PRIVILEGED & CONFIDENTIAL ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 599 Lexington Avenue New York, New York 10022
MEMORANDUM
To: Harrison Wexford, Responsible Partner, Mergers & Acquisitions Beatrice Holloway, Billing Partner, Mergers & Acquisitions
From: Tiffany Rosenthal, Lead Associate, Mergers & Acquisitions Andrew Fitzpatrick, Working Associate, Mergers & Acquisitions
Date: January 16, 2024
Re: Summary of R&W Insurance Underwriting Call with Northfield Assurance Ltd. — Acquisition of Cloudium Technologies plc by Solara Digital Infrastructure Fund VI LP
Matter No.: 1041-00003
This memorandum is a privileged and confidential attorney work product prepared in connection with the provision of legal advice to our client, Solara Digital Infrastructure Fund VI LP. It is not intended for distribution to any person other than the addressees and authorized members of the Calderwood & Harkness deal team without prior approval of the Responsible Partner.
I. Executive Summary
On January 16, 2024, Calderwood & Harkness LLP ("C&H" or the "Firm") conducted the underwriting diligence call (the "Underwriting Call") with Northfield Assurance Ltd. ("Northfield") in connection with the proposed buyer-side representation and warranty insurance policy (Policy No. NFA-TRI-2024-00487) for Solara Digital Infrastructure Fund VI LP's ("Solara" or the "Buyer") acquisition of Cloudium Technologies plc ("Cloudium" or the "Target") for aggregate consideration of $6,800,000,000 (the "Transaction"). The Transaction is structured as a reverse triangular merger under the Delaware General Corporation Law, pursuant to which Stratos Merger Sub Inc. ("Merger Sub"), a wholly owned subsidiary of Solara, will merge with and into Cloudium, with Cloudium surviving as a wholly owned subsidiary of Solara.
The Underwriting Call was attended by the following participants:
• From Calderwood & Harkness LLP: Tiffany Rosenthal (Lead Associate, M&A), Andrew Fitzpatrick (Working Associate, M&A), and Leonard Cross (Tax Specialist Partner);
• From Peregrine Advisory Group LLC (R&W Insurance Broker): Timothy Gallagher;
• From Northfield Assurance Ltd.: Patrick Graves (Senior Vice President, Transactional Risk) and two additional members of Northfield's underwriting team.
The Underwriting Call commenced at approximately 10:00 a.m. Eastern Time and concluded at approximately 12:30 p.m. Eastern Time, lasting approximately two and one-half hours. The call covered all major diligence workstreams undertaken by C&H in connection with the Transaction, including corporate organization, material contracts, intellectual property, litigation and regulatory, financial and accounting, tax, employee benefits and compensation, environmental and real property, and insurance.
The purpose of the Underwriting Call was to present C&H's diligence findings across all workstreams, identify key risks and areas of focus for the underwriting team, and address Northfield's questions in order to facilitate the binding of the representation and warranty insurance policy (the "R&W Policy" or the "Policy"). The target binding date is January 19, 2024, which is three business days prior to the scheduled signing of the Merger Agreement on January 22, 2024.
Northfield's non-binding indication, dated January 14, 2024, proposed the following key commercial terms for the R&W Policy:
• Policy Limit: $680,000,000 (equal to 10% of aggregate deal value);
• Retention: $544,000,000 (equal to 8% of aggregate deal value, matching the escrow amount);
• Retention Drop-Down: 50% reduction to $272,000,000 after 12 months post-closing, subject to no pending claims at the time of the drop-down;
• Premium: 2.0% rate on the policy limit, resulting in a premium of $13,600,000, payable at binding.
As summarized in greater detail below, the Underwriting Call was constructive, and Northfield's underwriting team expressed general comfort with the scope and findings of C&H's diligence program. The principal areas of underwriting focus related to (a) the change-of-control consent required under Cloudium's Master SaaS Agreement with Aegis Federal Solutions Inc. ($84,000,000 annual recurring revenue), (b) the termination-for-change-of-control provision in the Technology License Agreement with Helix Data Systems GmbH, and (c) the historical cybersecurity incident in Q2 2022. We do not anticipate any showstoppers to binding on the targeted date.
II. Transaction Overview Presented to Underwriters
At the outset of the Underwriting Call, C&H presented a comprehensive overview of the Transaction to Northfield's underwriting team. The following sections summarize the key information conveyed.
A. Parties and Structure
Buyer. Solara Digital Infrastructure Fund VI LP ("Fund VI") is a Delaware limited partnership with a 2022 vintage and $12.4 billion in committed capital. The general partner of Fund VI is Solara Fund VI GP LLC, a Delaware limited liability company. The managing partners of the Solara platform are Marcus Elliston and Priya Narasimhan, both of whom are well known to the R&W insurance market and have completed numerous prior transactions utilizing buyer-side R&W insurance policies. Fund VI is Solara's flagship digital infrastructure investment vehicle, with a mandate to acquire enterprise software, cloud infrastructure, and data services businesses.
Target. Cloudium Technologies plc is a public limited company incorporated under the laws of England and Wales (Companies House Registration No. 09734521). Cloudium is listed on the Nasdaq Global Select Market under the ticker symbol "CLDM." The company maintains its principal offices at 45 Broadwick Street, London W1F 0DB, United Kingdom and 600 Townsend Street, Suite 800, San Francisco, California 94103, United States. Cloudium is a leading provider of cloud-based enterprise resource planning, customer relationship management, and business intelligence software, serving a diversified global customer base spanning commercial enterprises and government agencies.
Merger Sub. Stratos Merger Sub Inc. is a Delaware corporation formed for the sole purpose of facilitating the Transaction. Merger Sub's sole stockholder is Fund VI. Merger Sub was incorporated on January 8, 2024, and its Delaware File Number is 7923841. Merger Sub has no operations, assets, or liabilities other than those incident to its formation and the consummation of the merger.
