SUBPROCESSOR FLOW-DOWN TERMS ADDENDUM
TO THE MASTER SOFTWARE-AS-A-SERVICE AGREEMENT
Orion Cloud Services, Inc.
This Subprocessor Flow-Down Terms Addendum (this "Addendum") is entered into as of the date of execution of the Master Software-as-a-Service Agreement referenced below (the "Effective Date"), by and between:
Skybridge Fintech Ltd., a Delaware limited company, with its principal offices located at 1400 Concord Pike, Suite 320, Wilmington, DE 19803 ("Licensor" or "Skybridge"),
and
Meridian National Bank, National Association, a national banking association chartered under the laws of the United States, with its principal offices located at 600 Lexington Avenue, 40th Floor, New York, NY 10022 ("Licensee" or "Meridian"),
with the acknowledgment and agreement of:
Orion Cloud Services, Inc., a Delaware corporation, with its principal offices located at 4500 Great America Parkway, Santa Clara, CA 95054 ("Orion Cloud" or "Subprocessor").
This Addendum is supplemental to and forms part of (a) the Master Software-as-a-Service Agreement between Skybridge and Meridian (the "MSA"), and (b) the Data Processing Addendum attached as Exhibit C to the MSA (the "DPA"). This Addendum documents the flow-down of data processing, security, and service level obligations from the MSA and DPA to Orion Cloud in its capacity as Skybridge's infrastructure-as-a-service ("IaaS") subprocessor for the SkyComply™ platform. All capitalized terms used but not defined herein shall have the meanings ascribed to them in the MSA or DPA, as applicable.
RECITALS
WHEREAS, Skybridge Fintech Ltd. is a Delaware limited company headquartered at 1400 Concord Pike, Suite 320, Wilmington, DE 19803, and is the licensor and provider of the SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform (the "Platform"), which leverages advanced machine learning algorithms and analytics to enable financial institutions to detect, investigate, and report suspicious activities in compliance with the Bank Secrecy Act and applicable anti-money-laundering regulations;
WHEREAS, Meridian National Bank, N.A. is a national banking association chartered under federal law with its principal offices at 600 Lexington Avenue, 40th Floor, New York, NY 10022, and is a systemically important financial institution regulated by the Office of the Comptroller of the Currency (the "OCC"), the Board of Governors of the Federal Reserve System (the "Federal Reserve"), and the Federal Deposit Insurance Corporation (the "FDIC"), with approximately $485 billion in total consolidated assets as of the most recently filed Call Report. Meridian Financial Group, Inc. is the NYSE-listed bank holding company of Meridian;
WHEREAS, Skybridge and Meridian have entered into the MSA for the provision of the SkyComply™ Platform to approximately 32,000 named users across Meridian's U.S. and international operations, with a total contract value of Fifty Million Dollars ($50,000,000) over a five-year initial term, pursuant to which Skybridge provides Meridian with hosted access to the Platform on a software-as-a-service basis;
WHEREAS, Orion Cloud Services, Inc. is a leading provider of IaaS hosting and cloud infrastructure services and provides the underlying IaaS hosting environment for the SkyComply™ Platform, including compute, storage, networking, and related infrastructure services necessary for the operation of the Platform;
WHEREAS, Orion Cloud has been identified and approved as a subprocessor of Meridian Data under Section 7.2 of the DPA (Exhibit C to the MSA), and Meridian has provided its initial consent to Orion Cloud's engagement as a subprocessor in connection with the execution of the MSA;
WHEREAS, the MSA and DPA require that Skybridge ensure that all subprocessors handling Meridian Data are bound by contractual obligations no less protective than those imposed on Skybridge under the MSA, DPA, and all related exhibits, including the Security Exhibit (Exhibit B to the MSA) and the SLA Exhibit (Exhibit A to the MSA);
WHEREAS, Meridian Data processed through the SkyComply™ Platform includes, without limitation, Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq. (the "GLBA"), and its implementing regulations, as well as personally identifiable information ("PII") as defined under applicable federal and state privacy and data breach notification laws, all of which is classified as "Confidential" and "Highly Restricted" under Meridian's internal data classification policy;
WHEREAS, Skybridge is subject to examination by federal banking regulators in its capacity as a service provider to Meridian under the Bank Service Company Act, 12 U.S.C. § 1867, and Orion Cloud's services as a downstream provider must accommodate regulatory examination rights consistent with OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and the Interagency Guidance on Third-Party Relationships: Risk Management, issued in June 2023 by the OCC, the Federal Reserve, and the FDIC; and
WHEREAS, the parties desire to memorialize the terms and conditions under which Orion Cloud's subprocessor obligations are governed, including data residency, security, service levels, audit rights, regulatory examination rights, incident notification, and data lifecycle management, to ensure that Meridian's data protection and regulatory compliance requirements are fully addressed throughout the subprocessor chain;
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:
SECTION 1: DEFINITIONS
For purposes of this Addendum, the following terms shall have the meanings set forth below:
1.1 "Addendum" means this Subprocessor Flow-Down Terms Addendum to the Master Software-as-a-Service Agreement, including all schedules and exhibits attached hereto.
1.2 "DPA" means the Data Processing Addendum attached as Exhibit C to the MSA, as may be amended from time to time in accordance with its terms, which sets forth the parties' obligations with respect to the processing of personal data and Meridian Data in connection with the Platform.
