PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT This memorandum is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of the addressees and should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP.
CALDERWOOD & HARKNESS LLP Attorneys at Law 555 Mission Street, Suite 3100 San Francisco, California 94105 Telephone: (415) 782-6000
MEMORANDUM
TO: Christine Aldridge, Partner, Deal Lead, Pinnacle Venture Fund II LP Tomas Medina, Vice President, Due Diligence, Pinnacle Venture Fund II LP Leila Nazari, Lead Associate, Calderwood & Harkness LLP
FROM: Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP
DATE: May 12, 2026
RE: Privacy & Data Security Due Diligence Assessment — Quillen Technologies, Inc. (Series A Preferred Stock Financing)
MATTER NO.: 1002-00002
BILLING CODE: 78412.001
I. Executive Summary
This memorandum sets forth the findings and recommendations of Calderwood & Harkness LLP's Privacy & Data Security practice group with respect to the privacy and data security posture of Quillen Technologies, Inc. ("Quillen" or the "Company"), a Delaware C-corporation headquartered at 88 Garrison Street, Floor 4, Boston, Massachusetts 02116, in connection with Pinnacle Venture Fund II LP's ("Pinnacle" or the "Fund") proposed $14,000,000 lead investment in a $22,500,000 Series A Preferred Stock financing of the Company.
This assessment has been prepared at the request of the Pinnacle deal team and is intended to inform the negotiation and structuring of the Series A Stock Purchase Agreement ("SPA"), the Investors' Rights Agreement, and any related ancillary documents. This memorandum should be read in conjunction with the Regulatory & Compliance Analysis Memorandum dated May 9, 2026, the intellectual Property Due Diligence Memorandum (forthcoming), and the Material Contracts Review Memorandum (forthcoming), each of which addresses adjacent areas of the Company's legal and regulatory profile.
Overall Assessment. Based on our review of the data room materials and supplemental inquiries, we have concluded that Quillen's privacy and data security practices are reasonably mature for a company at this stage of development. We have not identified any critical blockers to closing from a privacy or data security perspective. However, we have identified several areas requiring attention, which should be addressed through appropriate SPA representations, warranties, disclosure schedule items, and post-closing covenants, as described in detail in Section XI of this memorandum.
Key Findings. Our principal findings are summarized as follows:
(a) Nature of Data Processed. The data processed by Quillen's Mosaic platform is predominantly institutional portfolio-level data rather than individual consumer personally identifiable information ("PII") in most use cases. This significantly narrows the applicable privacy regulatory landscape but does not eliminate it entirely, particularly with respect to employee data, institutional client contact information, and certain edge cases involving pension fund and endowment beneficiary data.
(b) CCPA Applicability. The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), does not currently apply to Quillen based on the Company's revenue, data processing volumes, and business model. However, rapid revenue growth following the Series A financing could bring Quillen within the scope of CCPA within twelve to twenty-four months, and the Company should proactively prepare for compliance.
(c) SOC 2 Compliance. Quillen completed a SOC 2 Type I audit in January 2026, performed by Pemberton & Associates CPAs LLP, with no material exceptions noted in the design of controls. A SOC 2 Type II audit is currently in process and expected to be completed in Q3 2026, which will address the operating effectiveness of the Company's controls over a sustained review period.
(d) No Data Breaches. Quillen has represented that no data breaches, security incidents, or unauthorized access events have occurred since the Company's incorporation on July 12, 2023. No breach notifications have been filed with any regulatory authority, and no litigation, claims, or regulatory inquiries related to privacy or data security have been initiated or threatened.
(e) Policy and Contractual Gaps. We have identified certain gaps in the Company's privacy policy, customer-facing data processing agreements, and internal security governance that warrant remediation. These include the absence of AI/ML-specific data use disclosures in the privacy policy, the lack of a designated Chief Information Security Officer ("CISO") or Data Protection Officer ("DPO"), variations in notification and deletion timeframes across executed customer DPAs, and an informal vendor risk management process. None of these gaps rise to the level of a material impediment to closing, but each should be addressed through post-closing obligations.
Documents Reviewed. This memorandum is based on our review of data room materials provided by Company counsel Fenwick, Torres & Keane LLP (Gregory Navarro, Partner, and Sophie Marchetti, Senior Associate) during the due diligence period from April 18 through May 23, 2026. The complete list of documents reviewed is set forth in Appendix A to this memorandum. We also reviewed the Company's published privacy policy at quillentech.io, sample customer data processing agreements, internal information security policies, the SOC 2 Type I report, employee handbook excerpts, and vendor agreements. Where we have relied on representations made by Company management or counsel rather than independent verification, we have noted as much in the relevant sections below.
II. Company Background and Data Environment
A. Business Description and the Mosaic Platform
Quillen Technologies, Inc. develops and commercializes "Mosaic," an AI-driven portfolio analytics and risk-attribution platform designed for institutional investors. The Mosaic platform is offered on a Software-as-a-Service ("SaaS") subscription basis to institutional asset managers, pension consultants, endowments, and similar institutional market participants. The platform ingests portfolio holdings, asset allocation data, performance metrics, risk exposures, and attribution data from the client's systems and applies proprietary machine learning algorithms to deliver analytics, risk decomposition, and performance attribution insights through a web-based dashboard interface.
It is important to note that Quillen is not a registered investment adviser under the Investment Advisers Act of 1940, and the Mosaic platform is designed and marketed as a software tool providing analytics and data visualization rather than investment advice. The distinction between a technology tool and an advisory service, and the associated regulatory implications, are addressed in the separate Regulatory & Compliance Analysis Memorandum dated May 9, 2026, prepared by Calderwood & Harkness's Financial Regulation practice group.
As of the date of this memorandum, the Company employs thirty-eight (38) full-time employees, distributed across functional areas as follows: twenty-four (24) in engineering, six (6) in sales and marketing, five (5) in general and administrative functions, and three (3) in executive leadership. The executive leadership team consists of Dr. Amara Osei (Chief Executive Officer and Co-Founder), Julian Voss (Chief Technology Officer and Co-Founder), and Priya Chandrasekar (Vice President of Product). The Company reported Q1 2026 annual recurring revenue ("ARR") of approximately $3.8 million and last-twelve-months ("LTM") revenue of approximately $3.2 million.
Quillen was incorporated in the State of Delaware on July 12, 2023. Its Employer Identification Number is 93-4817265, and its Delaware File Number is 7384219. The Company maintains its principal office in Boston, Massachusetts, at the address set forth above.
B. Nature of Data Processed
An understanding of the types and categories of data processed by Quillen is essential to evaluating the Company's privacy and data security obligations. Based on our review of the data room materials, discussions with Company counsel, and our examination of the Mosaic platform's data flow architecture, we have identified the following principal categories of data processed by the Company:
Portfolio-Level Data. The primary category of data ingested and processed by the Mosaic platform consists of institutional portfolio holdings, asset allocations, performance metrics, risk exposures, and attribution data provided by Quillen's institutional clients. This data relates to the investment portfolios managed by the client organizations and typically includes information such as security identifiers, position sizes, sector and geographic allocations, benchmark comparisons, and risk factor exposures. This data is proprietary to the client and commercially sensitive but does not, in most cases, constitute "personal information" or "personally identifiable information" as those terms are defined under applicable privacy laws.
Institutional Client Contact Data. Quillen collects and processes contact information, account credentials, and billing data for the individual investment professionals, chief investment officers, and portfolio managers who access the Mosaic platform on behalf of their institutional employer. This data includes names, business email addresses, business phone numbers, and login credentials. This information constitutes "personal information" under most applicable privacy frameworks and is subject to appropriate protection obligations.
Limited Individual PII. In certain use cases, particularly in the context of pension fund analytics and endowment reporting, the underlying data sets provided by clients may include aggregated beneficiary information. However, Quillen has represented to us through Company counsel that the Mosaic platform does not receive or process individual Social Security numbers, dates of birth, or other directly identifying personally identifiable information of fund beneficiaries. We have not independently verified this representation, and we recommend that the SPA include an express representation and warranty to this effect.
Employee Data. Quillen processes standard human resources data for its thirty-eight full-time employees, including payroll information, benefits enrollment data, contact information, tax identification numbers, and other employment-related records. This data is maintained by the Company's human resources and finance functions and is subject to applicable employment privacy protections.
Website Visitor Data. The Company collects standard cookies, analytics data, and marketing data from visitors to its corporate website at quillentech.io. This includes IP addresses, browser information, page visit data, and similar web analytics information collected through cookies and analytics tools.
Key Observation. The Company's data environment is predominantly business-to-business institutional data rather than high-volume consumer personally identifiable information. This characteristic of the data environment significantly narrows the applicable privacy regulatory landscape. Most state comprehensive privacy laws, including CCPA/CPRA, are designed to protect individual consumers and impose obligations that are triggered by thresholds related to consumer data processing volumes. Because Quillen's core data processing activities involve institutional portfolio data and a relatively small number of institutional client contacts, the Company currently falls below the applicability thresholds of most of these regimes. However, as discussed in Section III below, this does not eliminate all privacy and data security obligations, and the Company should prepare for expanded compliance requirements as it grows.
C. Data Flow Architecture
Our review of the Company's data flow architecture, as described in the SOC 2 Type I report and supplemented by technical documentation provided in the data room, reveals the following structure:
Data is ingested from client systems through two primary channels: (i) application programming interface ("API") integrations with client portfolio management systems and (ii) secure file uploads via the Mosaic platform's web interface. Both ingestion methods employ encryption in transit using Transport Layer Security ("TLS") version 1.2 or higher.
Ingested data is stored in the Company's cloud infrastructure. The specific hosting provider and the terms of the hosting arrangement are addressed in the Material Contracts Review Memorandum. For purposes of this memorandum, we note that the cloud infrastructure provider maintains its own SOC 2 Type II compliance, which provides an additional layer of assurance with respect to the physical and logical security of the underlying hosting environment.
Analytics processing occurs server-side within the cloud environment. The Mosaic platform's machine learning models process client data within the Company's cloud infrastructure and deliver results to clients via the Mosaic web application dashboard. Client users access their analytics results through authenticated sessions with multi-factor authentication ("MFA") enforced.
Data is retained in accordance with the retention periods specified in each client's data processing agreement. Where a DPA does not specify a retention period, the Company's default retention policy applies. Upon contract termination or expiration, client data is subject to deletion or return in accordance with the applicable DPA terms.
The Company employs a multi-tenant architecture with logical data segregation by client tenant. Each client's data is isolated within the platform's database layer through tenant-level access controls. The SOC 2 Type I report reviewed the design of these segregation controls and found them to be suitably designed.
III. Applicable Privacy Laws and Regulatory Framework
A. California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), imposes a broad range of obligations on covered businesses with respect to the collection, use, disclosure, and sale of personal information of California consumers. The CCPA/CPRA applies to for-profit entities that do business in California and meet one or more of the following thresholds:
(1) Annual gross revenue exceeding $25,000,000 in the preceding calendar year;
(2) Alone or in combination, annually buying, selling, or sharing the personal information of 100,000 or more California consumers, households, or devices; or
(3) Deriving 50% or more of annual revenue from selling or sharing consumers' personal information.
Revenue Threshold. Quillen's LTM revenue is approximately $3.2 million, and its Q1 2026 ARR is approximately $3.8 million. Even assuming accelerated growth following the Series A financing, the Company's annualized revenue remains well below the $25 million gross revenue threshold. This threshold is not currently met.
Data Volume Threshold. Quillen's data processing activities involve a relatively limited number of California consumers. The personal information processed that could relate to "California consumers" within the meaning of the CCPA/CPRA is limited to (i) California-based individual contacts at institutional client organizations who use the Mosaic platform, and (ii) any Quillen employees who are California residents. Given the Company's current client base and workforce of thirty-eight employees, the number of California consumers whose personal information is processed by Quillen is unlikely to approach the 100,000 threshold by a significant margin. This threshold is not currently met.
Revenue from Data Sales. Quillen does not sell or share personal information as a primary or material business activity. The Company's revenue is derived from SaaS subscription fees paid by institutional clients. This threshold is not currently met.
Conclusion. Based on the foregoing analysis, Quillen does not currently meet any of the CCPA/CPRA applicability thresholds and is not subject to the CCPA/CPRA at this time. However, the Series A financing is intended to accelerate the Company's growth trajectory, and if Quillen's revenue scales rapidly toward the $25 million threshold — which is plausible within a twelve to twenty-four month timeframe depending on the Company's commercial success — CCPA/CPRA compliance will become required.
Recommendation. Quillen should proactively build CCPA-compliant processes, including the infrastructure for responding to consumer access and deletion requests, updating its privacy policy to include California-specific disclosures, and designating a privacy contact, in anticipation of growth that may trigger CCPA applicability. We recommend that the SPA include a representation that the Company is not currently subject to the CCPA/CPRA but that the Company will implement compliance measures upon triggering any applicable threshold, and that this obligation be memorialized as a post-closing covenant.
B. Other State Privacy Laws
A growing number of states have enacted comprehensive privacy statutes that impose obligations on entities processing the personal data of their residents. As of the date of this memorandum, enacted and effective state comprehensive privacy laws include, among others, the Virginia Consumer Data Protection Act ("CDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), and privacy statutes in several additional states that have adopted similar frameworks.
Most state comprehensive privacy laws apply to entities that process the personal data of a specified number of state residents, typically 100,000 or more consumers, or 25,000 or more consumers where the entity derives a specified percentage of revenue from data sales. The applicability analysis for these statutes largely mirrors our analysis of the CCPA/CPRA: Quillen's current data processing volumes and revenue are below the triggering thresholds of most state comprehensive privacy laws.
However, the analysis differs with respect to Massachusetts, where Quillen is headquartered and maintains its principal office. Massachusetts has adopted data security regulations at 201 CMR 17.00, which apply to persons who own or license personal information of Massachusetts residents. Unlike the comprehensive privacy statutes described above, the Massachusetts data security regulations do not include revenue or data volume thresholds — they apply to any person who owns or licenses personal information about a Massachusetts resident. "Personal information" under the Massachusetts regulations includes a combination of an individual's name with certain identifying information such as a Social Security number, driver's license number, or financial account number.
Quillen processes employee data for its workforce, which includes employees based in Massachusetts. In addition, institutional client contacts based in Massachusetts may have personal information processed by Quillen in connection with account administration. Accordingly, Quillen is subject to the Massachusetts data security regulations and is required to maintain a comprehensive Written Information Security Program ("WISP") that is compliant with 201 CMR 17.00. As discussed in Section VIII.A below, Quillen does maintain a WISP, and we have reviewed it for consistency with the 201 CMR 17.00 requirements.
Conclusion. Massachusetts 201 CMR 17.00 is the most immediately applicable state privacy and data security regulation to Quillen's current operations. The Company should ensure that its WISP remains compliant with these requirements on an ongoing basis. With respect to other state comprehensive privacy laws, the Company's current data processing volumes and revenue are below the triggering thresholds, but the Company should monitor its growth trajectory and prepare for compliance as necessary.
C. Federal Privacy and Data Security Laws
Gramm-Leach-Bliley Act (GLBA). Quillen is a technology vendor and not a "financial institution" as defined under the Gramm-Leach-Bliley Act. Accordingly, GLBA does not directly impose obligations on Quillen as a covered entity. However, many of Quillen's institutional clients — including asset managers, pension consultants, and other financial services firms — are themselves subject to GLBA and its implementing regulations, including the FTC Safeguards Rule and the SEC's Regulation S-P. To the extent that Quillen receives, processes, or stores "nonpublic personal information" (as defined under GLBA) from its financial institution clients, Quillen may be considered a "service provider" under the GLBA Safeguards Rule framework. Financial institution clients may impose contractual obligations on Quillen consistent with their own GLBA compliance programs, and Quillen's customer DPAs should address these obligations. Our review of the Company's DPAs is addressed in Section V below.
HIPAA. We have not identified any Health Insurance Portability and Accountability Act ("HIPAA") applicability. Quillen does not process protected health information, and none of its current clients or use cases involve health data. HIPAA is not applicable.
FTC Act Section 5. The Federal Trade Commission Act, Section 5, prohibits unfair or deceptive acts or practices in or affecting commerce. This general prohibition applies to all commercial entities, including Quillen. The practical import of Section 5 for Quillen is that the Company's privacy representations — whether made in its published privacy policy at quillentech.io, in marketing materials, or in customer agreements — must be accurate and must be honored. A material discrepancy between the Company's privacy representations and its actual practices could expose the Company to an FTC enforcement action. This is a general observation applicable to all companies and does not reflect any specific finding with respect to Quillen.
D. Contractual Privacy and Data Security Obligations
In addition to statutory and regulatory obligations, Quillen is subject to contractual privacy and data security obligations imposed by its institutional clients. Institutional asset managers and other sophisticated financial services clients routinely impose data protection requirements through their vendor management programs, which are memorialized in data processing agreements ("DPAs") and master subscription agreements.
We reviewed Quillen's template DPA and three executed DPAs with institutional clients (client names redacted in the data room). The key contractual obligations identified in these agreements include data encryption at rest and in transit, implementation and maintenance of access controls, security incident notification within specified timeframes (ranging from twenty-four to seventy-two hours, depending on the agreement), data deletion upon contract termination within specified periods, restrictions on the use of subprocessors, and annual third-party security audits. Several client DPAs specifically reference SOC 2 compliance as a required deliverable, which is addressed by Quillen's ongoing SOC 2 audit program. A more detailed discussion of the customer DPA provisions is set forth in Section V below.
IV. Review of Quillen's Privacy Policy
Quillen maintains a publicly accessible privacy policy published at quillentech.io. The policy describes the categories of information collected by the Company, the purposes for which such information is processed, the Company's data sharing practices, and the rights available to individuals with respect to their personal information. We reviewed the policy in detail and set forth our observations and recommendations below.
The privacy policy covers the following principal topics: categories of information collected (account registration information, usage data, cookies and similar tracking technologies, and information provided through customer support interactions); purposes of data processing (providing the Mosaic platform services, improving product functionality, communicating with users, and complying with legal obligations); data sharing practices (limited sharing with service providers, as required by law, and in connection with business transactions); data retention practices (general statement of retention consistent with business purposes and legal requirements); and user rights (general statement of rights applicable under various privacy laws).
Observations:
(a) The privacy policy is reasonably comprehensive for a B2B SaaS company at this stage of development. It covers the principal categories of information collected and the purposes of processing in a manner that is consistent with industry norms for enterprise software companies.
(b) The privacy policy should be updated to include more specific language regarding data retention periods. The current policy contains a general statement that data is retained "as long as necessary to fulfill the purposes described in this policy," but does not specify particular retention timeframes for different categories of data. Given that the Company's customer DPAs contain specific retention and deletion obligations, the privacy policy would benefit from more granular retention disclosures.
(c) The privacy policy includes references to California privacy rights that are forward-looking and appear to be placeholder language. This is appropriate given the Company's current non-applicability under the CCPA/CPRA, but these sections should be expanded with substantive California-specific disclosures when the Company triggers CCPA applicability thresholds.
(d) We reviewed the cookie consent mechanism implemented on quillentech.io. The current implementation provides a cookie banner with an "Accept" option and a link to the cookie settings. This is adequate for current domestic operations, but if the Company contemplates international expansion (particularly into the European Union or United Kingdom), the cookie consent mechanism will need to be enhanced to comply with the ePrivacy Directive and UK PECR requirements, including the implementation of a granular opt-in consent mechanism prior to the deployment of non-essential cookies.
(e) Notably, the privacy policy does not address AI/ML-specific data use disclosures. Given that the Mosaic platform is described and marketed as "AI-driven," and given the increasing regulatory and public attention to the use of artificial intelligence in data processing, we recommend that the Company update its privacy policy to include clear disclosures about how client data may or may not be used for machine learning model training, whether aggregated or anonymized data is used for product improvement purposes, and what safeguards are in place to prevent the use of customer data in unintended ways. This is particularly important given the emerging regulatory landscape around AI transparency and the expectations of sophisticated institutional clients.
Recommendation. We recommend that the SPA include a representation that the Company's published privacy policy is accurate, complete in all material respects, and has been complied with in all material respects since its publication. Post-closing, we recommend that Quillen update its privacy policy to address AI/ML data use practices and to incorporate anticipatory CCPA compliance language. This update should be completed within ninety (90) days of closing.
V. Review of Customer-Facing Data Processing Agreements (DPAs)
We reviewed Quillen's template customer data processing agreement and three executed DPAs with institutional clients (client names redacted in the data room). The DPA is executed as an addendum to the Company's master subscription agreement and governs the data processing relationship between Quillen and its institutional clients with respect to the client data processed through the Mosaic platform.
The template DPA establishes Quillen as a "data processor" (or "service provider," depending on the applicable legal framework) acting on the documented instructions of the client (as "data controller" or "business"). This characterization is appropriate given the nature of the Mosaic platform's data processing activities, in which Quillen processes client data at the direction of and for the benefit of the client organization.
We reviewed the following key provisions across the template DPA and the three executed DPAs:
Scope of Processing. The DPA appropriately limits the scope of data processing to the provision of the Mosaic platform services as described in the master subscription agreement. The template DPA does not authorize Quillen to process client data for any purpose beyond the delivery of contracted services, which is consistent with the Company's representation that client data is not used for cross-client model training or other secondary purposes without explicit consent.
Subprocessors. The DPA permits Quillen to engage subprocessors in connection with the delivery of the Mosaic platform services, subject to prior written notice to the client. Quillen maintains a list of approved subprocessors, which is made available to clients. Clients have the right to object to the appointment of new subprocessors within a specified timeframe. This is a market-standard provision for enterprise SaaS agreements.
Data Security Obligations. The DPA requires Quillen to implement and maintain appropriate technical and organizational measures to protect client data. Specific measures referenced in the DPA include encryption standards (at rest and in transit), access controls, employee security training, and regular penetration testing. These obligations are consistent with the Company's actual security practices as reviewed in Section VIII below.
Incident Notification. The template DPA provides for notification to the client of a security incident within seventy-two (72) hours of discovery. However, we note variation across the three executed DPAs: one executed DPA requires notification within twenty-four (24) hours of discovery, which imposes a significantly shorter response window. This variation creates operational complexity for the Company, as it must track and comply with different notification timeframes for different clients.
Data Deletion and Return. Upon termination or expiration of the master subscription agreement, the template DPA provides that Quillen will delete client data within thirty (30) days. One of the three executed DPAs requires deletion within fifteen (15) days, again reflecting variation in negotiated terms. The Company must ensure that its data deletion processes can accommodate the shortest applicable timeframe across its client base.
Audit Rights. The DPA provides clients with the right to audit Quillen's security practices and compliance with the DPA. The template DPA permits this audit right to be satisfied by delivery of the Company's most recent SOC 2 report, with additional on-site audit rights available under specified circumstances (e.g., following a security incident). This approach is market-standard and reduces the operational burden on the Company while providing clients with meaningful assurance.
Limitation of Liability. The DPA's liability provisions are cross-referenced to the limitation of liability provisions in the master subscription agreement. The template DPA does not include a separate liability cap for data protection obligations, which means that data-related liabilities are subject to the general contractual liability cap. We note that some institutional clients may seek to negotiate uncapped or enhanced liability for data protection obligations, and the Company should be prepared for such negotiations as it scales.
Observations:
(a) The DPAs reviewed are generally market-standard for enterprise SaaS agreements with institutional financial services clients. The template DPA reflects a well-structured data processing framework that appropriately allocates responsibilities between Quillen as processor and the client as controller.
(b) The variation across executed DPAs on notification timeframes (twenty-four hours versus seventy-two hours) and deletion periods (fifteen days versus thirty days) creates operational complexity. As the Company scales its client base, tracking and complying with different timeframes across potentially dozens of client agreements will become increasingly challenging. We recommend that the Company standardize these terms where possible in future negotiations and implement internal tracking mechanisms to ensure compliance with the most restrictive applicable timeframes.
(c) The DPAs do not include GDPR-specific provisions such as standard contractual clauses for cross-border data transfers, data protection impact assessment cooperation obligations, or EU-specific data subject rights provisions. This is appropriate given that Quillen does not currently process personal data of EU data subjects and does not have EU-based clients. However, if the Company pursues international expansion into European markets, the DPA template will need to be updated to include these provisions.
Recommendation. We recommend that the SPA include a representation and warranty that the Company is in material compliance with all of its obligations under its executed customer DPAs. We further recommend that the SPA include a closing condition or post-closing covenant requiring the Company to adopt a standardized DPA template for use with new customers, with the goal of reducing operational complexity in the Company's data processing obligation landscape.
VI. SOC 2 Compliance Status
A. SOC 2 Type I Report
Quillen completed a SOC 2 Type I audit in January 2026. The audit was performed by Pemberton & Associates CPAs LLP, with Diane Stratton, CPA serving as the engagement partner. The SOC 2 Type I report covers the design and implementation of Quillen's controls relevant to the American Institute of Certified Public Accountants ("AICPA") Trust Services Criteria for the categories of Security, Availability, and Confidentiality as of the report date.
We reviewed the SOC 2 Type I report in its entirety. The report concludes that Quillen's controls, as described in the system description provided by Company management, were suitably designed and implemented to meet the applicable Trust Services Criteria as of the specified date. No material exceptions were noted in the design of any of the controls evaluated.
It is important to note the inherent limitations of a SOC 2 Type I report. A Type I report provides assurance that controls were suitably designed and implemented at a point in time (i.e., as of the report date). It does not address whether those controls operated effectively over a sustained period. The distinction between Type I and Type II is significant for Quillen's institutional clients, many of whom require SOC 2 Type II compliance as an ongoing contractual obligation.
A summary of the SOC 2 Type I report's key findings is set forth in Appendix C to this memorandum.
B. SOC 2 Type II Report — In Process
Quillen has engaged Pemberton & Associates CPAs LLP to perform a SOC 2 Type II audit, which is currently in process. The Company expects the Type II report to be completed in Q3 2026. The Type II audit will cover the operating effectiveness of Quillen's controls over a specified review period, which is expected to encompass approximately six (6) months of sustained operations.
The completion of the SOC 2 Type II audit is significant for several reasons. First, the Type II report is the industry standard for demonstrating operational security maturity and is the form of report required by most institutional clients in their vendor management programs. Second, several of Quillen's executed customer DPAs reference SOC 2 compliance as a required annual deliverable, and while a Type I report may satisfy this requirement in the short term, clients will expect the Company to transition to Type II reporting on an annual basis. Third, the Type II report will provide Pinnacle and other investors with greater confidence in the sustained effectiveness of Quillen's security controls.
Recommendation. We recommend that the completion of the SOC 2 Type II audit be included as a post-closing obligation or covenant in the SPA or the Investors' Rights Agreement. Given the expected Q3 2026 completion timeline, this obligation should not be structured as a pre-closing condition (the target closing date of June 15, 2026 precedes the expected completion date). Pinnacle should monitor progress toward completion of the Type II audit through its enhanced information and inspection rights under the Side Letter, and the Company should be required to promptly deliver the Type II report to Pinnacle upon its completion.
C. Gap Between Type I and Type II
During the interim period between the completion of the SOC 2 Type I report in January 2026 and the expected completion of the Type II report in Q3 2026, Quillen is operating under the controls described in the Type I report but has not yet demonstrated that those controls have operated effectively over a sustained period. This gap is inherent in the SOC 2 audit lifecycle and is not unusual for companies at Quillen's stage of development, particularly given that the Type I report was completed only approximately four months before the date of this memorandum.
We assess the risk associated with this gap as low, based on the following factors: (i) no data breaches or security incidents have been reported during the interim period or at any time since the Company's incorporation; (ii) the Type I report identified no material exceptions in the design of controls; (iii) the Company has engaged its existing audit firm to perform the Type II audit on a timely basis; and (iv) the Company's technical security controls, as reviewed in Section VIII below, appear to be functioning as designed. Nonetheless, this gap should be noted as a finding in our diligence report and monitored through the post-closing covenant discussed above.
VII. Data Breach History and Incident Response
A. Data Breach History
Quillen has represented, through Company counsel, that the Company has not experienced any data breaches, security incidents, or unauthorized access to customer or Company data at any time since its incorporation on July 12, 2023. This representation is consistent with the following additional information:
(a) No breach notifications have been filed by the Company with any state attorney general, the Federal Trade Commission, or any other regulatory authority.
(b) No litigation, claims, demands, or regulatory inquiries related to data security or privacy have been initiated against the Company, and none have been threatened.
(c) We reviewed the Company's internal incident logs as provided in the data room. The logs reflect standard operational events (e.g., failed login attempts, minor system errors) but do not contain any entries reflecting a security incident, unauthorized access, or data breach.
(d) None of the customer correspondence or board minutes reviewed in connection with this assessment contain any references to data security incidents or breach-related discussions.
Based on the foregoing, we have no reason to believe that the Company has experienced any data breach or material security incident. However, we note that we have not conducted an independent technical audit or forensic examination of the Company's systems, and we have relied on the representations of Company management and counsel in this regard. The SPA should include a representation and warranty confirming the absence of any data breaches or security incidents, subject to standard materiality and knowledge qualifiers.
B. Incident Response Plan
Quillen maintains a written incident response plan, which was provided for our review in the data room. The plan addresses the following topics: identification and classification of security incidents according to severity levels; escalation procedures for incidents of varying severity; the internal notification chain, with CEO Dr. Amara Osei and CTO Julian Voss designated as the primary contacts for all security incidents; external notification procedures, including customer notification consistent with the Company's DPA obligations and applicable legal requirements; engagement of forensic investigation resources; and post-incident remediation and lessons-learned processes.
Observations:
(a) The incident response plan is adequate for a company of Quillen's current size and stage of development. The plan covers the principal elements expected in an enterprise incident response program and demonstrates that the Company has considered and documented its approach to security incident management.
(b) However, the plan does not currently designate a dedicated Data Protection Officer or Chief Information Security Officer. CTO Julian Voss serves as the de facto security lead and is the designated escalation point for all security incidents. While this arrangement is workable for a thirty-eight-person company, it becomes increasingly untenable as the Company scales, both because of the operational demands on the CTO's time and because institutional clients and regulators increasingly expect to see a dedicated security function within vendor organizations.
(c) The Company has not conducted tabletop exercises or incident response simulations to test the plan's effectiveness in a realistic scenario. Tabletop exercises are an industry best practice and are increasingly expected by institutional clients, auditors, and regulators as evidence of incident response preparedness.
Recommendation. Post-closing, we recommend that Quillen designate a formal security lead or hire a Chief Information Security Officer and conduct periodic incident response tabletop exercises (at least annually). These items should be included on the post-closing obligations checklist and, where appropriate, memorialized as covenants in the transaction documents.
VIII. Information Security Policies and Practices
A. Written Information Security Program (WISP)
Quillen maintains an internal information security policy document that functions as its Written Information Security Program. The WISP covers the following areas: acceptable use of Company systems and resources; access control policies, including role-based access and the principle of least privilege; password management requirements, including complexity standards and rotation schedules; endpoint security requirements for employee devices; data classification standards establishing categories of data sensitivity and corresponding handling requirements; encryption standards for data at rest and in transit; remote work security requirements, including VPN use and secure device management; and vendor security review procedures for evaluating the security posture of third-party service providers.
The WISP is consistent with the requirements of Massachusetts 201 CMR 17.00, which mandates that persons who own or license personal information of Massachusetts residents maintain a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the size, scope, and type of business, the resources available, the amount of stored data, and the need for security and confidentiality. We reviewed the WISP against the specific elements required by 201 CMR 17.00 and found it to be materially compliant.
The WISP was last updated in Q4 2025. Given the Company's ongoing growth and the anticipated acceleration of its operations following the Series A financing, we recommend that the WISP be reviewed and updated on at least an annual basis to reflect changes in the Company's data environment, workforce, and technology infrastructure.
B. Technical Security Controls
Based on our review of the SOC 2 Type I report, the WISP, and supplemental technical documentation provided in the data room, we identified the following technical security controls implemented by the Company:
(a) Encryption at Rest and in Transit. Data at rest is encrypted using AES-256 encryption. Data in transit is encrypted using TLS version 1.2 or higher. These encryption standards meet or exceed current industry standards and are consistent with the requirements of the Company's customer DPAs.
(b) Multi-Factor Authentication (MFA). MFA is required for all employee access to Company systems and administrative functions. MFA is also available and encouraged for institutional client users accessing the Mosaic platform dashboard.
(c) Role-Based Access Controls (RBAC). The Mosaic platform implements role-based access controls that limit user access to data and functionality based on the user's assigned role and permissions. This is consistent with the principle of least privilege and the tenant isolation requirements of the Company's multi-tenant architecture.
(d) Vulnerability Scanning and Penetration Testing. The Company conducts regular vulnerability scanning of its systems and applications. Annual penetration testing is performed by a qualified third-party firm. The most recent penetration test was conducted in Q4 2025; the report was reviewed in the data room and disclosed no critical findings. Certain medium and low-severity findings were noted and have been remediated or are subject to documented remediation plans.
(e) Cloud Infrastructure Security. The Company's cloud infrastructure provider maintains its own SOC 2 Type II compliance. The Company's use of this provider's infrastructure benefits from the provider's physical security controls, network security controls, and operational procedures.
(f) Automated Security Monitoring and Alerting. The Company employs automated monitoring and alerting tools to detect and respond to security events in real time. Alerts are routed to the CTO and designated members of the engineering team.
Overall, the Company's technical security controls are consistent with industry standards for a SaaS company of this size and stage and are appropriately aligned with the requirements of the SOC 2 Trust Services Criteria for Security, Availability, and Confidentiality.
C. Employee Security Practices
All Quillen employees are required to sign confidentiality and acceptable use agreements upon hiring. These agreements establish the employee's obligations with respect to the protection of Company and client confidential information and the appropriate use of Company systems and resources.
Security awareness training is conducted at onboarding for all new employees. Annual refresher training has been implemented, with the most recent annual training session conducted in Q1 2026. The training program covers topics including phishing awareness, password hygiene, data handling procedures, and incident reporting.
Background checks are performed for all new hires as a standard element of the Company's hiring process. This practice is particularly important for engineering roles and other positions with access to client data and production systems.
We reviewed the employment agreements for the three members of the executive leadership team: Dr. Amara Osei (CEO), Julian Voss (CTO), and Priya Chandrasekar (VP of Product). Each agreement contains confidentiality provisions, invention assignment clauses, and non-solicitation provisions. These agreements are appropriately structured to protect the Company's intellectual property and confidential information.
D. Vendor / Subprocessor Management
Quillen maintains a list of approved subprocessors, which includes the Company's cloud hosting provider, analytics tools, email and productivity platforms, and other third-party services used in connection with the delivery of the Mosaic platform and the operation of the Company's business. The list of approved subprocessors is made available to clients in accordance with the subprocessor notice provisions of the Company's DPAs.
The Company conducts security reviews of prospective vendors and subprocessors prior to onboarding. These reviews include an assessment of the vendor's security posture, certifications, and data protection practices. Contractual data protection provisions are required in the Company's agreements with its vendors and subprocessors.
Observation. While the Company's vendor management practices are functional, the vendor review process is currently informal and not governed by a written vendor risk management program. As the Company scales and its vendor ecosystem expands, a formalized program — including documented risk assessment criteria, periodic re-evaluation of existing vendors, and a standardized vendor security questionnaire — will be necessary to maintain appropriate oversight and to satisfy the expectations of institutional clients and auditors.
Recommendation. We recommend that the Company implement a formal, documented vendor risk management program within ninety (90) days of closing, and that this obligation be included as a post-closing covenant in the transaction documents.
IX. Open-Source and AI-Specific Considerations
The Mosaic platform is described and marketed as an "AI-driven" portfolio analytics and risk-attribution tool. The platform employs machine learning models to analyze client portfolio data, perform risk decomposition, and generate performance attribution insights. Given the increasing regulatory and market scrutiny of artificial intelligence and machine learning in financial services and data processing generally, we have considered the privacy and data security implications of the Company's AI/ML practices.
AI Data Use. A central question in the privacy due diligence of any AI-driven platform is whether customer data is used for training generalized machine learning models that benefit the vendor or other customers, or whether customer data is used exclusively for the benefit of the providing customer. We inquired with Company counsel on this point, and Quillen has represented that client data is used to generate client-specific analytics but is not used for cross-client model training without the explicit consent of the contributing client. This representation is consistent with the Company's DPA framework, which limits data processing to the provision of contracted services. However, this representation should be independently confirmed through the SPA representation and warranty process, as the use of customer data for cross-client model training without consent would constitute a material misalignment between the Company's privacy representations and its actual practices.
Open-Source Dependencies. We reviewed the Company's open-source software usage in conjunction with the intellectual Property due diligence workstream. The Company's Mosaic platform incorporates open-source libraries licensed under the Apache 2.0 License and the MIT License, among other permissive licenses. No copyleft or GPL-licensed dependencies were flagged in the open-source audit. From a privacy and data security perspective, the use of open-source components does not introduce additional privacy risk in and of itself. However, the Company should maintain appropriate supply chain security practices, including monitoring open-source dependencies for known vulnerabilities, applying security patches promptly, and maintaining a software bill of materials.
Recommendation. The Company's privacy policy and customer DPAs should explicitly address AI/ML data use practices, including clear disclosures about whether and how client data is used for model training, product improvement, or other purposes beyond the delivery of contracted services. The SPA should include a representation that the Company does not use customer data for cross-client model training without the explicit consent of the affected client. These disclosures and representations should be drafted with precision to avoid any ambiguity that could be exploited in future disputes or regulatory inquiries.
X. Risk Assessment Summary
The following is a summary of our risk assessment based on the findings described in the preceding sections of this memorandum.
A. Low-Risk Findings
1. Institutional B2B Data Environment. The Company's data processing activities predominantly involve institutional portfolio-level data with limited exposure to high-volume consumer PII, which significantly reduces the Company's privacy risk profile.
2. No Data Breaches. No data breaches, security incidents, or unauthorized access events have occurred since the Company's incorporation on July 12, 2023. No breach notifications have been filed, and no related litigation, claims, or regulatory inquiries have been initiated or threatened.
3. SOC 2 Type I Completed. The Company completed a SOC 2 Type I audit in January 2026 with no material exceptions noted in the design of controls.
4. Technical Security Controls. The Company maintains encryption (AES-256 at rest, TLS 1.2+ in transit), multi-factor authentication, and role-based access controls, all of which meet or exceed industry standards for companies at this stage.
5. Limited Statutory Applicability. CCPA/CPRA and most state comprehensive privacy laws do not currently apply to the Company based on its revenue and data processing volumes.
B. Moderate-Risk Findings
1. SOC 2 Type II Not Yet Completed. The SOC 2 Type II audit is in process and expected to be completed in Q3 2026. Until the Type II report is available, there is a gap between the point-in-time design assurance provided by the Type I report and the sustained operating effectiveness assurance that the Type II report will provide.
2. No Dedicated CISO or DPO. The Company does not currently have a dedicated Chief Information Security Officer or Data Protection Officer. CTO Julian Voss serves as the de facto security lead. As the Company scales, this arrangement creates risk related to the adequacy of security governance and the CTO's ability to dedicate sufficient attention to security matters alongside his other responsibilities.
3. Incident Response Plan Not Tested. The Company has not conducted tabletop exercises or incident response simulations to validate the effectiveness of its written incident response plan. Untested incident response procedures carry incremental risk of operational failure in the event of an actual security incident.
4. Privacy Policy Lacks AI/ML Disclosures. The Company's published privacy policy does not include disclosures specific to the use of artificial intelligence and machine learning in the processing of client data. Given the increasing regulatory and market expectation for transparency around AI data practices, this gap creates reputational and regulatory risk.
5. DPA Variation. Variation in notification timeframes (twenty-four hours versus seventy-two hours) and deletion periods (fifteen days versus thirty days) across executed customer DPAs creates operational complexity and increases the risk of non-compliance with the most restrictive applicable terms.
6. Informal Vendor Risk Management. The Company's vendor review process is functional but informal and not governed by a written vendor risk management program, which creates risk as the vendor ecosystem expands.
C. Items Requiring Post-Closing Attention
The following items should be addressed through post-closing obligations, covenants, or management undertakings:
1. Completion of SOC 2 Type II audit by end of Q3 2026.
2. Designation of a formal security lead or hire of a CISO within six (6) months of closing.
3. Conduct of the first incident response tabletop exercise within six (6) months of closing.
4. Update of the Company's privacy policy to include AI/ML-specific data use disclosures and anticipatory CCPA compliance provisions, within ninety (90) days of closing.
5. Implementation of a formal, documented vendor risk management program within ninety (90) days of closing.
6. Adoption of a standardized DPA template for new customer agreements, incorporating lessons learned from the current DPA review.
7. Preparation for CCPA/CPRA and other state privacy law compliance as the Company's revenue and data processing volumes scale, including the designation of a privacy contact and the development of consumer request response procedures.
XI. Recommendations for SPA Representations, Warranties, and Closing Conditions
Based on the findings set forth in this memorandum, we recommend the following provisions be included in the Series A Stock Purchase Agreement, the Investors' Rights Agreement, and/or the Pinnacle Side Letter, as appropriate.
A. Recommended Representations and Warranties (Company Side)
We recommend that the Company make the following representations and warranties in the SPA:
1. Privacy Law Compliance. The Company has complied in all material respects with all applicable privacy and data security laws, rules, and regulations, including without limitation the Massachusetts Standards for the Protection of Personal Information of Residents of the Commonwealth (201 CMR 17.00), and the Company is not currently subject to the California Consumer Privacy Act or any other state comprehensive privacy law based on its current revenue and data processing volumes.
2. Privacy Policy Compliance. The Company's published privacy policy accurately and completely describes the Company's data collection, use, sharing, and retention practices in all material respects, and the Company has complied with its published privacy policy in all material respects since its first publication.
3. No Breaches. The Company has not experienced any data breach, security incident, unauthorized access to, or unauthorized disclosure of personal information or customer data at any time since its incorporation on July 12, 2023, and the Company has not been required to provide any notification to any individual, governmental authority, or other entity relating to any such event.
4. DPA Compliance. The Company is in material compliance with all of its obligations under customer data processing agreements, master subscription agreements, and other contracts relating to the processing, security, or privacy of customer data or personal information.
5. No Regulatory Proceedings. No proceedings, investigations, inquiries, audits, or enforcement actions by any governmental authority relating to the Company's data privacy or data security practices have been initiated, are pending, or have been threatened against the Company, and no circumstances exist that would reasonably be expected to give rise to any such proceedings.
6. Written Information Security Program. The Company maintains a written information security program reasonably designed to protect the confidentiality, integrity, and availability of customer data and personal information, consistent with industry standards and applicable legal requirements.
7. AI/ML Data Use. The Company does not use customer data for cross-client model training, product development, or other secondary purposes without the explicit prior consent of the affected customer, and the Company has not derived or generated any machine learning models, datasets, or analytical outputs from customer data that are used for the benefit of parties other than the contributing customer without such customer's consent.
8. SOC 2 Status. The Company has completed a SOC 2 Type I audit performed by Pemberton & Associates CPAs LLP, with no material exceptions noted, and is currently engaged in a SOC 2 Type II audit expected to be compl