1011-00008 · Firm and Meridian Consumer Brands LLC · Memos & Analysis

competitive-overlap-antitrust-memo-2023-10-20.docx DOCUMENT Antitrust

7 / 12 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT

MEMORANDUM

October 20, 2023

FROM: Elaine Forsythe, Partner, Antitrust & Competition Practice, and Leila Nazari, Associate Calderwood & Harkness LLP 125 Park Avenue, 34th Floor New York, NY 10017

TO: David Halverston, General Counsel, Meridian Consumer Brands LLC Margaret "Meg" Thornbury, CEO, Meridian Consumer Brands LLC Karen Lau, Operating Partner, Ashford Capital Management LLC

RE: Competitive Overlap and Antitrust Analysis — Vaulton Technologies Group, Inc. Acquisition of Pinecrest Digital Solutions Inc.; Implications for Proposed Master Services Agreement (MSA-PDS-MCB-2023)

Matter No.: 1011-00008 Client No.: 71982

PRIVILEGE DESIGNATION: This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared in connection with Calderwood & Harkness LLP's representation of Meridian Consumer Brands LLC. It contains legal analysis and recommendations protected by the attorney-client privilege and the work product doctrine. This memorandum should not be disclosed, disseminated, distributed, or copied to any third party without the prior written consent of Calderwood & Harkness LLP. Any inadvertent disclosure does not constitute a waiver of privilege.

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes the competitive overlap risks and antitrust implications arising from Vaulton Technologies Group, Inc.'s ("Vaulton") announced acquisition of Pinecrest Digital Solutions Inc. ("Pinecrest") and the impact of that transaction on the proposed Master Services Agreement between Pinecrest and Meridian Consumer Brands LLC ("MCB" or the "Company") designated MSA-PDS-MCB-2023 (the "Proposed MSA").

On October 12, 2023, Vaulton publicly announced its agreement to acquire Pinecrest for a reported purchase price of $685 million. Stonebridge Advisory Group LLC served as Vaulton's investment banking advisor in connection with the transaction. As of the date of this memorandum, closing of the acquisition has not yet occurred but is anticipated imminently, with public filings and press reports indicating a targeted closing date of October 27, 2023. We will update our analysis to the extent any material developments arise between the date hereof and the date of the client's decision.

MCB had been in active negotiations with Pinecrest regarding the Proposed MSA since July 25, 2023, the date on which Calderwood & Harkness LLP ("C&H") was engaged to lead the negotiation of definitive transaction documentation. A first draft of the MSA was delivered to Pinecrest's outside counsel, Dunleavy, Proctor & Hale LLP ("DPH"), on August 4, 2023, and the parties had conducted two substantive negotiation sessions, on September 8 and September 29, 2023, respectively. A near-final draft of the MSA was circulated on October 6, 2023, with four substantive issues remaining open and bracketed for escalation to business principals. Negotiations were formally paused on October 18, 2023, via letter from C&H to DPH (attention: Carolyn Ostrowski, lead partner), pending the completion of this competitive overlap and antitrust analysis.

Key Conclusion. Based on our review of the competitive landscape, the nature and scope of the IT services contemplated under the Proposed MSA, the categories of MCB proprietary data that would be exposed to the service provider, and the existing commercial relationships between Vaulton and MCB's direct competitors, we conclude that the Vaulton acquisition of Pinecrest creates irreconcilable competitive overlap and data security risks that cannot be adequately mitigated through contractual mechanisms. The structural environment further presents ongoing antitrust compliance risk under both federal and state competition laws.

Accordingly, C&H recommends that MCB terminate the MSA negotiation process with Pinecrest and continue operating under its existing month-to-month arrangement with its incumbent IT vendor, Corwyn Technology Services LLC ("Corwyn"), notwithstanding the annual cost differential of approximately $200,000 (the Corwyn legacy agreement is priced at $3,150,000 per year compared to the proposed Pinecrest ACV of $2,950,000 per year). Over the contemplated five-year MSA term, this represents $1,000,000 in forfeited savings — a figure that, while not immaterial in isolation, is de minimis relative to MCB's FY 2022 revenue of $1.34 billion and is far outweighed by the data security, competitive intelligence, and antitrust risks identified herein.

The detailed analysis supporting this recommendation is set forth below.

II. Background

A. The Proposed MSA with Pinecrest

MCB initiated a formal procurement process for IT managed services in early 2023 in connection with a broader strategic review of the Company's technology infrastructure and vendor relationships. On June 12, 2023, MCB's Procurement team, under the direction of Samuel Otieno, Director of Procurement, issued Request for Proposal No. MCB-IT-RFP-2023-006 (the "RFP"), soliciting bids from qualified IT managed services providers for a comprehensive suite of cloud infrastructure management, managed IT services, enterprise application support, and cybersecurity monitoring and incident response services.

Pinecrest Digital Solutions Inc. was among several respondents to the RFP. Pinecrest is a Delaware corporation headquartered at 2300 Lakewood Boulevard, Suite 400, Durham, North Carolina 27713. Pinecrest was founded in 2016 and is led by Nathan Whitford, Chief Executive Officer. For its fiscal year ended December 31, 2022, Pinecrest reported revenue of approximately $218 million and employed approximately 1,100 individuals. Pinecrest's Chief Revenue Officer, Tessa Johannsen, led the commercial proposal process, and Rina Balakrishnan served as Pinecrest's General Counsel.

Following evaluation of the submitted proposals, MCB selected Pinecrest as the preferred vendor on July 10, 2023. The selection was based on a combination of factors, including competitive pricing, demonstrated technical capabilities in the consumer products sector, SOC 2 Type II certification, and favorable reference checks from comparable mid-market clients.

C&H was formally engaged on July 25, 2023, to negotiate the MSA and related documentation on behalf of MCB. The first draft of the MSA (designated MSA-PDS-MCB-2023) was prepared by C&H and delivered to Pinecrest's outside counsel, Dunleavy, Proctor & Hale LLP (300 South Tryon Street, Suite 2200, Charlotte, North Carolina 28202), on August 4, 2023. Lead partner Carolyn Ostrowski and associate James Feng of DPH represented Pinecrest throughout the negotiation process.

The principal commercial terms of the Proposed MSA, as reflected in the near-final draft circulated on October 6, 2023, are summarized as follows:

Term: Five-year initial term commencing November 1, 2023, and expiring October 31, 2028, with renewal provisions to be determined at the business principal level.

Contract Value: Total contract value of $14,750,000 over the five-year term, representing an annual contract value ("ACV") of $2,950,000. The ACV is allocated across four service components:

• Cloud Infrastructure Management: $1,200,000 per year — encompassing public and private cloud hosting, infrastructure provisioning, monitoring, capacity management, and disaster recovery services.

• Managed IT Services (Help Desk and Endpoint Management): $825,000 per year — encompassing 24/7 help desk support, desktop and laptop endpoint management, patch management, and mobile device management for MCB's approximately 4,200 endpoints.

• Enterprise Application Support (Harborline Software and Pinnacle Health IT): $575,000 per year — encompassing ongoing administration, configuration, customization, and break/fix support for MCB's Harborline Software production environment and Quillon Data Systems platform.

• Cybersecurity Monitoring and Incident Response: $350,000 per year — encompassing 24/7 security operations center (SOC) monitoring, threat intelligence, vulnerability scanning, penetration testing coordination, and incident response services.

Payment Terms: Net 45 days from invoice date, with invoices submitted quarterly in advance.

Key Protective Provisions: The Proposed MSA contains a number of protective provisions that were specifically negotiated by C&H on behalf of MCB, including:

• SOC 2 Type II Certification: Pinecrest is required to maintain, at all times during the term, a current SOC 2 Type II report covering the Trust Services Criteria relevant to the services provided under the MSA. Pinecrest's most recent SOC 2 Type II report was issued on March 15, 2023, and covers the period from April 1, 2022, through March 31, 2023.

• Breach Notification: Pinecrest is required to notify MCB of any security breach or unauthorized access to MCB data within seventy-two (72) hours of discovery.

• Liability Cap: The aggregate liability of Pinecrest under the MSA is capped at two times (2×) the fees paid or payable by MCB during the twelve (12) months immediately preceding the event giving rise to the claim, resulting in a maximum liability exposure of $5,900,000. This provision remained one of the four open items at the time negotiations were paused, with DPH advocating for a cap of one times (1×) the prior twelve months' fees.

• Change of Control: The MSA contains a change-of-control provision permitting either party to terminate the MSA upon thirty (30) days' written notice following the occurrence of a Change of Control event, defined to include any merger, acquisition, or other transaction resulting in a change of more than fifty percent (50%) of the equity ownership or voting control of either party.

• Non-Solicitation: Mutual twelve (12) month non-solicitation of employees during the term and for twelve months following expiration or termination.

• Insurance Requirements: Pinecrest is required to maintain the following minimum insurance coverages: technology errors and omissions / cyber liability insurance in the amount of $10,000,000 per occurrence; commercial general liability insurance in the amount of $5,000,000 per occurrence; and workers' compensation insurance in the amount of $2,000,000 per occurrence.

Negotiation Status. As of the date negotiations were paused on October 18, 2023, the MSA was in an advanced state of negotiation. Two formal negotiation calls had been conducted. During the first call on September 8, 2023, the parties addressed the initial redline delivered by DPH on August 25, 2023, which raised forty-seven (47) discrete issues. Of these, twenty-nine (29) were resolved during that call. A second redline was circulated by DPH on September 22, 2023, reflecting twelve (12) remaining open issues. During the second negotiation call on September 29, 2023, eight (8) of those remaining issues were resolved. A near-final draft incorporating all resolved provisions was circulated on October 6, 2023, with four (4) issues remaining open and bracketed for escalation to business principals:

1. Data security standards (scope and specificity of security controls obligations);

2. Liability cap (2× prior 12 months' fees vs. 1× prior 12 months' fees);

3. Termination fee (amount and conditions of early termination payment); and

4. Audit rights (scope, frequency, and cost allocation of MCB's right to audit Pinecrest's operations, security controls, and financial records).

No Binding Agreement. It is critical to note that no binding agreement was executed between MCB and Pinecrest at any point. No letters of intent, term sheets, or other preliminary agreements with binding effect were signed. No MCB data was transferred to Pinecrest, and no systems migration activities were initiated. MCB's IT operations continue to be performed by Corwyn Technology Services LLC under the legacy agreement dated March 1, 2020, which is currently operating on a month-to-month extension following expiration of its initial three-year term on February 28, 2023.

B. MCB's Business Profile

Meridian Consumer Brands LLC ("MCB" or the "Company") is a Delaware limited liability company headquartered at 680 Fifth Avenue, 22nd Floor, New York, New York 10019. The Company's registered agent in Delaware is Capitol Registered Agents, LLC, located at 1209 Orange Street, Wilmington, Delaware 19801. MCB's employer identification number (EIN) is 83-4127596.

MCB operates in the consumer products and retail industry, with a portfolio of well-known brands in the household cleaning, personal care, and beauty segments. For its fiscal year ended December 31, 2022, MCB reported revenue of approximately $1.34 billion, with distribution through major national retailers, e-commerce platforms, and specialty channels across the United States and select international markets.

MCB is wholly owned by Ashford Capital Partners Fund IV, LP ("Fund IV"), a private equity fund with approximately $3.8 billion in committed capital (2018 vintage). Fund IV's general partner is Ashford Capital Management LLC ("Ashford"), headquartered at 9 West 57th Street, Suite 3200, New York, New York 10019. Ashford's Managing Partner is Vincent Driscoll, and the Operating Partner with primary oversight responsibility for the MCB investment is Karen Lau, who is among the addressees of this memorandum. Ashford acquired MCB in 2019 and has been actively involved in the Company's operational and strategic decision-making since that time.

MCB's senior management team includes Margaret "Meg" Thornbury, Chief Executive Officer; David Halverston, General Counsel; Priya Chandrasekaran, Vice President, Information Technology; and Samuel Otieno, Director of Procurement. MCB's independent auditor is Ridgeline Audit Partners LLP, located at 7 Times Square, New York, New York 10036.

C. Vaulton Technologies Group, Inc.

Vaulton Technologies Group, Inc. ("Vaulton") is a Delaware corporation headquartered at 1400 Peachtree Road NE, Suite 3100, Atlanta, Georgia 30309. Vaulton's Chief Executive Officer is Robert "Rob" Castellano. For its fiscal year ended December 31, 2022, Vaulton reported revenue of approximately $4.7 billion, making it one of the largest enterprise technology and IT services companies in North America. Vaulton provides a comprehensive suite of IT infrastructure, managed services, cloud computing, data analytics, cybersecurity, and enterprise application services to clients across a wide range of industries, including consumer products, healthcare, financial services, and manufacturing.

On October 12, 2023, Vaulton publicly announced its agreement to acquire all of the outstanding equity interests of Pinecrest Digital Solutions Inc. for a reported purchase price of $685 million. The acquisition was described in Vaulton's public statements as a strategic transaction designed to expand Vaulton's mid-market IT managed services capabilities and broaden its footprint in the consumer products and healthcare verticals — sectors in which Pinecrest has developed a strong client base since its founding in 2016. Stonebridge Advisory Group LLC, located at 200 Clarendon Street, 50th Floor, Boston, Massachusetts 02116, served as Vaulton's investment banking advisor in connection with the transaction.

Based on public filings and press reports as of the date of this memorandum, closing of the Vaulton-Pinecrest transaction is expected to occur by the end of October 2023. We understand from subsequent reports that the acquisition closed on October 27, 2023; however, as of the date of this memorandum (October 20, 2023), closing had not yet occurred. Our analysis contemplates the post-closing environment in which Pinecrest operates as a wholly owned subsidiary of Vaulton.

D. Pinecrest's Counsel

Throughout the MSA negotiation process, Pinecrest has been represented by Dunleavy, Proctor & Hale LLP ("DPH"), located at 300 South Tryon Street, Suite 2200, Charlotte, North Carolina 28202. Lead partner Carolyn Ostrowski has served as the primary point of contact on behalf of DPH, with associate James Feng providing supporting analysis and drafting. Pinecrest's in-house legal team has been led by General Counsel Rina Balakrishnan, with commercial oversight provided by Chief Revenue Officer Tessa Johannsen. All formal communications regarding the pause of negotiations were directed to Ms. Ostrowski at DPH.

III. Competitive Overlap Analysis

A. Vaulton's Existing IT Relationships with MCB's Direct Competitors

A central concern arising from the Vaulton-Pinecrest transaction is the fact that Vaulton currently maintains active IT services relationships with at least two companies that are direct competitors of MCB in MCB's core product segments. These relationships are described below.

1. Brightleaf Brands, Inc.

Brightleaf Brands, Inc. ("Brightleaf") is a Delaware corporation and a direct competitor of MCB in the household cleaning and personal care product segments. For its fiscal year ended December 31, 2022, Brightleaf reported revenue of approximately $2.1 billion, making it a substantially larger competitor in the categories where its product portfolio overlaps with MCB's.

Based on publicly available information and industry intelligence gathered by MCB's IT and Procurement teams, Vaulton currently provides managed IT infrastructure services to Brightleaf under an existing commercial arrangement. The scope of Vaulton's services to Brightleaf includes cloud hosting, data center management, and enterprise application support — services that are substantially identical in nature and scope to the Cloud Infrastructure Management and Enterprise Application Support service lines contemplated under the Proposed MSA between MCB and Pinecrest. The overlap between the services Vaulton provides to Brightleaf and the services Pinecrest would provide to MCB is extensive and covers precisely the categories of IT services through which MCB's most competitively sensitive data would be exposed to the service provider.

2. Kessler Home & Personal Care Corp.

Kessler Home & Personal Care Corp. ("Kessler") is a Delaware corporation and a direct competitor of MCB in the personal care and beauty product segments. For its fiscal year ended December 31, 2022, Kessler reported revenue of approximately $890 million. While Kessler is smaller than MCB in aggregate revenue terms, the competitive overlap between the two companies is particularly intense in the personal care and beauty categories, where both companies compete for the same retail shelf space, digital advertising placements, and consumer demographics.

Based on available information, Vaulton currently provides data analytics platform hosting services to Kessler. These data analytics hosting services are directly analogous to the services that would be provided to MCB under the Proposed MSA's Cloud Infrastructure Management and Cybersecurity Monitoring components. In particular, the data analytics hosting relationship gives Vaulton visibility into Kessler's data infrastructure and analytical capabilities — the same types of operational systems and data flows that MCB would be entrusting to Pinecrest (now Vaulton) under the Proposed MSA.

B. Degree of Competitive Overlap

The competitive overlap created by the Vaulton-Pinecrest acquisition is both deep and structural. MCB, Brightleaf, and Kessler compete head-to-head across multiple product categories in the household cleaning, personal care, and beauty segments. These are not merely adjacent or tangentially related competitors; they are direct rivals competing for the same consumers, the same retailer shelf allocations, the same promotional windows, and the same digital advertising inventory.

The combined revenue of Brightleaf and Kessler — the two MCB competitors currently served by Vaulton — is approximately $2.99 billion ($2.1 billion + $890 million), compared to MCB's FY 2022 revenue of approximately $1.34 billion. In other words, Vaulton's existing competitor-client base in the consumer products space represents more than twice MCB's revenue. This disparity has implications for leverage dynamics: in any dispute over data isolation practices or information barrier compliance, Vaulton's economic incentives would be weighted toward its larger existing clients (Brightleaf and Kessler) rather than toward MCB.

Under the Proposed MSA, Pinecrest — which would operate as a wholly owned subsidiary of Vaulton post-closing — would have access to MCB's operational data across all four service lines: Cloud Infrastructure Management, Managed IT Services, Enterprise Application Support, and Cybersecurity Monitoring and Incident Response. In the post-acquisition environment, Vaulton would simultaneously hold the confidential operational data of MCB and at least two of MCB's primary competitors.

This creates an unprecedented concentration of competitive intelligence within a single IT services provider. While large IT services companies routinely serve multiple clients within the same industry, the specific combination of factors present here — direct horizontal competition among the clients, overlapping service categories providing access to substantially similar types of operational data, and the magnitude of the competitive overlap — distinguishes this situation from routine multi-client engagements and elevates it to a level of risk that warrants serious concern.

IV. Data Security and Competitive intelligence Risks

A. MCB Proprietary Data at Risk

The Proposed MSA contemplates that Pinecrest (now Vaulton) would host and manage a broad range of MCB's information technology systems and the data residing within those systems. Based on our review of the Proposed MSA's scope of services and the due diligence materials exchanged during the negotiation process, the following categories of MCB proprietary data would be hosted on, or accessible through, Pinecrest (Vaulton) infrastructure:

Trade Promotion Data. MCB's trade promotion management system, which would be supported under the Enterprise Application Support service line, contains detailed promotional calendars, retailer-specific pricing and promotional terms, promotional lift analytics and post-event analysis data, and co-op advertising budgets and spend allocations. This data provides granular visibility into MCB's go-to-market strategy on a retailer-by-retailer, category-by-category basis and represents some of the Company's most competitively sensitive commercial information. Competitors with access to this data would gain material insight into MCB's promotional cadence, pricing floors, and trade investment priorities.

Pricing Algorithms. MCB's pricing infrastructure, which relies in part on cloud-hosted computational resources that would fall within the Cloud Infrastructure Management service line, includes dynamic pricing models, competitive price benchmarking databases, and margin optimization algorithms. These systems incorporate proprietary methodologies for calculating optimal price points across channels and geographies, taking into account cost-of-goods-sold data, competitor pricing intelligence, retailer margin expectations, and consumer elasticity models. Access to these algorithms and the underlying data would provide a competitor with a roadmap to MCB's pricing strategy and enable targeted competitive responses.

Supply Chain Analytics. MCB's supply chain management systems, which would be supported through both the Cloud Infrastructure Management and Enterprise Application Support service lines, encompass demand forecasting models, supplier cost data (including negotiated raw material pricing, contract terms, and volume commitments), inventory optimization algorithms, and logistics routing and cost models. This data reflects MCB's operational efficiency, sourcing strategy, and cost structure at a level of detail that would be of extraordinary competitive value to Brightleaf and Kessler, both of which compete for many of the same raw materials, manufacturing capacity, and logistics networks.

Enterprise Application Data. The Proposed MSA's Enterprise Application Support service line specifically covers MCB's Harborline Software production environment and Quillon Data Systems platform. The Harborline Software environment contains MCB's financial data (general ledger, accounts payable, accounts receivable, cash management), procurement data (purchase orders, vendor master data, sourcing analytics), manufacturing data (production planning, bill of materials, quality management), and distribution data (warehouse management, shipping, transportation management). The Quillon Data Systems platform contains MCB's customer pipeline data, sales forecasting models, account-level strategies, and competitive win/loss analyses. Taken together, these systems constitute the operational backbone of MCB's business and contain data that, if accessed by a competitor, could cause material and irreparable competitive harm.

B. Mechanisms of Potential Information Leakage

Even with the best of intentions and robust contractual protections, the structural environment created by Vaulton's simultaneous service relationships with MCB and its competitors presents multiple vectors through which competitively sensitive information could leak — whether intentionally, inadvertently, or through the gradual accumulation of institutional knowledge. We identify four primary mechanisms of concern:

Personnel Overlap. Enterprise IT services firms, including Vaulton, routinely rotate technical personnel among client engagements based on skill requirements, project timelines, and resource availability. Engineers, analysts, system administrators, and project managers who service MCB's infrastructure under the Proposed MSA could subsequently — or, in some cases, simultaneously — be assigned to service Brightleaf or Kessler accounts. Even in the absence of any deliberate attempt to transfer information, these individuals would carry institutional knowledge of MCB's systems architecture, data structures, operational patterns, security posture, and technology roadmap. This institutional knowledge, once acquired, cannot be effectively partitioned or forgotten. The risk is particularly acute for senior technical personnel who develop deep familiarity with a client's operations over multi-year engagements and who may recognize commercially significant patterns in competitor environments based on their knowledge of MCB's operations.

Infrastructure Commingling. Unless Vaulton maintains strict physical and logical segregation of client environments — including dedicated hardware, separate network segments, independent administrative access credentials, isolated logging and monitoring systems, and segregated backup and disaster recovery infrastructure — MCB's data could reside on shared infrastructure with the data of Brightleaf, Kessler, or other Vaulton clients. Multi-tenant cloud environments, while cost-effective and operationally efficient, inherently create shared attack surfaces and access pathways. Administrative tools, network monitoring platforms, and centralized logging systems used by Vaulton's operations staff could create cross-client visibility that is difficult to detect and even more difficult to prevent. The trend in the IT services industry toward platform consolidation and shared services delivery models further increases the likelihood that Pinecrest's currently segregated infrastructure will be integrated into Vaulton's broader platform over time, particularly given the strategic rationale for the acquisition (expanding Vaulton's mid-market capabilities through integration of Pinecrest's operations).

Analytics and Benchmarking. IT service providers routinely aggregate and analyze client data — often in anonymized or pseudonymized form — for purposes of internal benchmarking, capacity planning, service level optimization, and product development. Even when such aggregation is conducted in good faith and with appropriate anonymization techniques, the resulting insights can reveal competitively sensitive patterns if the provider has sufficient context to de-anonymize or re-identify the data. In this case, Vaulton's deep knowledge of the consumer products industry and its simultaneous service relationships with MCB, Brightleaf, and Kessler would make effective anonymization extremely difficult to achieve. Aggregated data on cloud utilization patterns, compute demand curves, data volumes, and application usage profiles could reveal information about seasonal demand patterns, promotional activity levels, and operational capacity that would be meaningful to a sophisticated competitor.

Breach or Incident Response. The Proposed MSA's Cybersecurity Monitoring and Incident Response service line, priced at $350,000 per year, contemplates that Pinecrest (Vaulton) personnel would have deep, broad, and often unrestricted access to MCB's systems during security incident investigation and response. The 72-hour breach notification obligation — while an important contractual protection — operates after the fact and does not prevent Vaulton's incident response team from accessing and analyzing MCB's most sensitive data during the course of an investigation. Incident response activities often require forensic analysis of system logs, data flows, user activity, and application behavior, providing the responder with comprehensive visibility into the client's operational environment. In a shared-provider scenario, the same incident response team members could be called upon to respond to incidents at Brightleaf or Kessler, carrying forward detailed technical knowledge acquired during MCB engagements.

C. Adequacy of Contractual Data Isolation Mechanisms

We have carefully reviewed the confidentiality and data protection provisions of the Proposed MSA (MSA-PDS-MCB-2023) to assess whether they are adequate to mitigate the competitive intelligence risks identified above. Our assessment is that, while the existing contractual protections are reasonable and appropriate for a standalone Pinecrest engagement, they are fundamentally insufficient to address the systemic risks created by the Vaulton acquisition.

The draft MSA contains standard confidentiality provisions that impose obligations on Pinecrest to: (i) restrict access to MCB's confidential information to personnel with a legitimate "need to know" in connection with the performance of services under the MSA; (ii) maintain reasonable administrative, physical, and technical security controls to protect MCB data against unauthorized access, use, or disclosure; and (iii) refrain from using MCB's confidential information for any purpose other than the performance of the MSA.

In addition, the MSA requires Pinecrest to maintain a current SOC 2 Type II report (Pinecrest's most recent report, issued March 15, 2023, covers the period from April 1, 2022, through March 31, 2023) and to conduct annual penetration testing of the systems and infrastructure used to deliver services to MCB.

However, these provisions were drafted and negotiated with Pinecrest as a standalone company — an independent mid-market IT services provider with approximately $218 million in annual revenue and approximately 1,100 employees. Pinecrest as a wholly owned subsidiary of Vaulton ($4.7 billion in annual revenue) presents fundamentally different risk dynamics that the existing contractual framework was not designed to address:

Cross-Client Confidentiality. Vaulton's existing contracts with Brightleaf and Kessler undoubtedly contain their own confidentiality and data protection provisions. However, MCB has no visibility into, and no contractual right to review or enforce, those provisions. MCB cannot determine whether Vaulton's obligations to Brightleaf and Kessler are consistent with, or conflict with, its obligations to MCB, nor can MCB assess whether Vaulton's data isolation practices are adequate to prevent cross-client information flows.

Audit Rights. The Proposed MSA's audit rights provisions — which are themselves one of the four unresolved issues remaining at the time negotiations were paused — were scoped for Pinecrest-only operations. These provisions would not give MCB the right to audit Vaulton's broader operations, to inspect Vaulton's data isolation practices as between MCB's data and competitor data, or to verify that Vaulton's personnel assignment practices maintain adequate separation between the MCB engagement and the Brightleaf and Kessler engagements. Expanding these audit rights to cover Vaulton's enterprise-wide operations would require a fundamental renegotiation of the audit provisions — a concession that Vaulton is unlikely to grant, given the breadth and sensitivity of its operations and its obligations to other clients.

Operational Integration. Vaulton may — and, based on the strategic rationale for the acquisition, likely will — integrate Pinecrest's operations, personnel, technology platform, and infrastructure into its broader enterprise over time. Such integration could include consolidation of data centers, migration to shared cloud platforms, unification of identity and access management systems, standardization of monitoring and logging tools, and redeployment of Pinecrest personnel across Vaulton's client portfolio. Each of these integration activities has the potential to undermine the data isolation architecture that Pinecrest currently maintains as a standalone entity and that forms the technical foundation for the MSA's confidentiality protections.

SOC 2 Applicability. SOC 2 Type II reports evaluate the design and operating effectiveness of controls at a specific organization, covering a specific set of systems, over a defined period. Pinecrest's current SOC 2 Type II report (covering April 1, 2022, through March 31, 2023) was prepared with respect to Pinecrest's standalone operations and infrastructure. Post-acquisition restructuring of Pinecrest's operations — including any integration into Vaulton's broader platform — could render the existing SOC 2 report inapplicable to the environment in which MCB's data would actually reside and be processed. A new SOC 2 assessment of the post-integration environment would need to be conducted, and MCB would have limited ability to compel such an assessment or to ensure that it covers all relevant systems and controls.

Assessment. Based on the foregoing analysis, we conclude that the contractual protections available under the Proposed MSA — whether in their current draft form or with reasonable enhancements — are insufficient to mitigate the systemic risk of competitive intelligence leakage in a post-acquisition environment where the IT service provider simultaneously serves MCB and MCB's direct competitors. The fundamental limitation is structural rather than contractual: no set of contractual provisions can fully eliminate the risk that a sophisticated IT services provider with deep access to the operational systems of multiple horizontal competitors will become a conduit — whether deliberate, inadvertent, or structural — for the flow of competitively sensitive information.

D. Change of Control Clause

The Proposed MSA includes a change-of-control clause that permits either party to terminate the MSA upon thirty (30) days' written notice following the occurrence of a "Change of Control" event, defined to include any merger, acquisition, or other transaction resulting in a change of more than fifty percent (50%) of the equity ownership or voting control of either party.

This provision was specifically negotiated by C&H on behalf of MCB and was included in the initial draft MSA delivered to DPH on August 4, 2023. Its inclusion reflects the parties' mutual recognition that a change of control of either party fundamentally alters the commercial, operational, and risk dynamics of the engagement and that either party should have the right to exit the relationship in such circumstances without penalty.

While the MSA has not been executed, and therefore the change-of-control clause has no binding legal effect, the presence of this provision in the negotiated draft is significant for two reasons. First, it demonstrates that both MCB and Pinecrest contemplated the possibility that a change in ownership could render the engagement untenable — precisely the scenario that has now materialized. Second, it provides additional context for MCB's decision to terminate the negotiation process: MCB is exercising, in substance, the same judgment that the change-of-control clause was designed to enable, albeit at the pre-execution stage rather than post-execution.

Had the MSA been executed prior to the announcement of the Vaulton acquisition, MCB would have had the contractual right to terminate within thirty days. The fact that negotiations were still ongoing at the time of the announcement is, if anything, more favorable to MCB, as it allows for a clean exit without any termination fee, wind-down obligations, or data migration requirements.

V. Antitrust and Competition Law Considerations

A. Information Exchange Risks Under Federal Antitrust Law

The structural environment created by Vaulton's simultaneous IT service relationships with MCB and MCB's direct competitors raises concerns under federal antitrust law, specifically Section 1 of the Sherman Act (15 U.S.C. § 1) and Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45).

Under Section 1 of the Sherman Act, the exchange of competitively sensitive information among horizontal competitors — including pricing data, cost structures, promotional strategies, and capacity information — can constitute an unreasonable restraint of trade, even in the absence of an explicit agreement to fix prices or allocate markets. The courts have recognized that information exchange among competitors can facilitate tacit coordination, reduce competitive uncertainty, and lead to anti-competitive outcomes that harm consumers. The Supreme Court's decision in United States v. United States Gypsum Co., 438 U.S. 422 (1978), and subsequent lower court decisions have established that exchanges of competitively sensitive information between horizontal competitors are subject to rule of reason analysis and, in certain circumstances, may give rise to per se liability.

Significantly, the antitrust risk is not limited to direct exchanges between competitors. The Department of Justice and the Federal Trade Commission have brought enforcement actions against so-called "hub-and-spoke" arrangements in which a common intermediary — such as a shared vendor, platform, or technology provider — facilitates the flow of competitively sensitive information between horizontal competitors, even in the absence of any express agreement among the competitors to share such information. In these cases, the intermediary serves as the "hub" through which information flows between the competitor "spokes," creating the same anti-competitive effects as direct information exchange.

Vaulton's simultaneous access to the operational data of MCB, Brightleaf, and Kessler creates a structural risk profile that is consistent with the hub-and-spoke paradigm. Even in the absence of any affirmative intent by Vaulton to share information among its clients, the concentration of competitively sensitive data from multiple horizontal competitors within a single service provider creates the conditions under which information exchange could occur — whether through personnel overlap, infrastructure commingling, benchmarking practices, or other mechanisms identified in Section IV.B above. The mere existence of this structural risk could expose MCB (and, potentially, Vaulton) to antitrust scrutiny, private litigation by competitors or customers, or investigation by federal enforcement agencies, regardless of whether any actual information exchange takes place.

B. New York State Competition Law

The Proposed MSA is governed by New York law. Accordingly, in addition to federal antitrust considerations, we have assessed the implications of the competitive overlap under New York's competition statute, the Donnelly Act, codified at New York General Business Law § 340 et seq.

The Donnelly Act broadly prohibits "[e]very contract, agreement, arrangement or combination whereby... [c]ompetition or the free exercise of any activity in the conduct of any business, trade or commerce or in the furnishing of any service in this state is or may be restrained." N.Y. Gen. Bus. Law § 340(1). While the Donnelly Act is most commonly applied to affirmative anti-competitive agreements — such as price-fixing, market allocation, and bid-rigging — its broad statutory language encompasses any "arrangement" that restrains or may restrain competition.

The structural risk of information exchange through a common IT provider serving MCB and its direct competitors could, under an expansive reading of the Donnelly Act, give rise to claims of tacit coordination or facilitated collusion if competitive harm can be demonstrated. While we consider such a claim to be a lower-probability risk than the federal antitrust concerns described above, the reputational and litigation exposure associated with even an assertion of Donnelly Act liability should not be discounted, particularly in the current regulatory environment in which the New York Attorney General's office has demonstrated an increased appetite for competition enforcement actions.

C. Risk Assessment

Based on the foregoing analysis, we offer the following overall risk assessment with respect to antitrust and competition law exposure:

We do not believe that entering into the Proposed MSA with Pinecrest (now Vaulton), standing alone, would constitute an antitrust violation under either federal or New York State law. The mere fact that an IT services provider serves multiple clients in the same industry is not, by itself, unlawful. Antitrust liability would require some additional element — such as an agreement to exchange information, a pattern of information sharing, or demonstrable anti-competitive effects — beyond the structural overlap.

However, the structural environment created by Vaulton's simultaneous service relationships with MCB and its competitors generates ongoing compliance risk that would require continuous monitoring, robust internal controls, and significant management attention. Critically, MCB would be largely dependent on Vaulton to implement and maintain the data isolation, personnel separation, and information barrier mechanisms necessary to prevent information flows that could trigger antitrust scrutiny. MCB would have limited visibility into, and limited ability to enforce, Vaulton's compliance with these mechanisms.

The reputational and litigation risk of even the appearance of information exchange with competitors through a common IT provider is material. In a litigious industry environment, competitors, customers, or regulatory authorities could point to the structural arrangement as circumstantial evidence of information sharing or coordination, even in the absence of any actual wrongdoing. The burden of proving the negative — that no information was exchanged and no competitive harm resulted — would fall on MCB and Vaulton, and the cost of defending such allegations could be substantial.

This risk is further amplified by MCB's status as a portfolio company of Ashford Capital Partners Fund IV, LP. Any antitrust exposure at the portfolio company level could have cascading effects on fund-level reporting, investor relations, and regulatory compliance, particularly given the increasing scrutiny of private equity ownership structures by the FTC and DOJ. Karen Lau and the Ashford team should carefully consider whether the structural antitrust risk presented by the Vaulton/Pinecrest arrangement is consistent with Ashford's risk tolerance and fiduciary obligations to Fund IV's limited partners.

VI. Financial Analysis: Cost of Termination

A. Sunk Costs

MCB has incurred certain costs in connection with the MSA negotiation process that are not recoverable regardless of the termination decision. These sunk costs are summarized as follows:

C&H Legal Fees. Calderwood & Harkness LLP has incurred approximately $187,000 in professional fees through the date of this memorandum in connection with the negotiation of the Proposed MSA under matter number 1011-00008, client number 71982. In addition, approximately $3,200 in disbursements (including filing fees, document production costs, and travel expenses) have been incurred. A final invoice will be issued upon closure of the matter, and the total fees and disbursements are expected to remain within the range set forth herein absent further substantive work beyond the preparation of a termination letter and file closure activities.

MCB Internal Resources. Significant personnel time has been invested by MCB's internal team in connection with the MSA negotiation process. David Halverston (General Counsel), Priya Chandrasekaran (VP, IT), and Samuel Otieno (Director of Procurement) have each been materially involved over the approximately three-month negotiation period, contributing to RFP development, vendor evaluation, contract review, negotiation strategy, and internal coordination. While the internal cost of this time has not been separately quantified, it is estimated to be significant, representing a meaningful allocation of senior management attention during the negotiation period.

These costs are sunk and are not recoverable regardless of whether MCB proceeds with or terminates the MSA negotiation. They should not factor into the go-forward decision except to the extent that they inform the Company's assessment of the overall cost-effectiveness of the procurement process.

B. Ongoing Cost Differential

The primary ongoing financial impact of terminating the MSA negotiation process is the forfeiture of the cost savings that MCB would have realized under the Proposed MSA relative to the Company's incumbent IT vendor, Corwyn Technology Services LLC.

The Proposed MSA contemplated an annual contract value of $2,950,000 for a comprehensive suite of IT managed services encompassing cloud infrastructure management, managed IT services, enterprise application support, and cybersecurity monitoring and incident response. MCB's incumbent vendor, Corwyn, currently provides comparable IT managed services under a legacy agreement (originally effective March 1, 2020, with an initial three-year term that expired on February 28, 2023, and currently operating on a month-to-month extension) at an annual rate of $3,150,000.

The annual cost differential between the two arrangements is $200,000 ($3,150,000 under the Corwyn legacy agreement minus $2,950,000 under the Proposed MSA). Over the five-year initial term of the Proposed MSA (November 1, 2023, through October 31, 2028), the total forfeited savings would amount to approximately $1,000,000 ($200,000 × 5 years), assuming no escalation in Corwyn's pricing during the period (which is not guaranteed under the current month-to-month arrangement).

This cost differential, while not trivial in absolute terms, is modest in the context of MCB's financial profile. The $200,000 annual differential represents approximately 0.015% of MCB's FY 2022 revenue of $1.34 billion. Even at the total five-year level, the $1,000,000 in forfeited savings represents less than 0.075% of a single year's revenue. In our judgment, this cost differential is far outweighed by the competitive intelligence, data security, and antitrust risks identified in Sections III through V of this memorandum.

We note that MCB may have the opportunity to renegotiate its arrangement with Corwyn — either through renewal of the legacy agreement at an improved rate or through a new competitive procurement process — which could reduce or eliminate the cost differential over time.

C. No Transition or Wind-Down Costs

A significant mitigating factor in the financial analysis is the complete absence of transition or wind-down costs. Because the Proposed MSA was never executed and no binding agreement of any kind was entered into between MCB and Pinecrest, there are no contractual termination fees, early exit penalties, or wind-down obligations. No MCB data was transferred to Pinecrest's systems. No systems migration activities were initiated. No Pinecrest personnel were onboarded to MCB's environment. MCB's IT operations have continued to operate entirely within the Corwyn environment throughout the negotiation period, and the termination of negotiations will have no impact on MCB's day-to-day IT operations.

MCB's existing IT services arrangement with Corwyn Technology Services LLC continues on a month-to-month basis under the legacy agreement, providing continuity of service without interruption. There are no data migration costs, system reconfiguration expenses, or parallel-run charges that would be associated with a mid-contract transition from one vendor to another. In short, the financial impact of termination is limited to the sunk costs described in Section VI.A above and the ongoing cost differential described in Section VI.B above.

VII. Alternative Paths Forward

We have evaluated three alternative courses of action for MCB's consideration. Our recommended path is set forth in Section VII.A below. Sections VII.B and VII.C describe alternative approaches that we have considered and rejected.

A. Terminate MSA Process (Recommended)

We recommend that MCB formally terminate the MSA negotiation process with Pinecrest Digital Solutions Inc. (now a wholly owned subsidiary of Vaulton Technologies Group, Inc.). The specific steps involved in this course of action are as follows:

1. Formal Termination Notice. C&H will prepare and transmit a formal termination letter to Dunleavy, Proctor & Hale LLP (attention: Carolyn Ostrowski) on behalf of MCB, advising that MCB has elected to discontinue the MSA negotiation process. The letter will cite change-of-control concerns, competitive overlap, and data security risks as the basis for the decision, without providing the level of legal analysis contained in this memorandum (which is privileged and should not be shared with third parties).

2. Confirmation of No Binding Agreement. The termination letter will confirm that no binding agreement was reached between MCB and Pinecrest at any point, that no letters of intent or preliminary agreements with binding effect were executed, and that neither party has any transition, wind-down, or other obligations to the other in connection with the termination of negotiations.

3. Destruction of Confidential Information. The termination letter will request mutual destruction (or, at the receiving party's option, return) of all confidential information exchanged between the parties during the RFP and negotiation process, in accordance with the confidentiality obligations contained in the parties' mutual non-disclosure agreement executed in connection with the RFP process.

4. Continuation with Corwyn. MCB will continue to operate under its existing month-to-month arrangement with Corwyn Technology Services LLC at the current annual rate of $3,150,000. MCB may, at its discretion, evaluate whether to extend or renegotiate the Corwyn arrangement or to issue a new RFP for IT managed services in 2024 to identify alternative vendors without the competitive overlap concerns presented by Vaulton/Pinecrest.

This approach provides MCB with a clean, cost-effective, and legally defensible exit from the Pinecrest engagement. It preserves MCB's existing IT operations without disruption, eliminates the competitive intelligence and antitrust risks identified herein, and positions MCB to pursue alternative vendor relationships on a timeline that permits thorough evaluation of the competitive landscape.

B. Negotiate Enhanced Protections with Vaulton/Pinecrest (Not Recommended)

An alternative approach would be for MCB to continue the MSA negotiation process, but to seek enhanced data isolation, dedicated infrastructure, and information barrier provisions from Vaulton as a condition of proceeding with the engagement. Under this approach, MCB would insist on contractual commitments including, at a minimum: physically and logically segregated infrastructure for MCB's environment; dedicated personnel who do not service Brightleaf, Kessler, or any other MCB competitor; prohibition on use of MCB data for benchmarking or analytics purposes; expanded audit rights covering Vaulton's enterprise-wide data isolation practices; and enhanced breach notification and remediation obligations.

We have considered this approach and do not recommend it, for the following reasons:

Negotiating Leverage. MCB would be negotiating from a position of dependency, with limited leverage to compel Vaulton — a $4.7 billion enterprise — to implement and maintain costly dedicated infrastructure and dedicated personnel for a $2.95 million per year client relationship. Vaulton's economic incentive to accommodate MCB's data isolation requirements would be limited, particularly given the relatively modest size of the MCB engagement compared to Vaulton's overall revenue and its existing relationships with Brightleaf and Kessler.

Unresolved Issues. Four substantive MSA issues — data security standards, liability cap, termination fee, and audit rights — remained unresolved even before the acquisition announcement. Layering additional data isolation and information barrier requirements on top of these existing open items would further complicate and delay an already protracted negotiation process, with no assurance that mutually acceptable terms could be reached.

Structural Limitation of Contractual Protections. As discussed in detail in Section IV.C above, the structural risk of a common IT provider serving MCB and its direct competitors cannot be fully eliminated through contract. Contractual obligations are only as effective as the obligor's ability and willingness to implement them, and MCB's ability to monitor and enforce Vaulton's compliance would be inherently limited. No amount of contractual drafting can prevent the accumulation of institutional knowledge by personnel who rotate between engagements, the inadvertent cross-client visibility created by shared monitoring tools, or the inferential value of anonymized benchmarking data in the hands of a provider with deep knowledge of multiple competitors' operations.

Ongoing Monitoring and Enforcement Costs. Even if enhanced protections could be negotiated, the cost of ongoing monitoring, auditing, and enforcement would be significant. MCB would need to invest in specialized compliance and oversight capabilities — potentially including third-party auditors with expertise in IT data isolation — to verify Vaulton's adherence to the enhanced provisions. These costs would erode or eliminate the $200,000 annual cost savings that motivated the procurement process in the first place.

Audit Rights Expansion. The audit rights provisions of the Proposed MSA — already one of the four unresolved negotiation issues — would need to be substantially expanded to cover Vaulton's broader operations, including its data isolation practices, personnel assignment protocols, and infrastructure architecture. Vaulton is unlikely to grant audit rights of this scope, given the sensitivity of its operations and its obligations to other clients (including Brightleaf and Kessler, who would presumably object to MCB having audit access to systems and processes that touch their data).

For these reasons, we do not recommend pursuing enhanced protections as an alternative to termination.

C. Proceed with MSA Without Enhanced Protections (Not Recommended)

The third alternative — proceeding with the Proposed MSA as currently drafted, without attempting to negotiate enhanced data isolation or information barrier provisions — would expose MCB to the full range of data security, competitive intelligence, and antitrust risks identified in this memorandum. Under this approach, MCB would rely solely on the existing confidentiality provisions of the MSA, which, as discussed in Section IV.C, were designed for a standalone Pinecrest engagement and are inadequate to address the systemic risks created by the Vaulton acquisition.

This path is strongly not recommended. It would expose MCB to material and potentially irreparable competitive harm, create ongoing antitrust compliance risk, and place MCB in a position of significant dependency on Vaulton's good faith implementation of data isolation practices that MCB would have no meaningful ability to monitor or enforce.

VIII. Recommendation

Based on the analysis set forth in this memorandum, Calderwood & Harkness LLP recommends that Meridian Consumer Brands LLC terminate the MSA negotiation process with Pinecrest Digital Solutions Inc. (now a wholly owned subsidiary of Vaulton Technologies Group, Inc.) and formally close the matter.

The competitive overlap created by Vaulton's existing IT service relationships with Brightleaf Brands, Inc. and Kessler Home & Personal Care Corp. — two direct competitors of MCB in the household cleaning, personal care, and beauty segments — combined with the data security and antitrust risks identified in this memorandum, renders continuation of the Proposed MSA untenable. These risks exist regardless of additional contractual protections that might be negotiated, because the structural concentration of competitive intelligence within a single IT services provider that simultaneously serves MCB and its primary competitors presents a category of risk that contract cannot fully mitigate.

MCB should continue to operate under its month-to-month extension with Corwyn Technology Services LLC at the current annual rate of $3,150,000. While this represents a forfeiture of approximately $200,000 per year in savings relative to the proposed Pinecrest ACV of $2,950,000 per year ($1,000,000 over the contemplated five-year term), this cost differential is de minimis in the context of MCB's overall IT budget and revenue base (approximately 0.015% of FY 2022 revenue) and is far outweighed by the risk mitigation achieved through termination.

MCB may wish to consider issuing a new RFP for IT managed services in early 2024 to identify alternative vendors that do not present the competitive overlap concerns associated with the Vaulton/Pinecrest combination. Any future procurement process should incorporate competitive overlap screening criteria in the vendor evaluation framework to identify and mitigate similar risks at the outset.

If MCB management concurs with this recommendation, C&H will prepare and transmit a formal termination letter to Dunleavy, Proctor & Hale LLP (attention: Carolyn Ostrowski) on behalf of MCB and take all steps necessary to close the matter.

IX. Next Steps

Upon review of this memorandum, we request that the following steps be taken in the order indicated:

1. MCB Management Decision. Meg Thornbury (CEO) and David Halverston (General Counsel) to review this memorandum and confirm their decision regarding termination of the MSA negotiation process. We are available to discuss any questions or concerns by telephone or in person at the addressees' convenience.

2. PE Sponsor Alignment. Karen Lau, Operating Partner at Ashford Capital Management LLC, to review this memorandum and confirm that the recommended course of action is consistent with Ashford's risk tolerance and strategic perspective regarding the MCB investment. To the extent that Ashford's legal or compliance functions wish to review the antitrust analysis, we are available to provide a briefing at Ms. Lau's direction.

3. Formal Termination Letter. Upon confirmation of the termination decision by MCB management and the Ashford team, C&H will prepare and transmit a formal termination letter

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
MEMORANDUM
October 20, 2023
FROM: Elaine Forsythe, Partner, Antitrust & Competition Practice, and Leila Nazari, Associate Calderwood & Harkness LLP 125 Park Avenue, 34th Floor New York, NY 10017
TO: David Halverston, General Counsel, Meridian Consumer Brands LLC Margaret "Meg" Thornbury, CEO, Meridian Consumer Brands LLC Karen Lau, Operating Partner, Ashford Capital Management LLC
RE: Competitive Overlap and Antitrust Analysis — Vaulton Technologies Group, Inc. Acquisition of Pinecrest Digital Solutions Inc.; Implications for Proposed Master Services Agreement (MSA-PDS-MCB-2023)
Matter No.: 1011-00008 Client No.: 71982
PRIVILEGE DESIGNATION: This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared in connection with Calderwood & Harkness LLP's representation of Meridian Consumer Brands LLC. It contains legal analysis and recommendations protected by the attorney-client privilege and the work product doctrine. This memorandum should not be disclosed, disseminated, distributed, or copied to any third party without the prior written consent of Calderwood & Harkness LLP. Any inadvertent disclosure does not constitute a waiver of privilege.
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the competitive overlap risks and antitrust implications arising from Vaulton Technologies Group, Inc.'s ("Vaulton") announced acquisition of Pinecrest Digital Solutions Inc. ("Pinecrest") and the impact of that transaction on the proposed Master Services Agreement between Pinecrest and Meridian Consumer Brands LLC ("MCB" or the "Company") designated MSA-PDS-MCB-2023 (the "Proposed MSA").
On October 12, 2023, Vaulton publicly announced its agreement to acquire Pinecrest for a reported purchase price of $685 million. Stonebridge Advisory Group LLC served as Vaulton's investment banking advisor in connection with the transaction. As of the date of this memorandum, closing of the acquisition has not yet occurred but is anticipated imminently, with public filings and press reports indicating a targeted closing date of October 27, 2023. We will update our analysis to the extent any material developments arise between the date hereof and the date of the client's decision.
MCB had been in active negotiations with Pinecrest regarding the Proposed MSA since July 25, 2023, the date on which Calderwood & Harkness LLP ("C&H") was engaged to lead the negotiation of definitive transaction documentation. A first draft of the MSA was delivered to Pinecrest's outside counsel, Dunleavy, Proctor & Hale LLP ("DPH"), on August 4, 2023, and the parties had conducted two substantive negotiation sessions, on September 8 and September 29, 2023, respectively. A near-final draft of the MSA was circulated on October 6, 2023, with four substantive issues remaining open and bracketed for escalation to business principals. Negotiations were formally paused on October 18, 2023, via letter from C&H to DPH (attention: Carolyn Ostrowski, lead partner), pending the completion of this competitive overlap and antitrust analysis.
Key Conclusion. Based on our review of the competitive landscape, the nature and scope of the IT services contemplated under the Proposed MSA, the categories of MCB proprietary data that would be exposed to the service provider, and the existing commercial relationships between Vaulton and MCB's direct competitors, we conclude that the Vaulton acquisition of Pinecrest creates irreconcilable competitive overlap and data security risks that cannot be adequately mitigated through contractual mechanisms. The structural environment further presents ongoing antitrust compliance risk under both federal and state competition laws.
Accordingly, C&H recommends that MCB terminate the MSA negotiation process with Pinecrest and continue operating under its existing month-to-month arrangement with its incumbent IT vendor, Corwyn Technology Services LLC ("Corwyn"), notwithstanding the annual cost differential of approximately $200,000 (the Corwyn legacy agreement is priced at $3,150,000 per year compared to the proposed Pinecrest ACV of $2,950,000 per year). Over the contemplated five-year MSA term, this represents $1,000,000 in forfeited savings — a figure that, while not immaterial in isolation, is de minimis relative to MCB's FY 2022 revenue of $1.34 billion and is far outweighed by the data security, competitive intelligence, and antitrust risks identified herein.
The detailed analysis supporting this recommendation is set forth below.
II. Background
A. The Proposed MSA with Pinecrest
MCB initiated a formal procurement process for IT managed services in early 2023 in connection with a broader strategic review of the Company's technology infrastructure and vendor relationships. On June 12, 2023, MCB's Procurement team, under the direction of Samuel Otieno, Director of Procurement, issued Request for Proposal No. MCB-IT-RFP-2023-006 (the "RFP"), soliciting bids from qualified IT managed services providers for a comprehensive suite of cloud infrastructure management, managed IT services, enterprise application support, and cybersecurity monitoring and incident response services.
Pinecrest Digital Solutions Inc. was among several respondents to the RFP. Pinecrest is a Delaware corporation headquartered at 2300 Lakewood Boulevard, Suite 400, Durham, North Carolina 27713. Pinecrest was founded in 2016 and is led by Nathan Whitford, Chief Executive Officer. For its fiscal year ended December 31, 2022, Pinecrest reported revenue of approximately $218 million and employed approximately 1,100 individuals. Pinecrest's Chief Revenue Officer, Tessa Johannsen, led the commercial proposal process, and Rina Balakrishnan served as Pinecrest's General Counsel.
Following evaluation of the submitted proposals, MCB selected Pinecrest as the preferred vendor on July 10, 2023. The selection was based on a combination of factors, including competitive pricing, demonstrated technical capabilities in the consumer products sector, SOC 2 Type II certification, and favorable reference checks from comparable mid-market clients.
C&H was formally engaged on July 25, 2023, to negotiate the MSA and related documentation on behalf of MCB. The first draft of the MSA (designated MSA-PDS-MCB-2023) was prepared by C&H and delivered to Pinecrest's outside counsel, Dunleavy, Proctor & Hale LLP (300 South Tryon Street, Suite 2200, Charlotte, North Carolina 28202), on August 4, 2023. Lead partner Carolyn Ostrowski and associate James Feng of DPH represented Pinecrest throughout the negotiation process.
The principal commercial terms of the Proposed MSA, as reflected in the near-final draft circulated on October 6, 2023, are summarized as follows:
Term: Five-year initial term commencing November 1, 2023, and expiring October 31, 2028, with renewal provisions to be determined at the business principal level.
Contract Value: Total contract value of $14,750,000 over the five-year term, representing an annual contract value ("ACV") of $2,950,000. The ACV is allocated across four service components:
• Cloud Infrastructure Management: $1,200,000 per year — encompassing public and private cloud hosting, infrastructure provisioning, monitoring, capacity management, and disaster recovery services.
• Managed IT Services (Help Desk and Endpoint Management): $825,000 per year — encompassing 24/7 help desk support, desktop and laptop endpoint management, patch management, and mobile device management for MCB's approximately 4,200 endpoints.
• Enterprise Application Support (Harborline Software and Pinnacle Health IT): $575,000 per year — encompassing ongoing administration, configuration, customization, and break/fix support for MCB's Harborline Software production environment and Quillon Data Systems platform.
• Cybersecurity Monitoring and Incident Response: $350,000 per year — encompassing 24/7 security operations center (SOC) monitoring, threat intelligence, vulnerability scanning, penetration testing coordination, and incident response services.
Payment Terms: Net 45 days from invoice date, with invoices submitted quarterly in advance.
Key Protective Provisions: The Proposed MSA contains a number of protective provisions that were specifically negotiated by C&H on behalf of MCB, including:
• SOC 2 Type II Certification: Pinecrest is required to maintain, at all times during the term, a current SOC 2 Type II report covering the Trust Services Criteria relevant to the services provided under the MSA. Pinecrest's most recent SOC 2 Type II report was issued on March 15, 2023, and covers the period from April 1, 2022, through March 31, 2023.
• Breach Notification: Pinecrest is required to notify MCB of any security breach or unauthorized access to MCB data within seventy-two (72) hours of discovery.
• Liability Cap: The aggregate liability of Pinecrest under the MSA is capped at two times (2×) the fees paid or payable by MCB during the twelve (12) months immediately preceding the event giving rise to the claim, resulting in a maximum liability exposure of $5,900,000. This provision remained one of the four open items at the time negotiations were paused, with DPH advocating for a cap of one times (1×) the prior twelve months' fees.
• Change of Control: The MSA contains a change-of-control provision permitting either party to terminate the MSA upon thirty (30) days' written notice following the occurrence of a Change of Control event, defined to include any merger, acquisition, or other transaction resulting in a change of more than fifty percent (50%) of the equity ownership or voting control of either party.
• Non-Solicitation: Mutual twelve (12) month non-solicitation of employees during the term and for twelve months following expiration or termination.
• Insurance Requirements: Pinecrest is required to maintain the following minimum insurance coverages: technology errors and omissions / cyber liability insurance in the amount of $10,000,000 per occurrence; commercial general liability insurance in the amount of $5,000,000 per occurrence; and workers' compensation insurance in the amount of $2,000,000 per occurrence.
Negotiation Status. As of the date negotiations were paused on October 18, 2023, the MSA was in an advanced state of negotiation. Two formal negotiation calls had been conducted. During the first call on September 8, 2023, the parties addressed the initial redline delivered by DPH on August 25, 2023, which raised forty-seven (47) discrete issues. Of these, twenty-nine (29) were resolved during that call. A second redline was circulated by DPH on September 22, 2023, reflecting twelve (12) remaining open issues. During the second negotiation call on September 29, 2023, eight (8) of those remaining issues were resolved. A near-final draft incorporating all resolved provisions was circulated on October 6, 2023, with four (4) issues remaining open and bracketed for escalation to business principals:
1. Data security standards (scope and specificity of security controls obligations);
2. Liability cap (2× prior 12 months' fees vs. 1× prior 12 months' fees);
3. Termination fee (amount and conditions of early termination payment); and
4. Audit rights (scope, frequency, and cost allocation of MCB's right to audit Pinecrest's operations, security controls, and financial records).
No Binding Agreement. It is critical to note that no binding agreement was executed between MCB and Pinecrest at any point. No letters of intent, term sheets, or other preliminary agreements with binding effect were signed. No MCB data was transferred to Pinecrest, and no systems migration activities were initiated. MCB's IT operations continue to be performed by Corwyn Technology Services LLC under the legacy agreement dated March 1, 2020, which is currently operating on a month-to-month extension following expiration of its initial three-year term on February 28, 2023.
B. MCB's Business Profile
Meridian Consumer Brands LLC ("MCB" or the "Company") is a Delaware limited liability company headquartered at 680 Fifth Avenue, 22nd Floor, New York, New York 10019. The Company's registered agent in Delaware is Capitol Registered Agents, LLC, located at 1209 Orange Street, Wilmington, Delaware 19801. MCB's employer identification number (EIN) is 83-4127596.
MCB operates in the consumer products and retail industry, with a portfolio of well-known brands in the household cleaning, personal care, and beauty segments. For its fiscal year ended December 31, 2022, MCB reported revenue of approximately $1.34 billion, with distribution through major national retailers, e-commerce platforms, and specialty channels across the United States and select international markets.
MCB is wholly owned by Ashford Capital Partners Fund IV, LP ("Fund IV"), a private equity fund with approximately $3.8 billion in committed capital (2018 vintage). Fund IV's general partner is Ashford Capital Management LLC ("Ashford"), headquartered at 9 West 57th Street, Suite 3200, New York, New York 10019. Ashford's Managing Partner is Vincent Driscoll, and the Operating Partner with primary oversight responsibility for the MCB investment is Karen Lau, who is among the addressees of this memorandum. Ashford acquired MCB in 2019 and has been actively involved in the Company's operational and strategic decision-making since that time.
MCB's senior management team includes Margaret "Meg" Thornbury, Chief Executive Officer; David Halverston, General Counsel; Priya Chandrasekaran, Vice President, Information Technology; and Samuel Otieno, Director of Procurement. MCB's independent auditor is Ridgeline Audit Partners LLP, located at 7 Times Square, New York, New York 10036.
C. Vaulton Technologies Group, Inc.
Vaulton Technologies Group, Inc. ("Vaulton") is a Delaware corporation headquartered at 1400 Peachtree Road NE, Suite 3100, Atlanta, Georgia 30309. Vaulton's Chief Executive Officer is Robert "Rob" Castellano. For its fiscal year ended December 31, 2022, Vaulton reported revenue of approximately $4.7 billion, making it one of the largest enterprise technology and IT services companies in North America. Vaulton provides a comprehensive suite of IT infrastructure, managed services, cloud computing, data analytics, cybersecurity, and enterprise application services to clients across a wide range of industries, including consumer products, healthcare, financial services, and manufacturing.
On October 12, 2023, Vaulton publicly announced its agreement to acquire all of the outstanding equity interests of Pinecrest Digital Solutions Inc. for a reported purchase price of $685 million. The acquisition was described in Vaulton's public statements as a strategic transaction designed to expand Vaulton's mid-market IT managed services capabilities and broaden its footprint in the consumer products and healthcare verticals — sectors in which Pinecrest has developed a strong client base since its founding in 2016. Stonebridge Advisory Group LLC, located at 200 Clarendon Street, 50th Floor, Boston, Massachusetts 02116, served as Vaulton's investment banking advisor in connection with the transaction.
Based on public filings and press reports as of the date of this memorandum, closing of the Vaulton-Pinecrest transaction is expected to occur by the end of October 2023. We understand from subsequent reports that the acquisition closed on October 27, 2023; however, as of the date of this memorandum (October 20, 2023), closing had not yet occurred. Our analysis contemplates the post-closing environment in which Pinecrest operates as a wholly owned subsidiary of Vaulton.
D. Pinecrest's Counsel
Throughout the MSA negotiation process, Pinecrest has been represented by Dunleavy, Proctor & Hale LLP ("DPH"), located at 300 South Tryon Street, Suite 2200, Charlotte, North Carolina 28202. Lead partner Carolyn Ostrowski has served as the primary point of contact on behalf of DPH, with associate James Feng providing supporting analysis and drafting. Pinecrest's in-house legal team has been led by General Counsel Rina Balakrishnan, with commercial oversight provided by Chief Revenue Officer Tessa Johannsen. All formal communications regarding the pause of negotiations were directed to Ms. Ostrowski at DPH.
III. Competitive Overlap Analysis
A. Vaulton's Existing IT Relationships with MCB's Direct Competitors
A central concern arising from the Vaulton-Pinecrest transaction is the fact that Vaulton currently maintains active IT services relationships with at least two companies that are direct competitors of MCB in MCB's core product segments. These relationships are described below.
1. Brightleaf Brands, Inc.
Brightleaf Brands, Inc. ("Brightleaf") is a Delaware corporation and a direct competitor of MCB in the household cleaning and personal care product segments. For its fiscal year ended December 31, 2022, Brightleaf reported revenue of approximately $2.1 billion, making it a substantially larger competitor in the categories where its product portfolio overlaps with MCB's.
Based on publicly available information and industry intelligence gathered by MCB's IT and Procurement teams, Vaulton currently provides managed IT infrastructure services to Brightleaf under an existing commercial arrangement. The scope of Vaulton's services to Brightleaf includes cloud hosting, data center management, and enterprise application support — services that are substantially identical in nature and scope to the Cloud Infrastructure Management and Enterprise Application Support service lines contemplated under the Proposed MSA between MCB and Pinecrest. The overlap between the services Vaulton provides to Brightleaf and the services Pinecrest would provide to MCB is extensive and covers precisely the categories of IT services through which MCB's most competitively sensitive data would be exposed to the service provider.
2. Kessler Home & Personal Care Corp.
Kessler Home & Personal Care Corp. ("Kessler") is a Delaware corporation and a direct competitor of MCB in the personal care and beauty product segments. For its fiscal year ended December 31, 2022, Kessler reported revenue of approximately $890 million. While Kessler is smaller than MCB in aggregate revenue terms, the competitive overlap between the two companies is particularly intense in the personal care and beauty categories, where both companies compete for the same retail shelf space, digital advertising placements, and consumer demographics.
Based on available information, Vaulton currently provides data analytics platform hosting services to Kessler. These data analytics hosting services are directly analogous to the services that would be provided to MCB under the Proposed MSA's Cloud Infrastructure Management and Cybersecurity Monitoring components. In particular, the data analytics hosting relationship gives Vaulton visibility into Kessler's data infrastructure and analytical capabilities — the same types of operational systems and data flows that MCB would be entrusting to Pinecrest (now Vaulton) under the Proposed MSA.
B. Degree of Competitive Overlap
The competitive overlap created by the Vaulton-Pinecrest acquisition is both deep and structural. MCB, Brightleaf, and Kessler compete head-to-head across multiple product categories in the household cleaning, personal care, and beauty segments. These are not merely adjacent or tangentially related competitors; they are direct rivals competing for the same consumers, the same retailer shelf allocations, the same promotional windows, and the same digital advertising inventory.
The combined revenue of Brightleaf and Kessler — the two MCB competitors currently served by Vaulton — is approximately $2.99 billion ($2.1 billion + $890 million), compared to MCB's FY 2022 revenue of approximately $1.34 billion. In other words, Vaulton's existing competitor-client base in the consumer products space represents more than twice MCB's revenue. This disparity has implications for leverage dynamics: in any dispute over data isolation practices or information barrier compliance, Vaulton's economic incentives would be weighted toward its larger existing clients (Brightleaf and Kessler) rather than toward MCB.
Under the Proposed MSA, Pinecrest — which would operate as a wholly owned subsidiary of Vaulton post-closing — would have access to MCB's operational data across all four service lines: Cloud Infrastructure Management, Managed IT Services, Enterprise Application Support, and Cybersecurity Monitoring and Incident Response. In the post-acquisition environment, Vaulton would simultaneously hold the confidential operational data of MCB and at least two of MCB's primary competitors.
This creates an unprecedented concentration of competitive intelligence within a single IT services provider. While large IT services companies routinely serve multiple clients within the same industry, the specific combination of factors present here — direct horizontal competition among the clients, overlapping service categories providing access to substantially similar types of operational data, and the magnitude of the competitive overlap — distinguishes this situation from routine multi-client engagements and elevates it to a level of risk that warrants serious concern.
IV. Data Security and Competitive intelligence Risks
A. MCB Proprietary Data at Risk
The Proposed MSA contemplates that Pinecrest (now Vaulton) would host and manage a broad range of MCB's information technology systems and the data residing within those systems. Based on our review of the Proposed MSA's scope of services and the due diligence materials exchanged during the negotiation process, the following categories of MCB proprietary data would be hosted on, or accessible through, Pinecrest (Vaulton) infrastructure:
Trade Promotion Data. MCB's trade promotion management system, which would be supported under the Enterprise Application Support service line, contains detailed promotional calendars, retailer-specific pricing and promotional terms, promotional lift analytics and post-event analysis data, and co-op advertising budgets and spend allocations. This data provides granular visibility into MCB's go-to-market strategy on a retailer-by-retailer, category-by-category basis and represents some of the Company's most competitively sensitive commercial information. Competitors with access to this data would gain material insight into MCB's promotional cadence, pricing floors, and trade investment priorities.
Pricing Algorithms. MCB's pricing infrastructure, which relies in part on cloud-hosted computational resources that would fall within the Cloud Infrastructure Management service line, includes dynamic pricing models, competitive price benchmarking databases, and margin optimization algorithms. These systems incorporate proprietary methodologies for calculating optimal price points across channels and geographies, taking into account cost-of-goods-sold data, competitor pricing intelligence, retailer margin expectations, and consumer elasticity models. Access to these algorithms and the underlying data would provide a competitor with a roadmap to MCB's pricing strategy and enable targeted competitive responses.
Supply Chain Analytics. MCB's supply chain management systems, which would be supported through both the Cloud Infrastructure Management and Enterprise Application Support service lines, encompass demand forecasting models, supplier cost data (including negotiated raw material pricing, contract terms, and volume commitments), inventory optimization algorithms, and logistics routing and cost models. This data reflects MCB's operational efficiency, sourcing strategy, and cost structure at a level of detail that would be of extraordinary competitive value to Brightleaf and Kessler, both of which compete for many of the same raw materials, manufacturing capacity, and logistics networks.
Enterprise Application Data. The Proposed MSA's Enterprise Application Support service line specifically covers MCB's Harborline Software production environment and Quillon Data Systems platform. The Harborline Software environment contains MCB's financial data (general ledger, accounts payable, accounts receivable, cash management), procurement data (purchase orders, vendor master data, sourcing analytics), manufacturing data (production planning, bill of materials, quality management), and distribution data (warehouse management, shipping, transportation management). The Quillon Data Systems platform contains MCB's customer pipeline data, sales forecasting models, account-level strategies, and competitive win/loss analyses. Taken together, these systems constitute the operational backbone of MCB's business and contain data that, if accessed by a competitor, could cause material and irreparable competitive harm.
B. Mechanisms of Potential Information Leakage
Even with the best of intentions and robust contractual protections, the structural environment created by Vaulton's simultaneous service relationships with MCB and its competitors presents multiple vectors through which competitively sensitive information could leak — whether intentionally, inadvertently, or through the gradual accumulation of institutional knowledge. We identify four primary mechanisms of concern:
Personnel Overlap. Enterprise IT services firms, including Vaulton, routinely rotate technical personnel among client engagements based on skill requirements, project timelines, and resource availability. Engineers, analysts, system administrators, and project managers who service MCB's infrastructure under the Proposed MSA could subsequently — or, in some cases, simultaneously — be assigned to service Brightleaf or Kessler accounts. Even in the absence of any deliberate attempt to transfer information, these individuals would carry institutional knowledge of MCB's systems architecture, data structures, operational patterns, security posture, and technology roadmap. This institutional knowledge, once acquired, cannot be effectively partitioned or forgotten. The risk is particularly acute for senior technical personnel who develop deep familiarity with a client's operations over multi-year engagements and who may recognize commercially significant patterns in competitor environments based on their knowledge of MCB's operations.
Infrastructure Commingling. Unless Vaulton maintains strict physical and logical segregation of client environments — including dedicated hardware, separate network segments, independent administrative access credentials, isolated logging and monitoring systems, and segregated backup and disaster recovery infrastructure — MCB's data could reside on shared infrastructure with the data of Brightleaf, Kessler, or other Vaulton clients. Multi-tenant cloud environments, while cost-effective and operationally efficient, inherently create shared attack surfaces and access pathways. Administrative tools, network monitoring platforms, and centralized logging systems used by Vaulton's operations staff could create cross-client visibility that is difficult to detect and even more difficult to prevent. The trend in the IT services industry toward platform consolidation and shared services delivery models further increases the likelihood that Pinecrest's currently segregated infrastructure will be integrated into Vaulton's broader platform over time, particularly given the strategic rationale for the acquisition (expanding Vaulton's mid-market capabilities through integration of Pinecrest's operations).
Analytics and Benchmarking. IT service providers routinely aggregate and analyze client data — often in anonymized or pseudonymized form — for purposes of internal benchmarking, capacity planning, service level optimization, and product development. Even when such aggregation is conducted in good faith and with appropriate anonymization techniques, the resulting insights can reveal competitively sensitive patterns if the provider has sufficient context to de-anonymize or re-identify the data. In this case, Vaulton's deep knowledge of the consumer products industry and its simultaneous service relationships with MCB, Brightleaf, and Kessler would make effective anonymization extremely difficult to achieve. Aggregated data on cloud utilization patterns, compute demand curves, data volumes, and application usage profiles could reveal information about seasonal demand patterns, promotional activity levels, and operational capacity that would be meaningful to a sophisticated competitor.
Breach or Incident Response. The Proposed MSA's Cybersecurity Monitoring and Incident Response service line, priced at $350,000 per year, contemplates that Pinecrest (Vaulton) personnel would have deep, broad, and often unrestricted access to MCB's systems during security incident investigation and response. The 72-hour breach notification obligation — while an important contractual protection — operates after the fact and does not prevent Vaulton's incident response team from accessing and analyzing MCB's most sensitive data during the course of an investigation. Incident response activities often require forensic analysis of system logs, data flows, user activity, and application behavior, providing the responder with comprehensive visibility into the client's operational environment. In a shared-provider scenario, the same incident response team members could be called upon to respond to incidents at Brightleaf or Kessler, carrying forward detailed technical knowledge acquired during MCB engagements.
C. Adequacy of Contractual Data Isolation Mechanisms
We have carefully reviewed the confidentiality and data protection provisions of the Proposed MSA (MSA-PDS-MCB-2023) to assess whether they are adequate to mitigate the competitive intelligence risks identified above. Our assessment is that, while the existing contractual protections are reasonable and appropriate for a standalone Pinecrest engagement, they are fundamentally insufficient to address the systemic risks created by the Vaulton acquisition.
The draft MSA contains standard confidentiality provisions that impose obligations on Pinecrest to: (i) restrict access to MCB's confidential information to personnel with a legitimate "need to know" in connection with the performance of services under the MSA; (ii) maintain reasonable administrative, physical, and technical security controls to protect MCB data against unauthorized access, use, or disclosure; and (iii) refrain from using MCB's confidential information for any purpose other than the performance of the MSA.
In addition, the MSA requires Pinecrest to maintain a current SOC 2 Type II report (Pinecrest's most recent report, issued March 15, 2023, covers the period from April 1, 2022, through March 31, 2023) and to conduct annual penetration testing of the systems and infrastructure used to deliver services to MCB.
However, these provisions were drafted and negotiated with Pinecrest as a standalone company — an independent mid-market IT services provider with approximately $218 million in annual revenue and approximately 1,100 employees. Pinecrest as a wholly owned subsidiary of Vaulton ($4.7 billion in annual revenue) presents fundamentally different risk dynamics that the existing contractual framework was not designed to address:
Cross-Client Confidentiality. Vaulton's existing contracts with Brightleaf and Kessler undoubtedly contain their own confidentiality and data protection provisions. However, MCB has no visibility into, and no contractual right to review or enforce, those provisions. MCB cannot determine whether Vaulton's obligations to Brightleaf and Kessler are consistent with, or conflict with, its obligations to MCB, nor can MCB assess whether Vaulton's data isolation practices are adequate to prevent cross-client information flows.
Audit Rights. The Proposed MSA's audit rights provisions — which are themselves one of the four unresolved issues remaining at the time negotiations were paused — were scoped for Pinecrest-only operations. These provisions would not give MCB the right to audit Vaulton's broader operations, to inspect Vaulton's data isolation practices as between MCB's data and competitor data, or to verify that Vaulton's personnel assignment practices maintain adequate separation between the MCB engagement and the Brightleaf and Kessler engagements. Expanding these audit rights to cover Vaulton's enterprise-wide operations would require a fundamental renegotiation of the audit provisions — a concession that Vaulton is unlikely to grant, given the breadth and sensitivity of its operations and its obligations to other clients.
Operational Integration. Vaulton may — and, based on the strategic rationale for the acquisition, likely will — integrate Pinecrest's operations, personnel, technology platform, and infrastructure into its broader enterprise over time. Such integration could include consolidation of data centers, migration to shared cloud platforms, unification of identity and access management systems, standardization of monitoring and logging tools, and redeployment of Pinecrest personnel across Vaulton's client portfolio. Each of these integration activities has the potential to undermine the data isolation architecture that Pinecrest currently maintains as a standalone entity and that forms the technical foundation for the MSA's confidentiality protections.
SOC 2 Applicability. SOC 2 Type II reports evaluate the design and operating effectiveness of controls at a specific organization, covering a specific set of systems, over a defined period. Pinecrest's current SOC 2 Type II report (covering April 1, 2022, through March 31, 2023) was prepared with respect to Pinecrest's standalone operations and infrastructure. Post-acquisition restructuring of Pinecrest's operations — including any integration into Vaulton's broader platform — could render the existing SOC 2 report inapplicable to the environment in which MCB's data would actually reside and be processed. A new SOC 2 assessment of the post-integration environment would need to be conducted, and MCB would have limited ability to compel such an assessment or to ensure that it covers all relevant systems and controls.
Assessment. Based on the foregoing analysis, we conclude that the contractual protections available under the Proposed MSA — whether in their current draft form or with reasonable enhancements — are insufficient to mitigate the systemic risk of competitive intelligence leakage in a post-acquisition environment where the IT service provider simultaneously serves MCB and MCB's direct competitors. The fundamental limitation is structural rather than contractual: no set of contractual provisions can fully eliminate the risk that a sophisticated IT services provider with deep access to the operational systems of multiple horizontal competitors will become a conduit — whether deliberate, inadvertent, or structural — for the flow of competitively sensitive information.
D. Change of Control Clause
The Proposed MSA includes a change-of-control clause that permits either party to terminate the MSA upon thirty (30) days' written notice following the occurrence of a "Change of Control" event, defined to include any merger, acquisition, or other transaction resulting in a change of more than fifty percent (50%) of the equity ownership or voting control of either party.
This provision was specifically negotiated by C&H on behalf of MCB and was included in the initial draft MSA delivered to DPH on August 4, 2023. Its inclusion reflects the parties' mutual recognition that a change of control of either party fundamentally alters the commercial, operational, and risk dynamics of the engagement and that either party should have the right to exit the relationship in such circumstances without penalty.
While the MSA has not been executed, and therefore the change-of-control clause has no binding legal effect, the presence of this provision in the negotiated draft is significant for two reasons. First, it demonstrates that both MCB and Pinecrest contemplated the possibility that a change in ownership could render the engagement untenable — precisely the scenario that has now materialized. Second, it provides additional context for MCB's decision to terminate the negotiation process: MCB is exercising, in substance, the same judgment that the change-of-control clause was designed to enable, albeit at the pre-execution stage rather than post-execution.
Had the MSA been executed prior to the announcement of the Vaulton acquisition, MCB would have had the contractual right to terminate within thirty days. The fact that negotiations were still ongoing at the time of the announcement is, if anything, more favorable to MCB, as it allows for a clean exit without any termination fee, wind-down obligations, or data migration requirements.
V. Antitrust and Competition Law Considerations
A. Information Exchange Risks Under Federal Antitrust Law
The structural environment created by Vaulton's simultaneous IT service relationships with MCB and MCB's direct competitors raises concerns under federal antitrust law, specifically Section 1 of the Sherman Act (15 U.S.C. § 1) and Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45).
Under Section 1 of the Sherman Act, the exchange of competitively sensitive information among horizontal competitors — including pricing data, cost structures, promotional strategies, and capacity information — can constitute an unreasonable restraint of trade, even in the absence of an explicit agreement to fix prices or allocate markets. The courts have recognized that information exchange among competitors can facilitate tacit coordination, reduce competitive uncertainty, and lead to anti-competitive outcomes that harm consumers. The Supreme Court's decision in United States v. United States Gypsum Co., 438 U.S. 422 (1978), and subsequent lower court decisions have established that exchanges of competitively sensitive information between horizontal competitors are subject to rule of reason analysis and, in certain circumstances, may give rise to per se liability.
Significantly, the antitrust risk is not limited to direct exchanges between competitors. The Department of Justice and the Federal Trade Commission have brought enforcement actions against so-called "hub-and-spoke" arrangements in which a common intermediary — such as a shared vendor, platform, or technology provider — facilitates the flow of competitively sensitive information between horizontal competitors, even in the absence of any express agreement among the competitors to share such information. In these cases, the intermediary serves as the "hub" through which information flows between the competitor "spokes," creating the same anti-competitive effects as direct information exchange.
Vaulton's simultaneous access to the operational data of MCB, Brightleaf, and Kessler creates a structural risk profile that is consistent with the hub-and-spoke paradigm. Even in the absence of any affirmative intent by Vaulton to share information among its clients, the concentration of competitively sensitive data from multiple horizontal competitors within a single service provider creates the conditions under which information exchange could occur — whether through personnel overlap, infrastructure commingling, benchmarking practices, or other mechanisms identified in Section IV.B above. The mere existence of this structural risk could expose MCB (and, potentially, Vaulton) to antitrust scrutiny, private litigation by competitors or customers, or investigation by federal enforcement agencies, regardless of whether any actual information exchange takes place.
B. New York State Competition Law
The Proposed MSA is governed by New York law. Accordingly, in addition to federal antitrust considerations, we have assessed the implications of the competitive overlap under New York's competition statute, the Donnelly Act, codified at New York General Business Law § 340 et seq.
The Donnelly Act broadly prohibits "[e]very contract, agreement, arrangement or combination whereby... [c]ompetition or the free exercise of any activity in the conduct of any business, trade or commerce or in the furnishing of any service in this state is or may be restrained." N.Y. Gen. Bus. Law § 340(1). While the Donnelly Act is most commonly applied to affirmative anti-competitive agreements — such as price-fixing, market allocation, and bid-rigging — its broad statutory language encompasses any "arrangement" that restrains or may restrain competition.
The structural risk of information exchange through a common IT provider serving MCB and its direct competitors could, under an expansive reading of the Donnelly Act, give rise to claims of tacit coordination or facilitated collusion if competitive harm can be demonstrated. While we consider such a claim to be a lower-probability risk than the federal antitrust concerns described above, the reputational and litigation exposure associated with even an assertion of Donnelly Act liability should not be discounted, particularly in the current regulatory environment in which the New York Attorney General's office has demonstrated an increased appetite for competition enforcement actions.
C. Risk Assessment
Based on the foregoing analysis, we offer the following overall risk assessment with respect to antitrust and competition law exposure:
We do not believe that entering into the Proposed MSA with Pinecrest (now Vaulton), standing alone, would constitute an antitrust violation under either federal or New York State law. The mere fact that an IT services provider serves multiple clients in the same industry is not, by itself, unlawful. Antitrust liability would require some additional element — such as an agreement to exchange information, a pattern of information sharing, or demonstrable anti-competitive effects — beyond the structural overlap.
However, the structural environment created by Vaulton's simultaneous service relationships with MCB and its competitors generates ongoing compliance risk that would require continuous monitoring, robust internal controls, and significant management attention. Critically, MCB would be largely dependent on Vaulton to implement and maintain the data isolation, personnel separation, and information barrier mechanisms necessary to prevent information flows that could trigger antitrust scrutiny. MCB would have limited visibility into, and limited ability to enforce, Vaulton's compliance with these mechanisms.
The reputational and litigation risk of even the appearance of information exchange with competitors through a common IT provider is material. In a litigious industry environment, competitors, customers, or regulatory authorities could point to the structural arrangement as circumstantial evidence of information sharing or coordination, even in the absence of any actual wrongdoing. The burden of proving the negative — that no information was exchanged and no competitive harm resulted — would fall on MCB and Vaulton, and the cost of defending such allegations could be substantial.
This risk is further amplified by MCB's status as a portfolio company of Ashford Capital Partners Fund IV, LP. Any antitrust exposure at the portfolio company level could have cascading effects on fund-level reporting, investor relations, and regulatory compliance, particularly given the increasing scrutiny of private equity ownership structures by the FTC and DOJ. Karen Lau and the Ashford team should carefully consider whether the structural antitrust risk presented by the Vaulton/Pinecrest arrangement is consistent with Ashford's risk tolerance and fiduciary obligations to Fund IV's limited partners.
VI. Financial Analysis: Cost of Termination
A. Sunk Costs
MCB has incurred certain costs in connection with the MSA negotiation process that are not recoverable regardless of the termination decision. These sunk costs are summarized as follows:
C&H Legal Fees. Calderwood & Harkness LLP has incurred approximately $187,000 in professional fees through the date of this memorandum in connection with the negotiation of the Proposed MSA under matter number 1011-00008, client number 71982. In addition, approximately $3,200 in disbursements (including filing fees, document production costs, and travel expenses) have been incurred. A final invoice will be issued upon closure of the matter, and the total fees and disbursements are expected to remain within the range set forth herein absent further substantive work beyond the preparation of a termination letter and file closure activities.
MCB Internal Resources. Significant personnel time has been invested by MCB's internal team in connection with the MSA negotiation process. David Halverston (General Counsel), Priya Chandrasekaran (VP, IT), and Samuel Otieno (Director of Procurement) have each been materially involved over the approximately three-month negotiation period, contributing to RFP development, vendor evaluation, contract review, negotiation strategy, and internal coordination. While the internal cost of this time has not been separately quantified, it is estimated to be significant, representing a meaningful allocation of senior management attention during the negotiation period.
These costs are sunk and are not recoverable regardless of whether MCB proceeds with or terminates the MSA negotiation. They should not factor into the go-forward decision except to the extent that they inform the Company's assessment of the overall cost-effectiveness of the procurement process.
B. Ongoing Cost Differential
The primary ongoing financial impact of terminating the MSA negotiation process is the forfeiture of the cost savings that MCB would have realized under the Proposed MSA relative to the Company's incumbent IT vendor, Corwyn Technology Services LLC.
The Proposed MSA contemplated an annual contract value of $2,950,000 for a comprehensive suite of IT managed services encompassing cloud infrastructure management, managed IT services, enterprise application support, and cybersecurity monitoring and incident response. MCB's incumbent vendor, Corwyn, currently provides comparable IT managed services under a legacy agreement (originally effective March 1, 2020, with an initial three-year term that expired on February 28, 2023, and currently operating on a month-to-month extension) at an annual rate of $3,150,000.
The annual cost differential between the two arrangements is $200,000 ($3,150,000 under the Corwyn legacy agreement minus $2,950,000 under the Proposed MSA). Over the five-year initial term of the Proposed MSA (November 1, 2023, through October 31, 2028), the total forfeited savings would amount to approximately $1,000,000 ($200,000 × 5 years), assuming no escalation in Corwyn's pricing during the period (which is not guaranteed under the current month-to-month arrangement).
This cost differential, while not trivial in absolute terms, is modest in the context of MCB's financial profile. The $200,000 annual differential represents approximately 0.015% of MCB's FY 2022 revenue of $1.34 billion. Even at the total five-year level, the $1,000,000 in forfeited savings represents less than 0.075% of a single year's revenue. In our judgment, this cost differential is far outweighed by the competitive intelligence, data security, and antitrust risks identified in Sections III through V of this memorandum.
We note that MCB may have the opportunity to renegotiate its arrangement with Corwyn — either through renewal of the legacy agreement at an improved rate or through a new competitive procurement process — which could reduce or eliminate the cost differential over time.
C. No Transition or Wind-Down Costs
A significant mitigating factor in the financial analysis is the complete absence of transition or wind-down costs. Because the Proposed MSA was never executed and no binding agreement of any kind was entered into between MCB and Pinecrest, there are no contractual termination fees, early exit penalties, or wind-down obligations. No MCB data was transferred to Pinecrest's systems. No systems migration activities were initiated. No Pinecrest personnel were onboarded to MCB's environment. MCB's IT operations have continued to operate entirely within the Corwyn environment throughout the negotiation period, and the termination of negotiations will have no impact on MCB's day-to-day IT operations.
MCB's existing IT services arrangement with Corwyn Technology Services LLC continues on a month-to-month basis under the legacy agreement, providing continuity of service without interruption. There are no data migration costs, system reconfiguration expenses, or parallel-run charges that would be associated with a mid-contract transition from one vendor to another. In short, the financial impact of termination is limited to the sunk costs described in Section VI.A above and the ongoing cost differential described in Section VI.B above.
VII. Alternative Paths Forward
We have evaluated three alternative courses of action for MCB's consideration. Our recommended path is set forth in Section VII.A below. Sections VII.B and VII.C describe alternative approaches that we have considered and rejected.
A. Terminate MSA Process (Recommended)
We recommend that MCB formally terminate the MSA negotiation process with Pinecrest Digital Solutions Inc. (now a wholly owned subsidiary of Vaulton Technologies Group, Inc.). The specific steps involved in this course of action are as follows:
1. Formal Termination Notice. C&H will prepare and transmit a formal termination letter to Dunleavy, Proctor & Hale LLP (attention: Carolyn Ostrowski) on behalf of MCB, advising that MCB has elected to discontinue the MSA negotiation process. The letter will cite change-of-control concerns, competitive overlap, and data security risks as the basis for the decision, without providing the level of legal analysis contained in this memorandum (which is privileged and should not be shared with third parties).
2. Confirmation of No Binding Agreement. The termination letter will confirm that no binding agreement was reached between MCB and Pinecrest at any point, that no letters of intent or preliminary agreements with binding effect were executed, and that neither party has any transition, wind-down, or other obligations to the other in connection with the termination of negotiations.
3. Destruction of Confidential Information. The termination letter will request mutual destruction (or, at the receiving party's option, return) of all confidential information exchanged between the parties during the RFP and negotiation process, in accordance with the confidentiality obligations contained in the parties' mutual non-disclosure agreement executed in connection with the RFP process.
4. Continuation with Corwyn. MCB will continue to operate under its existing month-to-month arrangement with Corwyn Technology Services LLC at the current annual rate of $3,150,000. MCB may, at its discretion, evaluate whether to extend or renegotiate the Corwyn arrangement or to issue a new RFP for IT managed services in 2024 to identify alternative vendors without the competitive overlap concerns presented by Vaulton/Pinecrest.
This approach provides MCB with a clean, cost-effective, and legally defensible exit from the Pinecrest engagement. It preserves MCB's existing IT operations without disruption, eliminates the competitive intelligence and antitrust risks identified herein, and positions MCB to pursue alternative vendor relationships on a timeline that permits thorough evaluation of the competitive landscape.
B. Negotiate Enhanced Protections with Vaulton/Pinecrest (Not Recommended)
An alternative approach would be for MCB to continue the MSA negotiation process, but to seek enhanced data isolation, dedicated infrastructure, and information barrier provisions from Vaulton as a condition of proceeding with the engagement. Under this approach, MCB would insist on contractual commitments including, at a minimum: physically and logically segregated infrastructure for MCB's environment; dedicated personnel who do not service Brightleaf, Kessler, or any other MCB competitor; prohibition on use of MCB data for benchmarking or analytics purposes; expanded audit rights covering Vaulton's enterprise-wide data isolation practices; and enhanced breach notification and remediation obligations.
We have considered this approach and do not recommend it, for the following reasons:
Negotiating Leverage. MCB would be negotiating from a position of dependency, with limited leverage to compel Vaulton — a $4.7 billion enterprise — to implement and maintain costly dedicated infrastructure and dedicated personnel for a $2.95 million per year client relationship. Vaulton's economic incentive to accommodate MCB's data isolation requirements would be limited, particularly given the relatively modest size of the MCB engagement compared to Vaulton's overall revenue and its existing relationships with Brightleaf and Kessler.
Unresolved Issues. Four substantive MSA issues — data security standards, liability cap, termination fee, and audit rights — remained unresolved even before the acquisition announcement. Layering additional data isolation and information barrier requirements on top of these existing open items would further complicate and delay an already protracted negotiation process, with no assurance that mutually acceptable terms could be reached.
Structural Limitation of Contractual Protections. As discussed in detail in Section IV.C above, the structural risk of a common IT provider serving MCB and its direct competitors cannot be fully eliminated through contract. Contractual obligations are only as effective as the obligor's ability and willingness to implement them, and MCB's ability to monitor and enforce Vaulton's compliance would be inherently limited. No amount of contractual drafting can prevent the accumulation of institutional knowledge by personnel who rotate between engagements, the inadvertent cross-client visibility created by shared monitoring tools, or the inferential value of anonymized benchmarking data in the hands of a provider with deep knowledge of multiple competitors' operations.
Ongoing Monitoring and Enforcement Costs. Even if enhanced protections could be negotiated, the cost of ongoing monitoring, auditing, and enforcement would be significant. MCB would need to invest in specialized compliance and oversight capabilities — potentially including third-party auditors with expertise in IT data isolation — to verify Vaulton's adherence to the enhanced provisions. These costs would erode or eliminate the $200,000 annual cost savings that motivated the procurement process in the first place.
Audit Rights Expansion. The audit rights provisions of the Proposed MSA — already one of the four unresolved negotiation issues — would need to be substantially expanded to cover Vaulton's broader operations, including its data isolation practices, personnel assignment protocols, and infrastructure architecture. Vaulton is unlikely to grant audit rights of this scope, given the sensitivity of its operations and its obligations to other clients (including Brightleaf and Kessler, who would presumably object to MCB having audit access to systems and processes that touch their data).
For these reasons, we do not recommend pursuing enhanced protections as an alternative to termination.
C. Proceed with MSA Without Enhanced Protections (Not Recommended)
The third alternative — proceeding with the Proposed MSA as currently drafted, without attempting to negotiate enhanced data isolation or information barrier provisions — would expose MCB to the full range of data security, competitive intelligence, and antitrust risks identified in this memorandum. Under this approach, MCB would rely solely on the existing confidentiality provisions of the MSA, which, as discussed in Section IV.C, were designed for a standalone Pinecrest engagement and are inadequate to address the systemic risks created by the Vaulton acquisition.
This path is strongly not recommended. It would expose MCB to material and potentially irreparable competitive harm, create ongoing antitrust compliance risk, and place MCB in a position of significant dependency on Vaulton's good faith implementation of data isolation practices that MCB would have no meaningful ability to monitor or enforce.
VIII. Recommendation
Based on the analysis set forth in this memorandum, Calderwood & Harkness LLP recommends that Meridian Consumer Brands LLC terminate the MSA negotiation process with Pinecrest Digital Solutions Inc. (now a wholly owned subsidiary of Vaulton Technologies Group, Inc.) and formally close the matter.
The competitive overlap created by Vaulton's existing IT service relationships with Brightleaf Brands, Inc. and Kessler Home & Personal Care Corp. — two direct competitors of MCB in the household cleaning, personal care, and beauty segments — combined with the data security and antitrust risks identified in this memorandum, renders continuation of the Proposed MSA untenable. These risks exist regardless of additional contractual protections that might be negotiated, because the structural concentration of competitive intelligence within a single IT services provider that simultaneously serves MCB and its primary competitors presents a category of risk that contract cannot fully mitigate.
MCB should continue to operate under its month-to-month extension with Corwyn Technology Services LLC at the current annual rate of $3,150,000. While this represents a forfeiture of approximately $200,000 per year in savings relative to the proposed Pinecrest ACV of $2,950,000 per year ($1,000,000 over the contemplated five-year term), this cost differential is de minimis in the context of MCB's overall IT budget and revenue base (approximately 0.015% of FY 2022 revenue) and is far outweighed by the risk mitigation achieved through termination.
MCB may wish to consider issuing a new RFP for IT managed services in early 2024 to identify alternative vendors that do not present the competitive overlap concerns associated with the Vaulton/Pinecrest combination. Any future procurement process should incorporate competitive overlap screening criteria in the vendor evaluation framework to identify and mitigate similar risks at the outset.
If MCB management concurs with this recommendation, C&H will prepare and transmit a formal termination letter to Dunleavy, Proctor & Hale LLP (attention: Carolyn Ostrowski) on behalf of MCB and take all steps necessary to close the matter.
IX. Next Steps
Upon review of this memorandum, we request that the following steps be taken in the order indicated:
1. MCB Management Decision. Meg Thornbury (CEO) and David Halverston (General Counsel) to review this memorandum and confirm their decision regarding termination of the MSA negotiation process. We are available to discuss any questions or concerns by telephone or in person at the addressees' convenience.
2. PE Sponsor Alignment. Karen Lau, Operating Partner at Ashford Capital Management LLC, to review this memorandum and confirm that the recommended course of action is consistent with Ashford's risk tolerance and strategic perspective regarding the MCB investment. To the extent that Ashford's legal or compliance functions wish to review the antitrust analysis, we are available to provide a briefing at Ms. Lau's direction.
3. Formal Termination Letter. Upon confirmation of the termination decision by MCB management and the Ashford team, C&H will prepare and transmit a formal termination letter

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts