CONFIDENTIAL — SUBJECT TO NON-DISCLOSURE AGREEMENT DATED SEPTEMBER 5, 2023

CONFIDENTIAL — SUBJECT TO NON-DISCLOSURE AGREEMENT DATED SEPTEMBER 5, 2023
October 8, 2023
CALDERWOOD & HARKNESS LLP 599 Lexington Avenue New York, NY 10022
SUPPLEMENTAL DUE DILIGENCE REQUEST LIST INTELLECTUAL PROPERTY AND TECHNOLOGY
Prepared on behalf of:
Solara Digital Infrastructure LP 1200 Market Street, Suite 3400 Wilmington, DE 19801
Addressed to:
Ridgeway Phelps & Sato LLP 375 Park Avenue New York, NY 10152
Attention: Catherine Answorth, Esq.
As counsel to Cloudium Technologies plc
Matter No.: 1041-00003
Re: Proposed Acquisition of Cloudium Technologies plc — Supplemental Due Diligence Request List No. 2 (Intellectual Property and Technology)
Right-click to update Table of Contents
INTRODUCTORY INSTRUCTIONS
This Supplemental Due Diligence Request List No. 2 (this "Supplemental Request List") supplements the Preliminary Due Diligence Request List dated September 10, 2023 (the "Preliminary Request List"), previously delivered by Calderwood & Harkness LLP on behalf of Solara Digital Infrastructure LP ("Buyer") to Ridgeway Phelps & Sato LLP, as counsel to Cloudium Technologies plc (the "Company"). This Supplemental Request List focuses specifically on intellectual property, technology, data privacy, cybersecurity, and related matters, and should be read in conjunction with the Preliminary Request List. To the extent any item was previously requested in the Preliminary Request List, the inclusion of such item herein is intended to clarify or expand upon the scope of the prior request and is not intended to limit it in any respect.
All defined terms used herein shall have the meanings assigned to them in the Preliminary Request List unless otherwise defined or unless the context requires otherwise. Capitalized terms used herein that are not otherwise defined shall have the meanings ascribed to them in the Draft Transaction Agreement circulated on October 2, 2023.
References to "the Company" refer to Cloudium Technologies plc (Company No. 09734521, registered at 45 Broadwick Street, London W1F 0DB, United Kingdom; US headquarters at 600 Townsend Street, Suite 800, San Francisco, CA 94103) and, unless the context otherwise requires, its direct and indirect subsidiaries, including without limitation:
•  Cloudium Technologies UK Ltd. (Company No. 11287456, registered in England and Wales, with offices in London and Manchester);
•  Cloudium Technologies India Pvt. Ltd. (registered in Bangalore, Karnataka, India); and
•  Cloudium Solutions GmbH (registered in Berlin, Germany).
Where a request is directed to the Company, it is intended to encompass all of the foregoing entities and any other direct or indirect subsidiaries, affiliates, joint ventures, or special purpose vehicles of the Company, unless context clearly indicates otherwise.
All responsive documents and information should be uploaded to the virtual data room established for this transaction (the "VDR"), to which access was granted on September 18, 2023, in the designated IP and Technology folder structure. Where practicable, documents should be organized in accordance with the section and subsection numbering used in this Supplemental Request List. All documents should be uploaded in searchable PDF format (with OCR applied, where applicable), native format (for spreadsheets, databases, and source code documentation), or such other format as may be mutually agreed.
Where documents or information responsive to a particular request are voluminous, the Company may provide summaries, indices, or catalogs in the first instance, provided that the underlying documents are made available for review upon request by Buyer or its advisors. Any such summary should include sufficient detail to enable Buyer to determine whether review of the underlying documents is warranted.
The requests contained herein cover all jurisdictions in which the Company and its subsidiaries operate, including without limitation the United States, the United Kingdom, India, Germany, and any other applicable jurisdiction. Where a request calls for documents or information by jurisdiction, please provide responses organized by jurisdiction to the extent practicable.
To the extent any documents or information responsive to a request are subject to attorney-client privilege, work product protection, or other applicable privilege or protection, please identify such materials and provide a privilege log describing the nature of each withheld document, the date, the author(s) and recipient(s), and the basis for the privilege claim, in sufficient detail for Buyer's counsel to evaluate the claim. We reserve all rights to challenge any such claim.
This Supplemental Request List is not intended to be exhaustive and should not be construed as limiting the scope of Buyer's due diligence investigation. Buyer reserves the right to request additional documents and information as the due diligence process continues.
SECTION I: INTELLECTUAL PROPERTY PORTFOLIO — GENERAL OVERVIEW
1.1 IP Portfolio Summary
1.1.1. A comprehensive schedule (in spreadsheet format) of all intellectual property rights owned, co-owned, licensed (whether inbound or outbound), or otherwise used by the Company and each of its subsidiaries, organized first by type of intellectual property right (patents and patent applications; trademarks, service marks, and trade dress; copyrights and copyright applications; trade secrets and proprietary know-how; and domain names) and second by the entity within the corporate group that is the record owner, applicant, registrant, or licensee of such intellectual property right (i.e., separately identifying assets held by Cloudium Technologies plc, Cloudium Technologies UK Ltd., Cloudium Technologies India Pvt. Ltd., and Cloudium Solutions GmbH, respectively).
1.1.2. For each item of registered or applied-for intellectual property included in the schedule described in Request 1.1.1 above, the schedule should include, at a minimum, the following information:
(a) the title or mark;
(b) the registration number and/or application number (as applicable);
(c) the filing date;
(d) the registration date (if registered);
(e) the jurisdiction(s) in which the registration or application was filed;
(f) the current status of the registration or application (e.g., registered, pending, published, allowed, abandoned, expired, opposed);
(g) the record owner or applicant (specifying the legal entity within the corporate group);
(h) the name of the inventor(s) or author(s) (as applicable);
(i) any co-owners or joint applicants (whether within or outside the corporate group); and
(j) any liens, encumbrances, security interests, or restrictions on the intellectual property.
1.1.3. Identification of any material unregistered intellectual property rights not included in the schedule described above, including unregistered trademarks used in commerce, common law copyrights in material works, and material trade secrets.
