| Field | Value |
| Document Title | MSA Issues List and Negotiation Tracker |
| MSA Reference | MSA-PDS-MCB-2023 |
| Matter Number | 1011-00008 |
| Client Number | 71982 |
| Client | Meridian Consumer Brands LLC |
| Client Address | 680 Fifth Avenue, 22nd Floor, New York, NY 10019 |
| Client General Counsel | David Halverston |
| Client VP, IT | Priya Chandrasekaran |
| Client Director of Procurement | Samuel Otieno |
| Counterparty | Pinecrest Digital Solutions Inc. |
| Counterparty Address | 2300 Lakewood Boulevard, Suite 400, Durham, NC 27713 |
| Counterparty General Counsel | Rina Balakrishnan |
| Counterparty CRO | Tessa Johannsen |
| Counterparty Outside Counsel | Dunleavy, Proctor & Hale LLP (Carolyn Ostrowski, James Feng) |
| Counterparty Counsel Address | 300 South Tryon Street, Suite 2200, Charlotte, NC 28202 |
| Client Outside Counsel | Calderwood & Harkness LLP |
| C&H Address | 125 Park Avenue, 34th Floor, New York, NY 10017 |
| Responsible Partner | Elaine Forsythe |
| Billing Partner | Howard Bellamy |
| Lead Associate | Garrett Simmons |
| Working Associate | Leila Nazari |
| Governing Law | New York |
| RFP Reference | MCB-IT-RFP-2023-006 |
| Proposed MSA Term | November 1, 2023 – October 31, 2028 (5 years) |
| Date | Event | Responsible Party | Document / Reference | Notes |
| 2023-06-12 | MCB issues RFP for IT managed services | MCB (Samuel Otieno) | MCB-IT-RFP-2023-006 | RFP distributed to shortlisted vendors |
| 2023-07-10 | Pinecrest selected as preferred vendor | MCB (Priya Chandrasekaran, Samuel Otieno) | Vendor evaluation scorecard | Selection following multi-vendor evaluation |
| 2023-07-25 | Calderwood & Harkness engagement opened; initial MSA draft requested | C&H (Elaine Forsythe) | Engagement letter | Matter 1011-00008 opened |
| 2023-08-04 | First draft MSA delivered to MCB for review | C&H (Garrett Simmons) | msa-initial-draft-2023-08-04.docx | Draft MSA-PDS-MCB-2023 sent to David Halverston and Priya Chandrasekaran |
| 2023-08-11 | MCB provides consolidated comments; draft sent to Pinecrest | MCB / C&H | MSA-PDS-MCB-2023 (marked up) | Comments from Halverston, Chandrasekaran, and Otieno consolidated by C&H and transmitted to DPH |
| 2023-08-25 | Pinecrest (via DPH) returns first redline with 47 substantive comments | DPH (Carolyn Ostrowski, James Feng) | msa-redline-dph-2023-08-25.docx | 47 tracked changes and comments across liability, indemnification, data security, SLA credits, IP, audit rights, termination fee, insurance, and other provisions |
| 2023-09-08 | Negotiation call #1 — resolved 29 of 47 open issues | C&H / DPH / MCB / Pinecrest | Call notes | 29 issues resolved; 18 remaining open |
| 2023-09-15 | C&H circulates revised draft reflecting call #1 resolutions | C&H (Garrett Simmons) | msa-revised-draft-2023-09-15.docx | Clean draft incorporating 29 agreed resolutions; indemnification, IP assignment, insurance certificates, SLA measurement, force majeure revised |
| 2023-09-22 | DPH returns second redline with 12 remaining open issues | DPH (Carolyn Ostrowski, James Feng) | Second redline | 12 issues flagged from 18 previously open items; 6 issues implicitly accepted |
| 2023-09-29 | Negotiation call #2 — resolved 8 of 12 issues; 4 remain | C&H / DPH / MCB / Pinecrest | Call notes | 4 unresolved issues: data security standards, liability cap, termination fee, audit rights |
| 2023-10-06 | C&H circulates near-final draft; 4 remaining issues escalated to business principals | C&H (Garrett Simmons) | msa-near-final-draft-2023-10-06.docx | Bracketed provisions for escalation to Meg Thornbury / Nathan Whitford |
| 2023-10-12 | Vaulton Technologies Group announces agreement to acquire Pinecrest for $685 million | Vaulton / Pinecrest (public announcement) | Press release | Change-of-control event triggers assessment of MSA implications |
| 2023-10-13 | C&H sends internal alert memo to MCB re: change-of-control implications | C&H (Elaine Forsythe, Garrett Simmons) | change-of-control-alert-memo-2023-10-13.docx | Memo to Halverston and Chandrasekaran; recommends pausing negotiations |
| 2023-10-16 | MCB and Ashford Capital hold internal strategy call; decision to pause negotiations | MCB (Meg Thornbury, David Halverston) / Ashford (Karen Lau, Vincent Driscoll) | Internal call | Participants include MCB management and PE sponsor Ashford Capital |
| 2023-10-18 | C&H sends letter to DPH formally pausing MSA negotiations | C&H (Elaine Forsythe) | pause-letter-to-dph-2023-10-18.docx | Formal notice to Carolyn Ostrowski; all rights reserved |
| 2023-10-20 | C&H delivers competitive overlap and antitrust analysis memo to MCB | C&H (Elaine Forsythe, Leila Nazari) | competitive-overlap-antitrust-memo-2023-10-20.docx | Analysis of Vaulton's IT relationships with Brightleaf Brands, Inc. and Kessler Home & Personal Care Corp.; data isolation risks; recommendation to terminate |
| 2023-10-25 | MCB management formally decides to terminate MSA process | MCB (Meg Thornbury, David Halverston) | Internal decision | Decision communicated to C&H; C&H to prepare termination letter |
| 2023-10-27 | Vaulton closes acquisition of Pinecrest | Vaulton / Pinecrest | Public filing | Acquisition price: $685 million |
| 2023-10-30 | C&H sends formal termination letter to DPH on behalf of MCB; matter closed | C&H (Elaine Forsythe) | termination-letter-to-dph-2023-10-30.docx | MSA negotiation terminated; no binding agreement reached; no data migrated; no transition obligations; confidential information destruction requested |
| Issue # | MSA Section Ref | Issue Category | Issue Description | MCB Position | Pinecrest / DPH Position | Status | Raised Date | Negotiation Round Resolved | Date Resolved | Resolution Summary | Notes |
| 1 | §2.1 (Definitions — 'Services') | Scope | DPH proposed narrowing definition of 'Services' to exclude ad hoc projects not described in SOWs | MCB: Broad definition preferred; all IT-related services within Pinecrest's capabilities should be in scope | Pinecrest/DPH: Services limited to those expressly described in executed SOWs | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Services defined by reference to executed SOWs but with mechanism for MCB to request ad hoc services under a simplified change order process | Reflected in revised draft 2023-09-15 |
| 2 | §2.3 (Definitions — 'Deliverables') | IP / Scope | DPH sought to exclude pre-existing Pinecrest tools and methodologies from 'Deliverables' definition | MCB: Custom deliverables and work product assigned to MCB; acknowledge Pinecrest's pre-existing IP | Pinecrest/DPH: All pre-existing tools excluded; broad carve-out for Pinecrest methodology | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Work product and custom deliverables assigned to MCB; Pinecrest retains ownership of pre-existing tools and methodologies with perpetual license to MCB for use with deliverables | Consistent with IP ownership framework in initial draft |
| 3 | §3.1 (Service Levels — Uptime) | SLA | DPH proposed reducing uptime commitment from 99.9% to 99.5% | MCB: 99.9% uptime required for cloud infrastructure and enterprise applications | Pinecrest/DPH: 99.5% reflects industry standard for managed services | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: 99.9% for cloud infrastructure; 99.7% for managed IT services and enterprise application support |
| 4 | §3.2 (SLA Credits — Severity 1) | SLA | DPH objected to 15% credit for Severity 1 outages as excessive | MCB: Up to 15% of monthly fees for Severity 1 outages exceeding 4 hours | Pinecrest/DPH: Cap SLA credits at 5% of monthly fees regardless of severity | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Up to 15% of monthly fees for Severity 1 outages exceeding 4 hours; Pinecrest accepted MCB's position | Reflected in revised draft |
| 5 | §3.3 (SLA Credits — Severity 2) | SLA | DPH sought to eliminate Severity 2 credits entirely | MCB: Up to 10% of monthly fees for Severity 2 outages exceeding 8 hours | Pinecrest/DPH: No credits for Severity 2; remedy limited to root cause analysis report | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Up to 10% of monthly fees for Severity 2 outages exceeding 8 hours; root cause report also required within 5 business days |
| 6 | §3.5 (SLA — Measurement Methodology) | SLA | DPH proposed Pinecrest-managed monitoring tools as sole measurement basis | MCB: Independent third-party monitoring or MCB-designated tools | Pinecrest/DPH: Pinecrest's internal tools are authoritative | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Mutual agreement on monitoring tool selection; quarterly SLA reports provided to MCB with raw data access | Revised in Sept 15 draft |
| 7 | §4.1 (Fees — Payment Terms) | Commercial | DPH proposed Net 30 instead of Net 45 | MCB: Net 45 from invoice date, quarterly in advance | Pinecrest/DPH: Net 30 from invoice date | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Net 45 from invoice date; MCB's position accepted |
| 8 | §4.3 (Fees — Annual Escalation) | Commercial | DPH proposed 5% annual price escalation beginning Year 2 | MCB: No annual escalation; fixed pricing for entire 5-year term | Pinecrest/DPH: 5% annual increase to account for cost inflation | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: CPI-based escalation capped at 3% per year beginning Year 3 |
| 9 | §4.5 (Fees — Late Payment) | Commercial | DPH proposed 1.5% monthly interest on overdue amounts | MCB: Interest at lesser of 1% per month or maximum permitted by law | Pinecrest/DPH: 1.5% per month, compounding | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: 1% per month, non-compounding, with 10-day cure period before interest accrues |
| 10 | §5.1 (Term — Initial Term) | Term | DPH agreed with 5-year initial term but proposed auto-renewal for successive 2-year periods | MCB: 5-year initial term; renewal only by mutual written agreement | Pinecrest/DPH: Auto-renewal for 2-year periods unless 90-day non-renewal notice | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: 5-year initial term; renewal by mutual written agreement only; no auto-renewal |
| 11 | §5.3 (Termination for Cause — Cure Period) | Termination | DPH proposed extending cure period from 30 to 60 days for material breach | MCB: 30-day cure period for material breach | Pinecrest/DPH: 60-day cure period | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: 30-day cure for payment and non-performance breaches; 45-day cure for other material breaches |
| 12 | §5.4 (Termination for Convenience — Notice Period) | Termination | DPH proposed increasing convenience termination notice from 180 to 360 days | MCB: 180 days' written notice | Pinecrest/DPH: 360 days to protect revenue certainty | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: 180 days' written notice; MCB's position accepted |
| 13 | §6.2 (Confidentiality — Definition of Confidential Information) | Confidentiality | DPH sought to narrow definition to exclude information already known to receiving party or independently developed | MCB: Broad definition; standard carve-outs only | Pinecrest/DPH: Add carve-out for information independently developed without reference to disclosing party's information | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Standard confidentiality definition with four customary carve-outs (public domain, prior knowledge, independent development, third-party disclosure without restriction) |
| 14 | §6.4 (Confidentiality — Survival) | Confidentiality | DPH proposed 2-year post-termination survival instead of 5 years | MCB: 5-year survival for confidentiality obligations | Pinecrest/DPH: 2-year survival | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: 3-year survival for general confidential information; perpetual survival for trade secrets |
| 15 | §7.1 (IP Ownership — Work Product Assignment) | IP | DPH objected to blanket assignment of all work product to MCB | MCB: All work product and custom deliverables assigned to MCB | Pinecrest/DPH: Joint ownership of derivative works incorporating Pinecrest pre-existing IP | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Custom deliverables assigned to MCB; derivative works incorporating Pinecrest pre-existing IP licensed to MCB on perpetual, irrevocable, royalty-free basis | Reflected in Sept 15 draft |
| 16 | §7.3 (IP — License to Pre-Existing IP) | IP | DPH proposed limiting license to pre-existing tools to term of agreement only | MCB: Perpetual license to pre-existing tools necessary for use of deliverables | Pinecrest/DPH: License only during MSA term | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Perpetual, non-exclusive license to pre-existing tools embedded in deliverables; limited to use with MCB deliverables only |
| 17 | §8.1 (Data Security — Encryption Standards) | Data Security | DPH proposed AES-128 as sufficient; MCB required AES-256 | MCB: AES-256 encryption at rest and in transit | Pinecrest/DPH: AES-128 for data at rest; TLS 1.2 for transit | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: AES-256 at rest; TLS 1.3 in transit |
| 18 | §8.4 (Data Security — Penetration Testing) | Data Security | DPH proposed biennial penetration testing instead of annual | MCB: Annual penetration testing by independent third party | Pinecrest/DPH: Biennial testing; annual internal vulnerability scans | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Annual penetration testing by mutually agreed independent third party; results shared with MCB within 30 days |
| 19 | §9.1 (Indemnification — Scope of Pinecrest Indemnity) | Indemnification | DPH proposed limiting Pinecrest's indemnification to third-party IP infringement claims only | MCB: Broad indemnification covering IP infringement, data breaches, gross negligence, willful misconduct, and violation of law | Pinecrest/DPH: Limit to IP infringement only | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Pinecrest indemnifies for IP infringement, data breaches caused by Pinecrest's failure to meet security obligations, and willful misconduct; gross negligence and violation of law carved out as direct claims not subject to indemnity procedures | Revised in Sept 15 draft |
| 20 | §9.3 (Indemnification — MCB Counter-Indemnity) | Indemnification | DPH requested MCB indemnify Pinecrest for losses arising from MCB's data or content hosted on Pinecrest platform | MCB: Limited MCB indemnity for IP infringement in MCB-provided content | Pinecrest/DPH: Broad MCB indemnity for all MCB data/content-related claims | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: MCB indemnifies for third-party claims alleging that MCB-provided content infringes IP rights; no broader content indemnity |
| 21 | §9.5 (Indemnification — Procedure) | Indemnification | DPH proposed that indemnifying party has sole control of defense including settlement authority | MCB: Indemnified party retains consent rights over settlements affecting its rights or imposing non-monetary obligations | Pinecrest/DPH: Sole control including settlement | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Indemnifying party controls defense; settlement requires indemnified party's prior written consent (not to be unreasonably withheld) if settlement imposes non-monetary obligations or does not include full release |
| 22 | §10.3 (Insurance — Certificate Timing) | Insurance | DPH objected to requirement to provide insurance certificates 30 days prior to MSA commencement | MCB: Certificates 30 days prior to commencement and annually thereafter | Pinecrest/DPH: Certificates upon request, within 10 business days | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Certificates provided within 15 business days of MSA execution and annually within 30 days of policy renewal | Revised in Sept 15 draft |
| 23 | §10.4 (Insurance — Additional Insured) | Insurance | DPH resisted naming MCB as additional insured on CGL policy | MCB: Named as additional insured on CGL and Tech E&O policies | Pinecrest/DPH: Additional insured on CGL only, not Tech E&O | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: MCB named as additional insured on CGL policy; waiver of subrogation on Tech E&O policy in lieu of additional insured status |
| 24 | §11.1 (Force Majeure — Definition) | Force Majeure | DPH proposed broad force majeure including labor disputes and supply chain disruptions | MCB: Narrow force majeure limited to acts of God, war, terrorism, government orders, and natural disasters | Pinecrest/DPH: Include labor disputes, pandemics, supply chain disruptions, and utility failures | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Include pandemics and government orders; exclude labor disputes and supply chain disruptions affecting Pinecrest's subcontractors only | Revised in Sept 15 draft |
| 25 | §11.3 (Force Majeure — Duration Cap) | Force Majeure | DPH proposed no cap on force majeure period | MCB: If force majeure exceeds 90 days, MCB may terminate without penalty | Pinecrest/DPH: No termination right during force majeure; automatic extension | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: If force majeure exceeds 60 consecutive days, either party may terminate affected SOW without early termination fee |
| 26 | §12.1 (Non-Solicitation) | Personnel | DPH proposed asymmetric non-solicitation applying only to MCB | MCB: Mutual 12-month non-solicitation of personnel involved in service delivery | Pinecrest/DPH: Non-solicitation binding on MCB only | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Mutual 12-month non-solicitation of personnel directly involved in service delivery during term and for 12 months post-termination |
| 27 | §13.1 (Representations — Pinecrest Authorization) | Reps & Warranties | DPH proposed limiting Pinecrest's rep to 'duly organized' and removing 'validly existing' and 'in good standing' | MCB: Full corporate existence reps (duly organized, validly existing, in good standing) | Pinecrest/DPH: 'Duly organized' only | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Full existence reps including 'duly organized, validly existing, and in good standing' for both parties |
| 28 | §14.2 (Notices — Method of Delivery) | General | DPH proposed email as sufficient method of notice for all purposes | MCB: Formal notices by overnight courier or certified mail; email for operational communications only | Pinecrest/DPH: Email sufficient for all notices | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Formal legal notices (termination, breach, indemnification) by overnight courier or certified mail with email copy; operational notices by email |
| 29 | §14.5 (Dispute Resolution — Escalation) | General | DPH proposed immediate arbitration without management escalation | MCB: Escalation to senior management before arbitration; 30-day negotiation period | Pinecrest/DPH: Direct to binding arbitration | Resolved | 2023-08-25 | Call #1 (Sep 8) | 2023-09-08 | Agreed: Escalation to senior officers (VP-level or above) for 30-day negotiation period before either party may initiate arbitration |
| 30 | §5.5 (Change of Control) | Termination | DPH proposed limiting Change of Control termination right to MCB only (not mutual) | MCB: Either party may terminate within 30 days of a Change of Control event | Pinecrest/DPH: Only MCB should have CoC termination right; Pinecrest should not face termination if MCB is acquired | Resolved | 2023-08-25 | Implicitly accepted (Sept 22 redline) | 2023-09-22 | DPH dropped objection; mutual CoC termination right retained per MCB's draft | Not re-raised in second redline |
| 31 | §4.4 (Fees — Disputed Invoices) | Commercial | DPH proposed that disputed portions of invoices must still be paid pending resolution | MCB: MCB may withhold disputed amounts pending resolution without triggering late payment interest | Pinecrest/DPH: Full payment required; disputes addressed post-payment via credit process | Resolved | 2023-08-25 | Implicitly accepted (Sept 22 redline) | 2023-09-22 | DPH dropped objection; MCB may withhold disputed amounts in good faith | Not re-raised in second redline |
| 32 | §6.3 (Confidentiality — Permitted Disclosures) | Confidentiality | DPH proposed allowing disclosure to Pinecrest affiliates without prior consent | MCB: Disclosure to affiliates only with MCB's prior written consent and subject to affiliate confidentiality undertaking | Pinecrest/DPH: Disclosure to affiliates in ordinary course without consent | Resolved | 2023-08-25 | Implicitly accepted (Sept 22 redline) | 2023-09-22 | DPH dropped objection; disclosure to affiliates requires prior written consent and confidentiality undertaking | Not re-raised in second redline |
| 33 | §7.4 (IP — Open Source Components) | IP | DPH proposed that Pinecrest may use open source components without restriction | MCB: Pinecrest must disclose all open source components; no copyleft licenses that could affect MCB's proprietary data or IP | Pinecrest/DPH: Standard open source usage without disclosure obligation | Resolved | 2023-08-25 | Implicitly accepted (Sept 22 redline) | 2023-09-22 | DPH dropped objection; Pinecrest to maintain open source component register and avoid copyleft licenses affecting MCB IP | Not re-raised in second redline |
| 34 | §10.1 (Insurance — Tech E&O / Cyber Minimum) | Insurance | DPH proposed reducing Tech E&O / cyber liability minimum from $10M to $5M | MCB: $10,000,000 minimum Tech E&O / cyber liability | Pinecrest/DPH: $5,000,000 sufficient given Pinecrest's size | Resolved | 2023-08-25 | Implicitly accepted (Sept 22 redline) | 2023-09-22 | DPH dropped objection; $10,000,000 minimum retained | Not re-raised in second redline |
| 35 | §12.2 (Non-Solicitation — Scope of Covered Personnel) | Personnel | DPH proposed limiting non-solicitation to key personnel only (named individuals) | MCB: Non-solicitation covers all personnel involved in service delivery | Pinecrest/DPH: Limited to named key personnel listed in an exhibit | Resolved | 2023-08-25 | Implicitly accepted (Sept 22 redline) | 2023-09-22 | DPH dropped objection; non-solicitation covers all personnel directly involved in service delivery | Not re-raised in second redline |
| 36 | §8.2 (Data Security — SOC 2 Type II Certification) | Data Security | DPH proposed SOC 2 Type I as acceptable alternative to Type II | MCB: Pinecrest must maintain SOC 2 Type II certification at all times during the term; most recent report issued 2023-03-15 covering April 1, 2022 – March 31, 2023 | Pinecrest/DPH: SOC 2 Type I sufficient; Type II creates undue burden | Resolved | 2023-08-25 | Call #2 (Sep 29) | 2023-09-29 | Agreed: SOC 2 Type II required; Pinecrest to provide updated report annually within 90 days of audit period end |
| 37 | §8.5 (Data Security — Breach Notification Timeline) | Data Security | DPH proposed 7-day breach notification instead of 72 hours | MCB: 72-hour breach notification obligation | Pinecrest/DPH: 7 calendar days; 72 hours impractical for full assessment | Resolved | 2023-08-25 | Call #2 (Sep 29) | 2023-09-29 | Agreed: 72-hour preliminary notification with essential details; full incident report within 10 business days |
| 38 | §9.4 (Indemnification — Cap on Indemnification) | Indemnification | DPH proposed capping aggregate indemnification at 1x ACV | MCB: No separate indemnification cap; subject to overall liability cap | Pinecrest/DPH: Separate indemnification cap at 1x ACV ($2,950,000) | Resolved | 2023-08-25 | Call #2 (Sep 29) | 2023-09-29 | Agreed: Indemnification obligations subject to overall liability cap (quantum of liability cap still unresolved — see Issue #44) |
| 39 | §13.2 (Representations — Compliance with Laws) | Reps & Warranties | DPH proposed qualifying compliance rep with 'in all material respects' | MCB: Unqualified compliance representation | Pinecrest/DPH: 'In all material respects' qualification | Resolved | 2023-08-25 | Call #2 (Sep 29) | 2023-09-29 | Agreed: Compliance rep qualified by 'in all material respects' with carve-out for data protection laws (unqualified compliance required for data protection/privacy) |
| 40 | §14.3 (Assignment — Consent Requirement) | General | DPH proposed that Pinecrest may assign to affiliates without MCB consent | MCB: No assignment without MCB's prior written consent; no exception for affiliates | Pinecrest/DPH: Assignment to affiliates without consent | Resolved | 2023-08-25 | Call #2 (Sep 29) | 2023-09-29 | Agreed: Assignment to wholly-owned subsidiaries permitted without consent, provided assignee assumes all obligations; all other assignments require prior written consent |
| 41 | §14.6 (Dispute Resolution — Arbitration Seat) | General | DPH proposed arbitration in Charlotte, NC | MCB: Arbitration in New York, NY consistent with NY governing law | Pinecrest/DPH: Charlotte, NC as Pinecrest headquarters location | Resolved | 2023-08-25 | Call #2 (Sep 29) | 2023-09-29 | Agreed: Arbitration in New York, NY; MCB's position accepted |
| 42 | §3.4 (SLA — Exclusions from Uptime Calculation) | SLA | DPH proposed excluding scheduled maintenance windows and MCB-caused downtime from uptime calculation | MCB: Only pre-approved scheduled maintenance windows excluded; MCB-caused downtime excluded only if documented | Pinecrest/DPH: Broad exclusions including all maintenance and any downtime attributable to MCB systems | Resolved | 2023-08-25 | Call #2 (Sep 29) | 2023-09-29 | Agreed: Scheduled maintenance excluded (max 8 hours/month, with 48-hour advance notice); MCB-caused downtime excluded only if Pinecrest provides documented root cause analysis attributing outage to MCB within 5 business days |
| 43 | §14.4 (Governing Law — Exclusive Jurisdiction) | General | DPH proposed non-exclusive jurisdiction clause | MCB: Exclusive jurisdiction of New York state and federal courts (or arbitration per §14.5) | Pinecrest/DPH: Non-exclusive jurisdiction to preserve Pinecrest's ability to litigate in NC | Resolved | 2023-08-25 | Call #2 (Sep 29) | 2023-09-29 | Agreed: Exclusive jurisdiction of courts in New York County, NY for any disputes not subject to arbitration |
| 44 | §9.2 (Liability Cap) | Liability | DPH proposed reducing aggregate liability cap from 2x to 1x prior 12 months' fees | MCB: Aggregate liability capped at 2x prior 12 months' fees paid ($5,900,000 based on $2,950,000 ACV) | Pinecrest/DPH: Cap at 1x prior 12 months' fees ($2,950,000); 2x is excessive for IT services engagement | Escalated → Moot — Terminated | 2023-08-25 | Escalated to principals (Oct 6); moot upon termination (Oct 30) | UNRESOLVED. MCB firm on 2x ($5,900,000); Pinecrest firm on 1x ($2,950,000). Bracketed in near-final draft for business principal escalation. Rendered moot by termination of negotiations on October 30, 2023. | One of 4 final unresolved issues |
| 45 | §5.4 (Termination for Convenience — Early Termination Fee) | Termination | DPH proposed increasing early termination fee from 50% to 100% of remaining ACV | MCB: Early termination fee of 50% of remaining ACV for balance of then-current term | Pinecrest/DPH: 100% of remaining ACV as termination fee; 50% does not adequately compensate Pinecrest for lost revenue | Escalated → Moot — Terminated | 2023-08-25 | Escalated to principals (Oct 6); moot upon termination (Oct 30) | UNRESOLVED. MCB firm on 50%; Pinecrest firm on 100%. Bracketed in near-final draft. Rendered moot by termination. | One of 4 final unresolved issues |
| 46 | §8.3 (Data Security Standards — Comprehensive Framework) | Data Security | DPH objected to MCB's requirement that Pinecrest comply with MCB's internal data security policy (Exhibit D) in addition to SOC 2 Type II | MCB: Pinecrest must comply with MCB's internal data security policy as set forth in Exhibit D, which includes requirements exceeding SOC 2 (e.g., data residency, access controls, logging retention) | Pinecrest/DPH: Compliance with SOC 2 Type II and applicable law should be sufficient; MCB's internal policy imposes bespoke and potentially changing requirements without Pinecrest's consent | Escalated → Moot — Terminated | 2023-08-25 | Escalated to principals (Oct 6); moot upon termination (Oct 30) | UNRESOLVED. MCB insists on Exhibit D compliance; Pinecrest objects to unilateral modification risk. Bracketed in near-final draft. Rendered moot by termination. | One of 4 final unresolved issues; heightened significance given Vaulton competitive overlap concerns |
| 47 | §8.6 (Audit Rights) | Data Security / Governance | DPH objected to MCB's right to conduct on-site audits of Pinecrest's data security and service delivery practices with 10 business days' notice | MCB: MCB or its designee (including Ridgeline Audit Partners LLP) may conduct on-site audits annually with 10 business days' notice; additional audits upon reasonable cause (e.g., security incident) | Pinecrest/DPH: Audit rights limited to review of SOC 2 reports and written questionnaires; on-site audits only following confirmed security incident, and limited to 1 per year with 30 business days' notice | Escalated → Moot — Terminated | 2023-08-25 | Escalated to principals (Oct 6); moot upon termination (Oct 30) | UNRESOLVED. MCB firm on annual on-site audit rights; Pinecrest firm on SOC 2 report review as primary mechanism. Bracketed in near-final draft. Rendered moot by termination. | One of 4 final unresolved issues |
| Metric | Value | Notes |
| Total Issues Raised (DPH First Redline — Aug 25, 2023) | 47 | All substantive comments and tracked changes from DPH redline |
| Issues Resolved in Call #1 (Sep 8, 2023) | 29 | Resolved during negotiation call #1 |
| Remaining Issues After Call #1 | 18 | 47 − 29 = 18 |
| Issues Addressed in DPH Second Redline (Sep 22, 2023) | 12 | 12 of 18 remaining issues re-raised; 6 implicitly accepted by DPH |
| Issues Implicitly Accepted by DPH Between Rounds | 6 | 18 − 12 = 6; dropped from second redline |
| Issues Resolved in Call #2 (Sep 29, 2023) | 8 | Resolved during negotiation call #2 |
| Final Unresolved Issues (Escalated Oct 6, 2023) | 4 | Data security standards, liability cap, termination fee, audit rights |
| Total Issues Resolved | 43 | 29 + 6 + 8 = 43 |
| Resolution Rate (Pre-Termination) | 91.5% | 43 / 47 = 91.49% |
| Unresolved Issue #1 | §8.3 — Data Security Standards (Exhibit D compliance) | MCB: Exhibit D compliance required; Pinecrest: SOC 2 sufficient |
| Unresolved Issue #2 | §9.2 — Liability Cap (2x vs. 1x ACV) | MCB: 2x ($5,900,000); Pinecrest: 1x ($2,950,000) |
| Unresolved Issue #3 | §5.4 — Early Termination Fee (50% vs. 100% remaining ACV) | MCB: 50%; Pinecrest: 100% |
| Unresolved Issue #4 | §8.6 — Audit Rights (on-site vs. report review) | MCB: Annual on-site audit; Pinecrest: SOC 2 report review only |
| Final Status of All 4 Unresolved Issues | Moot — Negotiations Terminated Oct 30, 2023 | Vaulton acquisition of Pinecrest triggered change-of-control, competitive overlap, and data security concerns |
| MSA Document Reference | MSA-PDS-MCB-2023 |
| Proposed ACV | $2,950,000 | Cloud Infra ($1,200,000) + Managed IT ($825,000) + Enterprise App Support ($575,000) + Cybersecurity ($350,000) |
| Proposed TCV | $14,750,000 | 5 years × $2,950,000 |
| Proposed Initial Term | Nov 1, 2023 – Oct 31, 2028 | 5 years; never executed |
| Governing Law | New York |
| Reason for Termination | Vaulton Technologies Group, Inc. closed acquisition of Pinecrest Digital Solutions Inc. on Oct 27, 2023 for $685 million; irreconcilable change-of-control, competitive overlap (Brightleaf Brands, Inc. and Kessler Home & Personal Care Corp.), and data security concerns | MCB to continue with incumbent vendor Corwyn Technology Services LLC |
| Cost Impact of Termination | $200,000/yr incremental cost | Corwyn annual rate ($3,150,000) vs. proposed Pinecrest ACV ($2,950,000) |