CONFIDENTIAL — ATTORNEY WORK PRODUCT PRIVILEGED AND CONFIDENTIAL
MASTER SOFTWARE-AS-A-SERVICE AGREEMENT — SECOND REVISED DRAFT —
Matter No. 1009-00007 [●], 2025
Prepared by Amy Chesterton, Calderwood & Harkness LLP — Second Revised Draft incorporating negotiated positions following first-round markup by Hargrove, Tully & Cascade Insurance Brokers on behalf of Meridian National Bank, N.A.
Bracketed text [ ] indicates positions still under negotiation between the parties. See cover letter for discussion of remaining open items.
Right-click to update Table of Contents
MASTER SOFTWARE-AS-A-SERVICE AGREEMENT
This Master Software-as-a-Service Agreement (this "Agreement") is entered into as of [●], 2025 (the "Effective Date"), by and between:
SKYBRIDGE FINTECH LTD., a Delaware limited liability company, with its principal office at 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803 (hereinafter referred to as "Licensor" or "Skybridge");
and
MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION, a national banking association chartered under the laws of the United States and subject to the regulatory supervision of the Office of the Comptroller of the Currency, with its principal office at 600 Lexington Avenue, 40th Floor, New York, New York 10022 (hereinafter referred to as "Licensee" or "Meridian").
Skybridge and Meridian are each sometimes referred to herein individually as a "Party" and collectively as the "Parties."
RECITALS
WHEREAS, Skybridge has developed and operates a proprietary artificial-intelligence-driven anti-money-laundering and transaction-monitoring platform known as SkyComply™, which provides automated detection, investigation, and reporting capabilities designed for use by regulated financial institutions;
WHEREAS, Meridian desires to license and deploy SkyComply™ across its retail banking, commercial banking, and wealth management divisions for approximately thirty-two thousand (32,000) named users, in order to enhance its Bank Secrecy Act and anti-money-laundering compliance programs and to satisfy applicable regulatory requirements;
WHEREAS, the Parties desire to set forth the terms and conditions governing Meridian's subscription to and use of the SkyComply™ platform, including the implementation, hosting, maintenance, support, and related professional services to be provided by Skybridge;
WHEREAS, this Agreement, together with the Order Form and the Exhibits attached hereto, constitutes the entire agreement of the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations, and discussions, whether oral or written, relating to such subject matter;
NOW, THEREFORE, in consideration of the mutual covenants and agreements hereinafter set forth and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1: DEFINITIONS
As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Article 1 shall have the meanings assigned to them elsewhere in this Agreement.
"Acceptable Use Policy" means the policy governing the permitted and prohibited uses of the Platform, attached hereto as Exhibit D and incorporated herein by reference.
"Affiliate" means, with respect to any Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party. For purposes of this definition, "control" means the direct or indirect ownership of more than fifty percent (50%) of the voting securities or equivalent ownership interests of an entity, or the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract, or otherwise. With respect to Meridian, "Affiliate" includes Meridian Financial Group, Inc. and each of its direct and indirect subsidiaries.
"Aggregate Liability Cap" has the meaning set forth in Section 10.3.
"Annual Fees" means the total fees paid or payable by Licensee to Licensor in the twelve (12) month period immediately preceding the event, act, or omission giving rise to a claim under this Agreement.
"Authorized Users" means Licensee's employees, contractors, consultants, and authorized agents who are designated by Licensee to access and use the Platform in accordance with this Agreement, up to the maximum number of named users specified in the applicable Order Form.
"Business Day" means any day other than a Saturday, Sunday, or any day on which national banks in the United States are authorized or required by law to be closed, including all federal banking holidays as designated by the Board of Governors of the Federal Reserve System.
"Confidential Information" has the meaning set forth in Section 8.1.
"Data Processing Addendum" or "DPA" means the data processing addendum attached hereto as Exhibit C and incorporated herein by reference, which governs Skybridge's processing of Licensee Data, including Non-Public Personal Information and Personally Identifiable Information.
"Documentation" means the user manuals, technical specifications, release notes, operational procedures, training materials, and any other materials provided or made available by Skybridge to Meridian that describe the features, functionality, system requirements, and proper use of the Platform, as such documentation may be updated from time to time during the Term.
"Effective Date" means the date on which this Agreement is executed by the last Party to sign, as indicated on the signature page hereto.
"Go-Live Date" means the date on which the Platform is deployed and made available for production use by Licensee in accordance with Section 3.2, targeted as March 1, 2026.
"Implementation Period" means the period commencing on September 15, 2025 and ending on February 28, 2026, during which Skybridge shall perform the Implementation Services as described in Article 3 and the Order Form.
"Implementation Services" means the configuration, integration, data migration, testing, user acceptance testing, onboarding, and training services to be performed by Skybridge during the Implementation Period, as more fully described in the Order Form.
"Intellectual Property Rights" means all intellectual property rights of any kind, including patents, patent applications, copyrights, copyright registrations and applications, trademarks, trademark registrations and applications, trade secrets, know-how, inventions, moral rights, database rights, rights in designs, and all other intellectual and proprietary rights, in each case whether registered or unregistered and including all applications, renewals, extensions, and restorations thereof, now or hereafter in force and effect worldwide.
"Licensee Data" means all data, content, records, files, and information of any kind that is: (a) provided by or on behalf of Meridian or any of its Authorized Users to Skybridge or uploaded, transmitted, or entered into the Platform; or (b) generated, collected, processed, or stored in connection with Meridian's use of the Platform, including Non-Public Personal Information, Personally Identifiable Information, transaction data, customer records, and suspicious activity reports and related investigative data.
"Malicious Code" means any software code, program, routine, or device that is intentionally designed to: (a) disrupt, disable, harm, or otherwise impede the normal operation of computer systems, networks, or software; (b) damage, destroy, or alter any data or files without authorization; or (c) provide unauthorized access to any computer system, network, or software, including viruses, worms, Trojan horses, ransomware, spyware, adware, time bombs, drop-dead devices, or other similar harmful or malicious code.
"Non-Public Personal Information" or "NPI" has the meaning ascribed to such term under the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) and its implementing regulations, including Regulation P (12 C.F.R. Part 1016) and the Interagency Guidelines Establishing Information Security Standards.
"Order Form" means the initial order form attached hereto and incorporated herein by reference, which specifies the licensed user count, fees, implementation timeline, commercial terms, and other transaction-specific details, together with any supplemental order forms executed by the Parties from time to time during the Term.
"Personally Identifiable Information" or "PII" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable natural person, including name, address, Social Security number, date of birth, financial account number, and any other information defined as "personal information," "personal data," or an equivalent term under applicable data protection and privacy laws.
"Platform" means the SkyComply™ software-as-a-service platform, including all software, algorithms, machine-learning models, user interfaces, application programming interfaces, databases, and infrastructure components made available by Skybridge to Meridian as a hosted, cloud-based service under this Agreement, together with all Updates and Upgrades provided during the Term.
"Scheduled Maintenance" means planned maintenance windows during which the Platform may be unavailable, as defined in the SLA Exhibit attached hereto as Exhibit A.
"Security Exhibit" means the security requirements and controls document attached hereto as Exhibit B and incorporated herein by reference.
"Security Incident" means any actual or reasonably suspected unauthorized access to, acquisition of, use of, disclosure of, loss of, or destruction of Licensee Data, or any breach or compromise of the security, confidentiality, or integrity of the systems used to store, process, or transmit Licensee Data.
"SLA" or "SLA Exhibit" means the service level agreement attached hereto as Exhibit A and incorporated herein by reference, which sets forth the uptime commitments, service credit mechanisms, and incident response requirements applicable to the Platform.
"Subprocessor" means any third party engaged by Skybridge or any of Skybridge's subcontractors to process Licensee Data on behalf of Skybridge in connection with the performance of Skybridge's obligations under this Agreement.
"Term" has the meaning set forth in Section 11.1.
"Update" means a bug fix, patch, error correction, or minor enhancement to the Platform that does not materially alter its features or functionality, typically designated by a change in the version number following the decimal point (e.g., from version 4.1 to version 4.2).
"Upgrade" means a major new release of the Platform that materially adds features or functionality, typically designated by a change in the version number preceding the decimal point (e.g., from version 4.x to version 5.0).
ARTICLE 2: GRANT OF LICENSE; ACCESS AND USE
Section 2.1 — License Grant
Subject to the terms and conditions of this Agreement, including Licensee's payment of all applicable fees and compliance with the restrictions set forth in Section 2.3, Skybridge hereby grants to Meridian a non-exclusive, non-transferable (except as expressly provided in Section 15.5), non-sublicensable right and license to access and use the SkyComply™ platform during the Term solely for Meridian's internal business purposes in connection with its anti-money-laundering, transaction-monitoring, and regulatory compliance operations, in accordance with the Documentation, the Order Form, and this Agreement. The license granted under this Section 2.1 is limited to up to thirty-two thousand (32,000) named Authorized Users as specified in the initial Order Form attached hereto. Additional Authorized Users beyond thirty-two thousand (32,000) may be added in accordance with Section 4.2 at the incremental rates set forth in the Order Form.
Section 2.2 — Scope of Use
The license granted in Section 2.1 authorizes Meridian to access and use the Platform across Meridian's retail banking, commercial banking, and wealth management divisions for all lawful purposes consistent with the Platform's intended functionality as described in the Documentation. Meridian may use the Platform in connection with both its domestic United States operations and its international operations, subject to the data residency restrictions set forth in the Security Exhibit (Exhibit B) and the Data Processing Addendum (Exhibit C). Meridian's Affiliates may access and use the Platform only to the extent that such Affiliates are expressly identified in an Order Form executed by both Parties, and any such Affiliate's access shall be subject to all terms and conditions of this Agreement. Meridian shall be responsible for, and shall guarantee, the compliance of its Affiliates with all obligations applicable to Licensee under this Agreement.
