Master Services Agreement

Surety Technologies Incorporated · Last Updated: September 1, 2026

Scope

a) Context. "Client" means the entity that accepts a Surety quote, proposal, service order, or similar document (each, a "Quote"). This Agreement contains important payment, automatic-renewal, liability-limitation, and arbitration provisions.

b) Scope of Services. The services Surety will provide or facilitate (the "Services") are limited to those expressly listed in a Quote and further described in the applicable Services Guide. Any other service, project, or matter is an "Out-of-Scope Service." Surety has no obligation to perform an Out-of-Scope Service unless it agrees in writing. The Services Guide is binding and contains service descriptions, service levels, payment provisions, and operating policies applicable to the Services.

c) Version. Each Quote will identify the applicable versions of this Agreement and the Services Guide by their respective "Last Updated" dates. If a Quote omits either version date, the applicable version will be the version displayed at the referenced URL when Client accepts the Quote. Surety will retain static copies of the applicable versions with the accepted Quote and will provide those copies to Client upon request. Later revisions to this Agreement and the Services Guide are governed by the "Changes to this Agreement and the Services Guide" provision below.

d) Order of Precedence. If these documents conflict, this Agreement controls over the Services Guide and each Quote, and the Services Guide controls over each Quote, except as stated under "Quote-Controlled Terms" and "Provider Terms; Third-Party Terms Schedule."

e) Quote-Controlled Terms. A Quote controls the specific Services selected; their scope, specifications, deliverables, service levels, quantities, and locations; pricing, discounts, billing frequency, and payment schedule; commencement date, initial term, and renewal term; and the stated Expiration Date for Prepaid Block Hours. A service request, quantity adjustment, or other operational change expressly permitted by this Agreement or the Services Guide may be documented as stated in the applicable provision. That change does not amend any other term.

f) No Informal Modification. Except for applicable Provider Terms, a Quote, Services Guide, email, invoice, purchase order, or other document does not modify a provision concerning warranties, liability limitations, indemnification, confidentiality, data protection, arbitration, governing law, or amendment. A modification to one of those provisions is effective only through a written amendment issued by Surety and affirmatively accepted in writing by Client, or through a revision made under "Changes to this Agreement and the Services Guide." An amendment must expressly identify the provision and state the intended change.

g) Third-Party Providers and Services. Surety may use or facilitate products and services supplied by third parties ("Third-Party Providers" and "Third-Party Services") in delivering the Services.

i. Selection. Surety may select and replace Third-Party Providers in its discretion, including providers not individually identified in a Quote, provided a replacement does not materially diminish the Services required by the Quote.

ii. Reseller. Surety is a reseller or facilitator, not the provider, of Third-Party Services. As between Surety and Client, Third-Party Services are provided "as is," and Surety is not responsible for a Third-Party Service's defect, omission, interruption, failure, or a Third-Party Provider's failure to perform. Surety may attempt a reasonable workaround but does not guarantee that one will be available or successful.

iii. Pass-Through Increases. Surety may pass through any increase in the cost of a Third-Party Service (a "Pass-Through Increase") and will provide as much advance notice as reasonably practicable.

iv. Vendor Changes. If a Third-Party Provider discontinues, materially modifies, or ends support for a Third-Party Service, Surety may substitute a comparable service or reasonably modify the affected Services. Client will cooperate with the resulting transition. Surety is not liable for vendor-caused costs, downtime, or disruption, and transition labor is billable at Surety's then-current rates unless the Quote states otherwise.

v. Third-Party Service Levels. Surety does not adopt or guarantee a Third-Party Provider's service levels. Client's rights and remedies concerning a Third-Party Service are limited to those expressly available under the applicable Provider Terms and any remedy Surety expressly agrees or is required to pass through. Surety does not represent that Client has a direct claim against a provider where Surety holds the provider agreement or license.

Implementation

a) Advice; Instructions. Client will promptly follow Surety's reasonable Service-related directions ("Advice") at Client's cost. Advice may include replacing, upgrading, or securing components of the managed information technology environment (the "Environment") or stopping conduct that disrupts it. Surety is not responsible for issues caused by Client's failure to follow Advice. If that failure makes any Service economically or technically unreasonable or impracticable, Surety may give written notice under "Termination for Cause." If Client does not correct the failure within the cure period stated in that provision, Surety may exclude the affected portion of the Environment or terminate the affected Services in accordance with that provision. Unless expressly included in a Quote, work required because Client did not follow Advice, made an unauthorized change, or failed to satisfy Minimum Requirements is an Out-of-Scope Service.

b) Co-Management. "Co-Managed Providers" are Client personnel or other providers whose work overlaps or may conflict with the Services. Surety is not responsible for their acts or omissions or for resulting errors, downtime, security issues, or remediation. Client assumes responsibility for, and releases Surety from, losses to the extent caused by a Co-Managed Provider or by overlapping access that Surety did not direct or separately authorize in writing. Client will defend Surety against each Third-Party Claim, as defined under "Indemnification," arising from those acts, omissions, or access and will indemnify and hold Surety harmless from resulting Damages, as defined under "Indemnification." The "Indemnification" procedures below apply. A Co-Managed Provider's authority is limited to the systems and access stated in a Quote or other written approval. Surety will yield to that provider's contrary direction only within that scope and will notify Client.

c) Prioritization. Surety will schedule and prioritize the Services as it reasonably determines. Start dates are estimates and may change based on prerequisites, onboarding, transition, and matters outside Surety's control.

d) Modifications. Client will not move or modify the Environment or install software in it without Surety's authorization. Surety is not responsible for an unauthorized change or any resulting issue.

e) Third-Party Support. Surety may obtain vendor or original equipment manufacturer ("OEM") support when it determines that support is required. Client will pay the related fees and costs ("OEM Fees"). Surety will seek advance approval when reasonably practicable but may act without it in exigent circumstances. OEM Fees do not guarantee resolution.

f) Authorized Contacts. Surety may rely on directions and consent from Client's designated personnel or representatives ("Authorized Contacts"). If none is identified or available, the person who accepted the Quote or whom Client ordinarily presents as authorized will be an Authorized Contact. Surety may rely on that authority until it receives and implements Client's written change notice. A ticket, help desk request, or recorded message is not effective notice of a change. Surety may delay Services while confirming authority.

