Master Subscription Agreement

Version 1.1, dated 18 September 2026.

This Master Subscription Agreement (this "Agreement") is between Vesara, Inc., a Delaware corporation with offices at 548 Market Street, #90878, San Francisco, CA 94104 ("Vesara"), and the customer identified on an Order Form that references this Agreement ("Customer"). It takes effect on the Effective Date stated in the first Order Form. Vesara and Customer are each a "Party" and together the "Parties".

How the documents fit together. The agreement between the Parties consists of this Agreement, Exhibit A (Security and Deployment), Exhibit B (Design Partner Program Terms), the Data Processing Addendum (the "DPA"), and each Order Form. If these documents conflict, the order of precedence is (1) the DPA for Personal Data, (2) Exhibit A for security, (3) the Order Form for scope, commercial terms, and any term it expressly states modifies this Agreement, (4) Exhibit B for a Design Partner Pilot, and (5) this Agreement.

1. Definitions

"Activation Notice" means the notice in the form attached to the Order Form by which Customer starts the Subscription under Exhibit B.

"Archived Identity" means an identity in a Connected System that belongs to a former employee or contractor of Customer, cannot authenticate, and is kept so that its records can be read. Archived Identities are not Desks, and their records count toward the Data Pool as Source Data.

"Connected System" means a system, account, repository, or data source that Customer designates in an Order Form or in writing for Vesara to read.

"Current Data" means Source Data dated within the thirty-six (36) months before the billing date. "Historical Data" means all other Source Data.

"Customer Data" means all data, content, and records that Customer or its users make available to Vesara through a Connected System or otherwise, including Personal Data.

"Data Pool" means the volume of Source Data included in the fees, equal to the per-Desk allowance stated in the Order Form multiplied by the Desk count, shared across the whole company, every Connected System, and all periods of history.

"Desk" means one human identity of an employee or contractor of Customer that can authenticate to at least one Connected System during a billing month, whether or not that person uses the Service. Service accounts, shared mailboxes, aliases, distribution lists, bots, and Archived Identities are not Desks.

"Design Partner Pilot" means the evaluation program described in Exhibit B, where the Order Form provides for one.

"Documentation" means Vesara's then-current user guides, connection guides, and technical descriptions for the Service.

"Finding" means an item Vesara identifies from Customer Data that indicates an open, unperformed, expired, or unbilled obligation, or a recoverable or avoidable amount, as described in Exhibit B.

"Identity Provider" means the directory Customer designates in the Order Form for counting Desks, such as Google Workspace, Microsoft Entra ID, or Okta.

"Order Form" means an ordering document signed by both Parties that references this Agreement.

"Output" means the Findings, Findings Reports, obligation graph, dashboards, and other results that Vesara generates for Customer from Customer Data.

"Personal Data" has the meaning given in the DPA.

"Service" means Vesara's obligation intelligence platform and related services described in an Order Form and the Documentation, including the generation of Output, support, and any Customer-hosted deployment components.

"Source Data" means the volume of Customer Data within scope, measured in gigabytes as reported by each Connected System or, where a Connected System does not report volume, as measured by Vesara at the point of reading and before any extraction.

"Subprocessor" means a third party that Vesara engages to process Customer Data in providing the Service.

"Subscription" means paid access to the Service for the term and Desks stated in an Order Form.

"Vesara Technology" means the Service, the Documentation, Vesara's software, models, prompts, schemas, methods, know-how, and all improvements to them, excluding Customer Data and Output.

2. The Service

2.1 Access

Vesara will provide the Service to Customer as described in each Order Form and the Documentation. During the term of an Order Form, Customer and its authorized users may access and use the Service and the Output for Customer's internal business purposes.

2.2 Order Forms

Each Order Form incorporates this Agreement and is a separate contract between Vesara and the entity that signs it. An affiliate of Customer may sign an Order Form, and then "Customer" means that affiliate for that Order Form.

2.3 Design Partner Pilot

Where an Order Form provides for a Design Partner Pilot, Exhibit B applies to that pilot.

2.4 Changes

Vesara may modify the Service, provided that it does not materially reduce the functionality described in an Order Form during that Order Form's term.

2.5 Restrictions

Customer will not (a) sell, resell, license, or make the Service available to any third party other than its affiliates and advisors, (b) reverse engineer or attempt to derive the source code, models, or methods of the Vesara Technology, except to the extent applicable law prohibits this restriction, (c) use the Service to build a competing product, (d) remove any proprietary notice, or (e) use the Service in violation of applicable law.

3. Customer Data and Connected Systems

3.1 Read-only access

Vesara reads Connected Systems using the credentials, scopes, and permissions that Customer provisions. Vesara does not write to, modify, or delete data in any Connected System and does not access any system that Customer has not designated. Customer may revoke Vesara's access to any Connected System at any time.