1.1.4. Description of the Company's processes and systems for tracking and managing its intellectual property portfolio, including the names of any IP management software or databases used and the individual(s) responsible for portfolio management.
1.2 Patents and Patent Applications
1.2.1. A complete schedule of all patents and patent applications (including utility patents, design patents, provisional applications, PCT international applications, and national phase entries) owned or co-owned by the Company and each of its subsidiaries, in all jurisdictions worldwide. The schedule should include the information specified in Request 1.1.2 above, together with the following additional information for each patent or application:
(a) the technology area or product line to which the patent or application relates;
(b) the named inventor(s) and their employment relationship to the Company at the time of invention;
(c) the patent family to which the patent or application belongs (including all related continuations, continuations-in-part, divisionals, reissues, and foreign counterparts);
(d) the current prosecution status and the name of outside patent counsel handling prosecution;
(e) the priority date and any claims to priority; and
(f) the expected expiration date (taking into account any patent term adjustments or extensions).
1.2.2. Copies of all issued patents (including all claims, specifications, and drawings) and all pending patent applications (including all claims, specifications, drawings, and any published applications).
1.2.3. Complete patent prosecution history files for all pending patent applications, including all office actions, examiner interview summaries, responses to office actions, amendments, declarations, information disclosure statements (IDS), and any other correspondence with the relevant patent office.
1.2.4. Identification of any continuation applications, continuation-in-part applications, divisional applications, reissue applications, or requests for continued examination (RCE) filed or contemplated in connection with any of the Company's patents or patent applications.
1.2.5. Details of any inter partes review (IPR), post-grant review (PGR), covered business method review (CBM), re-examination (ex parte or inter partes), interference, derivation, or opposition proceedings involving any of the Company's patents or patent applications, whether as petitioner/challenger or patent owner, in any jurisdiction. For each such proceeding, please provide:
(a) the proceeding number and tribunal;
(b) the patent(s) or application(s) at issue;
(c) the identity of the opposing party;
(d) the claims at issue;
(e) the current status of the proceeding; and
(f) copies of all petitions, patent owner responses, decisions, and key filings.
1.2.6. A schedule showing the maintenance fee (annuity) payment status for all issued patents in all jurisdictions, including the date of the last maintenance fee payment and the due date and amount of the next maintenance fee payment. Identification of any patents for which a maintenance fee payment has been missed or for which a surcharge has been paid.
1.2.7. Identification of any patents or patent applications that have been abandoned, allowed to lapse, withdrawn, or are subject to terminal disclaimers, together with an explanation of the reason for each such action and the date on which it occurred.
1.2.8. Identification of any patents or patent applications that are subject to any obligation to license or grant rights to any third party (e.g., under standards-essential patent commitments, FRAND/RAND obligations, or cross-license agreements).
1.3 Trademarks, Service Marks, and Trade Dress
1.3.1. A complete schedule of all registered and pending trademarks, service marks, trade dress registrations, and applications in all jurisdictions worldwide, including the information specified in Request 1.1.2 above, together with the following additional information:
(a) the mark as registered or applied for (word mark, stylized mark, or design mark, with images where applicable);
(b) the goods and/or services covered by the registration or application (including class numbers);
(c) the basis for filing (e.g., use in commerce, intent to use, foreign registration);
(d) the date of first use and date of first use in commerce (for US registrations);
(e) the next renewal date and any upcoming Section 8 or Section 15 filing deadlines (for US registrations); and
(f) the current status, including whether any Statement of Use, Declaration of Use, or renewal filing is pending or overdue.
1.3.2. Copies of all trademark and service mark registration certificates, and copies of all pending applications (as filed).
1.3.3. Details of any opposition, cancellation, expungement, or other adversarial proceedings before any trademark office or tribunal involving any of the Company's trademarks, service marks, or trade dress, whether as applicant/registrant or opposing party. For each such proceeding, provide the proceeding number, tribunal, opposing party, mark(s) at issue, current status, and copies of all key filings.
1.3.4. Identification of any unregistered trademarks, service marks, brand names, product names, logos, slogans, or trade dress used in commerce by the Company that are not covered by a registration or pending application. For each such mark, provide a description of the mark, the goods and/or services with which it is used, the geographic scope of use, and the date of first use.
1.3.5. Copies of any trademark watch service reports or monitoring reports received by the Company within the past three years, and any notices of potential infringement or confusingly similar marks identified through such monitoring.
1.3.6. Copies of any coexistence agreements, consent-to-use agreements, concurrent use agreements, or other agreements with third parties relating to the use of trademarks or service marks that may be similar or potentially confusing with the Company's marks.
1.4 Copyrights
1.4.1. A schedule of all copyright registrations and pending copyright applications in all jurisdictions, including the registration/application number, title of the work, author(s), claimant, date of creation, date of first publication, date of registration, and jurisdiction.
1.4.2. Copies of all copyright registration certificates and pending applications.
1.4.3. Identification of all material copyrightable works created by or for the Company (whether or not registered), including but not limited to:
(a) software source code and object code for the Company's principal products and internal tools;
(b) software documentation, user manuals, and technical specifications;
(c) marketing materials, brochures, white papers, and promotional content;
(d) training materials, e-learning content, and certification programs;
(e) website content, blog posts, and other digital content;
(f) databases and data compilations; and
(g) audiovisual works, graphics, and design elements.
1.4.4. Copies of all copyright assignment agreements, work-for-hire agreements, or other agreements pursuant to which copyright in any material work was assigned or transferred to the Company by any employee, independent contractor, consultant, or third party.
1.5 Domain Names
1.5.1. A complete list of all domain names owned, registered, or controlled by the Company and each of its subsidiaries, including for each domain name:
(a) the domain name;
(b) the registrant (specifying the entity within the corporate group);
(c) the registrar;
(d) the date of registration;
(e) the expiration/renewal date;
(f) the auto-renewal status;
(g) the name server configuration;
(h) the WHOIS privacy/proxy service status; and
(i) whether the domain name is actively used (and, if so, the purpose — e.g., primary website, product-specific site, email, redirect, parked).
