IT Audit Agreement

CLIENT RESPONSIBILITY FOR RECORDS AND DATA. A. Accuracy and Completeness. Client is solely responsible for the accuracy, completeness, and legitimacy of all source documents, data, and information provided to the Firm, including but not limited to: bank statements, credit card statements, invoices, receipts, payroll records, loan documents, expense reports, and any other financial records (collectively, "Client Records"). The Firm will rely on Client Records without audit or independent verification. B. Timeliness. Client agrees to deliver all Client Records necessary for the Firm to perform the services described herein by the Monthly Document Submission Deadline (e.g., 5th) of each month (the "Submission Deadline"). Time is of the essence with respect to the Submission Deadline. Failure to deliver Client Records by the Submission Deadline may result in delayed deliverables, additional fees, or suspension of services as described in Section [Stop-Work & Suspension]. C. Reliance and Proportionate Fault. The Firm's work product is based solely on Client Records provided by Client. The Firm is not required to independently verify, audit, or confirm the accuracy of any Client Records. If Client Records are inaccurate, incomplete, or fraudulent, the Firm's liability for any resulting errors, omissions, or misstatements in the work product shall be reduced proportionately to the extent that such errors, omissions, or misstatements result from inaccuracies in or omissions from Client Records. Client agrees to indemnify and hold harmless the Firm for any losses, claims, damages, or expenses arising from Client's failure to provide accurate and complete Client Records. D. Notification. Client agrees to promptly notify the Firm of any facts or circumstances that may affect the financial statements or any other work product delivered under this engagement, including any discovered errors, fraud, or changes in Client's business operations or financial condition. E. No Independent Investigation. Nothing in this engagement requires the Firm to investigate the propriety or legality of any transaction. If the Firm becomes aware of information indicating that a transaction may be improper or illegal, the Firm will consult with Client; however, the Firm is under no obligation to report such information to any third party except as required by applicable law or professional standards.

2.1 Covered Assets Schedule. The systems, devices, users, sites, and software applications covered by the monthly managed-services fee (the "MSF") are set forth exclusively in Schedule A ("Covered Assets Schedule"), which is signed by both parties, incorporated herein, and updated by mutual written agreement. Only assets listed in the Covered Assets Schedule as of the applicable billing period are subject to the MSF. New assets added mid-period are covered from the date Provider completes its onboarding assessment for those assets. 2.2 Affirmative Scope. Subject to Section 2.3, Provider's managed-services obligations under the MSF are limited to: (a) the endpoints (desktops, laptops, and workstations) listed in Schedule A; (b) the server and virtual-machine instances listed in Schedule A; (c) the network devices (firewalls, managed switches, and wireless access points) listed in Schedule A; (d) the licensed software applications listed in Schedule A; (e) the physical sites identified in Schedule A; and (f) the named users identified in Schedule A ("Covered Users"). 2.3 Explicit Exclusions. The following are expressly excluded from the MSF and, if performed, are billed on a time-and-materials basis at the rates set forth in Schedule B: (a) Hardware Exclusion. Any device that (i) has exceeded five (5) years from the manufacturer's original ship date, or (ii) has reached or passed the manufacturer's published End-of-Life or End-of-Support date, whichever occurs first, is excluded from managed-services coverage. Provider will identify excluded hardware in the onboarding assessment described in Section 2.4 and update Schedule A accordingly. (b) Unsupported Operating Systems. Any operating system that is no longer receiving security patches from the vendor (e.g., Windows 10 after October 14, 2025, unless an Extended Security Update agreement is in place) is excluded from coverage. (c) Unlisted Software. Any software application, SaaS platform, cloud service, or line-of-business application not enumerated in Schedule A is excluded. Support for such applications may be added by written amendment to Schedule A. (d) Physical Infrastructure. On-site cabling, structured wiring, conduit installation, rack installation, physical plant upgrades, UPS installation, and other physical infrastructure work are excluded from the MSF. (e) Custom Development. Software development, scripting, automation development, database development, or custom integration work is excluded, regardless of the purpose of such work. (f) Compliance Certification. Advisory, audit-preparation, gap-remediation, or certification work required for any regulatory framework (including but not limited to SOC 2, ISO 27001, PCI DSS, HIPAA, CMMC, NIST, or GDPR) is excluded. (g) Disaster Recovery Beyond Schedule A. Disaster-recovery services exceeding the scope expressly defined in the backup and disaster-recovery clause and in Schedule A are excluded. (h) New Site Build-Outs. Technology deployment at physical sites not listed in Schedule A, including office moves, new office build-outs, and multi-site expansions, are excluded. (i) Vendor Disputes and Procurement. Negotiating with, managing disputes with, or administering procurement from third-party vendors is excluded, except as expressly listed in Schedule A. 2.4 Onboarding Compliance Assessment. Prior to or within Business days after Effective Date to complete onboarding assessment (e.g., "10") business days of the Effective Date, Provider shall complete a network and asset compliance assessment documenting: (a) all discovered devices and their compliance with Section 2.3; (b) systems identified as out-of-scope under Section 2.3 with the specific exclusion basis; and (c) recommended remediation steps. Provider will deliver the assessment in writing and both parties will execute Schedule A based on its findings. 2.5 Waiver of Non-Compliance. If Client elects to retain in its environment any system that Provider has identified as excluded under Section 2.3 and has not remediated within 30 days of the written assessment, Client shall execute a Waiver of Non-Compliance ("WNC") in the form attached as Exhibit W. Execution of a WNC confirms that: (a) the identified system is excluded from covered-assets coverage; (b) Provider bears no liability for incidents originating from or related to the non-compliant system; and (c) remediation work for incidents involving such systems is billed at time-and-materials rates per Schedule B. 2.6 Out-of-Scope Work. Out-of-scope work performed by Provider at Client's request is governed by the Change Management clause and is billed at the time-and-materials rates in Schedule B. No out-of-scope work will commence without a written Change Order signed by both parties, except as provided in the emergency verbal-authorization exception in the Change Management clause.

3.1 Provider Security Commitments. Provider shall implement and maintain the following security measures for all Covered Assets listed in Schedule A: (a) Patch Management. Provider shall apply security patches to Covered Assets according to the following timelines, measured from the vendor's public disclosure date: (i) Critical severity patches (CVSS score 9.0–10.0): within seven (7) calendar days; (ii) High severity patches (CVSS score 7.0–8.9): within fourteen (14) calendar days; (iii) Medium severity patches (CVSS score 3.0–6.9): within thirty (30) calendar days; (iv) Low severity patches (CVSS score 0.1–3.9): within ninety (90) calendar days or at the next scheduled maintenance window. Patch timelines apply only to supported operating systems and software listed in Schedule A. Excluded systems (as defined in the Scope of Managed Services clause) are not subject to these timelines. (b) Endpoint Protection. Provider shall deploy and maintain endpoint detection and response (EDR) software on all workstations and servers in Schedule A that support such software. EDR definitions shall be kept current. Provider shall monitor EDR alerts and respond per the priority matrix in the SLA clause. (c) Multi-Factor Authentication. Provider shall configure and enforce MFA on: (i) all administrator accounts for Covered Systems; (ii) all email and collaboration platform accounts in Schedule A; and (iii) all remote-access connections (VPN, RDP, remote desktop gateways) for Covered Users. Provider shall remediate any MFA bypass, gap, or failure within forty-eight (48) hours of discovery. (d) Security Incident Notification. Provider shall notify Client's designated security contact within twenty-four (24) hours of detecting a security incident involving Covered Assets. Notification shall include: (i) a description of the known or suspected incident; (ii) the systems affected; (iii) the containment steps taken; and (iv) next steps. A full written incident report shall be delivered within seventy-two (72) hours. 3.2 Client Security Obligations. Client shall, and shall cause its authorized users to: (a) implement Provider's written security recommendations within thirty (30) days of receipt, or execute a Declined Security Recommendation form per Section 3.4; (b) ensure all authorized users complete security-awareness training at the frequency Provider recommends, but no less than annually; (c) not disable, bypass, or alter any security control deployed by Provider, including endpoint protection agents, MFA configurations, and firewall rules, without Provider's prior written consent; (d) promptly notify Provider of any known or suspected security incident, unauthorized access, or suspicious activity involving Covered Assets; (e) not grant administrative privileges to users or devices without Provider's prior written consent; and (f) maintain and enforce an acceptable-use policy for Covered Systems consistent with Provider's recommendations. 3.3 Breach Response Protocol. Upon detection of a confirmed security breach involving Covered Assets: (a) Provider shall use reasonable efforts to isolate affected systems within four (4) hours of detection; (b) Provider shall preserve forensic evidence consistent with industry best practices and shall not destroy or alter log data without Client's written consent; (c) Provider shall deliver a written incident report within seventy-two (72) hours of containment, describing the incident timeline, affected systems, root-cause analysis (preliminary), and remediation steps taken; (d) Remediation work beyond initial containment is billed at time-and-materials rates per Schedule B, except where the breach was caused directly by Provider's gross negligence or willful misconduct, in which case remediation is at Provider's expense subject to the limitation-of-liability clause. 3.4 Declined Security Recommendation Waiver. If Client elects not to implement a security recommendation made by Provider in writing, Client shall execute a Declined Security Recommendation form ("DSR") within 5 business days of the recommendation. The DSR shall identify: (a) the specific recommendation declined; (b) the system(s) affected; (c) the risk described by Provider; and (d) Client's acknowledgment that (i) Provider's liability cap and criminal-acts exclusion apply in full to any incident related to the declined recommendation, and (ii) remediation of any incident exploiting the unaddressed vulnerability is billable at time-and-materials rates. Failure to execute a DSR within the required period does not expand Provider's obligations; Provider may, at its election, treat such failure as a deemed acceptance of the recommendation or as a deemed DSR. 3.5 HIPAA-Governed Clients. If Client is a Covered Entity or Business Associate subject to HIPAA, the security obligations in this Section shall be read in conjunction with, and shall not be less protective than, the requirements of 45 C.F.R. §§164.302–164.318. In the event of any conflict, the more protective standard applies.

CRIMINAL ACTS AND RANSOMWARE EXCLUSION. A. Third-Party Criminal Acts Exclusion. Provider shall not be liable for damages, losses, costs, or expenses arising from or caused by third-party criminal acts, including but not limited to: ransomware attacks; phishing and spear-phishing campaigns; business email compromise; unauthorized account takeover; distributed denial-of-service attacks; nation-state or advanced persistent threat (APT) intrusions; supply-chain attacks; and malicious insider acts by Client's employees or contractors (collectively, "Criminal Cyber Incidents"). B. Not Force Majeure — Independent Exclusion. This exclusion is separate from and in addition to any force majeure provision in this Agreement. Provider's lack of liability under this Section is not contingent on the Criminal Cyber Incident qualifying as a force majeure event. C. Gross Negligence and Willful Misconduct Carve-Out. Notwithstanding subsection (A), the criminal-acts exclusion does not apply to the extent that the Criminal Cyber Incident was directly caused by Provider's gross negligence or willful misconduct in performing services under this Agreement. D. RMM and PSA Tool Attack Vector — Allocation of Liability. If a Criminal Cyber Incident originates from or is facilitated by a vulnerability in a remote monitoring and management (RMM) tool, professional services automation (PSA) tool, or other third-party software used by Provider to deliver services under this Agreement ("Managed Tooling"), liability is allocated as follows: (i) Third-Party Tooling — Exclusion Applies. If the Managed Tooling is a third-party platform not operated or controlled by Provider (e.g., ConnectWise, Kaseya, SolarWinds, Datto, N-able), and the vulnerability is a zero-day exploit, supply-chain compromise, or other attack vector not reasonably preventable by Provider's adherence to the vendor's published security best practices, the criminal-acts exclusion in subsection (A) applies, and Provider has no liability. (ii) Patch-Failure Gross Negligence. If the Managed Tooling vulnerability was disclosed by the vendor with a security patch or update, and Provider failed to apply the patch within the patch-deployment window specified in the Service Level Agreement (Exhibit [X]) or, if no SLA window is specified, within 30 days of the vendor's release of the patch, then Provider's failure constitutes gross negligence, the criminal-acts exclusion does not apply pursuant to subsection (C), and Provider is liable for resulting damages to the extent of the liability cap specified in Section [Limitation of Liability]. (iii) Provider-Operated Tooling. If the Managed Tooling is a proprietary platform operated or controlled by Provider, the criminal-acts exclusion applies only if the attack vector was a third-party criminal act not reasonably preventable by Provider's adherence to industry-standard security practices (e.g., zero-day exploit, nation-state APT). The exclusion does not apply if the compromise resulted from Provider's failure to implement reasonable security controls. E. Client's Security Obligations. This exclusion does not relieve Client of Client's independent obligations under Section [Client Security Responsibilities] to maintain endpoint security, user access controls, security awareness training, and other client-side security measures.

5.1 Scope Lock. The managed-services fee covers only those services, systems, sites, and users set forth in Schedule A and the services expressly described in the Agreement. Any work outside that defined scope ("Out-of-Scope Work") requires a written Change Order signed by authorized representatives of both parties before Provider is obligated to perform. 5.2 Always-Project Activities. The following activities always constitute Out-of-Scope Work and always require a Change Order, regardless of the connection to Covered Assets or the apparent simplicity of the task: (a) Deployment of new servers, workstations, printers, or other hardware not covered by onboarding the devices into the existing managed schedule; (b) Microsoft 365 migrations, Google Workspace migrations, or other major collaboration-platform transitions; (c) On-site cabling, structured wiring, and physical infrastructure installation; (d) New-site technology build-outs and office relocations; (e) Large-scale user onboarding or offboarding events involving more than 5 users in a single request; (f) Software licensing procurement, management, or renewal negotiations; (g) Compliance and regulatory remediation, audit preparation, and certification-support work; (h) Custom software development, scripting projects, and automation development; and (i) Disaster recovery or business continuity planning work beyond quarterly restore verification for scheduled Tier 1 systems. 5.3 Change Order Process. Either party may initiate a Change Order by delivering a written request to the other party's designated contact in Schedule C. Within 3 business days of receipt, Provider shall deliver a written Change Order proposal specifying: (a) a description of the requested work; (b) the estimated time and cost at the rates in Schedule B; (c) any revised schedule impacts; and (d) any dependencies or prerequisites. The Change Order is not binding until signed by both parties' authorized representatives. 5.4 No Work Before Signature. Provider shall not commence Out-of-Scope Work until the Change Order is signed by both parties. Client shall not direct Provider to perform Out-of-Scope Work by informal channel. This Section constitutes a no-oral-modification clause for all out-of-scope engagements. 5.5 Emergency Verbal Authorization Exception. Notwithstanding Section 5.4, Provider may commence Out-of-Scope Work in connection with a P1 incident upon verbal authorization from Client's designated contact (identified in Schedule C), subject to the following conditions: (a) the P1 verbal authorization exception applies only to work directly necessary to contain and resolve the P1 incident; (b) the estimated cost of the emergency Out-of-Scope Work does not exceed Dollar cap for P1 emergency verbal authorization (e.g., "$2,500") without Client's prior written approval of any amount over that cap; (c) Provider shall document the verbal authorization (contact name, time, and scope of authorization) at the time it is received; and (d) Provider shall deliver a written Change Order or work-order confirmation to Client within two (2) business days of completing the emergency work, and Client's signature or written email confirmation within five (5) business days shall constitute retroactive authorization. Absence of timely written objection constitutes acceptance. 5.6 Consistency with Scope Exclusions. Out-of-Scope Work defined in this Section corresponds to and is consistent with the explicit exclusions enumerated in the Scope of Managed Services clause. Work that falls within a listed exclusion under the Scope clause is by definition Out-of-Scope Work under this clause.

6.1 Client Owns All Data. All data, files, configurations, records, databases, and documentation created by Client, stored on Covered Systems, or processed by Provider in the course of providing managed services ("Client Data") is and remains the exclusive property of Client. Provider acquires no ownership interest, license, or rights in Client Data except as necessary to perform the managed services. 6.2 No Withholding on Billing Dispute. Provider shall not withhold, restrict access to, or refuse to return Client Data on the basis of any outstanding billing dispute, invoice non-payment, or disagreement about this Agreement. Provider's right to pursue payment through separate legal process is unaffected. Withholding Client Data as leverage in a billing dispute is a material breach of this Agreement. 6.3 Return of Data on Termination. Within thirty (30) days of expiration or termination of this Agreement for any reason, Provider shall return all Client Data to Client in a mutually agreed standard format. If the parties cannot agree on a format within fifteen (15) days of termination notice, Provider shall return Client Data in one or more of the following formats (at Client's election): (a) CSV for structured data; (b) JSON for application and configuration data; (c) SQL dump for database content; or (d) the vendor-native export format for cloud-platform data. Provider shall cooperate with Client's successor IT provider as needed to facilitate data transfer. 6.4 Deletion and Written Certification. Provider shall delete all copies of Client Data from Provider's systems, tools, and subprocessors within sixty (60) days of completing the return under Section 6.3. Provider shall deliver written certification of deletion to Client within five (5) business days of completing deletion. Deletion obligations do not apply to Client Data retained in automated backup snapshots that are overwritten in the ordinary course within the normal backup retention cycle; such data will be deleted in the normal course. 6.5 Transition Assistance Period. For ninety (90) days following expiration or termination of this Agreement (the "Transition Period"), Provider shall provide reasonable transition assistance to Client and Client's designated successor IT provider, including: (a) transferring credentials, documentation, and configurations; (b) responding to written questions about the managed environment; and (c) reasonable cooperation with knowledge-transfer meetings. Transition assistance is billed at Provider's standard time-and-materials rates in Schedule B. 6.6 No-Charge Transition Hours — MSP-Fault Termination. If this Agreement is terminated by Client due to Provider's material breach (including but not limited to SLA failure triggering the termination right in the Service Credits clause), Provider shall provide the first twenty (20) hours of transition assistance at no charge. Hours beyond twenty (20) are billed at the T&M rates in Schedule B. 6.7 HIPAA PHI Return and Destruction. For PHI subject to a Business Associate Agreement, return and destruction obligations are governed by the BAA's termination provisions, which satisfy 45 C.F.R. §164.504(e)(2)(ii)(J). In the event of conflict between this Section 6 and the BAA, the BAA controls with respect to PHI. 6.8 GDPR Data Portability. For personal data processed on behalf of data subjects exercising portability rights under GDPR Article 20, Provider will cooperate in transmitting data to a designated third-party controller in a structured, commonly used, and machine-readable format, within the timeline required by applicable law.

THIRD-PARTY VENDOR / CLOUD PROVIDER EULA PASSTHROUGH & LIABILITY DISCLAIMER 1. Vendor Stack Disclosure. Provider's services rely on and incorporate third-party software, cloud services, hardware, and platforms, including but not limited to those listed in Exhibit Exhibit letter or number for vendor stack list (e.g., B) (collectively, 'Third-Party Services'). Provider may update Exhibit Exhibit letter or number for vendor stack list (e.g., B) as the vendor stack evolves by providing 30 days' written notice to Client. Client's continued use of Provider's services following such notice constitutes acceptance of the updated vendor stack. 2. EULA Passthrough. Each Third-Party Service is provided subject to the end-user license agreement, terms of service, acceptable-use policy, privacy policy, and data processing terms of the respective vendor ('Vendor Terms'), which are incorporated into this Agreement by reference. Client agrees to comply with all applicable Vendor Terms in connection with Client's use of the Third-Party Services. Provider will make the then-current Vendor Terms available to Client on request. If any Vendor Term materially conflicts with this Agreement, this Agreement governs Provider's obligations; the Vendor Terms govern the underlying service as between Client and the vendor. 3. Vendor Liability Passthrough. Each vendor's own liability caps, warranty disclaimers, indemnification exclusions, and service level commitments are a condition of Provider's ability to deliver the Third-Party Service. Client acknowledges and agrees that: (a) Provider's liability for any failure, outage, data loss, security incident, or service degradation caused by or attributable to a Third-Party Service is limited to the remedies (if any) available to Provider under the applicable Vendor Terms; (b) Provider will use commercially reasonable efforts to pursue available vendor remedies on Client's behalf when a Third-Party Service failure directly damages Client; (c) Provider is not liable for damages caused by a Third-Party Service's acts or omissions that are beyond Provider's reasonable control, including vendor-initiated outages, security breaches at the vendor level, licensing audits or compliance holds, vendor end-of-life decisions, or vendor price changes. 4. Licensing Audits and SPLA Changes. If a Third-Party Service vendor (including Microsoft, Adobe, or similar enterprise software vendors) conducts a license compliance audit of Client's environment, or if the vendor modifies its licensing terms in a way that affects Client's deployment (including changes to the Microsoft SPLA or bring-your-own-license rules for cloud deployments), Client and Provider will cooperate in good faith to respond to such audit or comply with such changes. The allocation of any resulting true-up costs, back-pay obligations, or license upgrades shall be determined by the Software License Compliance clause in this Agreement, if included, or by written agreement between the parties. 5. Vendor Substitution. Provider reserves the right to substitute an equivalent Third-Party Service for any listed service upon 30 days' written notice, provided the substitute offers materially equivalent functionality. If a substitution materially reduces functionality or increases Client's cost, Client may terminate the affected service line on 30 days' notice without early-termination fees. 6. No Endorsement. Provider's inclusion of a Third-Party Service in the vendor stack does not constitute an endorsement of the vendor's security posture, financial stability, or compliance with any specific regulatory framework. Client bears responsibility for assessing whether any Third-Party Service meets Client's own regulatory, contractual, or risk requirements.

SOFTWARE LICENSE COMPLIANCE OBLIGATION & AUDIT COOPERATION 1. Software Asset Inventory. Provider will maintain a software asset inventory (SAI) for Client's environment, tracking installed software, license entitlements, version levels, and deployment counts, using Software asset management tool name (e.g., NinjaRMM, Lansweeper) (software asset management tooling) (the 'SAI'). The SAI will be updated monthly and made available to Client on request. Responsibility for maintaining the SAI is Provider's unless Client has expressly retained that responsibility in writing. 2. Client-Requested Deployments. If Client directs Provider to deploy, install, upgrade, or expand the use of any software application — including during a hardware refresh, new-user onboarding, or project — Client is responsible for ensuring that adequate license entitlements exist for the deployment before Provider carries it out. Provider will: (a) note in the work order the license SKU and entitlement count being used; and (b) notify Client in writing if Provider reasonably believes the requested deployment may exceed existing entitlements. If Client directs Provider to proceed notwithstanding that notice, Client assumes sole responsibility for any resulting true-up costs, back-pay obligations, and audit exposure. 3. Provider-Initiated Deployments. For deployments that Provider initiates as part of routine managed-services operations (patch management, security tooling updates, RMM agent rollouts), Provider warrants that such deployments are covered by entitlements included in Provider's service stack or billed to Client's account, and Provider accepts responsibility for true-up costs arising solely from Provider's unauthorized deployment of software not authorized by this Agreement. 4. True-Up Costs from Client Decisions. True-up costs, license penalties, and compliance fees arising from Client's business decisions — including growth in user count, geographic expansion, use of software in new jurisdictions, or Client-directed non-standard deployments — are Client's financial responsibility and are not included in the monthly managed-services fee. 5. Audit Cooperation. If a software vendor (including Microsoft, Adobe, Oracle, or Autodesk) initiates a license compliance audit of Client's environment: (a) Client will notify Provider within 3 business days of receiving the vendor's audit notice; (b) Provider will cooperate fully with the audit by providing SAI data, deployment records, and reasonable access to managed systems within 10 business days of Client's notification; (c) Provider will not provide audit data directly to the vendor without Client's written consent, except as required by law or pursuant to a valid legal process; (d) The parties will engage in good faith to determine which party's decisions or actions gave rise to any compliance gap before accepting any vendor-proposed settlement. 6. SPLA and Hosting Licensing. Where Provider is the Microsoft Services Provider License Agreement (SPLA) licensee and provisions software to Client on a hosted basis: (a) the applicable license counts, use rights, and restrictions are as set forth in the current Microsoft Product Terms for SPLA; (b) Provider will pass through any material changes to SPLA use rights within 30 days of receipt from Microsoft; and (c) Client agrees to cooperate with Provider's monthly SPLA reporting obligations, including providing accurate user counts and usage data within 5 days of Provider's monthly request. 7. Survival. Provider's SAI maintenance obligation and Client's audit cooperation obligation survive termination of this Agreement for a period of 3 years, to the extent necessary to support or defend any pending or threatened vendor audit.

REPRESENTATIONS AND WARRANTIES (a) Mutual Representations. Each party represents and warrants to the other, as of the Effective Date and throughout the term of this Agreement, that: (i) Authority. It has the full legal right, power, and authority to enter into this Agreement and to perform its obligations hereunder; (ii) No Conflicts. Its execution, delivery, and performance of this Agreement do not and will not: (A) violate any applicable law, regulation, or court order; or (B) conflict with or result in a breach of any agreement to which it is a party; (iii) Binding Obligation. This Agreement constitutes its legal, valid, and binding obligation, enforceable against it in accordance with its terms; (iv) No Litigation. As of the Effective Date, there is no pending or, to its knowledge, threatened legal proceeding that would materially impair its ability to perform its obligations under this Agreement; and (v) Compliance with Law. It will comply with all applicable laws and regulations in performing its obligations or exercising its rights under this Agreement. (b) Agency Representations. Your name / business name additionally represents and warrants that: (i) Professional Standards. It will perform the Services in a professional and workmanlike manner consistent with industry standards; (ii) Non-Infringement. The materials, methodologies, and content created by Your name / business name (excluding Client-supplied content) will not, to Your name / business name's knowledge, infringe or misappropriate any third party's copyright, trademark, patent, trade secret, or other intellectual property right; (iii) Qualifications. It has the skills, experience, and qualifications necessary to perform the Services; and (iv) No Deceptive Practices. It will not engage in deceptive, unfair, or fraudulent practices in connection with the Services, including practices that violate the FTC Act or any analogous consumer-protection law. (c) Client Representations. Client name / business name additionally represents and warrants that: (i) Content Accuracy. All product descriptions, claims, pricing information, testimonials, and other materials supplied by Client name / business name to Your name / business name for publication or promotion are, to Client name / business name's knowledge, truthful, accurate, and not misleading, and are substantiated by competent and reliable evidence where required by applicable law; (ii) Ownership and Licenses. Client name / business name owns or has obtained all necessary rights, licenses, and permissions for all content, assets, images, trademarks, and data that Client name / business name provides to Your name / business name for use in the Services, and Client name / business name's provision of such materials to Your name / business name does not violate any third party's intellectual property rights; (iii) Regulatory Compliance. Client name / business name's products, services, and business practices comply with all applicable laws and regulations, and Client name / business name is not aware of any pending or threatened regulatory investigation or enforcement action that would affect the permissibility of the Services; (iv) Account Authority. Client name / business name has or will obtain all necessary rights, consents, and authorities to grant Your name / business name access to Client name / business name's systems, accounts, and platforms required to perform the Services; and (v) No Restricted Industry Violations. Client name / business name's products and services do not violate the applicable policies of the platforms on which the Services will be performed. (d) Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS SECTION, NEITHER PARTY MAKES ANY OTHER WARRANTY, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. Your name / business name DOES NOT WARRANT SPECIFIC BUSINESS OUTCOMES, REVENUE RESULTS, OR OTHER SPECIFIC RESULTS OR OUTCOMES FROM THE SERVICES.

CONFIDENTIALITY (a) Definition. "Confidential Information" means all non-public information disclosed by one party ("Discloser") to the other ("Recipient") in connection with this Agreement that is designated as confidential at the time of disclosure, or that a reasonable person would understand to be confidential given the nature of the information and circumstances of disclosure. Without limiting the foregoing, Confidential Information includes: business plans, financial data, pricing, fee structures, customer and prospect lists, proprietary methodologies, software, technical specifications, and personnel information. (b) Exclusions. Confidential Information does not include information that: (i) is or becomes publicly available through no fault of Recipient; (ii) Recipient already knew before receiving it from Discloser, as shown by written records; (iii) Recipient independently develops without use of or reference to the Confidential Information; or (iv) Recipient rightfully receives from a third party without restriction. (c) Obligations. Recipient will: (i) use Discloser's Confidential Information solely to perform or receive the Services under this Agreement; (ii) disclose it only to its employees, contractors, and advisors who have a need to know and who are bound by confidentiality obligations no less protective than this clause; and (iii) protect it with at least the same degree of care it uses for its own confidential information of similar sensitivity, but in no event less than reasonable care. (d) Compelled Disclosure. Recipient may disclose Confidential Information if required by law, court order, or regulatory authority, provided that Recipient: (i) gives Discloser prompt prior written notice to the extent legally permitted; (ii) cooperates with Discloser in seeking a protective order or other appropriate relief; and (iii) discloses only what is legally required. (e) Trade Secrets. Obligations with respect to information that constitutes a trade secret under applicable law (including the Defend Trade Secrets Act, 18 U.S.C. § 1836) will continue for as long as such information remains a trade secret, notwithstanding any shorter survival period stated below. (f) Subcontractors. Your name / business name may share Client name / business name's Confidential Information with approved subcontractors solely to the extent necessary for them to perform work under this Agreement, provided each subcontractor is bound by written confidentiality obligations at least as protective as this clause. (g) Return or Destruction. Upon termination or expiration of this Agreement, or upon Discloser's written request, Recipient will promptly return or securely destroy all of Discloser's Confidential Information (including copies) and certify such return or destruction in writing, except as required by law or for legal-hold purposes. (h) Survival. This Section survives termination or expiration of this Agreement for a period of 3 years, except as provided in Section (e).

LIMITATION OF LIABILITY (a) Exclusion of Consequential Damages. To the fullest extent permitted by applicable law, neither party will be liable to the other for any indirect, incidental, special, consequential, punitive, or exemplary damages — including lost profits, lost revenue, loss of business opportunity, loss of data, or harm to reputation — arising out of or related to this Agreement, even if the party has been advised of the possibility of such damages and even if a limited remedy fails of its essential purpose. (b) Aggregate Cap. Each party's total aggregate liability to the other arising out of or related to this Agreement — whether in contract, tort (including negligence), strict liability, or otherwise — will not exceed the total fees actually paid or payable by Client name / business name to Your name / business name during the Cap look-back period (months)-month period immediately preceding the event giving rise to the claim, or Minimum cap floor amount (e.g. $5,000), whichever is greater. (c) Exceptions. The limitations in Sections (a) and (b) do not apply to: (i) a party's obligation to indemnify the other for third-party claims of intellectual property infringement under the Mutual Indemnification clause; (ii) liability arising from a party's gross negligence or willful misconduct; (iii) a party's obligations under the Data Protection and Confidentiality clauses with respect to a data breach caused by that party's failure to maintain reasonable security; or (iv) a party's obligation to pay amounts owed under this Agreement. (d) Basis of the Bargain. Each party acknowledges that the limitations in this Section reflect a reasonable allocation of risk, are an essential element of the basis of the bargain between the parties, and that Your name / business name would not have entered into this Agreement without these limitations.

MUTUAL INDEMNIFICATION (a) Agency Indemnification. Your name / business name will defend, indemnify, and hold harmless Client name / business name and its officers, directors, employees, and agents ("Client Indemnitees") from and against any third-party claims, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) ("Losses") arising out of or related to: (i) any material breach by Your name / business name of its representations, warranties, or obligations under this Agreement; (ii) Your name / business name's infringement of a third party's intellectual property rights through materials created solely by Your name / business name and not based on Client-supplied content; (iii) Your name / business name's violation of applicable law in performing the Services; or (iv) Your name / business name's gross negligence or willful misconduct. (b) Client Indemnification. Client name / business name will defend, indemnify, and hold harmless Your name / business name and its officers, directors, employees, subcontractors, and agents ("Agency Indemnitees") from and against any Losses arising out of or related to: (i) any material breach by Client name / business name of its representations, warranties, or obligations under this Agreement; (ii) Client-supplied materials, content, product claims, pricing information, images, or data that infringe a third party's intellectual property rights or constitute false, misleading, or unsubstantiated claims under applicable law; (iii) Client name / business name's violation of applicable law; or (iv) Client name / business name's gross negligence or willful misconduct. (c) Indemnification Procedure. The indemnified party will: (i) promptly notify the indemnifying party in writing of any claim for which indemnification is sought (provided that delay in notice reduces the indemnification obligation only to the extent the indemnifying party is materially prejudiced by the delay); (ii) give the indemnifying party sole control of the defense and settlement of the claim, provided that no settlement that imposes any obligation, restriction, or liability on the indemnified party may be entered without the indemnified party's prior written consent, not to be unreasonably withheld; and (iii) provide reasonable cooperation and assistance at the indemnifying party's expense. (d) Interaction with Liability Cap. The indemnification obligations in this Section are subject to the aggregate liability cap set forth in the Limitation of Liability clause, except for claims arising from a party's gross negligence or willful misconduct, which are not subject to that cap.

GOVERNING LAW; JURISDICTION; VENUE (a) Governing Law. This Agreement and any dispute arising out of or related to it — including its formation, interpretation, performance, breach, or termination — will be governed by and construed in accordance with the laws of the State of Governing law state (e.g. New York), without regard to its conflict-of-law provisions. (b) Consent to Jurisdiction. Each party irrevocably submits to the exclusive personal jurisdiction of the state and federal courts located in Venue county (e.g. New York) County, Governing law state (e.g. New York) for any action or proceeding arising out of or relating to this Agreement that is not subject to arbitration under the Dispute Resolution clause (if any). (c) Venue. Each party waives any objection to the laying of venue in the courts identified in Section (b), and waives any claim that such courts are an inconvenient forum. (d) Service of Process. Service of process in any such action may be made by any method authorized by the applicable court rules or by mailing a copy of the summons and complaint by registered or certified mail, return receipt requested, to the party's address set forth in this Agreement. (e) Prevailing Party. In any dispute arising under this Agreement, the prevailing party is entitled to recover its reasonable attorneys' fees and costs from the non-prevailing party, unless the parties have agreed to a different allocation in the Dispute Resolution clause.

DISPUTE RESOLUTION (a) Good-Faith Negotiation. Before initiating any formal dispute proceeding, the parties will attempt to resolve any dispute, controversy, or claim arising out of or relating to this Agreement ("Dispute") through good-faith negotiation. Either party may initiate this step by delivering written notice to the other describing the Dispute in reasonable detail ("Dispute Notice"). Senior representatives of each party with authority to resolve the Dispute will meet (in person, by phone, or by videoconference) within 10 business days of the Dispute Notice and attempt to resolve the matter in good faith for a period of 30 business days from the date of the Dispute Notice (or longer, if agreed in writing). (b) Mediation. If the Dispute is not resolved through negotiation within the timeframe in Section (a), either party may submit it to non-binding mediation administered by Mediation provider (e.g. JAMS, AAA) (or, if the parties cannot agree on a provider, by the American Arbitration Association under its Commercial Mediation Procedures). The mediation will take place in Mediation city, Mediation state. The parties will share mediator fees equally. Each party will bear its own legal fees for the mediation. (c) Binding Arbitration. If the Dispute is not resolved through mediation within 60 days after the appointment of the mediator, either party may demand binding arbitration. Arbitration will be administered by Arbitration provider (e.g. JAMS, AAA) under its then-current Arbitration rules (e.g. Commercial Arbitration Rules), before a single arbitrator. The arbitration will take place in Arbitration city, Arbitration state. The arbitrator's decision will be final and binding and may be entered as a judgment in any court of competent jurisdiction. The parties agree that the arbitration — including its existence, proceedings, and any award — is confidential. (d) Exceptions to Arbitration. Either party may seek emergency injunctive or other equitable relief from a court of competent jurisdiction without first completing the negotiation or mediation steps, to prevent irreparable harm — including to protect Confidential Information or intellectual property — pending the outcome of arbitration. (e) Small Claims. Either party may bring a Dispute in small claims court if the amount in controversy falls within that court's jurisdictional limit. (f) Class Action Waiver. Each party waives any right to bring or participate in any class action, class arbitration, or representative proceeding relating to this Agreement. (g) Governing Law for Arbitration. The arbitration will be governed by the Federal Arbitration Act (9 U.S.C. §§ 1–16) and, where not preempted, by the laws of Governing law state (e.g. New York).

FORCE MAJEURE (a) Definition. A "Force Majeure Event" means any event beyond a party's reasonable control that prevents or materially impairs that party's ability to perform its obligations under this Agreement, including: acts of God; natural disasters; fire; flood; earthquake; epidemic or pandemic; war; terrorism; riots or civil unrest; actions or inactions of governmental authorities (including government-mandated service restrictions or platform-access bans); internet or telecommunications infrastructure failures (including widespread outages of major technology or infrastructure platforms affecting substantially all users); power outages; and cyber-attacks on the party's systems not caused by the party's own negligence (each, individually a "Force Majeure Event"). Economic downturns, changes in market conditions, and changes in third-party platform features or algorithms do not constitute Force Majeure Events. (b) Effect. The party affected by a Force Majeure Event ("Affected Party") will be excused from performance of the affected obligations during the continuance of the Force Majeure Event, provided that the Affected Party complies with the notice and mitigation obligations below. (c) Notice. The Affected Party will give the other party written notice of the Force Majeure Event as soon as reasonably practicable after the event begins, describing the nature of the event, the expected duration, and the obligations affected. (d) Mitigation. The Affected Party will use commercially reasonable efforts to mitigate the impact of and to overcome the Force Majeure Event, and will resume performance as soon as reasonably practicable after the event ends. (e) Suspension and Termination. If a Force Majeure Event prevents a party's material performance for more than 30 consecutive days, either party may terminate this Agreement on written notice without further liability, except for: (i) amounts already earned and owing; and (ii) obligations that survived the term of the Agreement (including confidentiality and IP assignments). (f) No Payment Excuse. A Force Majeure Event does not excuse Client name / business name from paying for Services already performed before the event or for Services Your name / business name is able to perform notwithstanding the event.

16.1 General Restriction. Neither Party may assign, delegate, or transfer any of its rights or obligations under this Agreement, in whole or in part, without the other Party's prior written consent, which will not be unreasonably withheld or delayed. 16.2 M&A Exception. Notwithstanding Section 16.1, either Party may assign this Agreement without consent in connection with a merger, acquisition, change of control, or sale of all or substantially all of the assets to which this Agreement relates, provided that: (a) the assignee assumes all obligations of the assigning Party under this Agreement; and (b) the assigning Party provides the other Party written notice within thirty (30) days of the assignment. 16.3 Void Assignment. Any purported assignment in violation of this Section is void. 16.4 Binding Effect. This Agreement is binding upon and inures to the benefit of the Parties and their permitted successors and assigns.

17.1 Form. All notices, requests, demands, consents, and other communications required or permitted under this Agreement ("Notices") must be in writing. 17.2 Delivery Methods. Notices may be delivered by: (a) personal delivery; (b) nationally recognized overnight courier (e.g., FedEx, UPS); (c) certified or registered mail, return receipt requested, postage prepaid; or (d) email to the address specified below, provided that the sender retains proof of transmission and does not receive an automated bounce or delivery-failure notification within twenty-four (24) hours. 17.3 Effectiveness. Notices are effective: (a) upon personal delivery; (b) one (1) business day after deposit with overnight courier; (c) three (3) business days after deposit in the mail; or (d) on the day of email transmission if sent by 5:00 PM recipient's local time on a business day, or on the next business day if sent after 5:00 PM or on a non-business day. 17.4 Addresses. To Provider: Your name / business name, Provider Notice Address, Email: Provider Legal/Notice Email To Customer: Client name / business name, Customer Notice Address, Email: Customer Legal/Notice Email Either Party may change its notice address by providing written notice to the other in accordance with this Section.

If any provision of this Agreement is held by a court of competent jurisdiction to be invalid, illegal, or unenforceable under applicable law, that provision will be: (a) modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving the Parties' original intent; or (b) if modification is not possible, severed from this Agreement. The validity, legality, and enforceability of the remaining provisions will not in any way be affected or impaired. The Parties agree to negotiate in good faith a replacement provision that, to the greatest extent possible, achieves the intended commercial purpose of the severed provision.

19.1 Integration. This Agreement, together with all SOWs, Change Orders, and exhibits executed hereunder, constitutes the entire agreement between the Parties with respect to its subject matter and supersedes all prior and contemporaneous agreements, negotiations, representations, warranties, and understandings, whether written or oral, relating to the same subject matter. 19.2 No Oral Modifications. No oral statement, prior course of dealing, trade usage, or conduct will be used to supplement, interpret, or contradict the written terms of this Agreement. 19.3 Purchase Orders. Any terms set forth in Customer's purchase orders, vendor registration forms, or similar documents are of no force or effect and do not modify this Agreement unless expressly incorporated into a signed SOW or Change Order. 19.4 Results Representations. Customer acknowledges that no employee, agent, or representative of Provider has authority to guarantee specific results or outcomes, and that any such representation made outside this Agreement is not binding on Provider.

20.1 Amendments. This Agreement may not be amended, modified, or supplemented except by a written instrument signed by authorized representatives of both Parties. 20.2 No Waiver. No failure or delay by either Party in exercising any right, remedy, power, or privilege under this Agreement operates as a waiver thereof. No single or partial exercise of any right, remedy, power, or privilege precludes any other or further exercise thereof or the exercise of any other right, remedy, power, or privilege. 20.3 Written Waivers Only. Any waiver of a provision of this Agreement must be in writing and signed by the waiving Party to be effective. A written waiver of any particular breach or right is effective only for the specific instance and purpose for which it was given.

21.1 Electronic Signatures. This Agreement and any SOW or amendment may be signed by electronic signature, including signatures created through E-Signature Platform (e.g., DocuSign, HelloSign) or any other electronic signature service compliant with the Electronic Signatures in Global and National Commerce Act (E-SIGN Act), 15 U.S.C. § 7001 et seq., and the Uniform Electronic Transactions Act (UETA) as enacted in the applicable jurisdiction. Electronic signatures have the same legal effect as original handwritten signatures. 21.2 Counterparts. This Agreement may be executed in one or more counterparts, each of which will be deemed an original, and all of which together will constitute one and the same instrument. Delivery of an executed counterpart by electronic transmission (including PDF or electronic signature platform delivery) is equally effective as delivery of a manually executed counterpart.

LIMITATION OF USE AND THIRD-PARTY RELIANCE. A. Permitted Use. All work product delivered by the Firm under this engagement — including bookkeeping records, prepared financial statements, compiled financial statements, and any reports or summaries — is prepared solely for Description of permitted use (the "Permitted Use") and for the exclusive use of Permitted users (the "Permitted Users"). The work product is not intended for use by any other person or entity. B. Third-Party Reliance Disclaimer. The Firm does not assume any duty of care to, and shall have no liability to, any person or entity other than Client. No third party (including lenders, investors, creditors, shareholders, regulatory agencies, or other parties) is entitled to rely on the Firm's work product. Client shall include the following legend on any copy of the Firm's work product distributed to any third party: "This [document type] was prepared by Your name / business name solely for the internal use of Client name / business name and is not intended for use by, and should not be relied upon by, any third party. Your name / business name assumes no duty of care to any third party and disclaims all liability for any reliance by third parties." C. Prohibition on Named Addressees and Lender Packages. Client shall not, and the Firm will not, address any cover letter, transmittal letter, comfort letter, consent to use, or lender information package to any named third party (including banks, investors, lenders, creditors, or regulatory agencies) in connection with the Firm's work product under this engagement. If Client requests that the Firm provide any such communication or package to a named third party, the Firm may, in its sole discretion, agree to do so only pursuant to a separate written engagement letter and upon payment of a separate engagement fee of not less than $Minimum fee for third-party engagement. This prohibition applies regardless of whether the underlying work product carries a use-restriction legend.

This engagement will be conducted in accordance with Applicable Standards Framework issued by Standards-Setting Body. Our audit will be planned and performed in conformity with those standards, which require that we obtain reasonable assurance about whether the financial statements are free of material misstatement. The standards selected govern all aspects of this engagement, including our responsibilities, our report, and the criteria for evaluating audit evidence. Any subsequent change to the applicable standards framework requires a written amendment to this Agreement signed by both parties.

Management of Client name / business name is responsible for: (a) the preparation and fair presentation of the financial statements in accordance with Applicable Financial Reporting Framework (e.g., US GAAP, IFRS); (b) the design, implementation, and maintenance of internal controls sufficient to enable the preparation of financial statements that are free from material misstatement, whether caused by error or fraud; (c) identifying and ensuring compliance with applicable laws and regulations; (d) making all financial records, supporting documentation, personnel, and premises available to us as we require to perform the audit; and (e) providing us, at the conclusion of the audit, with a written representation letter confirming the representations made to us during the course of the engagement. Management's fulfillment of these responsibilities is a precondition of this engagement.

An audit conducted in accordance with Applicable Standards Framework is designed to provide reasonable assurance that the financial statements are free from material misstatement. Reasonable assurance is a high but not absolute level of assurance. Because of the inherent limitations of an audit, including the use of sampling and testing on a test basis, the exercise of professional judgment, and the inherent limitations of internal control, there is an unavoidable risk that some material misstatements of the financial statements will not be detected, even if the audit is properly planned and performed in accordance with applicable auditing standards. Accordingly, our audit does not guarantee that all errors, irregularities, or fraud will be identified.

Before accepting this engagement, we have assessed whether any known conditions, restrictions, or limitations would preclude us from conducting an audit adequate to support the opinion we have been engaged to render. If, prior to or after accepting the engagement, we determine that a scope limitation exists that is so significant that it would require us to disclaim an opinion, we will advise you and may decline to proceed or continue. During the engagement, if a scope limitation arises — whether imposed by management or caused by circumstances outside anyone's control — we will evaluate its nature and pervasiveness and determine the appropriate modification to our report or, if necessary, withdraw from the engagement. Fees for work completed through the date of any withdrawal remain due and payable.