1041-00003 · Solara Digital Infrastructure LP · R&W Insurance

memo-rwi-exclusions-gap-analysis.docx DOCUMENT M&A / Corporate

106 / 155 ← → ✕

Contract analysis Extract to table

PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP

MEMORANDUM

TO: Harrison Wexford, Responsible Partner, M&A

FROM: Tiffany Rosenthal, Lead Associate, M&A; Andrew Fitzpatrick, Working Associate, M&A

DATE: January 20, 2024

RE: Representation and Warranty Insurance — Policy Exclusions and Gap Analysis; Northfield Assurance Ltd. Policy No. NFA-TRI-2024-00487

MATTER NO.: 1041-00003

CLIENT: Solara Digital Infrastructure LP

Right-click to update Table of Contents

I. Executive Summary

This memorandum provides a comprehensive review and analysis of the exclusions, limitations, known-loss provisions, and subrogation mechanics contained in the buyer-side representation and warranty insurance policy issued by Northfield Assurance Ltd. (Policy No. NFA-TRI-2024-00487) (the "Policy") in connection with the proposed acquisition by Solara Digital Infrastructure Fund VI LP ("Solara" or "Fund VI") of Cloudium Technologies plc ("Cloudium" or the "Target") through a reverse triangular merger with Stratos Merger Sub Inc. ("Merger Sub"), a wholly owned subsidiary of Solara, for an aggregate equity value of approximately $6,800,000,000 (the "Transaction"). The Transaction is structured such that Merger Sub will merge with and into Cloudium, with Cloudium surviving as a wholly owned subsidiary of Solara. The governing acquisition agreement is the Agreement and Plan of Merger among Cloudium Technologies plc, Stratos Merger Sub Inc., and Solara Digital Infrastructure Fund VI LP (the "Merger Agreement"), which is expected to be executed on or about January 22, 2024.

The Policy was bound on January 19, 2024 — three days prior to the anticipated signing of the Merger Agreement — pursuant to a binder agreement between Solara and Northfield Assurance Ltd. The final policy form is expected to be issued at or shortly before the closing of the Transaction. The R&W insurance broker for this placement is Peregrine Advisory Group LLC ("Peregrine"), with Timothy Gallagher serving as lead broker. The Northfield underwriter principally responsible for this risk is Patrick Graves, Senior Vice President, Transactional Risk.

The key policy parameters, as set forth in the binder agreement, are as follows:

• Policy Limit: $680,000,000 (representing 10% of aggregate deal value)

• Retention: $544,000,000 (equal to the 8% indemnity escrow to be deposited with Cobalt Trust Company, N.A. at closing)

• Retention Drop-Down: 50% of the retention drops to $272,000,000 after 12 months from closing, provided no pending claims exist at such time

• Premium: $13,600,000 (reflecting a rate of 2.0% on the policy limit), paid by Solara at binding

• Coverage Scope: The seller's representations and warranties set forth in Article IV of the Merger Agreement (Sections 4.1 through 4.28, inclusive)

The primary objectives of this memorandum are to: (i) identify and catalogue each exclusion and limitation contained in the Policy binder; (ii) evaluate the scope and commercial reasonableness of each exclusion against prevailing market standards for buyer-side R&W insurance policies in transactions of comparable size and complexity; (iii) assess the residual risk exposure to Solara where the Policy does not respond; and (iv) recommend specific negotiation points to raise with Northfield and Peregrine in advance of the execution of the Merger Agreement on January 22, 2024. Given the compressed timeline — signing is anticipated in two days — we believe it is imperative that the priority negotiation items identified in Section VI below be communicated to Peregrine no later than the morning of January 21, 2024, so that revised terms can be discussed with Northfield's underwriting team in advance of signing.

This memorandum should be read in conjunction with the R&W Insurance Coverage Analysis memorandum dated January 18, 2024, prepared by Tiffany Rosenthal, which addresses the affirmative coverage architecture (including the interaction between the indemnity escrow, direct seller indemnification, and the R&W policy), as well as the Underwriting Call Memorandum dated January 16, 2024, prepared by Andrew Fitzpatrick, which documents the substance of the underwriting call with Northfield's underwriters.

II. Policy Structure Overview

A. Coverage Basis

The Policy is a buyer-side representation and warranty insurance policy, with Solara Digital Infrastructure Fund VI LP designated as the named insured. The Policy is designed to provide coverage for losses arising from breaches of the seller's representations and warranties as set forth in Article IV of the Merger Agreement. This is the standard and market-prevalent form of R&W insurance in private equity acquisitions, wherein the buyer procures insurance to backstop the seller's indemnification obligations and provide an independent source of recovery for representation and warranty breaches discovered following the closing of the Transaction.

Under the terms of the binder agreement, the Policy sits above the indemnity escrow established pursuant to Section 9.4 of the Merger Agreement. Solara's first recourse for any claim arising from a breach of seller representations is to the escrow fund in the amount of $544,000,000, which is to be deposited with Cobalt Trust Company, N.A., as escrow agent, at closing. In addition, Solara has direct indemnification rights against the rollover equity participants — Jonathan Hargrove (Chief Executive Officer of Cloudium, who is rolling over a portion of his equity interest into the surviving entity) and Pinnacle Growth Ventures LLC (a significant pre-merger shareholder also rolling over equity into the surviving entity) — up to the general indemnification cap set forth in the Merger Agreement (15% of deal value, or $1,020,000,000). The Policy responds only for amounts in excess of the retention (i.e., amounts in excess of $544,000,000, dropping to $272,000,000 after 12 months if no pending claims exist), up to the policy limit of $680,000,000.

The Policy defines "loss" broadly, consistent with market practice for buyer-side R&W insurance policies, to include: (i) diminution in value of the acquired business resulting from a breach; (ii) out-of-pocket costs and expenses incurred by the insured in connection with a covered claim; and (iii) defense costs, including reasonable attorneys' fees and expenses incurred in investigating, defending, or settling a covered claim. The definition of "loss" is a critical component of the coverage architecture and warrants careful review in connection with the consequential and multiplied damages exclusion discussed in Section III.F below.

B. Relationship to Merger Agreement Indemnification

The R&W insurance policy is designed to complement — and in certain respects to operate independently of — the indemnification provisions of the Merger Agreement. The key indemnification parameters under the Merger Agreement, as currently drafted, are as follows:

• General Indemnification Cap: 15% of aggregate deal value, equaling $1,020,000,000. This cap applies to the aggregate liability of the seller parties for all claims arising under the general indemnification provisions of Article IX, exclusive of the special indemnities described below.

• Escrow Fund: $544,000,000 (approximately 8% of deal value), to be deposited at closing with Cobalt Trust Company, N.A., pursuant to an Escrow Agreement in the form attached as Exhibit E to the Merger Agreement. The escrow fund is the exclusive source of recovery for general indemnification claims during the first 12 months following closing, after which the surviving indemnification obligations of the rollover participants provide additional recourse. The escrow is to be released in two tranches: 50% of the escrow ($272,000,000) is released at 12 months following closing (estimated release date: July 9, 2025), and the remaining 50% ($272,000,000) is released at 18 months following closing (estimated release date: January 9, 2026), in each case less the aggregate amount of any pending and unresolved claims at the time of release.

• Basket / Deductible: 0.75% of deal value, equaling $51,000,000. The Merger Agreement employs a "tipping basket" (also referred to as a "first dollar" basket), meaning that once aggregate losses exceed the basket threshold, indemnification is available from the first dollar of loss — not merely for the excess over the basket. This is a meaningful structural feature that enhances the buyer's recovery position relative to a true deductible structure.

• De Minimis Threshold: Individual claims with a value below $500,000 are excluded from the basket calculation and are not indemnifiable. This threshold is intended to eliminate nuisance claims and is at the lower end of market norms for a transaction of this size.

• Special Indemnities (Uncapped): The following categories of claims are excluded from the general indemnification cap and are subject to uncapped indemnification obligations: (a) losses arising from fraud or intentional misrepresentation by any seller party; (b) losses arising from willful and material breach of any covenant or agreement in the Merger Agreement; (c) tax indemnities as set forth in Section 9.6 of the Merger Agreement; and (d) certain specified litigation matters to be identified in the final disclosure schedules. These uncapped indemnities operate independently of the R&W insurance policy, and the interplay between the uncapped indemnities and the Policy's fraud exclusion is discussed in Sections III.C and IV below.

The aggregate theoretical coverage available to Solara on a representation and warranty breach (excluding fraud and other uncapped items) consists of: (a) up to $1,020,000,000 from the indemnification provisions of the Merger Agreement (inclusive of the escrow and direct claims against rollover participants), plus (b) up to $680,000,000 from the R&W insurance policy for amounts above the retention. However, it is important to note that the R&W policy is designed as an excess policy above the escrow retention — it does not provide additive coverage for the same dollar of loss already recovered from the escrow or through direct indemnification. Rather, for any given rep-breach loss, Solara would first exhaust the retention (through the escrow and/or direct indemnification), and the Policy would then respond for the excess, up to the policy limit. Accordingly, the aggregate maximum recovery for Solara on a non-fraud rep-breach claim is approximately $1,020,000,000 from contractual indemnity sources plus $680,000,000 from insurance, subject to the retention mechanics, exclusions, and limitations discussed in this memorandum.

C. Policy Period and Survival

The Policy period mirrors the survival period for the seller's representations and warranties as set forth in Section 9.1 of the Merger Agreement. Under the current draft of the Merger Agreement, the general survival period for seller representations and warranties is 18 months from the closing date. Closing is scheduled for on or about June 30, 2024, pursuant to the outside date provisions of the Merger Agreement, though the actual closing date remains subject to the satisfaction or waiver of all conditions precedent and may occur earlier or later than this target. Assuming a June 30, 2024 closing, the 18-month survival period — and the corresponding Policy period — would expire on or about December 31, 2025.

An important open issue relates to the treatment of fundamental representations under the Policy. The Merger Agreement provides for an extended survival period of 36 months (rather than the general 18 months) for certain "fundamental representations," which include: (i) organization and good standing (Section 4.1); (ii) authority and enforceability (Section 4.2); (iii) capitalization (Section 4.4); (iv) tax matters (Section 4.12); and (v) broker's fees (Section 4.27). The extended survival period for fundamental representations would extend to approximately June 30, 2027, assuming a June 30, 2024 closing. We need to confirm whether the Policy tracks the extended 36-month survival period for these fundamental representations or whether the Policy period is a flat 18 months for all representations, regardless of the Merger Agreement survival schedule. If the Policy imposes a flat 18-month period, there would be a significant coverage gap for fundamental representation breaches discovered between months 18 and 36 — a period during which Solara would retain contractual indemnification rights under the Merger Agreement but would have no insurance coverage to backstop those rights.

Additionally, we note that claims must be noticed to Northfield in writing within the Policy period to be covered. This is a standard "claims-made" feature of R&W insurance policies. We should confirm whether the binder agreement or the final policy includes any extended reporting period (also known as a "Discovery tail") that would permit claims to be reported after the expiration of the Policy period if the underlying breach was discovered during the Policy period. An extended reporting period of 30 to 60 days is a common market feature and would provide a reasonable buffer against inadvertent late reporting. We recommend that this be raised with Peregrine as part of the negotiation agenda.

III. Detailed Exclusion Analysis

The binder agreement identifies ten categories of exclusions and limitations to coverage under the Policy. This Section provides a detailed analysis of each exclusion, including its scope, its interaction with the Merger Agreement and the broader Transaction, and our assessment of the associated coverage gaps and negotiation recommendations.

A. Known-Loss / Known-Matter Exclusion (Exclusion 1)

1. Scope of Exclusion

The Policy contains a standard known-loss exclusion, which precludes coverage for any breach, inaccuracy, or loss of which the "deal team" of the insured had actual knowledge prior to the inception date of the Policy. The inception date is January 19, 2024, which is the date the binder agreement was executed and the premium was paid. Under this exclusion, if any member of the insured's deal team possessed actual knowledge, as of the binding date, of a specific breach of any seller representation set forth in Article IV of the Merger Agreement, any loss arising from that breach would be excluded from coverage under the Policy.