Section 2.3 — Restrictions on Use
Licensee shall not, and shall not permit any Authorized User or third party to:
(a) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, object code, algorithms, data structures, or underlying ideas or techniques of the Platform, except to the limited extent expressly permitted by applicable law notwithstanding a contractual restriction to the contrary;
(b) sublicense, rent, lease, lend, sell, resell, distribute, or otherwise transfer or make available access to the Platform or any portion thereof to any third party, except as expressly authorized by this Agreement;
(c) copy, modify, adapt, translate, or create derivative works based upon the Platform or the Documentation, except as expressly authorized by this Agreement;
(d) use the Platform to provide processing services, service bureau services, or any similar services to third parties;
(e) remove, alter, or obscure any proprietary notices, labels, or marks on or within the Platform or Documentation;
(f) use the Platform in violation of the Acceptable Use Policy attached hereto as Exhibit D;
(g) use the Platform in violation of any applicable law, rule, regulation, or governmental order, including the Bank Secrecy Act, the USA PATRIOT Act, the Gramm-Leach-Bliley Act, and any regulations promulgated thereunder;
(h) introduce any Malicious Code into the Platform or Skybridge's systems; or
(i) access the Platform for the purpose of building a competitive product or service, or for benchmarking purposes, without Skybridge's prior written consent.
Section 2.4 — Reservation of Rights
As between the Parties, Skybridge retains all right, title, and interest in and to the Platform, the Documentation, and all intellectual Property Rights embodied therein or related thereto, including all Updates, Upgrades, modifications, enhancements, and derivative works thereof. No rights are granted to Licensee hereunder except as expressly set forth in this Agreement. All rights not expressly granted to Licensee are reserved by Skybridge. As between the Parties, Licensee retains all right, title, and interest in and to Licensee Data, and nothing in this Agreement shall be construed to transfer to Skybridge any ownership rights in or to Licensee Data.
Section 2.5 — Feedback
If Licensee or any of its Authorized Users provides suggestions, enhancement requests, recommendations, ideas, comments, or other feedback regarding the Platform, its features, or its functionality (collectively, "Feedback"), Skybridge shall be free to use, incorporate, modify, and otherwise exploit such Feedback without restriction, obligation, or compensation to Licensee. Licensee hereby assigns to Skybridge all right, title, and interest in and to any intellectual Property Rights in such Feedback, and Licensee agrees to execute such documents and take such actions as may be reasonably necessary to perfect such assignment.
ARTICLE 3: IMPLEMENTATION SERVICES
Section 3.1 — Implementation
Skybridge shall perform the Implementation Services described in the Order Form during the Implementation Period, which shall commence on September 15, 2025 and end on February 28, 2026. The Implementation Services shall include, without limitation: (a) initial configuration and customization of the Platform to conform to Meridian's operational requirements and risk parameters; (b) integration with Meridian's existing core banking systems, data warehouses, case management tools, and regulatory reporting infrastructure; (c) data migration, including the migration of historical transaction data and existing suspicious activity alerts from Meridian's legacy systems; (d) user acceptance testing in accordance with mutually agreed test scripts and acceptance criteria; and (e) onboarding and training for Meridian's Authorized Users, compliance officers, and system administrators. The Parties shall cooperate in good faith throughout the Implementation Period, and Meridian shall provide Skybridge with reasonably necessary access to Meridian's systems, personnel, data, documentation, and other resources as may be required for Skybridge to perform the Implementation Services in a timely and effective manner.
Section 3.2 — Go-Live
The targeted Go-Live Date for the Platform is March 1, 2026. Achieving the Go-Live Date is contingent upon the successful completion of user acceptance testing in accordance with the acceptance criteria mutually agreed upon by the Parties and set forth in the Order Form. Upon successful completion of user acceptance testing, Meridian shall deliver a written notice of acceptance, and the Platform shall thereafter be deemed available for production use. Any delay in the Go-Live Date that is primarily caused by Meridian's failure to provide reasonably necessary access, data, resources, or approvals, or by Meridian's failure to perform its obligations under the implementation plan, shall not constitute a breach by Skybridge and shall extend the targeted Go-Live Date by a commensurate period.
Section 3.3 — Implementation Fee
The one-time implementation and onboarding services fee shall be Three Million Six Hundred Thousand Dollars ($3,600,000), payable in the installments and on the schedule set forth in the Order Form. The implementation fee is subject to the volume discount applied across the total contract value as described in Section 4.1 of this Agreement.
Section 3.4 — Project Governance
Each Party shall appoint a dedicated project manager to serve as such Party's primary point of contact for all matters relating to the Implementation Services during the Implementation Period. Skybridge's project lead shall be designated in writing within five (5) Business Days of the Effective Date. Meridian's project lead shall be designated in writing within five (5) Business Days of the Effective Date. The Parties' respective project managers shall conduct weekly status meetings during the Implementation Period to review progress against the implementation plan, identify and escalate issues, track milestones, and coordinate resource allocation. Meeting agendas and minutes shall be documented and distributed to both Parties' project managers within two (2) Business Days following each meeting.
ARTICLE 4: FEES AND PAYMENT
Section 4.1 — Fees
Licensee shall pay to Licensor the fees set forth in the Order Form attached hereto. The Parties acknowledge and agree that the fee structure for the Initial Term of this Agreement is as follows:
(a) Year 1 Total Fees (post-discount, rounded): Twelve Million Seven Hundred Thousand Dollars ($12,700,000), comprising the platform subscription fee, the implementation fee, and the support and managed services fee.
