PRIVILEGED & CONFIDENTIAL ATTORNEY WORK PRODUCT MATTER NO. 1009-00007
Prepared by: Amy Chesterton & Nathan Ikeda Calderwood & Harkness LLP 200 South Ashbury Asset Advisors, Suite 1800 Chicago, IL 60604
With input from: Liam Prescott, Of Counsel — Technology Transactions Amara Okafor, CISO — Skybridge Fintech Ltd.
EXHIBIT B — SECURITY EXHIBIT
to the Master Software-as-a-Service Agreement
by and between
SKYBRIDGE FINTECH LTD., a Delaware limited company ("Licensor" or "Skybridge")
and
MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION, a national banking association ("Licensee" or "Meridian")
This Exhibit B (the "Security Exhibit") is attached to and incorporated into the Master Software-as-a-Service Agreement dated as of [●], 2025 (the "Agreement" or "MSA") between Licensor and Licensee. This Security Exhibit sets forth the security standards, controls, certifications, and related obligations applicable to Licensor's provision of the SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform (the "Platform") under the Agreement.
Unless otherwise specified herein, capitalized terms used in this Security Exhibit shall have the meanings assigned to them in the Agreement or as defined in Section 1 below.
Right-click to update Table of Contents
SECTION 1: DEFINITIONS AND INTERPRETATION
1.1 Definitions. As used in this Exhibit B, the following terms shall have the meanings set forth below:
(a) "Approved Subprocessor" means any Subprocessor that has been identified in Appendix 1 to this Exhibit B as of the Effective Date or that is subsequently approved by Licensee in accordance with Section 10 of this Exhibit B.
(b) "BYOK" means Bring-Your-Own-Key, a key management arrangement in which the Licensee generates, controls, and manages its own encryption keys for use in encrypting Licensee Data at rest within the Platform.
(c) "Documentation" means Licensor's then-current technical and user documentation for the Platform, as updated from time to time and made available to Licensee in accordance with the Agreement.
(d) "FFIEC" means the Federal Financial Institutions Examination Council, an interagency body empowered to prescribe uniform principles, standards, and report forms for the federal examination of financial institutions.
(e) "HSM" means Hardware Security Module, a physical computing device that safeguards and manages cryptographic keys, performs encryption and decryption functions, and provides strong authentication.
(f) "Licensee Data" means all data, including Non-Public Personal Information ("NPI") as defined under the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809 (the "GLBA"), personally identifiable information ("PII"), protected health information to the extent applicable, and any data classified as "Confidential" or "Highly Restricted" under Meridian's data classification policy (as provided to Licensor), that is provided by or on behalf of Licensee to Licensor, collected by Licensor on behalf of Licensee, or processed, stored, accessed, transmitted, or otherwise handled by Licensor or any Subprocessor in connection with the Platform or the services under the Agreement. For the avoidance of doubt, Licensee Data includes transaction data, customer identification data, suspicious activity reports and related workpapers, alert data, model tuning data, and any derived data or analytics produced by the Platform from such inputs.
(g) "Platform" means the SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform licensed by Licensor to Licensee under the Agreement, including all updates, upgrades, patches, and new releases made generally available by Licensor during the Term.
(h) "Security Incident" means any confirmed unauthorized access to, acquisition of, use of, disclosure of, or loss of Licensee Data, or any confirmed breach of the security, confidentiality, or integrity of systems containing Licensee Data. For purposes of this definition, "confirmed" means that Licensor has determined through its investigation that the event has, in fact, occurred and is not merely suspected or alleged.
(i) "Security Standards" means, collectively, the certifications, controls, policies, procedures, and technical and organizational measures set forth in this Exhibit B that Licensor is required to implement and maintain.
(j) "Subprocessor" means any third party (including affiliates of Licensor) engaged by Licensor that processes, stores, accesses, or has access to Licensee Data in connection with performing services under the Agreement. For the avoidance of doubt, the term "Subprocessor" does not include Licensee or Licensee's authorized agents.