1.3 "Meridian Data" means all data provided by or on behalf of Meridian to Skybridge for processing through the SkyComply™ Platform, or otherwise received, generated, or derived by Skybridge or its subprocessors in connection with the performance of services under the MSA. Meridian Data includes, without limitation, NPI, PII, transaction data, customer data, account data, suspicious activity referral data, and any data classified as "Confidential" or "Highly Restricted" under Meridian's data classification policy, regardless of format, medium, or mode of transmission.
1.4 "MSA" means the Master Software-as-a-Service Agreement between Skybridge and Meridian, as may be amended from time to time in accordance with its terms, pursuant to which Skybridge provides Meridian with access to the SkyComply™ Platform.
1.5 "Orion Cloud" or "Subprocessor" means Orion Cloud Services, Inc., a Delaware corporation, with its principal offices at 4500 Great America Parkway, Santa Clara, CA 95054, in its capacity as the IaaS subprocessor engaged by Skybridge for the hosting and infrastructure support of the SkyComply™ Platform.
1.6 "Platform" means the SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform, as described in the MSA and its associated order forms and statements of work.
1.7 "Security Exhibit" means Exhibit B to the MSA, which sets forth the information security requirements, controls, and obligations applicable to Skybridge's provision of the Platform and the handling of Meridian Data.
1.8 "Security Incident" shall have the meaning ascribed to such term in the MSA and the Security Exhibit, and shall include any confirmed unauthorized access to, acquisition of, disclosure of, use of, loss of, or destruction of Meridian Data, or any event that compromises the security, confidentiality, integrity, or availability of the systems hosting Meridian Data.
1.9 "SLA Exhibit" means Exhibit A to the MSA, which sets forth the service level commitments, uptime targets, measurement methodologies, and service credit structures applicable to Skybridge's provision of the Platform to Meridian.
1.10 All other capitalized terms used in this Addendum but not expressly defined herein shall have the meanings given to such terms in the MSA or DPA, as applicable. In the event of any inconsistency between the definitions in the MSA and the DPA, the definitions in the DPA shall control with respect to data processing matters, and the definitions in the MSA shall control with respect to all other matters.
SECTION 2: SCOPE OF SUBPROCESSING SERVICES
2.1 Description of Services
Orion Cloud provides IaaS hosting services for the SkyComply™ Platform, encompassing compute resources, persistent and ephemeral storage, networking and connectivity infrastructure, load balancing, backup, disaster recovery, and related infrastructure services as more particularly described in Schedule A attached hereto (the "Orion Cloud Services"). All Meridian Data processed through the SkyComply™ Platform is hosted on Orion Cloud's infrastructure within the approved hosting regions identified in Section 3.1 and Schedule A of this Addendum.
Orion Cloud's services under this Addendum are limited to the provision of infrastructure-layer services. Orion Cloud does not access, modify, control, or determine the purposes or means of the processing logic applied to Meridian Data. The application-layer processing of Meridian Data, including the configuration, operation, and management of the SkyComply™ Platform's AML detection models, alert generation, case management workflows, and reporting functions, remains solely the responsibility of Skybridge. Orion Cloud's role is that of a sub-processor providing infrastructure services to Skybridge, which in turn acts as the data processor under the DPA on behalf of Meridian as the data controller.
2.2 Approved Subprocessor Status
Orion Cloud is identified as the initial approved subprocessor in the register of subprocessors maintained by Skybridge pursuant to Section 7.2 of the DPA. Meridian has provided its written consent to Orion Cloud's engagement as a subprocessor as of the execution date of the MSA, based upon Skybridge's disclosure of Orion Cloud's identity, the nature and scope of the subprocessing services, the data center locations, and Orion Cloud's security certifications and compliance posture.
Any material change to the scope of Orion Cloud's services, including the addition of new hosting regions, the introduction of new infrastructure service categories, or the replacement of Orion Cloud with a different IaaS subprocessor, shall require no fewer than thirty (30) days' advance written notice from Skybridge to Meridian. Meridian shall have a reasonable objection right with respect to any such change, exercisable in accordance with the subprocessor approval process set forth in Section 7.3 of the DPA. Skybridge shall not implement any such change over Meridian's reasonable objection.
2.3 Skybridge Responsibility
Skybridge remains fully responsible and liable to Meridian for the performance and compliance of Orion Cloud with respect to all obligations arising under this Addendum, the MSA, the DPA, the SLA Exhibit, and the Security Exhibit. The engagement of Orion Cloud as a subprocessor does not relieve Skybridge of any obligation, representation, warranty, covenant, or liability under the MSA or any exhibit or addendum thereto. Skybridge shall be responsible for ensuring that its contractual arrangements with Orion Cloud are sufficient to enable Skybridge to comply with its obligations to Meridian, and Skybridge shall be liable to Meridian for any act or omission of Orion Cloud that would constitute a breach of the MSA, DPA, or this Addendum if committed by Skybridge directly.
SECTION 3: DATA RESIDENCY AND PROCESSING RESTRICTIONS
3.1 Data Residency Requirements
All Meridian Data shall be stored, processed, and maintained exclusively within the continental United States. Orion Cloud shall host all Meridian Data only in the following approved hosting regions:
(a) US-East (Virginia) — Primary production environment and primary data replication site; and
(b) US-West (Oregon) — Secondary production environment, disaster recovery site, and backup replication target.
No Meridian Data shall be transferred, replicated, mirrored, backed up, archived, or otherwise moved or copied to any data center, point of presence, edge location, or other facility located outside the continental United States, whether on a temporary or permanent basis, without Meridian's prior written consent. Orion Cloud shall implement and maintain technical and organizational controls to enforce the data residency requirements set forth in this Section 3.1, including network segmentation, geo-fencing, and replication policies that restrict data movement to the approved regions.