(b) Years 2 through 5 Annual Fees: Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000) per year, comprising the platform subscription fee and the support and managed services fee.
(c) Total Contract Value (TCV): Fifty Million Dollars ($50,000,000) over the five (5) year Initial Term.
(d) Volume discount: A volume discount of six and seventy-two hundredths percent (6.72%) has been applied to the gross undiscounted Total Contract Value of Fifty-Three Million Six Hundred Thousand Dollars ($53,600,000).
The fee components on a pre-discount basis are as follows:
Section 4.2 — Additional Users
Licensee may add incremental Authorized Users beyond the thirty-two thousand (32,000) named users included in the initial Order Form at a rate of Two Hundred Seventy-Five Dollars ($275.00) per user per year. The volume discount described in Section 4.1 does not apply to fees for incremental Authorized Users. Additional Authorized Users shall be added via a supplemental Order Form executed by both Parties, and the fees for such additional users shall be prorated based on the remaining portion of the then-current billing period.
Section 4.3 — Payment Terms
All fees under this Agreement are payable quarterly in advance. Skybridge shall deliver invoices to Meridian electronically to Meridian's designated billing contact not later than thirty (30) days prior to the commencement of each quarterly billing period. All invoices are due and payable within thirty (30) days from the date of the invoice (net thirty (30) days). Licensee shall make all payments in United States Dollars by wire transfer or automated clearing house (ACH) transfer to the account designated by Skybridge in writing.
Section 4.4 — Annual Escalator
Beginning in Year 3 of the Initial Term (i.e., effective as of the third anniversary of the Go-Live Date), the annual fees payable by Licensee under this Agreement (exclusive of the implementation fee, which is a one-time charge) shall increase by three percent (3.0%) per annum, reflecting a CPI-based escalation. Notwithstanding the foregoing, in no event shall the annual escalator exceed three and one-half percent (3.5%) per annum in any given year. The annual escalator does not apply to fees payable during Year 1 or Year 2 of the Initial Term.
Section 4.5 — Taxes
All fees stated in this Agreement and the Order Form are exclusive of, and Licensee shall be responsible for, all sales taxes, use taxes, value-added taxes, goods and services taxes, withholding taxes, and similar taxes, duties, levies, or governmental charges imposed in connection with this Agreement, excluding any taxes based on Skybridge's net income, gross receipts, capital, or franchise taxes assessed against Skybridge. If Licensee is required by law to withhold any taxes from payments due to Skybridge, Licensee shall provide Skybridge with official tax receipts or other documentation reasonably requested by Skybridge to enable Skybridge to claim any available credit or refund.
Section 4.6 — Late Payments
Any amounts due under this Agreement that are not paid when due shall accrue interest at the rate of one and one-half percent (1.5%) per month (or, if lower, the maximum rate permitted by applicable law) from the date such payment was due until the date such payment is received by Skybridge. In addition, if Licensee fails to pay any undisputed amount when due and such failure continues for thirty (30) days after Skybridge delivers written notice of such non-payment to Licensee, Skybridge may, upon an additional ten (10) Business Days' written notice and subject to Licensee's right to cure within such additional notice period, suspend Licensee's access to the Platform until all past-due amounts, including accrued interest, are paid in full. Any suspension of access under this Section 4.6 shall not relieve Licensee of its obligation to pay fees during the period of suspension.
Section 4.7 — SLA Credits
Service level credits as set forth in the SLA Exhibit (Exhibit A) shall be Licensee's sole and exclusive financial remedy for Skybridge's failure to meet the uptime commitments specified therein. SLA credits shall be applied against future invoices and are not redeemable for cash, refundable, or transferable. The availability of SLA credits is without prejudice to Licensee's termination rights under Section 5.2 and Section 11.3.
ARTICLE 5: SERVICE LEVELS
Section 5.1 — SLA Exhibit
The service level commitments, measurement methodologies, credit mechanisms, and incident response requirements applicable to the Platform are set forth in the SLA Exhibit attached hereto as Exhibit A. Skybridge shall use commercially reasonable efforts to maintain Platform availability at a rate of not less than [99.9%][99.95%] during each calendar month, measured exclusive of Scheduled Maintenance windows.
[OPEN ISSUE: The Platform availability target remains under negotiation between the Parties. Skybridge proposes a monthly uptime commitment of 99.9%. Meridian demands a monthly uptime commitment of 99.95%. The Parties have agreed to continue negotiating this point, and the final uptime commitment shall be reflected in the executed version of this Agreement and the SLA Exhibit.]
Scheduled Maintenance windows shall occur on Saturdays between 2:00 AM and 6:00 AM Eastern Time, with a maximum duration of four (4) hours per week. Skybridge shall provide Licensee with at least forty-eight (48) hours' advance notice of Scheduled Maintenance. The measurement period for all uptime calculations shall be the calendar month.
Section 5.2 — SLA Credit Tiers
Subject to the resolution of the uptime target in Section 5.1, the Parties have agreed upon the following framework for SLA credits:
In the event that monthly uptime falls below 98.0% in three (3) of any consecutive six (6) months, Licensee shall have the right to terminate this Agreement upon thirty (30) days' written notice, without liability for early termination fees, and shall receive a pro-rata refund of any pre-paid fees attributable to the period following the effective date of such termination.
