Master Services Agreement

Surety Technologies Incorporated · Last Updated: August 10, 2026

Scope

a) Context. "Client," "you," and "your" mean the entity that accepts a Surety quote, proposal, service order, or similar document (each, a "Quote"). This Agreement contains important payment, automatic-renewal, liability-limitation, and arbitration provisions and should be reviewed before accepting a Quote.

b) Scope of Services. The services Surety will provide or facilitate (the "Services") are limited to those expressly listed in a Quote and further described in the applicable Services Guide. Any other service, project, or matter is an "Out of Scope Service" and requires Surety's written agreement. The Services Guide is binding and contains service descriptions, service levels, payment provisions, and operating policies applicable to the Services.

c) Version. Each Quote will identify the applicable versions of this Agreement and the Services Guide by their respective "Last Updated" dates. If a Quote omits either version date, the applicable version will be the version displayed at the referenced URL when Client accepts the Quote. Surety will retain static copies of the applicable versions with the accepted Quote and will provide those copies to Client upon request. A later revision of this Agreement will not apply to an existing Quote unless accepted in accordance with the "Amendment" provision below. Later changes to the Services Guide are governed by the "Changes to Services Guide" provision below.

d) Conflicts. Except as stated below, this Agreement controls over the Services Guide and each Quote, and the Services Guide controls over each Quote. A Quote controls only as to the specific Services selected; their scope, specifications, deliverables, service levels, quantities, and locations; pricing, discounts, billing frequency, and payment schedule; and commencement date, initial term, and renewal term. Provider Terms apply to Client's use of the applicable Third Party Service only as stated in the "Provider Terms; Third-Party Terms Schedule" provision below. A service request, quantity adjustment, or other operational change expressly permitted by this Agreement or the Services Guide may be documented using the method stated in the applicable provision and does not amend any other term. Except for applicable Provider Terms as stated above, no Quote, Services Guide, email, invoice, purchase order, or other document modifies a provision concerning warranties, liability limitations, indemnification, confidentiality, data protection, arbitration, governing law, or amendment unless a Surety-initiated writing expressly identifies the provision being modified, states the intended modification, and is affirmatively accepted in writing by Client.

e) Third Party Providers/Services. Surety may use or facilitate products and services supplied by third parties ("Third Party Providers" and "Third Party Services") in delivering the Services.

i. Selection. Surety may select and replace Third Party Providers in its discretion, including providers not individually identified in a Quote, provided a replacement does not materially diminish the Services required by the Quote.

ii. Reseller. Surety is a reseller or facilitator, not the provider, of Third Party Services. As between Surety and Client, Third Party Services are provided "as is," and Surety is not responsible for a Third Party Service's defect, omission, interruption, failure, or a Third Party Provider's failure to perform. Surety may attempt a reasonable workaround but does not guarantee that one will be available or successful.

iii. Pass Through Increases. Surety may pass through any increase in the cost of a Third Party Service (a "Pass Through Increase") and will provide as much advance notice as reasonably practicable.

iv. Vendor Changes. If a Third Party Provider discontinues, materially modifies, or ends support for a Third Party Service, Surety may substitute a comparable service or reasonably modify the affected Services. Client will cooperate with the resulting transition. Surety is not liable for vendor-caused costs, downtime, or disruption, and transition labor is billable at Surety's then-current rates unless the Quote states otherwise.

v. Third Party Service Levels. Surety does not adopt or guarantee a Third Party Provider's service levels. Client's rights and remedies concerning a Third Party Service are limited to those expressly available under the applicable Provider Terms and any remedy Surety expressly agrees or is required to pass through. Surety does not represent that Client has a direct claim against a provider where Surety holds the provider agreement or license.

Implementation

a) Advice; Instructions. Client will promptly follow Surety's reasonable Service-related directions ("Advice"), including recommendations to replace, upgrade, secure, or stop disrupting the managed IT environment (the "Environment"), at Client's cost. Surety is not responsible for issues caused by Client's failure to follow Advice. If that failure makes any Service economically or technically unreasonable or impracticable, Surety may give Client at least ten (10) days to remediate and, if the issue continues, terminate the affected Services For Cause or exclude the affected portion of the Environment. Unless expressly included in a Quote, work required because Client did not follow Advice, made an unauthorized change, or failed to satisfy Minimum Requirements is out-of-scope.

b) Co-Management. "Co-Managed Providers" are Client personnel or other providers whose work overlaps or may conflict with the Services. Surety is not responsible for their acts or omissions or for resulting errors, downtime, security issues, or remediation. Client will indemnify and hold Surety harmless from damages arising from Environment issues that cannot be directly and unambiguously traced to Surety's wrongdoing. A Co-Managed Provider's authority is limited to the systems and access stated in a Quote or other written approval; Surety will yield to that provider's contrary direction only within that scope and will notify Client.

c) Prioritization. Surety will schedule and prioritize the Services as it reasonably determines. Start dates are estimates and may change based on prerequisites, onboarding, transition, and matters outside Surety's control.

d) Modifications. Client will not move or modify the Environment or install software in it without Surety's authorization. Surety is not responsible for an unauthorized change or any resulting issue.

e) Third Party Support. Surety may obtain vendor or OEM support when it determines that support is required and invoice Client for the related fees and costs ("OEM Fees"). Surety will seek advance approval when reasonably practicable, but may act without it in exigent circumstances. OEM Fees do not guarantee resolution.

f) Authorized Contacts. Surety may rely on directions and consent from Client's designated personnel or representatives ("Authorized Contacts"). If none is identified or available, the person who accepted the Quote or whom Client ordinarily presents as authorized will be an Authorized Contact. Surety may rely on that authority until it receives and implements Client's written change notice. A ticket, help desk request, or recorded message is not effective notice of a change. Surety may delay Services while confirming authority.

g) Access. Client authorizes Surety and its designated Third Party Providers to monitor, diagnose, communicate with, retrieve information from, install software agents in, and otherwise access the Environment as necessary for the Services. Client will obtain all required access rights, licenses, permits, and permissions and provide safe working conditions. Surety need not work under unsafe conditions or use extraordinary or non-industry-standard methods.

h) Encryption. Client will use application-level encryption for Confidential Information, sensitive information, and information protected by law or Client's contracts, including financial identifiers, government identifiers, protected health information, and nonpublic personal information. Client will indemnify and hold Surety harmless from claims, expenses, and reasonable attorneys' fees arising from Client's breach of this obligation. Surety is responsible for encryption configuration only when and to the extent expressly stated in a Quote or Services Guide.

i) Ongoing Requirements. All hardware and software in the Environment must be genuine and properly licensed, and Client will provide proof on request. Client will implement and continuously maintain Surety's required minimum hardware, software, and security conditions ("Minimum Requirements").

j) Response. Response commitments are governed by the Quote and Services Guide and do not apply during the Transition Exception; Scheduled, Client-Side, or Vendor-Side Downtime; a security-related suspension; or a force majeure event.

i. Scheduled Downtime. "Scheduled Downtime" is time designated by Surety for planned maintenance or adjustment. Without Client's authorization or exigent circumstances, it will not occur from 8:00 AM to 5:00 PM Central Time, Monday through Friday. Surety will use reasonable efforts to give at least twenty-four (24) hours' notice.

ii. Client-Side Downtime. "Client-Side Downtime" is delay or deficiency caused by Client or a Co-Managed Provider, including when Surety cannot obtain required participation, information, direction, or authorization. Surety is not responsible for Client-Side Downtime.

iii. Vendor-Side Downtime. Surety is not responsible for delay or deficiency caused by a Third Party Provider, licensor, or other upstream vendor ("Vendor-Side Downtime").

iv. Transition Exception. Response commitments do not apply during the first forty-five (45) days after a Service begins or while Surety performs offboarding or transition work, and unanticipated delay or downtime may occur during those periods (the "Transition Exception").

k) Right to Inspect. On reasonable advance notice and during normal business hours, Surety may inspect the Environment, premises, equipment, and security controls to verify compliance. Client will cooperate and correct noncompliance within the cure period stated under "Advice; Instructions."

l) Security Program. Surety will maintain reasonable administrative, technical, physical, and disposal safeguards appropriate to Surety's size and resources and to the nature and sensitivity of Client personal information in Surety's possession or control. Surety will contractually require a Third Party Provider receiving that information from Surety to maintain reasonable, appropriate security procedures and practices. An applicable Business Associate Agreement controls Surety's safeguards for protected health information. This paragraph states Surety's obligations under Neb. Rev. Stat. § 87-808 and comparable state laws; it does not guarantee a security outcome and remains subject to the Warranty Disclaimer and Liability Limitations.

Fees; Payment

a) Fees. Client will pay the fees, costs, and expenses stated in each Quote and the Services Guide ("Fees"), plus Surety's miscellaneous costs of providing the Services ("Miscellaneous Expenses"). Miscellaneous Expenses will be itemized and will not exceed $250 per month without Client's prior consent, except for reasonable incremental costs incurred while providing Services during a national, state, or local emergency or a fuel, labor, utility, or similar shortage. Client is also responsible for freight, insurance, and applicable taxes, duties, and assessments, unless Client provides valid proof of exemption. Unless a Quote states otherwise, recurring Services are invoiced monthly in advance, all invoices are due within fifteen (15) days, and time is of the essence.

b) Nonpayment. An amount unpaid more than fifteen (15) days after its due date accrues a charge of one and one-third percent (1.33%) per month, or the maximum lawful rate if lower, for each month or partial month it remains past due. Surety may apply payments to delinquent amounts and, without further notice, suspend any Service when an undisputed amount is at least fifteen (15) days past due; recurring charges continue during suspension. Restoration is subject to full payment and Surety's validation that managed components meet its then-current security and maintenance standards, and Surety may charge a reconnect fee not exceeding ten percent (10%) of monthly recurring Fees. Suspension may cause loss of functionality, licenses, or data. Notwithstanding the foregoing, if an applicable Business Associate Agreement governs the affected Service, Surety will not use the suspension or the restoration condition in this paragraph to block or terminate access by the covered entity or other authorized recipient identified in that Business Associate Agreement to Protected Health Information maintained by Surety on its behalf. Surety will preserve and provide that Protected Health Information for access, return, or export as required by the Business Associate Agreement and applicable law. Surety may suspend non-PHI functions and pursue all payment and collection remedies, but this limitation does not waive Fees or require Surety to provide unpaid transition, migration, restoration, or forensic services except to the extent required by the Business Associate Agreement or applicable law. The waiver and release in this paragraph does not apply to a claim based on Surety's violation of these Protected Health Information obligations or non-waivable law. Client waives and releases, and will hold Surety harmless from, claims by Client or its personnel, customers, agents, or contractors arising directly or indirectly from a suspension under this paragraph. Surety may recover reasonable collection-agency charges, court costs, filing fees, attorneys' fees, and other out-of-pocket costs of collecting undisputed amounts, in each case only to the extent authorized by applicable law. A Fee dispute is waived unless Surety receives notice within sixty (60) days after the later of performance or the invoice date.

c) Ownership of Deliverables. "Client Deliverables" means final reports, network diagrams, configuration documentation, and written plans created specifically for Client, together with any other items expressly identified as deliverables in a Quote. "Surety Materials" means all software, code, scripts, tools, templates, processes, methodologies, know-how, documentation, and other materials that (i) Surety owned or developed before providing the Services, (ii) Surety develops independently of the Services, or (iii) are of general applicability or reusable in Surety's business and do not contain Client's Confidential Information. Surety Materials include all modifications and improvements to those materials.

Surety owns each Client Deliverable until paid in full. Upon full payment, Surety assigns Client all right, title, and interest in it, excluding Surety Materials and Third Party Provider materials, and will execute documents reasonably necessary to evidence the assignment. For Surety Materials incorporated into a paid Client Deliverable, Surety grants Client a perpetual, worldwide, non-exclusive, royalty-free license to use, copy, and modify those materials only as part of that Client Deliverable for Client's internal business purposes and to permit its employees and service providers to do so on its behalf. Except for rights expressly assigned or licensed in this paragraph, each party retains its preexisting and independently developed intellectual property. Third Party Provider materials and software are licensed, not sold, and may be used only under the applicable provider terms. Client retains ownership of data and materials it furnishes. This paragraph does not limit Surety's "Transition; Deletion of Data" obligations.

d) Minimum Monthly Fees. The initial recurring Fees in a Quote are the minimum monthly fees ("MMF") for every month the affected Services remain active, including during month-to-month service and each renewal term. Billing will not fall below the MMF when users, devices, or other covered quantities decrease unless Surety agrees in writing. Quantity changes must otherwise be accepted in writing by both parties, except adjustments made under the Services Guide's "Changes to Environment" provision.

e) Increases. Surety may increase monthly recurring Fees through Client's invoice. If one increase, or the aggregate increases, in a calendar year exceeds ten percent (10%) of the prior calendar year's Fees for the same Services, Client may terminate the affected Services by written notice within sixty (60) days after the increase. A timely termination does not eliminate Fees accrued through termination or pre-approved, non-mitigatable expenses. Continued use after that period accepts the increase. Pass Through Increases are excluded from this ten-percent calculation.

f) Automatic Payment. Client will maintain an authorized ACH account or credit card for automatic payment of all invoices. If Client authorizes both, Surety will attempt ACH first and may charge the card if ACH fails.

i. ACH. Client authorizes Surety to debit its designated account for amounts due. The authorization continues until Client terminates it in writing. A returned debit is subject to a $35 service charge or the maximum lawful amount, whichever is less.

ii. Credit Card. Client authorizes Surety to charge its designated card for amounts due. Surety may add a convenience fee not exceeding its actual card-acceptance cost.

Limited Warranties; Limitations of Liability

a) Hardware / Software Purchases. Equipment, hardware, software, peripherals, and accessories purchased through Surety ("Third Party Products") are nonrefundable once ordered unless the provider or reseller permits a return. Client is responsible for all restocking, return, and warranty-service charges. Surety will use reasonable efforts to pass through available provider warranties and service commitments but does not insure or guarantee a Third Party Product's quality, operation, performance, uptime, usefulness, returnability, or exchangeability. AS BETWEEN SURETY AND CLIENT, ALL THIRD PARTY PRODUCTS ARE PROVIDED "AS IS" WITHOUT ANY EXPRESS OR IMPLIED WARRANTY.

b) Shipment; Risk of Loss. Unless a Quote states otherwise, Third Party Products are shipped FOB point of shipment at Client's cost, and risk of loss passes to Client when delivered to the carrier or Client's representative at that point.

c) Order Cancelation. Client may cancel an order for a Third Party Product only with Surety's written approval and on terms that indemnify Surety against all related losses.

d) Product Pricing; Payment; Permits. Unless a Quote states otherwise, Third Party Product pricing is valid for one (1) day, and Surety will not order a product until Client pays in full. Payment must be in U.S. currency. Client will obtain all governmental licenses, permits, and approvals required for the transaction.

e) Product Liability. NO MONETARY RECOVERY IS AVAILABLE FROM SURETY FOR WARRANTY CLAIMS RELATED TO THIRD PARTY PRODUCTS. IN NO EVENT WILL SURETY'S LIABILITY TO CLIENT RELATED TO A THIRD PARTY PRODUCT EXCEED THE PURCHASE PRICE PAID FOR THAT PRODUCT.

f) Services Warranty; Acceptance. Surety warrants that experienced, qualified personnel will perform the Services professionally and in accordance with generally accepted industry standards. A Service is accepted unless Client rejects it for nonconformance in a reasonably detailed writing within fifteen (15) days after performance. Acceptance does not waive a latent defect that could not reasonably have been discovered during that period if Client gives written notice within ninety (90) days after it knew or reasonably should have known of the defect. If Surety confirms nonconformance, it will use commercially reasonable efforts to re-perform the affected Service at no charge as Client's sole and exclusive remedy. This remedy does not apply to a defect caused by Client's failure to follow Advice, an unauthorized Environment change, or a Legacy Device.

g) Warranty Disclaimer. EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT OR A QUOTE, NEITHER PARTY MAKES ANY EXPRESS, IMPLIED, STATUTORY, OR OTHER WARRANTY, INCLUDING A WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR ARISING FROM USAGE OF TRADE OR COURSE OF PERFORMANCE. NO SURETY PERSONNEL MAY MAKE AN ADDITIONAL WARRANTY, AND CLIENT IS NOT RELYING ON ONE. THE INTERNET IS INHERENTLY INSECURE AND MAY BE UNRELIABLE, INTERRUPTED, DISRUPTED, OR BREACHED, FOR WHICH SURETY IS NOT LIABLE.

h) Liability Limitations. This paragraph is a bargained-for, material part of the parties' relationship, and Surety would not enter this Agreement or provide Services without it. IN NO EVENT WILL EITHER PARTY BE LIABLE FOR INDIRECT, SPECIAL, EXEMPLARY, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST REVENUE, PROFITS (EXCEPT FEES OWED TO SURETY), SAVINGS, OR OTHER INDIRECT OR CONTINGENT ECONOMIC LOSS ARISING FROM THE SERVICES, THIS AGREEMENT, A QUOTE, A BREACH, OR A DELAY, EVEN IF ADVISED OF THE POSSIBILITY. This exclusion does not limit amounts Client owes Surety or Client's indemnification obligations. Any attorneys' fees or costs recoverable from either party under this Agreement are subject to the aggregate liability limitation in this paragraph, except to the extent they arise from Client's indemnification obligations or applicable law prohibits that limitation. Except for those exclusions, each party's aggregate liability for all claims arising from or related to this Agreement, whether in contract, tort, indemnification, negligence, or otherwise, is limited to actual direct damages not exceeding the Fees Client paid Surety, excluding licenses, hardware, and pass-through third party charges, during the twelve (12) months before the cause of action accrued. Insurance does not increase this cap. These limitations apply even if a remedy fails of its essential purpose, but not to the extent prohibited by law or to a claim caused by the responsible party's willful misconduct or gross negligence. Liability will be reduced to the extent the other party's willful misconduct, gross negligence, or failure to reasonably mitigate caused the claim. Surety has no liability arising from Out of Scope Services.

i) Admin/Root Access. Client should not give administrative or root access to non-Surety personnel. If Client requests or requires such access, Client will indemnify and hold Surety harmless from Environment issues, downtime, security vulnerabilities, damages, expenses, claims, and liabilities arising from or reasonably traceable to administrative or root activity not performed or separately authorized in writing by Surety. Surety's business records are presumptive evidence of performance or written authorization absent manifest error. Approving a person's access does not approve that person's activity; an activity is authorized only by a separate Surety writing identifying it.

j) Legacy Devices. A "Legacy Device" is hardware or software that is outdated, obsolete, incompatible with industry standards, or unsupported by its manufacturer. If a Legacy Device remains in the Environment, including because Client declines replacement, Surety and its Third Party Providers are not responsible for remediating an issue arising from it and will be held harmless from related issues, claims, and causes of action. Client should determine whether Legacy Devices affect its insurance coverage.

k) Non-Managed Systems. Surety is not liable for damage caused by a service, system, software, or component that Surety and its personnel do not furnish or manage under this Agreement.

Indemnification

Each party (an "Indemnifying Party") will defend the other party (an "Indemnified Party") against any claim, demand, action, or proceeding brought by a person or entity that is not a party to this Agreement (a "Third-Party Claim") alleging facts that, if true, would constitute the Indemnifying Party's breach of this Agreement, and will indemnify and hold the Indemnified Party harmless from all resulting losses, damages, judgments, settlements, liabilities, costs, and reasonable attorneys' fees ("Damages") to the extent arising from or related to that breach. This Section does not create a right to indemnification or attorneys' fees for a direct claim between the parties.

The Indemnified Party will promptly give written notice of a Third-Party Claim and provide reasonable cooperation at the Indemnifying Party's expense. A delay in notice reduces the Indemnifying Party's obligations only to the extent the delay materially prejudices the defense. Subject to the rights of any applicable insurer, the Indemnifying Party may assume and control the defense with competent counsel reasonably acceptable to the Indemnified Party. The Indemnified Party may participate through counsel of its choice at its own expense. If the Indemnifying Party does not promptly assume and diligently conduct the defense, the Indemnified Party may do so, and its reasonable defense costs will constitute Damages.

The Indemnifying Party may settle a Third-Party Claim without the Indemnified Party's consent only if the settlement fully and unconditionally releases the Indemnified Party, requires no admission or nonmonetary obligation from it, and is fully paid by the Indemnifying Party. Any other settlement requires the Indemnified Party's prior written consent, which will not be unreasonably withheld, conditioned, or delayed.

These procedures apply to Third-Party Claims subject to another indemnification obligation in this Agreement unless the applicable provision expressly states otherwise. Nothing in this Section narrows any separate Client waiver, release, hold-harmless obligation, or indemnity stated elsewhere in this Agreement.

Term; Termination

Each Quote has its own term. Ongoing Managed Services may renew automatically as stated below.

a) This Agreement. This Agreement applies to all Services beginning on the earlier of Client's acceptance of a Quote or Surety's provision or facilitation of a Service (the "Effective Date"). It remains effective until terminated under this section or until six (6) months after the last Service ends. Ending one Quote does not end another. When this Agreement or a Quote ends, the affected Services cease, but accrued payment obligations and provisions intended to survive remain effective.

b) Quote Terms; Auto-Renewal. Each Quote and the Services Guide state the term of its Services. Unless a Quote states otherwise, each ongoing, recurring Managed Service invoiced monthly renews automatically for successive terms equal to its initial term unless either party gives the other at least thirty (30) days written notice of nonrenewal before the current term ends. If the initial term is a Minimum Term, each renewal term is also a Minimum Term for all purposes of this Agreement. Nonrenewal takes effect at the end of the current term. One-time projects, break/fix assignments, temporary services, and other non-recurring Services do not auto-renew.

c) Termination for Convenience. Unless the affected Quote states a Minimum Term or longer notice period, either party may terminate this Agreement or a Quote for convenience on thirty (30) days prior written notice. Termination of this Agreement while a Quote remains active takes effect when the last active Quote ends. A Minimum Term may not be ended for convenience before it expires without Surety's written consent, and Client's early termination is subject to the remedies below.

d) Termination For Cause. A party may terminate the affected Quote or this Agreement For Cause if the other party materially breaches this Agreement, a Quote, or the Services Guide and does not cure the breach within twenty (20) days after detailed written notice, reduced to ten (10) days for Client's nonpayment.

i. Remedies. If Surety terminates For Cause or Client terminates for convenience, Client will pay all Fees accrued through termination and all pre-approved, non-mitigatable expenses. If, before the current Minimum Term expires, Client ends affected Services for convenience without Surety's consent or Surety terminates them For Cause for Client's uncured material breach, Client will also pay an Early Termination Amount consisting of: (A) unpaid Fees accrued through termination; (B) noncancelable, non-mitigatable Third Party Provider charges committed through the end of the Minimum Term; (C) recurring service Fees that would have been payable through the end of the Minimum Term, excluding charges under subsection (B), less direct labor and variable costs Surety reasonably avoids and amounts actually recovered through reasonable mitigation; and (D) any unamortized onboarding credit, implementation credit, or hardware subsidy identified in the Quote. Surety will reasonably mitigate subsection (C), will not recover an item twice, and will provide a reasonable itemization on request. Subsections (B) through (D) will not exceed the Fees and costs Client would have paid through the Minimum Term. The parties agree this formula reasonably estimates difficult-to-calculate probable loss, including any price discount given for the Minimum Term, is proportionate to that loss, and is liquidated damages rather than a penalty. If Client terminates For Cause, Client owes only for properly delivered and accepted Services through termination and non-mitigatable Access Licenses.

e) Client Conduct. Surety may terminate the affected Quote or this Agreement For Cause on ten (10) days written notice if conduct by Client or its personnel, contractors, or representatives makes providing the Services impracticable, imprudent, or unreasonable and continues after Surety identifies the issue.

f) Mutual Termination. The parties may end a Quote or this Agreement at any time by written agreement.

g) Equipment; Software Agents. At termination, Client will provide normal-business-hours access for Surety to remove Surety-owned equipment. Client will immediately pay replacement value for equipment that is missing or damaged beyond normal wear. Client will not remove, disable, circumvent, or disrupt a Surety software agent unless Surety directs it to do so. Surety will delete information from returned equipment using commercially reasonable methods but does not guarantee that deleted information is irrecoverable; Client should permanently delete sensitive information before returning equipment.

h) Transition; Deletion of Data. At termination, regardless of unpaid Fees, Surety will provide Client the administrative credentials for Client's systems, tenants, domains, and accounts; Client data in the format Surety ordinarily maintains it; and configuration documentation for Client-owned equipment and cloud resources. Surety will not withhold those items for nonpayment. Additional transition, migration, knowledge-transfer, or conversion services are billed at Surety's then-current rates and may be conditioned on payment of outstanding Fees and reasonable advance payment. Surety need not provide its proprietary tools, scripts, templates, runbooks, or internal documentation. Except for backup data as stated below or where a Quote, the Services Guide, applicable law, or a Business Associate Agreement requires otherwise, Surety need not retain Client data after termination.

i) Backup Data. During backup Services, retention is governed by the Quote and Services Guide. After termination, Surety will keep backup data available for requested recovery or export for thirty (30) days (the "Backup Availability Period"), unless a Quote, Business Associate Agreement, or applicable law requires otherwise. Surety will not withhold backup data for nonpayment, but assistance and media, storage, and egress costs are chargeable and may be conditioned on outstanding Fees and reasonable advance payment. After that period, Surety will initiate deletion and deprovisioning using commercially reasonable safeguards. Data may temporarily remain unavailable in vendor-controlled residual systems and may be retained as required by law, a Business Associate Agreement, or legal hold. Any longer availability requires Surety's written agreement and is billed as an ongoing service.

Confidentiality

a) Defined. "Confidential Information" means non-public information disclosed by one party (the "Discloser") to the other (the "Recipient"), including customer data and lists, internal documents and communications, proprietary reports, and methodologies. It excludes information that, without the Recipient's breach, becomes public; was independently developed by the Recipient; or was lawfully obtained from a third party without a confidentiality obligation.

b) Protection and Use. The Recipient will protect Confidential Information with the same care it uses for its own comparable information, but no less than commercially reasonable care, and will use or disclose it only as the Discloser authorizes in writing, as needed to perform this Agreement, or as law requires.

c) Compelled Disclosure. Unless prohibited by law, a Recipient legally compelled to disclose Confidential Information will promptly notify the Discloser and, at the Discloser's expense, reasonably cooperate in seeking protection. If protection or waiver is unavailable, the Recipient may disclose only the portion its counsel advises is legally required.

d) Additional Agreements; HIPAA. If an additional nondisclosure agreement applies to third party information, this section and that agreement are read together, and the more protective term governs the affected information. If Surety will create, receive, maintain, or transmit protected health information on Client's behalf, the parties will execute a Business Associate Agreement before Surety receives access or begins the affected Service. That agreement controls only to the extent of a conflict concerning protected health information. Surety will obtain the assurances required by 45 C.F.R. § 164.308(b)(2) from each Third Party Provider handling protected health information on Surety's behalf.

Arbitration

Except for an action to collect undisputed Fees or a matter within the local small claims court's jurisdiction, any dispute arising from or related to this Agreement, including arbitrability, will be resolved by one arbitrator under the American Arbitration Association's Commercial Arbitration Rules. The parties will mutually select an arbitrator experienced in contract, intellectual-property, and information-technology matters. If they do not agree within fifteen (15) days after a demand, the AAA will select the arbitrator. If no AAA-certified arbitrator is available within twenty (20) miles of Surety's office, Surety may select another commercial arbitration forum and its rules. This paragraph controls over conflicting forum rules. Arbitration will occur at Surety's office unless the parties agree otherwise. Discovery will be limited to the specific disputed issues. The parties will initially split the arbitrator's compensation and forum fees. Each party will bear its own attorneys' fees and other legal expenses, except to the extent an award is expressly authorized by applicable law, imposed as a sanction, or recoverable under an enforceable indemnification obligation concerning a Third-Party Claim. The arbitrator may allocate arbitration costs other than attorneys' fees in the final award only to the extent permitted by applicable law.

Class Action Waiver. Each arbitration, court action, or other proceeding will be conducted only individually, not as a class, consolidated, mass, collective, or representative action. If this waiver is unenforceable for a claim, that aggregate claim will be litigated under this Agreement's exclusive venue provision and stayed pending arbitration of individual claims.

Miscellaneous

a) Changes to Services Guide. Surety may revise the Services Guide and affected Services to address industry and service changes. Each revision will show a new "Last Updated" date. A revision that does not materially and negatively affect active Services takes effect on that date. For a materially negative revision, Surety will give Client at least thirty (30) days email notice. Client may reject it by written notice within thirty (30) days after Surety's notice, after which Surety may either continue the prior version through the current term or terminate the affected Services on thirty (30) days notice without further liability. Client remains responsible for Fees accrued through termination and non-mitigatable Access License costs.

b) Provider Terms; Third-Party Terms Schedule. Third Party Services may be subject to provider EULAs, customer, subscription, beneficiary, end-customer, data-processing, security, or similar terms (collectively, "Provider Terms"). The Services Guide's Third-Party Terms Schedule identifies the Provider Terms incorporated for a Third Party Service included in an accepted Quote. Only obligations expressly applicable to Client, its users, or its use apply to Client. A term governing only Surety's provider relationship does not apply unless it expressly requires a customer obligation identified in the Schedule. Provider Terms may contain service levels, warranties, remedies, and liability limits different from this Agreement. By accepting a Quote, Client acknowledges a reasonable opportunity to review the identified terms.

If direct acceptance is required, Surety will not accept for Client or activate the Service until Client accepts, and Surety will retain available acceptance evidence. Otherwise, Client accepts the identified Provider Terms by accepting the Quote and this Agreement. A delayed acceptance may delay, suspend, or end the Service without Surety liability.

At or before Quote acceptance, the Schedule or Quote will identify each applicable document, official source, published version or effective date, and acceptance method. Surety will preserve an available static copy with the governing Quote, Agreement, and Services Guide versions and will provide or identify Client's applicable Provider Terms on written request.

Surety will notify Client and preserve the revised version if a provider changes terms required for continued Service. Renewed direct acceptance requires Client's affirmative acceptance. Otherwise, Client accepts the change unless it objects in writing within fifteen (15) days after notice. After an objection, Surety may reasonably modify delivery, substitute substantially similar functionality, or terminate the affected Service on thirty (30) days notice without liability; termination is Client's sole remedy. Client will comply with identified Client obligations, reasonably cooperate with provider-required compliance verification, reimburse provider costs or penalties caused by its failure, and indemnify Surety from Damages arising from its breach, subject to this Agreement's indemnification procedures.

c) Devices. Client represents and warrants that it is authorized to permit Surety to access every device connected to the Environment, regardless of ownership. A managed device receives no Service while powered off or disconnected. Surety need not support an unknown or uncovered device and is not responsible for issues it causes.

d) Insurance Forms. Surety's assistance with an insurance form or questionnaire reflects only its knowledge of the Environment when answered. An undisclosed change, failure to implement, circumvention, or disabling of a Service feature ("Unauthorized Activity") may make an answer inaccurate or obsolete. Client will indemnify and hold Surety harmless from claims, expenses, and reasonable attorneys' fees caused by Unauthorized Activity or a resulting inaccuracy.

e) Compliance; Client Responsibilities. Unless a Quote expressly states otherwise, the Services may facilitate but do not guarantee regulatory compliance and are not a legal opinion or compliance solution. Client is responsible for its laws, regulations, legal advice, and the continued accuracy of any Surety recommendation after legal requirements change. Client represents that it knows of no requirement that would impede the Services or require Surety to register or report them and will promptly identify any such requirement and any legally protected data before Surety receives access. Surety may adjust scope and pricing to address those requirements. Client will not use the Environment or Services for unlawful activity.

f) Security Limitations. No security solution is completely effective. Surety does not guarantee that a security product will detect, prevent, quarantine, or remove every threat or that deleted, corrupted, or encrypted data ("Impacted Data") is recoverable. Impacted Data recovery and activation of multifactor authentication are out-of-scope unless a Quote or the Services Guide states otherwise. Client should train its personnel to recognize phishing. Throughout the term of each Quote, Client will maintain, at its own expense, cyber and privacy liability insurance with limits of not less than $1,000,000 per claim and in the aggregate, or any higher amount stated in a Quote. The policy will provide first-party and third-party coverage appropriate to Client's operations, including coverage for data breaches, network-security and privacy liability, breach-response and forensic costs, restoration or replacement of lost or corrupted data, business interruption, cyber extortion or ransomware, and regulatory investigations, defense costs, fines, and penalties to the extent insurable. Upon Surety's reasonable request, Client will provide a certificate of insurance or other reasonable evidence of current coverage and will notify Surety promptly after Client receives notice of cancellation or a material reduction in coverage. Client's insurance does not limit Client's obligations or liability under this Agreement. Client releases and holds Surety harmless from malware-related costs, damages, and expenses unless caused by Surety's intentionally malicious conduct or gross negligence.

g) Physical Security. Client will maintain reasonable physical security for managed hardware in its control, including access barriers, an alarm system, fire detection and retardant systems, and periodic personnel-access reviews.

h) Updates. Hardware and software updates are supplied by third parties. If installation is included in the Services, Surety will follow the manufacturer's recommendations but does not guarantee an update's performance and is not responsible for resulting downtime, loss, or remediation. Surety may defer an update until it reasonably determines the update is compatible and materially beneficial.

i) Assignment. Neither party may assign this Agreement or a Quote without the other's prior written consent. Surety may assign to a successor in connection with a merger, consolidation, sale of substantially all business assets, or transfer of more than fifty percent (50%) of its voting securities if the successor assumes Surety's obligations. This Agreement binds and benefits permitted successors and assigns.

j) Amendment. Except for a revision to the Services Guide made under "Changes to Services Guide," this Agreement, the Services Guide, or a Quote may be amended only by a Surety-initiated writing that identifies the document and specific provision being amended, states the intended amendment, and is affirmatively accepted in writing by Client. A Quote may establish and control the commercial and service-specific items listed under "Conflicts" without separately amending this Agreement or the Services Guide. Email and electronic signatures are sufficient.

k) Time Limitations. Unless law prohibits it, an action arising from a Service or Third Party Product must begin within one (1) year after it accrues. This limit does not apply to Client nonpayment, either party's indemnification obligations, or a confidentiality breach.

l) Severability. An invalid, illegal, or unenforceable provision is ineffective only to that extent; its enforceable remainder and all other provisions remain effective to the fullest extent permitted by law.

m) Entire Agreement; Conflicting Terms; No Waiver. This Agreement, each Quote, and the Services Guide are the entire agreement concerning the Services and supersede prior understandings, but prior payment obligations remain due. Terms contained in a Client purchase order, invoice, memorandum, portal, email, or other document do not bind Surety or modify these documents, even if Surety accepts, references, or processes that document, unless the change satisfies the "Amendment" provision. No outside representation, promise, inducement, personnel statement, course of dealing, usage of trade, marketing material, or promotional information modifies these documents or creates a duty, service level, promise, or guarantee. A waiver or extension for one occurrence does not waive another.

n) Force Majeure. Neither party is liable for delay or failure caused by circumstances beyond its reasonable control, including the other party's act or omission; governmental action; natural disaster; terrorism, riot, sabotage, or labor dispute; utility, communications, transportation, or supply failure; cyberattack or malware that circumvents then-current protections; or the failure, degradation, suspension, or unavailability of a Third Party Service or upstream platform, network, or service.

o) Survival. Provisions that by their context are intended to survive termination or expiration will survive.

p) Governing Law; Venue. Nebraska law governs this Agreement. Client irrevocably consents to exclusive jurisdiction and venue in Douglas County, Nebraska, for each non-arbitrable claim arising from or related to this Agreement.

q) Third Party Beneficiaries. No third party may rely on or enforce this Agreement except as expressly stated in a Provider Term identified in the Third-Party Terms Schedule. A Third Party Provider is an intended beneficiary only of identified Client obligations that expressly grant it enforcement rights.

r) Notices; Electronic Records. Required notice may be sent by prepaid first-class certified or return-receipt mail, overnight courier, or email and is delivered three (3) business days after mailing, one (1) day after courier delivery, or one (1) day after email delivery. Email notice is valid only to the recipient's last known or designated legal-notice address. Notices to Surety must be addressed to Surety Technologies Incorporated, 4617 S 139th St, Omaha, NE 68137, Attention: Contracts, with an email copy to info@suretytek.com; notices to Client go to the Quote's Authorized Contact and address. Tickets, help desk requests, recorded messages, and other addresses are ineffective. Electronic records, signatures, acceptance, delivery, and counterparts satisfy writing and original-document requirements.

s) Independent Contractor; Contractors. Surety is an independent contractor, not Client's employer, employee, partner, affiliate, or fiduciary, and Client waives any fiduciary relationship asserted for an Out of Scope Service. Surety may use contractors and stands behind their onsite work as its own. A Third Party Provider's legal status depends on its function and applicable law, not this Agreement's terminology. Required PHI assurances and security obligations are governed by the "Additional Agreements; HIPAA" and "Security Program" provisions. Except as law or a Business Associate Agreement requires, Surety does not adopt a Third Party Provider's warranty, service level, or performance obligation.

t) International Access. Services may be performed outside the United States, and Client data may be accessed, viewed, or stored on secure servers outside the United States. Client will notify Surety of a contrary requirement, and related changes may involve additional cost.

u) Access Licensing. A Service may require noncancelable, nontransferable per-seat or per-device Third Party Provider licenses ("Access Licenses"). Regardless of why Services end, Client will pay each Access License for its full term. Once paid in full, Client may use it until expiration.

v) High Risk Use. Client will not use or permit use of a Service or Third Party Product for nuclear facilities, air traffic control, life support, or another activity where failure could reasonably cause death, personal injury, or catastrophic property or environmental damage. Surety is not liable for such use.

w) Publicity. Either party may publicize the parties' relationship and the general nature of the Services without consent but may not disclose the other's Confidential Information.

x) Export Compliance. Client will comply with applicable export, re-export, sanctions, and trade-control laws, including the EAR, ITAR, and OFAC regulations, and is solely responsible for compliance concerning its data and content.

y) Data Breach Notification. Client owns data processed through the Environment and is primarily responsible for applicable breach-notification duties, including under Neb. Rev. Stat. § 87-801 et seq. and Iowa Code ch. 715C. Surety will notify Client of an actual or reasonably suspected security breach affecting Client data without unreasonable delay and within any period applicable law requires, reasonably cooperate with Client's investigation, and provide legally required information and reasonably available forensic information, subject to law and confidentiality protections. Legally required notice and information are provided without additional charge; other incident-response or forensic services are billable unless a Business Associate Agreement states otherwise. Surety need not notify individuals or regulators directly unless law requires it.

z) Payment Card Data. Surety does not store, process, or transmit cardholder or sensitive authentication data ("Account Data") for Client. Client will not place, send, or route Account Data through Surety's custody or systems and will promptly report any occurrence. For a system component Client identifies in a Quote as within or connected to its cardholder data environment ("CDE"), Surety is responsible only for security tasks expressly assigned in that Quote or its responsibility matrix. Client is responsible for CDE scope, PCI DSS compliance, and validation. Surety is not a Qualified Security Assessor and provides no PCI DSS assessment, validation, remediation, or compliance service unless a Quote expressly says so.

Last Updated: August 10, 2026