All other capitalized terms used but not defined in this Exhibit B shall have the meanings ascribed to them in the Agreement, including the defined terms set forth in Section 1 of the MSA and any applicable Order Form.
1.2 Interpretation. (a) Capitalized terms not otherwise defined in this Exhibit B shall have the meanings given to them in the Agreement.
(b) In the event of a conflict or inconsistency between the provisions of this Exhibit B and the body of the Agreement (including any other exhibit, schedule, addendum, or Order Form attached thereto), the provisions of this Exhibit B shall govern and control with respect to Licensor's security obligations, the protection of Licensee Data, and all matters relating to information security, data privacy, and related compliance requirements.
(c) References in this Exhibit B to any law, regulation, statute, rule, guidance, or standard (including, without limitation, the GLBA, the Bank Service Company Act, NIST standards, and ISO/IEC standards) shall be deemed to include all amendments, supplements, modifications, successor provisions, and implementing regulations thereto as may be in effect from time to time.
(d) References to "days" shall mean calendar days unless expressly stated as "business days." References to "business days" shall mean days other than Saturdays, Sundays, and federal holidays observed in the United States.
(e) The words "include," "includes," and "including" shall be deemed to be followed by the phrase "without limitation."
(f) Section headings are for convenience of reference only and shall not affect the interpretation of this Exhibit B.
SECTION 2: INFORMATION SECURITY PROGRAM
2.1 General Obligation
Licensor shall establish, implement, and maintain a comprehensive written information security program (the "ISP") that is designed to protect the confidentiality, integrity, and availability of Licensee Data throughout the Term and for so long as Licensor retains any Licensee Data following expiration or termination of the Agreement. The ISP shall be reasonably designed to:
(a) ensure the security, confidentiality, and integrity of Licensee Data;
(b) protect against any anticipated threats or hazards to the security, confidentiality, or integrity of Licensee Data;
(c) protect against unauthorized access to, use of, or disclosure of Licensee Data;
(d) detect, prevent, and respond to Security Incidents in a timely manner; and
(e) ensure the proper disposal of Licensee Data in accordance with Section 15 of this Exhibit B.
The ISP shall be consistent with industry standards applicable to financial services SaaS providers, including standards applicable to service providers handling NPI under the GLBA and the Interagency Guidelines Establishing Information Security Standards (12 C.F.R. Part 30, Appendix B, and equivalent provisions under the regulations of the Federal Reserve and FDIC). The ISP shall address administrative, technical, and physical safeguards appropriate to the nature, size, complexity, and scope of Licensor's activities, the sensitivity of the Licensee Data processed, and the regulated nature of Licensee's business as a national banking association.
2.2 Policies and Procedures
Licensor shall maintain and enforce written security policies and procedures that form part of the ISP. Such policies and procedures shall cover, at a minimum, the following areas:
(a) Access Control — policies governing the granting, modification, and revocation of access to systems and data, including authentication and authorization mechanisms;
(b) Change Management — procedures for managing changes to production systems, applications, and infrastructure, including approval workflows, testing, and rollback procedures;
(c) Vulnerability Management — processes for identifying, assessing, prioritizing, and remediating vulnerabilities in systems and software;
(d) Incident Response — a formal incident response plan addressing the identification, containment, eradication, recovery, and post-incident review of Security Incidents;
(e) Business Continuity and Disaster Recovery — plans and procedures to ensure continuity of critical services and recovery of data and systems in the event of a disaster or significant disruption;
(f) Data Classification and Handling — standards for classifying, labeling, handling, transmitting, storing, and disposing of data based on sensitivity;
(g) Personnel Security — policies addressing background checks, security awareness training, acceptable use, and termination procedures;
(h) Physical Security — controls governing physical access to facilities and equipment where Licensee Data is stored or processed;
(i) Cryptographic Controls — policies governing the use of encryption, key management, and cryptographic standards; and
(j) Third-Party Risk Management — processes for assessing, monitoring, and managing the security risks associated with Subprocessors and other third-party service providers.
