SERVICE AGREEMENT
for
Outseer Fraud Manager Cloud™ Services*** IMPORTANT INFORMATION – PLEASE READ CAREFULLY ***THIS SERVICE AGREEMENT FOR THE OUTSEER FRAUD MANAGER CLOUD SERVICES ("AGREEMENT”) IS EFFECTIVE AS
OF THE DATE OF THE CUSTOMER’S SIGNED ACCEPTANCE OF THE APPLICABLE QUOTATION MAKING REFERENCE TO
THIS AGREEMENT.
ANY AND ALL REFERENCES TO "CUSTOMER" SHALL BE DEEMED TO MEAN THE CUSTOMER SET FORTH IN AN
APPLICABLE QUOTATION.
THIS AGREEMENT IS A LEGALLY BINDING DOCUMENT BETWEEN YOU (MEANING THE INDIVIDUAL PERSON OR THE
ENTITY THAT THE INDIVIDUAL REPRESENTS THAT HAS OBTAINED THE OUTSEER FRAUD MANAGER CLOUD SERVICEFOR ITS INTERNAL PRODUCTIVE USE AND NOT FOR OUTRIGHT RESALE) (THE “CUSTOMER”) AND OUTSEER WHICH
MEANS (I) RSA SECURITY LLC, IF CUSTOMER IS LOCATED IN THE UNITED STATES, MEXICO OR SOUTH AMERICA; (II)THE LOCAL RSA SALES AFFILIATE, IF CUSTOMER IS LOCATED OUTSIDE THE UNITED STATES, MEXICO OR SOUTH
AMERICA AND IN A COUNTRY IN WHICH RSA HAS A LOCAL RSA SALES AFFILIATE; OR (III) RSA SECURITY & RISKIRELAND LIMITED OR OTHER AUTHORIZED RSA ENTITY AS IDENTIFIED ON THE OUTSEER QUOTE OR STATEMENT OF
WORK, IF CUSTOMER IS LOCATED OUTSIDE THE UNITED STATES, MEXICO OR SOUTH AMERICA AND IN A COUNTRY IN
WHICH RSA DOES NOT HAVE A LOCAL SALES AFFILIATE.
THIS AGREEMENT SETS FORTH THE TERMS AND CONDITIONS UNDER WHICH OUTSEER WILL PROVIDE AND CUSTOMERWILL RECEIVE THE SERVICES (AS DEFINED BELOW).
1.

DEFINITIONS. The following words shall have the meanings set forth immediately below (or elsewhere in the Agreement).
“Affiliate” means a legal entity that is controlled by, controls, or is under common “control” of Outseer or Customer.
“Control” means more than 50% of the voting power or ownership interests.
“Confidential Information” means and includes the terms of this Agreement and the Service and all confidential andproprietary information of Outseer or Customer, including without limitation, all business plans, product plans,
financial information, software, designs, and technical, business and financial data of any nature whatsoever,provided that such information is marked or designated in writing as “confidential,” “proprietary,” or any other similarterm or designation. Confidential Information does not include information that is (i) rightfully in the receiving party’s
possession without obligation of confidentiality prior to receipt from the disclosing party, (ii) a matter of publicknowledge through no fault of the receiving party, (iii) rightfully furnished to the receiving party by a third party without
restriction on disclosure or use; or (iv) independently developed by the receiving party without use of or reference tothe disclosing party's Confidential Information.
“Channel Partner” means a reseller, integrator, service provider, independent software vendor, value-added reseller,
OEM or other partner that is authorized by Outseer to license the Service to end users. The term shall also refer toany third party duly authorized by Channel Partner to license the Service to end users.
“Data Services” means:i.
updates to the Global Data Network made available to Customer by Outseer via the Outseer servers.
ii. data and information derived from the Geo-Location Service (as used herein, “Geo-Location Service” means thegeo-location component available with the Service).
“Documentation” means the then-current, generally available, written user manuals and online help and guides forService provided by Outseer for the Service.
“End User” means a client of Customer, whose transaction may be processed by the Service pursuant to this Schedule.
“Global Data NetworkTM” means a database owned and operated by Outseer which contains information aggregated byOutseer, discovered by the parties as part of the performance of their obligations under this Agreement, obtained,
and/or procured from third parties and/or resulting from risk and fraud assessments carried out by Outseer andincludes without limitation IP addresses, Phishing website URLs and any other related data. The Global Data
Network will not include any information which would allow the holder thereof to identify an end user or the Customer.

CONFIDENTIAL

Ver: October 2022_R1-00

page 1 of 12

“Quote” or “Quotation” means one or more documents issued by Outseer specifying the Service that Customer seeks
to obtain from Outseer, the related pricing and sufficient other information to complete the transaction. Each Quote
shall incorporate this Agreement by reference.
“Service” means the Outseer Fraud Manager CloudTM service as described in the Schedule to this Agreement and its
Documentation.
“Transaction” means all Service functional activities except for Case Management API and Additional Features. For
purposes of clarity, a Transaction includes all requests sent by Customer to the Service.
2.
ORDERING, PRICING & PAYMENT. A Quote will only be accepted by Outseer when Customer places an order bysigning a Quote and returning it to Outseer for acceptance. Outseer will issue an invoice upon signing the Quote by Outseer.
Such invoice will reflect the price for the Service as set forth on the Quote. This Agreement, Schedule and Quote shall control
in the event that there are different or additional terms set forth in any purchase order submitted by Customer. Customer shallpay Outseer the price stated on the invoice and also pay or reimburse Outseer for all related taxes or withholdings, except for
those taxes based on Outseer’s net income. If Customer is required to withhold taxes, then Customer will forward any
withholding receipts to Outseer. All amounts are due in US currency and in full thirty (30) days after the date of Outseer's invoice,with interest accruing thereafter at the lesser of 1.5% per month or the highest lawful rate.
3.
INSTALLATION & ACCEPTANCE. Service fees do not include implementation nor customization. Service acceptanceoccurs when the Service operates in substantial conformity to the Documentation. Notwithstanding such acceptance, Customer
retains all rights and remedies set forth in section 5 (WARRANTY & DISCLAIMER) below.
4.
A.

B.

C.

5.
A.
B.

C.

D.