3.2 Processing Instructions
Orion Cloud shall process Meridian Data solely in accordance with Skybridge's documented and written instructions, which shall at all times conform to the processing instructions established under the DPA between Skybridge and Meridian. Orion Cloud shall not process Meridian Data for any purpose other than the provision of IaaS services to Skybridge for the operation of the SkyComply™ Platform. Without limiting the generality of the foregoing, Orion Cloud shall not:
(a) use Meridian Data for Orion Cloud's own purposes, including product development, analytics, benchmarking, marketing, advertising, or any purpose unrelated to the provision of the Orion Cloud Services;
(b) aggregate or commingle Meridian Data with data belonging to Orion Cloud's other customers, except to the extent that multi-tenant infrastructure operations inherently require shared physical resources, provided that logical separation of Meridian Data is maintained at all times;
(c) sell, rent, lease, or otherwise make Meridian Data available to any third party; or
(d) modify, alter, or transform Meridian Data except as strictly necessary for the provision of infrastructure-layer services (e.g., encryption, compression, or storage optimization).
If Orion Cloud receives a request or instruction from any party other than Skybridge to process Meridian Data, including a request from a governmental authority, Orion Cloud shall promptly notify Skybridge before complying with such request, unless prohibited by applicable law from doing so. In such event, Orion Cloud shall use commercially reasonable efforts to redirect the requesting party to Skybridge or Meridian, as appropriate.
3.3 Cross-Border Transfer Prohibition
No cross-border transfers of Meridian Data are permitted under this Addendum. This prohibition applies to all forms of data transfer, including electronic transmission, physical media transport, remote access, and any other means by which Meridian Data could be made accessible outside the continental United States.
Orion Cloud shall ensure that no personnel located outside the continental United States have logical or physical access to Meridian Data, the systems hosting Meridian Data, or the management consoles, administrative interfaces, or operational tools used to administer the infrastructure on which Meridian Data resides, unless expressly authorized by Skybridge with Meridian's prior written consent. Orion Cloud shall maintain access control lists and access logging sufficient to demonstrate compliance with this requirement and shall make such records available to Skybridge upon request.
SECTION 4: SECURITY OBLIGATIONS
4.1 Minimum Security Standards
Orion Cloud shall implement and maintain administrative, technical, and physical safeguards that are no less protective than those required of Skybridge under the Security Exhibit (Exhibit B to the MSA) to the extent applicable to infrastructure-layer services. Orion Cloud's security program shall be designed to protect the confidentiality, integrity, and availability of Meridian Data and the systems on which Meridian Data is processed, stored, and transmitted, against reasonably anticipated threats and hazards.
Orion Cloud shall maintain current and valid industry-standard certifications, including, at a minimum:
(a) SOC 2 Type II — An annual System and Organization Controls 2 Type II audit report, prepared by an independent third-party auditor in accordance with the AICPA Trust Services Criteria, covering the security, availability, and confidentiality trust service categories; and
(b) ISO 27001 — Certification of Orion Cloud's information security management system by an accredited certification body in accordance with ISO/IEC 27001:2022 (or the then-current version).
Orion Cloud shall provide copies of its current SOC 2 Type II audit reports and ISO 27001 certificates to Skybridge promptly upon request, and Skybridge shall have the right to deliver such reports and certificates to Meridian in fulfillment of Skybridge's audit and compliance obligations under the MSA and Security Exhibit. In the event Orion Cloud's certifications lapse or are revoked, or if Orion Cloud receives a qualified or adverse audit opinion, Orion Cloud shall promptly notify Skybridge, and Skybridge shall promptly notify Meridian.
4.2 Encryption Requirements
Orion Cloud shall implement and maintain the following encryption standards for all Meridian Data:
(a) Data at Rest. All Meridian Data stored on Orion Cloud infrastructure, including primary storage, backup storage, archival storage, and ephemeral storage (to the extent technically feasible), shall be encrypted using the Advanced Encryption Standard with a minimum key length of 256 bits (AES-256), or a successor algorithm of equivalent or greater cryptographic strength.
(b) Data in Transit. All Meridian Data transmitted within and between Orion Cloud regions hosting Meridian Data, including inter-region replication traffic, backup transfers, and administrative data flows, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher, with cipher suites meeting or exceeding current NIST recommendations.
(c) Key Management. Orion Cloud shall support Skybridge's managed hardware security module (HSM)-based key management solution, including the bring-your-own-key ("BYOK") option that Skybridge offers to Meridian under the Security Exhibit. Under the BYOK model, Meridian (or Skybridge on Meridian's behalf) retains control of the master encryption keys, and Orion Cloud shall not have the ability to access the plaintext content of Meridian Data encrypted with customer-managed keys. Orion Cloud shall document and maintain its key management practices, including key generation, rotation, storage, and destruction procedures, and shall make such documentation available to Skybridge upon request.
4.3 Access Controls
Orion Cloud shall implement and maintain role-based access controls ("RBAC") that restrict access to the infrastructure, systems, and environments hosting Meridian Data to authorized personnel on a least-privilege, need-to-know basis. Access privileges shall be reviewed and recertified at least quarterly, and promptly revoked upon personnel termination, role change, or cessation of need.
All Orion Cloud personnel — including full-time employees, temporary employees, contractors, and agents — who have logical or physical access to systems hosting Meridian Data shall be subject to background checks that are consistent with the Federal Financial Institutions Examination Council ("FFIEC") guidelines and the background check requirements set forth in the Security Exhibit. Background checks shall be completed prior to the individual being granted access and shall include, at a minimum, verification of identity, criminal history screening, and verification of employment history.
