system outages, data corruption, or misrepresentation of platform capabilities by Lumos or its authorized resellers.

Relationship to Contractual Indemnification Caps. The indemnification framework in the Agreement, set forth in Article 12, caps each party's aggregate indemnification liability at $15,000,000, which represents fifty percent (50%) of the total contract value ("TCV") of $30,000,000. However, the Agreement provides certain uncapped carve-outs from this aggregate indemnification cap, including: (i) indemnification obligations for intellectual property infringement under Section 12.1(a) (Lumos) and Section 12.2(a) (Meridian); (ii) liability arising from willful misconduct or fraud; and (iii) liability arising from breaches of the confidentiality obligations set forth in Article 10.

Lumos's E&O / cyber liability coverage at $20,000,000 aggregate provides an adequate backstop for indemnification claims falling within the $15,000,000 cap, as the aggregate policy limit exceeds the contractual indemnification cap by $5,000,000. However, for the uncapped carve-out categories — particularly IP infringement claims, which are the most likely category of uncapped claim to arise in the context of a SaaS distribution arrangement — the $10,000,000 per-occurrence / $20,000,000 aggregate limits may not fully backstop an IP infringement claim of extraordinary magnitude. This gap is analyzed further in Section VI.A below.

Escrow Holdback as Complementary Mechanism. The Agreement provides for a five percent (5%) escrow holdback on all reseller fees payable to Meridian, with the holdback amounts deposited into an escrow account maintained by Evergreen Trust Company, N.A. (escrow officer: Maria Gutierrez, 400 South Hope Street, Suite 1100, Los Angeles, CA 90071). In Year 1 of the Agreement, the quarterly escrow deposit is estimated at $56,250 (based on the Year 1 minimum annual commitment ("MAC") of $4,500,000). While this escrow provides a first-dollar indemnification reserve available to Lumos for lower-value indemnification claims, it is modest in absolute terms and is not a substitute for the comprehensive risk transfer afforded by insurance. Insurance remains the primary mechanism for addressing material claims.

C. Additional Lumos Coverage (General Note)

Lumos maintains a broader insurance program that includes, among other lines, commercial general liability coverage, directors' and officers' liability coverage, employment practices liability coverage, workers' compensation insurance, and umbrella / excess liability coverage. These additional policies are maintained under separate policy numbers with various carriers and are administered through Ridgepoint. While a comprehensive review of Lumos's entire insurance program is beyond the scope of this memorandum — as these additional lines are not specifically required by the Agreement — we have obtained confirmation from Ridgepoint that Lumos's commercial general liability coverage is in place and current, satisfying the requirement set forth in Section 14.2(c) of the Agreement. Should a more detailed review of any of these additional lines be required, we can coordinate with Ridgepoint to obtain the necessary documentation.

IV. Meridian's Insurance Program — Represented Coverage

A. Carrier and Policy Information

Calderwood & Harkness has reviewed the certificates of insurance furnished by Meridian in connection with the closing of the Agreement, together with representations made in the Officer's Certificate and correspondence from Meridian's outside counsel. The key terms of Meridian's insurance program are as follows:

Carrier: Rheinland Versicherung AG, a German-incorporated insurance company with its principal offices in Düsseldorf, Germany. Rheinland Versicherung AG is a well-established European insurer with a significant presence in the commercial lines market across Germany and the broader European Union. Based on our review of publicly available financial and rating information, Rheinland Versicherung AG maintains financial strength ratings consistent with the Agreement's requirement that Meridian's insurance carriers be rated at least "A-" by a recognized rating agency.

Policy Number: RV-2024-1148703.

Coverage Represented by Meridian:

Commercial General Liability: Coverage of not less than €5,000,000 per occurrence — satisfies the contractual minimum set forth in Section 14.1(a) of the Agreement.

Professional Indemnity: Coverage of not less than €10,000,000 per occurrence — satisfies the contractual minimum set forth in Section 14.1(b) of the Agreement.

Cyber Liability: Coverage of not less than €5,000,000 per occurrence — satisfies the contractual minimum set forth in Section 14.1(c) of the Agreement.

B. Verification Process

Calderwood & Harkness has undertaken the following steps to verify the adequacy and currency of Meridian's insurance coverage:

Officer's Certificate. Meridian has delivered an Officer's Certificate executed by Florian Eckstein, in his capacity as Geschäftsführer (Managing Director) of Meridian Data Solutions GmbH, dated March 22, 2024. In the Officer's Certificate, Mr. Eckstein represents and warrants that Meridian maintains the insurance coverage required by Article 14 of the Agreement, that such coverage is in full force and effect as of the date of the certificate, and that Meridian has not received any notice of cancellation, non-renewal, or material reduction in coverage from Rheinland Versicherung AG or any other applicable carrier. The Officer's Certificate further represents that Meridian is in compliance with all terms and conditions of its insurance policies and has paid all premiums due thereunder.

Certificates of Insurance. Meridian has provided certificates of insurance issued by Rheinland Versicherung AG or its authorized insurance broker, confirming the coverage types, limits, and policy periods described above. Calderwood & Harkness has reviewed these certificates and confirmed that the stated coverage meets or exceeds all contractual thresholds imposed by Section 14.1 of the Agreement. The certificates further confirm that the Rheinland policy is in full force and effect as of the closing date.

Correspondence from Meridian's Outside Counsel. Meridian's outside counsel, Kessler Hartmann Rechtsanwälte PartG mbB, acting through Dr. Stefan Kessler of its Munich office (Maximilianstraße 35, 80539 München, Germany), has provided correspondence to Calderwood & Harkness confirming the currency and adequacy of Meridian's insurance coverage under the Rheinland policy. Dr. Kessler's letter, dated March 18, 2024, confirms that: (i) the Rheinland policy is in full force and effect; (ii) all premiums have been paid in full through the current policy period; (iii) the policy limits meet or exceed the contractual minimums specified in the Agreement; and (iv) the policy provides coverage for claims arising in all EMEA territories in which Meridian is authorized to conduct resale activities under the Agreement.

Carrier Financial Stability. As noted above, Rheinland Versicherung AG's financial stability and market reputation have been assessed as satisfactory for purposes of the Agreement's requirement that insurance be maintained with a "reputable carrier" rated at least "A-" by a recognized rating agency. Rheinland Versicherung AG is a member of a major German insurance group with substantial statutory capital and surplus, and its financial strength is widely recognized in the European commercial insurance market.

C. Compliance Summary Table for Meridian

The following table summarizes Meridian's compliance with the contractual insurance minimums set forth in Section 14.1 of the Agreement:

Based on our review, all three categories of required coverage are in compliance with the contractual minimums. We note that the certificates of insurance provided by Meridian indicate that certain of the coverages may exceed the stated minimums; however, for purposes of this compliance review, we have confirmed that the minimums are met and have not independently audited the precise maximum coverage amounts beyond what was represented.

V. Coordination with Ridgepoint Insurance Brokers Inc.

As referenced throughout this memorandum, Calderwood & Harkness has coordinated with Sandra Nwosu, Account Executive at Ridgepoint Insurance Brokers Inc., in connection with our review of Lumos's insurance program. Ms. Nwosu has been consulted on the following matters, and her input has informed the analysis and recommendations set forth in this memorandum:

Confirmation of Atlas Mutual Policy Terms. Ms. Nwosu confirmed the coverage limits, scope, deductible/retention, and territorial scope of Atlas Mutual Policy No. AML-TECH-2024-07829. She provided a detailed summary of policy terms and confirmed that the worldwide territorial scope of the policy encompasses the EMEA Territory as defined in the Agreement, including all EEA member states, the United Kingdom, Switzerland, and the additional Middle Eastern and African countries specified in Schedule 1 to the Agreement.

EMEA Endorsement Analysis. Calderwood & Harkness inquired whether any endorsements or riders to the Atlas Mutual policy would be needed to specifically address the EMEA channel reseller arrangement established by the Agreement. After reviewing the policy terms and the structure of the distribution arrangement, Ms. Nwosu concluded that the existing worldwide territory provision in the policy is sufficient to cover the EMEA distribution activities and that no additional endorsement is required. The policy already covers claims arising from the provision of the Lumos Prism™ platform to end users worldwide, regardless of whether those end users access the platform directly or through an authorized channel reseller such as Meridian. Ms. Nwosu noted that the channel reseller arrangement does not alter the fundamental insured activities (i.e., the provision of the SaaS platform) and therefore does not trigger any endorsement or rider requirements.

Market Benchmarking. At our request, Ms. Nwosu conducted a market benchmarking analysis of Lumos's E&O / cyber liability limits against comparable SaaS and fintech companies engaged in international channel distribution. The benchmarking analysis confirmed that Lumos's $10,000,000 per occurrence / $20,000,000 aggregate limits are at or above the median for companies with comparable ARR ($150M–$250M range), comparable product complexity, and comparable geographic distribution footprints. Ms. Nwosu noted that some companies in this peer group maintain higher aggregate limits (in the $25M–$50M range), particularly those with significant EMEA revenue streams or those engaged in regulated industries (e.g., financial services, healthcare), but that Lumos's current limits are within the range of commercially reasonable coverage for its risk profile.

Forward-Looking Recommendation. Ms. Nwosu recommended that Lumos consider increasing its aggregate limits at the next renewal cycle if EMEA revenue under the Agreement ramps materially beyond the minimum annual commitment ("MAC") schedule. Under the Agreement, the MAC schedule increases over the five-year term, with MACs reaching $6,300,000 in Year 4 and $6,900,000 in Year 5. If Meridian's actual resale performance significantly exceeds the MAC levels — which is a reasonable possibility given the breadth of the EMEA Territory and the growth trajectory of the enterprise analytics market — the aggregate revenue flowing through the EMEA channel could reach levels that warrant higher insurance limits. Ms. Nwosu indicated that she would discuss this consideration with Lumos's risk management team in advance of the next renewal cycle and would obtain preliminary quotations for increased limits or excess coverage layers from Atlas Mutual or alternative carriers.

VI. Risk Considerations and Gap Analysis

While both parties' insurance programs satisfy the contractual requirements set forth in the Agreement, our review has identified certain risk considerations and potential gaps that warrant attention. These are discussed below.

A. Lumos's Uncapped IP Indemnification Exposure

As noted in Section III.B above, the indemnification framework in the Agreement provides that Lumos's obligation to indemnify Meridian against third-party intellectual property infringement claims under Section 12.1(a) is uncapped — that is, this category of indemnification obligation is carved out from the $15,000,000 aggregate indemnification cap that applies to other categories of indemnifiable claims. This carve-out reflects a common commercial allocation of IP infringement risk in software distribution agreements, under which the platform provider bears primary responsibility for the infringement-free nature of its technology.

However, Lumos's E&O / cyber liability policy under Atlas Mutual provides coverage with a $10,000,000 per-occurrence limit and a $20,000,000 aggregate limit. While these limits provide substantial coverage, they may not fully backstop an uncapped IP infringement claim of extraordinary magnitude. In the event that a third party were to assert a significant patent, copyright, or trade secret claim against the Lumos Prism™ platform — particularly in connection with EMEA distribution, where patent assertion entities have become increasingly active in certain European jurisdictions — the damages, settlement costs, and defense expenses associated with such a claim could theoretically exceed the available policy limits.

Recommendation: Lumos should discuss with Sandra Nwosu and the broader Ridgepoint team the availability and cost of excess or umbrella coverage, or a dedicated intellectual property indemnity insurance product, to address this tail risk. Dedicated IP indemnity policies, while relatively specialized, are available in the London and Bermuda markets and can provide meaningful additional coverage for IP infringement exposures. The cost-benefit analysis of such coverage should take into account the nature of Lumos's technology stack, any known freedom-to-operate opinions or patent clearance analyses, and the specific jurisdictions within the EMEA Territory in which IP enforcement activity is most prevalent.

B. Cross-Border Claims and Jurisdictional Issues

The EMEA-wide distribution contemplated by the Agreement may give rise to claims in multiple jurisdictions, including EU member states, the United Kingdom, Switzerland, and the additional territories specified in Schedule 1. This cross-border exposure creates the potential for claims to be asserted under the laws of various jurisdictions, each with its own substantive liability standards, procedural rules, and damages frameworks.

We have confirmed that the Atlas Mutual policy maintained by Lumos provides worldwide coverage, including defense cost coverage in non-U.S. jurisdictions. This means that if a claim is asserted against Lumos in a court or regulatory proceeding in an EMEA jurisdiction, the policy will respond to provide coverage for defense costs (including the appointment of local counsel in the relevant jurisdiction) and any resulting damages or settlements, subject to the policy's terms, conditions, and exclusions.

Similarly, we have confirmed — through the certificates of insurance and correspondence from Kessler Hartmann — that Meridian's Rheinland policy covers claims arising in all EMEA territories, and is not limited to claims arising in Germany. This is an important confirmation, given that Meridian's pre-approved sub-distributors operate in the United Kingdom and France, and resale activities are expected to extend across the broader EMEA Territory. If Meridian were involved in a claim arising from resale activities in, for example, the United Kingdom or a Middle Eastern jurisdiction, the Rheinland policy would respond to provide coverage in that jurisdiction.

No additional action is required at this time with respect to cross-border coverage, but we recommend that this issue be monitored on an ongoing basis, particularly if the Agreement is amended to expand the EMEA Territory or if Meridian appoints additional sub-distributors in jurisdictions not currently contemplated.

C. Sub-Distributor Coverage

The Agreement, in Section 5.3, permits Meridian to appoint sub-distributors for the Lumos Prism™ platform within the EMEA Territory, subject to Lumos's prior written approval. As of the closing date, two sub-distributors have been pre-approved by Lumos:

Meridian Data Solutions UK Ltd, a company incorporated in England and Wales (Companies House No. 12847391), with its registered office at 14 Fenchurch Place, London EC3M 5AJ, United Kingdom. The sole director of Meridian UK is Katarina Voss. Meridian UK is responsible for resale and first-line support activities in the United Kingdom and Ireland.

Meridian Data Solutions SARL, a French société à responsabilité limitée (SIREN 912 483 057), with its registered office at 27 Rue de la Boétie, 75008 Paris, France. The gérant (managing director) of Meridian France is Jean-Philippe Moreau. Meridian France is responsible for resale and first-line support activities in France, Belgium, Luxembourg, and certain francophone markets in North and West Africa.

Section 5.3(c) of the Agreement requires that each approved sub-distributor maintain insurance coverage comparable to the coverage required of Meridian under Section 14.1, including CGL of not less than €5,000,000 per occurrence, professional indemnity of not less than €10,000,000 per occurrence, and cyber liability of not less than €5,000,000 per occurrence. Meridian has represented in its closing deliverables that its sub-distributors are covered under the Rheinland master policy (Policy No. RV-2024-1148703) as named or scheduled insureds, or alternatively maintain their own comparable coverage.

Recommendation: While Meridian's representation is noted, Calderwood & Harkness recommends that Lumos request certificates of insurance directly from Meridian Data Solutions UK Ltd and Meridian Data Solutions SARL confirming that each sub-distributor maintains insurance coverage at or above the contractual minimums. In the alternative, Lumos should request written confirmation from Rheinland Versicherung AG (or its authorized broker) that Meridian UK and Meridian France are specifically named or scheduled as insureds under Rheinland Policy No. RV-2024-1148703, with coverage limits at or above the contractual minimums applicable to sub-distributors. This confirmation should be obtained prior to the commencement of resale activities by the sub-distributors and should be refreshed on an annual basis consistent with the certificate renewal obligations under the Agreement.

D. Escrow Holdback as Complementary Mechanism

As discussed in Section III.B above, the Agreement provides for a 5% escrow holdback on all reseller fees payable to Meridian, with the holdback amounts deposited into an escrow account maintained by Evergreen Trust Company, N.A. The escrow agent is Maria Gutierrez, Escrow Officer, located at 400 South Hope Street, Suite 1100, Los Angeles, CA 90071. The escrow holdback is governed by the Escrow Agreement attached to the Agreement as Exhibit G.

In Year 1 of the Agreement (April 1, 2024 – March 31, 2025), the quarterly escrow deposit is estimated at $56,250, based on Meridian's Year 1 minimum annual commitment of $4,500,000 and the 5% holdback rate. The escrow deposits will scale with increases in the MAC over subsequent years: the Year 2 MAC of $5,400,000 would yield quarterly deposits of approximately $67,500; the Year 3 MAC of $5,850,000 would yield approximately $73,125; the Year 4 MAC of $6,300,000 would yield approximately $78,750; and the Year 5 MAC of $6,900,000 would yield approximately $86,250. If Meridian's actual resale performance exceeds the MAC levels, the escrow holdback amounts would be correspondingly higher.

The escrow holdback serves as a complementary indemnification funding mechanism, providing Lumos with a readily accessible reserve of funds to satisfy lower-value indemnification claims without the need to pursue a direct claim against Meridian. However, the escrow is modest in absolute dollar terms relative to the overall risk profile of the arrangement. At its maximum estimated annual accumulation in Year 5 (approximately $345,000, assuming performance at the MAC level), the escrow would be sufficient to address only relatively minor claims.

Accordingly, insurance remains the primary risk-transfer mechanism under the Agreement. The escrow holdback is best understood as a supplementary reserve for lower-value indemnification claims or as a mechanism to fund deductible or self-insured retention obligations. It should not be relied upon as a substitute for the comprehensive coverage provided by the parties' insurance programs.

VII. Annual Monitoring and Renewal Obligations

Ongoing compliance with the insurance requirements of the Agreement will require diligent monitoring by both parties throughout the initial five-year term and any renewal periods. The following procedures and obligations should be observed:

Duration of Insurance Obligations. Both parties are contractually required to maintain the insurance coverage specified in Article 14 of the Agreement throughout the initial five-year term (April 1, 2024 through March 31, 2029) and during any renewal periods. In addition, as noted above, Section 14.4 requires each party to maintain the required coverage for a tail period of not less than thirty-six (36) months following the expiration or earlier termination of the Agreement.

Annual Certificate Exchange. Under Section 14.3 of the Agreement, updated certificates of insurance must be exchanged between the parties within thirty (30) days of each policy renewal. This obligation applies to both Lumos and Meridian, and extends to certificates confirming coverage for pre-approved sub-distributors.

Internal Calendar and Tracking. Lumos's internal compliance team, under the direction of Daniel Ostroff, Vice President of Legal & Compliance, should establish a calendared annual review process for monitoring Meridian's insurance certificates. This process should include:

(a) Setting calendar reminders approximately forty-five (45) days before the expected renewal date of Meridian's Rheinland policy, to allow sufficient lead time for follow-up if certificates are not received within the thirty-day contractual window;

(b) Reviewing each certificate of insurance upon receipt to confirm that coverage types, limits, carrier ratings, and named insured / additional insured designations remain in compliance with the Agreement;

(d) Flagging any deficiencies or changes in coverage for immediate follow-up with Meridian and, if necessary, with Calderwood & Harkness.

Ridgepoint Renewal Coordination. Sandra Nwosu at Ridgepoint Insurance Brokers Inc. should be directed to provide renewal reminders and updated certificates for Atlas Mutual Policy No. AML-TECH-2024-07829 in advance of each annual renewal. Ms. Nwosu should also be instructed to notify Lumos's legal department and Calderwood & Harkness promptly in the event of any material change to the Atlas Mutual policy, including but not limited to changes in coverage limits, exclusions, deductible/retention amounts, or carrier financial condition.

Meridian's Right to Change Carriers. If Meridian changes carriers or reduces its coverage below the contractual minimums, Section 14.5 of the Agreement provides Lumos with a right to require restoration of coverage as a condition to the continued authorization of Meridian as an approved reseller. Specifically, Lumos may deliver a written notice to Meridian specifying the deficiency and requiring Meridian to restore coverage to the contractual minimums within thirty (30) days. If Meridian fails to restore coverage within the cure period, Lumos may suspend Meridian's reseller authorization or, at Lumos's election, terminate the Agreement for material breach in accordance with Section 16.2(a). This remedial framework provides Lumos with meaningful leverage to ensure ongoing compliance with the insurance requirements.

VIII. Conclusions and Recommendations

Based on our review of the contractual insurance requirements set forth in the Agreement, the existing insurance programs maintained by both Lumos and Meridian, our coordination with Ridgepoint Insurance Brokers Inc., and the verification materials received from Meridian and its outside counsel, we reach the following conclusions and recommendations:

1. Lumos's coverage is compliant. Atlas Mutual Insurance Company Policy No. AML-TECH-2024-07829, providing errors and omissions / technology professional liability / cyber liability coverage with limits of $10,000,000 per occurrence and $20,000,000 aggregate, satisfies the insurance requirements imposed on Lumos under Section 14.2 of the Agreement and provides adequate protection for the EMEA distribution activities contemplated thereunder. The worldwide territorial scope of the policy encompasses the entire EMEA Territory, and the coverage scope addresses the key risk areas relevant to the Lumos Prism™ platform distribution arrangement, including IP infringement defense, data protection liability, and technology errors.

2. Meridian's coverage is compliant. Based on the certificates of insurance reviewed by Calderwood & Harkness, the representations made by Florian Eckstein in the Officer's Certificate dated March 22, 2024, and the confirmation provided by Meridian's outside counsel (Dr. Stefan Kessler of Kessler Hartmann Rechtsanwälte PartG mbB), Rheinland Versicherung AG Policy No. RV-2024-1148703 meets or exceeds all contractual minimums set forth in Section 14.1 of the Agreement, specifically: commercial general liability of not less than €5,000,000 per occurrence, professional indemnity of not less than €10,000,000 per occurrence, and cyber liability of not less than €5,000,000 per occurrence.

3. Recommendation — IP Indemnity Excess Coverage. Given the uncapped nature of Lumos's intellectual property infringement indemnification obligation under Section 12.1(a) of the Agreement, Lumos should explore with Ridgepoint Insurance Brokers Inc. whether excess or umbrella coverage, or a dedicated IP indemnity insurance product, is available and commercially justified to address the tail risk of an extraordinary IP infringement claim. This exploration should include a cost-benefit analysis, taking into account the nature of Lumos's technology stack, the EMEA IP enforcement landscape, and the availability of coverage in the London and Bermuda specialty markets.

4. Recommendation — Sub-Distributor Certificates. Lumos should request certificates of insurance from Meridian Data Solutions UK Ltd (Companies House No. 12847391) and Meridian Data Solutions SARL (SIREN 912 483 057) to confirm that each pre-approved sub-distributor maintains insurance coverage at or above the contractual minimums required by Section 5.3(c) of the Agreement. In the alternative, Lumos should request written confirmation from Rheinland Versicherung AG that Meridian UK and Meridian France are specifically named or scheduled as insureds under Rheinland Policy No. RV-2024-1148703. This confirmation should be obtained prior to the commencement of sub-distributor resale activities and refreshed annually.

5. Recommendation — Annual Monitoring. Lumos should establish a calendared annual review process for monitoring both parties' insurance certificates, coordinated between Daniel Ostroff (Vice President, Legal & Compliance, Lumos Analytics Inc.) and Sandra Nwosu (Account Executive, Ridgepoint Insurance Brokers Inc.). The review process should include calendar reminders, certificate review and documentation, and a protocol for addressing any deficiencies or changes in coverage. Sandra Nwosu should be directed to provide renewal reminders and updated certificates for the Atlas Mutual policy in advance of each renewal cycle.

We are available to discuss the foregoing analysis and recommendations at your convenience. If additional review is required with respect to any of the matters addressed in this memorandum, or if the terms of the Agreement or the parties' insurance programs change materially, we will update our analysis accordingly.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Robert Jansen Associate

IX. Appendices

Appendix A — Summary of Atlas Mutual Insurance Company Policy

Policy Number: AML-TECH-2024-07829

Named Insured: Lumos Analytics Inc., a Delaware corporation

Carrier: Atlas Mutual Insurance Company One Liberty Plaza Hartford, CT 06103

Coverage Type: Errors & Omissions / Technology Professional Liability / Cyber Liability (combined policy)

Coverage Limits:

• $10,000,000 per occurrence

• $20,000,000 annual aggregate

Territorial Scope: Worldwide (including EMEA Territory)

Policy Period: Current annual period (renewal date to be confirmed with Ridgepoint)

Broker of Record: Ridgepoint Insurance Brokers Inc. Sandra Nwosu, Account Executive 200 Vesey Street, Suite 2400 New York, NY 10281

A.M. Best Rating (Atlas Mutual): A (Excellent), Financial Size Category XII

Appendix B — Summary of Rheinland Versicherung AG Policy

Policy Number: RV-2024-1148703

Named Insured: Meridian Data Solutions GmbH, a company organized under the laws of the Federal Republic of Germany

Carrier: Rheinland Versicherung AG, Düsseldorf, Germany

Coverage Types and Limits:

Territorial Scope: EMEA-wide (confirmed to cover claims arising in all EMEA territories, not limited to Germany)

Policy Period: Current annual period (as confirmed by certificates of insurance and correspondence from Kessler Hartmann Rechtsanwälte PartG mbB)

Carrier Rating: Satisfies Agreement requirement of reputable carrier rated at least A- by a recognized rating agency

Appendix C — Relevant Excerpts from the Channel Reseller Program Agreement

The following are verbatim excerpts from the execution version of the Channel Reseller Program Agreement between Lumos Analytics Inc. and Meridian Data Solutions GmbH, dated March 22, 2024, relevant to the insurance requirements analyzed in this memorandum. These excerpts are reproduced for reference purposes only and are subject to the full text of the Agreement, which controls in the event of any discrepancy.

Article 14 — Insurance

Section 14.1 — Reseller Insurance Requirements

Section 14.2 — Provider Insurance Requirements

Section 14.3 — Certificates of Insurance

Section 14.4 — Tail Coverage

Section 14.5 — Remedies for Insurance Deficiency

Section 5.3(c) — Sub-Distributor Insurance

Article 12 — Indemnification (relevant excerpts regarding indemnification cap and uncapped carve-outs)

Note: Full verbatim excerpts of the above provisions are maintained in the Calderwood & Harkness matter file (Matter No. 1008-00010) and are available upon request. Due to the confidential and privileged nature of the Agreement, the full text of these provisions has not been reproduced in this memorandum but has been reviewed in their entirety in preparing the analysis set forth herein.

Appendix D — Correspondence with Ridgepoint Insurance Brokers Inc.

The following is a summary of communications between Calderwood & Harkness LLP and Ridgepoint Insurance Brokers Inc. relevant to the insurance compliance review set forth in this memorandum. Copies of all referenced correspondence are maintained in the Calderwood & Harkness matter file (Matter No. 1008-00010).

1. Email from Sandra Nwosu (Ridgepoint) to Robert Jansen (Calderwood & Harkness), dated March 8, 2024. Subject: Confirmation of Atlas Mutual Policy Terms for Lumos Analytics Inc. Ms. Nwosu provided a summary of the key terms of Atlas Mutual Policy No. AML-TECH-2024-07829, including coverage limits, scope, territorial provisions, and deductible/retention information. Ms. Nwosu confirmed the worldwide territorial scope and the absence of any territorial limitation that would exclude EMEA activities.

2. Email from Robert Jansen (Calderwood & Harkness) to Sandra Nwosu (Ridgepoint), dated March 11, 2024. Subject: EMEA Channel Reseller Arrangement — Endorsement Inquiry. Mr. Jansen inquired whether any endorsements or riders would be required to specifically address the EMEA channel reseller arrangement under the Agreement.

3. Email from Sandra Nwosu (Ridgepoint) to Robert Jansen (Calderwood & Harkness), dated March 13, 2024. Subject: RE: EMEA Channel Reseller Arrangement — Endorsement Inquiry. Ms. Nwosu confirmed that no additional endorsement is required, as the existing worldwide territory provision in the Atlas Mutual policy is sufficient to cover EMEA distribution activities through the channel reseller arrangement.

4. Telephone call between Sandra Nwosu (Ridgepoint) and Robert Jansen (Calderwood & Harkness), March 15, 2024. Subject: Market Benchmarking and Forward-Looking Coverage Recommendations. Ms. Nwosu provided benchmarking data on E&O/cyber liability limits for comparable SaaS/fintech companies and recommended that Lumos consider increasing aggregate limits at the next renewal cycle if EMEA revenue ramps materially beyond the MAC schedule. Ms. Nwosu also discussed the availability of excess coverage and dedicated IP indemnity products in the specialty markets.

5. Email from Sandra Nwosu (Ridgepoint) to Robert Jansen (Calderwood & Harkness), dated March 18, 2024. Subject: Confirmation of CGL Coverage — Lumos Analytics Inc. Ms. Nwosu confirmed that Lumos's commercial general liability coverage is in place and current under a separate policy, satisfying the CGL requirement of the Agreement.

— End of Memorandum —

Coverage Type	Contractual Minimum (Section 14.1)	Meridian's Coverage (Rheinland Policy RV-2024-1148703)	Compliant?
Commercial General Liability	≥ €5,000,000 per occurrence	≥ €5,000,000 per occurrence	Yes
Professional Indemnity	≥ €10,000,000 per occurrence	≥ €10,000,000 per occurrence	Yes
Cyber Liability	≥ €5,000,000 per occurrence	≥ €5,000,000 per occurrence	Yes
Coverage Type	Per-Occurrence Limit
Commercial General Liability	≥ €5,000,000
Professional Indemnity	≥ €10,000,000
Cyber Liability	≥ €5,000,000

MEMORANDUM
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
TO: Howard Bellamy, Partner, Calderwood & Harkness LLP Daniel Ostroff, Vice President, Legal & Compliance, Lumos Analytics Inc.
FROM: Robert Jansen, Associate, Calderwood & Harkness LLP
DATE: March 20, 2024
RE: Insurance Requirements Compliance Review — Channel Reseller Program Agreement between Lumos Analytics Inc. and Meridian Data Solutions GmbH
MATTER NO.: 1008-00010
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to review and confirm compliance with all insurance requirements imposed under the Channel Reseller Program Agreement (the "Agreement") by and between Lumos Analytics Inc., a Delaware corporation ("Lumos"), and Meridian Data Solutions GmbH, a company organized under the laws of the Federal Republic of Germany ("Meridian"), dated March 22, 2024. The Agreement governs the non-exclusive resale of the Lumos Prism™ cloud-based analytics platform across the EMEA Territory (as defined therein to include the European Economic Area, the United Kingdom, Switzerland, and certain additional countries in the Middle East and Africa as specified in Schedule 1 to the Agreement).
The Agreement carries an aggregate deal value of approximately $30,000,000 over its initial five-year term commencing April 1, 2024 and expiring March 31, 2029. Given the magnitude of the transaction, the cross-border nature of the distribution arrangement, and the sensitivity of the data processed through the Lumos Prism™ platform — including personal data subject to the European Union General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and the United Kingdom General Data Protection Regulation ("UK GDPR") — robust insurance coverage for both parties is essential to mitigate the spectrum of contractual, regulatory, and operational risks inherent in the arrangement.
In preparing this memorandum, Calderwood & Harkness LLP has coordinated with Ridgepoint Insurance Brokers Inc. ("Ridgepoint"), Lumos's insurance broker of record. Our primary contact at Ridgepoint has been Sandra Nwosu, Account Executive, located at 200 Vesey Street, Suite 2400, New York, NY 10281. Ms. Nwosu has provided confirmation of Lumos's existing coverage under its errors and omissions / cyber liability policy issued by Atlas Mutual Insurance Company and has assisted with our assessment of the adequacy of that coverage relative to the contractual requirements and the risk profile of the EMEA channel distribution arrangement.
Additionally, Calderwood & Harkness has reviewed certificates of insurance furnished by Meridian, as well as representations made by Meridian's officer in the Officer's Certificate delivered at closing and correspondence from Meridian's outside counsel, Kessler Hartmann Rechtsanwälte PartG mbB.
Based on our review, we conclude that both parties' insurance programs satisfy the contractual requirements set forth in the Agreement, subject to certain monitoring recommendations and risk mitigation considerations described in detail in Sections VI, VII, and VIII of this memorandum. In particular, we recommend that Lumos explore the availability of excess or dedicated intellectual property indemnity insurance to address the uncapped IP infringement indemnification exposure under the Agreement, and that Lumos request certificates of insurance from Meridian's pre-approved sub-distributors to confirm coverage at the sub-distributor level.
II. Contractual Insurance Requirements
A. Insurance Provisions in the Agreement
Article 14 of the Agreement (entitled "Insurance") sets forth the insurance obligations applicable to each party. Section 14.1 imposes specific minimum coverage requirements on Meridian as the reseller, while Section 14.2 requires Lumos, as the platform provider, to maintain insurance coverage appropriate to its role in providing the Lumos Prism™ SaaS platform and supporting EMEA distribution activities. Section 14.3 addresses procedural requirements applicable to both parties, including the furnishing of certificates of insurance.
The insurance obligations under the Agreement apply from the Effective Date (defined as April 1, 2024) and continue throughout the initial five-year term of the Agreement and any renewal periods. Importantly, Section 14.4 provides that each party shall maintain the required insurance coverage for a tail period of not less than thirty-six (36) months following the expiration or earlier termination of the Agreement, ensuring that claims arising from activities conducted during the term but reported after termination are covered under the applicable policies.
Under Section 14.3, each party is required to furnish certificates of insurance to the other party prior to the closing date (March 22, 2024) as a condition precedent to the effectiveness of the Agreement. Thereafter, updated certificates of insurance must be provided annually, within thirty (30) days of each policy renewal, for the duration of the term and the post-termination tail period. The Agreement further requires that, where applicable, each party shall cause the other party to be named as an additional insured under its commercial general liability policy, and that certificates of insurance shall reflect such additional insured status. Waiver of subrogation endorsements are required on all applicable policies in favor of the other party.
B. Lumos's Required Coverage
The Agreement imposes the following insurance requirements on Lumos as the platform provider:
Errors & Omissions (E&O) / Technology Professional Liability. Section 14.2(a) requires Lumos to maintain errors and omissions insurance, also referred to as technology professional liability insurance, with coverage limits adequate to the scope of the Lumos Prism™ SaaS platform and the EMEA distribution activities contemplated by the Agreement. The Agreement does not specify a fixed dollar minimum for Lumos's E&O coverage but instead requires that coverage be "commercially reasonable and consistent with industry practice for technology companies of comparable size and scope." This formulation provides flexibility but also requires a market benchmarking analysis, which we have conducted in coordination with Ridgepoint (as discussed in Section V below).
Cyber Liability / Network Security Insurance. Section 14.2(b) requires Lumos to maintain cyber liability and network security insurance, including coverage for data breach response, privacy liability, and network security events. This requirement is particularly important given the GDPR and UK GDPR compliance obligations applicable to the processing of EMEA customer data and the hosting of such data at the Stratos Cloud Services AG data center located in Frankfurt am Main, Germany (the "Frankfurt Data Center"), as specified in the Data Processing Addendum attached to the Agreement as Exhibit E. The cyber liability coverage must address, at a minimum, regulatory defense costs, consumer notification costs, credit monitoring expenses, forensic investigation costs, and third-party claims arising from unauthorized access to or disclosure of personal data processed through the Lumos Prism™ platform.
Commercial General Liability. Section 14.2(c) requires Lumos to maintain commercial general liability ("CGL") insurance providing standard coverage for third-party bodily injury and property damage claims. While the CGL requirement is less central to the risk profile of a SaaS distribution arrangement than the E&O and cyber liability requirements, it remains a standard contractual requirement and provides coverage for premises liability, products-completed operations, and personal and advertising injury claims that may arise in connection with Lumos's marketing and support activities in the EMEA Territory.
C. Meridian's Required Coverage
The Agreement imposes more specific and quantified insurance requirements on Meridian as the reseller. Section 14.1 of the Agreement requires Meridian to maintain the following minimum coverage:
Commercial General Liability (CGL). Meridian is required to maintain commercial general liability insurance with a minimum coverage limit of not less than €5,000,000 per occurrence. This coverage must include standard protection for third-party bodily injury, property damage, personal and advertising injury, and products-completed operations liability. The CGL policy must name Lumos as an additional insured with respect to claims arising out of or in connection with Meridian's performance under the Agreement.
Professional Indemnity (PI). Meridian is required to maintain professional indemnity insurance (the European equivalent of errors and omissions coverage) with a minimum coverage limit of not less than €10,000,000 per occurrence. This coverage must address claims arising from acts, errors, or omissions in Meridian's provision of reseller services, including the implementation, configuration, and first-line support services that Meridian is authorized to perform under the Agreement with respect to the Lumos Prism™ platform.
Cyber Liability. Meridian is required to maintain cyber liability insurance with a minimum coverage limit of not less than €5,000,000 per occurrence. This coverage must address data breach, privacy liability, and network security claims, including regulatory defense costs and third-party claims arising from the processing of customer data in connection with Meridian's resale and support activities. Given that Meridian will have access to certain categories of personal data as a processor or sub-processor under the GDPR framework, this coverage is essential to the overall risk allocation architecture of the Agreement.
Carrier Quality Requirement. Section 14.1(d) of the Agreement requires that all of Meridian's insurance policies be maintained with reputable carriers rated at least "A-" (A minus) by a recognized rating agency, such as A.M. Best, Standard & Poor's, or an equivalent European rating organization. This requirement ensures that the insurance backing Meridian's obligations is issued by financially stable and creditworthy carriers capable of paying claims.
Certificate Delivery. Meridian is required to provide certificates of insurance to Lumos at closing (March 22, 2024) and upon each annual renewal thereafter, as described in Section 14.3 of the Agreement.
III. Lumos's Insurance Program — Current Coverage
A. E&O / Cyber Liability Policy
Calderwood & Harkness has reviewed the certificate of insurance and policy summary for Lumos's primary errors and omissions / cyber liability policy, with the following key terms confirmed through Ridgepoint Insurance Brokers Inc.:
Carrier: Atlas Mutual Insurance Company, One Liberty Plaza, Hartford, CT 06103. Atlas Mutual is a well-established carrier in the technology errors and omissions and cyber liability markets, with an A.M. Best rating of "A" (Excellent), Financial Size Category XII, and a long-standing track record of providing coverage to enterprise software and SaaS companies.
Policy Number: AML-TECH-2024-07829.
Coverage Limits: $10,000,000 per occurrence / $20,000,000 annual aggregate.
Scope of Coverage: The policy provides comprehensive coverage for errors and omissions arising from the provision of the Lumos Prism™ SaaS platform, including but not limited to technology professional liability for claims alleging failure to perform, defects in software functionality, system downtime, data loss, and misrepresentation of platform capabilities. The policy also provides cyber liability coverage, including data breach response costs (notification, credit monitoring, public relations), privacy liability for claims arising from unauthorized access to or disclosure of personal data, network security liability for claims arising from failure to prevent unauthorized access, transmission of malicious code, or denial-of-service events, and regulatory defense costs for proceedings initiated by data protection authorities in any jurisdiction worldwide.
Policy Period: The current annual policy period runs through the next renewal date, which is to be confirmed with Ridgepoint upon the approaching renewal cycle. Ms. Nwosu has indicated that the current policy period is expected to renew without material changes to terms or limits, subject to final underwriting review by Atlas Mutual.
Territorial Scope: The policy provides worldwide coverage, including coverage for claims arising in the EMEA Territory. This territorial scope has been confirmed as adequate for the EMEA distribution activities contemplated under the Agreement. The worldwide territory covers not only claims brought in EMEA jurisdictions but also defense costs incurred in responding to regulatory proceedings initiated by EMEA data protection authorities, which is critical given the GDPR and UK GDPR compliance framework applicable to the Lumos Prism™ platform's processing of EMEA customer data at the Frankfurt Data Center.
Deductible / Self-Insured Retention: The policy includes a self-insured retention, the amount of which has been confirmed by Sandra Nwosu of Ridgepoint Insurance Brokers Inc. as consistent with market norms for companies of Lumos's size and risk profile. The self-insured retention applies to each covered claim and is the responsibility of Lumos as the named insured before the policy responds.
Broker of Record: Ridgepoint Insurance Brokers Inc., Sandra Nwosu, Account Executive, 200 Vesey Street, Suite 2400, New York, NY 10281. Ridgepoint serves as Lumos's insurance broker of record for all technology-related lines of coverage and has been Lumos's broker since 2019.
B. Adequacy Assessment
We have assessed the adequacy of Lumos's E&O / cyber liability coverage relative to the contractual requirements, the risk profile of the EMEA distribution arrangement, and prevailing market practices. Our assessment is as follows:
Limits Relative to Market Practice. The $10,000,000 per occurrence / $20,000,000 aggregate limits maintained by Lumos under the Atlas Mutual policy are consistent with market practice for SaaS and financial technology companies with Lumos's revenue profile. Lumos reported annual recurring revenue ("ARR") of $187.4 million for the fiscal year ended December 31, 2023. Based on benchmarking data provided by Ridgepoint, companies in the enterprise SaaS / fintech sector with ARR in the $150M–$250M range typically maintain E&O / cyber liability coverage with per-occurrence limits ranging from $5,000,000 to $15,000,000 and aggregate limits ranging from $15,000,000 to $30,000,000. Lumos's coverage falls comfortably within this range and, at the $10M/$20M level, is positioned at or slightly above the median for its peer group.
Coverage Scope Relative to Key Risk Areas. The scope of the Atlas Mutual policy addresses the key risk areas relevant to the Agreement, including the following:
IP Infringement Defense. The policy includes coverage for defense costs and damages arising from claims of intellectual property infringement, which supports Lumos's indemnification obligations under Section 12.1(a) of the Agreement (requiring Lumos to indemnify, defend, and hold harmless Meridian against third-party claims alleging that the Lumos Prism™ platform infringes a third party's patents, copyrights, trademarks, or trade secrets). As discussed further in Section VI.A below, the uncapped nature of this indemnification obligation warrants additional attention.
Data Protection Liability. The policy provides comprehensive coverage for privacy and data protection claims, aligned with the GDPR and UK GDPR compliance obligations set forth in the Data Processing Addendum (Exhibit E to the Agreement) and the data hosting arrangements at the Frankfurt Data Center operated by Stratos Cloud Services AG. This coverage addresses claims by data subjects, regulatory fines and penalties (to the extent insurable under applicable law), defense costs in regulatory proceedings, and breach notification expenses.
Technology Errors. The core E&O coverage addresses claims arising from failures in the Lumos Prism™ platform's performance, including claims for financial losses suffered by end users as a result of platform errors, system outages, data corruption, or misrepresentation of platform capabilities by Lumos or its authorized resellers.
Relationship to Contractual Indemnification Caps. The indemnification framework in the Agreement, set forth in Article 12, caps each party's aggregate indemnification liability at $15,000,000, which represents fifty percent (50%) of the total contract value ("TCV") of $30,000,000. However, the Agreement provides certain uncapped carve-outs from this aggregate indemnification cap, including: (i) indemnification obligations for intellectual property infringement under Section 12.1(a) (Lumos) and Section 12.2(a) (Meridian); (ii) liability arising from willful misconduct or fraud; and (iii) liability arising from breaches of the confidentiality obligations set forth in Article 10.
Lumos's E&O / cyber liability coverage at $20,000,000 aggregate provides an adequate backstop for indemnification claims falling within the $15,000,000 cap, as the aggregate policy limit exceeds the contractual indemnification cap by $5,000,000. However, for the uncapped carve-out categories — particularly IP infringement claims, which are the most likely category of uncapped claim to arise in the context of a SaaS distribution arrangement — the $10,000,000 per-occurrence / $20,000,000 aggregate limits may not fully backstop an IP infringement claim of extraordinary magnitude. This gap is analyzed further in Section VI.A below.
Escrow Holdback as Complementary Mechanism. The Agreement provides for a five percent (5%) escrow holdback on all reseller fees payable to Meridian, with the holdback amounts deposited into an escrow account maintained by Evergreen Trust Company, N.A. (escrow officer: Maria Gutierrez, 400 South Hope Street, Suite 1100, Los Angeles, CA 90071). In Year 1 of the Agreement, the quarterly escrow deposit is estimated at $56,250 (based on the Year 1 minimum annual commitment ("MAC") of $4,500,000). While this escrow provides a first-dollar indemnification reserve available to Lumos for lower-value indemnification claims, it is modest in absolute terms and is not a substitute for the comprehensive risk transfer afforded by insurance. Insurance remains the primary mechanism for addressing material claims.
C. Additional Lumos Coverage (General Note)
Lumos maintains a broader insurance program that includes, among other lines, commercial general liability coverage, directors' and officers' liability coverage, employment practices liability coverage, workers' compensation insurance, and umbrella / excess liability coverage. These additional policies are maintained under separate policy numbers with various carriers and are administered through Ridgepoint. While a comprehensive review of Lumos's entire insurance program is beyond the scope of this memorandum — as these additional lines are not specifically required by the Agreement — we have obtained confirmation from Ridgepoint that Lumos's commercial general liability coverage is in place and current, satisfying the requirement set forth in Section 14.2(c) of the Agreement. Should a more detailed review of any of these additional lines be required, we can coordinate with Ridgepoint to obtain the necessary documentation.
IV. Meridian's Insurance Program — Represented Coverage
A. Carrier and Policy Information
Calderwood & Harkness has reviewed the certificates of insurance furnished by Meridian in connection with the closing of the Agreement, together with representations made in the Officer's Certificate and correspondence from Meridian's outside counsel. The key terms of Meridian's insurance program are as follows:
Carrier: Rheinland Versicherung AG, a German-incorporated insurance company with its principal offices in Düsseldorf, Germany. Rheinland Versicherung AG is a well-established European insurer with a significant presence in the commercial lines market across Germany and the broader European Union. Based on our review of publicly available financial and rating information, Rheinland Versicherung AG maintains financial strength ratings consistent with the Agreement's requirement that Meridian's insurance carriers be rated at least "A-" by a recognized rating agency.
Policy Number: RV-2024-1148703.
Coverage Represented by Meridian:
Commercial General Liability: Coverage of not less than €5,000,000 per occurrence — satisfies the contractual minimum set forth in Section 14.1(a) of the Agreement.
Professional Indemnity: Coverage of not less than €10,000,000 per occurrence — satisfies the contractual minimum set forth in Section 14.1(b) of the Agreement.
Cyber Liability: Coverage of not less than €5,000,000 per occurrence — satisfies the contractual minimum set forth in Section 14.1(c) of the Agreement.
B. Verification Process
Calderwood & Harkness has undertaken the following steps to verify the adequacy and currency of Meridian's insurance coverage:
Officer's Certificate. Meridian has delivered an Officer's Certificate executed by Florian Eckstein, in his capacity as Geschäftsführer (Managing Director) of Meridian Data Solutions GmbH, dated March 22, 2024. In the Officer's Certificate, Mr. Eckstein represents and warrants that Meridian maintains the insurance coverage required by Article 14 of the Agreement, that such coverage is in full force and effect as of the date of the certificate, and that Meridian has not received any notice of cancellation, non-renewal, or material reduction in coverage from Rheinland Versicherung AG or any other applicable carrier. The Officer's Certificate further represents that Meridian is in compliance with all terms and conditions of its insurance policies and has paid all premiums due thereunder.
Certificates of Insurance. Meridian has provided certificates of insurance issued by Rheinland Versicherung AG or its authorized insurance broker, confirming the coverage types, limits, and policy periods described above. Calderwood & Harkness has reviewed these certificates and confirmed that the stated coverage meets or exceeds all contractual thresholds imposed by Section 14.1 of the Agreement. The certificates further confirm that the Rheinland policy is in full force and effect as of the closing date.
Correspondence from Meridian's Outside Counsel. Meridian's outside counsel, Kessler Hartmann Rechtsanwälte PartG mbB, acting through Dr. Stefan Kessler of its Munich office (Maximilianstraße 35, 80539 München, Germany), has provided correspondence to Calderwood & Harkness confirming the currency and adequacy of Meridian's insurance coverage under the Rheinland policy. Dr. Kessler's letter, dated March 18, 2024, confirms that: (i) the Rheinland policy is in full force and effect; (ii) all premiums have been paid in full through the current policy period; (iii) the policy limits meet or exceed the contractual minimums specified in the Agreement; and (iv) the policy provides coverage for claims arising in all EMEA territories in which Meridian is authorized to conduct resale activities under the Agreement.
Carrier Financial Stability. As noted above, Rheinland Versicherung AG's financial stability and market reputation have been assessed as satisfactory for purposes of the Agreement's requirement that insurance be maintained with a "reputable carrier" rated at least "A-" by a recognized rating agency. Rheinland Versicherung AG is a member of a major German insurance group with substantial statutory capital and surplus, and its financial strength is widely recognized in the European commercial insurance market.
C. Compliance Summary Table for Meridian
The following table summarizes Meridian's compliance with the contractual insurance minimums set forth in Section 14.1 of the Agreement:
Based on our review, all three categories of required coverage are in compliance with the contractual minimums. We note that the certificates of insurance provided by Meridian indicate that certain of the coverages may exceed the stated minimums; however, for purposes of this compliance review, we have confirmed that the minimums are met and have not independently audited the precise maximum coverage amounts beyond what was represented.
V. Coordination with Ridgepoint Insurance Brokers Inc.
As referenced throughout this memorandum, Calderwood & Harkness has coordinated with Sandra Nwosu, Account Executive at Ridgepoint Insurance Brokers Inc., in connection with our review of Lumos's insurance program. Ms. Nwosu has been consulted on the following matters, and her input has informed the analysis and recommendations set forth in this memorandum:
Confirmation of Atlas Mutual Policy Terms. Ms. Nwosu confirmed the coverage limits, scope, deductible/retention, and territorial scope of Atlas Mutual Policy No. AML-TECH-2024-07829. She provided a detailed summary of policy terms and confirmed that the worldwide territorial scope of the policy encompasses the EMEA Territory as defined in the Agreement, including all EEA member states, the United Kingdom, Switzerland, and the additional Middle Eastern and African countries specified in Schedule 1 to the Agreement.
EMEA Endorsement Analysis. Calderwood & Harkness inquired whether any endorsements or riders to the Atlas Mutual policy would be needed to specifically address the EMEA channel reseller arrangement established by the Agreement. After reviewing the policy terms and the structure of the distribution arrangement, Ms. Nwosu concluded that the existing worldwide territory provision in the policy is sufficient to cover the EMEA distribution activities and that no additional endorsement is required. The policy already covers claims arising from the provision of the Lumos Prism™ platform to end users worldwide, regardless of whether those end users access the platform directly or through an authorized channel reseller such as Meridian. Ms. Nwosu noted that the channel reseller arrangement does not alter the fundamental insured activities (i.e., the provision of the SaaS platform) and therefore does not trigger any endorsement or rider requirements.
Market Benchmarking. At our request, Ms. Nwosu conducted a market benchmarking analysis of Lumos's E&O / cyber liability limits against comparable SaaS and fintech companies engaged in international channel distribution. The benchmarking analysis confirmed that Lumos's $10,000,000 per occurrence / $20,000,000 aggregate limits are at or above the median for companies with comparable ARR ($150M–$250M range), comparable product complexity, and comparable geographic distribution footprints. Ms. Nwosu noted that some companies in this peer group maintain higher aggregate limits (in the $25M–$50M range), particularly those with significant EMEA revenue streams or those engaged in regulated industries (e.g., financial services, healthcare), but that Lumos's current limits are within the range of commercially reasonable coverage for its risk profile.
Forward-Looking Recommendation. Ms. Nwosu recommended that Lumos consider increasing its aggregate limits at the next renewal cycle if EMEA revenue under the Agreement ramps materially beyond the minimum annual commitment ("MAC") schedule. Under the Agreement, the MAC schedule increases over the five-year term, with MACs reaching $6,300,000 in Year 4 and $6,900,000 in Year 5. If Meridian's actual resale performance significantly exceeds the MAC levels — which is a reasonable possibility given the breadth of the EMEA Territory and the growth trajectory of the enterprise analytics market — the aggregate revenue flowing through the EMEA channel could reach levels that warrant higher insurance limits. Ms. Nwosu indicated that she would discuss this consideration with Lumos's risk management team in advance of the next renewal cycle and would obtain preliminary quotations for increased limits or excess coverage layers from Atlas Mutual or alternative carriers.
VI. Risk Considerations and Gap Analysis
While both parties' insurance programs satisfy the contractual requirements set forth in the Agreement, our review has identified certain risk considerations and potential gaps that warrant attention. These are discussed below.
A. Lumos's Uncapped IP Indemnification Exposure
As noted in Section III.B above, the indemnification framework in the Agreement provides that Lumos's obligation to indemnify Meridian against third-party intellectual property infringement claims under Section 12.1(a) is uncapped — that is, this category of indemnification obligation is carved out from the $15,000,000 aggregate indemnification cap that applies to other categories of indemnifiable claims. This carve-out reflects a common commercial allocation of IP infringement risk in software distribution agreements, under which the platform provider bears primary responsibility for the infringement-free nature of its technology.
However, Lumos's E&O / cyber liability policy under Atlas Mutual provides coverage with a $10,000,000 per-occurrence limit and a $20,000,000 aggregate limit. While these limits provide substantial coverage, they may not fully backstop an uncapped IP infringement claim of extraordinary magnitude. In the event that a third party were to assert a significant patent, copyright, or trade secret claim against the Lumos Prism™ platform — particularly in connection with EMEA distribution, where patent assertion entities have become increasingly active in certain European jurisdictions — the damages, settlement costs, and defense expenses associated with such a claim could theoretically exceed the available policy limits.
Recommendation: Lumos should discuss with Sandra Nwosu and the broader Ridgepoint team the availability and cost of excess or umbrella coverage, or a dedicated intellectual property indemnity insurance product, to address this tail risk. Dedicated IP indemnity policies, while relatively specialized, are available in the London and Bermuda markets and can provide meaningful additional coverage for IP infringement exposures. The cost-benefit analysis of such coverage should take into account the nature of Lumos's technology stack, any known freedom-to-operate opinions or patent clearance analyses, and the specific jurisdictions within the EMEA Territory in which IP enforcement activity is most prevalent.
B. Cross-Border Claims and Jurisdictional Issues
The EMEA-wide distribution contemplated by the Agreement may give rise to claims in multiple jurisdictions, including EU member states, the United Kingdom, Switzerland, and the additional territories specified in Schedule 1. This cross-border exposure creates the potential for claims to be asserted under the laws of various jurisdictions, each with its own substantive liability standards, procedural rules, and damages frameworks.
We have confirmed that the Atlas Mutual policy maintained by Lumos provides worldwide coverage, including defense cost coverage in non-U.S. jurisdictions. This means that if a claim is asserted against Lumos in a court or regulatory proceeding in an EMEA jurisdiction, the policy will respond to provide coverage for defense costs (including the appointment of local counsel in the relevant jurisdiction) and any resulting damages or settlements, subject to the policy's terms, conditions, and exclusions.
Similarly, we have confirmed — through the certificates of insurance and correspondence from Kessler Hartmann — that Meridian's Rheinland policy covers claims arising in all EMEA territories, and is not limited to claims arising in Germany. This is an important confirmation, given that Meridian's pre-approved sub-distributors operate in the United Kingdom and France, and resale activities are expected to extend across the broader EMEA Territory. If Meridian were involved in a claim arising from resale activities in, for example, the United Kingdom or a Middle Eastern jurisdiction, the Rheinland policy would respond to provide coverage in that jurisdiction.
No additional action is required at this time with respect to cross-border coverage, but we recommend that this issue be monitored on an ongoing basis, particularly if the Agreement is amended to expand the EMEA Territory or if Meridian appoints additional sub-distributors in jurisdictions not currently contemplated.
C. Sub-Distributor Coverage
The Agreement, in Section 5.3, permits Meridian to appoint sub-distributors for the Lumos Prism™ platform within the EMEA Territory, subject to Lumos's prior written approval. As of the closing date, two sub-distributors have been pre-approved by Lumos:
Meridian Data Solutions UK Ltd, a company incorporated in England and Wales (Companies House No. 12847391), with its registered office at 14 Fenchurch Place, London EC3M 5AJ, United Kingdom. The sole director of Meridian UK is Katarina Voss. Meridian UK is responsible for resale and first-line support activities in the United Kingdom and Ireland.
Meridian Data Solutions SARL, a French société à responsabilité limitée (SIREN 912 483 057), with its registered office at 27 Rue de la Boétie, 75008 Paris, France. The gérant (managing director) of Meridian France is Jean-Philippe Moreau. Meridian France is responsible for resale and first-line support activities in France, Belgium, Luxembourg, and certain francophone markets in North and West Africa.
Section 5.3(c) of the Agreement requires that each approved sub-distributor maintain insurance coverage comparable to the coverage required of Meridian under Section 14.1, including CGL of not less than €5,000,000 per occurrence, professional indemnity of not less than €10,000,000 per occurrence, and cyber liability of not less than €5,000,000 per occurrence. Meridian has represented in its closing deliverables that its sub-distributors are covered under the Rheinland master policy (Policy No. RV-2024-1148703) as named or scheduled insureds, or alternatively maintain their own comparable coverage.
Recommendation: While Meridian's representation is noted, Calderwood & Harkness recommends that Lumos request certificates of insurance directly from Meridian Data Solutions UK Ltd and Meridian Data Solutions SARL confirming that each sub-distributor maintains insurance coverage at or above the contractual minimums. In the alternative, Lumos should request written confirmation from Rheinland Versicherung AG (or its authorized broker) that Meridian UK and Meridian France are specifically named or scheduled as insureds under Rheinland Policy No. RV-2024-1148703, with coverage limits at or above the contractual minimums applicable to sub-distributors. This confirmation should be obtained prior to the commencement of resale activities by the sub-distributors and should be refreshed on an annual basis consistent with the certificate renewal obligations under the Agreement.
D. Escrow Holdback as Complementary Mechanism
As discussed in Section III.B above, the Agreement provides for a 5% escrow holdback on all reseller fees payable to Meridian, with the holdback amounts deposited into an escrow account maintained by Evergreen Trust Company, N.A. The escrow agent is Maria Gutierrez, Escrow Officer, located at 400 South Hope Street, Suite 1100, Los Angeles, CA 90071. The escrow holdback is governed by the Escrow Agreement attached to the Agreement as Exhibit G.
In Year 1 of the Agreement (April 1, 2024 – March 31, 2025), the quarterly escrow deposit is estimated at $56,250, based on Meridian's Year 1 minimum annual commitment of $4,500,000 and the 5% holdback rate. The escrow deposits will scale with increases in the MAC over subsequent years: the Year 2 MAC of $5,400,000 would yield quarterly deposits of approximately $67,500; the Year 3 MAC of $5,850,000 would yield approximately $73,125; the Year 4 MAC of $6,300,000 would yield approximately $78,750; and the Year 5 MAC of $6,900,000 would yield approximately $86,250. If Meridian's actual resale performance exceeds the MAC levels, the escrow holdback amounts would be correspondingly higher.
The escrow holdback serves as a complementary indemnification funding mechanism, providing Lumos with a readily accessible reserve of funds to satisfy lower-value indemnification claims without the need to pursue a direct claim against Meridian. However, the escrow is modest in absolute dollar terms relative to the overall risk profile of the arrangement. At its maximum estimated annual accumulation in Year 5 (approximately $345,000, assuming performance at the MAC level), the escrow would be sufficient to address only relatively minor claims.
Accordingly, insurance remains the primary risk-transfer mechanism under the Agreement. The escrow holdback is best understood as a supplementary reserve for lower-value indemnification claims or as a mechanism to fund deductible or self-insured retention obligations. It should not be relied upon as a substitute for the comprehensive coverage provided by the parties' insurance programs.
VII. Annual Monitoring and Renewal Obligations
Ongoing compliance with the insurance requirements of the Agreement will require diligent monitoring by both parties throughout the initial five-year term and any renewal periods. The following procedures and obligations should be observed:
Duration of Insurance Obligations. Both parties are contractually required to maintain the insurance coverage specified in Article 14 of the Agreement throughout the initial five-year term (April 1, 2024 through March 31, 2029) and during any renewal periods. In addition, as noted above, Section 14.4 requires each party to maintain the required coverage for a tail period of not less than thirty-six (36) months following the expiration or earlier termination of the Agreement.
Annual Certificate Exchange. Under Section 14.3 of the Agreement, updated certificates of insurance must be exchanged between the parties within thirty (30) days of each policy renewal. This obligation applies to both Lumos and Meridian, and extends to certificates confirming coverage for pre-approved sub-distributors.
Internal Calendar and Tracking. Lumos's internal compliance team, under the direction of Daniel Ostroff, Vice President of Legal & Compliance, should establish a calendared annual review process for monitoring Meridian's insurance certificates. This process should include:
(a) Setting calendar reminders approximately forty-five (45) days before the expected renewal date of Meridian's Rheinland policy, to allow sufficient lead time for follow-up if certificates are not received within the thirty-day contractual window;
(b) Reviewing each certificate of insurance upon receipt to confirm that coverage types, limits, carrier ratings, and named insured / additional insured designations remain in compliance with the Agreement;
(c) Documenting the review in Lumos's compliance files, with a copy retained in the matter file for the Agreement; and
(d) Flagging any deficiencies or changes in coverage for immediate follow-up with Meridian and, if necessary, with Calderwood & Harkness.
Ridgepoint Renewal Coordination. Sandra Nwosu at Ridgepoint Insurance Brokers Inc. should be directed to provide renewal reminders and updated certificates for Atlas Mutual Policy No. AML-TECH-2024-07829 in advance of each annual renewal. Ms. Nwosu should also be instructed to notify Lumos's legal department and Calderwood & Harkness promptly in the event of any material change to the Atlas Mutual policy, including but not limited to changes in coverage limits, exclusions, deductible/retention amounts, or carrier financial condition.
Meridian's Right to Change Carriers. If Meridian changes carriers or reduces its coverage below the contractual minimums, Section 14.5 of the Agreement provides Lumos with a right to require restoration of coverage as a condition to the continued authorization of Meridian as an approved reseller. Specifically, Lumos may deliver a written notice to Meridian specifying the deficiency and requiring Meridian to restore coverage to the contractual minimums within thirty (30) days. If Meridian fails to restore coverage within the cure period, Lumos may suspend Meridian's reseller authorization or, at Lumos's election, terminate the Agreement for material breach in accordance with Section 16.2(a). This remedial framework provides Lumos with meaningful leverage to ensure ongoing compliance with the insurance requirements.
VIII. Conclusions and Recommendations
Based on our review of the contractual insurance requirements set forth in the Agreement, the existing insurance programs maintained by both Lumos and Meridian, our coordination with Ridgepoint Insurance Brokers Inc., and the verification materials received from Meridian and its outside counsel, we reach the following conclusions and recommendations:
1. Lumos's coverage is compliant. Atlas Mutual Insurance Company Policy No. AML-TECH-2024-07829, providing errors and omissions / technology professional liability / cyber liability coverage with limits of $10,000,000 per occurrence and $20,000,000 aggregate, satisfies the insurance requirements imposed on Lumos under Section 14.2 of the Agreement and provides adequate protection for the EMEA distribution activities contemplated thereunder. The worldwide territorial scope of the policy encompasses the entire EMEA Territory, and the coverage scope addresses the key risk areas relevant to the Lumos Prism™ platform distribution arrangement, including IP infringement defense, data protection liability, and technology errors.
2. Meridian's coverage is compliant. Based on the certificates of insurance reviewed by Calderwood & Harkness, the representations made by Florian Eckstein in the Officer's Certificate dated March 22, 2024, and the confirmation provided by Meridian's outside counsel (Dr. Stefan Kessler of Kessler Hartmann Rechtsanwälte PartG mbB), Rheinland Versicherung AG Policy No. RV-2024-1148703 meets or exceeds all contractual minimums set forth in Section 14.1 of the Agreement, specifically: commercial general liability of not less than €5,000,000 per occurrence, professional indemnity of not less than €10,000,000 per occurrence, and cyber liability of not less than €5,000,000 per occurrence.
3. Recommendation — IP Indemnity Excess Coverage. Given the uncapped nature of Lumos's intellectual property infringement indemnification obligation under Section 12.1(a) of the Agreement, Lumos should explore with Ridgepoint Insurance Brokers Inc. whether excess or umbrella coverage, or a dedicated IP indemnity insurance product, is available and commercially justified to address the tail risk of an extraordinary IP infringement claim. This exploration should include a cost-benefit analysis, taking into account the nature of Lumos's technology stack, the EMEA IP enforcement landscape, and the availability of coverage in the London and Bermuda specialty markets.
4. Recommendation — Sub-Distributor Certificates. Lumos should request certificates of insurance from Meridian Data Solutions UK Ltd (Companies House No. 12847391) and Meridian Data Solutions SARL (SIREN 912 483 057) to confirm that each pre-approved sub-distributor maintains insurance coverage at or above the contractual minimums required by Section 5.3(c) of the Agreement. In the alternative, Lumos should request written confirmation from Rheinland Versicherung AG that Meridian UK and Meridian France are specifically named or scheduled as insureds under Rheinland Policy No. RV-2024-1148703. This confirmation should be obtained prior to the commencement of sub-distributor resale activities and refreshed annually.
5. Recommendation — Annual Monitoring. Lumos should establish a calendared annual review process for monitoring both parties' insurance certificates, coordinated between Daniel Ostroff (Vice President, Legal & Compliance, Lumos Analytics Inc.) and Sandra Nwosu (Account Executive, Ridgepoint Insurance Brokers Inc.). The review process should include calendar reminders, certificate review and documentation, and a protocol for addressing any deficiencies or changes in coverage. Sandra Nwosu should be directed to provide renewal reminders and updated certificates for the Atlas Mutual policy in advance of each renewal cycle.
We are available to discuss the foregoing analysis and recommendations at your convenience. If additional review is required with respect to any of the matters addressed in this memorandum, or if the terms of the Agreement or the parties' insurance programs change materially, we will update our analysis accordingly.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Robert Jansen Associate
IX. Appendices
Appendix A — Summary of Atlas Mutual Insurance Company Policy
Policy Number: AML-TECH-2024-07829
Named Insured: Lumos Analytics Inc., a Delaware corporation
Carrier: Atlas Mutual Insurance Company One Liberty Plaza Hartford, CT 06103
Coverage Type: Errors & Omissions / Technology Professional Liability / Cyber Liability (combined policy)
Coverage Limits:
• $10,000,000 per occurrence
• $20,000,000 annual aggregate
Territorial Scope: Worldwide (including EMEA Territory)
Policy Period: Current annual period (renewal date to be confirmed with Ridgepoint)
Broker of Record: Ridgepoint Insurance Brokers Inc. Sandra Nwosu, Account Executive 200 Vesey Street, Suite 2400 New York, NY 10281
A.M. Best Rating (Atlas Mutual): A (Excellent), Financial Size Category XII
Appendix B — Summary of Rheinland Versicherung AG Policy
Policy Number: RV-2024-1148703
Named Insured: Meridian Data Solutions GmbH, a company organized under the laws of the Federal Republic of Germany
Carrier: Rheinland Versicherung AG, Düsseldorf, Germany
Coverage Types and Limits:
Territorial Scope: EMEA-wide (confirmed to cover claims arising in all EMEA territories, not limited to Germany)
Policy Period: Current annual period (as confirmed by certificates of insurance and correspondence from Kessler Hartmann Rechtsanwälte PartG mbB)
Carrier Rating: Satisfies Agreement requirement of reputable carrier rated at least A- by a recognized rating agency
Appendix C — Relevant Excerpts from the Channel Reseller Program Agreement
The following are verbatim excerpts from the execution version of the Channel Reseller Program Agreement between Lumos Analytics Inc. and Meridian Data Solutions GmbH, dated March 22, 2024, relevant to the insurance requirements analyzed in this memorandum. These excerpts are reproduced for reference purposes only and are subject to the full text of the Agreement, which controls in the event of any discrepancy.
Article 14 — Insurance
Section 14.1 — Reseller Insurance Requirements
Section 14.2 — Provider Insurance Requirements
Section 14.3 — Certificates of Insurance
Section 14.4 — Tail Coverage
Section 14.5 — Remedies for Insurance Deficiency
Section 5.3(c) — Sub-Distributor Insurance
Article 12 — Indemnification (relevant excerpts regarding indemnification cap and uncapped carve-outs)
Note: Full verbatim excerpts of the above provisions are maintained in the Calderwood & Harkness matter file (Matter No. 1008-00010) and are available upon request. Due to the confidential and privileged nature of the Agreement, the full text of these provisions has not been reproduced in this memorandum but has been reviewed in their entirety in preparing the analysis set forth herein.
Appendix D — Correspondence with Ridgepoint Insurance Brokers Inc.
The following is a summary of communications between Calderwood & Harkness LLP and Ridgepoint Insurance Brokers Inc. relevant to the insurance compliance review set forth in this memorandum. Copies of all referenced correspondence are maintained in the Calderwood & Harkness matter file (Matter No. 1008-00010).
1. Email from Sandra Nwosu (Ridgepoint) to Robert Jansen (Calderwood & Harkness), dated March 8, 2024. Subject: Confirmation of Atlas Mutual Policy Terms for Lumos Analytics Inc. Ms. Nwosu provided a summary of the key terms of Atlas Mutual Policy No. AML-TECH-2024-07829, including coverage limits, scope, territorial provisions, and deductible/retention information. Ms. Nwosu confirmed the worldwide territorial scope and the absence of any territorial limitation that would exclude EMEA activities.
2. Email from Robert Jansen (Calderwood & Harkness) to Sandra Nwosu (Ridgepoint), dated March 11, 2024. Subject: EMEA Channel Reseller Arrangement — Endorsement Inquiry. Mr. Jansen inquired whether any endorsements or riders would be required to specifically address the EMEA channel reseller arrangement under the Agreement.
3. Email from Sandra Nwosu (Ridgepoint) to Robert Jansen (Calderwood & Harkness), dated March 13, 2024. Subject: RE: EMEA Channel Reseller Arrangement — Endorsement Inquiry. Ms. Nwosu confirmed that no additional endorsement is required, as the existing worldwide territory provision in the Atlas Mutual policy is sufficient to cover EMEA distribution activities through the channel reseller arrangement.
4. Telephone call between Sandra Nwosu (Ridgepoint) and Robert Jansen (Calderwood & Harkness), March 15, 2024. Subject: Market Benchmarking and Forward-Looking Coverage Recommendations. Ms. Nwosu provided benchmarking data on E&O/cyber liability limits for comparable SaaS/fintech companies and recommended that Lumos consider increasing aggregate limits at the next renewal cycle if EMEA revenue ramps materially beyond the MAC schedule. Ms. Nwosu also discussed the availability of excess coverage and dedicated IP indemnity products in the specialty markets.
5. Email from Sandra Nwosu (Ridgepoint) to Robert Jansen (Calderwood & Harkness), dated March 18, 2024. Subject: Confirmation of CGL Coverage — Lumos Analytics Inc. Ms. Nwosu confirmed that Lumos's commercial general liability coverage is in place and current under a separate policy, satisfying the CGL requirement of the Agreement.
— End of Memorandum —
Coverage Type | Contractual Minimum (Section 14.1) | Meridian's Coverage (Rheinland Policy RV-2024-1148703) | Compliant?
Commercial General Liability | ≥ €5,000,000 per occurrence | ≥ €5,000,000 per occurrence | Yes
Professional Indemnity | ≥ €10,000,000 per occurrence | ≥ €10,000,000 per occurrence | Yes
Cyber Liability | ≥ €5,000,000 per occurrence | ≥ €5,000,000 per occurrence | Yes
Coverage Type | Per-Occurrence Limit
Commercial General Liability | ≥ €5,000,000
Professional Indemnity | ≥ €10,000,000
Cyber Liability | ≥ €5,000,000

MEMORANDUM

MATTER NO.: 1008-00010

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts