CITY OF FAIRFIELD
TECHNOLOGY SOFTWARE-AS-A-SERVICE (SaaS) AGREEMENT FOR FLOCK
SAFETY PLATFORM WITH FLOCK GROUP INC
This AGREEMENT is made at Fairfield, California, as of June _____, 2025 (the “Effective Date”), by and between the City of Fairfield, a municipal corporation (the “City") and Flock Group Inc. (" Service Provider”), who agree as follows:
1) SERVICES. Subject to the terms and conditions set forth in this Agreement, Service Provider shall provide to the City the services described in Exhibit “A” (the “Scope of Services”), which consists of the following: (a) Exhibit A -1 – Statement of Work , (b) Exhibit A-2 – Product Schedule, and (c) Exhibit A-3 – Service Level Agreement.. Service Provider shall provide Services at the time, place, and in the manner specified in Exhibit “A.”
2) PAYMENT. City shall pay Service Provider for the services rendered pursuant to this Agreement at the times and in the manner set forth in Exhibit “B.” The payments specified in Exhibit “B” shall be the only payments to be made to Service Provider for services rendered pursuant to this Agreement.
Service Provider shall submit all billings for said services to the City in the manner specified in Exhibit “B.”
3) FACILITIES AND EQUIPMENT. Service Provider shall, at its sole cost and expense, furnish all facilities and equipment which may be required for furnishing Services pursuant to this Agreement.
4) COMPLETE AGREEMENT. The provisions set forth in Exhibits “A,” “B,” “C,” “D”, “E”, and “F” are part of this Agreement. In the event of any inconsistency between the general provisions of Exhibit “C” and any other terms or conditions of this Agreement, the provisions set forth in Exhibit “C” shall control. All provisions in this Agreement control over any provision in Exhibit “A.” In the event of a disagreement among the documents comprising Exhibit “A,” Exhibit A-1 controls over Exhibits A-2 through A-5; Exhibit A-2 controls over Exhibits A-3 through A-5; Exhibit A-3 controls over Exhibits A-4 through A-5; and Exhibit A-4 controls over Exhibit A-5.
5) INSURANCE REQUIREMENTS. The insurance requirements set forth in Exhibit “D” are part of this Agreement. Notwithstanding any other provision to the contrary, in the event of any inconsiste ncy between any other terms or conditions of this Agreement, the requirements set forth in Exhibit “D” shall control.
6) BUSINESS LICENSE. The CONSULTANT shall obtain and keep current a business license for work within the City of Fairfield pursuant to Chapter 10B of the Fairfield City Code, with respect to the gross receipts received pursuant to this Agreement. No payments shall be made to any SERVICE PROVIDER until such business licens e has been obtained, and all fees paid therefore, by the CONSULTANT. Business license applications and information may be obtained from the Community Development Department, Fairfield City Hall, 1000 Webster Street, Fairfield, CA 94533-4883, (707-428-7509) and online at www.fairfield.ca.gov/biz.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
7) EXHIBITS. All exhibits referred to herein are attached hereto and are by this reference incorporated herein.
8) TERM. This Agreement shall be effective upon the Effective Date and shall remain in effect for a period of five (5) years following the Effective Date (the “Initial Term”).
Following the Initial Term, this Agreement shall automatically renew for additional one (1) year terms, unless terminated pursuant to this Agreement or the City Manager, or his/her designee, provides Service Provider written notice of the City’s intent to not renew the Agreement.
9) Termination for Non-Appropriation of Funds. City is subject to federal, state or local law which makes City’s financial obligations under this Services Agreement contingent upon sufficient appropriation of funds by the applicable legislature (or other appropriate governmental body), and if such funds are not forthcoming or are insufficient due to failure of such appropriation, then City will have the right to terminate the Services Agreement at no additional cost and with no penalty by giving prior written notice documenting the lack of funding. City will use reasonable efforts to ensure appropriated funds are available. City will provide at least thirty (30) days advance written notice of such termination.
10) Where applicable, vehicles with a GVWR greater than 8,500 lbs. and light-duty package delivery vehicles operated in California may be subject to the California Air Resources Board Advanced Clean Fleets regulations. Such vehicles may therefore be subject to requirements to reduce emissions of air pollutants. For more information, please visit the CARB Advanced Clean Fleets webpage at https://ww2.arb.ca.gov/our- work/programs/advanced-clean-fleets
EXECUTED as of the day first above-stated.
City of Fairfield, a municipal corporation
By: ______________________________
(signature)
Printed: ______________________________
Service Provider
By: ______________________________
(signature)
Printed: ______________________________
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Mark Smith
Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 EXHIBIT “A”
SCOPE OF SERVICES
Services are described more particularly in the following exhibits, which comprise Exhibit A:
Exhibit A-1 – Statement of Work
Exhibit A-2 – Product Schedule
Exhibit A-3 – Service Level Agreement
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 Exhibit “A-1”
Statement of Work
1.0 DEFINITIONS: In this Agreement, the following terms have the following meanings, and all other capitalized terms have the meaning given to them elsewhere in this Agreement:
1.01 “Authorized Persons” as used in this document means the Service Provider’s employees, contractors, subcontractors or other agents who need to access the public jurisdiction’s personal data to enable the Service Provider to perform the services required.
1.02 “Data Breach” as used in this document means the unauthorized access by non-authorized person/s that result in the use, disclosure or theft of a public jurisdiction’s unencrypted personal data.
1.03 “Follow-the-sun” is a workflow model in which work is passed on to the offices located in different time zones. In this way work is done round-the-clock thereby reducing the support duration and increasing the responsiveness.
1.04 “Individually Identifiable Health Information ” as used in this document means information that is a subset of health information, including demographic information collected from an individual, and (1) is created or received by a health care provider, health plan, employer or health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) that identifies the individual; or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.
1.05 “Non-Public Data” means data, other than personal data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the public jurisdiction because it contains information that is exempt by statute, ordinance or administrative rule from access by the general public as public information.
1.06 “Personal Data” means data that includes information relating to a person that identifies the person by name and has any of the following personally identifiable information (PII): government -issued identification numbers (e.g. Social Security, driver’s license, passport); financial account information, including account number, credit or debit card numbers; or protected health information (PHI) relating to a person.
1.07 “Protected Health Information” (PHI) as used in this document is individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 its role as employer.
1.08 “Personally Identifiable Information” (PII) PII refers to a combination of data elements (e.g. Social Security number, driver’s license or other government-issued identification number, passport number, financial account number, or credit or debit card number in combination with security codes) that, when linked to the individual’s first name or first initial and their last name, and not encrypted or otherwise could lead to the loss, theft or unauthorized use of the individual’s personal information.
1.09 “Public Jurisdiction” means the City of Fairfield.
1.10 “Public Jurisdiction Data” as used in this document means all data created or in any way originating with the public jurisdiction, and all data that is the output of computer processing of or other electronic manipulation of any data that was created by or in any way originated with the public jurisdiction, whether such data or output is stored on the public jurisdiction’s hardware; the Service Provider’s hardware or exists in any system owned, maintained or otherwise controlled by the public jurisdiction or by the Service Provider.
1.11 “Public Jurisdiction Identified Contact ” means the person or persons designated in writing by the public jurisdiction to receive security incident or breach notification.
1.12 “Security Incident” means the potentially unauthorized access by non- authorized persons to personal data or non- public data that could reasonably result in the use, disclosure or theft of a public jurisdiction’s unencrypted personal data or non-public data within the possession or control of a Service Provider. A security incident may or may not turn into a data breach.
1.13 “Service Level Agreement” (SLA) means a written agreement between both the public jurisdiction and the Service Provider that is subject to the terms and conditions in this document that unless otherwise agreed to includes (1) the technical service level performance promises (i.e., metrics for performance and intervals for measure), (2) description of service quality, (3) i dentification of roles and responsibilities, (4) security responsibilities and notice requirements, (5) how disputes are discovered and addressed and (6) any remedies for performance failures.
1.14 “Service Provider” means the contractor and its employees, subcontractors, agents and affiliates who are providing the services agreed to under the contract.
1.15 “Software-as-a-Service” (SaaS) means the capability provided to the consumer to use the provider’s applications running on a cloud infrastructure.
The applications are accessible from various client devices through a thin client interface such as a Web browser (e.g., Web- based email) or a program interface. The consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, storage or even Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 individual application capabilities, with the possible exception of limited user - specific application configuration settings.
1.16 “Statement of Work” is a written statement in a solicitation document or contract that describes the public jurisdiction’s service needs and expectations.
2.0 DESCRIPTION OF SERVICES
2.1 Scope of Services
The scope of services to be performed by Service Provider under this Agreement is as described in this Statement of Work in Exhibit A of this Agreement.
2.2 Data Ownership
The public jurisdiction will own all right, title and interest in its data that is related to the services provided by this contract. SERVICE PROVIDER shall not access public jurisdiction user accounts or public jurisdiction data, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of this contract or (4) at the public jurisdiction’s written request.
2.3 Data Protection
Protection of personal privacy and data shall be an integral part of the business activities of the Service Provider to ensure there is no inappropriate or unauthorized use of public jurisdiction information at any time. To this end, the Service Provider shall safeguard the confidentiality, integrity and availability of public jurisdiction information and comply with the following conditions:
a. The Service Provider shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of personal data and non-public data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the Service Provider applies to its own personal data and non-public data of similar kind.
b. All data obtained by the Service Provider in the performance of this contract shall become and remain the property of the public jurisdiction. c. All personal data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, the Service Provider is responsible for encryption of the personal data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in the service level agreement (SLA), or otherwise made a part of this contract. d. Unless otherwise stipulated, the Service Provider shall encrypt all non- public data at rest and in transit. The public jurisdiction shall identify data it deems as non- public data to the Service Provider . The level of protection and encryption for all non- public data shall be identified and made a part of this contract.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 e. At no time shall any data or processes – that either belong to or are intended for the use of a public jurisdiction or its offers, agents or employees – be copied, disclosed or retained by the Service Provider or any party related to the Service Provider for subsequent use in any transaction that does not include the public jurisdiction. f. The Service Provider shall not use any information collected in connection with the service issued from this proposal for any purpose other than fulfilling the service.
2.4 Data Location
The Service Provider shall provide its services to the public jurisdiction and its end users solely from data centers in the U.S. Storage of public jurisdiction data at rest shall be located solely in data centers in the U.S. The Service Provider shall not allow its personnel or contractors to store public jurisdiction data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Service Provider shall permit its personnel and contractors to access public j urisdiction data remotely only as required to provide technical support. The Service Provider may provide technical user support on a 24/7 basis using a “Follow the Sun” model, unless otherwise prohibited in this contract.
2.5 Security Incident
Service Provider shall inform the public jurisdiction of any security incident or data breach.
a. Incident Response: The Service Provider may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the contract. Discussing security incidents with the public jurisdiction should be handled on an urgent as-needed basis, as part of Service Provider communication and mitigation processes as mutually agreed upon, defined by law or contain ed in the contract.
b. Security Incident Reporting Requirements: The Service Provider shall report a security incident to the appropriate public jurisdiction identified contact immediately as defined in the SLA.
c. Breach Reporting Requirements: If the Service Provider has actual knowledge of a confirmed data breach that affects the security of any public jurisdiction content that is subject to applicable data breach notification law, the Service Provider shall (1) promptly notify the appropriate public jurisdiction identified contact within 24 hours or sooner, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner.
2.6 Breach Responsibilities
This section only applies when a data breach occurs with respect to personal data within the possession or control of the Service Provider.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 a. The Service Provider, unless stipulated otherwise, shall immediately notify the appropriate public jurisdiction identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Service Provider, unless stipulated otherwise, shall promptly notify the appropriate public jurisdiction identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it confirms that there is, or reasonably believes that there has been a data breach. The Service Provider shall (1) cooperate with the public jurisdiction as reasonably requested by the public jurisdiction to investigate and resolve the data breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.
c. Unless otherwise stipulated, if a data breach is a direct result of the Service Provider’s breach of its contract obligation to encrypt personal data or otherwise prevent its release, the Service Provider shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by state law; (3) a credit monitoring service required by state (or federal) law; (4) a website or a toll-free number and call center for affected individuals required by state law — all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $201 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonable determined by Service Provider based on root cause; all [(1) through (5)] subject to this contract’s limitation of liability.
2.7 Notification of Legal Requests
The Service Provider shall contact the public jurisdiction upon receipt of any electronic discovery, litigation holds, discovery searches and expert testimonies related to the public jurisdiction’s data under this contract, or which in any way might reasonably require access to the data of the public jurisdiction. The Service Provider shall not respond to subpoenas, service of process and other legal requests related to the public jurisdiction without first notifying the public jurisdiction, unless prohibited by law from providing such notice.
2.8 Termination and Suspension of Service
a. In the event of a termination of the contract, the Service Provider shall implement an orderly return of public jurisdiction data in a CSV or another mutually agreeable format at a time agreed to by the parties and the subsequent secure disposal of public jurisdiction data. b. During any period of service suspension, the Service Provider shall not take any action to intentionally erase any public jurisdiction data.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 c. In the event of termination of any services or agreement in entirety, the Service Provider shall not take any action to intentionally erase any public jurisdiction data for a period of:
i. 10 days after the effective date of termination, if the termination is in accordance with the contract period;
ii. 30 days after the effective date of termination, if the termination is for convenience;
iii. 60 days after the effective date of termination, if the termination is for cause.
d. After such period, the Service Provider shall have no obligation to maintain or provide any public jurisdiction data and shall thereafter, unless legally prohibited, delete all public jurisdiction data in its systems or otherwise in its possession or under its control.
e. The public jurisdiction shall be entitled to any post - termination assistance generally made available with respect to the services, unless a unique data retrieval arrangement has been established as part of the SLA. f. The Service Provider shall securely dispose of all requested data in all of its forms, such as disk, CD/ DVD, backup tape and paper, when requested by the public jurisdiction. Data shall be permanently deleted and shall not be recoverable, according to National Institute of S tandards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to the public jurisdiction.
g. Termination for Non- Appropriation of Funds. City is subject to federal, state or local law which makes City’s financial obligations under this Services Agreement contingent upon sufficient appropriation of funds by the applicable legislature (or other appropriate governmental body), and if such funds are not forthcoming or are insufficient due to failure of such appropriation, then City will have the right to terminate the Services Agreement at no additional cost and with no penalty by giving prior written notice documenting the lack of funding. City will use reasonable efforts to ensure appropriated funds are available. City will provide at least thirty (30) days advance written notice of such termination.
2.9 Background Checks
The Service Provider shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the contract who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Service Provider shall promote and maintain an awareness of the importance of securing the public jurisdiction’s information among the Service Pro vider’s employees and agents.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
2.10 Access to Security Logs and Reports
The Service Provider shall provide reports to the public jurisdiction in a format as specified in the SLA agreed to by both the Service Provider and the public jurisdiction. Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all public jurisdiction files related to this contract.
2.11 Contract Audit
The Service Provider shall allow the public jurisdiction to audit conformance to the contract terms. The public jurisdiction may perform this audit or contract with a third party at its discretion and at the public jurisdiction’s expense.
2.12 Data Center Audit
The Service Provider shall perform an independent audit of its data centers at least annually at its expense, and provide a redacted version of the audit report upon request. The Service Provider may remove its proprietary information from the redacted version. A Service Organization Control (SOC) 2 audit report or approved equivalent sets the minimum level of a third-party audit.
2.13 Change Control and Advance Notice
The Service Provider shall give advance notice (to be determined at the contract time and included in the SLA) to the public jurisdiction of any upgrades (e.g., major upgrades, minor upgrades, system changes) that may impact service availability and performance. A major upgrade is a replacement of hardware, software or firmware with a newer or better version in order to bring the system up to date or to improve its characteristics. It usually includes a new version number.
2.14 Security
The Service Provider shall disclose its non-proprietary security processes and technical limitations to the public jurisdiction such that adequate protection and flexibility can be attained between the public jurisdiction and the Service Provider. For example: virus checking and port sniffing — the public jurisdiction and the Service Provider shall understand each other’s roles and responsibilities.
2.15 Non-disclosure and Separation of Duties
The Service Provider shall enforce separation of job duties, require commercially reasonable non-disclosure agreements, and limit staff knowledge of public jurisdiction data to that which is absolutely necessary to perform job duties.
2.16 Import and Export of Data
The public jurisdiction shall have the ability to import or export data in piecemeal or in entirety at its discretion without interference from the Service Provider. This includes the ability for the public jurisdiction to import or export data to/from other Service Providers.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
2.17 Responsibilities and Uptime Guarantee
The Service Provider shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the environments are the responsibilities of the Service Provider. The system shall be available
24/7/365 (with agreed-upon maintenance downtime), and provide service to customers as defined in the SLA.
2.18 Subcontractor Disclosure
The Service Provider shall identify all of its strategic business partners related to services provided under this contract, including but not limited to all subcontractors or other entities or individuals who may be a party to a joint venture or similar agreement with the Service Provider , and who shall be involved in any application development and/or operations.
2.19 Right to Remove Individuals
The public jurisdiction shall have the right at any time to require that the Service Provider remove from interaction with public jurisdiction any Service Provider representative who the public jurisdiction believes is detrimental to its working relationship with the Service Provider. The public jurisdiction shall provide the Service Provider with notice of its determination, and the reasons it requests the removal. If the public jurisdiction signifies that a potential security violation exists with respect to the request, the Service Provider shall immediately remove such individual. The Service Provider shall not assign the person to any aspect of the contract or future work orders without the public jurisdiction’s consent.
2.20 Business Continuity and Disaster Recovery
The Service Provider shall provide a business continuity and disaster recovery plan upon request and ensure that the public jurisdiction’s recovery time objective (RTO) of 24 hours/days is met.
2.21 Compliance with Accessibility Standards
The Service Provider shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973.
2.22 Web Services
The Service Provider shall use Web services exclusively to interface with the public jurisdiction’s data in near real time when possible.
2.23 Encryption of Data at Rest
The Service Provider shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140- 2, Security Requirements for Cryptographic Modules for all personal data, unless the public jurisdiction approves the storage of personal data on a Service Provider portable device in order to accomplish work as defined in the statement of work.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 Exhibit “A-2”
SCOPE OF WORK
Please see attached: Flock Safety Professional Services - Implementation Services Statement of Work For Fairfield Police Department – CA FlockOS Elite
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
Flock Safety Professional Services Implementation Services ______________________________________________ Statement of Work For Fairfield Police Department - CA FlockOS Elite Effective Date: May 5, 2025 Revision: 1.0 Drafted by: Kevin Jung
1. Introduction This Statement of Work (“SOW”) is between Fairfield Police Department (“Customer”) and Flock Group
Inc
(“Flock
Safety”).