Transaction Structure. The Transaction is structured as a reverse triangular merger under the Delaware General Corporation Law. Merger Sub will merge with and into Cloudium, with Cloudium surviving the merger as a wholly owned subsidiary of Fund VI. As a result of the merger, all outstanding shares of Cloudium's common stock (other than shares to be contributed as rollover equity, as described below) will be converted into the right to receive the per-share merger consideration in cash. The reverse triangular merger structure was selected, in part, to preserve Cloudium's existing contractual and regulatory relationships, including its FedRAMP authorization status and government contract eligibility.
Target's Counsel. Cloudium is represented in the Transaction by Ridgeway Phelps & Sato LLP, with Catherine Answorth serving as lead partner in the New York office and Alistair Fenn handling UK law matters from the London office.
B. Deal Economics
C&H presented the following summary of the Transaction's economics to the underwriting team:
Cloudium's employee base of approximately 6,800 professionals is distributed across the United States, the United Kingdom, India, and Germany. The company's business model is predominantly subscription-based, with recurring revenue comprising the vast majority of total revenue. The ARR of $1,740,000,000 as of December 31, 2023, reflects growth over the trailing twelve-month revenue figure of $1,620,000,000, consistent with the company's reported trajectory of net new subscription bookings. The EV/EBITDA multiple of approximately 16.8x is within the expected range for a high-growth enterprise SaaS platform of Cloudium's scale and market position.
C. Rollover Equity
Two existing Cloudium stakeholders will contribute a portion of their equity to the post-closing capital structure through rollover arrangements:
Mr. Hargrove will continue as Chief Executive Officer of Cloudium following the closing and is rolling over approximately 50% of his equity position. Pinnacle Growth Ventures LLC, a growth equity fund managed by Evelyn Carmichael, is Cloudium's largest institutional shareholder and is rolling over approximately 60% of its position. The rollover participants will hold equity interests in a newly formed holding company sitting between Fund VI and Cloudium in the post-closing organizational structure. The rollover equity has significant implications for the R&W Policy, particularly with respect to subrogation waiver provisions, as both Hargrove and Pinnacle will remain active participants in the business following the closing.
D. Key Deal Terms Relevant to Policy
C&H highlighted the following provisions of the Merger Agreement that are directly relevant to the R&W Policy underwriting:
Indemnification Cap. The general indemnification cap under the Merger Agreement is 15% of aggregate deal value, or $1,020,000,000. This cap applies to breaches of representations and warranties (other than fundamental representations and special indemnity matters, which are treated separately).
Escrow. Eight percent (8%) of aggregate deal value — $544,000,000 — will be deposited with Cobalt Trust Company at closing. The escrow contact is Laura Ng, Vice President, Escrow Services, at Cobalt Trust Company. The escrow release schedule provides that 50% of the escrow amount ($272,000,000) will be released to former Cloudium stockholders at 12 months post-closing, with the remaining 50% ($272,000,000) released at 18 months post-closing, in each case subject to deduction for any pending or resolved indemnification claims.
Survival Period. The representations and warranties in the Merger Agreement survive for 18 months following the closing date. Fundamental representations (organization, authorization, capitalization, and title) survive for a longer period, as is customary.
Basket. The indemnification basket is set at 0.75% of aggregate deal value, or $51,000,000. The basket functions as a tipping basket — once aggregate losses exceed the basket amount, the indemnifying party is liable for the full amount of losses from the first dollar (not merely the excess over the basket). The de minimis threshold for individual claims is $500,000, meaning that individual losses below $500,000 are excluded from the basket calculation.
Special Indemnities (Uncapped). Certain categories of losses are subject to uncapped indemnification, separate and apart from the general indemnification cap. These include: (a) fraud, (b) willful breach of representations or covenants, (c) tax indemnities under the Tax Indemnification Agreement, and (d) specified litigation matters (none currently identified).
Interplay with R&W Policy. The R&W Policy sits above the escrow and direct indemnification framework. Solara's first recourse for losses arising from breaches of representations and warranties is to the escrow fund and direct indemnification from the rollover participants (subject to the general indemnification cap of $1,020,000,000). The R&W Policy then provides coverage for amounts in excess of the retention (which is equal to the escrow amount of $544,000,000), up to the $680,000,000 policy limit. This layered structure ensures that Solara has access to a total of up to $1,224,000,000 in combined coverage ($544,000,000 escrow + $680,000,000 R&WI), in addition to the general indemnification cap of $1,020,000,000.
E. Financing Overview
C&H presented the following summary of the Transaction's financing structure to the underwriting team:
Debt Financing.
• Term Loan B: $3,740,000,000 (seven-year maturity; interest rate of SOFR plus 325 basis points). The lead arranger and administrative agent is Meridian Atlantic Bank, N.A. (contact: Graham Whitaker). The co-arranger is Ironclad Capital Markets LLC (contact: Samuel Diaz).
• Revolving Credit Facility: $500,000,000 capacity (five-year maturity; interest rate of SOFR plus 275 basis points). The revolving facility is expected to be undrawn at closing.
Equity Financing.
• Equity Contribution from Fund VI: $2,832,888,096.
Refinancing of Existing Indebtedness. Cloudium's existing indebtedness under its credit agreement dated March 15, 2021, with Atlas Commercial Lending Corp. will be repaid in full at closing. The total existing indebtedness consists of a $620,000,000 term loan and $200,000,000 in drawn revolving credit facility borrowings, for a total of $820,000,000. The existing credit agreement contains a change-of-control provision that triggers a mandatory prepayment obligation, and accordingly, no consent is required — the repayment is automatic upon consummation of the merger.
Total Funding Requirement. The total funding requirement for the Transaction is $7,188,944,048, comprising the $6,800,000,000 aggregate merger consideration, $820,000,000 in existing indebtedness to be refinanced, and transaction fees and expenses (offset by rollover equity of approximately $616,055,952 and available balance sheet cash).
