1011-00008 · Firm and Meridian Consumer Brands LLC · Memos & Analysis

change-of-control-alert-memo-2023-10-13.docx DOCUMENT Antitrust

6 / 12 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION

CALDERWOOD & HARKNESS LLP 125 Park Avenue, 34th Floor New York, NY 10017

Date: October 13, 2023

MEMORANDUM

To: David Halverston, General Counsel, Meridian Consumer Brands LLC Priya Chandrasekaran, Vice President, Information Technology, Meridian Consumer Brands LLC

From: Elaine Forsythe, Partner, Calderwood & Harkness LLP Garrett Simmons, Senior Associate, Calderwood & Harkness LLP

Re: Announced Acquisition of Pinecrest Digital Solutions Inc. by Vaulton Technologies Group, Inc. — Change-of-Control Implications for Proposed Master Services Agreement (MSA-PDS-MCB-2023)

Matter No.: 1011-00008 Client No.: 71982

I. Purpose and Executive Summary

This memorandum is being delivered on an expedited basis to alert Meridian Consumer Brands LLC ("MCB") to a material development that directly affects the Master Services Agreement currently under negotiation between MCB and Pinecrest Digital Solutions Inc. ("Pinecrest"). The development requires immediate attention and, in our view, warrants an immediate pause of all ongoing negotiation activity.

On October 12, 2023, Vaulton Technologies Group, Inc. ("Vaulton"), a Delaware corporation headquartered at 1400 Peachtree Road NE, Suite 3100, Atlanta, GA 30309, publicly announced that it has entered into a definitive agreement to acquire Pinecrest for a reported purchase price of approximately $685 million in an all-cash transaction. Stonebridge Advisory Group LLC, based at 200 Clarendon Street, 50th Floor, Boston, MA 02116, is serving as Vaulton's financial advisor in connection with the acquisition. While the precise closing timeline has not been confirmed, publicly available reporting and market commentary suggest that the transaction is expected to close in the near term — a matter of weeks rather than months.

This memorandum alerts MCB to the immediate implications of this development for the Master Services Agreement designated as MSA-PDS-MCB-2023, which has been under active negotiation between MCB and Pinecrest since early August 2023 and which, as of the date of this memorandum, remains unexecuted with four substantive issues still unresolved. The memorandum addresses three principal areas of concern:

(1) MCB's Contractual Rights Under the Change-of-Control Provision in the Draft MSA. The draft MSA includes a Change of Control provision that would afford MCB a termination right in the event of a change in ownership of Pinecrest. While this provision is not yet operative because the MSA has not been executed, the underlying policy rationale — that the identity of the counterparty is a material consideration — applies with equal or greater force to the threshold question of whether MCB should execute the agreement at all.

(2) Data Security and Confidentiality Risks. Under the proposed MSA, Pinecrest would host and manage some of MCB's most competitively sensitive data, including trade promotion information, pricing algorithms, and supply chain analytics. Following the acquisition, Vaulton would have the legal authority and practical ability to access Pinecrest's systems, personnel, and client data, creating significant new risk vectors that the current draft MSA does not adequately address.

(3) Competitive Overlap Concerns. Vaulton currently maintains IT services relationships with at least two of MCB's most significant direct competitors — Brightleaf Brands, Inc. and Kessler Home & Personal Care Corp. If MCB were to proceed with the Pinecrest MSA post-acquisition, Vaulton would simultaneously serve MCB and these competitors, creating an unacceptable risk of competitive intelligence cross-contamination, whether through intentional sharing, employee mobility, shared infrastructure, or inadvertent access.

Recommendation: Based on the analysis set forth in this memorandum, Calderwood & Harkness LLP ("C&H") strongly recommends that MCB immediately pause all MSA negotiations with Pinecrest and its outside counsel, Dunleavy, Proctor & Hale LLP, pending a comprehensive assessment of the Vaulton acquisition and its implications for MCB's IT services strategy. MCB should not execute the MSA in its current form, and no further draft exchanges, negotiation calls, or business principal escalation meetings should be scheduled until a deliberate strategic decision has been reached. C&H is prepared to assist MCB in implementing this recommendation and in evaluating the available paths forward, as described in detail in Section VIII of this memorandum.

II. Background

A. The Parties and the Proposed MSA

Meridian Consumer Brands LLC. MCB is a Delaware limited liability company headquartered at 680 Fifth Avenue, 22nd Floor, New York, NY 10019. MCB is a consumer products and retail company with reported fiscal year 2022 revenue of approximately $1.34 billion. MCB's product portfolio spans household cleaning products, personal care items, and beauty and wellness brands distributed through major retail channels and direct-to-consumer e-commerce platforms across the United States. MCB is a portfolio company of Ashford Capital Partners Fund IV, LP, a private equity fund with approximately $3.8 billion in committed capital (2018 vintage), which acquired MCB in 2019. Ashford Capital Management LLC serves as the general partner of Fund IV and exercises oversight responsibility for MCB's strategic direction and significant commercial commitments. Key personnel at Ashford Capital with involvement in MCB matters include Karen Lau, Operating Partner, and Vincent Driscoll, Managing Partner.

Pinecrest Digital Solutions Inc. Pinecrest is a Delaware corporation headquartered at 2300 Lakewood Boulevard, Suite 400, Durham, NC 27713. Founded in 2016, Pinecrest is an information technology services vendor that has grown rapidly to approximately 1,100 employees and reported fiscal year 2022 revenue of approximately $218 million. Pinecrest's Chief Executive Officer is Nathan Whitford, and its General Counsel is Rina Balakrishnan. Pinecrest provides a suite of IT services to mid-market and enterprise clients, including cloud infrastructure management, managed IT services, enterprise application support (with particular expertise in Harborline Software and Pinnacle Health IT implementations), cybersecurity monitoring and incident response, and data analytics platform hosting. Pinecrest was selected by MCB as its preferred vendor following a competitive request-for-proposal process, as described in Section II.B below.

The Proposed MSA. The MSA under negotiation (designated MSA-PDS-MCB-2023) contemplates a comprehensive IT managed services engagement in which Pinecrest would serve as MCB's primary IT services provider, replacing MCB's incumbent vendor arrangement. The scope of services, commercial terms, and negotiation history are described in Sections II.B and II.C below.

B. Negotiation History and Current Status

The negotiation history of the proposed MSA is as follows:

• June 12, 2023: MCB issued a formal request for proposal (designated MCB-IT-RFP-2023-006) for IT managed services, soliciting proposals from multiple vendors, including Pinecrest. The RFP encompassed cloud infrastructure management, managed IT operations, enterprise application support, cybersecurity monitoring, and data analytics hosting.

• July 10, 2023: Following an evaluation of the proposals received, MCB selected Pinecrest as its preferred vendor based on a combination of technical capability, cost competitiveness, cultural fit, and Pinecrest's track record of delivering managed services to mid-market consumer brands.

• July 25, 2023: MCB formally engaged C&H to serve as outside counsel for the MSA negotiation. C&H opened the engagement and was asked to prepare an initial draft of the MSA for MCB's review.

• August 4, 2023: C&H delivered its first draft of the MSA to MCB's legal team. The draft reflected MCB's standard positions on key commercial and risk-allocation provisions, including data security, intellectual property ownership, liability allocation, indemnification, audit rights, and termination.

• August 11, 2023: MCB consolidated internal business and technical comments from Priya Chandrasekaran's IT team and David Halverston's legal team, and the marked draft was transmitted to Pinecrest for its review and comment.

• August 25, 2023: Dunleavy, Proctor & Hale LLP ("DPH"), Pinecrest's outside counsel, returned its first redline of the MSA. The lead DPH partner on the engagement is Carolyn Ostrowski. DPH's redline contained forty-seven (47) substantive comments and proposed revisions spanning the key risk-allocation provisions, including significant pushback on MCB's proposed positions regarding data security standards, the liability cap structure, the termination fee, and the scope of MCB's audit rights.

• September 8, 2023: The first negotiation call between C&H and DPH took place, attended by David Halverston and Rina Balakrishnan as well as business representatives from both parties. This call resolved twenty-nine (29) of the forty-seven (47) open issues identified in DPH's initial redline, representing substantial progress on a range of mid-tier provisions.

• September 15, 2023: C&H circulated a revised draft of the MSA reflecting the resolutions reached on the September 8 negotiation call. The revised draft narrowed the open issues to eighteen (18).

• September 22, 2023: DPH returned a second redline further addressing the remaining open items. This redline reflected movement on several provisions and reduced the universe of truly contested issues to twelve (12).

• September 29, 2023: A second negotiation call between C&H and DPH resolved eight (8) of the twelve (12) remaining issues, leaving four (4) issues still unresolved.

• October 6, 2023: C&H circulated a near-final draft of the MSA incorporating all resolutions reached through the two negotiation calls. The draft was designated as "near-final" subject to resolution of the four remaining open issues, which the parties agreed would be escalated to business principals (MCB's Meg Thornbury, Senior Vice President of Operations, and Pinecrest's Nathan Whitford) for resolution. Those four unresolved issues are: (1) the applicable data security standards and compliance obligations; (2) the aggregate liability cap applicable to Pinecrest; (3) the structure and amount of the early termination fee; and (4) the scope and frequency of MCB's audit rights over Pinecrest's operations and controls.

As of the date of this memorandum, no MSA has been executed. The agreement remains in draft form, and the business principal escalation meeting has not yet been scheduled. This is a critically important fact: MCB has no binding contractual commitment to Pinecrest, and the decision whether to proceed with execution rests entirely with MCB.

C. Key Commercial Terms of the Proposed MSA

The principal commercial terms reflected in the near-final draft of the MSA are summarized below:

Term: The proposed MSA contemplates an initial term of five (5) years, commencing November 1, 2023 and continuing through October 31, 2028, with one (1) optional two-year renewal period exercisable by MCB upon written notice delivered no later than one hundred eighty (180) days prior to the expiration of the initial term.

Total Contract Value: The total contract value over the initial five-year term is $14,750,000.

Annual Contract Value: The annual contract value is $2,950,000, allocated among the following service categories:

Payment Terms: Net 45 from invoice date, with payments due quarterly in advance.

Incumbent Vendor Comparison: The proposed MSA would replace MCB's existing IT managed services arrangement with Corwyn Technology Services LLC ("Corwyn"), which currently provides comparable services at an annual cost of $3,150,000 per year. The Pinecrest engagement would therefore yield an annual cost saving of approximately $200,000 relative to the Corwyn arrangement, representing a total estimated savings of $1,000,000 over the five-year initial term.

D. The Vaulton Acquisition Announcement

On October 12, 2023, Vaulton Technologies Group, Inc. publicly announced that it has entered into a definitive agreement to acquire 100% of the outstanding equity of Pinecrest Digital Solutions Inc. for a reported purchase price of approximately $685 million.

The key facts of the announced acquisition are as follows:

• Date of Announcement: October 12, 2023.

• Acquirer: Vaulton Technologies Group, Inc., a Delaware corporation headquartered at 1400 Peachtree Road NE, Suite 3100, Atlanta, GA 30309. Vaulton is a major enterprise technology and IT services provider with fiscal year 2022 revenue of approximately $4.7 billion. Vaulton's Chief Executive Officer is Robert "Rob" Castellano. Vaulton's service offerings include enterprise IT outsourcing, cloud computing, cybersecurity, digital transformation consulting, and managed infrastructure services. Vaulton serves a broad base of clients across industries, including consumer products, financial services, healthcare, and manufacturing.