"Authorized User" means an individual whom Client authorizes to access or use a Service, subject to applicable Provider Terms. An Authorized User is not an Authorized Contact solely by reason of that access or use.

g) Access. Client authorizes Surety and its designated Third-Party Providers to monitor, diagnose, communicate with, retrieve information from, install software agents in, and otherwise access the Environment as necessary for the Services. Client will obtain all required access rights, licenses, permits, and permissions and provide safe working conditions. Surety need not work under unsafe conditions or use extraordinary or non-industry-standard methods.

h) Devices. Client represents and warrants that it is authorized to permit Surety to access each device Client asks Surety to support or that is enrolled in Surety's management tools, regardless of ownership. A managed device receives no Service while powered off or disconnected. Surety need not support an unknown or uncovered device and is not responsible for an issue it causes.

i) Ongoing Requirements. All hardware and software in the Environment must be genuine and properly licensed, and Client will provide proof on request. Client will implement and continuously maintain Surety's required minimum hardware, software, and security conditions ("Minimum Requirements").

j) Compliance; Client Responsibilities. Unless a Quote expressly states otherwise, the Services may facilitate but do not guarantee regulatory compliance and do not constitute legal advice or a compliance solution. Client is responsible for identifying the laws and contractual requirements applicable to its operations and data and for obtaining legal advice. Client will promptly identify any requirement that may impede the Services, require Surety to register or report, or require additional protection for Client data. Surety may adjust the scope and pricing to address those requirements. Client will not use the Environment or Services for unlawful activity.

k) Response. Response Time Objectives are governed by the Quote and Services Guide and do not apply during the Transition Exception; Scheduled, Client-Side, or Vendor-Side Downtime; a security-related suspension; or a force majeure event.

i. Scheduled Downtime. "Scheduled Downtime" is time designated by Surety for planned maintenance or adjustment. Without Client's authorization or exigent circumstances, it will not occur from 8:00 a.m. to 5:00 p.m. Central Time, Monday through Friday. Surety will use reasonable efforts to give at least twenty-four (24) hours' notice.

ii. Client-Side Downtime. "Client-Side Downtime" is delay or deficiency caused by Client or a Co-Managed Provider, including when Surety cannot obtain required participation, information, direction, or authorization. Surety is not responsible for Client-Side Downtime.

iii. Vendor-Side Downtime. Surety is not responsible for delay or deficiency caused by a Third-Party Provider, licensor, or other upstream vendor ("Vendor-Side Downtime").

iv. Transition Exception. Response Time Objectives do not apply during the first forty-five (45) days after a Service begins or while Surety performs offboarding or transition work, and unanticipated delay or downtime may occur during those periods (the "Transition Exception").

l) Right to Inspect. On reasonable advance notice and during normal business hours, Surety may inspect the Environment, premises, equipment, and security controls to verify compliance. Client will cooperate with the inspection. Any notice requiring correction must describe the noncompliance and required corrective action in reasonable detail. Client will correct the noncompliance within the cure period stated under "Termination for Cause."

Fees; Payment

a) Fees. Client will pay the fees, costs, and expenses stated in each Quote and the Services Guide ("Fees"), plus Surety's miscellaneous costs of providing the Services ("Miscellaneous Expenses"). Miscellaneous Expenses will be itemized and will not exceed $250 per month without Client's prior consent, except for reasonable incremental costs incurred while providing Services during a national, state, or local emergency or a fuel, labor, utility, or similar shortage. Client is also responsible for freight, insurance, and applicable taxes, duties, and assessments, unless Client provides valid proof of exemption.

Any onboarding fee stated in a Quote is due upon Client's acceptance of that Quote. Recurring Services are invoiced monthly in advance. Except for the onboarding fee, invoices are due within fifteen (15) days. These payment terms apply unless the Quote states otherwise. Time is of the essence for Client's payment obligations.

b) Nonpayment; Disputes. The following provisions apply to past-due and disputed Fees:

i. Past-Due Charges; Application of Payments. An amount unpaid more than fifteen (15) days after its due date accrues a charge of 1.33% per month, or the maximum lawful rate if lower, for each month or partial month it remains past due. Surety may apply payments to delinquent amounts.

ii. Suspension; Restoration. Surety may suspend any Service when an undisputed amount is at least fifteen (15) days past due, after giving Client at least five (5) calendar days' written notice. That notice may be given before the amount is fifteen (15) days past due. Recurring charges continue during suspension. Restoration is subject to full payment and Surety's validation that managed components meet its then-current security and maintenance standards. Surety may charge a reconnect fee not exceeding ten percent (10%) of monthly recurring Fees. Suspension may cause loss of functionality, licenses, or data.

iii. Protected Health Information. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations. "Protected Health Information" ("PHI") has the meaning given in 45 C.F.R. § 160.103 and the applicable Business Associate Agreement. If an applicable Business Associate Agreement governs the affected Service, Surety will not use suspension or a restoration condition to block or terminate required access to PHI maintained on behalf of the covered entity. The same protection applies to another authorized recipient identified in that agreement. Surety will preserve and provide the PHI for access, return, or export as required by the Business Associate Agreement and applicable law. Surety may suspend non-PHI functions and pursue all payment and collection remedies. This limitation does not waive Fees or require Surety to provide unpaid transition, migration, restoration, or forensic services except as required by the Business Associate Agreement or applicable law.

iv. Release; Collection Costs. Except for a claim based on Surety's violation of the preceding Protected Health Information obligations or non-waivable law, Client releases Surety from claims by Client arising directly or indirectly from a suspension permitted by this section. Client will defend Surety against each related Third-Party Claim brought by Client's personnel, customers, agents, or contractors and will indemnify and hold Surety harmless from resulting Damages. The "Indemnification" procedures below apply. Surety may recover reasonable collection-agency charges, court costs, filing fees, attorneys' fees, and other out-of-pocket costs of collecting undisputed amounts, in each case only to the extent authorized by applicable law.

v. Invoice Disputes. A Fee dispute is waived unless Surety receives written notice within sixty (60) days after the later of performance or the invoice date. Client will pay the undisputed portion of an invoice by its due date while a dispute is pending.

c) Minimum Monthly Fees. The initial recurring Fees in a Quote are the "Minimum Monthly Fees" for every month the affected Services remain active, including during month-to-month service and each renewal term. Billing will not fall below the Minimum Monthly Fees when users, devices, or other covered quantities decrease unless Surety agrees in writing. Quantity changes must otherwise be accepted in writing by both parties, except adjustments made under the Services Guide's "Changes to Environment" provision.

d) Increases. Surety may increase the per-unit or other recurring rates for the Services (the "Rates") by stating the increase on Client's invoice. If one increase, or all increases combined, during a calendar year raise a Rate by more than ten percent (10%) over that Rate in effect at the start of that calendar year, Client may terminate the affected Services by written notice within sixty (60) days after the first invoice reflecting the increase. A timely termination does not eliminate Fees accrued through termination or pre-approved costs that Surety cannot reasonably avoid or mitigate. Continued use of the affected Services after that sixty (60) day period constitutes acceptance of the increase. The following are not increases under this provision: Pass-Through Increases; changes in Fees resulting from changes in the quantity of users, devices, or other covered items billed at the existing Rates; Services added by Quote or change order; and the scheduled expiration of a discount stated in a Quote, to the extent the resulting Rate does not exceed the undiscounted Rate stated in that Quote.

e) Automatic Payment. Client will maintain an authorized ACH account or credit card for automatic payment of all invoices. If Client authorizes both, Surety will attempt ACH first and may charge the card if ACH fails.

i. ACH. Client authorizes Surety to debit its designated account for amounts due. The authorization continues until Client terminates it in writing. A returned debit is subject to a $35 service charge or the maximum lawful amount, whichever is less.

ii. Credit Card. Client authorizes Surety to charge its designated card for amounts due. Surety may impose a disclosed surcharge on eligible credit-card payments only as permitted by applicable law and card-network rules. The surcharge will not exceed the lesser of Surety's actual cost of acceptance or the applicable network limit. No surcharge will apply to debit or prepaid cards.

f) Access Licensing. A Service may require noncancelable, nontransferable per-seat or per-device Third-Party Provider licenses ("Access Licenses"). Regardless of why Services end, Client will pay each Access License for its full term. Once paid in full, Client may use it until expiration.

Intellectual Property; Deliverables

a) Definitions. "Client Deliverables" means final reports, network diagrams, configuration documentation, written plans, and other items created specifically for Client and expressly identified as deliverables in a Quote. "Surety Materials" means all software, code, scripts, tools, templates, processes, methodologies, know-how, documentation, and other materials that Surety owned or developed before providing the Services, develops independently of the Services, or uses generally in its business, in each case excluding Client's Confidential Information. Surety Materials include all modifications and improvements to those materials.

b) Ownership; Assignment. Surety owns each Client Deliverable until paid in full. Upon full payment, Surety assigns Client all right, title, and interest in that Client Deliverable, excluding Surety Materials and Third-Party Provider materials. Surety will execute documents reasonably necessary to evidence the assignment.

c) License to Embedded Surety Materials. If Surety Materials are incorporated into a paid Client Deliverable, Surety grants Client a perpetual, worldwide, non-exclusive, royalty-free license to use, copy, and modify those materials only as part of that Client Deliverable for Client's internal business purposes. Client may permit its employees and service providers to exercise those rights on its behalf.

d) Continued Use of Configurations. Upon full payment, Client may continue using, for its internal business purposes, the configurations and settings Surety implemented in Client's Environment, including after the Services end. This does not include Surety's tools, agents, or management platforms.

e) Retained Rights; Third-Party Materials; Client Data. Except for rights expressly assigned or licensed above, each party retains its preexisting and independently developed intellectual property. Third-Party Provider materials and software are licensed, not sold, and may be used only under applicable Provider Terms. Client retains ownership of data and materials it furnishes. This section does not limit Surety's obligations under "Transition; Deletion of Data."

Products; Warranties; Limitations of Liability

a) Hardware and Software Purchases. Equipment, hardware, peripherals, accessories, and software licenses acquired through Surety ("Third-Party Products") are nonrefundable once ordered unless the provider or reseller permits a return. Client is responsible for all restocking, return, and warranty-service charges. Surety will use reasonable efforts to pass through available provider warranties and service commitments but does not insure or guarantee a Third-Party Product's quality, operation, performance, uptime, usefulness, returnability, or exchangeability. AS BETWEEN SURETY AND CLIENT, ALL THIRD-PARTY PRODUCTS ARE PROVIDED "AS IS" WITHOUT ANY EXPRESS OR IMPLIED WARRANTY.

b) Shipment; Risk of Loss. This subsection applies only to tangible Third-Party Products. Unless a Quote states otherwise, tangible Third-Party Products are shipped F.O.B. the place of shipment at Client's cost. Risk of loss passes to Client when the product is delivered to the carrier or Client's representative.

c) Order Cancellation. Client may cancel an order for a Third-Party Product only with Surety's prior written approval and on written terms requiring Client to reimburse Surety for losses, costs, and charges resulting from the cancellation.

d) Product Pricing; Payment; Permits. Unless a Quote states otherwise, Third-Party Product pricing is valid for one (1) day, and Surety will not order a product until Client pays in full. Payment must be in U.S. currency. Client will obtain all governmental licenses, permits, and approvals required for the transaction.

e) Product Liability. NO MONETARY RECOVERY IS AVAILABLE FROM SURETY FOR WARRANTY CLAIMS RELATED TO THIRD-PARTY PRODUCTS. IN NO EVENT WILL SURETY'S LIABILITY TO CLIENT RELATED TO A THIRD-PARTY PRODUCT EXCEED THE PURCHASE PRICE PAID FOR THAT PRODUCT.

f) Services Warranty; Acceptance. Surety warrants that experienced, qualified personnel will perform the Services professionally and in accordance with generally accepted industry standards. A Service is accepted unless Client rejects it for nonconformance in a reasonably detailed writing within fifteen (15) days after performance. Acceptance does not waive a latent defect that could not reasonably have been discovered during that period if Client gives written notice within ninety (90) days after it knew or reasonably should have known of the defect. If Surety confirms nonconformance, it will use commercially reasonable efforts to reperform the affected Service at no charge as Client's sole and exclusive remedy. This remedy does not apply to a defect caused by Client's failure to follow Advice, an unauthorized Environment change, or a Legacy Device.

g) Warranty Disclaimer. EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT OR AN AMENDMENT SATISFYING THE "NO INFORMAL MODIFICATION" PROVISION, NEITHER PARTY MAKES ANY EXPRESS, IMPLIED, STATUTORY, OR OTHER WARRANTY, INCLUDING A WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE, OR USAGE OF TRADE. SURETY PERSONNEL ARE NOT AUTHORIZED TO MAKE WARRANTIES BEYOND THOSE EXPRESSLY STATED IN THIS AGREEMENT OR AN AMENDMENT SATISFYING THE "NO INFORMAL MODIFICATION" PROVISION. CLIENT IS NOT RELYING ON ANY SUCH ADDITIONAL WARRANTY. THE INTERNET IS INHERENTLY INSECURE AND MAY BE UNRELIABLE, INTERRUPTED, DISRUPTED, OR BREACHED, FOR WHICH SURETY IS NOT LIABLE.

h) Liability Limitations. The following limitations are a bargained-for, material part of the parties' relationship. Surety would not enter this Agreement or provide Services without them.

i. Excluded Damages. IN NO EVENT WILL EITHER PARTY BE LIABLE FOR INDIRECT, SPECIAL, EXEMPLARY, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING FROM THE SERVICES, THIS AGREEMENT, A QUOTE, A BREACH, OR A DELAY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. EXCLUDED DAMAGES INCLUDE LOST REVENUE, PROFITS (EXCEPT FEES OWED TO SURETY), SAVINGS, AND OTHER INDIRECT OR CONTINGENT ECONOMIC LOSS. This exclusion does not limit amounts Client owes Surety or Client's indemnification obligations.

ii. Aggregate Liability Cap. Except for amounts Client owes Surety and Client's indemnification obligations, each party's aggregate liability is limited to actual direct damages and will not exceed the Fees Client paid Surety during the twelve (12) months before the cause of action accrued, excluding licenses, hardware, and pass-through third-party charges (the "Liability Cap"). The Liability Cap applies to all claims arising from or related to this Agreement and under every theory of liability, including contract, tort, indemnification, and negligence. The Liability Cap does not apply to collection costs recoverable under "Release; Collection Costs" or to attorneys' fees and costs arising from Client's indemnification obligations. All other attorneys' fees and costs recoverable under this Agreement are subject to the Liability Cap, except to the extent prohibited by applicable law. Insurance does not increase the Liability Cap.

iii. Application; Exceptions; Releases. These limitations apply even if a remedy fails of its essential purpose. They do not apply to the extent prohibited by law or to a claim caused by the responsible party's willful misconduct or gross negligence. Liability will be reduced to the extent the other party's willful misconduct, gross negligence, or failure to reasonably mitigate caused the claim. Surety has no liability for failing to perform an Out-of-Scope Service that it has not agreed in writing to perform. No release, waiver, or hold-harmless obligation in this Agreement applies to the extent a claim is caused by the released party's willful misconduct or gross negligence, or to the extent prohibited by applicable law. However, the waiver of subrogation under "Training; Cyber Insurance; Waiver of Subrogation" applies to claims of gross negligence to the extent permitted by applicable law.

i) Administrative and Root Access. Surety recommends that Client not give administrative or root access to non-Surety personnel. If Client requests or requires that access, Client assumes responsibility for, and releases Surety from, losses to the extent arising from administrative or root activity not performed or separately authorized in writing by Surety. Client will defend Surety against each related Third-Party Claim and will indemnify and hold Surety harmless from resulting Damages. The "Indemnification" procedures below apply. Surety's business records are presumptive evidence of its performance or written authorization absent manifest error. Approval of a person's access does not approve that person's activity; Surety must separately authorize the activity in writing.

j) Legacy Devices. A "Legacy Device" is hardware or software that is outdated, obsolete, incompatible with industry standards, or unsupported by its manufacturer. If a Legacy Device remains in the Environment, including because Client declines replacement, Client assumes the resulting risk and releases Surety and its Third-Party Providers from related claims. Surety need not remediate an issue arising from a Legacy Device. Client should determine whether Legacy Devices affect its insurance coverage.

k) Non-Managed Systems. Surety is not liable for damage caused by a service, system, software, or component that Surety and its personnel do not furnish or manage under this Agreement.

Indemnification

Definitions; Breach Claims. "Third-Party Claim" means a claim, demand, action, or proceeding brought by a person or entity other than a party to this Agreement. For a Third-Party Claim alleging facts that, if true, would constitute a party's breach of this Agreement, the party whose breach is alleged is the "Indemnifying Party." The other party is the "Indemnified Party." For a separate indemnification obligation stated elsewhere in this Agreement, those terms refer to the party owing and the party receiving that protection, respectively.

Security Incident Claims. Client will defend Surety against, and indemnify and hold Surety harmless from Damages arising from, any Third-Party Claim brought by Client's customers, patients, employees, or other persons whose data Client collects or controls, to the extent the claim arises from a security incident caused by the acts or omissions of Client or its personnel, including the handling of credentials, payments, or data.

The Indemnifying Party will defend the Indemnified Party against the Third-Party Claim. "Damages" means losses, damages, judgments, settlements, liabilities, costs, and reasonable attorneys' fees resulting from the Third-Party Claim. The Indemnifying Party will indemnify and hold the Indemnified Party harmless from Damages to the extent arising from or related to the breach or other event covered by the applicable indemnification obligation. This Section does not create a right to indemnification or attorneys' fees for a direct claim between the parties.

The Indemnified Party will promptly give written notice of a Third-Party Claim and provide reasonable cooperation at the Indemnifying Party's expense. A delay in notice reduces the Indemnifying Party's obligations only to the extent the delay materially prejudices the defense. Subject to the rights of any applicable insurer, the Indemnifying Party may assume and control the defense with competent counsel reasonably acceptable to the Indemnified Party. The Indemnified Party may participate through counsel of its choice at its own expense. If the Indemnifying Party does not promptly assume and diligently conduct the defense, the Indemnified Party may do so, and its reasonable defense costs will constitute Damages.

The Indemnifying Party may settle a Third-Party Claim without the Indemnified Party's consent only if the settlement fully and unconditionally releases the Indemnified Party, requires no admission or nonmonetary obligation from it, and is fully paid by the Indemnifying Party. Any other settlement requires the Indemnified Party's prior written consent, which will not be unreasonably withheld, conditioned, or delayed.

These procedures apply to Third-Party Claims subject to another indemnification obligation in this Agreement unless the applicable provision expressly states otherwise. Nothing in this Section narrows any separate Client waiver, release, hold-harmless obligation, or indemnity stated elsewhere in this Agreement.

Term; Termination

Each Quote has its own term. Ongoing managed Services may renew automatically as stated below.

a) This Agreement. This Agreement applies to all Services beginning on the earlier of Client's acceptance of a Quote or Surety's provision or facilitation of a Service (the "Effective Date"). It remains effective until terminated under this section or until six (6) months after the last Service ends. Ending one Quote does not end another. When this Agreement or a Quote ends, the affected Services cease, but accrued payment obligations and provisions intended to survive remain effective.

b) Quote Terms; Auto-Renewal. Each Quote and the Services Guide state the term of its Services. A "Minimum Term" is an initial term that a Quote expressly designates as a minimum commitment, together with each renewal of that term. Unless a Quote states otherwise, each ongoing, recurring managed Service invoiced monthly renews automatically for successive terms equal to its initial term. Either party may prevent renewal by giving the other at least thirty (30) days' prior written notice before the current term ends. If the initial term is a Minimum Term, each renewal term is also a Minimum Term for all purposes of this Agreement. Nonrenewal takes effect at the end of the current term. One-time projects, break-fix assignments, temporary services, and other nonrecurring Services do not auto-renew.

c) Termination for Convenience. Unless the affected Quote states a Minimum Term or longer notice period, either party may terminate this Agreement or a Quote for convenience on thirty (30) days' prior written notice. Termination of this Agreement while a Quote remains active takes effect when the last active Quote ends. Client may end Services subject to a Minimum Term before it expires only by paying the Early Termination Amount.

d) Termination for Cause. A party may terminate the affected Quote or this Agreement for cause if the other party materially breaches this Agreement, a Quote, or the Services Guide and fails to cure the breach within twenty (20) days after written notice becomes effective under "Notices; Electronic Records." The notice must describe the breach in reasonable detail and identify the required corrective action. This cure period applies to all terminations for cause under this Agreement, including for nonpayment. It does not extend payment due dates or limit suspension, past-due charges, or protective measures otherwise permitted by this Agreement or the Services Guide.

e) Early Termination Charges. The following provisions apply when Services end before an applicable Minimum Term expires:

i. Accrued Fees and Unavoidable Costs. If Surety terminates for cause or Client terminates for convenience, Client will pay all Fees accrued through termination and all pre-approved costs that Surety cannot reasonably avoid or mitigate. If Client terminates for cause, Client owes only Fees for properly delivered and accepted Services through termination and unavoidable Access License costs.

ii. Early Termination Amount. Client will also pay the Early Termination Amount described below if, before the Minimum Term expires, Client ends affected Services for convenience without Surety's consent or Surety terminates them for cause based on Client's uncured material breach. The Early Termination Amount consists of:

(A) unpaid Fees accrued through termination;

(B) noncancelable Third-Party Provider charges committed through the end of the Minimum Term that Surety cannot reasonably avoid or mitigate;

(C) recurring Service Fees that would have been payable through the end of the Minimum Term, excluding charges under subsection (B), less direct labor and variable costs Surety reasonably avoids and amounts actually recovered through reasonable mitigation; and

(D) any unamortized onboarding credit, implementation credit, or hardware subsidy identified in the Quote.

iii. Mitigation; No Double Recovery. Surety will reasonably mitigate the amount under subsection (C), will not recover an item twice, and will provide a reasonable itemization on request. The total under subsections (B) through (D) will not exceed the Fees and costs Client would have paid through the Minimum Term.

iv. Liquidated Damages. The parties agree that this formula reasonably estimates difficult-to-calculate probable loss, including any price discount given for the Minimum Term, and is proportionate to that loss. The Early Termination Amount is liquidated damages, not a penalty.

f) Client Conduct. Surety may give written notice if conduct by Client or its personnel, contractors, or representatives materially interferes with Surety's ability to provide the Services safely or in a commercially reasonable manner. If the conduct continues after the cure period stated under "Termination for Cause," Surety may terminate the affected Quote or this Agreement in accordance with that provision.

g) Mutual Termination. The parties may end a Quote or this Agreement at any time by written agreement.

h) Equipment; Software Agents. At termination, Client will provide normal-business-hours access for Surety to remove Surety-owned equipment. Client will immediately pay replacement value for equipment that is missing or damaged beyond normal wear. Client will not remove, disable, circumvent, or disrupt a Surety software agent unless Surety directs it to do so. Surety will delete information from returned equipment using commercially reasonable methods but does not guarantee that deleted information is irrecoverable. Client should permanently delete sensitive information before returning equipment.

i) Transition; Deletion of Data. At termination, regardless of unpaid Fees, Surety will provide Client the administrative credentials for Client's systems, tenants, domains, and accounts; Client data in the format Surety ordinarily maintains it; and configuration documentation for Client-owned equipment and cloud resources. Surety will not withhold those items for nonpayment. Additional transition, migration, knowledge-transfer, or conversion services are billed at Surety's then-current rates and may be conditioned on payment of outstanding Fees and reasonable advance payment. Surety need not provide its proprietary tools, scripts, templates, runbooks, or internal documentation. Except for backup data as stated below or where a Quote, the Services Guide, applicable law, or a Business Associate Agreement requires otherwise, Surety need not retain Client data after termination.

j) Backup Data. During backup Services, retention is governed by the Quote and Services Guide. After termination, Surety will keep backup data available for requested recovery or export for thirty (30) days (the "Backup Availability Period"), unless a Quote, Business Associate Agreement, or applicable law requires otherwise. Surety will not condition access to or return of backup data required by this Agreement, an applicable Business Associate Agreement, or law on payment of outstanding Fees. Reasonable recovery, export, media, storage, and egress costs remain chargeable to the extent permitted by those provisions. Additional recovery, migration, or conversion services beyond the required access or return may be conditioned on payment of outstanding Fees and reasonable advance payment. After that period, Surety will initiate deletion and deprovisioning using commercially reasonable safeguards. Residual copies of data may remain temporarily in vendor-controlled systems that are not readily accessible. Data may also be retained as required by law, an applicable Business Associate Agreement, or a legal hold. Any longer availability requires Surety's written agreement and is billed as an ongoing service.

Confidentiality

a) Defined. "Confidential Information" means nonpublic information disclosed by one party (the "Discloser") to the other (the "Recipient"), including customer data and lists, internal documents and communications, proprietary reports, and methodologies. It excludes information that, without the Recipient's breach, becomes public; was known to the Recipient without restriction before disclosure; was independently developed by the Recipient without use of the Discloser's Confidential Information; or was lawfully obtained from a third party without a confidentiality obligation.

b) Protection and Use. The Recipient will protect Confidential Information with the same care it uses for its own comparable information, but no less than commercially reasonable care. The Recipient may use or disclose it only as the Discloser authorizes in writing, as needed to perform this Agreement, or as law requires.

c) Compelled Disclosure. Unless prohibited by law, a Recipient legally compelled to disclose Confidential Information will promptly notify the Discloser and, at the Discloser's expense, reasonably cooperate in seeking protection. If protection or waiver is unavailable, the Recipient may disclose only the portion its counsel advises is legally required.

d) Additional Agreements; HIPAA. If an additional nondisclosure agreement applies to third-party information, this section and that agreement are read together, and the more protective term governs the affected information. If Surety will create, receive, maintain, or transmit PHI on Client's behalf, the parties will execute a Business Associate Agreement before Surety receives access or begins the affected Service. That agreement controls only to the extent of a conflict concerning PHI. Surety will obtain the required written assurances from each subcontractor that creates, receives, maintains, or transmits PHI on Surety's behalf, as required by applicable law and the Business Associate Agreement.

e) AI-Assisted Tools. Surety may use approved generative artificial intelligence tools to assist its personnel in performing the Services. Use of Client's Confidential Information remains subject to this Agreement's confidentiality and security obligations.

Surety will not use Client's Confidential Information to train AI models or authorize an AI provider to do so. Surety will use external AI providers only under terms and account settings that prohibit such training. Surety will maintain reasonable controls designed to prevent the submission of PHI and authentication secrets and will not knowingly submit that information.

Surety personnel will review generated content for material accuracy, suitability, and unauthorized disclosure before providing it to Client or using it to make material changes to the Environment. These internal tools will not independently make changes to the Environment. Automated security measures are governed by the "Emergency Containment" provision and the Services Guide.

Security; Data Protection

a) Security Program. Surety will maintain reasonable administrative, technical, physical, and disposal safeguards appropriate to Surety's size and resources and to the nature and sensitivity of Client personal information in Surety's possession or control. Surety will contractually require a Third-Party Provider receiving that information from Surety to maintain reasonable, appropriate security procedures and practices. An applicable Business Associate Agreement controls Surety's safeguards for PHI. This paragraph states Surety's obligations under Neb. Rev. Stat. § 87-808 and comparable state laws. It does not guarantee a security outcome and remains subject to the Warranty Disclaimer and Liability Limitations.

b) Encryption. Client will use encryption appropriate to the sensitivity and risk of Confidential Information and information protected by law or Client contract. This includes encryption in transit and at rest when required by applicable law, contract, or generally accepted security practices. Client is responsible for identifying data that requires additional safeguards, including financial identifiers, government identifiers, PHI, and nonpublic personal information. Surety is responsible for encryption configuration only to the extent expressly stated in a Quote or the Services Guide. Client will reimburse Surety for reasonable out-of-pocket costs caused by Client's breach of this obligation. Client will also defend Surety against each resulting Third-Party Claim and indemnify and hold Surety harmless from resulting Damages, subject to the "Indemnification" procedures above.

c) Insurance Forms. Surety's assistance with an insurance form or questionnaire reflects only its knowledge of the Environment when answered. An undisclosed change, failure to implement, circumvention, or disabling of a Service feature ("Unauthorized Activity") may make an answer inaccurate or obsolete. Client will reimburse Surety for reasonable out-of-pocket costs caused by Unauthorized Activity or a resulting inaccuracy. Client will also defend Surety against each resulting Third-Party Claim and indemnify and hold Surety harmless from resulting Damages, subject to the "Indemnification" procedures above.

Surety's assistance is limited to technical information about the Environment and Services within its knowledge. Client is responsible for reviewing, approving, and submitting its insurance applications and other representations to insurers. Client will consult its own licensed insurance professional regarding coverage and policy requirements. Surety does not provide insurance advice or guarantee eligibility for coverage or payment of a claim. The insurance requirements in this Agreement are contractual minimums and do not establish the coverage or limits appropriate for Client.

d) Security Limitations. No security solution is completely effective. Surety does not guarantee that a security product will detect, prevent, quarantine, or remove every threat or that deleted, corrupted, or encrypted data ("Impacted Data") is recoverable. Recovery of Impacted Data and activation of multi-factor authentication are Out-of-Scope Services unless a Quote or the Services Guide states otherwise.

e) Training; Cyber Insurance; Waiver of Subrogation. Client will train its personnel to recognize phishing and other common threats. Throughout the term of each Quote, Client will maintain, at its expense, cyber and privacy liability insurance with limits of not less than $1,000,000 per claim and in the aggregate, or any different amount stated in a Quote. The policy will provide first-party and third-party coverage appropriate to Client's operations. Coverage will include data breaches; network-security and privacy liability; breach-response and forensic costs; restoration or replacement of lost or corrupted data; business interruption; cyber extortion or ransomware; and regulatory investigations, defense costs, fines, and penalties to the extent insurable. On reasonable request, Client will provide evidence of current coverage. Client will promptly notify Surety after receiving notice of cancellation or a material reduction in coverage. Client's insurance does not limit its obligations or liability under this Agreement. Each party waives all rights of recovery against the other for any loss to the extent covered by its insurance, and will cause its insurers to waive their rights of subrogation against the other party for that loss. Each party is responsible for confirming that its policies permit this waiver.

f) Security Incident Losses. Client releases Surety from costs, damages, and expenses arising from malware, unauthorized access, social engineering, fraudulent payment instructions, or other criminal acts of third parties, unless caused by Surety's willful misconduct or gross negligence.

g) Physical Security. Client will maintain reasonable physical security for managed hardware in its control, appropriate to its premises, such as controlled access to equipment areas, alarm or monitoring systems, fire detection, and periodic review of physical access.

h) Updates. Hardware and software updates are supplied by third parties. If installation is included in the Services, Surety will follow the manufacturer's recommendations but does not guarantee an update's performance and is not responsible for resulting downtime, loss, or remediation. Surety may defer an update until it reasonably determines that the update is compatible and materially beneficial.

i) International Access. Surety personnel perform the Services from within the United States. Third-Party Providers may access, process, or store Client data outside the United States, subject to their Provider Terms and applicable safeguards. Client will notify Surety of any contrary requirement. Related changes may involve additional cost.

j) Data Breach Notification. Client owns data processed through the Environment and is primarily responsible for applicable breach-notification duties, including under Neb. Rev. Stat. § 87-801 et seq. and Iowa Code ch. 715C. Surety will notify Client of an actual or reasonably suspected security breach affecting Client data without unreasonable delay and within any period required by applicable law. Surety will reasonably cooperate with Client's investigation and provide legally required information and reasonably available forensic information, subject to law and confidentiality protections. Legally required notice and information are provided without additional charge. Charges and approval requirements for other incident-response or forensic services are governed by the applicable Quote and Services Guide, subject to any applicable Business Associate Agreement and law. Surety need not notify individuals or regulators directly unless applicable law requires it.

k) Payment Card Data. Surety does not store, process, or transmit cardholder or sensitive authentication data ("Account Data") for Client. Client will not place, send, or route Account Data through Surety's custody or systems and will promptly report any occurrence. For a system component that Client identifies in a Quote as within or connected to its cardholder data environment ("CDE"), Surety is responsible only for security tasks expressly assigned in that Quote or its responsibility matrix. Client is responsible for CDE scope, Payment Card Industry Data Security Standard compliance, and validation. Surety is not a Qualified Security Assessor and provides no assessment, validation, remediation, or compliance service unless a Quote expressly states otherwise.

l) Client Incident Reporting; Coordination. Client will promptly report any actual or reasonably suspected Cybersecurity Incident, as defined in the Services Guide, affecting the Environment or Services. Client will use a designated support channel listed in the Quote or Services Guide. These reports are operational notices and are not subject to the formal delivery requirements in "Notices; Electronic Records." Client will maintain current emergency contact information for its Authorized Contacts, including a contact method independent of the affected Environment.

Client will take reasonable steps to preserve relevant evidence within its possession or control without delaying necessary containment. Subject to applicable law and privilege, Client will promptly inform Surety of any related third-party claim or regulatory inquiry concerning Surety's Services.

Client is responsible for notifying its insurers and obtaining any approvals required by its policies. Client will identify any counsel or incident-response provider appointed by its insurer. Surety will reasonably coordinate its agreed work with Client's designated response team, subject to confidentiality, privilege, and the defense-control provisions of this Agreement. That coordination does not expand the Services or transfer control of Surety's defense. Payment of Fees properly due is not contingent on insurance coverage or reimbursement.

Investigation and insurer coordination do not postpone any notice or other action required by this Agreement, an applicable Business Associate Agreement, or law.

m) Emergency Containment. Client authorizes Surety to take temporary containment measures when Surety reasonably determines that an actual or reasonably suspected security threat requires prompt action to protect the Environment, Client data, or systems used to provide the Services. This authority applies to systems and access that Surety manages or controls in providing the Services. Measures may include isolating devices, disabling accounts, revoking sessions or tokens, changing credentials, blocking malicious traffic, or disconnecting management tools or integrations.

Client also authorizes automated security measures triggered by configured detections within the scope of the Services and the response settings documented under the Services Guide. Those measures may occur without prior review by Surety personnel. The requirements in this provision concerning notice, reasonable efforts to limit disruption, and PHI apply to those measures.

When delay would materially increase the risk of harm, Surety may act without prior notice or separate approval. Surety will promptly notify Client of material containment measures and their known operational effects. Surety will use reasonable efforts to limit disruption and remove temporary restrictions when it reasonably determines they are no longer necessary.

Containment may interrupt access or Services. This authorization does not expand monitoring coverage, staffing, or Response Time Objectives. All measures remain subject to applicable law and any Business Associate Agreement, including obligations concerning access to and availability of PHI.

Charges for containment and approval of additional response work are governed by the Services Guide.

Arbitration

a) Covered Disputes. An action to collect undisputed Fees and a claim eligible for resolution in small claims court are excluded from arbitration. Either party may seek temporary or preliminary injunctive relief in court to prevent irreparable harm, including misuse of Confidential Information or failure to return Surety-owned equipment, without waiving arbitration of the underlying dispute. Any other dispute arising from or related to this Agreement, including arbitrability, will be resolved exclusively by final and binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules and decided by one arbitrator. Judgment on the award may be entered in any court having jurisdiction. The Federal Arbitration Act governs the interpretation and enforcement of this "Arbitration" section.

b) Arbitrator Selection. The parties will mutually select an arbitrator experienced in commercial contract or information-technology matters. If they do not agree within fifteen (15) days after an arbitration demand, the AAA will appoint the arbitrator under its rules. If the AAA is unavailable or unwilling to administer the dispute, Surety may designate another nationally recognized commercial arbitration administrator, subject to court appointment if required by applicable law. This section controls over a conflicting forum rule.

c) Seat; Hearing Format. The legal seat of arbitration is Douglas County, Nebraska. The arbitrator may conduct conferences and hearings remotely unless the arbitrator determines that an in-person proceeding is reasonably necessary. Any in-person hearing will occur in Douglas County unless the parties agree otherwise.

d) Procedure; Fees. Discovery will be limited to the specific disputed issues. The parties will initially share equally the arbitrator's compensation and forum fees. Each party will bear its own attorneys' fees and other legal expenses, except to the extent an award is expressly authorized by applicable law, imposed as a sanction, or recoverable under an enforceable indemnification obligation concerning a Third-Party Claim. The arbitrator may allocate arbitration costs other than attorneys' fees in the final award only to the extent permitted by applicable law.

e) Class Action Waiver. Each arbitration, court action, or other proceeding will be conducted only individually, not as a class, consolidated, mass, collective, or representative action. If this waiver is unenforceable for a claim, that aggregate claim will be litigated under this Agreement's exclusive venue provision and stayed pending arbitration of individual claims.

Miscellaneous

a) Changes to this Agreement and the Services Guide. Surety may revise this Agreement, the Services Guide, and affected Services to address legal, industry, and service changes. Each revision will show a new "Last Updated" date. A revision to either document takes effect thirty (30) days after Surety emails notice of it to Client's Authorized Contact, and that notice will summarize the material changes. The only exception is a revision to the Services Guide that is not materially adverse to active Services, which takes effect on its "Last Updated" date. A revision applies only prospectively and does not apply to a dispute, claim, or event arising before it takes effect. A revision does not change a Quote-Controlled Term in an existing Quote. Client may reject a revision that takes effect after notice by giving written notice before it takes effect. Surety may then continue the prior version through the current term or terminate the affected Services on thirty (30) days' notice without further liability, and no Early Termination Amount applies. Client remains responsible for Fees accrued through termination and Access License costs that Surety cannot reasonably avoid or mitigate. A change to the "Arbitration" section or to this provision requires Client's affirmative written acceptance. This provision does not apply to a Business Associate Agreement.

b) Provider Terms; Third-Party Terms Schedule. Third-Party Services may be subject to provider EULAs, customer, subscription, beneficiary, end-customer, data-processing, security, or similar terms (collectively, "Provider Terms").

i. Applicability. The Services Guide's Third-Party Terms Schedule identifies Provider Terms incorporated for a Third-Party Service included in an accepted Quote. Only obligations expressly applicable to Client, its users, or its use apply to Client. A term governing only Surety's provider relationship does not apply unless it expressly requires a customer obligation identified in the Schedule. Provider Terms may contain service levels, warranties, remedies, and liability limits different from this Agreement. By accepting a Quote, Client acknowledges a reasonable opportunity to review the identified terms.

ii. Acceptance. If a provider requires direct acceptance by Client or an Authorized User, Surety will not accept for Client or activate the affected Third-Party Service until that acceptance is completed. Surety will retain available acceptance evidence. If direct acceptance is not required, Client accepts the identified Provider Terms by accepting the Quote and this Agreement. Delayed acceptance may delay, suspend, or end the affected Service without Surety liability.

iii. Identification; Records. At or before Quote acceptance, the Schedule or Quote will identify each applicable document, official source, published version or effective date, and acceptance method. Surety will preserve an available static copy with the governing Quote, Agreement, and Services Guide versions. On written request, Surety will provide or identify Client's applicable Provider Terms.

iv. Changes; Client Obligations. If a provider changes terms required for continued Service, Surety will notify Client and preserve the revised version. Renewed direct acceptance requires Client's affirmative acceptance. Otherwise, Client accepts the change unless it objects in writing within fifteen (15) days after notice. After an objection, Surety may reasonably modify delivery, substitute substantially similar functionality, or terminate the affected Service on thirty (30) days' notice without liability. Termination is Client's sole remedy. Client will comply with identified Client obligations and reasonably cooperate with provider-required compliance verification. Client will reimburse Surety for Third-Party Provider costs or penalties caused by Client's failure. Client will indemnify Surety from Damages arising from its breach, subject to the "Indemnification" procedures above.

c) Assignment. Neither party may assign this Agreement or a Quote without the other's prior written consent. Surety may assign to a successor in connection with a merger, consolidation, sale of substantially all business assets, or transfer of more than fifty percent (50%) of its voting securities if the successor assumes Surety's obligations. Any attempted assignment in violation of this subsection is void. This Agreement binds and benefits permitted successors and assigns.

d) Amendment. Except for a revision made under "Changes to this Agreement and the Services Guide," an amendment must be in writing, issued by Surety, and affirmatively accepted by Client. The amendment must identify the affected document and provision and state the intended change. A Quote may establish and control the commercial and service-specific items listed under "Quote-Controlled Terms" without separately amending this Agreement or the Services Guide. Email and electronic signatures are sufficient.

e) Time Limitations. Unless applicable law prohibits it, a lawsuit or arbitration proceeding arising from a Service or Third-Party Product must be commenced within one (1) year after the claim accrues. This limitation does not apply to Client nonpayment, either party's indemnification obligations, or a breach of confidentiality.

f) Severability. An invalid, illegal, or unenforceable provision is ineffective only to that extent. Its enforceable remainder and all other provisions remain effective to the fullest extent permitted by law.

g) Entire Agreement; No Reliance; Conflicting Terms; No Waiver. This Agreement, each Quote, and the Services Guide are the entire agreement concerning the Services and supersede prior understandings, but prior payment obligations remain due. Terms in a Client purchase order, invoice, memorandum, portal, email, or other document do not bind Surety or modify these documents, even if Surety accepts, references, or processes that document, unless the change satisfies the "Amendment" provision. No outside representation, promise, inducement, personnel statement, course of dealing, usage of trade, marketing material, or promotional information modifies these documents or creates a duty, service level, promise, or guarantee. A waiver or extension for one occurrence does not waive another.

h) Force Majeure. Neither party is liable for delay or failure caused by circumstances beyond its reasonable control. Such circumstances include governmental action, natural disaster, terrorism, riot, sabotage, labor dispute, and utility, communications, transportation, or supply failure. They also include cyberattacks or malware that circumvent then-current protections and the failure, degradation, suspension, or unavailability of a Third-Party Service or upstream platform, network, or service. A party's performance is also excused to the extent delayed by the other party's act or omission. This provision does not excuse Client's obligation to pay Fees properly due under this Agreement.

i) Survival. Provisions that by their context are intended to survive termination or expiration will survive, including provisions concerning payment, intellectual property, warranty disclaimers, limitations of liability, releases, indemnification, confidentiality, data return and deletion, arbitration, governing law, and time limitations.

j) Governing Law; Venue. Except as stated in the "Arbitration" section, Nebraska law governs this Agreement, without regard to its conflict-of-laws principles. Client irrevocably consents to the exclusive jurisdiction and venue of the state and federal courts located in Douglas County, Nebraska, for each non-arbitrable claim arising from or related to this Agreement.

k) Third-Party Beneficiaries. No third party may rely on or enforce this Agreement except as expressly stated in a Provider Term identified in the Third-Party Terms Schedule. A Third-Party Provider is an intended beneficiary only of identified Client obligations that expressly grant it enforcement rights.

l) Notices; Electronic Records. Required notices must be in writing. Except where this Agreement expressly permits another method, notices to Surety must be sent by certified U.S. mail, return receipt requested, postage prepaid, or nationally recognized overnight courier, with an email copy. Mail and courier notices to Surety must be addressed to Surety Technologies Incorporated, 4617 S 139th St, Omaha, NE 68137, Attention: Contracts. The email copy must be sent to info@suretytek.com. Notices to Client may be sent by certified U.S. mail, return receipt requested, postage prepaid, nationally recognized overnight courier, or email to the Authorized Contact at the applicable address stated in the Quote.

Mail notice is effective three (3) business days after mailing. Courier notice is effective one (1) business day after delivery to the courier. Email notice is effective one (1) business day after transmission to the recipient's last known or designated legal-notice address, provided the sender receives no automated rejection or undeliverability notice. A notice to Surety is effective on the later of the applicable mail or courier notice date and the email notice date.

Tickets, help desk requests, recorded messages, and notices sent to other addresses are ineffective as formal notices. This subsection does not change the methods expressly permitted for Quote acceptance, amendments, service requests, or other operational changes. Electronic records, signatures, acceptance, delivery, and counterparts satisfy writing and original-document requirements.

m) Independent Contractor; Contractors. Surety is an independent contractor, not Client's employer, employee, partner, affiliate, or fiduciary. Client waives any fiduciary relationship asserted for an Out-of-Scope Service. Surety may use contractors and is responsible for their work under this Agreement to the same extent as work performed by Surety personnel. A Third-Party Provider's legal status depends on its function and applicable law, not this Agreement's terminology. Required PHI assurances and security obligations are governed by "Additional Agreements; HIPAA" and "Security Program." Except as applicable law or a Business Associate Agreement requires, Surety does not adopt a Third-Party Provider's warranty, service level, or performance obligation.

n) High-Risk Use. Client will not use or permit use of a Service or Third-Party Product for nuclear facilities, air traffic control, life support, or another activity where failure could reasonably cause death, personal injury, or catastrophic property or environmental damage. Surety is not liable for such use.

o) Publicity. Either party may publicize the parties' relationship and the general nature of the Services without consent but may not disclose the other's Confidential Information.

p) Export Compliance. Client will comply with applicable export, re-export, sanctions, and trade-control laws, including the U.S. Export Administration Regulations, International Traffic in Arms Regulations, and Office of Foreign Assets Control regulations. Client is solely responsible for compliance concerning its data and content.

q) Interpretation. In this Agreement, the Services Guide, and each Quote, "including" means "including without limitation." Headings are for convenience only and do not affect interpretation.

Last Updated: September 1, 2026