1.5.2. Identification of any domain name disputes, Uniform Domain-Name Dispute-Resolution Policy (UDRP) proceedings, Uniform Rapid Suspension (URS) proceedings, cybersquatting claims, or other domain-name-related disputes involving the Company (whether as complainant or respondent), and copies of all related filings and decisions.
1.5.3. Identification of any domain names that are material to the Company's business but are not owned or controlled by the Company (e.g., domains held by third-party partners, former employees, or domain holding services).
1.6 Trade Secrets and Proprietary Know-How
1.6.1. A description of the Company's trade secret identification, classification, and protection policies and procedures, including any formal trade secret management program.
1.6.2. Identification (by category, without requiring disclosure of the trade secrets themselves) of the Company's material trade secrets and proprietary know-how, including but not limited to:
(a) proprietary algorithms (including any algorithms used in the Company's ERP, CRM, and business-intelligence platforms);
(b) customer data analytics methodologies and models;
(c) pricing models, competitive analysis frameworks, and go-to-market strategies;
(d) proprietary development methodologies, tools, and processes;
(e) engineering know-how, system architecture designs, and optimization techniques;
(f) customer lists, vendor lists, and business relationship information; and
(g) any other categories of confidential business or technical information that the Company considers to be trade secrets.
1.6.3. Description of the physical and technical safeguards employed by the Company to protect trade secret information, including access restrictions, encryption, facility security, network segmentation, document classification and handling procedures, and employee exit protocols.
1.6.4. Copies of any trade secret audits, assessments, or inventories conducted by the Company (whether internally or by outside counsel or consultants) within the past five years.
1.6.5. Identification of any instances in which the Company believes its trade secrets may have been misappropriated, disclosed without authorization, or otherwise compromised, and a description of the remedial actions taken.
SECTION II: IP OWNERSHIP AND CHAIN OF TITLE
2.1 IP Assignment Agreements
2.1.1. Copies of all agreements (including assignment agreements, bills of sale, deeds of assignment, and instruments of transfer) pursuant to which any intellectual property was assigned, transferred, or conveyed to the Company or any of its subsidiaries by any person or entity, including founders, employees, independent contractors, consultants, former employers of key personnel, acquired companies, and third parties.
2.1.2. Identification of any gaps, defects, or unresolved issues in the chain of title for any material intellectual property asset of the Company, including any situation in which an assignment was not executed, was defectively executed, or was executed but not recorded with the relevant intellectual property office.
2.1.3. Copies of all work-for-hire agreements entered into by the Company with any person or entity, under which works were created for the Company as works made for hire within the meaning of applicable copyright law.
2.1.4. Copies of any confirmatory assignments, nunc pro tunc assignments, or corrective assignments executed to address chain-of-title issues.
2.2 Employee and Contractor IP Assignment Provisions
2.2.1. Copies of the Company's standard form employee invention assignment and confidentiality agreement (or equivalent proprietary information and inventions agreement, or PIIA) for each jurisdiction in which the Company employs personnel, including:
(a) United States (California and any other state-specific versions);
(b) United Kingdom;
(c) India; and
(d) Germany.
2.2.2. For each jurisdiction listed above, the percentage of current employees who have executed the applicable IP assignment agreement or equivalent, and the percentage of current independent contractors and consultants who have executed the applicable IP assignment agreement or equivalent.
2.2.3. Identification of any current or former employees or independent contractors who have:
(a) refused to execute an IP assignment agreement;
(b) executed an IP assignment agreement but carved out or excluded pre-existing inventions, works, or other intellectual property from the scope of the assignment (together with a description or list of such carved-out IP); or
(c) asserted any claim of ownership, co-ownership, or other right in any intellectual property developed during the course of their engagement with the Company.
2.2.4. With respect to the Company's research and development personnel at Cloudium Technologies India Pvt. Ltd. (which we understand employs approximately 2,400 individuals engaged in R&D and support functions), please provide:
(a) the form of employment agreement and IP assignment agreement used for India-based R&D personnel;
(b) confirmation of the percentage of India-based R&D personnel who have executed such agreements;
(c) identification of any India-specific legal limitations on the enforceability of employee IP assignment provisions (including under the Indian Patents Act, 1970, and the Indian Copyright Act, 1957);
(d) identification of any key R&D personnel at Cloudium Technologies India Pvt. Ltd. who have carved out pre-existing IP or who have not executed IP assignment agreements; and
(e) a description of any IP developed by India-based personnel that is owned by or could be claimed by such personnel (or any former employer of such personnel) rather than by the Company.
2.3 IP Developed by Subsidiaries
2.3.1. A description of the IP development activities conducted at each subsidiary entity, including the nature of the development work performed, the approximate number of personnel engaged in such activities, and the location(s) at which such work is performed. Specifically, please describe:
(a) Cloudium Technologies plc (US headquarters, San Francisco) — approximately how many personnel are engaged in IP development and the nature of their work;
(b) Cloudium Technologies UK Ltd. (approximately 1,200 employees in London and Manchester) — the nature and scope of IP development activities performed by UK personnel;
(c) Cloudium Technologies India Pvt. Ltd. (approximately 2,400 employees in Bangalore) — the nature and scope of IP development, engineering, quality assurance, and related activities performed by India personnel; and
(d) Cloudium Solutions GmbH (approximately 400 employees in Berlin) — the nature and scope of IP development, product localization, and related activities performed by German personnel.
2.3.2. Copies of all intercompany agreements governing the ownership, licensing, development, cost-sharing, or use of intellectual property among the Company and its subsidiaries, including:
(a) intercompany IP license agreements;
(b) intercompany cost-sharing agreements or cost contribution arrangements;
(c) intercompany services agreements relating to R&D, engineering, or IP development;
(d) transfer pricing documentation (including transfer pricing studies, benchmarking analyses, and advance pricing agreements) related to IP development and ownership among the Company and its subsidiaries; and
(e) any intercompany agreements relating to the allocation of income, costs, or risks associated with IP development.
