PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT DOCTRINE
CALDERWOOD & HARKNESS LLP Attorneys at Law
DUE DILIGENCE SUMMARY MEMORANDUM COMPREHENSIVE FINDINGS
January 5, 2024
This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP for the exclusive use of its client, Solara Digital Infrastructure LP, and its affiliates, in connection with the proposed acquisition of Cloudium Technologies plc. This memorandum should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and the client, except to the extent necessary for the placement of representation and warranty insurance or as otherwise agreed by the parties. Disclosure to any third party may constitute a waiver of the attorney-client privilege and/or work product protection.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
A. Purpose
This memorandum consolidates and summarizes the findings from all legal due diligence workstreams conducted by Calderwood & Harkness LLP in connection with the proposed acquisition of Cloudium Technologies plc ("Cloudium," the "Company," or the "Target") by Solara Digital Infrastructure Fund VI LP ("Fund VI" or the "Buyer") through a reverse triangular merger with Stratos Merger Sub Inc. ("Merger Sub"), a newly formed Delaware corporation and wholly owned subsidiary of Fund VI. This memorandum is intended to provide the Solara Deal Team and responsible partner with a comprehensive overview of all material legal issues identified during the diligence process, together with our recommendations for specific protections to be incorporated into the definitive merger agreement and ancillary transaction documents.
B. Transaction Overview
Fund VI proposes to acquire all of the outstanding shares of common stock of Cloudium in an all-cash transaction valued at approximately $6,800,000,000 (the "Transaction"). The Transaction will be structured as a reverse triangular merger under the Delaware General Corporation Law ("DGCL"), pursuant to which Merger Sub will merge with and into Cloudium, with Cloudium surviving the merger as a wholly owned subsidiary of Fund VI. The per-share cash consideration to be paid to Cloudium stockholders is approximately $36.92 per share, subject to rollover elections by Jonathan Hargrove, the Company's Chief Executive Officer, and Pinnacle Growth Ventures LLC ("Pinnacle"), the Company's largest institutional stockholder. Messrs. Hargrove and Pinnacle are expected to elect to roll over a portion of their equity holdings into equity interests in a parent holding entity of Fund VI, the specific terms of which are being negotiated separately and are addressed in the Tax Section of this memorandum (Section VIII) and in the separate tax structuring memorandum prepared by Leonard Cross of Calderwood & Harkness and Richard Okamura of Glenmore Thornton LLP.
C. Diligence Period and Process
Virtual data room access was granted to Calderwood & Harkness LLP and the Buyer's coordinating advisors on September 18, 2023. The Company's management team conducted a formal management presentation on October 2, 2023, at the offices of Ridgeway Phelps & Sato LLP in New York. Diligence was conducted on a continuous basis from September through December 2023 across all workstreams described in Section II below. The virtual data room was administered by Ridgeway Phelps & Sato LLP, counsel to the Target, with Catherine Answorth serving as lead partner on the sell-side.
D. Coordinating Advisors
The following advisors have been engaged by Fund VI or otherwise coordinated with Calderwood & Harkness LLP in connection with the due diligence process:
• Glenmore Thornton LLP — Richard Okamura (transaction tax structuring and tax due diligence) and Vanessa Liu (financial due diligence, including quality of earnings analysis and working capital assessment)
• Albright & Kerr LLP — Fiona McAllister (UK regulatory and competition law matters, including CMA merger notification)
• Osprey Bancroft & Co. — Damien Harlow (financial advisor to Fund VI; valuation support and fairness analysis)
E. Overall Risk Assessment
Based on the comprehensive review of all materials produced in the data room and supplemental information obtained through management discussions and follow-up requests, we assess the overall legal risk profile of the Transaction as MODERATE. Key areas requiring heightened attention include: (i) change of control provisions in certain material contracts, most notably the Aegis Federal Solutions Inc. Master SaaS Agreement and the Helix Data Systems GmbH Technology License Agreement; (ii) intellectual property licensing arrangements and open-source software compliance; (iii) UK employment law considerations, including potential TUPE implications in connection with any post-closing reorganization; and (iv) certain government contract compliance matters related to the Target's FedRAMP-authorized government cloud offering. No single issue has been identified that, in our judgment, constitutes a "deal-breaker" or should prevent the parties from proceeding to execution of the definitive merger agreement.
F. Recommendation
We recommend that Fund VI proceed to execution of the definitive merger agreement, subject to the negotiation and incorporation of specific protections as detailed throughout this memorandum. These protections include, among others: (i) specific representations and warranties tailored to the identified risk areas; (ii) an indemnification framework with an escrow mechanism, a tipping basket, special indemnities for identified high-risk matters, and an uncapped tax indemnity; (iii) buyer-side representation and warranty insurance; (iv) closing conditions requiring receipt of regulatory approvals (HSR, CMA) and specified third-party consents (Aegis Federal, Helix Data); and (v) a reverse termination fee payable by the Buyer in the event the regulatory closing condition is not satisfied. The specific recommendations are set forth in detail in each section of this memorandum and consolidated in the summary risk matrix in Section XIII.