Licensor shall review and update its security policies and procedures at least annually, and more frequently as warranted by material changes in the threat landscape, applicable law or regulation, or industry best practices. Licensor shall maintain records of policy reviews and revisions and shall make such records available to Licensee upon reasonable request in connection with an audit under Section 12.
2.3 Security Governance
Licensor shall designate a Chief Information Security Officer ("CISO") or equivalent senior officer who shall be responsible for the overall development, implementation, oversight, and enforcement of the ISP. As of the Effective Date, Skybridge's CISO is Amara Okafor. The designated CISO shall have sufficient authority, resources, and organizational independence to carry out the ISP effectively.
Licensor shall provide Licensee with the name and contact information of the designated CISO within five (5) business days of the Effective Date and shall notify Licensee of any change in the designated CISO (whether due to departure, reassignment, or organizational restructuring) within ten (10) business days of such change. In the event of a CISO transition, Licensor shall ensure that an interim senior officer is designated to fulfill the CISO's responsibilities until a permanent successor is appointed.
2.4 Risk Assessments
Licensor shall conduct comprehensive risk assessments of its information security program at least annually, and additionally in response to material changes in its technology environment, business operations, or the threat landscape. Each risk assessment shall include, at a minimum:
(a) identification of reasonably foreseeable internal and external threats to the security, confidentiality, and integrity of Licensee Data, including threats arising from unauthorized access, insider threats, social engineering, malware, ransomware, and advanced persistent threats;
(b) assessment of the likelihood and potential impact of each identified threat;
(c) evaluation of the sufficiency and effectiveness of existing safeguards and controls in mitigating identified threats;
(d) identification and prioritization of material risks and gaps; and
(e) development and implementation of a remediation plan to address identified material risks within reasonable timeframes.
Licensor shall document the results of each risk assessment, including key findings, risk ratings, and remediation actions. Upon Licensee's reasonable request, and subject to redaction of information pertaining to other customers or proprietary methodologies, Licensor shall provide Licensee with a summary of the most recent risk assessment findings and the status of remediation actions.
SECTION 3: SECURITY CERTIFICATIONS
3.1 SOC 2 Type II
Licensor shall obtain and maintain a current Service Organization Control 2 (SOC 2) Type II report, prepared in accordance with the American Institute of Certified Public Accountants ("AICPA") Trust Services Criteria and the AT-C Section 205 attestation standards. The SOC 2 Type II report shall cover the following Trust Services Criteria as applicable to the Platform and the services provided under the Agreement:
(a) Security — the system is protected against unauthorized access, use, or modification;
(b) Availability — the system is available for operation and use as committed or agreed;
(c) Confidentiality — information designated as confidential is protected as committed or agreed; and
(d) Processing Integrity — system processing is complete, valid, accurate, timely, and authorized.
The SOC 2 Type II audit shall be conducted annually by an independent, qualified third-party auditor. Each audit period shall cover a minimum of twelve (12) consecutive months. Licensor's most recent SOC 2 Type II report was issued by Crestfield Cyber Advisors, Inc. ("Crestfield"), an AICPA-registered CPA firm, dated March 15, 2025, covering the audit period from March 1, 2024 through February 28, 2025.
Licensor shall deliver a complete, unredacted copy of each new SOC 2 Type II report (including any management letter, bridge letter, or complementary user entity controls) to Licensee within thirty (30) days of Licensor's receipt of the final report from the auditor. If any SOC 2 Type II report contains qualified opinions, exceptions, or material findings, Licensor shall concurrently provide a written remediation plan and timeline for addressing such items.
3.2 ISO 27001
Licensor shall obtain and maintain certification under ISO/IEC 27001:2022 (Information Security Management Systems — Requirements) from a certification body accredited by a member of the International Accreditation Forum ("IAF") or the ANSI National Accreditation Board ("ANAB"). Licensor's current ISO 27001 certificate was issued by Crestfield Cyber Advisors, Inc., dated January 22, 2025, with a certification scope covering the design, development, hosting, and delivery of the SkyComply™ platform and related managed services.
Recertification under ISO 27001 shall occur on a triennial basis, with annual surveillance audits conducted during each intervening year to verify continued compliance. Licensor shall promptly notify Licensee if its ISO 27001 certification is suspended, withdrawn, or reduced in scope for any reason.