The knowledge standard employed in the known-loss exclusion is "actual knowledge." This is the narrowest and most insured-favorable knowledge standard available. It requires that the relevant individual actually knew of the breach — it does not extend to constructive knowledge (i.e., what the individual should have known through reasonable inquiry) or imputed knowledge (i.e., knowledge attributed to the insured based on the knowledge of agents, advisors, or other third parties). The distinction between actual and constructive knowledge is significant, as the scope of due diligence conducted in connection with this Transaction has been extensive, and a constructive knowledge standard could potentially capture matters identified in diligence materials but not actually reviewed or absorbed by the named deal team members.

The exclusion also addresses the relationship between the disclosure schedules and known losses. Under the standard formulation, matters disclosed in the seller's disclosure schedules are generally treated as "known" to the insured's deal team for purposes of the known-loss exclusion. However, this treatment requires careful analysis, as discussed below.

2. Definition of "Deal Team"

The definition of "deal team" is a critical element of the known-loss exclusion, as it determines whose knowledge is attributed to the insured for purposes of the exclusion. The binder agreement is expected to include a list of named knowledge persons whose knowledge will be relevant. Based on the standard practice for Northfield's policies and the representations made during the underwriting call, we anticipate that the named knowledge persons will include the following individuals at Solara:

• Marcus Elliston, Managing Partner, Solara Digital Infrastructure LP

• Priya Narasimhan, Chief Investment Officer, Solara Digital Infrastructure LP

• Additional deal professionals at Solara directly involved in the Transaction (to be confirmed upon receipt of the final list)

A threshold issue that must be resolved is whether Calderwood & Harkness personnel — specifically, Harrison Wexford and Tiffany Rosenthal — or Osprey Bancroft & Co. personnel — specifically, Damien Harlow, the lead investment banking advisor — are included as knowledge persons within the definition of "deal team." Standard market practice is to exclude outside legal counsel and financial advisors from the deal team definition, on the theory that the insured's knowledge should be limited to the knowledge of its own principals and employees, rather than the knowledge of professional advisors who may have reviewed extensive diligence materials on behalf of the insured. Including outside advisors as knowledge persons would significantly expand the scope of the known-loss exclusion, as the diligence conducted by Calderwood & Harkness and the financial analysis performed by Osprey Bancroft have generated substantial volumes of information that may not have been fully communicated to or internalized by Solara's internal deal team.

Recommendation: We recommend negotiating to limit the knowledge persons to Solara's internal deal team members only. Outside advisors — including Calderwood & Harkness, Osprey Bancroft, and Glenmore Thornton LLP — should not be included in the deal team definition. If Northfield insists on including any advisors, this should be resisted firmly, and at a minimum, any inclusion should be limited to the lead partner at each advisory firm and should require that the advisor's knowledge be both actual and specifically communicated in writing to the named Solara deal team members.

3. Interaction with Disclosure Schedules

The interaction between the known-loss exclusion and the seller's disclosure schedules requires careful analysis. The disclosure schedules, which are being compiled by Ridgeway Phelps & Sato LLP (seller's counsel, with Catherine Answorth as lead partner) and reviewed by Calderwood & Harkness, serve two distinct purposes in the Transaction: (i) they qualify certain seller representations by disclosing exceptions or additional information, thereby rendering the representation technically accurate notwithstanding the disclosed matters; and (ii) they provide notice to the buyer of matters that might otherwise constitute breaches.

Where a disclosure schedule entry qualifies a representation — that is, where the disclosure renders the representation true and accurate by disclosing the relevant exception — no breach exists, and accordingly, the known-loss exclusion is not triggered. The exclusion applies only where information known to the deal team reveals a breach of a seller representation notwithstanding the applicable disclosure. For example, if the disclosure schedules to the intellectual property representation (Section 4.14) disclose a pending patent challenge but the representation is drafted to be "true and correct, except as set forth on Schedule 4.14," the disclosure does not give rise to a breach, and the known-loss exclusion is inapplicable. Conversely, if a diligence finding reveals that a specific representation is inaccurate even after giving effect to the applicable disclosure schedule, and the deal team is aware of this inaccuracy, the resulting loss would be excluded from coverage.

This distinction is subtle but important. We have reviewed the current draft of the disclosure schedules as of January 15, 2024 (the most recent version provided by Ridgeway Phelps), but the schedules remain in draft form and are expected to be finalized in connection with signing. Our January 5, 2024 Due Diligence Summary Memorandum identified certain issues that warrant cross-referencing against the known-loss exclusion to confirm that no unintended known-loss gap is created. Specifically, we should confirm that each matter identified in our diligence summary has been either: (a) adequately addressed through the disclosure schedules such that no breach exists; or (b) disclosed to Northfield during the underwriting process such that, if a specific exclusion is warranted, it is reflected as a deal-specific exclusion (see Section III.B below) rather than as an unintended known-loss issue.

4. Gap/Risk Assessment

Risk Level: Moderate

The known-loss exclusion is standard and unavoidable in buyer-side R&W insurance policies. No underwriter will agree to cover losses of which the insured was aware at the time of binding. The primary negotiation leverage lies in the definition of "deal team" and the knowledge standard. As noted above, we have confirmed that no specific known breaches of seller representations have been identified as of this date. The no-claims declaration to be delivered by Solara at closing will reaffirm this representation. The residual risk is that matters surface between binding and closing that give rise to known-loss issues, which is addressed in Section V below in connection with the no-claims declaration mechanics.

B. Specific Matters / Deal-Specific Exclusions (Exclusion 2)

1. Matters Identified in Underwriting

During the underwriting call conducted on January 16, 2024 — which was documented in the R&W Insurance Underwriting Call Memorandum prepared by Andrew Fitzpatrick and distributed to the deal team on January 17, 2024 — Northfield's underwriting team, led by Patrick Graves, identified several areas of potential concern based on their review of the Transaction diligence materials and the underwriting presentation prepared by Peregrine Advisory Group. These areas may be reflected as specific exclusions or limitations in the final policy form. Each identified area is discussed in detail below.

(a) Change of Control Provisions in Key Contracts. The reverse triangular merger structure contemplated by the Merger Agreement constitutes a "change of control" within the meaning of several significant contracts to which Cloudium is a party. During the underwriting call, Northfield's underwriters specifically identified three contracts containing change of control provisions that may give rise to material consent requirements or termination rights:

(i) Master SaaS Agreement with Aegis Federal Solutions Inc. — This agreement, which generates approximately $84,000,000 in annual recurring revenue ("ARR") for Cloudium, contains a change of control provision requiring the prior written consent of Aegis Federal to any transaction resulting in a change of more than 50% of the voting equity interests of Cloudium. The Aegis Federal relationship is particularly significant because Aegis Federal is a United States government contractor, and the Master SaaS Agreement includes flow-down provisions from Aegis Federal's prime contract with the Department of Defense. Failure to obtain consent could result in Aegis Federal exercising a termination right, which would represent a loss of approximately 4.8% of Cloudium's total ARR.

(ii) Technology License Agreement with Helix Data Systems GmbH — This agreement provides Cloudium with a non-exclusive license to certain proprietary data compression technology that is embedded in Cloudium's core SaaS platform. The license agreement contains a change of control provision requiring 60 days' advance written notice and a consent right exercisable by Helix Data within 30 days of such notice. While the direct financial impact of a loss of this license would depend on the availability of alternative technology solutions, the technology is integrated into approximately 40% of Cloudium's product suite, and a termination of the license could require significant re-engineering effort.

(iii) Credit Agreement with Atlas Commercial Lending Corp. — Cloudium's existing credit facility with Atlas Commercial Lending Corp. has $820,000,000 in outstanding borrowings as of the most recent compliance certificate. The credit agreement contains a mandatory prepayment obligation upon a change of control, with a 101% repayment premium. This facility is being repaid in full at closing as part of the Transaction's financing structure.

Northfield has indicated that it may exclude from coverage under the Policy any losses arising from the failure to obtain the required consents under the Aegis Federal and Helix Data agreements, or from any termination, modification, or adverse action taken by any counterparty as a result of the change of control effectuated by the Transaction. In addition, Northfield may exclude any losses related to the Atlas credit agreement, including any accelerated repayment obligations, prepayment premiums, or related costs.

Assessment: Based on our discussions with the Cloudium management team and Ridgeway Phelps, both the Aegis Federal consent and the Helix Data consent are expected to be obtained prior to closing. The consent process for the Aegis Federal agreement was initiated on December 15, 2023, and we understand that preliminary indications from Aegis Federal's procurement office are favorable. The Helix Data notice was sent on January 5, 2024, and the 30-day consent period expires on February 4, 2024. The Atlas debt will be repaid in full at closing from the Transaction proceeds, eliminating any ongoing exposure under the credit agreement.

However, if the Policy excludes losses from change of control provisions broadly — as opposed to narrowly, with respect to only these three identified contracts — this could create a meaningful coverage gap for any change of control provisions in contracts not yet identified or not yet flagged in the diligence process. Cloudium is party to hundreds of commercial agreements, and it is possible that additional change of control provisions exist in contracts that have not been individually reviewed as part of the diligence exercise.

Recommendation: We recommend negotiating to narrow this exclusion to only the three specifically identified contracts and their specific change of control provisions. The exclusion should not be a blanket exclusion for all change of control-related losses across Cloudium's contract portfolio. Furthermore, we recommend that the exclusion include a provision confirming that, to the extent the required consents are obtained (in the case of Aegis Federal and Helix Data) or the debt is repaid (in the case of Atlas), the exclusion falls away or is limited to losses that actually arise from the failure to obtain consent or the failure to repay the facility. In other words, once the consent risk has been eliminated, the exclusion should have no further effect.

(b) UK and International Tax Exposures. Northfield's underwriters have identified potential transfer pricing exposures as an area of concern, which may be reflected in a specific exclusion for losses arising from transfer pricing adjustments, assessments, or challenges related to Cloudium's intercompany arrangements. Cloudium operates through several international subsidiaries with significant operations and headcount:

• Cloudium Technologies UK Ltd. — Headquartered in London, with additional offices in Manchester. The UK subsidiary generated approximately £312,000,000 (approximately $390,000,000 at current exchange rates) in revenue during the most recent fiscal year and employs approximately 1,200 individuals. The UK subsidiary serves as Cloudium's primary market for European enterprise customers and performs certain shared services functions, including customer success, implementation, and technical support for EMEA clients.

• Cloudium Technologies India Pvt. Ltd. — Located in Bangalore, India. The Indian subsidiary employs approximately 2,400 individuals and serves as the primary center for research and development, software engineering, and customer support operations. The Indian subsidiary provides services to both the US parent company and the UK subsidiary under intercompany services agreements.

• Cloudium Solutions GmbH — Located in Berlin, Germany. The German subsidiary employs approximately 400 individuals and is responsible for sales and customer success in the DACH region (Germany, Austria, and Switzerland).

The intercompany arrangements among these entities — including the intercompany services agreement between the US parent and the Indian subsidiary, the cost-sharing arrangement for R&D expenditures, and the intercompany licensing and royalty arrangements between the US parent and the UK and German subsidiaries — present potential transfer pricing risks. Specifically, HMRC (the UK tax authority), the Indian tax authorities, and the German Finanzamt could challenge the arm's-length nature of the transfer prices charged under these intercompany arrangements, resulting in adjustments that increase the taxable income allocated to the relevant jurisdiction and give rise to additional tax liabilities, interest, and penalties.

Assessment: Leonard Cross of Calderwood & Harkness's tax group, together with Richard Okamura (Transaction Tax) and Vanessa Liu (Financial Due Diligence) of Glenmore Thornton LLP, are conducting ongoing transaction tax diligence with respect to Cloudium's transfer pricing practices and intercompany arrangements. The tax diligence is not yet complete, and the final tax diligence report is expected to be delivered on or about January 25, 2024 — after the anticipated signing date. If Northfield imposes a blanket exclusion for all transfer pricing-related losses, this would leave Solara exposed on what may prove to be a significant area of risk, particularly given the scale of Cloudium's international operations (the UK subsidiary alone generates approximately $390 million in revenue, and the Indian subsidiary employs 2,400 individuals performing core R&D and support functions).

Recommendation: We strongly recommend pushing back on any blanket transfer pricing exclusion. The breadth of such an exclusion — covering all transfer pricing-related losses across all jurisdictions and all intercompany arrangements — would be disproportionate to the specific risk identified and would significantly undermine the value of the R&W coverage. We would accept, at most, a narrow carve-out for any specifically identified transfer pricing matters that are surfaced in the tax diligence and disclosed to Northfield, with a clear and detailed description of the excluded matter. Any such carve-out should be drafted to cover only the specific intercompany arrangement or tax position identified, not a broad category of risk. If the tax diligence does not identify any specific transfer pricing deficiency, there should be no transfer pricing exclusion at all.

(c) Pending or Threatened Litigation. Northfield's underwriters have indicated that any pending or threatened litigation matters disclosed in the seller's disclosure schedules may be specifically excluded from coverage. This is a standard approach in R&W insurance underwriting — litigation matters that are known at the time of binding represent quantifiable risks that the underwriter has the right to evaluate and, if warranted, exclude from coverage.

Assessment: As of the date of this memorandum, no material pending or threatened litigation has been identified in the due diligence process that would warrant a specific litigation exclusion. The current draft of Schedule 4.9 (Litigation and Proceedings) to the Merger Agreement discloses several routine employment-related claims and one minor contractual dispute involving a former reseller partner, none of which are individually material or, in the aggregate, expected to exceed the de minimis threshold of $500,000. We should confirm against the final disclosure schedules, which are expected to be finalized on or about January 21, 2024, that no additional material litigation matters have been disclosed that could trigger a specific exclusion.

Recommendation: Provided that no material litigation matters are identified in the final disclosure schedules, we do not anticipate a specific litigation exclusion. If any new litigation matter is disclosed, we should evaluate whether the matter warrants acceptance of a specific exclusion or whether the matter should be addressed through a different mechanism (e.g., an escrow holdback or a specific indemnity in the Merger Agreement).

(d) Data Privacy and Cybersecurity. Given that Cloudium is a cloud-native SaaS provider serving mid-market and enterprise customers globally, Northfield's underwriters have raised data privacy and cybersecurity as a potential area of concern. Cloudium processes and stores significant volumes of customer data, including personally identifiable information, in connection with the delivery of its SaaS platform. The company is subject to multiple data privacy regulatory regimes, including: (i) the European Union General Data Protection Regulation ("GDPR") and the UK equivalent (UK GDPR and the Data Protection Act 2018); (ii) the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"); and (iii) various sector-specific data security requirements applicable to Cloudium's government and financial services customers.

A blanket exclusion for all data privacy regulatory exposure would be non-market and would significantly impair the value of the R&W coverage. The seller's representations and warranties in Section 4.16 of the Merger Agreement (Data Privacy and Cybersecurity) are extensive and cover, among other things, compliance with applicable data protection laws, the adequacy of data security measures, the absence of material data security incidents, and the existence of appropriate data processing agreements with third-party processors. If the Policy were to exclude all data privacy-related losses, these representations would effectively be uninsured.

Assessment: No specific data security incidents, regulatory investigations, or data breach notifications have been identified in the due diligence materials as of this date. Cloudium maintains SOC 2 Type II certification and has completed its most recent GDPR compliance assessment in September 2023 without material findings. If the underwriters have identified specific data security incidents in the diligence materials that we have not been made aware of, those incidents should be specifically identified and discussed before any exclusion is accepted.

Recommendation: We recommend confirming that there is no blanket data privacy exclusion in the Policy. Any exclusion in this area should be limited to specifically identified data security incidents or regulatory investigations — not a categorical exclusion of all data privacy-related losses. A blanket data privacy exclusion would be non-market for a buyer-side R&W policy and should be resisted.

2. Gap/Risk Assessment

Risk Level: High (if broad exclusions are imposed) / Low-Moderate (if exclusions are properly negotiated to be narrow and specific)

The deal-specific exclusions represent the most significant area for negotiation with Northfield and Peregrine. The breadth of these exclusions will largely determine the practical value of the R&W insurance coverage to Solara. If the exclusions are drafted broadly — particularly with respect to transfer pricing and change of control provisions — significant categories of potential loss will fall outside the Policy's coverage, leaving Solara reliant solely on the contractual indemnification provisions of the Merger Agreement (which are capped, subject to a basket and de minimis threshold, and time-limited). Conversely, if the exclusions are properly negotiated to be narrow and specific — limited to the particular matters identified in the underwriting process — the residual gap is manageable, and the Policy will provide meaningful excess coverage for the broad range of potential representation breaches.

C. Fraud and Willful Misconduct Exclusion (Exclusion 3)

1. Scope. The Policy excludes losses arising from the fraud or willful misconduct of the insured — that is, fraud or willful misconduct committed by Solara, Fund VI, or their respective officers, directors, employees, or agents. This exclusion is standard and universal in buyer-side R&W insurance policies. No underwriter will agree to insure against losses that are caused by the insured's own fraudulent conduct. The exclusion is consistent with fundamental principles of insurance law and is non-negotiable.

Importantly, this exclusion does not apply to losses arising from fraud committed by the seller — Cloudium or its officers, directors, employees, or agents. The entire purpose of buyer-side R&W insurance is to provide the buyer with an independent source of recovery for representation breaches, including breaches that may have resulted from the seller's fraudulent or intentional conduct. The Policy is designed to respond to such claims, and Northfield's remedy against a fraudulent seller is through the subrogation mechanism (discussed in Section IV below), not through an exclusion from buyer coverage.

This treatment is consistent with the Merger Agreement's indemnification framework, which treats fraud and willful breach as special indemnities subject to uncapped liability. For losses arising from seller fraud, Solara has recourse to both: (a) uncapped contractual indemnification under Section 9.2(c) of the Merger Agreement; and (b) the R&W insurance policy (subject to the policy limit of $680,000,000 and the retention).

2. Gap/Risk Assessment

Risk Level: Low

This is a standard, non-negotiable exclusion that presents no coverage gap. No further action is required.

D. Purchase Price Adjustment / Closing Mechanics Exclusion (Exclusion 4)

1. Scope. The Policy excludes losses relating to purchase price adjustments, working capital true-ups, or other closing mechanics under the Merger Agreement. Specifically, the Policy does not cover any claim or loss arising from: (i) any dispute regarding the calculation of the closing date net working capital; (ii) any adjustment to the merger consideration pursuant to the post-closing purchase price adjustment procedures set forth in Section 2.7 of the Merger Agreement; or (iii) any dispute regarding the estimated closing statement or the final closing statement.

The rationale for this exclusion is straightforward: purchase price adjustment mechanisms are deal mechanics, not representations of fact. A dispute over the calculation of net working capital is not a breach of a representation or warranty — it is a disagreement over the proper application of accounting principles to the closing date balance sheet. Such disputes are addressed through the specific adjustment procedures set forth in the Merger Agreement (which typically include the engagement of an independent accounting firm as arbitrator) and are not appropriate for insurance coverage.

2. Gap/Risk Assessment

Risk Level: Low

This exclusion is standard, expected, and appropriate. The post-closing purchase price adjustment procedures under Section 2.7 of the Merger Agreement provide a comprehensive mechanism for resolving working capital disputes. The estimated closing statement is to be delivered within five business days following closing (approximately July 8, 2024, assuming a June 30, 2024 closing), and the parties have 60 days from receipt of the estimated closing statement to review and dispute the calculation, followed by a 30-day negotiation period and, if necessary, referral to the independent accounting firm. This mechanism operates entirely independently of the R&W insurance policy, and no coverage gap exists.

E. Forward-Looking / Covenant Breach Exclusion (Exclusion 5)

1. Scope. The Policy provides coverage exclusively for breaches of the seller's representations and warranties — that is, backward-looking statements of fact made by Cloudium as of the date of the Merger Agreement and/or as of the closing date. The Policy does not cover breaches of covenants (forward-looking obligations to take or refrain from taking specified actions) or failures to satisfy conditions to closing.

Specifically, the following categories of obligations are not covered:

• Pre-closing covenants: The interim operating covenants set forth in Section 6.1 of the Merger Agreement, which require Cloudium to conduct its business in the ordinary course between signing and closing and prohibit specified actions without Solara's prior consent, are covenants, not representations. A breach of these covenants during the interim period would not be covered by the Policy.

• Post-closing covenants: Any post-closing obligations of the seller parties under the Merger Agreement (e.g., cooperation obligations, non-competition covenants, transition services commitments) are likewise covenants and are not covered.

• Conditions to closing: The conditions precedent to closing set forth in Article VII of the Merger Agreement (including the bring-down condition requiring that seller's representations be true and correct in all material respects as of the closing date) are conditions, not representations, and a failure to satisfy these conditions is not itself a covered loss.

2. Gap/Risk Assessment

Risk Level: Low-Moderate

This exclusion is standard and consistent with the fundamental nature of R&W insurance as a representation-breach product. However, an important nuance arises in connection with representations that "speak" as of the closing date. Under Section 7.2(a) of the Merger Agreement, the closing is conditioned on the seller's representations being true and correct in all material respects as of the closing date (the "bring-down condition"). To the extent that a representation is drafted to speak as of both signing and closing (i.e., as a "dual-date" representation), a breach of that representation at closing constitutes a breach of a representation, not a breach of a covenant, and should be covered by the Policy.

The concern arises where conduct during the interim period (between signing and closing) causes a representation to be inaccurate as of closing. If the underwriter characterizes such conduct as a breach of the interim operating covenants (rather than as a breach of the closing-date representation), coverage could be denied. This is a classification issue that depends on the specific language of the Policy and the nature of the claim.

Recommendation: We recommend confirming that the Policy language treats bring-down representations at closing as covered representations. Specifically, the Policy should confirm that a representation that is required to be true and correct as of the closing date is a "covered representation" under the Policy, and that a breach of such representation at closing is a covered loss, regardless of whether the breach was caused by conduct during the interim period that may also constitute a breach of a pre-closing covenant.

F. Consequential, Punitive, and Multiplied Damages Exclusion (Exclusion 6)

1. Scope. The Policy may exclude certain categories of damages from the definition of "loss," including: (i) consequential damages; (ii) punitive, exemplary, or treble damages (except to the extent awarded by a court of competent jurisdiction in a third-party claim); and (iii) damages calculated as a multiple of earnings, revenue, or other financial metrics — commonly referred to as "multiplied damages."

The multiplied damages exclusion is of particular significance in this Transaction. Cloudium was acquired at an enterprise value of approximately $6,800,000,000, reflecting an EV/EBITDA multiple of approximately 16.8x (based on Cloudium's trailing twelve-month adjusted EBITDA of approximately $404,760,000, per the financial due diligence conducted by Glenmore Thornton LLP). A representation breach that reduces Cloudium's EBITDA on a going-forward basis — for example, a breach of the revenue recognition representation resulting in a restatement of historical revenue, or a breach of the tax representation resulting in an ongoing increase in the effective tax rate — would, from Solara's perspective, result in a loss measured not merely by the nominal EBITDA shortfall but by the enterprise value impact of that shortfall. At a 16.8x multiple, a $10,000,000 annual EBITDA reduction would translate to approximately $168,000,000 in lost enterprise value. If the Policy excludes damages measured by reference to a multiple of earnings, Solara's recovery would be limited to the nominal EBITDA shortfall rather than the true economic impact on the value of the acquired business.

The exclusion of consequential damages is also concerning, as many representation breach claims involve losses that could be characterized as "consequential" rather than "direct." For example, a breach of the intellectual property representation that results in the loss of a key technology license — and the consequent loss of customer relationships dependent on that technology — could give rise to damages that are characterized as consequential in nature.

2. Gap/Risk Assessment

Risk Level: Moderate-High

This exclusion presents one of the most significant potential coverage gaps in the Policy. Given the premium valuation at which Cloudium is being acquired (16.8x EBITDA), a limitation on multiplied damages could dramatically reduce the practical value of the R&W coverage. Solara is acquiring Cloudium as a growth-oriented digital infrastructure platform, and the acquisition price reflects expectations of future cash flow generation that are embedded in the EBITDA multiple. Any representation breach that impairs Cloudium's earnings capacity results in a loss to Solara that is properly measured by reference to the enterprise value impact, not merely the nominal shortfall in any individual financial metric.

Recommendation: We recommend the following negotiation approach:

(i) Diminution-in-value damages: Negotiate for the express inclusion of "diminution in value" as a covered component of loss. The inclusion of diminution-in-value damages is a standard and market-accepted feature of buyer-side R&W insurance policies and is essential to ensure that the Policy responds to the insured's actual economic loss rather than a truncated measure of damages.

(ii) Multiplied damages: Push to remove or significantly soften any blanket exclusion on damages measured by reference to a multiple of earnings or revenue. If Northfield is unwilling to remove the exclusion entirely, we should negotiate for a carve-out that permits diminution-in-value damages calculated by reference to the purchase price allocation or other appropriate valuation methodology, even if such calculation implicitly reflects a multiple.

(iii) Consequential damages: Push to remove or limit the consequential damages exclusion to the extent that consequential damages represent the insured's direct economic loss (i.e., losses that were reasonably foreseeable at the time of the Transaction and that flow directly from the representation breach). Accept the exclusion of remote or speculative damages.

(iv) Punitive damages: Accept the exclusion of punitive and exemplary damages as standard and non-controversial.

G. Asbestos, Environmental, and Product Liability Exclusion (Exclusion 7)

1. Scope. The Policy contains a standard blanket exclusion for losses arising from: (i) asbestos-related claims, including claims for asbestos removal, remediation, personal injury, or wrongful death; (ii) pollution, contamination, or environmental remediation obligations, including claims arising under the Comprehensive Environmental Response, Compensation, and Liability Act ("CERCLA"), the Resource Conservation and Recovery Act ("RCRA"), or equivalent state or foreign environmental laws; and (iii) product liability claims, including claims for bodily injury or property damage caused by a defective product.

2. Gap/Risk Assessment

Risk Level: Negligible

This exclusion is standard across virtually all buyer-side R&W insurance policies. It is not particularly relevant to the Cloudium acquisition, as Cloudium is a SaaS and software business that does not manufacture physical products, does not own or operate manufacturing facilities, does not generate hazardous waste, and has no identified exposure to asbestos-related claims. The company's physical footprint consists of leased office space in San Francisco (headquarters at 600 Townsend Street), London, Manchester, Bangalore, and Berlin, none of which are known to present environmental contamination risks. We do not anticipate any negotiation or coverage gap issues arising from this exclusion.

H. Pension and Employee Benefit Underfunding Exclusion (Exclusion 8)

1. Scope. The Policy may contain an exclusion for losses arising from the underfunding of defined benefit pension plans or multiemployer pension plans. This exclusion is common in buyer-side R&W insurance policies and is designed to address the potentially significant and difficult-to-quantify liabilities associated with pension underfunding, which may not be fully reflected in the target company's financial statements.

This exclusion is potentially relevant to the Cloudium acquisition in light of the company's significant UK operations. Cloudium Technologies UK Ltd. employs approximately 1,200 individuals in the United Kingdom and may maintain UK pension schemes for some or all of these employees. UK pension law imposes significant obligations on employers that sponsor defined benefit pension schemes, including potential liability for scheme funding deficits and Pension Protection Fund levies. If Cloudium UK maintains a defined benefit pension scheme — as opposed to a defined contribution scheme, which does not carry the same underfunding risk — this exclusion could be meaningful.

In addition, Cloudium Technologies India Pvt. Ltd. has statutory gratuity and provident fund ("PF") obligations with respect to its approximately 2,400 employees in Bangalore. While these obligations are typically more modest in scale than UK or US pension liabilities, they represent a potential area of underfunding exposure that should be evaluated.

We note that a supplemental due diligence request covering employee benefits and compensation arrangements was issued on October 22, 2023, but the response materials have not yet been fully reviewed with respect to the UK pension arrangements.

2. Gap/Risk Assessment

Risk Level: Low-Moderate

The risk level depends on the nature of the UK pension arrangements. If Cloudium UK operates only a defined contribution scheme (which is increasingly standard for UK technology companies), the pension underfunding exclusion is largely academic, as defined contribution schemes do not carry employer underfunding risk. If, however, Cloudium UK maintains a legacy defined benefit pension scheme — or if any UK employees participate in a multi-employer defined benefit scheme — this exclusion could expose Solara to significant uninsured liability.

Recommendation: We recommend the following steps:

(i) Confirm the type and scope of any UK pension arrangements maintained by Cloudium Technologies UK Ltd. through completion of the employee benefits diligence workstream.

(ii) If the UK subsidiary operates only a defined contribution scheme, push to remove or limit this exclusion, as it would be inapplicable and unnecessary.

(iii) If a defined benefit scheme exists, negotiate a sub-limit or carve-back for pension underfunding losses, rather than a blanket exclusion. At a minimum, negotiate for coverage of pension-related losses up to a specified sub-limit (e.g., $25,000,000 to $50,000,000) to provide some protection against unexpected underfunding.

(iv) Confirm that the Indian gratuity and PF obligations are adequately reserved on Cloudium India's balance sheet and that any shortfall is captured in the financial due diligence.

I. ERISA / 401(k) Exclusion (Exclusion 9)

1. Scope. Some R&W insurance policies exclude losses arising from ERISA-related liabilities, including violations of the Employee Retirement Income Security Act of 1974 ("ERISA"), deficiencies in 401(k) plan administration, or failures to comply with IRS qualification requirements for tax-qualified retirement plans. This exclusion may also extend to violations of Section 409A of the Internal Revenue Code (relating to deferred compensation arrangements) and Section 280G/4999 (relating to golden parachute payments in connection with change of control transactions).

Cloudium has significant US operations, with a global workforce of approximately 6,800 employees and a substantial US presence headquartered at 600 Townsend Street, San Francisco, California. The company maintains a 401(k) plan and various employee benefit programs for its US employees. The seller's representations and warranties in Section 4.17 of the Merger Agreement (Employee Benefit Plans) cover, among other things, the company's compliance with ERISA, the qualification status of the 401(k) plan, and the absence of material 409A or 280G liabilities.

2. Gap/Risk Assessment

Risk Level: Low

The ERISA / 401(k) exclusion is standard to the extent it addresses specific, identified plan deficiencies. It should not, however, operate as a blanket exclusion of all employee benefit plan-related losses, which would render the Section 4.17 representations effectively uninsured.

Recommendation: Confirm that routine ERISA compliance representations are covered under the Policy and that only specifically identified plan deficiencies (if any) are excluded. The general employee benefit plan representations — including representations regarding plan qualification, the absence of prohibited transactions, compliance with ERISA fiduciary standards, and the absence of material 409A or 280G exposure — should be fully insured under the Policy absent specific, identified compliance issues.

J. Government Contracts / FCA Exclusion (Exclusion 10)

1. Scope. Certain R&W insurance policies exclude losses arising from government contract compliance issues, including: (i) violations of the False Claims Act ("FCA"), 31 U.S.C. §§ 3729–3733; (ii) violations of the Anti-Kickback Act; (iii) violations of the Truth in Negotiations Act ("TINA"); (iv) debarment or suspension proceedings; and (v) other regulatory violations arising from the performance of contracts with the United States government or government instrumentalities.

This exclusion is potentially applicable to the Cloudium acquisition in light of the company's relationship with Aegis Federal Solutions Inc. Aegis Federal is a US government contractor, and Cloudium's Master SaaS Agreement with Aegis Federal generates approximately $84,000,000 in ARR — representing approximately 4.8% of Cloudium's total ARR of approximately $1,740,000,000. Cloudium's SaaS platform is utilized by Aegis Federal in connection with Aegis Federal's performance under prime contracts with the Department of Defense, and the Master SaaS Agreement contains flow-down provisions that impose certain government contracting requirements on Cloudium as a subcontractor.

Northfield's underwriters may view the government contract exposure as an area of heightened risk that warrants a specific exclusion, particularly given the severity of potential FCA liability (which includes treble damages, civil penalties, and potential debarment) and the regulatory complexity of government contract compliance.

2. Gap/Risk Assessment

Risk Level: Moderate

While the Aegis Federal relationship represents a meaningful but not dominant portion of Cloudium's revenue (4.8% of ARR), a blanket exclusion for government contract-related losses would effectively render the government contracts representation in Article IV (Section 4.21, if applicable) uninsured. Moreover, the $84,000,000 in ARR from Aegis Federal, combined with the severity of potential FCA liability (treble damages plus civil penalties of up to $27,894 per false claim under the current inflation-adjusted penalty schedule), represents a potentially significant uninsured exposure.

Recommendation: We recommend resisting any blanket government contracts exclusion. The representations regarding government contracts in Article IV should be fully covered under the Policy, absent specifically identified FCA compliance issues or government contract disputes surfaced in the diligence process. At most, we should accept a narrow carve-out for specifically identified matters — e.g., a specific government contract audit or investigation that has been disclosed in the disclosure schedules. If no specific matters have been identified, there should be no government contracts exclusion.

IV. Subrogation Waiver Analysis

A. Waiver of Subrogation Against Seller

The Policy contains a waiver of Northfield's subrogation rights against Cloudium Technologies plc and its officers and directors. Under the general principles of insurance law, an insurer that pays a claim to its insured is subrogated to the insured's rights against third parties whose conduct caused the loss. In the R&W insurance context, this means that after paying a claim to Solara for a breach of a seller representation, Northfield would ordinarily have the right to pursue Cloudium (as the breaching party) for reimbursement.

The subrogation waiver eliminates this right. Under the waiver, Northfield agrees not to pursue Cloudium or its officers and directors for reimbursement after paying a claim to Solara. This waiver is a standard and essential feature of buyer-side R&W insurance and was a key term in the Merger Agreement negotiations. From the seller's perspective, the subrogation waiver is one of the primary benefits of buyer-side R&W insurance — it provides the seller with a "clean exit" from the transaction, with certainty that the R&W insurer will not subsequently pursue the seller for recovery. Without the subrogation waiver, the seller's exposure would not be meaningfully reduced by the existence of the R&W insurance, as the insurer could simply step into the buyer's shoes and pursue the seller directly.

The subrogation waiver is reflected in both the Policy (as a policy provision) and the Merger Agreement (as a covenant of the buyer not to pursue the seller for indemnification beyond the escrow, except in cases of fraud or willful breach). The two provisions should be reviewed together to confirm that they are consistent and do not create any gaps or ambiguities.

B. Fraud Carve-Back to Subrogation Waiver

The subrogation waiver is subject to a critical carve-back for fraud. If a loss covered by the Policy was caused by the fraud of Cloudium or any of its officers or directors, Northfield retains the right to subrogate against the fraudulent party — that is, Northfield may pursue the fraudulent individual or entity for reimbursement of any amounts paid to Solara under the Policy.

This fraud carve-back is consistent with the broader treatment of fraud in the Transaction:

• Under the Merger Agreement, fraud and willful breach are carved out from all caps, baskets, and limitations on seller indemnification — the seller parties' liability for fraud is uncapped.

• Under the Policy, losses arising from seller fraud are covered (i.e., the fraud exclusion in Exclusion 3 applies only to fraud by the insured, not fraud by the seller), and Northfield retains subrogation rights against the fraudulent seller party.

• The combined effect is that Solara has recourse to both the insurer and the fraudulent seller party for fraud-related losses, and the insurer has recourse against the fraudulent seller party for reimbursement of any amounts paid.

The named individuals at Cloudium whose conduct could trigger the fraud carve-back include:

• Jonathan Hargrove, Chief Executive Officer (rollover shareholder

PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP
MEMORANDUM
TO: Harrison Wexford, Responsible Partner, M&A
FROM: Tiffany Rosenthal, Lead Associate, M&A; Andrew Fitzpatrick, Working Associate, M&A
DATE: January 20, 2024
RE: Representation and Warranty Insurance — Policy Exclusions and Gap Analysis; Northfield Assurance Ltd. Policy No. NFA-TRI-2024-00487
MATTER NO.: 1041-00003
CLIENT: Solara Digital Infrastructure LP
Right-click to update Table of Contents
I. Executive Summary
This memorandum provides a comprehensive review and analysis of the exclusions, limitations, known-loss provisions, and subrogation mechanics contained in the buyer-side representation and warranty insurance policy issued by Northfield Assurance Ltd. (Policy No. NFA-TRI-2024-00487) (the "Policy") in connection with the proposed acquisition by Solara Digital Infrastructure Fund VI LP ("Solara" or "Fund VI") of Cloudium Technologies plc ("Cloudium" or the "Target") through a reverse triangular merger with Stratos Merger Sub Inc. ("Merger Sub"), a wholly owned subsidiary of Solara, for an aggregate equity value of approximately $6,800,000,000 (the "Transaction"). The Transaction is structured such that Merger Sub will merge with and into Cloudium, with Cloudium surviving as a wholly owned subsidiary of Solara. The governing acquisition agreement is the Agreement and Plan of Merger among Cloudium Technologies plc, Stratos Merger Sub Inc., and Solara Digital Infrastructure Fund VI LP (the "Merger Agreement"), which is expected to be executed on or about January 22, 2024.
The Policy was bound on January 19, 2024 — three days prior to the anticipated signing of the Merger Agreement — pursuant to a binder agreement between Solara and Northfield Assurance Ltd. The final policy form is expected to be issued at or shortly before the closing of the Transaction. The R&W insurance broker for this placement is Peregrine Advisory Group LLC ("Peregrine"), with Timothy Gallagher serving as lead broker. The Northfield underwriter principally responsible for this risk is Patrick Graves, Senior Vice President, Transactional Risk.
The key policy parameters, as set forth in the binder agreement, are as follows:
• Policy Limit: $680,000,000 (representing 10% of aggregate deal value)
• Retention: $544,000,000 (equal to the 8% indemnity escrow to be deposited with Cobalt Trust Company, N.A. at closing)
• Retention Drop-Down: 50% of the retention drops to $272,000,000 after 12 months from closing, provided no pending claims exist at such time
• Premium: $13,600,000 (reflecting a rate of 2.0% on the policy limit), paid by Solara at binding
• Coverage Scope: The seller's representations and warranties set forth in Article IV of the Merger Agreement (Sections 4.1 through 4.28, inclusive)
The primary objectives of this memorandum are to: (i) identify and catalogue each exclusion and limitation contained in the Policy binder; (ii) evaluate the scope and commercial reasonableness of each exclusion against prevailing market standards for buyer-side R&W insurance policies in transactions of comparable size and complexity; (iii) assess the residual risk exposure to Solara where the Policy does not respond; and (iv) recommend specific negotiation points to raise with Northfield and Peregrine in advance of the execution of the Merger Agreement on January 22, 2024. Given the compressed timeline — signing is anticipated in two days — we believe it is imperative that the priority negotiation items identified in Section VI below be communicated to Peregrine no later than the morning of January 21, 2024, so that revised terms can be discussed with Northfield's underwriting team in advance of signing.
This memorandum should be read in conjunction with the R&W Insurance Coverage Analysis memorandum dated January 18, 2024, prepared by Tiffany Rosenthal, which addresses the affirmative coverage architecture (including the interaction between the indemnity escrow, direct seller indemnification, and the R&W policy), as well as the Underwriting Call Memorandum dated January 16, 2024, prepared by Andrew Fitzpatrick, which documents the substance of the underwriting call with Northfield's underwriters.
II. Policy Structure Overview
A. Coverage Basis
The Policy is a buyer-side representation and warranty insurance policy, with Solara Digital Infrastructure Fund VI LP designated as the named insured. The Policy is designed to provide coverage for losses arising from breaches of the seller's representations and warranties as set forth in Article IV of the Merger Agreement. This is the standard and market-prevalent form of R&W insurance in private equity acquisitions, wherein the buyer procures insurance to backstop the seller's indemnification obligations and provide an independent source of recovery for representation and warranty breaches discovered following the closing of the Transaction.
Under the terms of the binder agreement, the Policy sits above the indemnity escrow established pursuant to Section 9.4 of the Merger Agreement. Solara's first recourse for any claim arising from a breach of seller representations is to the escrow fund in the amount of $544,000,000, which is to be deposited with Cobalt Trust Company, N.A., as escrow agent, at closing. In addition, Solara has direct indemnification rights against the rollover equity participants — Jonathan Hargrove (Chief Executive Officer of Cloudium, who is rolling over a portion of his equity interest into the surviving entity) and Pinnacle Growth Ventures LLC (a significant pre-merger shareholder also rolling over equity into the surviving entity) — up to the general indemnification cap set forth in the Merger Agreement (15% of deal value, or $1,020,000,000). The Policy responds only for amounts in excess of the retention (i.e., amounts in excess of $544,000,000, dropping to $272,000,000 after 12 months if no pending claims exist), up to the policy limit of $680,000,000.
The Policy defines "loss" broadly, consistent with market practice for buyer-side R&W insurance policies, to include: (i) diminution in value of the acquired business resulting from a breach; (ii) out-of-pocket costs and expenses incurred by the insured in connection with a covered claim; and (iii) defense costs, including reasonable attorneys' fees and expenses incurred in investigating, defending, or settling a covered claim. The definition of "loss" is a critical component of the coverage architecture and warrants careful review in connection with the consequential and multiplied damages exclusion discussed in Section III.F below.
B. Relationship to Merger Agreement Indemnification
The R&W insurance policy is designed to complement — and in certain respects to operate independently of — the indemnification provisions of the Merger Agreement. The key indemnification parameters under the Merger Agreement, as currently drafted, are as follows:
• General Indemnification Cap: 15% of aggregate deal value, equaling $1,020,000,000. This cap applies to the aggregate liability of the seller parties for all claims arising under the general indemnification provisions of Article IX, exclusive of the special indemnities described below.
• Escrow Fund: $544,000,000 (approximately 8% of deal value), to be deposited at closing with Cobalt Trust Company, N.A., pursuant to an Escrow Agreement in the form attached as Exhibit E to the Merger Agreement. The escrow fund is the exclusive source of recovery for general indemnification claims during the first 12 months following closing, after which the surviving indemnification obligations of the rollover participants provide additional recourse. The escrow is to be released in two tranches: 50% of the escrow ($272,000,000) is released at 12 months following closing (estimated release date: July 9, 2025), and the remaining 50% ($272,000,000) is released at 18 months following closing (estimated release date: January 9, 2026), in each case less the aggregate amount of any pending and unresolved claims at the time of release.
• Basket / Deductible: 0.75% of deal value, equaling $51,000,000. The Merger Agreement employs a "tipping basket" (also referred to as a "first dollar" basket), meaning that once aggregate losses exceed the basket threshold, indemnification is available from the first dollar of loss — not merely for the excess over the basket. This is a meaningful structural feature that enhances the buyer's recovery position relative to a true deductible structure.
• De Minimis Threshold: Individual claims with a value below $500,000 are excluded from the basket calculation and are not indemnifiable. This threshold is intended to eliminate nuisance claims and is at the lower end of market norms for a transaction of this size.
• Special Indemnities (Uncapped): The following categories of claims are excluded from the general indemnification cap and are subject to uncapped indemnification obligations: (a) losses arising from fraud or intentional misrepresentation by any seller party; (b) losses arising from willful and material breach of any covenant or agreement in the Merger Agreement; (c) tax indemnities as set forth in Section 9.6 of the Merger Agreement; and (d) certain specified litigation matters to be identified in the final disclosure schedules. These uncapped indemnities operate independently of the R&W insurance policy, and the interplay between the uncapped indemnities and the Policy's fraud exclusion is discussed in Sections III.C and IV below.
The aggregate theoretical coverage available to Solara on a representation and warranty breach (excluding fraud and other uncapped items) consists of: (a) up to $1,020,000,000 from the indemnification provisions of the Merger Agreement (inclusive of the escrow and direct claims against rollover participants), plus (b) up to $680,000,000 from the R&W insurance policy for amounts above the retention. However, it is important to note that the R&W policy is designed as an excess policy above the escrow retention — it does not provide additive coverage for the same dollar of loss already recovered from the escrow or through direct indemnification. Rather, for any given rep-breach loss, Solara would first exhaust the retention (through the escrow and/or direct indemnification), and the Policy would then respond for the excess, up to the policy limit. Accordingly, the aggregate maximum recovery for Solara on a non-fraud rep-breach claim is approximately $1,020,000,000 from contractual indemnity sources plus $680,000,000 from insurance, subject to the retention mechanics, exclusions, and limitations discussed in this memorandum.
C. Policy Period and Survival
The Policy period mirrors the survival period for the seller's representations and warranties as set forth in Section 9.1 of the Merger Agreement. Under the current draft of the Merger Agreement, the general survival period for seller representations and warranties is 18 months from the closing date. Closing is scheduled for on or about June 30, 2024, pursuant to the outside date provisions of the Merger Agreement, though the actual closing date remains subject to the satisfaction or waiver of all conditions precedent and may occur earlier or later than this target. Assuming a June 30, 2024 closing, the 18-month survival period — and the corresponding Policy period — would expire on or about December 31, 2025.
An important open issue relates to the treatment of fundamental representations under the Policy. The Merger Agreement provides for an extended survival period of 36 months (rather than the general 18 months) for certain "fundamental representations," which include: (i) organization and good standing (Section 4.1); (ii) authority and enforceability (Section 4.2); (iii) capitalization (Section 4.4); (iv) tax matters (Section 4.12); and (v) broker's fees (Section 4.27). The extended survival period for fundamental representations would extend to approximately June 30, 2027, assuming a June 30, 2024 closing. We need to confirm whether the Policy tracks the extended 36-month survival period for these fundamental representations or whether the Policy period is a flat 18 months for all representations, regardless of the Merger Agreement survival schedule. If the Policy imposes a flat 18-month period, there would be a significant coverage gap for fundamental representation breaches discovered between months 18 and 36 — a period during which Solara would retain contractual indemnification rights under the Merger Agreement but would have no insurance coverage to backstop those rights.
Additionally, we note that claims must be noticed to Northfield in writing within the Policy period to be covered. This is a standard "claims-made" feature of R&W insurance policies. We should confirm whether the binder agreement or the final policy includes any extended reporting period (also known as a "Discovery tail") that would permit claims to be reported after the expiration of the Policy period if the underlying breach was discovered during the Policy period. An extended reporting period of 30 to 60 days is a common market feature and would provide a reasonable buffer against inadvertent late reporting. We recommend that this be raised with Peregrine as part of the negotiation agenda.
III. Detailed Exclusion Analysis
The binder agreement identifies ten categories of exclusions and limitations to coverage under the Policy. This Section provides a detailed analysis of each exclusion, including its scope, its interaction with the Merger Agreement and the broader Transaction, and our assessment of the associated coverage gaps and negotiation recommendations.
A. Known-Loss / Known-Matter Exclusion (Exclusion 1)
1. Scope of Exclusion
The Policy contains a standard known-loss exclusion, which precludes coverage for any breach, inaccuracy, or loss of which the "deal team" of the insured had actual knowledge prior to the inception date of the Policy. The inception date is January 19, 2024, which is the date the binder agreement was executed and the premium was paid. Under this exclusion, if any member of the insured's deal team possessed actual knowledge, as of the binding date, of a specific breach of any seller representation set forth in Article IV of the Merger Agreement, any loss arising from that breach would be excluded from coverage under the Policy.
The knowledge standard employed in the known-loss exclusion is "actual knowledge." This is the narrowest and most insured-favorable knowledge standard available. It requires that the relevant individual actually knew of the breach — it does not extend to constructive knowledge (i.e., what the individual should have known through reasonable inquiry) or imputed knowledge (i.e., knowledge attributed to the insured based on the knowledge of agents, advisors, or other third parties). The distinction between actual and constructive knowledge is significant, as the scope of due diligence conducted in connection with this Transaction has been extensive, and a constructive knowledge standard could potentially capture matters identified in diligence materials but not actually reviewed or absorbed by the named deal team members.
The exclusion also addresses the relationship between the disclosure schedules and known losses. Under the standard formulation, matters disclosed in the seller's disclosure schedules are generally treated as "known" to the insured's deal team for purposes of the known-loss exclusion. However, this treatment requires careful analysis, as discussed below.
2. Definition of "Deal Team"
The definition of "deal team" is a critical element of the known-loss exclusion, as it determines whose knowledge is attributed to the insured for purposes of the exclusion. The binder agreement is expected to include a list of named knowledge persons whose knowledge will be relevant. Based on the standard practice for Northfield's policies and the representations made during the underwriting call, we anticipate that the named knowledge persons will include the following individuals at Solara:
• Marcus Elliston, Managing Partner, Solara Digital Infrastructure LP
• Priya Narasimhan, Chief Investment Officer, Solara Digital Infrastructure LP
• Additional deal professionals at Solara directly involved in the Transaction (to be confirmed upon receipt of the final list)
A threshold issue that must be resolved is whether Calderwood & Harkness personnel — specifically, Harrison Wexford and Tiffany Rosenthal — or Osprey Bancroft & Co. personnel — specifically, Damien Harlow, the lead investment banking advisor — are included as knowledge persons within the definition of "deal team." Standard market practice is to exclude outside legal counsel and financial advisors from the deal team definition, on the theory that the insured's knowledge should be limited to the knowledge of its own principals and employees, rather than the knowledge of professional advisors who may have reviewed extensive diligence materials on behalf of the insured. Including outside advisors as knowledge persons would significantly expand the scope of the known-loss exclusion, as the diligence conducted by Calderwood & Harkness and the financial analysis performed by Osprey Bancroft have generated substantial volumes of information that may not have been fully communicated to or internalized by Solara's internal deal team.
Recommendation: We recommend negotiating to limit the knowledge persons to Solara's internal deal team members only. Outside advisors — including Calderwood & Harkness, Osprey Bancroft, and Glenmore Thornton LLP — should not be included in the deal team definition. If Northfield insists on including any advisors, this should be resisted firmly, and at a minimum, any inclusion should be limited to the lead partner at each advisory firm and should require that the advisor's knowledge be both actual and specifically communicated in writing to the named Solara deal team members.
3. Interaction with Disclosure Schedules
The interaction between the known-loss exclusion and the seller's disclosure schedules requires careful analysis. The disclosure schedules, which are being compiled by Ridgeway Phelps & Sato LLP (seller's counsel, with Catherine Answorth as lead partner) and reviewed by Calderwood & Harkness, serve two distinct purposes in the Transaction: (i) they qualify certain seller representations by disclosing exceptions or additional information, thereby rendering the representation technically accurate notwithstanding the disclosed matters; and (ii) they provide notice to the buyer of matters that might otherwise constitute breaches.
Where a disclosure schedule entry qualifies a representation — that is, where the disclosure renders the representation true and accurate by disclosing the relevant exception — no breach exists, and accordingly, the known-loss exclusion is not triggered. The exclusion applies only where information known to the deal team reveals a breach of a seller representation notwithstanding the applicable disclosure. For example, if the disclosure schedules to the intellectual property representation (Section 4.14) disclose a pending patent challenge but the representation is drafted to be "true and correct, except as set forth on Schedule 4.14," the disclosure does not give rise to a breach, and the known-loss exclusion is inapplicable. Conversely, if a diligence finding reveals that a specific representation is inaccurate even after giving effect to the applicable disclosure schedule, and the deal team is aware of this inaccuracy, the resulting loss would be excluded from coverage.
This distinction is subtle but important. We have reviewed the current draft of the disclosure schedules as of January 15, 2024 (the most recent version provided by Ridgeway Phelps), but the schedules remain in draft form and are expected to be finalized in connection with signing. Our January 5, 2024 Due Diligence Summary Memorandum identified certain issues that warrant cross-referencing against the known-loss exclusion to confirm that no unintended known-loss gap is created. Specifically, we should confirm that each matter identified in our diligence summary has been either: (a) adequately addressed through the disclosure schedules such that no breach exists; or (b) disclosed to Northfield during the underwriting process such that, if a specific exclusion is warranted, it is reflected as a deal-specific exclusion (see Section III.B below) rather than as an unintended known-loss issue.
4. Gap/Risk Assessment
Risk Level: Moderate
The known-loss exclusion is standard and unavoidable in buyer-side R&W insurance policies. No underwriter will agree to cover losses of which the insured was aware at the time of binding. The primary negotiation leverage lies in the definition of "deal team" and the knowledge standard. As noted above, we have confirmed that no specific known breaches of seller representations have been identified as of this date. The no-claims declaration to be delivered by Solara at closing will reaffirm this representation. The residual risk is that matters surface between binding and closing that give rise to known-loss issues, which is addressed in Section V below in connection with the no-claims declaration mechanics.
B. Specific Matters / Deal-Specific Exclusions (Exclusion 2)
1. Matters Identified in Underwriting
During the underwriting call conducted on January 16, 2024 — which was documented in the R&W Insurance Underwriting Call Memorandum prepared by Andrew Fitzpatrick and distributed to the deal team on January 17, 2024 — Northfield's underwriting team, led by Patrick Graves, identified several areas of potential concern based on their review of the Transaction diligence materials and the underwriting presentation prepared by Peregrine Advisory Group. These areas may be reflected as specific exclusions or limitations in the final policy form. Each identified area is discussed in detail below.
(a) Change of Control Provisions in Key Contracts. The reverse triangular merger structure contemplated by the Merger Agreement constitutes a "change of control" within the meaning of several significant contracts to which Cloudium is a party. During the underwriting call, Northfield's underwriters specifically identified three contracts containing change of control provisions that may give rise to material consent requirements or termination rights:
(i) Master SaaS Agreement with Aegis Federal Solutions Inc. — This agreement, which generates approximately $84,000,000 in annual recurring revenue ("ARR") for Cloudium, contains a change of control provision requiring the prior written consent of Aegis Federal to any transaction resulting in a change of more than 50% of the voting equity interests of Cloudium. The Aegis Federal relationship is particularly significant because Aegis Federal is a United States government contractor, and the Master SaaS Agreement includes flow-down provisions from Aegis Federal's prime contract with the Department of Defense. Failure to obtain consent could result in Aegis Federal exercising a termination right, which would represent a loss of approximately 4.8% of Cloudium's total ARR.
(ii) Technology License Agreement with Helix Data Systems GmbH — This agreement provides Cloudium with a non-exclusive license to certain proprietary data compression technology that is embedded in Cloudium's core SaaS platform. The license agreement contains a change of control provision requiring 60 days' advance written notice and a consent right exercisable by Helix Data within 30 days of such notice. While the direct financial impact of a loss of this license would depend on the availability of alternative technology solutions, the technology is integrated into approximately 40% of Cloudium's product suite, and a termination of the license could require significant re-engineering effort.
(iii) Credit Agreement with Atlas Commercial Lending Corp. — Cloudium's existing credit facility with Atlas Commercial Lending Corp. has $820,000,000 in outstanding borrowings as of the most recent compliance certificate. The credit agreement contains a mandatory prepayment obligation upon a change of control, with a 101% repayment premium. This facility is being repaid in full at closing as part of the Transaction's financing structure.
Northfield has indicated that it may exclude from coverage under the Policy any losses arising from the failure to obtain the required consents under the Aegis Federal and Helix Data agreements, or from any termination, modification, or adverse action taken by any counterparty as a result of the change of control effectuated by the Transaction. In addition, Northfield may exclude any losses related to the Atlas credit agreement, including any accelerated repayment obligations, prepayment premiums, or related costs.
Assessment: Based on our discussions with the Cloudium management team and Ridgeway Phelps, both the Aegis Federal consent and the Helix Data consent are expected to be obtained prior to closing. The consent process for the Aegis Federal agreement was initiated on December 15, 2023, and we understand that preliminary indications from Aegis Federal's procurement office are favorable. The Helix Data notice was sent on January 5, 2024, and the 30-day consent period expires on February 4, 2024. The Atlas debt will be repaid in full at closing from the Transaction proceeds, eliminating any ongoing exposure under the credit agreement.
However, if the Policy excludes losses from change of control provisions broadly — as opposed to narrowly, with respect to only these three identified contracts — this could create a meaningful coverage gap for any change of control provisions in contracts not yet identified or not yet flagged in the diligence process. Cloudium is party to hundreds of commercial agreements, and it is possible that additional change of control provisions exist in contracts that have not been individually reviewed as part of the diligence exercise.
Recommendation: We recommend negotiating to narrow this exclusion to only the three specifically identified contracts and their specific change of control provisions. The exclusion should not be a blanket exclusion for all change of control-related losses across Cloudium's contract portfolio. Furthermore, we recommend that the exclusion include a provision confirming that, to the extent the required consents are obtained (in the case of Aegis Federal and Helix Data) or the debt is repaid (in the case of Atlas), the exclusion falls away or is limited to losses that actually arise from the failure to obtain consent or the failure to repay the facility. In other words, once the consent risk has been eliminated, the exclusion should have no further effect.
(b) UK and International Tax Exposures. Northfield's underwriters have identified potential transfer pricing exposures as an area of concern, which may be reflected in a specific exclusion for losses arising from transfer pricing adjustments, assessments, or challenges related to Cloudium's intercompany arrangements. Cloudium operates through several international subsidiaries with significant operations and headcount:
• Cloudium Technologies UK Ltd. — Headquartered in London, with additional offices in Manchester. The UK subsidiary generated approximately £312,000,000 (approximately $390,000,000 at current exchange rates) in revenue during the most recent fiscal year and employs approximately 1,200 individuals. The UK subsidiary serves as Cloudium's primary market for European enterprise customers and performs certain shared services functions, including customer success, implementation, and technical support for EMEA clients.
• Cloudium Technologies India Pvt. Ltd. — Located in Bangalore, India. The Indian subsidiary employs approximately 2,400 individuals and serves as the primary center for research and development, software engineering, and customer support operations. The Indian subsidiary provides services to both the US parent company and the UK subsidiary under intercompany services agreements.
• Cloudium Solutions GmbH — Located in Berlin, Germany. The German subsidiary employs approximately 400 individuals and is responsible for sales and customer success in the DACH region (Germany, Austria, and Switzerland).
The intercompany arrangements among these entities — including the intercompany services agreement between the US parent and the Indian subsidiary, the cost-sharing arrangement for R&D expenditures, and the intercompany licensing and royalty arrangements between the US parent and the UK and German subsidiaries — present potential transfer pricing risks. Specifically, HMRC (the UK tax authority), the Indian tax authorities, and the German Finanzamt could challenge the arm's-length nature of the transfer prices charged under these intercompany arrangements, resulting in adjustments that increase the taxable income allocated to the relevant jurisdiction and give rise to additional tax liabilities, interest, and penalties.
Assessment: Leonard Cross of Calderwood & Harkness's tax group, together with Richard Okamura (Transaction Tax) and Vanessa Liu (Financial Due Diligence) of Glenmore Thornton LLP, are conducting ongoing transaction tax diligence with respect to Cloudium's transfer pricing practices and intercompany arrangements. The tax diligence is not yet complete, and the final tax diligence report is expected to be delivered on or about January 25, 2024 — after the anticipated signing date. If Northfield imposes a blanket exclusion for all transfer pricing-related losses, this would leave Solara exposed on what may prove to be a significant area of risk, particularly given the scale of Cloudium's international operations (the UK subsidiary alone generates approximately $390 million in revenue, and the Indian subsidiary employs 2,400 individuals performing core R&D and support functions).
Recommendation: We strongly recommend pushing back on any blanket transfer pricing exclusion. The breadth of such an exclusion — covering all transfer pricing-related losses across all jurisdictions and all intercompany arrangements — would be disproportionate to the specific risk identified and would significantly undermine the value of the R&W coverage. We would accept, at most, a narrow carve-out for any specifically identified transfer pricing matters that are surfaced in the tax diligence and disclosed to Northfield, with a clear and detailed description of the excluded matter. Any such carve-out should be drafted to cover only the specific intercompany arrangement or tax position identified, not a broad category of risk. If the tax diligence does not identify any specific transfer pricing deficiency, there should be no transfer pricing exclusion at all.
(c) Pending or Threatened Litigation. Northfield's underwriters have indicated that any pending or threatened litigation matters disclosed in the seller's disclosure schedules may be specifically excluded from coverage. This is a standard approach in R&W insurance underwriting — litigation matters that are known at the time of binding represent quantifiable risks that the underwriter has the right to evaluate and, if warranted, exclude from coverage.
Assessment: As of the date of this memorandum, no material pending or threatened litigation has been identified in the due diligence process that would warrant a specific litigation exclusion. The current draft of Schedule 4.9 (Litigation and Proceedings) to the Merger Agreement discloses several routine employment-related claims and one minor contractual dispute involving a former reseller partner, none of which are individually material or, in the aggregate, expected to exceed the de minimis threshold of $500,000. We should confirm against the final disclosure schedules, which are expected to be finalized on or about January 21, 2024, that no additional material litigation matters have been disclosed that could trigger a specific exclusion.
Recommendation: Provided that no material litigation matters are identified in the final disclosure schedules, we do not anticipate a specific litigation exclusion. If any new litigation matter is disclosed, we should evaluate whether the matter warrants acceptance of a specific exclusion or whether the matter should be addressed through a different mechanism (e.g., an escrow holdback or a specific indemnity in the Merger Agreement).
(d) Data Privacy and Cybersecurity. Given that Cloudium is a cloud-native SaaS provider serving mid-market and enterprise customers globally, Northfield's underwriters have raised data privacy and cybersecurity as a potential area of concern. Cloudium processes and stores significant volumes of customer data, including personally identifiable information, in connection with the delivery of its SaaS platform. The company is subject to multiple data privacy regulatory regimes, including: (i) the European Union General Data Protection Regulation ("GDPR") and the UK equivalent (UK GDPR and the Data Protection Act 2018); (ii) the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"); and (iii) various sector-specific data security requirements applicable to Cloudium's government and financial services customers.
A blanket exclusion for all data privacy regulatory exposure would be non-market and would significantly impair the value of the R&W coverage. The seller's representations and warranties in Section 4.16 of the Merger Agreement (Data Privacy and Cybersecurity) are extensive and cover, among other things, compliance with applicable data protection laws, the adequacy of data security measures, the absence of material data security incidents, and the existence of appropriate data processing agreements with third-party processors. If the Policy were to exclude all data privacy-related losses, these representations would effectively be uninsured.
Assessment: No specific data security incidents, regulatory investigations, or data breach notifications have been identified in the due diligence materials as of this date. Cloudium maintains SOC 2 Type II certification and has completed its most recent GDPR compliance assessment in September 2023 without material findings. If the underwriters have identified specific data security incidents in the diligence materials that we have not been made aware of, those incidents should be specifically identified and discussed before any exclusion is accepted.
Recommendation: We recommend confirming that there is no blanket data privacy exclusion in the Policy. Any exclusion in this area should be limited to specifically identified data security incidents or regulatory investigations — not a categorical exclusion of all data privacy-related losses. A blanket data privacy exclusion would be non-market for a buyer-side R&W policy and should be resisted.
2. Gap/Risk Assessment
Risk Level: High (if broad exclusions are imposed) / Low-Moderate (if exclusions are properly negotiated to be narrow and specific)
The deal-specific exclusions represent the most significant area for negotiation with Northfield and Peregrine. The breadth of these exclusions will largely determine the practical value of the R&W insurance coverage to Solara. If the exclusions are drafted broadly — particularly with respect to transfer pricing and change of control provisions — significant categories of potential loss will fall outside the Policy's coverage, leaving Solara reliant solely on the contractual indemnification provisions of the Merger Agreement (which are capped, subject to a basket and de minimis threshold, and time-limited). Conversely, if the exclusions are properly negotiated to be narrow and specific — limited to the particular matters identified in the underwriting process — the residual gap is manageable, and the Policy will provide meaningful excess coverage for the broad range of potential representation breaches.
C. Fraud and Willful Misconduct Exclusion (Exclusion 3)
1. Scope. The Policy excludes losses arising from the fraud or willful misconduct of the insured — that is, fraud or willful misconduct committed by Solara, Fund VI, or their respective officers, directors, employees, or agents. This exclusion is standard and universal in buyer-side R&W insurance policies. No underwriter will agree to insure against losses that are caused by the insured's own fraudulent conduct. The exclusion is consistent with fundamental principles of insurance law and is non-negotiable.
Importantly, this exclusion does not apply to losses arising from fraud committed by the seller — Cloudium or its officers, directors, employees, or agents. The entire purpose of buyer-side R&W insurance is to provide the buyer with an independent source of recovery for representation breaches, including breaches that may have resulted from the seller's fraudulent or intentional conduct. The Policy is designed to respond to such claims, and Northfield's remedy against a fraudulent seller is through the subrogation mechanism (discussed in Section IV below), not through an exclusion from buyer coverage.
This treatment is consistent with the Merger Agreement's indemnification framework, which treats fraud and willful breach as special indemnities subject to uncapped liability. For losses arising from seller fraud, Solara has recourse to both: (a) uncapped contractual indemnification under Section 9.2(c) of the Merger Agreement; and (b) the R&W insurance policy (subject to the policy limit of $680,000,000 and the retention).
2. Gap/Risk Assessment
Risk Level: Low
This is a standard, non-negotiable exclusion that presents no coverage gap. No further action is required.
D. Purchase Price Adjustment / Closing Mechanics Exclusion (Exclusion 4)
1. Scope. The Policy excludes losses relating to purchase price adjustments, working capital true-ups, or other closing mechanics under the Merger Agreement. Specifically, the Policy does not cover any claim or loss arising from: (i) any dispute regarding the calculation of the closing date net working capital; (ii) any adjustment to the merger consideration pursuant to the post-closing purchase price adjustment procedures set forth in Section 2.7 of the Merger Agreement; or (iii) any dispute regarding the estimated closing statement or the final closing statement.
The rationale for this exclusion is straightforward: purchase price adjustment mechanisms are deal mechanics, not representations of fact. A dispute over the calculation of net working capital is not a breach of a representation or warranty — it is a disagreement over the proper application of accounting principles to the closing date balance sheet. Such disputes are addressed through the specific adjustment procedures set forth in the Merger Agreement (which typically include the engagement of an independent accounting firm as arbitrator) and are not appropriate for insurance coverage.
2. Gap/Risk Assessment
Risk Level: Low
This exclusion is standard, expected, and appropriate. The post-closing purchase price adjustment procedures under Section 2.7 of the Merger Agreement provide a comprehensive mechanism for resolving working capital disputes. The estimated closing statement is to be delivered within five business days following closing (approximately July 8, 2024, assuming a June 30, 2024 closing), and the parties have 60 days from receipt of the estimated closing statement to review and dispute the calculation, followed by a 30-day negotiation period and, if necessary, referral to the independent accounting firm. This mechanism operates entirely independently of the R&W insurance policy, and no coverage gap exists.
E. Forward-Looking / Covenant Breach Exclusion (Exclusion 5)
1. Scope. The Policy provides coverage exclusively for breaches of the seller's representations and warranties — that is, backward-looking statements of fact made by Cloudium as of the date of the Merger Agreement and/or as of the closing date. The Policy does not cover breaches of covenants (forward-looking obligations to take or refrain from taking specified actions) or failures to satisfy conditions to closing.
Specifically, the following categories of obligations are not covered:
• Pre-closing covenants: The interim operating covenants set forth in Section 6.1 of the Merger Agreement, which require Cloudium to conduct its business in the ordinary course between signing and closing and prohibit specified actions without Solara's prior consent, are covenants, not representations. A breach of these covenants during the interim period would not be covered by the Policy.
• Post-closing covenants: Any post-closing obligations of the seller parties under the Merger Agreement (e.g., cooperation obligations, non-competition covenants, transition services commitments) are likewise covenants and are not covered.
• Conditions to closing: The conditions precedent to closing set forth in Article VII of the Merger Agreement (including the bring-down condition requiring that seller's representations be true and correct in all material respects as of the closing date) are conditions, not representations, and a failure to satisfy these conditions is not itself a covered loss.
2. Gap/Risk Assessment
Risk Level: Low-Moderate
This exclusion is standard and consistent with the fundamental nature of R&W insurance as a representation-breach product. However, an important nuance arises in connection with representations that "speak" as of the closing date. Under Section 7.2(a) of the Merger Agreement, the closing is conditioned on the seller's representations being true and correct in all material respects as of the closing date (the "bring-down condition"). To the extent that a representation is drafted to speak as of both signing and closing (i.e., as a "dual-date" representation), a breach of that representation at closing constitutes a breach of a representation, not a breach of a covenant, and should be covered by the Policy.
The concern arises where conduct during the interim period (between signing and closing) causes a representation to be inaccurate as of closing. If the underwriter characterizes such conduct as a breach of the interim operating covenants (rather than as a breach of the closing-date representation), coverage could be denied. This is a classification issue that depends on the specific language of the Policy and the nature of the claim.
Recommendation: We recommend confirming that the Policy language treats bring-down representations at closing as covered representations. Specifically, the Policy should confirm that a representation that is required to be true and correct as of the closing date is a "covered representation" under the Policy, and that a breach of such representation at closing is a covered loss, regardless of whether the breach was caused by conduct during the interim period that may also constitute a breach of a pre-closing covenant.
F. Consequential, Punitive, and Multiplied Damages Exclusion (Exclusion 6)
1. Scope. The Policy may exclude certain categories of damages from the definition of "loss," including: (i) consequential damages; (ii) punitive, exemplary, or treble damages (except to the extent awarded by a court of competent jurisdiction in a third-party claim); and (iii) damages calculated as a multiple of earnings, revenue, or other financial metrics — commonly referred to as "multiplied damages."
The multiplied damages exclusion is of particular significance in this Transaction. Cloudium was acquired at an enterprise value of approximately $6,800,000,000, reflecting an EV/EBITDA multiple of approximately 16.8x (based on Cloudium's trailing twelve-month adjusted EBITDA of approximately $404,760,000, per the financial due diligence conducted by Glenmore Thornton LLP). A representation breach that reduces Cloudium's EBITDA on a going-forward basis — for example, a breach of the revenue recognition representation resulting in a restatement of historical revenue, or a breach of the tax representation resulting in an ongoing increase in the effective tax rate — would, from Solara's perspective, result in a loss measured not merely by the nominal EBITDA shortfall but by the enterprise value impact of that shortfall. At a 16.8x multiple, a $10,000,000 annual EBITDA reduction would translate to approximately $168,000,000 in lost enterprise value. If the Policy excludes damages measured by reference to a multiple of earnings, Solara's recovery would be limited to the nominal EBITDA shortfall rather than the true economic impact on the value of the acquired business.
The exclusion of consequential damages is also concerning, as many representation breach claims involve losses that could be characterized as "consequential" rather than "direct." For example, a breach of the intellectual property representation that results in the loss of a key technology license — and the consequent loss of customer relationships dependent on that technology — could give rise to damages that are characterized as consequential in nature.
2. Gap/Risk Assessment
Risk Level: Moderate-High
This exclusion presents one of the most significant potential coverage gaps in the Policy. Given the premium valuation at which Cloudium is being acquired (16.8x EBITDA), a limitation on multiplied damages could dramatically reduce the practical value of the R&W coverage. Solara is acquiring Cloudium as a growth-oriented digital infrastructure platform, and the acquisition price reflects expectations of future cash flow generation that are embedded in the EBITDA multiple. Any representation breach that impairs Cloudium's earnings capacity results in a loss to Solara that is properly measured by reference to the enterprise value impact, not merely the nominal shortfall in any individual financial metric.
Recommendation: We recommend the following negotiation approach:
(i) Diminution-in-value damages: Negotiate for the express inclusion of "diminution in value" as a covered component of loss. The inclusion of diminution-in-value damages is a standard and market-accepted feature of buyer-side R&W insurance policies and is essential to ensure that the Policy responds to the insured's actual economic loss rather than a truncated measure of damages.
(ii) Multiplied damages: Push to remove or significantly soften any blanket exclusion on damages measured by reference to a multiple of earnings or revenue. If Northfield is unwilling to remove the exclusion entirely, we should negotiate for a carve-out that permits diminution-in-value damages calculated by reference to the purchase price allocation or other appropriate valuation methodology, even if such calculation implicitly reflects a multiple.
(iii) Consequential damages: Push to remove or limit the consequential damages exclusion to the extent that consequential damages represent the insured's direct economic loss (i.e., losses that were reasonably foreseeable at the time of the Transaction and that flow directly from the representation breach). Accept the exclusion of remote or speculative damages.
(iv) Punitive damages: Accept the exclusion of punitive and exemplary damages as standard and non-controversial.
G. Asbestos, Environmental, and Product Liability Exclusion (Exclusion 7)
1. Scope. The Policy contains a standard blanket exclusion for losses arising from: (i) asbestos-related claims, including claims for asbestos removal, remediation, personal injury, or wrongful death; (ii) pollution, contamination, or environmental remediation obligations, including claims arising under the Comprehensive Environmental Response, Compensation, and Liability Act ("CERCLA"), the Resource Conservation and Recovery Act ("RCRA"), or equivalent state or foreign environmental laws; and (iii) product liability claims, including claims for bodily injury or property damage caused by a defective product.
2. Gap/Risk Assessment
Risk Level: Negligible
This exclusion is standard across virtually all buyer-side R&W insurance policies. It is not particularly relevant to the Cloudium acquisition, as Cloudium is a SaaS and software business that does not manufacture physical products, does not own or operate manufacturing facilities, does not generate hazardous waste, and has no identified exposure to asbestos-related claims. The company's physical footprint consists of leased office space in San Francisco (headquarters at 600 Townsend Street), London, Manchester, Bangalore, and Berlin, none of which are known to present environmental contamination risks. We do not anticipate any negotiation or coverage gap issues arising from this exclusion.
H. Pension and Employee Benefit Underfunding Exclusion (Exclusion 8)
1. Scope. The Policy may contain an exclusion for losses arising from the underfunding of defined benefit pension plans or multiemployer pension plans. This exclusion is common in buyer-side R&W insurance policies and is designed to address the potentially significant and difficult-to-quantify liabilities associated with pension underfunding, which may not be fully reflected in the target company's financial statements.
This exclusion is potentially relevant to the Cloudium acquisition in light of the company's significant UK operations. Cloudium Technologies UK Ltd. employs approximately 1,200 individuals in the United Kingdom and may maintain UK pension schemes for some or all of these employees. UK pension law imposes significant obligations on employers that sponsor defined benefit pension schemes, including potential liability for scheme funding deficits and Pension Protection Fund levies. If Cloudium UK maintains a defined benefit pension scheme — as opposed to a defined contribution scheme, which does not carry the same underfunding risk — this exclusion could be meaningful.
In addition, Cloudium Technologies India Pvt. Ltd. has statutory gratuity and provident fund ("PF") obligations with respect to its approximately 2,400 employees in Bangalore. While these obligations are typically more modest in scale than UK or US pension liabilities, they represent a potential area of underfunding exposure that should be evaluated.
We note that a supplemental due diligence request covering employee benefits and compensation arrangements was issued on October 22, 2023, but the response materials have not yet been fully reviewed with respect to the UK pension arrangements.
2. Gap/Risk Assessment
Risk Level: Low-Moderate
The risk level depends on the nature of the UK pension arrangements. If Cloudium UK operates only a defined contribution scheme (which is increasingly standard for UK technology companies), the pension underfunding exclusion is largely academic, as defined contribution schemes do not carry employer underfunding risk. If, however, Cloudium UK maintains a legacy defined benefit pension scheme — or if any UK employees participate in a multi-employer defined benefit scheme — this exclusion could expose Solara to significant uninsured liability.
Recommendation: We recommend the following steps:
(i) Confirm the type and scope of any UK pension arrangements maintained by Cloudium Technologies UK Ltd. through completion of the employee benefits diligence workstream.
(ii) If the UK subsidiary operates only a defined contribution scheme, push to remove or limit this exclusion, as it would be inapplicable and unnecessary.
(iii) If a defined benefit scheme exists, negotiate a sub-limit or carve-back for pension underfunding losses, rather than a blanket exclusion. At a minimum, negotiate for coverage of pension-related losses up to a specified sub-limit (e.g., $25,000,000 to $50,000,000) to provide some protection against unexpected underfunding.
(iv) Confirm that the Indian gratuity and PF obligations are adequately reserved on Cloudium India's balance sheet and that any shortfall is captured in the financial due diligence.
I. ERISA / 401(k) Exclusion (Exclusion 9)
1. Scope. Some R&W insurance policies exclude losses arising from ERISA-related liabilities, including violations of the Employee Retirement Income Security Act of 1974 ("ERISA"), deficiencies in 401(k) plan administration, or failures to comply with IRS qualification requirements for tax-qualified retirement plans. This exclusion may also extend to violations of Section 409A of the Internal Revenue Code (relating to deferred compensation arrangements) and Section 280G/4999 (relating to golden parachute payments in connection with change of control transactions).
Cloudium has significant US operations, with a global workforce of approximately 6,800 employees and a substantial US presence headquartered at 600 Townsend Street, San Francisco, California. The company maintains a 401(k) plan and various employee benefit programs for its US employees. The seller's representations and warranties in Section 4.17 of the Merger Agreement (Employee Benefit Plans) cover, among other things, the company's compliance with ERISA, the qualification status of the 401(k) plan, and the absence of material 409A or 280G liabilities.
2. Gap/Risk Assessment
Risk Level: Low
The ERISA / 401(k) exclusion is standard to the extent it addresses specific, identified plan deficiencies. It should not, however, operate as a blanket exclusion of all employee benefit plan-related losses, which would render the Section 4.17 representations effectively uninsured.
Recommendation: Confirm that routine ERISA compliance representations are covered under the Policy and that only specifically identified plan deficiencies (if any) are excluded. The general employee benefit plan representations — including representations regarding plan qualification, the absence of prohibited transactions, compliance with ERISA fiduciary standards, and the absence of material 409A or 280G exposure — should be fully insured under the Policy absent specific, identified compliance issues.
J. Government Contracts / FCA Exclusion (Exclusion 10)
1. Scope. Certain R&W insurance policies exclude losses arising from government contract compliance issues, including: (i) violations of the False Claims Act ("FCA"), 31 U.S.C. §§ 3729–3733; (ii) violations of the Anti-Kickback Act; (iii) violations of the Truth in Negotiations Act ("TINA"); (iv) debarment or suspension proceedings; and (v) other regulatory violations arising from the performance of contracts with the United States government or government instrumentalities.
This exclusion is potentially applicable to the Cloudium acquisition in light of the company's relationship with Aegis Federal Solutions Inc. Aegis Federal is a US government contractor, and Cloudium's Master SaaS Agreement with Aegis Federal generates approximately $84,000,000 in ARR — representing approximately 4.8% of Cloudium's total ARR of approximately $1,740,000,000. Cloudium's SaaS platform is utilized by Aegis Federal in connection with Aegis Federal's performance under prime contracts with the Department of Defense, and the Master SaaS Agreement contains flow-down provisions that impose certain government contracting requirements on Cloudium as a subcontractor.
Northfield's underwriters may view the government contract exposure as an area of heightened risk that warrants a specific exclusion, particularly given the severity of potential FCA liability (which includes treble damages, civil penalties, and potential debarment) and the regulatory complexity of government contract compliance.
2. Gap/Risk Assessment
Risk Level: Moderate
While the Aegis Federal relationship represents a meaningful but not dominant portion of Cloudium's revenue (4.8% of ARR), a blanket exclusion for government contract-related losses would effectively render the government contracts representation in Article IV (Section 4.21, if applicable) uninsured. Moreover, the $84,000,000 in ARR from Aegis Federal, combined with the severity of potential FCA liability (treble damages plus civil penalties of up to $27,894 per false claim under the current inflation-adjusted penalty schedule), represents a potentially significant uninsured exposure.
Recommendation: We recommend resisting any blanket government contracts exclusion. The representations regarding government contracts in Article IV should be fully covered under the Policy, absent specifically identified FCA compliance issues or government contract disputes surfaced in the diligence process. At most, we should accept a narrow carve-out for specifically identified matters — e.g., a specific government contract audit or investigation that has been disclosed in the disclosure schedules. If no specific matters have been identified, there should be no government contracts exclusion.
IV. Subrogation Waiver Analysis
A. Waiver of Subrogation Against Seller
The Policy contains a waiver of Northfield's subrogation rights against Cloudium Technologies plc and its officers and directors. Under the general principles of insurance law, an insurer that pays a claim to its insured is subrogated to the insured's rights against third parties whose conduct caused the loss. In the R&W insurance context, this means that after paying a claim to Solara for a breach of a seller representation, Northfield would ordinarily have the right to pursue Cloudium (as the breaching party) for reimbursement.
The subrogation waiver eliminates this right. Under the waiver, Northfield agrees not to pursue Cloudium or its officers and directors for reimbursement after paying a claim to Solara. This waiver is a standard and essential feature of buyer-side R&W insurance and was a key term in the Merger Agreement negotiations. From the seller's perspective, the subrogation waiver is one of the primary benefits of buyer-side R&W insurance — it provides the seller with a "clean exit" from the transaction, with certainty that the R&W insurer will not subsequently pursue the seller for recovery. Without the subrogation waiver, the seller's exposure would not be meaningfully reduced by the existence of the R&W insurance, as the insurer could simply step into the buyer's shoes and pursue the seller directly.
The subrogation waiver is reflected in both the Policy (as a policy provision) and the Merger Agreement (as a covenant of the buyer not to pursue the seller for indemnification beyond the escrow, except in cases of fraud or willful breach). The two provisions should be reviewed together to confirm that they are consistent and do not create any gaps or ambiguities.
B. Fraud Carve-Back to Subrogation Waiver
The subrogation waiver is subject to a critical carve-back for fraud. If a loss covered by the Policy was caused by the fraud of Cloudium or any of its officers or directors, Northfield retains the right to subrogate against the fraudulent party — that is, Northfield may pursue the fraudulent individual or entity for reimbursement of any amounts paid to Solara under the Policy.
This fraud carve-back is consistent with the broader treatment of fraud in the Transaction:
• Under the Merger Agreement, fraud and willful breach are carved out from all caps, baskets, and limitations on seller indemnification — the seller parties' liability for fraud is uncapped.
• Under the Policy, losses arising from seller fraud are covered (i.e., the fraud exclusion in Exclusion 3 applies only to fraud by the insured, not fraud by the seller), and Northfield retains subrogation rights against the fraudulent seller party.
• The combined effect is that Solara has recourse to both the insurer and the fraudulent seller party for fraud-related losses, and the insurer has recourse against the fraudulent seller party for reimbursement of any amounts paid.
The named individuals at Cloudium whose conduct could trigger the fraud carve-back include:
• Jonathan Hargrove, Chief Executive Officer (rollover shareholder

PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP

MEMORANDUM

MATTER NO.: 1041-00003

Record

Parties

Dates

Amounts