PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
MEMORANDUM
To: Carolyn Whitford, General Counsel & Executive Vice President, Quorum Insurance Holdings Corp. Gregory Stahl, Vice President, Legal Affairs, Quorum Insurance Holdings Corp. Rajesh Anand, Chief Data Officer, Quorum Insurance Holdings Corp.
From: Patricia Heng, Senior Counsel, Technology Transactions, Calderwood & Harkness LLP
CC: Leonard Cross, Partner (Responsible Partner) Wendy Schultz, Associate (Lead Associate) Omar Siddiqui, Associate (Working Associate)
Date: March 2023
Re: Analysis of Meridian Credit intelligence, Inc.'s Proposed Uptime and Latency Commitments in SLA Counter-Draft — Master Data License Agreement (C&H Matter No. 1025-00008)
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to evaluate the adequacy of the service-level commitments proposed by Meridian Credit intelligence, Inc. ("Meridian" or "MCI") in its counter-draft of the Service Level Agreement ("SLA") schedule to the Master Data License Agreement ("MDLA") currently under negotiation between Quorum Insurance Holdings Corp. ("Quorum" or "QIH") and Meridian. This memorandum is intended to provide Quorum's legal and business teams with a detailed assessment of the commercial and operational risks posed by Meridian's proposed terms, benchmarked against industry standards and Quorum's operational requirements, together with specific recommendations for the negotiation response.
As background, Calderwood & Harkness LLP ("C&H") delivered Quorum's proposed SLA schedule to Meridian's counsel, Kessler Pruitt & Ashe LLP ("KP&A"), led by partner Graham Whitley, in January 2023. Meridian responded through KP&A with a counter-draft received by C&H in approximately late February to early March 2023. This memorandum evaluates that counter-draft in detail and provides recommendations for Quorum's negotiation position.
High-Level Conclusion. Based on our review, Meridian's proposed SLA counter-draft presents material deficiencies across four principal areas:
1. Uptime Commitments. Meridian's proposed 99.5% monthly uptime commitment falls materially below industry benchmarks for enterprise credit-data providers serving insurance and financial-services clients. The proposed blended measurement methodology further obscures the performance picture for individual data products and delivery channels.
2. Latency Commitments. Meridian's proposed REST API latency commitments are insufficiently defined and substantially below the thresholds required to support Quorum's real-time automated underwriting and claims-fraud detection operations. The omission of P99 latency commitments and API throughput guarantees creates unacceptable tail-latency and capacity risks.
3. Service Credit Remedies. The proposed service credit structure — a flat 2% credit capped at 5% of the monthly fee — fails to incentivize Meridian's compliance with its service-level obligations and provides Quorum with commercially negligible compensation in the event of significant outages or performance degradation.
4. Chronic Failure Termination. Meridian's counter-draft entirely deletes the chronic failure termination provision from Quorum's initial draft, effectively locking Quorum into a five-year, $60 million commitment with no meaningful exit right in the event of persistent service underperformance.
We recommend that Quorum insist on strengthened provisions across all four areas before accepting the SLA schedule. The recommendations set forth in this memorandum should be incorporated into C&H's redline response to the counter-draft, which is currently in preparation.
Deal Context. The MDLA under negotiation is a five-year enterprise data license valued at approximately $60,000,000 over the full term, structured as follows: $10,800,000 in Year 1 (equivalent to $900,000 per month) and $12,300,000 per year in Years 2 through 5 (equivalent to $1,025,000 per month), plus a one-time implementation and integration fee of $1,500,000. The SLA schedule governs the delivery of three Meridian data products:
• MCI Consumer Credit File™: Approximately 310 million consumer records, delivered via daily batch (SFTP) and real-time API access (REST API). This is the core product for Quorum's automated underwriting and claims-fraud detection operations.
• MCI CommercialView™: Approximately 42 million business records, delivered via weekly batch (SFTP). This product supports Quorum's commercial-lines underwriting and risk assessment.
• MCI AltSignal™: Approximately 85 million consumer alternative-data records, delivered via daily batch (SFTP). This product supplements MCI Consumer Credit File with non-traditional credit indicators for use in customer propensity scoring and underwriting analytics.
Total estimated monthly data volume across all three products is approximately 437 million records, representing 87.4% of the 500 million records/month base tier under the proposed pricing structure. Given the scale of this commitment and Quorum's dependence on timely, reliable access to these data feeds across its property and casualty, life, and specialty insurance lines of business, robust service-level protections are essential.
II. Scope and Methodology
A. Documents Reviewed
In preparing this memorandum, we reviewed the following materials:
1. Quorum's Proposed SLA Schedule (C&H draft, January 2023), which sets forth Quorum's initial service-level requirements for uptime, latency, batch delivery windows, service credits, escalation procedures, and termination triggers.
2. Meridian's SLA Counter-Draft (KP&A markup, received approximately late February to early March 2023), which constitutes Meridian's response to Quorum's proposed SLA schedule and is the primary subject of this memorandum's analysis.
3. Relevant Provisions of the MDLA Draft (KP&A initial draft dated November 4, 2022, and C&H response draft), with particular attention to the data delivery and remedies provisions (Article 4, Data Delivery and Access), the limitation of liability clause (Section 11.2), the termination provisions (Article 12), the force majeure clause (Section 14.6), and the governing law and dispute resolution provisions (Article 15).
4. Technical Schedule A — Data Delivery Specifications (C&H draft, February 2023), prepared by Omar Siddiqui with substantive input from Priya Nair, Director, Data Engineering, Quorum. Technical Schedule A sets forth the detailed specifications for data format, delivery cadence, API architecture, expected query volumes, error handling, and data-quality acceptance criteria.
5. Pinnacle Ridge Advisory LLC Benchmarking Materials, consisting of a pricing and terms benchmark study delivered February 14, 2023, prepared by Franklin Osei, Managing Director, Pinnacle Ridge Advisory LLC. The study benchmarks Meridian's proposed commercial terms — including SLA provisions — against comparable enterprise credit-data licensing arrangements in the insurance and financial-services sectors.
B. Benchmarking Approach
Our analysis benchmarks Meridian's proposed SLA terms against multiple reference points to establish whether the proposed commitments are commercially reasonable and consistent with market practice for transactions of this nature and scale.
First, we reviewed publicly available and proprietary market data assembled by Pinnacle Ridge Advisory LLC for enterprise credit-data licensing SLAs from comparable credit bureaus and alternative-data providers. The Pinnacle Ridge study covers fourteen enterprise data-licensing arrangements executed between 2019 and 2022 involving credit-data and alternative-data providers serving insurance and financial-services clients, with contract values ranging from $8 million to $120 million over comparable five-year terms. The benchmarking data includes uptime commitments, latency specifications, service credit structures, and termination provisions.
Second, we reviewed the SLA standards from Quorum's existing data-vendor arrangements, including Quorum's current agreements with two competing credit-data providers (the identities of which are subject to confidentiality restrictions and are omitted from this memorandum). These existing arrangements provide useful reference points for the service levels Quorum has historically negotiated and received from comparable vendors.
Third, we consulted with Priya Nair, Director, Data Engineering, Quorum, regarding Quorum's operational requirements for real-time underwriting, claims-fraud detection, and customer propensity scoring across Quorum's property and casualty, life, and specialty lines of business. Ms. Nair's input was critical in assessing whether Meridian's proposed latency thresholds and batch delivery windows are operationally viable given Quorum's downstream system dependencies and policyholder-facing response-time commitments.
Fourth, we referenced applicable industry standards, including SOC 2 Type II reporting requirements. Meridian's most recent SOC 2 Type II report was issued by Galloway Nash LLP for the period ending March 31, 2023. Quorum's most recent SOC 2 Type II report was issued by Felton Thorpe & Co. LLP for the period ending December 31, 2023. Both reports are relevant to assessing each party's capacity to meet the operational and security commitments contemplated by the SLA.
III. Analysis of Meridian's Proposed Uptime Commitments
A. Quorum's Proposed Standard
Quorum's January 2023 SLA draft proposed a 99.9% monthly uptime commitment for all data-delivery channels, encompassing both SFTP batch delivery and REST API access. Under this standard, 99.9% uptime translates to no more than approximately 43.8 minutes of unplanned downtime per calendar month (calculated as 0.1% of 43,800 minutes in a 30.4-day average month).
Critically, Quorum's draft structured the uptime measurement on a per-service basis — that is, uptime would be calculated separately for each of the three data products (MCI Consumer Credit File, MCI CommercialView, and MCI AltSignal) and separately for each delivery method (SFTP and REST API). This granular approach ensures that an outage affecting a single product or delivery channel — particularly the REST API for MCI Consumer Credit File, which is the most operationally critical feed — would be accurately reflected in the uptime calculation and would independently trigger service credit and termination remedies.
The 99.9% standard proposed by Quorum is consistent with the uptime commitments Quorum has secured in its existing data-vendor arrangements and reflects the operational reality that Quorum's automated underwriting systems, claims-fraud detection algorithms, and customer propensity scoring models are continuously dependent on reliable data access throughout business hours and, for certain operations, on a 24/7 basis.
B. Meridian's Counter-Proposal
Meridian's SLA counter-draft departs from Quorum's proposed standard in four significant respects:
Reduced Uptime Threshold. Meridian proposes a 99.5% monthly uptime commitment, representing a reduction from Quorum's proposed 99.9%. While the numerical difference may appear modest, its practical implications are substantial: 99.5% uptime permits approximately 3.65 hours (219 minutes) of unplanned downtime per month, which is roughly five times the downtime permitted under Quorum's proposed 99.9% standard. Over the five-year term of the MDLA, the cumulative difference is significant — a 99.5% standard could result in up to 219 hours of aggregate unplanned downtime over sixty months, compared to approximately 43.8 hours under a 99.9% standard.
Blended Measurement. Rather than the per-service, per-delivery-method measurement proposed by Quorum, Meridian proposes a single blended uptime measurement across all three data products and both delivery methods. Under this approach, the uptime percentage for any given month is calculated by aggregating the availability of all services and channels into a single composite metric. As discussed further in Section III.C below, this methodology creates a material risk that outages affecting individual products or delivery channels — including the most operationally critical ones — will be obscured by the continued availability of other services.
Broad Downtime Exclusions. Meridian's counter-draft defines "Downtime" in a manner that excludes several significant categories of unavailability from the uptime calculation:
(i) Scheduled maintenance windows. Meridian proposes up to 8 hours per month of scheduled maintenance, with only 48 hours' advance notice to Quorum. Time spent in scheduled maintenance would not count against the uptime commitment, regardless of when the maintenance occurs (i.e., no restriction to off-peak hours).
(ii) Force majeure events. Any period of unavailability attributable to a force majeure event as defined in the MDLA would be excluded from the uptime calculation. As discussed further in Section VII.C below, Meridian's proposed force majeure definition is itself overly broad.
(iii) Outages caused by Quorum's systems or third-party internet service providers. This exclusion is reasonable in principle but, as drafted, lacks any defined procedure for determining whether an outage is attributable to Quorum's systems or to a third-party ISP versus Meridian's infrastructure.
(iv) Degraded performance short of "Total Service Outage." Meridian defines "Total Service Outage" as the complete inability to access any data feed for 15 or more continuous minutes. Under this definition, any degradation that does not rise to the level of a total inability to access data — including severe latency spikes, partial data-feed failures, intermittent connectivity, or error rates rendering the service functionally unusable — would not count as Downtime.
Elevated Total Service Outage Threshold. As noted above, the 15-minute continuous threshold for "Total Service Outage" means that outages lasting fewer than 15 continuous minutes are not counted at all. This creates an obvious gaming risk: a series of 14-minute outages, each separated by brief periods of restored access, could result in hours of cumulative unavailability without registering as Downtime under Meridian's proposed methodology.
C. Industry Benchmark Analysis
Our review of comparable enterprise credit-data licensing arrangements, including the Pinnacle Ridge Advisory benchmarking study, reveals that Meridian's proposed uptime commitment is below market standards for transactions of this nature and scale.