3.2 Scope

Customer decides which systems, accounts, date ranges, and data classes are in scope. The scope is recorded in the Order Form and may be changed by written notice from Customer. Customer may narrow the scope at any time. Vesara applies the exclusion rules that Customer specifies (for example, named mailboxes, channels, folders, labels, or domains) to the extent technically feasible, and will tell Customer in writing before connection if any exclusion cannot be applied as specified.

3.3 Customer responsibilities

Customer is responsible for (a) having the rights, consents, and notices needed under applicable law and its own policies to make Customer Data available to Vesara for the Service, (b) provisioning, managing, and revoking Vesara's access, (c) the accuracy of the scope and exclusions it specifies, and (d) its decisions and actions based on the Output.

3.4 Use of Customer Data

Vesara will use Customer Data only to provide the Service to Customer, to comply with law, and as Customer instructs in writing. Vesara will not (a) use the content of Customer Data to train or fine-tune any machine learning model, (b) sell Customer Data or share it for advertising, or (c) disclose Customer Data to any third party other than Subprocessors under Exhibit A and the DPA. Sections 3.5 and 3.6 state the only other uses Vesara may make of Customer Data.

3.5 Usage Data

Vesara may collect and use technical and operational data about the use of the Service, such as data volumes, processing times, feature use, and error rates, to operate, secure, and improve the Service. Usage Data does not include the content of Customer Data and does not identify Customer, any person, or any counterparty of Customer.

3.6 Design partner training right

Vesara trains no model on Customer Data unless the Order Form states that Customer grants the training right in this Section. Where Customer grants it, Vesara may use Customer Data to train and evaluate models that Vesara itself builds and controls, only (a) under the supervision of named Vesara personnel, or (b) on data that has been anonymized so that it no longer identifies Customer, any person, or any counterparty, and in either case subject to any safety requirements Customer states in the Order Form. The right never extends to any Subprocessor or other third party, never permits disclosure of Customer Data, and ends when Customer withdraws it by written notice, after which Vesara stops further training and deletes training copies of Customer Data within thirty (30) days.

3.7 Return and deletion

Customer may export the Output at any time during the term of an Order Form. Within thirty (30) days after the last Order Form expires or terminates, Vesara will delete Customer Data and Output from its systems, and within ninety (90) days from backups, and will confirm deletion in writing on request. Vesara may retain copies only where law requires, subject to Section 8 for as long as they are kept.

3.8 Personnel access

Only Vesara personnel who need access to provide the Service to Customer may access Customer Data. Vesara records that access and maintains the controls in Exhibit A.

4. Security and privacy

4.1

Vesara will maintain the security program and controls described in Exhibit A throughout the term of each Order Form.

4.2

The DPA governs the processing of Personal Data. Vesara will notify Customer of Security Incidents as provided in Exhibit A and the DPA.

5. Fees and payment

5.1 Fees

Customer will pay the fees stated in each Order Form. Fees are in United States dollars. Except as an Order Form or Exhibit B states otherwise, fees are invoiced in advance and are due thirty (30) days after the invoice date.

5.2 Disputes

If Customer disputes an invoice in good faith, Customer will notify Vesara within fifteen (15) days after the invoice date and pay the undisputed portion. The Parties will work to resolve the dispute within thirty (30) days.

5.3 Late payment and suspension

Vesara may charge interest on undisputed amounts more than thirty (30) days overdue at one percent (1%) per month or the maximum lawful rate, whichever is lower. Vesara may suspend the Service for nonpayment only after giving Customer thirty (30) days' written notice and an opportunity to pay.

5.4 Desk count and true-up

The Order Form states the initial Desk count. On the first day of each calendar quarter, Customer provides, or permits Vesara to read from the Identity Provider, the number of Desks and Archived Identities. If the Desk count exceeds the count then being billed by more than ten percent (10%), Vesara invoices the additional Desks at the applicable Desk Rate for the remainder of the current term, pro rata. Decreases take effect at the next renewal. Customer is never billed for fewer Desks than the initial Desk count during the Initial Subscription Term.

5.5 Data Pool and overage

The fees include the Data Pool. There is no limit on how far back Customer's history may go. Vesara measures Source Data monthly and reports it to Customer on request, in a form Customer can check against its own system reports. Source Data above the Data Pool is billed monthly at the two rates stated in the Order Form, one for Current Data and a lower one for Historical Data. Vesara will notify Customer when Source Data reaches eighty percent (80%) of the Data Pool, and Customer may narrow the scope under Section 3.2 instead of paying overage.

5.6 Taxes

Fees exclude sales, use, value added, and similar taxes. Customer is responsible for those taxes, except taxes on Vesara's income. If Customer is required to withhold any tax, Customer will gross up the payment so that Vesara receives the full invoiced amount, unless the Parties agree otherwise in the Order Form.

6. Term and termination

6.1 Agreement term

This Agreement starts on the Effective Date and continues until every Order Form has expired or terminated.

6.2 Order Form term

Each Order Form states its term. Unless an Order Form states otherwise, a Subscription renews for successive twelve (12) month terms unless either Party gives written notice of nonrenewal at least sixty (60) days before the current term ends. Vesara may increase the Desk Rate for a renewal term by no more than five percent (5%) over the prior term, on at least ninety (90) days' written notice. A pre-agreed Year 2 Desk Rate stated in the Order Form is not an increase for this purpose.

6.3 Termination for cause

Either Party may terminate this Agreement or an Order Form by written notice if the other Party (a) materially breaches it and does not cure the breach within thirty (30) days after written notice describing the breach, or (b) becomes insolvent, makes an assignment for the benefit of creditors, or is the subject of a bankruptcy proceeding that is not dismissed within sixty (60) days.

6.4 Design Partner Pilot

Customer may end a Design Partner Pilot at any time as provided in Exhibit B.

6.5 Effect

On expiry or termination of an Order Form, Customer's right to access the Service under that Order Form ends, Section 3.7 applies, and Customer will pay any fees accrued before the termination date. If Customer terminates an Order Form for Vesara's uncured material breach, Vesara will refund any prepaid fees for the remainder of the term.

6.6 Survival

Sections 1, 3.4, 3.6, 3.7, 5 (for amounts accrued), 7, 8, 9.4, 10, 11, 12.3, and 13 survive expiry or termination.

7. Intellectual property

7.1 Vesara Technology

Vesara and its licensors own all right, title, and interest in the Vesara Technology. Except for the rights expressly granted in this Agreement, no license is granted by implication or otherwise.

7.2 Customer Data and Output

Customer owns all right, title, and interest in Customer Data and Output. Customer grants Vesara a nonexclusive license to use Customer Data during the term of the applicable Order Form solely to provide the Service and as Section 3 permits. Output may embed Vesara Technology, and Customer's ownership of Output does not extend to that embedded Vesara Technology.

7.3 Feedback

If Customer provides suggestions or feedback about the Service, Vesara may use them without restriction or attribution, provided that Vesara does not disclose Customer's Confidential Information in doing so.

7.4 Third-party models

The Service uses third-party language models and cloud infrastructure provided by the Subprocessors listed in Exhibit A. Vesara contracts with each such Subprocessor on terms that prohibit the Subprocessor from using Customer Data to train its models and that limit retention to what is needed to process the request.

8. Confidentiality

8.1 Definition

"Confidential Information" means nonpublic information that one Party (the "Discloser") makes available to the other (the "Recipient") under this Agreement that is marked or identified as confidential or that a reasonable person would understand to be confidential. Customer Data and Output are Customer's Confidential Information. The Vesara Technology, Documentation, pricing, security documentation, and product roadmap are Vesara's Confidential Information. The terms of this Agreement and each Order Form are Confidential Information of both Parties.

8.2 Exclusions

Confidential Information does not include information that the Recipient can show (a) is or becomes publicly available through no breach of this Agreement, (b) was known to the Recipient without a duty of confidentiality before disclosure, (c) is received from a third party without a duty of confidentiality, or (d) is developed independently without use of the Discloser's Confidential Information.

8.3 Obligations

The Recipient will use Confidential Information only to perform or exercise its rights under this Agreement, will protect it with at least reasonable care, and will disclose it only to its employees, affiliates, contractors, and professional advisors who need to know it and are bound by written obligations at least as protective. The Recipient is responsible for their compliance.

8.4 Required disclosure

The Recipient may disclose Confidential Information to the extent required by law or legal process, provided that, where legally permitted, it gives the Discloser prompt notice and reasonable cooperation to seek protective treatment and discloses only what is required.

8.5 Duration

These obligations continue during the term and for three (3) years after this Agreement ends, and for any trade secret for as long as it remains a trade secret, and for Customer Data and Personal Data for as long as Vesara holds them.

9. Warranties and disclaimers

9.1 Mutual

Each Party represents that it has the authority to enter into this Agreement and that doing so does not breach any other agreement it is bound by.

9.2 Vesara

Vesara warrants that (a) the Service will perform materially as described in the Documentation and the applicable Order Form, (b) it will provide the Service with reasonable skill and care and in compliance with applicable law, (c) it will not knowingly introduce malicious code into any Connected System or Customer environment, and (d) it will maintain the security program in Exhibit A. Customer's exclusive remedy for a breach of Section 9.2(a) is for Vesara to correct the nonconformity and, if Vesara cannot do so within thirty (30) days after notice, for Customer to terminate the affected Order Form and receive a refund of prepaid fees for the remaining term.