Section 5.3 — SLA Credit Caps
The Parties have agreed to cap SLA credits as follows:
(a) Monthly Cap: Thirty percent (30%) of the monthly subscription fee. Based on the fee structure set forth in Section 4.1, this equates to a maximum monthly credit of approximately Three Hundred Seventeen Thousand Five Hundred Dollars ($317,500) in Year 1 and approximately Two Hundred Thirty-Three Thousand One Hundred Twenty-Five Dollars ($233,125) in Years 2 through 5.
(b) Annual Cap: Fifteen percent (15%) of the annual subscription fee. Based on the fee structure set forth in Section 4.1, this equates to a maximum annual credit of approximately One Million Nine Hundred Five Thousand Dollars ($1,905,000) in Year 1 and approximately One Million Three Hundred Ninety-Eight Thousand Seven Hundred Fifty Dollars ($1,398,750) in Years 2 through 5.
Drafting Note: The Parties have agreed to cap SLA credits as reflected above. Meridian's initial demand for uncapped SLA credits was withdrawn during the first-round negotiation in exchange for the enhanced termination right set forth in Section 5.2.
Section 5.4 — Critical Incident Response Times
Skybridge shall respond to critical incidents affecting the Platform in accordance with the following response time commitments:
Skybridge shall assign severity levels in good faith in consultation with Meridian, and Meridian shall have the right to escalate the severity level in the event of a reasonable disagreement. All response time commitments are measured from the time the incident is reported to Skybridge's support team through the designated support channels specified in the SLA Exhibit.
Section 5.5 — Exclusive Remedy
The SLA credits set forth in this Article 5 and the termination right set forth in Section 5.2 are Licensee's sole and exclusive remedies for Skybridge's failure to meet the uptime commitments specified in the SLA Exhibit, subject to the following qualification: nothing in this Section 5.5 shall prejudice or limit Licensee's rights under Article 9 (Indemnification) or Article 10 (Limitation of Liability) with respect to losses, damages, or claims arising from the same event or circumstance that gave rise to the SLA credit, to the extent such losses, damages, or claims are independently actionable under such Articles.
Section 5.6 — Upstream Infrastructure
The Parties acknowledge that Skybridge's ability to meet its uptime commitments under this Agreement is dependent in part on the availability and performance of the cloud infrastructure provided by Orion Cloud Services, Inc. ("Orion Cloud"), Skybridge's primary infrastructure-as-a-service provider. Orion Cloud currently maintains a platform service level agreement providing for 99.95% monthly uptime availability. Downtime attributable to force majeure events affecting Orion Cloud's infrastructure shall be excused from the uptime calculation under the SLA Exhibit, provided that Skybridge activates its documented failover and disaster recovery procedures within commercially reasonable timeframes and provides Licensee with prompt notice of the event and its expected duration. Skybridge shall use commercially reasonable efforts to maintain its agreement with Orion Cloud at service levels no less favorable than those in effect as of the Effective Date.
ARTICLE 6: SECURITY AND DATA PROTECTION
Section 6.1 — Security Obligations
Skybridge shall implement and maintain, throughout the Term, administrative, technical, and physical safeguards designed to protect the security, confidentiality, integrity, and availability of Licensee Data and the Platform, in accordance with the security controls, standards, and requirements set forth in the Security Exhibit attached hereto as Exhibit B. Without limiting the generality of the foregoing, Skybridge shall maintain the following certifications:
(a) SOC 2 Type II Certification: Skybridge's most recent SOC 2 Type II report is dated March 15, 2025, and was performed by Crestfield Cyber Advisors, Inc. Skybridge shall undergo annual SOC 2 Type II audits conducted by Crestfield Cyber Advisors, Inc. or another nationally recognized audit firm reasonably acceptable to Meridian, and shall provide Meridian with a copy of the resulting report within thirty (30) days of its issuance.
(b) ISO 27001 Certification: Skybridge's most recent ISO 27001 certificate is dated January 22, 2025, and was issued following an audit by Crestfield Cyber Advisors, Inc. Skybridge shall maintain ISO 27001 certification throughout the Term, including triennial recertification audits and annual surveillance audits, and shall provide Meridian with evidence of continued certification upon request.
Section 6.2 — Encryption Standards
The Parties have agreed upon the following encryption standards, which are further detailed in the Security Exhibit:
(a) Data at Rest: All Licensee Data stored on Skybridge's systems and infrastructure shall be encrypted using Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256).
(b) Data in Transit: All Licensee Data transmitted between Meridian's systems and Skybridge's systems, and between components of Skybridge's infrastructure, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher.
(c) Key Management: Encryption keys shall be managed through Skybridge-managed hardware security modules (HSMs). Skybridge shall offer Meridian the option to integrate bring-your-own-key (BYOK) capabilities, under which Meridian may generate, manage, and control its own encryption keys used to encrypt Licensee Data at rest.
Section 6.3 — Data Residency
All Licensee Data shall be stored and processed exclusively within the continental United States. Hosting of the Platform and all Licensee Data shall be limited to Orion Cloud's US-East (Virginia) and US-West (Oregon) regions. No cross-border transfer of Licensee Data to any location outside of the continental United States shall occur without the prior written consent of Meridian, which may be withheld or conditioned in Meridian's sole discretion. Skybridge shall not, and shall ensure that its Subprocessors do not, access, process, store, or transfer Licensee Data from or to any location outside of the continental United States without such prior written consent.
Section 6.4 — Penetration Testing
The Parties have agreed upon the following framework for penetration testing of the Platform:
(a) Skybridge-Conducted Testing: Skybridge shall, at its own expense, engage a qualified independent third-party security firm to conduct an annual penetration test of the Platform and its supporting infrastructure. Skybridge shall share the results of each such penetration test, including identified vulnerabilities and remediation plans, with Meridian under the terms of a non-disclosure agreement or the confidentiality provisions of this Agreement, within thirty (30) days of completion of the test.
(b) Meridian-Conducted Testing — Application Layer: Meridian may, at Meridian's expense, conduct its own annual penetration test of the Platform, provided that such testing is limited to application-layer testing. Meridian shall coordinate the scope, timing, and methodology of such testing with Skybridge in advance and shall provide Skybridge with at least twenty (20) Business Days' prior written notice.
(c) Meridian-Conducted Testing — Infrastructure Layer: Infrastructure-layer penetration testing by or on behalf of Meridian shall require Skybridge's prior written consent, which shall not be unreasonably withheld, conditioned, or delayed. Any infrastructure-layer testing must be coordinated with Orion Cloud and scheduled in advance to avoid disruption to the Platform or other Skybridge customers.
(d) Testing Firm: Meridian may designate Crestfield Cyber Advisors, Inc. or another mutually agreed independent security firm to perform penetration testing under this Section 6.4.
Section 6.5 — Security Incident Notification
In the event Skybridge discovers or is made aware of a confirmed Security Incident affecting Licensee Data, Skybridge shall notify Meridian in writing within [24 hours][12 hours] of discovery.
[OPEN ISSUE: The Security Incident notification window remains under negotiation. Skybridge proposes notification within twenty-four (24) hours of discovery of a confirmed Security Incident affecting Licensee Data. Meridian demands notification within twelve (12) hours of discovery. The Parties have agreed to continue negotiating this point.]
Such notification shall include, to the extent known at the time of notification:
(a) the nature and scope of the Security Incident, including a description of the type of incident and the systems affected;
(b) a description of the Licensee Data potentially affected, including the categories and approximate volume of data involved;
(c) the remediation steps that have been taken or are planned to be taken to contain, investigate, and resolve the Security Incident; and
(d) the name and contact information of a designated point of contact at Skybridge responsible for managing the incident response.
Following initial notification, Skybridge shall cooperate fully with Meridian's investigation of the Security Incident and shall provide written updates to Meridian at least every twenty-four (24) hours until the Security Incident is fully resolved and remediated. Skybridge shall preserve all relevant logs, records, and evidence related to the Security Incident and shall not destroy or alter such materials without Meridian's prior written consent. Skybridge's obligations under this Section 6.5 are in addition to, and do not limit, any notification obligations under applicable law, including state data breach notification statutes.
Section 6.6 — Audit Rights
Meridian may audit Skybridge's compliance with the security controls and data protection obligations set forth in this Agreement and the Security Exhibit, subject to the following terms:
(a) Frequency: Meridian may conduct such audits no more than once per calendar year, upon thirty (30) Business Days' prior written notice to Skybridge.
(b) Satisfaction of Audit Requests: Skybridge may satisfy Meridian's audit requests, in whole or in part, by delivering to Meridian: (i) the most recent SOC 2 Type II report; (ii) the current ISO 27001 certificate and any associated statement of applicability; and (iii) a completed Security Assessment Questionnaire in the form reasonably requested by Meridian.
(c) On-Site Audits: On-site audits of Skybridge's facilities, systems, and processes shall be permitted only upon Meridian's demonstration of a material security concern that cannot be addressed through the documentation described in Section 6.6(b). On-site audits shall be conducted during normal business hours, with reasonable scope and timing limitations designed to minimize disruption to Skybridge's operations, and shall be subject to Skybridge's reasonable security and confidentiality requirements.
(d) Audit Costs: The costs and expenses of any audit conducted under this Section 6.6 shall be borne by Meridian, except that if an audit reveals a material non-compliance by Skybridge with its obligations under this Agreement, the Security Exhibit, or the DPA, the reasonable costs and expenses of such audit shall be borne by Skybridge.
Section 6.7 — Subprocessor Approvals
Skybridge shall provide Meridian with at least thirty (30) days' advance written notice before engaging any new Subprocessor that will process, store, or have access to Licensee Data. Such notice shall include the identity of the proposed Subprocessor, the nature of the processing to be performed, the categories of Licensee Data involved, and the location(s) where processing will occur. Meridian shall have a reasonable right to object to the engagement of any proposed Subprocessor. If Meridian raises an objection in writing within the thirty (30) day notice period, the Parties shall negotiate in good faith for a period of fifteen (15) Business Days to resolve such objection. If the objection is not resolved within such period, Meridian may terminate the processing activity affected by the proposed Subprocessor engagement. Skybridge shall not engage the objected-to Subprocessor for the processing of Licensee Data unless and until the objection is resolved. Orion Cloud Services, Inc. is identified as an approved Subprocessor as of the Effective Date. A current list of approved Subprocessors is attached to the DPA (Exhibit C).
Section 6.8 — Background Checks
All Skybridge personnel, including employees, contractors, and agents, who are granted access to Licensee Data or to Meridian's systems in connection with the performance of Skybridge's obligations under this Agreement shall undergo background checks prior to being granted such access. Such background checks shall be consistent with the standards and guidelines established by the Federal Financial Institutions Examination Council (FFIEC) and shall include, at a minimum, verification of identity, criminal history checks, and such other screening as is appropriate given the nature of the individual's role and level of access.
Section 6.9 — Data Processing Addendum
The Data Processing Addendum attached hereto as Exhibit C governs Skybridge's processing of Licensee Data, including NPI under the Gramm-Leach-Bliley Act and PII, and is incorporated herein by reference. The DPA sets forth the Parties' respective roles and responsibilities with respect to data processing, including the scope and purposes of processing, data subject rights, international data transfer mechanisms (if applicable), and data retention and deletion requirements. In the event of a conflict or inconsistency between the provisions of this Article 6 and the provisions of the DPA with respect to data processing matters, the terms of the DPA shall control.
ARTICLE 7: DATA RETENTION AND DELETION
Section 7.1 — During Term
During the Term, Skybridge shall retain Licensee Data only as necessary to perform its obligations under this Agreement and as directed by Meridian in writing. Skybridge shall not retain Licensee Data for any purpose other than the performance of its obligations under this Agreement and shall not use Licensee Data for its own purposes, including product development, analytics, benchmarking, or marketing, except to the extent expressly authorized by Meridian in writing or as required by applicable law.
Section 7.2 — Post-Termination
Upon the termination or expiration of this Agreement for any reason:
(a) Data Export: Within thirty (30) days of the effective date of termination or expiration, Skybridge shall provide Meridian with a complete export of all Licensee Data in a commonly used, machine-readable, non-proprietary format (such as CSV, JSON, or XML), together with such documentation as may be reasonably necessary to enable Meridian to import and use such data in alternative systems. Skybridge shall provide reasonable assistance to Meridian in connection with the data export process, at Skybridge's then-current professional services rates, unless the termination is by Meridian for cause, in which case Skybridge shall provide such assistance at no additional charge.
(b) Data Deletion: Within sixty (60) days of the effective date of termination or expiration, Skybridge shall certify in writing to Meridian the secure destruction and deletion of all Licensee Data from Skybridge's systems and from the systems of all Subprocessors, using methods consistent with NIST Special Publication 800-88 or an equivalent standard. Such certification shall be signed by an authorized officer of Skybridge. Notwithstanding the foregoing, Skybridge may retain copies of Licensee Data to the extent, and for the period, required by applicable law or regulation, provided that Skybridge shall (i) notify Meridian in writing of the nature and extent of such retention, (ii) continue to protect such retained data in accordance with the confidentiality and security obligations of this Agreement, and (iii) delete such retained data promptly upon the expiration of the applicable legal retention period.
(c) Exclusion from Liability Cap: Skybridge's obligations under this Section 7.2 are excluded from the Aggregate Liability Cap set forth in Section 10.3.
ARTICLE 8: CONFIDENTIALITY
Section 8.1 — Definition of Confidential Information
"Confidential Information" means all information disclosed by or on behalf of one Party (the "Disclosing Party") to the other Party (the "Receiving Party"), whether orally, in writing, electronically, or in any other form or medium, that: (a) is marked, designated, or otherwise identified as "confidential," "proprietary," or with a similar legend at the time of disclosure; or (b) by its nature or the circumstances of its disclosure, would reasonably be understood by a person exercising reasonable judgment to be confidential or proprietary. Without limiting the generality of the foregoing, all Licensee Data shall be deemed Confidential Information of Meridian regardless of whether it is marked or designated as confidential. The terms, conditions, and pricing of this Agreement shall be deemed Confidential Information of both Parties.
Section 8.2 — Obligations
The Receiving Party shall:
(a) use the Disclosing Party's Confidential Information solely for the purpose of performing its obligations or exercising its rights under this Agreement, and for no other purpose;
(b) protect the Disclosing Party's Confidential Information using at least the same degree of care that it uses to protect its own confidential information of like kind, but in no event less than reasonable care;
(c) limit access to and disclosure of the Disclosing Party's Confidential Information to those of its employees, contractors, consultants, agents, officers, directors, and professional advisors who have a legitimate need to know such information for the purposes of this Agreement and who are bound by written confidentiality obligations no less protective than those set forth in this Article 8; and
(d) promptly notify the Disclosing Party upon discovery of any unauthorized use, access, or disclosure of the Disclosing Party's Confidential Information.
Section 8.3 — Exclusions
The obligations set forth in Section 8.2 shall not apply to any information that:
(a) is or becomes publicly available through no fault, act, or omission of the Receiving Party or any person to whom the Receiving Party has disclosed such information;
(b) was rightfully known to or in the possession of the Receiving Party prior to the time of disclosure by the Disclosing Party, as evidenced by the Receiving Party's contemporaneous written records;
(c) is independently developed by the Receiving Party without reference to or use of the Disclosing Party's Confidential Information, as evidenced by the Receiving Party's contemporaneous written records; or
(d) is rightfully received by the Receiving Party from a third party that is not, to the Receiving Party's knowledge, subject to any obligation of confidentiality with respect to such information.
Section 8.4 — Compelled Disclosure
Notwithstanding the foregoing, the Receiving Party may disclose Confidential Information of the Disclosing Party to the extent required by applicable law, regulation, rule, or legal process, including any examination, inquiry, information request, subpoena, civil investigative demand, or similar process by any federal banking regulator (including the OCC, the Federal Reserve, and the FDIC), any state banking regulator, or any court of competent jurisdiction, provided that the Receiving Party: (a) provides the Disclosing Party with prompt written notice of such requirement (to the extent permitted by applicable law and the terms of such process); (b) cooperates with the Disclosing Party's reasonable efforts to obtain a protective order, confidential treatment, or other appropriate remedy limiting the scope of such disclosure; and (c) discloses only such portion of the Confidential Information as is legally required to be disclosed.
Section 8.5 — Equitable Relief
Each Party acknowledges and agrees that any breach or threatened breach of this Article 8 may cause the non-breaching Party irreparable harm for which monetary damages alone would be an inadequate remedy. Accordingly, in addition to any other remedies available at law or in equity, the non-breaching Party shall be entitled to seek temporary, preliminary, and permanent injunctive relief and specific performance, without the necessity of proving actual damages, posting a bond, or other security.
ARTICLE 9: INDEMNIFICATION
Section 9.1 — Indemnification by Skybridge (Licensor)
Skybridge shall indemnify, defend, and hold harmless Meridian, Meridian Financial Group, Inc., and their respective officers, directors, employees, agents, successors, and assigns (collectively, the "Meridian Indemnitees") from and against any and all third-party claims, demands, actions, suits, proceedings, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees and court costs) (collectively, "Losses") arising from or related to:
(a) IP Infringement: Any claim that Meridian's authorized use of the SkyComply™ platform in accordance with this Agreement infringes, misappropriates, or otherwise violates any third-party intellectual Property Rights, including patents, copyrights, trademarks, and trade secrets;
(b) Data Breach: Skybridge's breach of its data security, data protection, or confidentiality obligations under this Agreement, the Security Exhibit, or the DPA, to the extent that such breach results in the unauthorized access to, acquisition of, use of, or disclosure of Licensee Data; and
(c) Breach of Law: Skybridge's material breach of applicable law, including the Gramm-Leach-Bliley Act, the Bank Secrecy Act, applicable anti-money-laundering regulations, the USA PATRIOT Act, state data breach notification laws, and any related regulatory requirements.
Section 9.2 — Indemnification by Meridian (Licensee)
Meridian shall indemnify, defend, and hold harmless Skybridge and its officers, directors, employees, agents, successors, and assigns (collectively, the "Skybridge Indemnitees") from and against any and all Losses arising from or related to:
(a) Acceptable Use Policy Breach: Any third-party claim arising from Meridian's breach of the Acceptable Use Policy attached hereto as Exhibit D;
(b) Data Infringement: Any third-party claim that data, content, or materials provided by Meridian to Skybridge for processing through the Platform infringe, misappropriate, or otherwise violate any third-party intellectual Property Rights; and
(c) Breach of Law: Meridian's material breach of applicable law in connection with its use of the Platform.
Section 9.3 — Indemnification Caps
The indemnification obligations of the Parties under this Article 9 are subject to the following caps:
(a) IP Indemnification (Section 9.1(a)): Skybridge's indemnification obligations with respect to intellectual property infringement claims under Section 9.1(a) are uncapped, consistent with industry standard practice for intellectual property indemnification in enterprise software-as-a-service agreements.
(b) Data Breach Indemnification (Section 9.1(b)): [Skybridge's indemnification obligations with respect to data breach claims under Section 9.1(b) shall be capped at two times (2×) the Annual Fees paid or payable by Licensee in the twelve (12) month period preceding the event giving rise to the claim, which, based on the steady-state annual fees of $9,325,000, equals approximately Eighteen Million Six Hundred Fifty Thousand Dollars ($18,650,000).][Skybridge's indemnification obligations with respect to data breach claims under Section 9.1(b) shall be uncapped.]
[OPEN ISSUE: The cap on Skybridge's data breach indemnification obligations remains under negotiation. Skybridge proposes a cap at 2× Annual Fees (approximately $18,650,000). Meridian demands that Skybridge's data breach indemnification be uncapped. This issue is linked to the confidentiality/data security super-cap issue in Section 10.4(b).]
(c) General Indemnification (Sections 9.1(c) and 9.2): Each Party's indemnification obligations with respect to all other claims under Section 9.1(c) (Skybridge) and Section 9.2 (Meridian) shall be capped at one times (1×) the Annual Fees paid or payable by Licensee in the twelve (12) month period preceding the event giving rise to the claim, which, based on the steady-state annual fees of $9,325,000, equals approximately Nine Million Three Hundred Twenty-Five Thousand Dollars ($9,325,000).