This
Statement
of
Work
is
governed
by
the
Master
Service
Agreement
with
Flock
Safety
and
Customer.
This
SOW
defines
the
scope
of
the
services
that
Flock
Safety
will
provide
to
the
Customer.
This
Statement
of
Work
provides
definitions
and
mutual
understanding
of
the
work
to
be
completed.
2. Project Summary Flock Safety will implement for Fairfield Police Department:
FlockOS Elite ● Configure and integrate up to 700 camera streams with Wing VMS for Genetec Security
Center
● Integration with Axon’s Evidence.com for sending Flock LPR data to Axon*** ● Integration of Axon Body Worn Cameras (BWC for officer location tracking** ○ Active subscription to Axon Respond is required for live GPS tracking ● Custom ESRI map layers to overlay on FlockOS map ● Integration of Single Sign-On (SSO) with Azure Active Directory ○ Identity Provider supports SAML SOW Version: 2.0
Docusign Envelope ID: F10F8592-4E7C-4FA6-9972-0ABE2BD516FD Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 ● Map Attachments to allow file and image uploads to map and redirection from FlockOS to
desired
web
resource
● Integration with Sunridge RIMS CAD through a standard API to API interface, it includes:
○ Position of patrol units on FlockOS map (when available through SunRidge RIMS and
provided
location
data
is
available)
○ Display of active CAD incidents in FlockOS (in the last 24hrs) with narrative. ○ Customer is responsible for any third party costs associated with procurement of the
SunRidge
RIMS
API.
○ Customer is responsible for requesting API credentials for testing and production APIs
from
SunRidge
and
providing
them
to
Flock.
○ The customer is responsible to ensure that Flock can connect to any on-site server
where
the
CAD
system
is
installed
(including
whitelisting
Flock
IPs
in
the
firewall).
***Axon may limit Flock’s usage of their API affecting potential Axon integrations.
Flock911
***
● Implementation of Flock911 for real-time integration for emergency 911 calls to include: ○ Automated 911 call alerts within the Flock Alerts view ○ Enable listening to 911 calls in real-time and playback audio ○ Location of inbound calls on a map in Alerts view ○ Location of inbound calls in the Flock OS Map view when Generally Available. ○ Filter calls by geographic radius of officers on the field ○ Radius will be filtered using AVL data from Axon ***Customer
will
need
to
work
with
Prepared
911
for
initial
audio
setup
3. Flock Safety Software
FlockOS Implementation Restrictions
FlockOS integrations will require assistance from Customer’s IT team for a successful implementation.
Project
items
that
may
require
IT
expertise
may
include
integrations
with
cameras,
video
management
system
(VMS)
,
computer-aided
dispatch
(CAD),
ESRI
maps,
etc.
Installation
and
integrations
of
FlockOS
project
items
may
be
delayed
and
increase
project
timeline
without
IT
response
in
a
timely
manner.
Projects
will
be
placed
on
hold
after
multiple
failed
outreach
attempts
by
Technical
Project
Manager
to
Customer
IT
on
pending
action
items.
A
completed
and
signed
SOW
states
that
IT
has
reviewed
and
acknowledged
the
items
listed
in
this
SOW
to
assist
the
Flock
Safety
team
on
implementation.
SOW Version: 2.0
Docusign Envelope ID: F10F8592-4E7C-4FA6-9972-0ABE2BD516FD Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 IT Contact
Customer will dedicate the following individual(s) as the main IT point of contact for IT related
project
items:
IT Contact
Name Nicholas Giaccio
Title Senior Analyst
Email [email protected]
Software Configuration and Validation ● Configure ESRI Based map interface ● Implement Video Management System ● Integrate existing Flock Hardware ● Enable Unlimited Users ● Enable Real-Time Routing ● Enable Axon BWC and Fleet Locations ● Enable Map Attachments ● Implement Single Sign-On (SSO) for FlockOS ● Test CAD connectivity and verify active call queries within FlockOS Video Integrations Configure up to 700 video feeds within FlockOS package***** ● Configure and integrate up to 700 camera streams with Wing VMS for Gentec Security
Center
*****Cameras must be able to support RTSP streaming back to Flock’s cloud.
VMS Integration ● Enable RTSP in the Security Center’s Media Gateway ● Port forward the server to Flock’s IP and whitelist the IP (54.157.57.206). ● Creation of a Flock user (minimum “read” access to the desired cameras) SOW Version: 2.0
Docusign Envelope ID: F10F8592-4E7C-4FA6-9972-0ABE2BD516FD Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
4. Description of Services The following services will be provided as part of this Statement of Work. Any Services not described
herein
will
require
a
Project
Change
Request
(PCR).
Dedicated Flock Team Members ● Flock Safety will provide a Project Manager for engagement that will be responsible
for
the
following
tasks:
○ Flock Safety will assign a Technical Project Manager and Integration Manager
to
coordinate
all
aspects
of
integrations
for
FlockOS
software
■ Duration: 2-6+ months ● Flock Safety will provide a Customer Success Manager (CSM). The CSM will be the
Customer’s
long-term
strategic
partner.
CSM
will
help
with
account
setup,
training,
and
provide
direction
on
how
to
best
leverage
your
Flock
Safety
system
post-installation.
○ Duration: Length of Contract ● Flock Safety’s support team will be available to the Customer Monday through Friday
8am-8pm
EST.
○ Phone: 1-(866) 901-1781 ○ Email: [email protected] ■ Duration: Length of Contract Kick-Off Meeting ● Flock Safety will coordinate bi-weekly calls beginning with a kickoff meeting with Customer
and
Flock
Safety
stakeholders
to
review
a
Project
Plan
for
a
successful
deployment
of
Flock
products.
The
meeting
will
cover:
FlockOS Software
● Project Plan ● Integration item review ● Identify stakeholder responsibilities ● Bi-weekly cadence scheduling ● Question/concerns
5. Project Conditions and Assumptions ● Out of Scope ○ Physical installation of any product not supplied by Flock. ○ Software changes/configurations outside of FlockOS. ○ Network configurations outside of Flock standards.
SOW Version: 2.0
Docusign Envelope ID: F10F8592-4E7C-4FA6-9972-0ABE2BD516FD Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 ● Any changes or additions to this SOW will require a PCR (Project Change Request) ● Project Timeline is dependent upon the information supplied by the Customer. All information
that
is
asked
by
Flock
Safety,
is
required
to
be
completed
prior
to
Flock
Employee
onsite.
● Streams will be available to the Customer within 5 business days of Flock product installation.
● A completed statement of work will include the FlockOS Elite package. All streams and products
purchased
will
be
installed
or
implemented
via
Flock
Safety.
Third
Party
cameras
integrated
will
be
available
on
the
Flock
Safety
network.
This
may
exclude
change
orders
and
or
individual
stream
troubleshooting.
6. Implementation Timeline Software Timeline
The following chart represents a rough timeline for implementation of FlockOS software integrations.
The
estimated
time
for
Flock
Safety
Technical
Project
Managers
to
schedule
a
kick
off
meeting
is
6-8
weeks
from
the
signing
of
a
contract.
Integration Duration
Flock Gateway ~ 30-90 days (Groups of 5-20 locations max per visit) VMS integration ~ 30-90 days
3rd Party cameras installs ~ 90 days (Groups of 5-20 locations max per visit) Wing LPR ~ 1-2 weeks
CAD integration ~ 60-120 days
Custom Map Layers ~ 1-2 weeks
Community Website & Marketing Materials ~ 30-60 days Flock911 ~ 90-120 days Estimated Customer Project Timeline Expected Timeline for Software Configuration: ~ 4 months
SOW Version: 2.0
Docusign Envelope ID: F10F8592-4E7C-4FA6-9972-0ABE2BD516FD Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
7. Payment Terms Services will be invoiced as per the terms on your Flock Safety quote and contract. Flock Safety Professional
Services
labor
rate
is
$250
per
hour
for
all
services
above
and
beyond
those
purchased
and
outlined
in
this
statement
of
work.
8. Acknowledgement and Approvals Upon completion of this SOW, no additional services are due to the Customer under this SOW. The parties, through their authorized representatives signed below, hereby agree to the terms of this
Statement
of
Work
as
of
the
Effective
Date.
Flock Safety
Name Tyler Carlson
Title Senior Director, Solutions Engineering
Signature
Date
Customer
Name
Title
Signature
Date
Customer IT
Name
Title
Signature
Date
SOW Version: 2.0
Docusign Envelope ID: F10F8592-4E7C-4FA6-9972-0ABE2BD516FD 5/5/2025
Nicholas Giaccio
Nick McDowell
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 Exhibit “A-3”
Service Level Agreement
Please see Flock Safety Order Form attached.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
Flock Safety + CA - City of Fairfield
______________
Flock Group Inc.
1170 Howell Mill Rd, Suite 210
Atlanta, GA 30318
______________
MAIN CONTACT:
Jeff Lents
[email protected]
480 621 2406
Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
ORDER FORM
This order form (“Order Form”) hereby incorporates and includes the terms of the previously executed agreement (the “Terms”) which describe and set forth the general legal terms governing the relationship (collectively, the "Agreement" ). The Terms contain, among other things, warranty disclaimers, liability limitations and use limitations.
This additional services Agreement will be effective when this Order Form is executed by both Parties (the “Effective Date”)
Customer: CA - City of Fairfield Initial Term: 60 Months Legal Entity Name: CA - City of Fairfield Renewal Term: 24 Months Accounts Payable Email: [email protected] Payment Terms: Net 30 Address: 1000 Webster St Fairfield, California
94533
Billing Frequency: Annual Plan - First Year Invoiced at Signing.
Retention Period: 30 Days
Hardware and Software Products
Annual recurring amounts over subscription term
Item Cost Quantity Total
Flock Safety Platform $500,000.00
Flock Safety Flock OS
FlockOS™ Elite Package Included 1 Included
Flock Safety LPR Products
Flock Safety LPR, fka Falcon Included 2 Included
Flock Safety Drone Hardware and Services
Flock Aerodome DFR - M4DT + Dock 3 Included 2 Included
Flock911 for Aerodome Included 1 Included
Flock Aerodome DFR - M350 + Dock Included 1 Included
Flock Aerodome DFR - Radar Included 1 Included
Flock Safety Video Products
Flock Safety Video Integration VMS, fka Wing Included 700 Included Flock Safety Platform Add Ons
Flock Safety Platform - FreeForm Add-On Included 1 Included Flock Nova - Customer Data Included 1 Included
Flock Nova - OSINT Data Included 1 Included
Flock Safety Professional Services
Custom Recurring Subscription Included 1 Included
Professional Services and One Time Purchases
Item Cost Quantity Total
One Time Fees
Flock Safety Professional Services
Professional Services - Existing Infrastructure $0.00 2 $0.00 Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 Implementation Fee
Subtotal Year 1: $350,000.00
Annual Recurring Subtotal: $500,000.00
Discounts: $535,800.00
Estimated Tax: $0.00
Contract Total: $2,350,000.00
Taxes shown above are provided as an estimate. Actual taxes are the responsibility of the Customer. This Agreement will automatically renew for successive renewal terms of the greater of one year or the length set forth on the Order Form (each, a “Renewal Term”) unless either Party gives the other Party notice of non-renewal at least thirty (30) days prior to the end of the then-current term.
The Term for Flock Hardware shall commence upon first installation and validation, except that the Term for any Flock Hardware that requires self- installation shall commence upon execution of the Agreement. In the event a Customer purchases more than one type of Flock Hardware, the earliest Term start date shall control. In the event a Customer purchases software only, the Term shall commence upon execution of the Agreement.
Special Terms:
• In the first year of the deployment, Flock will provide Customer with complimentary use of radar [Flock Aerodome DFR - Radar].
For reference, the products listed (prewritten computer software delivered electronically and installation not associated with the sale of tangible personal property) on the quote are both exempt in California
Custom Recurring: Jamie Hudson Real Time Consulting.
Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
Billing Schedule
Billing Schedule Amount (USD)
Year 1
At Contract Signing $350,000.00
Annual Recurring after Year 1 $500,000.00
Contract Total $2,350,000.00
*Tax not included
Discounts
Discounts Applied Amount (USD)
Flock Safety Platform $30,000.00
Flock Safety Add-ons $195,500.00
Flock Safety Professional Services $300.00
Flock Safety Drone Hardware and Services $310,300.00
Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 Product and Services Description
Flock Safety Platform Items Product Description
Flock Aerodome DFR - M4DT +
Dock 3
Drone as First Responder (DFR) 2.0 system, including hardware, software, and services. Hardware includes M4D series drone, camera, batteries, and contact-charging Dock 3. Software includes remote piloting, air traffic awareness, spectator view, mobile app, flight logging, mission reporting, and community engagement dashboard. Services include FAA regulatory services, SOP development, training, and ongoing support.
Flock911 for Aerodome
Flock911 enables users to access live 911 calls directly within the FlockOS™ software, delivering real-time situational context that ensures faster, safer, and more efficient responses to calls for service.
Flock Safety Platform - FreeForm
Add-On
AI-powered software add-on to the Flock Safety Platform that adds the ability for users to search using plain language across LPR images and video footage (from FreeForm-enabled devices) with built-in safeguards ensuring ethical and compliant usage.
Flock Nova - Customer Data
Flock Nova data integration and intelligence platform subscription, enabling data centralization from agency computer-aided dispatch (CAD), record management system (RMS), digital evidence management system (DEMS), and shared inter-agency networks.
Flock Nova - OSINT Data
Flock Nova data integration and intelligence platform subscription. Includes access to open source intelligence (OSINT) and shared inter-agency data.
FlockOS™ Elite Package
Distinguishing itself from traditional brick-and-mortar real-time crime centers (RTCCs) and other cloud-based solutions, FlockOS™ Elite is scalable and community-powered, offering a versatile, cloud-based RTCC platform.
Custom Recurring Subscription Real Time Consulting (Jamie Hudson) Flock Safety Video Integration
VMS, fka Wing
Flock Aerodome DFR - M350 +
Dock
Drone as First Responder (DFR) 2.0 system, including hardware, software, and services. Hardware includes Matrice (M350) drone, camera, batteries, and battery-swapping dock. Software includes remote piloting, air traffic awareness, spectator view, mobile app, flight logging, mission reporting, and community engagement dashboard. Services include FAA regulatory services, SOP development, training, and ongoing support.
Flock Safety LPR, fka Falcon
Law enforcement grade infrastructure-free (solar power + LTE) license plate recognition camera with Vehicle Fingerprint ™ technology (proprietary machine learning software) and real-time alerts for unlimited users.
Professional Services - Existing
Infrastructure Implementation Fee
One-time Professional Services engagement. Includes site and safety assessment of existing vertical infrastructure location, camera setup and testing, and shipping and handling in accordance with the Flock Safety Standard Implementation Service Brief.
Flock Aerodome DFR - Radar
Drone as First Responder (DFR) 2.0 detect and avoid capabilities for operations up to 400 ft according to agreed-upon UASFM altitudes. Includes FAA regulatory services and installation.
Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
PRODUCT ADDENDUM
UNMANNED AIR SUPPORT AS A SERVICE (UASaaS) PROGRAM
FOR DRONE RESPONSE SERVICES
WHEREAS, Customer has determined that it is in the interests of public safety for it to have the ability to utilize unmanned drones during crisis incidents, public emergencies, and in certain public safety operations, to the extent permitted by law;
WHEREAS, Flock is in the business of providing unmanned drone services ( the unmanned drone services shall be considered part of the “Flock Services”) and Flock Hardware; NOW, THEREFORE, for good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, Customer and Flock agree as follows:
1. UNMANNED AIR SUPPORT GENERAL TERMS OF DELIVERY
1.1 Flock Services and Hardware. Flock shall provide access to Customer the Flock Services and related Flock Hardware (the “Flock Hardware”) listed on the Order Form upon the terms and conditions set forth in the Agreement. Flock maintains ownership of all the Flock Hardware. Each year, as specified in the Order Form, the Customer will be provi ded with a designated number of batteries. Customer may place an order for additional Flock Hardware (e.g., batteries prior to 500 complete charging cycles, hardware damaged due to Customer’s error, additional spares, etc.) at Flock’s then current list price, which will be made available to Customer upon request.
1.2 FAA Regulatory Waivers . Flock will assist Customer in acquiring any required Federal Aviation Administration (“FAA”) regulatory waivers.
1.3 Delivery. Flock shall make the Flock Hardware available to Customer at Customer’s delivery address set forth in the Order Form (“Delivery Point”). If for any reason Customer fails to accept delivery of the Flock Hardware by the date fixed pursuant to Flock's notice stating that the Flock Hardware is available at the Delivery Point: (i) Customer shall bear the risk of loss to the Flock Hardware; (ii) the Flock Hardware shall be deemed to have been delivered; and (iii) Flock, at its option, may store the Flock Hardware until collected by Customer, whereupon Customer shall be liable for all related costs and expenses (including, without limitation, storage and insurance). Once the Flock Hardware is made available as the Delivery Point, Customer is responsible for any resulting use of the Flock Hardware by all Authorized Users and all third-parties who may gain access to the same.
1.4 Pilot Services. Upon Customer’s request, Flock will make available an employee or independent contractor pilot (each a “Pilot”) to Customer for purposes o f operating the Flock Hardware (hereafter the “Pilot Services”) at the pricing set forth in the Order Form. The Pilot Services shall be considered part of the Flock Services. When operating the Flock Hardware, the Pilot shall comply with the reasonable requests of Customer. Such Pilot Services may be used for up to forty (40) hours per week during the Term. Customer’s use of the Pilot Services shall not alleviate any of Customer’s obligations set forth herein. Customer shall provide Pilots with a safe worki ng environment when on Customer’s premises.
2. LOSS AND DAMAGE OF FLOCK HARDWARE
2.1 Customer assumes and shall bear the entire risk of loss, damage to, theft or destruction of, all Flock Hardware. LOSS OR DAMAGE TO THE FLOCK HARDWARE, OR ANY PART OF IT, SHALL NO T RELIEVE CUSTOMER OF ANY OBLIGATION UNDER THE AGREEMENT. Customer’s obligations with respect to this Section shall commence upon delivery of the Flock Hardware.
Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
2.2 Customer agrees to immediately notify Flock of any accident or event of loss or damage involving the Flock Hardware. The notification shall include any information as may be pertinent to Flock's investigation of such accident, loss, or damage, or which Flock may reasonably require.
3. FEES. The Order Form dictates the Flock Hardware, software, personnel, and Flock Services and the entire Flock Services corresponding fees. Customer shall pay the Fees as described on the Order Form.
4. TERM. The term of this Agreement commences on the Effective Date of this Agreement and continues until terminated as provided under this Agreement (the “ Term”). Each Order Form shall commence and expire and/or terminate according to the terms set forth in such Order Form. On expiration or termination of the Agreement, all licenses provided hereunder by Flock shall immediately expire.
5. FLOCK DRONE IP. Customer Data does not include, and Flock Drone IP (defined herein) expressly includes, any data to the extent processed by, resulting as an output of, or based on the usage of, the Flock Services, Flock Hardware, including, without limitation, data collected by Flock’s radar and radio frequency sensors.
Such Flock Drone IP shall be Flock’s Confidential Information. Flock shall own all rights to (i) any data input into the Flock Services, Flock Hardware by or on behalf of Flock (not including any Customer Data) and (ii) any aggregated and anonymized data extracted or derived from the Flock Services, or use of the Flock Hardware, including all aggregated and anonymized usage data, statistical data, transactional data, metadata, market data, flight logs and flight history, telemetry data and logs, fleet information including drone serial numbers and models, connected device information including radar data concerning the surrounding airspace, and other aggregated and anonymized data collected from user data and files (collectively, “Flock Drone IP”). Without limiting the generality of the foregoing, Flock reserves the right to create and market public indexes, analysis or insights created from such data. Customer agrees that it will not share, sell, transfer, or make available any data generated by the Flock Hardware, including all Flock Drone IP to which it may have access, to any third party without the prior express written consent of Flock
Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
SCHEDULE A
SERVICES
Flock makes no warranties regarding the efficacy of the training detailed below.
1. AIRWORTHINESS TRAINING
Flock will make commercially reasonable efforts to provide training for the Customer to maintain the airworthiness of its drones, including compliance-related trainings.
Customer shall be responsible for ensuring that all crew, including pilot in command, visual observer, sensor or payload operator, or other persons necessary for the safe operation of the flight have the qualifications, experience, licenses, and certificates required by applicable FAA regulations and that all have the necessary skill req uired to perform their duties. After completion of training, Customer will be responsible for maintaining the airworthiness of drones to which Customer is responsible and the ensuring that the respective operations are in line with all applicable laws and regulations.
The training will be conducted via both online and in -person methods, as agreed upon by both parties. The frequency and duration of training will be mutually decided and scheduled to the convenience of the Customer.
2. FLIGHT TRAINING
Flock will assist the Customer in obtaining FAA BVLOS waivers and train the Customer on compliance matters related to such waivers. Flock will start with one deployment location at a time, and work up to the agreed upon number of deployment locations for all UAS. As part of the BVLOS process, Flock will provide training materials to the Customer to certify all employees of the Customers selected as Visual Observers (“VOs”) to help aid in BVLOS operations.
Flock will provide training to officers on how to utilize the Flock IP. This will consist of:
● Showing how to access Flock on their respective internet devices ● Showing how to view a live stream through the application ● Showing how to control the drone using the application ● Showing how to report problems if they come across them on the application The training will be conducted via both online and in -person methods, as agreed upon by both parties. The frequency and duration of training will be mutually decided and scheduled to the convenience of the Customer.
3. FLOCK HARDWARE TRAINING
There will also be training for the Customer to use the Flock Hardware. This training will consist of:
● Discussing maintenance list for the drone, and how to maintain airworthiness ● Teaching how to fly the drone autonomously using the Flock IP ● Teaching how to fly the drone manually using the remote controller The training will be conducted via both online and in -person methods, as agreed upon by both parties. The frequency and duration of training will be mutually decided and scheduled to the convenience of the Customer.
Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
4. DEPLOYMENT SUPPORT
Flock will teach the Customer how to dispatch the Flock Hardware using the software for 911 calls.
Only personnel authorized by Customer may have access to the livestream from the drone. They will also be taught on how to use Flock’s software to view said stream on any internet-connected device.
Authorized personnel may have access to the Flock IP, which can convey the current status of the drone, and how to tell the drone to conduct additional maneuvers if needed.
All operations must be conducted by a Pilot in Command (“PIC”), who is an FAA-certified pilot. Customer will provide the PICs needed to sustain this program.
Flock will assist in drafting a Standard Operating Procedure (“SOP”) as well as department policies regarding access, deployments, privacy, and community engagement.
Flock will ensure correct implementation of each Flock station and its included Flock Hardware which may or may not include the aircraft, on-prem servers, charging dock installations, radars, and more.
Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
SCHEDULE B
SPECIFICATIONS
Customer must abide by the following standards:
Operational:
● Per FAA regulations, and without the necessary waiver, a minimum of one pilot is required to operate each drone.
● Work with Flock to get BVLOS waivers for the city to fully use Flock’s product and services. ● Train members of the city to be VOs so that the Customer can have FAA -compliant and safe BVLOS operations (Flock will provide training material if needed). ● If Customer wants to connect Flock’s software to their Computer Aided Dispatch (“CAD”) system, Customer will provide access to said CAD system at no cost to Flock to location information and other pertinent information about calls-for-service as they are placed. ● Flock will provide their Flock software interface to command the Flock Hardware . Customer must independently access and store any personal information about calls-for-services other than their location and the type of response (police, fire, or EMS) they prompted.
Customer shall be responsible to integrate with CAD software to pull location information and call type information of every call-for-service that the Customer decides the drone should be deployed to, so long as there are no moneta ry charges to Flock for said integration.
Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 By executing this Order Form, Customer represents and warrants that it has read and agrees to all of the terms and conditions contained in the previously executed agreement.
The Parties have executed this Agreement as of the dates set forth below.
FLOCK GROUP, INC. Customer: CA - City of Fairfield
By:
\FSSignature2\
By:
\FSSignature1\
Name:
\FSFullname2\
Name:
\FSFullname1\
Title:
\FSTitle2\
Title:
\FSTitle1\
Date:
\FSDateSigned2\
Date:
\FSDateSigned1\
PO Number:
Docusign Envelope ID: BAAF5D4F-75A4-4387-98DA-19908B8393A6 Mark Smith
6/2/2025
General Counsel
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 EXHIBIT “B”
PAYMENT
Billing Schedule
Year 1 350,000.00
Year 2 350,000.00
Year 3 350,000.00
Year 4 350,000.00
Year 5 350,000.00
Contract Total 1,750,000.00
Annual Recurring 350,000.00
Services will be invoiced as per the terms on your Flock Safety quote and contract. Flock Safety Professional Services labor rate is $250 per hour for all services above and beyond those purchased and outlined in this statement of work.
1) The total contract price for services rendered by SERVICE PROVIDER under this Agreement described in Exhibit “A” shall be eighteen thousand dollars ($1,750,000.00). 2) Payment shall be made to SERVICE PROVIDER on a time and materials basis, and SERVICE PROVIDER shall submit monthly invoices to [email protected] for the same.
3) CITY shall pay SERVICE PROVIDER within 45 days after receipt of SERVICE PROVIDER’S invoice.
4) Any additional meetings, work, or other services required beyond that set forth in Exhibit “A-2” shall be mutually agreed to in writing by the CITY and CONSULTANT. Such additional work shall be billed on a time and materials basis, or as otherwise agreed to in writing by CITY and CONSULTANT.
5) NON-REIMBURSABLE EXPENSES. CONSULTANT shall be responsible for all costs and expenses incurred by CONSULTANT, personnel of CONSULTANT and subcontractors of CONSULTANT, in connection with the Services, including, without limitation, payment of salaries, fringe benefit contributions, payroll taxes, withholding taxes, and other taxes or levies, office overhead expenses, travel expenses, telephone and other telecommunication expenses, and document reproduction expenses.
6) Termination for Non -Appropriation of Funds. City is subject to federal, state or local law which makes City’s financial obligations under this Services Agreement contingent upon sufficient appropriation of funds by the applicable legislature (or other appropriate governmental body), and if such funds are not forthcoming or are insufficient due to failure of such appropriation, then City will have the right to terminate the Services Agreement at no additional cost and with no penalty by giving prior written notice documenting the lack of funding. City will use reasonable efforts to ensure appropriated funds are available. City will provide at least thirty (30) days advance written notice of such termination.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 EXHIBIT “C”
GENERAL PROVISIONS
1) INDEPENDENT SERVICE PROVIDER . At all times during the term of this Agreement, Service Provider shall be an independent contractor and shall not be an employee of City. City shall have the right to control Service Provider only insofar as the results of Service Provider's services rendered pursuant to this Agreement; however, City shall not have the right to control the means by which Service Provider accomplishes services rendered pursuant to this Agreement.
2) LICENSES; PERMITS; ETC. Service Provider represents and warrants to City that Service Provider has all licenses, permits, qualifications, and approvals of whatsoever nature which are legally required for Service Provider to practice Service Provider's profession. Service Provider represents and warrants to City that Service Provider shall, at its sole cost and expense, keep in effect at all times during the term of this Agreement, any licenses, permits, and approvals which are legally required for Service Provider to practice his profession.
3) TIME. Service Provider shall devote such services pursuant to this Agreement as may be reasonably necessary for satisfactory performance of Service Provider 's obligations pursuant to this Agreement.
4) SERVICE PROVIDER NOT AN AGENT. Except as City may specify in writing, Service Provider shall have no authority, express or implied, to act on behalf of City in any capacity whatsoever as an agent. Service Provider shall have no authority, express or implied, pursuant to this Agreement, to bind City to any obligation whatsoever.
5) ASSIGNMENT PROHIBITED. No party to this Agreement may assign any right or obligation pursuant to this Agreement. Any attempted or purported assignment of any right or obligation pursuant to this Agreement shall be void and of no effect.
6) PERSONNEL. Service Provider shall assign only competent personnel to perform services pursuant to this Agreement. In the event that City, in its sole discretion, at any time during the term of this Agreement, desires the removal of any person or persons assigned by Service Provider to perform services pursuant to this Agreement, Service Provider shall remove any such person immediately upon receiving notice from City of the desire of City for the removal of such person or persons.
7) STANDARD OF PERFORMANCE. Service Provider shall perform all services required pursuant to this Agreement. Services shall be performed in the manner and according to the standards observed by a competent practitioner of the profession in which Service Provider is engaged in the geographical area in which Service Provider practices his profession. All products which Service Provider delivers to City pursuant to this Agreement shall be prepared in a workmanlike manner and conform to the standards of quality normally observed by a person practicing in Service Provider 's profession. City shall be the sole judge as to whether the product of the Service Provider is satisfactory.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 8) CANCELLATION OF AGREEMENT. This Agreement may be canceled at any time by the City at the discretion of the City Manager , or his/her designee, upon written notification to Service Provider. Service Provider is entitled to receive full payment for all services performed and all costs incurred up to and including the date of receipt of written notice to cease work on the project . Service Provider shall be entitled to no further compensation for work performed after the cancellation date. All completed and incomplete reports and documents of the Service Provider provided under this Agreement up to the date of receipt of written notice to cease work shall become the property of City.
9) INDEMNIFY AND HOLD HARMLESS.
a) If AGREEMENT is an agreement for design professional services subject to California Civil Code § 2782.8(a) and Service Provider is a design professional, as defined in California Civil Code § 2782.8(c)(2), to the fullest extent allowed by law, Service Provider shall hold harmless, defend and indemnify the City, its officers, agents, employees, and volunteers from and against all claims, damages, losses, and expenses including attorneys’ fees arising out of, or pertaining to, or relating t o the negligence, recklessness, or willful misconduct of the Service Provider, except where caused by the active negligence, sole negligence, or willful misconduct of the City.
b) If AGREEMENT is not an agreement for design professional services subject to California Civil Code § 2782.8(a) or Service Provider is not a design professional as defined in subsection 10(a) above, to the fullest extent allowed by law, Service Provider shall indemnify, defend, and hold harmless the City, its officers, agents, employees and volunteers from all claims, suits, or actions of every name, kind and description, brought forth on account of injuries to or death of any person or damage to property arising from or connected with the willful misconduct, negligent acts, serious errors or omissions, ultra-hazardous activities, activities giving rise to strict liability, or defects in design by Service Provider or any person directly or indirectly employed by or acting as agent for Service Provider in the performance of this Agreement, including the concurrent or successive passive negligence of the City, its officers, agents, employees or volunteers.
It is understood that the duty of Service Provider to indemnify and hold harmless includes the duty to defend as set forth in Section 2778 of the California Civil Code.
Acceptance of insurance certificates and endorsements required under this Agreement does not relieve Service Provider from liability under this indemnification and hold harmless clause. This indemnification and hold harmless clause shall apply whether or not such insurance policies are determined to be applicable to any such damages or claims for damages.
Service Provider’s responsibility for such defense and indemnity shall survive termination or completion of this agreement for the full period of time allowed by law.
10) PROHIBITED INTERESTS. No employee of the City shall have any direct financial interest in this agreement. This agreement shall be voidable at the option of the City if this provision is violated.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
11) LOCAL EMPLOYMENT POLICY. The City desires wherever possible, to hire qualified local residents to work on city projects. Local resident is defined as a person who resides in Solano County. The City encourages an active affirmative action program on the part of its contractors, sub -contractors, and developers. When local projects require, subcontractors, contractors, consultants and developers will solicit proposals from qualified local firms where possible.
As a way of responding to the provisions of the Davis-Bacon Act and this program, contractor, consultants, and developers will be asked, to provide no more frequently than monthly, a report which lists the employee's name, job class, hours worked, salary paid, city of residence, and ethnic origin.
12) SERVICE PROVIDER NOT A PUBLIC OFFICIAL. Service Provider is not a "public official" for purposes of Government Code §§ 87200 et seq. Service Provider conducts research and arrives at his or her conclusions, advice, recommendation, or counsel independent of the control and direction of the City or any City official, other than normal contract monitoring. In addition, Service Provider possesses no authority with respect to any City decision beyond these conclusions, advice, recommendation, or counsel.
13) EMPLOYMENT DEVELOPMENT DEPARTMENT REPORTING
REQUIREMENTS. When the City executes an agreement for or makes payment to Service Provider in the amount of $600 (six hundred dollars) or more in any one calendar year, Service Provider shall provide the following information to City to comply with Employment Development Department (EDD) reporting requirements:
a) Whether Service Provider is doing business as a sole proprietorship, partnership, limited liability partnership, corporation, limited liability corporation, non- profit corporation or other form of organization.
b) If Service Provider is doing business as a sole proprietorship, Service Provider shall provide the full name, address and social security number or federal tax identification number of the sole proprietor.
c) If Service Provider is doing business as other than a sole proprietorship, Service Provider shall provide Service Provider’s federal tax identification number.
14) NOTICES. All notices shall be given in writing to the following addresses or other such addresses as the parties may designate by written notice:
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 To City: City of Fairfield
Attn: __________
c/o ____________
1000 Webster Street
Fairfield, California 94533
To Service Provider:
Flock Group Inc
_________________________
_________________________
15) GOVERNING LAW AND VENUE. This Agreement shall be governed by the laws of the State of California and, in the event of litigation, venue will be in the County of Solano.
16) PROPRIETARY AND CONFIDENTIAL INFORMATION. Service Provider agrees that all of the information it obtains from City constitutes City’s confidential property (“Confidential Information”) regardless of whether such information is pre- marked as confidential or in any other manner to indicate its confidential nature. Except as expressly authorized herein, Service Provider agrees to hold in confidence and not disclose any Confidential Information. Service Provider further agrees to establish such systems and procedures as may be reasonable to maintain City’s Confidential Information. Service Provider’s nondisclosure obligation shall not apply to information which Service Provider can document: (a) was rightfully in its possession or known to it prior to receipt of the Confidential Information; (b) is or has become public knowledge through no fault of Service Provider; (c) is rightfully obtained by Service Provider from a third party without breach of any confidentiality obligation; or (d) is required to be disclosed pursuant to the order or requirement of a court, administrative agency, federal law, foreign state law, California state law, applicable regulatory authorities, or other governmental body.
17) DIVULGING OF CONFIDENTIAL OR PROPRIETARY INFORMATION. Should City require the services of a third party to operate, maintain or modify the Product(s) nothing in this Agreement shall preclude City from doing so. City shall provide Service Provider with as much notice as practicable before utilizing or divulging any proprietary information or trade secrets so that Service Provider may coordinate and or limit the delivery of said information to the third party necessary to accomplish said operation, modification or maintenance. Any third party receiving Confidential or Proprietary Information or trade secrets under this paragraph must agree to the same prohibition against disclosure as City.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 EXHIBIT “D”
INSURANCE REQUIREMENTS
Service Provider shall procure and maintain for the duration of the contract insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the work hereunder by the Service Provider, its agents, representatives, or employees.
1. MINIMUM SCOPE AND LIMITS OF INSURANCE
a) Commercial General Liability coverage (occurrence Form CG 00 01) with minimum limits of $1,000,000 per occurrence for bodily injury, personal injury, products and completed operations, and property damage. If Commercial General Liability or other form with a general aggregate limit is used, either the general aggregate limit shall apply separately to this project/location or the general aggregate limit shall be twice the required occurrence limit.
b) Automobile Liability coverage (Form CA 00 01 with Code 1 – any auto) with minimum limits of $1,000,000 per accident for bodily injury and property damage.
c) Workers’ Compensation insurance as required by the State of California and Employers’ Liability insurance, each in the amount of $1,000,000 per accident for bodily injury or disease.
d) Insurance Disclosure Clause – Sublimits
Disclosure of Insurance Sublimits
Vendor shall provide complete and accurate documentation of all applicable insurance policies required under this Agreement, including but not limited to general liability, cyber liability, professional liability, and errors and omissions insurance. Vendor shall expressly disclose any sublimits that apply to any portion of the coverage required under this Agreement. This includes, but is not limited to, sublimits applicable to specific types of claims, data breaches, regulatory investigations, defense costs, or geographic restrictions.
e) Failure to disclose any applicable sublimits shall be deemed a material breach of this Agreement. The disclosure shall be made in writing and must accompany the Certificate(s) of Insurance provided prior to the commencement of services and upon each annual renewal thereafter.
2. INDUSTRY SPECIFIC COVERAGES
The following insurance is also required.
X Cyber Liability Insurance in the minimum amount of $1,000,000 per occurrence
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
3. INSURANCE PROVISIONS
a) DEDUCTIBLES AND SELF-INSURED RETENTIONS. Any deductibles or self- insured retentions must be declared to and approved by the City. At the option of the City, either the insurer shall reduce or eliminate such deductibles or self- insured retentions as respects the City, its officers, officials, employees and volunteers; or the Service Provider shall procure a bond guaranteeing payment of losses and related investigations, claim administration and defense expenses.
b) The general and automobile liability policies (and if applicable, cyber liability, garage keepers liability and builder’s risk policies) are to contain, or be endorsed to contain, the following provisions:
i. The City, its officers, officials, employees and volunteers are to be covered as insureds as respects: liability arising out of work or operations performed by or on behalf of the Service Provider; products and completed operations of the Service Provider; premises owned, occupied or used by the Service Provider; and automobiles owned, leased, hired or borrowed by the Service Provider. The coverage shall contain no special limitations on the scope of protection afforded to the City, its officers, officials, employees or volunteers.
ii. For any claims related to this project, the Service Provider’s insurance coverage shall be primary insurance as respects the City, its officers, officials, employees and volunteers. Any insurance or self-insured maintained by the City, its officers, officials, employees or volunteers shall be excess of the Service Provider’s insurance and shall not contribute with it.
iii. Any failure to comply with reporting or other provisions of the policies including breaches of warranties shall not affect coverage provided to the City, its officers, officials, employees or volunteers.
iv. The Service Provider’s insurance shall apply separately to each insured against whom claim is made or suit is brought, except with respect to the limits of the insurer’s liability.
v. Each insurance policy required by this clause shall be endorsed to state that coverage shall not be suspended, voided, canceled by either party, reduced in coverage or in limits except after thirty (30) days’ prior written notice by certified mail, return receipt requested, has been given to the City.
vi. The policy limits of coverage shall be made available to the full limits of the policy. The minimum limits stated above shall not serve to reduce the Service Provider’s policy limits of coverage. Therefore, the requirements for coverage and limits shall be (1) the minimum coverage and limits specified in this agreement, or (2) the broader coverage and maximum limits of coverage of any insurance policy or proceeds available to the named insured, whichever is greater.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
c) ACCEPTABILITY OF INSURER. Insurance is to be placed with insurers with a current A.M. Best’s rating of no less than A:VII, unless otherwise acceptable to the City.
d) VERIFICATION OF COVERAGE. CONSULTANT shall furnish the CITY with original endorsements effecting coverage required by this Exhibit D. The endorsements are to be signed by a person authorized by that insurer to bind coverage on its behalf. The endorsements are to be on forms equivalent to CG 20 10 11 85 subject to CITY approval. All insurance certificates and endorsements are to be received and approved by the CITY before work commences, these documents must be submitted electronically via email at [email protected]. At the request of the CITY, CONSULTANT shall provide complete copies of all required insurance policies, including endorsements effecting the coverage required by these specifications.
e) SUB-CONTRACTORS. Service Provider shall require all subcontractors to procure and maintain insurance policies subject to the requirements of Exhibit D. Failure of Service Provider to verify existence of sub-contractor’s insurance shall not relieve Service Provider from any claim arising from sub-contractors work on behalf of Service Provider.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 EXHIBIT “E”
CJIS SECURITY ADDENDUM AGREEMENT
Agency Identification
Agency Name/ORI: City of Fairfield Police Department
Agency Address: 1000 Webster St Fairfield, CA 94533
Agency Representative (Title and Name): Imelda Preciado Phone Number: 707-428-7707
Email address: [email protected]
Vendor/Contractor Identification
COMPANY NAME: _________________________________________________ ADDRESS: _______________________________________________________ CITY, STATE ZIP: _________________________________________________ Contractor Representative: _________________________________________ Phone Number/Fax Number: _______________________________________ Email Address: __________________________________________________
This document is not intended to replace the Security Addendum process identified in the CJIS Security Policy. This document is intended to provide an alternative method for the Security Addendum process in situations where there is no formal or “typical” contract for services between a criminal justice agency and a CJIS related vendor, or the existing contract/service level agreement does not incorporate the Security Addendum. A copy of the contract must be available for audit purposes.
This Security Addendum Agreement incorporates the Security Addendum found in Appendix H of the CJIS Security Policy.
Signatory Page
The undersigned parties agree that the CJIS Security Addendum and the CJIS Security Policy are now a part of any criminal justice information services contract between the entities. The parties agree to abide by all applicable requirements of the CJIS Security Addendum and the CJIS Security Policy, and it shall remain in force for the term of the contract. Any violation of this agreement shall have the same force as identified in the contract. This agreement is signed and dated by the vendor/contractor and criminal justice agency representative(s) who have the authority to bind each entity.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
1.866.901.1781
[email protected]
Flock Group, Inc.
1170 Howell Mill Rd, Suite 210
Atlanta, GA 30318
Mark Smith
Criminal Justice Agency
___________________________________________________________________ Printed Name of Agency Representative
__________________________________________________________________ Signature of Agency Representative & Title
___________________________________________________________________ Agency Name and ORI Date
Vendor/Contractor
___________________________________________________________________ Printed Name of Vendor Representative
___________________________________________________________________
Signature of Vendor Representative Title
___________________________________________________________________ Signature of Vendor (Contractor) Representative Date
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 General Counsel
6/2/2025
Mark Smith
FEDERAL BUREAU OF INVESTIGATION
CRIMINAL JUSTICE INFORMATION SERVICES
SECURITY ADDENDUM
Legal Authority for and Purpose and Genesis of the
Security Addendum
Traditionally, law enforcement and other criminal justice agencies have been responsible for the confidentiality of their information. Accordingly, until mid-1999, the Code of Federal Regulations Title 28, Part 20, subpart C, and the National Crime Information Center (NCIC) policy paper approved December 6, 1982, required that the management and exchange of criminal justice information be performed by a criminal justice agency or, in certain circumstances, by a noncriminal justice agency under the management control of a criminal justice agency.
In light of the increasing desire of governmental agencies to contract with private entities to perform administration of criminal justice functions, the FBI sought and obtained approval from the United States Department of Justice (DOJ) to permit such privatization of traditional law enforcement functions under certain controlled circumstances. In the Federal Register of May 10, 1999, the FBI published a Notice of Proposed Rulemaking, announcing as follows:
1. Access to CHRI [Criminal History Record Information] and Related Information, Subject to Appropriate Controls, by a Private Contractor Pursuant to a Specific Agreement with an Authorized Governmental Agency To Perform an Administration of Criminal Justice Function (Privatization). Section 534 of title 28 of the United States Code authorizes the Attorney General to exchange identification, criminal identification, crime, and other records for the official use of authorized officials of the federal government, the states, cities, and penal and other institutions. This statute also provides, however, that such exchanges are subject to cancellation if dissemination is made outside the receiving departments or related agencies.
Agencies authorized access to CHRI traditionally have been hesitant to disclose that information, even in furtherance of authorized criminal justice functions, to anyone other than actual agency employees lest such disclosure be viewed as unauthorized. In recent years, however, governmental agencies seeking greater efficiency and economy have become increasingly interested in obtaining support services for the administration of criminal justice from the private sector. With the concurrence of the FBI Criminal Justice Information Service (CJIS) Advisory Policy Board, the DOJ has concluded that disclosures to private persons and entities providing support services for criminal justice agencies may, when subject to appropriate controls, properly be viewed as permissible disclosures for purposes of compliance with 28 U.S.C. 534.
We are therefore proposing to revise 28 CFR 20.33(a)(7) to provide express authority for such arrangements. The proposed authority is similar to the authority that already exists in 28 CFR 20.21(b)(3) for state and local CHRI systems.
Provision of CHRI under this authority would only be permitted pursuant to a specific agreement with an authorized governmental agency for the purpose of Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 providing services for the administration of criminal justice. The agreement would be required to incorporate a security addendum approved by the Director of the FBI (acting for the Attorney General). The security addendum would specifically authorize access to CHRI, limit the use of the information to the specific purposes for which it is being provided, ensure the security and confidentiality of the information consistent with applicable laws and regulations, provide for sanctions, and contain such other provisions as the Director of the FBI (acting for the Attorney General) may require. The security addendum, buttressed by ongoing audit programs of both the FBI and the sponsoring governmental agency, will provide an appropriate balance between the benefits of privatization, protection of individual privacy interests, and preservation of the security of the FBI’s CHRI systems.
The FBI will develop a security addendum to be made available to interested governmental agencies. We anticipate that the security addendum will include physical and personnel security constraints historically required by NCIC security practices and other programmatic requirements, together with personal integrity and electronic security provisions comparable to those in NCIC User Agreements between the FBI and criminal justice agencies, and in existing Management Control Agreements between criminal justice agencies and noncriminal justice governmental entities. The security addendum will make clear that access to CHRI will be limited to those officers and employees of the private contractor or its subcontractor who require the information to properly perform services for the sponsoring governmental agency, and that the service provider may not access, modify, use, or disseminate such information for inconsistent or unauthorized purposes.
Consistent with such intent, Title 28 of the Code of Federal Regulations (C.F.R.) was amended to read:
§ 20.33 Dissemination of criminal history record information. a) Criminal history record information contained in the Interstate Identification Index (III) System and the Fingerprint Identification Records System (FIRS) may be made available:
To criminal justice agencies for criminal justice purposes, which purposes include the screening of employees or applicants for employment hired by criminal justice agencies.
To non-criminal justice governmental agencies performing criminal justice dispatching functions or data processing/information services for criminal justice agencies; and
To private contractors pursuant to a specific agreement with an agency identified in paragraphs (a)(1) or (a)(6) of this section and for the purpose of providing services for the administration of criminal justice pursuant to that agreement. The agreement must incorporate a security addendum approved by the Attorney General of the United States, which shall specifically authorize access to criminal history record information, limit the use of the information to the purposes for which it is provided, ensure the security and confidentiality of the information consistent with these regulations, provide for sanctions, and contain such other provisions as the Attorney General Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 may require. The power and authority of the Attorney General hereunder shall be exercised by the FBI Director (or the Director’s designee).
This Security Addendum, appended to and incorporated by reference in a government-private sector contract entered into for such purpose, is intended to insure that the benefits of privatization are not attained with any accompanying degradation in the security of the national system of criminal records accessed by the contracting private party. This Security Addendum addresses both concerns for personal integrity and electronic security which have been addressed in previously executed user agreements and management control agreements.
A government agency may privatize functions traditionally performed by criminal justice agencies (or noncriminal justice agencies acting under a management control agreement), subject to the terms of this Security Addendum. If privatized, access by a private contractor's personnel to NCIC data and other CJIS information is restricted to only that necessary to perform the privatized tasks consistent with the government agency's function and the focus of the contract. If privatized the contractor may not access, modify, use or disseminate such data in any manner not expressly authorized by the government agency in consultation with the FBI.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
FEDERAL BUREAU OF INVESTIGATION
CRIMINAL JUSTICE INFORMATION SERVICES
SECURITY ADDENDUM
The goal of this document is to augment the CJIS Security Policy to ensure adequate security is provided for criminal justice systems while (1) under the control or management of a private entity or (2) connectivity to FBI CJIS Systems has been provided to a private entity (contractor). Adequate security is defined in Office of Management and Budget Circular A-130 a “security commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information.”
The intent of this Security Addendum is to require that the Contractor maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed), as well as with policies and standards established by the Criminal Justice Information Services (CJIS) Advisory Policy Board (APB).
This Security Addendum identifies the duties and responsibilities with respect to the installation and maintenance of adequate internal controls within the contractual relationship so that the security and integrity of the FBI's information resources are not compromised. The security program shall include consideration of personnel security, site security, system security, and data security, and technical security.
The provisions of this Security Addendum apply to all personnel, systems, networks and support facilities supporting and/or acting on behalf of the government agency.
1.00 Definitions
1.01 Contracting Government Agency (CGA) - the government agency, whether a Criminal Justice Agency or a Noncriminal Justice Agency, which enters into an agreement with a private contractor subject to this Security Addendum.
1.02 Contractor - a private business, organization or individual which has entered into an agreement for the administration of criminal justice with a Criminal Justice Agency or a Noncriminal Justice Agency.
2.00 Responsibilities of the Contracting Government Agency.
2.01 The CGA will ensure that each Contractor employee receives a copy of the Security Addendum and the CJIS Security Policy and executes an acknowledgment of such receipt and the contents of the Security Addendum. The signed acknowledgments shall remain in the possession of the CGA and available for audit purposes. The acknowledgement may be signed by hand or via digital signature (see glossary for definition of digital signature).
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
3.00 Responsibilities of the Contractor.
3.01 The Contractor will maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed and all subsequent versions), as well as with policies and standards established by the Criminal Justice Information Services (CJIS) Advisory Policy Board (APB).
4.00 Security Violations
4.01 The CGA must report security violations to the CJIS Systems Officer (CSO) and the Director, FBI, along with indications of actions taken by the CGA and Contractor.
4.02 Security violations can justify termination of the appended agreement.
4.03 Upon notification, the FBI reserves the right to:
a. Investigate or decline to investigate any report of unauthorized use; b. Suspend or terminate access and services, including
telecommunications links. The FBI will provide the CSO with timely written notice of the suspension. Access and services will be reinstated only after satisfactory assurances have been provided to the FBI by the CGA and Contractor. Upon termination, the Contractor's records containing CHRI must be deleted or returned to the CGA.
5.00 Audit
5.01 The FBI is authorized to perform a final audit of the Contractor's systems after termination of the Security Addendum.
6.00 Scope and Authority
6.01 This Security Addendum does not confer, grant, or authorize any rights, privileges, or obligations on any persons other than the Contractor, CGA, CJA (where applicable), CSA, and FBI.
6.02 The following documents are incorporated by reference and made part of this agreement: (1) the Security Addendum; (2) the NCIC 2000 Operating Manual; (3) the CJIS Security Policy; and (4) Title 28, Code of Federal Regulations, Part 20.
The parties are also subject to applicable federal and state laws and regulations.
6.03 The terms set forth in this document do not constitute the sole understanding by and between the parties hereto; rather they augment the provisions of the CJIS Security Policy to provide a minimum basis for the security of the system and contained information and it is understood that there may be terms and conditions of the appended Agreement which impose more stringent requirements upon the Contractor.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
6.04 This Security Addendum may only be modified by the FBI, and may not be modified by the parties to the appended Agreement without the consent of the FBI.
6.05 All notices and correspondence shall be forwarded by First Class mail to:
Information Security Officer
Criminal Justice Information Services Division, FBI
1000 Custer Hollow Road
Clarksburg, West Virginia 26306
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
FEDERAL BUREAU OF INVESTIGATION
CRIMINAL JUSTICE INFORMATION SERVICES
SECURITY ADDENDUM
CERTIFICATION
I hereby certify that I am familiar with the contents of (1) the Security Addendum, including its legal authority and purpose; (2) the NCIC Operating Manual; (3) the CJIS Security Policy; and (4) Title 28, Code of Federal Regulations, Part 20, and agree to be bound by their provisions.
I recognize that criminal history record information and related data, by its very nature, is sensitive and has potential for great harm if misused. I acknowledge that access to criminal history record information and related data is therefore limited to the purpose(s) for which a government agency has entered into the contract incorporating this Security Addendum. I understand that misuse of the system by, among other things: accessing it without authorization; accessing it by exceeding authorization; accessing it for an improper purpose; using, disseminating or re- disseminating information received as a result of this contract for a purpose other than that envisioned by the contract, may subject me to administrative and criminal penalties. I understand that accessing the system for an appropriate purpose and then using, disseminating or re-disseminating the information received for another purpose other than execution of the contract also constitutes misuse. I further understand that the occurrence of misuse does not depend upon whether or not I receive additional compensation for such authorized activity. Such exposure for misuse includes, but is not limited to, suspension or loss of employment and prosecution for state and federal crimes.
_______________________________________ _______________ Printed Name/Signature of Contractor Employee Date
_______________________________________ _______________ Printed Name/Signature of Contractor Representative Date
_______________________________________
Organization and Title of Contractor Representative
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8 Mark Smith
Flock Group, Inc.
6/2/2025
General Counsel
6/2/2025Mark Smith
EXHIBIT “F”
SOC 2 REPORTING REQUIREMENTS
This Exhibit F (the "Exhibit") forms an integral part of the Agreement between Flock Group (the "Vendor") and the City of Fairfield (the "City"), effective as of the signing of the Agreement.
1. Purpose
The purpose of this Exhibit is to establish the Vendor’s obligation to provide the City with a Service Organization Control 2 (SOC 2) Type II Report (the "Report") to demonstrate the Vendor’s compliance with industry standards for security, availability, processing integrity, confidentiality, and/or privacy.
2. SOC 2 Reporting Requirements
2.1 Frequency of Report Delivery
The Vendor shall provide the City with a SOC 2 Type II Report every two (2) years, measured from the effective date of this Agreement or the date of the last delivered Report, whichever is later.
2.2 Scope of the SOC 2 Report
The SOC 2 Report shall:
Be prepared by an independent, licensed Certified Public Accountant (CPA) or firm qualified to perform SOC 2 audits.
Cover the technology services provided under this Agreement, as agreed upon by both parties.
Include details regarding any identified deficiencies or areas for improvement, along with the corrective actions implemented.
2.3 Timely Submission
The Vendor shall ensure that each SOC 2 Report is delivered to the City no later than sixty (60) calendar days after the end of the reporting period.
3. Cost and Responsibilities
3.1 Vendor Responsibility
The Vendor shall bear all costs associated with the preparation and submission of the SOC 2 Report.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8
3.2 Cooperation
The Vendor shall provide the necessary access, documentation, and support to the auditors to ensure the timely and accurate preparation of the SOC 2 Report.
4. Review and Remediation
4.1 Review of the SOC 2 Report
Upon receipt of the SOC 2 Report, the City shall review the findings. If the Report identifies any material deficiencies, the Vendor shall provide a detailed remediation plan within thirty (30) calendar days of the City’s request.
4.2 Failure to Comply
Failure to deliver a SOC 2 Report, remediate deficiencies, or otherwise comply with the terms of this Exhibit may be considered a material breach of the Agreement, subject to the remedies set forth in the Agreement.
5. Confidentiality
The SOC 2 Report shall be treated as confidential information under the terms of the Agreement and used solely for the purpose of verifying the Vendor’s compliance.
Docusign Envelope ID: 8BF58B94-C4B0-4047-BB39-7AA5E7F60D62 Docusign Envelope ID: B83B8960-A947-490B-8103-6D3A74155FC8