II. SCOPE AND METHODOLOGY
A. Workstream Organization
The legal due diligence was organized into the following ten workstreams, each of which is addressed in a separate section of this memorandum:
1. Corporate Organization and Authority (Section III)
2. Material Contracts (Section IV)
3. intellectual Property and Technology (Section V)
4. Litigation and Disputes (Section VI)
5. Regulatory and Government Contracts (Section VII)
6. Tax (Section VIII)
7. Employment and Benefits (Section IX)
8. Real Estate (Section X)
9. Insurance (Section XI)
10. Environmental (Section XII)
Each workstream was staffed by a dedicated team of associates and counsel within Calderwood & Harkness LLP, with oversight provided by the responsible partner or specialist partner for the relevant practice area. Where external specialist counsel was required (UK competition law, financial diligence, tax structuring), the relevant workstream was coordinated with the appropriate advisor as noted above.
Due diligence request lists were issued on the following dates:
• Preliminary Due Diligence Request List — September 10, 2023 (covering all workstreams)
• Supplemental IP and Technology Request List — October 8, 2023 (issued following initial review of patent portfolio and technology license agreements)
• Supplemental Regulatory and Government Contracts Request List — October 15, 2023 (issued following management presentation and identification of Aegis Federal relationship)
• Supplemental Employee Benefits and Compensation Request List — October 22, 2023 (issued following review of equity incentive plan and executive employment agreements)
B. Data Room Statistics
The virtual data room contained approximately 4,200 documents organized across 187 data-room folders. Documents were produced by Cloudium and its advisors, including Ridgeway Phelps & Sato LLP (London and New York offices) and Harwell & Dobson LLP (Cloudium's independent auditors, with Martin Chisholm serving as engagement partner). Document production occurred on a rolling basis, with the initial population of the data room completed in mid-October 2023 and supplemental productions continuing through December 2023. Certain categories of documents, including the most recent quarterly financial information and updated capitalization data, were produced in the final weeks of the diligence period.
C. Limitations and Qualifications
The findings and conclusions set forth in this memorandum are subject to the following limitations and qualifications:
1. Reliance on Produced Materials. Our diligence is based on the documents and information produced by Cloudium and its advisors in the virtual data room, supplemented by management discussions and written responses to our request lists. We have not independently audited, verified, or confirmed the accuracy or completeness of the information provided, and our conclusions are necessarily limited by the scope and quality of the materials produced to us. To the extent that material information was not produced, withheld, or inaccurately represented, our conclusions may be affected.
2. Financial Due Diligence. The financial due diligence, including the quality of earnings analysis, working capital assessment, and analysis of historical and projected financial performance, was conducted by Glenmore Thornton LLP under a separate engagement. This memorandum addresses legal findings only and does not purport to address financial, accounting, or valuation matters. The audited financial statements of Cloudium were provided by Harwell & Dobson LLP, and we have not independently verified those statements.
3. Rolling Production. Certain categories of documents were produced on a rolling basis through December 2023. While we have reviewed all materials produced as of the date of this memorandum, there may be additional documents or information that become available after the date hereof. We will supplement this memorandum as appropriate if material new information is received.
4. Foreign Subsidiary Records. Certain records of Cloudium Technologies India Pvt. Ltd. and Cloudium Solutions GmbH were reviewed in English translation. We have relied on the accuracy of those translations and have not independently verified the original-language documents. Local counsel in India and Germany was not separately engaged for the purpose of this diligence, although Albright & Kerr LLP provided guidance on certain German legal matters in connection with the competition analysis.
5. Scope of Legal Analysis. Our analysis is limited to legal matters and does not constitute business, financial, tax, or accounting advice. The tax section of this memorandum summarizes the findings of the tax workstream conducted by Leonard Cross of Calderwood & Harkness and coordinated with Richard Okamura of Glenmore Thornton LLP, but should be read in conjunction with the separate tax due diligence report and tax structuring memoranda issued by those advisors.
III. CORPORATE ORGANIZATION AND AUTHORITY
A. Cloudium Technologies plc (Parent)
Cloudium Technologies plc is a public limited company incorporated under the laws of England and Wales, registered with Companies House under Company Number 09734521. The Company's registered office is located at 45 Broadwick Street, London W1F 0DB, United Kingdom. The Company maintains its US headquarters at 600 Townsend Street, Suite 800, San Francisco, California 94103.
Cloudium is listed on the Nasdaq Global Select Market under the ticker symbol CLDM. As of the most recent capitalization information provided, the Company has 184,200,000 shares of common stock issued and outstanding. The Company's articles of association and certificate of incorporation were reviewed and appear to be in order. No amendments to the articles of association are required in connection with the proposed Transaction, although the surviving corporation's governing documents will be amended and restated as part of the merger.
The Company's Board of Directors currently consists of nine members, including Douglas Pemberton (Independent Chair) and Jonathan Hargrove (Chief Executive Officer and Director). Nadia Chowdhury serves as General Counsel and Corporate Secretary. We reviewed the minutes of meetings of the Board of Directors and its committees (Audit Committee, Compensation Committee, Nominating and Corporate Governance Committee) for the prior three fiscal years (FYE September 30, 2021, 2022, and 2023). The minutes reflect regular quarterly meetings and special meetings as warranted. No material irregularities or governance concerns were identified in the minutes reviewed. Board actions appear to have been properly authorized in accordance with the Company's articles of association and applicable law.
