1041-00004 · Solara Digital Infrastructure LP · Diligence/Regulatory

regulatory-compliance-diligence-memo.docx DOCUMENT M&A / Corporate

13 / 36 ← → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

TO: James Prentice, Responsible Partner, Calderwood & Harkness LLP Claire Nakamura, Partner, Head of Software Investing, Solara Digital Infrastructure LP

FROM: Andrew Fitzpatrick, Lead Associate, Calderwood & Harkness LLP

DATE: February 24, 2026

RE: Regulatory and Compliance Due Diligence — Meridian FleetWorks, Inc. (Project Trident)

MATTER NO.: 1041-00004

ENGAGEMENT REFERENCE: 1041-00004

This memorandum is a privileged and confidential communication prepared by Calderwood & Harkness LLP at the direction of Solara Digital Infrastructure LP in connection with the proposed acquisition of Meridian FleetWorks, Inc. (Project Trident). This memorandum is protected by the attorney-client privilege and constitutes attorney work product. It is intended solely for the use of the addressees and other authorized recipients within the Solara deal team. Distribution to third parties is not authorized without the prior written consent of Calderwood & Harkness LLP. Nothing in this memorandum constitutes legal advice to any person other than the addressees.

Right-click to update Table of Contents

I. EXECUTIVE SUMMARY

This memorandum summarizes the preliminary findings of the regulatory and compliance due diligence conducted by Calderwood & Harkness LLP ("C&H" or the "Firm") in connection with the proposed acquisition (the "Transaction") by Solara Fleet Holdings LLC ("Buyer"), a newly formed, wholly-owned subsidiary of Solara Fund III, LP (the "Fund"), which is itself a fund managed by Solara Digital Infrastructure LP ("Solara"), of one hundred percent (100%) of the issued and outstanding shares of common stock and Series A Preferred Stock of Meridian FleetWorks, Inc. ("MFW" or the "Company"), for an aggregate purchase price of Three Hundred Fifty Million Dollars ($350,000,000) (the "Purchase Price"), subject to customary purchase price adjustments as set forth in the definitive Stock Purchase Agreement (the "SPA") currently under negotiation.

The scope of this regulatory and compliance due diligence review encompasses the following principal areas: (i) antitrust analysis under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended (the "HSR Act"); (ii) foreign investment review under the Committee on Foreign Investment in the United States ("CFIUS") regulatory framework; (iii) state regulatory licensing and approval requirements; (iv) data privacy and cybersecurity compliance, with particular attention to the Illinois Biometric Information Privacy Act ("BIPA"), the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), and other applicable state privacy laws; (v) sales and use tax compliance related to MFW's SaaS subscription revenue; and (vi) regulatory compliance under the Federal Motor Carrier Safety Administration ("FMCSA") regulations governing electronic logging devices ("ELDs").

Calderwood & Harkness obtained access to the Thackeray Solutions virtual data room established for this transaction (code name: Project Trident) on February 3, 2026. Our review is ongoing and will continue through the buyer's diligence completion deadline of March 15, 2026, as established under the Letter of Intent dated February 18, 2026 (reference LOI-MFW-2026-0218). As of the date of this memorandum, certain document requests remain outstanding, and several analyses are still in progress. The findings set forth herein are accordingly preliminary and subject to revision upon receipt and review of additional materials.

Key Findings Summary:

• HSR Filing Requirement. An HSR Act pre-merger notification filing is required in connection with the Transaction. Based on the applicable size-of-transaction thresholds, the estimated filing fee is $350,000. We do not anticipate substantive antitrust concerns based on the transaction profile, and a second request from the reviewing agency is unlikely.

• CFIUS. No CFIUS concerns have been identified. All parties to the Transaction are U.S.-domiciled entities controlled by U.S. persons. Neither a mandatory declaration nor a voluntary notice is recommended at this time, subject to confirmation regarding the composition of the Fund's limited partner investor base.

• State Regulatory Approvals. MFW does not hold any regulated professional or industry licenses that would require separate state regulatory approvals as a condition to closing. The stock purchase structure preserves MFW as the same legal entity post-closing, thereby avoiding assignment-of-license considerations.

• Data Privacy and Cybersecurity. Data privacy compliance review is in progress and represents one of the more significant areas of regulatory risk identified to date. MFW processes fleet GPS and driver-behavior data, including potential biometric identifiers, raising material questions under Illinois BIPA, CCPA/CPRA, and other state privacy laws. MFW's platform documentation references optional "facial recognition-based ELD login" features that, if deployed for Illinois-operating customers, would trigger BIPA compliance obligations. Documentation regarding MFW's biometric data policies and consent practices has been requested but has not yet been provided.

• Sales and Use Tax Exposure. Preliminary findings from Whitmore Sandoval Group LLC ("Whitmore Sandoval"), Solara's buy-side quality of earnings advisor, indicate that MFW appears to have sales tax nexus in an estimated six to eight states where it has not been collecting or remitting SaaS sales tax. The estimated exposure range, inclusive of back taxes, penalties, and interest, is $800,000 to $1,400,000. Detailed state-by-state analysis is ongoing.

• ELD/FMCSA Compliance. MFW's ELD compliance module is a core feature of its platform and is subject to FMCSA regulations under 49 CFR Part 395. Preliminary review indicates that MFW's ELD solution is registered on the FMCSA's list of registered ELDs. Detailed technical compliance confirmation is pending.

Recommendation. Based on the preliminary findings summarized above, we recommend that certain findings warrant specific representations and indemnification coverage in the SPA. In particular, the sales tax exposure and data privacy compliance issues should receive focused attention in both the SPA negotiation process and the representations and warranties insurance ("R&W Insurance") underwriting submission. We provide detailed recommendations for SPA provisions in each substantive section below and in Section IX of this memorandum.

II. HART-SCOTT-RODINO ANTITRUST IMPROVEMENTS ACT ANALYSIS

A. Filing Requirement

The Transaction is subject to the pre-merger notification requirements of the HSR Act (15 U.S.C. § 18a) and the implementing rules promulgated by the Federal Trade Commission (the "FTC") at 16 CFR Parts 801–803.

The proposed acquisition constitutes the acquisition of one hundred percent (100%) of all issued and outstanding voting securities of MFW, specifically all shares of common stock and Series A Preferred Stock. The aggregate transaction value of $350,000,000 exceeds the current size-of-transaction threshold under the HSR Act, which, as adjusted for fiscal year 2026, requires notification for transactions valued in excess of the applicable dollar threshold. Because the Transaction exceeds this threshold, the size-of-transaction test is satisfied regardless of the size of the parties, though we note that the size-of-person thresholds are independently satisfied as well.

With respect to the acquiring person, Solara Digital Infrastructure LP, acting through the Fund (Solara Fund III, LP) and the acquisition vehicle (Solara Fleet Holdings LLC), constitutes the ultimate parent entity for purposes of the HSR Act analysis. The Fund has committed capital of approximately $1.85 billion, well in excess of the applicable asset or revenue thresholds under the size-of-person test. With respect to the acquired person, Meridian FleetWorks, Inc. reported total revenue of approximately $67,500,000 for fiscal year 2025, also satisfying the applicable size-of-person thresholds for the acquired entity.

Pre-merger notification must be filed with both the FTC and the Antitrust Division of the United States Department of Justice (the "DOJ"). Under the HSR Act, both the acquiring person and the acquired person are required to file notification forms (HSR Form). The estimated filing fee for this Transaction, based on the aggregate transaction value of $350,000,000, is $350,000. Pursuant to the terms of the Letter of Intent (LOI-MFW-2026-0218), the filing fee is the Buyer's obligation. The HSR transaction number will be assigned by the FTC upon acceptance of the notification filing.

Following the filing of the notification forms, a standard thirty (30) calendar day initial waiting period will commence. The waiting period must expire or be terminated before the Transaction may be consummated. The parties may request early termination of the waiting period from the FTC and DOJ, which, if granted, would shorten the waiting period. If the reviewing agency issues a request for additional information and documentary material (a "second request"), the initial waiting period is extended and a new waiting period begins upon substantial compliance with the second request.

B. Timing Considerations

The current Transaction timeline contemplates execution of the definitive SPA on or about March 31, 2026, with a target closing date of April 30, 2026, and an outside date of June 30, 2026. These dates are subject to negotiation and will be set forth in the SPA.

We recommend filing the HSR notification promptly following execution of the definitive SPA to preserve maximum timeline flexibility. In practice, the notification forms can be substantially prepared in advance of SPA execution, allowing for rapid filing once the definitive agreement is signed. If early termination is granted or the standard thirty-day initial waiting period expires without issuance of a second request, HSR clearance should be obtained well in advance of the target closing date and should not constitute a gating item for the Transaction.

HSR Act clearance — defined as the expiration or early termination of the applicable waiting period, or, in the event of a second request, compliance with the second request and expiration of the resulting waiting period — will be included as a condition precedent to closing in the SPA. This is standard practice for transactions of this size and nature. We will coordinate with Solara's deal team on the preparation and filing of the notification forms as the SPA approaches execution.

C. Substantive Antitrust Assessment

We have conducted a preliminary substantive assessment of the antitrust risk profile of the Transaction.

MFW operates a vertical software-as-a-service platform serving the fleet management and logistics sector. The Company's platform provides fleet management, route optimization, electronic logging device compliance, and embedded payments functionality to approximately 4,200 mid-market trucking and logistics customer accounts. MFW's annual recurring revenue ("ARR") as of fiscal year 2025 is approximately $62,000,000.

Solara's existing portfolio is focused on asset management and software/SaaS businesses. Based on information provided by Solara and our review of Solara's publicly available portfolio descriptions, the Solara portfolio does not include any direct competitor in the fleet management or logistics SaaS market. Accordingly, we have identified no horizontal overlap between MFW and any existing Solara portfolio company that would give rise to competitive concerns under Section 7 of the Clayton Act.

MFW's market share in the broader fleet management software market is estimated to be modest. The market is characterized by significant fragmentation, with numerous established competitors and emerging entrants across various segments (full-suite fleet management platforms, standalone ELD solutions, route optimization providers, telematics providers, and embedded fintech solutions). MFW's focus on the mid-market segment further limits its competitive overlap with larger enterprise-focused competitors.

No vertical integration concerns have been identified. Solara is a financial sponsor rather than an operating company with upstream or downstream market positions in the trucking, logistics, or fleet management industries. The Transaction does not raise concerns regarding vertical foreclosure, input denial, or customer access denial.

Assessment: We assess the antitrust risk associated with the Transaction to be low. A second request from the FTC or DOJ is not anticipated. The Transaction is expected to receive HSR clearance through expiration or early termination of the standard thirty-day initial waiting period without further inquiry.

III. COMMITTEE ON FOREIGN INVESTMENT IN THE UNITED STATES (CFIUS)

A. Applicability Analysis

CFIUS is an interagency committee authorized to review transactions that could result in foreign control of, or certain foreign investment in, U.S. businesses, with a particular focus on transactions involving critical technology, critical infrastructure, or sensitive personal data of U.S. citizens. CFIUS's jurisdiction and authority are established by Section 721 of the Defense Production Act of 1950, as amended by the Foreign Investment Risk Review Modernization Act of 2018 ("FIRRMA"), and the implementing regulations at 31 CFR Parts 800 and 802.

CFIUS jurisdiction extends to "covered transactions," which include any transaction by or with a foreign person that could result in foreign control of a U.S. business, as well as "covered investments" by a foreign person in certain U.S. businesses that deal in critical technology, critical infrastructure, or sensitive personal data of U.S. citizens.

We have analyzed the parties to the Transaction to determine whether any foreign person or entity is involved in a manner that would trigger CFIUS jurisdiction:

Solara Digital Infrastructure LP is a Delaware limited partnership with its principal office at 1200 Market Street, Suite 2400, Wilmington, Delaware 19801. Solara is a U.S.-domiciled entity. The general partner of Solara is Solara Digital Infrastructure GP LLC, a Delaware limited liability company. The key principals of Solara, including Viktor Sorensen (Managing Partner) and Claire Nakamura (Partner, Head of Software Investing), are U.S. persons as defined under FIRRMA and the implementing regulations.

Solara Fund III, LP is a Delaware limited partnership (EIN 84-6239017) and is the specific investment vehicle through which the Transaction will be consummated. Solara Fund III, LP is a U.S.-domiciled entity.

Solara Fleet Holdings LLC is a newly formed Delaware limited liability company and wholly-owned subsidiary of Solara Fund III, LP, organized for the purpose of serving as the acquisition vehicle for the Transaction.

Meridian FleetWorks, Inc. is a Delaware corporation (EIN 47-3891205) with its principal office at 8750 Westpark Drive, Suite 600, McLean, Virginia 22102. MFW is a U.S.-domiciled corporation.

Based on the information provided by Solara and our review of the organizational documents made available in the VDR, all parties to the Transaction are U.S.-domiciled entities controlled by U.S. persons. No foreign person or entity has a direct or indirect interest in the acquiring entity sufficient to constitute foreign "control" or a "covered investment" under the CFIUS regulations.

B. Conclusion. Based on the foregoing analysis, CFIUS review is not applicable to the Transaction. We do not recommend either a mandatory declaration or a voluntary notice to CFIUS.

We note, however, an important qualification: if the composition of limited partners in Solara Fund III, LP includes any non-U.S. investors that possess governance rights — such as board designation rights, consent rights, veto rights over material decisions, or other rights that would be considered indicia of "control" or a "covered investment" under 31 CFR § 800.208 or § 800.211 — this analysis should be revisited. We have submitted a request to Solara for confirmation regarding the LP investor base, including a representation that no limited partner in the Fund is a foreign person with governance rights that would trigger CFIUS jurisdiction. Based on preliminary representations received from Solara's internal legal team, no CFIUS-triggering foreign LP interests exist. We will update this analysis upon receipt of the formal confirmation.

Additionally, we note that MFW processes sensitive personal data of U.S. citizens (including geolocation data, driver identification data, and Social Security numbers for payroll-integrated customers). Under FIRRMA, certain transactions involving U.S. businesses that maintain or collect sensitive personal data of U.S. citizens are subject to mandatory CFIUS declarations, even in the case of non-controlling investments by foreign persons. Because no foreign person is party to this Transaction, this provision is not triggered. However, this consideration further underscores the importance of confirming the absence of CFIUS-triggering foreign LP interests in the Fund.

IV. STATE REGULATORY APPROVALS AND LICENSING

A. Industry-Specific Licensing

MFW provides a software-as-a-service platform serving the fleet management and logistics industry. The Company does not itself operate as a motor carrier, freight broker, freight forwarder, or other regulated transportation entity. Accordingly, MFW does not hold, and is not required to hold, operating authority from the FMCSA or from any state transportation regulatory body (such as a state department of transportation or public utilities commission).

We have evaluated whether MFW's embedded payments functionality — which facilitates fleet-related payments such as fuel card transactions, toll payments, and vendor payments on behalf of its customers — could require licensing as a money transmitter under applicable state money transmitter statutes. Money transmitter licensing is regulated on a state-by-state basis, and the threshold for when a technology platform's facilitation of payments constitutes "money transmission" varies by jurisdiction.

Based on VDR documents reviewed to date, MFW utilizes a third-party payment processor (identified in VDR materials as Strata Payments, Inc.) and does not itself hold, control, or transmit customer funds directly. MFW's role in the payment flow appears to be limited to initiating payment instructions that are executed by the third-party payment processor. Under most state money transmitter statutes, a platform that merely facilitates payment instructions without holding or controlling the funds is not engaged in money transmission and does not require a money transmitter license. However, the precise characterization of MFW's role in the payment processing arrangement is critical, as certain states apply a broader definition of money transmission that may encompass platforms that exercise control over funds at any point in the transaction flow.

We recommend confirming the specific contractual arrangement between MFW and Strata Payments, Inc. (including the flow of funds, timing of settlement, and whether MFW has any custody of customer funds at any stage) and conducting a targeted analysis of money transmitter licensing requirements in the states where MFW has significant customer concentrations. We have requested the relevant agreements and documentation from MFW through HKA Advisory Partners LLP ("HKA"), the Company's sell-side advisor.

MFW does not hold any professional licenses, insurance licenses, or financial services licenses. MFW is not a registered investment adviser, broker-dealer, insurance producer, or any other type of regulated financial services entity under federal or state law.

B. Foreign Qualification / Authority to Do Business

MFW is incorporated in the State of Delaware (Delaware Division of Corporations File Number 5582037). MFW maintains physical office locations in three states:

(i) McLean, Virginia — Corporate headquarters at 8750 Westpark Drive, Suite 600, McLean, VA 22102;

(ii) Austin, Texas — Regional office (address to be confirmed from VDR materials); and

(iii) Boise, Idaho — Regional office (address to be confirmed from VDR materials).

As a Delaware corporation conducting business in Virginia, Texas, and Idaho, MFW is required to qualify to do business as a foreign corporation in each of those states. We have requested certificates of good standing and foreign qualification certificates from MFW for each of these jurisdictions. These documents have not yet been received.

MFW may also have nexus for purposes of foreign qualification requirements in additional states where it has employees working remotely, maintains significant customer relationships, or conducts activities that constitute "doing business" under applicable state corporate statutes. The analysis of MFW's state-by-state nexus for purposes of foreign qualification overlaps significantly with the sales and use tax nexus analysis discussed in Section VI below, and we are coordinating both analyses to ensure consistency.

Failure to qualify as a foreign corporation in states where qualification is required does not typically void contracts or transactions entered into in those states, but it can result in the imposition of penalties, back fees, and interest, and may prevent MFW from maintaining or bringing legal proceedings in those jurisdictions until qualification is obtained. We will assess the extent of MFW's foreign qualification obligations upon receipt of additional information regarding MFW's employee locations and operational footprint.

C. Conclusion on State Regulatory Approvals

Based on our analysis to date, no separate state regulatory approvals are anticipated as a condition to closing the stock purchase Transaction. MFW does not hold any regulated licenses or permits that would require pre-closing regulatory consent, approval, or notification in connection with a change of control.

Importantly, the Transaction is structured as a stock purchase rather than an asset purchase. Under a stock purchase structure, MFW will continue as the same legal entity following the closing, with the same state qualifications, registrations, and contractual relationships. This structure avoids the assignment-of-license and assignment-of-permit issues that can arise in asset purchase transactions, where the transfer of specific assets may trigger requirements for new license applications or regulatory approvals.

We note that certain of MFW's customer contracts (specifically, the Master Subscription Agreement form) may contain change-of-control provisions that require notice to or consent from customers upon a change in control of MFW. While this is a commercial contract matter rather than a regulatory licensing matter, it should be addressed as part of the broader commercial due diligence and SPA drafting process. We will coordinate with the team conducting the commercial contract review.

V. DATA PRIVACY AND CYBERSECURITY COMPLIANCE

A. Overview of MFW's Data Processing Activities

MFW's platform collects, processes, transmits, and stores significant volumes of data in connection with its fleet management, route optimization, ELD compliance, and embedded payments services. The nature and sensitivity of this data make data privacy and cybersecurity compliance a material area of regulatory risk for the Transaction. Based on our review of VDR materials to date, the key categories of data processed by MFW include:

Fleet GPS and Location Data. MFW's platform collects and processes real-time and historical GPS coordinates for customer fleet vehicles. This geolocation data enables MFW's route optimization, fleet tracking, and dispatch management functionality. Under various state privacy laws, geolocation data — particularly precise geolocation data — constitutes a category of sensitive personal information subject to heightened regulatory requirements, including requirements for consent prior to collection, limitations on use, and specific disclosure obligations.

Driver-Behavior Data. MFW's platform captures data from ELD devices and telematics sensors installed in or connected to customer fleet vehicles. This data includes driving patterns, hours-of-service records, vehicle speed, acceleration and braking events, idling time, and other operational metrics. Significantly, MFW's platform documentation references a "driver identification" and "facial recognition-based ELD login" feature that is offered as an optional capability to customers. If this feature captures or processes facial geometry or other biometric identifiers, it would trigger compliance obligations under BIPA and potentially other state biometric privacy laws.

Driver Personal Information. MFW processes personal information of individual commercial drivers employed by MFW's customers, including names, commercial driver's license numbers, dates of birth, contact information (telephone numbers, email addresses, mailing addresses), employment records, and — for customers that have opted into MFW's payroll integration feature — Social Security numbers and payroll-related financial data. This data constitutes personal information under virtually all applicable state privacy laws and, in several instances, qualifies as sensitive personal information subject to heightened protections.

Customer Business Data. MFW processes operational and financial data belonging to its business customers, including route information, cargo manifests, scheduling data, delivery records, fleet composition and vehicle information, and financial data related to the embedded payments functionality (including payment amounts, vendor information, and bank account or payment card details).

MFW's customer base consists of approximately 4,200 mid-market trucking and logistics companies. The individual data subjects whose personal information is processed by MFW include the drivers, fleet managers, dispatchers, and other employees of those customer companies. The estimated number of individual data subjects has not yet been confirmed by MFW, but given the nature of mid-market fleet operations (where individual customer fleets may range from dozens to hundreds of vehicles and drivers), the total number of individual data subjects is likely in the tens of thousands, and may exceed one hundred thousand. We have requested this information from MFW.

B. Illinois Biometric Information Privacy Act (BIPA)

Applicability. The Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq., regulates the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and biometric information by private entities. "Biometric identifiers" are defined to include retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, and other specified biometric data. 740 ILCS 14/10. "Biometric information" means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual. Id.

If MFW's ELD functionality or driver authentication features involve the collection, capture, or otherwise obtaining of biometric identifiers — such as facial geometry scans used for driver identity verification during ELD login — from drivers operating in the State of Illinois, BIPA would apply to those collection activities. BIPA applies to private entities that collect biometric identifiers of individuals in Illinois; there is no requirement that the collecting entity be headquartered or organized in Illinois.

Key Requirements. BIPA imposes the following principal obligations on private entities that collect or possess biometric identifiers or biometric information:

(i) Written Policy. The entity must develop and make available to the public a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and information when the initial purpose for collecting such data has been satisfied or within three years of the individual's last interaction with the entity, whichever occurs first. 740 ILCS 14/15(a).

(ii) Written Informed Consent. Before collecting a biometric identifier, the entity must (a) inform the individual in writing that biometric data is being collected or stored, (b) inform the individual in writing of the specific purpose and length of term for which the biometric data is being collected, stored, and used, and (c) receive a written release executed by the individual. 740 ILCS 14/15(b).

(iii) Prohibition on Sale or Disclosure. The entity may not sell, lease, trade, or otherwise profit from an individual's biometric identifier or biometric information, and may not disclose or disseminate such data except in limited circumstances (consent, legal requirement, or financial transaction completion). 740 ILCS 14/15(c), (d).

(iv) Data Security. The entity must store, transmit, and protect biometric data using a reasonable standard of care, and in a manner at least as protective as the manner in which the entity stores, transmits, and protects other confidential and sensitive information. 740 ILCS 14/15(e).

Private Right of Action. BIPA is notable for its private right of action provision, which permits any person aggrieved by a violation to bring suit and recover the greater of actual damages or statutory liquidated damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus reasonable attorneys' fees and costs, and other relief as the court deems appropriate, including injunctive relief. 740 ILCS 14/20. The Illinois Supreme Court's decision in Cothron v. White Castle System, Inc., 2023 IL 128004 (2023), confirmed that a separate claim accrues each time a private entity scans or collects a biometric identifier or biometric information without prior informed consent, significantly increasing potential aggregate exposure in class action contexts.

VDR Findings to Date. MFW's platform documentation reviewed in the VDR references "driver identification" and "facial recognition-based ELD login" as optional features available to customers. The product specification documents describe this feature as providing biometric-based identity verification for ELD authentication, intended to ensure that the correct driver is logged into the ELD system in compliance with FMCSA regulations. If these features involve the capture, collection, or processing of facial geometry data — which, based on the feature description, appears likely — they would constitute the collection of biometric identifiers under BIPA.

The critical question is whether this facial recognition feature is currently enabled and in active use by any of MFW's customers whose drivers operate in the State of Illinois. If so, BIPA compliance is mandatory for those data collection activities.

Status of Review. We have submitted requests through HKA for the following documents and information:

(a) MFW's biometric data policies, including any written policy regarding retention and destruction of biometric identifiers and information;

(b) MFW's biometric data consent forms, including any written notices and releases provided to individuals prior to biometric data collection;

(c) Confirmation of whether the facial recognition-based ELD login feature is currently enabled for any MFW customers, and if so, identification of those customers and the geographic locations (including Illinois) in which the feature is deployed;

(d) The number of individual drivers whose biometric data has been collected or processed through the facial recognition feature; and

(e) Any legal or compliance assessments previously conducted by MFW or its counsel regarding BIPA compliance.

As of the date of this memorandum, these documents and responses remain pending.

Risk Assessment. If MFW has been collecting biometric identifiers from Illinois-based drivers (or drivers operating in Illinois) through its facial recognition-based ELD login feature without providing BIPA-compliant written notice and obtaining written consent, the Company's liability exposure could be significant. Given BIPA's per-violation statutory damages framework and the Cothron ruling that each scan or collection constitutes a separate violation, aggregate exposure could be substantial depending on the number of affected individuals and the frequency of biometric data collection events. BIPA class action litigation has resulted in major settlements in recent years, including the landmark $650 million settlement in In re Kestrel Services Inc. Biometric Information Privacy Litigation and numerous other significant settlements across various industries.

This issue warrants a specific representation and indemnification provision in the SPA, and should be prominently flagged in the R&W insurance underwriting submission to Atlas Meridian Underwriters Ltd. We recommend that the underwriting team, including Megan Forsythe at Trident Peak Insurance Brokers Inc., be briefed on this issue promptly so that it can be addressed during the policy negotiation process.

C. California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

Applicability. The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), applies to for-profit businesses that do business in California and meet one or more of the following thresholds: (a) annual gross revenue in excess of $25,000,000; (b) annually buys, sells, or shares the personal information of 100,000 or more California residents, households, or devices; or (c) derives 50% or more of its annual revenue from selling or sharing consumers' personal information. Cal. Civ. Code § 1798.140(d).

MFW's total revenue for fiscal year 2025 was approximately $67,500,000, which exceeds the $25,000,000 revenue threshold. MFW conducts business in California through its provision of SaaS services to California-based trucking and logistics companies and the processing of personal information of California-based drivers and fleet operators. Accordingly, MFW is subject to the CCPA/CPRA.

Key Requirements. The CCPA/CPRA imposes comprehensive obligations on covered businesses, including but not limited to:

(i) Privacy Policy Disclosures. Businesses must provide consumers with a comprehensive privacy policy that discloses, among other things, the categories of personal information collected, the purposes for which personal information is collected and used, the categories of third parties with which personal information is shared, the retention periods for each category of personal information, and information regarding consumer rights.

(ii) Consumer Rights. The CCPA/CPRA grants California consumers the right to know what personal information is collected, the right to delete personal information, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information, and the right to limit the use and disclosure of sensitive personal information.

(iii) Data Processing Agreements. Businesses must enter into written agreements with service providers and contractors that process personal information on the business's behalf, containing specific contractual provisions mandated by the CCPA/CPRA.

(iv) Data Protection Assessments. Under the CPRA, businesses must conduct and submit to the California Privacy Protection Agency (the "CPPA"), upon request, regular risk assessments with respect to processing activities that present significant risk to consumers' privacy, including the processing of sensitive personal information.

(v) Data Minimization. Businesses must limit the collection and use of personal information to that which is reasonably necessary and proportionate to the purposes for which it was collected.

VDR Findings. MFW maintains a privacy policy on its website (URL reviewed in VDR materials). Our preliminary review of this privacy policy indicates that it may not fully address CCPA/CPRA requirements in several respects. Specifically, the privacy policy does not appear to include: (a) a conspicuous "Do Not Sell or Share My Personal Information" link or mechanism; (b) a "Limit the Use of My Sensitive Personal Information" link or mechanism; (c) specific disclosures regarding the categories of sensitive personal information collected (including precise geolocation data, Social Security numbers for payroll-integrated customers, and potentially biometric data); (d) retention periods for each category of personal information; or (e) information regarding the right to opt out of the sale or sharing of personal information.

MFW processes personal information of California-based drivers and fleet operators through its customer accounts. Given that MFW's platform collects geolocation data, driver-behavior data, and potentially biometric data, these processing activities may qualify as processing of "sensitive personal information" under the CCPA/CPRA, triggering additional obligations, including the obligation to provide consumers with the right to limit the use and disclosure of such data.

Additionally, MFW shares data with third-party partners and integrations (as described in its platform documentation), which may constitute "sharing" of personal information for purposes of cross-context behavioral advertising under the CCPA/CPRA, requiring opt-out mechanisms.

Status of Review. A detailed review of MFW's CCPA/CPRA compliance program is in progress. We have requested the following additional materials from MFW:

(a) MFW's internal data mapping documentation, including a comprehensive inventory of personal information collected, used, disclosed, and retained;

(b) Copies of data processing agreements with MFW's service providers, contractors, and third-party partners;

(c) Documentation of MFW's consumer rights request handling procedures, including metrics on the volume and disposition of consumer requests received;

(d) Any data protection assessments conducted pursuant to the CPRA; and

(e) Copies of any correspondence with the California Attorney General's office or the California Privacy Protection Agency.

Risk Assessment. Non-compliance with the CCPA/CPRA could result in enforcement actions by the California Attorney General or the CPPA, with civil penalties of up to $2,500 per violation or $7,500 per intentional violation. Additionally, the CCPA provides a private right of action for data breaches involving certain categories of unencrypted or unredacted personal information, with statutory damages of $100 to $750 per consumer per incident, or actual damages, whichever is greater. Cal. Civ. Code § 1798.150. Given the volume of personal information processed by MFW and the potential deficiencies in its privacy policy and compliance program, we assess this as a moderate risk. We recommend inclusion of a comprehensive data privacy representation in the SPA.

D. Other State Privacy Laws

Beyond Illinois BIPA and California CCPA/CPRA, several additional states have enacted comprehensive consumer privacy legislation that may apply to MFW's data processing activities. These include, among others:

• Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.) — MFW is headquartered in Virginia and processes personal data of Virginia residents.

• Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.) — Applicable if MFW processes the personal data of 100,000 or more Colorado residents or derives revenue from the sale of personal data of 25,000 or more Colorado residents.

• Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.) — Similar applicability thresholds as Colorado.

• Texas Data Privacy and Security Act (Tex. Bus. & Com. Code § 541.001 et seq.) — MFW maintains an office in Texas and processes personal data of Texas residents.

• Additional state privacy laws enacted in states such as Oregon, Montana, Iowa, Indiana, Tennessee, and others, with varying effective dates and applicability thresholds.

MFW operates in Virginia (headquarters) and Texas (regional office) and has customer accounts across the United States, meaning that the personal data of individual drivers and fleet operators in numerous states is processed by MFW's platform. MFW should be assessed for compliance with each applicable state's comprehensive privacy law based on its specific data processing activities, the volume of data subjects in each state, and the particular requirements of each statute.

Status. This analysis is pending receipt of additional information from MFW. We have submitted a request through HKA for MFW's state-by-state privacy compliance matrix, which should detail MFW's assessment of applicable privacy laws, compliance measures taken, and any identified gaps.

E. Federal Data Privacy and Cybersecurity

There is no overarching federal comprehensive privacy statute currently in effect in the United States. However, MFW should be reviewed for compliance with the following sector-specific federal requirements:

FTC Act Section 5. Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45) prohibits "unfair or deceptive acts or practices in or affecting commerce." The FTC has used this authority extensively to bring enforcement actions against companies whose privacy and data security practices are deceptive (e.g., misrepresentations in privacy policies) or unfair (e.g., failure to implement reasonable data security measures). MFW's privacy representations to its customers and to the individual drivers whose data is processed must be accurate and not misleading. Any material discrepancy between MFW's stated privacy practices and its actual data handling practices could give rise to FTC enforcement risk.

Driver Privacy Protection Act (DPPA). The Driver Privacy Protection Act (18 U.S.C. § 2721 et seq.) restricts the use and disclosure of personal information obtained from state motor vehicle records. If MFW obtains or processes personal information that originates from state motor vehicle departments — such as commercial driver's license records — the DPPA's restrictions on permissible uses and disclosures would apply. The applicability of the DPPA to MFW depends on MFW's specific data sources and whether any personal information processed by MFW is derived from motor vehicle records. We have requested clarification from MFW regarding its data sources.

Cybersecurity Practices. Our review of MFW's cybersecurity practices is ongoing. Based on VDR materials reviewed to date, we have identified the following areas for further diligence:

(a) Data encryption practices (encryption at rest and in transit);

(b) Access controls and authentication requirements for MFW employees and contractors accessing customer and driver data;

(d) MFW's history of data security incidents and breaches;

(e) Third-party security audits or certifications (e.g., SOC 2 Type II, ISO 27001); and

(f) Cybersecurity insurance coverage.

No data breaches have been disclosed by MFW to date based on VDR materials reviewed. We have requested express confirmation from MFW regarding whether the Company has experienced any data security incident, unauthorized access event, or data breach at any time, and whether MFW has been required to provide breach notification to any individual, state attorney general, or other regulatory authority. This confirmation is pending.

F. Data Privacy — Recommendations for SPA

Based on the preliminary data privacy and cybersecurity findings set forth above, we recommend the following provisions be incorporated into the SPA:

1. Comprehensive Data Privacy Representations and Warranties. The SPA should include detailed representations and warranties by MFW (and/or the Sellers) regarding compliance with all applicable federal, state, and international (to the extent applicable) privacy and data security laws, regulations, and industry standards. These representations should cover, at a minimum: (a) compliance with applicable privacy laws; (b) accuracy and completeness of privacy policies; (c) implementation of reasonable data security measures; (d) no unauthorized access to or breach of personal information; (e) compliance with data processing agreements with customers and service providers; and (f) no pending or threatened investigations, inquiries, or enforcement actions by any data protection authority.

2. Specific BIPA Representation. A targeted representation addressing MFW's collection and processing of biometric identifiers and biometric information, including confirmation of compliance with BIPA's notice, consent, and retention requirements, or disclosure of any non-compliance.

3. Disclosure Schedule — Data Privacy. The SPA should require a disclosure schedule itemizing: (a) all past data breaches or security incidents; (b) any regulatory inquiries, investigations, or enforcement actions related to data privacy or cybersecurity; (c) any consumer complaints related to data privacy or data security; and (d) any pending or threatened litigation related to privacy or data security matters.

4. R&W Insurance Coordination. We recommend discussing with Trident Peak Insurance Brokers Inc. (Megan Forsythe) and the underwriting team at Atlas Meridian Underwriters Ltd. whether the data privacy findings — particularly the BIPA exposure — should be specifically addressed in the R&W insurance policy, including whether BIPA-related claims will be covered, excluded, or subject to sub-limits or retentions.

VI. SALES AND USE TAX COMPLIANCE

A. Background — SaaS Taxability

The taxability of software-as-a-service products for state sales and use tax purposes is an area of significant complexity and ongoing evolution. The treatment of SaaS subscriptions varies markedly by state, with states generally falling into the following categories: (i) states that treat SaaS as a taxable sale of tangible personal property or a taxable digital good; (ii) states that treat SaaS as a taxable enumerated service; (iii) states that treat SaaS as non-taxable; and (iv) states where the taxability of SaaS is unclear or has not been definitively addressed by statute, regulation, or administrative guidance. The landscape continues to shift as states issue new rulings and revise their tax codes to address cloud-based and subscription software models.

MFW's primary revenue stream is its SaaS subscription platform. The Company reported ARR of approximately $62,000,000 in fiscal year 2025, with additional professional services and implementation revenue of approximately $5,500,000. The SaaS subscription revenue constitutes the vast majority of MFW's total revenue and is the primary focus of the sales tax analysis.

The question of whether MFW has been properly collecting and remitting sales tax on its SaaS subscription revenue in all states where it has nexus — whether physical nexus (through employees, offices, or property) or economic nexus (through revenue or transaction volume thresholds, as established under the U.S. Supreme Court's decision in South Dakota v. Wayfair, Inc., 138 S. Ct. 2080 (2018)) — is a material compliance issue for the Transaction. Failure to collect and remit required sales tax creates a liability for the vendor (MFW) to the taxing jurisdiction for the uncollected tax, plus applicable penalties and interest.

B. Preliminary Findings — Whitmore Sandoval Group LLC

Whitmore Sandoval Group LLC has been engaged by Solara to perform buy-side quality of earnings diligence in connection with the Transaction. The Whitmore Sandoval engagement is led by Daniel Ostroff, CPA, located at 225 West Wacker Drive, Suite 1600, Chicago, Illinois 60606. As part of its financial due diligence, Whitmore Sandoval has performed a preliminary assessment of MFW's sales and use tax compliance, with findings summarized below.

Key Finding. Based on its preliminary analysis, Whitmore Sandoval has identified that MFW may have sales tax nexus — either physical nexus or economic nexus under Wayfair — in an estimated six to eight states where MFW has not been collecting or remitting SaaS sales tax. This finding is based on an initial review of MFW's revenue by customer billing state, MFW's employee and contractor locations, and the applicable SaaS taxability rules in each state.

Estimated Exposure Range. Whitmore Sandoval has provided a preliminary estimate of MFW's aggregate sales tax exposure across the identified states of $800,000 to $1,400,000. This range encompasses estimated back taxes owed, applicable penalties for failure to file and failure to collect, and accrued interest. The wide range reflects uncertainty regarding the specific states involved, the applicable lookback periods, the extent to which certain customer transactions may qualify for exemptions, and the potential for penalty abatement.

Specific States at Issue. The specific states in which MFW may have uncollected sales tax liabilities have not yet been fully identified by Whitmore Sandoval. The likely states include those that meet two criteria: (a) the state subjects SaaS subscriptions to sales tax, and (b) MFW has established nexus in the state, either through physical presence (employees or contractors located in the state) or through economic nexus (meeting the state's revenue or transaction volume thresholds for economic nexus based on sales to customers in that state).

MFW has employees in three states (Virginia, Texas, and Idaho), establishing physical nexus in those jurisdictions. With respect to economic nexus, MFW's approximately 4,200 active customer accounts are distributed across the United States. States where MFW's customer revenue likely exceeds the applicable economic nexus thresholds — and where SaaS is taxable — may include states in the Northeast (e.g., New York, Pennsylvania, Connecticut), Midwest (e.g., Ohio, Indiana), and Southeast (e.g., South Carolina, Tennessee), among others. The precise identification of affected states requires the detailed revenue allocation analysis currently being performed by Whitmore Sandoval.

We note that Texas, where MFW maintains a physical office, subjects SaaS to sales tax (Texas treats SaaS as a taxable data processing service), and we have specifically flagged this state for priority analysis, as MFW's physical presence in Texas creates clear nexus.

C. Coordination with Tax Diligence

Sylvia Hartwell, Specialist Partner (Tax) at Calderwood & Harkness, is coordinating with Daniel Ostroff at Whitmore Sandoval on the detailed state-by-state nexus analysis and exposure quantification. The objective is to produce a comprehensive analysis that identifies each state in which MFW has nexus (physical or economic), the taxability of SaaS in that state, MFW's current registration and filing status, the estimated uncollected tax by state, and the applicable penalties and interest.

To support this analysis, Calderwood & Harkness has submitted the following document requests through HKA:

(a) MFW's sales tax registrations by state, including copies of all active and inactive registrations;

(b) All sales and use tax returns filed by MFW, by state and period;

(d) Exemption certificates on file from customers claiming sales tax exemptions;

(e) Any correspondence with state tax authorities, including audit notices, voluntary disclosure agreement correspondence, and assessment notices;

(f) MFW's internal sales tax compliance policies and procedures; and

(g) Any prior sales tax studies or analyses commissioned by MFW.

Status. The foregoing documents remain pending as of this memorandum. Whitmore Sandoval expects to deliver its detailed sales tax nexus analysis by approximately early March 2026, prior to the diligence completion deadline of March 15, 2026.

D. Sales Tax — Recommendations for SPA

Based on the preliminary sales tax findings, we recommend the following provisions for inclusion in the SPA:

1. Specific Tax Representations and Warranties. The SPA should include detailed representations and warranties by the Sellers regarding MFW's sales and use tax collection, remittance, and compliance obligations. These representations should address: (a) all jurisdictions in which MFW is registered to collect and remit sales tax; (b) all jurisdictions in which MFW has filed sales and use tax returns; (c) all jurisdictions in which MFW has nexus (whether physical or economic) but has not collected or remitted sales tax; (d) the absence of outstanding assessments, audit notices, or disputes with state tax authorities; and (e) the accuracy and completeness of MFW's sales tax exemption certificate files.

2. Disclosure of Non-Compliance. The SPA should require the Sellers to disclose on the disclosure schedule all jurisdictions in which MFW has not collected or remitted sales tax despite having potential nexus, along with the Company's estimate of the resulting liability exposure.

3. Specific Indemnity / Purchase Price Adjustment. Given the estimated exposure of $800,000 to $1,400,000, we recommend considering one or more of the following mechanisms to allocate the pre-closing sales tax risk:

(a) Special Indemnity. A specific indemnification obligation of the Sellers for pre-closing sales tax liabilities, potentially carved out from the general indemnification basket (i.e., the Sellers would be liable for pre-closing sales tax claims from dollar one, without application of the de minimis threshold or deductible);

(b) Escrow Allocation. A defined portion of the purchase price could be placed in escrow to fund potential sales tax liabilities, with the escrow amount and release conditions negotiated based on the final Whitmore Sandoval analysis;

(c) Purchase Price Adjustment. The estimated sales tax exposure could be netted against the purchase price at closing, either as a fixed adjustment or through a mechanism tied to the final quantification of the exposure; or

(d) Voluntary Disclosure Agreement Funding. The Sellers could fund MFW's participation in voluntary disclosure agreement programs in affected states, with the cost of the VDA process (including back taxes, reduced penalties, and interest) borne by the Sellers.

4. Coordination on VDA Strategy. We recommend coordinating with Sylvia Hartwell and Daniel Ostroff at Whitmore Sandoval on whether a post-closing voluntary disclosure agreement strategy in the affected states would be advisable. VDA programs, offered by most states, allow taxpayers to come forward voluntarily to report and pay back taxes in exchange for reduced or waived penalties and, in some states, a limited lookback period. A VDA strategy could materially reduce the total exposure from the $800,000–$1,400,000 preliminary range, particularly by eliminating or reducing penalties.

5. Basket and Threshold Considerations. The estimated sales tax exposure of $800,000 to $1,400,000 should be factored into the negotiation of the general indemnification basket and threshold amounts in the SPA. If the general indemnification deductible is set at or above the estimated sales tax exposure, the practical effect would be to leave the buyer bearing the majority of the pre-closing sales tax risk. We recommend that the sales tax exposure be addressed through a special indemnity mechanism that ensures meaningful recovery for the buyer, separate from the general basket.

VII. FMCSA ELECTRONIC LOGGING DEVICE (ELD) REGULATORY COMPLIANCE

A. Regulatory Framework

The Federal Motor Carrier Safety Administration, an agency within the United States Department of Transportation, promulgated the ELD mandate under 49 CFR Part 395, requiring commercial motor vehicle ("CMV") operators subject to hours-of-service ("HOS") regulations to use registered and compliant electronic logging devices to automatically record driver duty status. The ELD mandate, which became fully effective on December 16, 2019, replaced the prior paper-based recording of drivers' records of duty status ("RODS") with electronic recording requirements applicable to most CMV operators.

Under the regulatory framework, ELD technology providers — including SaaS platforms such as MFW that offer ELD compliance functionality as part of their fleet management solutions — must ensure that their devices and software are self-certified as compliant with the FMCSA's technical specifications set forth at 49 CFR § 395.26. Self-certification is the responsibility of the ELD provider; FMCSA does not independently test or approve ELD devices prior to their listing on the FMCSA's registered ELD list. Rather, the ELD provider certifies that its product meets the applicable technical requirements and registers its device on the FMCSA's list, which is maintained on the FMCSA's website.

Key technical compliance requirements under 49 CFR Part 395 include, among others:

(a) Data Recording Accuracy. The ELD must accurately and automatically record driving time and other duty status changes based on vehicle movement data from the CMV's engine control module.

(b) Tamper-Resistance. The ELD must be designed to resist tampering and must alert the driver and motor carrier of any malfunction or data diagnostic event.

(c) Data Transfer Capabilities. The ELD must support data transfer to authorized safety officials via Bluetooth, USB, and/or web services, in the standardized output file format specified by FMCSA.

(d) Driver Interface Requirements. The ELD must provide a compliant driver interface that allows the driver to review, edit, annotate, and certify RODS.

(e) Data Retention. ELD records must be retained for a minimum period as specified by regulation, and must be available for inspection during roadside inspections and audits.

B. MFW's ELD Product

MFW's fleet management platform includes an ELD compliance module as a core component of its product offering. This module is marketed to MFW's approximately 4,200 mid-market trucking and logistics customers as a fully integrated ELD solution that enables compliance with the FMCSA's HOS recording requirements. Based on MFW's product documentation and marketing materials reviewed in the VDR, the ELD compliance module is a central element of MFW's value proposition and a significant driver of customer adoption and retention.

Based on VDR materials reviewed to date, MFW's ELD solution appears to be listed on the FMCSA's registered ELD list. We have submitted a request to MFW for confirmation of the current registration status, including the registration number assigned by FMCSA, the date of initial registration, and any correspondence between MFW and FMCSA regarding the registration, compliance, or any technical issues related to MFW's ELD product.

The importance of this product feature to MFW's business cannot be overstated. If MFW's ELD solution were to be found non-compliant with FMCSA technical specifications, or if the solution were to be removed from (de-listed from) the FMCSA's registered ELD list, the consequences for MFW's business would be severe. MFW's customers — motor carriers subject to the ELD mandate — would be unable to rely on MFW's ELD module for regulatory compliance and would likely need to transition to an alternative ELD solution, potentially resulting in mass customer attrition. Regulatory non-compliance or de-listing would therefore have a material adverse effect on MFW's business, financial condition, and results of operations.

C. Compliance Status and Risks

Registration Status. As noted, MFW's ELD solution is confirmed as registered on the FMCSA's registered ELD list based on our preliminary review. However, registration is based on self-certification by the E

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
MEMORANDUM
TO: James Prentice, Responsible Partner, Calderwood & Harkness LLP Claire Nakamura, Partner, Head of Software Investing, Solara Digital Infrastructure LP
FROM: Andrew Fitzpatrick, Lead Associate, Calderwood & Harkness LLP
DATE: February 24, 2026
RE: Regulatory and Compliance Due Diligence — Meridian FleetWorks, Inc. (Project Trident)
MATTER NO.: 1041-00004
ENGAGEMENT REFERENCE: 1041-00004
This memorandum is a privileged and confidential communication prepared by Calderwood & Harkness LLP at the direction of Solara Digital Infrastructure LP in connection with the proposed acquisition of Meridian FleetWorks, Inc. (Project Trident). This memorandum is protected by the attorney-client privilege and constitutes attorney work product. It is intended solely for the use of the addressees and other authorized recipients within the Solara deal team. Distribution to third parties is not authorized without the prior written consent of Calderwood & Harkness LLP. Nothing in this memorandum constitutes legal advice to any person other than the addressees.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This memorandum summarizes the preliminary findings of the regulatory and compliance due diligence conducted by Calderwood & Harkness LLP ("C&H" or the "Firm") in connection with the proposed acquisition (the "Transaction") by Solara Fleet Holdings LLC ("Buyer"), a newly formed, wholly-owned subsidiary of Solara Fund III, LP (the "Fund"), which is itself a fund managed by Solara Digital Infrastructure LP ("Solara"), of one hundred percent (100%) of the issued and outstanding shares of common stock and Series A Preferred Stock of Meridian FleetWorks, Inc. ("MFW" or the "Company"), for an aggregate purchase price of Three Hundred Fifty Million Dollars ($350,000,000) (the "Purchase Price"), subject to customary purchase price adjustments as set forth in the definitive Stock Purchase Agreement (the "SPA") currently under negotiation.
The scope of this regulatory and compliance due diligence review encompasses the following principal areas: (i) antitrust analysis under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended (the "HSR Act"); (ii) foreign investment review under the Committee on Foreign Investment in the United States ("CFIUS") regulatory framework; (iii) state regulatory licensing and approval requirements; (iv) data privacy and cybersecurity compliance, with particular attention to the Illinois Biometric Information Privacy Act ("BIPA"), the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), and other applicable state privacy laws; (v) sales and use tax compliance related to MFW's SaaS subscription revenue; and (vi) regulatory compliance under the Federal Motor Carrier Safety Administration ("FMCSA") regulations governing electronic logging devices ("ELDs").
Calderwood & Harkness obtained access to the Thackeray Solutions virtual data room established for this transaction (code name: Project Trident) on February 3, 2026. Our review is ongoing and will continue through the buyer's diligence completion deadline of March 15, 2026, as established under the Letter of Intent dated February 18, 2026 (reference LOI-MFW-2026-0218). As of the date of this memorandum, certain document requests remain outstanding, and several analyses are still in progress. The findings set forth herein are accordingly preliminary and subject to revision upon receipt and review of additional materials.
Key Findings Summary:
• HSR Filing Requirement. An HSR Act pre-merger notification filing is required in connection with the Transaction. Based on the applicable size-of-transaction thresholds, the estimated filing fee is $350,000. We do not anticipate substantive antitrust concerns based on the transaction profile, and a second request from the reviewing agency is unlikely.
• CFIUS. No CFIUS concerns have been identified. All parties to the Transaction are U.S.-domiciled entities controlled by U.S. persons. Neither a mandatory declaration nor a voluntary notice is recommended at this time, subject to confirmation regarding the composition of the Fund's limited partner investor base.
• State Regulatory Approvals. MFW does not hold any regulated professional or industry licenses that would require separate state regulatory approvals as a condition to closing. The stock purchase structure preserves MFW as the same legal entity post-closing, thereby avoiding assignment-of-license considerations.
• Data Privacy and Cybersecurity. Data privacy compliance review is in progress and represents one of the more significant areas of regulatory risk identified to date. MFW processes fleet GPS and driver-behavior data, including potential biometric identifiers, raising material questions under Illinois BIPA, CCPA/CPRA, and other state privacy laws. MFW's platform documentation references optional "facial recognition-based ELD login" features that, if deployed for Illinois-operating customers, would trigger BIPA compliance obligations. Documentation regarding MFW's biometric data policies and consent practices has been requested but has not yet been provided.
• Sales and Use Tax Exposure. Preliminary findings from Whitmore Sandoval Group LLC ("Whitmore Sandoval"), Solara's buy-side quality of earnings advisor, indicate that MFW appears to have sales tax nexus in an estimated six to eight states where it has not been collecting or remitting SaaS sales tax. The estimated exposure range, inclusive of back taxes, penalties, and interest, is $800,000 to $1,400,000. Detailed state-by-state analysis is ongoing.
• ELD/FMCSA Compliance. MFW's ELD compliance module is a core feature of its platform and is subject to FMCSA regulations under 49 CFR Part 395. Preliminary review indicates that MFW's ELD solution is registered on the FMCSA's list of registered ELDs. Detailed technical compliance confirmation is pending.
Recommendation. Based on the preliminary findings summarized above, we recommend that certain findings warrant specific representations and indemnification coverage in the SPA. In particular, the sales tax exposure and data privacy compliance issues should receive focused attention in both the SPA negotiation process and the representations and warranties insurance ("R&W Insurance") underwriting submission. We provide detailed recommendations for SPA provisions in each substantive section below and in Section IX of this memorandum.
II. HART-SCOTT-RODINO ANTITRUST IMPROVEMENTS ACT ANALYSIS
A. Filing Requirement
The Transaction is subject to the pre-merger notification requirements of the HSR Act (15 U.S.C. § 18a) and the implementing rules promulgated by the Federal Trade Commission (the "FTC") at 16 CFR Parts 801–803.
The proposed acquisition constitutes the acquisition of one hundred percent (100%) of all issued and outstanding voting securities of MFW, specifically all shares of common stock and Series A Preferred Stock. The aggregate transaction value of $350,000,000 exceeds the current size-of-transaction threshold under the HSR Act, which, as adjusted for fiscal year 2026, requires notification for transactions valued in excess of the applicable dollar threshold. Because the Transaction exceeds this threshold, the size-of-transaction test is satisfied regardless of the size of the parties, though we note that the size-of-person thresholds are independently satisfied as well.
With respect to the acquiring person, Solara Digital Infrastructure LP, acting through the Fund (Solara Fund III, LP) and the acquisition vehicle (Solara Fleet Holdings LLC), constitutes the ultimate parent entity for purposes of the HSR Act analysis. The Fund has committed capital of approximately $1.85 billion, well in excess of the applicable asset or revenue thresholds under the size-of-person test. With respect to the acquired person, Meridian FleetWorks, Inc. reported total revenue of approximately $67,500,000 for fiscal year 2025, also satisfying the applicable size-of-person thresholds for the acquired entity.
Pre-merger notification must be filed with both the FTC and the Antitrust Division of the United States Department of Justice (the "DOJ"). Under the HSR Act, both the acquiring person and the acquired person are required to file notification forms (HSR Form). The estimated filing fee for this Transaction, based on the aggregate transaction value of $350,000,000, is $350,000. Pursuant to the terms of the Letter of Intent (LOI-MFW-2026-0218), the filing fee is the Buyer's obligation. The HSR transaction number will be assigned by the FTC upon acceptance of the notification filing.
Following the filing of the notification forms, a standard thirty (30) calendar day initial waiting period will commence. The waiting period must expire or be terminated before the Transaction may be consummated. The parties may request early termination of the waiting period from the FTC and DOJ, which, if granted, would shorten the waiting period. If the reviewing agency issues a request for additional information and documentary material (a "second request"), the initial waiting period is extended and a new waiting period begins upon substantial compliance with the second request.
B. Timing Considerations
The current Transaction timeline contemplates execution of the definitive SPA on or about March 31, 2026, with a target closing date of April 30, 2026, and an outside date of June 30, 2026. These dates are subject to negotiation and will be set forth in the SPA.
We recommend filing the HSR notification promptly following execution of the definitive SPA to preserve maximum timeline flexibility. In practice, the notification forms can be substantially prepared in advance of SPA execution, allowing for rapid filing once the definitive agreement is signed. If early termination is granted or the standard thirty-day initial waiting period expires without issuance of a second request, HSR clearance should be obtained well in advance of the target closing date and should not constitute a gating item for the Transaction.
HSR Act clearance — defined as the expiration or early termination of the applicable waiting period, or, in the event of a second request, compliance with the second request and expiration of the resulting waiting period — will be included as a condition precedent to closing in the SPA. This is standard practice for transactions of this size and nature. We will coordinate with Solara's deal team on the preparation and filing of the notification forms as the SPA approaches execution.
C. Substantive Antitrust Assessment
We have conducted a preliminary substantive assessment of the antitrust risk profile of the Transaction.
MFW operates a vertical software-as-a-service platform serving the fleet management and logistics sector. The Company's platform provides fleet management, route optimization, electronic logging device compliance, and embedded payments functionality to approximately 4,200 mid-market trucking and logistics customer accounts. MFW's annual recurring revenue ("ARR") as of fiscal year 2025 is approximately $62,000,000.
Solara's existing portfolio is focused on asset management and software/SaaS businesses. Based on information provided by Solara and our review of Solara's publicly available portfolio descriptions, the Solara portfolio does not include any direct competitor in the fleet management or logistics SaaS market. Accordingly, we have identified no horizontal overlap between MFW and any existing Solara portfolio company that would give rise to competitive concerns under Section 7 of the Clayton Act.
MFW's market share in the broader fleet management software market is estimated to be modest. The market is characterized by significant fragmentation, with numerous established competitors and emerging entrants across various segments (full-suite fleet management platforms, standalone ELD solutions, route optimization providers, telematics providers, and embedded fintech solutions). MFW's focus on the mid-market segment further limits its competitive overlap with larger enterprise-focused competitors.
No vertical integration concerns have been identified. Solara is a financial sponsor rather than an operating company with upstream or downstream market positions in the trucking, logistics, or fleet management industries. The Transaction does not raise concerns regarding vertical foreclosure, input denial, or customer access denial.
Assessment: We assess the antitrust risk associated with the Transaction to be low. A second request from the FTC or DOJ is not anticipated. The Transaction is expected to receive HSR clearance through expiration or early termination of the standard thirty-day initial waiting period without further inquiry.
III. COMMITTEE ON FOREIGN INVESTMENT IN THE UNITED STATES (CFIUS)
A. Applicability Analysis
CFIUS is an interagency committee authorized to review transactions that could result in foreign control of, or certain foreign investment in, U.S. businesses, with a particular focus on transactions involving critical technology, critical infrastructure, or sensitive personal data of U.S. citizens. CFIUS's jurisdiction and authority are established by Section 721 of the Defense Production Act of 1950, as amended by the Foreign Investment Risk Review Modernization Act of 2018 ("FIRRMA"), and the implementing regulations at 31 CFR Parts 800 and 802.
CFIUS jurisdiction extends to "covered transactions," which include any transaction by or with a foreign person that could result in foreign control of a U.S. business, as well as "covered investments" by a foreign person in certain U.S. businesses that deal in critical technology, critical infrastructure, or sensitive personal data of U.S. citizens.
We have analyzed the parties to the Transaction to determine whether any foreign person or entity is involved in a manner that would trigger CFIUS jurisdiction:
Solara Digital Infrastructure LP is a Delaware limited partnership with its principal office at 1200 Market Street, Suite 2400, Wilmington, Delaware 19801. Solara is a U.S.-domiciled entity. The general partner of Solara is Solara Digital Infrastructure GP LLC, a Delaware limited liability company. The key principals of Solara, including Viktor Sorensen (Managing Partner) and Claire Nakamura (Partner, Head of Software Investing), are U.S. persons as defined under FIRRMA and the implementing regulations.
Solara Fund III, LP is a Delaware limited partnership (EIN 84-6239017) and is the specific investment vehicle through which the Transaction will be consummated. Solara Fund III, LP is a U.S.-domiciled entity.
