A contract agent that knows your playbook.

This Master Services Agreement (this "Agreement"), dated as of the Effective Date, is by and between Acme Co., a Delaware corporation with offices at 500 Market St., Wilmington, DE ("Customer"), and Northwind Inc., a Delaware corporation with offices at 1 Pine Plaza, San Francisco, CA ("Vendor"). Each a "Party" and together the "Parties." This Agreement governs all Services, Deliverables, and Subscriptions ordered under any Statement of Work or Order Form ("SOW") executed hereunder, and supersedes any conflicting terms in Customer's purchase orders.

Capitalized terms have the meanings set forth in this Section or where first defined. "Affiliate" means any entity that controls, is controlled by, or is under common control with a Party. "Customer Data" means all electronic data or information submitted by or on behalf of Customer to the Services. "Documentation" means the then-current user guides and technical documentation made generally available by Vendor. "Personal Data" has the meaning given under applicable Data Protection Laws (including GDPR, UK GDPR, and the CCPA/CPRA). "Services" means the hosted software, APIs, and professional services described in any SOW. "Deliverables" means the work product specifically identified as such in an SOW.

2.1 Vendor shall provide the Services and Deliverables described in each SOW, which is incorporated herein upon mutual execution. 2.2 In the event of a conflict, the order of precedence is: (a) the body of this Agreement; (b) the applicable Exhibit; (c) the SOW, except where the SOW expressly amends a specific section of this Agreement. 2.3 Vendor may engage subcontractors provided Vendor remains responsible for their acts and omissions and they are bound by confidentiality obligations no less protective than those herein.

3.1 Subject to the terms of this Agreement, Vendor grants Customer and its Affiliates a non-exclusive, non-transferable, worldwide right during the Term to access and use the Services for Customer's internal business purposes. 3.2 Customer shall not (a) reverse engineer or attempt to derive source code; (b) resell, sublicense, or provide the Services on a service-bureau basis; (c) use the Services to develop a competing product; or (d) upload malicious code or unlawful content. 3.3 Customer is responsible for the acts and omissions of its Authorized Users.

4.1 Customer shall (a) provide accurate account information and reasonable cooperation; (b) maintain the confidentiality of account credentials; (c) comply with all applicable laws in its use of the Services; and (d) obtain all necessary rights, consents, and notices required for Vendor to process Customer Data, including any Personal Data, in connection with the Services. 4.2 Customer is responsible for the legality, accuracy, and quality of all Customer Data.

5.1 Mutual. Each Party represents and warrants that (a) it is duly organized and validly existing; (b) it has full corporate power to enter into this Agreement; and (c) its execution and performance do not conflict with any other agreement. 5.2 Vendor. Vendor warrants that the Services will materially conform to the Documentation and be performed in a professional and workmanlike manner consistent with industry standards. 5.3 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH HEREIN, THE SERVICES ARE PROVIDED "AS IS" AND VENDOR DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

6.1 Vendor shall maintain 99.9% monthly uptime for Production Services, measured per the SLA in Exhibit B. 6.2 Support is provided 24×7×365 for Severity 1 incidents with a fifteen (15) minute response and four (4) hour resolution target. 6.3 Service credits are Customer's sole and exclusive remedy for SLA failures, except where chronic failure constitutes a material breach under Section 9.2.

7.1 Customer shall pay all undisputed fees within thirty (30) (Net 30) days of invoice in U.S. Dollars by ACH or wire. 7.2 Late amounts accrue interest at the lesser of 1.0% per month or the maximum permitted by applicable law. 7.3 Fees are exclusive of sales, use, VAT, GST, or similar taxes, other than taxes on Vendor's net income. 7.4 Annual fee escalation shall not exceed CPI-U + 3%.

8.1 In no event shall Vendor be liable for any indirect, incidental, special, consequential, or punitive damages of any kind, whether in contract, tort (including negligence), strict liability, or otherwise, even if advised of the possibility of such damages.

8.1 Vendor shall not be liable for indirect, incidental, or consequential damages, except for (a) breaches of confidentiality, (b) IP infringement indemnity under Section 11.2, (c) gross negligence or willful misconduct, (d) data-security incidents involving Personal Data, or (e) amounts owed to third parties under indemnity, each of which shall be uncapped.

8.2 Aggregate liability cap: fees paid in the prior 12 months — your playbook requires 2×; counter to 2× fees paid in prior 24 months.

9.1 The Initial Term is twelve (12) months from the Effective Date, auto-renewing for successive 12-month Renewal Terms unless either party provides thirty (30) days' written notice of non-renewal prior to the end of the then-current Term. 9.2 Either party may terminate this Agreement or any SOW for an uncured material breach upon thirty (30) days' written notice describing the breach in reasonable detail. 9.3 Upon termination, Vendor shall, at Customer's election, return or securely destroy all Customer Data within thirty (30) days and certify such destruction in writing. 9.4 Sections 1, 6, 8, 10, 11, 13, and 15 survive termination.

10.1 Each party ("Recipient") shall protect the other party's Confidential Information using no less than reasonable care, and in no event less than the degree of care it uses to protect its own confidential information of like importance, for a period of five (5) years post-termination, and indefinitely with respect to trade secrets. 10.2 The Data Processing Addendum, including the EU Standard Contractual Clauses (Module 2, Commission Decision 2021/914), the UK International Data Transfer Addendum, and Customer's security requirements set forth in Exhibit C, are incorporated by reference. 10.3 Vendor shall notify Customer of any confirmed Security Incident without undue delay and in no event later than seventy-two (72) hours of discovery.

11.1 As between the Parties, Customer retains all right, title, and interest in and to Customer Data and Customer Marks. Vendor retains all right, title, and interest in and to the Services, the underlying software, models, and any improvements, enhancements, or derivative works thereof, including aggregated, anonymized usage data. 11.2 Vendor shall defend, indemnify, and hold harmless Customer and its Affiliates, officers, directors, employees, and agents from and against any third-party claim alleging that the Services, as provided by Vendor and used in accordance with this Agreement, infringe a valid U.S. patent, copyright, trademark, or trade secret, and shall pay all damages and costs finally awarded or agreed in settlement. 11.3 If the Services are enjoined, Vendor shall, at its option: (a) procure the right for Customer to continue use; (b) modify the Services to be non-infringing while materially preserving functionality; or (c) terminate the affected SOW and refund pre-paid, unused fees.

Vendor shall maintain, at its sole expense, (i) Commercial General Liability of not less than $2,000,000 per occurrence / $5,000,000 aggregate; (ii) Workers' Compensation as required by law and Employer's Liability of $1,000,000; (iii) Professional Liability / Technology E&O of $5,000,000 per claim; and (iv) Cyber Liability of $5,000,000 per claim — your playbook requires $10M.

13.1 This Agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-laws principles. 13.2 The Parties shall first attempt in good faith to resolve any dispute through executive escalation within thirty (30) days. 13.3 Any unresolved dispute shall be finally settled by binding arbitration administered by JAMS under its Comprehensive Rules in Wilmington, Delaware, before a single arbitrator, except that either party may seek injunctive relief in a court of competent jurisdiction to protect its Confidential Information or Intellectual Property. 13.4 EACH PARTY WAIVES ANY RIGHT TO A JURY TRIAL AND TO PARTICIPATE IN A CLASS ACTION.

14.1 Force Majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control. 14.2 Assignment. Neither party may assign this Agreement without the other's prior written consent (not to be unreasonably withheld), except to a successor in connection with a merger, acquisition, or sale of substantially all assets. 14.3 Notices. Written notices shall be sent to the addresses on the cover page, by hand, overnight courier, or certified mail, with a courtesy copy to legal@acme.com. 14.4 Independent Contractors. The Parties are independent contractors; nothing creates an agency, partnership, or joint venture. 14.5 Publicity. Vendor shall not use Customer's name or marks without prior written consent. 14.6 Export. The Parties shall comply with all applicable export-control and sanctions laws. 14.7 Severability. If any provision is held unenforceable, the remainder shall continue in full force. 14.8 Entire Agreement. This Agreement, together with all SOWs and Exhibits, is the entire agreement of the Parties and supersedes all prior proposals, negotiations, and communications. Amendments must be in a writing signed by authorized representatives of both Parties. 14.9 Waiver. No failure or delay in exercising any right shall operate as a waiver thereof. 14.10 Counterparts; E-Signatures. This Agreement may be executed in counterparts, including by electronic signature, each of which is deemed an original. 14.11 Third-Party Beneficiaries. There are no intended third-party beneficiaries. 14.12 Government End Users. The Services are "commercial items" as defined in FAR 2.101 and are licensed with only those rights set forth herein. 14.13 Anti-Corruption. Each Party shall comply with the U.S. Foreign Corrupt Practices Act, the UK Bribery Act, and all other applicable anti-corruption laws. 14.14 Audit. Once per twelve (12) months, on thirty (30) days' notice, Customer (or its independent auditor under NDA) may audit Vendor's compliance with the security and data-protection obligations herein. 14.15 Non-Solicitation. During the Term and for twelve (12) months thereafter, neither Party shall solicit for employment any employee of the other with whom it had material contact, excluding general advertisements not targeted at such individuals. 14.16 Construction. Headings are for convenience only; "including" means "including without limitation"; the singular includes the plural and vice versa. 14.17 Order of Signature. The Effective Date is the later of the two signature dates on the cover page.