EXHIBIT B
SECURITY EXHIBIT
Revised Draft — June 27, 2025
Exhibit B to the Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, National Association
Calderwood & Harkness LLP — Matter No. 1009-00007
REDLINE NOTE: This Revised Draft of Exhibit B reflects negotiated changes from the initial Security Exhibit draft dated May 9, 2025, incorporating comments received from Hargrove, Tully & Cascade Insurance Brokers on behalf of Meridian National Bank, National Association. Revisions are reflected in clean form; a separately circulated redline comparison against the initial draft is available upon request. Substantive provisions that were the subject of negotiated compromise between the parties are identified with the notation "(Revised — Negotiated Provision)" or "(Revised — Negotiated Compromise)" in the relevant section heading.
Right-click to update Table of Contents
SECTION 1: DEFINITIONS
1.1 Defined Terms
As used in this Exhibit B (this "Security Exhibit" or "Exhibit"), the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined in this Exhibit shall have the meanings ascribed to them in the Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. ("Licensor") and Meridian National Bank, National Association ("Licensee"), dated as of the date set forth on the signature page thereto (the "MSA" or "Agreement"), or, where applicable, in the Data Processing Addendum attached as Exhibit C to the Agreement.
"Agreement" means the Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. ("Licensor") and Meridian National Bank, National Association ("Licensee"), together with all exhibits, schedules, addenda, and amendments thereto.
"Confidential Data" means all data provided by or on behalf of Licensee to Licensor in connection with the services provided under the Agreement, including, without limitation, Non-Public Personal Information ("NPI") as defined under Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809, and regulations promulgated thereunder (collectively, the "GLBA"), personally identifiable information ("PII") as such term is commonly understood under applicable federal and state privacy laws, and any other data that is identified as confidential, proprietary, or restricted under the Agreement, this Exhibit, or Licensee's applicable data classification policies. Confidential Data includes, without limitation, Highly Restricted Data as defined below.
"Highly Restricted Data" means the subset of Confidential Data that is classified as "Highly Restricted" under Licensee's data classification policy, as communicated to Licensor in writing from time to time. As of the Effective Date, Highly Restricted Data includes, without limitation: (a) customer financial records, including account numbers, balances, and credit information; (b) transaction data, including wire transfer records, ACH transaction details, and payment instructions; and (c) suspicious activity report ("SAR") information and related investigative materials filed or maintained pursuant to the Bank Secrecy Act and its implementing regulations (31 C.F.R. Part 1020 et seq.). Licensee may update its data classification policy from time to time upon reasonable written notice to Licensor; provided that any such update that materially increases Licensor's obligations under this Exhibit shall be subject to mutual good-faith discussion regarding implementation timelines and, where applicable, additional fees as contemplated by the Agreement.
"Licensor Personnel" means all employees, independent contractors, agents, consultants, and Subprocessors (as defined below) of Skybridge Fintech Ltd. who access, process, store, transmit, or otherwise handle Licensee Confidential Data or Highly Restricted Data in connection with the performance of services under the Agreement.
"Platform" means the SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform, including all software, algorithms, machine-learning models, application programming interfaces, user interfaces, documentation, and related components provided by Licensor to Licensee under the Agreement, as further described in Exhibit A (Service Description) to the Agreement.
"Security Incident" means any confirmed unauthorized access to, acquisition of, use of, disclosure of, modification of, or loss of Licensee Confidential Data or Highly Restricted Data, or any confirmed breach of the security controls set forth in this Exhibit, that compromises the security, confidentiality, or integrity of such data. For the avoidance of doubt, a Security Incident does not include unsuccessful login attempts, port scans, denial-of-service attacks that do not result in unauthorized access to data, or other similar events that do not result in actual unauthorized access to, acquisition of, use of, disclosure of, modification of, or loss of Licensee data, unless such events are determined by Licensor's security team to have resulted in a compromise of the security controls described herein.
"Subprocessor" means any third-party entity engaged by Licensor to process, store, access, or transmit Licensee data in connection with the performance of services under the Agreement. As of the Effective Date, the approved Subprocessor is Orion Cloud Services, Inc., which serves as Licensor's cloud infrastructure-as-a-service ("IaaS") hosting provider. A current list of approved Subprocessors is maintained in Schedule B-1 to this Exhibit.
"Security Assessment Questionnaire" or "SAQ" means the standardized questionnaire completed by Licensor detailing its security controls, policies, and procedures, in the form provided by Licensee as part of its vendor risk management program. The current SAQ template is attached as Schedule B-4 to this Exhibit.
All references to sections, schedules, and exhibits in this Exhibit are to sections of, and schedules and exhibits to, this Exhibit unless otherwise specified. Cross-references to definitions contained in the Agreement, the Data Processing Addendum (Exhibit C), or any other exhibit to the Agreement are incorporated herein by reference and shall be given full force and effect as if set forth herein in their entirety.
SECTION 2: SECURITY CERTIFICATIONS AND STANDARDS
2.1 Required Certifications
Licensor shall obtain and maintain at all times during the term of the Agreement, at Licensor's sole cost and expense, each of the following security certifications:
(a) SOC 2 Type II Certification. Licensor shall maintain a current Service Organization Control 2 Type II report ("SOC 2 Type II Report") covering the Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy, as applicable to the Platform and the services provided under the Agreement. The SOC 2 Type II Report shall be issued by a qualified, independent third-party auditing firm and shall cover a reporting period of not less than twelve (12) consecutive months. As of the date of this Revised Draft, Licensor's most recent SOC 2 Type II Report is dated March 15, 2025, and was performed by Crestfield Cyber Advisors, Inc., an independent third-party auditing firm. Licensor shall cause a SOC 2 Type II audit to be performed annually and shall ensure that there is no gap in coverage between successive reporting periods.
