EX-10.1



 Exhibit 10.1 
 ADDENDUM TO MASTER SERVICES AGREEMENT 
 Addendum, dated as of
September 22, 2011, between Internap Network Services Corporation and SoundBite Communications, Inc. (“SoundBite”), to the Master Services Agreement, dated August 28, 2003 (the “Agreement”). 

 

	1.	As the parties wish to add security requirements to the Agreement, the parties agree to add Attachment A attached to this Addendum to the Agreement.


  

	2.	If there is a conflict between the terms of this Addendum and the terms of the Agreement, this Addendum shall control. Except as modified by this Addendum, the
Agreement shall continue to apply. 

  

									
	INTERNAP NETWORK SERVICES CORPORATION	 		 	SOUNDBITE COMMUNICATIONS, INC.
					
	By:	 	



	 		 	By:	 	




		 	  
	 		 		 	  

					
	Name:	 	 Bruce S. Hoffman
	 		 	Name:	 	 Robert C. Leahy

					
	Title:	 	 Director of Sales
	 		 	Title:	 	 COO & CFO

					
	Date:	 	 9/21/2011
	 		 	Date:	 	 9/22/11



  
 [Page 1 of 14]









 ATTACHMENT A 
 INFORMATION SECURITY STANDARD 
 Introduction 

This SoundBite Information Security Standard defines the information protection controls used to protect SoundBite Information and applies to any
organization (Company) that stores, processes, transmits, or access that information. SoundBite uses these controls internally and, to the degree that a vendor to SoundBite handles SoundBite Information, particularly SoundBite Confidential
Information or SoundBite Highly Confidential Information, SoundBite requires that Company meet these security requirements as well. 
 This
standard is based on industry-accepted standards including, but not limited to, the PCI DSS, NIST 800-53, and ISO 27002. 
 This standard
reflects the superset of SoundBite’s information protection requirements which originate from SoundBite’s regulatory requirements, contractual requirements, and internal risk management requirements. 

 

	1.	Definitions 

  

	 	1.1.	Information Security Executive Sponsor – Company executive officer or director with ultimate responsibility for the Information Security Program.


  

	 	1.2.	Information Security Officer – Person responsible for the day-to-day management of the Information Security Program. 


 

	 	1.3.	Information Security Policy – Company policy documents that outlines high-level requirements or rules that define the Information Security Program.
Compliance is mandatory. 

  

	 	1.4.	Information Security Program – The people, processes, and technology required to implement, to operate, to manage, to maintain, and to assure conformance by
Company with the Information Security Plan and Information Security Policies. 

  

	 	1.5.	Malicious Code – Viruses, worms, Trojans, back-doors, root kits, malware and any other software that may disrupt business or compromise data confidentiality
or integrity. 

  

	 	1.6.	Security Incident – Any event including, but not limited to, a hacking attack, system compromise, information mishandling, policy violation, loss of
information, theft of information, or fraud that Company knows or suspects might have resulted in a failure to protect the confidentiality of SoundBite Confidential Information. 


 

	 	1.7.	Service – Any services or work performed on behalf of SoundBite Communications. 


 

	 	1.8.	SoundBite Confidential Information – Any information or data made available to Company by SoundBite except for information contractually excluded from
confidentiality obligations, such as public information. SoundBite Highly Confidential Information is a subset of SoundBite Confidential Information. 

  

	 	1.9.	 SoundBite Highly Confidential Information – Any information or data made available to Company by SoundBite that includes information that
could be used to identify a person. This includes but is not limited to consumer names when provided in conjunction with identifying information such as a phone number, Card Holder Data (CHD) as defined by the Payment Card Industry (PCI) Data
Security Standard (DSS), Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act of 1996 (P.L.104-191) (HIPAA), Non-Public Personal Information (NPI) as defined by section




  
 [Page 2 of 14]










	 	
501(b) of the Gramm-Leach-Bliley Act of 1999 (GLBA), and Personal Information (PI) as defined by the Mass Privacy Act (M.G.L. 93 H, 93 I, and 201 CMR 17.00). SoundBite Highly Confidential
Information is a subset of SoundBite Confidential Information. 

  

	 	1.10.	Staff – All Company employees, contractors, sub-contractors, consultants, or other parties who may use Company’s information systems or access
SoundBite’s information systems or SoundBite Confidential Information. 

  

	 	1.11.	Standard – This document: The SoundBite Communications Information Security Standard. 


 

	 	1.12.	Strong Encryption – Encryption performed using industry-standard cryptographic algorithms such as AES, 3DES, SHA, RSA, and RC4 where a minimum key length of
128 bits is used for symmetric ciphers and a minimum key length of 1024 bits is used for asymmetric ciphers. 

  

	 	1.13.	Un-trusted Networks – The Internet and any network not operated by Company alone or by Company in exclusive collaboration with SoundBite.


  

	 	1.14.	Written Information Security Plan – A formal document that defines the objectives of the Information Security Program, assigns responsibility for the
Information Security Program, and describes how the responsible parties either do or will achieve the objectives of the Information Security Program. 

  

	2.	SoundBite Information Security Standard 

  

	 	2.1.	Information Security Program Governance 

  

	 	2.1.1.	Information Security Program Ownership 

  

	 	2.1.2.	Risk Management 

  

	 	2.1.2.1.	Company must have a formal risk analysis and management process that documents the organization’s assets, the threats against those assets, the inherent
vulnerability of the assets to those threats, and the controls designed to protect the assets from the threats. 

  

	 	2.1.2.2.	Company must conduct an annual risk assessment so as to evaluate the effectiveness of the controls and ultimately determine the residual risk to the assets.


  

	 	2.2.	Information Security Policy 

  

	 	2.2.1.	Company must have, maintain and follow a Written Information Security Plan 


 

	 	2.2.2.	Company must have and adhere to a written and comprehensive set of Information Security Policy documents. The Information Security Policy documents must, at a minimum,
include the following content: 

  

	 	2.2.2.1.	The following, overarching content shall either be included in all policy documents or in an overarching policy document that governs all other security policy
documents: 

  

	 	2.2.2.1.1.	A definition of information security or information security mission statement, including, but not limited to, the policy’s overall objective and scope.



  
 [Page 3 of 14]










	 	2.2.2.1.2.	A statement of management intent to support the goals and principals of information security in line with business strategy and objectives, 


 

	 	2.2.2.1.3.	Control objectives, including, but not limited to, risk assessment and risk management. 


 

	 	2.2.2.1.4.	A brief overview of security policies, principles, and standards. 

  

	 	2.2.2.1.5.	Regulatory and industry standards compliance requirements. 

  

	 	2.2.2.1.6.	Policy maintenance requirements. 

  

	 	2.2.2.1.7.	Penalties for policy violations, which must include actions up to and including termination. 


 

	 	2.2.2.2.	The following specific security policy topics must be addressed by one or more Information Security Policy documents: 


 

	 	2.2.2.2.1.	Asset Management, including, but not limited to, hardware, software, and information 


 

	 	2.2.2.2.2.	Third Party Service Provider Security 

  

	 	2.2.2.2.3.	Access Control 

  

	 	2.2.2.2.4.	Acceptable Use, including, but not limited to, email usage, computer and communications systems access and use, and Internet/ intranet access and use


  

	 	2.2.2.2.5.	Anti-Virus 

  

	 	2.2.2.2.6.	Authentication and Identity Management 

  

	 	2.2.2.2.7.	Background Check 

  

	 	2.2.2.2.8.	Change Management 

  

	 	2.2.2.2.9.	Incident Response 

  

	 	2.2.2.2.10.	Information Classification 

  

	 	2.2.2.2.11.	Logging and Security Monitoring 

  

	 	2.2.2.2.12.	Passwords 

  

	 	2.2.2.2.13.	Physical and Environmental Security 

  

	 	2.2.2.2.14.	Risk Assessment 

  

	 	2.2.2.2.15.	System and Network Device Configuration and Hardening 

  

	 	2.2.2.2.16.	Security Awareness 

  

	 	2.2.2.2.17.	New Hire, Role Change, and Termination 

  

	 	2.2.2.2.18.	Vulnerability Management 

  

	 	2.2.2.2.19.	Equipment Installation and Removal 

  

	 	2.2.2.2.20.	Segregation of Duties 

  

	 	2.2.2.2.21.	Third Party Connectivity 


  
 [Page 4 of 14]










	 	2.2.2.2.22.	Incident Reporting 

  

	 	2.2.2.2.23.	Emergency Operations Plan 

  

	 	2.2.2.2.24.	Testing and Revision Procedures 

  

	 	2.2.3.	All policies must be communicated to staff and staff must acknowledge that they will comply with the policies. 


 

	 	2.2.4.	Company must have in place a disciplinarily process for non-compliance with the Information Security Policy. 


 

	 	2.3.	Background Checks 

  

	 	2.3.1.	Prior to assigning any individual to perform the Services in the United States, or, if Services are to be performed outside of the United States, to the maximum extent
permitted under local law, Company shall perform background checks consisting of the following: 

  

	 	2.3.1.1.	SSN Verification – Search of the individual’s Social Security number, tax ID number or other applicable government-issued identifier to verify the accuracy of
the individual’s identity and current and previous addresses. 

  

	 	2.3.1.2.	Criminal Checks – A criminal background search performed by an independent, professional search firm of all court records (at least National and County within the
US) in each jurisdiction of the individual’s current and previous addresses over the past seven (7) years. 

  

	 	2.3.1.3.	Reference Checks – Verification of previous employers and a minimum of at least two (2) confirmed work references. 


 

	 	2.3.1.4.	Education – Verification of education listed on the candidates resume or otherwise noted by the candidate. 


 

	 	2.3.1.5.	Credit Checks – Credit Report for Finance and Senior Level Executives 


 

	 	2.3.1.6.	DMV Checks Department of Motor Vehicles for all employees in Sales positions. 


 

	 	2.3.1.7.	Citizenship – Validation of citizenship or certification to work in the country in which the individual is assigned. 


 

	 	2.3.2.	Where an individual has ended his/her employment with Company and has been re-hired by Company, irrespective of the amount of time that has elapsed, a new background
check must be performed. 

  

	 	2.3.3.	Company shall utilize a specialist vetting company for the performance of background checks. The Company is wholly accountable for compliance with this Standard.


  

	 	2.3.3.1.	Company shall retain evidence of all background checks performed for a period of at least two years. These records shall document the checks performed and their
outcome. 

  

	 	2.3.4.	 In the event that any staff is found to have been convicted of and/or have any active/pending charges for any Disqualifying Offense listed below, that
person shall be prevented from accessing any SoundBite Confidential Information and 



  
 [Page 5 of 14]










	 	
that person shall be prevented from entering SoundBite’s facilities. Additionally, in the event that the person has already had access to any SoundBite Confidential Information, Company must
notify SoundBite immediately and in no event later than the next business day. 

  

	 	2.3.4.1.	Disqualifying Offenses 

  

	 	2.3.4.1.1.	Dishonesty including, but not limited to felony convictions in the following categories: 


 

	 	2.3.4.1.1.1.	Fraud Offenses 

  

	 	2.3.4.1.1.1.1.	Credit Card Fraud 

  

	 	2.3.4.1.1.1.2.	Credit Card Fraud 

  

	 	2.3.4.1.1.1.3.	Embezzlement 

  

	 	2.3.4.1.1.1.4.	Bad/Worthless Checks 

  

	 	2.3.4.1.1.2.	Fraudulent Trading 

  

	 	2.3.4.1.1.3.	Possession of Stolen Property 

  

	 	2.3.4.1.1.4.	Forgery and Counterfeiting 

  

	 	2.3.4.1.1.5.	Proceeds of Criminal Offenses 

  

	 	2.3.4.1.1.6.	Theft 

  

	 	2.3.4.1.1.7.	Bribery and/or Corruption 

  

	 	2.3.4.1.1.8.	Money Laundering 

  

	 	2.3.4.1.1.9.	Concealment of Property 

  

	 	2.3.4.1.1.10.	Trespassing with Intent to Steal (Burglary) 

  

	 	2.3.4.1.1.11.	Blackmail/Extortion 

  

	 	2.3.4.1.2.	Business Offenses 

  

	 	2.3.4.1.2.1.	Any offense involving computer misuse 

  

	 	2.3.4.1.2.2.	Organizing or engaging in illegal work 

  

	 	2.3.4.1.2.3.	Economic, Corporate, or Business Espionage 

  

	 	2.3.4.1.3.	Crimes Against Persons 

  

	 	2.3.4.1.3.1.	Serious sexual offenses or offenses against children 

  

	 	2.3.4.1.3.2.	Racially motivated or discrimination offenses 

  

	 	2.3.4.1.3.3.	Murder or manslaughter 

  

	 	2.3.4.1.3.4.	Crimes involving assault, violence, or threatening behavior 

  

	 	2.3.4.1.3.5.	Human trafficking 

  

	 	2.3.4.1.4.	Other 

  

	 	2.3.4.1.4.1.	Felony (US) or host country equivalent serious crime 


  
 [Page 6 of 14]










	 	2.3.4.1.4.2.	Producing, supplying, importing, or trafficking controlled drugs/substances 


 

	 	2.3.4.1.4.3.	Firearms and explosives offenses 

  

	 	2.3.4.1.4.4.	Terrorism 

  

	 	2.3.4.1.4.5.	Pretrial Diversions (US) for disqualifying crimes 

  

	 	2.3.4.1.4.6.	Deferred Adjudication for disqualifying crimes 

  

	 	2.3.4.1.4.7.	More than 2 misdemeanor convictions (US) or host country equivalent minor crimes relating to fraud, ethics, or other topics covered in this section, , within past 5
years. 

  

	 	2.3.4.1.4.8.	Convictions (US) involving imprisonment for terms of six months or greater (whether or not all of that term was served) 


 

	 	2.4.	Access Control 

  

	 	2.4.1.	Company must have a user identification process in place that validates the identity of each user. For example, in the United States, using the process defined by the
Form I-9, Employment Eligibility Verification, as published by the Department of Homeland Security U.S. Citizenship and Immigration Services, (This is the standard employment verification process required in the U.S. wherein an employee
presents certain government issued IDs to the employer to prove their identity and right to work.) 

  

	 	2.4.2.	Company shall have appropriate new-hire, role-change, and terminations processes that ensure that: 


 

	 	2.4.2.1.	User accounts are appropriately created and disabled or removed 

  

	 	2.4.2.2.	Information access privileges for all user accounts are appropriately enabled and disabled 


 

	 	2.4.3.	Company must have an access control process that: 

  

	 	2.4.3.1.	Assigns access rights based on roles 

  

	 	2.4.3.2.	Provides for segregation of duties between information owners (who approve access changes) and information custodians (who implement access changes)


  

	 	2.4.3.3.	Updates access rights based on personnel or system changes 

  

	 	2.4.3.4.	Requires the periodic review of access rights for all systems that store, process, transmit, or access SoundBite Confidential Information. These reviews must be
conducted on at least a quarterly basis. More frequent reviews may be required based on the risk to the application or system. 

  

	 	2.4.4.	Access to Company system components and SoundBite Confidential Data must be restricted based on a user’s need to know and be set to “deny all” unless
specifically allowed. 


  
 [Page 7 of 14]










	 	2.4.5.	All Company users must have BOTH: 

  

	 	2.4.5.1.	A unique User ID 

  

	 	2.4.5.2.	Either a password/passphrase or two-factor authentication 

  

	 	2.4.5.2.1.	Company must have an appropriate password policy in place: 

  

	 	2.4.5.2.1.1.	Passwords must contain a minimum of 8 characters 

  

	 	2.4.5.2.1.2.	Passwords must contain 3 out of 4 of the following character types: 

  

	 	2.4.5.2.1.2.1.	Uppercase letters 

  

	 	2.4.5.2.1.2.2.	Lowercase letters 

  

	 	2.4.5.2.1.2.3.	Numbers 

  

	 	2.4.5.2.1.2.4.	Special characters, for example, 

  

	 	    	~, !, @, #, $, %, ^, &, *, (, ), _, +, 

  

	 	    	-, =, [, ], \, ;, ‘, ,, ., /, :, “ 

  

	 	2.4.5.2.1.3.	Passwords are changed after a maximum of 60 days 

  

	 	2.4.5.2.1.4.	Previous 10 passwords are not allowed to be reused 

  

	 	2.4.5.2.1.5.	User is locked out after not more than 5 failed login attempts 

  

	 	2.4.5.2.1.6.	User is automatically logged out after not more than 15 minutes of inactivity 


 

	 	2.4.5.2.2.	Passwords/passphrases are to be encrypted with strong encryption in transit and at rest. 


 

	 	2.4.5.2.3.	Two-factor authentication is defined as the use of two of the following authentication types: 


 

	 	2.4.5.2.3.1.	Something the user knows, like a password 

  

	 	2.4.5.2.3.2.	Something the user has, like a SecurID token or digital certificate 

  

	 	2.4.5.2.3.3.	Something the user is, like a fingerprint 

  

	 	2.5.	Operational Security 

  

	 	2.5.1.	Company must have operating procedures that are documented, reviewed and maintained by an owner, and made available to all users who need them.


  

	 	2.5.2.	Company must have a formal, documented change management and change control process. 


 

	 	2.5.3.	Changes managed according to the change management process must be documented, for example, using a change control ticketing system. 


 

	 	2.5.4.	Company must prohibit Staff from connecting to networks, systems, databases, or applications that contain SoundBite Confidential Information from any system not
exclusively managed by Company according to this Information Security Standard. For example, Staff would typically not be able to access SoundBite Confidential Information from their personally-owned computers. 


  
 [Page 8 of 14]










	 	2.5.5.	Company must have processes and mechanisms established for the security hardening and maintenance of servers, workstations, network devices, and off-the-shelf
applications, including, but not limited to, Web server software, application server software, and database server software. 

  

	 	2.5.5.1.	Implement only one primary function per server 

  

	 	2.5.5.2.	Disable all unnecessary services and insecure protocols (e.g. telnet) 

  

	 	2.5.5.3.	Configure system security parameters to prevent misuse 

  

	 	2.5.5.4.	Remove all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems and unnecessary web servers 


 

	 	2.5.6.	Company must use industry-standard anti-virus software on all applicable systems. Applicable systems shall include, at a minimum, all systems that run any version of
the Microsoft Windows operating system, inbound and outbound e-mail systems, and any other systems that Company identifies, during its risk assessment process, as potentially being susceptible to Malicious Code. This antivirus requirement shall not
apply to e-mail solutions the sole function of which is the sending of system-generated e-mail content. 

  

	 	2.5.6.1.	Anti-virus solutions [or combination of solutions] must address all types of Malicious Code. 


 

	 	2.5.6.2.	Systems must be maintained with daily anti-virus signature updates. 

  

	 	2.5.6.3.	Systems must use a current and supported versions of the Anti-Virus solution utilized. 


 

	 	2.5.7.	Company must utilize a reasonable process to monitor its systems for vulnerabilities. Options include vulnerability scanning and monitoring information sources for
advisory and/or patch publications. 

  

	 	2.5.7.1.	In the event that Company becomes aware of a vulnerability, they will endeavor to remediate the vulnerability within 30 days. 


 

	 	2.5.8.	Company must implement an appropriate logging solution or solutions for all physical security systems. The logging solution or solutions must be appropriately secured
to prevent tampering. 

  

	 	2.5.8.1.	At a minimum, the following event types must be logged: 

  

	 	2.5.8.1.1.	Individual access to SoundBite cage 

  

	 	2.5.8.1.2.	Actions taken by any individual with administrative access to physical security systems 


 

	 	2.5.8.1.3.	Access to all audit trails 

  

	 	2.5.8.1.4.	Invalid login access attempts 

  

	 	2.5.8.1.5.	Use of identification and authentication mechanisms 

  

	 	2.5.8.1.6.	Initialization of the audit logs 

  

	 	2.5.8.1.7.	Creation and deletion of system-level objects 

  

	 	2.5.8.2.	When logging events, the following information must be logged: 

  

	 	2.5.8.2.1.	User ID 


  
 [Page 9 of 14]










	 	2.5.8.2.2.	Type of event 

  

	 	2.5.8.2.3.	Data and time of event 

  

	 	2.5.8.2.4.	Event success or failure 

  

	 	2.5.8.2.5.	Origination of event (for example, source IP or TTY) 

  

	 	2.5.8.2.6.	Identity or name of affected data, system component, or resource 

  

	 	2.5.8.3.	Logs must be reviewed for Security Incidents daily or generate applicable alerts which are reviewed daily. 


 

	 	2.5.8.4.	Electronic access logs must be maintained on a rolling 90 day basis and paper based sign in logs must be retained for at least one year. 


 

	 	2.6.	Network Security 

  

	 	2.6.1.	Company will put appropriate network access controls in place, including, but not limited to, the segregation of network segments by use of a firewall capable of
stateful packet inspection. Application layer packet inspection (sometimes referred to as “deep packet inspection”) is also encouraged. 

  

	 	2.6.2.	Company must not allow direct wireless network access to systems storing SoundBite data. 


 

	 	2.7.	Physical Security 

  

	 	2.7.1.	Company must use appropriate facility entry controls to limit, monitor, and log physical access to systems storing, processing, transmitting, or accessing SoundBite
data. 

  

	 	2.7.2.	Company will only grant access to authorized personnel. 

  

	 	2.7.3.	Company must have appropriate procedures to track visitors and to help all personnel easily distinguish between Staff and visitors. 


 

	 	2.7.3.1.	Visitors are to be escorted at all times. 

  

	 	2.7.3.2.	All Staff and visitors must wear ID badges visible at all times. 

  

	 	2.7.4.	Company shall have in place monitoring controls appropriate to the facility, including, but not limited to, staffing all unlocked entries with guards or equivalent;
video surveillance at entry points, access points, and sensitive areas; and glass-break detectors. 

  

	 	2.7.5.	Company shall establish (and implement as needed) procedures that allow facility access in support of restoration of lost data in the event of an emergency.


  

	 	2.7.6.	Company shall document repairs and modifications to the physical components of a facility which are related to security (for example, hardware, walls, doors and locks),
if the facility is used to store SoundBite data. 

  

	 	2.7.7.	Data centers housing SoundBite data must have environmental controls and redundant power (UPS and Generator or equivalent). 


  
 [Page 10 of
14] 









	 	2.7.8.	Company shall have an asset management policy and associated processes that apply to all assets that process, store, transmit, or access SoundBite data.


  

	 	2.7.8.1.	Company shall maintain an accurate inventory of its assets. 

  

	 	2.8.	Incident Response 

  

	 	2.8.1.	The Company shall maintain an Incident Response process to address incidents, including, but not limited to, Security Incidents, the loss of SoundBite Information, and
significant service disruptions. The Incident Response process shall include steps for: 

  

	 	2.8.1.1.	Incident identification 

  

	 	2.8.1.2.	Incident escalation 

  

	 	2.8.1.3.	Incident containment 

  

	 	2.8.1.4.	Incident investigation, including, but not limited to, the collection of forensic evidence appropriate for law enforcement purposes 


 

	 	2.8.1.5.	Incident remediation and recovery 

  

	 	2.8.1.5.1.	Company shall document responsive actions taken in connection with any incident involving a Security Incident or other breach of security. 


 

	 	2.8.1.6.	Following any Security Incident or breach of security, Company shall review events and take actions, if applicable, to make changes in business practices relating to
protection of personal information. 

  

	 	2.8.1.7.	The Company shall communicate the Incident Response process to all Staff. First responders with direct responsibility for execution of the Incident Response process
shall be trained on that process. 

  

	 	2.9.	Notification 

  

	 	2.9.1.	Without undue delay and in any event not later than 24 hours following the occurrence of a business interruption, or disaster affecting the Services, Company shall
notify SoundBite, and implement Company’s BC/DR Plan. Company must use best efforts to reinstate the Services as soon as practicable. 

  

	 	2.9.2.	Without undue delay and in any event not later than 24 hours following the occurrence of a Security Incident or other use or disclosure of SoundBite Confidential
Information in violation of this Standard by Company or any of its officers, directors, employees, contractors, agents or other Staff, Company shall notify SoundBite, and implement Company’s Incident Response process. Company must use best
efforts to prevent further breach of confidentiality of SoundBite Confidential Information and to recover or otherwise prevent abuse or fraud using lost or compromised SoundBite Confidential Information. 


 

	 	2.9.3.	Company shall notify and report to SoundBite any use or disclosure of SoundBite Confidential Information in violation of this Agreement by Company or any of its
officers, directors, employees, contractors, agents or other Staff without undue delay and in any event not later than 24 hours following the disclosure. 


  
 [Page 11 of
14] 









	 	2.9.4.	All notifications shall be via any expedient means, followed directly by written notice, to be sent in to both of the following addresses: 


 

	 	2.9.4.1.	John Nye 

 Information Security
Officer 
 SoundBite Communications 
 22 Crosby Drive 
 Bedford, MA 01730 

 

	 	2.9.4.2.	Robert C. Leahy 

 CFO/COO

 SoundBite Communications 
 22 Crosby Drive 
 Bedford, MA 01730 

 

	 	2.9.5.	The Company shall ensure that if there are material changes to the way that SoundBite data is processed (e.g. Company engages a third Party Vendor for storing,
processing, transmitting, or accessing SoundBite Information), then: 

  

	 	2.9.5.1.	These changes must be communicated to SoundBite and prior approval obtained; and 


 

	 	2.9.5.2.	These changes must be communicated to appropriate departments within the Company. 


 

	 	2.9.6.	SoundBite Contact Information: 

  

	 	2.9.6.1.	Information Security Officer: 


John Nye 

jnye@soundbite.com 
 1-781-897-2570 
  

	 	2.9.6.2.	SoundBite Support: 


sbsupport@soundbite.com 
 1-888-807-4732 
  

	 	2.9.6.3.	SoundBite Front Desk: 


1-781-897-2500 
  

	 	2.9.6.4.	SoundBite Business Contact: 


Jason Temple 

jtemple@soundbite.com 
 781-897-2725 
  

	 	2.10.	Software Licensing 

  

	 	2.10.1.	Company will maintain appropriate licenses for all software use to provide service to SoundBite. 


 

	 	2.11.	Data 

  

	 	2.11.1.	Company must not collect, access, use, maintain, or disclose SoundBite data. 


 

	 	2.11.1.1.	Company will take appropriate, industry-accepted measures to protect encryption keys, including, but not limited to, ensuring that encryption keys are encrypted during
transit. 

  

	 	2.11.1.2.	Company shall appropriately protect an encrypted communication’s endpoints. 


  
 [Page 12 of
14] 









	 	2.11.2.	All data provided by SoundBite to the Company remain the property of SoundBite. 


 

	 	2.11.3.	Unless explicitly approved by SoundBite, Company may not use any SoundBite data in a testing environment. In the event that such usage is allowed, this Information
Security Standard will apply in full effect to the testing environment. 

  

	 	2.11.4.	Media handling and disposal 

  

	 	2.11.4.1.	So long as account is active, current, and not in default, Company must not remove SoundBite-owned equipment from data center facilities without prior, written consent
from SoundBite in the form of a Statement of Work, Remote Hands service ticket, or other method described elsewhere in an agreement between the two parties. 


 

	 	2.11.5.	The Company shall only transmit, process and store SoundBite Highly Confidential information at data centers whose location has been approved by SoundBite.


  

	 	2.12.	Audit and Assessment 

  

	 	2.12.1.	Company management must regularly review the compliance of information processing within their area of responsibility with the appropriate security policies, standards,
and any other security requirements. 

  

	 	2.12.2.	On an annual basis, Company shall conduct an internal audit or assessment of all security controls, including, but not limited, to the controls required by this
Standard. 

  

	 	2.12.3.	Company must have an external Information Security audit performed at least annually by an independent, reputable third party which must be provided to SoundBite upon
request. This requirement shall be considered satisfied by having an independent audit firm perform procedures under applicable auditing standards such as SAS70, SSAE16, SOC audits (SysTrust), ISO, or other commonly accepted IT governance
frameworks. SoundBite may audit solely at their own expense Company to monitor compliance with this Information Security Standard. Such audits will occur during normal business hours and will not occur more than once in any calendar year, unless
required by applicable laws and regulations or unless Company experiences a Security Incident, in which case additional audits may be performed. 

  

	 	2.12.3.1.	SoundBite’s right to audit/inspect Company extends to SoundBite’s authorized representatives or any applicable regulator. 


 

	 	2.12.3.2.	On-site inspections of Company’s facilities may be conducted by SoundBite or SoundBite’s authorized representatives. 


 

	 	2.12.3.3.	Company will promptly correct any violation of this Standard found by SoundBite or its agents and will certify in writing that the correction has been made.



  
 [Page 13 of
14] 









	 	2.13.	3rd Party Vendors 

  

	 	2.13.1.	Where any third-party will have access to SoundBite Information in order to provide its services to Company on behalf of SoundBite, Company will ensure that such entity
signs a written contract in which it agrees (i) to restrict its use of SoundBite Information to activities directly required for Company’s performance of its obligations to SoundBite; (ii) to comply with all applicable laws, rules, regulations,
security requirements (as defined in this Information Security Standard); and (iii) to implement and maintain appropriate administrative, technical and physical safeguards to protect the security, confidentiality and integrity of all SoundBite
Information as provided for by this Standard. Company shall be responsible for any unauthorized use or disclosure of any SoundBite Confidential Information by any entity to whom it discloses or provides access to SoundBite’s Confidential
Information, to the same extent as if Company had used or disclosed such information itself. 

  

	 	2.13.2.	Company must execute a written confidentiality and non-disclosure agreements when dealing with third parties that will store, process, transmit, or access SoundBite
Confidential Information. 

  

	 	2.13.3.	Company must require third parties to demonstrate that their Staff has been adequately screened if they require access to SoundBite Highly Confidential Information.


  

	 	2.14.	Regulatory Compliance 

  

	 	2.14.1.	PCI: In the event that Company stores, processes, or transmits CHD, as defined by the PCI DSS, Company shall maintain compliance with the PCI DSS, but only to the
degree that the requirements of the PCI DSS are directly applicable to the services provided under contract to SoundBite. 

  

	 	2.14.1.1.	Company shall either obtain a PCI Certification or allow SoundBite to include sites that support the services provided under contract to SoundBite in SoundBite’s
annual PCI Assessment at SoundBite’s sole expense. 

  

	 	2.14.1.2.	Company will provide evidence of PCI compliant controls and/or certification to SoundBite upon request. 


  
 [Page 14 of
14] 









							
	Internap Sales Order - Summary	  		  	





  
  

 

									
	Date:	  	2/10/2010	 		  	Valid Thru:	  	3/12/2010
					
	To:	  	 Soundbite
 22 Crosby
Drive
 Bedford, MA 01730
	 		  	From:	  	 Internap Network Services, Corp.

Brian Kern / John Murphy
 250 Williams Street,
Suite E100
 Atlanta, GA 30303

					
	Subject:	  	Ashburn Renewal plus IP	 		  	TERM:	  	2 Years

 Summary of New Services 

 

									
	 Services
	  	Total
One-Time
	 	  	Total
Monthly	 
	 CDN Services
	  	$	—  	  	  	$	—  	  
			
	 Colocation Services
	  	$	—  	  	  	$	37,055.00	  
			
	 IP Services
	  	$	—  	  	  	$	15,750.00	  
			
	 Managed Server Services
	  	$	—  	  	  	$	—  	  
			
	 FCP and Value Add Services
	  	$	—  	  	  	$	—  	  
		  	  
	  
	 	  	  
	  
	 
			
	 TOTAL SOLUTION CHARGES
	  	$	—  	  	  	$	52,805.00	  
		  	  
	  
	 	  	  
	  
	 

 Summary of Retained Services 

 

									
	 Services
	  	Total
One-Time
	 	  	Total
Monthly	 
			
	 Renewed and Retained Services
	  				  	$	—  	  
		  	  
	  
	 	  	  
	  
	 
			
	 TOTAL SERVICES
	  	$	—  	  	  	$	52,805.00	  
		  	  
	  
	 	  	  
	  
	 

 Special Comments 
 Terms and Conditions 
 All service implementations are subject to
Internap standard installation intervals. While Internap will make reasonable efforts to accommodate customer specific requests, the standard installation intervals apply for all Services being ordered and shall begin upon Internap’s formal
acceptance of this Sales Order. Billing for services will commence upon delivery of the contracted services. Specific billing activations dates will be communicated and confirmed during implementation process. Internap’s formal acceptance of
this Sales Order occurs when (i) Internap has received a signed Sales Order Form complete with accurate information and signed Agreement for Service, (ii) capacity has been approved, (iii) Customer’s credit has been approved, and
(iv) Internap has provided countersigned order form. Changes to an accepted Sales Order, Customer-initiated delays (including those associated with Customer provisioned access), and credit approval issues will place the installation interval on
hold. 
 The initial Term specified above shall start at the Service Commencement Date as set forth in the MSA (defined below).

 The Term of this Sales Order shall automatically renew for one year periods absent contrary written notice provided by either
party, delivered in accordance with this paragraph at least sixty days in advance of expiration. To be effective, Customer must give any such notice of non-renewal or any notice of disconnection by completing the form located at
https://customers.Internap.com/requests/. 
 THE PARTIES AGREE TO BE BOUND BY THE TERMS AND CONDITIONS CONTAINED IN THE MASTER
SALES AGREEMENT (“MSA”) SIGNED BETWEEN THE PARTIES, WHICH ARE INCORPORATED BY REFERENCE HEREIN, ABSENT SUCH EXECUTED MSA, THE EXECUTION OF THIS DOCUMENT IS DEEMED TO BE ACCEPTANCE OF THE TERMS AND CONDITIONS SET FORTH IN THE INTERNAP
STANDARD MSA LOCATED AT http://internap.com/legal/msa.html, INCLUDING ALL ATTACHMENTS THERETO, ALL OF WHICH ARE INCORPORATED BY REFERENCE HEREIN. IN THE EVENT OF A CONFLICT BETWEEN THE MSA AND THIS SALES ORDER, THE MSA SHALL PREVAIL. THE PROVISION
OF SERVICES HEREUNDER IS SUBJECT TO INTERNAP’S CONTINUING APPROVAL OF CUSTOMER’S CREDIT-WORTHINESS. 
 Customer Acceptance

  

									
	Printed Name:	 	 Robert C. Leahy
	 		 	Title:	 	 COO & CFO

					
	By:	 	 




  
	 		 	Date:	 	 2/18/10

	
	Authorized INTERNAP Signature
					
	By:	 	 




  
	 		 	Date:	 	 2/18/10



  

					
	Internap Network Services Confidential	  	2/10/2010	  	Page 15 of 5










									
	Internap Services - Service Change Order	  		  	





  
  

 

									
	Date:	  	2/10/2010	 		  	Valid Thru	  	3/12/2010
					
	To:	  	 Soundbite
 22 Crosby
Drive
 Bedford, MA 01730
	 		  	From	  	 Internap Network Services, Corp.

Brian Kern / John Murphy
 250 Williams Street,
Suite E100
 Atlanta, GA 30303

					
	Subject:	  	Ashburn Renewal plus IP	 		  	TERM	  	2 Years

 Summary of Services 

 

																					
	 Location
	 	SO#	 	5VCOID	 	QTY	  	 Description
	 	MRC	 	 	Treatment	 	Extended	 	 	Effective Date
	 BSN
	 	10000100385	 	149953	 	1.00	  	 Gige Dual Usage 250Mbps Monthly Fee
	 	$	10,000.00	  	 	Replace	 	$	10,000.00	  	 	
	 BSN
	 	10000100385	 	149957	 	1.00	  	 100mb Dual 4Mbps Monthly Fee
	 	$	1,100.00	  	 	Replace	 	$	1,100.00	  	 	
	 BSN
	 	10000100385	 	149955	 	1.00	  	 GigE Cross Connect Monthly Fee
	 	$	200.00	  	 	Replace	 	$	200.00	  	 	
	 BSN
	 	10000100385	 	149955	 	1.00	  	 GigE Cross Connect Monthly Fee
	 	$	200.00	  	 	Replace	 	$	200.00	  	 	
	 BSN
	 	10000100385	 	149958,[Illegible]	 	2.00	  	 Standard Ethernet Cross Connect Monthly Fee
	 	$	150.00	  	 	Replace	 	$	300.00	  	 	
	 WDC002
	 	10000106740	 	161674	 	1.00	  	 Standard Back Channel Ethernet Cross Connect Monthly Fee
	 	$	225.00	  	 	Replace	 	$	225.00	  	 	
	 WDC002
	 	10000054291	 	72611	 	1.00	  	 Private Cage (Square Footage) Monthly Fee
	 	$	11,770.00	  	 	Replace	 	$	11,770.00	  	 	
	 WDC002
	 	10000054291	 	72809	 	1.00	  	 Private Cage (Square Footage) Monthly Fee
	 	$	5,835.00	  	 	Replace	 	$	5,835.00	  	 	
	 WDC002
	 	10000056918	 	79261	 	1.00	  	 Private Cage (Square Footage) Monthly Fee
	 	$	[Illegible]	  	 	Replace	 	$	[Illegible]	  	 	
	 WDC002
	 	10000056918	 	[Illegible]	 	1.00	  	 Private Cage (Square Footage) Monthly Fee
	 	$	1,177.00	  	 	Replace	 	$	1,177.00	  	 	
	 WDC002
	 	10000056918	 	79282, 79263	 	2.00	  	 30A 208V Primary Power Circuit Monthly Fee
	 	$	910.000	  	 	Replace	 	$	1,620.000	  	 	
	 WDC002
	 	10000064936	 	[Illegible]	 	2.00	  	 30A 208V Primary Power Circuit Monthly Fee
	 	$	845.00	  	 	Replace	 	$	1,690.00	  	 	
	 WDC002
	 	10000067594	 	91405	 	1.00	  	 100mb Dual 4Mbps Monthly Fee
	 	$	500.00	  	 	Replace	 	$	500.00	  	 	
	 WDC002
	 	10000054291	 	S-83340,72612-	 	10.00	  	 20A 120V Primary Power Circuit Monthly Fee
	 	$	360.00	  	 	Replace	 	$	[Illegible]	  	 	
	 WDC002
	 	10000054291	 	87896-87903	 	6.00	  	 20A 120V Primary Power Circuit Monthly Fee
	 	$	325.00	  	 	Replace	 	$	[Illegible]	  	 	
	 WDC002
	 	10000079712	 	118118	 	[Illegible].00	  	 Back Channel Fiber Cross Connect Monthly Fee
	 	$	200.00	  	 	Replace	 	$	200.00	  	 	
	 WDC002
	 	10000056289	 	77900	 	[Illegible].00	  	 Back Channel OC-X Cross Connect Monthly
	 	$	200.00	  	 	Replace	 	$	200.00	  	 	
	 WDC002
	 	10000071711	 	99303,99304	 	[Illegible].00	  	 GigE Cross Connect Monthly Fee
	 	$	200.00	  	 	Replace	 	$	400.00	  	 	
	 WDC002
	 	10000054291	 	72621	 	[Illegible].00	  	 20A 120V Redundant Power Circuit Monthly Fee
	 	$	[Illegible]	  	 	Replace	 	$	180.00	  	 	
	 WDC002
	 	10000067594	 	91406, 91407	 	[Illegible].00	  	 Ethernet Cross Connect
	 	$	175.00	  	 	Replace	 	$	350.00	  	 	
	 WDC002
	 	10000067558	 	77443	 	[Illegible].00	  	 Standard Back Channel Ethernet Cross Connect Monthly Fee
	 	$	175.00	  	 	Replace	 	$	175.00	  	 	
	 WDC002
	 	10000064145	 	87264	 	[Illegible].00	  	 Back Channel [Illegible] Cross Connect Monthly Fee
	 	$	125.00	  	 	Replace	 	$	125.00	  	 	
	 WDC002
	 	10000060018	 	80590	 	[Illegible].00	  	 T-1 Cross Connect
	 	$	80.00	  	 	Replace	 	$	80.00	  	 	
	 WDC002
	 	10000060018	 	347, 155728, 11	 	[Illegible].00	  	 T-1 Cross Connect
	 	$	75.00	  	 	Replace	 	$	225.00	  	 	
	 WDC002
	 	10000058916	 	79278, 79278	 	[Illegible].00	  	 POTs Cross Connect
	 	$	50.00	  	 	Replace	 	$	100.00	  	 	
	 WDC002
	 	10000054291	 	72620, 72622	 	[Illegible].00	  	 Standard 20A [Illegible] Primary Power Circuit Monthly Fee
	 	$	[Illegible]	  	 	Replace	 	$	1,250.00	  	 	
	 WDC002
	 	10000079712	 	[Illegible]	 	[Illegible].00	  	 Back Channel Fiber Cross Connect Monthly Fee
	 	$	200.00	  	 	Remove	 	$	200.00	  	 	

 Treatment Summary 
  

							
	 	  	 	  	Total [Illegible]	 
	Renew	  	 Renew extends terms for existing services through Effective Date at the MRC specified
	  	$	 	  
	Retain	  	 Retain maintains contract terms for existing services through Effective Date at the MRC specified
	  	$	 	  
	Replace	  	 Replace terminates existing services on the effective date and replaces them with services specified on Services Proposal
[ILLEGIBLE] 
	  	$	50,050.00	  
	Remove	  	 Remove terminates services on the effective date
	  	$	200.00	  

 Early Termination Fees (ETF) 

 

					
		  	$	            	  
		  	$	 	  
		  	$	 	  
		  	  
	  
	 
	 Total ETF Fees
	  	$	 	  
		  	  
	  
	 

 ETF Notes 

  

					
	Internap Network Services Confidential	  	2/10/2010	  	Page 16 of 5










									
	Internap Sales Order - Colocation Services	  		  	





  
  

 

									
	Date:	  	2/10/2010	 		  	Valid Thru:	  	3/12/2010
					
	To:	  	 Soundbite
 22 Crosby
Drive
 Bedford, MA 01730
	 		  	From:	  	 Internap Network Services, Corp.

Brian Kern / John Murphy
 250 Williams Street,
Suite E100
 Atlanta, GA 30303

					
	Subject:	  	Ashburn Renewal plus IP	 		  	TERM:	  	2 Years

 Internap Colocation Services 

 

																			
	  	  	Qty	  	Design &
Engineering
Fees	 	  	Total
One-Time	 	  	Monthly Recurring
Charges	 	  	Total
Monthly	 
	 Service Point WDC002
	  		  				  				  				  			
	 Facility address Equinix - 21715 Filigree Court, Bldg. F, Ashburn, VA 20147
	  		  				  				  				  			
						
	 Space (Power not Included)
	  		  				  				  				  			
	 Cabinet(s) (Shared colo not in private cage)
	  		  				  				  				  			
	 Private Cage (Square Ft)
	  	400	  	$	0.00	  	  	$	0.00	  	  	$	56.00	  	  	$	22,400.00	  
						
	 Power
	  		  				  				  				  			
	 120V - 20 AMP Primary (incl Power Strip)
	  	21	  	$	0.00	  	  	$	0.00	  	  	$	360.00	  	  	$	7,560.00	  
	 120 V - 20 AMP Redundant (incl. Power Strip)
	  	1	  	$	0.00	  	  	$	0.00	  	  	$	180.00	  	  	$	180.00	  
	 120 V - 30 AMP Primary
	  		  				  				  				  			
	 120 V - 30 AMP Redundant
	  		  				  				  				  			
	 208 V - 20 AMP Primary
	  	2	  	$	0.00	  	  	$	0.00	  	  	$	625.00	  	  	$	1,250.00	  
	 208V - 20AMP Redundant
	  		  				  				  				  			
	 208 V - 30 AMP Primary
	  	4	  	$	0.00	  	  	$	0.00	  	  	$	935.00	  	  	$	3,740.00	  
	 208 V - 30 AMP Redundant
	  		  				  				  				  			
	 3 Phase 208 V - 20 AMP Primary
	  		  				  				  				  			
	 3 Phase 208 V - 20 AMP Redundant
	  		  				  				  				  			
	 3 Phase 208 V - 30 AMP Primary
	  		  				  				  				  			
	 3 Phase 208 V - 30 AMP Redundant
	  		  				  				  				  			
						
	 Cross Connects
	  		  				  				  				  			
	 Back Channel POTS Cross Connect
	  	2	  	$	0.00	  	  	$	0.00	  	  	$	75.0	  	  	$	150.00	  
	 Back Channel T1 Cross Connect
	  	4	  	$	0.00	  	  	$	0.00	  	  	$	75.0	  	  	$	300.00	  
	 Back Channel DS3 Cross Connect
	  	1	  	$	0.00	  	  	$	0.00	  	  	$	125.0	  	  	$	125.00	  
	 Back Channel OCX Cross Connect
	  	1	  	$	0.00	  	  	$	0.00	  	  	$	225.0	  	  	$	225.00	  
	 Back Channel Ethernet Cross Connect
	  	2	  	$	0.00	  	  	$	0.00	  	  	$	225.0	  	  	$	450.00	  
	 Back Channel GigE Cross Connect/Fiber Cross Connect
	  	3	  	$	0.00	  	  	$	0.00	  	  	$	225.0	  	  	$	675.00	  
						
	 On Demand Remote Hands Charges (Billed at $300/Hour, 30 minute minimum)
	  		  				  				  				  	 	Usage Based	  
		  		  				  	  
	  
	 	  				  	  
	  
	 
						
	 TOTAL COLOCATION CHARGES
	  		  	 	One-Time	  	  	$	—  	  	  	 	Monthly	  	  	$	37,055.00	  
		  		  				  	  
	  
	 	  				  	  
	  
	 

 Standard Configuration Notes: 

 

	 	•	 	 Internap to provide and install (14) 4-post racks in a private cage 



 

	 	•	 	 Internap to the supply power strip for each 20a/120v circuit. Customer to supply power strips for all other power circuits



  

	 	•	 	 Monthly cage pricing does not include power. Power is billed separately 



 

	 	•	 	 Future power requests must be approved by Internap Product Management and are subject to availability 



 

	 	•	 	 Standard Ladder racking and grounding is included in the cage construction charges 



 

	 	•	 	 Customer may not draw more than an aggregate of 33.6 kW (the “Power Cap”) in the Cage. 



 

	 	•	 	 In the event that Internap measures Customer’s draw in the Cage and such draw exceeds the Power Cap, Internap may require Customer to reduce the
power draw in the Cage to the Power Cap within twenty-four (24) hours of such measurement. Internap may disconnect power circuits until the aggregate rated capacity of all circuits in the Cage equals the Power Cap. 



Special Configuration Notes: 

Internap Solution Notes: 
 Colo-Grade Colocation Facility Includes: 
 24x7 engineering support

 Hardened security 
 Redundant, conditioned power 
 Tiered fire suppression systems 

  

					
	Internap Network Services Confidential	  	2/10/2010	  	Page 17 of 5










							
	Internap Sales Order - IP Services	  		  	





  
  

 

									
	Date:	  	2/10/2010	 		  	Valid Thru:	  	3/12/2010
					
	To:	  	 Soundbite
 22 Crosby
Drive
 Bedford, MA 01730
	 		  	From:	  	 Internap Network Services, Corp.

Brian Kern / John Murphy
 250 Williams Street,
Suite E100
 Atlanta, GA 30303

					
	Subject:	  	Ashburn Renewal plus IP	 		  	TERM:	  	2 Years

 Internap IP Services 

 

																																			
	 	  	 	 	 	 	 	 	 	 	 	 	 	 	Design &
Engineering
Fees	 	 	Total
One-Time	 	 	 	 	 	Monthly Recurring
Charges	 	 	Total
Monthly	 
	 	  	Port Services	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 
	 	  	 Port Type
	 	Access Type	 	Commit	 	 	PNAP	 	Qty	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 
	 1
	  	 100Mb Dual
	 	Non-CPA	 	 	10	  	 	WDC002	 	 	1	  	 	$	0.00	  	 	$	0.00	  	 				 	$	1,000.00	  	 	$	1,000.00	  
		  		 		 				 		 				 				 				 	 	Rate/Mb	  	 	$	100.00	  	 			
		  		 		 				 		 				 				 				 	 	Burst rate/Mb	  	 	$	102.00	  	 			
	 2
	  	 Dual GigE
	 	Non-CPA	 	 	500	  	 	BSN	 	 	1	  	 	$	0.00	  	 	$	0.00	  	 				 	$	11,500.00	  	 	$	12,500.00	  
		  	 Rate Limit per handoff
	 	 	800	  	 		 				 				 				 	 	Rate/Mb	  	 	$	25.00	  	 			
		  		 		 				 		 				 				 				 	 	Burst rate/Mb	  	 	$	27.00	  	 			
	 3
	  	 100Mb Dual
	 	Non-CPA	 	 	5	  	 	BSN	 	 	1	  	 	$	0.00	  	 	$	0.00	  	 				 	$	1,100.00	  	 	$	1,100.00	  
		  		 		 				 		 				 				 				 	 	Rate/Mb	  	 	$	220.00	  	 			
		  		 		 				 		 				 				 				 	 	Burst rate/Mb	  	 	$	222.00	  	 			
	 4
	  		 		 				 		 				 	$	0.00	  	 				 				 				 			
		  		 		 				 		 				 				 				 	 	Rate/Mb	  	 				 			
		  		 		 				 		 				 				 				 	 	Burst rate/Mb	  	 	 	N/A	  	 			
	 5
	  		 		 				 		 				 	$	0.00	  	 				 				 				 			
		  		 		 				 		 				 				 				 	 	Rate/Mb	  	 				 			
		  		 		 				 		 				 				 				 	 	Burst rate/Mb	  	 	 	N/A	  	 			
		  		 		 				 		 				 				 	  
	  
	 	 				 				 	  
	  
	 
		  		 		 				 		 	 	TOTAL	  	 				 	$	0.00	  	 				 				 	$	14,600.00	  
		  		 		 				 		 				 				 	  
	  
	 	 				 				 	  
	  
	 
		  	Circuit Services	 		 				 		 				 				 				 				 				 			
	 1
	  	 Copper Cross Connect
	 		 				 	WDC002	 	 	2	  	 	$	0.00	  	 	$	0.00	  	 				 	$	22[Illegible]00	  	 	$	450.00	  
											
	 2
	  	 Fiber Cross-connect
	 		 				 	BSN	 	 	2	  	 	$	0.00	  	 	$	0.00	  	 				 	$	20[Illegible]00	  	 	$	400.00	  
											
	 3
	  	 Copper Cross Connect
	 		 				 	BSN	 	 	2	  	 	$	0.00	  	 	$	0.00	  	 				 	$	15[Illegible]00	  	 	$	300.00	  
											
	 4
	  		 		 				 		 				 				 				 				 				 			
											
	 5
	  		 		 				 		 				 				 				 				 				 			
		  		 		 				 		 				 				 	  
	  
	 	 				 				 	  
	  
	 
		  		 		 				 		 	 	TOTAL	  	 				 	$	—  	  	 				 				 	$	1,150.00	  
		  		 		 				 		 				 				 	  
	  
	 	 				 				 	  
	  
	 
								
		  	 TOTAL IP SERVICES CHARGES
	 				 	 	One-Time	  	 	$	—  	  	 				 	 	Monthly	  	 	$	15,760.00	  
		  		 		 				 		 				 				 	  
	  
	 	 				 				 	  
	  
	 

 Configuration Notes: 

Bandwidth Charges are based on 95th percentile billing methodology, bursting charges apply for usage in excess of commit

 Customer Provided Access (CPA] - Customer is responsible for all local access support associated with CPA orders, and must work directly with
the access provider to resolve all issues. 
 Included with your service: 

 

	 	•	 	 Full transit, route optimized TCP/IP connectivity through Internals P-NAP® facility directly to the major Internet backbones



  

	 	•	 	 24 x 7 Proactive circuit monitoring, outage reporting and outage troubleshooting by Internal’s own Network Operations Center (NOC)



  

	 	•	 	 Notification schedule and escalation procedures 


  

	 	•	 	 Primary DNS for one (1) domain -or- Secondary DNS for up to 200 domains 



 

	 	•	 	 Allocation of IP addresses in compliance with ARIN policy 



  

					
	Internap Network Services Confidential	  	2/10/2010	  	Page 18 of 5










							
	Internap Services Order - Key Contacts	  		  	





  
  

 

									
	Date:	  	2/10/2010	 		  	Valid Thru:	  	3/12/2010
					
	To:	  	 Soundbite
 22 Crosby
Drive
 Bedford, MA 01730
	 		  	From:	  	 Internap Network Services, Corp.

Brian Kern / John Murphy
 250 Williams Street,
Suite E100
 Atlanta, GA 30303

					
	Subject:	  	Ashburn Renewal plus IP	 		  	TERM:	  	2 Years

 Contact Information


 Customer 

 

			
	Primary Contact
		
	Name:	 	Jason Temple
		
	Title:	 	VP Operations
		
	Email:	 	jtemple@soundbite.com
		
	Phone:	 	(781) 897-2725
		
	Mobile:	 	(617) 803-8236
	
	Technical Contact
		
	Name:	 	
		
	Title:	 	
		
	Email:	 	
		
	Phone:	 	
		
	Mobile:	 	
	
	Billing Contact
		
	Name:	 	
		
	Title:	 	
		
	Email:	 	
		
	Phone:	 	
		
	Mobile:	 	
	
	Additional Contact
		
	Name:	 	
		
	Title:	 	
		
	Email:	 	
		
	Phone:	 	
		
	Mobile:	 	

 

 Internap 

 

			
	Account Executive
		
	Name:	 	Brian Kern
		
	Title:	 	Sr. Account Executive
		
	Email:	 	bkern@internap.com
		
	Phone:	 	617-374-4911
		
	Mobile:	 	617-947-7521
	
	Technical Consultant
		
	Name:	 	John Murphy
		
	Title:	 	Sr. Sales Engineer
		
	Email:	 	murphy@internap.com
		
	Phone:	 	617-374-4907
		
	Mobile:	 	978-302-6657
	
	Client Services Contact
		
	Name:	 	Elena Spadazzi
		
	Title:	 	Client Services Leader
		
	Email:	 	espadazzi@internap.com
		
	Phone:	 	617-374-4910
		
	Mobile:	 	
	
	Additional Contact
		
	Name:	 	Trent Collie
		
	Title:	 	Sr. Sales Engineer
		
	Email:	 	tcollie@internap.com
		
	Phone:	 	617-374-4922
		
	Mobile:	 	

 
 


  

					
	Internap Network Services Confidential	  	2/10/2010	  	Page 19 of 5