2.3.3. Identification of any intellectual property that is owned by a subsidiary entity rather than by Cloudium Technologies plc (the parent company), and a description of the basis for such ownership (e.g., the IP was developed locally, was assigned to the subsidiary, or was registered in the subsidiary's name).
2.3.4. Description of any plans or actions taken to centralize IP ownership within the parent entity or to rationalize the allocation of IP among the Company and its subsidiaries.
2.4 Government-Funded IP
2.4.1. Identification of any intellectual property developed, in whole or in part, with funding from any government source (federal, state, local, or foreign), including grants, contracts, subcontracts, cooperative agreements, or other government funding mechanisms. With respect to such government-funded IP, please identify:
(a) the specific government funding source and the relevant contract, grant, or agreement number;
(b) the nature of the IP developed;
(c) the extent to which government funding contributed to the development;
(d) any government rights attaching to such IP, including march-in rights, government use licenses, or unlimited rights; and
(e) any reporting obligations (e.g., invention disclosure, election of title, utilization reports) required under the applicable funding agreement.
2.4.2. With particular reference to the Company's relationship with Aegis Federal Solutions Inc. (which we understand accounts for approximately $84,000,000 in annual recurring revenue and involves the provision of services to US government end-users), please provide:
(a) copies of all contracts, subcontracts, or agreements between the Company and Aegis Federal Solutions Inc. (or between the Company and any US government agency) that include provisions regarding IP ownership, licensing, or data rights;
(b) identification of any IP developed under or in connection with such contracts that is subject to government rights under FAR Part 27, DFARS Part 227, or any other applicable government IP regulations;
(c) identification of any "subject inventions" (as defined in FAR 52.227-11 or equivalent clause) for which the Company has or has not elected title; and
(d) copies of any invention disclosures, confirmatory licenses, or other filings made with or on behalf of the US government relating to IP developed under such contracts.
2.5 University and Research Institution Collaborations
2.5.1. Copies of all agreements between the Company and any university, research institution, national laboratory, or academic collaborator under which intellectual property was developed, co-developed, licensed, or otherwise obtained, including sponsored research agreements, collaborative research agreements, joint development agreements, and material transfer agreements.
2.5.2. For each such agreement, please identify:
(a) the university or research institution;
(b) the nature of the research conducted;
(c) the IP developed or expected to be developed under the agreement;
(d) the allocation of ownership of resulting IP (sole ownership by the Company, sole ownership by the institution, joint ownership, or other arrangement);
(e) any license rights retained by the institution (including reserved research use rights);
(f) any publication rights or restrictions;
(g) any commercialization milestones or diligence obligations; and
(h) any terms that may affect the Company's ability to freely use, license, or assign the resulting IP.
2.5.3. Description of any joint ownership arrangements for IP arising from university or research institution collaborations, including any joint ownership agreements or understandings regarding each party's right to exploit the jointly owned IP.
SECTION III: IP LICENSES — INBOUND
3.1 Inbound License Agreements
3.1.1. Copies of all material agreements under which the Company or any of its subsidiaries licenses, receives, or otherwise obtains rights to use intellectual property from any third party, including but not limited to technology license agreements, patent license agreements, copyright license agreements, trademark license agreements, trade secret license agreements, and data license agreements.
3.1.2. A schedule (in spreadsheet format) of all such inbound license agreements, identifying for each agreement:
(a) the licensor;
(b) the licensed intellectual property (described with reasonable specificity);
(c) the scope of the license (exclusive or non-exclusive; field-of-use limitations, if any; territory);
(d) the term of the license (including any renewal provisions);
(e) the fee structure (one-time payment, ongoing royalties, minimum commitments, usage-based fees);
(f) any restrictions on sublicensing, assignment, or transfer;
(g) any change of control provisions, including provisions that would terminate the license, require consent to assignment, or modify the license terms upon a change of control of the Company;
(h) any anti-assignment provisions or provisions requiring consent for assignment (whether by operation of law, merger, or otherwise);
(i) any most-favored-nation or pricing parity provisions;
(j) any audit rights;
(k) any termination provisions (including termination for convenience, termination for cause, and termination upon insolvency or bankruptcy); and
(l) the current status of the agreement (active, expired, terminated, or in dispute).
3.1.3. With specific reference to the Technology License Agreement with Helix Data Systems GmbH (Frankfurt, Germany), which we understand contains a termination-for-change-of-control clause:
(a) a complete, unredacted copy of such agreement, including all amendments, addenda, side letters, and schedules;
(b) identification of all change of control provisions, anti-assignment provisions, and consent-required provisions in such agreement, with the relevant sections cited;
(c) an analysis of whether the proposed transaction structure (reverse triangular merger of Stratos Merger Sub Inc. with and into Cloudium Technologies plc, with the Company surviving as a wholly owned subsidiary of Buyer) constitutes a "change of control" or triggers any assignment provision under such agreement;
(d) identification of the consequences of triggering any such provision (termination, renegotiation, consent requirement, fee adjustment, etc.);
(e) the status of any communications with Helix Data Systems GmbH regarding the proposed transaction, including whether any consent or waiver has been sought or obtained; and
(f) the business significance of the licensed technology to the Company's products and operations, including an estimate of the cost and timeline that would be required to replace the licensed technology if the license were terminated.
3.2 Third-Party Software Licenses
3.2.1. A comprehensive schedule of all third-party commercial software licenses used by the Company in its products or internal operations, including but not limited to:
(a) enterprise software (ERP, CRM, HRIS, finance, accounting);
(b) middleware and integration platforms;
(c) database management systems;
(d) development tools, IDEs, and SDKs;
(e) cloud infrastructure services (compute, storage, networking, serverless, managed services);
(f) analytics, monitoring, and observability tools;
(g) security tools (SIEM, endpoint protection, vulnerability scanning, WAF);
(h) communication and collaboration tools; and
(i) any other material third-party software.
3.2.2. Identification of all third-party proprietary software that is embedded in, bundled with, linked to, or distributed as part of the Company's SaaS products (as distinguished from software used solely for internal operations), together with the applicable license terms for each such embedded component.
3.2.3. Copies of all material third-party software license agreements (including master agreements, order forms, statements of work, and amendments) for licenses with annual fees or total contract value exceeding $100,000.
3.2.4. Identification of any third-party software licenses that contain restrictions on sublicensing, redistribution, incorporation into other products, use in a SaaS or cloud-delivery model, or use for the benefit of third parties, and an assessment of the Company's compliance with such restrictions.
3.3 Change of Control and Assignment Provisions in Inbound Licenses
3.3.1. A summary schedule (in spreadsheet format) identifying all inbound IP and technology license agreements that contain change of control, anti-assignment, consent-required, or similar provisions that may be triggered by the proposed transaction (the reverse triangular merger of Stratos Merger Sub Inc. with and into Cloudium Technologies plc). For each such agreement, the schedule should identify:
(a) the counterparty;
(b) the agreement name and date;
(c) the specific provision(s) at issue (with section references);
(d) a description of the triggering event(s);
(e) the consequence of triggering (termination, consent requirement, fee adjustment, renegotiation, or other);
(f) whether the proposed transaction structure would constitute a triggering event under the Company's counsel's analysis;
(g) whether consent or waiver has been sought;
(h) the current status of any consent or waiver request; and
(i) the estimated business impact if consent is not obtained or the provision is triggered.
3.3.2. An analysis by the Company's legal counsel of whether the proposed transaction structure (reverse triangular merger) triggers the change of control, anti-assignment, or consent provisions identified in the schedule above, including identification of any agreements where the analysis is uncertain or fact-dependent.
3.3.3. Copies of all consents, waivers, or estoppel certificates that have been sought, obtained, or are pending in connection with the proposed transaction.
SECTION IV: IP LICENSES — OUTBOUND
4.1 Outbound License Agreements
4.1.1. Copies of all material agreements under which the Company or any of its subsidiaries licenses, sublicenses, or otherwise grants rights to its intellectual property to any third party, including technology licenses, patent licenses, copyright licenses, trademark licenses, brand licenses, and data licenses.
4.1.2. A schedule (in spreadsheet format) of all such outbound license agreements, identifying for each agreement:
(a) the licensee;
(b) the licensed intellectual property (described with reasonable specificity);
(c) the scope of the license (exclusive or non-exclusive; field-of-use limitations; territory);
(d) the term of the license (including renewal provisions);
(e) the fee structure (one-time payment, ongoing royalties, minimum commitments, usage-based fees);
(f) any exclusivity provisions or restrictions on the Company's ability to license the same IP to others;
(g) any change of control or termination provisions;
(h) any source code access or escrow obligations; and
(i) the current status of the agreement.
4.2 Customer Agreements with IP License Components
4.2.1. Copies of all form customer agreements used by the Company, including the current versions and any prior versions used within the past three years, of:
(a) the Master SaaS Agreement (or Master Subscription Agreement);
(b) the End-User License Agreement (EULA);
(c) the standard order form or subscription order;
(d) the acceptable use policy;
(e) the service level agreement (SLA); and
(f) any other standard terms and conditions applicable to customer relationships.
4.2.2. Identification of all customer agreements that contain non-standard IP license terms, including but not limited to:
(a) grants of exclusive use rights in any field or territory;
(b) rights to access, receive, or use the Company's source code (other than through escrow arrangements);
(c) perpetual license rights (surviving termination or expiration of the subscription);
(d) broad indemnification obligations beyond the Company's standard terms;
(e) restrictions on the Company's ability to use or license technology to competing customers; and
(f) any "most favored customer" or pricing parity provisions.
4.2.3. With specific reference to the Master SaaS Agreement with Aegis Federal Solutions Inc. (US government contractor; approximately $84,000,000 in annual recurring revenue):
(a) a complete, unredacted copy of the Master SaaS Agreement and all related agreements, amendments, order forms, statements of work, and exhibits;
(b) identification of all change of control provisions, anti-assignment provisions, consent-required provisions, and termination provisions in such agreement, with relevant sections cited;
(c) identification of all provisions specific to government customers or government end-use, including government data rights clauses, FAR/DFARS flowdown provisions, security requirements, audit rights, and compliance obligations;
(d) identification of all IP license provisions, including the scope of the license granted, any restrictions on the Company's use of its own IP, and any provisions regarding ownership of customizations, configurations, or derivative works;
(e) identification of any source code escrow obligations applicable to this customer;
(f) an analysis of whether the proposed transaction triggers any change of control, assignment, or consent provision in this agreement; and
(g) the current status of any communications with Aegis Federal Solutions Inc. regarding the proposed transaction.
4.3 Reseller, Distributor, and OEM Agreements
4.3.1. Copies of all reseller agreements, distributor agreements, value-added reseller (VAR) agreements, system integrator (SI) agreements, and original equipment manufacturer (OEM) agreements under which the Company's technology, products, or services are marketed, distributed, resold, or embedded by third parties.
4.3.2. For each such agreement, identification of:
(a) the counterparty;
(b) the products or services covered;
(c) the territory and exclusivity provisions (if any);
(d) any exclusive distribution rights, rights of first refusal, or rights of first offer;
(e) any most-favored-nation pricing provisions;
(f) the fee structure and revenue sharing arrangements;
(g) any minimum commitment or purchase obligations;
(h) change of control and assignment provisions; and
(i) the term and termination provisions.
4.4 API and Integration Partner Agreements
4.4.1. Copies of all agreements governing third-party API integrations, technology partnerships, co-development arrangements, and similar relationships under which the Company's technology interfaces with or is combined with third-party technology.
4.4.2. For each such agreement, identification of:
(a) the scope of the API or integration access granted;
(b) any IP cross-licenses or grants of IP rights resulting from the partnership;
(c) any joint ownership of IP arising from the collaboration;
(d) any restrictions on the Company's ability to develop competing integrations or to partner with competitors of the counterparty;
(e) any data sharing or data access provisions; and
(f) change of control and termination provisions.
SECTION V: SOURCE CODE AND SOFTWARE DEVELOPMENT
5.1 Source Code Repository
5.1.1. A description of the source code management systems and repositories (e.g., Git, Aldermere Data Systems, Aldermere Software, Strathmore Solutions, SVN, Perforce) used by the Company to store, manage, and version control its source code, including the name of each system, the hosting model (self-hosted, cloud-hosted, or hybrid), and the approximate number of repositories maintained.
5.1.2. A high-level architecture diagram of the Company's principal software products, including the cloud-native ERP, CRM, and business-intelligence SaaS solutions. The diagram should identify the major components, modules, services, and layers of the platform, including front-end applications, back-end services, API layers, data storage layers, and integration points.
5.1.3. Identification of the principal software modules, services, and components comprising each product line, including a brief description of the function and purpose of each major component.
5.1.4. Approximate number of lines of code (in the aggregate and broken down by major product or module) for each major product in the Company's portfolio.
5.1.5. Identification of the programming languages, frameworks, and technology stacks used in the Company's products.
5.2 Source Code Ownership and Access
5.2.1. Description of access controls for the Company's source code repositories, including:
(a) role-based access control (RBAC) policies and procedures;
(b) multi-factor authentication (MFA) requirements for source code access;
(c) audit logging of source code access, commits, and repository changes;
(d) restrictions on downloading, copying, or transferring source code outside of authorized systems; and
(e) separation of access by team, product, or sensitivity level.
5.2.2. Identification of all third parties (including independent contractors, outsourced development firms, consulting firms, technology partners, and other non-employees) who have or have had access to the Company's source code within the past three years. For each such third party, please identify:
(a) the name of the third party;
(b) the nature and scope of their access;
(c) the applicable contractual protections (NDA, IP assignment, source code access agreement); and
(d) whether access has been terminated and, if so, the date of termination and the measures taken to revoke access.
5.2.3. Copies of all contracts governing third-party access to the Company's source code, including any confidentiality agreements, IP assignment agreements, and source code access agreements.
5.3 Source Code Escrow Arrangements
5.3.1. Copies of all source code escrow agreements to which the Company is a party (whether as depositor or beneficiary).
5.3.2. For each source code escrow agreement, identification of:
(a) the escrow agent;
(b) the depositor (if not the Company);
(c) the beneficiary(ies);
(d) the release conditions (e.g., insolvency, material breach, cessation of business, failure to maintain);
(e) the scope of the deposited materials;
(f) the current deposit status (date of last deposit, whether deposits are current);
(g) the verification status (whether the deposited materials have been verified for completeness and functionality); and
(h) any obligations of the Company to update or supplement escrow deposits.
5.3.3. Identification of all customer agreements that require the Company to maintain a source code escrow arrangement, and confirmation of whether such arrangements are in place and current.
5.4 Software Development Process
5.4.1. A description of the Company's software development lifecycle (SDLC), including:
(a) the development methodology employed (e.g., Agile, Scrum, Kanban, SAFe, DevOps, or hybrid);
(b) the typical release cadence for each major product line;
(c) the quality assurance (QA) processes, including manual testing, automated testing, regression testing, and user acceptance testing;
(d) the code review practices, including peer review, pull request workflows, and code quality standards; and
(e) the processes for prioritizing, tracking, and managing bugs, defects, and technical debt.
5.4.2. Description of the Company's use of automated testing frameworks, continuous integration/continuous deployment (CI/CD) pipelines, and related DevOps tooling, including the specific tools used (e.g., Jenkins, CircleCI, Aldermere Data Systems Actions, Aldermere Software CI, ArgoCD, Terraform).
5.4.3. Identification of development teams by location and function, including:
(a) San Francisco, California (US headquarters);
(b) London and Manchester, United Kingdom;
(c) Bangalore, India; and
(d) Berlin, Germany.
For each location, please provide the approximate number of engineers and developers, the product lines or components for which they are responsible, and the reporting structure.
5.5 Third-Party Code and Components
5.5.1. Identification of all third-party proprietary code, libraries, SDKs, frameworks, or components that are incorporated into, linked with, bundled with, or distributed as part of the Company's products (excluding open-source software, which is addressed in Section VI below).
5.5.2. For each such third-party component, provide the following information:
(a) the name of the component and the vendor or publisher;
(b) the version currently in use;
(c) the applicable license terms, including any restrictions on modification, redistribution, sublicensing, or use in a SaaS/cloud-delivery model;
(d) the manner in which the component is used (statically linked, dynamically linked, embedded, bundled, or API-accessed);
(e) the specific product(s) or module(s) in which the component is used; and
(f) whether the license permits use following the proposed change of control.
SECTION VI: OPEN-SOURCE SOFTWARE
6.1 Open-Source Software Inventory
6.1.1. A complete inventory or software bill of materials (SBOM) of all open-source software (OSS) components that are used in, incorporated into, linked with (statically or dynamically), combined with, or distributed as part of the Company's products, services, and internal tools. The SBOM should be provided in a standard machine-readable format (e.g., SPDX, CycloneDX) to the extent available, or in spreadsheet format.
6.1.2. For each OSS component identified in the SBOM, the following information should be provided:
(a) the name of the OSS component;
(b) the version currently in use;
(c) the applicable open-source license(s) (e.g., MIT, Apache 2.0, BSD, GPL v2, GPL v3, LGPL, AGPL, MPL, EUPL, or other);
(d) the manner of use (e.g., statically linked, dynamically linked, modified, unmodified, distributed, SaaS-only delivery, internal use only);
(e) the specific product(s), module(s), or service(s) in which the component is used;
(f) the location within the codebase where the component is found; and
(g) whether the component has been modified by the Company, and if so, the nature and extent of the modifications.
6.2 Open-Source License Compliance
6.2.1. A description of the Company's open-source compliance policies, procedures, and governance framework, including:
(a) the process for evaluating and approving the use of new OSS components (including any approval workflows, legal review processes, or license compatibility checks);
(b) the process for monitoring and updating OSS components (including tracking of security vulnerabilities, license changes, and end-of-life status);
(c) the tools used for OSS compliance management and license scanning;
(d) the training provided to developers on OSS compliance; and
(e) the escalation and remediation processes for identified compliance issues.
6.2.2. Copies of all open-source compliance policy documents, internal guidelines, developer handbooks, and training materials.
6.2.3. Identification of the individual(s) or team(s) responsible for OSS compliance oversight, including their title(s) and organizational reporting line(s).
6.2.4. Copies of the results of all open-source license scans, audits, or assessments conducted within the past three years, whether using commercial tools (e.g., Penrose Solutions, Glenrock Systems, Larkspur Data Systems Open Source, Crowne Albany Solutions, Meridian Technologies) or through manual review. For each scan or audit, please identify the date, scope (products/codebases covered), tool used, findings, and remediation actions taken.
6.3 Copyleft and Reciprocal License Exposure
6.3.1. Identification of all OSS components licensed under copyleft or reciprocal licenses that are used in the Company's products or services, including but not limited to components licensed under:
(a) GNU General Public License (GPL), versions 2 and 3;
(b) GNU Lesser General Public License (LGPL), versions 2.1 and 3;
(c) GNU Affero General Public License (AGPL), version 3;
(d) Mozilla Public License (MPL), versions 1.1 and 2.0;
(e) European Union Public License (EUPL);
(f) Common Development and Distribution License (CDDL); and
(g) any other copyleft or reciprocal license identified by the OSI or the Free Software Foundation.
6.3.2. For each copyleft-licensed OSS component identified above, please provide:
(a) a description of how the component is used within the Company's products (e.g., statically linked, dynamically linked, used as a standalone process, modified, incorporated into proprietary code);
(b) whether the Company's proprietary code interacts with the copyleft-licensed component in a manner that could constitute a "derivative work" or "combined work" under the applicable license;
(c) whether the copyleft-licensed component is distributed to end users or delivered solely through a SaaS model;
(d) the Company's assessment of whether its use of the component triggers any copyleft obligations, including obligations to:
(i) disclose the source code of the copyleft-licensed component (including any modifications);
(ii) disclose the source code of the Company's proprietary code that is linked with, combined with, or constitutes a derivative work of the copyleft-licensed component; or
(iii) license the Company's proprietary code under the terms of the copyleft license; and
(e) a description of the steps taken by the Company to comply with any applicable copyleft obligations (e.g., providing source code offers, maintaining corresponding source archives, including license notices).
6.3.3. With specific reference to any AGPL-licensed components used in connection with the Company's SaaS-delivered products:
(a) identification of each AGPL-licensed component;
(b) a description of how the component is deployed in the SaaS environment (e.g., server-side execution, interaction with users over a network);
(c) the Company's assessment of whether Section 13 of the AGPL (the "network use" provision) is triggered by the Company's use of the component, and if so, the Company's compliance posture; and
(d) identification of any measures taken to isolate AGPL-licensed components from proprietary code (e.g., process isolation, containerization, API boundaries).
6.3.4. Copies of any legal opinions, memoranda, analyses, or assessments (whether by in-house or outside counsel) regarding the Company's copyleft compliance posture, including any assessments of specific copyleft risk exposures.
6.4 Open-Source Contributions
6.4.1. A description of any contributions of the Company's proprietary code or original works to open-source projects, including the name of the project, the nature of the contribution, the license under which the contribution was made, and whether the contribution included any code that was previously proprietary to the Company.
6.4.2. Copies of any contributor license agreements (CLAs), developer certificates of origin (DCOs), or similar agreements executed by the Company or its employees in connection with contributions to open-source projects.
6.4.3. Identification of any open-source projects that are maintained, sponsored, or governed by the Company, including a description of the project, the applicable license, and the Company's role (maintainer, core contributor, sponsor, or governance participant).
6.5 Open-Source Litigation and Disputes
6.5.1. Identification of any claims, demands, cease-and-desist letters, allegations, or disputes (whether pending, threatened, or resolved) relating to the Company's use of open-source software, including any allegations of:
(a) failure to comply with open-source license terms (e.g., failure to provide required attribution, failure to disclose source code as required by a copyleft license);
(b) copyright infringement arising from the Company's use of open-source code;
(c) violation of contributor license agreements; or
(d) misuse or misappropriation of open-source project trademarks or branding.
6.5.2. Copies of all correspondence, filings, and settlement documentation relating to any such claims or disputes.
SECTION VII: SAAS PLATFORM ARCHITECTURE AND CLOUD INFRASTRUCTURE
7.1 Platform Architecture Overview
7.1.1. Detailed architecture documentation for the Company's cloud-native SaaS platform, covering the ERP, CRM, and business-intelligence product lines, including:
(a) system architecture diagrams (including logical architecture, deployment architecture, and data architecture);
(b) a description of the platform's multi-tenant versus single-tenant architecture, including whether different customer tiers or deployment models are offered;
(c) a description of the microservices architecture, including the number and nature of principal microservices, inter-service communication protocols (e.g., REST, gRPC, message queues), and service discovery mechanisms;
(d) a description of containerization and orchestration technologies used (e.g., Docker, Kubernetes, ECS, EKS, GKE, AKS);
(e) infrastructure diagrams showing compute, storage, networking, and data flow, including data ingestion pipelines and ETL/ELT processes; and
(f) identification of any legacy or monolithic components that have not yet been migrated to the cloud-native architecture.
7.2 Cloud Hosting and Infrastructure
7.2.1. Identification of all cloud infrastructure providers (e.g., Ridgeway Industries, Crestline Systems, Aldermere Technologies, or others) used by the Company, and the specific services utilized from each provider (compute, storage, database, networking, AI/ML, analytics, security, monitoring, etc.).
7.2.2. Copies of all material cloud hosting and infrastructure agreements, including master agreements, service orders, enterprise discount agreements, committed use contracts, and reserved instance commitments.
7.2.3. Description of the geographic distribution of the Company's cloud hosting infrastructure, including:
(a) the regions, availability zones, and data center locations used;
(b) any data residency, data localization, or data sovereignty requirements applicable to the Company's operations or customer data;
(c) the rationale for the current geographic distribution; and
(d) any plans for expansion or relocation of hosting infrastructure.
