MASTER SOFTWARE-AS-A-SERVICE AGREEMENT
Execution Version
by and between
SKYBRIDGE FINTECH LTD.
a Delaware limited company
("Licensor" or "Skybridge")
and
MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION
a national banking association
("Licensee" or "Meridian")
This Agreement, together with all Exhibits and Order Forms attached hereto, is entered into as of the Effective Date set forth on the signature page hereof.
Right-click to update Table of Contents
RECITALS
WHEREAS, Skybridge Fintech Ltd. is a Delaware limited company with its principal office at 1400 Concord Pike, Suite 320, Wilmington, DE 19803 (hereinafter referred to as "Licensor" or "Skybridge"), engaged in the business of developing and providing an AI-driven anti-money-laundering and transaction-monitoring software-as-a-service platform known as "SkyComply™" (the "Platform"), which Platform is designed to assist regulated financial institutions in meeting their compliance obligations under the Bank Secrecy Act, applicable anti-money-laundering regulations, and the sanctions programs administered by the Office of Foreign Assets Control of the U.S. Department of the Treasury; and
WHEREAS, Meridian National Bank, N.A. is a national banking association chartered under federal law with its principal office at 600 Lexington Avenue, 40th Floor, New York, NY 10022 (hereinafter referred to as "Licensee" or "Meridian"), and is a subsidiary of Meridian Financial Group, Inc., a publicly traded bank holding company; and
WHEREAS, Meridian desires to license access to the SkyComply™ platform for use across its retail banking, commercial banking, and wealth management divisions for approximately thirty-two thousand (32,000) named users across its U.S. and international operations, in order to enhance its BSA/AML compliance capabilities and transaction-monitoring infrastructure; and
WHEREAS, the parties desire to set forth the terms and conditions under which Skybridge will provide the Platform and related implementation, support, and managed services to Meridian, with a total contract value of Fifty Million Dollars ($50,000,000) over the Initial Term (as defined below); and
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:
ARTICLE 1: DEFINITIONS
As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Article 1 shall have the meanings ascribed to them elsewhere in this Agreement.
1.1 "Acceptable Use Policy" means the policy governing Licensee's and Authorized Users' use of the Platform, as set forth in Exhibit D attached hereto and incorporated herein by reference, as such policy may be updated by Licensor from time to time in accordance with the terms of this Agreement.
1.2 "Affiliate" means, with respect to either party, any entity that directly or indirectly controls, is controlled by, or is under common control with such party, where "control" means the ownership of, or the power to vote, more than fifty percent (50%) of the outstanding voting securities of such entity, or the power to direct or cause the direction of the management and policies of such entity, whether through ownership of voting securities, by contract, or otherwise.
1.3 "Agreement" means this Master Software-as-a-Service Agreement, together with all Exhibits, Order Forms, and addenda attached hereto or incorporated by reference, as each may be amended from time to time in accordance with Section 16.7.
1.4 "Annual Fees" means the aggregate fees paid or payable by Licensee in any twelve (12)-month period under the applicable Order Form, as such fees may be adjusted for the annual escalator set forth in Section 4.3.
1.5 "Authorized Users" means Licensee's employees, contractors, and agents who are authorized to access and use the Platform under named-user licenses granted pursuant to this Agreement and the applicable Order Form, initially up to thirty-two thousand (32,000) named users.
1.6 "Business Day" means any day other than a Saturday, Sunday, or day on which banks in the City of New York are authorized or required by law or executive order to be closed (including U.S. federal holidays).
1.7 "Confidential Information" has the meaning set forth in Section 11.1.
1.8 "Data Processing Addendum" or "DPA" means the data processing addendum attached hereto as Exhibit C and incorporated herein by reference, which governs the processing of Licensee Data by Licensor and its Subprocessors.
1.9 "Documentation" means the user guides, technical manuals, API documentation, online help materials, release notes, and other written materials made available by Licensor from time to time describing the features, functionality, system requirements, and proper use of the Platform.
1.10 "Effective Date" means the date set forth on the signature page hereof, which is the date on which the last party to sign this Agreement has executed the same.
1.11 "Go-Live Date" means the date on which the Platform is made available for production use by Licensee following successful completion of the Implementation Services, including user acceptance testing and written confirmation by both parties as described in Section 5.2. The targeted Go-Live Date is March 1, 2026.
1.12 "Highly Restricted Data" means Licensee Data classified as "Highly Restricted" under Licensee's data classification policy, including, without limitation, Non-Public Personal Information under the Gramm-Leach-Bliley Act, social security numbers, account numbers, and any other data elements that, if disclosed or compromised, would present a significant risk of harm to Licensee's customers or to Licensee's regulatory standing.
1.13 "Implementation Period" means the period commencing on September 15, 2025 and concluding on February 28, 2026, during which Licensor shall perform the Implementation Services.
1.14 "Implementation Services" means the onboarding, configuration, integration, data migration, user acceptance testing, and training services to be performed by Licensor during the Implementation Period as described in the applicable Order Form and the mutually agreed project plan.
1.15 "Initial Term" has the meaning set forth in Section 3.1.
1.16 "Licensee Data" means all data, content, and information provided by or on behalf of Licensee to Licensor, or collected, generated, or processed through the Platform on Licensee's behalf, including Non-Public Personal Information, PII, transaction data, customer records, alert data, suspicious activity reports and related workpapers, and any other data or information that constitutes the property of Licensee or Licensee's customers.
1.17 "Malicious Code" means any software code, script, agent, or program that is intentionally designed to damage, disrupt, disable, harm, or otherwise impede in any manner the operation of, or provide unauthorized access to, a computer system or network, including viruses, worms, Trojan horses, ransomware, time bombs, drop dead devices, spyware, adware, or any other malicious or harmful code.
1.18 "NPI" means Non-Public Personal Information as defined under the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) and its implementing regulations, including Regulation P (12 C.F.R. Part 1016) and the Interagency Guidelines Establishing Information Security Standards.