• Target: Pinecrest Digital Solutions Inc.

• Reported Acquisition Price: Approximately $685 million.

• Financial Advisor to Vaulton: Stonebridge Advisory Group LLC, 200 Clarendon Street, 50th Floor, Boston, MA 02116.

• Expected Closing: The parties to the acquisition have not publicly disclosed a definitive closing date. However, based on publicly available reporting and market commentary, the transaction is expected to close in the near term. Market analysts have indicated that the transaction is anticipated to close within several weeks rather than months, subject to satisfaction of customary closing conditions, including any required regulatory approvals. C&H has not had any direct communication with Vaulton, Pinecrest, or their respective advisors regarding the acquisition timeline, and the foregoing is based solely on publicly available information.

The acquisition announcement was not preceded by any disclosure from Pinecrest or DPH to MCB or C&H during the MSA negotiation process. C&H has not confirmed whether Pinecrest was subject to any confidentiality or standstill obligations that would have precluded such disclosure, but the lack of advance notice is noteworthy in the context of an active commercial negotiation in which the identity and independence of the vendor was a material consideration for MCB.

III. Analysis of Change-of-Control Provision in Draft MSA

A. Relevant Contract Language

The near-final draft of MSA-PDS-MCB-2023 includes a Change of Control provision that was the subject of negotiation between C&H and DPH and has been agreed upon in principle by the parties. The provision, as reflected in the October 6, 2023 near-final draft, is located in Section 14.3 of the MSA and provides, in relevant part, as follows:

Section 14.3 — Change of Control. In the event that either Party undergoes a Change of Control (as defined herein), the other Party may, at its sole option, terminate this Agreement upon written notice delivered to the Party undergoing the Change of Control within thirty (30) days following the date on which the terminating Party first receives written notice of, or otherwise becomes aware of, the Change of Control event (the "Change of Control Notice Period"). Termination pursuant to this Section 14.3 shall be effective thirty (30) days following delivery of the termination notice (the "Change of Control Termination Date"), and neither Party shall have any liability to the other Party on account of such termination, except with respect to obligations accrued prior to the Change of Control Termination Date, including without limitation the payment of fees for Services rendered through the Change of Control Termination Date.

The draft MSA defines "Change of Control" in Section 1.7 as follows:

"Change of Control" means, with respect to a Party, the occurrence of any of the following events: (a) any merger, consolidation, or other business combination transaction in which such Party is not the surviving entity, or in which such Party is the surviving entity but the holders of equity interests in such Party immediately prior to the transaction hold less than fifty percent (50%) of the voting power of the surviving entity immediately following the transaction; (b) the acquisition by any Person or "group" (within the meaning of Section 13(d)(3) of the Securities Exchange Act of 1934, as amended) of direct or indirect beneficial ownership of more than fifty percent (50%) of the outstanding equity interests or voting securities of such Party; (c) the sale, transfer, assignment, or other disposition of all or substantially all of the assets of such Party; or (d) the dissolution or liquidation of such Party.

B. MCB's Termination Right

The application of the Change of Control provision to the Vaulton acquisition is straightforward. Vaulton's acquisition of 100% of Pinecrest's outstanding equity falls squarely within clause (b) of the Change of Control definition — and, depending on the structure of the transaction, may also satisfy clause (a) if the acquisition is structured as a merger in which Pinecrest is merged into a Vaulton subsidiary. In either case, the Vaulton acquisition would unambiguously constitute a "Change of Control" of Pinecrest under the draft MSA.

If the MSA were to be executed prior to the closing of the Vaulton acquisition, MCB would have a thirty (30) day window from the date on which MCB first becomes aware of the Change of Control event to exercise its right to terminate the MSA without penalty. Conversely, if the acquisition closes before the MSA is executed, the Change of Control provision would have no operative effect — but the Change of Control would have already occurred, and MCB would be entering into an agreement with a party that is, by that point, a wholly-owned subsidiary of Vaulton.

This leads to a critical practical distinction: the MSA has not been executed. The Change of Control clause, like all other provisions of the draft MSA, is not yet operative and would only become binding upon execution by both parties. However, the underlying principle that the Change of Control provision embodies — that the identity, independence, and organizational posture of the counterparty are material to the agreement — is equally relevant to the threshold decision of whether MCB should execute the agreement at all in the current circumstances.

The insertion of a Change of Control provision in the draft MSA reflects the shared understanding of both parties that a change in ownership of either party is a sufficiently material event to warrant a right of termination. The parties negotiated this provision precisely because they recognized that an acquisition of Pinecrest could fundamentally alter the nature of the counterparty relationship. It would be incongruous for MCB to exercise restraint after execution (by invoking the termination right) but not before execution (by declining to sign an agreement with a vendor whose ownership is undergoing a fundamental change).

Recommendation: MCB should not execute the MSA in its current form while the Vaulton acquisition is pending. Executing the MSA and then immediately invoking the Change of Control termination right would create unnecessary complexity, potential disputes regarding the timing and effectiveness of the termination notice, and possible exposure to claims by Pinecrest (or Vaulton) that MCB acted in bad faith or breached an implied covenant of good faith and fair dealing by executing the agreement with the intention of immediately terminating it. The cleaner and more defensible course of action is to decline to execute the agreement until the implications of the acquisition have been fully assessed.

C. Status of the Four Unresolved Issues

As noted in Section II.B above, four issues remain unresolved in the MSA negotiation and were previously escalated for resolution by business principals: (1) data security standards, (2) the aggregate liability cap, (3) the termination fee, and (4) the scope and frequency of audit rights.

Each of these issues becomes significantly more consequential — and more difficult to resolve — in a post-acquisition environment in which Vaulton is the ultimate parent company and service provider:

(1) Data Security Standards. The parties had not yet agreed on the specific data security standards and compliance frameworks that Pinecrest would be required to maintain. In a post-acquisition environment, the relevant question is not merely what standards Pinecrest will maintain, but what standards Vaulton will maintain across its enterprise, how Pinecrest's security posture will be integrated into (or maintained separately from) Vaulton's broader security framework, and whether MCB will have any visibility into or control over Vaulton-level security decisions that may affect the Pinecrest environment.

(2) Liability Cap. The liability cap negotiation was focused on the aggregate dollar amount and the categories of damages subject to and excluded from the cap. In a post-acquisition scenario, MCB must consider whether the liability cap should be guaranteed by Vaulton as the parent company, and whether Pinecrest — as a subsidiary that may or may not maintain its current balance sheet — will have the financial capacity to satisfy claims up to the cap amount independently.

(3) Termination Fee. The structure and amount of the early termination fee were contested. In light of the Vaulton acquisition, the termination fee takes on new significance: MCB may wish to negotiate for a right to terminate without payment of a termination fee in the event of a Change of Control, or for a reduced termination fee that reflects the heightened risk profile of the post-acquisition relationship.

(4) Audit Rights. The scope and frequency of MCB's audit rights over Pinecrest's operations, security controls, and compliance were among the most contentious negotiation points. In a post-acquisition environment where Vaulton serves MCB's direct competitors, audit rights become a critical tool for MCB to monitor whether data isolation commitments are being honored. The current draft audit rights provisions may be insufficient for this purpose.

Negotiations on all four of these issues should be suspended immediately pending a comprehensive assessment of the implications of the Vaulton acquisition. Resuming negotiation on these points without first addressing the threshold question of whether MCB should proceed with the MSA at all would be premature and potentially counterproductive.

IV. Data Security and Confidentiality Risk Assessment

A. Nature of MCB Data at Risk

Under the proposed MSA, Pinecrest would be entrusted with hosting, managing, and processing some of MCB's most competitively sensitive business data. The scope of data that would be within Pinecrest's custody and control includes, but is not limited to, the following categories:

Trade Promotion Data. MCB's trade promotion optimization data encompasses detailed records of promotional spending patterns by retailer, promotional effectiveness analytics (including lift analysis, return on promotional investment calculations, and cannibalization modeling), and forward-looking promotional planning data. This information represents a core competitive asset for MCB: the ability to optimize trade promotion spending is a key differentiator in the consumer products industry, and MCB has invested significant resources in developing its proprietary trade promotion capabilities.

Pricing Algorithms. MCB employs proprietary algorithmic pricing models that incorporate competitive pricing intelligence, demand elasticity modeling, margin optimization, and retailer-specific pricing strategies. These algorithms are embedded within MCB's Harborline Software and Pinnacle Health IT environments, both of which would be managed by Pinecrest under the proposed MSA. If exposed to competitors, these algorithms could allow rivals to anticipate MCB's pricing decisions and respond preemptively, eroding MCB's competitive position.

Supply Chain Analytics. MCB's supply chain data includes supplier relationships and contract terms, logistics costs and carrier arrangements, inventory optimization models, demand forecasting algorithms, and manufacturing cost structures. This data is housed in MCB's enterprise systems and would be accessible through the managed IT services and cloud infrastructure that Pinecrest would be administering.

Customer Data and Sales Forecasts. MCB's Pinnacle Health IT environment contains granular customer-level data, including purchasing histories, account-level profitability analyses, pipeline forecasts, and customer segmentation models. MCB's Harborline Software environment contains detailed margin information at the product, category, and customer level, as well as sales forecasts that reflect MCB's commercial strategy and growth expectations.

In aggregate, the data that would be entrusted to Pinecrest under the proposed MSA constitutes the crown jewels of MCB's competitive intelligence. The exposure of this data to MCB's competitors — whether through intentional disclosure, inadvertent access, or systemic vulnerability — could cause material and potentially irreparable commercial harm to MCB.

B. Data Isolation Concerns Post-Acquisition

Following the closing of the Vaulton acquisition, Pinecrest will become a wholly-owned subsidiary of Vaulton. As a legal matter, Vaulton, as the sole shareholder of Pinecrest, will have the authority to direct Pinecrest's operations, access Pinecrest's systems and records, appoint and remove Pinecrest's management and board members, and integrate Pinecrest's operations into Vaulton's broader enterprise. As a practical matter, acquisitions of this nature typically result in significant operational integration, including the consolidation of IT systems, the integration of security and compliance functions, and the redeployment of personnel across the combined organization.

Even if Vaulton were to make contractual commitments regarding data isolation — for example, by agreeing to maintain logical or physical separation between MCB's data environment and the environments used to serve other Vaulton clients — the practical effectiveness of such information barriers within a single corporate group is inherently limited. Academic literature, regulatory guidance (including guidance from the SEC and financial regulators regarding information barriers in the financial services context), and practical experience all confirm that intra-organizational information barriers are imperfect and are subject to erosion through employee mobility, management reporting relationships, shared service functions (such as IT, HR, and legal), and the ordinary course pressures of corporate integration.

The risk is particularly acute in the context of a technology services provider, where the employees who manage MCB's systems and data may, after integration, also serve or interact with personnel who serve MCB's competitors. The risk is not limited to intentional or malicious disclosure; it encompasses the full spectrum of inadvertent access, inference, and competitive intelligence leakage that can occur when a single organization serves multiple competitors.