7.2.4. Copies of all service level agreements (SLAs) with cloud providers, and historical uptime and performance data for each major cloud service utilized, for the past 24 months.
7.3 Platform Scalability and Performance
7.3.1. Documentation regarding the platform's scalability characteristics, including load testing results, capacity planning models, auto-scaling configurations, and any architectural limitations on horizontal or vertical scaling.
7.3.2. Key performance metrics for the platform, including:
(a) historical uptime data (monthly and annual availability percentages) for the past 36 months;
(b) average and peak latency metrics;
(c) throughput metrics (requests per second, concurrent users supported);
(d) any material SLA breaches with customers and the associated remedies or credits provided; and
(e) the Company's internal performance benchmarks and targets.
7.3.3. Incident reports for all material service disruptions, outages, or degradation events affecting the Company's SaaS platform in the past three years, including for each incident:
(a) the date and duration;
(b) the affected services, features, or customer segments;
(c) the root cause;
(d) the resolution and remediation steps taken;
(e) the customer communications issued; and
(f) any SLA credits or other remedies provided to affected customers.
7.4 Disaster Recovery and Business Continuity
7.4.1. Copies of the Company's disaster recovery (DR) and business continuity plans (BCP) as they relate to the SaaS platform and technology infrastructure.
7.4.2. Description of the Company's backup procedures, including:
(a) backup frequency and scope;
(b) backup storage locations (including geographic redundancy);
(c) recovery point objectives (RPOs) for each major system or data store;
(d) recovery time objectives (RTOs) for each major system or data store; and
(e) backup encryption and access control procedures.
7.4.3. Results of any disaster recovery testing, tabletop exercises, or failover tests conducted within the past two years, including the date of each test, the scenario tested, the results, and any identified deficiencies or remediation actions.
7.5 DevOps and Deployment
7.5.1. Description of the Company's deployment infrastructure, including:
(a) CI/CD pipeline architecture and tooling;
(b) staging, pre-production, and production environment configurations;
(c) blue-green, canary, or rolling deployment strategies employed;
(d) rollback procedures and capabilities; and
(e) deployment frequency and typical deployment windows.
7.5.2. Description of the Company's infrastructure-as-code (IaC) practices and configuration management tools, including the specific tools used (e.g., Terraform, CloudFormation, Ansible, Puppet, Chef, Helm) and the extent to which infrastructure provisioning is automated.
SECTION VIII: DATA PRIVACY AND DATA PROTECTION
8.1 Privacy Policies and Notices
8.1.1. Copies of all current and historical (for the past three years) versions of the following documents, as published or distributed by the Company to customers, users, or data subjects:
(a) privacy policies (website, mobile applications, products);
(b) privacy notices (including any notices specific to particular products, services, or jurisdictions);
(c) cookie policies and cookie consent mechanisms;
(d) data processing terms; and
(e) any other notices or disclosures relating to the collection, use, or sharing of personal data.
8.1.2. Description of any material changes to the Company's privacy policies or notices in the past three years, including the nature of each change, the date of implementation, and the process used to notify customers, users, and data subjects of such changes (e.g., email notification, website banner, in-product notification).
8.2 Data Protection Compliance Framework
8.2.1. A comprehensive description of the Company's data protection compliance program, including:
(a) the governance structure for data protection and privacy, including the roles and responsibilities of senior management, legal, compliance, and operational teams;
(b) the identity, qualifications, and organizational reporting line of the Company's designated data protection officer(s) (DPO), including whether the DPO is an employee or external appointment;
(c) the privacy compliance team's headcount, budget, and organizational structure; and
(d) the processes for monitoring and ensuring ongoing compliance with applicable data protection laws.
8.2.2. Copies of all data protection impact assessments (DPIAs) or privacy impact assessments (PIAs) conducted by the Company within the past three years, including any DPIAs required under Article 35 of the GDPR.
8.2.3. A description of the Company's compliance posture with respect to each of the following regulatory frameworks, including an identification of the applicable entity or entities within the corporate group, the geographic scope, the compliance measures in place, and any known gaps or remediation efforts:
(a) EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) — applicable to Cloudium Technologies UK Ltd., Cloudium Solutions GmbH, and any other operations involving the processing of personal data of EU data subjects;
(b) UK Data Protection Act 2018 / UK GDPR — applicable to Cloudium Technologies UK Ltd. and the processing of personal data of UK data subjects;
(c) California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) — applicable to the Company's US operations and the processing of personal information of California consumers;
(d) Other applicable US state privacy laws — including the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and any other state laws applicable to the Company's operations;
(e) India's Digital Personal Data Protection Act, 2023 — applicable to Cloudium Technologies India Pvt. Ltd. and the processing of digital personal data in India;
(f) German Federal Data Protection Act (BDSG) — applicable to Cloudium Solutions GmbH;
(g) Sector-specific privacy requirements, including:
(i) HIPAA (Health Insurance Portability and Accountability Act), to the extent the Company processes protected health information;
(ii) FedRAMP Privacy Overlay, to the extent applicable to services provided to US government customers; and
(iii) any other sector-specific privacy requirements applicable to the Company's operations.
8.3 Data Processing Agreements
8.3.1. Copies of the Company's standard form data processing agreement (DPA) and/or data processing addendum, including all current versions and any prior versions used within the past three years.
8.3.2. A schedule of all material data processing agreements entered into by the Company with:
(a) customers (where the Company acts as a data processor or sub-processor);
(b) sub-processors (where the Company engages third parties to process personal data on behalf of customers);
(c) vendors and service providers (where vendors process personal data on behalf of the Company); and
(d) affiliates and subsidiaries (intercompany data processing arrangements).
8.3.3. Identification of any non-standard DPA terms negotiated with key customers, including any terms that deviate from the Company's standard form with respect to data processing instructions, sub-processor engagement, data breach notification timelines, audit rights, data retention or deletion obligations, or liability and indemnification.
8.4 Cross-Border Data Transfers
8.4.1. A description of the mechanisms used by the Company for the cross-border transfer of personal data, including:
(a) EU Standard Contractual Clauses (SCCs) (identifying the module(s) used — Controlle