Uptime Thresholds. Enterprise credit-data providers serving insurance and financial-services clients typically commit to 99.9% or higher monthly uptime for production data feeds. Among the fourteen comparable transactions reviewed by Pinnacle Ridge Advisory, twelve included uptime commitments of 99.9% or above, and two included uptime commitments of 99.95%. Leading credit bureaus' standard enterprise SLAs generally provide 99.95% uptime for batch delivery and 99.9% for real-time API access. The 99.5% standard proposed by Meridian falls below the range observed in every comparable transaction reviewed by Pinnacle Ridge Advisory. Notably, even Meridian's own published marketing materials for the MCI Consumer Credit File product reference "industry-leading reliability" and "always-on data access," which is inconsistent with a 99.5% uptime commitment that permits nearly four hours of monthly downtime.
Measurement Methodology. Among the comparable transactions reviewed, the predominant approach is per-service measurement, with uptime calculated separately for each major data product and delivery channel. Only one of the fourteen surveyed arrangements used a blended measurement approach, and that arrangement involved a significantly smaller data volume (approximately 25 million records per month) and a single delivery channel. Per-service measurement is the industry norm precisely because it prevents the masking effect described above — where the continued availability of less critical batch feeds dilutes the measured impact of an outage affecting the real-time API channel.
Scheduled Maintenance. The industry norm for scheduled maintenance windows in enterprise data-licensing SLAs is 4 hours per month with 72 hours' advance written notice, with maintenance restricted to designated off-peak hours. Meridian's proposal of 8 hours per month with only 48 hours' notice is double the typical maintenance allowance and provides Quorum with significantly less advance planning time. The absence of any off-peak restriction is particularly problematic: scheduled maintenance conducted during Quorum's business hours could disrupt real-time underwriting operations even though such downtime would be excluded from the uptime calculation.
Downtime Definition. The "Total Service Outage" threshold of 15 continuous minutes is notably high relative to market practice. Among comparable arrangements, the median threshold for counting an incident as Downtime is 5 continuous minutes of unavailability. Several arrangements use a 1-minute threshold. The 15-minute threshold proposed by Meridian would effectively exempt a significant category of disruptive outages from the uptime measurement.
Blended Measurement Concerns. To illustrate the practical impact of the blended measurement approach, consider the following scenario: In a given month, the REST API for MCI Consumer Credit File experiences a 4-hour outage during peak business hours. However, SFTP batch delivery for MCI CommercialView and MCI AltSignal continues to function normally throughout the month. Under Meridian's blended measurement, the 4-hour REST API outage would be averaged across all services, potentially yielding a composite uptime figure that still exceeds 99.5% — even though the most operationally critical service was unavailable for an extended period during peak demand. Under Quorum's per-service measurement, the same 4-hour outage would be measured against the REST API's individual uptime target, clearly triggering service credits and potentially reaching a chronic failure threshold.
D. Recommendations. Based on the foregoing analysis, we recommend the following positions for the negotiation response:
1. Reject the 99.5% standard. Quorum should insist on the 99.9% monthly uptime commitment as proposed in Quorum's January 2023 SLA draft. This threshold is consistent with industry benchmarks, with Quorum's existing data-vendor arrangements, and with the operational requirements of Quorum's real-time automated underwriting and claims-fraud detection systems. The 99.9% standard is not aspirational; it reflects the minimum level of reliability required for a data product upon which Quorum's core insurance operations depend.
2. Require per-service, per-delivery-method measurement. Uptime must be calculated separately for each of the three data products (MCI Consumer Credit File, MCI CommercialView, MCI AltSignal) and separately for each delivery method (SFTP and REST API). This ensures that the uptime metric accurately reflects the performance of each individual service and prevents the dilution effect inherent in blended measurement.
3. Narrow the Downtime exclusions. Specifically:
(a) Scheduled maintenance. Reduce the scheduled maintenance window from 8 hours to 4 hours per month, require 72 hours' advance written notice (increased from Meridian's proposed 48 hours), and add a requirement that all scheduled maintenance be conducted during off-peak hours, defined as Saturday 12:00 AM to 6:00 AM Eastern Time.
(b) Total Service Outage threshold. Tighten the threshold from 15 continuous minutes to 5 continuous minutes of unavailability before an incident counts as Downtime. This is consistent with the median threshold observed in comparable enterprise data-licensing SLAs.
(c) Degraded performance. Remove the exclusion for degraded (non-total) outages. Any period during which measured response times exceed the agreed latency thresholds by more than 200% should count as Downtime for purposes of the uptime calculation. This ensures that severe performance degradation — which may be functionally equivalent to an outage from the perspective of Quorum's downstream systems — is captured in the uptime metric.
(d) Attribution of outages. Retain the exclusion for outages demonstrably caused by Quorum's own systems, but require Meridian to provide documented evidence of root cause within 48 hours of the incident. In the absence of such documentation, the outage should be presumed attributable to Meridian's infrastructure.
4. Off-peak maintenance requirement. As noted above, require that all scheduled maintenance be conducted during the designated off-peak window (Saturday 12:00 AM to 6:00 AM ET) absent Quorum's prior written consent. Emergency maintenance outside the scheduled window should be permitted only in the event of a bona fide security vulnerability or imminent system failure, with immediate telephonic and email notice to Quorum's designated technical contact.
IV. Analysis of Meridian's Proposed Latency Commitments
A. Quorum's Proposed Standards
Quorum's January 2023 SLA draft established specific latency commitments for both the REST API and SFTP batch delivery channels, calibrated to Quorum's operational requirements:
REST API (MCI Consumer Credit File — Real-Time Access):
• P95 response time: ≤200 milliseconds per query (i.e., 95% of all API queries in any calendar month must return a response within 200 milliseconds).
• P99 response time: ≤500 milliseconds per query (i.e., 99% of all API queries in any calendar month must return a response within 500 milliseconds).
SFTP Batch Delivery Windows:
• MCI Consumer Credit File daily batch: available for download by 6:00 AM ET each business day.
• MCI AltSignal daily batch: available for download by 7:00 AM ET each business day.
• MCI CommercialView weekly batch: available for download by 6:00 AM ET on the designated delivery day (currently Wednesday).
These standards were developed in consultation with Priya Nair, Director, Data Engineering, Quorum, and reflect the operational requirements of Quorum's technology infrastructure. Specifically, the 200ms P95 latency requirement for the REST API reflects the constraints of Quorum's real-time automated underwriting models and claims-fraud detection algorithms, which depend on timely and rapid access to MCI Consumer Credit File data to return decisions within the policyholder-facing response-time windows committed to by Quorum's underwriting platforms. The batch delivery deadlines are aligned with Quorum's overnight data-processing cycles, which must complete before the start of business operations each day.
B. Meridian's Counter-Proposal
Meridian's SLA counter-draft proposes latency commitments that differ materially from Quorum's proposed standards in three key respects:
REST API Latency. Meridian proposes a P95 response time of ≤500 milliseconds — 2.5 times slower than Quorum's proposed 200ms P95. Meridian's counter-draft includes no P99 commitment whatsoever, leaving the tail of the latency distribution entirely unaddressed.
SFTP Batch Delivery. Rather than committing to hard delivery deadlines, Meridian proposes that it will use "commercially reasonable efforts" to deliver batch feeds by the designated times. The counter-draft further specifies only a "best efforts" obligation to deliver within 4 hours of the designated delivery window. No service credits or other remedies attach to a failure to meet even this relaxed obligation. The phrase "commercially reasonable efforts" is not further defined in the counter-draft.
API Rate Limits and Throughput. Meridian's counter-draft does not define API rate limits or throughput guarantees (queries per second). There is no specification of the minimum sustained query rate that Meridian's infrastructure will support, no definition of burst capacity, and no commitment regarding error rates. This omission is notable given that Quorum's Technical Schedule A specifies expected query volumes that are tied to the approximately 310 million consumer records in the MCI Consumer Credit File product and that reflect Quorum's projected real-time underwriting and fraud-detection query volumes across its lines of business.
C. Assessment. P95 Latency. The 500ms P95 latency proposed by Meridian is 2.5 times slower than the 200ms P95 proposed by Quorum. While a 500ms response time might be acceptable for batch-oriented analytics or non-time-sensitive applications, it is inadequate for Quorum's real-time automated underwriting operations. Quorum's automated underwriting models are designed to return coverage decisions to applicants within defined response windows — in many cases, within seconds of application submission. These models incorporate real-time credit-data queries as a critical input. According to Ms. Nair's engineering assessment, the end-to-end latency budget for a single underwriting decision allows no more than 250 milliseconds for the credit-data retrieval step. A 500ms P95 would mean that 5% of all queries could take even longer than 500ms, resulting in frequent timeouts and fallback processing that would materially degrade the speed and accuracy of Quorum's underwriting operations.
P99 Latency. The absence of any P99 commitment creates significant tail-latency risk. In production environments handling high query volumes, P99 outliers — queries that take far longer than the median response time — can cause cascading timeouts in downstream systems. Ms. Nair's engineering assessment specifically identified tail latency as a critical concern: Quorum's underwriting platform processes queries in parallel across multiple data sources, and a single slow response from Meridian's API can block the entire decision pipeline, causing timeouts that cascade to the policyholder-facing application. Without a P99 commitment, Meridian has no contractual obligation to manage tail latency, and the 1% of queries at the extreme tail could experience arbitrarily long response times without consequence.
Batch Delivery Standards. The use of "commercially reasonable efforts" to describe Meridian's batch delivery obligation renders that commitment essentially unenforceable as a service-level commitment. "Commercially reasonable efforts" is a standard of conduct, not a measurable performance threshold. It provides no objective benchmark against which Quorum could assess compliance, and it offers no basis for calculating or claiming service credits. In a dispute, Meridian could argue that it employed "commercially reasonable efforts" even if batch deliveries were consistently late, so long as it took some reasonable steps to attempt timely delivery. The additional "best efforts" qualifier for delivery within 4 hours of the designated window is similarly problematic, as "best efforts" — while arguably a higher standard than "commercially reasonable efforts" — remains subjective and difficult to enforce. In practical terms, a batch delivery that is 4 hours late (e.g., MCI Consumer Credit File arriving at 10:00 AM ET rather than 6:00 AM ET) would miss Quorum's overnight processing window and require manual intervention or delayed analytics outputs.
API Rate Limits and Throughput. The absence of defined API rate limits and throughput guarantees is a significant gap in the SLA counter-draft. Without these definitions, Quorum has no assurance that Meridian's API infrastructure can support the query volumes that Quorum's operations require. Quorum's Technical Schedule A specifies expected query volumes based on the approximately 310 million consumer records in the MCI Consumer Credit File and Quorum's projected real-time query patterns. If Meridian were to impose undisclosed rate limits or throttle API access during peak periods, Quorum's real-time underwriting and fraud-detection systems could be materially impaired without any contractual recourse. Furthermore, the absence of a defined error-rate threshold means that Meridian could return elevated rates of error responses (e.g., HTTP 500 or 503 errors) without triggering any SLA consequence.
D. Recommendations. Based on the foregoing assessment, we recommend the following positions:
1. Maintain the 200ms P95 / 500ms P99 REST API latency requirement. The 200ms P95 threshold is not discretionary; it reflects the operational constraints of Quorum's underwriting infrastructure as validated by the Data Engineering team. The 500ms P99 commitment is essential to managing tail-latency risk and preventing cascading failures in Quorum's downstream systems. If Meridian contends that it cannot meet these thresholds, Quorum should require Meridian to provide historical API performance data (from its existing enterprise clients) demonstrating actual latency distributions, so that the parties can negotiate from an informed baseline.
2. Require hard delivery deadlines for all SFTP batch feeds. Replace the "commercially reasonable efforts" language with firm, measurable delivery commitments: MCI Consumer Credit File by 6:00 AM ET daily, MCI AltSignal by 7:00 AM ET daily, and MCI CommercialView by 6:00 AM ET on the designated weekly delivery day. Define service credits for late delivery (see Section V below) to create a meaningful financial incentive for timely performance.