B. Subsidiary Structure
Cloudium operates through three wholly owned subsidiaries, each of which is described below. No minority interests, joint ventures, unconsolidated affiliates, or other equity interests in third parties were identified in the data room materials. The subsidiary structure is straightforward, which simplifies the acquisition analysis and reduces structural risk.
1. Cloudium Technologies UK Ltd.
Cloudium Technologies UK Ltd. is a private limited company incorporated under the laws of England and Wales, registered with Companies House under Company Number 11287456. Its registered office is located at 45 Broadwick Street, London W1F 0DB, United Kingdom. The UK subsidiary employs approximately 1,200 employees across its London and Manchester offices and serves as the Company's primary operating entity for the UK and broader European market. For the fiscal year ended September 30, 2023, Cloudium Technologies UK Ltd. reported revenue of approximately £312,000,000 (approximately $390,000,000 at a conversion rate of $1.25/£). The UK subsidiary's accounts are filed with Companies House and have been audited by Harwell & Dobson LLP. The subsidiary appears to be in good standing and in compliance with its filing obligations under the Companies Act 2006.
2. Cloudium Technologies India Pvt. Ltd.
Cloudium Technologies India Pvt. Ltd. is a private limited company incorporated in Bangalore, Karnataka, India. The Indian subsidiary employs approximately 2,400 employees and serves as the Company's primary center for research and development, engineering, and customer support functions. The subsidiary is wholly owned by Cloudium Technologies plc, and its corporate records, as reviewed in translation, appear to reflect proper incorporation, capitalization, and governance. The Indian subsidiary is registered with the Registrar of Companies, Karnataka, and appears to be in good standing. Annual filings and statutory registers were reviewed and appear to be current.
3. Cloudium Solutions GmbH
Cloudium Solutions GmbH is a limited liability company (Gesellschaft mit beschränkter Haftung) incorporated in Berlin, Germany. The German subsidiary employs approximately 400 employees and is responsible for sales and customer success operations in the DACH region (Germany, Austria, and Switzerland). The subsidiary is wholly owned by Cloudium Technologies plc, and its Handelsregister (commercial register) filings were reviewed. The subsidiary appears to be properly organized and in good standing. No material governance or corporate record-keeping issues were identified.
4. Global Headcount Summary
The Company's total global employee count is approximately 6,800, distributed as follows: approximately 2,800 in the United States, approximately 1,200 in the United Kingdom, approximately 2,400 in India, and approximately 400 in Germany. This headcount is consistent with the information presented in the Company's most recent public filings and management presentation.
C. Capitalization
As of the most recent capitalization data provided, Cloudium has 184,200,000 shares of common stock issued and outstanding. The Company's key stockholders are as follows:
Pinnacle Growth Ventures LLC is a growth-equity investment fund. Evelyn Carmichael is the Managing Member of Pinnacle. Pinnacle holds two seats on the Cloudium Board of Directors. The Pinnacle investment is governed by a stockholders' agreement and investor rights agreement, each of which was reviewed. The investor rights agreement provides Pinnacle with certain registration rights, information rights, and board designation rights. These agreements will be addressed in the merger agreement and are expected to terminate upon consummation of the Transaction, subject to any rollover arrangements.
We reviewed the Company's equity incentive plan (the "2018 Equity Incentive Plan" and subsequent amendments thereto), under which the Company has granted stock options and restricted stock units ("RSUs") to employees, directors, and consultants. The equity incentive plan contains provisions for acceleration of vesting upon a "change of control," which is defined to include a merger or acquisition of the type contemplated by the Transaction. The treatment of outstanding equity awards — including the mechanics for acceleration, cancellation, and cash-out — will need to be specifically addressed in the definitive merger agreement. The aggregate value of in-the-money options and unvested RSUs at the proposed per-share merger consideration of $36.92 will be calculated by the Company's equity plan administrator and should be confirmed prior to signing.
No preferred stock, convertible debt, warrants, or other instruments convertible into or exercisable for equity securities of the Company are outstanding, other than the equity incentive awards described above. The Company's capitalization is clean and does not present structural complexity for the Transaction.
D. Authority and Approvals
The Transaction will require the approval of Cloudium's stockholders. As a Nasdaq-listed company with English incorporation, the Company will be required to hold a stockholder meeting and conduct a proxy solicitation in accordance with applicable Nasdaq listing rules, SEC regulations (including Regulation 14A), and the Companies Act 2006 (to the extent applicable to the approval of the scheme or merger). The Company has retained Blackthorn Proxy Advisors LLC as its proxy solicitor to assist in the solicitation process.
The Cloudium Board of Directors authorized the Company to enter into exclusive negotiations with Fund VI on November 6, 2023. An exclusivity agreement was executed on November 15, 2023, providing for a 45-day exclusive negotiation period (expiring on or about December 30, 2023). As of the date of this memorandum, the exclusivity period has expired; however, the parties have continued to negotiate on an exclusive basis by mutual agreement. We recommend that a formal extension or renewal of the exclusivity agreement be obtained if negotiations are expected to continue for a material additional period prior to signing.
E. Recommended Merger Agreement Protections
Based on the findings in this section, we recommend the following protections be incorporated into the definitive merger agreement:
• Standard representations and warranties regarding corporate organization, good standing, authority, and capitalization of the Company and each of its subsidiaries.
• Full and complete disclosure of all outstanding equity awards, including detailed capitalization table attached as a disclosure schedule.
• Bring-down of corporate representations at closing, subject to a material adverse effect qualifier.
• Delivery at closing of an officer's certificate and secretary's certificate of the Company certifying the accuracy of representations and warranties and the authorization and approval of the Transaction by the Company's Board of Directors and stockholders.
IV. MATERIAL CONTRACTS
A. Overview
Calderwood & Harkness LLP reviewed approximately 340 material contracts produced in the data room, spanning customer agreements, vendor and supplier agreements, partnership and channel agreements, technology licensing agreements, and corporate agreements (including the existing credit facility, insurance policies, and real estate leases). The review was conducted with a particular focus on: (i) change of control provisions, (ii) assignment restrictions, (iii) termination rights triggered by a merger or acquisition, and (iv) material adverse effect triggers or other provisions that could be implicated by the Transaction.
The following sections summarize the most significant findings from the material contracts review. A detailed schedule of all contracts containing change of control provisions or assignment restrictions is being compiled as a separate attachment (Attachment C, to follow).
B. Change of Control Provisions — Critical Findings
Three contracts were identified as containing change of control provisions or mandatory prepayment triggers that present material risk to the Transaction and require specific attention in the definitive merger agreement:
1. Aegis Federal Solutions Inc. — Master SaaS Agreement
Risk Rating: HIGH
Cloudium is party to a Master SaaS Agreement with Aegis Federal Solutions Inc. ("Aegis Federal"), a Virginia-based US government contractor. This contract represents Cloudium's largest single-customer relationship, generating annual recurring revenue of approximately $84,000,000 (representing approximately 4.8% of total ARR). The Master SaaS Agreement provides cloud-based ERP and data management solutions to Aegis Federal in support of its US government contracts.
The Master SaaS Agreement contains a provision (Section 14.3) requiring Cloudium to obtain written consent from Aegis Federal prior to any "change of control" of Cloudium. The term "change of control" is broadly defined to include any transaction resulting in a change in the direct or indirect ownership or control of more than 50% of the voting securities or equity interests of Cloudium, which would clearly encompass the proposed reverse triangular merger. Failure to obtain written consent prior to the consummation of the Transaction would constitute a breach of the Master SaaS Agreement and could result in termination of the contract by Aegis Federal.
Given the magnitude of this customer relationship and the potential revenue loss in the event of termination, we strongly recommend that receipt of written consent from Aegis Federal be included as a condition precedent to closing in the definitive merger agreement. In addition, the merger agreement should contain a specific pre-closing covenant requiring the Company to use commercially reasonable efforts to obtain such consent. We understand that the Company has initiated preliminary discussions with Aegis Federal regarding the Transaction and the consent process; Ridgeway Phelps & Sato LLP is coordinating these discussions on behalf of the Company.
2. Helix Data Systems GmbH — Technology License Agreement
Risk Rating: MEDIUM-HIGH
Cloudium is party to a Technology License Agreement (the "Helix License") with Helix Data Systems GmbH ("Helix Data"), a Frankfurt-based technology company. The Helix License grants Cloudium a non-exclusive license to certain proprietary data analytics and business intelligence algorithms and software components developed by Helix Data, which are integrated into Cloudium's customer-facing SaaS platform.
The Helix License contains a termination-for-change-of-control clause (Section 9.2) that permits Helix Data to terminate the license upon written notice in the event of a "change of control" of Cloudium. The definition of "change of control" in the Helix License is similar to that in the Aegis Federal agreement and would encompass the proposed Transaction. Termination of the Helix License would require Cloudium to develop or license replacement data analytics and business intelligence technology, which could involve significant cost, development time, and operational disruption.
We recommend that the definitive merger agreement include a specific pre-closing covenant requiring the Company to use commercially reasonable efforts to obtain a consent or waiver from Helix Data with respect to the change of control provision. We further recommend that a consent or waiver from Helix Data be included as a condition precedent to closing, or, at minimum, that the failure to obtain such consent trigger specific indemnification obligations. We understand that consent/waiver negotiations with Helix Data are currently underway.
3. Atlas Commercial Lending Corp. — Credit Agreement
Risk Rating: MEDIUM
Cloudium is party to a Credit Agreement dated March 15, 2021 (as amended), with Atlas Commercial Lending Corp. ("Atlas") as administrative agent and a syndicate of lenders. As of the date of this memorandum, the Company has approximately $620,000,000 outstanding under the term loan facility and approximately $200,000,000 drawn on its $400,000,000 revolving credit facility, for a total of approximately $820,000,000 in outstanding indebtedness under the Credit Agreement.