Licensor shall deliver copies of its ISO 27001 certificate, the certificate's scope statement, and each annual surveillance audit report to Licensee within thirty (30) days of Licensor's receipt of such documents from the certification body.
3.3 Additional Certifications
If Licensee reasonably requests that Licensor obtain additional security certifications, assessments, or attestations relevant to the services provided under the Agreement (including, by way of example and not limitation, SOC 2 Type II coverage of the Privacy Trust Services Criterion, PCI DSS compliance, or FedRAMP authorization), the parties shall discuss such request in good faith. Any additional costs associated with obtaining, maintaining, or renewing such additional certifications shall be borne by Licensee unless otherwise agreed in writing by the parties. Nothing in this Section 3.3 shall obligate Licensor to obtain any additional certification; however, Licensor shall not unreasonably refuse to engage in such good faith discussions.
SECTION 4: ENCRYPTION STANDARDS
4.1 Data at Rest
All Licensee Data stored at rest within the Platform environment shall be encrypted using the Advanced Encryption Standard with a minimum key length of 256 bits (AES-256), or a successor encryption standard providing equivalent or greater cryptographic protection as recognized by the National Institute of Standards and Technology ("NIST"). Encryption at rest shall apply to all storage media containing Licensee Data, including, without limitation:
(a) primary and secondary databases;
(b) file systems and object storage;
(c) backups and snapshots;
(d) archives and cold storage;
(e) log files containing Licensee Data; and
(f) any removable or portable media (to the extent Licensee Data is stored on such media, which Licensor shall minimize to the greatest extent practicable).
4.2 Data in Transit
All Licensee Data transmitted over public or private networks — including data transmitted between Licensee and the Platform, between Platform components, between the Platform and any Subprocessor, and between data center regions — shall be encrypted using Transport Layer Security ("TLS") version 1.2 or higher, employing cipher suites consistent with NIST guidelines and industry best practices. Licensor shall disable and shall not permit the use of deprecated or insecure protocols for transmission of Licensee Data, including but not limited to SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1.
Licensor shall implement HTTP Strict Transport Security ("HSTS") headers and certificate pinning (or equivalent protections) for all web-facing components of the Platform to mitigate the risk of man-in-the-middle attacks and protocol downgrade attacks.
4.3 Key Management
Licensor shall manage all encryption keys used to protect Licensee Data using Hardware Security Modules ("HSMs") that have achieved a minimum certification of FIPS 140-2 Level 3, or a successor FIPS 140 standard providing equivalent or greater assurance. Key management practices shall conform to NIST SP 800-57 (Recommendation for Key Management) or equivalent industry guidance, and shall include the following controls:
(a) Key Generation. Encryption keys shall be generated within HSMs using cryptographically secure random number generators.
(b) Key Storage. Encryption keys shall be stored within HSMs and shall not be exported in plaintext form outside of the HSM boundary.
(c) Key Rotation. Encryption keys shall be rotated at least annually. In the event that a key is suspected of compromise, Licensor shall rotate the affected key immediately and notify Licensee in accordance with Section 11.
(d) Key Segregation. Licensor shall maintain segregation of encryption keys such that keys used for Licensee Data are logically and cryptographically separate from, and not shared with or accessible to, any other Licensor customer. Each customer's data shall be protected by unique, customer-specific encryption keys.
(e) Key Destruction. Upon expiration, revocation, or replacement of an encryption key, Licensor shall securely destroy the superseded key in a manner that prevents recovery, in accordance with NIST SP 800-88 and HSM vendor guidelines.
4.4 Bring-Your-Own-Key (BYOK) Option
Licensee shall have the option, at Licensee's election, to implement a Bring-Your-Own-Key ("BYOK") arrangement for encryption of Licensee Data at rest, whereby Licensee generates, manages, and controls its own encryption keys through integration with Licensor's key management infrastructure. Under a BYOK arrangement, Licensee shall retain the ability to revoke its keys at any time, which may render Licensee Data inaccessible within the Platform.