9.3 Customer

Customer warrants that it has the rights, consents, and notices needed to make Customer Data available to Vesara for the Service.

9.4 Nature of the Output

The Output is an analysis of Customer's own records. It is not legal, accounting, tax, or financial advice, and it does not replace Customer's professional advisors. Customer decides which Findings to act on. Vesara does not warrant that the Output is complete, that any Finding is collectible or enforceable, or that Customer will recover or save any amount.

9.5 Disclaimer

Except as expressly stated in this Agreement, each Party disclaims all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, and noninfringement.

10. Indemnification

10.1 By Vesara

Vesara will defend Customer against any third-party claim alleging that the Service, as provided by Vesara and used in accordance with this Agreement, infringes a patent, copyright, or trademark or misappropriates a trade secret, and will pay the damages, costs, and settlement amounts finally awarded or agreed. Vesara has no obligation for a claim that arises from Customer Data, from a combination of the Service with items not provided by Vesara, or from a modification not made by Vesara. If the Service is or may be enjoined, Vesara may procure the right for Customer to continue using it, modify it so that it is noninfringing without material loss of functionality, or terminate the affected Order Form and refund prepaid fees for the remaining term.

10.2 By Customer

Customer will defend Vesara against any third-party claim arising from Customer Data, including a claim that Customer lacked the rights or consents required to make Customer Data available to Vesara, or from Customer's use of the Service or Output in violation of this Agreement or applicable law, and will pay the damages, costs, and settlement amounts finally awarded or agreed.

10.3 Process

The indemnified Party will give the indemnifying Party prompt written notice of the claim, sole control of its defense and settlement, and reasonable cooperation at the indemnifying Party's expense. The indemnifying Party will not settle a claim in a way that admits fault by, or imposes an unindemnified obligation on, the indemnified Party without that Party's written consent, not to be unreasonably withheld. Failure to give prompt notice relieves the indemnifying Party only to the extent it is prejudiced.

11. Limitation of liability

11.1 Exclusion

Neither Party is liable to the other for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or goodwill, arising out of this Agreement, however caused and even if foreseeable.

11.2 General cap

Each Party's total liability arising out of this Agreement in any twelve (12) month period is limited to the greater of (a) the fees paid or payable by Customer under this Agreement in the twelve (12) months before the event giving rise to the claim and (b) one hundred thousand dollars ($100,000).

11.3 Enhanced cap

For a breach of Section 3.4, Section 8, Exhibit A, or the DPA, each Party's total liability in any twelve (12) month period is limited to the greater of (a) three (3) times the fees paid or payable by Customer under this Agreement in the twelve (12) months before the event giving rise to the claim and (b) five hundred thousand dollars ($500,000).

11.4 Exceptions

Sections 11.1, 11.2, and 11.3 do not apply to a Party's indemnification obligations under Section 10, to a Party's gross negligence, fraud, or willful misconduct, to a Party's infringement or misappropriation of the other Party's intellectual property, or to Customer's obligation to pay fees.

12. Publicity and design partner recognition

12.1 Name and logo

From the Effective Date of the first Order Form, Vesara may identify Customer by name as a design partner of Vesara in its investor materials and in private conversations with prospective investors, partners, and customers. From the date Customer delivers an Activation Notice, Vesara may also show Customer's name and logo in the customer list on its website and in its sales materials, following Customer's brand guidelines. Any quotation attributed to Customer, any case study, and any press release or public announcement require Customer's prior written approval, which may be given by email.

12.2 Withdrawal

Customer may withdraw the permission in Section 12.1 for future materials on thirty (30) days' written notice.

12.3 Results

Vesara will not disclose the amount or content of any Finding, or any other Customer-specific result, to any third party without Customer's prior written approval. Vesara may state aggregated results across customers in a form that does not identify Customer.

12.4 References

Customer may agree, on a case-by-case basis, to speak with a prospective customer or investor of Vesara. Vesara will request each reference conversation in advance and will not provide Customer's contact details to any third party without Customer's consent for that conversation.

13. General

13.1 Governing law and venue

This Agreement is governed by the laws of the State of Delaware, without regard to its conflict of laws rules. The Parties submit to the exclusive jurisdiction of the state and federal courts located in New Castle County, Delaware, except that either Party may seek injunctive relief in any court of competent jurisdiction.

13.2 Assignment

Neither Party may assign this Agreement without the other Party's written consent, not to be unreasonably withheld, except that either Party may assign it without consent to an affiliate or to a successor in a merger, acquisition, or sale of substantially all of its assets, with written notice to the other Party. This Agreement binds and benefits the Parties and their permitted successors and assigns.

13.3 Notices

Notices must be in writing and sent by email to the address stated in the Order Form, with a copy by courier or registered mail for any notice of breach, termination, or claim. A notice is effective when sent by email, provided that the sender does not receive an automated delivery failure.

13.4 Subcontractors

Vesara may use subcontractors and Subprocessors to provide the Service, remains responsible for their performance, and will bind them to obligations consistent with this Agreement.

13.5 Force majeure

Neither Party is liable for a delay or failure to perform, other than a payment obligation, caused by events beyond its reasonable control, provided that it uses reasonable efforts to resume performance.

13.6 Compliance

Each Party will comply with applicable export control, sanctions, and anti-corruption laws in performing this Agreement.

13.7 Independent contractors

The Parties are independent contractors. This Agreement creates no partnership, joint venture, agency, or employment relationship, and there are no third-party beneficiaries.

13.8 Entire agreement

This Agreement, its Exhibits, the DPA, and the Order Forms are the entire agreement between the Parties on their subject matter and supersede all prior and contemporaneous agreements and understandings about it, except that any nondisclosure agreement between the Parties continues to govern information disclosed before the Effective Date. Terms in a Customer purchase order or vendor portal do not apply. This Agreement may be amended only in a writing signed by both Parties. A waiver on one occasion is not a waiver on any other. If a provision is held unenforceable, it will be modified to the minimum extent needed and the rest of this Agreement remains in effect.

13.9 Interpretation

Headings are for convenience only. "Including" means "including without limitation". "Days" means calendar days unless business days are stated. References to "written" or "in writing" include email. Neither Party is treated as the drafter for purposes of construing this Agreement.

13.10 Counterparts

This Agreement and each Order Form may be signed in counterparts and by electronic signature, each of which is an original and all of which form one agreement.

Exhibit A: Security and Deployment

This Exhibit describes how Vesara deploys the Service, accesses Customer's systems, handles Customer Data, and secures its own environment. It forms part of the Master Subscription Agreement.

A1. Deployment model

A1.1 Vesara-hosted

By default, Vesara hosts the Service on Amazon Web Services in the United States, in the us-west-2 (Oregon) region. Customer Data does not leave the United States unless the Order Form states a different region.

A1.2 Customer-hosted

Where the Order Form selects a Customer-hosted deployment, Vesara deploys the processing components inside a cloud account that Customer controls. Customer Data then stays in Customer's account, and Vesara's access is limited to the operational access described in the Order Form. Customer-hosted deployment is available to select customers by written arrangement, on Amazon Web Services, and Vesara delivers the deployment specification with the Order Form.

A1.3 Segregation

Vesara keeps each customer's data segregated with a separate database for each customer workspace, storage volumes encrypted with AWS KMS keys, encrypted backups (under a customer-provided key where Customer supplies one), and access controls that prevent one customer's data from being accessed through another customer's environment.

A2. Access to Connected Systems

A2.1

Vesara connects to each Connected System using read-only integrations (for example, OAuth applications, API keys, or service accounts) with the least-privilege scopes listed in the Documentation for that system. Vesara does not store Customer user passwords. Where Customer elects to provide documents directly, Customer uploads the documents it selects through the Vesara dashboard and no connection to that system is made.

A2.2

Customer grants and can revoke each connection. Credentials and tokens are stored encrypted and are used only by the Service. Vesara provides, on request, a log of the connections made and the data classes read.

A2.3

Customer may exclude named mailboxes, channels, folders, labels, domains, date ranges, or record types. Vesara applies the exclusions before indexing and confirms the exclusion configuration in writing before the first read. Where Customer provides documents directly, exclusion is by Customer's selection of the documents provided.

A3. Data handling

A3.1 Encryption

Customer Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or an equivalent standard.

A3.2 Processing

Vesara processes Customer Data to index it, build the obligation graph, and generate the Output. Processing includes sending excerpts of Customer Data to the language model providers listed in Section A8 under terms that prohibit training and limit retention.

A3.3 Human review

Vesara personnel review Findings before delivery. Their access is limited to the named Vesara personnel listed in the Order Form or notified to Customer in writing, is recorded in Vesara's access register or logged per access, and is subject to Section A5.

A3.4 Retention

Vesara retains Customer Data only for the term of the applicable Order Form and deletes it as provided in Section 3.7 of the Agreement.

A3.5 Training

Vesara does not train or fine-tune any model on Customer Data unless the Order Form grants the design partner training right in Section 3.6 of the Agreement, and its Subprocessors never train on Customer Data in any case.

A3.6 Service data and improvement

Vesara records operational and audit data about its processing of Customer Data, including identifiers, timestamps, event types, actor references, processing durations, error and refusal classifications, extractor and comparator versions, and aggregate counts. This data describes how the Service behaved; it does not contain Customer Data, and Vesara does not reconstruct Customer Data from it.

Vesara may retain and use this operational data, and statistical or aggregated data derived from its processing of Customer Data, to operate, secure, support, analyze, and improve the Service, provided that such data is de-identified, is not attributable to Customer or to any individual, is never disclosed in a form identifying Customer, and is not used to train any third-party model. This right survives deletion of Customer Data under Section 3.7 of the Agreement and Section A3.4 and termination of the Agreement.

For the avoidance of doubt, this Section does not permit Vesara to retain Customer Data, contract text, financial records, or any document or extract of a document provided by or on behalf of Customer, after the deletion period in Section 3.7 of the Agreement.

A4. Personnel

A4.1

All Vesara personnel with access to Customer Data sign confidentiality agreements, complete security training on joining and annually, and pass background checks, where permitted by law, before they are given access to Customer Data.

A4.2

Access to production systems and Customer Data follows least privilege, requires multi-factor authentication, and is reviewed at least quarterly. Access is removed within twenty-four (24) hours after a person leaves Vesara or changes role. Access granted to a Vesara person for Findings review is authenticated with a hardware security key and is recorded against that named person.

A4.3 Customer user authentication

Customer users authenticate to the Vesara dashboard through Vesara's identity provider, which supports single sign-on by SAML or OpenID Connect against Customer's own identity provider, and directory synchronisation by SCIM. Where Customer does not use single sign-on, Vesara requires a unique account for each user and multi-factor authentication. Authorization is evaluated separately from authentication: every request is checked against Customer's workspace, and no session may reach the data of a workspace it is not authorized for.

A5. Application and infrastructure security

A5.1

Vesara follows secure development practices, including code review before deployment, dependency and container scanning, and centralized secrets management. Production changes go through a change management process with rollback.

A5.2

Vesara remediates vulnerabilities according to severity: critical within seven (7) days, high within thirty (30) days, and medium within ninety (90) days of confirmation.

A5.3

Vesara engages an independent firm to perform a penetration test of the Service at least annually, with the first test completed within ninety (90) days after the production environment first hosts Customer Data, and provides Customer with a summary of the most recent results on request.

A5.4

Vesara logs access to Customer Data and administrative actions, monitors those logs for anomalies, and retains them for at least twelve (12) months. Operational and application logs that do not record access to Customer Data are retained for ninety (90) days.

A6. Business continuity

Vesara backs up its systems at least daily, encrypts backups, and tests restoration at least annually. Target recovery time objective: twenty-four (24) hours. Target recovery point objective: twenty-four (24) hours. The first restoration test occurs within ninety (90) days after the production environment first hosts Customer Data.

A7. Security Incident notification

A7.1

A "Security Incident" is any suspected or confirmed unauthorized access to, or acquisition, disclosure, or loss of, Customer Data in Vesara's or a Subprocessor's possession.

A7.2

Vesara will notify Customer without undue delay and no later than forty-eight (48) hours after becoming aware of a suspected or confirmed Security Incident affecting Customer Data. A preliminary notice stating what is then known is given within that period and supplemented as material facts emerge. The notice will describe what is known about the nature of the incident, the data and systems affected, the steps taken, and a contact. Vesara will provide updates as the investigation progresses and will cooperate with Customer's response, including any notices Customer must give.

A8. Subprocessors

Vesara uses the following Subprocessors to provide the Service:

No Subprocessor receives Customer Data before 15 October 2026.

Vesara keeps the current list, with a dated change log, at vesara.ai/subprocessors. Vesara will email the Customer notice address in the Order Form at least thirty (30) days before adding or replacing a Subprocessor that will process Customer Data. If Customer objects on reasonable data protection grounds and the Parties cannot resolve the objection, Customer may terminate the affected Order Form and receive a refund of prepaid fees for the remaining term.

A9. Assurance and audit

A9.1 Reports

Vesara maintains a SOC 2 audit program. Its status and target report dates are stated in Vesara's current security package. Vesara will provide its current report to Customer under confidentiality when available.

A9.2 Documentation

On request and no more than once per year, Vesara will provide its information security policy summary, its most recent penetration test summary once a test has been completed, and a completed standard security questionnaire (SIG Lite or CAIQ) at no charge.

A9.3 Audit

No more than once per year, on thirty (30) days' written notice, Customer or an independent auditor bound by confidentiality may review Vesara's compliance with this Exhibit through remote review of documentation and interviews, at Customer's cost and without unreasonable disruption to Vesara's operations. A current SOC 2 Type II report satisfies this audit right for the period it covers, except where a Security Incident affecting Customer Data has occurred or a regulator requires more.

A10. Insurance

From the date Vesara first hosts Customer Data, Vesara maintains technology errors and omissions and cyber liability insurance with limits of at least one million dollars ($1,000,000) per claim, and commercial general liability insurance, and will provide certificates on request.

A11. Customer-side controls

Customer keeps administrative control of every connector, can revoke access at any time, and can request a data deletion at any time. Customer is responsible for the security of its own systems and credentials and for applying its own retention rules to the Output it exports.

Exhibit B: Design Partner Program Terms

This Exhibit governs a Design Partner Pilot where the Order Form provides for one. It forms part of the Master Subscription Agreement. Capitalized terms not defined here have the meanings given in the Agreement. Dates, thresholds, and fees are stated in the Order Form, and the defaults below apply only where the Order Form is silent. The pilot runs in three phases: the Pilot Period, the Decision Period, and, only if Customer delivers an Activation Notice, the Subscription. Every commercial term of the Subscription is agreed in the Order Form before the Pilot Period begins, so that activation requires no further negotiation or paperwork beyond the Activation Notice.

B1. The pilot

B1.1 Purpose

During the Design Partner Pilot, Vesara reads the Connected Systems in scope, builds Customer's obligation graph, and delivers a Findings Report so that Customer can judge the value of the Service on its own records.

B1.2 Pilot scope

The pilot covers the Connected Systems Customer selects in the Order Form, with no limit on volume or history. Vesara's guidance is to include every source that holds obligations, such as finance, legal, and account management mailboxes, the contract repository, the billing system, and the shared folders that hold statements of work, because the largest Findings tend to sit in the oldest records.

B1.3 Pilot Period

The Pilot Period is thirty (30) days beginning on the Kickoff Date stated in the Order Form. If Customer has not provisioned access to the Connected Systems within five (5) business days after the Kickoff Date, the Kickoff Date moves to the day access is provisioned.

B1.4 No fees

Customer pays no fees for the Pilot Period other than the Milestone Fee, which is due only if the Milestone is achieved under Section B5.

B1.5 Ending the pilot

Customer may end the Design Partner Pilot at any time by written notice. No fee is due if Customer ends the pilot before the Milestone is achieved. Vesara then disables its connections and Section 3.7 of the Agreement applies.

B2. Deliverables

B2.1 Timeline

During days one (1) to fifteen (15), Vesara connects, indexes, and builds the obligation graph. On or before the Findings Report Date stated in the Order Form (default: day fifteen (15)), Vesara delivers the Findings Report and holds a read-out meeting with Customer.

B2.2 Findings Report

The Findings Report lists each Finding with (a) a description of the obligation or amount, (b) the counterparty, (c) citations to the source records in Customer's Connected Systems, including document or message identifiers and dates, (d) the stated value and the valuation basis under Section B4, (e) a category (for example, unbilled revenue, overpayment or duplicate payment, expired or unused commitment, curable breach, or other), and (f) a recommended next step. Findings are ranked by the value Customer is likely to be able to collect or avoid first.

B3. Review and confirmation

B3.1 Review Period

The Review Period runs from delivery of the Findings Report to the Review End Date stated in the Order Form (default: day thirty (30)).

B3.2 Customer decides

During the Review Period, Customer reviews each Finding and marks it Confirmed, Confirmed in Part (with the value Customer accepts), or Declined, by email or through the review tool Vesara provides. A Finding counts toward the Milestone only when Customer confirms it in writing. Silence does not confirm a Finding. Customer need not give a reason for declining a Finding, and a short reason helps Vesara calibrate.

B3.3 Good faith

Each Party acts in good faith in identifying, valuing, reviewing, and confirming Findings. Customer confirms Findings that it reasonably considers real on the basis of its own records.

B3.4 Review meeting

If Customer has not responded on any Finding by five (5) business days before the Review End Date, either Party may call a forty-five (45) minute review meeting, and Customer responds on the open Findings within five (5) business days after that meeting. Either Party may extend the Review End Date once, by up to fifteen (15) days, by written notice before the original Review End Date.

B4. Valuation rules

B4.1

A one-time amount is valued at its face amount.

B4.2

A recurring amount is valued at twelve (12) months of the recurring amount from the date Vesara identifies, or at the remaining term of the underlying obligation if shorter.

B4.3

An avoidable cost is valued at the amount Customer avoids in the twelve (12) months after the Findings Report Date if Customer acts on the Finding.

B4.4

Duplicates are counted once. An item that Customer identified and acted on before the Kickoff Date is excluded, and Customer identifies those items during the Review Period.

B4.5

Value is measured on identification and confirmation. It does not depend on whether Customer collects, recovers, or saves the amount.

B5. Milestone and Milestone Fee

B5.1 Milestone

The Milestone is achieved when the sum of the values of the Confirmed Findings (using Customer's accepted value for any Finding confirmed in part) equals or exceeds the Milestone Threshold stated in the Order Form (default: one hundred thousand dollars ($100,000)) on or before the Review End Date.

B5.2 Milestone Notice

When the Milestone is achieved, Vesara sends Customer a Milestone Notice listing the Confirmed Findings, their values, and the total.

B5.3 Milestone Fee

On delivery of the Milestone Notice, Vesara invoices the Milestone Fee stated in the Order Form (default: twenty thousand dollars ($20,000)), due thirty (30) days after the invoice date.

B5.4 Milestone not achieved

If the Milestone is not achieved by the Review End Date, no fee is due. Customer keeps the Findings Report, and Customer may still deliver an Activation Notice under Section B6.

B6. Decision Period and activation

B6.1 Decision Period

The Decision Period begins on the day after the Review End Date and runs for the number of days stated in the Order Form (default: thirty (30) days). During the Decision Period, Customer keeps access to the Findings Report and the Output, Vesara reads no new Customer Data, and the Subscription terms stated in the Order Form do not change.

B6.2 Activation Notice

Customer starts the Subscription by delivering an Activation Notice, in the form attached to the Order Form and signed by an authorized representative of Customer, at any time after delivery of the Findings Report and before the end of the Decision Period. The Activation Notice states the Subscription Start Date, which is no later than ten (10) days after the end of the Decision Period, and confirms the Desk count from the Identity Provider. No other document is required.

B6.3 Alternative pricing

Before the end of the Decision Period, Vesara may offer Customer a price based on Source Data volume as an alternative to the Desk Rate, in writing, with the same term and credit. Customer chooses one basis in the Activation Notice. If Vesara offers no alternative, or Customer does not choose, the Desk Rate applies.

B6.4 Hard opt-in

The Subscription begins only on delivery of an Activation Notice. Silence, continued access to the Output, or the passage of time does not start the Subscription or create any fee other than the Milestone Fee under Section B5.

B6.5 Effect of activation

On the Subscription Start Date, the Subscription begins on the terms stated in the Order Form, including the Year 1 Desk Rate, the Year 2 Desk Rate, the Initial Subscription Term, the Data Pool, and the full scope Customer selects for the Subscription, which may go beyond the pilot scope. Vesara credits the full Milestone Fee against the first invoice. Any Milestone Fee already paid is refunded against that invoice.

B6.6 No activation

If Customer does not deliver an Activation Notice by the end of the Decision Period, the Order Form expires on that day, Vesara disables its connections, and Section 3.7 of the Agreement applies. The Milestone Fee, if the Milestone was achieved, remains payable under Section B5.3.

B6.7 Early activation

Customer may deliver an Activation Notice at any time after delivery of the Findings Report. The Pilot Period and Review Period continue to run for the purpose of the Milestone, and the Milestone Fee credit in Section B6.5 applies whenever the Milestone is achieved.

B7. Customer participation

B7.1

Customer designates a Pilot Lead who coordinates access, answers scoping questions, and manages the review. Vesara expects the Pilot Lead and Customer's finance, legal, and operations contacts to spend about two (2) hours in total during the pilot, in addition to the read-out and review meetings.

B7.2

Customer participates in two (2) feedback sessions of up to forty-five (45) minutes each, during or shortly after the Pilot Period, on the usefulness and design of the Service.

B7.3

Section 12 of the Agreement governs design partner recognition and references.

B8. End of the Pilot Period

At the end of the Pilot Period, Vesara stops reading new Customer Data and keeps the existing index available for the Decision Period. Connections are disabled, and Section 3.7 of the Agreement applies, at the end of the Decision Period unless Customer has delivered an Activation Notice. Customer may revoke access at any earlier time.

B9. Worked example

The following example shows how Sections B3 to B6 operate together. The amounts are illustrative.

In this example the Milestone Threshold of $100,000 is met and Vesara invoices the Milestone Fee of $20,000. If the Customer delivers an Activation Notice during the Decision Period, the $20,000 is credited against the first Subscription invoice. If the Customer had also declined the first Finding, the total would be $33,600, no fee would be due, and the Customer would keep the Findings Report. Whether the Customer later collects the $84,000 invoice or renegotiates the vendor fee does not change the counted values.

B10. Pilot terms at a glance

The Order Form states the values for each pilot. The defaults below apply only where the Order Form is silent.

Signature page to the Master Subscription Agreement, including Exhibit A and Exhibit B

Each Party has caused this Agreement to be signed by its authorized representative as of the Effective Date stated in the first Order Form.

Master Subscription Agreement, version 1.1, effective 18 September 2026. Older versions