3. Add API throughput guarantees. Specify minimum sustained query rates (queries per second) and define burst capacity, consistent with the expected query volumes set forth in Technical Schedule A. The specific throughput thresholds should be validated with Ms. Nair's team but should, at a minimum, accommodate Quorum's projected peak query volumes with a reasonable margin of headroom (e.g., 125% of projected peak volume).
4. Specify API error-rate thresholds. Define a maximum permissible error rate — we recommend that the error rate not exceed 0.1% of total API calls per calendar month — with defined consequences (service credits and, at higher thresholds, potential Downtime reclassification) for exceeding the threshold. Errors should be defined to include HTTP 5xx server errors, timeout errors, and any response that does not return a valid, parseable data payload within the P99 latency threshold.
V. Analysis of Service Credit Remedies
A. Quorum's Proposed Service Credit Structure
Quorum's January 2023 SLA draft proposed a tiered service credit structure calibrated to the severity and duration of SLA failures. The proposed credit tiers are as follows:
Uptime-Based Credits (per data product, per delivery method, per month):
Batch Delivery Credits:
• Batch delivery delay exceeding 2 hours past the designated delivery deadline: 2% credit per occurrence per product per month.
API Latency Credits:
• REST API latency exceeding the agreed P95 or P99 thresholds for more than 1 hour in any 24-hour period: 3% credit for each such occurrence per month.
The monthly fee baseline for credit calculation is the applicable Year 1 monthly rate of $900,000 and the Years 2–5 monthly rate of $1,025,000. Under Quorum's proposed structure, service credits would be applied automatically to the next invoice following the month in which the SLA failure occurred, without any requirement for Quorum to submit a written claim or affirmatively request the credit. This automatic application mechanism reduces administrative burden and eliminates the risk of credit forfeiture due to missed claim deadlines.
B. Meridian's Counter-Proposal
Meridian's SLA counter-draft proposes a service credit structure that is materially weaker than Quorum's proposal in every significant respect:
Flat Credit. Meridian proposes a flat 2% service credit for any month in which the blended uptime falls below 99.5%. There is no additional tiering for more severe outages — a month with 99.4% uptime would generate the same 2% credit as a month with 95.0% uptime.
Limited Scope. Meridian's counter-draft provides no service credits for batch delivery delays or REST API latency failures. Only uptime shortfalls trigger credits. This means that even persistent, severe latency degradation or chronic batch delivery delays would carry no financial consequence for Meridian under the SLA.
Low Cap. Service credits are capped at 5% of the applicable monthly fee in any given month. At the Year 1 monthly rate of $900,000, this equates to a maximum credit of $45,000 per month. At the Years 2–5 monthly rate of $1,025,000, the maximum credit is $51,250 per month.
Claim-Submission Requirement. Rather than automatic application, Meridian's counter-draft requires Quorum to submit a written claim within 30 calendar days after the end of the affected month. Failure to submit a timely claim would result in forfeiture of the credit for that month.
Sole and Exclusive Remedy. The counter-draft states that service credits constitute Quorum's "sole and exclusive remedy" for any SLA failure, subject only to the limitation of liability provisions in the MDLA. This language would preclude Quorum from pursuing actual damages for SLA failures, regardless of the magnitude of the failure or the harm to Quorum's business.
C. Assessment. Inadequacy of Credit Amounts. The flat 2% credit with a 5% monthly cap is commercially inadequate for a transaction of this magnitude. To illustrate:
• At the Year 1 monthly rate of $900,000, the maximum monthly credit of $45,000 represents approximately 0.09% of the annualized contract value ($10,800,000). This is a negligible amount relative to the potential business impact of a significant data outage on Quorum's underwriting operations. A multi-hour outage of the MCI Consumer Credit File REST API during peak business hours could cause Quorum to delay or decline thousands of policy applications, with revenue impact potentially measured in millions of dollars.
• At the Years 2–5 monthly rate of $1,025,000, the maximum monthly credit of $51,250 is similarly trivial. Over a 12-month period, the theoretical maximum aggregate credit under Meridian's proposed structure would be $615,000 — barely 5% of the annual contract value and a fraction of the potential downstream harm to Quorum.
Absence of Latency and Batch Credits. The omission of service credits for latency and batch-delivery failures effectively removes any financial incentive for Meridian to meet those commitments. Without financial consequences, Meridian's latency and batch-delivery obligations (even to the extent they are defined, which, as discussed in Section IV, is itself insufficient) become aspirational targets rather than enforceable commitments. This is particularly concerning given that Quorum's most critical operational dependency — real-time API access to MCI Consumer Credit File data for automated underwriting — is governed by the latency commitments that carry no remedy under Meridian's proposed structure.
Claim-Submission Burden. The requirement that Quorum submit a written claim within 30 days creates an administrative burden and a forfeiture risk. Quorum's operations team would need to implement a process to track SLA performance on a monthly basis, calculate credits, and prepare and submit written claims within the 30-day window — all without the benefit of timely or granular reporting from Meridian (which, as discussed in Section VII.A, Meridian proposes to deliver only within 15 business days after month-end). In practice, the claim-submission requirement shifts the monitoring and enforcement burden from the service provider to the customer, which is contrary to emerging industry practice. Among the comparable arrangements reviewed by Pinnacle Ridge Advisory, automatic crediting is the increasingly standard approach, employed in ten of the fourteen benchmarked transactions.
"Sole and Exclusive Remedy" Limitation. The designation of service credits as Quorum's "sole and exclusive remedy" for SLA failures, combined with the low credit caps, would leave Quorum without meaningful recourse for persistent underperformance short of contract termination. This limitation is particularly problematic in conjunction with Meridian's deletion of the chronic failure termination right (see Section VI below). Under Meridian's proposed framework, Quorum's only remedy for ongoing, severe SLA failures would be a monthly credit of at most $51,250 — with no right to terminate, no right to pursue actual damages, and no right to seek injunctive relief or specific performance to compel improved service delivery.
D. Recommendations.
1. Insist on the tiered service credit structure proposed in Quorum's January 2023 draft. The tiered approach ensures that credits escalate proportionally with the severity of the performance failure, creating a graduated financial incentive for Meridian to maintain high service levels.
2. Increase the monthly service credit cap to at least 20% of the applicable monthly fee. At the Year 1 monthly rate, a 20% cap would yield a maximum monthly credit of $180,000; at the Years 2–5 rate, $205,000. While still modest relative to the potential downstream harm from a catastrophic outage, a 20% cap provides a materially more meaningful incentive than Meridian's proposed 5%. We note that several of the comparable arrangements reviewed by Pinnacle Ridge Advisory include monthly credit caps in the 15%–30% range.
3. Extend service credits to cover latency and batch-delivery failures as proposed in Quorum's draft. Every measurable SLA commitment must be backed by a defined financial consequence; otherwise, the commitment is meaningless as a contractual protection.
4. Require automatic application of service credits without any claim-submission requirement. Credits should be calculated based on the agreed monitoring data and applied automatically to the next invoice following the affected month. This is consistent with industry practice and eliminates the administrative burden and forfeiture risk associated with claim-based crediting.
5. Clarify that service credits are not Quorum's sole and exclusive remedy. The SLA should expressly preserve Quorum's right to pursue actual damages for SLA failures that cause material harm to Quorum's business, subject to the negotiated limitation-of-liability provisions in the MDLA (with appropriate carve-outs as discussed in Section VIII.A below). The SLA should also expressly preserve Quorum's termination rights under the chronic failure provisions discussed in Section VI. Service credits should be characterized as liquidated damages for the inconvenience and administrative costs associated with SLA failures, without prejudice to Quorum's right to seek additional remedies for losses exceeding the liquidated amounts.
VI. Termination Triggers for Chronic SLA Failures
A. Quorum's Proposed Provisions
Quorum's January 2023 SLA draft included a "chronic failure" termination right designed to provide Quorum with a meaningful exit mechanism in the event that Meridian's data services prove persistently unreliable. The proposed provision operates as follows:
• If monthly uptime for any individual data product or delivery method falls below 99.0% in any three months within a rolling twelve-month period, Quorum may terminate the MDLA for cause upon 30 days' written notice without payment of any early termination fee.
• Alternatively, if monthly uptime for any individual data product or delivery method falls below 98.0% in any single month, Quorum may exercise the same termination right.
Upon exercise of the chronic failure termination right, all prepaid but unused license fees would be refundable to Quorum on a pro rata basis, calculated from the effective date of termination through the end of the then-current payment period.
The chronic failure termination provision serves a dual purpose: it provides Quorum with a concrete exit path if service quality proves unacceptable, and it creates a powerful performance incentive for Meridian by attaching the ultimate commercial consequence — loss of the contract — to persistent underperformance. The thresholds proposed by Quorum (99.0% over three months or 98.0% in any single month) represent a substantial buffer below the 99.9% uptime target, ensuring that the termination right is triggered only by genuinely chronic or catastrophic performance failures, not by isolated incidents.
B. Meridian's Counter-Proposal
Meridian's SLA counter-draft deletes the chronic failure termination provision in its entirety. No alternative termination trigger for SLA underperformance is proposed.
Under Meridian's proposed terms, the only remedy for SLA failures is the capped service credits described in Section V.B above. Termination for SLA-related performance issues would require Quorum to invoke the MDLA's general termination-for-material-breach provisions, which require a finding of "material breach" followed by a 60-day cure period during which Meridian would have the opportunity to remediate the breach before termination becomes effective.
Meridian's counsel at KP&A has taken the position, in communications with C&H, that SLA failures do not constitute "material breach" of the MDLA absent a total cessation of data delivery for an extended period. Under this interpretation, even chronic underperformance — months of missed uptime targets, persistent latency failures, and repeated batch delivery delays — would not give rise to a termination right so long as Meridian continued to deliver some data through some channel at some level of reliability.
C. Assessment. The deletion of the chronic failure termination right is among the most commercially significant changes in Meridian's SLA counter-draft and warrants particular attention from Quorum's legal and business teams.
Lock-In Risk. Without a specific SLA-based termination trigger, Quorum would be effectively locked into a five-year, $60 million commitment with no meaningful exit right if Meridian's data services prove persistently substandard. The only financial remedy available to Quorum would be the capped service credits — maximum $51,250 per month — which, as discussed in Section V.C, are commercially negligible relative to the potential harm from chronic service underperformance. This creates a profoundly asymmetric risk allocation: Quorum bears the full commercial risk of Meridian's service quality while Meridian's financial exposure is capped at trivial credit amounts.
Inadequacy of General Material Breach Standard. Relying on the MDLA's general "material breach" termination provision is inadequate for several reasons:
(i) Ambiguity. The concept of "material breach" is inherently ambiguous and fact-dependent. There is no bright-line test for determining whether a particular pattern of SLA failures constitutes a material breach of the MDLA, and the outcome of any such determination would depend on the circumstances, the cumulative impact, and the weight assigned to various factors by the decision-maker. This ambiguity creates significant litigation risk if Quorum were to attempt to terminate based on SLA underperformance.
(ii) Meridian's Litigation Position. Meridian could — and, based on KP&A's stated position, almost certainly would — argue that partial data delivery, even if degraded or unreliable, does not meet the materiality threshold. A court or arbitrator might agree, particularly if Meridian can demonstrate that some data was being delivered through some channel during the relevant period. The "total cessation" standard articulated by KP&A is a plausible, if aggressive, interpretation that Quorum should not be forced to litigate against.
(iii) 60-Day Cure Period. The MDLA's general termination-for-breach provision includes a 60-day cure period. In the context of chronic SLA failures, this cure period creates a risk of cyclical failure and remediation: Meridian experiences poor performance for several months, Quorum issues a termination notice, Meridian temporarily improves performance during the cure period (resetting the clock), and then performance degrades again once the immediate termination threat has passed. This cycle could repeat indefinitely without Quorum ever achieving an effective termination.
Industry Practice. Specific, measurable SLA-based termination triggers are standard practice in enterprise data-licensing agreements of this scale. Among the fourteen comparable transactions reviewed by Pinnacle Ridge Advisory, eleven included specific SLA-based termination provisions with defined uptime thresholds and rolling measurement periods. The deletion of such provisions is well outside the range of market-standard terms.
Leverage Implications. Beyond its function as an exit mechanism, the chronic failure termination right serves as Quorum's ultimate leverage to enforce service quality. If Meridian knows that persistent underperformance will result in the loss of a $60 million contract, it has a powerful incentive to invest in the infrastructure, redundancy, and operational discipline necessary to maintain high service levels. Without this leverage, Quorum's only tools for influencing Meridian's performance are modest service credits and informal persuasion — neither of which is adequate for a relationship of this commercial significance.
D. Recommendations.
1. Reinstate the chronic failure termination provision from Quorum's January 2023 draft. The proposed uptime-based thresholds — below 99.0% in any three months within a rolling twelve-month period, or below 98.0% in any single month — are reasonable, represent a substantial buffer below the 99.9% target, and are consistent with market practice.
2. Add a termination trigger for persistent API latency failures. We propose that Quorum may exercise a termination right if P95 REST API latency exceeds 500 milliseconds for more than 5 business days in any calendar month, and such latency failures occur in three or more months within a rolling twelve-month period. This threshold provides a meaningful check on chronic latency degradation while allowing for isolated incidents.
3. Add a termination trigger for batch delivery failures. We propose that failure to deliver any batch feed within 8 hours of the designated delivery time on more than 10 occasions in a rolling twelve-month period should trigger a termination right. This threshold accommodates occasional delays while addressing a pattern of persistent late delivery.
4. Define the consequences of SLA-based termination. Upon Quorum's exercise of an SLA-based termination right:
(i) No early termination fee. Quorum should not be required to pay any early termination fee, breakage fee, or similar charge, as the termination is a direct consequence of Meridian's failure to meet its service-level commitments.
(ii) Pro rata refund of prepaid fees. All prepaid but unused license fees should be refundable on a pro rata basis, calculated from the effective date of termination through the end of the then-current prepaid period.
(iii) Transition assistance. Meridian must provide a transition assistance period of 90 days following the effective date of termination, during which Meridian continues to provide data access at no additional charge, to facilitate Quorum's migration to an alternative data provider. During this transition period, all SLA commitments remain in full force and effect.
5. Expressly define SLA failures as material breach. The MDLA should include a provision expressly stating that SLA failures meeting the defined chronic failure termination thresholds constitute "material breach" for purposes of all MDLA provisions, including the termination provisions, limitation of liability provisions, and indemnification provisions. This eliminates the ambiguity inherent in the general material breach standard and preempts Meridian's anticipated argument that SLA underperformance does not rise to the level of materiality.
6. Coordinate with post-termination data treatment provisions. An SLA-based termination would trigger the MDLA's post-termination obligations, including the 90-day return/destruction period for raw Meridian data. The transition assistance period should be aligned with this 90-day window to ensure continuity. We note that the treatment of Derived Data post-termination — including Quorum's QuorumScore™ and other derived analytics products — remains a disputed term in the broader MDLA negotiation and is connected to the derived-data rights impasse that is one of the two principal open negotiation issues. Quorum's position that Derived Data constitutes Quorum's proprietary intellectual property and must be preserved regardless of the basis for termination should be reinforced in the SLA-specific termination provisions.
VII. Additional SLA Provisions Requiring Attention
In addition to the four principal areas analyzed above, several other provisions in Meridian's SLA counter-draft require attention and revision. These issues, while individually less significant than the uptime, latency, service credit, and termination provisions, collectively have a material impact on the enforceability and practical effectiveness of the SLA.
A. Measurement and Reporting
Meridian's Proposal. Meridian's counter-draft proposes that uptime and latency performance will be measured solely by Meridian's internal monitoring tools. Monthly performance reports would be provided to Quorum within 15 business days after the end of each calendar month. The counter-draft does not grant Quorum any right to deploy independent monitoring tools or to audit Meridian's monitoring data.
Assessment. Allowing Meridian to serve as both the service provider and the sole arbiter of its own performance creates an inherent conflict of interest. While there is no suggestion of deliberate manipulation, Meridian's monitoring tools may employ measurement methodologies, sampling rates, or exclusion criteria that systematically undercount outages or overstate performance. Without independent verification, Quorum has no way to validate the accuracy of Meridian's reported metrics. Additionally, the 15-business-day reporting timeline is excessively long; in practice, it means that Quorum might not receive performance data for a given month until nearly the end of the following month, well past the point at which real-time operational decisions could be informed by the data.
Recommendations:
(i) Independent monitoring. Quorum should have the right to deploy its own independent monitoring tools to measure API uptime, latency, and error rates from Quorum's network perspective. Both parties' measurements should be reconciled on a monthly basis, with discrepancies investigated jointly and resolved in accordance with a defined escalation procedure.
(ii) Accelerated reporting. Monthly performance reports should be delivered within 5 business days after the end of each calendar month, rather than 15 business days. This provides Quorum with timely data to assess service quality and to submit any necessary escalations or credit calculations.
(iii) Audit rights. Quorum should have the right to audit Meridian's monitoring data, methodologies, and systems, upon reasonable notice and during normal business hours, to verify the accuracy and completeness of reported performance metrics. This audit right should be consistent with the broader audit-right framework currently being negotiated in the MDLA, including the pricing audit right proposed as an MFN fallback mechanism in the event the MFN pricing provisions are modified during negotiations.
B. Escalation Procedures
Meridian's Proposal. Meridian's counter-draft includes a single-tier support contact with a 4-hour initial response time for all severity levels. There is no distinction between a total service outage affecting all data products and a minor cosmetic issue with a reporting dashboard. Named contacts on either side are not specified.
Assessment. A single-tier escalation framework is inadequate for an enterprise data-licensing relationship of this complexity and scale. Total service outages — which directly impact Quorum's ability to process insurance applications and detect fraudulent claims — require immediate, senior-level attention and rapid resolution. A 4-hour response time for a total outage is commercially unreasonable and could result in significant harm to Quorum's operations and policyholders. Conversely, minor issues do not warrant the same level of urgency and can be addressed through standard support channels on a next-business-day basis.
Recommendations:
We recommend a tiered escalation procedure with response and resolution targets calibrated to incident severity:
Named escalation contacts should be designated on both sides and included in the SLA schedule. Quorum's primary technical contact is Priya Nair, Director, Data Engineering. Meridian's counterpart should be designated by Keith Marlow, SVP, Data Licensing & Partnerships, and should be an individual with sufficient authority to direct Meridian's engineering and operations teams to prioritize incident resolution.
For Severity 1 incidents, the escalation procedure should include automatic escalation to senior management on both sides (VP level or above) if the incident is not resolved within 2 hours. For incidents exceeding 4 hours, executive-level escalation (C-suite) should be triggered.
C. Force Majeure
Meridian's Proposal. Meridian's counter-draft includes a broad force majeure carve-out that extends to, among other categories, "cyber-attacks, system failures of third-party cloud providers, and internet disruptions." Events qualifying as force majeure would excuse Meridian's performance obligations, including the uptime commitments, for the duration of the event, and periods of unavailability attributable to force majeure would be excluded from the uptime calculation.
Assessment. While traditional force majeure events — natural disasters, acts of war or terrorism, governmental actions, and similar extraordinary circumstances beyond the reasonable control of either party — are appropriately excluded from SLA performance obligations, the extension of force majeure to cyber-attacks, cloud-provider failures, and internet disruptions is overly broad and inconsistent with the risk allocation appropriate for a data-services provider of Meridian's scale and sophistication.
Cyber-attacks are a foreseeable operational risk in the data-services industry. Meridian, as a major credit-data provider, is expected to maintain robust cybersecurity infrastructure, including intrusion detection, incident response capabilities, and disaster recovery systems. Both parties are required under the MDLA to maintain SOC 2 Type II certifications, and Meridian is further required to maintain ISO 27001 certification — both of which encompass security incident management and business continuity. Meridian's required cyber and technology errors and omissions insurance minimum of $25,000,000 aggregate further reflects the expectation that cyber incidents are foreseeable risks to be managed and insured against, not unforeseeable acts of God.
Similarly, third-party cloud-provider failures are foreseeable risks that Meridian should manage through contractual protections with its cloud providers, architectural redundancy (multi-region or multi-provider deployment), and disaster recovery planning. Allowing Meridian to claim force majeure for a cloud-provider outage would effectively shift to Quorum the risk of Meridian's infrastructure and vendor-management choices — an allocation that is inconsistent with the parties' respective roles in the data-services relationship.
Recommendations:
• Narrow the force majeure definition to traditional categories: natural disasters, war, terrorism, governmental actions, embargoes, and similar extraordinary events genuinely beyond the reasonable control of the affected party.
• Expressly exclude cyber-attacks, cloud-provider failures, and internet disruptions from the force majeure definition. These are operational risks that Meridian should manage through its cybersecurity and disaster recovery infrastructure, as contemplated by the SOC 2, ISO 27001, and insurance requirements in the MDLA.
• If Meridian insists on retaining some protection for catastrophic cyber events (e.g., a nation-state-level attack on critical infrastructure), consider a narrow carve-out limited to cyber events that simultaneously affect three or more major enterprise data providers and are formally declared by a governmental authority as a critical infrastructure incident. Any such carve-out should be time-limited (e.g., excusing performance for no more than 72 hours before SLA obligations resume) and should require Meridian to activate its documented disaster recovery plan within a defined timeframe.
D. Data Quality
Meridian's Proposal. The SLA counter-draft is entirely silent on data-quality standards. There are no commitments regarding the accuracy, completeness, timeliness, or freshness of the data delivered through any channel. No remedies are defined for data-quality failures.
Assessment. The omission of data-quality standards from the SLA is a significant gap. While uptime and latency metrics measure the availability and speed of data delivery, they do not address the quality of the data being delivered. Quorum's use cases — automated underwriting, claims-fraud detection, and customer propensity scoring — depend not only on receiving data quickly but on receiving data that is accurate, complete, and current. A data feed that is 100% available and highly responsive but delivers stale, incomplete, or inaccurate records is of limited value and could lead to erroneous underwriting decisions, missed fraud indicators, or unreliable analytics outputs.
Technical Schedule A (C&H draft, February 2023), prepared by Omar Siddiqui with substantive input from Priya Nair, includes data-quality acceptance criteria covering record completeness rates, data freshness standards (tied to stated refresh frequencies for each product), field-level accuracy requirements, and deduplication standards. These criteria were developed based on Quorum's operational requirements and should be incorporated into the SLA framework with defined monitoring, reporting, and remedy provisions.
Recommendations:
• Cross-reference Technical Schedule A in the SLA and incorporate the data-quality acceptance criteria into the SLA's measurable performance commitments.
• Define minimum data-quality thresholds as SLA metrics subject to monitoring, reporting, and service credits. Recommended thresholds include:
• Record completeness rate: ≥99.5% (i.e., no more than 0.5% of records in any batch delivery or API response may have missing mandatory fields).
• Data freshness: Within the stated refresh frequencies for each product (daily for MCI Consumer Credit File and MCI AltSignal; weekly for MCI CommercialView), with a tolerance of no more than 24 hours beyond the stated refresh cycle.
• Duplicate record rate: ≤0.1% of total records per delivery.
• Attach service credits to data-quality failures, structured as a percentage credit per occurrence or per month in which quality thresholds are not met, and include data-quality failures in the chronic failure termination calculus if they are persistent.
• Require root-cause analysis and corrective action plans for data-quality failures exceeding defined severity thresholds, with reporting to Quorum within 5 business days of identification.
VIII. Interaction with Other MDLA Provisions
The SLA schedule does not exist in isolation; it operates within the broader contractual framework of the MDLA. Several provisions of the MDLA interact with the SLA in ways that require careful coordination to ensure that Quorum's rights and remedies are consistent and enforceable.
A. Limitation of Liability
Meridian's form MDLA (KP&A draft dated November 4, 2022) includes a limitation-of-liability provision consisting of two eleme