1.19 "Order Form" means the ordering document executed by the parties specifying the commercial terms, service descriptions, pricing, and other particulars applicable to Licensee's subscription to the Platform and related services. The initial Order Form is attached hereto as the Initial Order Form and incorporated herein by reference.
1.20 "PII" means personally identifiable information as defined under applicable federal, state, and international data protection laws, including but not limited to names, addresses, dates of birth, social security numbers, account numbers, and any other information that can be used to identify a specific individual.
1.21 "Platform" means Skybridge's SkyComply™ AI-driven anti-money-laundering and transaction-monitoring software-as-a-service platform, including all modules, features, functionality, updates, upgrades, and new releases made generally available by Licensor to its customers during the Term.
1.22 "Renewal Term" has the meaning set forth in Section 3.2.
1.23 "Scheduled Maintenance" means the routine, planned maintenance windows during which the Platform may be temporarily unavailable, as defined and described in the SLA Exhibit (Exhibit A).
1.24 "Security Exhibit" means Exhibit B attached hereto and incorporated herein by reference, which sets forth the minimum security controls, standards, and requirements applicable to Licensor's hosting, operation, and support of the Platform.
1.25 "Security Incident" means any confirmed unauthorized access to, acquisition of, use of, or disclosure of Licensee Data, or any confirmed compromise of the security, confidentiality, or integrity of Licensee Data, that is not attributable to Licensee's own acts or omissions.
1.26 "SLA" or "Service Level Agreement" means the service level commitments, performance standards, remedies, and related terms set forth in Exhibit A attached hereto and incorporated herein by reference.
1.27 "Subprocessor" means any third-party entity or natural person engaged by Licensor (or by a Subprocessor of Licensor) to process Licensee Data on behalf of Licensor in connection with the provision of the Platform or related services under this Agreement.
1.28 "Term" means, collectively, the Initial Term and any Renewal Terms, as such terms are defined in Sections 3.1 and 3.2, respectively.
ARTICLE 2: LICENSE GRANT AND SCOPE
2.1 License Grant. Subject to the terms and conditions of this Agreement and the applicable Order Form, and conditioned upon Licensee's payment of all applicable fees, Licensor hereby grants to Licensee a non-exclusive, non-transferable (except as set forth in Section 16.4), non-sublicensable right and license to access and use the Platform during the Term solely for Licensee's internal business purposes. Such right of access and use shall be limited as follows:
(a) Access to the Platform shall be restricted to Authorized Users holding valid named-user licenses, initially up to thirty-two thousand (32,000) named users as specified in the Initial Order Form;
(b) Authorized Users may access and use the Platform in connection with Licensee's retail banking, commercial banking, and wealth management divisions, as well as any centralized compliance, risk management, and audit functions supporting those divisions;
(c) The license granted herein covers Licensee's U.S. and international operations, provided that all Licensee Data shall be stored and processed exclusively within the continental United States in accordance with Section 7.4 and Section 8.4; and
(d) Licensee's right to use the Platform includes the right to access the Documentation and to use the Platform's application programming interfaces (APIs) for purposes of integrating the Platform with Licensee's internal systems, in each case as described in the Documentation.
2.2 Restrictions. Licensee acknowledges that the Platform is proprietary to Licensor and that Licensee's rights therein are limited to those expressly granted in this Agreement. Licensee shall not, and shall not permit any Authorized User or other third party to:
(a) sublicense, sell, lease, rent, loan, distribute, or otherwise transfer access to the Platform or any portion thereof to any third party, except as expressly permitted herein;
(b) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, underlying algorithms, data models, or structure of the Platform, except to the extent expressly permitted by applicable law notwithstanding a contractual restriction to the contrary;
(c) use the Platform in any manner that violates the Acceptable Use Policy set forth in Exhibit D, the Documentation, or any applicable law, rule, or regulation;
(d) use the Platform to process the data of third parties other than Licensee's own customers and prospective customers in connection with Licensee's own banking operations and compliance functions;
(e) copy, modify, or create derivative works based upon the Platform or any portion thereof;
(f) remove, alter, or obscure any proprietary notices, labels, or marks on the Platform or Documentation;
(g) access the Platform for purposes of competitive benchmarking, developing a competing product or service, or any other purpose that is adverse to Licensor's legitimate business interests; or
(h) use the Platform in a manner that exceeds the scope of the license granted herein or the usage limitations set forth in the applicable Order Form.
2.3 Reservation of Rights. Licensor retains all right, title, and interest in and to the Platform, the Documentation, and all intellectual property rights embodied therein, including all patents, copyrights, trademarks, trade secrets, and other proprietary rights. No rights are granted to Licensee except as expressly set forth in this Agreement. Without limiting the foregoing, Licensee acknowledges that the Platform contains valuable trade secrets and proprietary information of Licensor, and that the restrictions set forth in Section 2.2 are reasonable and necessary to protect Licensor's legitimate business interests.
2.4 Incremental Users. Licensee may add Authorized Users in excess of the initial thirty-two thousand (32,000) named users at a rate of Two Hundred Seventy-Five Dollars ($275.00) per user per year, without volume discount, pursuant to an amended or supplemental Order Form executed by both parties. Such incremental users shall be subject to all terms and conditions of this Agreement. Licensor shall provision incremental user accounts within five (5) Business Days of receipt of a fully executed amended or supplemental Order Form.
2.5 Affiliates. Licensee's Affiliates may access and use the Platform under this Agreement, provided that: (a) Licensee remains fully responsible and liable for each such Affiliate's compliance with all terms and conditions of this Agreement, including the Acceptable Use Policy; (b) all Affiliate users are counted toward the total Authorized User count for purposes of license fees; and (c) any Affiliate that accesses the Platform shall be deemed to have agreed to be bound by the terms of this Agreement as if such Affiliate were a party hereto. Licensee shall provide Licensor with a list of Affiliates accessing the Platform upon Licensor's reasonable request.