The Credit Agreement contains a mandatory prepayment provision (Section 2.14) that requires the Company to repay all outstanding indebtedness in full upon the occurrence of a "change of control," as defined therein. The proposed Transaction would constitute a "change of control" under the Credit Agreement.
Resolution: It is anticipated that the existing indebtedness under the Credit Agreement will be repaid in full at closing from the proceeds of new debt financing to be arranged by Fund VI. A payoff letter and lien release documentation will need to be obtained from Atlas in advance of closing. This is a standard requirement in leveraged acquisitions and does not present unusual risk, provided that the new financing is committed and available at closing.
C. Customer Contracts — General Findings
Cloudium's customer contracts are predominantly SaaS subscription agreements entered into on the Company's standard terms and conditions. Contract terms generally range from one to three years with automatic renewal provisions. The Company's total annual recurring revenue ("ARR") as of December 31, 2023 was approximately $1,740,000,000, and its last twelve months ("LTM") revenue for the fiscal year ended September 30, 2023 was approximately $1,620,000,000.
With the exception of the Aegis Federal relationship (approximately 4.8% of ARR), no material customer concentration risk was identified. The Company's customer base is diversified across industries and geographies, and no other single customer accounts for more than 3% of total ARR.
A limited number of customer contracts were identified as containing uncapped liability provisions (i.e., contracts in which Cloudium's liability to the customer is not subject to a contractual cap). While this is not uncommon in enterprise SaaS contracts, particularly those with large or strategically significant customers, we recommend that these contracts be specifically identified in a disclosure schedule to the merger agreement and that the Company provide a specific representation regarding the existence and terms of all contracts with uncapped or materially elevated liability exposure.
D. Vendor and Supplier Contracts
We reviewed the Company's key vendor and supplier contracts, with particular attention to the Company's hosting and infrastructure agreements (cloud hosting services, data center colocation, and related IT infrastructure). These contracts are essential to the Company's ability to deliver its SaaS platform and maintain service level commitments to its customers.
No unusual termination provisions or material adverse effect triggers were identified in the vendor and supplier contracts beyond standard market terms. Certain hosting agreements contain assignment restrictions that require notice to, or consent of, the vendor in the event of a change of control of Cloudium. We recommend that the Company obtain the necessary notices and consents under these agreements prior to closing, to the extent that the contracts are material to the Company's operations.
E. Partnership and Channel Agreements
The Company maintains standard reseller and technology partnership agreements with a number of channel partners and technology ecosystem participants. These agreements were reviewed and no material change of control issues were identified beyond those noted above in connection with the Helix Data Technology License Agreement. The partnership and channel agreements are generally on standard market terms with reasonable termination and renewal provisions.
F. Recommended Merger Agreement Protections
Based on the findings in this section, we recommend the following protections be incorporated into the definitive merger agreement:
• A specific representation and warranty regarding all contracts containing change of control provisions, assignment restrictions, or termination rights triggered by the Transaction.
• A disclosure schedule listing all material contracts requiring consent, notice, or other action in connection with the Transaction.
• A pre-closing covenant requiring the Company to use commercially reasonable efforts to obtain all required consents, with Aegis Federal Solutions Inc. and Helix Data Systems GmbH specifically identified.
• A condition precedent to closing: receipt of written consent from Aegis Federal Solutions Inc. under the Master SaaS Agreement.
• A condition precedent to closing (or, alternatively, a specific indemnification obligation): receipt of a consent or waiver from Helix Data Systems GmbH under the Technology License Agreement.
• Indemnification for losses arising from undisclosed change of control triggers or assignment restrictions in material contracts.
V. INTELLECTUAL PROPERTY AND TECHNOLOGY
A. Patent Portfolio
Cloudium maintains a substantial patent portfolio that covers key aspects of its cloud-based ERP architecture, CRM automation technology, and proprietary business intelligence algorithms. The patent portfolio consists of the following:
We reviewed the patent portfolio at a summary level, including patent numbers, filing dates, expiration dates, and the status of all pending applications. The patents appear to be properly assigned to Cloudium Technologies plc, and maintenance fees appear to be current. No material patent infringement claims are currently pending against the Company, and no material third-party patents have been identified that would appear to restrict the Company's ability to operate its current business.
We note that a comprehensive freedom-to-operate analysis was outside the scope of this legal due diligence engagement. Given the nature and scale of the Company's technology platform, we recommend that the buyer-side representation and warranty insurance policy provide robust coverage for intellectual property infringement claims, including claims that may arise post-closing.
B. Trademarks and Brands
The "Cloudium" name and related word marks and logos are registered with the United States Patent and Trademark Office ("USPTO"), the European Union intellectual Property Office ("EUIPO"), the UK intellectual Property Office ("UKIPO"), and the Controller General of Patents, Designs and Trademarks in India. The trademark registrations appear to be current and in good standing. No material opposition or cancellation proceedings are pending with respect to any of the Company's registered marks. The Company's brand identity and trademark portfolio are well-maintained and do not present material risk.
C. Trade Secrets and Proprietary Technology
The Company's proprietary source code is maintained in controlled repositories with role-based access controls. Based on the documentation reviewed, including the Company's information security policies, source code management procedures, and access logs, the access controls appear to be adequate and consistent with industry best practices for a company of Cloudium's size and nature.
Employee invention assignment agreements are in place for substantially all employees across the Company's US, UK, India, and Germany operations. These agreements generally provide that all intellectual property created by employees in the course of their employment is assigned to the Company. Non-disclosure and confidentiality agreements are also in place with contractors, consultants, and third-party developers who have access to the Company's proprietary technology or confidential information.
We did not identify any material gaps in the Company's intellectual property assignment or confidentiality framework that would present a risk of ownership disputes or unauthorized disclosure of trade secrets, although we note that the enforceability of certain restrictive covenant provisions in India may be limited under Section 27 of the Indian Contract Act (discussed further in Section IX.C below).
D. Open-Source Software
Cloudium utilizes a number of open-source software components in its technology platform. We reviewed the Company's open-source inventory, which catalogues the open-source components used, their applicable licenses, and their deployment within the Company's technology stack.
The review identified the use of certain copyleft-licensed components, including components licensed under the GNU General Public License version 2 ("GPL v2") and the GNU Lesser General Public License ("LGPL"). However, these copyleft-licensed components are used exclusively in non-customer-facing internal tools and are not incorporated into or distributed as part of the Company's proprietary customer-facing SaaS platform. Based on our review of the Company's open-source audit report (prepared by the Company's internal engineering team), no material "copyleft contamination" risk was identified with respect to the Company's proprietary software. The copyleft-licensed components are isolated from the proprietary codebase through appropriate architectural separation.
Notwithstanding the foregoing, open-source software compliance is an area that warrants ongoing vigilance. We recommend that the definitive merger agreement include a specific representation and warranty regarding the Company's compliance with all open-source software licenses, and that the R&W insurance policy provide coverage for claims arising from open-source non-compliance.
E. Technology License — Helix Data Systems GmbH
As discussed in detail in Section IV.B.2 above, the Helix Data Technology License Agreement is a material technology license that supports certain data analytics and business intelligence functionality within the Cloudium platform. The termination-for-change-of-control provision in this license presents a material risk that, if not resolved prior to closing, could require the Company to develop or license replacement technology at significant cost and with potential operational disruption.
The Company has initiated consent/waiver negotiations with Helix Data, and we are coordinating with Ridgeway Phelps & Sato LLP on the status of those negotiations. We will continue to monitor this matter closely and provide updates to the Deal Team as developments warrant.
F. Data Privacy and Cybersecurity
Cloudium processes significant volumes of customer data globally in connection with its cloud-based ERP, CRM, and business intelligence platform. The Company is subject to a complex web of data protection and privacy regulations, including:
• General Data Protection Regulation (GDPR) — applicable to the Company's UK and EU operations through Cloudium Technologies UK Ltd. and Cloudium Solutions GmbH
• California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) — applicable to the Company's processing of personal information of California residents
• Sector-specific requirements — including requirements imposed by the Company's government contractor customers (Aegis Federal and others)
We reviewed the Company's privacy policies, data processing agreements (DPAs) with customers and vendors, and data protection impact assessments. The Company's privacy practices appear to be generally consistent with market practice for a SaaS company of Cloudium's size and complexity. Data processing agreements are in place with the Company's major hosting and infrastructure providers, and standard contractual clauses (SCCs) or other appropriate cross-border data transfer mechanisms are utilized for international data transfers.
The Company disclosed that no material data breaches have occurred in the prior three years. The Company maintains a cyber-incident response plan that was reviewed and appears to be comprehensive and regularly tested.
The Company has obtained and maintains FedRAMP authorization for its government cloud offering, which is a critical requirement for the Company's relationship with Aegis Federal Solutions Inc. and other government contractor customers. The FedRAMP authorization was obtained through the Joint Authorization Board (JAB) process and is subject to ongoing continuous monitoring requirements. The Company's FedRAMP compliance status was confirmed based on the documentation reviewed.
We recommend that the definitive merger agreement include specific representations and warranties regarding data privacy compliance, cybersecurity practices, absence of data breaches, and FedRAMP authorization status. Data privacy and cybersecurity representations should also be included as covered representations under the R&W insurance policy.
G. Recommended Merger Agreement Protections
Based on the findings in this section, we recommend the following protections:
• Comprehensive intellectual property representations and warranties covering ownership, non-infringement, validity, and open-source license compliance.
• Technology and data privacy representations covering compliance with applicable data protection laws, data processing agreements, absence of material data breaches, FedRAMP authorization, and cybersecurity practices.
• A specific indemnification obligation for any intellectual property-related claims arising from pre-closing acts or omissions.
• R&W insurance coverage for intellectual property and data privacy representations, with appropriate coverage limits and terms.
VI. LITIGATION AND DISPUTES
A. Pending Litigation
Two pending litigation matters were identified in the data room and confirmed through management discussions:
1. Employment Dispute (UK)
A former employee of Cloudium Technologies UK Ltd. has filed a wrongful dismissal claim in the London Employment Tribunal. The claimant alleges that their dismissal was procedurally unfair and seeks damages of approximately £350,000 (approximately $437,500 at current exchange rates). Counsel for Cloudium UK (Ridgeway Phelps & Sato LLP, London office) has advised that the Company views the claim as without merit and intends to defend the matter vigorously. The claim is at a preliminary stage, and a hearing date has not yet been set. Based on our review of the available documentation and counsel's assessment, we rate the exposure on this matter as LOW.
2. Customer Billing Dispute (US)
A civil action has been filed in the Superior Court of the State of California, County of San Francisco, by a mid-market customer of Cloudium alleging overcharging under a SaaS subscription agreement. The amount in dispute is approximately $2,100,000. The case is in early-stage discovery, and the Company has filed an answer denying the material allegations. The Company's litigation counsel views the claim as manageable and believes that the customer's claims are based on a misinterpretation of the pricing terms in the applicable SaaS agreement. Based on our review of the pleadings and counsel's assessment, we rate the exposure on this matter as LOW to MODERATE.
No other material pending litigation, arbitration proceedings, or governmental investigations were identified.
B. Threatened Claims
One threatened claim was identified during the diligence process:
In August 2023, Cloudium received a cease-and-desist letter from a competitor (identity withheld from this memorandum for confidentiality purposes) alleging trade-secret misappropriation in connection with the hiring of a former employee of the competitor. The cease-and-desist letter asserted that the former employee had brought proprietary information and trade secrets from the competitor to Cloudium. Cloudium's outside counsel, Ridgeway Phelps & Sato LLP, assessed the claim as lacking merit and responded to the cease-and-desist letter denying the allegations. No formal legal proceeding has been filed to date. We recommend that this matter be monitored on an ongoing basis, as the risk of formal litigation cannot be entirely eliminated.
No other material threatened claims were identified.
C. Government Investigations
The Company disclosed that there are no pending government investigations by the U.S. Department of Justice ("DOJ"), the Securities and Exchange Commission ("SEC"), the Federal Trade Commission ("FTC"), Her Majesty's Revenue and Customs ("HMRC"), or any foreign regulatory body. No material orders, consent decrees, injunctions, or settlement agreements are currently in effect with respect to the Company or any of its subsidiaries.
D. Recommended Merger Agreement Protections
Based on the findings in this section, we recommend the following protections:
• Standard litigation representation and warranty with a disclosure schedule identifying all pending and threatened litigation matters, including the two pending matters and the trade-secret cease-and-desist letter described above.
• A specific indemnification obligation for the identified litigation matters. We recommend that these matters — the UK employment dispute, the US billing dispute, and the trade-secret cease-and-desist — be carved out from the general indemnity cap and basket as "special indemnities," or, at minimum, be specifically scheduled and identified in the merger agreement to ensure that any losses arising from these matters are fully recoverable by the Buyer.
• The R&W insurance policy should cover the litigation representations, subject to any applicable known-loss exclusions and underwriting conditions.
VII. REGULATORY AND GOVERNMENT CONTRACTS
A. Antitrust / Competition — HSR and CMA
1. HSR Act Filing
The proposed Transaction will require a pre-merger notification filing under the Hart-Scott-Rodino Antitrust Improvements Act of 1976 ("HSR Act"). Both the size-of-transaction threshold (the aggregate consideration exceeds $111.4 million, the current threshold) and the size-of-person thresholds are met. Elaine Forsythe of Calderwood & Harkness LLP will lead the HSR filing preparation and coordination with the Federal Trade Commission ("FTC") and the Antitrust Division of the Department of Justice ("DOJ"). The HSR filing is planned for February 2024, with an expected initial waiting period of 30 days from the date of filing (subject to extension in the event of a Second Request).
2. UK CMA Merger Notification
A merger notification to the UK Competition and Markets Authority ("CMA") is required given the turnover of Cloudium Technologies UK Ltd. in the United Kingdom (£312,000,000 for FYE September 30, 2023), which exceeds the £70 million turnover test under the Enterprise Act 2002. The CMA notification will be prepared in coordination with Albright & Kerr LLP (Fiona McAllister, lead partner). Phase 1 review by the CMA typically takes approximately 40 working days from acceptance of the notification.
3. Preliminary Competitive Assessment
Cloudium operates in the cloud-based enterprise resource planning ("ERP"), customer relationship management ("CRM"), and business intelligence ("BI") software markets. The Buyer, Solara Digital Infrastructure LP, is a financial sponsor (private equity fund) and does not hold any portfolio companies that operate in the same product markets as Cloudium. Accordingly, the Transaction does not raise horizontal overlap concerns. No vertical or conglomerate theories of competitive harm were identified.
Based on this preliminary assessment, the substantive antitrust risk of the Transaction is assessed as LOW. We do not anticipate that the Transaction will receive a Second Request from the FTC or DOJ, or that the CMA will refer the Transaction to a Phase 2 investigation. However, these outcomes cannot be definitively ruled out until the filings have been made and reviewed by the relevant authorities.