LICENSE.
General License Grant. Subject to Customer’s compliance with this Agreement and payment of all fees, Outseer grants
to Customer a nonexclusive and nontransferable (except as otherwise permitted herein) license (with no right tosublicense) to use (i) the Service for Customer’s internal business purposes; and (ii) the Documentation for the purposeof supporting Customer’s use of the Service. The duration of the licenses granted to Customer is indicated in the quotefrom Outseer or Channel Partner. Documentation is licensed solely for purposes of supporting Customer’s use of theService as permitted in this section.
License Restrictions. Customer may copy Documentation as reasonably necessary in connection with Customer’s
authorized use of the Service. Customer shall not, without Outseer's prior written consent (i) use the Service in a service
bureau, application service provider or similar capacity; or (ii) disclose to any third party the results of any comparative orcompetitive analyses, benchmark testing or analyses of the Service performed by or on behalf of Customer; or (iii) makeaccess available to the Service in any form to anyone other than Customer’s employees or contractors.
Reserved Rights. All rights not expressly granted to Customer are reserved. In particular, no title to, or ownership of, theService is transferred to Customer. Customer shall reproduce and include copyright and other proprietary notices on andin any copies of the Documentation. Unless expressly permitted by applicable mandatory law, Customer shall not modify,
enhance, supplement, create derivative works from, reverse assemble, reverse engineer, decompile or otherwise reduce
to human readable form the Service without Outseer's prior written consent, nor shall Customer permit any third party to
do the same. Nothing contained herein shall limit Outseer’s right to license or otherwise distribute or make available toany third party, develop, use, create derivative works of, or otherwise exploit the Outseer Service (and the underlying
Outseer products and services), in whole or in part.
WARRANTY & DISCLAIMER.
Warranty. Outseer warrants that the Service will substantially conform to its Documentation. Outseer does not warrant
that the operation of the Service shall be uninterrupted or error free, that all defects can be corrected, or that the Service
meets Customer’s requirements.
Customer Remedies. Outseer’s entire liability and Customer’s exclusive remedies under the warranties described in thissection shall be for Outseer, at its option, to remedy the non-compliance or to replace the affected component of theService. If Outseer is unable to effect such within a reasonable time, then Outseer shall refund a pro-rated amountreceived by Outseer for the Service for the remaining term, The foregoing shall not void any supplementary remedies
made available to Customer by a Channel Partner, with respect to which Outseer shall have no liability or obligation.
Warranty Exclusions. Warranty does not cover problems that arise from (i) accident or neglect by Customer or any third
party; (ii) any third party items or services with which the Service is used or other causes beyond Outseer’s control;(iii) installation, operation or use not in accordance with Outseer’s instructions or the applicable Documentation; (iv) use
in an environment, in a manner or for a purpose for which the Service was not designed; or (v) modification, alteration or
repair by anyone other than Outseer or its authorized representatives;. Outseer has no obligation whatsoever for Service(a) installed or used beyond the licensed scope of use, (b) that has reach end of life or end of support, or (c) whose
original identification marks have been altered or removed.
No Further Warranties. EXCEPT FOR THE WARRANTY SET FORTH HEREIN, AND TO THE MAXIMUM EXTENTPERMITTED BY LAW, OUTSEER (INCLUDING ITS SUPPLIERS) MAKES NO OTHER EXPRESS OR IMPLIEDWARRANTIES, WRITTEN OR ORAL. INSOFAR AS PERMITTED UNDER APPLICABLE LAW, ALL OTHERWARRANTIES ARE SPECIFICALLY EXCLUDED, INCLUDING WARRANTIES ARISING BY STATUTE, COURSE OF
DEALING OR USAGE OF TRADE.

CONFIDENTIAL

Ver: October 2022_R1-00

page 2 of 12

6.
A.

B.

C.
D.
E.
7.
A.

B.
C.

D.

E.

LIMITATION OF LIABILITY.
Limitation on Direct Damages. OUTSEER’S TOTAL LIABILITY AND CUSTOMER’S SOLE AND EXCLUSIVE REMEDY
FOR ANY CLAIM OF ANY TYPE WHATSOEVER, ARISING OUT OF SOFTWARE PROVIDED HEREUNDER, SHALLBE LIMITED TO PROVEN DIRECT DAMAGES CAUSED BY OUTSEER’S SOLE NEGLIGENCE IN AN AMOUNT NOT
TO EXCEED (I) US$1,000,000, FOR DAMAGE TO REAL OR TANGIBLE PERSONAL PROPERTY; AND (II) THE PRICE
PAID BY CUSTOMER TO OUTSEER FOR THE SERVICE (CALCULATED ON AN ANNUAL BASIS, WHEN
APPLICABLE) OR FOR DAMAGE OF ANY TYPE NOT IDENTIFIED IN (I) ABOVE OR OTHERWISE EXCLUDEDHEREUNDER.
EXCEPT WITH RESPECT TO CLAIMS REGARDING VIOLATION OF OUTSEER’S
No Indirect Damages.
INTELLECTUAL PROPERTY RIGHTS, NEITHER CUSTOMER NOR OUTSEER SHALL HAVE LIABILITY TO THE
OTHER FOR ANY SPECIAL, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, OR INDIRECT DAMAGES(INCLUDING, BUT NOT LIMITED TO, LOSS OF PROFITS, REVENUES, GOOD WILL, DATA AND/OR USE), EVEN IF
ADVISED OF THE POSSIBILITY THEREOF.
Special Exclusion. IN JURISDICTIONS THAT DO NOT ALLOW LIMITATION OR EXCLUSION OF CONSEQUENTIAL
OR INCIDENTAL DAMAGES, ALL OR A PORTION OF SECTION 6.A AND/OR 6.B ABOVE MAY NOT APPLY.
CUSTOMER ACKNOWLESGES AND AGREES THAT NO INDEMNITY IS GIVEN WITH RESPECT TO THE SERVICES.
Limitation Period. Unless otherwise required by applicable law, the limitation period for claims for damages shall beeighteen (18) months after the cause of action accrues, unless statutory law provides for a shorter limitation period.
Suppliers. The foregoing limitations shall also apply in favor of Outseer’s suppliers.
UAT SERVICES.
Outseer may provide the Service solely for testing and evaluation purposes in a UAT environment (“UAT Services”).
There is no charge to Customer for UAT Services. UAT Services may be terminated at any time by Outseer at its sole
option and without liability, by giving Customer prior notice of termination and Customer shall cease all use of the UAT
Service.
Customer must not put production data or data regulated by law or regulation into the UAT Service. If Customer puts thatdata into UAT Service, Customer does so at Customer’s own risk and Outseer will not be responsible for theconsequences of that use.
OUTSEER (INCLUDING ITS SUPPLIERS) PROVIDES UAT SERVICE “AS IS” AND MAKES NO EXPRESSWARRANTIES, WRITTEN OR ORAL, REGARDING THE UAT SERVICE. ALL WARRANTIES ARE SPECIFICALLYDISCLAIMED AND EXCLUDED, INCLUDING, BUT NOT LIMITED TO THE IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, AND ANY WARRANTYARISING BY STATUTE, OPERATION OF LAW, COURSE OF DEALING OR PERFORMANCE, OR USAGE OF TRADE.
Customer acknowledges:i.
the UAT Service is not covered by 24x7 support. Support will be provided as and when available during Outseer’s
regular business hours.
ii.
service level standards do not apply to UAT Service. Availability and performance standards are “as is”.
THE AGGREGATE LIABILITY (EXCLUDING INDIRECT DAMAGES, FOR WHICH OUTSEER EXPRESSLY DISCLAIMSALL LIABILITY) OF OUTSEER, AND ITS AFFILIATES AND SUPPLIERS, FOR ANY CLAIM ARISING FROMCUSTOMER’S USE OF THE UAT SERVICE WILL NOT EXCEED $1,000 USD (OR THE EQUIVALENT IN LOCALCURRENCY).

8.
CONFIDENTIALITY. Each party shall (i) use Confidential Information of the other party only for the purposes of
exercising rights or performing obligations in connection with this Agreement; and (ii) use at least reasonable care to protectfrom disclosure to any third parties any Confidential Information disclosed by the other party for a period commencing upon thedate of disclosure until three (3) years thereafter. Notwithstanding the foregoing, either party may disclose Confidential
Information (a) to an Affiliate for the purpose of fulfilling its obligations or exercising its rights hereunder as long as such Affiliatecomplies with the foregoing; and (b) if required by law provided the receiving party has given the disclosing party prompt notice.
9.
GOVERNMENT REGULATIONS AND EXPORT CONTROL. The Service and the technology included therein provided
under this Agreement are subject to governmental restrictions on (i) exports from the U.S.; (ii) exports from other countries inwhich such Service and technology included therein may be produced or located; (iii) disclosures of technology to foreign
persons; (iv) exports from abroad of derivative products thereof; and (v) the importation and/or use of such Service andtechnology included therein outside of the United States or other countries (collectively, "Export Laws"). Customer shall comply
with all Export Laws and Outseer export policies to the extent such policies are made available to Customer by Outseer.
Diversion contrary to U.S. law or other Export Laws is expressly prohibited.
10.
TERMINATION. Either Customer or Outseer may terminate this Agreement upon written notice due to the other party’s
material breach of the terms governing use of the Service; provided that such breach is not cured within thirty (30) days after
the provision of written notice to the breaching party specifying the nature of such breach. Upon termination of this Agreement,
Customer shall cease all use of the Service and return or certify destruction of the Documentation (including copies) to Outseer.
Any provision that by its nature or context is intended to survive any termination or expiration, including but not limited toprovisions relating to payment of outstanding fees, confidentiality and liability, shall so survive.

CONFIDENTIAL

Ver: October 2022_R1-00

page 3 of 12

11.
A.
B.

C.

D.

E.

F.

G.
H.
I.

MISCELLANEOUS.
References. Outseer may identify Customer for reference purposes unless and until Customer expressly objects in writing
Notices and Language. Any notices permitted or required under this Agreement shall be in writing and shall be deemed
given when delivered (i) in person, (ii) by overnight courier, upon written confirmation of receipt, (iii) by certified orregistered mail, with proof of delivery, or (iv) by email, with confirmation of receipt (except for routine business
communications issued by Outseer, which shall not require confirmation from Customer). Notices shall be sent to theaddress, or email address set forth below, or at such other address, or email address as provided to the other party inwriting. Notices shall be sent to Outseer Security LLC, 174 Middlesex Turnpike, Bedford, MA 01730. Email for legal
notices: legalnotices@rsa.com. The parties agree that this Agreement has been written in the English language, that the
English language version shall govern and that all notices shall be in the English language.
Entire Agreement. This Agreement (i) is the complete statement of the agreement of the parties with regard to the subject
matter hereof; and (ii) may be modified only by a writing signed by both parties. All terms of any purchase order or similar
document provided by Customer, including but not limited to any pre-printed terms thereon and any terms that areinconsistent or conflict with this Agreement, shall be null and void and of no legal force or effect.
Force Majeure. Except for the payment of fees, if any, due Outseer from Customer, neither party shall be liable under
this Agreement because of a failure or delay in performing its obligations hereunder on account of any force majeure
event, such as strikes, riots, insurrection, terrorism, fires, natural disasters, acts of God, war, governmental action, or any
other cause which is beyond the reasonable control of such party.
Assignment. Customer shall not assign this Agreement or any right or delegate any performance without Outseer’s priorwritten consent, which consent shall not be unreasonably withheld. Customer shall promptly notify Outseer, and Outseer
may terminate this Agreement on thirty days’ notice if Customer merges with or is acquired by a third party or otherwise
undergoes a change of control.
Governing Law. This Agreement is governed by: (i) the laws of the Commonwealth of Massachusetts when Outseermeans Outseer Security LLC; (ii) the laws of the applicable country in which the applicable Outseer subsidiary isregistered to do business when Outseer means the local Outseer subsidiary, and (iii) the laws of Ireland when Outseer
Customer is located outside United States, Mexico or South America or in a country in which Outseer does not have a
local sales subsidiary. In each case, the applicability of laws shall exclude any conflict of law rules. The U.N. Convention
on Contracts for the International Sale of Goods shall not apply. In the event of a dispute concerning this Agreement,
Customer consents to the sole and exclusive personal jurisdiction of the courts of competency in the location where
Outseer is domiciled.
Waiver. No waiver shall be deemed a waiver of any prior or subsequent default hereunder. If any part of this Agreement
is held unenforceable, the validity of the remaining provisions shall not be affected.
Partial Invalidity. If any part of this Agreement, a purchase order or an Outseer quote is held unenforceable, the validityof the remaining provisions shall not be affected.
Optional Feedback. Customer may provide comments and suggestions regarding the Service, but Customer is not
required to do so. If Customer provides comments or suggestions, Outseer may use that feedback without restriction,
and Customer hereby irrevocably assigns to Outseer all right, title, and interest in and to that feedback. Subject to thepreceding sentence regarding any feedback Customer provides, providing any comments and suggestions does not grant
RSA any rights in Customer’s data or Customer’s intellectual property.

12.

COUNTRY SPECIFIC TERMS.

A.

United Kingdom. The terms in this subsection A apply only when Outseer means the Outseer sales subsidiary locatedin the United Kingdom:
1.
Section 5D (Warranty Exclusions). The entire section is deleted and replaced with:D.
Warranty Exclusions. Except as expressly stated in the applicable warranty set forth in this Agreement,
Outseer (including its suppliers) provides Service “AS IS” and makes no other express or implied warranties, written
or oral, and ALL OTHER WARRANTIES AND CONDITIONS (SAVE FOR THE WARRANTIES AND CONDITIONSIMPLIED BY SECTION 12 OF THE SALE OF GOODS ACT 1979) ARE SPECIFICALLY EXCLUDED TO THE
FULLEST EXTENT PERMITTED BY LAW, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIESOF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND ANY WARRANTY ARISINGBY STATUTE, OPERATION OF LAW, COURSE OF DEALING OR PERFORMANCE, OR USAGE OF TRADE.
2.
Section 6 (LIMITATION OF LIABILITY). This Section is deleted in its entirety and replaced with:
6.
LIMITATION OF LIABILITY AND PRESERVATION OF DATA.
A.
The entire aggregate liability of Outseer (including its suppliers) under or in connection with the supplyof the Service, whether in tort (including negligence), for breach of contract, misrepresentation orotherwise, is limited in respect of each event or a series of events: (i) to the amounts actually paid by
Customer for the Service which give rise to such liability during the twelve (12) month period
immediately preceding the date of the cause of action giving rise to such claim; or (ii) Great British
Pounds Sterling one million (£1,000,000), whichever is the greater amount. In no event shall Outseer(including its suppliers) or Customer be liable to the other or any other person or entity for loss of
profits, loss of revenue, loss of use or any indirect, special, incidental, consequential or exemplary
damages arising out of or in connection with this Agreement, the license of the Service, and the use,
performance, receipt or disposition of such Service, even if such party has been advised of the

CONFIDENTIAL

Ver: October 2022_R1-00

page 4 of 12

3.

B.

possibility of such damages or losses. Nothing in this Agreement shall operate to exclude or restrict
Outseer’s liability for: (a) death or personal injury resulting from negligence; (b) breach of obligations
arising from section 12 of the Sale of Goods Act 1979; or (c) fraud.
B.
CUSTOMER OBLIGATIONS IN RESPECT OF PRESERVATION OF DATA. During the Term of
the Agreement, the Customer shall:
1)
from a point in time prior to the point of failure, (i) make full and/or incremental backups of data
which allow recovery in an application consistent form, and (ii) store such back-ups at an off-site
location sufficiently distant to avoid being impacted by the event(s) (e.g. including but not limited toflood, fire, power loss, denial of access or air crash) and affect the availability of data at the impactedsite;
2)
have adequate processes and procedures in place to restore data back to a point in time andprior to point of failure, and in the event of real or perceived data loss, provide the skills/backup andoutage windows to restore the data in question.
3)
use anti-virus software, regularly install updates across all data which is accessible across the
network, and protect all storage arrays against power surges and unplanned power outages with
Uninterruptible Power Supplies; and4)
ensure that all operating system, firmware, system utility (e.g., but not limited to, volume
management, cluster management and backup) and patch levels are kept to Outseer recommended
versions and that any proposed changes thereto shall be communicated to Outseer in a timely
fashion.
Section 11 (MISCELLANEOUS). Add the following as new subsection J:
J.
Each of the parties acknowledges and agrees that in entering into this Agreement, it does not rely on, andshall have no remedy in respect of, any statement, representation, warranty or understanding (whether negligently
or innocently made) of any person (whether party to this Agreement or not) other than as expressly set out in thisAgreement as a warranty. The only remedy available to Customer for a breach of the warranties shall be for breachof contract under the terms of this Agreement. Nothing in Section 6 shall however operate to limit or exclude any
liability for fraud. No term of this Agreement shall be enforceable under the Contracts (Rights of Third Parties) Act
1999 by a person that is not a party to this Agreement. If any part of this Agreement is held unenforceable, thevalidity of the remaining provisions shall not be affected.

Ireland. The terms in this subsection B apply only when Outseer means the Outseer sales subsidiary located in Ireland:
1.
Section 5D (Warranty Exclusions). The entire section is deleted and replaced with:D.
Warranty Exclusions. Except as expressly stated in the applicable warranty set forth in this Agreement
and the applicable exhibits, Outseer (including its suppliers) and makes no warranties, and ALL WARRANTIES,TERMS AND CONDITIONS, WHETHER ORAL OR WRITTEN, EXPRESS OR IMPLIED BY LAW, CUSTOMEROR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTIES, TERMS AND CONDITIONS, OF
FITNESS FOR PURPOSE, DESCRIPTION, AND QUALITY ARE HEREBY EXCLUDED TO THE MAXIMUMEXTENT PERMITTED UNDER APPLICABLE LAW.
2.
Section 6 (LIMITATION OF LIABILITY). This section is deleted in its entirety and replaced with the following:
6.
LIMITATION OF LIABILITY.
A.
Outseer does not exclude or limit its liability to the Customer for death or personal injury, or, breachof obligations implied by Section 12 of the Sale of Goods Act, 1893, as amended by the Sale ofGoods and Supply of Services Act, 1980, or, due to the fraud or fraudulent misrepresentation of
Outseer, its employees or agents.
B.
Subject always to subsection 6.A, the liability of Outseer (including its suppliers) to the Customer
under or in connection with an order, whether arising from negligent error or omission, breach ofcontract, or otherwise (“Defaults”) shall be: (i) the aggregate liability of Outseer for all Defaults
resulting in direct loss of or damage to the tangible property of the Customer shall be limited todamages which shall not exceed the greater of two hundred per cent (200%) of the applicable pricepaid and/or payable for the Service, or one million euros (€1,000,000); or (ii) the aggregate liabilityof Outseer for all Defaults, other than those governed by subsection 6.B(i) shall be limited to damages
which shall not exceed the greater of one hundred and fifty per cent (150%) of the applicable pricepaid and/or payable or five hundred thousand euro (€500,000).
C.
In no event shall Outseer (including its suppliers) be liable to Customer for (i) loss of profits, loss ofbusiness, loss of revenue, loss of use, wasted management time, cost of substitute services or
facilities, loss of goodwill or anticipated savings, loss of or loss of use of any software or data; and/or(ii) indirect, consequential or special loss or damage; and/or (iii) damages, costs and/or expenses
due to third party claims; and/or (iv) loss or damage due to the Customer’s failure to comply withobligations under this Agreement, failure to do back-ups of data or any other matter under the controlof the Customer. For the purposes of this Section 6, the term “loss” shall include a partial loss, aswell as a complete or total loss.
D.
The parties expressly agree that should any limitation or provision contained in this Section 6 be held
to be invalid under any applicable statute or rule of law, it shall to that extent be deemed omitted, but

CONFIDENTIAL

Ver: October 2022_R1-00

page 5 of 12

3.

if any party thereby becomes liable for loss or damage which would otherwise have been excluded
such liability shall be subject to the other limitations and provisions set out in this Section 6.
E.
The parties expressly agree that any order for specific performance made in connection with thisAgreement in respect of Outseer shall be subject to the financial limitations set out in sub-section
6.B.
F.
CUSTOMER OBLIGATIONS IN RESPECT OF PRESERVATION OF DATA. During the Term of
the Agreement the Customer shall:
1)
from a point in time prior to the point of failure, (i) make full and/or incremental backups of data
which allow recovery in an application consistent form, and (ii) store such back-ups at an off-site
location sufficiently distant to avoid being impacted by the event(s) (e.g., including but not limited toflood, fire, power loss, denial of access or air crash) and affect the availability of data at the impactedsite;
2)
have adequate processes and procedures in place to restore data back to a point in time andprior to point of failure, and in the event of real or perceived data loss, provide the skills/backup andoutage windows to restore the data in question.
3)
use anti-virus software and regularly install updates across all data which is accessible acrossthe network; and4)
ensure that all operating system, firmware, system utility (e.g., but not limited to, volume
management, cluster management and backup) and patch levels are kept to current with Outseer’s
best practice recommendations.
Section 5.D (Limitation Period). This Section is deleted in its entirety and replaced with the following as a totally
separate section:(D)
WAIVER OF RIGHT TO BRING ACTIONS: The Customer waives the right to bring any claim arising outof or in connection with this Agreement more than twenty-four (24) months after the date of the cause of action
giving rise to such claim.

C.

European Union. The terms in this subsection C apply only when Outseer means an Outseer sales subsidiary locatedin the European Union:
1.
Section 4.A (General License Grant). The following is added at the end of this section:
Customer shall not, and Customer shall not permit any third party to, modify, enhance, supplement, create
derivative works from, reverse assemble, reverse engineer, reverse compile or otherwise reduce to humanreadable form the Service without Outseer's prior written consent, except to the extent that local, mandatory law
grants Customer the right to decompile such Service in order to obtain information necessary to render suchinteroperable with other software. In such event, Customer shall first inform Outseer of its intention and request
Outseer to provide Customer with the necessary information. Outseer may impose reasonable conditions on theprovision of the requested information, including the payment of a reasonable fee.

D.

Australia. The terms in this subsection D apply only when the Customer is located in Australia:
1.
Section 6 (LIMITATION OF LIABILITY). This section is deleted in its entirety and replaced with the following:
6.
LIMITATION OF LIABILITY.
A.
Limitation on Direct Damages. OUTSEER’S AND ITS SUPPLIERS’ TOTAL LIABILITY AND
CUSTOMER’S SOLE AND EXCLUSIVE REMEDY FOR ANY CLAIM OF ANY TYPEWHATSOEVER, ARISING OUT OF SOFTWARE, OR SERVICE PROVIDED HEREUNDER, SHALLBE LIMITED TO PROVEN DIRECT DAMAGES CAUSED BY OUTSEER’S SOLE NEGLIGENCE IN
AN AMOUNT NOT TO EXCEED (I) AUD$2,000,000, FOR DAMAGE TO REAL OR TANGIBLEPERSONAL PROPERTY; AND (II) THE PRICE PAID BY CUSTOMER TO OUTSEER FOR THE
SPECIFIC SERVICE (CALCULATED ON AN ANNUAL BASIS, WHEN APPLICABLE) SOFTWAREFROM WHICH SUCH CLAIM ARISES, FOR DAMAGE OF ANY TYPE NOT IDENTIFIED IN(i) ABOVE OR OTHERWISE EXCLUDED HEREUNDER.
B.
No Indirect Damages. EXCEPT WITH RESPECT TO CLAIMS REGARDING VIOLATION OF
OUTSEER’S INTELLECTUAL PROPERTY RIGHTS, NEITHER CUSTOMER NOR OUTSEER(INCLUDING OUTSEER’S SUPPLIERS) SHALL (A) HAVE LIABILITY TO THE OTHER FOR ANY
SPECIAL, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, OR INDIRECT DAMAGES(INCLUDING, BUT NOT LIMITED TO, LOSS OF PROFITS, REVENUES, DATA AND/OR USE),EVEN IF ADVISED OF THE POSSIBILITY THEREOF; AND (B) BRING ANY CLAIM BASED ON
SOFTWARE OR SERVICE PROVIDED HEREUNDER MORE THAN EIGHTEEN (18) MONTHS
AFTER THE CAUSE OF ACTION ACCRUES.
C.
Trade Practices Legislation: OUTSEER'S LIABILITY UNDER ANY STATUTORY RIGHT OR ANY
CONDITION OR WARRANTY, INCLUDING ANY IMPLIED BY ANY STATE FAIR TRADING ACT
OR THE TRADE PRACTICES ACT, 1974 (CTH) IS, TO THE MAXIMUM EXTENT PERMITTED BY
LAW, EXCLUDED. TO THE EXTENT THAT SUCH LIABILITY CANNOT BE EXCLUDED,OUTSEER'S LIABILITY IS LIMITED AT THE OPTION OF OUTSEER TO ANY ONE OR MORE OF
THE FOLLOWING: (I) THE REPLACEMENT THEREOF OR the supply of its equivalent; (ii) the

CONFIDENTIAL

Ver: October 2022_R1-00

page 6 of 12repair thereof; (iii) the payment of the cost of replacement thereof or of acquiring its equivalent; or(iv) the payment of the cost of having such repaired.
F.

New Zealand - The terms in this subsection E apply only when the Customer is located in New Zealand:
1.
Section 6 (LIMITATION OF LIABILITY). This section is deleted in its entirety and replaced with the following:
6.
LIMITATION OF LIABILITY.
A.
Limitation on Direct Damages. OUTSEER’S AND ITS SUPPLIERS’ TOTAL LIABILITY AND
CUSTOMER’S SOLE AND EXCLUSIVE REMEDY FOR ANY CLAIM OF ANY TYPEWHATSOEVER, ARISING OUT OF SOFTWARE OR SERVICE PROVIDED HEREUNDER, SHALLBE LIMITED TO PROVEN DIRECT DAMAGES CAUSED BY OUTSEER’S SOLE NEGLIGENCE IN
AN AMOUNT NOT TO EXCEED (I) NZ$2,000,000, FOR DAMAGE TO REAL OR TANGIBLEPERSONAL PROPERTY; AND (II) THE PRICE PAID BY CUSTOMER TO OUTSEER FOR THE
SPECIFIC SERVICE (CALCULATED ON AN ANNUAL BASIS, WHEN APPLICABLE) OR
SOFTWARE FROM WHICH SUCH CLAIM ARISES, FOR DAMAGE OF ANY TYPE NOTIDENTIFIED IN (i) ABOVE OR OTHERWISE EXCLUDED HEREUNDER.
B.
No Indirect Damages. EXCEPT WITH RESPECT TO CLAIMS REGARDING VIOLATION OF
OUTSEER’S INTELLECTUAL PROPERTY RIGHTS, NEITHER CUSTOMER NOR OUTSEER(INCLUDING OUTSEER’S SUPPLIERS) SHALL (A) HAVE LIABILITY TO THE OTHER FOR ANY
SPECIAL, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, OR INDIRECT DAMAGES(INCLUDING, BUT NOT LIMITED TO, LOSS OF PROFITS, REVENUES, DATA AND/OR USE),EVEN IF ADVISED OF THE POSSIBILITY THEREOF; AND (B) BRING ANY CLAIM BASED ON
SOFTWARE OR SERVICE PROVIDED HEREUNDER MORE THAN EIGHTEEN (18) MONTHS
AFTER THE CAUSE OF ACTION ACCRUES.
C.
Fair Trading Legislation. Outseer's liability under any statutory right or any condition or warranty,
including any implied by the Fair-Trading Act 1986 or Consumer Guarantees Act 1993 (“FTA”) or any
similar law is, to the maximum extent permitted by law, excluded. To the extent that such liability
cannot be excluded, Outseer's liability is limited at the option of Outseer to any one or more of thefollowing: (i) the replacement thereof or the supply of its equivalent; (ii) the repair thereof; (iii) the
payment of the cost of replacement thereof or of acquiring its equivalent; or (iv) the payment of thecost of having such repaired.

13.
A.

CUSTOMER OBLIGATIONS
Customer may not engage any third parties to conduct security audits of Outseer Products without the prior writtenconsent of Outseer.
Customer agrees to comply with the Outseer Security Vulnerability Reporting Policy, currently located athttps://www.rsa.com/en-us/vulnerability-response-policy

B.

CONFIDENTIAL

Ver: October 2022_R1-00

page 7 of 12

FRAUD MANAGER CLOUD LICENSE SCHEDULE
for deployment of Fraud Manager in a
CLOUD ENVIRONMENT
1.

Cloud Deployment. The Service is deployed in Microsoft’s Windows Azure environment hosted in Microsoft data
centers (the “Cloud Environment”). The Service is designed to utilize the data security features of the Cloud
Environment to protect Customer’s data. The Service will be implemented by Outseer as a multi-tenanted installationin the Cloud Environment which employs shared infrastructure while segregating customer data. Hardware
infrastructure components, including but not limited to firewalls, load balancers, web servers, database servers, andstorage equipment are shared across multiple customers. Unless stated otherwise in the Documentation Customer
data is segmented via the use of separate directories and databases such that there is no co-mingling of customer
data. Outseer’s Service levels and operational procedures are standardized for all customers due to the shared natureof the installation and the platform.

2.

Service Features. The Service provides the following functionality:
Risk Based Authentication of Transactions
Assessment, analysis and scoring of login and post-login activities (in digital channels) by a supervised machinelearning risk engine that leverages both device, user and transactional behavioral profiling. A partial list of such
post-login transaction activities includes but is not limited to: transferring funds, making online payments, establishingpayees, updating personal information, etc.
Back-office applications to allow customer to set policies, configurations, administrate, view and mark cases and run
reports.
Optional Additional Features –NOTE: Additional Fees will apply if these features are selected.
If selected, the Fees will be set forth in the Outseer Quotation
Authentication Methods
Out of band phone call. Out-of-band phone call (telephone confirmation using telephone numbers stored in
Customer’s systems).
Out-of-band SMS. One Time Password generated by Adaptive Authentication and sent by Outseer to end user via
SMS.
The out-of-band feature (phone call and/or SMS messages) involves set up costs and fees to send the call/SMS(one time third party set up; onetime Outseer set up fee; and a per call/message fee) (“OOB”). OOB is provided via
third parties on infrastructure not owned/controlled by Outseer. Delivery of OOB or the timing of delivery is notguaranteed. Outseer’s warranties and/or indemnities do not extend to nor apply to OOB.
Transaction Signing.
An out of band step up validation method for payment transactions. A validation method to the integrity andauthenticity of payment transactions. Transaction Signing has two components: (i) a software component and (ii) a
messaging component. The messaging component can use either the Customer’s or Outseer’s third party
messaging infrastructure. Outseer’s warranties and/or indemnities do not extend to nor apply to the messaging
infrastructure.
Case Management API.
The Case Management API allows organizations to programmatically integrate Outseer Adaptive Authenticationcase management application with other third-party or in-house fraud detection systems, repositories, reporting andcase management systems, and investigation tools that they are already using.
• The Case Management API allows organizations to: extract cases and activities from the case management
application to their organization systems using an API• Investigate the cases in their custom application; andUpdate the case statuses in Adaptive Authentication case management application.

CONFIDENTIAL

Ver: October 2022_R1-00

page 8 of 12

Raw Data Reports.
Raw Data Reports provide Customer with a rich set of raw data values, from which Customer can choose the data
they need for auditing or integration with its internal tools for further data analysis, or the creation of sophisticated orcustom reports. Raw Data Reports are generated daily. The exact report structure and the fields included in eachreport are detailed in the Documentation. Customer may choose one of the two options set forth below:
a. Enhanced: Customer receives all four (4) Raw Data Report types described below:•
Back Office Operator Report: This report contains a log of the operator activities using Back Officeapplications, such as editing rules, cases and users and viewing reports.
•
Cases Report: This report contains a list of all the flagged activities. It reflects to some extent the casemanagement application. The report includes all the information presented in the activities report plus caserelated data.
•
Activities Report: This report contains a list of all the online banking activities that flowed through thesystem, and is based on all of the notifications and risk assessment requests directed to the Outseer
Adaptive Authentication Cloud solution, regardless if they were later flagged as cases.
•
User Status Report: This report contains detailed information about end-user status changes. The report
includes information such as authentication locks, authentication unlocks, enrollment and re-enrollment
questions reset by the Customer Service Representative, and collections made by the Customer Service
Representative.
b. Basic: Customer receives all reports except for the “Activities Report”.
3.

Term & Termination. The initial term of this Service shall commence on the date the Outseer Quotation is acceptedand shall end on the third anniversary of the Service’s implementation in accordance with the terms of the
Implementation SOW (the “Initial Term”). The Initial Term shall automatically renew for additional one (1) year terms(each a “Renewal Term”) unless either party sends the other written notice of termination at least sixty (60) days prior
to the end of the Initial Term or the applicable Renewal Term in which case this term shall terminate at the end of theInitial Term or such Renewal Term. The Initial Term and the Renewal Term are referred to together as the “Term”.
Outseer may increase the Fees at the end of the Term by no more than the annual CPI rate plus five percent (5%) year
over year.

4.

Authorized Use. During the Term, Outseer authorizes the Customer to access and use the Service for assessing therisk of Transactions, in accordance with the instructions contained in the Documentation and subject to the scope andpricing specified in the applicable Outseer Quotation.

5.

Service Implementation. The implementation plan for the Customer will be set out in a separate statement of work
(the “Implementation SOW”). The Implementation SOW will detail the final delivery project scope and the Customer
specific configuration and implementation of the Service. The parties will cooperate as reasonably necessary and in atimely manner to complete the implementation process described in the Implementation SOW.

6.

Data Services & Support: Data Services are bundled with the Service for the duration of the Term. Customer willnot (a) reproduce or distribute the Geo-Location Service in a manner that allows its users to access the Geo-Location
Service in any way other than through aggregate reports generated by the Service (as described in the Documentation);or (b) use the data and information derived from the Geo-Location Service to create or otherwise support thetransmission of unsolicited commercial email. Outseer shall provide Service support in accordance
https://www.outseer.com/wp-content/uploads/Outseer-Maintenance-Agreement.pdf.

7.

Global Data Network Data. Outseer shall retain and own all right, title and interest and all intellectual property rights(including but not limited to copyrights, trade secrets, trademarks and patent rights) to all information which is collected,
submitted to and made available on the Global Data Network in the course of the performance by either party of their
obligations under the Agreement (or where such title cannot be granted or otherwise transferred to Outseer thenCustomer agrees to grant Outseer an unconditional, unlimited, unrestricted, royalty free license to use, distribute and/or
otherwise make available such information). Customer will: (i) not use any robot, spider, site search or other retrieval
application or device to scrape, retrieve or index nor attempt to (a) identify any individual or any device and/or (b) extract
any personally identifying information from data in the Global Data Network; (ii) not send any End User’s data to
Outseer if such end user withholds or withdraws their consent to the collection of data by the Customer; and (iii) onlyuse data provided by Outseer strictly in conjunction with the use of the Service.

8.

Service Data Integrity. The Service as implemented within the Cloud Environment, is designed to process Customer
data in the following manner:i.
within a virtual network (“Vnet”).
ii.
connectivity between the Vnets across different regions routes are over a secure Vnet-to-Vnet (VPN) tunnel.

CONFIDENTIAL

Ver: October 2022_R1-00

page 9 of 12

iii.
iv.
v.
vi.
vii.
viii.
ix.
x.
xi.
xii.
xiii.

ivx.

in a 3-tier design, namely a web, app and data tier. Each tier is deployed in a separate subnet and eachsubnet is protected by Outseer defined and managed ACL’s for in/out-bound traffic. Outseer uses a
messaging middleware between the web and app tier to prevent a direct access from web tier to app tier.
leverage proxy servers for the in/out-bound internet traffic routed to/from the production level Vnet.
segregate between management and production Vnets.
not allow remote access direct to production systems.
all sensitive data and configuration parameters are encrypted on a per customer basis. All virtual machine
images are hardened in accordance with industry standards.
data encryption keys are maintained on a per customer basis (the data encryption keys are rotatedautomatically on a weekly basis).
all application and system log files (including an audit trail of access to the back-office functions, for example
the customer facing applications – Case Management, Policy Management, etc.) are retained in accordancewith Outseer’s data retention policies.
the data source for access management by Outseer enforces the use of strict password policy for Outseer
administrators and Customer administrators.
Outseer performs authorized access to all data sources and uses IP restriction rules for the management of
the incoming traffic. All Customer communications in/out-bound are managed through SSL certificates issued
for a Customer specific FQDN.
All sensitive data (for example, account numbers) is to be submitted to Outseer, such data shall be hashedusing a minimum level of SHA256 by the Customer before submission to Outseer. Outseer is not responsible
for protecting any unhashed sensitive data that may be sent to and received by Outseer.
Upon at least ninety (90) days prior written notice to Outseer and no more frequently than once every twelve(12) months during the Term, Outseer will permit Customer to review selected samples of Outseer’s security
policies directly related to the Service during an onsite visit to Outseer’s Executive Briefing Center (“EBC”)
during Outseer standard business hours. Customer will not be given physical access to data operations
centers, the Cloud Environment and other like premises that are subject to restricted access. The Customer
is responsible for any costs and expenses which Customer incurs in connection with the onsite visit to the
EBC.
Outseer shall maintain effective internal controls consistent with industry standards to monitor compliance withthis section 10. Outseer shall maintain complete and accurate records in English. During the Term and for aperiod of three (3) years thereafter, or longer if required under applicable law, upon receipt of 45 days
advanced written notice, Outseer shall provide to Customer, its agents, auditors and government regulators a‘certificate of compliance’ duly signed by Outseer’s chief information security officer in order to verify
compliance with this section.

9.

Scoring & Response Time Benchmarks.
i.
Transaction scoring: 95% of the transactions will be scored within no more than one second, and 99.5% oftransactions shall be scored within no more than four seconds. Note: transaction scoring term shall bemeasured from the moment Outseer received the request till submission of score.
ii.
Out-of-band phone call: Telephone calls shall be initiated (i.e., allocate a telephone line for the call and go
off-hook and begin to dial) approximately within ten (10) seconds from receiving the request from Customer
95% of the time and in no event within more than sixty (60) seconds of receiving the request from Customer.
iii.
Out-of-band SMS: Generally 90% of SMS messages bound to the applicable carrier will processed by the
SMS aggregator within five (5) seconds and 99% of the SMS messages bound to the applicable carrier willprocessed by the SMS aggregator within fifteen (15) seconds.
Customer acknowledges that the scoring and/or timeliness of the above benchmarks are not guaranteed by Outseer.
Outseer does not assume and shall not be responsible for performance delays or failures (including without limitation
latency, scheduled downtime, etc.) attributed to any non-Outseer platform and/or network. Upon Customer request,
Outseer will provide a transaction scoring report to Customer no later than the 14th day of the month following thereporting period,

10.

Service Availability.
i.
The Service shall have 99.5% availability on a monthly basis (“Service Availability”). Service Availability foreach elapsed calendar month is calculated as follows:
M = total number of minutes in the elapsed calendar month;
Y = actual total minutes of Scheduled Downtime in elapsed month:
N = actual authorized Service Availability in minutes for the elapsed month which is calculated as follows:
N = [(M – Y) x 99.5%]
X = is the number of minutes the Service is authorized to not be available in the elapsed month and whichis calculated as follows:
X=M-N
D = the total number of minutes where the Service was not available;

CONFIDENTIAL

Ver: October 2022_R1-00

page 10 of 12

ii.

iii.

Iv.

then if
D > X Customer will qualify for a service credit in compliance with section 10.iii. below.
For the avoidance of doubt Outseer makes no representations or warranties whatsoever with respect to theavailability of network connectivity between the IT systems of Customer to the premises where the Service islocated. The handover occurs when Customer data transported over an ethernet channel reaches the data
center extranet switch. Service Availability is determined on a calendar month basis.
As used above, “Scheduled Downtime” means Planned Downtime and/or Emergency Downtime, as bothterms are defined below:a.
"Planned Downtime" is (i) downtime requested by Customer, or (ii) any planned outage for which
Customer has received notification of at least seven (7) days in advance of such occurrence. Outseer
shall be limited to one instance of Scheduled Downtime per month not to exceed six (6) hours induration and one additional instance per year not to exceed eight (8) hours in duration, unless more
frequent or longer outages are requested or approved by Customer. In order to minimize as muchas possible the impact on Customer, Outseer shall make best effort to schedule Scheduled Downtime
between 00:00 and 08:00 EST on Sunday mornings.
b.
"Emergency Downtime" is any unplanned outage for which Outseer is unable to provide notice as
Scheduled Downtime, but where Outseer has notified Customer at least twenty-four (24) hours inadvance of such occurrence. There shall be no more than one (1) instance of Emergency Downtime
in any calendar month, with a duration not to exceed four (4) hours in each instance.
If Outseer fails to meet the Service Availability standard in any two months within a three-month rolling period(commencing from the month where the Service Availability standard first failed), then Outseer shall issue tothe Customer a service credit in the amount of five percent (5%) of the total Fees received for each of themonths during which such failures were measured. In no event shall the service credits exceed five percent(5%) of the total Fees received. The customer must request a credit from Outseer in the event that a credit isdue. The remedies specified in this Section 10 shall be the Customer’s sole and exclusive remedies for the
failure of Outseer to meet its obligations of Service Availability.
Outseer will provide reports of the Service Availability percentage to Customer no later than the 14th day ofthe month following the Service Availability reporting period. Outseer and Customer agree to notify each otherof any unscheduled outages within 1 hour of detection. Notifications should include Customer impact;
estimated Customer base affected, and expected duration. Outseer and Customer will also provide
notification to each other at the end of any unscheduled outages.

11.

Payment. Customer shall pay Outseer the applicable fees as outlined in the Outseer Quotation (“Fees”).

12.

Consents. Any type of data collected by the Customer from its End Users (including without limitation such users’
device, location) and any form of processing, maintenance, uploading, syncing, or transmission thereof must comply
with all applicable privacy and data collection laws and regulations. Customer is solely responsible for:i.
informing its users about the specific types of data that Customer will collect and the purpose thereof;ii.
obtaining the users’ documented consent to such collection;iii.
displaying a conspicuous visual indicator when such data is being collected; andiv.
not disable, override or otherwise interfere with any Outseer implemented system alerts, warnings, display
panels, consent panels and the like intended to notify the end user.

13.

Privacy Legislation. Except as required for the proper performance of the party’s obligations under this Schedule,
the parties do not intend to disclose to one another hereunder information that would be covered by the Gramm-LeachBliley Act, the Health Insurance Portability and Accountability Act of 1996 or similar privacy legislation within or outsideof the United States. Accordingly, neither party shall disclose to the other hereunder any of the following information
regarding either party’s employees, customers, suppliers or other business partners: protected health information (asdefined at 45 CFR 164.501), social security numbers, driver’s license numbers, credit card numbers or similar
government identity numbers or personal account numbers. Outseer shall not be liable for any claim by Customer’s
customers’, including End Users’ or other third parties arising from the unauthorized or fraudulent application for, accessto or use of such personal data and Customer shall indemnify Outseer for all third-party claims arising as a result of
Customer’s breach of this obligation.

14.

Ownership & License to Customer Data. As between Customer and Outseer, Customer owns and will own all right,
title and interest in and to any data provided by Customer to Outseer in connection with Customer’s use of the Services(“Customer Data”). During the Term, Customer grants to Outseer a limited, non-exclusive license to use the Customer
Data solely for all reasonable and necessary purposes contemplated by the use of the Services. Customer, notOutseer, shall have sole responsibility for the accuracy, quality, integrity, legality, reliability, appropriateness andintellectual property ownership or right to use of all Customer Data. Outseer shall not be responsible or liable for any
deletion, destruction, damage, or loss of any Customer Data that is caused by Customer. Outseer reserves the rightto withhold, remove and/or discard Customer Data upon 15 days prior written notice for any breach of this Cloud
Schedule by Customer, including, without limitation, for any failure by Customer to pay any amounts due under thisCONFIDENTIAL

Ver: October 2022_R1-00

page 11 of 12

Cloud Schedule. In the event this Cloud Schedule and/or the Agreement is terminated (other than by reason ofCustomer’s breach), and if Customer so requests at the time of termination, Outseer, in its option, will: (i) make available
to Customer a file of all Customer Data, or (ii) Outseer will delete all Customer Data within Outseer’s possession within
ninety (90) days of termination.
15

Restrictions on Storage of Regulated Data. Customer acknowledges and agrees that 1) the Service is not intended
or designed to securely host and store any “personal information” that is “sensitive” by nature or deemed “sensitive” by
any applicable laws or regulations (such as social security numbers, credit card data, drivers license numbers, national
ID numbers, bank account numbers, and health/medical information), and Customer shall not store any suchinformation on the Services, and 2) Outseer will have no visibility into the types of information uploaded into or stored
on the Services by Customer.

16.

Customer Responsibilities. Customer will provide Outseer with the cooperation, access and detailed information
reasonably necessary for Outseer to implement and deliver the Services, including, where applicable, (i) test time on
Customer’s computer systems and networks sufficient for Outseer to provide the Services and (ii) one (1) employee
who has substantial computer system, network management and project management experience satisfactory to
Outseer to act as project manager and as a liaison between Outseer and Customer. Outseer will be excused from its
failure to perform any obligation under this Cloud Schedule to the extent such failure is caused by Customer’s delay or
failure to perform its responsibilities. Customer shall use reasonable and appropriate safeguards to protect its
Customer Data.

17.

Outseer Trademark License. During the Term, Outseer grants Customer the right to use the “Secured by Outseer”
trademarks (the “Outseer Mark”) solely for the purpose of displaying the Outseer Mark on the End User facing webbased log in pages of its online services. Customer will not seek to register any trademarks of Outseer in any country
in the world. Any use of the Outseer Mark shall be in accordance with Outseer’s reasonable policies regarding
advertising and trademark usage as established from time to time. Nothing else herein shall prevent Customer fromseparately branding its security processes which may use the Service.

18

Microsoft Intellectual Property. :a.
Customer acknowledges and agrees that Outseer does not assume nor undertake any obligations on behalfof itself and/or Microsoft with regard to any claim alleging infringement or misappropriation of intellectual
property rights by the Cloud Environmentb.
If the Customer is notified of any claim alleging infringement or misappropriation of intellectual property
rights by the Cloud Environment, and if Customer informs Outseer of such claim, Outseer will forward suchinformation to Microsoft provided always, any such action by Outseer will not create nor impose any
obligation on Outseer to take any responsive action to such information.

19.

Cloud Environment. Outseer’s entire liability and Customer’s exclusive remedy for failure in the Cloud Environment
shall be for Outseer to use commercially reasonable efforts to cause Microsoft to remediate the failure. OUTSEER
MAKES NO EXPRESS WARRANTIES, WRITTEN OR ORAL, AND ALL OTHER WARRANTIES ARE SPECIFICALLYEXCLUDED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESSFOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, AND ANY WARRANTY ARISING BY STATUTE,
OPERATION OF LAW, COURSE OF DEALING OR PERFORMANCE, OR USAGE OF TRADE.

20.

Third Party Rights. CUSTOMER ACKNOWLEDGES THAT MICROSOFT IS NOT A PARTY TO THE AGREEMENT.
NOTHING HEREIN, EXPRESSED OR IMPLIED, IS INTENDED OR SHALL BE CONSTRUED TO CONSTITUTE,
CREATE OR CONFER UPON OR GIVE THE CUSTOMER ANY THIRD-PARTY BENEFICIARY RIGHTS AGAINSTMICROSOFT; OR OTHERWISE IMPOSE UPON MICROSOFT, ANY DIRECT OBLIGATION TO THE CUSTOMERWITH RESPECT TO THE CLOUD ENVIRONMENT. CUSTOMER AGREES THAT ALL CUSTOMER REQUESTS ORCOMMUNICATIONS PERTAINING TO THE SERVICES SHALL (A) BE DIRECTED TO OUTSEER AND NOT TOMICROSOFT; AND (B) CUSTOMER SHALL NOT COMMUNICATE DIRECTLY WITH MICROSOFT WITHOUTOUTSEER’S PRIOR WRITTEN CONSENT.

CONFIDENTIAL

Ver: October 2022_R1-00

page 12 of 12