(b) ISO 27001 Certification. Licensor shall maintain certification under the International Organization for Standardization / International Electrotechnical Commission standard ISO/IEC 27001:2022 (Information Security Management Systems — Requirements) or its successor standard. ISO 27001 certification shall be subject to triennial recertification with annual surveillance audits conducted by a qualified, independent certification body. As of the date of this Revised Draft, Licensor's most recent ISO 27001 certificate is dated January 22, 2025, and was issued following an audit conducted by Crestfield Cyber Advisors, Inc.
Licensor shall maintain both the SOC 2 Type II certification and the ISO 27001 certification without interruption throughout the entire term of the Agreement, including any renewal terms. Any lapse, suspension, revocation, or withdrawal of either certification shall constitute a material breach of the Agreement and this Exhibit, entitling Licensee to exercise all rights and remedies available under the Agreement, at law, or in equity, including, without limitation, the right to terminate the Agreement for cause in accordance with the termination provisions of the Agreement.
Licensor shall provide Licensee with complete, unredacted copies of the current SOC 2 Type II Report and the current ISO 27001 certificate within ten (10) business days of Licensee's written request therefor. In addition, Licensor shall promptly provide Licensee with copies of any renewed, reissued, or updated SOC 2 Type II Reports and ISO 27001 certificates within ten (10) business days of Licensor's receipt of such reports or certificates from the applicable auditor or certification body. Copies of the current certifications as of the date of this Exhibit are identified in Schedule B-2.
2.2 Industry Standards Compliance
In addition to maintaining the certifications described in Section 2.1, Licensor's information security practices, controls, and procedures shall at all times meet or exceed the prevailing industry standards for security applicable to software-as-a-service providers serving regulated financial institutions in the United States.
Without limiting the generality of the foregoing, Licensor shall maintain security practices that are designed to comply with or align with the following frameworks, standards, and regulatory guidance, as applicable to the nature of the services provided under the Agreement:
(a) The applicable provisions of the Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook, including, without limitation, the booklets on Information Security, Outsourcing Technology Services, and Business Continuity Management.
(b) The National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), version 2.0 or its successor, as applicable to financial services SaaS environments.
(c) The security and privacy controls set forth in NIST Special Publication 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations, to the extent such controls are applicable to the services provided under the Agreement and to the processing, storage, and transmission of Licensee Confidential Data and Highly Restricted Data in a cloud-based SaaS environment.
Licensor acknowledges that Licensee is a nationally chartered banking institution and a systemically important financial institution subject to the supervisory authority and examination jurisdiction of the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System (the "Federal Reserve"), and the Federal Deposit Insurance Corporation ("FDIC"). Licensor further acknowledges that this Security Exhibit is designed to, and shall be interpreted and applied in a manner intended to, satisfy the requirements of OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), the Interagency Guidance on Third-Party Relationships: Risk Management (issued June 6, 2023, by the OCC, Federal Reserve, and FDIC), and any successor or supplemental regulatory guidance addressing third-party risk management for banking organizations. Licensor agrees to cooperate with Licensee in good faith to implement any additional security controls or reporting requirements that may be necessary to ensure Licensee's ongoing compliance with applicable regulatory guidance.
SECTION 3: ENCRYPTION STANDARDS
3.1 Data at Rest
All Licensee Confidential Data and Highly Restricted Data stored by Licensor or its Subprocessors shall be encrypted at rest using the Advanced Encryption Standard ("AES") with a minimum key length of 256 bits ("AES-256"). Encryption at rest shall be applied at the storage volume level for all storage media containing Licensee data, including, without limitation, block storage volumes, object storage repositories, database storage, and backup media.
In addition to volume-level encryption, Licensor shall implement database field-level encryption for Highly Restricted Data where technically feasible. Licensor shall use commercially reasonable efforts to identify and implement field-level encryption for all database fields containing Highly Restricted Data categories identified in Section 1.1 above. Where field-level encryption is not technically feasible due to application architecture or performance constraints, Licensor shall document the basis for such determination and provide such documentation to Licensee upon request.
All encryption keys used for encryption of data at rest shall be generated, stored, and managed using Licensor-managed hardware security modules ("HSMs") that are validated to at least FIPS 140-2 Level 3 (or FIPS 140-3 Level 3, upon availability and adoption). HSMs shall be hosted within the approved Orion Cloud Services, Inc. data center regions identified in Section 4.1 of this Exhibit.
3.2 Data in Transit
All Licensee Confidential Data and Highly Restricted Data transmitted over any network, including, without limitation, public networks, private networks, and internal networks, shall be encrypted in transit using Transport Layer Security ("TLS") protocol version 1.2 or higher. Licensor shall support and prefer TLS 1.3 where supported by the client environment.
No fallback to deprecated or insecure protocols shall be permitted. Without limiting the generality of the foregoing, Licensor shall not permit the use of Secure Sockets Layer ("SSL") in any version, TLS version 1.0, or TLS version 1.1 for any communications involving Licensee data. Licensor shall disable support for such deprecated protocols on all systems processing, storing, or transmitting Licensee data.
Licensor shall maintain certificate management procedures designed to ensure timely renewal and, where necessary, revocation of digital certificates used in connection with TLS encryption. Certificates shall be issued by a reputable, publicly trusted certificate authority. Licensor shall monitor certificate expiration dates and initiate renewal procedures sufficiently in advance of expiration to prevent any lapse in encryption coverage.
3.3 Key Management
(a) Default Key Management. Unless Licensee elects the BYOK option described in subsection (b) below, encryption keys shall be managed by Licensor using Licensor-managed HSMs as described in Section 3.1. Licensor shall maintain documented key management policies and procedures covering key generation, distribution, storage, rotation, revocation, and destruction.