ARTICLE 3: TERM AND RENEWAL
3.1 Initial Term. The initial term of this Agreement (the "Initial Term") shall commence on the Go-Live Date (targeted for March 1, 2026) and shall expire on February 28, 2031, a period of five (5) years, unless earlier terminated in accordance with the provisions of this Agreement. For the avoidance of doubt, the Implementation Period shall precede the commencement of the Initial Term, and the parties' obligations during the Implementation Period shall be governed by this Agreement, including Section 5.1 and the applicable Order Form.
3.2 Renewal Terms. Unless either party provides the other party with written notice of non-renewal at least one hundred eighty (180) days prior to the expiration of the then-current Term (whether the Initial Term or any Renewal Term), this Agreement shall automatically renew for up to two (2) successive one (1)-year periods (each, a "Renewal Term"). Fees for each Renewal Term shall be as set forth in the applicable Order Form or, if not specified therein, shall be the Annual Fees in effect during the final year of the then-current Term, subject to the annual escalator set forth in Section 4.3. The aggregate Term of this Agreement, including the Initial Term and all Renewal Terms, shall not exceed seven (7) years without the execution of a new agreement or amendment signed by both parties.
3.3 Implementation Period. The Implementation Period shall commence on September 15, 2025 and shall conclude on February 28, 2026, a period of approximately five and one-half (5.5) months. Licensor shall perform the Implementation Services during the Implementation Period in accordance with the project plan mutually agreed upon by the parties (the "Project Plan"). The parties acknowledge that the successful and timely completion of the Implementation Services is dependent upon both parties' fulfillment of their respective obligations as set forth in the Project Plan. Any material delay in the Implementation Period caused by Licensee's failure to perform its obligations under the Project Plan shall extend the targeted Go-Live Date by an equivalent period, provided that Licensor has promptly notified Licensee in writing of such delay and its anticipated impact.
ARTICLE 4: FEES AND PAYMENT
4.1 Fees. Licensee shall pay to Licensor the fees set forth in the applicable Order Form in consideration for the license, implementation, support, and managed services provided hereunder. The Initial Order Form provides for the following fee structure:
(a) Year 1 Fees (Post-Volume-discount): Twelve Million Seven Hundred Thousand Dollars ($12,700,000), inclusive of the following components: (i) Platform subscription fees; (ii) Implementation Services fees of Three Million Six Hundred Thousand Dollars ($3,600,000); and (iii) support and managed services fees of One Million Eight Hundred Thousand Dollars ($1,800,000);
(b) Years 2 through 5 Annual Fees: Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000) per year, inclusive of Platform subscription fees and support and managed services fees, subject to the annual escalator set forth in Section 4.3 beginning in Year 3;
(c) Total Contract Value: Fifty Million Dollars ($50,000,000) over the Initial Term; and
(d) Volume discount: A volume discount of six and seventy-two hundredths percent (6.72%) has been applied to the gross undiscounted total contract value of Fifty-Three Million Six Hundred Thousand Dollars ($53,600,000), resulting in the Total Contract Value stated in clause (c) above.
4.2 Payment Terms. All fees set forth in the applicable Order Form are payable quarterly in advance. Licensor shall issue invoices to Licensee on or before the first Business Day of each calendar quarter for the fees applicable to such quarter. All invoices shall be due and payable net thirty (30) days from the date of the invoice. Payments shall be made by electronic funds transfer (ACH or wire transfer) to the bank account designated by Licensor in writing. Licensee's obligation to pay fees shall not be contingent upon the availability or performance of the Platform except as expressly set forth in Article 6 (Service Level Agreement).
4.3 Annual Escalator. Beginning in Year 3 of the Initial Term (i.e., commencing on the second anniversary of the Go-Live Date), the Annual Fees (exclusive of one-time Implementation Services fees) shall be subject to an annual escalation equal to the greater of: (a) three percent (3.0%) per annum; or (b) the percentage increase in the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, All Items, as published by the U.S. Bureau of Labor Statistics, for the twelve (12)-month period ending on the June 30 immediately preceding the applicable contract year; provided, however, that in no event shall the annual escalation exceed three and one-half percent (3.5%) per annum. Licensor shall provide Licensee with written notice of any fee adjustment at least sixty (60) days prior to the commencement of the applicable contract year.
4.4 Taxes. All fees stated in this Agreement and the applicable Order Form are exclusive of all applicable federal, state, local, and foreign taxes, duties, levies, and similar governmental charges (collectively, "Taxes"). Licensee shall be responsible for the payment of all Taxes arising in connection with this Agreement, excluding taxes based on Licensor's net income, capital, or franchise. If Licensor is required by law to collect or remit any Taxes on behalf of Licensee, Licensor shall invoice Licensee for such amounts, and Licensee shall pay such invoiced amounts in accordance with the payment terms set forth in Section 4.2. If Licensee is exempt from any Taxes, Licensee shall provide Licensor with a valid exemption certificate or other documentation reasonably satisfactory to Licensor.
4.5 Late Payments. Any amounts not paid by Licensee when due under this Agreement shall bear interest from the due date until paid in full at the lesser of: (a) one and one-half percent (1.5%) per month (eighteen percent (18%) per annum); or (b) the maximum rate of interest permitted by applicable law. The assessment of late payment interest shall be in addition to, and not in lieu of, any other rights or remedies available to Licensor under this Agreement or at law. Licensor may, upon fifteen (15) days' prior written notice to Licensee, suspend Licensee's access to the Platform if any undisputed fees remain unpaid for more than forty-five (45) days past the applicable due date.
4.6 Fee Disputes. In the event that Licensee disputes any portion of an invoice in good faith, Licensee may withhold only the disputed portion of such invoice, provided that Licensee: (a) notifies Licensor in writing within fifteen (15) days of receipt of the invoice, specifying in reasonable detail the basis for the dispute and the amount in dispute; and (b) pays all undisputed amounts in accordance with Section 4.2. The parties shall use commercially reasonable efforts to resolve any fee dispute within thirty (30) days of Licensor's receipt of Licensee's dispute notice. If the dispute is resolved in Licensor's favor, Licensee shall pay the disputed amount within ten (10) Business Days of resolution, together with interest calculated in accordance with Section 4.5 from the original due date. Disputed amounts shall not constitute a basis for suspension of Platform access under Section 4.5.
ARTICLE 5: IMPLEMENTATION AND SUPPORT SERVICES
5.1 Implementation Services. Licensor shall perform the Implementation Services described in the applicable Order Form during the Implementation Period (September 15, 2025 through February 28, 2026). The Implementation Services shall include, without limitation, the following:
(a) Onboarding: Establishment of Licensee's production and non-production environments, provisioning of Authorized User accounts, and initial configuration of the Platform;
(b) Configuration: Configuration of the Platform's rules engine, alert thresholds, risk scoring models, and reporting modules to align with Licensee's BSA/AML program requirements, existing compliance policies, and regulatory obligations;
(c) Data Migration: Migration of historical transaction data, customer data, and existing alert and case data from Licensee's legacy transaction-monitoring systems to the Platform, in accordance with the data migration plan set forth in the Project Plan;
(d) Integration: Development and deployment of integrations between the Platform and Licensee's core banking systems, customer information files, payment processing systems, and other internal systems as specified in the Project Plan, utilizing the Platform's APIs and standard integration toolkits;
(e) User Acceptance Testing: Execution of a comprehensive user acceptance testing plan, developed jointly by the parties, to validate that the Platform meets the functional and technical requirements specified in the Project Plan and the Documentation; and
(f) Training: Delivery of end-user training, administrator training, and compliance-officer training programs as described in the Order Form, including both on-site and virtual training sessions for Licensee's personnel across its designated divisions.
The parties shall cooperate in good faith to develop and finalize the Project Plan within thirty (30) days of the Effective Date. Each party shall designate a project manager to serve as the primary point of contact for all implementation-related matters.
5.2 Go-Live. The Platform shall be deemed to have achieved "Go-Live" upon the occurrence of both of the following conditions: (a) successful completion of user acceptance testing in accordance with the testing criteria set forth in the Project Plan, with all Severity 1 and Severity 2 defects resolved; and (b) written confirmation by both parties that the Platform is ready for production use (the "Go-Live Certificate"). The targeted Go-Live Date is March 1, 2026. In the event that Go-Live is delayed beyond March 1, 2026 due to Licensor's failure to complete the Implementation Services in accordance with the Project Plan (and such delay is not attributable to Licensee's acts or omissions), Licensee shall be entitled to a fee credit equal to one-thirtieth (1/30) of the monthly subscription fee for each day of delay beyond March 31, 2026 (a thirty (30)-day grace period), up to a maximum credit of sixty (60) days' fees.
5.3 Ongoing Support and Managed Services. Throughout the Term, Licensor shall provide the support and managed services described in the applicable Order Form, at an annual fee of One Million Eight Hundred Thousand Dollars ($1,800,000) per year (as included in the Annual Fees and subject to the volume discount and annual escalator set forth in Sections 4.1 and 4.3, respectively). Such support and managed services shall include, without limitation:
(a) Access to Licensor's technical support team via telephone, email, and online ticketing system during Licensor's standard support hours (Monday through Friday, 7:00 AM – 9:00 PM ET, excluding U.S. federal holidays), with 24×7×365 support for Severity 1 issues;
(b) Bug fixes, error corrections, and patches;
(c) Updates, upgrades, and new releases of the Platform made generally available by Licensor to its customer base at no additional charge;
(d) Ongoing model tuning and rule optimization services to ensure the Platform's continued alignment with evolving regulatory requirements and Licensee's compliance needs; and
(e) Designated customer success management, including periodic business reviews and best-practice recommendations.
5.4 Service Levels. Licensor shall provide the Platform in accordance with the Service Level Agreement set forth in Exhibit A. In the event of any conflict between the terms of Exhibit A and this Agreement, the terms more favorable to Licensee shall control.
ARTICLE 6: SERVICE LEVEL AGREEMENT
6.1 Incorporation. The Service Level Agreement attached hereto as Exhibit A is incorporated herein by reference in its entirety and governs Platform availability, performance standards, incident response requirements, and the remedies available to Licensee for Licensor's failure to meet the service levels specified therein. Licensee's acceptance of the service levels set forth in Exhibit A does not constitute a waiver of any other rights or remedies available to Licensee under this Agreement.
6.2 Uptime Commitment. Licensor shall use commercially reasonable efforts to maintain Platform availability of not less than ninety-nine and nine-tenths percent (99.9%) monthly uptime, measured on a calendar-month basis and calculated as follows:
Monthly Uptime Percentage = ((Total Minutes in Calendar Month – Unscheduled Downtime Minutes) / Total Minutes in Calendar Month) × 100
Unscheduled Downtime shall be measured from the time the Platform becomes materially unavailable (as determined by Licensor's monitoring systems or upon notification by Licensee, whichever is earlier) until the time the Platform is restored to normal operation. The uptime calculation shall exclude Scheduled Maintenance windows, which shall occur on Saturdays between 2:00 AM and 6:00 AM Eastern Time and shall not exceed a maximum of four (4) hours per week. Licensor shall provide Licensee with at least forty-eight (48) hours' advance notice of any Scheduled Maintenance window.
6.3 SLA Credits. In the event that Licensor fails to meet the monthly uptime commitment set forth in Section 6.2, Licensee shall be entitled to service credits against future subscription fees, calculated as a percentage of the monthly subscription fee for the affected calendar month, as follows:
Service credits shall be applied against the next invoice following Licensor's confirmation of the applicable downtime. Licensee must request SLA credits in writing within thirty (30) days of the end of the calendar month in which the downtime occurred, and Licensor shall respond to such request within ten (10) Business Days.