Leverage Metrics. Closing-date total leverage is approximately 9.24x LTM EBITDA on a pre-synergies basis. On a pro forma adjusted basis, including $110,000,000 in identified run-rate cost synergies, total leverage decreases to approximately 6.91x adjusted EBITDA. The credit agreement governing the new debt facilities contains a total net leverage covenant that requires maintenance of Total Net Leverage at or below 6.50:1.00, stepping down over time to 5.00:1.00. A solvency certificate will be delivered by Solara at closing, affirming the post-closing solvency of the surviving entity and its subsidiaries.
III. Diligence Workstream Summaries Presented
C&H presented detailed summaries of each major diligence workstream to the Northfield underwriting team. The following sections reflect the substance of those presentations and the discussions that ensued.
A. Corporate Organization and Subsidiaries
C&H presented the corporate organizational structure of Cloudium and its subsidiaries. The organizational chart, capitalization table, and copies of articles of association and certificates of incorporation for each entity in the group were made available to Northfield in the virtual data room prior to the call.
Parent Entity. Cloudium Technologies plc is the ultimate parent entity of the group, incorporated under the laws of England and Wales. As a Nasdaq-listed public company, Cloudium files periodic reports with the U.S. Securities and Exchange Commission and is subject to the reporting and governance requirements of the Securities Exchange Act of 1934 and the Sarbanes-Oxley Act of 2002.
Key Subsidiaries. Cloudium's operating subsidiaries include the following:
All subsidiaries are wholly owned by Cloudium Technologies plc, either directly or through intermediate holding entities. C&H confirmed that no minority interests, joint ventures, or unconsolidated investees were identified in the course of diligence. Good-standing certificates (or jurisdictional equivalents) and organizational documents for each entity were reviewed and found to be in order, with no material issues flagged.
Northfield's underwriting team did not raise any material questions or concerns with respect to the corporate organization workstream.
B. Material Contracts — Change of Control Provisions
C&H presented its analysis of material contracts containing change-of-control provisions that would be triggered by the consummation of the merger. This workstream was a significant area of focus during the Underwriting Call, as change-of-control consent risk is a common source of R&W insurance claims in the software sector.
C&H identified the following material contracts with change-of-control implications:
1. Existing Credit Agreement with Atlas Commercial Lending Corp. (dated March 15, 2021). The credit agreement governing Cloudium's existing $820,000,000 in indebtedness contains a change-of-control mandatory prepayment clause. Upon the occurrence of a change of control (which includes the Transaction), all outstanding borrowings become immediately due and payable. No lender consent is required. The entire $820,000,000 balance ($620,000,000 term loan and $200,000,000 drawn revolver) will be repaid at closing from proceeds of the new Term Loan B facility. This provision presents no risk, as repayment is fully factored into the Transaction's financing plan.
2. Master SaaS Agreement with Aegis Federal Solutions Inc. Aegis Federal Solutions Inc. ("Aegis Federal") is a U.S. government contractor and Cloudium's largest single customer, with annual recurring revenue of $84,000,000. The Master SaaS Agreement requires Aegis Federal's prior written consent to any change of control of Cloudium. This is a consent requirement, not merely a notice requirement. C&H flagged this as a moderate risk item during the Underwriting Call.
C&H reported that the consent process has been initiated, and Cloudium management has had preliminary discussions with Aegis Federal's procurement office. Based on the strength of the existing business relationship and the nature of Aegis Federal's reliance on Cloudium's platform, management expects that consent will be forthcoming. However, the government-contractor regulatory overlay — including FedRAMP authorization requirements and procurement compliance considerations — introduces a degree of procedural complexity that may affect the timeline for consent. C&H noted that the Merger Agreement includes receipt of all material third-party consents as a condition to closing, which means the Aegis Federal consent must be obtained prior to the closing date.
During the discussion, Northfield's underwriting team asked detailed follow-up questions regarding the Aegis Federal consent, which are addressed in Section IV below.
3. Technology License Agreement with Helix Data Systems GmbH. The Technology License Agreement between Cloudium and Helix Data Systems GmbH ("Helix Data"), a Frankfurt-based analytics technology company, contains a termination-for-change-of-control clause. The license covers certain embedded analytics technology that Cloudium utilizes in its business intelligence module. The consent process has been initiated, and C&H assessed this risk as manageable, though it remains an area of focus.
C&H noted that Cloudium's intellectual property team has identified potential fallback options — including proprietary development of a replacement analytics engine — in the event that consent is not obtained and Helix Data exercises its termination right. The estimated cost and timeline for a proprietary replacement, as well as Northfield's follow-up questions, are discussed further in Section IV below.
4. Other Commercial Contracts. In addition to the three contracts identified above, C&H's review identified change-of-control provisions in approximately 35 additional commercial contracts. None of these contracts individually exceeds $10,000,000 in annual recurring revenue. Based on the review, all such contracts were assessed as low risk, either because (a) the change-of-control provision requires only notice (not consent), (b) the revenue associated with the contract is not material, or (c) the counterparty relationship is such that consent is expected to be readily obtainable. A complete schedule of these contracts has been prepared and is available in the diligence materials.
C. Intellectual Property
C&H presented its review of Cloudium's intellectual property portfolio and related diligence findings to the Northfield underwriting team.
Patent Portfolio. Cloudium's IP portfolio includes approximately 145 registered U.S. and international patents and approximately 85 pending patent applications. The patents cover core functionality of Cloudium's enterprise software platform, including cloud infrastructure management, data analytics algorithms, user interface innovations, and security protocols. C&H reviewed the patent portfolio in coordination with outside patent counsel and confirmed that the registrations are current, maintenance fees are up to date, and no material challenges to the validity of Cloudium's patents were identified.
Trademarks. Cloudium holds approximately 320 registered trademarks across various jurisdictions, covering the company's brand names, product names, and logos. No material trademark disputes or oppositions were identified.
Proprietary Source Code. Cloudium maintains a substantial body of proprietary source code underlying its SaaS platform. The source code is subject to standard internal security protocols, access controls, and version management practices. C&H reviewed Cloudium's software development practices and intellectual property assignment agreements to confirm that the company owns or has appropriate rights to all material software assets.
Open-Source Software. Cloudium utilizes certain open-source software components in its products, including components licensed under the GNU Affero General Public License (AGPL) and the GNU General Public License (GPL). C&H's diligence focused on whether the use of these copyleft-licensed components could create "viral" contamination of Cloudium's proprietary source code — that is, whether the use of such components in connection with Cloudium's proprietary code could require Cloudium to make its proprietary code available under open-source terms.
C&H found that Cloudium has implemented an open-source compliance program, including policies for reviewing and approving open-source component usage, code segregation practices designed to prevent commingling of copyleft-licensed code with proprietary code, and internal auditing procedures. While C&H noted that some areas of open-source license hygiene require ongoing attention — a common finding in enterprise software companies of this scale — no material viral license contamination of proprietary source code was identified. The open-source usage was disclosed and discussed with Northfield, as described further in Section IV below.
IP Litigation. No pending intellectual property litigation against Cloudium was identified. Cloudium sent two outbound cease-and-desist letters in 2023, both relating to minor trademark infringement matters that were resolved informally. Neither matter escalated to formal proceedings.
Key Risk — Helix Data Technology License. As discussed in Section III.B above, the Technology License Agreement with Helix Data Systems GmbH covering embedded analytics technology in Cloudium's BI module is a key risk item. If the license is terminated upon the change of control and consent is not obtained, Cloudium would need to re-engineer the affected module. C&H flagged this to Northfield as a focus area, and Northfield acknowledged it as such.
Data Privacy and Cybersecurity. C&H's review of Cloudium's data privacy and cybersecurity posture confirmed the following:
• Cloudium is GDPR-compliant across its UK and EU operations, with a dedicated data protection officer and comprehensive data processing agreements with customers and sub-processors.
• Cloudium holds SOC 2 Type II certification, which is current and was reviewed as part of diligence.
• C&H reviewed Cloudium's cybersecurity incident history and identified one data breach incident in Q2 2022, involving the exposure of approximately 2,300 customer records. The affected records did not include payment card data or Social Security numbers. The incident was promptly identified, contained, and fully remediated. Cloudium reported the incident to the UK Information Commissioner's Office (ICO) in accordance with applicable data protection regulations. No enforcement action, fine, or penalty was imposed by the ICO. Cloudium has since implemented additional security measures, including enhanced intrusion detection systems, employee security training, and third-party penetration testing on a quarterly basis.
The Q2 2022 incident has been fully disclosed in the seller's disclosure schedules to the Merger Agreement. C&H discussed this incident with Northfield, and the related underwriting implications are addressed in Sections IV and V below.
D. Litigation and Regulatory
C&H presented its review of Cloudium's litigation and regulatory compliance profile.
Pending Litigation. No material pending or threatened litigation against Cloudium or any of its subsidiaries was identified in the course of diligence. C&H reviewed all active dockets, attorney communication files, demand letters, and litigation hold notices and found no matters that would give rise to a material liability.
Settled Litigation. One previously settled litigation matter was identified: an employment class action filed in California Superior Court in 2020, alleging violations of California wage and hour laws. The case was settled in 2021 for $3,800,000, with the settlement fully paid and a final order of dismissal entered. C&H confirmed that the settlement included a broad release of claims and that no residual obligations or monitoring requirements remain.
Governmental Orders. C&H reviewed all governmental orders, consent decrees, and regulatory settlements. No outstanding orders, decrees, or injunctions affecting Cloudium or its subsidiaries were identified.
Regulatory Compliance. Cloudium's regulatory compliance profile is generally clean. In particular, C&H confirmed that Cloudium's FedRAMP authorization status is current, which is essential for its engagement with Aegis Federal Solutions Inc. and other government-sector customers. Cloudium does not hold any classified government contracts and does not possess or export any technology subject to the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR).
During the Underwriting Call, Northfield asked whether any product liability exposure or class-action risk existed from SaaS platform failures, data loss events, or service-level agreement breaches. C&H confirmed that no such claims, demands, or threatened actions were identified in diligence.
E. Financial and Accounting
C&H presented its review of Cloudium's financial statements and accounting practices, supplemented by the findings of the financial due diligence conducted by Glenmore Thornton LLP.
Auditors and Audit History. Cloudium's independent auditors are Harwell & Dobson LLP, with Martin Chisholm serving as the engagement partner. Harwell & Dobson has issued clean (unqualified) audit opinions for all fiscal periods reviewed in connection with the Transaction. No going-concern qualifications, material weaknesses in internal controls over financial reporting, or significant deficiencies were identified.
Financial Due Diligence. Glenmore Thornton LLP, a nationally recognized accounting and advisory firm, conducted the buy-side financial due diligence for Solara. Vanessa Liu served as the lead partner on the engagement. The financial due diligence report (the "FDD Report") was reviewed by C&H and key findings were presented to Northfield at a high level, without disclosing the specific privileged details of the FDD Report.
Revenue Recognition. C&H reviewed the Target's revenue recognition practices, with particular focus on compliance with ASC 606 (Revenue from Contracts with Customers). Given Cloudium's subscription-based business model, revenue recognition is relatively straightforward for the majority of contracts. However, Cloudium also enters into multi-element arrangements that include professional services, implementation support, and customization, as well as contract modifications and renewals. These areas were identified as areas of focus for both C&H's legal diligence and Glenmore Thornton's FDD. The FDD Report found Cloudium's revenue recognition practices to be generally appropriate, with certain minor normalizing adjustments identified.
SEC Reporting. No material restatements of previously filed financial statements were identified. C&H reviewed Cloudium's history of SEC comment letters and confirmed that no comment letters required substantive revisions to the company's financial reporting or disclosures.