Solara Fleet Holdings LLC is a newly formed Delaware limited liability company and wholly-owned subsidiary of Solara Fund III, LP, organized for the purpose of serving as the acquisition vehicle for the Transaction.
Meridian FleetWorks, Inc. is a Delaware corporation (EIN 47-3891205) with its principal office at 8750 Westpark Drive, Suite 600, McLean, Virginia 22102. MFW is a U.S.-domiciled corporation.
Based on the information provided by Solara and our review of the organizational documents made available in the VDR, all parties to the Transaction are U.S.-domiciled entities controlled by U.S. persons. No foreign person or entity has a direct or indirect interest in the acquiring entity sufficient to constitute foreign "control" or a "covered investment" under the CFIUS regulations.
B. Conclusion. Based on the foregoing analysis, CFIUS review is not applicable to the Transaction. We do not recommend either a mandatory declaration or a voluntary notice to CFIUS.
We note, however, an important qualification: if the composition of limited partners in Solara Fund III, LP includes any non-U.S. investors that possess governance rights — such as board designation rights, consent rights, veto rights over material decisions, or other rights that would be considered indicia of "control" or a "covered investment" under 31 CFR § 800.208 or § 800.211 — this analysis should be revisited. We have submitted a request to Solara for confirmation regarding the LP investor base, including a representation that no limited partner in the Fund is a foreign person with governance rights that would trigger CFIUS jurisdiction. Based on preliminary representations received from Solara's internal legal team, no CFIUS-triggering foreign LP interests exist. We will update this analysis upon receipt of the formal confirmation.
Additionally, we note that MFW processes sensitive personal data of U.S. citizens (including geolocation data, driver identification data, and Social Security numbers for payroll-integrated customers). Under FIRRMA, certain transactions involving U.S. businesses that maintain or collect sensitive personal data of U.S. citizens are subject to mandatory CFIUS declarations, even in the case of non-controlling investments by foreign persons. Because no foreign person is party to this Transaction, this provision is not triggered. However, this consideration further underscores the importance of confirming the absence of CFIUS-triggering foreign LP interests in the Fund.
IV. STATE REGULATORY APPROVALS AND LICENSING
A. Industry-Specific Licensing
MFW provides a software-as-a-service platform serving the fleet management and logistics industry. The Company does not itself operate as a motor carrier, freight broker, freight forwarder, or other regulated transportation entity. Accordingly, MFW does not hold, and is not required to hold, operating authority from the FMCSA or from any state transportation regulatory body (such as a state department of transportation or public utilities commission).
We have evaluated whether MFW's embedded payments functionality — which facilitates fleet-related payments such as fuel card transactions, toll payments, and vendor payments on behalf of its customers — could require licensing as a money transmitter under applicable state money transmitter statutes. Money transmitter licensing is regulated on a state-by-state basis, and the threshold for when a technology platform's facilitation of payments constitutes "money transmission" varies by jurisdiction.
Based on VDR documents reviewed to date, MFW utilizes a third-party payment processor (identified in VDR materials as Strata Payments, Inc.) and does not itself hold, control, or transmit customer funds directly. MFW's role in the payment flow appears to be limited to initiating payment instructions that are executed by the third-party payment processor. Under most state money transmitter statutes, a platform that merely facilitates payment instructions without holding or controlling the funds is not engaged in money transmission and does not require a money transmitter license. However, the precise characterization of MFW's role in the payment processing arrangement is critical, as certain states apply a broader definition of money transmission that may encompass platforms that exercise control over funds at any point in the transaction flow.
We recommend confirming the specific contractual arrangement between MFW and Strata Payments, Inc. (including the flow of funds, timing of settlement, and whether MFW has any custody of customer funds at any stage) and conducting a targeted analysis of money transmitter licensing requirements in the states where MFW has significant customer concentrations. We have requested the relevant agreements and documentation from MFW through HKA Advisory Partners LLP ("HKA"), the Company's sell-side advisor.
MFW does not hold any professional licenses, insurance licenses, or financial services licenses. MFW is not a registered investment adviser, broker-dealer, insurance producer, or any other type of regulated financial services entity under federal or state law.
B. Foreign Qualification / Authority to Do Business
MFW is incorporated in the State of Delaware (Delaware Division of Corporations File Number 5582037). MFW maintains physical office locations in three states:
(i) McLean, Virginia — Corporate headquarters at 8750 Westpark Drive, Suite 600, McLean, VA 22102;
(ii) Austin, Texas — Regional office (address to be confirmed from VDR materials); and
(iii) Boise, Idaho — Regional office (address to be confirmed from VDR materials).
As a Delaware corporation conducting business in Virginia, Texas, and Idaho, MFW is required to qualify to do business as a foreign corporation in each of those states. We have requested certificates of good standing and foreign qualification certificates from MFW for each of these jurisdictions. These documents have not yet been received.
MFW may also have nexus for purposes of foreign qualification requirements in additional states where it has employees working remotely, maintains significant customer relationships, or conducts activities that constitute "doing business" under applicable state corporate statutes. The analysis of MFW's state-by-state nexus for purposes of foreign qualification overlaps significantly with the sales and use tax nexus analysis discussed in Section VI below, and we are coordinating both analyses to ensure consistency.
Failure to qualify as a foreign corporation in states where qualification is required does not typically void contracts or transactions entered into in those states, but it can result in the imposition of penalties, back fees, and interest, and may prevent MFW from maintaining or bringing legal proceedings in those jurisdictions until qualification is obtained. We will assess the extent of MFW's foreign qualification obligations upon receipt of additional information regarding MFW's employee locations and operational footprint.
C. Conclusion on State Regulatory Approvals
Based on our analysis to date, no separate state regulatory approvals are anticipated as a condition to closing the stock purchase Transaction. MFW does not hold any regulated licenses or permits that would require pre-closing regulatory consent, approval, or notification in connection with a change of control.
Importantly, the Transaction is structured as a stock purchase rather than an asset purchase. Under a stock purchase structure, MFW will continue as the same legal entity following the closing, with the same state qualifications, registrations, and contractual relationships. This structure avoids the assignment-of-license and assignment-of-permit issues that can arise in asset purchase transactions, where the transfer of specific assets may trigger requirements for new license applications or regulatory approvals.
We note that certain of MFW's customer contracts (specifically, the Master Subscription Agreement form) may contain change-of-control provisions that require notice to or consent from customers upon a change in control of MFW. While this is a commercial contract matter rather than a regulatory licensing matter, it should be addressed as part of the broader commercial due diligence and SPA drafting process. We will coordinate with the team conducting the commercial contract review.
V. DATA PRIVACY AND CYBERSECURITY COMPLIANCE
A. Overview of MFW's Data Processing Activities
MFW's platform collects, processes, transmits, and stores significant volumes of data in connection with its fleet management, route optimization, ELD compliance, and embedded payments services. The nature and sensitivity of this data make data privacy and cybersecurity compliance a material area of regulatory risk for the Transaction. Based on our review of VDR materials to date, the key categories of data processed by MFW include:
Fleet GPS and Location Data. MFW's platform collects and processes real-time and historical GPS coordinates for customer fleet vehicles. This geolocation data enables MFW's route optimization, fleet tracking, and dispatch management functionality. Under various state privacy laws, geolocation data — particularly precise geolocation data — constitutes a category of sensitive personal information subject to heightened regulatory requirements, including requirements for consent prior to collection, limitations on use, and specific disclosure obligations.
Driver-Behavior Data. MFW's platform captures data from ELD devices and telematics sensors installed in or connected to customer fleet vehicles. This data includes driving patterns, hours-of-service records, vehicle speed, acceleration and braking events, idling time, and other operational metrics. Significantly, MFW's platform documentation references a "driver identification" and "facial recognition-based ELD login" feature that is offered as an optional capability to customers. If this feature captures or processes facial geometry or other biometric identifiers, it would trigger compliance obligations under BIPA and potentially other state biometric privacy laws.
Driver Personal Information. MFW processes personal information of individual commercial drivers employed by MFW's customers, including names, commercial driver's license numbers, dates of birth, contact information (telephone numbers, email addresses, mailing addresses), employment records, and — for customers that have opted into MFW's payroll integration feature — Social Security numbers and payroll-related financial data. This data constitutes personal information under virtually all applicable state privacy laws and, in several instances, qualifies as sensitive personal information subject to heightened protections.
Customer Business Data. MFW processes operational and financial data belonging to its business customers, including route information, cargo manifests, scheduling data, delivery records, fleet composition and vehicle information, and financial data related to the embedded payments functionality (including payment amounts, vendor information, and bank account or payment card details).
MFW's customer base consists of approximately 4,200 mid-market trucking and logistics companies. The individual data subjects whose personal information is processed by MFW include the drivers, fleet managers, dispatchers, and other employees of those customer companies. The estimated number of individual data subjects has not yet been confirmed by MFW, but given the nature of mid-market fleet operations (where individual customer fleets may range from dozens to hundreds of vehicles and drivers), the total number of individual data subjects is likely in the tens of thousands, and may exceed one hundred thousand. We have requested this information from MFW.
B. Illinois Biometric Information Privacy Act (BIPA)
Applicability. The Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq., regulates the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and biometric information by private entities. "Biometric identifiers" are defined to include retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, and other specified biometric data. 740 ILCS 14/10. "Biometric information" means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual. Id.
If MFW's ELD functionality or driver authentication features involve the collection, capture, or otherwise obtaining of biometric identifiers — such as facial geometry scans used for driver identity verification during ELD login — from drivers operating in the State of Illinois, BIPA would apply to those collection activities. BIPA applies to private entities that collect biometric identifiers of individuals in Illinois; there is no requirement that the collecting entity be headquartered or organized in Illinois.
Key Requirements. BIPA imposes the following principal obligations on private entities that collect or possess biometric identifiers or biometric information:
(i) Written Policy. The entity must develop and make available to the public a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and information when the initial purpose for collecting such data has been satisfied or within three years of the individual's last interaction with the entity, whichever occurs first. 740 ILCS 14/15(a).
(ii) Written Informed Consent. Before collecting a biometric identifier, the entity must (a) inform the individual in writing that biometric data is being collected or stored, (b) inform the individual in writing of the specific purpose and length of term for which the biometric data is being collected, stored, and used, and (c) receive a written release executed by the individual. 740 ILCS 14/15(b).
(iii) Prohibition on Sale or Disclosure. The entity may not sell, lease, trade, or otherwise profit from an individual's biometric identifier or biometric information, and may not disclose or disseminate such data except in limited circumstances (consent, legal requirement, or financial transaction completion). 740 ILCS 14/15(c), (d).
(iv) Data Security. The entity must store, transmit, and protect biometric data using a reasonable standard of care, and in a manner at least as protective as the manner in which the entity stores, transmits, and protects other confidential and sensitive information. 740 ILCS 14/15(e).
Private Right of Action. BIPA is notable for its private right of action provision, which permits any person aggrieved by a violation to bring suit and recover the greater of actual damages or statutory liquidated damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus reasonable attorneys' fees and costs, and other relief as the court deems appropriate, including injunctive relief. 740 ILCS 14/20. The Illinois Supreme Court's decision in Cothron v. White Castle System, Inc., 2023 IL 128004 (2023), confirmed that a separate claim accrues each time a private entity scans or collects a biometric identifier or biometric information without prior informed consent, significantly increasing potential aggregate exposure in class action contexts.
VDR Findings to Date. MFW's platform documentation reviewed in the VDR references "driver identification" and "facial recognition-based ELD login" as optional features available to customers. The product specification documents describe this feature as providing biometric-based identity verification for ELD authentication, intended to ensure that the correct driver is logged into the ELD system in compliance with FMCSA regulations. If these features involve the capture, collection, or processing of facial geometry data — which, based on the feature description, appears likely — they would constitute the collection of biometric identifiers under BIPA.
The critical question is whether this facial recognition feature is currently enabled and in active use by any of MFW's customers whose drivers operate in the State of Illinois. If so, BIPA compliance is mandatory for those data collection activities.
Status of Review. We have submitted requests through HKA for the following documents and information:
(a) MFW's biometric data policies, including any written policy regarding retention and destruction of biometric identifiers and information;
(b) MFW's biometric data consent forms, including any written notices and releases provided to individuals prior to biometric data collection;
(c) Confirmation of whether the facial recognition-based ELD login feature is currently enabled for any MFW customers, and if so, identification of those customers and the geographic locations (including Illinois) in which the feature is deployed;
(d) The number of individual drivers whose biometric data has been collected or processed through the facial recognition feature; and
(e) Any legal or compliance assessments previously conducted by MFW or its counsel regarding BIPA compliance.
As of the date of this memorandum, these documents and responses remain pending.
Risk Assessment. If MFW has been collecting biometric identifiers from Illinois-based drivers (or drivers operating in Illinois) through its facial recognition-based ELD login feature without providing BIPA-compliant written notice and obtaining written consent, the Company's liability exposure could be significant. Given BIPA's per-violation statutory damages framework and the Cothron ruling that each scan or collection constitutes a separate violation, aggregate exposure could be substantial depending on the number of affected individuals and the frequency of biometric data collection events. BIPA class action litigation has resulted in major settlements in recent years, including the landmark $650 million settlement in In re Kestrel Services Inc. Biometric Information Privacy Litigation and numerous other significant settlements across various industries.
This issue warrants a specific representation and indemnification provision in the SPA, and should be prominently flagged in the R&W insurance underwriting submission to Atlas Meridian Underwriters Ltd. We recommend that the underwriting team, including Megan Forsythe at Trident Peak Insurance Brokers Inc., be briefed on this issue promptly so that it can be addressed during the policy negotiation process.
C. California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
Applicability. The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), applies to for-profit businesses that do business in California and meet one or more of the following thresholds: (a) annual gross revenue in excess of $25,000,000; (b) annually buys, sells, or shares the personal information of 100,000 or more California residents, households, or devices; or (c) derives 50% or more of its annual revenue from selling or sharing consumers' personal information. Cal. Civ. Code § 1798.140(d).
MFW's total revenue for fiscal year 2025 was approximately $67,500,000, which exceeds the $25,000,000 revenue threshold. MFW conducts business in California through its provision of SaaS services to California-based trucking and logistics companies and the processing of personal information of California-based drivers and fleet operators. Accordingly, MFW is subject to the CCPA/CPRA.
Key Requirements. The CCPA/CPRA imposes comprehensive obligations on covered businesses, including but not limited to:
(i) Privacy Policy Disclosures. Businesses must provide consumers with a comprehensive privacy policy that discloses, among other things, the categories of personal information collected, the purposes for which personal information is collected and used, the categories of third parties with which personal information is shared, the retention periods for each category of personal information, and information regarding consumer rights.
(ii) Consumer Rights. The CCPA/CPRA grants California consumers the right to know what personal information is collected, the right to delete personal information, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information, and the right to limit the use and disclosure of sensitive personal information.
(iii) Data Processing Agreements. Businesses must enter into written agreements with service providers and contractors that process personal information on the business's behalf, containing specific contractual provisions mandated by the CCPA/CPRA.
(iv) Data Protection Assessments. Under the CPRA, businesses must conduct and submit to the California Privacy Protection Agency (the "CPPA"), upon request, regular risk assessments with respect to processing activities that present significant risk to consumers' privacy, including the processing of sensitive personal information.
(v) Data Minimization. Businesses must limit the collection and use of personal information to that which is reasonably necessary and proportionate to the purposes for which it was collected.
VDR Findings. MFW maintains a privacy policy on its website (URL reviewed in VDR materials). Our preliminary review of this privacy policy indicates that it may not fully address CCPA/CPRA requirements in several respects. Specifically, the privacy policy does not appear to include: (a) a conspicuous "Do Not Sell or Share My Personal Information" link or mechanism; (b) a "Limit the Use of My Sensitive Personal Information" link or mechanism; (c) specific disclosures regarding the categories of sensitive personal information collected (including precise geolocation data, Social Security numbers for payroll-integrated customers, and potentially biometric data); (d) retention periods for each category of personal information; or (e) information regarding the right to opt out of the sale or sharing of personal information.
MFW processes personal information of California-based drivers and fleet operators through its customer accounts. Given that MFW's platform collects geolocation data, driver-behavior data, and potentially biometric data, these processing activities may qualify as processing of "sensitive personal information" under the CCPA/CPRA, triggering additional obligations, including the obligation to provide consumers with the right to limit the use and disclosure of such data.
Additionally, MFW shares data with third-party partners and integrations (as described in its platform documentation), which may constitute "sharing" of personal information for purposes of cross-context behavioral advertising under the CCPA/CPRA, requiring opt-out mechanisms.
Status of Review. A detailed review of MFW's CCPA/CPRA compliance program is in progress. We have requested the following additional materials from MFW:
(a) MFW's internal data mapping documentation, including a comprehensive inventory of personal information collected, used, disclosed, and retained;
(b) Copies of data processing agreements with MFW's service providers, contractors, and third-party partners;
(c) Documentation of MFW's consumer rights request handling procedures, including metrics on the volume and disposition of consumer requests received;
(d) Any data protection assessments conducted pursuant to the CPRA; and
(e) Copies of any correspondence with the California Attorney General's office or the California Privacy Protection Agency.
Risk Assessment. Non-compliance with the CCPA/CPRA could result in enforcement actions by the California Attorney General or the CPPA, with civil penalties of up to $2,500 per violation or $7,500 per intentional violation. Additionally, the CCPA provides a private right of action for data breaches involving certain categories of unencrypted or unredacted personal information, with statutory damages of $100 to $750 per consumer per incident, or actual damages, whichever is greater. Cal. Civ. Code § 1798.150. Given the volume of personal information processed by MFW and the potential deficiencies in its privacy policy and compliance program, we assess this as a moderate risk. We recommend inclusion of a comprehensive data privacy representation in the SPA.
D. Other State Privacy Laws
Beyond Illinois BIPA and California CCPA/CPRA, several additional states have enacted comprehensive consumer privacy legislation that may apply to MFW's data processing activities. These include, among others:
• Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.) — MFW is headquartered in Virginia and processes personal data of Virginia residents.
• Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.) — Applicable if MFW processes the personal data of 100,000 or more Colorado residents or derives revenue from the sale of personal data of 25,000 or more Colorado residents.
• Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.) — Similar applicability thresholds as Colorado.
• Texas Data Privacy and Security Act (Tex. Bus. & Com. Code § 541.001 et seq.) — MFW maintains an office in Texas and processes personal data of Texas residents.
• Additional state privacy laws enacted in states such as Oregon, Montana, Iowa, Indiana, Tennessee, and others, with varying effective dates and applicability thresholds.
MFW operates in Virginia (headquarters) and Texas (regional office) and has customer accounts across the United States, meaning that the personal data of individual drivers and fleet operators in numerous states is processed by MFW's platform. MFW should be assessed for compliance with each applicable state's comprehensive privacy law based on its specific data processing activities, the volume of data subjects in each state, and the particular requirements of each statute.
Status. This analysis is pending receipt of additional information from MFW. We have submitted a request through HKA for MFW's state-by-state privacy compliance matrix, which should detail MFW's assessment of applicable privacy laws, compliance measures taken, and any identified gaps.
E. Federal Data Privacy and Cybersecurity
There is no overarching federal comprehensive privacy statute currently in effect in the United States. However, MFW should be reviewed for compliance with the following sector-specific federal requirements:
FTC Act Section 5. Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45) prohibits "unfair or deceptive acts or practices in or affecting commerce." The FTC has used this authority extensively to bring enforcement actions against companies whose privacy and data security practices are deceptive (e.g., misrepresentations in privacy policies) or unfair (e.g., failure to implement reasonable data security measures). MFW's privacy representations to its customers and to the individual drivers whose data is processed must be accurate and not misleading. Any material discrepancy between MFW's stated privacy practices and its actual data handling practices could give rise to FTC enforcement risk.
Driver Privacy Protection Act (DPPA). The Driver Privacy Protection Act (18 U.S.C. § 2721 et seq.) restricts the use and disclosure of personal information obtained from state motor vehicle records. If MFW obtains or processes personal information that originates from state motor vehicle departments — such as commercial driver's license records — the DPPA's restrictions on permissible uses and disclosures would apply. The applicability of the DPPA to MFW depends on MFW's specific data sources and whether any personal information processed by MFW is derived from motor vehicle records. We have requested clarification from MFW regarding its data sources.
Cybersecurity Practices. Our review of MFW's cybersecurity practices is ongoing. Based on VDR materials reviewed to date, we have identified the following areas for further diligence:
(a) Data encryption practices (encryption at rest and in transit);
(b) Access controls and authentication requirements for MFW employees and contractors accessing customer and driver data;
(c) MFW's cybersecurity incident response plan, including incident detection, notification, and remediation procedures;
(d) MFW's history of data security incidents and breaches;
(e) Third-party security audits or certifications (e.g., SOC 2 Type II, ISO 27001); and
(f) Cybersecurity insurance coverage.
No data breaches have been disclosed by MFW to date based on VDR materials reviewed. We have requested express confirmation from MFW regarding whether the Company has experienced any data security incident, unauthorized access event, or data breach at any time, and whether MFW has been required to provide breach notification to any individual, state attorney general, or other regulatory authority. This confirmation is pending.
F. Data Privacy — Recommendations for SPA
Based on the preliminary data privacy and cybersecurity findings set forth above, we recommend the following provisions be incorporated into the SPA:
1. Comprehensive Data Privacy Representations and Warranties. The SPA should include detailed representations and warranties by MFW (and/or the Sellers) regarding compliance with all applicable federal, state, and international (to the extent applicable) privacy and data security laws, regulations, and industry standards. These representations should cover, at a minimum: (a) compliance with applicable privacy laws; (b) accuracy and completeness of privacy policies; (c) implementation of reasonable data security measures; (d) no unauthorized access to or breach of personal information; (e) compliance with data processing agreements with customers and service providers; and (f) no pending or threatened investigations, inquiries, or enforcement actions by any data protection authority.
2. Specific BIPA Representation. A targeted representation addressing MFW's collection and processing of biometric identifiers and biometric information, including confirmation of compliance with BIPA's notice, consent, and retention requirements, or disclosure of any non-compliance.
3. Disclosure Schedule — Data Privacy. The SPA should require a disclosure schedule itemizing: (a) all past data breaches or security incidents; (b) any regulatory inquiries, investigations, or enforcement actions related to data privacy or cybersecurity; (c) any consumer complaints related to data privacy or data security; and (d) any pending or threatened litigation related to privacy or data security matters.
4. R&W Insurance Coordination. We recommend discussing with Trident Peak Insurance Brokers Inc. (Megan Forsythe) and the underwriting team at Atlas Meridian Underwriters Ltd. whether the data privacy findings — particularly the BIPA exposure — should be specifically addressed in the R&W insurance policy, including whether BIPA-related claims will be covered, excluded, or subject to sub-limits or retentions.
VI. SALES AND USE TAX COMPLIANCE
A. Background — SaaS Taxability
The taxability of software-as-a-service products for state sales and use tax purposes is an area of significant complexity and ongoing evolution. The treatment of SaaS subscriptions varies markedly by state, with states generally falling into the following categories: (i) states that treat SaaS as a taxable sale of tangible personal property or a taxable digital good; (ii) states that treat SaaS as a taxable enumerated service; (iii) states that treat SaaS as non-taxable; and (iv) states where the taxability of SaaS is unclear or has not been definitively addressed by statute, regulation, or administrative guidance. The landscape continues to shift as states issue new rulings and revise their tax codes to address cloud-based and subscription software models.
MFW's primary revenue stream is its SaaS subscription platform. The Company reported ARR of approximately $62,000,000 in fiscal year 2025, with additional professional services and implementation revenue of approximately $5,500,000. The SaaS subscription revenue constitutes the vast majority of MFW's total revenue and is the primary focus of the sales tax analysis.
The question of whether MFW has been properly collecting and remitting sales tax on its SaaS subscription revenue in all states where it has nexus — whether physical nexus (through employees, offices, or property) or economic nexus (through revenue or transaction volume thresholds, as established under the U.S. Supreme Court's decision in South Dakota v. Wayfair, Inc., 138 S. Ct. 2080 (2018)) — is a material compliance issue for the Transaction. Failure to collect and remit required sales tax creates a liability for the vendor (MFW) to the taxing jurisdiction for the uncollected tax, plus applicable penalties and interest.
B. Preliminary Findings — Whitmore Sandoval Group LLC
Whitmore Sandoval Group LLC has been engaged by Solara to perform buy-side quality of earnings diligence in connection with the Transaction. The Whitmore Sandoval engagement is led by Daniel Ostroff, CPA, located at 225 West Wacker Drive, Suite 1600, Chicago, Illinois 60606. As part of its financial due diligence, Whitmore Sandoval has performed a preliminary assessment of MFW's sales and use tax compliance, with findings summarized below.
Key Finding. Based on its preliminary analysis, Whitmore Sandoval has identified that MFW may have sales tax nexus — either physical nexus or economic nexus under Wayfair — in an estimated six to eight states where MFW has not been collecting or remitting SaaS sales tax. This finding is based on an initial review of MFW's revenue by customer billing state, MFW's employee and contractor locations, and the applicable SaaS taxability rules in each state.
Estimated Exposure Range. Whitmore Sandoval has provided a preliminary estimate of MFW's aggregate sales tax exposure across the identified states of $800,000 to $1,400,000. This range encompasses estimated back taxes owed, applicable penalties for failure to file and failure to collect, and accrued interest. The wide range reflects uncertainty regarding the specific states involved, the applicable lookback periods, the extent to which certain customer transactions may qualify for exemptions, and the potential for penalty abatement.
Specific States at Issue. The specific states in which MFW may have uncollected sales tax liabilities have not yet been fully identified by Whitmore Sandoval. The likely states include those that meet two criteria: (a) the state subjects SaaS subscriptions to sales tax, and (b) MFW has established nexus in the state, either through physical presence (employees or contractors located in the state) or through economic nexus (meeting the state's revenue or transaction volume thresholds for economic nexus based on sales to customers in that state).
MFW has employees in three states (Virginia, Texas, and Idaho), establishing physical nexus in those jurisdictions. With respect to economic nexus, MFW's approximately 4,200 active customer accounts are distributed across the United States. States where MFW's customer revenue likely exceeds the applicable economic nexus thresholds — and where SaaS is taxable — may include states in the Northeast (e.g., New York, Pennsylvania, Connecticut), Midwest (e.g., Ohio, Indiana), and Southeast (e.g., South Carolina, Tennessee), among others. The precise identification of affected states requires the detailed revenue allocation analysis currently being performed by Whitmore Sandoval.
We note that Texas, where MFW maintains a physical office, subjects SaaS to sales tax (Texas treats SaaS as a taxable data processing service), and we have specifically flagged this state for priority analysis, as MFW's physical presence in Texas creates clear nexus.
C. Coordination with Tax Diligence
Sylvia Hartwell, Specialist Partner (Tax) at Calderwood & Harkness, is coordinating with Daniel Ostroff at Whitmore Sandoval on the detailed state-by-state nexus analysis and exposure quantification. The objective is to produce a comprehensive analysis that identifies each state in which MFW has nexus (physical or economic), the taxability of SaaS in that state, MFW's current registration and filing status, the estimated uncollected tax by state, and the applicable penalties and interest.
To support this analysis, Calderwood & Harkness has submitted the following document requests through HKA:
(a) MFW's sales tax registrations by state, including copies of all active and inactive registrations;
(b) All sales and use tax returns filed by MFW, by state and period;
(c) Revenue allocation by customer billing state for fiscal years 2022 through 2025;
(d) Exemption certificates on file from customers claiming sales tax exemptions;
(e) Any correspondence with state tax authorities, including audit notices, voluntary disclosure agreement correspondence, and assessment notices;
(f) MFW's internal sales tax compliance policies and procedures; and
(g) Any prior sales tax studies or analyses commissioned by MFW.
Status. The foregoing documents remain pending as of this memorandum. Whitmore Sandoval expects to deliver its detailed sales tax nexus analysis by approximately early March 2026, prior to the diligence completion deadline of March 15, 2026.
D. Sales Tax — Recommendations for SPA
Based on the preliminary sales tax findings, we recommend the following provisions for inclusion in the SPA:
1. Specific Tax Representations and Warranties. The SPA should include detailed representations and warranties by the Sellers regarding MFW's sales and use tax collection, remittance, and compliance obligations. These representations should address: (a) all jurisdictions in which MFW is registered to collect and remit sales tax; (b) all jurisdictions in which MFW has filed sales and use tax returns; (c) all jurisdictions in which MFW has nexus (whether physical or economic) but has not collected or remitted sales tax; (d) the absence of outstanding assessments, audit notices, or disputes with state tax authorities; and (e) the accuracy and completeness of MFW's sales tax exemption certificate files.
2. Disclosure of Non-Compliance. The SPA should require the Sellers to disclose on the disclosure schedule all jurisdictions in which MFW has not collected or remitted sales tax despite having potential nexus, along with the Company's estimate of the resulting liability exposure.
3. Specific Indemnity / Purchase Price Adjustment. Given the estimated exposure of $800,000 to $1,400,000, we recommend considering one or more of the following mechanisms to allocate the pre-closing sales tax risk:
(a) Special Indemnity. A specific indemnification obligation of the Sellers for pre-closing sales tax liabilities, potentially carved out from the general indemnification basket (i.e., the Sellers would be liable for pre-closing sales tax claims from dollar one, without application of the de minimis threshold or deductible);
(b) Escrow Allocation. A defined portion of the purchase price could be placed in escrow to fund potential sales tax liabilities, with the escrow amount and release conditions negotiated based on the final Whitmore Sandoval analysis;
(c) Purchase Price Adjustment. The estimated sales tax exposure could be netted against the purchase price at closing, either as a fixed adjustment or through a mechanism tied to the final quantification of the exposure; or
(d) Voluntary Disclosure Agreement Funding. The Sellers could fund MFW's participation in voluntary disclosure agreement programs in affected states, with the cost of the VDA process (including back taxes, reduced penalties, and interest) borne by the Sellers.
4. Coordination on VDA Strategy. We recommend coordinating with Sylvia Hartwell and Daniel Ostroff at Whitmore Sandoval on whether a post-closing voluntary disclosure agreement strategy in the affected states would be advisable. VDA programs, offered by most states, allow taxpayers to come forward voluntarily to report and pay back taxes in exchange for reduced or waived penalties and, in some states, a limited lookback period. A VDA strategy could materially reduce the total exposure from the $800,000–$1,400,000 preliminary range, particularly by eliminating or reducing penalties.
5. Basket and Threshold Considerations. The estimated sales tax exposure of $800,000 to $1,400,000 should be factored into the negotiation of the general indemnification basket and threshold amounts in the SPA. If the general indemnification deductible is set at or above the estimated sales tax exposure, the practical effect would be to leave the buyer bearing the majority of the pre-closing sales tax risk. We recommend that the sales tax exposure be addressed through a special indemnity mechanism that ensures meaningful recovery for the buyer, separate from the general basket.
VII. FMCSA ELECTRONIC LOGGING DEVICE (ELD) REGULATORY COMPLIANCE
A. Regulatory Framework
The Federal Motor Carrier Safety Administration, an agency within the United States Department of Transportation, promulgated the ELD mandate under 49 CFR Part 395, requiring commercial motor vehicle ("CMV") operators subject to hours-of-service ("HOS") regulations to use registered and compliant electronic logging devices to automatically record driver duty status. The ELD mandate, which became fully effective on December 16, 2019, replaced the prior paper-based recording of drivers' records of duty status ("RODS") with electronic recording requirements applicable to most CMV operators.
Under the regulatory framework, ELD technology providers — including SaaS platforms such as MFW that offer ELD compliance functionality as part of their fleet management solutions — must ensure that their devices and software are self-certified as compliant with the FMCSA's technical specifications set forth at 49 CFR § 395.26. Self-certification is the responsibility of the ELD provider; FMCSA does not independently test or approve ELD devices prior to their listing on the FMCSA's registered ELD list. Rather, the ELD provider certifies that its product meets the applicable technical requirements and registers its device on the FMCSA's list, which is maintained on the FMCSA's website.
Key technical compliance requirements under 49 CFR Part 395 include, among others:
(a) Data Recording Accuracy. The ELD must accurately and automatically record driving time and other duty status changes based on vehicle movement data from the CMV's engine control module.
(b) Tamper-Resistance. The ELD must be designed to resist tampering and must alert the driver and motor carrier of any malfunction or data diagnostic event.
(c) Data Transfer Capabilities. The ELD must support data transfer to authorized safety officials via Bluetooth, USB, and/or web services, in the standardized output file format specified by FMCSA.
(d) Driver Interface Requirements. The ELD must provide a compliant driver interface that allows the driver to review, edit, annotate, and certify RODS.
(e) Data Retention. ELD records must be retained for a minimum period as specified by regulation, and must be available for inspection during roadside inspections and audits.
B. MFW's ELD Product
MFW's fleet management platform includes an ELD compliance module as a core component of its product offering. This module is marketed to MFW's approximately 4,200 mid-market trucking and logistics customers as a fully integrated ELD solution that enables compliance with the FMCSA's HOS recording requirements. Based on MFW's product documentation and marketing materials reviewed in the VDR, the ELD compliance module is a central element of MFW's value proposition and a significant driver of customer adoption and retention.
Based on VDR materials reviewed to date, MFW's ELD solution appears to be listed on the FMCSA's registered ELD list. We have submitted a request to MFW for confirmation of the current registration status, including the registration number assigned by FMCSA, the date of initial registration, and any correspondence between MFW and FMCSA regarding the registration, compliance, or any technical issues related to MFW's ELD product.
The importance of this product feature to MFW's business cannot be overstated. If MFW's ELD solution were to be found non-compliant with FMCSA technical specifications, or if the solution were to be removed from (de-listed from) the FMCSA's registered ELD list, the consequences for MFW's business would be severe. MFW's customers — motor carriers subject to the ELD mandate — would be unable to rely on MFW's ELD module for regulatory compliance and would likely need to transition to an alternative ELD solution, potentially resulting in mass customer attrition. Regulatory non-compliance or de-listing would therefore have a material adverse effect on MFW's business, financial condition, and results of operations.
C. Compliance Status and Risks
Registration Status. As noted, MFW's ELD solution is confirmed as registered on the FMCSA's registered ELD list based on our preliminary review. However, registration is based on self-certification by the E