C. Contractual Protections

The draft MSA includes several provisions designed to protect MCB's data and confidential information. These provisions were negotiated with Pinecrest as an independent company with approximately $218 million in annual revenue and no existing relationships with MCB's direct competitors. The principal protections include:

SOC 2 Type II Certification. The draft MSA requires Pinecrest to maintain current SOC 2 Type II certification throughout the term of the agreement and to provide copies of its most recent SOC 2 Type II report to MCB upon request. Pinecrest's most recent SOC 2 Type II report was issued on March 15, 2023, covering the audit period from April 1, 2022 through March 31, 2023. This report was issued by Pinecrest's independent auditor and reflects Pinecrest's organizational controls, security practices, and operational environment as an independent entity. The report does not — and could not — address the post-acquisition organizational controls, data isolation measures, or integration-related risks that will arise upon completion of the Vaulton acquisition.

Annual Penetration Testing. The draft MSA requires Pinecrest to conduct annual penetration testing of its production environments and to remediate any critical or high-severity findings within specified timeframes. This requirement addresses technical vulnerabilities in Pinecrest's systems but does not address the organizational and personnel-related risks described above.

72-Hour Breach Notification. The draft MSA includes a breach notification obligation requiring Pinecrest to notify MCB within seventy-two (72) hours of discovering any actual or reasonably suspected breach of security affecting MCB's data. While this is a standard and important provision, it is reactive rather than preventive and does not address the underlying risk of competitive intelligence cross-contamination.

IP Ownership Provisions. The draft MSA provides that all MCB data remains MCB's sole and exclusive property at all times, and that all custom deliverables developed by Pinecrest specifically for MCB will be assigned to MCB upon creation and payment. These provisions establish clear ownership rights but do not prevent unauthorized access to or use of MCB's data by Vaulton personnel.

Confidentiality Obligations. The draft MSA includes mutual confidentiality obligations with a five-year post-termination survival period. However, these obligations were drafted to govern the relationship between MCB and an independent Pinecrest. They do not specifically address the risks arising from Pinecrest's integration into a larger corporate group, and they do not impose obligations directly on Vaulton as the parent company.

In summary, while the existing contractual protections in the draft MSA are reasonable for an engagement with an independent vendor, they are materially insufficient to address the enhanced risk profile presented by a post-acquisition relationship in which the service provider is owned and controlled by a company that serves MCB's direct competitors. As noted above, data security standards remained one of the four unresolved negotiation issues, underscoring the fact that even the protections currently in the draft were not fully agreed upon.

D. Insurance Considerations

The draft MSA requires Pinecrest to maintain the following minimum insurance coverage throughout the term of the agreement:

Following the closing of the Vaulton acquisition, it is typical for the acquired company's standalone insurance program to be integrated into the acquirer's corporate insurance program. This integration may result in changes to policy terms, coverage limits, carriers, and deductible or self-insured retention levels. MCB would need to verify, as a condition of any decision to proceed with the MSA, that the required coverage levels specified in the draft MSA are maintained by Pinecrest (or by Vaulton on Pinecrest's behalf) following the acquisition, and that MCB's status as an additional named insured (to the extent required by the draft MSA) is preserved under any successor insurance program. Given the potential for changes in Pinecrest's insurance arrangements, this represents an additional area of uncertainty and risk in the post-acquisition environment.

V. Competitive Overlap Analysis

A. Vaulton's Relationships with MCB Competitors

The competitive overlap between Vaulton's existing client base and MCB's competitive landscape represents, in C&H's assessment, the most significant risk factor arising from the Vaulton acquisition. Based on publicly available information and industry sources, Vaulton currently maintains active IT services relationships with at least two of MCB's most significant direct competitors:

Brightleaf Brands, Inc. Brightleaf Brands, Inc. ("Brightleaf") is a Delaware corporation and a major consumer products company with annual revenue of approximately $2.1 billion. Brightleaf competes directly with MCB in the household cleaning and personal care product categories — two of MCB's core business segments. Vaulton currently provides managed IT services to Brightleaf, the precise scope and nature of which are not publicly known but are understood to include enterprise application management and infrastructure services similar in nature to those contemplated by the proposed MCB-Pinecrest MSA.

Kessler Home & Personal Care Corp. Kessler Home & Personal Care Corp. ("Kessler") is a Delaware corporation with annual revenue of approximately $890 million. Kessler competes directly with MCB in the personal care and beauty product categories. Vaulton currently provides data analytics hosting services to Kessler, which may include services analogous to the data analytics platform hosting that Pinecrest would provide to MCB under the proposed MSA.

If MCB were to proceed with the Pinecrest MSA following the Vaulton acquisition, Vaulton would simultaneously serve MCB and two of its most significant direct competitors in the managed IT and data analytics space. This would mean that a single corporate entity — Vaulton — would have access to the proprietary trade promotion data, pricing algorithms, supply chain analytics, and customer information of MCB, Brightleaf, and Kessler. The risk of competitive intelligence cross-contamination in this environment is, in C&H's assessment, unacceptable.

B. Specific Risk Vectors

The competitive overlap described above creates several specific risk vectors that warrant detailed consideration:

Trade Promotion Optimization Data. MCB's trade promotion data — including promotional spending patterns by retailer, promotional effectiveness analytics, and forward-looking promotional plans — would be particularly valuable to Brightleaf and Kessler. In the consumer products industry, trade promotion spending represents one of the largest discretionary expenditures, and the ability to optimize trade spend is a critical competitive differentiator. If Brightleaf or Kessler were to gain access to MCB's trade promotion data, even in summary or aggregated form, they could use this intelligence to adjust their own promotional strategies, target the same retail accounts with competing promotions, and undercut MCB's promotional effectiveness. The competitive harm from such exposure would be material and difficult to quantify or remediate after the fact.

Pricing Algorithms. MCB's proprietary pricing models incorporate competitive pricing intelligence, demand elasticity modeling, retailer-specific pricing strategies, and margin optimization logic. These algorithms represent a significant investment of analytical resources and institutional knowledge. If exposed to competitors — whether directly or through the intermediation of Vaulton personnel who have access to data from multiple competing clients — MCB's pricing strategies could be anticipated and countered by Brightleaf and Kessler, resulting in margin erosion and competitive disadvantage.

Supply Chain Analytics. MCB's supply chain data, including supplier relationships, logistics costs, carrier arrangements, inventory optimization models, and manufacturing cost structures, represents another category of highly sensitive competitive intelligence. Competitors with access to this data could gain insights into MCB's cost structure, identify MCB's key suppliers, and potentially exploit this knowledge to secure competitive advantages in procurement, distribution, and inventory management.

Systemic Risk Factors. Even absent intentional sharing of competitive intelligence, the co-location of sensitive data from competing firms on the same vendor platform — or within the same corporate organization — creates risk through several systemic channels:

• Employee mobility within Vaulton. Employees who work on the MCB account may be reassigned to the Brightleaf or Kessler accounts (or vice versa), carrying with them institutional knowledge and, potentially, access credentials or data insights from their prior assignments.

• Shared infrastructure vulnerabilities. If MCB's data is hosted on infrastructure that is shared with (or accessible from) environments used to serve Brightleaf or Kessler, a security vulnerability or misconfiguration in one environment could expose data from another.

• Management reporting and oversight. Senior Vaulton personnel with oversight responsibility for the consumer products vertical may have visibility into the operations, performance metrics, and strategic priorities of multiple competing clients, enabling competitive intelligence aggregation even without access to granular data.

• Inadvertent access. Administrative errors, system misconfigurations, and human factors can result in unintended access to client data, particularly during periods of organizational change such as post-acquisition integration.

C. Contractual Mitigation Limitations

C&H has considered whether contractual protections could adequately mitigate the competitive overlap risks described above and has concluded that, while contractual measures can reduce risk, they cannot eliminate it and may not provide sufficient practical protection in a multi-competitor-client environment.

Non-Disclosure and Confidentiality Provisions. The mutual non-disclosure and confidentiality provisions in the draft MSA were negotiated with Pinecrest as an independent entity. These provisions obligate Pinecrest to maintain the confidentiality of MCB's data and to restrict access to personnel with a need to know. However, in a post-acquisition environment, the definition of "personnel with a need to know" may expand to include Vaulton employees involved in integration, oversight, compliance, and management reporting. Furthermore, the confidentiality obligations run to Pinecrest as the contracting party; they do not directly bind Vaulton as the parent company. While Pinecrest's obligations would survive the Change of Control, the practical enforceability of confidentiality provisions against an entity that is wholly controlled by the party whose conduct is in question is inherently limited.

Non-Solicitation Clause. The draft MSA includes a mutual twelve (12) month non-solicitation clause restricting either party from soliciting or hiring the other party's employees who are directly involved in the delivery or receipt of services under the agreement. This provision would provide limited protection against the redeployment of Pinecrest personnel who have worked on the MCB account to roles serving Brightleaf or Kessler. However, the restriction is limited to twelve months in duration and applies only to "solicitation" — it would not prevent Vaulton from reassigning Pinecrest employees to other client accounts within Vaulton's organization after the restriction period expires, or from using the institutional knowledge acquired by those employees in connection with services provided to MCB's competitors.

Audit Rights. Audit rights — one of the four unresolved negotiation issues — take on heightened importance in a multi-client environment where the vendor serves competitors. In theory, robust audit rights could allow MCB to verify that data isolation commitments are being honored, that access controls are functioning as intended, and that MCB's data has not been accessed by unauthorized personnel. In practice, however, the audit rights as currently drafted in the near-final MSA may be insufficient for this purpose. The current draft contemplates annual audits conducted during business hours with reasonable advance notice, which may not provide the real-time visibility needed to detect competitive intelligence leakage. Moreover, auditing a subsidiary of a large enterprise technology company raises practical complications regarding the scope of the audit (e.g., whether MCB can audit Vaulton-level systems and controls) and the ability to obtain meaningful cooperation from Vaulton personnel who are not direct parties to the MSA.

C&H intends to address the question of whether enhanced contractual protections could adequately mitigate these risks in the more detailed competitive overlap memorandum referenced in Section VIII below. However, based on our preliminary assessment, it is our view that no set of contractual provisions can fully eliminate the competitive intelligence risks arising from a vendor relationship in which the vendor's parent company simultaneously serves two or more of MCB's direct competitors in categories of direct competitive overlap.

VI. Preliminary Antitrust and Regulatory Considerations

C&H notes, on a preliminary basis, that the Vaulton acquisition of Pinecrest may itself be subject to regulatory review under applicable antitrust and competition laws. Given the reported $685 million transaction value, the acquisition almost certainly exceeds the filing thresholds established under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended (the "HSR Act"), and may require pre-closing notification to the Federal Trade Commission and the Department of Justice Antitrust Division. The parties to the acquisition may also be subject to review by state attorneys general, foreign competition authorities (to the extent either party has operations or revenue outside the United States), or sector-specific regulators.

MCB is not a party to the Vaulton-Pinecrest acquisition and has no standing to challenge or seek to block the transaction. However, MCB should monitor any regulatory conditions, remedies, or consent decrees that may be imposed in connection with the acquisition, as such conditions could affect Pinecrest's ability to serve existing or prospective clients, the organizational structure of the combined entity, or the data isolation and client-separation measures that Vaulton may be required to implement. If regulatory authorities impose conditions that restrict Vaulton's ability to serve competing clients in the same industry vertical, those conditions could have direct relevance to MCB's analysis of whether to proceed with the MSA.