Quality-of-Earnings Adjustments. At a high level, C&H noted that the FDD Report identified approximately $15,000,000 to $20,000,000 in normalizing adjustments to LTM EBITDA. These adjustments reflect standard items such as non-recurring expenses, stock-based compensation normalization, and run-rate cost adjustments. All adjustments were within the expected range for a SaaS company of Cloudium's scale and were factored into the Buyer's valuation model.
Accounts Receivable. No material accounts receivable collection issues were identified. Days Sales Outstanding (DSO) metrics were in line with industry benchmarks for enterprise SaaS companies, reflecting the predictability and contractual nature of Cloudium's recurring revenue streams.
Northfield's Response. Northfield's underwriting team expressed comfort with the financial representation coverage in light of Cloudium's clean audit history, Sarbanes-Oxley compliance discipline, and the absence of material restatements or SEC comment letter issues. No significant follow-up questions were raised on this workstream.
F. Tax. Leonard Cross, a tax specialist partner at C&H, presented the tax diligence findings to Northfield's underwriting team.
Tax Compliance. There are no open IRS or HMRC audits currently pending against Cloudium or any of its subsidiaries. No pending tax disputes, assessments, or deficiency notices were identified in the course of diligence. Cloudium's effective tax rate is consistent with the rates disclosed in its public filings and is within the expected range for a multinational technology company of its profile.
Tax Positions. C&H reviewed Cloudium's tax positions, including uncertain tax positions disclosed in its financial statements, and confirmed that no aggressive or material uncertain tax positions were identified. Cloudium does not utilize tax shelters, listed transactions, or similar structures that might give rise to heightened audit risk.
Transfer Pricing. The intercompany arrangements among Cloudium Technologies plc, Cloudium Technologies UK Ltd., Cloudium Technologies India Pvt. Ltd., and Cloudium Solutions GmbH were reviewed for transfer pricing compliance. The arrangements are generally at arm's length and are supported by contemporaneous transfer pricing documentation. Cloudium Technologies India Pvt. Ltd. performs primarily cost-plus research and development services for the group, and the cost-plus margins applied are consistent with OECD Transfer Pricing Guidelines and local Indian regulations.
UK Tax Matters. Mr. Cross confirmed that no Stamp Duty Reserve Tax (SDRT) exposure is expected in connection with the Transaction, as Cloudium's shares are listed on the Nasdaq Global Select Market (a non-UK exchange) and the shares are not held within the CREST settlement system. No material UK corporation tax, VAT, or other tax risks were identified.
Tax Representations and Indemnities. C&H reviewed the tax representations contained in Article IV of the Merger Agreement and confirmed that they are standard for a transaction of this type and scope. C&H noted that the tax indemnities under the Transaction are treated as special indemnities — they are uncapped and carved out from the general 15% indemnification cap of $1,020,000,000. This provides the Buyer with direct, uncapped recourse against the seller for historical tax liabilities that constitute breaches of the tax representations.
Northfield's Response. Northfield's underwriting team noted that tax-related claims represent a growing area of R&W insurance loss experience across the market. Northfield confirmed that the standard tax-related policy exclusions will apply to the R&W Policy, including exclusions for (a) prospective or forward-looking tax planning, (b) post-closing reorganization impacts (including IP migration and restructuring), and (c) transfer pricing adjustments attributable to post-closing changes in intercompany arrangements. These exclusions are market-standard and are distinct from coverage for breaches of the historical tax representations, which will be covered under the Policy.
G. Employee Benefits and Compensation
C&H presented its review of employee benefits and compensation matters across Cloudium's global operations.
United States. Cloudium's U.S. employees participate in a standard 401(k) retirement savings plan, and the company provides customary health and welfare benefits (medical, dental, vision, life, and disability insurance). C&H reviewed the change-of-control acceleration provisions in Cloudium's Equity Incentive Plan and confirmed that all outstanding stock options and restricted stock units ("RSUs") are subject to single-trigger acceleration upon the closing of the Transaction. The cost of this acceleration has been fully incorporated into the deal model and is reflected in the per-share merger consideration.
United Kingdom. C&H reviewed the defined-contribution pension scheme maintained by Cloudium Technologies UK Ltd. for its approximately 1,200 UK-based employees. No defined-benefit pension liabilities exist within the Cloudium group, and the UK subsidiary is in compliance with auto-enrollment requirements under applicable UK pensions legislation. No material pension-related risks or deficiencies were identified.
India. C&H reviewed the statutory employee benefit obligations of Cloudium Technologies India Pvt. Ltd., including gratuity obligations under the Payment of Gratuity Act, 1972, and provident fund contributions under the Employees' Provident Fund and Miscellaneous Provisions Act, 1952. All obligations were found to be within statutory parameters, with no material arrears or compliance deficiencies identified.
Germany. Cloudium Solutions GmbH, the German subsidiary, employs approximately 400 individuals in Berlin. C&H confirmed that no works council (Betriebsrat) has been established at the German subsidiary. Standard German social security, statutory health insurance, and employee benefit compliance was confirmed. No material issues were identified.
TUPE Considerations. C&H flagged the potential applicability of the Transfer of Undertakings (Protection of Employment) Regulations 2006 ("TUPE") to UK employees. However, in the context of a share acquisition (as opposed to an asset deal or transfer of an undertaking), TUPE is generally not triggered, because the identity of the employer does not change — Cloudium Technologies UK Ltd. will remain the employer of its UK employees following the closing. C&H confirmed this analysis in a separate UK employment diligence memorandum dated January 10, 2024, which has been circulated to the deal team.
ERISA Compliance. No material ERISA compliance deficiencies were identified with respect to Cloudium's U.S. benefit plans. The 401(k) plan is a standard defined-contribution plan that does not give rise to the pension underfunding risks associated with defined-benefit plans.
Northfield's Response. Northfield expressed no significant concerns regarding the employee benefits and compensation workstream. This is consistent with the target profile — as a technology company, Cloudium does not present the defined-benefit pension or legacy labor liabilities that frequently arise in R&W insurance underwriting for industrial or manufacturing targets.
H. Environmental and Real Property
C&H presented a brief summary of the environmental and real property diligence findings.
Environmental. Cloudium is a software company with no manufacturing, industrial, or chemical processing operations. The environmental risk profile is minimal. No environmental remediation obligations, hazardous materials usage, or Comprehensive Environmental Response, Compensation, and Liability Act ("Superfund") exposure was identified. Cloudium's operations are limited to office spaces and data center colocation facilities, none of which present material environmental concerns.
Real Property. All of Cloudium's operating locations are leased. The company does not own any real property. C&H reviewed the key lease agreements for Cloudium's principal offices and operating facilities, including:
• London, United Kingdom (45 Broadwick Street — corporate headquarters)
• Manchester, United Kingdom (subsidiary office)
• San Francisco, California (600 Townsend Street — U.S. headquarters)
• Bangalore, India (R&D and support center)
• Berlin, Germany (DACH sales office)
The leases are on market terms, and no material issues (such as impending lease expirations, onerous renewal terms, or defaults) were identified. Certain of the leases contain assignment or change-of-control notice provisions, which are being addressed as part of the broader consent process described above.
Northfield's Response. Northfield confirmed that environmental matters are not a significant underwriting concern for this target profile. This is consistent with standard R&W insurance market practice for software and technology acquisitions.
I. Insurance. C&H reviewed Cloudium's existing insurance program and presented a summary of findings to the underwriting team.
Existing Coverage. Cloudium maintains a comprehensive insurance program, including directors' and officers' liability (D&O), errors and omissions / professional liability (E&O), cyber liability, general commercial liability, and property insurance. C&H reviewed the key policies and confirmed that coverage limits, deductibles, and terms are consistent with industry norms for a company of Cloudium's size and risk profile.
D&O Tail Policy. A directors' and officers' liability tail policy will be placed at closing to provide continued coverage for the pre-closing acts and omissions of Cloudium's directors and officers. The placement of the D&O tail is a separate matter from the R&W Policy and is being handled by a different insurance brokerage.
Claims History. No material uninsured or underinsured known loss events were identified. The Q2 2022 data breach incident (discussed in Section III.C above) was covered under Cloudium's existing cyber liability insurance policy. The claim was resolved within policy limits, and no residual exposure remains.
Northfield's Response. Northfield did not raise any material questions regarding Cloudium's existing insurance program.
IV. Northfield Underwriter Questions and C&H Responses
A. Specific Questions Raised by Northfield Underwriters
Following C&H's presentation of the diligence workstream summaries, Northfield's underwriting team raised a number of specific questions. The following is a comprehensive summary of the questions and C&H's responses.
1. Aegis Federal Consent Risk.
Northfield's underwriters focused significant attention on the change-of-control consent required under Cloudium's Master SaaS Agreement with Aegis Federal Solutions Inc. Northfield asked for more detail on (a) the specific consent mechanism under the agreement, (b) the anticipated timeline for obtaining consent, and (c) the business impact if consent were ultimately withheld.
C&H responded as follows:
(a) Consent Mechanism. The Master SaaS Agreement requires Aegis Federal's prior written consent to any change of control of Cloudium, defined to include a merger, acquisition, or transfer of a majority of Cloudium's outstanding voting securities. This is a consent requirement, not merely a notice requirement. The agreement does not specify that consent cannot be unreasonably withheld, which gives Aegis Federal broader discretion.
(b) Timeline. Based on Cloudium management's communications with Aegis Federal's procurement office, consent is expected to be obtained within 30 to 60 days following the signing of the Merger Agreement. Given the anticipated signing date of January 22, 2024, this would place the expected consent receipt in the February to March 2024 timeframe, well in advance of the targeted closing date. The consent process involves both commercial relationship management and government procurement compliance review, the latter of which may introduce some procedural lead time.
(c) Revenue Impact. The $84,000,000 in annual recurring revenue associated with the Aegis Federal contract represents approximately 4.8% of Cloudium's total ARR of $1,740,000,000. While the loss of this customer would be material from a revenue perspective, it would not be existential to the business. Cloudium's customer base is diversified, with no other single customer representing more than 3.5% of total ARR.
(d) Closing Condition. The Merger Agreement includes as a condition to the obligation of the parties to consummate the closing the receipt of all consents identified on a specified schedule of material consents. The Aegis Federal consent is included on this schedule. Accordingly, the consent must be obtained prior to closing; if it is not obtained, the parties would not be obligated to close (and, depending on the circumstances, could exercise termination rights).
Northfield's underwriters acknowledged the moderate nature of the risk and indicated that, depending on the status of the consent at the time of binding, a specific exclusion might be imposed. C&H noted its intention to negotiate this point.
2. Helix Data License Termination.
Northfield asked about the scope of the embedded analytics technology covered by the Helix Data Systems GmbH license, the cost and timeline for developing a proprietary replacement, and whether any fallback intellectual property existed.
C&H responded as follows:
(a) Scope. The Helix Data analytics engine is used in Cloudium's business intelligence module to provide advanced data visualization and predictive analytics capabilities. It is an embedded component within the BI module, not a core element of Cloudium's primary ERP or CRM platform. The BI module is an important product offering, but it does not represent the majority of Cloudium's ARR.
(b) Replacement Cost and Timeline. Cloudium's engineering team has estimated that developing a proprietary replacement for the Helix Data analytics engine would take approximately 6 to 9 months and cost approximately $8,000,000 to $12,000,000 in development resources. During the transition period, certain advanced analytics features of the BI module might experience reduced functionality, although the core module would remain operational.
(c) Consent Status. Consent discussions with Helix Data are underway and are expected to be resolved on commercially reasonable terms. Cloudium and Helix Data have had a productive business relationship, and there is no indication that Helix Data intends to withhold consent.
Northfield noted this as an area of focus and indicated that, similar to the Aegis Federal consent, a specific exclusion might apply if the consent is unresolved at the time of binding.
3. Open-Source Compliance.
Northfield asked whether any open-source license contamination risk could affect the valuation of Cloudium's intellectual property portfolio, particularly given the use of AGPL- and GPL-licensed components.
C&H confirmed that Cloudium's open-source compliance framework — including code segregation practices, component-level tracking, and internal review processes — is designed to prevent viral contamination of proprietary source code. C&H's review, which included discussions with Cloudium's VP of Engineering and a review of the company's open-source usage logs, found no evidence that copyleft-licensed code had been improperly commingled with proprietary code in a manner that would require Cloudium to release its proprietary code under open-source terms. While the open-source compliance program could benefit from continued maturation — an observation that is common across enterprise software companies — the current risk level was assessed as manageable and not material.
4. Cybersecurity Incident History.
Northfield asked for additional details regarding the Q2 2022 data breach, including the nature of the compromised data, the timeline for remediation, the regulatory response, and the measures taken to prevent recurrence.
C&H provided the following details:
(a) The incident involved the unauthorized access to a database containing approximately 2,300 customer records. The affected records included customer names, email addresses, and account identifiers. No payment card data, Social Security numbers, financial account information, or other highly sensitive personal data was compromised.
(b) The incident was identified by Cloudium's internal security team within 48 hours of the initial unauthorized access. Containment and remediation were completed within one week. Affected customers were notified in accordance with applicable data breach notification laws.
(c) The incident was reported to the UK Information Commissioner's Office (ICO) in compliance with GDPR notification requirements. The ICO reviewed the matter and took no enforcement action, issued no fine, and imposed no corrective order.
(d) Following the incident, Cloudium implemented enhanced security measures, including upgraded intrusion detection and prevention systems, mandatory multi-factor authentication for all administrative access, quarterly third-party penetration testing, and enhanced employee cybersecurity awareness training.
C&H emphasized that the incident was fully remediated, that no enforcement action resulted, and that the matter has been disclosed in the seller's disclosure schedules. C&H noted its intention to advocate that this fully remediated historical incident should not warrant a specific exclusion from the R&W Policy.
5. Closing-Date Leverage.
Northfield's underwriting team asked about the post-closing solvency of the surviving entity in light of the Transaction's leverage profile, noting that closing-date total leverage of approximately 9.24x LTM EBITDA (pre-synergies) is elevated.
C&H responded as follows:
(a) Pro forma adjusted EBITDA, including $110,000,000 in identified run-rate cost synergies, reduces total leverage to approximately 6.91x adjusted EBITDA. The synergy assumptions have been independently validated by Glenmore Thornton LLP as part of its financial due diligence work and are consistent with comparable transactions in the enterprise SaaS sector.
(b) The credit agreement governing the new debt facilities includes a Total Net Leverage maintenance covenant that requires compliance at or below 6.50:1.00 initially, stepping down to 5.00:1.00 over the term of the facility. Solara's underwriting of the Transaction anticipates achieving covenant compliance within the first year of operations.
(c) A solvency certificate will be delivered by Solara at closing, affirming the solvency of the surviving entity and its subsidiaries as of the closing date. The solvency certificate will be prepared in consultation with a nationally recognized valuation firm.
Northfield expressed no material concern regarding the financial representation coverage in light of these factors.
6. Government Contracts and FedRAMP.
Northfield asked whether Cloudium holds any classified government contracts or possesses any export-controlled technology subject to ITAR or EAR restrictions.
C&H confirmed that Cloudium does not hold any classified government contracts and does not possess, develop, or export any technology that is controlled under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). Cloudium's government-sector business is conducted exclusively through its commercial cloud platform, which holds a current FedRAMP authorization at the Moderate impact level. The FedRAMP authorization is issued by the Joint Authorization Board and is expected to remain in effect following the closing, subject to compliance with ongoing monitoring requirements.
7. UK Subsidiary Revenue Significance.
Northfield asked about the relative importance of the UK subsidiary to the overall Cloudium group, in light of the fact that Cloudium Technologies UK Ltd. contributes approximately £312,000,000 (~$390,000,000) in revenue, representing approximately 24% of total group revenue.
C&H confirmed the revenue contribution and noted that risks specific to UK operations — including post-Brexit regulatory developments, UK data protection compliance (under the UK GDPR and the Data Protection Act 2018), employment law considerations, and tax matters — were addressed in dedicated UK-law diligence workstreams. No material UK-specific risks were identified that would fall outside the coverage of the representations and warranties in the Merger Agreement. Northfield acknowledged the significance of the UK operations but did not flag any additional underwriting concerns.
V. Areas of Potential Coverage Exclusion Identified
Based on the discussions during the Underwriting Call, Northfield flagged the following areas that may be subject to exclusion or limitation in the final R&W Policy. These items will be addressed in the binder agreement and final policy wording, and C&H will negotiate on behalf of Solara to minimize the scope of exclusions to the extent commercially reasonable.
1. Known Matters / Specific Disclosures. Any matter specifically disclosed in the seller disclosure schedules to the Merger Agreement will be excluded from coverage under the standard known-loss exclusion. This is a market-standard provision in buyer-side R&W insurance policies and reflects the principle that the policy is designed to cover unknown breaches of representations, not matters of which the buyer is already aware at the time of binding.
2. Aegis Federal Consent. If the written consent of Aegis Federal Solutions Inc. under the Master SaaS Agreement has not been obtained prior to the binding date of January 19, 2024, Northfield may impose a specific exclusion for losses arising from the Aegis Federal change-of-control consent issue. C&H noted that this is primarily a timing issue — the consent process has been initiated, and consent is expected within 30 to 60 days post-signing. Consent need not be obtained prior to binding, but must be obtained prior to closing. C&H will negotiate to ensure that any exclusion is narrowly tailored and includes a mechanism for automatic reinstatement of coverage upon receipt of consent.
3. Helix Data License. Similarly, if the consent of Helix Data Systems GmbH under the Technology License Agreement has not been resolved at the time of binding, Northfield may impose a specific exclusion for losses arising from the Helix Data change-of-control termination right. C&H will negotiate the scope of any such exclusion and will seek reinstatement language.
4. Forward-Looking Tax Matters. Northfield indicated that the standard exclusion for forward-looking tax matters will apply. This exclusion covers losses arising from post-closing tax restructuring, intellectual property migration, transfer pricing adjustments attributable to post-closing changes in intercompany arrangements, and other prospective tax planning activities. This exclusion does not extend to breaches of the historical tax representations contained in Article IV of the Merger Agreement, which will remain fully covered under the Policy. C&H will ensure that the distinction between historical tax representation breaches and forward-looking tax matters is clearly delineated in the policy wording.
5. Cyber / Data Privacy Claims. Northfield indicated that the standard market approach will apply to data privacy and cybersecurity claims. The Policy will provide coverage for breaches of data-privacy-related representations and warranties as of the closing date. However, Northfield noted the potential for a sub-limit or specific exclusion with respect to claims arising from the known Q2 2022 data breach incident. C&H will negotiate vigorously to ensure that the 2022 incident, having been fully remediated with no enforcement action taken by the ICO, is not specifically excluded from coverage. C&H's position is that the inclusion of a specific exclusion for a fully resolved incident with no residual liability is not warranted and is inconsistent with market practice for incidents of this nature and scope.
6. Asbestos / Environmental / Product Liability. Northfield's standard blanket exclusion for asbestos-related claims, environmental liabilities, and product liability claims will apply. This exclusion is not a meaningful concern for the Transaction, given Cloudium's software-only business model and the absence of any manufacturing, industrial, or environmental exposure.
7. Pension Underfunding. The standard exclusion for defined-benefit pension underfunding liabilities will apply. This exclusion is not applicable to the Transaction, as Cloudium maintains only defined-contribution pension plans across all jurisdictions.
8. Purchase Price Adjustments. Losses arising from post-closing working capital true-up disputes will be excluded from R&W Policy coverage. This is a market-standard exclusion reflecting the principle that purchase price adjustment mechanisms are a contractual matter between the buyer and seller, not an insurable risk under an R&W policy.
9. Covenant Breaches. The R&W Policy covers only breaches of the seller's representations and warranties as set forth in Article IV of the Merger Agreement. Breaches of interim-period operating covenants (Article VI), closing conditions, or other contractual obligations of the seller are excluded from coverage. This is standard for buyer-side R&W insurance policies, which are designed to insure the accuracy of the representations and warranties as of the signing date and the closing date.
VI. Subrogation and Fraud Provisions
C&H discussed the subrogation and fraud provisions of the R&W Policy with Northfield's underwriting team.
Subrogation Waiver. Northfield confirmed that the R&W Policy will include the standard buyer-side subrogation waiver. Under this provision, the insurer waives its right to pursue subrogation claims against Cloudium, its former officers and directors, and the selling stockholders in the event that the insurer pays a claim under the Policy. The subrogation waiver is a critical feature of buyer-side R&W insurance policies, as it ensures that the payment of a claim does not create a secondary dispute between the insurer and the target company or its former stakeholders.
Northfield confirmed that the subrogation waiver is particularly important in this Transaction given the rollover equity dynamic. Jonathan Hargrove (CEO) and Pinnacle Growth Ventures LLC will remain actively involved in the business following the closing, both as equity investors and, in Mr. Hargrove's case, as a continuing executive. If the insurer retained subrogation rights against these individuals and entities, a paid claim could give rise to a subrogation action that would undermine the post-closing business relationship and governance structure. The subrogation waiver eliminates this risk.
Fraud Carve-Out. The subrogation waiver does not extend to cases of fraud. The insurer retains the right to pursue subrogation claims against any person who committed fraud in connection with the representations and warranties. Additionally, the R&W Policy itself will not cover losses arising from fraud by any person with actual knowledge of the fraudulent conduct. This fraud exclusion is standard and reflects the fundamental insurance principle that fraud is not an insurable risk.
However, C&H noted that fraud by the seller is treated as an uncapped special indemnity under the Merger Agreement. Accordingly, if fraud is discovered, Solara retains direct recourse against the perpetrators under the indemnification provisions of the Merger Agreement, without any limitation by the general indemnification cap or the R&W Policy exclusion. This ensures that Solara is fully protected against fraud risk through the direct contractual indemnification framework, even though the R&W Policy does not provide coverage for such matters.
VII. Policy Terms and Premium Confirmation
The following table summarizes the key commercial terms of the R&W Policy, as confirmed during the Underwriting Call and consistent with Northfield's non-binding indication dated January 14, 2024:
The premium of $13,600,000, representing a rate of 2.0% on the $680,000,000 policy limit, is within the expected market range for a transaction of this size and risk profile. The broker fee of $680,000 payable to Peregrine Advisory Group LLC is consistent with the engagement terms previously agreed between Solara and Peregrine.
The retention of $544,000,000 is structured to equal the escrow amount, ensuring that Solara must first exhaust the escrow fund (and pursue direct indemnification from the rollover participants up to the applicable indemnification cap) before the R&W Policy attaches. The retention drop-down to $272,000,000 after 12 months — conditioned on no pending claims — aligns with the escrow release schedule, under which 50% of the escrow is released at the 12-month anniversary. This structure incentivizes prompt resolution of any claims within the first year and provides enhanced protection to Solara in the second year of the policy period, when the reduced escrow balance may leave a gap between available escrow funds and the original retention level.
VIII. Next Steps and Action Items
The following action items were identified during and following the Underwriting Call: