ARCHER APPLICATION HOSTING SCHEDULE

The use of the hosting services described herein is subject to and expressly conditioned upon acceptance of this Archer Application
Hosting Schedule (“Hosting Schedule”).
This Hosting Schedule is subject to: (i) the applicable License Agreement between RSA and Customer; or if the parties have no suchagreement in place (ii)(a) the End User License Agreement for RSA Products and (ii)(b) the Maintenance Agreement for RSA Products
both currently located at https://www.archerirm.com/company/standard-form-agreements; and (iii) the applicable ordering document
covering the Customer’s purchase of the Hosting Services from RSA or an RSA authorized reseller, the terms of which are incorporated
herein by reference (collectively referred to the “Agreement”).
This Hosting Schedule is a legally binding document between you (meaning the individual person or the entity that the individual
represents that is subscribing to the Hosting Services for its internal productive use and not for outright resale ("Customer")) and RSA(which means (i) If Customer is located in the United States, Mexico or South America, then this is a legal agreement between the
Customer and RSA with “RSA” meaning RSA Security LLC. If Customer is located outside of the United States, Mexico or SouthAmerica, then this is a legal agreement between the Customer and RSA, with “RSA” meaning (ii) RSA Security & Risk Ireland Ltd;or (iii) other authorized RSA or Archer entity as identified on the Archer quote or other Archer ordering document.
Unless RSA agrees otherwise in writing, this Hosting Schedule governs Customer’s use of the Hosting Services except to the extent
all or any portion of the Hosting Services are subject of a separate written agreement set forth in a quotation issued by RSA.
By clicking on the “Agree” or “Accept” or similar button at the end of this Hosting Schedule, or proceeding with the use of the hosting
services or authorizing any other person to do so, you are representing to RSA that you are (i) authorized to bind the Customer; and(ii) agreeing on behalf of the Customer that the terms of this Hosting Schedule shall govern the relationship of the parties with regard
to the subject matter in this Hosting Schedule and are waiving any rights, to the maximum extent permitted by applicable law, to any
claim anywhere in the word concerning the enforceability or validity of this Hosting Schedule.
If you do not have authority to agree to the terms of the Hosting Schedule on behalf of the Customer, or do not accept the terms of this
Hosting Schedule on behalf of the Customer, click on the “Cancel” or “Decline” or other similar button at the end of this Hosting
Schedule and/or immediately cease any further attempt to use the hosting services for any purpose.

ADDITIONAL TERMS AND CONDITIONSThis Hosting Schedule governs the performance by RSA of certain hosting services, as described herein, in relation to the Hosted
Software licensed by Customer under the Agreement. Notwithstanding anything to the contrary in the Agreement, in the event of aconflict between the terms of the Agreement and this Hosting Schedule, the terms of this Hosting Schedule shall prevail solely withrespect to the subject matter hereof. Capitalized words used in this Hosting Schedule and not expressly defined herein will have themeaning stated in the Agreement.
The Hosting Services (as defined below) are performed by RSA in an environment which employs shared infrastructure while
segregating customer data. Hardware infrastructure components, including but not limited to firewalls, load balancers, web servers,
database servers, and storage equipment are shared across multiple customers. Customer data is segmented via the use of separate
directories and databases such that there is no co-mingling of customer data. Service levels and operational procedures are standardized
for all customers due to the shared nature of the platform. RSA’s provision of the Hosting Services in this manner is generally referred
to in the technology community as “Shared Hosting” or “Platform as a Service”.
1.

SCOPE OF SERVICES.

A.
During the Term, RSA will provide the services described in Exhibit 1 attached hereto (the “Hosting Services”) to Customer
in accordance with the service levels set forth in Exhibit 2 hereof in order to allow Customer to access and use the software hosted by

Updated March 2022

RSA in connection with the Hosting Services and as further described in Exhibit 1 attached hereto (referred to herein as the “Hosted
Software”). Customer’s access and use of the Hosted Software will be subject to all those restrictions stated in the Agreement, as wellas any such restrictions contained in the applicable ordering document covering the Hosting Services.
B.
Account Access. RSA will deliver to Customer an application administrator user ID, password and other account information(“Account Access Information”) necessary for Customer to access the Hosted Software in accordance with this Hosting Schedule.
Thereafter, Customer will create and manage Account Access Information for each authorized user of the Hosted Software. Customer
is responsible for all activity occurring under such Account Access Information and shall abide by all applicable local, state, nationaland foreign laws, treaties and regulations in connection with Customer’s use of the Hosting Services, including those related to data
privacy, international communications and the transmission of technical or personal data. Customer shall: (i) notify RSA immediatelyof any unauthorized use of any Account Access Information or any other known or suspected breach of security, and (ii) not impersonate
another RSA user or provide false identity information to gain access to or use the Hosted Software.
2.

CUSTOMER RESPONSIBILITIES.

Customer will provide RSA with the cooperation, access and detailed information reasonably necessary for RSA to implement anddeliver the Hosting Services, including, where applicable, (i) test time on Customer’s computer systems and networks sufficient for
RSA to provide the Hosting Services and (ii) one (1) employee who has substantial computer system, network management and project
management experience satisfactory to RSA to act as project manager and as a liaison between RSA and Customer. RSA will be
excused from its failure to perform any obligation under this Hosting Schedule to the extent such failure is caused by Customer’s delay
or failure to perform its responsibilities under this Hosting Schedule. Customer shall use reasonable and appropriate safeguards toprotect its Customer Data (as defined below).
3.

CUSTOMERDATA.

A.
Ownership and License to Customer Data.
As between Customer and RSA, Customer owns and will own all right,
title and interest in and to any data provided by Customer to RSA in connection with Customer’s use of the Hosting Services (“Customer
Data”). During the Term, Customer grants to RSA a limited, non-exclusive license to use the Customer Data solely for all reasonable
and necessary purposes contemplated by this Hosting Schedule and for RSA to provide the Hosting Services. Customer, not RSA, shallhave sole responsibility for the accuracy, quality, integrity, legality, reliability, appropriateness and intellectual
property ownership or right to use of all Customer Data. RSA shall not be responsible or liable for any deletion, destruction, damage,or loss of any Customer Data that is caused by Customer. RSA reserves the right to withhold, remove and/or discard Customer Data
upon 15 days prior written notice for any breach of this Hosting Schedule by Customer, including, without limitation, for any failure
by Customer to pay any amounts due under this Hosting Schedule. In the event this Hosting Schedule and/or the Agreement isterminated (other than by reason of Customer’s breach), and if Customer so requests at the time of termination, RSA will makeavailable to Customer a file of all Customer Data within RSA’s possession within thirty (30) days of termination.
B.
Restrictions on Storage of Regulated Data.
RSA shall use reasonable and appropriate administrative, technical andphysical safeguards to protect the security, integrity and confidentiality of personal contact information that may be stored on the RSA
servers, such as name, address, telephone number, and/or e-mail address. However, Customer acknowledges and agrees that 1) the
Hosting Services are not intended or designed to securely host and store any “personal information” that is “sensitive” by nature ordeemed “sensitive” by any applicable laws or regulations (such as social security numbers, credit card data, drivers license numbers,
national ID numbers, bank account numbers, and health/medical information), and Customer shall not store any such information on
the Hosting Services, and 2) RSA will have no visibility into the types of information uploaded into or stored on the Hosting Services
by Customer.
4.

TERM AND TERMINATION.

A.
Term and Renewal. Unless otherwise terminated in accordance with the Agreement, the Hosting Services shallcommence on the date RSA first provides Customer with the Account Access Information and will continue for the Term stated in theordering document.
B.
Termination of the Agreement. This Hosting Schedule shall automatically terminate upon the termination of Customer’s
right to use the Software pursuant to the ordering document.
5.

WARRANTY.

A.
Hosting Services Warranty.
RSA warrants that such Hosting Services shall be performed in a workmanlike mannerconsistent with generally accepted industry standards and best practices of leading companies in the critical data storage and security
industry. With the exception of any Service Level Credits which may be due to Customer pursuant to Exhibit 2 hereto, RSA’s entire
liability and Customer’s exclusive remedy under the foregoing warranty shall be for RSA where possible to use commerciallyreasonable efforts to re-perform any nonconforming Hosting Services within a reasonable time, or if not possible or after reasonable
efforts RSA is unable to perform the Hosting Services as warranted, Customer shall be entitled to recover the portion of the Hosting

Updated March 2022

Services fees paid to RSA that corresponds to the nonconforming Hosting Services.
B.
Disclaimer of Warranties. EXCEPT AS EXPRESSLY STATED IN THIS WARRANTY SECTION, RSA PROVIDESHOSTING SERVICES “AS IS” AND MAKES NO OTHER EXPRESS WARRANTIES, WRITTEN OR ORAL, AND ALL OTHERWARRANTIES ARE SPECIFICALLY EXCLUDED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, AND ANY WARRANTYARISING BY STATUTE, OPERATION OF LAW, COURSE OF DEALING OR PERFORMANCE, OR USAGE OF TRADE.

Confidential – September 2020

Updated March 2022

EXHIBIT 1
HOSTING SERVICES
During the Term, RSA will provide Customer, through the World Wide Web, limited access to, and use of, the Hosted Software andHosting Services described herein.
1.

HOSTED SOFTWARE.

Hosted Software means the Software licensed under the Agreement and hosted by RSA pursuant to this Hosting Schedule and which
consists of those components stated in Customer’s accepted order for RSA’s application generally known as “RSA Archer eGRC
Platform”.
2.

HOSTING SERVICE PACKAGES.

The Hosting Services are offered in several package levels. Customer’s accepted order for the Hosting Services will state whichpackage is selected, along with the permitted Concurrent Users (1), Content Records (2), and Storage (3).
(1) Concurrent Users: Refers to total permitted concurrent users.
(2) Content Records: Refers to total permitted RSA application records.
(3) Storage: Refers to total permitted storage (documents and database).
3.

RSA OBLIGATIONS.

A.

General.

RSA will supply and maintain adequate heating/cooling, electrical power, server hardware, network infrastructure and bandwidth
necessary to provide the Hosting Services. While any Customer Data resides on any RSA server, RSA will provide technologicalmeasures, such as data encryption (SSL) for data transmission and computer server “Firewalls,” in a commercially reasonable effort
consistent with the level of protection provided by generally accepted industry standards and best practices of leading companies in
the critical data storage and security industry to restrict access to Customer Data by unauthorized users.
B.

Application Upgrades.

During the Term, RSA reserves the right to make modifications, including upgrades, patches, revisions or additions to the Hosting
Services subject to the terms set forth in Exhibit 2.
C.

Backup Management.

During the Term, RSA shall perform regular data backups of Customer Data. Such data back-ups will be encrypted, sent off-site to asecure location each business day, and stored/retained for one (1) year.
D.

Virus Protection.

RSA will install commercially reasonable malicious code detection software, to include virus detection and malware detectors, on all
systems underlying the Hosted Software and Hosting Services and used to access, process or store Customer Data. In addition, allanti-virus definition files shall be updated regularly, and shall provide protection consistent with generally accepted industry standards
and best practices of leading companies in the critical data storage and security industry. For the avoidance of doubt, Customer
remains responsible for protecting its own systems by installing, updating, and maintaining industry standard malware protection.
E.

Hardware and Operating System Management.

RSA shall perform hardware maintenance, monitoring and problem resolution, and operating system maintenance, patching,upgrading, monitoring and problem resolution in accordance with the terms set forth in Exhibit 2.
F.

Capacity.
Confidential – September 2020

Updated March 2022

RSA will provide appropriate capacity to support the Hosting Services stated on Customer’s accepted order.
G.

Disaster Recovery.

In the event of a Force Majeure Event, RSA will recover the Hosting Services and Customer Data within a forty-eight (48) hour
period. Customer Data will be recovered from the latest nightly backup that is available.
H.

Audit Logging.

RSA will monitor and log all system access to the Hosting Services to produce an audit trail that includes, but is not limited to, webserver logs, application logs, system logs, and network event logs. Such logs are RSA confidential information, but will be disclosed
as necessary to comply with applicable law.

Confidential – September 2020

Updated March 2022

EXHIBIT 2
SERVICE LEVELSThis Exhibit 2 relates to the availability of the Hosting Services only. Application support for the Hosted Software (including software
error correction, delivery of Updates, and Customer technical support) is provided separately and as further described in the Agreement
and/or Customer’s accepted order for the Software and associated maintenance services.
I.

SERVICE LEVELS FOR PRODUCTION ENVIRONMENT.

This Section I of Exhibit 2 applies to Hosting Services for any Hosted Software in RSA’s production environment (“Production
Environment”). The Production Environment comprises the applications, systems, software, and supporting infrastructure that
customers access and use on an operational basis to execute their business processes via the Hosted Software. Hosting Services
pertaining to development, user acceptance testing, pre-production staging, and the like are not part of the Production Environment
and are, instead, part of the Non-Production Environment (as set forth in Exhibit 2, Section II).
1.

DEFINITIONS.

In addition to those defined terms stated in the Hosting Schedule and the Agreement, the following terms and definitions shall apply
for the purpose of this Exhibit 2, Section I:
TermDefinition

At-Risk Amount

Twenty-five percent (25%) of the annual Hosting Services fee as prorated on a monthly basis (being
the annual Hosting Services fee divided by 12), and which may be credited to Customer in the event
where the applicable Service Level is not achieved.

Production
Availability

In any given month, Potential Production Uptime less Production Downtime, divided by Potential
Production Uptime, expressed as a percentage.

Production Downtime

The amount of time, measured in minutes, in a given month that the Hosting Services are notavailable in the Production Environment as a result of a Production Service Interruption.

Force Majeure Events

Strikes, riots, insurrection, terrorism, fires, natural disasters, acts of God, war, governmental action,or any other cause which is beyond the reasonable control of RSA.

Static Production
Maintenance Window

The period of time every Sunday from 12:00am CST/CDT to 4:00am CST/CDT during which
maintenance is conducted on the Hosting Services in the Production Environment. The Hosting
Services may be unavailable in the Production Environment during this period.

Potential Production
Uptime

The amount of time that the Hosting Services should be available in each month in the Production
Environment, excluding the Static Production Maintenance Window and any Scheduled Production
Maintenance Window(s). For example, the Potential Production Uptime in June in a year where June
has 4 Sundays and no Scheduled Production Maintenance Windows would be calculated in minutes
as (30 days x 24 hours x 60 minutes) – (4 Sundays x 4 hours x 60 minutes) or 42,240 minutes.
Maintenance of the Hosting Services in the Production Environment that cannot be conducted during
the Static Production Maintenance Window, where RSA has provided notice to Customer as far inadvance as reasonably practical (but in no event less than five business days for non-emergency
maintenance and in no event less than 48 hours for emergency maintenance) before thecommencement of such maintenance, which specifies the anticipated impact of such maintenance on
availability, including duration. RSA will use commercially reasonable efforts to minimize theimpact of any Scheduled Production Maintenance Window to its customers by scheduling any such
Scheduled Production Maintenance Windows during low utilization periods whenever reasonably
practical.
The unavailability of the Hosting Services in the Production Environment, or any material portion
thereof, caused by, resulting from, or attributable to software, hardware, or equipment owned orcontrolled by RSA or its agents, except for the Static Production Maintenance Window and/or the
Scheduled Production Maintenance Window(s).

Scheduled Production
Maintenance Window

Production Service
Interruption

Confidential – September 2020

Updated March 2022

Service Level Credits
Service Levels
Weighting Factor
2.

The credits payable by RSA to Customer for a failure to meet the Service Levels, as set out in
Section I.3 of this Exhibit 2.
The service delivery criteria established for the Hosting Services, as set out in Section I.3 of thisExhibit 2.
The percentages set forth in Section I.3 of this Exhibit 2.

PRODUCTION HOSTING SERVICES INTERRUPTIONS.

A.
Measurement. Production Downtime is measured from the time RSA responds to a notification from Customer inconnection with a confirmed Production Service Interruption to the time the Hosting Services are operational in the Production
Environment.
B.
Exclusions.
Unavailability of the Hosting Services in the Production Environment shall not be considered a Production
Service Interruption to the extent that it is caused by one or more of the following factors:(i)Customer’s failure to perform its obligations under the Agreement;(ii)

The written request or consent by Customer’s representative to interrupt the Hosting Services in the Production
Environment, specifically acknowledging that such interruption shall not count as Production Downtime, up to theamount of time set forth in such request or consent;(iii)

Anything inside Customer’s internal network, including, but not limited to, firewall configuration and bandwidth tointernet, local area workstations, servers, software, and configuration; and(iv)

Force Majeure Events.

RSA shall be solely responsible for establishing the extent to which Production Service Interruptions are caused by one or more of theabove factors.
3.

PRODUCTION SERVICE LEVELS AND MEASUREMENT.

A.
General.
RSA shall provide the Hosting Services in the Production Environment in a manner that meets or exceeds
the requirements of this Section I.3 (the “Production Service Levels”).
B.
Production Service Levels.
RSA’s Production Service Level commitment for the Hosting Services Production
Availability is 99.5% or higher, when calculated as average performance over a calendar month.
Service Metrics
Hosting Services
Production
Availability

Service Level
Less than 90% Production Availability
90.0 – 94.9% Production Availability
95.0 – 99.9% Production Availability

Weighting Factor
20%
10%
0%

C.
Service Level Credits. If RSA fails to perform the Hosting Services in accordance with the Production Service Levels,
Customer may request a credit on future charges payable under Customer’s order for the Hosting Services and as calculated in Section
I.3.E.
D.
Service Level Credit Calculation.
For any given month, in the event that RSA fails to meet any of the Production
Service Levels, Customer may request the applicable Service Level Credit as follows:
Service Level Credits ( in $) = (Weighting Factor applicable to missed Production Service Level) x At-Risk-AmountThe actual amount credited to Customer as Service Level Credits for any given month shall not exceed the At-Risk Amount for suchmonth. Notwithstanding any other provision in this Hosting Schedule, or the Agreement, the Service Level Credits shall be
Customer’s sole and exclusive remedy for any breach of the terms of this Section I of Exhibit 2.
E.
Credit Request and Payment Procedures.
To receive a Service Level Credit, Customer (for logging/tracking purposes)
must make a request by sending an e-mail message to archersupport@rsa.com. Each request in connection with this Section I.3(E)must include the dates and times of the Production Service Interruption and must be received by RSA within five (5) business days
Confidential – September 2020

Updated March 2022

after receiving the report described under Section I.4 below. If the Production Service Interruption is confirmed by RSA, Service
Level Credits will be applied within two billing cycles after RSA’s receipt of Customer’s credit request. Credits are not refundable
and can be used only towards future billing charges.
4.

SERVICE LEVEL REPORTING.

To receive a report assessing RSA’s performance against the Production Service Levels during the previous month, Customer (forlogging/tracking purposes) must make a request by sending an e-mail message to archersupport@rsa.com no later than the 20th day of
the next month. RSA shall measure and report on minutes of Potential Production Uptime, Production Downtime, and Production
Availability for the Hosting Services in the Production Environment.
5.

GENERAL OBLIGATIONS.

RSA will use reasonable commercial efforts consistent with generally accepted industry standards and best practices of leading
companies in the critical data storage and security industry to: (i) protect the Hosting Services and supporting infrastructure controlled
or maintained by RSA per Section 3 of Exhibit 1; (ii) monitor the Hosting Services and supporting infrastructure controlled or
maintained by RSA for problems; (iii) identify root causes; (iv) correct problems; and (v) minimize recurrences of missed Production
Service Levels for which it is responsible. Notwithstanding anything to the contrary in this Section I of Exhibit 2, should a Force
Majeure Event result in a Production Service Interruption and a Non-Production Service Interruption (as defined in Section II of
Exhibit 2), RSA will focus its efforts on restoring availability of the Hosted Services first to the Production Environment, and then to
the Non-Production Environment.
II.

SERVICE LEVELS FOR NON-PRODUCTION ENVIRONMENT.

This Section II of Exhibit 2 applies to Hosting Services for any Hosted Software in RSA’s non-production environment (“NonProduction Environment”). Consistent with generally accepted industry standards and best practices of leading companies in thecritical data storage and security industry, the Non-Production Environment comprises the applications, systems, software andsupporting infrastructure that customers access and use for development, user acceptance testing, pre-production staging, and the like.
1.

DEFINITIONS.

In addition to those defined terms stated in the Hosting Schedule and the Agreement, the following terms and definitions shall apply
for the purpose of this Exhibit 2, Section II:
Term
Non-Production
Availability
Non-Production
Downtime
Force Majeure
EventsStatic NonProduction
MaintenanceWindow
Potential NonProduction Uptime

Scheduled NonProduction
MaintenanceWindow
Non-Production
Service Interruption

Definition
In any given month, Potential Non-Production Uptime less Non-Production Downtime, divided byPotential Non-Production Uptime, expressed as a percentage.
The amount of time, measured in minutes, in a given month that the Hosting Services are not available in
the Non-Production Environment as a result of a Non-Production Service Interruption.
Strikes, riots, insurrection, terrorism, fires, natural disasters, acts of God, war, governmental action, or any
other cause which is beyond the reasonable control of RSA.
The period of time every Sunday from 12:00am CST/CDT to 4:00am CST/CDT, during which
maintenance is conducted on the Hosting Services in the Non-Production Environment. The Hosting
Services may be unavailable in the Non-Production Environment during this period.
The amount of time that the Hosting Services should be available in the Non-Production Environment ineach month, excluding the Static Non-Production Maintenance Window and any Scheduled NonProduction Maintenance Window(s). For example, the Potential Uptime in June in a year where June has 4
Sundays and no Scheduled Non-Production Maintenance Windows would be calculated in minutes as (30days x 24 hours x 60 minutes) – (4 Sundays x 4 hours x 60 minutes) or 42,240 minutes.
Maintenance of the Hosting Services in the Non-Production Environment conducted at any time during theweek that cannot be conducted during the Static Non-Production Maintenance Window, where RSA has
provided notice to Customer as far in advance as reasonably practical (but in no event less than 48 hours)
before the commencement of such maintenance, which specifies the anticipated impact of such
maintenance on availability, including duration.
The unavailability of the Hosting Services in the Non-Production Environment, or any material portion
thereof, caused by, resulting from, or attributable to software, hardware, or equipment owned or controlled
by RSA or its agents, except for the Static Non-Production Maintenance Window and/or the Scheduled
Non-Production Maintenance Window(s).
Confidential – September 2020

Updated March 2022

3.

NON-PRODUCTION SERVICE LEVELS AND MEASUREMENT.

A.
General.
RSA shall use commercially reasonable efforts to provide the Hosting Services in the Non-Production
Environment in a manner that meets or exceeds the requirements of this Section II.3 (the “Non-Production Service Levels”).
B.
Non-Production Service Levels. RSA’s Non-Production Service Level objective for the Hosting Services Non-Production
Availability is 98.0% or higher, when calculated as average performance over a calendar month.
C.
Service Level Credits. Customer acknowledges that Hosting Services in the Non-Production Environment are at-risk
services given that they are in support of Customer development, user acceptance testing, pre-production staging, and preview(s) of
upcoming Hosting Services changes to the Production Environment as defined in Exhibit 2, Section I. As such, Hosting Services
provided in the Non-Production Environment are not eligible for credits on future charges as a result of any failure to meet or exceed
the requirements of this Section II.3.
4.

GENERAL OBLIGATIONS.

RSA will use reasonable commercial efforts to: (i) protect the Hosting Services and supporting infrastructure controlled or maintainedby RSA per Section 3of Exhibit 1; (ii) monitor the Hosting Services and supporting infrastructure controlled or maintained by RSA for
problems in the Non-Production Environment; (iii) identify root causes; (iv) correct problems; and (v) minimize recurrences of missed
Non-Production Service Levels for which it is responsible. Notwithstanding anything to the contrary in this Section II of Exhibit 2,should a Force Majeure Event result in a Non-Production Service Interruption and a Production Service Interruption as defined in
Section I of Exhibit 2, RSA will focus its efforts on restoring availability of the Hosted Services first to the Production Environment,
and then to the Non-Production Environment.

Confidential – September 2020

Updated March 2022