(b) Bring-Your-Own-Key ("BYOK") Option. Licensee may elect to manage its own encryption keys via a key management integration supported by Licensor. If Licensee elects the BYOK option, the parties shall cooperate to implement the necessary technical integration during the Implementation Period, currently scheduled for September 15, 2025 through February 28, 2026, as set forth in the Agreement. Licensor shall provide reasonable technical support and documentation to facilitate BYOK integration. The specific terms, technical requirements, and any additional costs associated with the BYOK option shall be documented in a mutually agreed implementation plan. If Licensee does not elect the BYOK option during the Implementation Period, Licensee may elect to implement BYOK at a later date, subject to mutual agreement on implementation timeline and, where applicable, additional fees.
(c) Key Rotation. All encryption keys, whether managed by Licensor or by Licensee under the BYOK option, shall be rotated no less frequently than once every twelve (12) months. In the event of a suspected or confirmed compromise of any encryption key, the affected key shall be rotated immediately, and Licensor shall promptly notify Licensee of such key rotation and the circumstances giving rise to it.
(d) Key Access Controls. Access to encryption keys shall be restricted to authorized Licensor security personnel whose roles and responsibilities require such access. All key access shall be subject to documented role-based access controls, and all key management operations shall be logged with audit trails maintained in accordance with the access logging requirements set forth in Section 5.1 of this Exhibit.
SECTION 4: DATA RESIDENCY AND STORAGE
4.1 Geographic Restrictions
All Licensee Confidential Data and Highly Restricted Data shall be stored and processed exclusively within the continental United States. Hosting of Licensee data shall be limited to the following Orion Cloud Services, Inc. data center regions:
(a) US-East (Northern Virginia); and
(b) US-West (Oregon).
No Licensee data shall be transferred to, accessed from, stored in, or processed in any location outside the continental United States without the prior written consent of Licensee. This restriction applies to all forms of Licensee data, including, without limitation, production data, backup data, disaster recovery replicas, development or test copies (to the extent such copies contain Licensee data or data derived from Licensee data), and log files containing Licensee data.
Licensor shall implement and maintain technical and organizational controls designed to prevent inadvertent or unauthorized cross-border transfer of Licensee data. Such controls shall include, at a minimum: (i) configuration of cloud infrastructure to restrict data storage and processing to the approved regions identified above; (ii) network-level controls and access policies to prevent routing of Licensee data through non-approved regions; and (iii) monitoring and alerting mechanisms to detect and flag any potential cross-border data transfer.
4.2 Infrastructure Provider
Licensor's designated infrastructure-as-a-service ("IaaS") provider for the hosting of the Platform and the processing of Licensee data is Orion Cloud Services, Inc., a Delaware corporation with principal offices located at 4500 Great America Parkway, Santa Clara, California 95054. Orion Cloud Services, Inc. is identified as an approved Subprocessor in Schedule B-1 to this Exhibit.
Orion Cloud Services, Inc.'s platform service level agreement provides for 99.95% monthly uptime availability for the infrastructure services utilized by Licensor in connection with the Platform. Licensor shall ensure that the service level commitments applicable to the Platform, as set forth in the Agreement or any applicable service level addendum, are supported by the infrastructure-level SLAs maintained with Orion Cloud Services, Inc.
Licensor shall ensure that Orion Cloud Services, Inc.'s security controls meet or exceed the standards set forth in this Exhibit through contractual flow-down obligations. Such flow-down obligations shall be documented in the Subprocessor Flow-Down Terms Addendum maintained between Licensor and Orion Cloud Services, Inc. Licensor shall make the relevant security-related provisions of such flow-down agreement available to Licensee upon request for purposes of Licensee's vendor risk management review, subject to any confidentiality restrictions imposed by Orion Cloud Services, Inc. (provided that Licensor shall use commercially reasonable efforts to obtain Orion Cloud's consent to such disclosure).
SECTION 5: ACCESS CONTROLS AND PERSONNEL SECURITY
5.1 Access Controls
Licensor shall implement and maintain the following access controls with respect to all systems, applications, databases, and environments that process, store, or transmit Licensee Confidential Data or Highly Restricted Data:
(a) Role-Based Access Control. Licensor shall implement role-based access control ("RBAC") for all Licensor Personnel with access to Licensee data. Access permissions shall be assigned based on job function and organizational role, and shall be documented in an access control matrix or equivalent record maintained by Licensor's security team.
(b) Principle of Least Privilege. All access to Licensee data shall be granted on the principle of least privilege. Access shall be limited to the minimum level necessary for each individual to perform his or her assigned job functions. No Licensor Personnel shall be granted standing administrative or privileged access to Licensee data environments unless such access is required by the individual's documented role and responsibilities.
(c) Multi-Factor Authentication. Multi-factor authentication ("MFA") shall be required for all administrative and privileged access to systems processing, storing, or transmitting Licensee data. MFA shall also be required for all remote access to Licensor's corporate network and to any environment from which Licensee data can be accessed. MFA shall utilize at least two distinct authentication factors from different categories (e.g., something the user knows and something the user possesses).
(d) Access Logging and Monitoring. All access to Licensee data, including read, write, modify, and delete operations, shall be logged. Access logs shall include, at a minimum, the following information: (i) timestamp of the access event; (ii) identity of the user or system account performing the action; (iii) type of action performed; (iv) the data or system resource accessed; and (v) source IP address or network location, where applicable. Access logs shall be stored in a secure, tamper-evident manner and shall be retained for a minimum period of twelve (12) months. Licensor shall monitor access logs for anomalous or unauthorized activity and shall investigate any suspected unauthorized access promptly.