If Licensee elects to implement BYOK, the parties shall negotiate in good faith and memorialize the implementation details, technical requirements, integration specifications, timelines, responsibilities, and any additional costs in a mutually agreed written addendum to this Exhibit B or an amendment to the applicable Order Form. Licensor shall provide reasonable technical assistance, documentation, and support to facilitate BYOK implementation.
Licensor represents that its Platform architecture supports BYOK integration through its published key management APIs and that BYOK functionality is available as of the Effective Date for customers utilizing the Orion Cloud Services HSM infrastructure.
SECTION 5: ACCESS CONTROLS
5.1 Authentication. Licensor shall enforce multi-factor authentication ("MFA") for all access to systems, applications, and environments that store, process, or provide access to Licensee Data. MFA requirements shall apply to, without limitation:
(a) all Licensor personnel (including employees, contractors, and temporary staff) accessing production systems, administrative consoles, databases, and infrastructure components;
(b) all Approved Subprocessor personnel with access to systems containing Licensee Data; and
(c) all remote access to Licensor's corporate network or production environment.
Licensor shall also support MFA for Licensee's authorized users accessing the Platform, including support for integration with Licensee's existing identity provider through SAML 2.0, OpenID Connect, or equivalent federation protocols. Licensor shall enforce strong password policies (minimum 14 characters, complexity requirements, prohibition on password reuse for at least the prior 12 passwords) in addition to MFA.
5.2 Role-Based Access Control
Access to Licensee Data shall be strictly limited to Licensor personnel and Approved Subprocessor personnel who require such access to perform their assigned duties and obligations under the Agreement, on a need-to-know, least-privilege basis. No Licensor employee, contractor, or Subprocessor representative shall be granted access to Licensee Data unless such access is necessary for the performance of a specific, documented job function.
Licensor shall maintain a role-based access control ("RBAC") framework that includes, at a minimum:
(a) documented role definitions and associated access rights for each role within the organization;
(b) formal access request and approval workflows, requiring management authorization prior to granting access to systems containing Licensee Data;
(c) periodic access reviews conducted no less frequently than quarterly to verify that access rights remain appropriate and that terminated or reassigned personnel have had their access promptly revoked or modified; and
(d) documentation and audit trails of all access grants, modifications, and revocations.
5.3 Privileged Access Management
Licensor shall implement and maintain heightened security controls for all privileged and administrative accounts (including root accounts, database administrator accounts, system administrator accounts, and any accounts with elevated permissions), including the following:
(a) Individual Accountability. No shared or generic administrative accounts shall be used. Each privileged user shall be assigned a unique, individually identifiable account.
(b) Session Logging and Monitoring. All privileged access sessions shall be logged and monitored in real time, with logs capturing user identity, timestamps, commands executed, and resources accessed.
(c) Automatic Session Timeout. Privileged sessions shall be subject to automatic timeout after a maximum period of inactivity of fifteen (15) minutes.
(d) Just-in-Time Provisioning. Where technically feasible, Licensor shall implement just-in-time ("JIT") provisioning of privileged access, whereby elevated permissions are granted only for the specific duration needed to perform an authorized task and are automatically revoked upon completion or timeout.
(e) Privileged Access Workstations. Access to production systems containing Licensee Data shall be performed from dedicated, hardened workstations or secure jump hosts, to the extent commercially reasonable.
5.4 Access Logging and Monitoring
Licensor shall maintain comprehensive logs of all access to systems containing Licensee Data. Access logs shall capture, at a minimum, the following information:
(a) user identity (including unique user identifier);
(b) timestamp of each access event (in UTC);
(c) type of action performed (e.g., login, logout, read, write, modify, delete, export);
(d) source IP address or device identifier;
(e) success or failure of the access attempt; and
(f) resources or data objects accessed.
Access logs shall be stored in a tamper-evident manner and shall be retained for a minimum of twelve (12) months in readily accessible online or near-line storage, and for an additional twelve (12) months in archive storage. Licensor shall make access logs available to Licensee upon reasonable request in connection with a Security Incident investigation, regulatory examination, or audit conducted pursuant to Section 12 of this Exhibit B. Licensor shall implement automated monitoring and alerting mechanisms to detect anomalous or suspicious access patterns, including failed login attempts, access from unusual locations or times, and bulk data exports.
SECTION 6: NETWORK AND INFRASTRUCTURE SECURITY
6.1 Network Security
Licensor shall implement and maintain network security controls that are designed to protect Licensee Data from unauthorized access, interception, and exfiltration. Such controls shall include, at a minimum:
(a) Firewalls. Enterprise-grade, stateful-inspection firewalls at all network perimeter boundaries and between internal network zones, configured with deny-by-default rules that permit only explicitly authorized traffic.
(b) Intrusion Detection and Prevention Systems ("IDS/IPS"). Network-based and host-based intrusion detection and prevention systems deployed across all environments that process or store Licensee Data, with signatures and detection rules updated regularly to address emerging threats.
(c) Network Segmentation. Logical and, where applicable, physical segmentation of network environments to isolate Licensee Data from other customer environments, Licensor's corporate network, and development/test environments. Licensee Data shall reside in dedicated virtual private cloud ("VPC") environments or equivalent logical partitions within the Orion Cloud infrastructure.
(d) DDoS Mitigation. Distributed denial-of-service ("DDoS") protection mechanisms, including volumetric attack mitigation, application-layer attack mitigation, and traffic scrubbing services.
(e) Web Application Firewall ("WAF"). A web application firewall deployed in front of all web-facing components of the Platform to protect against common web application attacks, including those identified in the OWASP Top Ten.
6.2 Vulnerability Management
Licensor shall establish and maintain a vulnerability management program that addresses the identification, assessment, prioritization, and remediation of security vulnerabilities across all systems, applications, and infrastructure components that process, store, or transmit Licensee Data. The vulnerability management program shall include:
(a) Regular Vulnerability Scanning. Automated vulnerability scanning of internal and external systems shall be performed at least monthly, with additional scanning conducted after significant changes to the environment. Scanning tools shall be maintained with current vulnerability databases and signatures.
(b) Patch Management. Licensor shall maintain a formal patch management process. Critical and high-severity patches (as defined by the Common Vulnerability Scoring System ("CVSS") version 3.1 or successor, with a base score of 7.0 or higher) shall be applied within fourteen (14) days of the patch release date. If immediate patching is not feasible due to compatibility, testing, or operational constraints, Licensor shall implement and document compensating controls to mitigate the risk until the patch can be applied, and shall apply the patch as soon as reasonably practicable.
(c) Tracking and Remediation. Licensor shall track all identified vulnerabilities through a centralized vulnerability management system, assign severity ratings, prioritize remediation based on risk, and maintain records of remediation activities and timelines.
6.3 Malicious Code Protection
Licensor shall deploy and maintain industry-standard anti-malware, anti-virus, and endpoint detection and response ("EDR") tools across all endpoints, servers, and systems that process, store, or have access to Licensee Data. Anti-malware and anti-virus definitions shall be updated automatically and no less frequently than daily. Licensor shall also implement email security controls (including attachment sandboxing and URL rewriting) and content filtering to prevent the introduction of malicious code through common attack vectors.
Licensor represents and warrants that the Platform, as delivered to Licensee, shall not contain any malicious code, including but not limited to viruses, worms, Trojan horses, ransomware, spyware, adware, or any other code designed to disrupt, disable, harm, or otherwise impede the operation of the Platform or any system with which the Platform interacts. This warranty is in addition to, and shall not limit, any similar warranty set forth in the body of the Agreement.
SECTION 7: PENETRATION TESTING
7.1 Licensor-Commissioned Penetration Testing
Licensor shall engage a qualified, independent third-party security firm to conduct penetration testing of the Platform and its associated infrastructure at least once per calendar year. Each penetration test shall be comprehensive in scope and shall include, at a minimum:
(a) Application-Layer Testing. Testing of the SkyComply™ Platform application, including web application testing, API security testing, authentication and authorization testing, session management testing, input validation testing, and business logic testing, aligned with OWASP Testing Guide methodology.
(b) Infrastructure-Layer Testing. Testing of the underlying infrastructure, including network penetration testing, host-level testing, cloud configuration review, and testing of supporting services and integrations.
Licensor shall provide Licensee with an executive summary of the penetration test results within thirty (30) days of the completion of each test. The executive summary shall include a description of the scope and methodology, a summary of findings categorized by severity (critical, high, medium, low, and informational), remediation recommendations, and agreed-upon remediation timelines for each finding. Full detailed reports shall be made available for Licensee's review at Licensor's facilities or through a secure document-sharing mechanism, subject to reasonable confidentiality protections.
Licensor's most recent penetration test may be conducted by Crestfield Cyber Advisors, Inc. or another qualified third-party assessor selected by Licensor in its reasonable discretion. Licensee may request that Licensor identify the firm performing the test, and Licensor shall provide such information upon request.
7.2 Licensee-Initiated Penetration Testing
In addition to Licensor's annual penetration testing obligations under Section 7.1, Licensee shall have the right to conduct or commission, at Licensee's sole cost and expense, one (1) penetration test per calendar year of the Platform. Such Licensee-initiated penetration testing shall be subject to the following conditions:
(a) Scope. Licensee-initiated penetration testing shall be limited to application-layer testing of the SkyComply™ Platform, including web application, API, and authentication/authorization testing. Infrastructure-layer testing (including network penetration testing, host-level testing, and testing of Orion Cloud infrastructure) shall not be conducted without Licensor's prior written consent, which consent shall not be unreasonably withheld, conditioned, or delayed.
(b) Prior Notice. Licensee shall provide Licensor with at least thirty (30) business days' prior written notice of any planned penetration test. The notice shall include the identity and qualifications of the proposed testing firm, the proposed scope of testing, the testing methodology, the proposed testing schedule (including dates and hours), and the names and contact information of the individuals who will perform the test.
(c) Testing Environment. Testing shall be conducted in a non-production (staging/sandbox) environment provided by Licensor for such purpose, unless the parties otherwise agree in writing that testing in a production environment is necessary to achieve the objectives of the test. Licensee shall use commercially reasonable efforts to minimize any disruption to the Platform or to Licensor's operations and other customers.
(d) Confidentiality. The testing firm engaged by Licensee must execute a confidentiality and non-disclosure agreement in a form reasonably satisfactory to Licensor prior to commencing any testing. The testing firm shall be prohibited from disclosing any test results, findings, or information about the Platform or Licensor's systems to any third party without Licensor's prior written consent.
(e) Sharing of Results. Licensee shall share the complete results of any Licensee-initiated penetration test, including the final written report and any supporting data, with Licensor within fifteen (15) business days of Licensee's receipt of the final report from the testing firm.
(f) Coordination. Licensor shall designate a point of contact to coordinate with Licensee and the testing firm during the test, including providing necessary access credentials, test accounts, and technical information.
7.3 Remediation. Licensor shall remediate all findings identified through penetration testing, whether such testing is commissioned by Licensor under Section 7.1 or initiated by Licensee under Section 7.2, in accordance with the following timelines:
(a) Critical-Severity Findings. Remediated within thirty (30) days of the finding being reported to Licensor.
(b) High-Severity Findings. Remediated within thirty (30) days of the finding being reported to Licensor.
(c) Medium-Severity Findings. Remediated within sixty (60) days of the finding being reported to Licensor.
(d) Low-Severity Findings. Remediated within ninety (90) days of the finding being reported to Licensor or accepted by Licensor through a documented risk acceptance process.
If Licensor is unable to remediate a finding within the applicable timeline, Licensor shall promptly notify Licensee, provide a written explanation of the delay, implement compensating controls to mitigate the risk in the interim, and provide a revised remediation timeline for Licensee's review.
Licensor shall provide Licensee with written confirmation of remediation upon completion of remediation for each critical and high-severity finding, and shall maintain records of all remediation activities for Licensee's review during audits conducted under Section 12.
SECTION 8: DATA RESIDENCY
8.1 Geographic Restrictions
All Licensee Data, in all forms (including production data, backups, replicas, snapshots, archives, logs, and any derived or aggregated data), shall be stored, processed, accessed, and maintained exclusively within the continental United States. Licensor shall not transfer, access, transmit, or otherwise process Licensee Data from any location outside the continental United States without Licensee's prior written consent. For the avoidance of doubt, this restriction applies to:
(a) all Licensor personnel accessing Licensee Data, regardless of their physical location — all such access shall occur only from within the continental United States;
(b) all Subprocessors and their personnel;
(c) all support, maintenance, development, and administrative functions involving access to Licensee Data; and
(d) all disaster recovery, backup, and failover operations.
8.2 Hosting Locations
Licensor hosts the Platform and stores Licensee Data through Orion Cloud Services, Inc. ("Orion Cloud"), a Delaware corporation with headquarters at 4500 Great America Parkway, Santa Clara, California 95054. Licensee Data shall be stored and processed exclusively within the following Orion Cloud data center regions:
(a) US-East — Northern Virginia (Ashburn, VA metropolitan area); and
(b) US-West — Oregon (The Dalles, OR metropolitan area).
Licensor shall not migrate, transfer, replicate, or otherwise cause Licensee Data to be stored or processed in any data center region, availability zone, or facility other than those specified above, or with any cloud infrastructure provider other than Orion Cloud, without Licensee's prior written consent. In the event that Licensor desires to change hosting providers or regions, Licensor shall provide Licensee with at least ninety (90) days' advance written notice and shall not proceed without Licensee's written approval.
8.3 Redundancy and Failover
Licensor shall maintain geographic redundancy between the US-East (Virginia) and US-West (Oregon) Orion Cloud regions for disaster recovery and business continuity purposes, as further described in Section 13 of this Exhibit B. Data replication between regions shall occur over encrypted channels in compliance with Section 4.2. Failover to the secondary region, whether automatic or manual, shall not alter, reduce, or modify the data residency commitments set forth in this Section 8. Under no circumstances shall failover result in Licensee Data being stored, processed, or accessed from a location outside the continental United States.
SECTION 9: PERSONNEL SECURITY
9.1 Background Checks
All Licensor personnel — including full-time employees, part-time employees, independent contractors, consultants, and temporary staff — who will have access to Licensee Data or to systems, networks, applications, or environments that store, process, or transmit Licensee Data shall undergo comprehensive background checks prior to being granted such access. Background checks shall be consistent with Federal Financial Institutions Examination Council ("FFIEC") guidance on personnel security and shall include, at a minimum:
(a) criminal history checks at the federal, state, and county levels for all jurisdictions of residence during the preceding seven (7) years;
(b) identity verification (including Social Security number verification and government-issued photo identification);
(c) employment history verification for the preceding five (5) years;
(d) education verification (highest degree obtained); and
(e) check against the Office of Foreign Assets Control ("OFAC") Specially Designated Nationals and blocked Persons List and other applicable government watchlists.
Background checks shall be conducted by a qualified, reputable third-party screening provider. Licensor shall not grant access to Licensee Data or systems containing Licensee Data to any individual whose background check reveals information that would reasonably call into question such individual's trustworthiness or fitness to handle sensitive financial institution data.
Licensor shall maintain records of completed background checks and shall, upon Licensee's written request, provide a written certification confirming that all Licensor personnel with access to Licensee Data have successfully completed background checks in accordance with this Section 9.1. Licensor shall not be required to disclose the specific results of individual background checks, but shall certify compliance in the aggregate.
9.2 Security Awareness Training
Licensor shall provide comprehensive security awareness training to all personnel with access to Licensee Data, and shall require completion of such training prior to granting access and at least annually thereafter. Security awareness training shall cover, at a minimum:
(a) phishing identification and prevention;
(b) social engineering awareness;
(c) proper data handling and classification procedures;
(d) password hygiene and MFA best practices;
(e) incident reporting procedures and the obligation to promptly report suspected Security Incidents;