6.4 Credit Caps. Notwithstanding Section 6.3, SLA credits shall be subject to the following limitations:
(a) SLA credits shall not exceed thirty percent (30%) of the monthly subscription fee in any single calendar month (Year 1: maximum credit of approximately Three Hundred Seventeen Thousand Five Hundred Dollars ($317,500); Years 2 through 5: maximum credit of approximately Two Hundred Thirty-Three Thousand One Hundred Twenty-Five Dollars ($233,125) per month); and
(b) SLA credits shall not exceed fifteen percent (15%) of the annual subscription fee in any contract year (Year 1: maximum credit of approximately One Million Nine Hundred Five Thousand Dollars ($1,905,000); Years 2 through 5: maximum credit of approximately One Million Three Hundred Ninety-Eight Thousand Seven Hundred Fifty Dollars ($1,398,750) per year).
6.5 Termination Right. If Platform uptime falls below ninety-eight percent (98.0%) in three (3) of any consecutive six (6) calendar months, Licensee shall have the right to terminate this Agreement upon thirty (30) days' prior written notice to Licensor, without payment of any early termination fee, and Licensor shall refund to Licensee any pre-paid fees on a pro-rata basis for the unused portion of the then-current Term.
6.6 Sole Remedy. The SLA credits and termination right set forth in this Article 6 and Exhibit A shall be Licensee's sole and exclusive remedies for Licensor's failure to meet the uptime commitment set forth in Section 6.2. For the avoidance of doubt, this Section 6.6 does not limit Licensee's rights or remedies with respect to any other breach of this Agreement by Licensor.
6.7 Incident Response. Licensor shall respond to incidents affecting the Platform in accordance with the severity-based response and resolution times set forth in Exhibit A, which include, at a minimum, the following:
(a) Severity 1 (Critical): Production system down; complete loss of Platform functionality or data integrity compromise. Acknowledgment within fifteen (15) minutes; first substantive response within one (1) hour; target resolution within four (4) hours. Continuous effort (24×7) until resolution.
(b) Severity 2 (High): Major functionality degraded; significant impact on Licensee's operations but Platform remains partially operational. Acknowledgment within thirty (30) minutes; first substantive response within two (2) hours; target resolution within eight (8) hours.
(c) Severity 3 (Medium): Minor functionality impaired; workaround available. Acknowledgment within four (4) hours; first substantive response within one (1) Business Day; target resolution within five (5) Business Days.
Licensor shall provide Licensee with regular status updates during the pendency of any Severity 1 or Severity 2 incident, at intervals of no less than every thirty (30) minutes for Severity 1 incidents and every two (2) hours for Severity 2 incidents. Following resolution of any Severity 1 or Severity 2 incident, Licensor shall deliver to Licensee a written root cause analysis within five (5) Business Days.
ARTICLE 7: SECURITY AND DATA PROTECTION
7.1 Security Obligations. Licensor shall implement and maintain throughout the Term administrative, technical, and physical safeguards that are designed to: (a) protect the security, confidentiality, integrity, and availability of Licensee Data; (b) protect against any anticipated threats or hazards to the security or integrity of Licensee Data; and (c) protect against any unauthorized access to, acquisition of, use of, or disclosure of Licensee Data. Such safeguards shall comply with the requirements set forth in the Security Exhibit (Exhibit B) and the Data Processing Addendum (Exhibit C), each of which is incorporated herein by reference. In the event of any conflict between the provisions of this Article 7 and the provisions of Exhibit B or Exhibit C, the provisions that afford the greatest protection to Licensee Data shall control.
7.2 Security Certifications. Licensor shall obtain and maintain throughout the Term the following industry-standard security certifications:
(a) SOC 2 Type II Certification: Licensor shall undergo an annual SOC 2 Type II examination conducted by an independent, nationally recognized accounting or cybersecurity firm. Licensor's most recent SOC 2 Type II report is dated March 15, 2025, and was prepared by Crestfield Cyber Advisors, Inc. Licensor shall provide Licensee with a copy of its annual SOC 2 Type II report within thirty (30) days of issuance and shall promptly notify Licensee of any material findings or exceptions noted in such report.
(b) ISO 27001 Certification: Licensor shall maintain ISO/IEC 27001:2022 certification, with triennial recertification and annual surveillance audits conducted by an accredited certification body. Licensor's most recent ISO 27001 certificate is dated January 22, 2025, and was issued by Crestfield Cyber Advisors, Inc. Licensor shall provide Licensee with a copy of its current ISO 27001 certificate and any surveillance audit reports upon request.
In the event that Licensor's SOC 2 Type II report or ISO 27001 certification is revoked, suspended, or allowed to lapse, Licensor shall notify Licensee in writing within five (5) Business Days and shall use commercially reasonable efforts to restore such certification within ninety (90) days.
7.3 Encryption. All Licensee Data shall be encrypted as follows:
(a) At Rest: Licensee Data stored on Licensor's systems (including databases, file systems, and backup media) shall be encrypted using Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256).
(b) In Transit: Licensee Data transmitted between Licensee's systems and the Platform, as well as between components of the Platform infrastructure, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher.
(c) Key Management: Encryption keys shall be managed through Licensor-managed hardware security modules (HSMs) that are FIPS 140-2 Level 3 (or higher) validated. At Licensee's option, Licensor shall support a bring-your-own-key ("BYOK") integration, pursuant to which Licensee may provide and manage its own encryption keys through a mutually agreed key management protocol, at no additional charge.
7.4 Data Residency. All Licensee Data shall be stored, processed, and maintained exclusively within the continental United States. Specifically, the Platform shall be hosted within Orion Cloud Services, Inc.'s US-East (Virginia) and US-West (Oregon) regions. Licensor shall not transfer, store, or process Licensee Data outside of these approved regions without Licensee's prior written consent. For the avoidance of doubt, this restriction applies to all copies of Licensee Data, including backup copies, disaster recovery copies, and data used for development or testing purposes.
7.5 Penetration Testing. Licensor shall engage an independent, qualified third party to conduct at least one (1) comprehensive penetration test of the Platform per calendar year. Licensor shall provide Licensee with a summary of the penetration testing results, including all material findings and remediation timelines, within thirty (30) days of completion of each test. In addition, Licensee shall have the right to conduct its own annual penetration test of the Platform at Licensee's expense, subject to the following conditions as further detailed in Exhibit B:
(a) Licensee shall provide Licensor with at least thirty (30) days' advance written notice of any planned penetration test;
(b) Licensee's penetration testing shall be limited to application-layer testing of the Platform;
(c) Infrastructure-layer testing of the underlying cloud environment shall require Licensor's prior written consent and shall be coordinated with Orion Cloud Services, Inc. in accordance with Orion's acceptable use policies and testing policies; and
(d) All penetration testing activities shall be conducted by qualified security professionals and shall not unreasonably disrupt the Platform's availability or performance.
7.6 Background Checks. All Licensor personnel (including employees, contractors, and subcontractors) who have or may have access to Licensee Data or to Licensee's production environments shall undergo pre-engagement background checks that are consistent with the Federal Financial Institutions Examination Council (FFIEC) guidelines and that include, at a minimum: (a) criminal history checks; (b) identity verification; and (c) verification of employment history. Licensor shall maintain records of completed background checks and shall make evidence of compliance available to Licensee upon reasonable request.
7.7 Security Incident Notification. In the event of a confirmed Security Incident affecting Licensee Data, Licensor shall:
(a) Notify Licensee of the Security Incident within eighteen (18) hours of Licensor's discovery or confirmed awareness of such incident. Such notification shall be provided to Licensee's designated security contact by telephone and email and shall include: (i) a description of the nature and scope of the incident; (ii) the types of Licensee Data affected or reasonably believed to be affected; (iii) the date and time of discovery; and (iv) a summary of the initial response and planned remediation steps;
(b) Provide ongoing updates to Licensee at intervals of no less than every twelve (12) hours during the active investigation of the Security Incident, or more frequently as reasonably requested by Licensee;
(c) Cooperate with Licensee's investigation of the Security Incident, including providing access to relevant logs, records, and personnel;
(d) Take all commercially reasonable steps to contain, mitigate, and remediate the Security Incident and to prevent recurrence; and
(e) Deliver to Licensee a comprehensive written incident report within fifteen (15) Business Days of the resolution of the Security Incident, including a root cause analysis, a description of the data affected, the remediation actions taken, and recommendations for preventing similar incidents.
The eighteen (18)-hour notification window set forth in clause (a) above reflects the negotiated agreement between the parties and shall apply regardless of whether Licensor has completed its internal investigation of the incident.
7.8 Audit Rights. Licensee (or its designated third-party auditor, subject to reasonable confidentiality obligations) may audit Licensor's security controls, practices, and compliance with the requirements of this Agreement and Exhibits B and C, once per calendar year, upon thirty (30) Business Days' prior written notice to Licensor. Licensor may satisfy such audit requests by providing Licensee with the following documentation:
(a) Licensor's most recent SOC 2 Type II audit report;
(b) Licensor's current ISO 27001 certificate and most recent surveillance audit report; and
(c) A completed supplemental Security Assessment Questionnaire in a format reasonably acceptable to Licensee, addressing any topics not covered by the SOC 2 Type II report or ISO 27001 certificate.
On-site audits of Licensor's facilities, systems, and controls shall be permitted only upon a demonstrated material security concern (including, without limitation, a confirmed Security Incident, a material finding in a SOC 2 Type II report, or a reasonable belief that Licensor is not in compliance with its security obligations under this Agreement). On-site audits shall be conducted at Licensee's expense and shall be scheduled at mutually agreed times during normal business hours so as not to unreasonably disrupt Licensor's operations. Licensor shall cooperate fully with any such audit and shall provide Licensee's audit team with reasonable access to relevant personnel, systems, and facilities.
7.9 Subprocessor Approvals. Licensor shall provide Licensee with at least thirty (30) days' advance written notice before engaging any new Subprocessor that will have access to or will process Licensee Data. Such notice shall include the identity and location of the proposed Subprocessor, a description of the services to be performed, and the categories of Licensee Data to which the Subprocessor will have access. Licensee shall have a reasonable right to object to the engagement of any proposed Subprocessor on legitimate data security or privacy grounds. If Licensee objects in writing within fifteen (15) days of receiving such notice and the parties are unable to resolve Licensee's objection within fifteen (15) additional days, Licensee may terminate the affected services upon sixty (60) days' written notice without payment of any early termination fee. Orion Cloud Services, Inc. (4500 Great America Parkway, Santa Clara, CA 95054) is hereby approved as an initial Subprocessor. A current list of approved Subprocessors shall be maintained by Licensor and made available to Licensee upon request.
ARTICLE 8: DATA PROCESSING
8.1 Data Processing Addendum. The processing of Licensee Data by Licensor and its Subprocessors shall be governed by the Data Processing Addendum attached hereto as Exhibit C and incorporated herein by reference. The DPA sets forth the parties' respective obligations with respect to the processing of personal data, including the subject matter and duration of processing, the nature and purpose of processing, the types of personal data processed, the categories of data subjects, and the rights and obligations of the parties. In the event of any conflict between the provisions of this Article 8 and the provisions of the DPA, the provisions that afford the greatest protection to Licensee Data shall control.
8.2 Data Classification. Licensee Data processed through the Platform shall be classified and handled in accordance with Licensee's data classification policy, a current copy of which Licensee shall provide to Licensor within thirty (30) days of the Effective Date. Licensor acknowledges that Licensee Data will include data classified under Licensee's data classification policy as "Confidential" and "Highly Restricted," including, without limitation:
(a) Non-Public Personal Information as defined under the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) and implementing regulations;
(b) Personally identifiable information as defined under applicable federal, state, and international data protection laws;
(c) Customer account numbers, social security numbers, and government-issued identification numbers;
(d) Transaction records, wire transfer data, and payment processing data; and
(e) Suspicious activity report (SAR) data and related investigation workpapers, which are subject to heightened confidentiality protections under federal law (31 U.S.C. § 5318(g)(2)).
Licensor shall apply security controls commensurate with the highest classification level of Licensee Data processed through the Platform.
8.3 Data Retention and Deletion. Upon expiration or termination of this Agreement for any reason:
(a) Data Export: Within thirty (30) days following the effective date of expiration or termination, Licensor shall provide Licensee with an export of all Licensee Data in a machine-readable format (such as CSV, JSON, or XML, as reasonably designated by Licensee), together with all data schemas, data dictionaries, and other documentation necessary for Licensee to access and use the exported data independently of the Platform. Licensor shall provide reasonable transition assistance to Licensee during this period at Licensor's then-current professional services rates.
(b) Data Destruction: Within sixty (60) days following the effective date of expiration or termination, Licensor shall certify in writing (executed by an officer of Licensor) the complete and irreversible destruction of all Licensee Data in Licensor's possession, custody, or control, including all copies, backups, archives, and data stored on backup systems or disaster recovery systems. Such destruction shall be performed in accordance with NIST SP 800-88 (Guidelines for Media Sanitization) or an equivalent standard.
(c) Legal Hold Exception: Notwithstanding clause (b) above, Licensor may retain copies of Licensee Data to the extent required by applicable law, regulation, or legal hold obligation, provided that: (i) such retained data shall continue to be subject to the confidentiality and security obligations of this Agreement; (ii) Licensor shall promptly notify Licensee of any such retention requirement, specifying the categories of data retained and the legal basis for retention; and (iii) Licensor shall destroy all retained data promptly upon the expiration of the applicable retention requirement and shall certify such destruction in writing.
8.4 Cross-Border Transfer Restrictions. No Licensee Data shall be transferred, stored, or processed outside the continental United States. This restriction applies to all transfers of Licensee Data, whether for primary processing, backup, disaster recovery, development, testing, or any other purpose. Licensor shall implement and maintain technical and organizational measures to ensure compliance with this restriction, including contractual restrictions on Subprocessors and access controls that restrict the geographic location from which Licensee Data may be accessed.
ARTICLE 9: REPRESENTATIONS AND WARRANTIES
9.1 By Licensor. Licensor represents and warrants to Licensee as of the Effective Date and throughout the Term, as follows:
(a) Platform Performance. The Platform will perform materially in accordance with the Documentation throughout the Term. In the event the Platform fails to perform in material conformance with the Documentation, Licensor shall, at no additional cost to Licensee, use commercially reasonable efforts to correct the non-conformity within a reasonable period of time after receiving written notice from Licensee describing the non-conformity in reasonable detail.
(b) Professional Services. All Implementation Services, support services, managed services, and other professional services provided by Licensor under this Agreement will be performed in a professional and workmanlike manner by qualified personnel with the skills, training, and experience necessary to perform such services in accordance with generally accepted industry standards for comparable SaaS providers serving the financial services industry.
(c) intellectual Property Rights. Licensor has and will maintain all necessary rights, title, and authority to grant the license set forth in Article 2, and the provision of the Platform to Licensee as contemplated herein does not and will not infringe or misappropriate any third-party intellectual property right.
(d) Malicious Code. The Platform, as delivered by Licensor, will not contain any Malicious Code at the time of delivery or at any time during the Term. Licensor shall implement and maintain commercially reasonable measures to detect and prevent the introduction of Malicious Code into the Platform.
(e) Legal Compliance. Licensor is and will remain in material compliance with all applicable laws, rules, and regulations in connection with its performance under this Agreement, including, without limitation, the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.), the Bank Secrecy Act (31 U.S.C. § 5311 et seq.), applicable anti-money-laundering regulations, and the sanctions programs administered by the Office of Foreign Assets Control (OFAC).
(f) Security Standards. Licensor's information security practices, policies, and procedures meet or exceed industry standards for financial services SaaS providers, including the requirements set forth in the FFIEC IT Examination Handbook, the NIST Cybersecurity Framework, and the security controls specified in Exhibit B.
(g) Authority and Standing. Licensor is a limited company duly organized, validly existing, and in good standing under the laws of the State of Delaware, and has all requisite corporate power and authority to enter into and perform its obligations under this Agreement. The execution, delivery, and performance of this Agreement have been duly authorized by all necessary corporate action on the part of Licensor.
9.2 By Licensee. Licensee represents and warrants to Licensor as of the Effective Date and throughout the Term, as follows:
(a) Authority and Standing. Licensee is a national banking association duly organized, validly existing, and in good standing under the laws of the United States, and has all requisite corporate power and authority to enter into and perform its obligations under this Agreement. The execution, delivery, and performance of this Agreement have been duly authorized by all necessary corporate action on the part of Licensee.
(b) Compliance. Licensee's use of the Platform shall be in compliance with the Acceptable Use Policy set forth in Exhibit D and all applicable laws, rules, and regulations.
9.3 Warranty Period. Licensor's warranty with respect to the Implementation Services shall extend for a period of twelve (12) months from the Go-Live Date. During such warranty period, Licensor shall, at no additional cost to Licensee, correct any defect in or non-conformity of the Implementation Services that is reported by Licensee in writing. Licensor's warranty with respect to the Platform subscription (including the representations and warranties set forth in Sections 9.1(a), (d), (e), and (f)) shall continue throughout the Term.
9.4 Warranty Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN THIS ARTICLE 9, EACH PARTY DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, OR NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. LICENSOR DOES NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED OR ERROR-FREE, THAT ALL DEFECTS WILL BE CORRECTED, OR THAT THE PLATFORM WILL MEET LICENSEE'S REQUIREMENTS EXCEPT AS EXPRESSLY SET FORTH IN THE DOCUMENTATION. THE DISCLAIMERS IN THIS SECTION 9.4 SHALL APPLY TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW.
ARTICLE 10: INDEMNIFICATION
10.1 Indemnification by Licensor. Licensor shall indemnify, defend, and hold harmless Licensee, its Affiliates, and their respective directors, officers, employees, and agents (collectively, "Licensee Indemnitees") from and against any and all third-party claims, actions, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of investigation and litigation) arising out of or relating to:
(a) IP Claims. Any claim that Licensee's authorized use of the Platform in accordance with this Agreement and the Documentation infringes or misappropriates any United States or international patent, copyright, trademark, trade secret, or other intellectual property right of a third party (an "IP Claim");
(b) Data Security Breaches. Licensor's breach of its data security and confidentiality obligations under this Agreement (including Articles 7, 8, and 11) resulting in the unauthorized access to, acquisition of, disclosure of, or loss of Licensee Data, including all costs of notification, credit monitoring, forensic investigation, regulatory fines, and other remedial measures; and
(c) Legal Compliance. Licensor's material breach of applicable law in connection with its performance under this Agreement, including the Gramm-Leach-Bliley Act, the Bank Secrecy Act, applicable AML regulations, and other applicable financial services regulations.
10.2 Indemnification by Licensee. Licensee shall indemnify, defend, and hold harmless Licensor, its Affiliates, and their respective directors, officers, employees, and agents (collectively, "Licensor Indemnitees") from and against any and all third-party claims, actions, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of investigation and litigation) arising out of or relating to:
(a) Acceptable Use Violations. Licensee's breach of the Acceptable Use Policy set forth in Exhibit D;
(b) Licensee Data Claims. Claims arising from data or content provided by Licensee to Licensor for processing through the Platform, to the extent such data or content infringes any third-party intellectual property right or otherwise violates any right of a third party, and such claim is not attributable to Licensor's processing of such data in breach of this Agreement; and
(c) Legal Compliance. Licensee's material breach of applicable law in connection with its use of the Platform.
10.3 Indemnification Caps. The indemnification obligations set forth in this Article 10 shall be subject to the following limitations:
(a) IP Indemnification: Licensor's indemnification obligation under Section 10.1(a) for IP Claims shall be uncapped and shall not be subject to the aggregate liability cap set forth in Section 12.1 or any other limitation of liability in this Agreement.
(b) Data Breach Indemnification: Licensor's indemnification obligation under Section 10.1(b) for data security breaches shall be subject to the super-cap set forth in Section 12.2(b) (i.e., three times (3×) the Annual Fees paid or payable in the twelve (12)-month period immediately preceding the event giving rise to the claim, approximately Twenty-Seven Million Nine Hundred Seventy-Five Thousand Dollars ($27,975,000) in a steady-state year based on Annual Fees of Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000)).
(c) General Indemnification: All other indemnification obligations of either party under this Article 10 shall be subject to a cap equal to one times (1×) the Annual Fees paid or payable in the twelve (12)-month period immediately preceding the event giving rise to the claim (approximately Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000) in a steady-state year).
10.4 Indemnification Procedures. The obligations of the indemnifying party under this Article 10 are conditioned upon the following:
(a) Notice. The indemnified party shall promptly notify the indemnifying party in writing of any claim, action, suit, or proceeding for which indemnification is sought under this Article 10. Such notice shall describe the claim in reasonable detail and shall include copies of all relevant pleadings, correspondence, and other documents.
(b) Control of Defense. The indemnified party shall grant the indemnifying party sole control of the defense and settlement of such claim, provided that: (i) no settlement that imposes any obligation, restriction, or liability on the indemnified party (other than the payment of money, which shall be the sole responsibility of the indemnifying party) shall be entered into without the indemnified party's prior written consent (such consent not to be unreasonably withheld, conditioned, or delayed); and (ii) no settlement that includes an admission of liability or wrongdoing on the part of the indemnified party shall be entered into without the indemnified party's prior written consent.
(c) Cooperation. The indemnified party shall provide reasonable cooperation to the indemnifying party in the defense of such claim, at the indemnifying party's expense, including making available relevant personnel, documents, and information.
(d) Failure to Notify. Failure by the indemnified party to provide prompt notice of a claim shall not relieve the indemnifying party of its indemnification obligations under this Article 10, except to the extent that such failure materially prejudices the indemnifying party's ability to defend the claim.
10.5 Exclusive Remedy for IP Infringement. If Licensor reasonably determines that the Platform, or any material component thereof, may become the subject of an injunction or order for infringement or misappropriation of a third-party intellectual property right, Licensor shall, at its sole option and expense, take one or more of the following actions:
(a) Procure for Licensee the right to continue using the Platform in accordance with this Agreement;
(b) Modify or replace the Platform (or the affected component thereof) to make it non-infringing, provided that such modification or replacement does not materially reduce the Platform's functionality, performance, or security; or
(c) If neither clause (a) nor clause (b) is commercially practicable despite Licensor's commercially reasonable efforts, terminate the affected portion of this Agreement and refund to Licensee any pre-paid, unearned fees on a pro-rata basis for the unused portion of the then-current Term.
The remedies set forth in this Section 10.5, together with the indemnification obligations in Section 10.1(a), shall constitute Licensee's sole and exclusive remedies with respect to any IP Claim.
ARTICLE 11: CONFIDENTIALITY
11.1 Definition. "Confidential Information" means all non-public information disclosed by one party (the "Disclosing Party") to the other party (the "Receiving Party") in connection with this Agreement, whether disclosed orally, in writing, electronically, visually, or by any other means, that is designated as "confidential," "proprietary," or a similar designation, or that, given the nature of the information or the circumstances of disclosure, should reasonably be understood to be confidential. Without limiting the foregoing, Confidential Information includes: (a) business plans, strategies, forecasts, and projections; (b) technical data, designs, algorithms, source code, and architectures; (c) financial information, pricing, and fee structures; (d) customer lists, customer data, and market data; (e) trade secrets and know-how; and (f) the terms and conditions of this Agreement (including all Exhibits and Order Forms). For the avoidance of doubt, all Licensee Data shall be deemed Confidential Information of Licensee.
11.2 Obligations. Each Receiving Party shall:
(a) Use the Disclosing Party's Confidential Information solely for the purposes of exercising its rights and performing its obligations under this Agreement;