(e) Quarterly Access Reviews. Licensor shall conduct access reviews on at least a quarterly basis to verify that all access to Licensee data remains appropriate and consistent with current job functions and the principle of least privilege. Access rights shall be promptly revoked or modified upon any change in an individual's role, responsibilities, or employment status. Upon termination of any Licensor Personnel's employment or engagement, all access to Licensee data and related systems shall be revoked within twenty-four (24) hours of the effective date of such termination.
5.2 Background Checks
All Licensor Personnel who are granted access to Licensee Confidential Data or Highly Restricted Data must undergo background checks prior to being granted such access. Background checks shall be consistent with the guidelines and expectations set forth in the FFIEC Information Technology Examination Handbook and shall include, at a minimum, the following components:
(a) Criminal history check, including federal, state, and county-level criminal records searches;
(b) Verification of employment history for at least the most recent five (5) years of employment; and
(c) Verification of educational credentials claimed by the individual.
Licensor shall maintain records of completed background checks for all Licensor Personnel with access to Licensee data. Upon Licensee's reasonable written request, Licensor shall certify in writing that background checks have been completed for all such personnel in accordance with this Section 5.2. Licensor shall not be required to disclose the detailed results of individual background checks but shall confirm that such checks have been completed and that no disqualifying information was identified (or, if disqualifying information was identified, that the individual has not been granted access to Licensee data).
5.3 Security Awareness Training
All Licensor Personnel who are granted access to Licensee Confidential Data or Highly Restricted Data shall receive comprehensive security awareness training upon hire or initial engagement and at least annually thereafter. Security awareness training shall cover, at a minimum, the following topics:
(a) Recognition and reporting of phishing, social engineering, and other common attack vectors;
(b) Proper data handling procedures, including classification, storage, transmission, and destruction of sensitive data;
(c) Obligations to report suspected Security Incidents, policy violations, and other security concerns promptly to Licensor's security team;
(d) Regulatory requirements specific to the handling of financial services data, including an overview of GLBA, BSA/AML obligations, and the importance of safeguarding SAR-related information; and
(e) Licensor's information security policies, acceptable use policies, and any other policies relevant to the protection of Licensee data.
Licensor shall maintain records of training completion for all Licensor Personnel and shall make such records available to Licensee upon reasonable request for purposes of Licensee's vendor risk management program.
SECTION 6: PENETRATION TESTING
6.1 Licensor-Initiated Penetration Testing
Licensor shall, at Licensor's sole cost and expense, engage a qualified independent third-party security firm to conduct a comprehensive penetration test of the Platform and its supporting infrastructure at least once per calendar year. The scope of each annual penetration test shall include both application-layer testing (including, without limitation, testing of the SkyComply™ web application, APIs, and authentication mechanisms) and infrastructure-layer testing (including, without limitation, testing of network architecture, firewall configurations, and server hardening within the SkyComply™ environment hosted on Orion Cloud Services, Inc. infrastructure).
Licensor's current designated third-party penetration testing firm is Crestfield Cyber Advisors, Inc. (Lead Auditor: Deepa Rajan; CEO: Winston Lam; principal offices: 222 West Adams Street, Suite 1200, Chicago, Illinois 60606). In the event Licensor proposes to change its designated penetration testing firm, Licensor shall notify Licensee in advance and shall ensure that any replacement firm is a reputable, qualified security assessment firm with experience in testing financial services technology platforms.
Within thirty (30) calendar days of the completion of each annual penetration test, Licensor shall provide Licensee with an executive summary of the penetration test results. The executive summary shall include, at a minimum: (i) the scope and methodology of the test; (ii) a summary of findings categorized by severity level (critical, high, medium, and low); (iii) the remediation status for any critical-severity or high-severity findings; and (iv) Licensor's planned remediation timeline for any open findings. Licensee may request the full penetration test report, and Licensor shall provide such report subject to the confidentiality provisions of the Agreement.
6.2 Licensee-Initiated Penetration Testing (Revised — Negotiated Provision)
Licensee shall have the right to conduct or commission one (1) penetration test of the Platform per calendar year, at Licensee's sole cost and expense, subject to the terms and conditions set forth in this Section 6.2 and the scheduling and coordination provisions of Section 6.3 below.
Application-Layer Testing. Licensee-initiated application-layer penetration testing of the SkyComply™ Platform, including testing of web application interfaces, APIs, authentication and authorization mechanisms, and session management controls, shall be permitted without restriction other than compliance with the scheduling and coordination provisions of Section 6.3 below.
Infrastructure-Layer Testing (Negotiated Compromise). Licensee-initiated infrastructure-layer penetration testing shall be permitted only under the following conditions:
(a) Licensee must provide Licensor with at least thirty (30) business days' prior written notice specifying the proposed scope, methodology, and identity of the testing firm that will conduct the infrastructure-layer testing.
(b) The testing firm engaged by Licensee must be a mutually agreed-upon qualified third party with demonstrated experience in infrastructure-layer security assessments for cloud-hosted financial services platforms. If Licensee's designated testing firm is not acceptable to Licensor, Licensor shall provide a written explanation for its objection (such objection not to be unreasonably withheld, conditioned, or delayed). In the event the parties cannot agree on Licensee's designated firm, the parties shall engage Crestfield Cyber Advisors, Inc., or, if Crestfield Cyber Advisors, Inc. is unavailable or declines the engagement, another mutually agreed independent security assessment firm.
(c) Infrastructure-layer testing shall be limited to the logical infrastructure layer supporting the SkyComply™ Platform, including, without limitation, virtual network configurations, virtual machine and container configurations, and access control configurations within the Orion Cloud Services, Inc. environment provisioned for the Platform. Infrastructure-layer testing shall not extend to Orion Cloud Services, Inc.'s underlying physical infrastructure, hypervisor-layer infrastructure, or shared multi-tenant infrastructure components, which are governed by Orion Cloud Services, Inc.'s own security certifications, audit program, and customer agreements.
(d) Licensor shall have the right to have a representative present during all infrastructure-layer testing activities. Such representative may observe the testing and raise concerns regarding testing activities that may, in Licensor's reasonable judgment, pose a risk to the stability, availability, or security of the production environment or other customers' data.
(e) Testing must be conducted during non-peak hours, as mutually agreed by the parties, and shall not intentionally disrupt production environments, impact service availability for Licensee or other customers of Licensor, or create security vulnerabilities. Licensor may, in its reasonable discretion, require that infrastructure-layer testing be conducted in a staging or pre-production environment that mirrors the production configuration in all material respects, provided that Licensor makes such staging environment available in a timely manner and certifies that the environment is representative of the production configuration.
(f) All findings, reports, and work products resulting from Licensee-initiated penetration testing (whether application-layer or infrastructure-layer) shall be treated as Licensor's Confidential Information under the Agreement and shall not be disclosed to any third party other than Licensee's federal banking regulators (OCC, Federal Reserve, or FDIC) without Licensor's prior written consent. Notwithstanding the foregoing, Licensee may share penetration testing findings with its external auditors and legal counsel, provided that such recipients are bound by confidentiality obligations no less restrictive than those set forth in the Agreement.
6.3 Scheduling and Coordination
Licensee shall coordinate all penetration testing activities, whether application-layer or infrastructure-layer, with Licensor's Chief Information Security Officer (currently Amara Okafor) or Licensor's designated security point of contact. All testing requests shall be submitted in writing (email to be sufficient) to Licensor's CISO or designated security point of contact.
Licensor shall not unreasonably delay or obstruct Licensee-initiated penetration testing. Testing windows shall be mutually agreed by the parties. If Licensee's proposed testing window conflicts with Licensor's scheduled maintenance windows (currently Saturdays, 2:00 AM to 6:00 AM Eastern Time) or other documented operational constraints, Licensor shall propose one or more alternative testing windows within five (5) business days of receiving Licensee's request. Alternative testing windows shall be reasonable and shall not result in a delay of more than twenty (20) business days from the date of Licensee's original request unless a longer delay is necessitated by exceptional circumstances documented in writing by Licensor.
6.4 Remediation. Licensor shall remediate any critical-severity findings (defined as findings with a CVSS score of 9.0 or higher, or findings assessed by the testing firm as "critical" in accordance with the testing firm's severity classification methodology) within fifteen (15) calendar days of Licensor's confirmation of the finding. Licensor shall remediate any high-severity findings (defined as findings with a CVSS score between 7.0 and 8.9, or findings assessed by the testing firm as "high" in accordance with the testing firm's severity classification methodology) within thirty (30) calendar days of Licensor's confirmation of the finding.
Within five (5) business days of Licensor's receipt of the final penetration test results from any Licensor-initiated or Licensee-initiated penetration test, Licensor shall provide Licensee with a written remediation plan that identifies each finding, its severity classification, the planned remediation actions, the responsible individual or team, and the target remediation date.
Licensee shall have the right to verify the remediation of all critical-severity and high-severity findings through targeted re-testing, conducted at Licensee's expense (unless the finding is attributable to a Licensor breach of its obligations under this Exhibit, in which case re-testing costs shall be borne by Licensor). Such re-testing shall be coordinated with Licensor in accordance with the scheduling provisions of Section 6.3.
SECTION 7: SECURITY INCIDENT NOTIFICATION AND RESPONSE
7.1 Notification Timing (Revised — Negotiated Compromise)
Licensor shall notify Licensee of any confirmed Security Incident affecting Licensee Confidential Data or Highly Restricted Data within eighteen (18) hours of discovery of such Security Incident.
For purposes of this Section 7, "discovery" means the point in time at which Licensor's security team has confirmed, through its incident response procedures, that a Security Incident has occurred, as distinguished from a suspected or potential security event that remains under investigation. Licensor shall not delay confirmation of a Security Incident for the purpose of extending the notification window provided herein, and Licensor's incident response procedures shall include provisions for the timely escalation and triage of suspected security events.
Drafting Note: The initial Skybridge Fintech Ltd. position was a twenty-four (24) hour notification window. Hargrove, Tully & Cascade Insurance Brokers, on behalf of Meridian National Bank, N.A., requested a twelve (12) hour notification window. Following negotiation, the parties have agreed to an eighteen (18) hour compromise notification window as reflected above.
Notification shall be provided to the following Licensee representatives:
(i) Sandra Petrov, Head of Financial Crimes & Compliance, Meridian National Bank, N.A. (contact details as set forth in Schedule B-3); and
(ii) Catherine Woo, Associate General Counsel, Technology, Meridian National Bank, N.A. (contact details as set forth in Schedule B-3).
Notification shall be provided via both email and telephone to the individuals identified above (or their successors as designated by Licensee in writing from time to time). If initial contact cannot be made with either individual, Licensor shall continue to attempt contact via the alternative contact methods set forth in Schedule B-3 and shall leave detailed voicemail messages describing the nature of the Security Incident and requesting an immediate return call.
7.2 Content of Initial Notification
The initial notification provided under Section 7.1 shall include the following information, to the extent known or reasonably determinable at the time of notification:
(a) The nature and scope of the Security Incident, including a description of the type of security event (e.g., unauthorized access, data exfiltration, ransomware, insider threat);
(b) The categories and approximate volume of Licensee data affected or potentially affected by the Security Incident, including whether Highly Restricted Data is believed to be involved;
(c) The date and time of discovery of the Security Incident, and, if known, the estimated date and time of initial occurrence;
(d) A preliminary assessment of the likely cause of the Security Incident;
(e) A description of the immediate containment and mitigation measures that Licensor has taken or is in the process of taking to limit the scope and impact of the Security Incident; and
(f) The name, title, telephone number, and email address of Licensor's incident response lead for the Security Incident.
Licensor acknowledges that initial notification may necessarily be based on preliminary and incomplete information. The provision of an initial notification under this Section 7.2 shall not relieve Licensor of its obligation to provide follow-up reporting as set forth in Section 7.3.
7.3 Follow-Up Reporting
Following delivery of the initial notification under Section 7.1, Licensor shall provide Licensee with written status updates at intervals of not less than every twenty-four (24) hours until such time as the Security Incident has been fully contained and remediated. Status updates shall include any new or updated information regarding the items identified in Section 7.2, as well as a description of ongoing investigation and remediation activities.
Within thirty (30) calendar days of the resolution of the Security Incident, Licensor shall deliver to Licensee a comprehensive written incident report constituting a root cause analysis ("Root Cause Analysis"). The Root Cause Analysis shall include, at a minimum:
(a) A detailed timeline of events, from the estimated date and time of initial occurrence through full containment and remediation;
(b) A thorough root cause analysis identifying the underlying cause(s) of the Security Incident, including any contributing factors such as process failures, control gaps, or human error;
(c) A complete description of the scope of Licensee data affected, including the categories and volume of data compromised, accessed, or exfiltrated;
(d) A description of all remediation actions completed and any remediation actions planned or in progress; and
(e) A description of any changes to security controls, policies, procedures, or configurations that Licensor has implemented or plans to implement to prevent recurrence of the same or similar Security Incidents.
7.4 Cooperation and Regulatory Notifications
Licensor shall cooperate fully with Licensee in connection with any notifications to affected individuals, regulators, law enforcement, or other parties that may be required in connection with a Security Incident, including, without limitation, notifications required under applicable state data breach notification laws, the GLBA, or any regulatory directive, examination finding, or supervisory guidance from the OCC, Federal Reserve, or FDIC.
Licensee shall retain sole authority and discretion to determine the content, timing, and method of delivery of all notifications to affected individuals and regulators arising from a Security Incident. Licensor shall not make any public statement or notification regarding a Security Incident affecting Licensee data without the prior written consent of Licensee, except as may be required by applicable law (in which case Licensor shall provide Licensee with advance notice to the extent permitted by law and shall cooperate with Licensee to coordinate the timing and content of such disclosure).
Licensor shall provide all information, documentation, and assistance reasonably necessary to support Licensee in preparing and delivering required notifications, including, without limitation, identifying affected individuals, preparing notification content, and responding to inquiries from regulators or affected individuals.
Licensor shall preserve all evidence and forensic data related to any Security Incident, including, without limitation, system logs, access logs, forensic images, network traffic captures, and malware samples, for a minimum period of three (3) years following resolution of the Security Incident, or such longer period as may be required by applicable law, regulation, or regulatory directive. Evidence preservation shall be conducted in a manner designed to maintain the integrity and chain of custody of all forensic evidence.
7.5 Incident Response Plan
Licensor shall develop, maintain, and keep current a written information security incident response plan ("IRP") that documents Licensor's procedures for detecting, responding to, containing, remediating, and reporting Security Incidents. The IRP shall be reviewed and updated at least annually, and more frequently as necessary to reflect changes in Licensor's technology environment, threat landscape, or regulatory requirements.
A copy of Licensor's current IRP shall be made available to Licensee upon Licensee's written request, subject to reasonable redactions to protect Licensor's proprietary security methodologies (provided that such redactions do not materially impair Licensee's ability to evaluate the adequacy of the IRP).
Licensor shall conduct tabletop incident response exercises at least annually, simulating realistic Security Incident scenarios relevant to the Platform and the financial services data processed thereunder. Licensor shall provide Licensee with a summary of the exercise results, including any identified gaps or improvement areas and the corrective actions planned or taken, upon Licensee's request.
SECTION 8: AUDIT RIGHTS
8.1 Standard Audit Satisfaction
Licensor may satisfy Licensee's annual audit right with respect to the security controls described in this Exhibit through the delivery of the following documentation (collectively, the "Standard Audit Package"):
(a) A complete, unredacted copy of Licensor's current SOC 2 Type II audit report (most recent report: dated March 15, 2025, prepared by Crestfield Cyber Advisors, Inc.);
(b) A copy of Licensor's current ISO 27001 certificate (most recent certificate: dated January 22, 2025, issued following audit by Crestfield Cyber Advisors, Inc.);
(c) A completed Security Assessment Questionnaire ("SAQ") responsive to Licensee's standard vendor security questionnaire, in the form set forth in Schedule B-4 to this Exhibit or such updated form as Licensee may provide from time to time; and
(d) An executive summary of the most recent Licensor-initiated penetration test results, as described in Section 6.1 of this Exhibit.
The Standard Audit Package shall be delivered to Licensee within twenty (20) business days of Licensee's written request therefor. Licensor shall update the components of the Standard Audit Package promptly upon completion of each annual SOC 2 Type II audit, ISO 27001 surveillance audit, and annual penetration test.
Delivery of the Standard Audit Package shall not limit or impair Licensee's rights under Sections 8.2, 8.3, or 8.4 of this Exhibit.
8.2 On-Site Audit Rights (Revised — Negotiated Provision)
In addition to the Standard Audit Package, Licensee shall have the right to conduct an on-site audit of Licensor's security controls, practices, and procedures no more than one (1) time per calendar year, subject to the following conditions:
(a) Triggering Conditions. An on-site audit shall be permitted only upon the existence of a demonstrated material security concern, which shall be defined as any one or more of the following: (i) a confirmed Security Incident affecting Licensee Confidential Data or Highly Restricted Data; (ii) a material deficiency, qualified opinion, or exception identified in Licensor's most recent SOC 2 Type II report or ISO 27001 surveillance audit that is relevant to the protection of Licensee data; (iii) a critical-severity or high-severity finding in any penetration test (whether Licensor-initiated or Licensee-initiated) that remains unremediated beyond the applicable remediation period set forth in Section 6.4 of this Exhibit; or (iv) a specific written directive, examination finding, or supervisory requirement issued by a federal banking regulator (OCC, Federal Reserve, or FDIC) requiring Licensee to conduct an on-site assessment of Licensor's security controls.
(b) Notice. Licensee shall provide Licensor with at least thirty (30) business days' prior written notice of the intended on-site audit, specifying the scope, purpose, and anticipated duration of the audit, as well as the identity of any third-party audit personnel who will participate.
(c) Scope Limitation. The scope of any on-site audit shall be limited to systems, facilities, processes, and personnel directly related to the processing, storage, or transmission of Licensee Confidential Data and Highly Restricted Data. The audit shall not extend to Licensor's proprietary source code, trade secrets, or confidential business information not relevant to the security of Licensee data.
(d) Timing and Conduct. On-site audits shall be conducted during Licensor's normal business hours (Monday through Friday, 9:00 AM to 6:00 PM Eastern Time, excluding federal holidays). Licensor may require that Licensee's audit personnel (whether internal or third-party) execute a confidentiality agreement or non-disclosure agreement prior to commencement of the audit, unless such personnel are already bound by confidentiality obligations no less restrictive than those set forth in the Agreement.
(e) Third-Party Auditors. Licensee may use its own internal audit staff or may engage a mutually agreed independent third party to conduct the on-site audit. Crestfield Cyber Advisors, Inc. is pre-approved by both parties as an acceptable third-party auditor for purposes of this Section 8.2. If Licensee proposes to engage a different third-party auditor, Licensor's consent shall not be unreasonably withheld.
(f) Cooperation. Licensor shall provide reasonable cooperation during any on-site audit, including access to relevant personnel for interviews, access to applicable records and documentation, and access to the physical facilities from which Licensee data is accessed or processed (excluding Orion Cloud Services, Inc. data center facilities, which are subject to Orion Cloud's own audit and access policies).
(g) Confidentiality of Findings. All findings, observations, and reports resulting from an on-site audit shall be treated as Licensor's Confidential Information under the Agreement, subject to disclosure to Licensee's federal banking regulators as required or permitted by applicable law.
8.3 Regulatory Examination Rights
Licensee's federal banking regulators, including, without limitation, the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation, shall have the right to examine Licensor's services, records, systems, controls, and facilities as permitted under the Bank Service Company Act, 12 U.S.C. § 1867(c), OCC Bulletin 2013-29, and the Interagency Guidance on Third-Party Relationships (June 2023), and any successor or supplemental regulatory guidance.
Licensor acknowledges and agrees that it may be subject to examination by Licensee's federal banking regulators in connection with the services provided under the Agreement and shall cooperate fully with any such examination, including by providing access to relevant personnel, records, systems, and facilities as requested by the examining regulatory agency.
The regulatory examination rights set forth in this Section 8.3 shall not be subject to the notice requirements, frequency limitations, triggering conditions, or other restrictions set forth in Section 8.2 of this Exhibit. Nothing in this Exhibit shall be construed to limit, restrict, or impair the examination authority of any federal banking regulator.
Licensor shall promptly notify Licensee in writing if any federal banking regulator initiates an examination of Licensor's services related to the Platform or otherwise contacts Licensor regarding the services provided to Licensee under the Agreement. Such notice shall be provided within five (5) business days of Licensor's receipt of the examination notice or regulatory contact, to the extent permitted by the examining regulator.
8.4 Additional Assessments — Crestfield Cyber Advisors Engagement
In addition to the Standard Audit Package and the on-site audit rights described above, Licensee may request that Crestfield Cyber Advisors, Inc. (or another independent security assessment firm mutually agreed upon by the parties) perform a targeted supplemental security assessment of specific controls, processes, or systems within the scope of this Exhibit.
The costs of any supplemental security assessment under this Section 8.4 shall be borne by Licensee, unless the assessment is triggered by a confirmed Security Incident that is attributable to Licensor's failure to comply with its obligations under this Exhibit, in which case the costs shall be borne by Licensor.
Licensee may request up to two (2) supplemental security assessments per calendar year under this Section 8.4. Any additional supplemental assessments beyond two (2) per calendar year shall require Licensor's prior written consent, which shall not be unreasonably withheld.
The results of any supplemental security assessment conducted under this Section 8.4 shall be shared with both parties and shall be treated as Licensor's Confidential Information under the Agreement. Licensor shall cooperate with the assessment firm and provide reasonable access to personnel, systems, and documentation as necessary to conduct the assessment.
SECTION 9: SUBPROCESSOR MANAGEMENT
9.1 Approved Subprocessors
As of the Effective Date of the Agreement, the following Subprocessor has been approved by Licensee for the processing, storage, and transmission of Licensee Confidential Data and Highly Restricted Data in connection with the services provided under the Agreement:
A complete schedule of approved Subprocessors is maintained in Schedule B-1 to this Exhibit. Licensor shall update Schedule B-1 as Subprocessors are added or removed in accordance with the procedures set forth in Section 9.2 and shall provide an updated schedule to Licensee upon request.
9.2 New Subprocessor Approval Process
Licensor shall provide Licensee with at least thirty (30) calendar days' advance written notice before engaging any new Subprocessor that will access, process, store, or transmit Licensee Confidential Data or Highly Restricted Data in connection with the services provided under the Agreement. Such notice shall include the following information:
(a) The identity and legal name of the proposed Subprocessor;
(b) The location(s) from which the proposed Subprocessor will access, process, store, or transmit Licensee data;
(c) A description of the services to be performed by the proposed Subprocessor;
(d) The security certifications held by the proposed Subprocessor (e.g., SOC 2 Type II, ISO 27001); and
(e) A summary of the proposed Subprocessor's security controls relevant to the protection of Licensee data.
Licensee shall have a reasonable objection right with respect to any proposed new Subprocessor. If Licensee objects in writing within the thirty (30) calendar day notice period, specifying the basis for its objection, Licensor shall not engage the proposed Subprocessor for the processing of Licensee data. In such event, Licensor shall either (i) propose an alternative Subprocessor that is acceptable to Licensee, or (ii) perform the applicable services directly without engaging the proposed Subprocessor.
If the parties are unable to resolve a dispute regarding a proposed Subprocessor within thirty (30) calendar days following Licensee's objection, the dispute shall be escalated in accordance with the dispute resolution and escalation procedures set forth in the Agreement.
9.3 Subprocessor Security Requirements
Licensor shall ensure that all approved Subprocessors are contractually bound by security, confidentiality, and data protection obligations that are no less protective of Licensee data than the obligations imposed on Licensor under this Exhibit. Such contractual obligations shall be documented in written agreements between Licensor and each Subprocessor and shall include, at a minimum, requirements relating to encryption, access controls, background checks, Security Incident notification, audit rights, and data residency consistent with this Exhibit.
Licensor shall conduct due diligence on each Subprocessor's security posture prior to engagement and at least annually thereafter. Such due diligence shall include, at a minimum, a review of the Subprocessor's security certifications, completion of a vendor security assessment questionnaire, and evaluation of the Subprocessor's incident response capabilities.
Licensor shall remain fully responsible to Licensee for the acts and omissions of its Subprocessors as if such acts or omissions were those of Licensor itself. The engagement of any Subprocessor shall not relieve Licensor of any of its obligations under the Agreement or this Exhibit.
SECTION 10: VULNERABILITY MANAGEMENT AND PATCHING
10.1 Vulnerability Scanning
Licensor shall perform automated vulnerability scanning of the Platform and all supporting infrastructure at least once per calendar month. Vulnerability scans shall cover the full scope of systems, applications, databases, and network components that process, store, or transmit Licensee data.
Identified vulnerabilities shall be categorized and prioritized based on severity using the Common Vulnerability Scoring System ("CVSS"), version 3.1 or its successor. Licensor shall remediate identified vulnerabilities in accordance with the following timelines:
(a) Critical vulnerabilities (CVSS score of 9.0 or higher): remediated within seventy-two (72) hours of identification;
(b) High vulnerabilities (CVSS score of 7.0 through 8.9): remediated within fifteen (15) calendar days of identification;
(c) Medium vulnerabilities (CVSS score of 4.0 through 6.9): remediated in accordance with Licensor's risk-based prioritization procedures, generally within thirty (30) calendar days of identification; and
(d) Low vulnerabilities (CVSS score below 4.0): remediated in accordance with Licensor's risk-based prioritization procedures, generally within ninety (90) calendar days of identification.
Where remediation within the timelines specified above is not technically feasible, Licensor shall implement compensating controls to mitigate the risk associated with the vulnerability and shall document the basis for the delay and the expected remediation date.
10.2 Patch Management
Licensor shall maintain a documented patch management program that provides for the timely identification, testing, and deployment of security patches for all operating systems, applications, middleware, and third-party software components used in the Platform and its supporting infrastructure.
Emergency and critical security patches shall be applied in accordance with the remediation timelines set forth in Section 10.1 above. All patches shall be tested in a non-production environment prior to deployment to the production environment to assess potential impact on system stability and functionality, except where the severity of the vulnerability, the availability of active exploits in the wild, or other exigent circumstances justify emergency deployment to the production environment without prior testing in a non-production environment. In such cases, Licensor shall document the basis for the emergency deployment and shall conduct post-deployment testing to verify system stability.
SECTION 11: BUSINESS CONTINUITY AND DISASTER RECOVERY
11.1 Business Continuity Plan
Licensor shall develop, maintain, and keep current a comprehensive written business continuity plan ("BCP") covering the Platform and all supporting systems, infrastructure, and personnel necessary for the continued delivery of services to Licensee under the Agreement. The BCP shall address, at a minimum, the following: identification of critical business functions and supporting systems; risk assessment and business impact analysis; recovery strategies and procedures; roles and responsibilities of BCP team members; communication procedures; and plans for alternate processing facilities and workforce relocation.
The BCP shall be reviewed and updated at least annually, and more frequently as necessary to reflect material changes in Licensor's technology environment, organizational structure, or risk profile. The BCP shall be tested at least annually through tabletop exercises, functional tests, or full-scale recovery exercises, as appropriate. A summary of BCP test results, including any identified deficiencies and corrective actions, shall be provided to Licensee upon written request.
11.2 Disaster Recovery
Licensor shall maintain a disaster recovery program for the Platform that provides for the following recovery objectives:
(a) Recovery Point Objective ("RPO"): The maximum acceptable data loss, measured in time, shall not exceed four (4) hours. Licensor shall implement data replication and backup procedures designed to ensure that, in the event of a disaster, Licensee data can be recovered to a point no more than four (4) hours prior to the disaster event.