C&H recommends conducting a more detailed competitive overlap and antitrust analysis addressing these considerations in greater depth. This analysis will be provided in a separate memorandum, as discussed in Section VIII below.

VII. Impact on MCB's IT Services Strategy

A. Incumbent Vendor Fallback

A significant mitigating factor in the current situation is that MCB currently maintains an active, ongoing IT services arrangement with its incumbent vendor, Corwyn Technology Services LLC ("Corwyn"). MCB's relationship with Corwyn is governed by a legacy IT services agreement dated March 1, 2020, which has been extended on a month-to-month basis following the expiration of its initial term. Under this arrangement, Corwyn continues to provide cloud infrastructure management, managed IT services, enterprise application support, and cybersecurity monitoring to MCB at an annual cost of $3,150,000.

This arrangement provides operational continuity for MCB and eliminates any immediate risk to MCB's IT operations from a decision to pause or terminate the Pinecrest negotiations. MCB is not in a position where it must execute the Pinecrest MSA to avoid a gap in IT service coverage; rather, MCB can continue to operate under the Corwyn arrangement for as long as necessary while it evaluates the implications of the Vaulton acquisition and determines its preferred path forward.

The cost differential between the Corwyn arrangement ($3,150,000 per year) and the proposed Pinecrest MSA ($2,950,000 per year) is $200,000 per year, representing a total differential of approximately $1,000,000 over the five-year initial term. While the Pinecrest MSA would have yielded meaningful cost savings, these savings must be weighed against the competitive risks identified in this memorandum. In C&H's assessment, the potential competitive harm from proceeding with the Pinecrest MSA in a post-acquisition environment — including the risk of exposure of MCB's trade promotion data, pricing algorithms, and supply chain analytics to direct competitors — far exceeds the $200,000 annual cost advantage of the Pinecrest arrangement. A single competitive intelligence breach could cause harm measured in orders of magnitude beyond the cost savings at stake.

B. No Data Migration or Transition-Out Risk

Because the MSA has not been executed and no services have commenced, MCB is in the advantageous position of having no data or systems currently hosted, managed, or controlled by Pinecrest. No data migration has occurred. No systems integration has been performed. No MCB data resides in Pinecrest's environment. No transition-out plan needs to be developed or executed.

This is a significant practical advantage that would not exist if MCB were to execute the MSA, begin the onboarding and data migration process, and subsequently invoke the Change of Control termination right. In that scenario, MCB would face the operational complexity and cost of transitioning its data and systems back to Corwyn or to an alternative vendor, including the risk of service disruption during the transition period. By acting now — before execution — MCB avoids all of these complications entirely.

The absence of transition-out risk also means that MCB can take a deliberate and measured approach to evaluating its options. There is no operational urgency that would compel MCB to make a hasty decision. MCB can afford to conduct a thorough assessment of the competitive overlap risks, evaluate whether enhanced contractual protections could provide adequate mitigation, explore alternative vendor options (including potentially re-opening the RFP process), and consult with Ashford Capital on the strategic implications — all without any adverse impact on MCB's day-to-day IT operations.

VIII. Recommended Next Steps

Based on the foregoing analysis, C&H recommends the following immediate and near-term actions:

1. Immediate Pause of Negotiations. MCB should not proceed with any further negotiation sessions, draft exchanges, business principal escalation meetings, or other activities related to the MSA with Pinecrest or its outside counsel, Dunleavy, Proctor & Hale LLP, until the implications of the Vaulton acquisition have been fully assessed and a deliberate strategic decision has been reached. This includes suspending any internal preparations for the business principal escalation meeting that was contemplated for resolution of the four remaining open issues. MCB should communicate the pause decision promptly and clearly to all internal stakeholders, including Meg Thornbury (Senior Vice President, Operations) and Priya Chandrasekaran (Vice President, Information Technology), to ensure that no informal communications with Pinecrest personnel proceed in parallel.

2. Formal Communication to Pinecrest's Counsel. C&H recommends sending a formal letter to Carolyn Ostrowski, lead partner at Dunleavy, Proctor & Hale LLP, notifying Pinecrest that MCB is pausing the MSA negotiation pending its assessment of the recently announced Vaulton acquisition and its implications for the proposed engagement. The letter should be drafted in measured and professional terms, without prejudging the outcome of MCB's assessment, but should clearly convey that MCB considers the change-of-ownership event to be a material development warranting careful review before any further progress toward execution. C&H is prepared to draft this letter upon MCB's authorization and to circulate a draft for MCB's review promptly upon receipt of instructions to proceed.

3. Internal Strategy Call. MCB management and Ashford Capital personnel should convene an internal strategy call at the earliest practicable opportunity to discuss the path forward. Recommended participants include David Halverston (General Counsel), Meg Thornbury (Senior Vice President, Operations), Priya Chandrasekaran (Vice President, Information Technology), Karen Lau (Operating Partner, Ashford Capital), and Vincent Driscoll (Managing Partner, Ashford Capital). C&H is available to participate in this call to present the findings of this memorandum and respond to questions. The agenda for the strategy call should include a discussion of the three principal options available to MCB:

(a) Terminate the MSA process entirely. MCB could elect to terminate the negotiation with Pinecrest and either continue with Corwyn under the existing month-to-month arrangement or re-open the IT managed services RFP process to identify an alternative vendor that does not present the competitive overlap concerns identified herein.

(b) Seek enhanced contractual protections and proceed. MCB could, following a detailed assessment, determine that enhanced contractual protections — such as data isolation covenants, Vaulton parent guarantees, expanded audit rights, named personnel restrictions, escrow arrangements for MCB data, and contractual prohibitions on the redeployment of MCB account personnel to competitor accounts — could adequately mitigate the identified risks and elect to resume negotiations on that basis. C&H would advise caution with this approach, as described in Section V.C above, but acknowledges that it represents a potential path forward if the enhanced protections are sufficiently robust and enforceable.

(c) Re-open the RFP process with alternative vendors. MCB could issue a new or supplemental RFP to identify alternative IT managed services vendors that do not present the competitive overlap concerns associated with Vaulton. This approach would involve additional time and cost but would address the competitive intelligence risks at their source.

4. Detailed Competitive Overlap Analysis. C&H will prepare a comprehensive memorandum analyzing the competitive overlap, data isolation risks, and antitrust considerations arising from the Vaulton acquisition in greater detail than is provided in this initial alert memorandum. The detailed memorandum will include an assessment of: (i) the full scope of Vaulton's existing client relationships in the consumer products sector; (ii) the specific categories of data and competitive intelligence at risk; (iii) the feasibility and limitations of contractual mitigation measures, including data isolation covenants, audit rights, and personnel restrictions; (iv) any regulatory conditions or remedies that may be imposed on the Vaulton-Pinecrest acquisition; and (v) a comparative analysis of the costs and benefits of the three strategic options described above. C&H anticipates delivering this memorandum within one week, by approximately October 20, 2023.

5. Communication with Ashford Capital. Given that Ashford Capital Partners Fund IV, LP (through its general partner, Ashford Capital Management LLC) exercises oversight responsibility for MCB and has a fiduciary interest in MCB's strategic decisions, Karen Lau (Operating Partner) and Vincent Driscoll (Managing Partner) should be apprised of this development and consulted on the strategic decision at the earliest opportunity. The Vaulton acquisition represents a material change in the landscape surrounding a significant commercial commitment (the MSA has a total contract value of $14,750,000 over five years), and Ashford Capital's input and concurrence should be obtained before MCB determines its course of action. C&H is prepared to arrange a briefing call with Ashford Capital if MCB so requests.

6. Preservation of Rights. MCB should expressly reserve all rights in any communication with Pinecrest, DPH, or any other party in connection with this matter. This includes, without limitation, the right to terminate the negotiation process entirely, the right to re-open discussions with alternative vendors, and the right to invoke any applicable provision of the draft MSA (including the Change of Control provision) in the event that the MSA is ultimately executed. No communication from MCB or C&H should be construed or characterized as a commitment to proceed with the MSA, a waiver of any right or remedy, or an acknowledgment of any obligation to Pinecrest.

IX. Conclusion

The Vaulton acquisition of Pinecrest fundamentally alters the risk profile of the proposed Master Services Agreement. What was a straightforward engagement with a mid-size, independent IT services vendor has become, through no action of MCB, a potential engagement with a subsidiary of one of the largest enterprise technology companies in the United States — a company that simultaneously serves two of MCB's most significant direct competitors.

The identity of the ultimate service provider matters. Pinecrest Digital Solutions Inc., as an independent company with $218 million in annual revenue, no relationships with MCB's competitors, and a focused commitment to serving its own client base, presents a fundamentally different counterparty than Pinecrest as a wholly-owned subsidiary of Vaulton Technologies Group, Inc., a $4.7 billion enterprise technology company with existing engagements with Brightleaf Brands, Inc. and Kessler Home & Personal Care Corp. The risk of competitive intelligence cross-contamination — through employee mobility, shared infrastructure, management oversight, or inadvertent access — is material and cannot be fully eliminated through contractual protections alone.

The Change of Control provision in the draft MSA reflects the parties' shared recognition that a change in ownership of either party is a material event warranting a right of termination. The principle underlying that provision — that the identity, independence, and organizational posture of the counterparty are material to the relationship — applies with even greater force to the decision of whether to execute the MSA in the first instance. MCB should not knowingly enter into a long-term, high-value IT services engagement with a vendor whose ownership, organizational structure, and competitive landscape are undergoing a fundamental transformation.

C&H is available to discuss this memorandum with MCB at its earliest convenience and stands ready to implement whichever course of action MCB determines is appropriate. We are prepared to draft the formal communication to Pinecrest's counsel, participate in the internal strategy call, brief Ashford Capital, and deliver the detailed competitive overlap memorandum within the timeframe described above.

CONFIDENTIALITY NOTICE: This memorandum is a privileged and confidential attorney-client communication of Calderwood & Harkness LLP. It has been prepared at the request of and for the exclusive use of Meridian Consumer Brands LLC and is protected by the attorney-client privilege and the work product doctrine. This memorandum is intended solely for the use of the addressees identified above and should not be disclosed, distributed, or shared with any third party without the prior written consent of Calderwood & Harkness LLP. If you have received this memorandum in error, please notify the sender immediately and destroy all copies.

CALDERWOOD & HARKNESS LLP

By: ________

Elaine Forsythe Partner eforsythe@calderwoodharkness.com

By: ________

Garrett Simmons Senior Associate gsimmons@calderwoodharkness.com

Calderwood & Harkness LLP 125 Park Avenue, 34th Floor New York, NY 10017

Service Category	Annual Cost
Cloud Infrastructure Management	$1,200,000
Managed IT Services	$825,000
Enterprise Application Support (Harborline Software, Pinnacle Health IT)	$575,000
Cybersecurity Monitoring & Incident Response	$350,000
Total Annual Contract Value	$2,950,000
Policy Type	Required Coverage
Technology Errors & Omissions / Cyber Liability	$10,000,000 per occurrence / aggregate
Commercial General Liability	$5,000,000 per occurrence / aggregate
Workers' Compensation	$2,000,000 (statutory minimum or as required by law)

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
CALDERWOOD & HARKNESS LLP 125 Park Avenue, 34th Floor New York, NY 10017
Date: October 13, 2023
MEMORANDUM
To: David Halverston, General Counsel, Meridian Consumer Brands LLC Priya Chandrasekaran, Vice President, Information Technology, Meridian Consumer Brands LLC
From: Elaine Forsythe, Partner, Calderwood & Harkness LLP Garrett Simmons, Senior Associate, Calderwood & Harkness LLP
Re: Announced Acquisition of Pinecrest Digital Solutions Inc. by Vaulton Technologies Group, Inc. — Change-of-Control Implications for Proposed Master Services Agreement (MSA-PDS-MCB-2023)
Matter No.: 1011-00008 Client No.: 71982
I. Purpose and Executive Summary
This memorandum is being delivered on an expedited basis to alert Meridian Consumer Brands LLC ("MCB") to a material development that directly affects the Master Services Agreement currently under negotiation between MCB and Pinecrest Digital Solutions Inc. ("Pinecrest"). The development requires immediate attention and, in our view, warrants an immediate pause of all ongoing negotiation activity.
On October 12, 2023, Vaulton Technologies Group, Inc. ("Vaulton"), a Delaware corporation headquartered at 1400 Peachtree Road NE, Suite 3100, Atlanta, GA 30309, publicly announced that it has entered into a definitive agreement to acquire Pinecrest for a reported purchase price of approximately $685 million in an all-cash transaction. Stonebridge Advisory Group LLC, based at 200 Clarendon Street, 50th Floor, Boston, MA 02116, is serving as Vaulton's financial advisor in connection with the acquisition. While the precise closing timeline has not been confirmed, publicly available reporting and market commentary suggest that the transaction is expected to close in the near term — a matter of weeks rather than months.
This memorandum alerts MCB to the immediate implications of this development for the Master Services Agreement designated as MSA-PDS-MCB-2023, which has been under active negotiation between MCB and Pinecrest since early August 2023 and which, as of the date of this memorandum, remains unexecuted with four substantive issues still unresolved. The memorandum addresses three principal areas of concern:
(1) MCB's Contractual Rights Under the Change-of-Control Provision in the Draft MSA. The draft MSA includes a Change of Control provision that would afford MCB a termination right in the event of a change in ownership of Pinecrest. While this provision is not yet operative because the MSA has not been executed, the underlying policy rationale — that the identity of the counterparty is a material consideration — applies with equal or greater force to the threshold question of whether MCB should execute the agreement at all.
(2) Data Security and Confidentiality Risks. Under the proposed MSA, Pinecrest would host and manage some of MCB's most competitively sensitive data, including trade promotion information, pricing algorithms, and supply chain analytics. Following the acquisition, Vaulton would have the legal authority and practical ability to access Pinecrest's systems, personnel, and client data, creating significant new risk vectors that the current draft MSA does not adequately address.
(3) Competitive Overlap Concerns. Vaulton currently maintains IT services relationships with at least two of MCB's most significant direct competitors — Brightleaf Brands, Inc. and Kessler Home & Personal Care Corp. If MCB were to proceed with the Pinecrest MSA post-acquisition, Vaulton would simultaneously serve MCB and these competitors, creating an unacceptable risk of competitive intelligence cross-contamination, whether through intentional sharing, employee mobility, shared infrastructure, or inadvertent access.
Recommendation: Based on the analysis set forth in this memorandum, Calderwood & Harkness LLP ("C&H") strongly recommends that MCB immediately pause all MSA negotiations with Pinecrest and its outside counsel, Dunleavy, Proctor & Hale LLP, pending a comprehensive assessment of the Vaulton acquisition and its implications for MCB's IT services strategy. MCB should not execute the MSA in its current form, and no further draft exchanges, negotiation calls, or business principal escalation meetings should be scheduled until a deliberate strategic decision has been reached. C&H is prepared to assist MCB in implementing this recommendation and in evaluating the available paths forward, as described in detail in Section VIII of this memorandum.
II. Background
A. The Parties and the Proposed MSA
Meridian Consumer Brands LLC. MCB is a Delaware limited liability company headquartered at 680 Fifth Avenue, 22nd Floor, New York, NY 10019. MCB is a consumer products and retail company with reported fiscal year 2022 revenue of approximately $1.34 billion. MCB's product portfolio spans household cleaning products, personal care items, and beauty and wellness brands distributed through major retail channels and direct-to-consumer e-commerce platforms across the United States. MCB is a portfolio company of Ashford Capital Partners Fund IV, LP, a private equity fund with approximately $3.8 billion in committed capital (2018 vintage), which acquired MCB in 2019. Ashford Capital Management LLC serves as the general partner of Fund IV and exercises oversight responsibility for MCB's strategic direction and significant commercial commitments. Key personnel at Ashford Capital with involvement in MCB matters include Karen Lau, Operating Partner, and Vincent Driscoll, Managing Partner.
Pinecrest Digital Solutions Inc. Pinecrest is a Delaware corporation headquartered at 2300 Lakewood Boulevard, Suite 400, Durham, NC 27713. Founded in 2016, Pinecrest is an information technology services vendor that has grown rapidly to approximately 1,100 employees and reported fiscal year 2022 revenue of approximately $218 million. Pinecrest's Chief Executive Officer is Nathan Whitford, and its General Counsel is Rina Balakrishnan. Pinecrest provides a suite of IT services to mid-market and enterprise clients, including cloud infrastructure management, managed IT services, enterprise application support (with particular expertise in Harborline Software and Pinnacle Health IT implementations), cybersecurity monitoring and incident response, and data analytics platform hosting. Pinecrest was selected by MCB as its preferred vendor following a competitive request-for-proposal process, as described in Section II.B below.
The Proposed MSA. The MSA under negotiation (designated MSA-PDS-MCB-2023) contemplates a comprehensive IT managed services engagement in which Pinecrest would serve as MCB's primary IT services provider, replacing MCB's incumbent vendor arrangement. The scope of services, commercial terms, and negotiation history are described in Sections II.B and II.C below.
B. Negotiation History and Current Status
The negotiation history of the proposed MSA is as follows:
•  June 12, 2023: MCB issued a formal request for proposal (designated MCB-IT-RFP-2023-006) for IT managed services, soliciting proposals from multiple vendors, including Pinecrest. The RFP encompassed cloud infrastructure management, managed IT operations, enterprise application support, cybersecurity monitoring, and data analytics hosting.
•  July 10, 2023: Following an evaluation of the proposals received, MCB selected Pinecrest as its preferred vendor based on a combination of technical capability, cost competitiveness, cultural fit, and Pinecrest's track record of delivering managed services to mid-market consumer brands.
•  July 25, 2023: MCB formally engaged C&H to serve as outside counsel for the MSA negotiation. C&H opened the engagement and was asked to prepare an initial draft of the MSA for MCB's review.
•  August 4, 2023: C&H delivered its first draft of the MSA to MCB's legal team. The draft reflected MCB's standard positions on key commercial and risk-allocation provisions, including data security, intellectual property ownership, liability allocation, indemnification, audit rights, and termination.
•  August 11, 2023: MCB consolidated internal business and technical comments from Priya Chandrasekaran's IT team and David Halverston's legal team, and the marked draft was transmitted to Pinecrest for its review and comment.
•  August 25, 2023: Dunleavy, Proctor & Hale LLP ("DPH"), Pinecrest's outside counsel, returned its first redline of the MSA. The lead DPH partner on the engagement is Carolyn Ostrowski. DPH's redline contained forty-seven (47) substantive comments and proposed revisions spanning the key risk-allocation provisions, including significant pushback on MCB's proposed positions regarding data security standards, the liability cap structure, the termination fee, and the scope of MCB's audit rights.
•  September 8, 2023: The first negotiation call between C&H and DPH took place, attended by David Halverston and Rina Balakrishnan as well as business representatives from both parties. This call resolved twenty-nine (29) of the forty-seven (47) open issues identified in DPH's initial redline, representing substantial progress on a range of mid-tier provisions.
•  September 15, 2023: C&H circulated a revised draft of the MSA reflecting the resolutions reached on the September 8 negotiation call. The revised draft narrowed the open issues to eighteen (18).
•  September 22, 2023: DPH returned a second redline further addressing the remaining open items. This redline reflected movement on several provisions and reduced the universe of truly contested issues to twelve (12).
•  September 29, 2023: A second negotiation call between C&H and DPH resolved eight (8) of the twelve (12) remaining issues, leaving four (4) issues still unresolved.
•  October 6, 2023: C&H circulated a near-final draft of the MSA incorporating all resolutions reached through the two negotiation calls. The draft was designated as "near-final" subject to resolution of the four remaining open issues, which the parties agreed would be escalated to business principals (MCB's Meg Thornbury, Senior Vice President of Operations, and Pinecrest's Nathan Whitford) for resolution. Those four unresolved issues are: (1) the applicable data security standards and compliance obligations; (2) the aggregate liability cap applicable to Pinecrest; (3) the structure and amount of the early termination fee; and (4) the scope and frequency of MCB's audit rights over Pinecrest's operations and controls.
As of the date of this memorandum, no MSA has been executed. The agreement remains in draft form, and the business principal escalation meeting has not yet been scheduled. This is a critically important fact: MCB has no binding contractual commitment to Pinecrest, and the decision whether to proceed with execution rests entirely with MCB.
C. Key Commercial Terms of the Proposed MSA
The principal commercial terms reflected in the near-final draft of the MSA are summarized below:
Term: The proposed MSA contemplates an initial term of five (5) years, commencing November 1, 2023 and continuing through October 31, 2028, with one (1) optional two-year renewal period exercisable by MCB upon written notice delivered no later than one hundred eighty (180) days prior to the expiration of the initial term.
Total Contract Value: The total contract value over the initial five-year term is $14,750,000.
Annual Contract Value: The annual contract value is $2,950,000, allocated among the following service categories:
Payment Terms: Net 45 from invoice date, with payments due quarterly in advance.
Incumbent Vendor Comparison: The proposed MSA would replace MCB's existing IT managed services arrangement with Corwyn Technology Services LLC ("Corwyn"), which currently provides comparable services at an annual cost of $3,150,000 per year. The Pinecrest engagement would therefore yield an annual cost saving of approximately $200,000 relative to the Corwyn arrangement, representing a total estimated savings of $1,000,000 over the five-year initial term.
D. The Vaulton Acquisition Announcement
On October 12, 2023, Vaulton Technologies Group, Inc. publicly announced that it has entered into a definitive agreement to acquire 100% of the outstanding equity of Pinecrest Digital Solutions Inc. for a reported purchase price of approximately $685 million.
The key facts of the announced acquisition are as follows:
•  Date of Announcement: October 12, 2023.
•  Acquirer: Vaulton Technologies Group, Inc., a Delaware corporation headquartered at 1400 Peachtree Road NE, Suite 3100, Atlanta, GA 30309. Vaulton is a major enterprise technology and IT services provider with fiscal year 2022 revenue of approximately $4.7 billion. Vaulton's Chief Executive Officer is Robert "Rob" Castellano. Vaulton's service offerings include enterprise IT outsourcing, cloud computing, cybersecurity, digital transformation consulting, and managed infrastructure services. Vaulton serves a broad base of clients across industries, including consumer products, financial services, healthcare, and manufacturing.
•  Target: Pinecrest Digital Solutions Inc.
•  Reported Acquisition Price: Approximately $685 million.
•  Financial Advisor to Vaulton: Stonebridge Advisory Group LLC, 200 Clarendon Street, 50th Floor, Boston, MA 02116.
