1014-00006 · Meridian Design Systems, Inc · Transaction Documents

data-security-cloud-rider-draft.docx DOCUMENT IP / Technology

8 / 12 ← → ✕

DATA SECURITY AND CLOUD SERVICES RIDER

Exhibit F to the Amended and Restated Enterprise License Agreement

Agreement No. MDS-ELA-2026-01192

This Data Security and Cloud Services Rider (this "Rider") is entered into as a supplemental rider to the Amended and Restated Enterprise License Agreement dated as of February 1, 2026 (the "Agreement"), by and between:

Optiwave Semiconductor Corp., a Delaware corporation ("Licensee" or "OWS"), with its principal offices located at 4850 Great America Parkway, Suite 300, Santa Clara, California 95054;

and

Meridian Design Systems, Inc., a Delaware corporation ("Licensor" or "Meridian"), with its principal offices located at 2700 Orchard Parkway, San Jose, California 95134.

This Rider is incorporated into and forms an integral part of the Agreement. Capitalized terms used but not otherwise defined in this Rider shall have the meanings ascribed to them in the Agreement. In the event of any conflict between this Rider and the Agreement with respect to data security, cloud services, or the subject matter addressed herein, the terms of this Rider shall control.

This Rider applies to Meridian CloudVerify™ and any other cloud-hosted components, modules, or services provided by Licensor to Licensee under or in connection with the Agreement (collectively, the "Cloud Services"), as further defined in Section 1 below.

RECITALS

WHEREAS, Licensee and Licensor have entered into the Amended and Restated Enterprise License Agreement (Agreement No. MDS-ELA-2026-01192) dated as of February 1, 2026 (the "Agreement"), which amends and restates in its entirety the Original Enterprise License Agreement (Agreement No. MDS-ELA-2023-00487) dated as of February 1, 2023 (the "Original Agreement");

WHEREAS, the Agreement provides for Licensee's use of certain cloud-hosted verification compute services, including the Meridian CloudVerify™ platform, and other cloud-hosted components, modules, and tools made available by Licensor as part of its integrated electronic design automation ("EDA") product suite;

WHEREAS, Licensee's design data — including, without limitation, integrated circuit design files, register-transfer level (RTL) descriptions, gate-level and transistor-level netlists, layout data in GDSII and OASIS formats, simulation results, formal verification outputs, and related intellectual property processed through the Cloud Services (collectively, "Licensee Data") — constitutes highly confidential and proprietary information of significant commercial value, the unauthorized disclosure or compromise of which would cause material and irreparable harm to Licensee;

WHEREAS, the parties desire to establish minimum data security standards, service level commitments, and operational requirements applicable to all Cloud Services, in order to protect the confidentiality, integrity, and availability of Licensee Data and to ensure the reliable operation of Cloud Services critical to Licensee's design and verification workflows;

WHEREAS, Licensee is a fabless semiconductor design company whose design data interfaces with third-party foundry process design kits ("PDKs"), including those of Brindoval Foundry Services Ltd., and whose customers and foundry partners impose contractual and regulatory requirements necessitating heightened security protections for design data processed in cloud environments; and

WHEREAS, the parties acknowledge that the security and operational commitments set forth in this Rider are a material inducement to Licensee's agreement to utilize the Cloud Services and to the parties' entry into the Agreement.

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

SECTION 1: DEFINITIONS

For purposes of this Rider, the following terms shall have the meanings set forth below. All other capitalized terms used in this Rider and not defined herein shall have the meanings set forth in the Agreement.

1.1 "Cloud Services" means Meridian CloudVerify™ and any other cloud-hosted, software-as-a-service ("SaaS")-delivered, or remotely hosted components, modules, tools, platforms, or services provided by Licensor to Licensee under or in connection with the Agreement, including any updates, upgrades, new releases, or successor services thereto. For the avoidance of doubt, Cloud Services include any compute, storage, networking, and related infrastructure operated or managed by Licensor (or its Subprocessors) to deliver the foregoing to Licensee.

1.2 "Licensee Data" means all data, files, designs, source code, netlists, layouts (including GDSII, OASIS, and LEF/DEF formats), simulation outputs, verification results, timing reports, power analysis data, configuration files, scripts, user credentials, metadata, log data generated by or on behalf of Licensee, and any other information or intellectual property of Licensee or its personnel that is uploaded to, processed by, stored in, generated by, or transmitted through the Cloud Services, regardless of the format or medium in which such data exists. Licensee Data includes any derivative data, intermediate results, or cached copies created by the Cloud Services in the course of processing Licensee's inputs.

1.3 "Security Incident" means any actual or reasonably suspected (i) unauthorized access to, acquisition of, use of, disclosure of, modification of, or destruction of Licensee Data, or (ii) breach of Licensor's security systems, controls, policies, or procedures that compromises or is reasonably likely to compromise the confidentiality, integrity, or availability of Licensee Data, or (iii) any other event that requires notification under applicable data breach notification laws with respect to Licensee Data.

1.4 "SOC 2 Type II Report" means a Service Organization Control 2 Type II audit report prepared by an independent certified public accounting firm in accordance with the attestation standards established by the American Institute of Certified Public Accountants ("AICPA") and the AICPA Trust Services Criteria, covering the Security, Availability, Confidentiality, and Processing Integrity trust services categories (or such successor criteria as may be adopted by the AICPA from time to time).

1.5 "Scheduled Downtime" means planned maintenance windows during which Cloud Services may be temporarily unavailable, provided that such maintenance windows have been communicated to Licensee in writing at least seventy-two (72) hours in advance in accordance with Section 3.4. Scheduled Downtime must be scheduled during off-peak hours, defined as weekends (Saturday 12:00 a.m. through Sunday 11:59 p.m. Pacific Time) or between 12:00 a.m. and 6:00 a.m. Pacific Time on weekdays (Monday through Friday).

1.6 "Uptime Percentage" means, for any given calendar month, the percentage of total minutes during such month during which the Cloud Services are available and operational, excluding Scheduled Downtime minutes. The Uptime Percentage shall be calculated using the following formula:

Uptime Percentage = ((Total Minutes in Month – Scheduled Downtime Minutes – Unscheduled Downtime Minutes) / (Total Minutes in Month – Scheduled Downtime Minutes)) × 100

For purposes of this calculation, "Unscheduled Downtime" means any period during which the Cloud Services are materially unavailable to Licensee for their intended use, other than Scheduled Downtime. A period of unavailability shall be deemed to commence when Licensor's monitoring systems detect the outage or when Licensee reports the outage to Licensor (whichever is earlier), and shall be deemed to end when the Cloud Services are restored to normal operation.

1.7 "Service Level" means the commitment by Licensor to maintain an Uptime Percentage of not less than ninety-nine and one-half percent (99.5%) for all Cloud Services in each calendar month, as more particularly described in Section 3.

1.8 "Subprocessor" means any third-party entity (including, without limitation, cloud infrastructure providers, managed hosting providers, data center operators, and third-party service providers) engaged by Licensor to process, store, host, transmit, or otherwise handle Licensee Data in connection with the provision of the Cloud Services. For the avoidance of doubt, Subprocessor does not include Licensee's own third-party contractors or vendors.

SECTION 2: DATA SECURITY REQUIREMENTS

2.1 General Security Obligations

Licensor shall implement and maintain a comprehensive information security program comprising administrative, technical, and physical safeguards that are designed to protect the confidentiality, integrity, and availability of Licensee Data against unauthorized access, acquisition, use, disclosure, modification, destruction, loss, or other compromise. Such safeguards shall be no less protective than: (a) industry standards and best practices for enterprise software-as-a-service providers handling confidential semiconductor design data and other highly sensitive intellectual property; and (b) the security measures Licensor applies to its own confidential information of a similar nature and sensitivity.

Without limiting the generality of the foregoing, Licensor shall establish and maintain an information security management program consistent with the requirements of ISO/IEC 27001:2022 (Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Requirements) or an equivalent internationally recognized information security framework. Licensor's information security program shall include, at a minimum, documented policies and procedures governing information classification, risk assessment, access management, incident response, vulnerability management, change management, secure software development, employee security awareness training, and third-party vendor management.

Licensor shall designate a qualified information security officer or equivalent executive-level individual responsible for the oversight and management of Licensor's information security program as it relates to the Cloud Services and the protection of Licensee Data. Licensor shall provide Licensee with the name and contact information of such individual upon request.

2.2 Encryption Standards

(a) Encryption at Rest. All Licensee Data stored on Licensor's systems, including without limitation data stored in databases, file storage systems, object storage, block storage, backups, snapshots, archives, and any temporary or cached copies, shall be encrypted at rest using the Advanced Encryption Standard with 256-bit keys (AES-256) or a successor encryption standard of equivalent or greater cryptographic strength as recognized by the National Institute of Standards and Technology ("NIST"). Encryption at rest shall apply to all storage media, whether magnetic, solid-state, or otherwise, and to all environments, including production, staging, development, and disaster recovery environments in which Licensee Data may reside.

(b) Encryption in Transit. All Licensee Data transmitted between Licensee's systems and the Cloud Services, between components of the Cloud Services, and between the Cloud Services and any Subprocessor systems, shall be encrypted in transit using Transport Layer Security version 1.3 (TLS 1.3) or a successor protocol of equivalent or greater cryptographic strength. Licensor shall not permit the use of TLS versions below 1.3, SSL, or any other deprecated or known-vulnerable transport encryption protocol for any communication involving Licensee Data. Cipher suites shall be configured to support only strong cryptographic algorithms and to disable weak or export-grade ciphers. Licensor shall implement certificate pinning or equivalent mechanisms where technically feasible to mitigate man-in-the-middle risks.

(c) Key Management. Licensor shall implement industry-standard encryption key management practices consistent with NIST SP 800-57 (Recommendation for Key Management) or equivalent guidance, including, without limitation: (i) secure generation of encryption keys using cryptographically secure random number generators; (ii) secure storage of encryption keys in hardware security modules ("HSMs") or equivalent tamper-resistant key storage systems, separate from the encrypted data they protect; (iii) rotation of encryption keys at least annually, and immediately upon any suspected compromise; (iv) secure destruction of retired encryption keys using methods that render them unrecoverable; and (v) strict access controls limiting key access to authorized personnel with a legitimate operational need. Licensee may request, not more than once per calendar year, a written summary of Licensor's key management procedures, and Licensor shall provide such summary within thirty (30) days of the request.

2.3 Access Controls

(a) Role-Based Access Controls. Licensor shall implement and enforce role-based access controls ("RBAC") to ensure that only authorized Licensor personnel with a documented, legitimate business need may access Licensee Data or systems containing Licensee Data. Access permissions shall be granted on the principle of least privilege, limited to the minimum level of access necessary for each individual to perform their assigned duties. Licensor shall conduct periodic reviews of access permissions (at least quarterly) and promptly revoke access for any personnel who no longer require it, including upon termination of employment or change of role.

(b) Multi-Factor Authentication. Multi-factor authentication ("MFA") shall be required for all Licensor personnel, contractors, and Subprocessor personnel accessing systems, applications, or environments that contain, process, or could provide access to Licensee Data. MFA shall utilize at least two distinct authentication factors (e.g., something the user knows and something the user possesses). Single-factor authentication shall not be permitted for any such access.

(c) Access Logging and Monitoring. Licensor shall maintain detailed access logs recording all access to systems containing Licensee Data, including, at a minimum, the identity of the individual accessing the system, the date and time of access, the nature of the access (e.g., read, write, delete, administrative), and the resources accessed. Access logs shall be retained for a minimum of twelve (12) months and shall be made available to Licensee upon reasonable request in connection with any Security Incident investigation or audit conducted pursuant to Section 6.3. Licensor shall implement automated monitoring and alerting mechanisms to detect and flag anomalous or unauthorized access attempts in real time.

(d) Background Checks. Licensor shall conduct appropriate background checks, to the extent permitted by applicable law and consistent with industry practice, on all personnel (including employees, contractors, and temporary workers) who may have access to Licensee Data or to systems containing Licensee Data. Background checks shall be completed prior to granting such access and shall include, at a minimum, identity verification, criminal history review, and verification of employment history.

2.4 Network Security

Licensor shall maintain and enforce robust network security controls for all systems and infrastructure used to deliver the Cloud Services or to store, process, or transmit Licensee Data. Such controls shall include, without limitation:

(a) Enterprise-grade firewalls configured to restrict inbound and outbound network traffic to only that which is necessary for the operation of the Cloud Services, with default-deny rules for all other traffic;

(b) Intrusion detection systems and intrusion prevention systems ("IDS/IPS") deployed at network perimeter and at critical internal network boundaries, monitored on a continuous (24/7/365) basis;

(c) Network segmentation measures to logically and, where feasible, physically isolate the Cloud Services infrastructure from Licensor's general corporate network, internal development environments, and the infrastructure used to serve other Licensor customers;

(d) Regular network architecture reviews to identify and remediate potential security weaknesses; and

(e) DDoS (distributed denial-of-service) mitigation capabilities to protect the availability of the Cloud Services.

Licensor shall implement automated vulnerability scanning of all Cloud Services infrastructure, including network devices, servers, operating systems, databases, and applications, on at least a monthly basis. Licensor shall apply critical security patches (as classified by the applicable vendor or by CVSS score of 9.0 or above) within thirty (30) calendar days of public release. For zero-day vulnerabilities — meaning vulnerabilities that are actively being exploited in the wild or for which no vendor patch is yet available — Licensor shall implement compensating controls or mitigations within seventy-two (72) hours of becoming aware of such vulnerability, and shall apply a permanent patch within thirty (30) days of its availability.

2.5 Data Segregation

Licensee Data shall be logically segregated from the data of all other Licensor customers and from Licensor's own corporate data at all times, across all environments (production, staging, backup, and disaster recovery). Licensor shall implement and maintain logical access controls — including, without limitation, separate database schemas or instances, separate encryption keys, separate storage containers, and separate access credentials — ensuring that no other customer of Licensor, and no Licensor personnel without a legitimate need related to Licensee's account, can access or view Licensee Data.

Licensor shall not commingle Licensee Data with data belonging to third parties in any shared storage environment, shared database, or shared application instance without implementing and maintaining logical access controls and tenant isolation mechanisms that ensure complete and effective separation. In no event shall Licensee Data be accessible to, or retrievable by, any other tenant, customer, or user of the Cloud Services.

SECTION 3: SERVICE LEVEL AGREEMENT (SLA)

3.1 Availability Commitment

Licensor commits to maintaining a minimum Uptime Percentage of ninety-nine and one-half percent (99.5%) for all Cloud Services in each calendar month during the term of the Agreement (February 1, 2026 through January 31, 2031, as may be extended in accordance with the Agreement). This availability commitment applies to all components of the Cloud Services, including compute, storage, networking, and user interface components, and is measured on a calendar-month basis.

Uptime shall be measured using Licensor's automated infrastructure monitoring systems, which shall continuously monitor the availability and responsiveness of all Cloud Services endpoints. Licensee may request, and Licensor shall provide within ten (10) business days of such request, access to real-time or near-real-time monitoring dashboards or reports reflecting the current and historical availability status of the Cloud Services. In the event of any dispute regarding the measurement of Uptime Percentage, the parties shall cooperate in good faith to reconcile their respective data, and if no resolution is reached, the dispute shall be resolved in accordance with the dispute resolution provisions of the Agreement.

3.2 Service Credit Schedule

If Licensor fails to meet the 99.5% Uptime Percentage commitment in any calendar month, Licensee shall be entitled to service credits applied against future Cloud Services fees in accordance with the following schedule:

The maximum aggregate service credits to which Licensee shall be entitled in any single calendar month shall not exceed thirty percent (30%) of the monthly Cloud Services fees for that month. Service credits shall be calculated based on the monthly Cloud Services fees actually payable by Licensee for the affected month (or, if Cloud Services fees are billed on an annual or multi-year basis, the monthly pro-rata portion of such fees). Service credits shall be applied against Licensee's next invoice for Cloud Services fees, or, if no further invoices are expected (e.g., at expiration or termination of the Agreement), shall be refunded to Licensee in cash within thirty (30) days.

To request service credits, Licensee shall submit a written request to Licensor within thirty (30) days after the end of the calendar month in which the Service Level was not met. Licensor shall apply or dispute such service credits within fifteen (15) business days of receipt. If Licensor disputes a service credit request, the parties shall cooperate in good faith to resolve the dispute, including by sharing relevant monitoring data.

Sole and Exclusive Remedy. Service credits are Licensee's sole and exclusive remedy for Licensor's failure to meet the Uptime Percentage commitment set forth in Section 3.1; provided, however, that this limitation on remedies shall not apply to, and shall not limit or restrict: (i) Licensor's indemnification obligations under the Agreement or this Rider; (ii) Licensor's obligations under Section 5 (Security Incident Notification and Response); (iii) Licensee's termination rights under Section 3.3 (Chronic Failure Termination Right); or (iv) Licensor's liability for willful misconduct, gross negligence, or fraud.

3.3 Chronic Failure Termination Right

If Licensor fails to meet the 99.5% Uptime Percentage in any three (3) or more calendar months within any rolling twelve (12)-month period (whether or not consecutive), Licensee shall have the right, exercisable at Licensee's sole discretion, to terminate the Cloud Services portion of the Agreement upon thirty (30) days' prior written notice to Licensor, without penalty, early termination fee, or other charge. Upon any such termination, Licensee shall receive a pro-rata refund of all prepaid fees allocable to the terminated Cloud Services for the remainder of the then-current annual period, calculated from the effective date of termination through the end of such annual period. Such refund shall be paid within thirty (30) days of the effective date of termination. The exercise of Licensee's termination right under this Section 3.3 shall not affect Licensee's rights under the remaining portions of the Agreement (including any on-premises license grants), which shall continue in full force and effect.

3.4 Scheduled Maintenance

Licensor shall provide at least seventy-two (72) hours' advance written notice (by email to Licensee's designated technical contact and operations team distribution list, as designated by Licensee from time to time) of any Scheduled Downtime. Such notice shall include the expected start time, estimated duration, and a description of the maintenance to be performed.

Scheduled Downtime shall not exceed eight (8) hours in aggregate per calendar month. Licensor shall use commercially reasonable efforts to minimize the frequency and duration of Scheduled Downtime and to perform maintenance activities during off-peak hours as defined in Section 1.5. In no event shall Licensor schedule maintenance during Licensee's designated critical tapeout or sign-off periods, provided that Licensee has notified Licensor of such periods at least two (2) weeks in advance. Scheduled Downtime is excluded from the Uptime Percentage calculation in accordance with Section 1.6.

3.5 Measurement and Reporting

Licensor shall provide Licensee with a monthly SLA performance report within ten (10) business days after the end of each calendar month. Each monthly report shall include, at a minimum:

(a) The actual Uptime Percentage for the preceding calendar month, calculated in accordance with Section 1.6;

(b) A summary of all downtime events during the month, including for each event: (i) start time and end time, (ii) duration, (iii) whether the downtime was scheduled or unscheduled, and (iv) affected Cloud Services components;

(c) For any unscheduled downtime event exceeding fifteen (15) minutes in duration, a root-cause description identifying the nature of the issue, the affected systems, and the steps taken to resolve the issue;

(d) A calculation of any service credits earned by Licensee for the month, if applicable; and

(e) A trailing twelve (12)-month trend summary of Uptime Percentage and downtime events.

Reports shall be delivered in electronic format (PDF or equivalent) to Licensee's designated contact. Licensor shall retain SLA measurement data for a minimum of twenty-four (24) months and shall make such data available to Licensee upon reasonable request.

SECTION 4: DATA LOCALIZATION AND SOVEREIGNTY

4.1 Data Localization Requirement

All Licensee Data — including, without limitation, primary production data, database replicas, cache copies, backups, snapshots, archives, disaster recovery copies, and any other copies or derivatives of Licensee Data — shall be stored, processed, and maintained exclusively within data center facilities that are physically located in the continental United States of America. Licensor shall not, under any circumstances, transfer, store, process, copy, replicate, mirror, or permit access to Licensee Data from or in any location outside the United States without the prior written consent of Licensee.

This data localization requirement applies to all stages of data processing, including data ingestion, computation, intermediate storage, output generation, archival, backup, and disaster recovery, and to all environments, including production, staging, quality assurance, development, and disaster recovery environments.

4.2 Data Center Specifications

Licensor shall identify in writing, as Appendix A to this Rider (or by separate written notice delivered to Licensee on or prior to the effective date of this Rider), the specific data center facilities used to host the Cloud Services and to store or process Licensee Data. Such identification shall include, for each facility: (i) the facility name or identifier; (ii) the geographic location (city and state); (iii) the hosting provider or operator (if a third party); (iv) the facility's primary or disaster recovery designation; and (v) the compliance certifications held by the facility (e.g., SOC 2 Type II, ISO 27001, PCI DSS).

Licensor shall provide at least sixty (60) days' prior written notice to Licensee before migrating or relocating Licensee Data to a different data center facility, provided that any such new facility remains within the continental United States and satisfies all applicable requirements of this Rider. Licensee shall have the right to object to any proposed migration within thirty (30) days of receiving such notice, and Licensor shall not proceed with the migration over Licensee's reasonable objection.

All data center facilities used to host Cloud Services or to store, process, or transmit Licensee Data shall maintain, at a minimum, current SOC 2 Type II and ISO/IEC 27001 certifications (or certifications under equivalent frameworks). Licensor shall ensure that such facilities provide physical security measures consistent with industry best practices, including, without limitation, 24/7 physical security staffing, biometric and multi-factor physical access controls, video surveillance, visitor logging, environmental controls, and redundant power and cooling systems.

4.3 Restrictions on Offshore Access

No Licensor personnel, contractor, agent, or Subprocessor located outside the United States shall have remote or physical access to Licensee Data or to any systems, networks, databases, or infrastructure hosting or capable of accessing Licensee Data, unless Licensee provides its prior written consent in each instance.

If Licensee consents to offshore access for specific, limited support purposes (e.g., follow-the-sun technical support during a critical incident), Licensor shall ensure that such access is: (a) limited in scope and duration to the specific purpose for which consent was granted; (b) logged in detail, including the identity of the individual, the date, time, and duration of access, and the specific data or systems accessed; (c) conducted over encrypted connections meeting the requirements of Section 2.2(b); (d) subject to all access control requirements of Section 2.3; and (e) terminable by Licensee at any time upon written or electronic notice. Licensor shall provide Licensee with a summary of any offshore access sessions within five (5) business days of such access occurring.

SECTION 5: SECURITY INCIDENT NOTIFICATION AND RESPONSE

5.1 Notification Obligation

Licensor shall notify Licensee in writing of any Security Incident within seventy-two (72) hours of Licensor's discovery or reasonable determination that a Security Incident has occurred. For purposes of this Section 5.1, "Discovery" means the point in time at which Licensor has a reasonable basis to believe that a Security Incident has occurred, regardless of whether the full scope or impact of the incident has been determined. Licensor shall not delay notification in order to complete its investigation.

Initial notification shall be provided via email to the following individuals at Licensee (or their designated successors as notified to Licensor in writing from time to time):

• Douglas Tran, General Counsel, Optiwave Semiconductor Corp.

• Priya Venkatesh, VP of Engineering Operations, Optiwave Semiconductor Corp.

In addition, Licensor shall provide telephonic notice to Licensee's General Counsel within twenty-four (24) hours of discovery of any Security Incident that Licensor reasonably believes involves the actual unauthorized access to, or exfiltration of, Licensee Data.

The initial written notification shall include, to the extent known at the time of notification:

(a) The date and time of discovery of the Security Incident;

(b) A description of the nature and circumstances of the Security Incident, including the attack vector or method of compromise (if known);

(d) The likely consequences of the Security Incident for Licensee, including potential impacts on the confidentiality, integrity, or availability of Licensee Data;

(e) A description of the measures taken or proposed to be taken by Licensor to address the Security Incident, contain its effects, and prevent further unauthorized access; and

(f) The identity, title, and contact information (including direct telephone number and email address) of Licensor's designated incident response lead.

If complete information is not available at the time of the initial notification, Licensor shall provide the information then available and supplement it in writing as additional information becomes known, on a continuing basis and without undue delay.

5.2 Investigation and Remediation

Licensor shall promptly initiate a thorough investigation of any Security Incident, utilizing qualified internal resources and, where appropriate, engaging independent third-party forensic investigators. Licensor shall take all reasonable and commercially appropriate steps to contain the Security Incident, mitigate its effects, prevent recurrence, and restore the confidentiality, integrity, and availability of Licensee Data as quickly as practicable. Licensor shall cooperate fully with Licensee's own investigation of the Security Incident, including by providing timely access to relevant personnel, systems, logs, and documentation as reasonably requested by Licensee.

Licensor shall provide Licensee with a comprehensive written root-cause analysis within thirty (30) calendar days following the date of the initial notification. The root-cause analysis shall include, at a minimum: (i) a detailed description of the Security Incident, including the timeline of events; (ii) the root cause(s) of the incident; (iii) the specific Licensee Data affected; (iv) the remediation actions taken to date; (v) a remediation plan addressing any remaining vulnerabilities or weaknesses, with specific milestones and a timeline for completion; and (vi) an assessment of measures to prevent similar incidents in the future.

5.3 Regulatory Reporting

Licensor shall reasonably cooperate with Licensee in fulfilling any regulatory notification, reporting, or disclosure obligations arising from or in connection with a Security Incident, including, without limitation, obligations under applicable federal and state data breach notification laws, industry-specific regulations, and any contractual notification obligations owed by Licensee to its customers, partners, or foundry counterparties (including Brindoval Foundry Services Ltd.). Such cooperation shall include providing information, documentation, and assistance necessary for Licensee to comply with applicable notification timelines and content requirements.

Licensor shall not issue any public statement, press release, blog post, social media communication, regulatory filing, or other external communication regarding a Security Incident that affects or may affect Licensee Data without Licensee's prior written consent, except to the minimum extent required by applicable law, regulation, or binding legal process. In any case where Licensor believes it is legally compelled to make such a disclosure, Licensor shall provide Licensee with as much advance notice as is legally permissible and shall cooperate with Licensee to limit the scope of the disclosure to the minimum required.

5.4 Preservation of Evidence

Licensor shall preserve and protect all logs, records, system images, memory dumps, network captures, forensic artifacts, and other evidence related to a Security Incident for a minimum of twenty-four (24) months following the date of discovery of the Security Incident, or for such longer period as may be required by applicable law, regulation, or litigation hold obligation. Licensor shall implement a litigation hold or equivalent evidence preservation protocol promptly upon discovery of any Security Incident and shall not destroy, overwrite, modify, or permit the destruction, overwriting, or modification of any potentially relevant evidence during the preservation period. Licensor shall make preserved evidence available to Licensee or its designated forensic investigators upon reasonable request.

SECTION 6: COMPLIANCE CERTIFICATIONS AND AUDIT RIGHTS

6.1 SOC 2 Type II Compliance

Licensor shall obtain and maintain a current SOC 2 Type II Report covering, at a minimum, the Trust Services Criteria for Security, Availability, Confidentiality, and Processing Integrity, issued by an independent certified public accounting firm of recognized national standing. Licensor represents that its most recent SOC 2 Type II Report is dated June 30, 2025, and covers the twelve (12)-month examination period ending on that date.

Licensor shall obtain a new SOC 2 Type II Report at least annually during the term of the Agreement, with each such report covering a twelve (12)-month examination period, and shall provide a copy of each SOC 2 Type II Report (including any bridge letters covering interim periods) to Licensee within thirty (30) days of issuance. Licensor shall promptly notify Licensee of any delays in the issuance of a scheduled SOC 2 Type II Report.

If any SOC 2 Type II Report identifies material control deficiencies, exceptions, qualifications, or deviations from the applicable Trust Services Criteria (including management responses or complementary user entity controls that may affect Licensee), Licensor shall: (i) promptly notify Licensee of such findings; (ii) develop and provide to Licensee a detailed written remediation plan, including specific corrective actions and a timeline for completion; and (iii) remediate all material deficiencies within ninety (90) days of the report date (or such shorter period as may be warranted by the severity of the deficiency). Licensor shall keep Licensee reasonably informed of remediation progress and shall confirm completion of remediation in writing.

6.2 Additional Certifications

Licensor shall obtain and maintain ISO/IEC 27001:2022 certification (or certification under an equivalent internationally recognized information security management framework) for the facilities, systems, and operational processes used to deliver the Cloud Services and to store, process, or transmit Licensee Data. Such certification shall be issued by an accredited certification body and shall be renewed in accordance with the applicable certification scheme requirements.

Upon Licensee's reasonable request, Licensor shall provide copies of: (i) current ISO/IEC 27001 certificates and statements of applicability; (ii) audit summaries or bridge letters covering periods between full certification audits; (iii) management responses to audit findings or non-conformities; and (iv) any other relevant compliance certifications or attestations maintained by Licensor with respect to the Cloud Services (e.g., CSA STAR, FedRAMP, or PCI DSS, to the extent applicable).

6.3 Licensee Audit Right (Data Security)

In addition to, and separate from, any software license compliance audit rights set forth in the Agreement, Licensee shall have the right, exercisable at Licensee's discretion, to conduct or commission (through a qualified, independent third-party information security assessor mutually acceptable to the parties, such acceptance not to be unreasonably withheld) an audit of Licensor's data security practices, controls, policies, procedures, and compliance with the requirements of this Rider, subject to the following conditions:

(a) Frequency. Licensee may conduct a maximum of one (1) such audit per calendar year under this Section 6.3; provided, however, that this limitation shall not apply following a Security Incident, in which case Licensee may conduct an additional audit related to the incident.

(b) Notice. Licensee shall provide Licensor with at least thirty (30) business days' prior written notice of its intent to conduct an audit, specifying the proposed scope, timing, and identity of any third-party assessor.

(c) Conduct. The audit shall be conducted during Licensor's normal business hours and in a manner that does not unreasonably interfere with Licensor's normal business operations or the availability of the Cloud Services. Licensee and its auditors shall comply with Licensor's reasonable security and facility access policies.

(d) Cooperation. Licensor shall provide reasonable cooperation, including access to relevant systems, facilities, documentation, records, and personnel, as reasonably necessary for Licensee (or its designated assessor) to evaluate Licensor's compliance with this Rider.

(e) Confidentiality. All audit findings, reports, observations, and related information obtained during the audit shall be treated as Confidential Information of Licensor under the Agreement and shall be subject to the confidentiality obligations set forth therein. Licensee shall ensure that any third-party assessor is bound by confidentiality obligations at least as protective as those in the Agreement.

(f) Remediation. If the audit reveals material non-compliance with any requirement of this Rider, Licensor shall remediate such non-compliance at its own expense within sixty (60) calendar days of receiving written notice of the audit findings (or such shorter period as may be warranted by the severity of the non-compliance). Additionally, Licensor shall bear the reasonable, documented cost of a follow-up verification audit to confirm that the identified non-compliance has been remediated, such follow-up audit to be conducted within ninety (90) days of the remediation deadline.

SECTION 7: PENETRATION TESTING AND VULNERABILITY ASSESSMENTS

7.1 Licensor's Testing Obligations

Licensor shall engage a qualified, independent third-party information security firm with recognized expertise in cloud infrastructure and application security testing to conduct comprehensive penetration testing of the Cloud Services infrastructure at least annually (once per calendar year). The selection of the third-party firm shall be at Licensor's discretion, provided that the firm holds relevant industry certifications (e.g., CREST, OSCP, or equivalent) and has no material conflicts of interest.

The scope of each annual penetration test shall include, at a minimum:

(a) External network penetration testing — Evaluating the security of internet-facing infrastructure, including perimeter devices, public-facing APIs, web servers, and DNS configurations;

(b) Web application testing — Evaluating the security of the Cloud Services web application and API interfaces against the OWASP Top 10 and other recognized web application vulnerability categories, including authentication and authorization flaws, injection vulnerabilities, cross-site scripting, and insecure deserialization;

(c) Internal network penetration testing — Evaluating the security of internal network segments, lateral movement potential, and privilege escalation paths within the Cloud Services environment; and

(d) Social engineering testing — Evaluating the susceptibility of Licensor personnel to phishing, pretexting, and other social engineering techniques that could compromise access to systems containing Licensee Data.

Licensor shall provide Licensee with an executive summary of the penetration test results within thirty (30) calendar days of the completion of each test. The executive summary shall describe all critical-severity and high-severity findings (classified in accordance with the Common Vulnerability Scoring System ("CVSS") or equivalent methodology), the potential impact of each finding, and Licensor's planned remediation actions. Licensor is not required to disclose the full detailed penetration test report to Licensee, but shall make additional information available upon Licensee's reasonable request to the extent necessary for Licensee to evaluate the security posture of the Cloud Services.

Licensor shall remediate all critical-severity findings (CVSS score 9.0 or above) within thirty (30) calendar days and all high-severity findings (CVSS score 7.0 to 8.9) within sixty (60) calendar days of identification. Licensor shall confirm remediation in writing and, upon Licensee's request, provide evidence of re-testing confirming that the vulnerabilities have been addressed.

7.2 Licensee-Initiated Testing

Licensee may, upon thirty (30) business days' prior written notice and at Licensee's sole expense, engage a mutually agreed qualified third-party information security firm to perform penetration testing of the Cloud Services infrastructure, not more than once per calendar year. The parties shall cooperate in good faith to agree on the identity of the third-party firm, the scope and methodology of testing, and the testing schedule. Licensor shall not unreasonably withhold, condition, or delay its agreement to a proposed testing firm or scope.

Licensor shall provide reasonable cooperation and access to facilitate the Licensee-initiated testing, including access to testing environments, coordination with Licensor's operations team, and provision of necessary credentials or configuration information. All testing shall be conducted in a manner designed to avoid disruption to the production Cloud Services environment and shall comply with a mutually agreed rules-of-engagement document.

The results of any Licensee-initiated penetration test shall be shared with Licensor promptly upon completion and shall be treated as the Confidential Information of both parties under the Agreement. If the testing identifies critical- or high-severity findings, Licensor shall remediate such findings in accordance with the timelines set forth in Section 7.1.

SECTION 8: SUBPROCESSORS

8.1 Use of Subprocessors

Licensor shall not engage any Subprocessor to process, store, host, transmit, or otherwise handle Licensee Data in connection with the Cloud Services without the prior written consent of Licensee, which consent may be withheld or conditioned in Licensee's reasonable discretion. Licensor shall provide Licensee with a current and complete list of all Subprocessors engaged as of the effective date of this Rider, in the format set forth in Appendix B, including for each Subprocessor: (i) entity name and principal office location; (ii) a description of the functions performed in connection with the Cloud Services; (iii) the data center location(s) at which such Subprocessor processes or stores Licensee Data; (iv) the date of initial engagement; and (v) the current approval status.

Licensor shall update the Subprocessor list and provide written notice to Licensee at least thirty (30) days prior to engaging any new Subprocessor or materially changing the scope of an existing Subprocessor's engagement with respect to Licensee Data. Such notice shall include the information described above and a description of the security measures the proposed Subprocessor will implement to protect Licensee Data.

8.2 Subprocessor Obligations

Licensor shall enter into a written agreement with each Subprocessor that imposes data security, confidentiality, and data protection obligations that are at least as protective of Licensee Data as those set forth in this Rider. Such agreements shall include, without limitation, obligations relating to encryption, access controls, data segregation, Security Incident notification, data localization (consistent with Section 4), data return and deletion, and compliance with applicable laws.

Licensor shall remain fully responsible and liable to Licensee for any acts, omissions, errors, or failures of its Subprocessors relating to Licensee Data, to the same extent as if such acts, omissions, errors, or failures were those of Licensor itself. The engagement of a Subprocessor shall not relieve Licensor of any obligation under this Rider or the Agreement.

8.3 Licensee Objection Right

If Licensee reasonably objects in writing to a proposed new Subprocessor on data security or data sovereignty grounds within the thirty (30)-day notice period described in Section 8.1, Licensor shall not engage such Subprocessor with respect to Licensee Data. In such event, Licensor shall, at Licensee's election: (a) propose and use an alternative Subprocessor that is acceptable to Licensee, subject to Licensee's consent pursuant to Section 8.1; or (b) perform the relevant processing, storage, or hosting functions without engaging the proposed Subprocessor, using Licensor's own resources or existing approved Subprocessors. Licensor shall use commercially reasonable efforts to implement Licensee's election without material disruption to the Cloud Services or material delay in service delivery.

SECTION 9: DATA OWNERSHIP, RETURN, AND DELETION

9.1 Ownership. As between the parties, all Licensee Data is and shall remain the sole and exclusive property of Licensee. Nothing in this Rider or the Agreement shall be construed as granting Licensor any right, title, or interest in or to Licensee Data, other than the limited, non-exclusive, non-transferable right to access, use, copy, and process Licensee Data solely to the extent necessary to provide the Cloud Services to Licensee in accordance with the Agreement and this Rider. Licensor shall not use Licensee Data for any purpose other than providing the Cloud Services to Licensee, and shall not, without limitation, use Licensee Data for benchmarking, product development, machine learning model training, analytics, marketing, or any other purpose, without Licensee's prior express written consent.

9.2 Data Return

Upon expiration or termination of the Agreement (or of the Cloud Services portion thereof), or upon Licensee's written request at any time during the term, Licensor shall, at Licensee's election, return to Licensee all Licensee Data in a standard, industry-recognized, machine-readable format (e.g., original file formats as uploaded by Licensee, or in a mutually agreed alternative format) within thirty (30) calendar days of receiving such request or the effective date of expiration or termination, whichever is applicable. Licensor shall provide Licensee Data via a secure transfer method (e.g., encrypted transfer via SFTP, secure cloud storage download, or encrypted physical media, as mutually agreed). Licensor shall not charge Licensee any fee for data return, except that if Licensee requests return via physical media, Licensee shall bear the reasonable cost of such media and shipping.

Licensor shall cooperate in good faith with Licensee to ensure an orderly transition of Licensee Data, including by providing reasonable technical support and assistance during the data return process, for a period of up to sixty (60) days following expiration or termination (the "Transition Period"). During the Transition Period, Licensor shall continue to maintain the security of Licensee Data in accordance with Section 2.

9.3 Data Deletion

Following the confirmed return of all Licensee Data to Licensee (as evidenced by Licensee's written acknowledgment of receipt), or upon Licensee's written instruction to delete Licensee Data without return, Licensor shall securely delete and destroy all copies of Licensee Data from its systems, including all production systems, backup systems, archives, disaster recovery systems, and any other storage media, within sixty (60) calendar days. Deletion shall be performed using methods consistent with NIST Special Publication 800-88, Revision 1 (Guidelines for Media Sanitization), or an equivalent standard, sufficient to render Licensee Data unrecoverable.

Within five (5) business days following the completion of deletion, Licensor shall provide Licensee with a written certification, signed by an authorized officer or director of Licensor, confirming that all Licensee Data has been securely deleted and destroyed in accordance with this Section 9.3, specifying the date(s) of deletion and the methods used.

9.4 Post-Termination Retention

Notwithstanding Section 9.3, Licensor may retain copies of Licensee Data solely to the extent, and for the minimum period, required by applicable law, regulation, or binding legal process (including litigation hold obligations). Any Licensee Data retained pursuant to this Section 9.4 shall continue to be subject to all confidentiality and security obligations of this Rider and the Agreement for the duration of such retention. Licensor shall notify Licensee in writing of any post-termination retention of Licensee Data, identifying the legal basis for retention, the categories of data retained, and the anticipated retention period. Upon expiration of the applicable legal retention requirement, Licensor shall promptly delete such data in accordance with Section 9.3.

SECTION 10: BUSINESS CONTINUITY AND DISASTER RECOVERY

10.1 BC/DR Plan

Licensor shall develop, implement, and maintain a comprehensive business continuity and disaster recovery ("BC/DR") plan for the Cloud Services that is designed to ensure the continued availability, integrity, and security of the Cloud Services and Licensee Data in the event of a natural disaster, infrastructure failure, cyberattack, pandemic, or other disruptive event. The BC/DR plan shall be designed to achieve, at a minimum, the following recovery objectives:

• Recovery Time Objective (RTO): Restoration of Cloud Services availability within four (4) hours of a declared disaster or material service disruption.

• Recovery Point Objective (RPO): Recovery of Licensee Data to a state no more than one (1) hour prior to the disaster or service disruption event, ensuring that no more than one (1) hour of Licensee Data is lost.

Licensor shall test its BC/DR plan at least annually through tabletop exercises, functional tests, or full-scale recovery simulations, and shall document the results of each test, including any deficiencies identified and corrective actions taken. Licensor shall maintain written records of all BC/DR plan tests for a minimum of three (3) years.

10.2 Geographic Redundancy

Licensor shall maintain geographically redundant data center facilities within the continental United States for disaster recovery purposes, ensuring that Licensee Data is replicated to a secondary data center located in a different geographic region from the primary data center. All disaster recovery data centers and replicated data shall comply with the data localization requirements set forth in Section 4 and shall satisfy the same security and compliance standards applicable to the primary data center under this Rider.

10.3 Plan Disclosure

Upon Licensee's reasonable request, not more than once per calendar year, Licensor shall provide Licensee with a written summary of its BC/DR plan applicable to the Cloud Services, including: (i) the current RTO and RPO commitments; (ii) the locations of primary and disaster recovery data centers; (iii) a description of the replication methodology and frequency; (iv) the date and results of the most recent BC/DR plan test; and (v) a description of any material changes to the BC/DR plan since the last disclosure. Such summary shall be treated as the Confidential Information of Licensor under the Agreement.

SECTION 11: INSURANCE

11.1 Minimum Coverage

Licensor shall obtain and maintain, at its own expense, during the entire term of the Agreement and for a period of two (2) years following expiration or termination thereof, the following minimum insurance coverages with carriers rated "A-" or better by A.M. Best Company (or equivalent rating):

(a) Commercial General Liability Insurance: With limits of not less than Five Million Dollars ($5,000,000) per occurrence and Ten Million Dollars ($10,000,000) in the aggregate, covering bodily injury, property damage, personal injury, and advertising injury arising out of Licensor's operations.

(b) Technology Errors and Omissions / Cyber Liability Insurance: With limits of not less than Ten Million Dollars ($10,000,000) per claim and Ten Million Dollars ($10,000,000) in the aggregate, covering claims arising from: (i) data breaches and unauthorized access to, or disclosure of, confidential information (including Licensee Data); (ii) network security failures, including failures of firewalls, intrusion detection systems, and other security infrastructure; (iii) privacy-related claims, including regulatory fines and penalties (to the extent insurable); (iv) technology errors and omissions in the provision of the Cloud Services; and (v) costs of breach notification, credit monitoring, forensic investigation, and crisis management.

Licensor shall provide Licensee with certificates of insurance evidencing the required coverages upon execution of this Rider and thereafter upon Licensee's request, but not more than once per calendar year. Such certificates shall identify Licensee as an additional insured with respect to the commercial general liability policy, to the extent of Licensor's indemnification obligations under the Agreement. Licensor shall provide Licensee with at least thirty (30) days' prior written notice of any material reduction in coverage, cancellation, or non-renewal of any required policy.

SECTION 12: REPRESENTATIONS AND WARRANTIES

12.1 Licensor Representations

Licensor represents and warrants to Licensee, as of the effective date of this Rider and on a continuing basis during the term of the Agreement, that:

(a) Licensor has the technical capability, infrastructure, qualified personnel, and financial resources necessary to comply with the security, service level, business continuity, and other requirements set forth in this Rider;

(b) The Cloud Services will be provided in material compliance with all applicable federal, state, and local laws, rules, and regulations, including without limitation data protection and privacy laws, export control laws, and any industry-specific regulations applicable to the processing of semiconductor design data;

(c) As of the effective date of this Rider, Licensor is not aware of any material security vulnerabilities in the Cloud Services, the Cloud Services infrastructure, or the systems used to store or process Licensee Data that have not been disclosed to Licensee in writing;

(d) Licensor's most recent SOC 2 Type II Report, dated June 30, 2025, did not contain material qualifications, exceptions, or control deficiencies that remain unremediated as of the effective date of this Rider; and

(e) Licensor has not experienced any Security Incident affecting the Cloud Services or the data of any customer within the twelve (12) months preceding the effective date of this Rider that has not been disclosed to Licensee in writing.

12.2 Ongoing Compliance

Licensor shall promptly notify Licensee in writing if, at any time during the term of the Agreement, Licensor becomes aware that it is unable to comply, or is in material non-compliance, with any requirement, obligation, or commitment set forth in this Rider. Such notice shall include a description of the non-compliance, the Licensee Data or Cloud Services affected, the steps being taken to remediate the non-compliance, and the expected timeline for remediation. Failure to provide such notice shall not limit or excuse Licensor's liability for the underlying non-compliance.

SECTION 13: RELATIONSHIP TO AGREEMENT

13.1 Incorporation. This Rider is incorporated into and forms an integral part of the Amended and Restated Enterprise License Agreement (Agreement No. MDS-ELA-2026-01192) between Optiwave Semiconductor Corp. and Meridian Design Systems, Inc., dated as of February 1, 2026. All references in this Rider to the "Agreement" mean the Amended and Restated Enterprise License Agreement, as may be amended, supplemented, or restated from time to time in accordance with its terms. All provisions of the Agreement that are not specifically modified or superseded by this Rider, including without limitation the indemnification, limitation of liability, intellectual property, and general provisions of the Agreement, shall remain in full force and effect and shall apply to the Cloud Services and to this Rider.

13.2 Conflict. In the event of any conflict, inconsistency, or ambiguity between the terms of this Rider and the terms of the Agreement (including any other exhibit, schedule, or addendum thereto) with respect to data security, cloud services, service levels, data localization, audit rights, or any other subject matter addressed in this Rider, the terms of this Rider shall prevail and control to the extent of such conflict, inconsistency, or ambiguity.

13.3 Survival. The following Sections of this Rider shall survive the expiration or termination of the Agreement (for any reason) for a period of three (3) years following the effective date of such expiration or termination, or until all Licensee Data has been returned to Licensee or securely deleted in accordance with Section 9, whichever is later:

• Section 2 (Data Security Requirements)

• Section 5 (Security Incident Notification and Response)

• Section 6 (Compliance Certifications and Audit Rights)

• Section 9 (Data Ownership, Return, and Deletion)

• Section 12 (Representations and Warranties)

All other provisions of this Rider that by their nature are intended to survive expiration or termination (including, without limitation, Licensor's indemnification obligations and the confidentiality obligations applicable to Licensee Data) shall also survive in accordance with their terms.

SECTION 14: GOVERNING LAW AND DISPUTE RESOLUTION

14.1 Governing Law

This Rider shall be governed by, and construed and enforced in accordance with, the laws of the State of California, without regard to its principles of conflicts of laws that would require the application of the laws of any other jurisdiction. This governing law provision is consistent with,

DATA SECURITY AND CLOUD SERVICES RIDER
Exhibit F to the Amended and Restated Enterprise License Agreement
Agreement No. MDS-ELA-2026-01192
This Data Security and Cloud Services Rider (this "Rider") is entered into as a supplemental rider to the Amended and Restated Enterprise License Agreement dated as of February 1, 2026 (the "Agreement"), by and between:
Optiwave Semiconductor Corp., a Delaware corporation ("Licensee" or "OWS"), with its principal offices located at 4850 Great America Parkway, Suite 300, Santa Clara, California 95054;
and
Meridian Design Systems, Inc., a Delaware corporation ("Licensor" or "Meridian"), with its principal offices located at 2700 Orchard Parkway, San Jose, California 95134.
This Rider is incorporated into and forms an integral part of the Agreement. Capitalized terms used but not otherwise defined in this Rider shall have the meanings ascribed to them in the Agreement. In the event of any conflict between this Rider and the Agreement with respect to data security, cloud services, or the subject matter addressed herein, the terms of this Rider shall control.
This Rider applies to Meridian CloudVerify™ and any other cloud-hosted components, modules, or services provided by Licensor to Licensee under or in connection with the Agreement (collectively, the "Cloud Services"), as further defined in Section 1 below.
RECITALS
WHEREAS, Licensee and Licensor have entered into the Amended and Restated Enterprise License Agreement (Agreement No. MDS-ELA-2026-01192) dated as of February 1, 2026 (the "Agreement"), which amends and restates in its entirety the Original Enterprise License Agreement (Agreement No. MDS-ELA-2023-00487) dated as of February 1, 2023 (the "Original Agreement");
WHEREAS, the Agreement provides for Licensee's use of certain cloud-hosted verification compute services, including the Meridian CloudVerify™ platform, and other cloud-hosted components, modules, and tools made available by Licensor as part of its integrated electronic design automation ("EDA") product suite;
WHEREAS, Licensee's design data — including, without limitation, integrated circuit design files, register-transfer level (RTL) descriptions, gate-level and transistor-level netlists, layout data in GDSII and OASIS formats, simulation results, formal verification outputs, and related intellectual property processed through the Cloud Services (collectively, "Licensee Data") — constitutes highly confidential and proprietary information of significant commercial value, the unauthorized disclosure or compromise of which would cause material and irreparable harm to Licensee;
WHEREAS, the parties desire to establish minimum data security standards, service level commitments, and operational requirements applicable to all Cloud Services, in order to protect the confidentiality, integrity, and availability of Licensee Data and to ensure the reliable operation of Cloud Services critical to Licensee's design and verification workflows;
WHEREAS, Licensee is a fabless semiconductor design company whose design data interfaces with third-party foundry process design kits ("PDKs"), including those of Brindoval Foundry Services Ltd., and whose customers and foundry partners impose contractual and regulatory requirements necessitating heightened security protections for design data processed in cloud environments; and
WHEREAS, the parties acknowledge that the security and operational commitments set forth in this Rider are a material inducement to Licensee's agreement to utilize the Cloud Services and to the parties' entry into the Agreement.
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:
SECTION 1: DEFINITIONS
For purposes of this Rider, the following terms shall have the meanings set forth below. All other capitalized terms used in this Rider and not defined herein shall have the meanings set forth in the Agreement.
1.1 "Cloud Services" means Meridian CloudVerify™ and any other cloud-hosted, software-as-a-service ("SaaS")-delivered, or remotely hosted components, modules, tools, platforms, or services provided by Licensor to Licensee under or in connection with the Agreement, including any updates, upgrades, new releases, or successor services thereto. For the avoidance of doubt, Cloud Services include any compute, storage, networking, and related infrastructure operated or managed by Licensor (or its Subprocessors) to deliver the foregoing to Licensee.
1.2 "Licensee Data" means all data, files, designs, source code, netlists, layouts (including GDSII, OASIS, and LEF/DEF formats), simulation outputs, verification results, timing reports, power analysis data, configuration files, scripts, user credentials, metadata, log data generated by or on behalf of Licensee, and any other information or intellectual property of Licensee or its personnel that is uploaded to, processed by, stored in, generated by, or transmitted through the Cloud Services, regardless of the format or medium in which such data exists. Licensee Data includes any derivative data, intermediate results, or cached copies created by the Cloud Services in the course of processing Licensee's inputs.
1.3 "Security Incident" means any actual or reasonably suspected (i) unauthorized access to, acquisition of, use of, disclosure of, modification of, or destruction of Licensee Data, or (ii) breach of Licensor's security systems, controls, policies, or procedures that compromises or is reasonably likely to compromise the confidentiality, integrity, or availability of Licensee Data, or (iii) any other event that requires notification under applicable data breach notification laws with respect to Licensee Data.
1.4 "SOC 2 Type II Report" means a Service Organization Control 2 Type II audit report prepared by an independent certified public accounting firm in accordance with the attestation standards established by the American Institute of Certified Public Accountants ("AICPA") and the AICPA Trust Services Criteria, covering the Security, Availability, Confidentiality, and Processing Integrity trust services categories (or such successor criteria as may be adopted by the AICPA from time to time).
1.5 "Scheduled Downtime" means planned maintenance windows during which Cloud Services may be temporarily unavailable, provided that such maintenance windows have been communicated to Licensee in writing at least seventy-two (72) hours in advance in accordance with Section 3.4. Scheduled Downtime must be scheduled during off-peak hours, defined as weekends (Saturday 12:00 a.m. through Sunday 11:59 p.m. Pacific Time) or between 12:00 a.m. and 6:00 a.m. Pacific Time on weekdays (Monday through Friday).
1.6 "Uptime Percentage" means, for any given calendar month, the percentage of total minutes during such month during which the Cloud Services are available and operational, excluding Scheduled Downtime minutes. The Uptime Percentage shall be calculated using the following formula:
Uptime Percentage = ((Total Minutes in Month – Scheduled Downtime Minutes – Unscheduled Downtime Minutes) / (Total Minutes in Month – Scheduled Downtime Minutes)) × 100
For purposes of this calculation, "Unscheduled Downtime" means any period during which the Cloud Services are materially unavailable to Licensee for their intended use, other than Scheduled Downtime. A period of unavailability shall be deemed to commence when Licensor's monitoring systems detect the outage or when Licensee reports the outage to Licensor (whichever is earlier), and shall be deemed to end when the Cloud Services are restored to normal operation.
1.7 "Service Level" means the commitment by Licensor to maintain an Uptime Percentage of not less than ninety-nine and one-half percent (99.5%) for all Cloud Services in each calendar month, as more particularly described in Section 3.
1.8 "Subprocessor" means any third-party entity (including, without limitation, cloud infrastructure providers, managed hosting providers, data center operators, and third-party service providers) engaged by Licensor to process, store, host, transmit, or otherwise handle Licensee Data in connection with the provision of the Cloud Services. For the avoidance of doubt, Subprocessor does not include Licensee's own third-party contractors or vendors.
SECTION 2: DATA SECURITY REQUIREMENTS
2.1 General Security Obligations
Licensor shall implement and maintain a comprehensive information security program comprising administrative, technical, and physical safeguards that are designed to protect the confidentiality, integrity, and availability of Licensee Data against unauthorized access, acquisition, use, disclosure, modification, destruction, loss, or other compromise. Such safeguards shall be no less protective than: (a) industry standards and best practices for enterprise software-as-a-service providers handling confidential semiconductor design data and other highly sensitive intellectual property; and (b) the security measures Licensor applies to its own confidential information of a similar nature and sensitivity.
Without limiting the generality of the foregoing, Licensor shall establish and maintain an information security management program consistent with the requirements of ISO/IEC 27001:2022 (Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Requirements) or an equivalent internationally recognized information security framework. Licensor's information security program shall include, at a minimum, documented policies and procedures governing information classification, risk assessment, access management, incident response, vulnerability management, change management, secure software development, employee security awareness training, and third-party vendor management.
Licensor shall designate a qualified information security officer or equivalent executive-level individual responsible for the oversight and management of Licensor's information security program as it relates to the Cloud Services and the protection of Licensee Data. Licensor shall provide Licensee with the name and contact information of such individual upon request.
2.2 Encryption Standards
(a) Encryption at Rest. All Licensee Data stored on Licensor's systems, including without limitation data stored in databases, file storage systems, object storage, block storage, backups, snapshots, archives, and any temporary or cached copies, shall be encrypted at rest using the Advanced Encryption Standard with 256-bit keys (AES-256) or a successor encryption standard of equivalent or greater cryptographic strength as recognized by the National Institute of Standards and Technology ("NIST"). Encryption at rest shall apply to all storage media, whether magnetic, solid-state, or otherwise, and to all environments, including production, staging, development, and disaster recovery environments in which Licensee Data may reside.
(b) Encryption in Transit. All Licensee Data transmitted between Licensee's systems and the Cloud Services, between components of the Cloud Services, and between the Cloud Services and any Subprocessor systems, shall be encrypted in transit using Transport Layer Security version 1.3 (TLS 1.3) or a successor protocol of equivalent or greater cryptographic strength. Licensor shall not permit the use of TLS versions below 1.3, SSL, or any other deprecated or known-vulnerable transport encryption protocol for any communication involving Licensee Data. Cipher suites shall be configured to support only strong cryptographic algorithms and to disable weak or export-grade ciphers. Licensor shall implement certificate pinning or equivalent mechanisms where technically feasible to mitigate man-in-the-middle risks.
(c) Key Management. Licensor shall implement industry-standard encryption key management practices consistent with NIST SP 800-57 (Recommendation for Key Management) or equivalent guidance, including, without limitation: (i) secure generation of encryption keys using cryptographically secure random number generators; (ii) secure storage of encryption keys in hardware security modules ("HSMs") or equivalent tamper-resistant key storage systems, separate from the encrypted data they protect; (iii) rotation of encryption keys at least annually, and immediately upon any suspected compromise; (iv) secure destruction of retired encryption keys using methods that render them unrecoverable; and (v) strict access controls limiting key access to authorized personnel with a legitimate operational need. Licensee may request, not more than once per calendar year, a written summary of Licensor's key management procedures, and Licensor shall provide such summary within thirty (30) days of the request.
2.3 Access Controls
(a) Role-Based Access Controls. Licensor shall implement and enforce role-based access controls ("RBAC") to ensure that only authorized Licensor personnel with a documented, legitimate business need may access Licensee Data or systems containing Licensee Data. Access permissions shall be granted on the principle of least privilege, limited to the minimum level of access necessary for each individual to perform their assigned duties. Licensor shall conduct periodic reviews of access permissions (at least quarterly) and promptly revoke access for any personnel who no longer require it, including upon termination of employment or change of role.
(b) Multi-Factor Authentication. Multi-factor authentication ("MFA") shall be required for all Licensor personnel, contractors, and Subprocessor personnel accessing systems, applications, or environments that contain, process, or could provide access to Licensee Data. MFA shall utilize at least two distinct authentication factors (e.g., something the user knows and something the user possesses). Single-factor authentication shall not be permitted for any such access.
(c) Access Logging and Monitoring. Licensor shall maintain detailed access logs recording all access to systems containing Licensee Data, including, at a minimum, the identity of the individual accessing the system, the date and time of access, the nature of the access (e.g., read, write, delete, administrative), and the resources accessed. Access logs shall be retained for a minimum of twelve (12) months and shall be made available to Licensee upon reasonable request in connection with any Security Incident investigation or audit conducted pursuant to Section 6.3. Licensor shall implement automated monitoring and alerting mechanisms to detect and flag anomalous or unauthorized access attempts in real time.
(d) Background Checks. Licensor shall conduct appropriate background checks, to the extent permitted by applicable law and consistent with industry practice, on all personnel (including employees, contractors, and temporary workers) who may have access to Licensee Data or to systems containing Licensee Data. Background checks shall be completed prior to granting such access and shall include, at a minimum, identity verification, criminal history review, and verification of employment history.
2.4 Network Security
Licensor shall maintain and enforce robust network security controls for all systems and infrastructure used to deliver the Cloud Services or to store, process, or transmit Licensee Data. Such controls shall include, without limitation:
(a) Enterprise-grade firewalls configured to restrict inbound and outbound network traffic to only that which is necessary for the operation of the Cloud Services, with default-deny rules for all other traffic;
(b) Intrusion detection systems and intrusion prevention systems ("IDS/IPS") deployed at network perimeter and at critical internal network boundaries, monitored on a continuous (24/7/365) basis;
(c) Network segmentation measures to logically and, where feasible, physically isolate the Cloud Services infrastructure from Licensor's general corporate network, internal development environments, and the infrastructure used to serve other Licensor customers;
(d) Regular network architecture reviews to identify and remediate potential security weaknesses; and
(e) DDoS (distributed denial-of-service) mitigation capabilities to protect the availability of the Cloud Services.
Licensor shall implement automated vulnerability scanning of all Cloud Services infrastructure, including network devices, servers, operating systems, databases, and applications, on at least a monthly basis. Licensor shall apply critical security patches (as classified by the applicable vendor or by CVSS score of 9.0 or above) within thirty (30) calendar days of public release. For zero-day vulnerabilities — meaning vulnerabilities that are actively being exploited in the wild or for which no vendor patch is yet available — Licensor shall implement compensating controls or mitigations within seventy-two (72) hours of becoming aware of such vulnerability, and shall apply a permanent patch within thirty (30) days of its availability.
2.5 Data Segregation
Licensee Data shall be logically segregated from the data of all other Licensor customers and from Licensor's own corporate data at all times, across all environments (production, staging, backup, and disaster recovery). Licensor shall implement and maintain logical access controls — including, without limitation, separate database schemas or instances, separate encryption keys, separate storage containers, and separate access credentials — ensuring that no other customer of Licensor, and no Licensor personnel without a legitimate need related to Licensee's account, can access or view Licensee Data.
Licensor shall not commingle Licensee Data with data belonging to third parties in any shared storage environment, shared database, or shared application instance without implementing and maintaining logical access controls and tenant isolation mechanisms that ensure complete and effective separation. In no event shall Licensee Data be accessible to, or retrievable by, any other tenant, customer, or user of the Cloud Services.
SECTION 3: SERVICE LEVEL AGREEMENT (SLA)
3.1 Availability Commitment
Licensor commits to maintaining a minimum Uptime Percentage of ninety-nine and one-half percent (99.5%) for all Cloud Services in each calendar month during the term of the Agreement (February 1, 2026 through January 31, 2031, as may be extended in accordance with the Agreement). This availability commitment applies to all components of the Cloud Services, including compute, storage, networking, and user interface components, and is measured on a calendar-month basis.
Uptime shall be measured using Licensor's automated infrastructure monitoring systems, which shall continuously monitor the availability and responsiveness of all Cloud Services endpoints. Licensee may request, and Licensor shall provide within ten (10) business days of such request, access to real-time or near-real-time monitoring dashboards or reports reflecting the current and historical availability status of the Cloud Services. In the event of any dispute regarding the measurement of Uptime Percentage, the parties shall cooperate in good faith to reconcile their respective data, and if no resolution is reached, the dispute shall be resolved in accordance with the dispute resolution provisions of the Agreement.
3.2 Service Credit Schedule
If Licensor fails to meet the 99.5% Uptime Percentage commitment in any calendar month, Licensee shall be entitled to service credits applied against future Cloud Services fees in accordance with the following schedule:
The maximum aggregate service credits to which Licensee shall be entitled in any single calendar month shall not exceed thirty percent (30%) of the monthly Cloud Services fees for that month. Service credits shall be calculated based on the monthly Cloud Services fees actually payable by Licensee for the affected month (or, if Cloud Services fees are billed on an annual or multi-year basis, the monthly pro-rata portion of such fees). Service credits shall be applied against Licensee's next invoice for Cloud Services fees, or, if no further invoices are expected (e.g., at expiration or termination of the Agreement), shall be refunded to Licensee in cash within thirty (30) days.
To request service credits, Licensee shall submit a written request to Licensor within thirty (30) days after the end of the calendar month in which the Service Level was not met. Licensor shall apply or dispute such service credits within fifteen (15) business days of receipt. If Licensor disputes a service credit request, the parties shall cooperate in good faith to resolve the dispute, including by sharing relevant monitoring data.
Sole and Exclusive Remedy. Service credits are Licensee's sole and exclusive remedy for Licensor's failure to meet the Uptime Percentage commitment set forth in Section 3.1; provided, however, that this limitation on remedies shall not apply to, and shall not limit or restrict: (i) Licensor's indemnification obligations under the Agreement or this Rider; (ii) Licensor's obligations under Section 5 (Security Incident Notification and Response); (iii) Licensee's termination rights under Section 3.3 (Chronic Failure Termination Right); or (iv) Licensor's liability for willful misconduct, gross negligence, or fraud.
3.3 Chronic Failure Termination Right
If Licensor fails to meet the 99.5% Uptime Percentage in any three (3) or more calendar months within any rolling twelve (12)-month period (whether or not consecutive), Licensee shall have the right, exercisable at Licensee's sole discretion, to terminate the Cloud Services portion of the Agreement upon thirty (30) days' prior written notice to Licensor, without penalty, early termination fee, or other charge. Upon any such termination, Licensee shall receive a pro-rata refund of all prepaid fees allocable to the terminated Cloud Services for the remainder of the then-current annual period, calculated from the effective date of termination through the end of such annual period. Such refund shall be paid within thirty (30) days of the effective date of termination. The exercise of Licensee's termination right under this Section 3.3 shall not affect Licensee's rights under the remaining portions of the Agreement (including any on-premises license grants), which shall continue in full force and effect.
3.4 Scheduled Maintenance
Licensor shall provide at least seventy-two (72) hours' advance written notice (by email to Licensee's designated technical contact and operations team distribution list, as designated by Licensee from time to time) of any Scheduled Downtime. Such notice shall include the expected start time, estimated duration, and a description of the maintenance to be performed.
Scheduled Downtime shall not exceed eight (8) hours in aggregate per calendar month. Licensor shall use commercially reasonable efforts to minimize the frequency and duration of Scheduled Downtime and to perform maintenance activities during off-peak hours as defined in Section 1.5. In no event shall Licensor schedule maintenance during Licensee's designated critical tapeout or sign-off periods, provided that Licensee has notified Licensor of such periods at least two (2) weeks in advance. Scheduled Downtime is excluded from the Uptime Percentage calculation in accordance with Section 1.6.
3.5 Measurement and Reporting
Licensor shall provide Licensee with a monthly SLA performance report within ten (10) business days after the end of each calendar month. Each monthly report shall include, at a minimum:
(a) The actual Uptime Percentage for the preceding calendar month, calculated in accordance with Section 1.6;
(b) A summary of all downtime events during the month, including for each event: (i) start time and end time, (ii) duration, (iii) whether the downtime was scheduled or unscheduled, and (iv) affected Cloud Services components;
(c) For any unscheduled downtime event exceeding fifteen (15) minutes in duration, a root-cause description identifying the nature of the issue, the affected systems, and the steps taken to resolve the issue;
(d) A calculation of any service credits earned by Licensee for the month, if applicable; and
(e) A trailing twelve (12)-month trend summary of Uptime Percentage and downtime events.
Reports shall be delivered in electronic format (PDF or equivalent) to Licensee's designated contact. Licensor shall retain SLA measurement data for a minimum of twenty-four (24) months and shall make such data available to Licensee upon reasonable request.
SECTION 4: DATA LOCALIZATION AND SOVEREIGNTY
4.1 Data Localization Requirement
All Licensee Data — including, without limitation, primary production data, database replicas, cache copies, backups, snapshots, archives, disaster recovery copies, and any other copies or derivatives of Licensee Data — shall be stored, processed, and maintained exclusively within data center facilities that are physically located in the continental United States of America. Licensor shall not, under any circumstances, transfer, store, process, copy, replicate, mirror, or permit access to Licensee Data from or in any location outside the United States without the prior written consent of Licensee.
This data localization requirement applies to all stages of data processing, including data ingestion, computation, intermediate storage, output generation, archival, backup, and disaster recovery, and to all environments, including production, staging, quality assurance, development, and disaster recovery environments.
4.2 Data Center Specifications
Licensor shall identify in writing, as Appendix A to this Rider (or by separate written notice delivered to Licensee on or prior to the effective date of this Rider), the specific data center facilities used to host the Cloud Services and to store or process Licensee Data. Such identification shall include, for each facility: (i) the facility name or identifier; (ii) the geographic location (city and state); (iii) the hosting provider or operator (if a third party); (iv) the facility's primary or disaster recovery designation; and (v) the compliance certifications held by the facility (e.g., SOC 2 Type II, ISO 27001, PCI DSS).
Licensor shall provide at least sixty (60) days' prior written notice to Licensee before migrating or relocating Licensee Data to a different data center facility, provided that any such new facility remains within the continental United States and satisfies all applicable requirements of this Rider. Licensee shall have the right to object to any proposed migration within thirty (30) days of receiving such notice, and Licensor shall not proceed with the migration over Licensee's reasonable objection.
All data center facilities used to host Cloud Services or to store, process, or transmit Licensee Data shall maintain, at a minimum, current SOC 2 Type II and ISO/IEC 27001 certifications (or certifications under equivalent frameworks). Licensor shall ensure that such facilities provide physical security measures consistent with industry best practices, including, without limitation, 24/7 physical security staffing, biometric and multi-factor physical access controls, video surveillance, visitor logging, environmental controls, and redundant power and cooling systems.
4.3 Restrictions on Offshore Access
No Licensor personnel, contractor, agent, or Subprocessor located outside the United States shall have remote or physical access to Licensee Data or to any systems, networks, databases, or infrastructure hosting or capable of accessing Licensee Data, unless Licensee provides its prior written consent in each instance.
If Licensee consents to offshore access for specific, limited support purposes (e.g., follow-the-sun technical support during a critical incident), Licensor shall ensure that such access is: (a) limited in scope and duration to the specific purpose for which consent was granted; (b) logged in detail, including the identity of the individual, the date, time, and duration of access, and the specific data or systems accessed; (c) conducted over encrypted connections meeting the requirements of Section 2.2(b); (d) subject to all access control requirements of Section 2.3; and (e) terminable by Licensee at any time upon written or electronic notice. Licensor shall provide Licensee with a summary of any offshore access sessions within five (5) business days of such access occurring.
SECTION 5: SECURITY INCIDENT NOTIFICATION AND RESPONSE
5.1 Notification Obligation
Licensor shall notify Licensee in writing of any Security Incident within seventy-two (72) hours of Licensor's discovery or reasonable determination that a Security Incident has occurred. For purposes of this Section 5.1, "Discovery" means the point in time at which Licensor has a reasonable basis to believe that a Security Incident has occurred, regardless of whether the full scope or impact of the incident has been determined. Licensor shall not delay notification in order to complete its investigation.
Initial notification shall be provided via email to the following individuals at Licensee (or their designated successors as notified to Licensor in writing from time to time):
•  Douglas Tran, General Counsel, Optiwave Semiconductor Corp.
•  Priya Venkatesh, VP of Engineering Operations, Optiwave Semiconductor Corp.
In addition, Licensor shall provide telephonic notice to Licensee's General Counsel within twenty-four (24) hours of discovery of any Security Incident that Licensor reasonably believes involves the actual unauthorized access to, or exfiltration of, Licensee Data.
The initial written notification shall include, to the extent known at the time of notification:
(a) The date and time of discovery of the Security Incident;
(b) A description of the nature and circumstances of the Security Incident, including the attack vector or method of compromise (if known);
(c) The categories and approximate volume of Licensee Data affected or potentially affected;
(d) The likely consequences of the Security Incident for Licensee, including potential impacts on the confidentiality, integrity, or availability of Licensee Data;
(e) A description of the measures taken or proposed to be taken by Licensor to address the Security Incident, contain its effects, and prevent further unauthorized access; and
(f) The identity, title, and contact information (including direct telephone number and email address) of Licensor's designated incident response lead.
If complete information is not available at the time of the initial notification, Licensor shall provide the information then available and supplement it in writing as additional information becomes known, on a continuing basis and without undue delay.
5.2 Investigation and Remediation
Licensor shall promptly initiate a thorough investigation of any Security Incident, utilizing qualified internal resources and, where appropriate, engaging independent third-party forensic investigators. Licensor shall take all reasonable and commercially appropriate steps to contain the Security Incident, mitigate its effects, prevent recurrence, and restore the confidentiality, integrity, and availability of Licensee Data as quickly as practicable. Licensor shall cooperate fully with Licensee's own investigation of the Security Incident, including by providing timely access to relevant personnel, systems, logs, and documentation as reasonably requested by Licensee.
Licensor shall provide Licensee with a comprehensive written root-cause analysis within thirty (30) calendar days following the date of the initial notification. The root-cause analysis shall include, at a minimum: (i) a detailed description of the Security Incident, including the timeline of events; (ii) the root cause(s) of the incident; (iii) the specific Licensee Data affected; (iv) the remediation actions taken to date; (v) a remediation plan addressing any remaining vulnerabilities or weaknesses, with specific milestones and a timeline for completion; and (vi) an assessment of measures to prevent similar incidents in the future.
5.3 Regulatory Reporting
Licensor shall reasonably cooperate with Licensee in fulfilling any regulatory notification, reporting, or disclosure obligations arising from or in connection with a Security Incident, including, without limitation, obligations under applicable federal and state data breach notification laws, industry-specific regulations, and any contractual notification obligations owed by Licensee to its customers, partners, or foundry counterparties (including Brindoval Foundry Services Ltd.). Such cooperation shall include providing information, documentation, and assistance necessary for Licensee to comply with applicable notification timelines and content requirements.
Licensor shall not issue any public statement, press release, blog post, social media communication, regulatory filing, or other external communication regarding a Security Incident that affects or may affect Licensee Data without Licensee's prior written consent, except to the minimum extent required by applicable law, regulation, or binding legal process. In any case where Licensor believes it is legally compelled to make such a disclosure, Licensor shall provide Licensee with as much advance notice as is legally permissible and shall cooperate with Licensee to limit the scope of the disclosure to the minimum required.
5.4 Preservation of Evidence
Licensor shall preserve and protect all logs, records, system images, memory dumps, network captures, forensic artifacts, and other evidence related to a Security Incident for a minimum of twenty-four (24) months following the date of discovery of the Security Incident, or for such longer period as may be required by applicable law, regulation, or litigation hold obligation. Licensor shall implement a litigation hold or equivalent evidence preservation protocol promptly upon discovery of any Security Incident and shall not destroy, overwrite, modify, or permit the destruction, overwriting, or modification of any potentially relevant evidence during the preservation period. Licensor shall make preserved evidence available to Licensee or its designated forensic investigators upon reasonable request.
SECTION 6: COMPLIANCE CERTIFICATIONS AND AUDIT RIGHTS
6.1 SOC 2 Type II Compliance
Licensor shall obtain and maintain a current SOC 2 Type II Report covering, at a minimum, the Trust Services Criteria for Security, Availability, Confidentiality, and Processing Integrity, issued by an independent certified public accounting firm of recognized national standing. Licensor represents that its most recent SOC 2 Type II Report is dated June 30, 2025, and covers the twelve (12)-month examination period ending on that date.
Licensor shall obtain a new SOC 2 Type II Report at least annually during the term of the Agreement, with each such report covering a twelve (12)-month examination period, and shall provide a copy of each SOC 2 Type II Report (including any bridge letters covering interim periods) to Licensee within thirty (30) days of issuance. Licensor shall promptly notify Licensee of any delays in the issuance of a scheduled SOC 2 Type II Report.
If any SOC 2 Type II Report identifies material control deficiencies, exceptions, qualifications, or deviations from the applicable Trust Services Criteria (including management responses or complementary user entity controls that may affect Licensee), Licensor shall: (i) promptly notify Licensee of such findings; (ii) develop and provide to Licensee a detailed written remediation plan, including specific corrective actions and a timeline for completion; and (iii) remediate all material deficiencies within ninety (90) days of the report date (or such shorter period as may be warranted by the severity of the deficiency). Licensor shall keep Licensee reasonably informed of remediation progress and shall confirm completion of remediation in writing.
6.2 Additional Certifications
Licensor shall obtain and maintain ISO/IEC 27001:2022 certification (or certification under an equivalent internationally recognized information security management framework) for the facilities, systems, and operational processes used to deliver the Cloud Services and to store, process, or transmit Licensee Data. Such certification shall be issued by an accredited certification body and shall be renewed in accordance with the applicable certification scheme requirements.
Upon Licensee's reasonable request, Licensor shall provide copies of: (i) current ISO/IEC 27001 certificates and statements of applicability; (ii) audit summaries or bridge letters covering periods between full certification audits; (iii) management responses to audit findings or non-conformities; and (iv) any other relevant compliance certifications or attestations maintained by Licensor with respect to the Cloud Services (e.g., CSA STAR, FedRAMP, or PCI DSS, to the extent applicable).
6.3 Licensee Audit Right (Data Security)
In addition to, and separate from, any software license compliance audit rights set forth in the Agreement, Licensee shall have the right, exercisable at Licensee's discretion, to conduct or commission (through a qualified, independent third-party information security assessor mutually acceptable to the parties, such acceptance not to be unreasonably withheld) an audit of Licensor's data security practices, controls, policies, procedures, and compliance with the requirements of this Rider, subject to the following conditions:
(a) Frequency. Licensee may conduct a maximum of one (1) such audit per calendar year under this Section 6.3; provided, however, that this limitation shall not apply following a Security Incident, in which case Licensee may conduct an additional audit related to the incident.
(b) Notice. Licensee shall provide Licensor with at least thirty (30) business days' prior written notice of its intent to conduct an audit, specifying the proposed scope, timing, and identity of any third-party assessor.
(c) Conduct. The audit shall be conducted during Licensor's normal business hours and in a manner that does not unreasonably interfere with Licensor's normal business operations or the availability of the Cloud Services. Licensee and its auditors shall comply with Licensor's reasonable security and facility access policies.
(d) Cooperation. Licensor shall provide reasonable cooperation, including access to relevant systems, facilities, documentation, records, and personnel, as reasonably necessary for Licensee (or its designated assessor) to evaluate Licensor's compliance with this Rider.
(e) Confidentiality. All audit findings, reports, observations, and related information obtained during the audit shall be treated as Confidential Information of Licensor under the Agreement and shall be subject to the confidentiality obligations set forth therein. Licensee shall ensure that any third-party assessor is bound by confidentiality obligations at least as protective as those in the Agreement.
(f) Remediation. If the audit reveals material non-compliance with any requirement of this Rider, Licensor shall remediate such non-compliance at its own expense within sixty (60) calendar days of receiving written notice of the audit findings (or such shorter period as may be warranted by the severity of the non-compliance). Additionally, Licensor shall bear the reasonable, documented cost of a follow-up verification audit to confirm that the identified non-compliance has been remediated, such follow-up audit to be conducted within ninety (90) days of the remediation deadline.
SECTION 7: PENETRATION TESTING AND VULNERABILITY ASSESSMENTS
7.1 Licensor's Testing Obligations
Licensor shall engage a qualified, independent third-party information security firm with recognized expertise in cloud infrastructure and application security testing to conduct comprehensive penetration testing of the Cloud Services infrastructure at least annually (once per calendar year). The selection of the third-party firm shall be at Licensor's discretion, provided that the firm holds relevant industry certifications (e.g., CREST, OSCP, or equivalent) and has no material conflicts of interest.
The scope of each annual penetration test shall include, at a minimum:
(a) External network penetration testing — Evaluating the security of internet-facing infrastructure, including perimeter devices, public-facing APIs, web servers, and DNS configurations;
(b) Web application testing — Evaluating the security of the Cloud Services web application and API interfaces against the OWASP Top 10 and other recognized web application vulnerability categories, including authentication and authorization flaws, injection vulnerabilities, cross-site scripting, and insecure deserialization;
(c) Internal network penetration testing — Evaluating the security of internal network segments, lateral movement potential, and privilege escalation paths within the Cloud Services environment; and
(d) Social engineering testing — Evaluating the susceptibility of Licensor personnel to phishing, pretexting, and other social engineering techniques that could compromise access to systems containing Licensee Data.
Licensor shall provide Licensee with an executive summary of the penetration test results within thirty (30) calendar days of the completion of each test. The executive summary shall describe all critical-severity and high-severity findings (classified in accordance with the Common Vulnerability Scoring System ("CVSS") or equivalent methodology), the potential impact of each finding, and Licensor's planned remediation actions. Licensor is not required to disclose the full detailed penetration test report to Licensee, but shall make additional information available upon Licensee's reasonable request to the extent necessary for Licensee to evaluate the security posture of the Cloud Services.
Licensor shall remediate all critical-severity findings (CVSS score 9.0 or above) within thirty (30) calendar days and all high-severity findings (CVSS score 7.0 to 8.9) within sixty (60) calendar days of identification. Licensor shall confirm remediation in writing and, upon Licensee's request, provide evidence of re-testing confirming that the vulnerabilities have been addressed.
7.2 Licensee-Initiated Testing
Licensee may, upon thirty (30) business days' prior written notice and at Licensee's sole expense, engage a mutually agreed qualified third-party information security firm to perform penetration testing of the Cloud Services infrastructure, not more than once per calendar year. The parties shall cooperate in good faith to agree on the identity of the third-party firm, the scope and methodology of testing, and the testing schedule. Licensor shall not unreasonably withhold, condition, or delay its agreement to a proposed testing firm or scope.
Licensor shall provide reasonable cooperation and access to facilitate the Licensee-initiated testing, including access to testing environments, coordination with Licensor's operations team, and provision of necessary credentials or configuration information. All testing shall be conducted in a manner designed to avoid disruption to the production Cloud Services environment and shall comply with a mutually agreed rules-of-engagement document.
The results of any Licensee-initiated penetration test shall be shared with Licensor promptly upon completion and shall be treated as the Confidential Information of both parties under the Agreement. If the testing identifies critical- or high-severity findings, Licensor shall remediate such findings in accordance with the timelines set forth in Section 7.1.
SECTION 8: SUBPROCESSORS
8.1 Use of Subprocessors
Licensor shall not engage any Subprocessor to process, store, host, transmit, or otherwise handle Licensee Data in connection with the Cloud Services without the prior written consent of Licensee, which consent may be withheld or conditioned in Licensee's reasonable discretion. Licensor shall provide Licensee with a current and complete list of all Subprocessors engaged as of the effective date of this Rider, in the format set forth in Appendix B, including for each Subprocessor: (i) entity name and principal office location; (ii) a description of the functions performed in connection with the Cloud Services; (iii) the data center location(s) at which such Subprocessor processes or stores Licensee Data; (iv) the date of initial engagement; and (v) the current approval status.
Licensor shall update the Subprocessor list and provide written notice to Licensee at least thirty (30) days prior to engaging any new Subprocessor or materially changing the scope of an existing Subprocessor's engagement with respect to Licensee Data. Such notice shall include the information described above and a description of the security measures the proposed Subprocessor will implement to protect Licensee Data.
8.2 Subprocessor Obligations
Licensor shall enter into a written agreement with each Subprocessor that imposes data security, confidentiality, and data protection obligations that are at least as protective of Licensee Data as those set forth in this Rider. Such agreements shall include, without limitation, obligations relating to encryption, access controls, data segregation, Security Incident notification, data localization (consistent with Section 4), data return and deletion, and compliance with applicable laws.
Licensor shall remain fully responsible and liable to Licensee for any acts, omissions, errors, or failures of its Subprocessors relating to Licensee Data, to the same extent as if such acts, omissions, errors, or failures were those of Licensor itself. The engagement of a Subprocessor shall not relieve Licensor of any obligation under this Rider or the Agreement.
8.3 Licensee Objection Right
If Licensee reasonably objects in writing to a proposed new Subprocessor on data security or data sovereignty grounds within the thirty (30)-day notice period described in Section 8.1, Licensor shall not engage such Subprocessor with respect to Licensee Data. In such event, Licensor shall, at Licensee's election: (a) propose and use an alternative Subprocessor that is acceptable to Licensee, subject to Licensee's consent pursuant to Section 8.1; or (b) perform the relevant processing, storage, or hosting functions without engaging the proposed Subprocessor, using Licensor's own resources or existing approved Subprocessors. Licensor shall use commercially reasonable efforts to implement Licensee's election without material disruption to the Cloud Services or material delay in service delivery.
SECTION 9: DATA OWNERSHIP, RETURN, AND DELETION
9.1 Ownership.  As between the parties, all Licensee Data is and shall remain the sole and exclusive property of Licensee. Nothing in this Rider or the Agreement shall be construed as granting Licensor any right, title, or interest in or to Licensee Data, other than the limited, non-exclusive, non-transferable right to access, use, copy, and process Licensee Data solely to the extent necessary to provide the Cloud Services to Licensee in accordance with the Agreement and this Rider. Licensor shall not use Licensee Data for any purpose other than providing the Cloud Services to Licensee, and shall not, without limitation, use Licensee Data for benchmarking, product development, machine learning model training, analytics, marketing, or any other purpose, without Licensee's prior express written consent.
9.2 Data Return
Upon expiration or termination of the Agreement (or of the Cloud Services portion thereof), or upon Licensee's written request at any time during the term, Licensor shall, at Licensee's election, return to Licensee all Licensee Data in a standard, industry-recognized, machine-readable format (e.g., original file formats as uploaded by Licensee, or in a mutually agreed alternative format) within thirty (30) calendar days of receiving such request or the effective date of expiration or termination, whichever is applicable. Licensor shall provide Licensee Data via a secure transfer method (e.g., encrypted transfer via SFTP, secure cloud storage download, or encrypted physical media, as mutually agreed). Licensor shall not charge Licensee any fee for data return, except that if Licensee requests return via physical media, Licensee shall bear the reasonable cost of such media and shipping.
Licensor shall cooperate in good faith with Licensee to ensure an orderly transition of Licensee Data, including by providing reasonable technical support and assistance during the data return process, for a period of up to sixty (60) days following expiration or termination (the "Transition Period"). During the Transition Period, Licensor shall continue to maintain the security of Licensee Data in accordance with Section 2.
9.3 Data Deletion
Following the confirmed return of all Licensee Data to Licensee (as evidenced by Licensee's written acknowledgment of receipt), or upon Licensee's written instruction to delete Licensee Data without return, Licensor shall securely delete and destroy all copies of Licensee Data from its systems, including all production systems, backup systems, archives, disaster recovery systems, and any other storage media, within sixty (60) calendar days. Deletion shall be performed using methods consistent with NIST Special Publication 800-88, Revision 1 (Guidelines for Media Sanitization), or an equivalent standard, sufficient to render Licensee Data unrecoverable.
Within five (5) business days following the completion of deletion, Licensor shall provide Licensee with a written certification, signed by an authorized officer or director of Licensor, confirming that all Licensee Data has been securely deleted and destroyed in accordance with this Section 9.3, specifying the date(s) of deletion and the methods used.
9.4 Post-Termination Retention
Notwithstanding Section 9.3, Licensor may retain copies of Licensee Data solely to the extent, and for the minimum period, required by applicable law, regulation, or binding legal process (including litigation hold obligations). Any Licensee Data retained pursuant to this Section 9.4 shall continue to be subject to all confidentiality and security obligations of this Rider and the Agreement for the duration of such retention. Licensor shall notify Licensee in writing of any post-termination retention of Licensee Data, identifying the legal basis for retention, the categories of data retained, and the anticipated retention period. Upon expiration of the applicable legal retention requirement, Licensor shall promptly delete such data in accordance with Section 9.3.
SECTION 10: BUSINESS CONTINUITY AND DISASTER RECOVERY
10.1 BC/DR Plan
Licensor shall develop, implement, and maintain a comprehensive business continuity and disaster recovery ("BC/DR") plan for the Cloud Services that is designed to ensure the continued availability, integrity, and security of the Cloud Services and Licensee Data in the event of a natural disaster, infrastructure failure, cyberattack, pandemic, or other disruptive event. The BC/DR plan shall be designed to achieve, at a minimum, the following recovery objectives:
•  Recovery Time Objective (RTO): Restoration of Cloud Services availability within four (4) hours of a declared disaster or material service disruption.
•  Recovery Point Objective (RPO): Recovery of Licensee Data to a state no more than one (1) hour prior to the disaster or service disruption event, ensuring that no more than one (1) hour of Licensee Data is lost.
Licensor shall test its BC/DR plan at least annually through tabletop exercises, functional tests, or full-scale recovery simulations, and shall document the results of each test, including any deficiencies identified and corrective actions taken. Licensor shall maintain written records of all BC/DR plan tests for a minimum of three (3) years.
10.2 Geographic Redundancy
Licensor shall maintain geographically redundant data center facilities within the continental United States for disaster recovery purposes, ensuring that Licensee Data is replicated to a secondary data center located in a different geographic region from the primary data center. All disaster recovery data centers and replicated data shall comply with the data localization requirements set forth in Section 4 and shall satisfy the same security and compliance standards applicable to the primary data center under this Rider.
10.3 Plan Disclosure
Upon Licensee's reasonable request, not more than once per calendar year, Licensor shall provide Licensee with a written summary of its BC/DR plan applicable to the Cloud Services, including: (i) the current RTO and RPO commitments; (ii) the locations of primary and disaster recovery data centers; (iii) a description of the replication methodology and frequency; (iv) the date and results of the most recent BC/DR plan test; and (v) a description of any material changes to the BC/DR plan since the last disclosure. Such summary shall be treated as the Confidential Information of Licensor under the Agreement.
SECTION 11: INSURANCE
11.1 Minimum Coverage
Licensor shall obtain and maintain, at its own expense, during the entire term of the Agreement and for a period of two (2) years following expiration or termination thereof, the following minimum insurance coverages with carriers rated "A-" or better by A.M. Best Company (or equivalent rating):
(a) Commercial General Liability Insurance: With limits of not less than Five Million Dollars ($5,000,000) per occurrence and Ten Million Dollars ($10,000,000) in the aggregate, covering bodily injury, property damage, personal injury, and advertising injury arising out of Licensor's operations.
(b) Technology Errors and Omissions / Cyber Liability Insurance: With limits of not less than Ten Million Dollars ($10,000,000) per claim and Ten Million Dollars ($10,000,000) in the aggregate, covering claims arising from: (i) data breaches and unauthorized access to, or disclosure of, confidential information (including Licensee Data); (ii) network security failures, including failures of firewalls, intrusion detection systems, and other security infrastructure; (iii) privacy-related claims, including regulatory fines and penalties (to the extent insurable); (iv) technology errors and omissions in the provision of the Cloud Services; and (v) costs of breach notification, credit monitoring, forensic investigation, and crisis management.
Licensor shall provide Licensee with certificates of insurance evidencing the required coverages upon execution of this Rider and thereafter upon Licensee's request, but not more than once per calendar year. Such certificates shall identify Licensee as an additional insured with respect to the commercial general liability policy, to the extent of Licensor's indemnification obligations under the Agreement. Licensor shall provide Licensee with at least thirty (30) days' prior written notice of any material reduction in coverage, cancellation, or non-renewal of any required policy.
SECTION 12: REPRESENTATIONS AND WARRANTIES
12.1 Licensor Representations
Licensor represents and warrants to Licensee, as of the effective date of this Rider and on a continuing basis during the term of the Agreement, that:
(a) Licensor has the technical capability, infrastructure, qualified personnel, and financial resources necessary to comply with the security, service level, business continuity, and other requirements set forth in this Rider;
(b) The Cloud Services will be provided in material compliance with all applicable federal, state, and local laws, rules, and regulations, including without limitation data protection and privacy laws, export control laws, and any industry-specific regulations applicable to the processing of semiconductor design data;
(c) As of the effective date of this Rider, Licensor is not aware of any material security vulnerabilities in the Cloud Services, the Cloud Services infrastructure, or the systems used to store or process Licensee Data that have not been disclosed to Licensee in writing;
(d) Licensor's most recent SOC 2 Type II Report, dated June 30, 2025, did not contain material qualifications, exceptions, or control deficiencies that remain unremediated as of the effective date of this Rider; and
(e) Licensor has not experienced any Security Incident affecting the Cloud Services or the data of any customer within the twelve (12) months preceding the effective date of this Rider that has not been disclosed to Licensee in writing.
12.2 Ongoing Compliance
Licensor shall promptly notify Licensee in writing if, at any time during the term of the Agreement, Licensor becomes aware that it is unable to comply, or is in material non-compliance, with any requirement, obligation, or commitment set forth in this Rider. Such notice shall include a description of the non-compliance, the Licensee Data or Cloud Services affected, the steps being taken to remediate the non-compliance, and the expected timeline for remediation. Failure to provide such notice shall not limit or excuse Licensor's liability for the underlying non-compliance.
SECTION 13: RELATIONSHIP TO AGREEMENT
13.1 Incorporation.  This Rider is incorporated into and forms an integral part of the Amended and Restated Enterprise License Agreement (Agreement No. MDS-ELA-2026-01192) between Optiwave Semiconductor Corp. and Meridian Design Systems, Inc., dated as of February 1, 2026. All references in this Rider to the "Agreement" mean the Amended and Restated Enterprise License Agreement, as may be amended, supplemented, or restated from time to time in accordance with its terms. All provisions of the Agreement that are not specifically modified or superseded by this Rider, including without limitation the indemnification, limitation of liability, intellectual property, and general provisions of the Agreement, shall remain in full force and effect and shall apply to the Cloud Services and to this Rider.
13.2 Conflict.  In the event of any conflict, inconsistency, or ambiguity between the terms of this Rider and the terms of the Agreement (including any other exhibit, schedule, or addendum thereto) with respect to data security, cloud services, service levels, data localization, audit rights, or any other subject matter addressed in this Rider, the terms of this Rider shall prevail and control to the extent of such conflict, inconsistency, or ambiguity.
13.3 Survival.  The following Sections of this Rider shall survive the expiration or termination of the Agreement (for any reason) for a period of three (3) years following the effective date of such expiration or termination, or until all Licensee Data has been returned to Licensee or securely deleted in accordance with Section 9, whichever is later:
•  Section 2 (Data Security Requirements)
•  Section 5 (Security Incident Notification and Response)
•  Section 6 (Compliance Certifications and Audit Rights)
•  Section 9 (Data Ownership, Return, and Deletion)
•  Section 12 (Representations and Warranties)
All other provisions of this Rider that by their nature are intended to survive expiration or termination (including, without limitation, Licensor's indemnification obligations and the confidentiality obligations applicable to Licensee Data) shall also survive in accordance with their terms.
SECTION 14: GOVERNING LAW AND DISPUTE RESOLUTION
14.1 Governing Law
This Rider shall be governed by, and construed and enforced in accordance with, the laws of the State of California, without regard to its principles of conflicts of laws that would require the application of the laws of any other jurisdiction. This governing law provision is consistent with,