1016-00001 · Dunmore Energy Holdings · Document Collection

crestview-analytics-sow.docx DOCUMENT Antitrust

6 / 12 ← → ✕

Contract analysis Extract to table

STATEMENT OF WORK — E-DISCOVERY SERVICES

CALDERWOOD & HARKNESS LLP

September 12, 2025

C&H Matter No. 1016-00001

CONTRACTING PARTIES

This Statement of Work ("SOW") is entered into as of September 12, 2025, by and between:

Client: Calderwood & Harkness LLP ("Client" or "C&H"), a limited liability partnership organized and existing under the laws of the District of Columbia, with offices located at 1900 K Street NW, Suite 1100, Washington, DC 20006.

Vendor: Brindoval Analytics LLC ("Vendor" or "Brindoval"), a limited liability company organized and existing under the laws of the Commonwealth of Virginia, with its principal place of business located at 8400 Leesburg Pike, Suite 320, Tysons Corner, VA 22182.

Client and Vendor are referred to individually as a "Party" and collectively as the "Parties."

This SOW sets forth the terms and conditions under which Vendor will provide certain electronic discovery services to Client in connection with the matter described in Section 1 below. This SOW is governed by and incorporates the terms of any existing Master Services Agreement between the Parties. To the extent of any conflict between this SOW and any such Master Services Agreement, the terms of this SOW shall control with respect to the services described herein.

SECTION 1: PROJECT OVERVIEW

1.1 Engagement Description. Vendor will provide comprehensive electronic discovery services—including forensic collection, processing, deduplication, hosting, technology-assisted review, and production—in connection with Client's defense of Dunmore Energy Holdings Ltd. ("DEH"), a Cayman Islands exempted limited company with operational headquarters at 4100 Westchase Boulevard, Suite 1200, Houston, TX 77042, and DEH's wholly-owned subsidiary, Dunmore Fuel Supply, Inc. ("DFS"), a corporation organized under the laws of the State of Delaware and headquartered at the same Houston address (DEH and DFS are collectively referred to herein as the "Respondents").

1.2 Underlying Matter. The engagement arises from a pending state attorney general antitrust investigation. On August 22, 2025, the Office of the Attorney General of the State of Meridian, Antitrust Division, located at 500 Capitol Avenue, Suite 300, Baxter City, Meridian 39201, issued Civil Investigative Demand No. AG-ANT-2025-04172 (the "CID") to the Respondents. The CID was issued pursuant to the Meridian Antitrust Enforcement Act, §§ 45-7-101 through 45-7-118, and seeks documents and communications relevant to an investigation into allegations of bid rigging in connection with fuel-supply contracts awarded by the Meridian State Department of Transportation ("Meridian DOT") during the period from January 2021 through December 2024. The investigation concerns competitive procurement processes for bulk fuel supply used by Meridian DOT in its statewide fleet operations, road maintenance equipment fueling, and transportation infrastructure programs.

1.3 Co-Respondents. DEH and DFS are respondents to the CID alongside two co-respondents: (a) Galloway Petroleum Corp., a Delaware corporation with its principal place of business in Birmingham, Alabama; and (b) Ridgeline Energy Partners LLC, a Georgia limited liability company with its principal place of business in Duluth, Georgia. Co-respondents are represented by separate counsel, as further addressed in Section 6 of this SOW.

1.4 Client Supervision. Client serves as lead outside counsel for the Respondents in the above-described investigation. The engagement is supervised by Howard Bellamy, Partner, Antitrust & Competition Practice Group, Calderwood & Harkness LLP. Day-to-day management of the engagement, including all communications with Vendor relating to the services described in this SOW, is the responsibility of Monica Reyes, Senior Associate, Antitrust & Competition Practice Group, Calderwood & Harkness LLP.

1.5 Matter Reference. All invoices, correspondence, work product, and deliverables prepared or submitted in connection with this SOW shall reference C&H Matter No. 1016-00001.

SECTION 2: SCOPE OF SERVICES

The services to be provided by Vendor under this SOW are organized into five sequential phases, as described below. Each phase is dependent upon the successful completion of the preceding phase, except where otherwise noted. Vendor shall perform all services in a professional and workmanlike manner consistent with prevailing industry standards for electronic discovery and digital forensics.

2.1 Phase 1: Forensic Collection

2.1.1 Custodian Device Collection. Vendor shall perform forensic imaging of laptops, desktops, and mobile devices belonging to the following five (5) identified custodians (the "Custodians"). Forensic imaging shall be performed using industry-standard forensic tools and shall produce bit-for-bit copies of all storage media associated with each Custodian's devices. The estimated data volumes set forth below are based on preliminary assessments conducted by DFS's internal IT department and communicated to Client on September 5, 2025. Actual data volumes may vary.

1. Terrence "Terry" Kinloch — Vice President, Government Contracts, DFS. Estimated data volume: 42.7 GB, comprising approximately 186,000 documents. Mr. Kinloch's devices include one Kestrel Solutions laptop, one Brightmoor Group OptiPlex 7000 desktop, and one Ashbury Corporation 14 Pro (company-issued). Mr. Kinloch served as the primary DFS executive responsible for responses to Meridian DOT RFPs and is expected to be a key custodian.

2. Sandra Ochoa — Director of Pricing & Analytics, DFS. Estimated data volume: 31.4 GB, comprising approximately 142,000 documents. Ms. Ochoa's devices include one Lenovo ThinkPad X1 Carbon laptop and one Northgate & Co. Galaxy S23 (company-issued). Ms. Ochoa was responsible for developing pricing models and bid calculations submitted in connection with Meridian DOT fuel-supply solicitations.

3. Nolan Prescott — Regional Sales Manager, Southeastern United States, DFS. Estimated data volume: 18.9 GB, comprising approximately 95,000 documents. Mr. Prescott's devices include one Brightmoor Group Latitude 5530 laptop and one Ashbury Corporation 13 (company-issued). Mr. Prescott maintained direct client relationships with Meridian DOT procurement personnel and participated in industry trade association events relevant to the investigation.

4. Patricia Aldridge — Senior Vice President & General Counsel, DEH. Estimated data volume: 27.3 GB, comprising approximately 118,000 documents. Ms. Aldridge's devices include one Tidewater Industries MacBook Pro 14" laptop, one Brightmoor Group OptiPlex 7090 desktop, and one Brightwater Systems (company-issued). Ms. Aldridge provided legal counsel to DFS in connection with government contract compliance and antitrust matters. Documents collected from Ms. Aldridge's devices are expected to include a significant volume of potentially privileged communications.

5. Malcolm Haverford — Chief Executive Officer, DEH. Estimated data volume: 12.1 GB, comprising approximately 63,000 documents. Mr. Haverford's devices include one Tidewater Industries MacBook Pro 16" laptop and one Brightwater Systems Max (company-issued). While Mr. Haverford was not directly involved in day-to-day Meridian DOT bid preparation, he received periodic briefings from Mr. Kinloch and Ms. Aldridge regarding government contract strategy and is identified as a custodian due to his receipt of reports and board-level communications.

2.1.2 Cloud-Hosted Data Collection. Vendor shall collect cloud-hosted data from the DEH/DFS Ashgrove Software tenant for all five Custodians. The scope of cloud-hosted data collection includes the following Ashgrove Software services:

• Drayton Solutions: Complete mailbox contents for each Custodian, including inbox, sent items, deleted items, drafts, archive folders, calendar items, and contacts.

• Westvale Services Inc.: All documents stored in Aldermere Systems sites to which each Custodian had access or for which each Custodian is identified as an author or last modifier during the relevant time period.

• Northgate Data Systems: All Teams chat messages (one-to-one and group chats), channel messages, and files shared in Teams channels for each Custodian.

Cloud data collection shall be performed using Sterling Reach Systems eDiscovery tools or comparable Vendor-approved third-party collection tools that provide defensible, auditable collection with complete metadata preservation.

2.1.3 Archived Email Collection. Vendor shall collect archived email from the DFS Brightwater Solutions system for all five Custodians. The temporal scope of the Enterprise Vault collection shall cover the period from January 1, 2020 through the date of collection. The Parties acknowledge that the earliest alleged conspiratorial conduct identified in the CID concerns the period beginning January 2021. The temporal scope of the Enterprise Vault collection extends back to January 1, 2020—one year before the earliest date of alleged conspiratorial conduct—in order to capture potential pre-conspiracy communications that may be relevant to the defense, including any communications bearing on market conditions, pricing methodologies, and competitive dynamics preceding the period of alleged coordination. This extended temporal scope is consistent with Client's litigation-hold memorandum dated September 3, 2025, and reflects Client's professional judgment regarding the appropriate scope of preservation and collection in light of the Respondents' obligation to respond to the CID in good faith.

2.1.4 Non-Custodial Data Source Collection. Vendor shall collect data from the following designated non-custodial data sources:

• DFS Shared Network Drive: Vendor shall collect all files and folders located on the DFS shared network drive at the following path: \\\\DFS-FILE01\\GovContracts\\. This network share contains centralized government contracts documentation, bid preparation files, and related materials maintained by the DFS Government Contracts team. Vendor shall perform a complete copy of this directory, preserving all original metadata, including file creation dates, modification dates, and access control information.

• DFS Pricing Database ("FuelPricer" Application): Vendor shall work with DFS's internal IT department to export relevant data from the FuelPricer proprietary pricing application. Exports shall be provided in .csv and .xlsx format and shall include all pricing models, bid calculations, cost analyses, and related data pertaining to Meridian DOT solicitations during the relevant period. DFS's IT department will perform the data extraction under Vendor's supervision, and Vendor shall verify the completeness and integrity of the exported data.

• DFS Quillon Data Systems Instance: Vendor shall perform a targeted export from the DFS Quillon Data Systems instance (accessible at dfs.my.Pinnacle Health IT.com). The Pinnacle Health IT export shall be limited to Meridian-related accounts, opportunities, activities, tasks, and communications. Vendor shall work with DFS's Pinnacle Health IT administrator to identify and extract all relevant object records using appropriate filters (including, without limitation, account name, opportunity stage, and geographic filters for Meridian-related records).

2.1.5 Chain-of-Custody Documentation. Vendor shall prepare and maintain defensible chain-of-custody documentation for all collections performed under this Phase 1. Chain-of-custody documentation shall include, at a minimum:

• Identification of the collecting technician(s);

• Date, time, and location of each collection activity;

• Description of the device(s) or data source(s) collected;

• Serial numbers, asset tags, or other unique identifiers for each physical device;

• Hash verification of all collected data using both MD5 and SHA-256 algorithms;

• Documentation of the storage media used for transport and storage of collected data; and

• A continuous, unbroken chain-of-custody log from the point of collection through ingestion into Vendor's processing environment.

2.1.6 Collection Timeline. All collection activities described in this Section 2.1 shall commence no later than September 19, 2025, with a targeted completion date of September 26, 2025. Vendor shall coordinate on-site collection activities with DFS's IT department (primary contact: James Yun, IT Director, DFS; jyun@dunmorefuel.com) and shall provide Client with at least forty-eight (48) hours' advance notice of all on-site collection dates.

2.2 Phase 2: Processing and Deduplication

2.2.1 Data Ingestion. Upon completion of Phase 1 collection activities, Vendor shall ingest all collected data into Vendor's proprietary or licensed processing platform. Vendor shall maintain a detailed ingestion log documenting all data sets ingested, volumes, and any errors or exceptions encountered during ingestion.

2.2.2 Deduplication. Vendor shall apply global deduplication across all Custodians using MD5 hash values. Global deduplication will eliminate exact duplicate documents across the entire collection population, reducing overall document volume and eliminating redundant review. Vendor shall retain a deduplication log identifying all documents removed through the deduplication process, including the hash values of deduplicated items and the custodian(s) from whom each duplicate instance was collected.

2.2.3 Text and Metadata Extraction. Vendor shall extract full text and metadata from all file types present in the collected data. For documents that do not contain extractable text (e.g., image-only PDFs, scanned documents), Vendor shall apply optical character recognition (OCR) to generate searchable text. Vendor shall extract all available metadata fields, including but not limited to author, date created, date modified, date last accessed, file path, file size, file type, email sender, email recipients (To, CC, BCC), email subject, and email date sent/received.

2.2.4 Date Filtering. Vendor shall apply a date filter to restrict the processed data population to documents and communications dated January 1, 2020 through the date of processing. Documents lacking a discernible date (i.e., documents for which no date metadata is available and no date is evident from the document content) shall be retained in the population for manual review and shall not be excluded by the date filter.

2.2.5 Search-Term Culling. Following deduplication and date filtering, Vendor shall apply search terms provided by Client as a first-pass culling step to further reduce the document population to a potentially relevant review set. Client will provide search terms to Vendor in writing. Vendor shall run the search terms against the full text and key metadata fields (including email subject lines, file names, and file paths) and shall provide Client with hit reports showing the number of documents responsive to each individual search term and each combination of terms, to enable Client to refine the search-term list as necessary.

2.2.6 Estimated Volumes. The estimated input volume for Phase 2 processing is 132.4 GB, comprising approximately 604,000 documents (reflecting the sum of estimated data across all five Custodians and all non-custodial sources). Based on Vendor's experience with similar data populations in comparable antitrust investigations, the estimated post-processing, post-deduplication document volume is approximately 380,000 unique documents. These estimates are subject to revision based on actual collection volumes and deduplication rates.

2.3 Phase 3: Hosting and Review Platform

2.3.1 Hosting Environment. Vendor shall host the processed document population on Vendor's Relativity instance, specifically on the Brindoval Kestrel Technologies tenant (cloud-hosted). The Kestrel Technologies workspace shall be configured and made available to Client within three (3) business days following the completion of processing and deduplication described in Phase 2.

2.3.2 Workspace Configuration. Vendor shall configure the review workspace with the following coding fields, layouts, and views, as directed by Client:

Coding Fields:

• Responsiveness: Single-choice field with the following options: Responsive; Not Responsive; Needs Further Review.

• Privilege: Single-choice field with the following options: Privileged; Not Privileged; Needs Privilege Review.

• Confidentiality: Single-choice field with the following options: Confidential; Highly Confidential; Not Designated.

• Issue Tags: Multi-choice field with the following options: Bid Coordination; Pricing Strategy; Competitor Communication; Trade Association; Meridian DOT; Other.

• Custodian: Single-choice field, auto-populated based on custodian assignment during processing.

• Date Range: Date field, auto-populated based on extracted metadata.

Additional coding fields, layouts, views, saved searches, and dashboards may be requested by Client during the course of the engagement. Vendor shall implement reasonable additional configuration requests at no additional charge, provided that such requests do not require significant custom development. Requests requiring significant custom development will be scoped and priced separately by mutual agreement.

2.3.3 User Access. Vendor shall provide user access to the Kestrel Technologies workspace for up to ten (10) concurrent reviewers designated by Client. Client shall provide Vendor with the names and email addresses of authorized reviewers. Vendor shall provision user accounts within one (1) business day of receiving Client's access request. All users shall authenticate using multi-factor authentication. Vendor shall maintain an access log documenting all user login and logout activity.

2.4 Phase 4: Technology-Assisted Review (TAR)

2.4.1 TAR Protocol. Vendor shall implement a Technology-Assisted Review protocol using the TAR 2.0 (continuous active learning) methodology, leveraging the Kestrel Health IT module within the Brindoval Kestrel Technologies tenant. The continuous active learning model will prioritize the most likely responsive documents for review, continuously updating the model's predictions as reviewers code documents, thereby increasing review efficiency and reducing the volume of documents requiring manual review.

2.4.2 Subject-Matter Expert Training. Client's attorneys shall serve as subject-matter experts ("SMEs") for training-round coding. The primary SMEs for this engagement are:

• Monica Reyes, Senior Associate, Calderwood & Harkness LLP; and

• Elliot Nguyen, Associate, Calderwood & Harkness LLP.

Additional contract reviewers from the C&H document-review team may participate in coding under the supervision of Ms. Reyes and Mr. Nguyen. All SME and reviewer coding decisions will be subject to quality-control review by Client's lead attorneys to ensure consistency and accuracy.

2.4.3 Statistical Validation Reporting. Vendor shall provide Client with statistical validation reports at each training checkpoint during the TAR process. Each validation report shall include the following metrics, calculated using a statistically valid random sample of the document population:

• Recall: The proportion of all responsive documents in the collection that the TAR model has identified as responsive (i.e., the percentage of truly responsive documents captured by the model).

• Precision: The proportion of documents identified as responsive by the TAR model that are, in fact, responsive upon manual review (i.e., the accuracy of the model's responsive predictions).

• Elusion: The proportion of documents in the non-reviewed or model-predicted non-responsive population that are, in fact, responsive (i.e., the rate of responsive documents "missed" by the model in the uncoded remainder).

Validation sample sizes shall be determined based on a confidence level of 95% and a margin of error of ±2%, unless Client and Vendor agree to alternative parameters.

2.4.4 Target Recall Rate. The target recall rate for the TAR protocol is ≥ 80%. This target is consistent with prevailing judicial expectations and case law regarding the defensibility of TAR protocols. Vendor shall continue model training until the target recall rate is achieved or until Client determines, in its professional judgment, that additional training is unlikely to materially improve recall.

2.4.5 TAR Timeline. TAR 2.0 model training shall commence on October 10, 2025, following the completion of processing, deduplication, and search-term culling. The first validation checkpoint is targeted for October 20, 2025.

2.4.6 TAR Validation Summary Report. Upon completion of the TAR process, Vendor shall prepare a comprehensive TAR validation summary report documenting the TAR protocol, training methodology, validation methodology, and final statistical metrics. This report shall be prepared in a format suitable for disclosure to the Office of the Attorney General of the State of Meridian, if requested, to demonstrate the defensibility and reasonableness of the Respondents' review methodology. The TAR validation summary report shall be delivered to Client no later than three (3) business days following the completion of the review described in Section 3.

2.5 Phase 5: Production

2.5.1 Production Format. Vendor shall produce responsive, non-privileged documents in the following format:

• Image Files: Single-page TIFF images (Group IV, 300 DPI, black and white), with color TIFF or JPEG images produced for documents where color is material to the content (e.g., charts, graphs, maps, photographs).

• Extracted Text: Document-level extracted text files (.txt), with one text file per document, named to correspond to the beginning Bates number of the associated document.

• Load Files:

• Ashgrove Technologies load file (.dat), containing all metadata and coding fields;

• Relativity image load file (.opt), mapping Bates numbers to TIFF image file paths.

• Native Productions: Spreadsheets (Ashbury Holdings Excel, .xlsx and .xls) and databases shall be produced in native format with extracted metadata, in addition to TIFF images. Native files shall be named using the beginning Bates number of the associated document.

2.5.2 Bates Numbering. All produced documents shall be assigned sequential Bates numbers using the following prefix and format: DEH-MERID-000001 through DEH-MERID-[final]. Bates numbers shall appear as endorsements on the lower-right corner of each TIFF image. Vendor shall maintain a Bates number register and shall ensure that no gaps or duplications occur in the Bates numbering sequence.

2.5.3 Privilege Log. Vendor shall assist Client in preparing a privilege log in spreadsheet format (.xlsx). The privilege log shall contain the following fields for each document or communication withheld on the basis of privilege:

Client's attorneys shall make all final privilege determinations. Vendor's role in privilege log preparation is limited to populating metadata fields and formatting the privilege log based on Client's coding decisions.

2.5.4 Production Delivery. Completed productions shall be delivered to Client on encrypted USB drives, using AES-256 hardware encryption. Each USB drive shall be password-protected, and the password shall be transmitted to Client separately via a secure communication channel (encrypted email or secure file transfer). Vendor shall include a production cover letter with each delivery identifying the volume number, Bates range, document count, and page count of the enclosed production.

SECTION 3: TIMELINE / MILESTONES

The following table sets forth the target milestones and dates for the services described in this SOW. The Parties acknowledge that these dates are targets and that actual dates may vary depending on data volumes, collection logistics, Client review capacity, and other factors. Vendor shall promptly notify Client of any anticipated delays and shall propose revised timelines for Client's approval.

Extension of CID Response Deadline. The original CID response deadline was October 3, 2025—forty (40) calendar days from the August 22, 2025 date of issuance, as required by Section 45-7-109(b) of the Meridian Antitrust Enforcement Act. Calderwood & Harkness, on behalf of the Respondents, submitted a written request for an extension of the response deadline to the Office of the Attorney General of the State of Meridian on September 22, 2025, citing the volume and complexity of the data collection and review required. The extension request was granted by the Attorney General's office on September 26, 2025, extending the CID response deadline to November 3, 2025. A copy of the extension correspondence is maintained in the C&H matter file. The timeline set forth above is designed to ensure that the Respondents' production is completed with adequate time for final quality control prior to the extended November 3, 2025 deadline.

SECTION 4: PRICING

4.1 Unit-Rate Pricing. Vendor shall perform the services described in this SOW at the following unit rates. The estimated costs set forth below are based on the estimated data volumes and timelines described in this SOW and are provided for budgeting purposes only. Actual costs will depend on actual data volumes, processing requirements, hosting duration, production volumes, and project management hours.

4.2 Invoicing. Vendor shall invoice Client on a monthly basis for services performed during the preceding calendar month. Each invoice shall include a detailed breakdown of charges by service category, unit rate, quantity, and total amount, together with supporting documentation sufficient to allow Client to verify the accuracy of each charge. Invoices shall reference C&H Matter No. 1016-00001.

4.3 Payment Terms. Client shall pay each invoice within thirty (30) days of receipt. Vendor shall submit invoices to Client at the following email address: mreyes@calderwoodharkness.com, with a copy to invoices@calderwoodharkness.com.

4.4 Cost Overrun Notification. Vendor shall promptly notify Client in writing if projected costs are expected to exceed the estimated total set forth in Section 4.1 by more than ten percent (10%) (i.e., by more than $38,500). Vendor shall not incur costs in excess of the estimated total without Client's prior written approval, which may be given by email from Monica Reyes or Howard Bellamy.

4.5 Pass-Through of Vendor Costs. Client will pass through Vendor's costs to DEH/DFS at Vendor's invoiced rates without markup, in accordance with the terms of the engagement letter between Calderwood & Harkness LLP and DEH dated August 27, 2025. Vendor acknowledges that Client's ability to pay Vendor's invoices is dependent upon Client's receipt of corresponding payment from DEH/DFS, provided that Client's payment obligation to Vendor is not contingent upon Client's receipt of payment from DEH/DFS.

SECTION 5: DATA SECURITY

5.1 Data Center. All data collected, processed, and hosted by Vendor in connection with this SOW shall be stored in Vendor's SOC 2 Type II–certified data center located in Ashburn, Virginia. Vendor represents and warrants that the data center has been the subject of a SOC 2 Type II examination performed by an independent auditor within the preceding twelve (12) months, and that the examination report identified no material deficiencies in the design or operating effectiveness of the data center's controls relating to security, availability, processing integrity, confidentiality, or privacy. Upon Client's request, Vendor shall provide Client with a copy of the most recent SOC 2 Type II examination report, subject to any applicable confidentiality restrictions imposed by the auditor.

5.2 Encryption at Rest. All data at rest in Vendor's systems—including data stored on servers, storage arrays, backup media, and portable devices—shall be encrypted using the Advanced Encryption Standard with a key length of 256 bits (AES-256). Encryption keys shall be managed in accordance with industry-standard key management practices and shall not be stored on the same media as the encrypted data.

5.3 Encryption in Transit. All data in transit between Client and Vendor, between Vendor and the Respondents' IT systems, and within Vendor's internal network shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher. Vendor shall not transmit any data collected, processed, or hosted under this SOW using unencrypted channels.

5.4 Cyber-Liability Insurance. Vendor represents and warrants that it maintains cyber-liability insurance with Hargrove Mutual Insurance Co. with a per-occurrence limit of not less than $10,000,000. Vendor shall maintain such insurance coverage in full force and effect throughout the term of this SOW and for a period of not less than two (2) years following the expiration or termination of this SOW. Upon Client's request, Vendor shall provide Client with a certificate of insurance evidencing such coverage.

5.5 Data-Breach Notification. Vendor shall comply with all applicable federal, state, and local laws, regulations, and industry standards relating to data security, including without limitation the Virginia Consumer Data Protection Act and any applicable breach notification statutes. In the event of any data breach, unauthorized access, or security incident involving data collected, processed, or hosted under this SOW, Vendor shall notify Client in writing within twenty-four (24) hours of becoming aware of such breach, access, or incident. The notification shall include a description of the nature and scope of the breach, the data affected, the measures taken to contain and remediate the breach, and any recommended actions for Client or the Respondents.

5.6 Access Controls. Vendor shall implement and maintain appropriate physical and logical access controls to restrict access to data collected, processed, and hosted under this SOW to authorized personnel only. Access shall be granted on a least-privilege, need-to-know basis. Vendor shall maintain an access control log and shall provide Client with a list of Vendor personnel authorized to access the data upon request.

SECTION 6: CONFIDENTIALITY

6.1 Privileged and Protected Materials. Vendor acknowledges that all data collected, processed, hosted, reviewed, and produced in connection with this SOW may be subject to the attorney-client privilege, the work-product doctrine, or both. Vendor's services are performed at the direction of Client for the purpose of assisting Client in providing legal advice and services to the Respondents. Vendor shall treat all such data as privileged and confidential at all times.

6.2 Non-Disclosure. Vendor shall not disclose any data or information collected, processed, hosted, or otherwise obtained in connection with this SOW to any third party without prior written authorization from Client. This obligation extends to all Vendor personnel, subcontractors, and agents. Vendor shall not use any such data or information for any purpose other than the performance of services under this SOW.

6.3 Joint Defense and Common Interest Agreement. Vendor acknowledges that a Joint Defense and Common Interest Agreement (the "JDA") exists among the Respondents and their co-respondents in the above-described investigation. Notwithstanding the existence of the JDA, Vendor shall not share any data, documents, work product, or information of any kind with counsel for the co-respondents—specifically, Whitfield, Strauss & DeVane LLP (counsel for Galloway Petroleum Corp.) or Archer Colby LLP (counsel for Ridgeline Energy Partners LLC)—or with any e-discovery vendors or other service providers retained by such co-respondents' counsel, without Client's express written direction. Any such sharing, if authorized by Client, shall be conducted in accordance with the terms of the JDA and any applicable protocols established by the parties to the JDA.

6.4 Individual Confidentiality Agreements. All Vendor personnel who will have access to data collected, processed, or hosted in connection with this SOW—including but not limited to project managers, processing technicians, quality-control analysts, and support staff—shall execute individual confidentiality and non-disclosure agreements in a form approved by Client prior to being granted access to any such data. Vendor shall provide executed copies of all such confidentiality agreements to Client upon request.

SECTION 7: POINTS OF CONTACT

7.1 Client Contact. The primary point of contact for Client with respect to all matters arising under this SOW shall be:

Monica Reyes Senior Associate Calderwood & Harkness LLP 1900 K Street NW, Suite 1100 Washington, DC 20006

Email: mreyes@calderwoodharkness.com

Telephone: (202) 555-0147

7.2 Vendor Contact. The primary point of contact for Vendor with respect to all matters arising under this SOW shall be:

Daniel Furrow Project Manager Brindoval Analytics LLC 8400 Leesburg Pike, Suite 320 Tysons Corner, VA 22182

Email: dfurrow@crestviewanalytics.com

Telephone: (703) 555-0263

7.3 Escalation Contacts. In the event that any matter arising under this SOW cannot be resolved through the primary contacts identified above, the following escalation contacts shall be available:

• Client Escalation Contact: Howard Bellamy, Partner, Antitrust & Competition Practice Group, Calderwood & Harkness LLP; hbellamy@calderwoodharkness.com; (202) 555-0112.

• Vendor Escalation Contact: Vendor's designated account executive, to be named by Vendor within five (5) business days of SOW execution and communicated to Client in writing.

7.4 Status Meetings. Vendor shall participate in weekly status meetings with Client (or at such other frequency as Client may request) to discuss project progress, issues, and upcoming milestones. Status meetings may be conducted by telephone, videoconference, or in person, as determined by Client.

SECTION 8: TERM AND TERMINATION

8.1 Effective Date and Term. This SOW is effective as of September 12, 2025 (the "Effective Date"), and shall remain in effect until the completion of all services described herein through the November 3, 2025 CID response deadline (collectively, the "Phase 1 Services"), unless earlier terminated in accordance with this Section 8. Following the completion of Phase 1 Services, the Parties may extend the term of this SOW by mutual written agreement to cover additional phases of work, including any follow-on production requests, supplemental productions, or additional investigative demands.

8.2 Termination for Convenience. Either Party may terminate this SOW at any time, with or without cause, upon fifteen (15) days' prior written notice to the other Party. In the event of termination by Client, Vendor shall promptly cease all work, except as necessary to preserve and secure data, and shall cooperate with Client to ensure an orderly transition of data and work product.

8.3 Data Return or Destruction. Upon termination or expiration of this SOW, Vendor shall, at Client's election, either (a) return all Client data—including all collected data, processed data, work product, and copies thereof—to Client in a format and on media reasonably specified by Client, or (b) securely destroy all Client data using methods consistent with NIST Special Publication 800-88, Guidelines for Media Sanitization, and provide Client with a written certification of destruction signed by an authorized representative of Vendor. Client shall make its election within thirty (30) days of termination or expiration. Pending Client's election, Vendor shall continue to securely store all Client data in accordance with the data-security requirements set forth in Section 5.

8.4 Survival of Payment Obligations. Notwithstanding termination, Client's obligation to pay fees for services performed by Vendor through the effective date of termination shall survive. Vendor shall submit a final invoice within fifteen (15) days of the effective date of termination, and Client shall pay such invoice in accordance with the payment terms set forth in Section 4.3.

SECTION 9: LIMITATION OF LIABILITY / INDEMNIFICATION

9.1 Mutual Indemnification. Each Party (the "Indemnifying Party") shall indemnify, defend, and hold harmless the other Party and its partners, members, officers, directors, employees, and agents (collectively, the "Indemnified Parties") from and against any and all third-party claims, actions, suits, proceedings, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from (a) the Indemnifying Party's breach of any representation, warranty, or obligation under this SOW, (b) the Indemnifying Party's negligence or willful misconduct in the performance of its obligations under this SOW, or (c) any violation of applicable law by the Indemnifying Party in connection with this SOW.

9.2 Limitation of Vendor Liability. Except in cases of willful misconduct, gross negligence, or breach of Vendor's confidentiality or data-security obligations under Sections 5 and 6 of this SOW, Vendor's aggregate liability to Client under or in connection with this SOW shall not exceed the total fees actually paid by Client to Vendor under this SOW as of the date on which the claim giving rise to liability arose. In no event shall either Party be liable to the other Party for any indirect, incidental, consequential, special, or punitive damages, including loss of profits, loss of data (other than data in Vendor's custody), or loss of business opportunity, regardless of the form of action and whether such damages were foreseeable.

9.3 Vendor Indemnification for Data Breach. Without limiting the generality of Section 9.1, Vendor shall indemnify, defend, and hold harmless Client and the Respondents from and against any and all third-party claims, regulatory actions, fines, penalties, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees and the costs of notification, credit monitoring, and remediation) arising out of or resulting from any breach of Vendor's confidentiality or data-security obligations under Sections 5 and 6 of this SOW, including but not limited to any unauthorized access to, disclosure of, or loss of data collected, processed, or hosted by Vendor in connection with this SOW.

SECTION 10: GENERAL PROVISIONS

10.1 Independent Contractor. Vendor is an independent contractor and is not an employee, agent, partner, or joint venturer of Client. Nothing in this SOW shall be construed to create any relationship of employment, agency, partnership, or joint venture between the Parties. Vendor shall be solely responsible for the compensation, benefits, and tax obligations of its personnel.

10.2 Amendment. This SOW may not be amended, modified, or supplemented except by a written instrument signed by authorized representatives of both Parties. No waiver of any provision of this SOW shall be effective unless made in writing and signed by the waiving Party.

10.3 Notices. All notices, requests, demands, and other communications required or permitted under this SOW shall be in writing and shall be deemed to have been duly given when (a) delivered personally, (b) sent by confirmed email to the addresses specified in Section 7, (c) sent by nationally recognized overnight courier service, or (d) sent by certified or registered mail, return receipt requested, postage prepaid, addressed to the Parties at the addresses specified in the Contracting Parties Block of this SOW or to such other address as either Party may designate by written notice.

10.4 Governing Law. This SOW shall be governed by, and construed in accordance with, the laws of the Commonwealth of Virginia, without regard to its conflict-of-laws principles. Any dispute arising out of or relating to this SOW shall be resolved exclusively in the state or federal courts located in Fairfax County, Virginia, and each Party hereby consents to the personal jurisdiction of such courts.

10.5 Entire Agreement. This SOW, together with any Master Services Agreement between the Parties and any attachments, exhibits, or schedules hereto, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations, and discussions, whether oral or written, relating to the scope of e-discovery services for C&H Matter No. 1016-00001. Neither Party has relied on any representation, warranty, or promise not expressly set forth in this SOW.

10.6 Severability. If any provision of this SOW is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable, and the remaining provisions of this SOW shall continue in full force and effect.

10.7 Counterparts. This SOW may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Electronic signatures and signatures transmitted by facsimile or PDF shall be deemed to be original signatures for all purposes.

10.8 Assignment. Neither Party may assign or transfer this SOW or any rights or obligations hereunder without the prior written consent of the other Party, except that Client may assign this SOW to a successor firm without Vendor's consent.

SIGNATURE PAGE

IN WITNESS WHEREOF, the Parties have caused this Statement of Work to be executed by their respective authorized representatives as of the date first written above.

CALDERWOOD & HARKNESS LLP

By: ________

Name: Monica Reyes

Title: Senior Associate

Date: September 12, 2025

BRINDOVAL ANALYTICS LLC

By: ________

Name: Daniel Furrow

Title: Project Manager

Date: September 12, 2025

Field	Description
Bates Begin	Beginning Bates number of the withheld document
Bates End	Ending Bates number of the withheld document
Date	Date of the document or communication
Author	Author or sender of the document or communication
Recipient(s)	Recipient(s) (To line)
CC	CC recipient(s)
Document Type	Type of document (e.g., email, memorandum, letter)
Subject / Description	Subject line or brief description of the document
Basis for Privilege	Applicable privilege (e.g., attorney-client privilege, work product)
Milestone	Target Date
SOW Execution	September 12, 2025
Forensic Collection — Start	September 19, 2025
Forensic Collection — Complete	September 26, 2025
Processing & Deduplication Complete	October 3, 2025
Search-Term Culling Complete	October 7, 2025
TAR Training Begins	October 10, 2025
TAR Validation Checkpoint 1	October 20, 2025
Review Complete	October 27, 2025
Production Ready (QC'd)	October 31, 2025
CID Response Deadline (Extended)	November 3, 2025
Service	Unit Rate	Estimated Cost
Forensic Collection (on-site)	$3,200 per day (estimated 7 days)	$22,400
Cloud Collection (M365, Enterprise Vault)	$1,500 per custodian (5 custodians)	$7,500
Non-Custodial Source Collection	Flat fee	$8,500

Processing	$18 per GB (estimated 132.4 GB)	$2,383
Hosting (Kestrel Technologies)	$15 per GB per month (132.4 GB × 3 months)	$5,958
TAR — Active Learning Setup	Flat fee	$12,000
TAR — Ongoing Analytics	$4,500 per month (estimated 2 months)	$9,000
Review Platform Licensing	$35 per user per month (10 users × 3 months)	$1,050
Production (TIFF + load files)	$0.06 per page	Estimated; varies based on production volume
Project Management	$225 per hour	Estimated; varies based on hours incurred
Estimated Total (Phase 1)	$385,000 (approximate)

STATEMENT OF WORK — E-DISCOVERY SERVICES
CALDERWOOD & HARKNESS LLP
September 12, 2025
C&H Matter No. 1016-00001
CONTRACTING PARTIES
This Statement of Work ("SOW") is entered into as of September 12, 2025, by and between:
Client: Calderwood & Harkness LLP ("Client" or "C&H"), a limited liability partnership organized and existing under the laws of the District of Columbia, with offices located at 1900 K Street NW, Suite 1100, Washington, DC 20006.
Vendor: Brindoval Analytics LLC ("Vendor" or "Brindoval"), a limited liability company organized and existing under the laws of the Commonwealth of Virginia, with its principal place of business located at 8400 Leesburg Pike, Suite 320, Tysons Corner, VA 22182.
Client and Vendor are referred to individually as a "Party" and collectively as the "Parties."
This SOW sets forth the terms and conditions under which Vendor will provide certain electronic discovery services to Client in connection with the matter described in Section 1 below. This SOW is governed by and incorporates the terms of any existing Master Services Agreement between the Parties. To the extent of any conflict between this SOW and any such Master Services Agreement, the terms of this SOW shall control with respect to the services described herein.
SECTION 1: PROJECT OVERVIEW
1.1 Engagement Description. Vendor will provide comprehensive electronic discovery services—including forensic collection, processing, deduplication, hosting, technology-assisted review, and production—in connection with Client's defense of Dunmore Energy Holdings Ltd. ("DEH"), a Cayman Islands exempted limited company with operational headquarters at 4100 Westchase Boulevard, Suite 1200, Houston, TX 77042, and DEH's wholly-owned subsidiary, Dunmore Fuel Supply, Inc. ("DFS"), a corporation organized under the laws of the State of Delaware and headquartered at the same Houston address (DEH and DFS are collectively referred to herein as the "Respondents").
1.2 Underlying Matter. The engagement arises from a pending state attorney general antitrust investigation. On August 22, 2025, the Office of the Attorney General of the State of Meridian, Antitrust Division, located at 500 Capitol Avenue, Suite 300, Baxter City, Meridian 39201, issued Civil Investigative Demand No. AG-ANT-2025-04172 (the "CID") to the Respondents. The CID was issued pursuant to the Meridian Antitrust Enforcement Act, §§ 45-7-101 through 45-7-118, and seeks documents and communications relevant to an investigation into allegations of bid rigging in connection with fuel-supply contracts awarded by the Meridian State Department of Transportation ("Meridian DOT") during the period from January 2021 through December 2024. The investigation concerns competitive procurement processes for bulk fuel supply used by Meridian DOT in its statewide fleet operations, road maintenance equipment fueling, and transportation infrastructure programs.
1.3 Co-Respondents. DEH and DFS are respondents to the CID alongside two co-respondents: (a) Galloway Petroleum Corp., a Delaware corporation with its principal place of business in Birmingham, Alabama; and (b) Ridgeline Energy Partners LLC, a Georgia limited liability company with its principal place of business in Duluth, Georgia. Co-respondents are represented by separate counsel, as further addressed in Section 6 of this SOW.
1.4 Client Supervision. Client serves as lead outside counsel for the Respondents in the above-described investigation. The engagement is supervised by Howard Bellamy, Partner, Antitrust & Competition Practice Group, Calderwood & Harkness LLP. Day-to-day management of the engagement, including all communications with Vendor relating to the services described in this SOW, is the responsibility of Monica Reyes, Senior Associate, Antitrust & Competition Practice Group, Calderwood & Harkness LLP.
1.5 Matter Reference. All invoices, correspondence, work product, and deliverables prepared or submitted in connection with this SOW shall reference C&H Matter No. 1016-00001.
SECTION 2: SCOPE OF SERVICES
The services to be provided by Vendor under this SOW are organized into five sequential phases, as described below. Each phase is dependent upon the successful completion of the preceding phase, except where otherwise noted. Vendor shall perform all services in a professional and workmanlike manner consistent with prevailing industry standards for electronic discovery and digital forensics.
2.1 Phase 1: Forensic Collection
2.1.1 Custodian Device Collection. Vendor shall perform forensic imaging of laptops, desktops, and mobile devices belonging to the following five (5) identified custodians (the "Custodians"). Forensic imaging shall be performed using industry-standard forensic tools and shall produce bit-for-bit copies of all storage media associated with each Custodian's devices. The estimated data volumes set forth below are based on preliminary assessments conducted by DFS's internal IT department and communicated to Client on September 5, 2025. Actual data volumes may vary.
1.  Terrence "Terry" Kinloch — Vice President, Government Contracts, DFS. Estimated data volume: 42.7 GB, comprising approximately 186,000 documents. Mr. Kinloch's devices include one Kestrel Solutions laptop, one Brightmoor Group OptiPlex 7000 desktop, and one Ashbury Corporation 14 Pro (company-issued). Mr. Kinloch served as the primary DFS executive responsible for responses to Meridian DOT RFPs and is expected to be a key custodian.
2.  Sandra Ochoa — Director of Pricing & Analytics, DFS. Estimated data volume: 31.4 GB, comprising approximately 142,000 documents. Ms. Ochoa's devices include one Lenovo ThinkPad X1 Carbon laptop and one Northgate & Co. Galaxy S23 (company-issued). Ms. Ochoa was responsible for developing pricing models and bid calculations submitted in connection with Meridian DOT fuel-supply solicitations.
3.  Nolan Prescott — Regional Sales Manager, Southeastern United States, DFS. Estimated data volume: 18.9 GB, comprising approximately 95,000 documents. Mr. Prescott's devices include one Brightmoor Group Latitude 5530 laptop and one Ashbury Corporation 13 (company-issued). Mr. Prescott maintained direct client relationships with Meridian DOT procurement personnel and participated in industry trade association events relevant to the investigation.
4.  Patricia Aldridge — Senior Vice President & General Counsel, DEH. Estimated data volume: 27.3 GB, comprising approximately 118,000 documents. Ms. Aldridge's devices include one Tidewater Industries MacBook Pro 14" laptop, one Brightmoor Group OptiPlex 7090 desktop, and one Brightwater Systems (company-issued). Ms. Aldridge provided legal counsel to DFS in connection with government contract compliance and antitrust matters. Documents collected from Ms. Aldridge's devices are expected to include a significant volume of potentially privileged communications.
5.  Malcolm Haverford — Chief Executive Officer, DEH. Estimated data volume: 12.1 GB, comprising approximately 63,000 documents. Mr. Haverford's devices include one Tidewater Industries MacBook Pro 16" laptop and one Brightwater Systems Max (company-issued). While Mr. Haverford was not directly involved in day-to-day Meridian DOT bid preparation, he received periodic briefings from Mr. Kinloch and Ms. Aldridge regarding government contract strategy and is identified as a custodian due to his receipt of reports and board-level communications.
2.1.2 Cloud-Hosted Data Collection. Vendor shall collect cloud-hosted data from the DEH/DFS Ashgrove Software tenant for all five Custodians. The scope of cloud-hosted data collection includes the following Ashgrove Software services:
•  Drayton Solutions: Complete mailbox contents for each Custodian, including inbox, sent items, deleted items, drafts, archive folders, calendar items, and contacts.
•  Westvale Services Inc.: All documents stored in Aldermere Systems sites to which each Custodian had access or for which each Custodian is identified as an author or last modifier during the relevant time period.
•  Northgate Data Systems: All Teams chat messages (one-to-one and group chats), channel messages, and files shared in Teams channels for each Custodian.
Cloud data collection shall be performed using Sterling Reach Systems eDiscovery tools or comparable Vendor-approved third-party collection tools that provide defensible, auditable collection with complete metadata preservation.
2.1.3 Archived Email Collection. Vendor shall collect archived email from the DFS Brightwater Solutions system for all five Custodians. The temporal scope of the Enterprise Vault collection shall cover the period from January 1, 2020 through the date of collection. The Parties acknowledge that the earliest alleged conspiratorial conduct identified in the CID concerns the period beginning January 2021. The temporal scope of the Enterprise Vault collection extends back to January 1, 2020—one year before the earliest date of alleged conspiratorial conduct—in order to capture potential pre-conspiracy communications that may be relevant to the defense, including any communications bearing on market conditions, pricing methodologies, and competitive dynamics preceding the period of alleged coordination. This extended temporal scope is consistent with Client's litigation-hold memorandum dated September 3, 2025, and reflects Client's professional judgment regarding the appropriate scope of preservation and collection in light of the Respondents' obligation to respond to the CID in good faith.
2.1.4 Non-Custodial Data Source Collection. Vendor shall collect data from the following designated non-custodial data sources:
•  DFS Shared Network Drive: Vendor shall collect all files and folders located on the DFS shared network drive at the following path: \\\\DFS-FILE01\\GovContracts\\. This network share contains centralized government contracts documentation, bid preparation files, and related materials maintained by the DFS Government Contracts team. Vendor shall perform a complete copy of this directory, preserving all original metadata, including file creation dates, modification dates, and access control information.
•  DFS Pricing Database ("FuelPricer" Application): Vendor shall work with DFS's internal IT department to export relevant data from the FuelPricer proprietary pricing application. Exports shall be provided in .csv and .xlsx format and shall include all pricing models, bid calculations, cost analyses, and related data pertaining to Meridian DOT solicitations during the relevant period. DFS's IT department will perform the data extraction under Vendor's supervision, and Vendor shall verify the completeness and integrity of the exported data.
•  DFS Quillon Data Systems Instance: Vendor shall perform a targeted export from the DFS Quillon Data Systems instance (accessible at dfs.my.Pinnacle Health IT.com). The Pinnacle Health IT export shall be limited to Meridian-related accounts, opportunities, activities, tasks, and communications. Vendor shall work with DFS's Pinnacle Health IT administrator to identify and extract all relevant object records using appropriate filters (including, without limitation, account name, opportunity stage, and geographic filters for Meridian-related records).
2.1.5 Chain-of-Custody Documentation. Vendor shall prepare and maintain defensible chain-of-custody documentation for all collections performed under this Phase 1. Chain-of-custody documentation shall include, at a minimum:
•  Identification of the collecting technician(s);
•  Date, time, and location of each collection activity;
•  Description of the device(s) or data source(s) collected;
•  Serial numbers, asset tags, or other unique identifiers for each physical device;
•  Hash verification of all collected data using both MD5 and SHA-256 algorithms;
•  Documentation of the storage media used for transport and storage of collected data; and
•  A continuous, unbroken chain-of-custody log from the point of collection through ingestion into Vendor's processing environment.
2.1.6 Collection Timeline. All collection activities described in this Section 2.1 shall commence no later than September 19, 2025, with a targeted completion date of September 26, 2025. Vendor shall coordinate on-site collection activities with DFS's IT department (primary contact: James Yun, IT Director, DFS; jyun@dunmorefuel.com) and shall provide Client with at least forty-eight (48) hours' advance notice of all on-site collection dates.
2.2 Phase 2: Processing and Deduplication
2.2.1 Data Ingestion. Upon completion of Phase 1 collection activities, Vendor shall ingest all collected data into Vendor's proprietary or licensed processing platform. Vendor shall maintain a detailed ingestion log documenting all data sets ingested, volumes, and any errors or exceptions encountered during ingestion.
2.2.2 Deduplication. Vendor shall apply global deduplication across all Custodians using MD5 hash values. Global deduplication will eliminate exact duplicate documents across the entire collection population, reducing overall document volume and eliminating redundant review. Vendor shall retain a deduplication log identifying all documents removed through the deduplication process, including the hash values of deduplicated items and the custodian(s) from whom each duplicate instance was collected.
2.2.3 Text and Metadata Extraction. Vendor shall extract full text and metadata from all file types present in the collected data. For documents that do not contain extractable text (e.g., image-only PDFs, scanned documents), Vendor shall apply optical character recognition (OCR) to generate searchable text. Vendor shall extract all available metadata fields, including but not limited to author, date created, date modified, date last accessed, file path, file size, file type, email sender, email recipients (To, CC, BCC), email subject, and email date sent/received.
2.2.4 Date Filtering. Vendor shall apply a date filter to restrict the processed data population to documents and communications dated January 1, 2020 through the date of processing. Documents lacking a discernible date (i.e., documents for which no date metadata is available and no date is evident from the document content) shall be retained in the population for manual review and shall not be excluded by the date filter.
2.2.5 Search-Term Culling. Following deduplication and date filtering, Vendor shall apply search terms provided by Client as a first-pass culling step to further reduce the document population to a potentially relevant review set. Client will provide search terms to Vendor in writing. Vendor shall run the search terms against the full text and key metadata fields (including email subject lines, file names, and file paths) and shall provide Client with hit reports showing the number of documents responsive to each individual search term and each combination of terms, to enable Client to refine the search-term list as necessary.
2.2.6 Estimated Volumes. The estimated input volume for Phase 2 processing is 132.4 GB, comprising approximately 604,000 documents (reflecting the sum of estimated data across all five Custodians and all non-custodial sources). Based on Vendor's experience with similar data populations in comparable antitrust investigations, the estimated post-processing, post-deduplication document volume is approximately 380,000 unique documents. These estimates are subject to revision based on actual collection volumes and deduplication rates.
2.3 Phase 3: Hosting and Review Platform
2.3.1 Hosting Environment. Vendor shall host the processed document population on Vendor's Relativity instance, specifically on the Brindoval Kestrel Technologies tenant (cloud-hosted). The Kestrel Technologies workspace shall be configured and made available to Client within three (3) business days following the completion of processing and deduplication described in Phase 2.
2.3.2 Workspace Configuration. Vendor shall configure the review workspace with the following coding fields, layouts, and views, as directed by Client:
Coding Fields:
•  Responsiveness: Single-choice field with the following options: Responsive; Not Responsive; Needs Further Review.
•  Privilege: Single-choice field with the following options: Privileged; Not Privileged; Needs Privilege Review.
•  Confidentiality: Single-choice field with the following options: Confidential; Highly Confidential; Not Designated.
•  Issue Tags: Multi-choice field with the following options: Bid Coordination; Pricing Strategy; Competitor Communication; Trade Association; Meridian DOT; Other.
•  Custodian: Single-choice field, auto-populated based on custodian assignment during processing.
•  Date Range: Date field, auto-populated based on extracted metadata.
Additional coding fields, layouts, views, saved searches, and dashboards may be requested by Client during the course of the engagement. Vendor shall implement reasonable additional configuration requests at no additional charge, provided that such requests do not require significant custom development. Requests requiring significant custom development will be scoped and priced separately by mutual agreement.
2.3.3 User Access. Vendor shall provide user access to the Kestrel Technologies workspace for up to ten (10) concurrent reviewers designated by Client. Client shall provide Vendor with the names and email addresses of authorized reviewers. Vendor shall provision user accounts within one (1) business day of receiving Client's access request. All users shall authenticate using multi-factor authentication. Vendor shall maintain an access log documenting all user login and logout activity.
2.4 Phase 4: Technology-Assisted Review (TAR)
2.4.1 TAR Protocol. Vendor shall implement a Technology-Assisted Review protocol using the TAR 2.0 (continuous active learning) methodology, leveraging the Kestrel Health IT module within the Brindoval Kestrel Technologies tenant. The continuous active learning model will prioritize the most likely responsive documents for review, continuously updating the model's predictions as reviewers code documents, thereby increasing review efficiency and reducing the volume of documents requiring manual review.
2.4.2 Subject-Matter Expert Training. Client's attorneys shall serve as subject-matter experts ("SMEs") for training-round coding. The primary SMEs for this engagement are:
•  Monica Reyes, Senior Associate, Calderwood & Harkness LLP; and
•  Elliot Nguyen, Associate, Calderwood & Harkness LLP.
Additional contract reviewers from the C&H document-review team may participate in coding under the supervision of Ms. Reyes and Mr. Nguyen. All SME and reviewer coding decisions will be subject to quality-control review by Client's lead attorneys to ensure consistency and accuracy.
2.4.3 Statistical Validation Reporting. Vendor shall provide Client with statistical validation reports at each training checkpoint during the TAR process. Each validation report shall include the following metrics, calculated using a statistically valid random sample of the document population:
•  Recall: The proportion of all responsive documents in the collection that the TAR model has identified as responsive (i.e., the percentage of truly responsive documents captured by the model).
•  Precision: The proportion of documents identified as responsive by the TAR model that are, in fact, responsive upon manual review (i.e., the accuracy of the model's responsive predictions).
•  Elusion: The proportion of documents in the non-reviewed or model-predicted non-responsive population that are, in fact, responsive (i.e., the rate of responsive documents "missed" by the model in the uncoded remainder).
Validation sample sizes shall be determined based on a confidence level of 95% and a margin of error of ±2%, unless Client and Vendor agree to alternative parameters.
2.4.4 Target Recall Rate. The target recall rate for the TAR protocol is ≥ 80%. This target is consistent with prevailing judicial expectations and case law regarding the defensibility of TAR protocols. Vendor shall continue model training until the target recall rate is achieved or until Client determines, in its professional judgment, that additional training is unlikely to materially improve recall.
2.4.5 TAR Timeline. TAR 2.0 model training shall commence on October 10, 2025, following the completion of processing, deduplication, and search-term culling. The first validation checkpoint is targeted for October 20, 2025.
2.4.6 TAR Validation Summary Report. Upon completion of the TAR process, Vendor shall prepare a comprehensive TAR validation summary report documenting the TAR protocol, training methodology, validation methodology, and final statistical metrics. This report shall be prepared in a format suitable for disclosure to the Office of the Attorney General of the State of Meridian, if requested, to demonstrate the defensibility and reasonableness of the Respondents' review methodology. The TAR validation summary report shall be delivered to Client no later than three (3) business days following the completion of the review described in Section 3.
2.5 Phase 5: Production
2.5.1 Production Format. Vendor shall produce responsive, non-privileged documents in the following format:
•  Image Files: Single-page TIFF images (Group IV, 300 DPI, black and white), with color TIFF or JPEG images produced for documents where color is material to the content (e.g., charts, graphs, maps, photographs).
•  Extracted Text: Document-level extracted text files (.txt), with one text file per document, named to correspond to the beginning Bates number of the associated document.
•  Load Files:
•  Ashgrove Technologies load file (.dat), containing all metadata and coding fields;
•  Relativity image load file (.opt), mapping Bates numbers to TIFF image file paths.
•  Native Productions: Spreadsheets (Ashbury Holdings Excel, .xlsx and .xls) and databases shall be produced in native format with extracted metadata, in addition to TIFF images. Native files shall be named using the beginning Bates number of the associated document.
2.5.2 Bates Numbering. All produced documents shall be assigned sequential Bates numbers using the following prefix and format: DEH-MERID-000001 through DEH-MERID-[final]. Bates numbers shall appear as endorsements on the lower-right corner of each TIFF image. Vendor shall maintain a Bates number register and shall ensure that no gaps or duplications occur in the Bates numbering sequence.
2.5.3 Privilege Log. Vendor shall assist Client in preparing a privilege log in spreadsheet format (.xlsx). The privilege log shall contain the following fields for each document or communication withheld on the basis of privilege:
Client's attorneys shall make all final privilege determinations. Vendor's role in privilege log preparation is limited to populating metadata fields and formatting the privilege log based on Client's coding decisions.
2.5.4 Production Delivery. Completed productions shall be delivered to Client on encrypted USB drives, using AES-256 hardware encryption. Each USB drive shall be password-protected, and the password shall be transmitted to Client separately via a secure communication channel (encrypted email or secure file transfer). Vendor shall include a production cover letter with each delivery identifying the volume number, Bates range, document count, and page count of the enclosed production.
SECTION 3: TIMELINE / MILESTONES
The following table sets forth the target milestones and dates for the services described in this SOW. The Parties acknowledge that these dates are targets and that actual dates may vary depending on data volumes, collection logistics, Client review capacity, and other factors. Vendor shall promptly notify Client of any anticipated delays and shall propose revised timelines for Client's approval.
Extension of CID Response Deadline. The original CID response deadline was October 3, 2025—forty (40) calendar days from the August 22, 2025 date of issuance, as required by Section 45-7-109(b) of the Meridian Antitrust Enforcement Act. Calderwood & Harkness, on behalf of the Respondents, submitted a written request for an extension of the response deadline to the Office of the Attorney General of the State of Meridian on September 22, 2025, citing the volume and complexity of the data collection and review required. The extension request was granted by the Attorney General's office on September 26, 2025, extending the CID response deadline to November 3, 2025. A copy of the extension correspondence is maintained in the C&H matter file. The timeline set forth above is designed to ensure that the Respondents' production is completed with adequate time for final quality control prior to the extended November 3, 2025 deadline.
SECTION 4: PRICING
4.1 Unit-Rate Pricing. Vendor shall perform the services described in this SOW at the following unit rates. The estimated costs set forth below are based on the estimated data volumes and timelines described in this SOW and are provided for budgeting purposes only. Actual costs will depend on actual data volumes, processing requirements, hosting duration, production volumes, and project management hours.
4.2 Invoicing. Vendor shall invoice Client on a monthly basis for services performed during the preceding calendar month. Each invoice shall include a detailed breakdown of charges by service category, unit rate, quantity, and total amount, together with supporting documentation sufficient to allow Client to verify the accuracy of each charge. Invoices shall reference C&H Matter No. 1016-00001.
4.3 Payment Terms. Client shall pay each invoice within thirty (30) days of receipt. Vendor shall submit invoices to Client at the following email address: mreyes@calderwoodharkness.com, with a copy to invoices@calderwoodharkness.com.
4.4 Cost Overrun Notification. Vendor shall promptly notify Client in writing if projected costs are expected to exceed the estimated total set forth in Section 4.1 by more than ten percent (10%) (i.e., by more than $38,500). Vendor shall not incur costs in excess of the estimated total without Client's prior written approval, which may be given by email from Monica Reyes or Howard Bellamy.
4.5 Pass-Through of Vendor Costs. Client will pass through Vendor's costs to DEH/DFS at Vendor's invoiced rates without markup, in accordance with the terms of the engagement letter between Calderwood & Harkness LLP and DEH dated August 27, 2025. Vendor acknowledges that Client's ability to pay Vendor's invoices is dependent upon Client's receipt of corresponding payment from DEH/DFS, provided that Client's payment obligation to Vendor is not contingent upon Client's receipt of payment from DEH/DFS.
SECTION 5: DATA SECURITY
5.1 Data Center. All data collected, processed, and hosted by Vendor in connection with this SOW shall be stored in Vendor's SOC 2 Type II–certified data center located in Ashburn, Virginia. Vendor represents and warrants that the data center has been the subject of a SOC 2 Type II examination performed by an independent auditor within the preceding twelve (12) months, and that the examination report identified no material deficiencies in the design or operating effectiveness of the data center's controls relating to security, availability, processing integrity, confidentiality, or privacy. Upon Client's request, Vendor shall provide Client with a copy of the most recent SOC 2 Type II examination report, subject to any applicable confidentiality restrictions imposed by the auditor.
5.2 Encryption at Rest. All data at rest in Vendor's systems—including data stored on servers, storage arrays, backup media, and portable devices—shall be encrypted using the Advanced Encryption Standard with a key length of 256 bits (AES-256). Encryption keys shall be managed in accordance with industry-standard key management practices and shall not be stored on the same media as the encrypted data.
5.3 Encryption in Transit. All data in transit between Client and Vendor, between Vendor and the Respondents' IT systems, and within Vendor's internal network shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher. Vendor shall not transmit any data collected, processed, or hosted under this SOW using unencrypted channels.
5.4 Cyber-Liability Insurance. Vendor represents and warrants that it maintains cyber-liability insurance with Hargrove Mutual Insurance Co. with a per-occurrence limit of not less than $10,000,000. Vendor shall maintain such insurance coverage in full force and effect throughout the term of this SOW and for a period of not less than two (2) years following the expiration or termination of this SOW. Upon Client's request, Vendor shall provide Client with a certificate of insurance evidencing such coverage.
5.5 Data-Breach Notification. Vendor shall comply with all applicable federal, state, and local laws, regulations, and industry standards relating to data security, including without limitation the Virginia Consumer Data Protection Act and any applicable breach notification statutes. In the event of any data breach, unauthorized access, or security incident involving data collected, processed, or hosted under this SOW, Vendor shall notify Client in writing within twenty-four (24) hours of becoming aware of such breach, access, or incident. The notification shall include a description of the nature and scope of the breach, the data affected, the measures taken to contain and remediate the breach, and any recommended actions for Client or the Respondents.
5.6 Access Controls. Vendor shall implement and maintain appropriate physical and logical access controls to restrict access to data collected, processed, and hosted under this SOW to authorized personnel only. Access shall be granted on a least-privilege, need-to-know basis. Vendor shall maintain an access control log and shall provide Client with a list of Vendor personnel authorized to access the data upon request.
SECTION 6: CONFIDENTIALITY
6.1 Privileged and Protected Materials. Vendor acknowledges that all data collected, processed, hosted, reviewed, and produced in connection with this SOW may be subject to the attorney-client privilege, the work-product doctrine, or both. Vendor's services are performed at the direction of Client for the purpose of assisting Client in providing legal advice and services to the Respondents. Vendor shall treat all such data as privileged and confidential at all times.
6.2 Non-Disclosure. Vendor shall not disclose any data or information collected, processed, hosted, or otherwise obtained in connection with this SOW to any third party without prior written authorization from Client. This obligation extends to all Vendor personnel, subcontractors, and agents. Vendor shall not use any such data or information for any purpose other than the performance of services under this SOW.
6.3 Joint Defense and Common Interest Agreement. Vendor acknowledges that a Joint Defense and Common Interest Agreement (the "JDA") exists among the Respondents and their co-respondents in the above-described investigation. Notwithstanding the existence of the JDA, Vendor shall not share any data, documents, work product, or information of any kind with counsel for the co-respondents—specifically, Whitfield, Strauss & DeVane LLP (counsel for Galloway Petroleum Corp.) or Archer Colby LLP (counsel for Ridgeline Energy Partners LLC)—or with any e-discovery vendors or other service providers retained by such co-respondents' counsel, without Client's express written direction. Any such sharing, if authorized by Client, shall be conducted in accordance with the terms of the JDA and any applicable protocols established by the parties to the JDA.
6.4 Individual Confidentiality Agreements. All Vendor personnel who will have access to data collected, processed, or hosted in connection with this SOW—including but not limited to project managers, processing technicians, quality-control analysts, and support staff—shall execute individual confidentiality and non-disclosure agreements in a form approved by Client prior to being granted access to any such data. Vendor shall provide executed copies of all such confidentiality agreements to Client upon request.
SECTION 7: POINTS OF CONTACT
7.1 Client Contact. The primary point of contact for Client with respect to all matters arising under this SOW shall be:
Monica Reyes Senior Associate Calderwood & Harkness LLP 1900 K Street NW, Suite 1100 Washington, DC 20006
Email: mreyes@calderwoodharkness.com
Telephone: (202) 555-0147
7.2 Vendor Contact. The primary point of contact for Vendor with respect to all matters arising under this SOW shall be:
Daniel Furrow Project Manager Brindoval Analytics LLC 8400 Leesburg Pike, Suite 320 Tysons Corner, VA 22182
Email: dfurrow@crestviewanalytics.com
Telephone: (703) 555-0263
7.3 Escalation Contacts. In the event that any matter arising under this SOW cannot be resolved through the primary contacts identified above, the following escalation contacts shall be available:
•  Client Escalation Contact: Howard Bellamy, Partner, Antitrust & Competition Practice Group, Calderwood & Harkness LLP; hbellamy@calderwoodharkness.com; (202) 555-0112.
•  Vendor Escalation Contact: Vendor's designated account executive, to be named by Vendor within five (5) business days of SOW execution and communicated to Client in writing.
7.4 Status Meetings. Vendor shall participate in weekly status meetings with Client (or at such other frequency as Client may request) to discuss project progress, issues, and upcoming milestones. Status meetings may be conducted by telephone, videoconference, or in person, as determined by Client.
SECTION 8: TERM AND TERMINATION
8.1 Effective Date and Term. This SOW is effective as of September 12, 2025 (the "Effective Date"), and shall remain in effect until the completion of all services described herein through the November 3, 2025 CID response deadline (collectively, the "Phase 1 Services"), unless earlier terminated in accordance with this Section 8. Following the completion of Phase 1 Services, the Parties may extend the term of this SOW by mutual written agreement to cover additional phases of work, including any follow-on production requests, supplemental productions, or additional investigative demands.
8.2 Termination for Convenience. Either Party may terminate this SOW at any time, with or without cause, upon fifteen (15) days' prior written notice to the other Party. In the event of termination by Client, Vendor shall promptly cease all work, except as necessary to preserve and secure data, and shall cooperate with Client to ensure an orderly transition of data and work product.
8.3 Data Return or Destruction. Upon termination or expiration of this SOW, Vendor shall, at Client's election, either (a) return all Client data—including all collected data, processed data, work product, and copies thereof—to Client in a format and on media reasonably specified by Client, or (b) securely destroy all Client data using methods consistent with NIST Special Publication 800-88, Guidelines for Media Sanitization, and provide Client with a written certification of destruction signed by an authorized representative of Vendor. Client shall make its election within thirty (30) days of termination or expiration. Pending Client's election, Vendor shall continue to securely store all Client data in accordance with the data-security requirements set forth in Section 5.
8.4 Survival of Payment Obligations. Notwithstanding termination, Client's obligation to pay fees for services performed by Vendor through the effective date of termination shall survive. Vendor shall submit a final invoice within fifteen (15) days of the effective date of termination, and Client shall pay such invoice in accordance with the payment terms set forth in Section 4.3.
SECTION 9: LIMITATION OF LIABILITY / INDEMNIFICATION
9.1 Mutual Indemnification. Each Party (the "Indemnifying Party") shall indemnify, defend, and hold harmless the other Party and its partners, members, officers, directors, employees, and agents (collectively, the "Indemnified Parties") from and against any and all third-party claims, actions, suits, proceedings, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from (a) the Indemnifying Party's breach of any representation, warranty, or obligation under this SOW, (b) the Indemnifying Party's negligence or willful misconduct in the performance of its obligations under this SOW, or (c) any violation of applicable law by the Indemnifying Party in connection with this SOW.
9.2 Limitation of Vendor Liability. Except in cases of willful misconduct, gross negligence, or breach of Vendor's confidentiality or data-security obligations under Sections 5 and 6 of this SOW, Vendor's aggregate liability to Client under or in connection with this SOW shall not exceed the total fees actually paid by Client to Vendor under this SOW as of the date on which the claim giving rise to liability arose. In no event shall either Party be liable to the other Party for any indirect, incidental, consequential, special, or punitive damages, including loss of profits, loss of data (other than data in Vendor's custody), or loss of business opportunity, regardless of the form of action and whether such damages were foreseeable.
9.3 Vendor Indemnification for Data Breach. Without limiting the generality of Section 9.1, Vendor shall indemnify, defend, and hold harmless Client and the Respondents from and against any and all third-party claims, regulatory actions, fines, penalties, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees and the costs of notification, credit monitoring, and remediation) arising out of or resulting from any breach of Vendor's confidentiality or data-security obligations under Sections 5 and 6 of this SOW, including but not limited to any unauthorized access to, disclosure of, or loss of data collected, processed, or hosted by Vendor in connection with this SOW.
SECTION 10: GENERAL PROVISIONS
10.1 Independent Contractor. Vendor is an independent contractor and is not an employee, agent, partner, or joint venturer of Client. Nothing in this SOW shall be construed to create any relationship of employment, agency, partnership, or joint venture between the Parties. Vendor shall be solely responsible for the compensation, benefits, and tax obligations of its personnel.
10.2 Amendment. This SOW may not be amended, modified, or supplemented except by a written instrument signed by authorized representatives of both Parties. No waiver of any provision of this SOW shall be effective unless made in writing and signed by the waiving Party.
10.3 Notices. All notices, requests, demands, and other communications required or permitted under this SOW shall be in writing and shall be deemed to have been duly given when (a) delivered personally, (b) sent by confirmed email to the addresses specified in Section 7, (c) sent by nationally recognized overnight courier service, or (d) sent by certified or registered mail, return receipt requested, postage prepaid, addressed to the Parties at the addresses specified in the Contracting Parties Block of this SOW or to such other address as either Party may designate by written notice.
10.4 Governing Law. This SOW shall be governed by, and construed in accordance with, the laws of the Commonwealth of Virginia, without regard to its conflict-of-laws principles. Any dispute arising out of or relating to this SOW shall be resolved exclusively in the state or federal courts located in Fairfax County, Virginia, and each Party hereby consents to the personal jurisdiction of such courts.
10.5 Entire Agreement. This SOW, together with any Master Services Agreement between the Parties and any attachments, exhibits, or schedules hereto, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations, and discussions, whether oral or written, relating to the scope of e-discovery services for C&H Matter No. 1016-00001. Neither Party has relied on any representation, warranty, or promise not expressly set forth in this SOW.
10.6 Severability. If any provision of this SOW is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable, and the remaining provisions of this SOW shall continue in full force and effect.
10.7 Counterparts. This SOW may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Electronic signatures and signatures transmitted by facsimile or PDF shall be deemed to be original signatures for all purposes.
10.8 Assignment. Neither Party may assign or transfer this SOW or any rights or obligations hereunder without the prior written consent of the other Party, except that Client may assign this SOW to a successor firm without Vendor's consent.
SIGNATURE PAGE
IN WITNESS WHEREOF, the Parties have caused this Statement of Work to be executed by their respective authorized representatives as of the date first written above.
CALDERWOOD & HARKNESS LLP
By: ________
Name: Monica Reyes
Title: Senior Associate
Date: September 12, 2025
BRINDOVAL ANALYTICS LLC
By: ________
Name: Daniel Furrow
Title: Project Manager
Date: September 12, 2025
Field | Description
Bates Begin | Beginning Bates number of the withheld document
Bates End | Ending Bates number of the withheld document
Date | Date of the document or communication
Author | Author or sender of the document or communication
Recipient(s) | Recipient(s) (To line)
CC | CC recipient(s)
Document Type | Type of document (e.g., email, memorandum, letter)
Subject / Description | Subject line or brief description of the document
Basis for Privilege | Applicable privilege (e.g., attorney-client privilege, work product)
Milestone | Target Date
SOW Execution | September 12, 2025
Forensic Collection — Start | September 19, 2025
Forensic Collection — Complete | September 26, 2025
Processing & Deduplication Complete | October 3, 2025
Search-Term Culling Complete | October 7, 2025
TAR Training Begins | October 10, 2025
TAR Validation Checkpoint 1 | October 20, 2025
Review Complete | October 27, 2025
Production Ready (QC'd) | October 31, 2025
CID Response Deadline (Extended) | November 3, 2025
Service | Unit Rate | Estimated Cost
Forensic Collection (on-site) | $3,200 per day (estimated 7 days) | $22,400
Cloud Collection (M365, Enterprise Vault) | $1,500 per custodian (5 custodians) | $7,500
Non-Custodial Source Collection | Flat fee | $8,500
Processing | $18 per GB (estimated 132.4 GB) | $2,383
Hosting (Kestrel Technologies) | $15 per GB per month (132.4 GB × 3 months) | $5,958
TAR — Active Learning Setup | Flat fee | $12,000
TAR — Ongoing Analytics | $4,500 per month (estimated 2 months) | $9,000
Review Platform Licensing | $35 per user per month (10 users × 3 months) | $1,050
Production (TIFF + load files) | $0.06 per page | Estimated; varies based on production volume
Project Management | $225 per hour | Estimated; varies based on hours incurred
Estimated Total (Phase 1) | $385,000 (approximate)

STATEMENT OF WORK — E-DISCOVERY SERVICES

CALDERWOOD & HARKNESS LLP

CONTRACTING PARTIES

SECTION 1: PROJECT OVERVIEW

SECTION 2: SCOPE OF SERVICES

SECTION 3: TIMELINE / MILESTONES

SECTION 4: PRICING

SECTION 5: DATA SECURITY

SECTION 6: CONFIDENTIALITY

SECTION 7: POINTS OF CONTACT

SECTION 8: TERM AND TERMINATION

SECTION 9: LIMITATION OF LIABILITY / INDEMNIFICATION

SECTION 10: GENERAL PROVISIONS

SIGNATURE PAGE

CALDERWOOD & HARKNESS LLP

BRINDOVAL ANALYTICS LLC

Record

Parties

Dates

Amounts