Orion Cloud shall maintain multi-factor authentication for all administrative and privileged access to systems hosting Meridian Data. Orion Cloud shall log all access to and activity within environments hosting Meridian Data and shall retain such logs for a minimum of twelve (12) months or such longer period as may be required under the Security Exhibit or applicable law.
4.4 Penetration Testing
Orion Cloud shall permit Skybridge's independent third-party security auditor, currently Crestfield Cyber Advisors, Inc. ("Crestfield"), or Meridian's designated auditor as applicable under the Security Exhibit, to conduct application-layer penetration testing of the SkyComply™ Platform as hosted on Orion Cloud infrastructure. Such testing shall be coordinated with Orion Cloud to avoid disruption to other Orion Cloud customers and shall be conducted in accordance with mutually agreed rules of engagement.
Infrastructure-layer penetration testing directed at Orion Cloud's own underlying systems, networks, and infrastructure components (as distinguished from the application layer of the SkyComply™ Platform) shall require Skybridge's prior written consent and shall be subject to the penetration testing scope provisions set forth in Section 6.4 of the Security Exhibit. Orion Cloud may require that such infrastructure-layer testing be conducted by Orion Cloud's own designated third-party security firm, provided that the scope of testing and reporting obligations meet the requirements of the Security Exhibit.
Orion Cloud shall conduct its own annual third-party penetration test of its infrastructure and IaaS platform, performed by a qualified independent security firm. Orion Cloud shall make the results of such penetration tests, including identified vulnerabilities and remediation timelines, available to Skybridge for sharing with Meridian upon reasonable request, subject to appropriate redaction of information pertaining to other Orion Cloud customers.
4.5 Physical Security
Orion Cloud data centers hosting Meridian Data shall maintain physical security controls that meet or exceed industry standards for Tier III or higher data center facilities. Such physical security controls shall include, at a minimum:
(a) 24/7/365 on-site security personnel and video surveillance monitoring;
(b) biometric access controls (e.g., fingerprint or retinal scanning) for entry to secured areas containing servers and storage systems hosting Meridian Data;
(c) man-trap entry systems and visitor management procedures, including visitor escort requirements;
(d) environmental protections, including fire suppression systems, redundant HVAC systems, water damage detection, and seismic safeguards appropriate to the facility location;
(e) redundant power supply, including uninterruptible power supply (UPS) systems and backup generator capacity sufficient to sustain operations during extended power outages; and
(f) physical media destruction procedures for decommissioned storage devices, including degaussing and/or physical destruction in accordance with NIST SP 800-88 guidelines.
SECTION 5: SERVICE LEVEL COMMITMENTS
5.1 Orion Cloud Uptime SLA
Orion Cloud's standard platform service level agreement provides for 99.95% monthly uptime for its IaaS services, measured on a calendar-month basis in accordance with Orion Cloud's standard methodology as described in Schedule A. This upstream SLA commitment of 99.95% monthly uptime is intended to support Skybridge's downstream SLA commitments to Meridian under the SLA Exhibit (Exhibit A to the MSA), which establishes the negotiated uptime target for the SkyComply™ Platform as delivered to Meridian. The parties acknowledge that Skybridge's proposed monthly uptime commitment to Meridian under the SLA Exhibit is 99.9%, while Meridian has requested a monthly uptime commitment of 99.95%, and that the final uptime target shall be as agreed in the executed MSA.
Skybridge shall use commercially reasonable efforts to ensure that Orion Cloud's SLA performance is sufficient to meet Skybridge's SLA obligations to Meridian under the SLA Exhibit. In the event that Orion Cloud's actual uptime falls below its committed 99.95% threshold, Skybridge shall promptly notify Meridian and take all commercially reasonable steps to mitigate the impact on Meridian's use of the Platform.
5.2 Measurement and Reporting
Orion Cloud shall measure uptime on a calendar-month basis, exclusive of Scheduled Maintenance Windows (as defined in Section 5.4 below). Uptime shall be calculated as the total number of minutes in the applicable calendar month, minus the total number of minutes of Unscheduled Downtime, divided by the total number of minutes in the applicable calendar month, expressed as a percentage. "Unscheduled Downtime" means any period during which the Orion Cloud infrastructure hosting Meridian Data is unavailable or materially degraded, other than during Scheduled Maintenance Windows.
Orion Cloud shall provide Skybridge with written monthly uptime reports within five (5) business days of the end of each calendar month. Each monthly uptime report shall include, at a minimum: (a) the calculated uptime percentage for the month; (b) a summary of any Unscheduled Downtime events, including duration, root cause, and corrective actions; and (c) a summary of any Scheduled Maintenance Windows that occurred during the month. Skybridge shall have the right to share Orion Cloud uptime data and reports with Meridian as required under the SLA Exhibit or upon Meridian's reasonable request.
5.3 SLA Credits Flow-Down
In the event Orion Cloud fails to meet its 99.95% monthly uptime commitment, Skybridge shall be entitled to receive service credits from Orion Cloud in accordance with Orion Cloud's standard SLA credit terms, as set forth in Orion Cloud's applicable service agreement with Skybridge. Skybridge shall use commercially reasonable efforts to claim all available service credits from Orion Cloud in a timely manner.