•  Expected Closing: The parties to the acquisition have not publicly disclosed a definitive closing date. However, based on publicly available reporting and market commentary, the transaction is expected to close in the near term. Market analysts have indicated that the transaction is anticipated to close within several weeks rather than months, subject to satisfaction of customary closing conditions, including any required regulatory approvals. C&H has not had any direct communication with Vaulton, Pinecrest, or their respective advisors regarding the acquisition timeline, and the foregoing is based solely on publicly available information.
The acquisition announcement was not preceded by any disclosure from Pinecrest or DPH to MCB or C&H during the MSA negotiation process. C&H has not confirmed whether Pinecrest was subject to any confidentiality or standstill obligations that would have precluded such disclosure, but the lack of advance notice is noteworthy in the context of an active commercial negotiation in which the identity and independence of the vendor was a material consideration for MCB.
III. Analysis of Change-of-Control Provision in Draft MSA
A. Relevant Contract Language
The near-final draft of MSA-PDS-MCB-2023 includes a Change of Control provision that was the subject of negotiation between C&H and DPH and has been agreed upon in principle by the parties. The provision, as reflected in the October 6, 2023 near-final draft, is located in Section 14.3 of the MSA and provides, in relevant part, as follows:
Section 14.3 — Change of Control. In the event that either Party undergoes a Change of Control (as defined herein), the other Party may, at its sole option, terminate this Agreement upon written notice delivered to the Party undergoing the Change of Control within thirty (30) days following the date on which the terminating Party first receives written notice of, or otherwise becomes aware of, the Change of Control event (the "Change of Control Notice Period"). Termination pursuant to this Section 14.3 shall be effective thirty (30) days following delivery of the termination notice (the "Change of Control Termination Date"), and neither Party shall have any liability to the other Party on account of such termination, except with respect to obligations accrued prior to the Change of Control Termination Date, including without limitation the payment of fees for Services rendered through the Change of Control Termination Date.
The draft MSA defines "Change of Control" in Section 1.7 as follows:
"Change of Control" means, with respect to a Party, the occurrence of any of the following events: (a) any merger, consolidation, or other business combination transaction in which such Party is not the surviving entity, or in which such Party is the surviving entity but the holders of equity interests in such Party immediately prior to the transaction hold less than fifty percent (50%) of the voting power of the surviving entity immediately following the transaction; (b) the acquisition by any Person or "group" (within the meaning of Section 13(d)(3) of the Securities Exchange Act of 1934, as amended) of direct or indirect beneficial ownership of more than fifty percent (50%) of the outstanding equity interests or voting securities of such Party; (c) the sale, transfer, assignment, or other disposition of all or substantially all of the assets of such Party; or (d) the dissolution or liquidation of such Party.
B. MCB's Termination Right
The application of the Change of Control provision to the Vaulton acquisition is straightforward. Vaulton's acquisition of 100% of Pinecrest's outstanding equity falls squarely within clause (b) of the Change of Control definition — and, depending on the structure of the transaction, may also satisfy clause (a) if the acquisition is structured as a merger in which Pinecrest is merged into a Vaulton subsidiary. In either case, the Vaulton acquisition would unambiguously constitute a "Change of Control" of Pinecrest under the draft MSA.
If the MSA were to be executed prior to the closing of the Vaulton acquisition, MCB would have a thirty (30) day window from the date on which MCB first becomes aware of the Change of Control event to exercise its right to terminate the MSA without penalty. Conversely, if the acquisition closes before the MSA is executed, the Change of Control provision would have no operative effect — but the Change of Control would have already occurred, and MCB would be entering into an agreement with a party that is, by that point, a wholly-owned subsidiary of Vaulton.
This leads to a critical practical distinction: the MSA has not been executed. The Change of Control clause, like all other provisions of the draft MSA, is not yet operative and would only become binding upon execution by both parties. However, the underlying principle that the Change of Control provision embodies — that the identity, independence, and organizational posture of the counterparty are material to the agreement — is equally relevant to the threshold decision of whether MCB should execute the agreement at all in the current circumstances.
The insertion of a Change of Control provision in the draft MSA reflects the shared understanding of both parties that a change in ownership of either party is a sufficiently material event to warrant a right of termination. The parties negotiated this provision precisely because they recognized that an acquisition of Pinecrest could fundamentally alter the nature of the counterparty relationship. It would be incongruous for MCB to exercise restraint after execution (by invoking the termination right) but not before execution (by declining to sign an agreement with a vendor whose ownership is undergoing a fundamental change).
Recommendation: MCB should not execute the MSA in its current form while the Vaulton acquisition is pending. Executing the MSA and then immediately invoking the Change of Control termination right would create unnecessary complexity, potential disputes regarding the timing and effectiveness of the termination notice, and possible exposure to claims by Pinecrest (or Vaulton) that MCB acted in bad faith or breached an implied covenant of good faith and fair dealing by executing the agreement with the intention of immediately terminating it. The cleaner and more defensible course of action is to decline to execute the agreement until the implications of the acquisition have been fully assessed.
C. Status of the Four Unresolved Issues
As noted in Section II.B above, four issues remain unresolved in the MSA negotiation and were previously escalated for resolution by business principals: (1) data security standards, (2) the aggregate liability cap, (3) the termination fee, and (4) the scope and frequency of audit rights.
Each of these issues becomes significantly more consequential — and more difficult to resolve — in a post-acquisition environment in which Vaulton is the ultimate parent company and service provider:
(1) Data Security Standards. The parties had not yet agreed on the specific data security standards and compliance frameworks that Pinecrest would be required to maintain. In a post-acquisition environment, the relevant question is not merely what standards Pinecrest will maintain, but what standards Vaulton will maintain across its enterprise, how Pinecrest's security posture will be integrated into (or maintained separately from) Vaulton's broader security framework, and whether MCB will have any visibility into or control over Vaulton-level security decisions that may affect the Pinecrest environment.
(2) Liability Cap. The liability cap negotiation was focused on the aggregate dollar amount and the categories of damages subject to and excluded from the cap. In a post-acquisition scenario, MCB must consider whether the liability cap should be guaranteed by Vaulton as the parent company, and whether Pinecrest — as a subsidiary that may or may not maintain its current balance sheet — will have the financial capacity to satisfy claims up to the cap amount independently.
(3) Termination Fee. The structure and amount of the early termination fee were contested. In light of the Vaulton acquisition, the termination fee takes on new significance: MCB may wish to negotiate for a right to terminate without payment of a termination fee in the event of a Change of Control, or for a reduced termination fee that reflects the heightened risk profile of the post-acquisition relationship.
(4) Audit Rights. The scope and frequency of MCB's audit rights over Pinecrest's operations, security controls, and compliance were among the most contentious negotiation points. In a post-acquisition environment where Vaulton serves MCB's direct competitors, audit rights become a critical tool for MCB to monitor whether data isolation commitments are being honored. The current draft audit rights provisions may be insufficient for this purpose.
Negotiations on all four of these issues should be suspended immediately pending a comprehensive assessment of the implications of the Vaulton acquisition. Resuming negotiation on these points without first addressing the threshold question of whether MCB should proceed with the MSA at all would be premature and potentially counterproductive.
IV. Data Security and Confidentiality Risk Assessment
A. Nature of MCB Data at Risk
Under the proposed MSA, Pinecrest would be entrusted with hosting, managing, and processing some of MCB's most competitively sensitive business data. The scope of data that would be within Pinecrest's custody and control includes, but is not limited to, the following categories:
Trade Promotion Data. MCB's trade promotion optimization data encompasses detailed records of promotional spending patterns by retailer, promotional effectiveness analytics (including lift analysis, return on promotional investment calculations, and cannibalization modeling), and forward-looking promotional planning data. This information represents a core competitive asset for MCB: the ability to optimize trade promotion spending is a key differentiator in the consumer products industry, and MCB has invested significant resources in developing its proprietary trade promotion capabilities.
Pricing Algorithms. MCB employs proprietary algorithmic pricing models that incorporate competitive pricing intelligence, demand elasticity modeling, margin optimization, and retailer-specific pricing strategies. These algorithms are embedded within MCB's Harborline Software and Pinnacle Health IT environments, both of which would be managed by Pinecrest under the proposed MSA. If exposed to competitors, these algorithms could allow rivals to anticipate MCB's pricing decisions and respond preemptively, eroding MCB's competitive position.
Supply Chain Analytics. MCB's supply chain data includes supplier relationships and contract terms, logistics costs and carrier arrangements, inventory optimization models, demand forecasting algorithms, and manufacturing cost structures. This data is housed in MCB's enterprise systems and would be accessible through the managed IT services and cloud infrastructure that Pinecrest would be administering.
Customer Data and Sales Forecasts. MCB's Pinnacle Health IT environment contains granular customer-level data, including purchasing histories, account-level profitability analyses, pipeline forecasts, and customer segmentation models. MCB's Harborline Software environment contains detailed margin information at the product, category, and customer level, as well as sales forecasts that reflect MCB's commercial strategy and growth expectations.
In aggregate, the data that would be entrusted to Pinecrest under the proposed MSA constitutes the crown jewels of MCB's competitive intelligence. The exposure of this data to MCB's competitors — whether through intentional disclosure, inadvertent access, or systemic vulnerability — could cause material and potentially irreparable commercial harm to MCB.
B. Data Isolation Concerns Post-Acquisition
Following the closing of the Vaulton acquisition, Pinecrest will become a wholly-owned subsidiary of Vaulton. As a legal matter, Vaulton, as the sole shareholder of Pinecrest, will have the authority to direct Pinecrest's operations, access Pinecrest's systems and records, appoint and remove Pinecrest's management and board members, and integrate Pinecrest's operations into Vaulton's broader enterprise. As a practical matter, acquisitions of this nature typically result in significant operational integration, including the consolidation of IT systems, the integration of security and compliance functions, and the redeployment of personnel across the combined organization.
Even if Vaulton were to make contractual commitments regarding data isolation — for example, by agreeing to maintain logical or physical separation between MCB's data environment and the environments used to serve other Vaulton clients — the practical effectiveness of such information barriers within a single corporate group is inherently limited. Academic literature, regulatory guidance (including guidance from the SEC and financial regulators regarding information barriers in the financial services context), and practical experience all confirm that intra-organizational information barriers are imperfect and are subject to erosion through employee mobility, management reporting relationships, shared service functions (such as IT, HR, and legal), and the ordinary course pressures of corporate integration.
The risk is particularly acute in the context of a technology services provider, where the employees who manage MCB's systems and data may, after integration, also serve or interact with personnel who serve MCB's competitors. The risk is not limited to intentional or malicious disclosure; it encompasses the full spectrum of inadvertent access, inference, and competitive intelligence leakage that can occur when a single organization serves multiple competitors.
C. Contractual Protections
The draft MSA includes several provisions designed to protect MCB's data and confidential information. These provisions were negotiated with Pinecrest as an independent company with approximately $218 million in annual revenue and no existing relationships with MCB's direct competitors. The principal protections include:
