MASTER SERVICES AGREEMENT
E-discovery and Litigation Support Services
Between
CALDERWOOD & HARKNESS LLP ("Client" or "Firm")
and
TRITON DISCOVERY SOLUTIONS INC. ("Service Provider" or "Triton")
Effective Date: August 1, 2023
Agreement Reference / Matter Number: 1021-00008
CONFIDENTIAL — SUBJECT TO ATTORNEY-CLIENT PRIVILEGE AND ATTORNEY WORK-PRODUCT PROTECTION
Right-click to update Table of Contents
RECITALS
WHEREAS, Calderwood & Harkness LLP is a limited liability partnership organized and existing under the laws of the State of Florida, with its principal office located at 200 South Biscayne Boulevard, Suite 4400, Miami, FL 33131, and is engaged in the practice of law, including complex corporate investigations, securities enforcement defense, and commercial litigation;
WHEREAS, Triton discovery Solutions Inc. is a corporation duly organized and existing under the laws of the State of New York, with its principal office located at 500 Seventh Avenue, 14th Floor, New York, NY 10018, and is engaged in the business of providing electronic discovery, data processing, document hosting, technology-assisted review, and litigation-support services to law firms, corporations, and government agencies;
WHEREAS, Calderwood & Harkness LLP has been retained by the Audit Committee of the Board of Directors of Verimark Hospitality Group Inc. ("VHG"), a corporation organized and existing under the laws of the State of Delaware, with its headquarters located at 4100 Bayshore Boulevard, Suite 1200, Tampa, FL 33611, and whose common stock is publicly traded on the Nasdaq Stock Market under the ticker symbol VMRK, to conduct an independent internal investigation (the "Investigation") into certain financial reporting and expense irregularities identified at VHG's wholly owned subsidiary, Verimark Coastal Resorts LLC ("VCR"), a limited liability company organized under the laws of the State of Florida, with its principal office located at 7820 Gulf Breeze Parkway, Suite 400, Destin, FL 32541;
WHEREAS, Calderwood & Harkness LLP requires the services of an experienced and qualified electronic discovery vendor to collect, process, host, facilitate review of, and produce electronically stored information ("ESI") and other documents in connection with the Investigation, and has determined that it is necessary to engage a vendor possessing the technical capabilities, infrastructure, and security protocols appropriate for an engagement involving materials that are subject to attorney-client privilege, work-product protection, and federal securities regulation;
WHEREAS, Triton discovery Solutions Inc. has represented to Calderwood & Harkness LLP that it possesses the requisite technical capabilities, qualified personnel, security infrastructure, and industry certifications to perform such electronic discovery and litigation-support services in a manner consistent with the requirements of the Investigation and applicable professional and legal standards; and
NOW, THEREFORE, in consideration of the mutual covenants, agreements, representations, and warranties set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:
ARTICLE 1: DEFINITIONS
Section 1.1 — Defined Terms
As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Article 1 shall have the meanings ascribed to them elsewhere in this Agreement.
(a) "Agreement" means this Master Services Agreement, together with all Exhibits, Schedules, Statements of Work, amendments, and addenda attached hereto or incorporated herein by reference, as each may be amended from time to time in accordance with the provisions hereof.
(b) "Authorized Representatives" means, with respect to Client, the following individuals: Howard Quinn (Responsible Partner), Conrad Ashby (Billing Partner), Liam Donahue (Lead Associate), and Steven Hollander (Working Associate); and with respect to Triton, the designated project manager and account executive identified in each Statement of Work executed hereunder. Either party may update its Authorized Representatives by written notice to the other party.
(c) "Confidential Information" means all information, data, documents, ESI, communications, memoranda, analyses, reports, attorney work product, attorney-client privileged materials, and any other information or materials, in any form or medium, that relate to the Investigation, VHG, VCR, or any individual who is a subject, witness, or target of the Investigation, including but not limited to Garrett W. Daskine, Nicole Prescott, and Ryan Mateo Serrano. Confidential Information includes, without limitation, financial records, accounting data, audit workpapers, interview memoranda, investigative findings, legal analyses, strategy documents, communications between Client and VHG or the Audit Committee, and any information that, by its nature or the circumstances of its disclosure, would reasonably be understood to be confidential or proprietary.
(d) "Custodians" means the individuals whose ESI and documents have been identified as subject to collection in connection with the Investigation. As of the Effective Date, up to eleven (11) custodians have been identified, with eight (8) custodians designated for initial collection. Additional custodians may be added in accordance with the procedures set forth in Article 3.
(e) "Data" means all ESI, documents, records, emails, email attachments, instant messages, text messages, financial records, contracts, purchase orders, vendor invoices, accounting records, spreadsheets, presentations, databases, images, audio files, video files, and all other materials, in whatever form or medium, provided to Triton by Client, VHG, VCR, or any other party at the direction of Client for processing, hosting, review, or production in connection with the Investigation.
(f) "De-NISTing" means the process of removing system and application files from a collected data set by comparing file hash values against the National Institute of Standards and Technology (NIST) National Software Reference Library (NSRL) hash sets, thereby eliminating known system files that have no evidentiary value.
(g) "De-Duplication" means the process of identifying and eliminating exact duplicate documents within a data set by computing and comparing MD5 or SHA-1 hash values, performed at both the custodian level (removing duplicates within a single custodian's collection) and the cross-custodian level (removing duplicates across multiple custodians' collections), as directed by Client.
(h) "Effective Date" means August 1, 2023.
(i) "Estimated Volume" means the anticipated volume of documents and data to be collected and processed under this Agreement, estimated as of the Effective Date at approximately 1.2 million documents.
(j) "Investigation" means the independent internal investigation opened on July 24, 2023, by Calderwood & Harkness LLP at the direction of the Audit Committee of the Board of Directors of VHG, concerning certain financial reporting and expense irregularities at VCR, as more particularly described in Section 2.2 of this Agreement.
(k) "MNPI" means material non-public information, as that term is understood under the federal securities laws of the United States, including Section 10(b) of the Securities Exchange Act of 1934 and Rule 10b-5 promulgated thereunder.
(l) "Privileged Materials" means documents, communications, memoranda, analyses, and other materials that are protected by the attorney-client privilege, the attorney work-product doctrine (as codified in Federal Rule of Civil Procedure 26(b)(3) and its state-law analogues), or the joint-defense or common-interest privilege, as determined by Client in its sole discretion.
(m) "Review Platform" means Triton's proprietary or licensed hosted document-review platform, which supports technology-assisted review workflows, including TAR 2.0 predictive-coding functionality utilizing continuous active learning methodologies, and provides features for document review, coding, annotation, redaction, and production.
(n) "Statement of Work" or "SOW" means an individual project order executed by authorized representatives of both parties under and subject to the terms of this Agreement, specifying particular services, timelines, custodians, data volumes, fees, milestones, and acceptance criteria for a defined phase or component of the engagement.
(o) "TAR 2.0" means technology-assisted review utilizing continuous active learning (CAL) predictive-coding methodology, in which the predictive model is iteratively updated as reviewers code documents, enabling continuous refinement of document prioritization and relevance rankings throughout the review process.
Section 1.2 — Interpretation
Unless the context otherwise requires: (a) the singular includes the plural and vice versa; (b) references to "Articles," "Sections," "Exhibits," and "Schedules" are to articles, sections, exhibits, and schedules of this Agreement; (c) the words "include," "includes," and "including" are deemed to be followed by the phrase "without limitation"; (d) the words "herein," "hereof," and "hereunder" refer to this Agreement as a whole; and (e) all references to dollar amounts are to United States dollars.
ARTICLE 2: SCOPE OF SERVICES
Section 2.1 — General Description
Triton shall provide electronic discovery and litigation-support services as described in each Statement of Work executed under this Agreement. The services to be provided by Triton shall include, but shall not be limited to, the following:
(a) Collection and Ingestion. Collection support and ingestion of ESI from up to eleven (11) custodians, with eight (8) custodians initially designated for collection, utilizing forensically sound collection methodologies designed to preserve the integrity and authenticity of the collected data.
(b) Processing. Processing of collected data, including file extraction from container files and archives, metadata parsing and extraction, text extraction, and optical character recognition (OCR) for image-based documents.
(c) De-Duplication. De-duplication of processed data at both the custodian level and the cross-custodian level, utilizing MD5 or SHA-1 hash-value comparison, to eliminate exact duplicate documents and reduce the volume of data subject to review.
(d) De-NISTing. Removal of system and application files from the processed data set utilizing current NIST NSRL hash sets, thereby excluding files of no evidentiary value from the review population.
(e) Hosting. Hosting of processed data on Triton's secure Review Platform, providing Client and its authorized reviewers with web-based access to the document population for review, coding, annotation, and analysis.
(f) Technology-Assisted Review. Implementation and support of a TAR 2.0 predictive-coding workflow utilizing continuous active learning methodology, including seed-set development, iterative model training, quality-control metrics and reporting, and validation of model performance, as directed by Client.
(g) Analytics Support. Provision of advanced analytics capabilities, including email threading, near-duplicate identification, concept clustering, communication-pattern mapping, timeline analysis, and other analytical tools as requested by Client to support the review and investigation process.
(h) Document Production. Preparation and delivery of document productions in formats specified by Client, including TIFF images with extracted text, native-file productions for specified file types (including Microsoft Excel spreadsheets, Microsoft Northgate Services Inc. presentations, and other designated file types), and generation of load files compatible with Client's review platform. Productions shall include sequential Bates numbering in the prefix and numbering format specified by Client.
(i) Privilege-Log Support. Extraction and compilation of metadata fields necessary to populate privilege-log entries for documents designated as privileged or work-product protected by Client's review team, with the current estimate of approximately 4,218 documents anticipated to require privilege-log entries.
(j) Project Management and Technical Consultation. Dedicated project management services, including assignment of a project manager and technical lead, regular status reporting, attendance at project calls and meetings, and ad hoc technical consultation as reasonably requested by Client.
Section 2.2 — Investigation Context
The services to be provided by Triton under this Agreement relate to Calderwood & Harkness LLP's independent internal investigation conducted on behalf of the Audit Committee of VHG's Board of Directors. The Investigation was opened on July 24, 2023, and concerns the following matters:
(a) Premature Revenue Recognition of Timeshare-Interest Deposits. The Investigation is examining whether VCR personnel engaged in premature recognition of revenue from timeshare-interest deposits at certain VCR properties, including but not limited to Coral Dune Resort & Residences, located at 14200 Emerald Coast Parkway, Destin, FL 32541, and Palmetto Bluff Club, located at 3950 Longboat Key Drive, Sarasota, FL 34228. The Investigation is examining whether such deposits were improperly recorded as recognized revenue before satisfaction of all applicable revenue-recognition criteria under ASC 606.
(b) Expense-Reporting Irregularities Involving Fictitious Vendor Invoices. The Investigation is also examining whether VCR personnel submitted or approved fictitious vendor invoices for payment, resulting in improper expense recognition and potential misappropriation of company funds.
Triton acknowledges and understands that the Data may include materials related to VHG, a publicly traded company whose common stock is listed on the Nasdaq Stock Market under the ticker symbol VMRK, and that the Investigation implicates federal securities laws, including Sections 302 and 404 of the Sarbanes-Oxley Act of 2002 ("SOX"). Triton further acknowledges that the matters under investigation are the subject of a pending SEC preliminary inquiry designated as File No. HO-14237, and that the services performed hereunder may be relevant to potential regulatory proceedings, enforcement actions, or litigation. Triton shall conduct itself at all times with an awareness of the sensitivity and regulatory significance of the engagement.
Section 2.3 — Coordination with Forensic Accounting Advisor
Triton shall coordinate, as directed by Client, with Crestline Forensic Advisory LLC ("Crestline"), located at 1330 Avenue of the Americas, 28th Floor, New York, NY 10019. Crestline has been retained by Calderwood & Harkness LLP under the Kovel doctrine (see United States v. Kovel, 296 F.2d 918 (2d Cir. 1961)) as the forensic accounting advisor to the Investigation. The Crestline engagement team includes Douglas Reinhardt, CPA, CFF (engagement partner) and Priya Venkatesh, CPA (senior manager).
Subject to Client's prior written authorization, Crestline personnel may be granted read-only access to the Review Platform for designated financial-record populations, including but not limited to accounting records, vendor invoices, purchase orders, and financial statements. Triton shall implement appropriate access controls to ensure that Crestline personnel have access only to the document populations specifically designated by Client, and shall maintain audit logs of all Crestline access to the Review Platform.
Section 2.4 — Volume Estimates
The parties acknowledge the following volume estimates as of the Effective Date, which are provided for planning and fee-estimation purposes and are subject to adjustment as the Investigation progresses:
(a) Estimated Collected Documents. Approximately 1.2 million documents are anticipated to be collected from the eight (8) initially designated custodians and any additional data sources identified by Client.
(b) Estimated Documents for Review. Following processing, de-duplication, de-NISTing, and TAR filtering, approximately 347,000 documents are anticipated to constitute the review population.
(c) Custodians. Eleven (11) custodians have been identified as of the Effective Date; eight (8) custodians have been designated for initial collection. Additional custodians may be added by SOW amendment in accordance with Section 3.4 of this Agreement.
In the event that actual data volumes materially differ from these estimates, the parties shall follow the procedures set forth in Section 4.4 for fee adjustments.
ARTICLE 3: STATEMENTS OF WORK
Section 3.1 — Execution of SOWs
Each phase or component of the engagement shall be governed by a Statement of Work duly executed by Authorized Representatives of both parties. Each SOW shall expressly reference this Agreement and shall be subject to and governed by the terms and conditions set forth herein. In the event of any conflict between the terms of a SOW and the terms of this Agreement, the terms of this Agreement shall control unless the SOW expressly states that a specific provision is intended to supersede a specific provision of this Agreement and is acknowledged as such by both parties.
Section 3.2 — Contents of Each SOW
Each Statement of Work shall include, at a minimum, the following information:
(a) A detailed description of the services to be performed under the SOW;
(b) Identification of custodians and data sources subject to collection;
(c) Estimated data volumes (in documents and/or gigabytes);
(d) Timeline, milestones, and deliverables;
(e) A specific fee schedule or fee cap applicable to the services described in the SOW, with reference to the fee rates set forth in Exhibit B or such adjusted rates as the parties may agree;
(f) Acceptance criteria and quality-control requirements;
(g) Identification of key Triton personnel assigned to the SOW; and
(h) Any special instructions, protocols, or requirements applicable to the services.
Section 3.3 — Initial SOW
The Initial Statement of Work (SOW No. 1) shall be attached hereto as Exhibit A and is incorporated herein by reference. SOW No. 1 covers the initial collection, processing, hosting, TAR 2.0 implementation, analytics, first-phase production services, and privilege-log support for the Investigation, and is more particularly described in Exhibit A.
Section 3.4 — Amendments
Statements of Work may be amended by mutual written agreement of the parties' Authorized Representatives. Any material change in scope, including the addition of custodians, expansion of data sets, additional data sources, or additional production obligations, shall require an amended or supplemental SOW with revised volume estimates, timelines, and fee estimates. Triton shall not perform any services outside the scope of an executed SOW without prior written authorization from Client.
ARTICLE 4: FEES AND PAYMENT
Section 4.1 — Fee Structure
Triton's fees for the services described herein are estimated at Four Hundred Eighty-Seven Thousand Dollars ($487,000) in the aggregate for the Initial SOW (SOW No. 1), encompassing processing, hosting, de-duplication, de-NISTing, TAR 2.0 licensing and support, analytics, production services, privilege-log support, and project management. This estimate is based on the volume estimates set forth in Section 2.4 and is subject to adjustment in accordance with Section 4.4 below.
The fee components shall be as follows, with detailed rates and unit pricing set forth in Exhibit B — Fee Schedule:
(a) Processing Fees. Per-gigabyte rates for data ingestion, file extraction, metadata parsing, text extraction, OCR processing, de-duplication, and de-NISTing, as specified in Exhibit B.
(b) Hosting Fees. Monthly per-gigabyte rates for hosting of processed data on the Review Platform, billed based on the volume of hosted data as of the last calendar day of each billing month.
(c) TAR 2.0 Licensing and Support. A flat monthly fee for the technology-assisted review module, including continuous active learning workflow functionality, model-training support, quality-control metrics and reporting, and validation analytics.
(d) Production Fees. Per-document rates for TIFF and PDF image conversion, Bates-number stamping, load-file generation, and delivery of production media. A separate per-document rate shall apply to native-file productions.
(e) Project Management. A monthly fixed fee for a dedicated project manager assigned to the Investigation engagement, covering project coordination, status reporting, meeting attendance, and day-to-day technical oversight.
(f) Ad Hoc Services. An hourly rate for custom analytics, specialized keyword searches, data remediation, format conversion, technical consultation, and other services not covered by the standard fee categories set forth in subsections (a) through (e) above. Ad hoc services shall be performed only upon prior written authorization from Client.
Section 4.2 — Invoicing
Triton shall submit detailed monthly invoices to Calderwood & Harkness LLP at the following address:
Calderwood & Harkness LLP
Attn: Conrad Ashby, Billing Partner
200 South Biscayne Boulevard, Suite 4400 Miami, FL 33131
Invoices may also be submitted electronically to such email address as Client may designate in writing. Each invoice shall include, at a minimum: (a) the Agreement reference and matter number 1021-00008; (b) the applicable SOW number; (c) detailed line items identifying the specific services rendered during the billing period; (d) unit counts (gigabytes, documents, hours, or other applicable units) for each line item; (e) the applicable per-unit rate for each line item; (f) the total charge for each line item; and (g) the aggregate total amount due for the invoice period. Triton shall retain backup documentation supporting each invoice and shall provide such documentation to Client upon request.
Section 4.3 — Payment Terms
Client shall pay all undisputed invoiced amounts within thirty (30) days of receipt of a conforming invoice. Any amounts not paid when due shall bear interest at the rate of one and one-half percent (1.5%) per month (or the maximum rate permitted by applicable law, whichever is less), calculated from the date payment was due until the date payment is received. Client shall notify Triton in writing within fifteen (15) days of receipt of an invoice of any disputed amounts, specifying in reasonable detail the basis for the dispute. The parties shall work in good faith to resolve any billing disputes promptly.
Section 4.4 — Fee Adjustments
The parties acknowledge that the fee estimates set forth in Section 4.1 and Exhibit B are based on the volume estimates set forth in Section 2.4. If actual data volumes exceed the estimates by more than fifteen percent (15%), the parties shall negotiate in good faith an adjusted fee schedule that reflects the increased volumes while maintaining per-unit rates that are consistent with the rates set forth in Exhibit B. No volume overages shall be billed by Triton without the prior written approval of Client. If the parties are unable to agree on an adjusted fee schedule within fifteen (15) days of Triton's notice of a volume overage, Client may, at its option, direct Triton to cease processing additional data until an agreement is reached or may terminate the applicable SOW upon ten (10) days' written notice.
Section 4.5 — Taxes
All fees set forth in this Agreement and in Exhibit B are exclusive of any applicable federal, state, or local sales, use, excise, value-added, or other taxes, levies, or assessments (collectively, "Taxes"). Any such Taxes that Triton is required by law to collect from Client shall be invoiced separately and clearly identified on each invoice. Client shall be responsible for payment of such Taxes, except for taxes based on Triton's net income.
ARTICLE 5: CONFIDENTIALITY AND DATA SECURITY
Section 5.1 — Confidentiality Obligations
Triton shall maintain all Confidential Information in strict confidence and shall not disclose, disseminate, publish, or otherwise make available any Confidential Information to any third party without the prior written consent of Client. This obligation of confidentiality shall extend to all forms and derivatives of Confidential Information, including summaries, analyses, compilations, notes, and reports prepared by Triton that contain or reflect Confidential Information. Triton shall protect Confidential Information using at least the same degree of care that Triton uses to protect its own confidential information, but in no event less than a reasonable degree of care. The obligations of confidentiality set forth in this Article 5 shall survive the expiration or termination of this Agreement for a period of five (5) years, or for such longer period as may be required by applicable law or professional obligation.
Notwithstanding the foregoing, Triton may disclose Confidential Information to the extent required by applicable law, regulation, or court order, provided that Triton: (a) provides Client with prompt written notice of such requirement (to the extent permitted by law) at least five (5) business days prior to any such disclosure, (b) cooperates with Client in seeking a protective order or other appropriate remedy to limit the scope of disclosure, (c) discloses only such Confidential Information as is legally required to be disclosed, and (d) takes all reasonable steps to preserve the confidential and privileged nature of the disclosed materials.
Confidential Information encompasses, without limitation, all Data, metadata, attorney work product, communications between Client and VHG or its Audit Committee, interview memoranda, investigative findings, legal analyses, strategy documents, privilege determinations, and any information regarding VHG, VCR, the Investigation, the subjects of the Investigation, or the Investigation's findings and conclusions.
Section 5.2 — Permitted Disclosures
Triton may disclose Confidential Information only to those of its employees, contractors, subcontractors, and agents who: (a) have a bona fide need to know such information in order to perform services under this Agreement; (b) have been informed of the confidential and privileged nature of the information; and (c) are bound by written confidentiality obligations that are at least as restrictive as those set forth in this Agreement. Triton shall maintain a current list of all personnel who have access to Confidential Information and shall make such list available to Client upon request. Triton shall be responsible for any breach of this Article 5 by any of its employees, contractors, subcontractors, or agents.
Section 5.3 — Attorney-Client Privilege and Work Product
Triton acknowledges and agrees that substantial portions of the Data constitute materials that are protected by the attorney-client privilege, the attorney work-product doctrine, or both. Triton further acknowledges that other portions of the Data may be protected by joint-defense or common-interest privileges.
Triton shall implement and maintain technical and procedural safeguards reasonably designed to prevent inadvertent disclosure of Privileged Materials to unauthorized persons, including access controls, role-based permissions, and training of Triton personnel regarding the handling of privileged materials.
All services performed by Triton under this Agreement are performed at the direction of, under the supervision of, and as an agent of Calderwood & Harkness LLP in connection with the rendering of legal services by Calderwood & Harkness LLP to the Audit Committee of VHG. Triton's access to and handling of Privileged Materials in the course of performing services under this Agreement shall not constitute a waiver of any applicable privilege or protection, and Triton shall take no action that could result in or be construed as a waiver of any such privilege or protection. In the event of any inadvertent production of Privileged Materials, the parties shall comply with the applicable provisions of Federal Rule of Evidence 502(b) and any applicable court orders or agreements.
Section 5.4 — Data Security Standards
Triton shall maintain, at its own cost and expense, data-security standards that meet or exceed the following requirements throughout the term of this Agreement:
(a) Certifications. Triton shall maintain a current SOC 2 Type II certification (or equivalent industry-recognized certification) for its data-center and hosting environments, and shall provide copies of its most recent SOC 2 Type II audit report to Client upon request.
(b) Encryption at Rest. All Data stored on Triton's systems, servers, storage devices, or backup media shall be encrypted using Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256).
(c) Encryption in Transit. All Data transmitted between Client and Triton, or between Triton's systems and authorized users, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher.
(d) Access Controls. Triton shall maintain role-based access controls that limit access to Data to only those personnel who have a bona fide need to access such Data in the performance of their duties. All user accounts shall be protected by multi-factor authentication (MFA). Triton shall maintain detailed audit logs recording all user access to the Review Platform and the Data, including login events, document views, downloads, exports, and coding actions.
(e) Physical Security. Triton's data-center facilities shall be equipped with physical security measures including, at a minimum, controlled access (key card, biometric, or comparable access control), video surveillance, environmental monitoring, and 24/7 security personnel or monitoring.
(f) Data-Center Location. All Data shall be stored, processed, and hosted in data-center facilities located within the continental United States. No Data shall be stored, processed, accessed, or transmitted to or from facilities located outside the United States without Client's prior written consent.
Section 5.5 — Security Incident Notification
In the event that Triton discovers or reasonably suspects any security incident, data breach, unauthorized access to, loss of, theft of, or compromise of Confidential Information or Data (collectively, a "Security Incident"), Triton shall notify Client within twenty-four (24) hours of such discovery or reasonable suspicion. Such notification shall be directed to Howard Quinn (Responsible Partner) and Liam Donahue (Lead Associate) by telephone and confirmed in writing via email. The notification shall include, to the extent known at the time: (a) a description of the nature of the Security Incident; (b) the categories and approximate volume of Data affected; (c) the likely consequences of the Security Incident; (d) the measures taken or proposed to be taken to address the Security Incident and mitigate its effects; and (e) the identity of any third parties who may have gained unauthorized access to the Data. Triton shall cooperate fully with Client in investigating and remediating any Security Incident, and shall take all reasonable steps to prevent recurrence. Triton shall bear all costs associated with any Security Incident caused by Triton's breach of its security obligations under this Agreement.
Section 5.6 — Insider-Trading Prohibition
Triton and its personnel acknowledge that, in the course of performing services under this Agreement, they may receive or have access to material non-public information ("MNPI") concerning VHG (Nasdaq: VMRK), including but not limited to information regarding VHG's financial condition, accounting practices, internal controls, regulatory proceedings, and the findings of the Investigation. Triton shall implement and enforce written policies and procedures that prohibit all Triton employees, contractors, subcontractors, agents, and any other persons associated with Triton who have access to the Data or Confidential Information from: (a) purchasing, selling, or otherwise trading in VHG securities (including common stock, options, and any derivative instruments); (b) tipping or otherwise communicating MNPI concerning VHG to any person who is not authorized to receive such information; and (c) recommending or suggesting that any other person purchase, sell, or otherwise trade in VHG securities based on MNPI. Triton shall certify its compliance with this Section 5.6 in writing upon Client's request, and shall promptly notify Client of any known or suspected violations. Triton's obligations under this Section 5.6 shall survive the expiration or termination of this Agreement.
ARTICLE 6: DATA HANDLING AND CHAIN OF CUSTODY
Section 6.1 — Data Ingestion
Triton shall receive Data via encrypted electronic transfer (using secure file-transfer protocols approved by Client) or via secure courier delivery of encrypted media. Data may be provided to Triton by Client, by Client's designees (including VHG IT department personnel acting at Client's direction), or by Crestline Forensic Advisory LLC acting at Client's direction. Upon receipt of any Data, Triton shall promptly log all Data received, including: (a) the date and time of receipt; (b) the source and custodian of the Data; (c) the volume of Data received (in documents and/or gigabytes); (d) the method of transfer or delivery; (e) hash values (MD5 and/or SHA-1) computed upon receipt to verify data integrity; and (f) the identity of the Triton personnel who received and processed the Data. Triton shall verify the integrity of received Data against any hash values provided by the delivering party and shall promptly notify Client of any discrepancies.
Section 6.2 — Processing Protocols
Triton shall process all Data in accordance with the e-discovery protocol established by Client, as set forth in the E-discovery Protocol & TAR Methodology Memorandum dated August 4, 2023 (the "Protocol Memorandum"), a copy of which shall be provided to Triton upon execution of this Agreement. Processing shall include, at a minimum, the following steps:
(a) De-Duplication. De-duplication shall be performed at both the custodian level and the cross-custodian level using MD5 hash values. The de-duplication methodology shall preserve custodian attribution for all unique documents.
(b) De-NISTing. System and application files shall be removed from the processed data set using the most current NIST NSRL hash sets available at the time of processing.
(c) Metadata Extraction. Triton shall extract and preserve all standard metadata fields for each document, including but not limited to: date created, date last modified, date sent, date received, author, sender, recipients (To, CC, BCC), subject line, file type, file extension, file name, file size, custodian, source file path, parent-child relationships (for emails with attachments), and such additional metadata fields as Client may specify.
(d) Text Extraction and OCR. Triton shall extract text from all documents that contain embedded text. For image-based documents (including scanned PDFs and TIFF files) that do not contain embedded text, Triton shall perform optical character recognition (OCR) to generate searchable text.
(e) Exception Handling. Triton shall generate exception reports identifying any documents that cannot be processed, extracted, or rendered, including password-protected files, corrupted files, and unsupported file formats. Triton shall work with Client to resolve processing exceptions in a timely manner.
Section 6.3 — Chain of Custody Documentation
Triton shall maintain a complete and accurate chain-of-custody log for all Data from the point of initial ingestion through final return or destruction, including all transfers, movements, access events, and dispositions. The chain-of-custody log shall be maintained in sufficient detail to support the admissibility of the Data and any documents derived therefrom under the Federal Rules of Evidence, including Rules 901 and 902, and shall be available for inspection by Client at any time upon reasonable request. Triton shall designate a qualified individual to serve as custodian of records for purposes of providing testimony or certification regarding chain-of-custody matters, if required.
Section 6.4 — Quality Control
Triton shall implement and maintain quality-control procedures designed to ensure the accuracy and reliability of all processing operations. Such procedures shall include, at a minimum: (a) random sampling of processed documents to verify the accuracy of text extraction, OCR output, and metadata integrity; (b) verification of de-duplication results through spot-check comparisons; (c) validation of De-NISTing results against expected file-type distributions; and (d) periodic audits of processing workflows and exception-handling procedures. Triton shall provide quality-control reports to Client upon request and shall promptly remediate any errors or deficiencies identified through the quality-control process.
ARTICLE 7: TECHNOLOGY-ASSISTED REVIEW (TAR 2.0)
Section 7.1 — TAR Implementation
Triton shall implement a TAR 2.0 continuous active learning (CAL) workflow on the Review Platform as directed by Client. The TAR 2.0 workflow shall be configured and operated in accordance with the Protocol Memorandum and such additional instructions as Client may provide from time to time. Seed-set development and initial model training shall be conducted under the direct supervision of Liam Donahue (Lead Associate) and Steven Hollander (Working Associate) of Calderwood & Harkness LLP. Triton shall provide technical support for the TAR workflow, including model configuration, parameter adjustment, seed-set management, and iterative training cycles.
Triton shall ensure that the TAR 2.0 system produces auditable and defensible results, including the preservation of model-training data, seed-set coding decisions, iteration logs, and all model-performance metrics generated during the review process.
Section 7.2 — Validation and Metrics
Triton shall provide recall, precision, and F1-score metrics to Client at intervals determined by Client, but no less frequently than at the conclusion of each major training iteration or review phase. Quality-control sampling shall be performed by Triton, under Client's direction, to validate TAR model performance before any production or privilege review is deemed complete. The validation methodology shall include: (a) statistical sampling of documents classified as non-responsive by the TAR model to estimate recall; (b) sampling of documents classified as responsive by the TAR model to estimate precision; and (c) calculation of F1 scores (the harmonic mean of recall and precision) to provide an integrated measure of model performance. Triton shall document all validation procedures, sampling methodologies, and results, and shall make such documentation available to Client for purposes of defensibility.
Section 7.3 — Review Platform Access
Triton shall provision individual user accounts on the Review Platform for members of the Calderwood & Harkness review team, including partners, associates, paralegals, and contract reviewers as designated by Client. Each user account shall be configured with role-based permissions as specified by Client, and all accounts shall require multi-factor authentication. Upon Client's written authorization, Triton shall also provision read-only user accounts for Crestline personnel, restricted to designated document populations identified by Client. Triton shall maintain audit logs of all user activity on the Review Platform and shall make such logs available to Client upon request.
ARTICLE 8: PRODUCTIONS
Section 8.1 — Production Specifications
Triton shall produce documents in the formats specified by Client, which may include any or all of the following: (a) single-page TIFF images with associated extracted-text files (one text file per document); (b) multi-page PDF files; (c) native files for specified file types, including but not limited to Microsoft Excel spreadsheets (.xls, .xlsx), Microsoft Northgate Services Inc. presentations (.ppt, .pptx), and such other file types as Client may designate; and (d) load files (including .DAT, .OPT, and .LFP files, or such other load-file formats as Client may specify) compatible with Client's review platform or the review platform of any producing or receiving party. Triton shall apply sequential Bates numbers to all produced documents in the prefix and numbering format specified by Client, and shall maintain a complete Bates-number log for each production.
Section 8.2 — Redaction Support
Triton shall provide redaction functionality on the Review Platform, including both manual redaction tools (enabling reviewers to apply redaction boxes to specific areas of document images) and automated redaction capabilities (enabling batch redaction based on search terms, patterns, or coding designations). Redactions shall be applied to support Client's privilege redactions and any redactions required for productions to regulatory authorities, including the SEC, or in connection with any litigation. All redactions shall be applied in a manner that renders the redacted content permanently irrecoverable from the produced document.
Section 8.3 — Privilege-Log Support
Triton shall extract and compile the metadata fields necessary to populate privilege-log entries for documents designated as privileged or work-product protected by Client's review team. Based on current estimates, approximately 4,218 documents are anticipated to require privilege-log entries. The metadata fields to be extracted for privilege-log purposes shall include, at a minimum: document date, author/sender, all recipients (To, CC, BCC), document type, subject line or document title, Bates number range, and custodian. Triton shall export privilege-log data in a format specified by Client (including Microsoft Excel or CSV format) to facilitate Client's preparation of the final privilege log.
ARTICLE 9: PERSONNEL AND PROJECT MANAGEMENT
Section 9.1 — Triton Project Team
Triton shall assign a dedicated project manager and technical lead to the Investigation engagement. The project manager shall serve as the primary point of contact for day-to-day project coordination, status reporting, and operational matters. The technical lead shall be responsible for overseeing processing operations, TAR configuration and support, analytics, and production workflows. Key Triton personnel shall be identified by name and role in each Statement of Work executed under this Agreement. Triton shall not reassign, remove, or replace any key personnel identified in a SOW without providing Client at least ten (10) business days' prior written notice and obtaining Client's consent, which shall not be unreasonably withheld. In the event that key personnel become unavailable due to circumstances beyond Triton's reasonable control (e.g., resignation, illness, or leave of absence), Triton shall promptly notify Client and propose a qualified replacement for Client's approval.
Section 9.2 — Client Points of Contact
The following individuals shall serve as Client's designated points of contact for purposes of this Agreement:
(a) Day-to-Day Supervision. Liam Donahue, Lead Associate, shall serve as the primary Client contact for day-to-day supervision of Triton's performance, including direction of processing, TAR workflow, review, and production activities.
(b) Technical and Review Coordination. Steven Hollander, Working Associate, shall serve as the primary Client contact for technical matters, review-platform configuration, TAR model training, and quality-control matters.
(c) Billing Inquiries. Conrad Ashby, Billing Partner, shall serve as the primary Client contact for all invoicing and billing matters.
(d) Escalation. Howard Quinn, Responsible Partner, shall serve as the primary Client contact for escalation of any significant operational, security, legal, or contractual matters.
Section 9.3 — Background Checks
Triton represents and warrants that all Triton personnel (including employees, contractors, and subcontractors) who will have access to the Data or Confidential Information in connection with the performance of services under this Agreement have undergone background checks consistent with industry standards for providers of electronic discovery services to law firms and corporate clients. Such background checks shall include, at a minimum, criminal-history checks, identity verification, and employment-history verification. Triton shall maintain records of all background checks conducted and shall make such records available for Client's review upon reasonable request, subject to applicable privacy laws.
ARTICLE 10: REPRESENTATIONS AND WARRANTIES
Section 10.1 — Triton Representations and Warranties
Triton represents and warrants to Client as follows:
(a) Organization and Authority. Triton is a corporation duly organized, validly existing, and in good standing under the laws of the State of New York, and has full corporate power and authority to enter into this Agreement and to perform its obligations hereunder.
(b) No Conflicts of Interest. Triton represents that neither Triton nor any of its officers, directors, employees, contractors, or agents has any existing or prior relationship, engagement, financial interest, or other conflict of interest with VHG, VCR, any subject of the Investigation (including Garrett W. Daskine, Nicole Prescott, and Ryan Mateo Serrano), or any other party known to be involved in or related to the Investigation, including without limitation: Hargrove, Steen & Aldrich LLP; Westlake Burris & Holt LLP; Merritt & Dunleavy LLP; Langford Pace LLP; Coletti & Ruiz PA; North Atlantic Indemnity Corp.; or any other entity known to Triton to be associated with the matters under investigation. Triton shall promptly notify Client if it becomes aware of any actual or potential conflict of interest during the term of this Agreement.
(c) Data Security Compliance. Triton's data-center facilities, hosting environments, security infrastructure, and operational procedures meet or exceed the data-security standards set forth in Article 5 and Exhibit C of this Agreement as of the Effective Date, and Triton shall maintain such standards throughout the term of this Agreement.
(d) Professional Standards. Triton shall perform all services hereunder in a professional and workmanlike manner, consistent with industry best practices for electronic discovery service providers, and in compliance with all applicable laws and regulations.
(e) Personnel Qualifications. All Triton personnel assigned to perform services under this Agreement possess the qualifications, training, and experience necessary to perform their assigned duties competently and professionally.
Section 10.2 — Client Representations and Warranties
Client represents and warrants to Triton as follows:
(a) Organization and Authority. Client is a limited liability partnership duly organized and validly existing under the laws of the State of Florida, and has full power and authority to enter into this Agreement and to perform its obligations hereunder.
(b) Audit Committee Authorization. Client has been duly authorized by the Audit Committee of the Board of Directors of VHG to engage Triton for the electronic discovery and litigation-support services described in this Agreement, and Client's execution of this Agreement and performance of its obligations hereunder are within the scope of such authorization.
(c) Compliance with Law. Client shall comply with all applicable laws and regulations in connection with its obligations under this Agreement, including but not limited to obligations related to the preservation, collection, and production of documents and ESI.
ARTICLE 11: INDEMNIFICATION
Section 11.1 — Triton Indemnification of Client
Triton shall indemnify, defend, and hold harmless Client and its partners, members, associates, employees, agents, and representatives (collectively, "Client Indemnitees") from and against any and all losses, damages, liabilities, judgments, settlements, costs, and expenses (including reasonable attorneys' fees and costs of investigation and defense) (collectively, "Losses") arising out of or relating to: (a) any breach by Triton of any representation, warranty, covenant, or obligation under this Agreement; (b) any negligent act or omission of Triton or its employees, contractors, subcontractors, or agents in connection with the performance of services under this Agreement; (c) any willful misconduct by Triton or its employees, contractors, subcontractors, or agents; (d) any unauthorized disclosure of Confidential Information or Data by Triton or its employees, contractors, subcontractors, or agents; or (e) any Security Incident caused by Triton's failure to maintain the data-security standards set forth in this Agreement.
Section 11.2 — Client Indemnification of Triton
Client shall indemnify, defend, and hold harmless Triton and its officers, directors, employees, and agents (collectively, "Triton Indemnitees") from and against any and all Losses arising out of or relating to any breach by Client of any representation, warranty, covenant, or obligation under this Agreement, provided that Triton has performed its obligations in accordance with the terms and conditions of this Agreement.
Section 11.3 — Limitation of Liability
Except as expressly provided in this Section 11.3, the aggregate liability of either party to the other party for any and all claims arising out of or relating to this Agreement shall not exceed the total fees paid or payable by Client to Triton under this Agreement. Notwithstanding the foregoing, the limitation of liability set forth in this Section 11.3 shall not apply to: (a) breaches of the confidentiality obligations set forth in Article 5; (b) breaches of the data-security obligations set forth in Article 5 and Exhibit C; (c) indemnification obligations arising under Section 11.1(d) or Section 11.1(e); (d) claims arising from willful misconduct or gross negligence; or (e) breaches of the insider-trading prohibitions set forth in Section 5.6. In no event shall either party be liable to the other party for any indirect, incidental, consequential, special, or punitive damages, regardless of the form of action or theory of liability, except in connection with breaches described in clauses (a) through (e) of this Section.
ARTICLE 12: INSURANCE
Section 12.1 — Triton Insurance Requirements
Triton shall procure and maintain, at its own cost and expense, throughout the term of this Agreement and for a period of two (2) years following the expiration or termination of this Agreement, the following insurance coverage with carriers rated A- VII or better by A.M. Best:
(a) Commercial General Liability Insurance. Coverage with limits of not less than Five Million Dollars ($5,000,000) per occurrence and Five Million Dollars ($5,000,000) in the annual aggregate, covering bodily injury, property damage, personal injury, and advertising injury.
(b) Professional Errors and Omissions Insurance. Coverage with limits of not less than Ten Million Dollars ($10,000,000) per claim and Ten Million Dollars ($10,000,000) in the annual aggregate, covering claims arising from errors, omissions, or negligent acts in the performance of professional services, including electronic discovery and litigation-support services.
(c) Cyber Liability / Data-Breach Insurance. Coverage with limits of not less than Ten Million Dollars ($10,000,000) per occurrence and Ten Million Dollars ($10,000,000) in the annual aggregate, covering claims arising from data breaches, unauthorized access to or disclosure of confidential information, network security failures, and related cyber incidents, including coverage for notification costs, credit-monitoring expenses, regulatory fines and penalties, and forensic investigation costs.
Triton shall provide Client with certificates of insurance evidencing the foregoing coverage upon execution of this Agreement and thereafter upon Client's request. The certificates shall name Calderwood & Harkness LLP as an additional insured under the commercial general liability policy. Triton shall provide Client with at least thirty (30) days' prior written notice of any material change in, cancellation of, or non-renewal of any required insurance coverage.
ARTICLE 13: TERM AND TERMINATION
Section 13.1 — Term
This Agreement shall be effective as of August 1, 2023 (the "Effective Date"), and shall remain in full force and effect until the earliest to occur of: (a) the completion of all services under all Statements of Work executed hereunder and the satisfaction of all obligations of the parties arising therefrom; (b) the mutual written agreement of the parties to terminate this Agreement; or (c) termination for cause in accordance with Section 13.3 below. The provisions of this Agreement that by their nature are intended to survive termination or expiration, including without limitation Articles 5, 6, 11, 12, 14, 15, 16, 17, and 18, shall survive any termination or expiration of this Agreement.
Section 13.2 — Termination for Convenience
Either party may terminate this Agreement for convenience upon thirty (30) days' prior written notice to the other party. In the event of termination for convenience by Client, Client shall pay Triton for all services rendered and costs properly incurred through the effective date of termination, including prorated hosting fees for the month in which termination becomes effective. In the event of termination for convenience by Triton, Triton shall continue to perform services at Client's request during the thirty (30) day notice period and shall cooperate with Client in transitioning services and Data to an alternative service provider.
Section 13.3 — Termination for Cause
Either party may terminate this Agreement immediately upon written notice to the other party if the other party: (a) materially breaches any provision of this Agreement and fails to cure such breach within fifteen (15) days after receipt of written notice specifying the nature of the breach; or (b) becomes insolvent, makes an assignment for the benefit of creditors, files or has filed against it a petition in bankruptcy, or has a receiver or trustee appointed for substantially all of its assets. A breach of the confidentiality obligations set forth in Article 5, the data-security obligations set forth in Article 5, or the insider-trading prohibitions set forth in Section 5.6 shall be deemed a material breach for purposes of this Section 13.3.