B. CFIUS
The Committee on Foreign Investment in the United States ("CFIUS") has jurisdiction to review certain transactions involving foreign investment in US businesses, particularly those involving "TID" (critical technologies, critical infrastructure, or sensitive personal data) US businesses and those involving covered real estate.
Calderwood & Harkness LLP conducted an internal assessment and concluded that Cloudium does not constitute a TID U.S. business and does not hold "covered real estate" within the meaning of the CFIUS regulations. While the Company does process customer data and maintains FedRAMP authorization, the Company is not a US government contractor itself (Aegis Federal is the prime contractor), and the Company's technology is not classified as a critical technology under ITAR, EAR (other than EAR99), or other applicable regulatory frameworks. Accordingly, a voluntary CFIUS notice is not recommended at this time. A separate memorandum setting forth the detailed CFIUS analysis was prepared by Elaine Forsythe and distributed to the Deal Team on November 30, 2023.
C. EU Merger Regulation
Cloudium's EU revenues fall below the jurisdictional thresholds established by the EU Merger Regulation (Regulation (EC) No. 139/2004) ("EUMR"). Specifically, the Company's combined aggregate EU-wide turnover and the individual turnover of the parties in at least three Member States do not meet the applicable thresholds. Accordingly, no EU merger filing is required for this Transaction. A separate memorandum setting forth the EUMR jurisdictional analysis was prepared by Elaine Forsythe and distributed on December 3, 2023.
D. EU Foreign Subsidies Regulation (FSR)
The EU Foreign Subsidies Regulation (Regulation (EU) 2022/2560) ("FSR") imposes notification requirements on certain concentrations where the parties have received significant financial contributions from non-EU governments. The FSR notification thresholds are not triggered for this Transaction based on our analysis of the financial contributions received by Fund VI and its affiliates. A separate memorandum setting forth the FSR analysis was prepared and distributed on December 3, 2023.
E. German FDI Screening (AWV)
The German Federal Ministry for Economic Affairs and Climate Action has authority to review and potentially prohibit certain foreign investments in German businesses operating in sensitive sectors under the Außenwirtschaftsverordnung ("AWV"). Cloudium Solutions GmbH does not operate in a sector designated as sensitive under the AWV (e.g., defense, critical infrastructure, media, telecommunications, or health), and accordingly, no German FDI notification is required. A separate memorandum was prepared and distributed on December 8, 2023.
F. Indian FDI / CCI
The Competition Commission of India ("CCI") has jurisdiction to review mergers that meet the applicable asset and turnover thresholds. Based on the turnover of Cloudium Technologies India Pvt. Ltd., the CCI filing thresholds are not met, and accordingly, no CCI filing is required. Additionally, the downstream change of control of the Indian subsidiary resulting from the acquisition of Cloudium plc does not require prior approval under India's foreign direct investment ("FDI") policy, given that the Indian subsidiary operates in the software sector, which is subject to automatic route FDI approval. A separate memorandum was prepared and distributed on December 10, 2023.
G. Government Contracts — Aegis Federal Relationship
As discussed in Section IV.B.1 above, Cloudium's relationship with Aegis Federal Solutions Inc. is the Company's largest single-customer relationship, generating approximately $84,000,000 in ARR. The Aegis Federal Master SaaS Agreement requires written consent for any change of control of Cloudium, and the receipt of such consent is recommended as a condition precedent to closing.
In connection with the Aegis Federal relationship, we also reviewed the following government contract compliance matters:
• FedRAMP Authorization. The Company has obtained and maintains FedRAMP authorization for its government cloud offering. This authorization is a critical prerequisite for the Company's ability to serve Aegis Federal and other government contractor customers. The FedRAMP authorization status was confirmed based on the documentation reviewed, and no compliance deficiencies were identified.
• Debarment, Suspension, and Exclusion. No debarment, suspension, or exclusion issues were identified with respect to Cloudium or any of its current officers or directors. The Company and its principals are not listed on the System for Award Management (SAM) exclusion list.
• ITAR / EAR Exposure. The Company's products are commercial software and are not subject to the International Traffic in Arms Regulations ("ITAR"). The Export Administration Regulations ("EAR") classification of the Company's products was reviewed, and the products appear to be classified as EAR99 (i.e., items subject to the EAR that are not specifically listed on the Commerce Control List). The Company's export compliance program was reviewed at a summary level and appears to be adequate.
H. Recommended Merger Agreement Protections
Based on the findings in this section, we recommend the following protections:
• Condition precedent to closing: receipt of all required regulatory approvals, including (i) HSR Act clearance (expiration or early termination of the waiting period, or satisfaction of any Second Request) and (ii) CMA unconditional clearance (Phase 1 approval or equivalent).
• Specific representation and warranty regarding government contracts, FedRAMP authorization status, export controls compliance, and absence of debarment, suspension, or exclusion.
• Hell-or-high-water / best efforts covenant regarding the pursuit of antitrust clearance. The scope and specificity of this covenant — including whether Fund VI will be required to agree to divestitures, behavioral remedies, or other conditions imposed by the antitrust authorities — is a key point to be negotiated with the Target.