SOC 2 Type II Certification. The draft MSA requires Pinecrest to maintain current SOC 2 Type II certification throughout the term of the agreement and to provide copies of its most recent SOC 2 Type II report to MCB upon request. Pinecrest's most recent SOC 2 Type II report was issued on March 15, 2023, covering the audit period from April 1, 2022 through March 31, 2023. This report was issued by Pinecrest's independent auditor and reflects Pinecrest's organizational controls, security practices, and operational environment as an independent entity. The report does not — and could not — address the post-acquisition organizational controls, data isolation measures, or integration-related risks that will arise upon completion of the Vaulton acquisition.
Annual Penetration Testing. The draft MSA requires Pinecrest to conduct annual penetration testing of its production environments and to remediate any critical or high-severity findings within specified timeframes. This requirement addresses technical vulnerabilities in Pinecrest's systems but does not address the organizational and personnel-related risks described above.
72-Hour Breach Notification. The draft MSA includes a breach notification obligation requiring Pinecrest to notify MCB within seventy-two (72) hours of discovering any actual or reasonably suspected breach of security affecting MCB's data. While this is a standard and important provision, it is reactive rather than preventive and does not address the underlying risk of competitive intelligence cross-contamination.
IP Ownership Provisions. The draft MSA provides that all MCB data remains MCB's sole and exclusive property at all times, and that all custom deliverables developed by Pinecrest specifically for MCB will be assigned to MCB upon creation and payment. These provisions establish clear ownership rights but do not prevent unauthorized access to or use of MCB's data by Vaulton personnel.
Confidentiality Obligations. The draft MSA includes mutual confidentiality obligations with a five-year post-termination survival period. However, these obligations were drafted to govern the relationship between MCB and an independent Pinecrest. They do not specifically address the risks arising from Pinecrest's integration into a larger corporate group, and they do not impose obligations directly on Vaulton as the parent company.
In summary, while the existing contractual protections in the draft MSA are reasonable for an engagement with an independent vendor, they are materially insufficient to address the enhanced risk profile presented by a post-acquisition relationship in which the service provider is owned and controlled by a company that serves MCB's direct competitors. As noted above, data security standards remained one of the four unresolved negotiation issues, underscoring the fact that even the protections currently in the draft were not fully agreed upon.
D. Insurance Considerations
The draft MSA requires Pinecrest to maintain the following minimum insurance coverage throughout the term of the agreement:
Following the closing of the Vaulton acquisition, it is typical for the acquired company's standalone insurance program to be integrated into the acquirer's corporate insurance program. This integration may result in changes to policy terms, coverage limits, carriers, and deductible or self-insured retention levels. MCB would need to verify, as a condition of any decision to proceed with the MSA, that the required coverage levels specified in the draft MSA are maintained by Pinecrest (or by Vaulton on Pinecrest's behalf) following the acquisition, and that MCB's status as an additional named insured (to the extent required by the draft MSA) is preserved under any successor insurance program. Given the potential for changes in Pinecrest's insurance arrangements, this represents an additional area of uncertainty and risk in the post-acquisition environment.
V. Competitive Overlap Analysis
A. Vaulton's Relationships with MCB Competitors
The competitive overlap between Vaulton's existing client base and MCB's competitive landscape represents, in C&H's assessment, the most significant risk factor arising from the Vaulton acquisition. Based on publicly available information and industry sources, Vaulton currently maintains active IT services relationships with at least two of MCB's most significant direct competitors:
Brightleaf Brands, Inc. Brightleaf Brands, Inc. ("Brightleaf") is a Delaware corporation and a major consumer products company with annual revenue of approximately $2.1 billion. Brightleaf competes directly with MCB in the household cleaning and personal care product categories — two of MCB's core business segments. Vaulton currently provides managed IT services to Brightleaf, the precise scope and nature of which are not publicly known but are understood to include enterprise application management and infrastructure services similar in nature to those contemplated by the proposed MCB-Pinecrest MSA.
Kessler Home & Personal Care Corp. Kessler Home & Personal Care Corp. ("Kessler") is a Delaware corporation with annual revenue of approximately $890 million. Kessler competes directly with MCB in the personal care and beauty product categories. Vaulton currently provides data analytics hosting services to Kessler, which may include services analogous to the data analytics platform hosting that Pinecrest would provide to MCB under the proposed MSA.
If MCB were to proceed with the Pinecrest MSA following the Vaulton acquisition, Vaulton would simultaneously serve MCB and two of its most significant direct competitors in the managed IT and data analytics space. This would mean that a single corporate entity — Vaulton — would have access to the proprietary trade promotion data, pricing algorithms, supply chain analytics, and customer information of MCB, Brightleaf, and Kessler. The risk of competitive intelligence cross-contamination in this environment is, in C&H's assessment, unacceptable.
B. Specific Risk Vectors
The competitive overlap described above creates several specific risk vectors that warrant detailed consideration:
Trade Promotion Optimization Data. MCB's trade promotion data — including promotional spending patterns by retailer, promotional effectiveness analytics, and forward-looking promotional plans — would be particularly valuable to Brightleaf and Kessler. In the consumer products industry, trade promotion spending represents one of the largest discretionary expenditures, and the ability to optimize trade spend is a critical competitive differentiator. If Brightleaf or Kessler were to gain access to MCB's trade promotion data, even in summary or aggregated form, they could use this intelligence to adjust their own promotional strategies, target the same retail accounts with competing promotions, and undercut MCB's promotional effectiveness. The competitive harm from such exposure would be material and difficult to quantify or remediate after the fact.
Pricing Algorithms. MCB's proprietary pricing models incorporate competitive pricing intelligence, demand elasticity modeling, retailer-specific pricing strategies, and margin optimization logic. These algorithms represent a significant investment of analytical resources and institutional knowledge. If exposed to competitors — whether directly or through the intermediation of Vaulton personnel who have access to data from multiple competing clients — MCB's pricing strategies could be anticipated and countered by Brightleaf and Kessler, resulting in margin erosion and competitive disadvantage.
Supply Chain Analytics. MCB's supply chain data, including supplier relationships, logistics costs, carrier arrangements, inventory optimization models, and manufacturing cost structures, represents another category of highly sensitive competitive intelligence. Competitors with access to this data could gain insights into MCB's cost structure, identify MCB's key suppliers, and potentially exploit this knowledge to secure competitive advantages in procurement, distribution, and inventory management.
Systemic Risk Factors. Even absent intentional sharing of competitive intelligence, the co-location of sensitive data from competing firms on the same vendor platform — or within the same corporate organization — creates risk through several systemic channels:
•  Employee mobility within Vaulton. Employees who work on the MCB account may be reassigned to the Brightleaf or Kessler accounts (or vice versa), carrying with them institutional knowledge and, potentially, access credentials or data insights from their prior assignments.
•  Shared infrastructure vulnerabilities. If MCB's data is hosted on infrastructure that is shared with (or accessible from) environments used to serve Brightleaf or Kessler, a security vulnerability or misconfiguration in one environment could expose data from another.
•  Management reporting and oversight. Senior Vaulton personnel with oversight responsibility for the consumer products vertical may have visibility into the operations, performance metrics, and strategic priorities of multiple competing clients, enabling competitive intelligence aggregation even without access to granular data.
•  Inadvertent access. Administrative errors, system misconfigurations, and human factors can result in unintended access to client data, particularly during periods of organizational change such as post-acquisition integration.
C. Contractual Mitigation Limitations
C&H has considered whether contractual protections could adequately mitigate the competitive overlap risks described above and has concluded that, while contractual measures can reduce risk, they cannot eliminate it and may not provide sufficient practical protection in a multi-competitor-client environment.
Non-Disclosure and Confidentiality Provisions. The mutual non-disclosure and confidentiality provisions in the draft MSA were negotiated with Pinecrest as an independent entity. These provisions obligate Pinecrest to maintain the confidentiality of MCB's data and to restrict access to personnel with a need to know. However, in a post-acquisition environment, the definition of "personnel with a need to know" may expand to include Vaulton employees involved in integration, oversight, compliance, and management reporting. Furthermore, the confidentiality obligations run to Pinecrest as the contracting party; they do not directly bind Vaulton as the parent company. While Pinecrest's obligations would survive the Change of Control, the practical enforceability of confidentiality provisions against an entity that is wholly controlled by the party whose conduct is in question is inherently limited.
Non-Solicitation Clause. The draft MSA includes a mutual twelve (12) month non-solicitation clause restricting either party from soliciting or hiring the other party's employees who are directly involved in the delivery or receipt of services under the agreement. This provision would provide limited protection against the redeployment of Pinecrest personnel who have worked on the MCB account to roles serving Brightleaf or Kessler. However, the restriction is limited to twelve months in duration and applies only to "solicitation" — it would not prevent Vaulton from reassigning Pinecrest employees to other client accounts within Vaulton's organization after the restriction period expires, or from using the institutional knowledge acquired by those employees in connection with services provided to MCB's competitors.
Audit Rights. Audit rights — one of the four unresolved negotiation issues — take on heightened importance in a multi-client environment where the vendor serves competitors. In theory, robust audit rights could allow MCB to verify that data isolation commitments are being honored, that access controls are functioning as intended, and that MCB's data has not been accessed by unauthorized personnel. In practice, however, the audit rights as currently drafted in the near-final MSA may be insufficient for this purpose. The current draft contemplates annual audits conducted during business hours with reasonable advance notice, which may not provide the real-time visibility needed to detect competitive intelligence leakage. Moreover, auditing a subsidiary of a large enterprise technology company raises practical complications regarding the scope of the audit (e.g., whether MCB can audit Vaulton-level systems and controls) and the ability to obtain meaningful cooperation from Vaulton personnel who are not direct parties to the MSA.
C&H intends to address the question of whether enhanced contractual protections could adequately mitigate these risks in the more detailed competitive overlap memorandum referenced in Section VIII below. However, based on our preliminary assessment, it is our view that no set of contractual provisions can fully eliminate the competitive intelligence risks arising from a vendor relationship in which the vendor's parent company simultaneously serves two or more of MCB's direct competitors in categories of direct competitive overlap.
VI. Preliminary Antitrust and Regulatory Considerations
C&H notes, on a preliminary basis, that the Vaulton acquisition of Pinecrest may itself be subject to regulatory review under applicable antitrust and competition laws. Given the reported $685 million transaction value, the acquisition almost certainly exceeds the filing thresholds established under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended (the "HSR Act"), and may require pre-closing notification to the Federal Trade Commission and the Department of Justice Antitrust Division. The parties to the acquisition may also be subject to review by state attorneys general, foreign competition authorities (to the extent either party has operations or revenue outside the United States), or sector-specific regulators.