Skybridge acknowledges and agrees that the SLA credit structure between Skybridge and Meridian, as set forth in the SLA Exhibit, is independent of and may differ from the credit structure between Skybridge and Orion Cloud. The SLA Exhibit provides for monthly service credit caps of thirty percent (30%) of the applicable monthly subscription fee and annual service credit caps of fifteen percent (15%) of the applicable annual subscription fee. Skybridge bears the financial risk of any gap between credits received from Orion Cloud and credits owed to Meridian under the SLA Exhibit, and no shortfall in Orion Cloud credits shall relieve Skybridge of its obligation to issue credits to Meridian in accordance with the SLA Exhibit.
5.4 Scheduled Maintenance Coordination
Orion Cloud shall coordinate all scheduled maintenance windows with Skybridge to align, to the greatest extent practicable, with the maintenance windows established in the SLA Exhibit. The SLA Exhibit provides for Scheduled Maintenance Windows on Saturdays from 2:00 AM to 6:00 AM Eastern Time, with a maximum duration of four (4) hours per week. Orion Cloud shall use commercially reasonable efforts to perform all planned maintenance activities within these windows or during other periods of low utilization that do not materially impact Platform availability.
Orion Cloud shall provide Skybridge with at least seventy-two (72) hours' advance written notice of any scheduled maintenance that may affect the availability of the SkyComply™ Platform or the infrastructure hosting Meridian Data. In the event of emergency maintenance required to address a critical security vulnerability or imminent threat to system integrity, Orion Cloud shall provide as much advance notice as is reasonably practicable under the circumstances and shall promptly notify Skybridge upon commencement of such emergency maintenance.
SECTION 6: SECURITY INCIDENT NOTIFICATION
6.1 Notification to Skybridge
Orion Cloud shall notify Skybridge of any confirmed Security Incident affecting Meridian Data, the infrastructure hosting Meridian Data, or the systems used to manage or administer such infrastructure, without undue delay and in no event later than the timeframe necessary to enable Skybridge to comply with its own notification obligation to Meridian under the MSA and Security Exhibit. The parties acknowledge that the MSA establishes a Security Incident notification timeframe for Skybridge's notification to Meridian (Skybridge's proposed obligation: within twenty-four (24) hours of discovery; Meridian's demand: within twelve (12) hours of discovery), and that the final notification timeframe shall be as agreed in the executed MSA. Orion Cloud shall provide its initial notification to Skybridge sufficiently in advance of Skybridge's downstream deadline to permit Skybridge to investigate, assess, and prepare its notification to Meridian within the agreed timeframe.
Orion Cloud's initial notification to Skybridge shall include, to the extent known at the time of notification:
(a) the nature and scope of the Security Incident, including the type of vulnerability exploited or event that occurred;
(b) the categories and approximate volume of Meridian Data affected or potentially affected;
(c) the remediation steps taken or planned, including containment measures and any interim protective actions; and
(d) the identity and contact information of the designated point of contact for ongoing communication regarding the Security Incident.
Orion Cloud shall provide supplemental updates to Skybridge as additional information becomes available, at intervals reasonably requested by Skybridge, until the Security Incident has been fully resolved and remediated.
6.2 Cooperation and Remediation
Orion Cloud shall cooperate fully and in good faith with Skybridge, and, as directed by Skybridge, with Meridian, in investigating, containing, and remediating any Security Incident. Such cooperation shall include, without limitation:
(a) providing Skybridge and Meridian's designated forensic investigators with reasonable access to relevant logs, systems, and personnel;
(b) implementing containment and remediation measures as directed by Skybridge or as required under the Security Exhibit;
(c) supporting Skybridge's preparation of any notifications required under applicable data breach notification laws, regulatory requirements, or contractual obligations; and
(d) participating in post-incident review meetings and providing input to corrective action plans.
Orion Cloud shall preserve all logs, audit trails, forensic images, and other evidence related to any Security Incident for a minimum of twelve (12) months following the date of the Security Incident, or such longer period as may be required by applicable law, regulation, or regulatory guidance. Orion Cloud shall not destroy, modify, or overwrite any such evidence without Skybridge's prior written consent during the preservation period.
6.3 Root Cause Analysis
Orion Cloud shall provide Skybridge with a comprehensive written root cause analysis ("RCA") within thirty (30) calendar days of any Security Incident affecting Meridian Data. The RCA shall include, at a minimum: (a) a detailed description of the Security Incident, including the timeline of events; (b) the root cause or causes of the Security Incident; (c) the Meridian Data affected or potentially affected; (d) the corrective actions implemented to remediate the Security Incident; and (e) the preventive measures implemented or planned to prevent recurrence of similar incidents. Skybridge shall have the right to share the RCA with Meridian as required under the MSA or upon Meridian's reasonable request.
SECTION 7: AUDIT AND EXAMINATION RIGHTS
7.1 Skybridge Audit Rights
Skybridge shall have the right to audit Orion Cloud's security controls, data processing practices, infrastructure operations, and compliance with the terms and conditions of this Addendum at least once per calendar year. Skybridge shall provide Orion Cloud with no fewer than thirty (30) business days' prior written notice of any planned audit.
Orion Cloud may satisfy Skybridge's audit requests by providing the following documentation, which Skybridge shall evaluate in good faith to determine whether it is sufficient to address the audit objectives:
(a) current SOC 2 Type II audit reports covering the relevant trust service categories;
(b) current ISO 27001 certificates and, upon request, the statement of applicability;
(c) a completed security assessment questionnaire, using a standardized industry questionnaire format (e.g., SIG, CAIQ, or a mutually agreed-upon format); and
(d) such additional documentation as Skybridge may reasonably request to verify compliance with specific provisions of this Addendum.
On-site audits of Orion Cloud's data center facilities and corporate offices shall be permitted only where Skybridge has demonstrated a material security concern or where the documentation provided by Orion Cloud is insufficient to address the audit objectives. On-site audits shall be conducted during normal business hours, with reasonable advance coordination, and shall not unreasonably interfere with Orion Cloud's operations or the operations of Orion Cloud's other customers.
7.2 Meridian Audit Rights (Flow-Down)
To the extent required under the MSA, the DPA, or the Security Exhibit, Skybridge shall have the right to facilitate Meridian's exercise of its contractual audit rights with respect to Orion Cloud's infrastructure, data handling practices, and compliance with the obligations set forth in this Addendum. Meridian's audit rights with respect to Orion Cloud shall be exercised through Skybridge, and Skybridge shall serve as the primary point of coordination between Meridian and Orion Cloud for all audit-related activities.
Meridian's audits of Orion Cloud conducted through Skybridge shall be subject to the same limitations, procedures, and notice requirements applicable to audits of Skybridge under the MSA, including the requirement for thirty (30) business days' prior written notice and Skybridge's right to satisfy audit requests through the delivery of audit reports, certificates, and completed questionnaires as described in Section 7.1. Meridian shall have the right to review all audit reports and documentation provided by Orion Cloud to Skybridge, and Skybridge shall promptly deliver such materials to Meridian upon request.
In the event Meridian identifies material concerns based on its review of audit reports or other documentation, Meridian may request, through Skybridge, that an on-site audit of Orion Cloud's facilities be conducted, subject to the conditions set forth in Section 7.1 above.
7.3 Regulatory Examination Rights
Orion Cloud acknowledges and agrees that Meridian is subject to ongoing supervision and examination by the OCC, the Federal Reserve, and the FDIC, and that Skybridge, as a service provider to Meridian, is subject to examination under the Bank Service Company Act, 12 U.S.C. § 1867(c). Orion Cloud further acknowledges that federal banking regulators may, in connection with their supervisory responsibilities, require access to the books, records, systems, facilities, and personnel of service providers and their subcontractors that provide technology services to regulated financial institutions.
Orion Cloud shall permit examination of its services, records, systems, and facilities by federal banking regulators, including the OCC, the Federal Reserve, and the FDIC, to the extent required by applicable law, regulation, or supervisory guidance, including without limitation OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), the Interagency Guidance on Third-Party Relationships: Risk Management (June 2023), and any successor or supplemental guidance. Orion Cloud shall cooperate fully with federal banking regulators and shall provide reasonable access to its premises, personnel, records, and systems as directed by Skybridge, Meridian, or as required by applicable law or regulatory directive.
Orion Cloud shall not impose any fees, charges, or conditions on the exercise of regulatory examination rights that are inconsistent with the requirements of applicable law or supervisory guidance. Orion Cloud shall promptly notify Skybridge if it receives any direct communication from a federal banking regulator relating to the services provided under this Addendum or the hosting of Meridian Data, unless Orion Cloud is prohibited by applicable law from providing such notification.
SECTION 8: DATA RETENTION, EXPORT, AND DELETION
8.1 Data Retention During Term
Orion Cloud shall retain Meridian Data on its infrastructure only for so long as is necessary for the provision of the Orion Cloud Services under its agreement with Skybridge, and in strict accordance with the data retention provisions set forth in the DPA. Orion Cloud shall not retain copies of Meridian Data beyond the period required for the provision of IaaS services, except as otherwise required by applicable law or regulation, in which case Orion Cloud shall promptly notify Skybridge of the applicable retention requirement and shall continue to protect such retained data in accordance with the security and confidentiality obligations of this Addendum.
8.2 Data Export
Upon termination or expiration of the MSA, or upon termination of Orion Cloud's engagement as a subprocessor (whether due to replacement with an alternative subprocessor or otherwise), Skybridge shall ensure that Orion Cloud cooperates in providing a complete export of all Meridian Data in a machine-readable, industry-standard format (e.g., CSV, JSON, Parquet, or such other format as agreed under the DPA) within the thirty (30) calendar day export window established in the DPA. Orion Cloud shall provide Skybridge with reasonable technical assistance to facilitate the data export, including access to APIs, data migration tools, and technical documentation necessary to ensure a complete and accurate export.
During the export period, Orion Cloud shall continue to host Meridian Data and maintain all security, confidentiality, and access control obligations set forth in this Addendum, and shall not degrade the performance or availability of the infrastructure hosting Meridian Data.
8.3 Data Destruction
Following the successful completion of data export and verification by Skybridge (and, if applicable, by Meridian), and within the sixty (60) calendar day certified destruction window established in the DPA, Orion Cloud shall permanently and irretrievably delete or destroy all Meridian Data in its possession, custody, or control, including all copies, backups, replicas, snapshots, archives, and any other instances of Meridian Data stored on Orion Cloud infrastructure. Data destruction shall be performed in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) or an equivalent industry-standard methodology.
Upon completion of data destruction, Orion Cloud shall provide Skybridge with a written certification of destruction, signed by an authorized officer of Orion Cloud, confirming that all Meridian Data has been permanently and irretrievably deleted or destroyed in accordance with this Section 8.3. Skybridge shall promptly provide such certification of destruction to Meridian.
SECTION 9: SUBPROCESSOR CHANGE MANAGEMENT
9.1 Notification of Changes
If Skybridge proposes to replace Orion Cloud with a different IaaS subprocessor for the hosting of the SkyComply™ Platform, or if Orion Cloud proposes to engage its own sub-subprocessors that would have access to, or the ability to process, Meridian Data, Skybridge shall provide Meridian with no fewer than thirty (30) calendar days' advance written notice of the proposed change. Such notice shall include the identity of the proposed replacement subprocessor or sub-subprocessor, a description of the services to be provided, the data center locations, relevant security certifications, and any other information reasonably necessary for Meridian to evaluate the proposed change, consistent with the subprocessor approval process set forth in Section 7.3 of the DPA.
9.2 Meridian Objection Right
Meridian shall have a reasonable objection right with respect to any proposed replacement of Orion Cloud as the IaaS subprocessor or any proposed engagement of sub-subprocessors with access to Meridian Data. If Meridian objects to the proposed change on reasonable grounds related to data security, regulatory compliance, operational risk, or data residency, Skybridge shall either:
(a) not proceed with the proposed change and continue to utilize Orion Cloud (or the existing sub-subprocessor arrangement, as applicable) for the provision of IaaS services; or
(b) take reasonable steps to address Meridian's objection, which may include implementing additional security controls, obtaining additional certifications from the proposed subprocessor, providing enhanced audit rights, or making available an alternative subprocessor that is acceptable to Meridian.
In no event shall Skybridge implement a subprocessor change over Meridian's reasonable and continuing objection.
9.3 Continuity of Obligations
Any replacement subprocessor engaged by Skybridge for the provision of IaaS services in connection with the SkyComply™ Platform shall be bound by data processing, security, data residency, audit, regulatory examination, incident notification, and data lifecycle management obligations that are no less protective than those set forth in this Addendum. Skybridge shall provide Meridian with a copy of the flow-down terms applicable to any replacement subprocessor upon request.
SECTION 10: CONFIDENTIALITY
10.1 Orion Cloud Confidentiality Obligations
Orion Cloud shall treat all Meridian Data as confidential information of the highest sensitivity and shall not disclose, disseminate, publish, or otherwise make Meridian Data available to any third party, except as strictly necessary for the provision of the Orion Cloud Services or as required by applicable law, regulation, or valid legal process. In the event Orion Cloud is compelled by law or legal process to disclose Meridian Data, Orion Cloud shall, to the extent permitted by applicable law, provide Skybridge with prompt prior written notice of such compelled disclosure to enable Skybridge (and, as applicable, Meridian) to seek a protective order or other appropriate remedy.
Orion Cloud's confidentiality obligations under this Section 10 shall survive the termination or expiration of this Addendum, the MSA, and any agreement between Skybridge and Orion Cloud, and shall continue in full force and effect for so long as Orion Cloud or any of its personnel, contractors, or agents retain any Meridian Data or any information derived from Meridian Data, and in any event for a period of no less than five (5) years following the later of termination or expiration of this Addendum or the certified destruction of all Meridian Data.
10.2 Employee and Contractor Obligations
Orion Cloud shall ensure that all of its employees, contractors, subcontractors, and agents who have access to Meridian Data, or to systems hosting or processing Meridian Data, are bound by written confidentiality obligations that are no less restrictive than those imposed on Orion Cloud under this Addendum. Orion Cloud shall maintain a record of all personnel with access to systems hosting Meridian Data and shall make such records available to Skybridge upon request. Orion Cloud shall promptly revoke access to Meridian Data systems for any individual who is no longer authorized or whose employment or engagement with Orion Cloud has been terminated.
SECTION 11: COMPLIANCE WITH APPLICABLE LAW
11.1 Regulatory Compliance
Orion Cloud shall comply with all applicable federal, state, and local laws, regulations, and industry standards relevant to its provision of IaaS services under this Addendum, including, without limitation:
(a) the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq., and its implementing regulations, including Regulation P (12 C.F.R. Part 1016) and the Interagency Guidelines Establishing Information Security Standards, to the extent applicable to the hosting and processing of NPI;
(b) applicable state privacy and data breach notification laws, including the New York State Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500), the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), and the data breach notification laws of all U.S. states and territories in which Meridian operates;
(c) the Federal Information Security Modernization Act (FISMA) and NIST Cybersecurity Framework, to the extent referenced in the Security Exhibit; and
(d) all other applicable laws, regulations, and industry standards relating to information security, data privacy, and the protection of financial data.
11.2 BSA/AML Considerations
Orion Cloud acknowledges that the SkyComply™ Platform provides critical Bank Secrecy Act ("BSA") and anti-money-laundering ("AML") compliance functionality to Meridian, and that the Platform is an integral component of Meridian's regulatory compliance infrastructure. Any disruption, degradation, or unauthorized access to the infrastructure hosting the Platform could have material regulatory implications for Meridian, including potential supervisory actions by federal banking regulators. Accordingly, Orion Cloud shall prioritize the availability, integrity, and security of the infrastructure hosting the SkyComply™ Platform and shall treat any incident affecting such infrastructure as a high-priority matter requiring immediate attention and escalation.
SECTION 12: INSURANCE
Orion Cloud shall obtain and maintain, at its own expense and throughout the term of this Addendum, commercially reasonable insurance coverage appropriate for the nature and scope of the services provided, including, at a minimum:
(a) Technology Errors and Omissions Insurance — providing coverage for claims arising from errors, omissions, or negligent acts in the provision of technology and IaaS services;
(b) Cyber Liability Insurance — providing coverage for data breaches, network security failures, and related cyber events, including costs of notification, credit monitoring, forensic investigation, regulatory fines and penalties (to the extent insurable), and third-party liability arising from a Security Incident; and
(c) Commercial General Liability Insurance and Workers' Compensation Insurance — at levels consistent with industry standards for companies of Orion Cloud's size and nature of operations.
Insurance coverage limits shall be maintained at levels appropriate for the services provided and commensurate with the volume and sensitivity of Meridian Data hosted on Orion Cloud infrastructure. Skybridge shall have the right to request evidence of Orion Cloud's insurance coverage, including certificates of insurance and policy endorsements, upon reasonable request, and Orion Cloud shall provide such evidence within ten (10) business days of any such request.
SECTION 13: LIABILITY AND INDEMNIFICATION
13.1 Skybridge's Responsibility to Meridian
As between Skybridge and Meridian, Skybridge remains fully and unconditionally liable for any and all acts, omissions, breaches, failures, or negligence of Orion Cloud in connection with the processing, hosting, storage, or handling of Meridian Data, to the same extent as if such acts, omissions, breaches, failures, or negligence were committed by Skybridge directly. Skybridge's liability to Meridian for Orion Cloud's performance shall be subject to the indemnification provisions, liability cap provisions, and limitation of liability provisions set forth in the MSA, and nothing in this Addendum shall be construed to expand or limit such provisions except as expressly provided in the MSA.
This Addendum does not create, and shall not be construed to create, any direct contractual relationship, privity of contract, or third-party beneficiary rights between Meridian and Orion Cloud. Meridian's recourse for any breach of the obligations set forth in this Addendum shall be against Skybridge in accordance with the terms of the MSA, and not directly against Orion Cloud, except to the extent required by applicable law.
13.2 Skybridge-Orion Cloud Liability
Skybridge shall ensure that its contractual agreement with Orion Cloud includes appropriate indemnification, liability, and remediation provisions sufficient to permit Skybridge to recover from Orion Cloud for losses, damages, costs, and expenses arising from Orion Cloud's breach of its obligations under such agreement, including, without limitation, losses arising from data security breaches, unauthorized access to or disclosure of Meridian Data, service level failures, violations of data residency requirements, and failures to comply with regulatory examination or audit requirements. Skybridge shall use commercially reasonable efforts to enforce its rights against Orion Cloud in the event of any breach that affects Meridian Data or Meridian's interests.
SECTION 14: TERM AND TERMINATION
14.1 Term. This Addendum shall be effective as of the Effective Date (i.e., the execution date of the MSA) and shall remain in full force and effect for the duration of the MSA, including any renewal terms or extensions thereof, and for so long thereafter as Orion Cloud retains or has access to any Meridian Data.
14.2 Effect of Termination
Upon termination of Orion Cloud's engagement as a subprocessor, whether due to replacement with an alternative subprocessor, termination or expiration of the MSA, termination of Skybridge's agreement with Orion Cloud, or otherwise, the following provisions shall survive termination:
(a) Data Export and Destruction. The data export and destruction obligations set forth in Section 8 of this Addendum shall survive termination and shall be performed within the timeframes specified therein.
(b) Confidentiality. The confidentiality obligations set forth in Section 10 of this Addendum shall survive termination in accordance with the survival period specified in Section 10.1.
(c) Security Incident Cooperation. To the extent any Security Incident is discovered or remains under investigation at the time of termination, the incident notification, cooperation, and root cause analysis obligations of Section 6 shall survive until the incident has been fully resolved and all required documentation has been provided.
(d) Audit and Regulatory Examination. The audit and regulatory examination rights set forth in Section 7 shall survive termination for a period of twelve (12) months following the date of certified destruction of all Meridian Data, or such longer period as required by applicable law or regulation.
SECTION 15: GENERAL PROVISIONS
15.1 Governing Law
This Addendum shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles, consistent with the governing law provision of the MSA. Any disputes arising out of or relating to this Addendum shall be resolved in accordance with the dispute resolution provisions set forth in the MSA.
15.2 Amendments. This Addendum may be amended, modified, or supplemented only by a written instrument duly executed by authorized representatives of both Skybridge and Meridian. Any amendment that materially affects Orion Cloud's obligations under this Addendum, or that imposes new or additional requirements on Orion Cloud, shall require Orion Cloud's prior written acknowledgment. For the avoidance of doubt, an amendment to the MSA, DPA, Security Exhibit, or SLA Exhibit that affects the flow-down obligations described herein shall be deemed to modify this Addendum to the extent necessary to maintain consistency, and Skybridge shall promptly notify Orion Cloud of any such amendment and obtain Orion Cloud's written acknowledgment as applicable.
15.3 Conflict with MSA
In the event of any conflict or inconsistency between the terms of this Addendum and the terms of the MSA or DPA, the provisions of the MSA or DPA (as applicable) shall control and prevail, unless this Addendum expressly provides otherwise with respect to obligations, limitations, or procedures that are specific to Orion Cloud's role as the IaaS subprocessor. In the event of any conflict between this Addendum and Orion Cloud's standard terms of service, the provisions of this Addendum shall control.
15.4 Notices. All notices, requests, consents, demands, and other communications required or permitted under this Addendum shall be in writing and shall be delivered in accordance with the notice provisions of the MSA. Notices shall be addressed as follows:
If to Orion Cloud:
Orion Cloud Services, Inc. 4500 Great America Parkway Santa Clara, CA 95054
Attention: General Counsel
If to Skybridge:
Skybridge Fintech Ltd. 1400 Concord Pike, Suite 320 Wilmington, DE 19803