MCB is not a party to the Vaulton-Pinecrest acquisition and has no standing to challenge or seek to block the transaction. However, MCB should monitor any regulatory conditions, remedies, or consent decrees that may be imposed in connection with the acquisition, as such conditions could affect Pinecrest's ability to serve existing or prospective clients, the organizational structure of the combined entity, or the data isolation and client-separation measures that Vaulton may be required to implement. If regulatory authorities impose conditions that restrict Vaulton's ability to serve competing clients in the same industry vertical, those conditions could have direct relevance to MCB's analysis of whether to proceed with the MSA.
C&H recommends conducting a more detailed competitive overlap and antitrust analysis addressing these considerations in greater depth. This analysis will be provided in a separate memorandum, as discussed in Section VIII below.
VII. Impact on MCB's IT Services Strategy
A. Incumbent Vendor Fallback
A significant mitigating factor in the current situation is that MCB currently maintains an active, ongoing IT services arrangement with its incumbent vendor, Corwyn Technology Services LLC ("Corwyn"). MCB's relationship with Corwyn is governed by a legacy IT services agreement dated March 1, 2020, which has been extended on a month-to-month basis following the expiration of its initial term. Under this arrangement, Corwyn continues to provide cloud infrastructure management, managed IT services, enterprise application support, and cybersecurity monitoring to MCB at an annual cost of $3,150,000.
This arrangement provides operational continuity for MCB and eliminates any immediate risk to MCB's IT operations from a decision to pause or terminate the Pinecrest negotiations. MCB is not in a position where it must execute the Pinecrest MSA to avoid a gap in IT service coverage; rather, MCB can continue to operate under the Corwyn arrangement for as long as necessary while it evaluates the implications of the Vaulton acquisition and determines its preferred path forward.
The cost differential between the Corwyn arrangement ($3,150,000 per year) and the proposed Pinecrest MSA ($2,950,000 per year) is $200,000 per year, representing a total differential of approximately $1,000,000 over the five-year initial term. While the Pinecrest MSA would have yielded meaningful cost savings, these savings must be weighed against the competitive risks identified in this memorandum. In C&H's assessment, the potential competitive harm from proceeding with the Pinecrest MSA in a post-acquisition environment — including the risk of exposure of MCB's trade promotion data, pricing algorithms, and supply chain analytics to direct competitors — far exceeds the $200,000 annual cost advantage of the Pinecrest arrangement. A single competitive intelligence breach could cause harm measured in orders of magnitude beyond the cost savings at stake.
B. No Data Migration or Transition-Out Risk
Because the MSA has not been executed and no services have commenced, MCB is in the advantageous position of having no data or systems currently hosted, managed, or controlled by Pinecrest. No data migration has occurred. No systems integration has been performed. No MCB data resides in Pinecrest's environment. No transition-out plan needs to be developed or executed.
This is a significant practical advantage that would not exist if MCB were to execute the MSA, begin the onboarding and data migration process, and subsequently invoke the Change of Control termination right. In that scenario, MCB would face the operational complexity and cost of transitioning its data and systems back to Corwyn or to an alternative vendor, including the risk of service disruption during the transition period. By acting now — before execution — MCB avoids all of these complications entirely.
The absence of transition-out risk also means that MCB can take a deliberate and measured approach to evaluating its options. There is no operational urgency that would compel MCB to make a hasty decision. MCB can afford to conduct a thorough assessment of the competitive overlap risks, evaluate whether enhanced contractual protections could provide adequate mitigation, explore alternative vendor options (including potentially re-opening the RFP process), and consult with Ashford Capital on the strategic implications — all without any adverse impact on MCB's day-to-day IT operations.
VIII. Recommended Next Steps
Based on the foregoing analysis, C&H recommends the following immediate and near-term actions:
1. Immediate Pause of Negotiations. MCB should not proceed with any further negotiation sessions, draft exchanges, business principal escalation meetings, or other activities related to the MSA with Pinecrest or its outside counsel, Dunleavy, Proctor & Hale LLP, until the implications of the Vaulton acquisition have been fully assessed and a deliberate strategic decision has been reached. This includes suspending any internal preparations for the business principal escalation meeting that was contemplated for resolution of the four remaining open issues. MCB should communicate the pause decision promptly and clearly to all internal stakeholders, including Meg Thornbury (Senior Vice President, Operations) and Priya Chandrasekaran (Vice President, Information Technology), to ensure that no informal communications with Pinecrest personnel proceed in parallel.
2. Formal Communication to Pinecrest's Counsel. C&H recommends sending a formal letter to Carolyn Ostrowski, lead partner at Dunleavy, Proctor & Hale LLP, notifying Pinecrest that MCB is pausing the MSA negotiation pending its assessment of the recently announced Vaulton acquisition and its implications for the proposed engagement. The letter should be drafted in measured and professional terms, without prejudging the outcome of MCB's assessment, but should clearly convey that MCB considers the change-of-ownership event to be a material development warranting careful review before any further progress toward execution. C&H is prepared to draft this letter upon MCB's authorization and to circulate a draft for MCB's review promptly upon receipt of instructions to proceed.
3. Internal Strategy Call. MCB management and Ashford Capital personnel should convene an internal strategy call at the earliest practicable opportunity to discuss the path forward. Recommended participants include David Halverston (General Counsel), Meg Thornbury (Senior Vice President, Operations), Priya Chandrasekaran (Vice President, Information Technology), Karen Lau (Operating Partner, Ashford Capital), and Vincent Driscoll (Managing Partner, Ashford Capital). C&H is available to participate in this call to present the findings of this memorandum and respond to questions. The agenda for the strategy call should include a discussion of the three principal options available to MCB:
(a) Terminate the MSA process entirely. MCB could elect to terminate the negotiation with Pinecrest and either continue with Corwyn under the existing month-to-month arrangement or re-open the IT managed services RFP process to identify an alternative vendor that does not present the competitive overlap concerns identified herein.
(b) Seek enhanced contractual protections and proceed. MCB could, following a detailed assessment, determine that enhanced contractual protections — such as data isolation covenants, Vaulton parent guarantees, expanded audit rights, named personnel restrictions, escrow arrangements for MCB data, and contractual prohibitions on the redeployment of MCB account personnel to competitor accounts — could adequately mitigate the identified risks and elect to resume negotiations on that basis. C&H would advise caution with this approach, as described in Section V.C above, but acknowledges that it represents a potential path forward if the enhanced protections are sufficiently robust and enforceable.
(c) Re-open the RFP process with alternative vendors. MCB could issue a new or supplemental RFP to identify alternative IT managed services vendors that do not present the competitive overlap concerns associated with Vaulton. This approach would involve additional time and cost but would address the competitive intelligence risks at their source.
4. Detailed Competitive Overlap Analysis. C&H will prepare a comprehensive memorandum analyzing the competitive overlap, data isolation risks, and antitrust considerations arising from the Vaulton acquisition in greater detail than is provided in this initial alert memorandum. The detailed memorandum will include an assessment of: (i) the full scope of Vaulton's existing client relationships in the consumer products sector; (ii) the specific categories of data and competitive intelligence at risk; (iii) the feasibility and limitations of contractual mitigation measures, including data isolation covenants, audit rights, and personnel restrictions; (iv) any regulatory conditions or remedies that may be imposed on the Vaulton-Pinecrest acquisition; and (v) a comparative analysis of the costs and benefits of the three strategic options described above. C&H anticipates delivering this memorandum within one week, by approximately October 20, 2023.
5. Communication with Ashford Capital. Given that Ashford Capital Partners Fund IV, LP (through its general partner, Ashford Capital Management LLC) exercises oversight responsibility for MCB and has a fiduciary interest in MCB's strategic decisions, Karen Lau (Operating Partner) and Vincent Driscoll (Managing Partner) should be apprised of this development and consulted on the strategic decision at the earliest opportunity. The Vaulton acquisition represents a material change in the landscape surrounding a significant commercial commitment (the MSA has a total contract value of $14,750,000 over five years), and Ashford Capital's input and concurrence should be obtained before MCB determines its course of action. C&H is prepared to arrange a briefing call with Ashford Capital if MCB so requests.
6. Preservation of Rights. MCB should expressly reserve all rights in any communication with Pinecrest, DPH, or any other party in connection with this matter. This includes, without limitation, the right to terminate the negotiation process entirely, the right to re-open discussions with alternative vendors, and the right to invoke any applicable provision of the draft MSA (including the Change of Control provision) in the event that the MSA is ultimately executed. No communication from MCB or C&H should be construed or characterized as a commitment to proceed with the MSA, a waiver of any right or remedy, or an acknowledgment of any obligation to Pinecrest.
IX. Conclusion
The Vaulton acquisition of Pinecrest fundamentally alters the risk profile of the proposed Master Services Agreement. What was a straightforward engagement with a mid-size, independent IT services vendor has become, through no action of MCB, a potential engagement with a subsidiary of one of the largest enterprise technology companies in the United States — a company that simultaneously serves two of MCB's most significant direct competitors.
The identity of the ultimate service provider matters. Pinecrest Digital Solutions Inc., as an independent company with $218 million in annual revenue, no relationships with MCB's competitors, and a focused commitment to serving its own client base, presents a fundamentally different counterparty than Pinecrest as a wholly-owned subsidiary of Vaulton Technologies Group, Inc., a $4.7 billion enterprise technology company with existing engagements with Brightleaf Brands, Inc. and Kessler Home & Personal Care Corp. The risk of competitive intelligence cross-contamination — through employee mobility, shared infrastructure, management oversight, or inadvertent access — is material and cannot be fully eliminated through contractual protections alone.
The Change of Control provision in the draft MSA reflects the parties' shared recognition that a change in ownership of either party is a material event warranting a right of termination. The principle underlying that provision — that the identity, independence, and organizational posture of the counterparty are material to the relationship — applies with even greater force to the decision of whether to execute the MSA in the first instance. MCB should not knowingly enter into a long-term, high-value IT services engagement with a vendor whose ownership, organizational structure, and competitive landscape are undergoing a fundamental transformation.
C&H is available to discuss this memorandum with MCB at its earliest convenience and stands ready to implement whichever course of action MCB determines is appropriate. We are prepared to draft the formal communication to Pinecrest's counsel, participate in the internal strategy call, brief Ashford Capital, and deliver the detailed competitive overlap memorandum within the timeframe described above.
CONFIDENTIALITY NOTICE: This memorandum is a privileged and confidential attorney-client communication of Calderwood & Harkness LLP. It has been prepared at the request of and for the exclusive use of Meridian Consumer Brands LLC and is protected by the attorney-client privilege and the work product doctrine. This memorandum is intended solely for the use of the addressees identified above and should not be disclosed, distributed, or shared with any third party without the prior written consent of Calderwood & Harkness LLP. If you have received this memorandum in error, please notify the sender immediately and destroy all copies.
CALDERWOOD & HARKNESS LLP
By: ________
Elaine Forsythe Partner eforsythe@calderwoodharkness.com
By: ________
Garrett Simmons Senior Associate gsimmons@calderwoodharkness.com
Calderwood & Harkness LLP 125 Park Avenue, 34th Floor New York, NY 10017
Service Category | Annual Cost
Cloud Infrastructure Management | $1,200,000
Managed IT Services | $825,000
Enterprise Application Support (Harborline Software, Pinnacle Health IT) | $575,000
Cybersecurity Monitoring & Incident Response | $350,000
Total Annual Contract Value | $2,950,000
Policy Type | Required Coverage
Technology Errors & Omissions / Cyber Liability | $10,000,000 per occurrence / aggregate
Commercial General Liability | $5,000,000 per occurrence / aggregate
Workers' Compensation | $2,000,000 (statutory minimum or as required by law)

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION

MEMORANDUM

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts