Agenda packet — Rancho Cucamonga City Council, August 19, 2026 (part 10 of 20)

6.1. Ownership of FireEye Materials; Restrictions. All Intellectual Property Rights in FireEye Materials, Products, Deliverables, Documentation, and Subscriptions belong exclusively to FireEye and its licensors.

Customer will not (and will not allow any third party to): (i) disassemble, decompile, reverse compile, reverse engineer or attempt to discover any source code or underlying ideas or algorithms of any FireEye Materials (except to the limited extent that applicable law prohibits reverse engineering restrictions); (ii) sell, resell, distribute, sublicense or otherwise transfer, the FireEye Materials, or make the functionality of the FireEye Materials available to any other party through any means (unless otherwise FireEye has provided prior written consent), (iii) without the express prior written consent of FireEye, conduct any benchmarking or comparative study or analysis involving the FireEye Materials (“Benchmarking”) for any reason or purpose except, to the limited extent absolutely necessary, to determine the suitability of Products or Subscriptions to interoperate with Customer’s internal computer systems; (iv) disclose or publish to any third party any Benchmarking or any other information related thereto; (v) use the FireEye Materials or any Benchmarking in connection with the development of products, services or subscriptions that compete with the FireEye Materials; or (vi) reproduce, alter, modify or create derivatives of the FireEye Materials. Between Customer and FireEye, FireEye shall retain all rights and title in and to any Indicators of Compromise FireEye developed by or for FireEye in the course of providing Subscriptions or performing Services.

6.2. Third Party Materials. Customer acknowledges that Products and Subscriptions may include Third Party Materials. FireEye represents that these Third Party Materials will not diminish the license rights provided herein or limit Customer’s ability to use the Products and Subscriptions in accordance with the applicable Documentation, and neither the inclusion of Third Party Materials in any Product or Subscription or use of Third Party Materials in performance of Services will create any obligation on the part of Customer to license Customer’s software or products under any open source or similar license.

7. WARRANTIES.

7.1. Product Warranty. FireEye warrants to Customer that during the one (1) year period following the shipment of the Products, the Products will perform substantially in accordance with the applicable Documentation. The warranty stated in this Section 7.1 shall not apply if the Product has: (i) been subjected to abuse, misuse, neglect, negligence, accident, improper testing, improper installation, improper storage, improper handling or use contrary to any instructions issued by FireEye; (ii) been repaired or altered by persons other than FireEye; (iii) not been installed, operated, repaired and maintained in accordance with the Documentation; or (iv) been used with any third party software or hardware which has not been previously approved in writing by FireEye. If during the one-year Product warranty period: (a) FireEye is notified promptly in writing upon discovery of any error in a Product, including a detailed description of such alleged error; (b) such Product is returned, transportation charges prepaid, to FireEye’s designated manufacturing facility in accordance with FireEye’s then-current return procedures, as set forth by FireEye from time to time; and (c) FireEye’s inspections and tests determine that the Product contains errors and has not been subjected to any of the conditions set forth in 7.1(i)-(iv) above, then, as Customer’s sole remedy and FireEye’s sole obligation under the foregoing warranty, FireEye shall, at FireEye’s option, repair or replace without charge such Product. Any Product that has either been repaired or replaced under this warranty shall have warranty coverage for the remaining warranty period. Replacement parts used in the repair of a Product may be new or equivalent to new.

7.2. Services Warranty. FireEye warrants to Customer that Services will be performed in a professional manner in accordance with industry standards for like services. If Customer believes the warranty stated in this Section has been breached, Customer must notify FireEye of the breach no later than thirty (30) days following the date the Services were performed, and FireEye will promptly correct or re-perform the Services, at FireEye’s expense.

7.3. Subscription Warranty. FireEye warrants to Customer the Subscriptions will be provided in a professional manner in accordance with industry standards for similar subscriptions. If Customer believes the warranty stated in this Section has been breached, Customer must notify FireEye of the breach no later than thirty (30) days following the date the warranty was allegedly breached, and FireEye will promptly correct the nonconformity, at FireEye’s expense.

Page 779988 ends

Confidential FireEye Rev. 8/2016

Page 6 ends

7.4. Remedies Exclusive. Except for any Service Level Credits described in Exhibit B, the remedies stated in Sections 7.1-7.3 above are the sole remedies, and FireEye’s sole obligation, with respect to Products, Subscriptions and Services that fail to comply with the foregoing warranties.

7.5. Disclaimer of Warranties. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH HEREIN, ALL PRODUCTS, SUBSCRIPTIONS, FIREEYE MATERIALS, DELIVERABLES AND SERVICES ARE PROVIDED ON AN “AS IS” BASIS WITHOUT ANY WARRANTY WHATSOEVER. FIREEYE AND ITS SUPPLIERS EXPRESSLY DISCLAIM, TO THE MAXIMUM EXTENT

PERMISSIBLE UNDER APPLICABLE LAW, ALL WARRANTIES, EXPRESS, IMPLIED AND STATUTORY, INCLUDING WITHOUT

LIMITATION ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, NONINFRINGEMENT, OR ARISING FROM COURSE OF PERFORMANCE, DEALING, USAGE OR TRADE. FIREEYE ALSO

MAKES NO WARRANTY REGARDING NONINTERRUPTION OF USE OR FREEDOM FROM BUGS, AND MAKES NO WARRANTY THAT PRODUCTS, FIREEYE MATERIALS, DELIVERABLES, SERVICES OR SUBSCRIPTIONS WILL BE ERROR-FREE.

8. INFRINGEMENT INDEMNITY.

8.1. FireEye shall defend Customer, and its officers, directors and employees, against any third party action alleging that the FireEye Materials infringes a valid U.S. patent or copyright issued as of the date of delivery or performance, as applicable, and FireEye shall pay all settlements entered into, and all final judgments and costs (including reasonable attorneys’ fees) finally awarded against such party in connection with such action.

If the FireEye Materials, or parts thereof, become, or in FireEye’s opinion may become, the subject of an infringement claim, FireEye may, at its option: (i) procure for Customer the right to continue using the applicable FireEye Materials; (ii) modify or replace such FireEye Materials with a substantially equivalent non-infringing FireEye Materials; or (iii) require the return of such FireEye Materials or cease providing affected Product, Subscriptions, Deliverables or Services, and refund to Customer, with respect to Products, a pro-rata portion of the purchase price of such Products based on a three-year straight line amortization of the purchase price, and with respect to Subscriptions, a portion of any pre-paid Fees for such Subscriptions, pro rated for any unused Subscription Term, and with respect to Services, any pre-paid Fees for Services that have not been delivered. THIS SECTION 8.1 STATES THE ENTIRE LIABILITY OF FIREEYE AND CUSTOMER’S SOLE REMEDY WITH RESPECT TO ANY INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS BY THE OFFERINGS, FIREEYE MATERIALS, OR DELIVERABLES.

8.2. FireEye shall have no indemnification obligations with respect to any action arising out of: (i) the use of any Product, Subscription, Deliverable, or Service, or any part thereof, in combination with software or other products not supplied by FireEye; (ii) any modification of the Products, Subscriptions, Deliverables, or Services not performed or expressly authorized by FireEye; or (iii) the use of any the Products, Subscriptions, Deliverables, or Services other than in accordance with this Agreement and applicable Documentation.

8.3. The indemnification obligations shall be subject to Customer: (i) notifying FireEye within ten (10) days of receiving notice of any threat or claim in writing of such action; (ii) giving FireEye exclusive control and authority over the defense or settlement of such action; (iii) not entering into any settlement or compromise of any such action without FireEye’s prior written consent; and (iv) providing reasonable assistance requested by FireEye.

9. LIMITATION OF LIABILITY.

9.1. Consequential Damages Waiver. EXCEPT FOR LIABILITY ARISING UNDER A BREACH OF ANY INTELLECTUAL PROPERTY RIGHT OF FIREEYE, OR THE INDEMNIFICATION OBLIGATIONS SET FORTH IN SECTION 8 (INFRINGEMENT INDEMNITY), IN NO EVENT WILL FIREEYE BE LIABLE FOR ANY SPECIAL, INCIDENTAL, CONSEQUENTIAL

OR EXEMPLARY DAMAGES OF ANY KIND, INCLUDING BUT NOT LIMITED TO ANY LOST PROFITS AND LOST SAVINGS,

HOWEVER CAUSED, WHETHER FOR BREACH OR REPUDIATION OF CONTRACT, TORT, BREACH OF WARRANTY,

NEGLIGENCE, OR OTHERWISE, WHETHER OR NOT FIREEYE WAS ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGES.

9.2. Limitation of Monetary Damages. EXCEPT FOR LIABILITY ARISING UNDER A BREACH OF ANY

INTELLECTUAL PROPERTY RIGHT OF FIREEYE, PAYMENT OBLIGATIONS OF CUSTOMER, AND THE INDEMNIFICATION OBLIGATIONS SET FORTH IN SECTION 8 (INFRINGEMENT INDEMNITY), AND NOTWITHSTANDING ANY OTHER PROVISIONS OF THIS AGREEMENT OR ANY ORDER OR STATEMENT OF WORK, FIREEYE’S TOTAL LIABILITY ARISING OUT

OF THIS AGREEMENT, THE OFFERINGS, THE FIREEYE IP AND DELIVERABLES SHALL BE LIMITED TO THE TOTAL AMOUNTS

Page 779999 ends

Confidential FireEye Rev. 8/2016

Page 7 ends

RECEIVED BY FIREEYE FOR THE RELEVANT OFFERINGS DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE FIRST OCCURRENCE OF THE EVENTS GIVING RISE TO SUCH LIABILITY.

9.3. Applicability. THE LIMITATIONS AND EXCLUSIONS CONTAINED HEREIN WILL APPLY ONLY TO THE MAXIMUM EXTENT PERMISSIBLE UNDER APPLICABLE LAW, AND NOTHING HEREIN PURPORTS TO LIMIT EITHER PARTY’S

LIABILITY IN A MANNER THAT WOULD BE UNENFORCEABLE OR VOID AS AGAINST PUBLIC POLICY IN THE APPLICABLE JURISDICTION.

9.4 SAFETY Act. FireEye and Customer hereby mutually waive and release each other from any and all liabilities relating to any claims for losses or damages of any kind (including, but not limited to, business interruption losses) arising out of an Act of Terrorism as defined by the Support Anti-Terrorism By Fostering Effective Technologies Act of 2002 (“SAFETY Act”)(6 U.S.C. §§ 441-444). FireEye and Customer further agree to be solely responsible to the full extent of any and all losses they may sustain, or for any and all losses their respective employees, officers, or agents may sustain, resulting from an Act of Terrorism as defined by 6 U.S.C. §§ 441-444 when FireEye’s Multi-Vector Virtual Execution Engine and any subscriptions, cloud services platform or associated services (the “Qualified Anti-Terrorism Technology”) are utilized in defense against, response to, or recovery from an Act of Terrorism.

10. Export Control; Anti-Corruption; U.S. Government Restricted Rights.

10.1. Export Control. Export Control. Each party represents and warrants that it shall comply with all laws and regulations applicable to it with respect to the Offerings. Customer further acknowledges and agrees that the Products and FireEye Materials may be subject to restrictions and controls imposed by the United States Export Administration Act, the regulations thereunder, as well as European Union (“EU”) or National export control laws and obligations and similar laws in other jurisdictions. Customer agrees to comply with all applicable export and re-export control laws and regulations, including the Export Administration Regulations (“EAR”) maintained by the U.S. Department of Commerce, trade and economic sanctions maintained by the Treasury Department’s Office of Foreign Assets Control, and the International Traffic in Arms Regulations (“ITAR”) maintained by the Department of State. Specifically, Customer covenants that it shall not, directly or indirectly, sell, export, reexport, transfer, divert, or otherwise dispose of any Products, FireEye Materials, or technology (including products derived from or based on such technology) received from FireEye under this Agreement to any destination, entity, or person prohibited by the laws or regulations of the United States and the EU, without obtaining prior authorization from the competent government authorities as required by those laws and regulations. These prohibitions include, but are not limited to the following: (i) the Products and FireEye Materials cannot be exported or re-exported to any countries embargoed by the United States (currently including Cuba, Iran, North Korea, Sudan or Syria) which includes nationals of these countries employed by Customer; (ii) the Products and FireEye Materials cannot be exported or re-exported for military use in country group ‘b’ prior to valid ‘export license’ or valid ‘license exception’; and (iii) the Products and FireEye Materials cannot be used for any prohibited end uses including any “nuclear, biological or chemical weapon related activities.”; and (iv) the Products and FireEye Materials will not be re-exported or otherwise sold or transferred if it is known or suspected that they are intended or likely to be used for such purposes. Customer agrees to notify FireEye of any suspicious activities by any employee related to the Products. Customer agrees to indemnify, to the fullest extent permitted by law, FireEye from and against any fines or penalties that may arise as a result of Customer’s breach of this provision. This export control clause shall survive termination or cancellation of any Orders.

10.2. Anticorruption Laws. Each Party acknowledges that it is familiar with and understands the provisions of the U.S. Foreign Corrupt Practices Act ("the FCPA") and the U.K. Bribery Act of 2010 (“UKBA”) and agrees to comply with its terms as well as any provisions of local law related thereto. Each party further understands the provisions relating to the FCPA and UKBA’s prohibitions regarding the payment or giving of anything of value, including but not limited to payments, gifts, travel, entertainment and meals, either directly or indirectly, to an official of a foreign government or political party for the purpose of influencing an act or decision in his or her official capacity or inducing the official to use his or her party's influence with that government, to obtain or retain business involving the Offering. Each Party agrees to not violate or knowingly let anyone violate the FCPA or UKBA, and Each Party agrees that no payment it makes will constitute a bribe, influence payment, kickback, rebate, or other payment that violates the FCPA, the UKBA, or any other applicable anticorruption or anti-bribery law.

Page 880000 ends

Confidential FireEye Rev. 8/2016

Page 8 ends

10.3. U.S. Government Restricted Rights. The Offerings, Deliverables and Documentation are “commercial items”, “commercial computer software” and “commercial computer software documentation,” pursuant to DFAR Section 227.7202 and FAR Section 12.212, as applicable. All Offerings and FireEye Materials are and were developed solely at private expense. Any use, modification, reproduction, release, performance, display or disclosure of the Offerings, FireEye Materials and Documentation by the United States Government shall be governed solely by the this Agreement and shall be prohibited except to the extent expressly permitted by this Agreement.

11. CONFIDENTIAL INFORMATION.

11.1. Confidential Information. “Confidential Information” means the non-public information that is exchanged between the parties, provided that such information is: (i) identified as confidential at the time of disclosure by the disclosing party (“Discloser”); or (ii) disclosed under circumstances that would indicate to a reasonable person that the information should be treated as confidential by the party receiving such information (“Recipient”). The terms of any commercial transaction between the parties (including pricing related to the Offerings) shall be considered Confidential Information.

11.2. Maintenance of Confidentiality. Each party agrees that it shall: (i) take reasonable measures to protect the Confidential Information by using the same degree of care, but no less than a reasonable degree of care, to prevent the unauthorized use, dissemination or publication of the Confidential Information as the Recipient uses to protect its own confidential information of a like nature; (ii) limit disclosure to those persons within Recipient’s organization with a need to know and who have previously agreed in writing, prior to receipt of Confidential Information either as a condition of their employment or in order to obtain the Confidential Information, to obligations similar to the provisions hereof; (iii) not copy, reverse engineer, disassemble, create any works from, or decompile any prototypes, software or other tangible objects which embody the other party's Confidential Information and/or which are provided to the party hereunder; and (iv) comply with, and obtain all required authorizations arising from, all U.S. and other applicable export control laws or regulations.. Confidential Information shall not be used or reproduced in any form except as required to accomplish the purposes and intent of an Order or Statement of Work. Any reproduction of Confidential Information shall be the property of Discloser and shall contain any and all notices of confidentiality contained on the original Confidential Information.

11.3. Exceptions. The parties agree that the foregoing shall not apply to any information that Recipient can evidence: (i) is or becomes publicly known and made generally available through no improper action or inaction of Recipient; (ii) was already in its possession or known by it prior to disclosure by Discloser to Recipient; (iii) is independently developed by Recipient without use of or reference to any Confidential Information; or (iv) was rightfully disclosed to it by, or obtained from, a third party. Recipient may make disclosures required by law or court order provided that Recipient: (a) uses diligent efforts to limit disclosure and to obtain, if possible, confidential treatment or a protective order; (b) has given prompt advance notice to Discloser of such required disclosure; and (c) has allowed Discloser to participate in the proceedings.

11.4. Injunctive Relief. Each party will retain all right, title and interest to such party’s Confidential Information. The parties acknowledge that a violation of the Recipient’s obligations with respect to Confidential Information may cause irreparable harm to the Discloser for which a remedy at law would be inadequate.

Therefore, in addition to any and all remedies available at law, Discloser shall be entitled to seek an injunction or other equitable remedies in all legal proceedings in the event of any threatened or actual violation of any or all of the provisions hereof.

11.5. Return of Confidential Information. Within thirty (30) days after the date when all Orders and SOWs have expired or been terminated, or after any request for return of Confidential Information, each party will return to the other party or destroy all of such other party’s Confidential Information, at such other party’s discretion, and, upon request, provide such other party with an officer’s certificate attesting to such return and/or destruction, as appropriate.

11.6. Privacy. If FireEye is a data processor under this Agreement, further to the provisions of Article 17 and 25 of the EU Data Protection Directive EU (Directive 95/46/EC), FireEye agrees that it will:

Page 880011 ends

Confidential FireEye Rev. 8/2016

Page 9 ends

11.6.1 only deal with and process personal data controlled by Customer in compliance with, and subject to, the instructions received from Customer and in compliance with this Agreement and will not use or process the personal data for any other purpose whatever;

11.6.2 adopt and maintain appropriate (including organizational and technical) security measures in dealing with Customer’s personal data in order to protect against unauthorized or accidental access, loss, alteration, disclosure or destruction of such data, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing; and

11.6.3 take all reasonable steps to ensure that (i) persons employed by it, and (ii) other persons engaged at its place of work, are aware of and comply with applicable data privacy laws and regulations.

11.6.4 FireEye may process or otherwise transfer any personal information in or to any country outside the European Economic Area or any country not deemed adequate by the European Commission pursuant to Article 25(6) to the extent necessary for the provision of the Offerings. If required, FireEye will enter into the EU Standard Contractual Clauses as approved by the European Commission for ensuring an adequate level of data protection in respect of the personal information that will be processed or transferred.

12. TERM AND TERMINATION.

12.1. Term.

12.1.1 Products. Products will be licensed according to the applicable terms in Exhibit A, for the period of time stated on the Order (e.g., if the Order lists a Product as being provided for “3Y,” the license for that Product is provided for three years from the date of the Order). If no period of time is stated on the Order, then the Product is licensed perpetually, unless otherwise terminated as set forth herein.

12.1.2 Support Services. Support Services will begin ten (10) days from the date of shipment of the associated Product and continue for the period of time stated on the Order(“Initial Support Term”). Unless otherwise stated on the Order, the Support Services will automatically renew for additional periods of one (1) year each (each, a “Renewal Support Term” and together with the Initial Support Term, the “Support Term”), unless either party notifies the other of its intention not to renew Support Services at least sixty (60) days prior to the expiration of the then-current Support Term. Customer may terminate Support at any time, for convenience, on thirty (30) days’ written notice to FireEye. If Customer terminates Support Services for convenience before the end of the then-current Support Term, Customer will pay any remaining fees owing for the remainder of the thencurrent Support Term within thirty (30) days of the effective date of termination.

12.1.3 Subscriptions. The term of each Subscription will begin on the Order Effective Date and will continue in effect for the period of time stated in the Order (“Initial Subscription Term”). Unless otherwise stated on the Order, the Subscription will automatically renew after its Initial Subscription Term for additional periods of one (1) year each (each, a “Renewal Subscription Term” and together with the Initial Subscription Term, the “Subscription Term”), unless either party notifies the other of its intention not to renew that Subscription at least sixty (60) days prior to the expiration of the then-current Subscription Term. Customer may terminate a Subscription at any time, for convenience, on thirty (30) days’ written notice to FireEye. If Customer terminates a Subscription for convenience before the end of the then-current Subscription Term, Customer will pay any remaining fees owing for the remainder of the then-current Subscription Term within thirty (30) days of the effective date of termination.

12.1.4 Professional Services; Statements of Work. Professional Services described on an Order will be provided at mutually agreed-upon times, and will continue until complete, unless otherwise terminated as set forth herein. The term of each SOW will be as set forth in that SOW. If no term is expressed in an SOW, then the term of that SOW will begin on the SOW Effective Date and continue until the Professional Services described in that SOW are complete or the SOW is earlier terminated as set forth herein. Unless otherwise stated in a SOW, Customer may terminate a SOW at any time for convenience by giving FireEye at least thirty (30) days’ written notice of its intent to terminate the SOW. If Customer terminates an SOW for convenience as set forth in this Section, Customer will pay any amounts owing for Professional Services and Deliverables provided under that SOW up to and including the date of termination. Customer may request that FireEye suspend performing Professional Services during the term of a Statement of Work, and FireEye will suspend such Professional Services within 24 hours of Customer’s request. Customer acknowledges that any such suspension will not affect Customer’s obligation to pay fees for Professional Services rendered through the date of suspension, and that

Page 880022 ends

Confidential FireEye Rev. 8/2016

Page 10 ends

resumption of Professional Services may be delayed if FireEye redeploys personnel to other engagements during the period of suspension.

12.2. Termination for Material Breach. Either party may terminate any Order or any SOW upon written notice of a material breach of the applicable Order or SOW by the other party as provided below, subject to a thirty (30) day cure period (“Cure Period”). If the breaching party has failed to cure the breach within the Cure Period after the receipt by the breaching party of written notice of such breach, the non-breaching party may give a second notice to the breaching party terminating the applicable Order or SOW. Termination of any particular Order or SOW under this Section will not be deemed a termination of any other Order or SOW, unless the notice of termination states that another Order or SOW is also terminated. Notwithstanding the foregoing, the Cure Period applicable to a breach by Customer of any payment obligations under any Order or any SOW will be fifteen (15) days. Notwithstanding the foregoing, this Agreement shall terminate automatically in the event Customer has breached any license restriction and, in FireEye’s determination, that breach cannot be adequately cured within the Cure Period.

12.3. Effect of Termination. Termination or expiration of any Order or SOW will not be deemed a termination or expiration of any other Orders or SOWs in effect as of the date of termination or expiration, and this Agreement will continue to govern and be effective as to those outstanding Orders and SOWs until those Orders and SOWs have expired or terminated by their own terms or as set forth herein. The provisions of Section 3 (Payment), Section 6 (Intellectual Property), Section 7.5 (Disclaimer of Warranties), 9 (Limitation of Liability), 10 (Export Control; Anti-Corruption; U.S. Government Restricted Rights), 12 (Confidential Information), and 13 (Miscellaneous), and all accrued payment obligations, shall survive the termination of all Orders and SOWs and the relationship between FireEye and Customer.

13. MISCELLANEOUS.

13.1. Assignment. Customer may not assign any Order or Statement of Work, or any rights or obligations thereunder, in whole or in part, without FireEye’s prior written consent, and any such assignment or transfer shall be null and void. FireEye shall have the right to assign all or part of an Order or Statement of Work without Customer’s approval. Subject to the foregoing, each Order and Statement of Work shall be binding on and inure to the benefit of the parties’ respective successors and permitted assigns.

13.2. Entire Agreement. This Agreement along with any Order, Statement of Work and the Exhibits attached hereto is the entire agreement of the parties with respect to the Offerings and supersedes all previous or contemporaneous communications, representations, proposals, commitments, understandings and agreements, whether written or oral, between the parties regarding the subject matter thereof. FireEye does not accept, expressly or impliedly and FireEye hereby rejects and deems deleted any additional or different terms or conditions that Customer presents, including, but not limited to, any terms or conditions contained or referenced in any order, acceptance, acknowledgement, or other document, or established by trade usage or prior course of dealing. This Agreement may be amended only in writing signed by authorized representatives of both parties.

13.3. Force Majeure. Neither party will be liable to the other for any delay or failure to perform any obligation under this Agreement (except for a failure to pay fees) if the delay or failure is due to unforeseen events, which occur after the signing of this Agreement and which are beyond the reasonable control of the parties, such as strikes, blockade, war, terrorism, riots, natural disasters, refusal of license by the government or other governmental agencies, in so far as such an event prevents or delays the affected party from fulfilling its obligations and such party is not able to prevent or remove the force majeure at reasonable cost.

13.4. Governing Law. This Agreement shall be deemed to have been made in, and shall be construed pursuant to the laws of the State of California and the United States without regard to conflicts of laws provisions thereof, and without regard to the United Nations Convention on the International Sale of Goods or the Uniform Computer Information Transactions Act. Any legal suit, action or proceeding arising out of or relating to the Offerings, the FireEye Materials, this Agreement, an Order or a Statement of Work will be commenced exclusively in a federal court in the Northern District of California or in state court in Santa Clara County, California, and each party hereto irrevocably submits to the jurisdiction and venue of any such court in any such suit, action or proceeding.

Page 880033 ends

Confidential FireEye Rev. 8/2016

Page 11 ends

13.5. Independent Contractors. The parties are independent contractors. Nothing in this Agreement, any Order or any Statement of Work shall be construed to create a partnership, joint venture or agency relationship between the parties. Customer shall make no representations or warranties on behalf of FireEye.

13.6. Language. This Agreement and each Order and Statement of Work are in the English language only, which shall be controlling in all respects. All communications, notices, and Documentation to be furnished hereunder shall be in the English language only.

13.7. Notices. All notices required to be sent hereunder shall be in writing, addressed to receiving party’s current business contact, if known, with a cc: to the General Counsel/Legal Department of the receiving party, and sent to the party’s address as listed in this Agreement, or as updated by either party by written notice. Notices shall be effective upon receipt and shall be deemed to be received as follows: (i) if personally delivered by courier, when delivered; or (ii) if mailed by first class mail, or the local equivalent, on the fifth business day after posting with the proper address.

13.8. Severability. If any provision of this Agreement is held to be illegal, invalid or unenforceable under the laws of any jurisdiction, the provision will be enforced to the maximum extent permissible so as to effect the intent of the parties, and the remaining provisions of this Agreement will remain in full force and effect.

13.9. Third Party Rights. Other than as expressly set out in this Agreement, this Agreement does not create any rights for any person who is not a party to it and no person who is not a party to this Agreement may enforce any of its terms or rely on any exclusion or limitation contained in it.

13.10. Waiver. The waiver of a breach of any provision of this Agreement shall not constitute a waiver of any other provision or any subsequent breach.

13.11. Equal Opportunity. FireEye is committed to the provisions outlined in the Equal Opportunity Clauses of Executive Order 11246, the Rehabilitation Act of 1973, the Vietnam Era Veterans Readjustment Act of 1974, the Jobs for Veterans Act of 2003, as well as any other regulations pertaining to these orders.

Wherefore, the parties have caused this Master Purchase Agreement to be executed as of the Effective Date.

FIREEYE, INC.

Signature: _____________________________
Name: ________________________________
Title: __________________________________
Date: _________________________________

CUSTOMER
Signature: _____________________________
Name: ________________________________
Title: __________________________________
Date: _________________________________

FIREEYE IRELAND LIMITED
Signature: _____________________________
Name: ________________________________
Title: __________________________________
Date: _________________________________

Page 880044 ends

Confidential FireEye Rev. 8/2016

Page 12 ends

EXHIBIT A

PRODUCT LICENSE AND SUPPORT TERMS
(FIREEYE NX, EX, AX, PX, FX, HX, SECURITY ORCHESTRATOR™, MVX SMART GRID, AND CENTRAL MANAGEMENT

SERIES (CMS) PRODUCTS)
The following terms apply to the FireEye NX, EX, AX, PX, FX, HX, Security Orchestrator, MVX Smart Grid, and Central Management Series (CMS) Products, including any add-on features such as FireEye Advanced Threat Intelligence (ATI).

1. Grant of License and Restrictions. Subject to the terms hereof, payment of all fees, and any applicable user/use limitations, FireEye grants Customer a personal, perpetual, nonsublicensable, nonexclusive, right to use the Product, in accordance with the Agreement and this Exhibit A. Customer will maintain the copyright notice and any other notices that appear on the Product, including any interfaces related to the Product. With respect to the FireEye HX Series Product, Customer may install the “agent” software component of the Product on the number of Nodes stated on the applicable Order. With respect to the FireEye EX Series Product, Customer may use the Product in connection with the number of attached URL engines (i.e., email accounts) (“Attached URL Engines”) stated on the applicable Order. FireEye reserves the right to audit Customer’s use of the Product to ensure compliance with this Agreement. “Nodes” are endpoint computing devices owned or controlled by Customer (such as laptops, workstations, and servers), on which Customer installs the agent software. Updates, preview features, Content Feeds and/or Support Services are not necessarily provided with the Software, may require additional payment or include additional terms and conditions, and may be provided on a “preview” basis for a limited period at no additional charge but then licensed for an additional fee at a later date.

Customer acknowledges that Third Party Software distributed with the Products may be subject to separate license terms, and specifically, if the Oracle™ Java® software is included within the Product, that software is subject to the license found at http://www.oracle.com/technetwork/java/javase/terms/license/index.html.

2. Content Feeds. Subject to Customer’s payment in full of all associated fees for the applicable FireEye Content Feed, as set forth on the applicable Order, FireEye shall grant a limited, non-exclusive, personal, nontransferable, non-sublicenseable right to use the Content Feed as set forth in the Documentation for the applicable Product, for Customer’s internal business purposes during the active Support Term for the applicable Product. FireEye shall not disclose to any third party any personally identifiable data or Customer Confidential Information in connection with the Content Feed unless expressly authorized to do so by Customer. The Content Feeds available to the Customer with respect to the Products may include:

2.1 FireEye Dynamic Threat Intelligence™ (DTI™) – The DTI Content Feed (currently available only for customers who have purchased the FireEye NX, EX, AX, HX or FX Product) provides continual, updated information to the Product about threats.

2.2. FireEye Advanced Threat Intelligence™ (ATI™) – The ATI Content Feed (currently available only for customers who have purchased the FireEye NX Product) provides contextual information about malware detected in Customer’s environment, such as information regarding threat groups associated with certain malware, industry verticals in which FireEye has observed certain threat groups operate and in which certain malware is used, and relative frequency of observation of various threats and malware.

3. Support Services. Subject to Customer’s payment in full of all associated fees for FireEye Support Services, FireEye shall provide Support Services for the Products as set forth in Exhibit C, as may be updated by FireEye in its discretion.

Page 880055 ends

Confidential FireEye Rev. 8/2016

Page 13 ends

EXHIBIT B

SUBSCRIPTION TERMS

Page 880066 ends

Confidential FireEye Rev. 8/2016

Page 14 ends

EXHIBIT B-1
SUBSCRIPTION TERMS FOR FIREEYE AS A SERVICE (FAAS) – CONTINUOUS PROTECTION The following terms govern the FireEye as a Service (FaaS) – Continuous Protection (CP) Subscription. 1 Definitions.

1.1 “Alert” means, individually and collectively, APT Alerts, High Priority Alerts, and Low Priority Alerts.

1.2 “APT Alert” means (a) with respect to Products other than HX, an alert generated by a Product, that is identified by the Product as being associated with a “targeted threat,” which means advanced persistent threat (APT) actors or APT activity; (b) with respect to the HX Product, an alert designated by HX as XPLT, EXC, or PRE, that is triggered by a FireEye standard Indicator; and (c) with respect to the TAP Subscription, an “APT Alert” means a TAP Alert designated as an “APT Alert” in the table in Section 1.11 below.

1.3 “APT Only Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of APT Alert. If Customer purchases the APT Only Service, FireEye will provide FaaS Reports and monitoring of only APT Alerts, and not any other Alerts.

1.4 “Covered System” means (i) a computing device (to the extent supported by FireEye) that Customer specifies as within the scope of the CP Subscription, and if the Customer has purchased the HX Product, on which a software agent has been installed to support CP Subscription delivery, or (ii) a computing device (to the extent supported by FireEye) whose network traffic is observable to support CP Subscription delivery; (iii) with respect to ETP Subscriptions, mailboxes monitored to support CP Subscription delivery; or (iv) any computing device that both Customer and FireEye agree is within scope of the CP Subscription.

1.5 “Full Coverage Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of all Alerts, regardless of the severity level of the Alert as classified by the Product.

1.6 “High Priority Alert Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of High Priority Alerts and APT Alerts.

1.7 “FaaS Reports” means the written reports relating to Alerts that FireEye creates and makes available to Customer through the CP Subscription.

1.8 “High Priority Alert” means (a) with respect to Products other than HX and FX, an alert generated by that Product that is classified by that Product as severity level “critical” or “major”; (b) with respect to the FX Product, any alert generated by the FX Product, including APT Alerts; and (c) with respect to a TAP subscription, a TAP Alert designated as a “High Priority Alert” in the table in Section 1.11 below.

1.9 “Low Priority Alert” means an alert generated by a Product or TAP Subscription (as applicable) that is not an APT Alert or a High Priority Alert.

1.10 “Nodes” or “Node Band” refers to number of Covered Systems within the Customer environment, which is reflected on the Subscription Order.

1.11 “TAP Alert” means an alert generated by the TAP Subscription, with a severity level assigned by the TAP Subscription (e.g., “Critical,” “High,” “Medium”). TAP Alerts are investigated and reported on as “APT Alerts” and “High Priority Alerts” as shown in the table below, depending on the TAP Rule Pack that invoked the TAP Alert:

FireEye Rule Pack APT Alerts High Priority Alerts
Application Detection
Cloud Infrastructure
Commodity Malware All

Page 880077 ends

Confidential FireEye Rev. 8/2016

Page 15 ends

Current Events Critical, High Critical, High
DTI Rules All
Exploit Kits All
FTP
Industrial Control Systems Critical, High, Medium Critical, High, Medium Intel Match Critical, High, Medium Critical, High, Medium Linux Critical, High
Malware Methodology Critical, High
Phishing Critical High Critical, High
Point of Sale All All
Security Tools Critical, High, Medium
Targeted Malware All All
Vendor – FireEye
Vulnerability Critical, High, Medium
Web Application Attacks Critical, High, Medium
Windows Critical, High

1.13 “TAP Rule Packs” means a predefined set of criteria that identifies suspicious events or threats based on the associated rule type within the TAP Subscription.
2 Scope of FaaS – Continuous Protection (CP) Subscription. During the Subscription Term, FireEye will provide the CP Subscription as set forth in this Section 2, according to the Subscription level purchased by Customer as set forth in the Subscription Order. If the Subscription Order does not specify the Subscription lvel purchased, then Customer will be deemed to have purchased the APT Only Service. All services Customer requests that are not described in this Section 2 will be performed at mutually agreed upon rates as set forth in Statements of Work. Unless otherwise specified, the CP Subscription is provided by FireEye personnel remotely accessing Customer’s environment from FireEye’s networks. The CP Subscription is available for the number of Nodes purchased (available for Customers who have purchased the FireEye NX, FX, or EX Product or the ETP or TAP Subscription). If the number of Nodes exceeds the amount reflected in the Subscription Order by more than ten percent (10%), FireEye will notify Customer in writing, and will issue an invoice for the next higher Node Band at FireEye’s then-current rates pro-rated for the remaining portion of the then-current Subscription Term.

2.1 Event Analysis.
(a) Time to Begin Analysis. FireEye will begin analysis of an Alert within the times set forth in the table below, calculated from the time the Alert was generated by the Product or TAP Subscription (as applicable). (b) Alerts Investigated. FireEye will investigate and report on the Alerts that correspond with the Subscription level the Customer purchased. If the Customer purchased the APT Only Service, FireEye will investigate and report on only APT Alerts. If the Customer purchased the High Priority Alerts Service, FireEye will investigate and report on only High Priority Alerts and APT Alerts. If the Customer purchased the All Alerts Service, FireEye will investigate and report on APT Alerts, High Priority Alerts, and Low Priority Alerts.

FireEye has no obligation to investigate and report on Alerts that fall outside the purchased Subscription level.
(c) Initial Investigation. FireEye analysts will perform an initial analysis of the Customer’s Covered Systems to determine if the Alert is a true or false positive, benign or suspicious activity. (d) FaaS Reports. If FireEye’s investigation determines that the Alert indicates a true compromise, FireEye will publish a FaaS Report to the FaaS Portal within one (1) hour of the time FireEye makes that determination.

Regardless of whether FireEye’s investigation determines that an Alert indicates a true compromise, FireEye will publish a FaaS Report on the Alert to the FaaS Portal within the times set forth in the table

Page 880088 ends

Confidential FireEye Rev. 8/2016

Page 16 ends

below, based on the classification of the Alert (APT Alert, High Priority Alert, Low Priority Alert). Customer acknowledges that in some cases, when FireEye’s investigation is not complete, a FaaS Report may provide only an update of current status of the Alert investigation.

Alerts Investigated (Level of
Service)
FaaS Alert
Classification
Time to
Begin
Investigation
(from time
Product or
TAP
Subscription
generates
Alert)
Time to
Publish FaaS
Report (from
time FireEye
validates
actual
compromise)
Time to Publish
FaaS Report
(when no
validation of
actual
compromise;
from time
Product or TAP
Subscription
generates
Alert)
APT Only
Service
High
Priority
Alerts
Service
Full
Coverage
Service
Yes Yes Yes APT Alert 1 hours 1 hour 24 hours
No Yes Yes High Priority
Alert
7 hours 1 hour 24 hours
No No Yes Low Priority
Alert
24 hours 1 hour 48 hours
The service levels noted in the table above will become effective thirty (30) days following the Order Effective Date, to allow time for Customer to install Products and for FireEye to determine the level of staffing needed to respond to Alerts in Customer’s environment. (e) Extended Investigations; Multiple Related Alerts. When FireEye has identified a true positive or suspicious activity, FireEye analysts may perform an extended investigation, and/or may aggregate and review multiple Alerts from related Covered Systems to determine the extent of activity related to the Alert.

FireEye analysts may append results from the extended investigation or subsequent Alert investigations to the initial FaaS Report if FireEye determines that additional or subsequent Alerts are related, and in such cases, FireEye will not be required to issue a separate FaaS Report for each such related Alert. (f) Non-Remediable Alerts. FireEye has no obligation to notify the Customer or generate a new FaaS Report on new Alerts that are directly related to previous investigations where a FaaS Report has been published and FireEye has provided recommended remediation steps, when the Customer has acknowledged the FaaS Report but chooses not to or cannot remediate the cause of these Alerts. (g) Alert Priority. FireEye may re-prioritize Alerts, regardless of their severity classification, to provide focus to Alerts that FireEye determines may have the largest impact to the Customer’s environment. (h) Continuity of Monitoring. All monitoring, investigation and reporting activities described in this Section 2.1 will be provided on a 24/7/365 basis.

2.2 System Health Monitoring and Notification. For Customers who have purchased the FireEye NX, EX, or FX Product, FireEye will provide Customer with notifications of system health issues such as connectivity problems.

2.3 Containment. When the Customer has purchased the HX Product, FireEye may, when appropriate, recommend containment of the target Covered System from the Customer’s network. Containment must be executed by the Customer.

2.4 Portal Access. Alerts and FaaS Reports will be provided via an online portal (“FaaS Portal”), and FireEye will provide login credentials to the Customer to enable access to the FaaS Portal. The FaaS Portal will be available 99.9% of the time in any calendar month, other than Downtime, as defined below, and this FaaS Portal Service Level commitment will be subject to the Service Level Credits set forth in Section 3 below.

Page 880099 ends

Confidential FireEye Rev. 8/2016

Page 17 ends

2.5 FireEye Intelligence Center. During the Subscription Term, FireEye will provide access to the FireEye Intelligence Center (FIC), which includes the Community Threat Intelligence (CTI) platform, subject to the following:
(a) Permitted Use; Reports. Customer may access, view and use FIC and content appearing on FIC (“FIC Content”) solely for internal use. Some features of FIC may allow Customer to generate a report (each, a “FIC Report”). FIC Reports and FIC Content are FireEye IP. Subject to Customer’s payment obligations, FireEye grants to Customer a limited, non-exclusive right to produce FIC Reports using FIC, and reproduce and distribute those FIC Reports and FIC Content internally for Customer’s own business purposes.
(b) Additional Use Limitations. Customer may appoint up to fifteen (15) users of FIC at any time. Each day, all users on Customer’s account may collectively make up to (A) one hundred (100) queries of IP addresses and domain names and (B) one hundred (100) queries of malware. Customer may request additional queries, to be evaluated by FireEye on a case by case basis. (c) User Content. “User Content” means any communications, images, sounds, and all the material and information that Customer or anyone using Customer’s account contributes to or through FIC, including any contributions to or through the CTI platform (e.g., comments to FIC Content, suspected malware that Customer uploads to FIC). Customer hereby grants FireEye a perpetual, irrevocable, worldwide, paid-up, non-exclusive, license, including the right to sublicense to third parties, and right to reproduce, fix, adapt, modify, translate, reformat, create derivative works from, publish, distribute, sell, license, transmit, publicly display, publicly perform, or provide access to electronically, broadcast, display, perform, and use and practice such User Content as well as all modified and derivative works thereof.

Customer represents that Customer has all necessary rights to grant the license referenced in the preceding sentence. FireEye may use and disclose any of the information it collects about its customers’ use of FIC, including CTI, to the extent such information is de-identified. (d) Restrictions. Customer may not access FIC by any means other than through the interface that is provided or approved by FireEye. Customer will not collect any information from or through FIC using any automated means, including without limitation any script, spider, “screen scraping,” or “database scraping” application, and Customer will not damage, disable, overburden, or impair FIC or interfere with any other party’s use and enjoyment of FIC.
(e) Customer acknowledges that some optional features and content appearing on FIC may require payment of additional fees.

2.6 Reseller and Partner Purchases. If Customer receives the Subscription via a FireEye authorized services or support partner (a “Partner”), Customer agrees that the Subscription and FaaS Reports may be delivered to Customer through the Partner. Notwithstanding any other confidentiality obligations between the parties, Customer authorizes FireEye to disclose information related to the Subscription and Customer Data to Partner.

2.7 Customer Networks. The Subscription may only be provided for computer systems and networks leased to or owned by Customer, and under Customer’s control, up to the number of Nodes allowed, as set forth in the applicable Subscription Order.

2.8 Connectivity Requirements. Unless otherwise specified, the Subscription are provided by FireEye personnel remotely accessing Customer’s environment from FireEye’s networks. Customer must provide outbound TCPbased connectivity from all Products to FireEye for the establishment of a virtual private network (VPN). Details pertaining to specific network access requirements will be established in conjunction with installation activities.

2.9 Credential Security. Customer will be responsible for the following: (a) providing accurate information to FireEye for provisioning access to (and removal of) Customer personnel access to the FaaS Portal; (b) implementing and adhering to strong password standards; (c) providing accurate information to FireEye for domain whitelisting; and (d) reporting any security issues related to the Subscription (including the FaaS Portal) to FireEye immediately.

2.10 Exclusions. Notwithstanding anything else contained in this Agreement to the contrary, FireEye shall have no obligation or responsibility to provide the Subscription for (i) Products for which Customer does not have an active Subscription in place; (ii) Products that the Customer (or FireEye or another third party on Customer’s behalf) has configured with a one-way feed of FireEye’s Dynamic Threat Intelligence (DTI) Subscription; (iii)

Page 881100 ends

Page 881111 ends

Confidential FireEye Rev. 8/2016

Page 19 ends

EXHIBIT B-2
SUBSCRIPTION TERMS FOR FIREEYE AS A SERVICE (FAAS) – CONTINUOUS VIGILANCE The following terms govern the FireEye as a Service (FaaS) – Continuous Vigilance (CV) Subscription. 3 Definitions.

3.1 “Alert” means, individually and collectively, APT Alerts, High Priority Alerts, and Low Priority Alerts.

3.2 “APT Alert” means (a) with respect to Products other than HX, an alert generated by a Product, that is identified by the Product as being associated with a “targeted threat,” which means advanced persistent threat (APT) actors or APT activity; (b) with respect to the HX Product, an alert designated by HX as XPLT, EXC, or PRE, that is triggered by a FireEye standard Indicator; and (c) with respect to the TAP Subscription, an “APT Alert” means a TAP Alert designated as an “APT Alert” in the table in Section 1.11 below.

3.3 “APT Only Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of APT Alert. If Customer purchases the APT Only Service, FireEye will provide FaaS Reports and monitoring of only APT Alerts, and not any other Alerts.

3.4 “Covered System” means (i) a computing device (to the extent supported by FireEye) that Customer specifies as within the scope of the CV Subscription, and if the Customer has purchased the HX Product, on which a software agent has been installed to support CV Subscription delivery, or (ii) a computing device (to the extent supported by FireEye) whose network traffic is observable to support CV Subscription delivery; (iii) with respect to ETP Subscriptions, mailboxes monitored to support CV Subscription delivery; or (iv) any computing device that both Customer and FireEye agree is within scope of the CV Subscription.

3.5 “Full Coverage Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of all Alerts, regardless of the severity level of the Alert as classified by the Product.

3.6 “High Priority Alert Service” means the Subscription level in which FireEye will provide FaaS Reports and monitoring of High Priority Alerts and APT Alerts.

3.7 “FaaS Reports” means the written reports relating to Alerts that FireEye creates and makes available to Customer through the CV Subscription.

3.8 “High Priority Alert” means (a) with respect to Products other than HX and FX, an alert generated by that Product that is classified by that Product as severity level “critical” or “major”; (b) with respect to the FX Product, any alert generated by the FX Product, including APT Alerts; and (c) with respect to a TAP subscription, a TAP Alert designated as a “High Priority Alert” in the table in Section 1.11 below.

3.9 “Low Priority Alert” means an alert generated by a Product or TAP Subscription (as applicable) that is not an APT Alert or a High Priority Alert.

3.10 “Nodes” or “Node Band” refers to number of Covered Systems within the Customer environment, which is reflected on the Subscription Order.

3.11 “TAP Alert” means an alert generated by the TAP Subscription, with a severity level assigned by the TAP Subscription (e.g., “Critical,” “High,” “Medium”). TAP Alerts are investigated and reported on as “APT Alerts” and “High Priority Alerts” as shown in the table below, depending on the TAP Rule Pack that invoked the TAP Alert:

FireEye Rule Pack APT Alerts High Priority Alerts
Application Detection
Cloud Infrastructure
Commodity Malware All

Page 881122 ends

Confidential FireEye Rev. 8/2016

Page 20 ends

1.13 “TAP Rule Packs” means a predefined set of criteria that identifies suspicious events or threats based on the associated rule type within the TAP Subscription.
2 Scope of FaaS – Continuous Vigilance (CV) Subscription. During the Subscription Term, FireEye will provide the CV Subscription as set forth in this Section 2, according to the Subscription level purchased by Customer as set forth in the Subscription Order. If the Subscription Order does not specify the Subscription lvel purchased, then Customer will be deemed to have purchased the APT Only Service. All services Customer requests that are not described in this Section 2 will be performed at mutually agreed upon rates as set forth in Statements of Work. Unless otherwise specified, the CV Subscription is provided by FireEye personnel remotely accessing Customer’s environment from FireEye’s networks. The CV Subscription is available for the number of Nodes purchased (available for Customers who have purchased the FireEye NX, FX, or EX Product or the ETP or TAP Subscription). If the number of Nodes exceeds the amount reflected in the Subscription Order by more than ten percent (10%), FireEye will notify Customer in writing, and will issue an invoice for the next higher Node Band at FireEye’s then-current rates pro-rated for the remaining portion of the then-current Subscription Term.

2.1 Event Analysis.
(e) Time to Begin Analysis. FireEye will begin analysis of an Alert within the times set forth in the table below, calculated from the time the Alert was generated by the Product or TAP Subscription (as applicable). (f) Alerts Investigated. FireEye will investigate and report on the Alerts that correspond with the Subscription level the Customer purchased. If the Customer purchased the APT Only Service, FireEye will investigate and report on only APT Alerts. If the Customer purchased the High Priority Alerts Service, FireEye will investigate and report on only High Priority Alerts and APT Alerts. If the Customer purchased the All Alerts Service, FireEye will investigate and report on APT Alerts, High Priority Alerts, and Low Priority Alerts.

FireEye has no obligation to investigate and report on Alerts that fall outside the purchased Subscription level.
(g) Initial Investigation. FireEye analysts will perform an initial analysis of the Customer’s Covered Systems to determine if the Alert is a true or false positive, benign or suspicious activity. (h) FaaS Reports. If FireEye’s investigation determines that the Alert indicates a true compromise, FireEye will publish a FaaS Report to the FaaS Portal within one (1) hour of the time FireEye makes that determination.

Page 881133 ends

Confidential FireEye Rev. 8/2016

Page 21 ends

FireEye analysts may append results from the extended investigation or subsequent Alert investigations to the initial FaaS Report if FireEye determines that additional or subsequent Alerts are related, and in such cases, FireEye will not be required to issue a separate FaaS Report for each such related Alert. (f) Non-Remediable Alerts. FireEye has no obligation to notify the Customer or generate a new FaaS Report on new Alerts that are directly related to previous investigations where a FaaS Report has been published and FireEye has provided recommended remediation steps, when the Customer has acknowledged the FaaS Report but chooses not to or cannot remediate the cause of these Alerts. (g) Alert Priority. FireEye may re-prioritize Alerts, regardless of their severity classification, to provide focus to Alerts that FireEye determines may have the largest impact to the Customer’s environment. (h) Hunting. FireEye will conduct periodic proactive hunting techniques on Covered Systems to look for additional indicators of malicious or attacker activity. When FireEye’s investigation reveals a compromise, then within one (1) hour of the time FireEye makes that determination, FireEye will publish a FaaS Report related to that activity to the FaaS Portal. (i) Continuity of Monitoring. All monitoring, investigation and reporting activities described in this Section 2.1 will be provided on a 24/7/365 basis.

Page 881144 ends

Confidential FireEye Rev. 8/2016

Page 22 ends

available 99.9% of the time in any calendar month, other than Downtime, as defined below, and this FaaS Portal Service Level commitment will be subject to the Service Level Credits set forth in Section 3 below.

2.5 FireEye Intelligence Center. During the Subscription Term, FireEye will provide access to the FireEye Intelligence Center (FIC), which includes the Community Threat Intelligence (CTI) platform, subject to the following:
(f) Permitted Use; Reports. Customer may access, view and use FIC and content appearing on FIC (“FIC Content”) solely for internal use. Some features of FIC may allow Customer to generate a report (each, a “FIC Report”). FIC Reports and FIC Content are FireEye IP. Subject to Customer’s payment obligations, FireEye grants to Customer a limited, non-exclusive right to produce FIC Reports using FIC, and reproduce and distribute those FIC Reports and FIC Content internally for Customer’s own business purposes.
(g) Additional Use Limitations. Customer may appoint up to fifteen (15) users of FIC at any time. Each day, all users on Customer’s account may collectively make up to (A) one hundred (100) queries of IP addresses and domain names and (B) one hundred (100) queries of malware. Customer may request additional queries, to be evaluated by FireEye on a case by case basis. (h) User Content. “User Content” means any communications, images, sounds, and all the material and information that Customer or anyone using Customer’s account contributes to or through FIC, including any contributions to or through the CTI platform (e.g., comments to FIC Content, suspected malware that Customer uploads to FIC). Customer hereby grants FireEye a perpetual, irrevocable, worldwide, paid-up, non-exclusive, license, including the right to sublicense to third parties, and right to reproduce, fix, adapt, modify, translate, reformat, create derivative works from, publish, distribute, sell, license, transmit, publicly display, publicly perform, or provide access to electronically, broadcast, display, perform, and use and practice such User Content as well as all modified and derivative works thereof.

Customer represents that Customer has all necessary rights to grant the license referenced in the preceding sentence. FireEye may use and disclose any of the information it collects about its customers’ use of FIC, including CTI, to the extent such information is de-identified. (i) Restrictions. Customer may not access FIC by any means other than through the interface that is provided or approved by FireEye. Customer will not collect any information from or through FIC using any automated means, including without limitation any script, spider, “screen scraping,” or “database scraping” application, and Customer will not damage, disable, overburden, or impair FIC or interfere with any other party’s use and enjoyment of FIC.
(j) Customer acknowledges that some optional features and content appearing on FIC may require payment of additional fees.

2.8 Connectivity Requirements. Unless otherwise specified, the Subscription are provided by FireEye personnel remotely accessing Customer’s environment from FireEye’s networks. Customer must provide outbound TCVbased connectivity from all Products to FireEye for the establishment of a virtual private network (VPN). Details pertaining to specific network access requirements will be established in conjunction with installation activities.

Page 881155 ends

Page 881166 ends

Confidential FireEye Rev. 8/2016

Page 24 ends

3.2.4 Customer shall not be entitled to receive a Credit that exceeds 10% of its prorated monthly Subscription Fee for a Service Outage for the applicable calendar month.

Page 881177 ends

Confidential FireEye Rev. 8/2016

Page 25 ends

EXHIBIT B-3

SUBSCRIPTION TERMS FOR FIREEYE THREAT ANALYTICS PLATFORM (TAP) The following terms govern the Threat Analytics Platform Subscription, including purchase and support of TAP Cloud Collector™ Appliances and Support.

1. TAP Software, Alerts

1.1.1 TAP Software and Hardware. As part of the TAP Subscription, FireEye may deliver to Customer one or more software files (individually and collectively, “TAP Software”), and/or one or more “Cloud Collector” hardware appliances (“Cloud Collector Appliances”), which may contain TAP Software. Subject to full payment of all Fees associated with the TAP Subscription, FireEye grants to Customer a non-exclusive, limited right and license to install and run the TAP Software during the Subscription Term solely for purposes of using the TAP Subscription in accordance with the Documentation for the TAP Subscription.

1.1.2 Access; Customer Logs. FireEye will provide Customer with credentials to enable access to the TAP Subscription. Using the TAP Software, and subject to payment of Fees for the TAP Subscription and any Cloud Collector Appliances, Customer may upload Customer Logs to the TAP portal (“TAP Portal”). “Customer Logs” means any communications, logs and other content and information that Customer or anyone using Customer’s account contributes to or through the TAP Portal. Customer grants to FireEye a perpetual, irrevocable, worldwide, paid-up, non-exclusive license and right to reproduce, modify, create derivative works from, publish, distribute, sell, sub-license, transmit, publicly display and provide access to Customer Logs, for purposes of enhancing FireEye’s products and services, so long as (i) FireEye ensures that any Customer Confidential Information is removed from Customer Logs, and (ii) FireEye’s use of Customer Logs does not in any way identify Customer or its employees or in any other way allow a third party to identify Customer as the source of the Customer Logs.

Customer Logs are Customer’s property, and other than the licenses granted in herein, FireEye does not obtain any ownership rights in Customer Logs.

1.1.3 TAP Alerts. Some features of the TAP Subscription may generate alerts of suspected malicious activity (each, a “TAP Alert”). TAP Alerts are FireEye Materials. FireEye hereby grants to Customer a limited, non-exclusive right to use TAP Alerts, and reproduce and distribute those TAP Alerts internally for Customer’s own business purposes.

1.1.4 Cloud Collector Management. If Customer has installed Cloud Collectors in connection with the TAP Subscription, then FireEye will continuously monitor the Customer’s Cloud Collector Appliances or Cloud Collector TAP Software for system health issues such as monitoring to ensure proper throughput and relay of data.

1.1.5 Cloud Collector Appliances. If the Customer has purchased Cloud Collector Appliances, then during the TAP Subscription Term, FireEye will replace any defective Cloud Collector Appliances as follows:
a) Prior to any return, Customer shall verify that the Cloud Collector Appliance at issue is defective by logging a Support request via one of the mechanisms provided in the Documentation and in accordance with FireEye’s RMA procedures, including providing the part number, serial number, quantity and reason for return, an explanation of all failure symptoms and other relevant information. b) Upon confirmation by FireEye of a defect, Customer shall obtain from FireEye an RMA number. FireEye shall ship via a recognized express courier service a replacement Cloud Collector Appliance to Customer to arrive no later than next business day after FireEye’s issuance of an RMA number, provided the RMA number was issued prior to the business day cutoff time local to the defective Cloud Collector Appliance, provided the replacement does not require any custom pre-configuration, and provided no external-toFireEye circumstances prevent the delivery. The replacement Cloud Collector Appliance may be a new or reconditioned Cloud Collector Appliance (of equivalent or better quality) at FireEye’s sole discretion. c) FireEye shall pay the shipping costs to ship the replacement Cloud Collector Appliance to Customer, but Customer shall bear any and all risk of loss of or damage to said Cloud Collector Appliance at all times after said Cloud Collector Appliance is made available by FireEye to the common carrier.

Page 881188 ends

Confidential FireEye Rev. 8/2016

Page 26 ends

d) Within five (5) business days after Customer receives the replacement Cloud Collector Appliance from FireEye, Customer shall package the defective Cloud Collector Appliance in its original packing material or equivalent, write the RMA number on the outside of the package and return the defective Cloud Collector Appliance, at FireEye’s cost (provided Customer utilizes FireEye’s designated courier service and properly packages the defective Cloud Collector Appliance according to FireEye’s instructions), shipped properly insured, FOB FireEye’s designated facility. Customer shall enclose with the returned Cloud Collector Appliance the applicable RMA form, and any other documentation or information requested by FireEye customer support. Customer shall assume any and all risk of loss of or damage to such Cloud Collector Appliance during shipping. Title to the defective Cloud Collector Appliance shall pass to FireEye upon FireEye’s receipt thereof.
e) When a replacement Cloud Collector Appliance is provided and Customer fails to return the defective Cloud Collector Appliance to FireEye within ten (10) business days after Customer receives the replacement Cloud Collector Appliance from FireEye, FireEye may charge Customer, and Customer shall pay for the replacement Cloud Collector Appliance at the then-current list price.

2. Event Volume; True-Up

2.1.1 Fees for the TAP Subscription are divided into “Tiers” based on the volume of events processed through the TAP Subscription per second (“Event Volume”). If at any point during the Subscription Term, Customer’s Event Volume exceeds the Tier upon which Customer’s TAP Subscription Fees were based, FireEye will not guarantee that Customer Logs in excess of the purchased Tier will be ingested and processed by the TAP Subscription. In times of Event Volume in excess of the paid Tier, Customer Logs will enter a queue. Excessive queueing may cause Customer Logs to be lost from the queue. If at any point during the Subscription Term, Customer’s average Event Volume for any consecutive thirty-day period exceeds the Tier upon which Customer’s TAP Subscription Fees were based, FireEye may issue a true-up invoice for the pro-rated difference between the Fees already paid for that Subscription Term and FireEye’s list prices for the Fees for the Tier associated with Customer’s actual Event Volume for that thirty-day period, pro-rated to reflect that thirty-day period and the remainder of the Subscription Term. FireEye will apply any discounts that were applied to initial Fees to FireEye’s list prices for any true-up invoice.

Until such time that the True Up invoice is paid in full, the TAP Subscription will continue to ingest and process only the Event Volume of the purchased Tier, allowing any excess Customer Logs to enter queueing conditions. The Tier for any Renewal Subscription Term will be the Tier associated with the actual Event Volume for the immediately preceding Subscription Term.

2.1.2 At the end of the Initial Subscription Term and each Renewal Subscription Term, FireEye may true-up Fees for that Subscription Term, and if the average monthly Event Volume for that Subscription Term exceeds the maximum Event Volume for the Tier for which Customer previously paid Fees, then (a) FireEye will issue a true-up invoice reflecting the difference between the Fees already paid for that Subscription Term and the Fees for the Tier associated with Customer’s actual Event Volume.

3. TAP Portal Availability

3.1 FireEye shall undertake commercially reasonable efforts to ensure the TAP Portal availability for 99.9% of the time during each calendar month.

3.1.1 “Service Outage” is where the TAP Portal is not available due to a failure or a disruption in TAP Portal that is not the result of Scheduled Maintenance, Emergency Maintenance, a force majeure event or of the act or omission of Customer.

3.1.2 “Scheduled Maintenance Period" is the period during which weekly scheduled maintenance of the TAP Portal may be performed, or a maintenance window otherwise mutually agreed upon by FireEye and Customer.

3.1.3 "Emergency Maintenance" means any time outside of Scheduled Maintenance that FireEye is required to apply critical patches or fixes or undertake other urgent maintenance. If Emergency Maintenance is required, FireEye will contact Customer and provide the expected time frame of the Emergency Maintenance and availability of the TAP Portal during the Emergency Maintenance.

Page 881199 ends

Page 882200 ends

Confidential FireEye Rev. 8/2016

Page 28 ends

iv. Restrictions. Customer may not access FIC by any means other than through the interface that is provided or approved by FireEye. Customer will not collect any information from or through FIC using any automated means, including without limitation any script, spider, “screen scraping,” or “database scraping” application, and Customer will not damage, disable, overburden, or impair FIC or interfere with any other party’s use and enjoyment of FIC.
v. Customer acknowledges that some optional features and content appearing on FIC may require payment of additional fees.

Page 882211 ends

Confidential FireEye Rev. 8/2016

Page 29 ends

EXHIBIT B-4
SUBSCRIPTION TERMS FOR FIREEYE EMAIL THREAT PREVENTION (ETP) and MOBILE THREAT PREVENTION (MTP) The following terms govern the Email Threat Prevention Subscription and Mobile Threat Prevention Subscription.

1. Definitions.
“Cloud Subscription" means the online, web-based applications and platform which is made accessible to Customer by FireEye via a designated website, which includes the associated offline Software components to be used in connection with FireEye Mobile Threat Prevention and/or FireEye Email Threat Prevention. FireEye Mobile Threat Prevention (“MTP”) and FireEye Email Threat Prevention (“ETP”) are separate Cloud Subscriptions and usage is conditional on what the Customer has indicated on an Order. “Customer Data” means data, information, applications, and any other items originated by Customer that Customer submits to the Cloud Subscription.
“Customer Representatives” means any employee or contractor of Customer or Mobile Device Manager to whom Customer provides access to the Cloud Subscriptions (or any component thereof, including Software) for use on behalf of and for the benefit of the Customer and for Customer’s internal business purposes, subject to all the terms and conditions of this Agreement.
“Licensed Device” means (i) with respect to MTP, the registered devices that Customer may have at any time that are registered to the Cloud Subscription; which maximum number shall be based on the subscription fees paid by Customer and identified on the relevant purchase order from Customer as approved and invoiced by FireEye; and (ii) with respect to ETP, the number of email inboxes Customer may have at any time that are registered to the Cloud Subscription; which maximum number shall be based on the subscription fees paid by Customer and identified on the relevant purchase order from Customer as approved and invoiced by FireEye.

For the avoidance of doubt, with respect to MTP, “registered devices” are those devices which have loaded device Software and which have been registered to the Cloud Subscription and which have not been retired (meaning unregistered).
“Mobile Device Manager” shall mean a third party who has been engaged by the Customer to provide security services for Licensed Devices for the benefit of Customer. Where indicated as such, the Mobile Device Manager shall be a subset of the definition of the Customer Representatives solely as applicable to MTP. “Software” means the object code version of FireEye’s proprietary computer programs delivered to Customer hereunder for use in connection with the Cloud Subscriptions, including collectively and individually the deviceside software used on devices registered to the Cloud Subscription (“Device Software”) and any connector software and/or any other server-side software (collectively the “Premise Software”) , each which are delivered to Customer hereunder for use in connection with the Cloud Subscriptions, and any Documentation, backup copies and updates, upgrades, maintenance releases, bug fixes to any of the forgoing provided to Customer hereunder.

2. Right of Access and Use. During the Subscription Term, and subject to the terms of this Agreement, FireEye grants to Customer a non-exclusive right to (a) permit those Customer Representatives authorized by Customer to access and use the Cloud Subscriptions on Customer's behalf in compliance with the terms of this Agreement, and (b) to install, copy and use Premise Software in connection with Cloud Subscriptions in accordance with the Agreement and this Exhibit, but solely on systems and hardware owned or controlled or otherwise managed by Customer on behalf of and for the benefit of Customer, (c) to install, copy and use Device Software in connection with Cloud Subscriptions in accordance with the Documentation, but solely on devices used by Customer Representatives on behalf of and for the benefit of Customer. Notwithstanding anything else herein, the number of devices Customer and/or Customer Representatives may register to the Cloud Subscriptions may not exceed the number of Licensed Devices.

Notwithstanding anything to the contrary herein, if Customer is using the Cloud Subscriptions for evaluation purposes then such Customer usage is solely for internal testing and evaluation and the Subscription Term shall not exceed fifteen (15) days unless otherwise mutually agreed upon in a signed Evaluation License Agreement.

Page 882222 ends

Confidential FireEye Rev. 8/2016

Page 30 ends

3. Restrictions. Except as otherwise expressly permitted under this Agreement, Customer agrees that it shall not, nor shall it permit any third party to, (a) use the Cloud Subscriptions (or any portion thereof) in excess of or beyond the Subscription Term, the Licensed Device quantity, and/or other restrictions/limitations described in this Agreement; use the Cloud Subscriptions to store or transmit infringing, libelous, or otherwise unlawful or tortious material, or to store or transmit material in violation of third-party privacy or other rights; (d) interfere with or disrupt the integrity or performance of the Cloud Subscriptions or third-party data contained therein; (e) use the Software on equipment or devices which are not specified in the Documentation; (f) Cloud Subscription specific to ETP Cloud Subscriptions, Customer shall route email through a commercially available secure email gateway for anti-spam scanning prior to relay through the FireEye network. No rights or licenses are granted other than as expressly and unambiguously set forth herein. Customer access and usage for the Cloud Subscriptions is limited to the MTP or ETP Subscription that has been paid or are being evaluated by the Customer.

4. Updates, Malware Detection Content and Support Services. Updates and malware detection content and/or support services are not necessarily provided with the Software or Subscriptions, and may require additional payment or include additional terms and conditions. However, to the extent that an update to the Software and/or malware detection content is provided, such update/content shall be deemed “Software” provided subject to this Agreement. If malware detection content/support services are provided, FireEye reserves the right to change the scope or duration of such services at anytime, and to access, freely use and distribute data collected from Customer through such services. If such services are made available, Customer may be required to pay fees or other charges for use or access to some or all such services, which fees and terms will be specified in the invoice or order form for such service.

5. Device Count Increases; Reporting; Invoice. If the number of devices that Customer or Customer Representatives have registered to the Cloud Subscription (“Actual Device Count”) exceeds Customer’s then current Licensed Device count or if Customer wishes to increase the Licensed Device count, then Customer shall notify FireEye (or the applicable FireEye Partner) and submit an Order for the incremental Subscription Fees due, and upon receipt of such Order, the Licensed Device count shall be amended to reflect this change. Upon written request, Customer will provide FireEye a report identifying (i) the Actual Devices; (ii) the copies of and location of the Premise Software maintained; and (iii) any other information reasonably requested by FireEye at the time as it relates to the use of the Cloud Subscription to determine compliance with the terms of this Agreement. FireEye and/or its Authorized Resellers may invoice Customer if it learns of any shortfalls, i.e. that the Licensed Device Count is below the Actual Device count. The fees charged to Customer for increases in License Device counts will be based on the then-current Subscription Term pricing.

6. Cloud Subscription Availability

6.1 FireEye shall undertake commercially reasonable efforts to ensure the Cloud Subscription availability for

99.9% of the time during each calendar month.

6.1.1 “Service Outage” is where the Customer is not receiving Cloud Subscription due to a failure or a disruption in the Cloud Subscriptions and is not the result of Scheduled Maintenance, Emergency Maintenance, a force majeure event or of the act or omission of Customer.

6.1.2 “Scheduled Maintenance Period" is the period during which weekly scheduled maintenance of the Cloud Subscriptions may be performed, or a maintenance window otherwise mutually agreed upon by FireEye and Customer.

6.1.3 "Emergency Maintenance" means any time outside of Scheduled Maintenance that FireEye is required to apply critical patches or fixes or undertake other urgent maintenance. If Emergency Maintenance is required, FireEye will contact Customer and provide the expected time frame of the Emergency Maintenance and availability of the Cloud Subscriptions during the Emergency Maintenance.

6.1.4 "System Availability" means the percentage of total time during which the Cloud Subscriptions shall be available to Customer, excluding the Scheduled Maintenance Period, Emergency Maintenance, force majeure events, or acts or omissions of the Customer that cause system downtime.

Page 882233 ends

Page 882244 ends

Confidential FireEye Rev. 8/2016

Page 32 ends

EXHIBIT B-5
SUBSCRIPTION TERMS FOR FIREEYE ADVANCED THREAT INTELLIGENCE PLUS (ATI+) The following terms govern the Advanced Threat Intelligence Plus (ATI+) Subscription.

The ATI+ Subscription comprises two features: Continuous Monitoring (“CM” or “Continuous Monitoring”) and the FireEye Intelligence Center™ (FIC™) (“FIC”).

1. Continuous Monitoring
The Continuous Monitoring portion of the Subscription is purchased in connection with one or more FireEye Products, and includes the following during the Subscription Term for the specific Products for which Continuous Monitoring was purchased (some Products may not be eligible for CM):
(a) Critical Event Notification. For Customers who have purchased the FireEye NX, FX, HX or EX Product, MVX Smart Grid with Network Smart node product combination, or the ETP or TAP Subscription, FireEye will provide Customer with proactive notifications of events FireEye determines to be critical that are logged by the Products (“Alerts”). FireEye will also provide Customer with access to a detailed description of the Alert. Alerts are not proof of vulnerability, threats or attacks on Customer. (b) System Health Monitoring and Notification. For Customers who have purchased the FireEye NX, EX, FX, HX AX or FX Product, or MVX Smart Grid w/Network Smart node combination (hardware only), FireEye will provide Customer with proactive notifications of serious system health issues related to the hardware for Products covered by Continuous Monitoring. Customers will also be provided with metrics on critical event notifications and, for purchased hardware, the status of monitored hardware parameters. (c) Portal Access. Alerts and critical event notifications from Continuous Monitoring will be provided via an online portal, and FireEye will provide login credentials to the Customer to enable access to that portal. (d) Continuity of Monitoring. The monitoring activities described in (a)-(c) above will be provided on a 24/7 basis.
(f) Reseller and Partner Purchases. If Customer receives the Subscription via a FireEye Partner, Customer agrees that the Subscription may be delivered to Customer through the Partner. Notwithstanding any other confidentiality obligations between the parties, Customer authorizes FireEye to disclose information related to the Subscription to the Partner.
(g) Exclusions. Notwithstanding anything else contained in this Agreement to the contrary, FireEye shall have no obligation or responsibility to provide the Subscription for (i) Products for which Customer does not have an active Subscription in place; (ii) Products that the Customer (or FireEye or another third party on Customer’s behalf) has configured with a one-way feed of FireEye’s Dynamic Threat Intelligence subscription; (iii) Products with an installed FireEye operating system less than version 6.2; (iv) Products that are end of life; (v) Products that have no active support service in place; (vi) Products for which software updates have not been applied; or (vii) Products that have not been installed and deployed.

2. FireEye Intelligence Center™ (FIC™), Community Threat Intelligence™ (CTI™) FireEye will provide the FIC portion of the Subscription, which includes the Community Threat Intelligence (CTI) platform, during the Subscription Term, as set forth below:

2.1 Permitted Use; Reports. Customer may view and use FIC and content appearing on FIC (“FIC Content”) solely for internal use. Some features of FIC may allow Customer to generate a report (each, a “FIC Report”).

FIC Reports and FIC Content are FireEye Materials. Subject to Customer’s payment obligations, FireEye grants to Customer a limited, non-exclusive right to produce FIC Reports and FIC Content using FIC, and reproduce and distribute those FIC Reports and FIC Content internally for Customer’s own business purposes.

Page 882255 ends

Confidential FireEye Rev. 8/2016

Page 33 ends

2.2 Additional Use Limitations. Customer may appoint up to fifteen (15) users of FIC at any time. Each day, all users on Customer’s account may collectively make up to (i) one hundred (100) queries of IP addresses and domain names, and (ii) one hundred (100) queries of malware per day. Customer may request additional queries, to be evaluated by FireEye on a case by case basis.

2.3 User Content. “User Content” means any communications, images, sounds, and all the material and information that Customer or anyone using Customer’s account contributes to or through FIC including any contributions to or through the CTI platform. Customer hereby grants FireEye a perpetual, irrevocable, worldwide, paid-up, non-exclusive, license, including the right to sublicense to third parties, and right to reproduce, fix, adapt, modify, translate, reformat, create derivative works from, publish, distribute, sell, license, transmit, publicly display, publicly perform, or provide access to electronically, broadcast, display, perform, and use and practice such User Content as well as all modified and derivative works thereof. Customer represents that Customer has all necessary rights to grant the license referenced in the preceding sentence. FireEye may use and disclose any of the information it collects about its customers’ use of FIC, including the CTI platform to the extent such information is de-identified.

2.4 Restrictions. Customer may not access FIC by any means other than through the interface that is provided or approved by FireEye. Customer will not collect any information from or through FIC using any automated means, including without limitation any script, spider, “screen scraping,” or “database scraping” application, and Customer will not damage, disable, overburden, or impair FIC or interfere with any other party’s use and enjoyment of FIC. Customer acknowledges that some optional features and content appearing on FIC may require payment of additional fees.

Page 882266 ends

Confidential FireEye Rev. 8/2016

Page 34 ends

EXHIBIT B-6
SUBSCRIPTION TERMS FOR FIREEYE INTELLIGENCE CENTER™ (FIC™) (INCLUDING COMMUNITY THREAT INTELLIGENCE™ (CTI™))
The following terms govern the FireEye Intelligence Center™ (FIC™) Subscription, which includes access to the Community Threat Intelligence™ (CTI™) platform.

1. During the Subscription Term, FireEye will provide access to the FireEye Intelligence Center (FIC), which includes the Community Threat Intelligence (CTI) platform, subject to the following:
i. Permitted Use; Reports. Customer may view and use FIC and content appearing on FIC (“FIC Content”) solely for internal use. Some features of FIC may allow Customer to generate a report (each, a “FIC Report”). FIC Reports and FIC Content are FireEye Materials. Subject to Customer’s payment obligations, FireEye grants to Customer a limited, non-exclusive right to produce FIC Reports and FIC Content using FIC, and reproduce and distribute those FIC Reports and FIC Content internally for Customer’s own business purposes.
ii. Additional Use Limitations. Customer may appoint up to fifteen (15) users of FIC at any time. Each day, all users on Customer’s account may collectively make up to (A) one hundred (100)queries of IP addresses and domain names, and (ii) one hundred (100) queries of malware. Customer may request additional queries, to be evaluated by FireEye on a case by case basis. iii. User Content. “User Content” means any communications, images, sounds, and all the material and information that Customer or anyone using Customer’s account contributes to or through FIC including any contributions to or through the CTI platform (e.g., comments to FIC Content, suspected malware that Customer uploads to FIC). Customer hereby grants FireEye a perpetual, irrevocable, worldwide, paid-up, non-exclusive, license, including the right to sublicense to third parties, and right to reproduce, fix, adapt, modify, translate, reformat, create derivative works from, publish, distribute, sell, license, transmit, publicly display, publicly perform, or provide access to electronically, broadcast, display, perform, and use and practice such User Content as well as all modified and derivative works thereof. Customer represents that Customer has all necessary rights to grant the license referenced in the preceding sentence. FireEye may use and disclose any of the information it collects about its customers’ use of FIC, including the CTI platform, to the extent such information is de-identified. iv. Restrictions. Customer may not access FIC by any means other than through the interface that is provided or approved by FireEye. Customer will not collect any information from or through FIC using any automated means, including without limitation any script, spider, “screen scraping,” or “database scraping” application, and Customer will not damage, disable, overburden, or impair FIC or interfere with any other party’s use and enjoyment of FIC.
v. Customer acknowledges that some optional features and content appearing on FIC may require payment of additional fees.

Page 882277 ends

Confidential FireEye Rev. 8/2016

Page 35 ends

EXHIBIT B-7
SUBSCRIPTION TERMS FOR FIREEYE iSIGHT INTELLIGENCE
The following terms govern the FireEye iSIGHT Intelligence Subscription (“iSIGHT” or “iSIGHT Subscription”). FireEye will provide the iSIGHT Subscription purchased by the Customer, as shown on the Order.

1. Definitions.

1.1 “Access Method(s)” or “Access Methods” means the MySIGHT Portal (“MySIGHT”), Software Development Kit (“SDK”), Application Programming Interface (“API”), Browser Plugin, iSIGHT App for Splunk, or any other method provided by FireEye for Customer to access the iSIGHT Subscription, individually or collectively. All Access Methods are FireEye Material as defined in the Agreement.

1.2 “Application” is a software program the Customer creates, or causes to have created on its behalf, that is designed to access the Content, which includes the features of the SDK/API but adds significant functionality beyond that provided by the SDK/API.

1.3 “Application Programming Interface” or “API” means the latest version of the iSIGHT Application Programming Interface software made generally available by iSIGHT, with its developer’s guide and other related material (available at http://www.isightpartners.com).

1.4 “Browser Plugin” means the iSIGHT Browser Plugin which a Customer may install on Google Chrome and/or other commercially available and supported browsers that allows the Customer to access and view the Content when licensed to do so. The Browser Plugin displays the iSIGHT logo and links to MySIGHT. The Browser Plugin includes the latest version of the Browser Plugin software, its documentation and any html embedded code.

1.5 “Content” means the cyber threat intelligence data and any reports, threat indicators, trends, events, information, documentation or functionality provided in connection with the iSIGHT Subscription. All Content is FireEye Material as defined in the Agreement.

1.6 “End User” means the Customer or the Customer’s employees, as applicable.

1.7 “Software Development Kit” or “SDK” shall mean the latest publicly-available version of the iSIGHT Software Development Kit and any associated documentation, tools, libraries, technical notes, software code, or other materials.

1.8 “iSIGHT App for Splunk” means the application provided by FireEye, which a Customer may install on Splunk, that allows the Customer to access and view the Content in accordance with this Agreement. The iSIGHT App for Splunk includes the latest version of the iSIGHT App for Splunk software, its documentation and any html embedded code.

1.9 “iSIGHT Subscription” includes but is not limited to, Cyber Crime, Cyber Espionage, Critical Infrastructure, Enterprise, Hacktivism, Vulnerability and Exploitation, MySIGHT Portal, Global Response, Analyst Access, iSIGHT SDK, iSIGHT API, iSIGHT Research Reports, or the current offering(s) as listed on the iSIGHT website, and as purchased by the Customer as shown on the Order.

2. License; Access to iSIGHT Subscription and Content.

2.1. Grant of Limited License. During the Subscription Term, FireEye grants to Customer in strict accordance with the terms of this Agreement, a limited, worldwide, revocable, non-exclusive, non-transferable, nonassignable, non-sublicensable royalty-free right and license to:
(a) use MySIGHT, the iSIGHT Subscription, and any Content provided by FireEye for internal use only. The ISIGHT Subscription can be used by End Users who have a valid "need to know" within Customer’s organization, typically defined as a person or group that has a direct role in securing information system or networks. FireEye agrees to provide support for the ISIGHT Subscription in accordance with Section 3 below (“Subscription Support” or “Support”).

Page 882288 ends

Confidential FireEye Rev. 8/2016

Page 36 ends

(b) use the API to search, display, and otherwise access the Content. The API can be used to develop, display, or integrate applications, scripts, tools or workflows that interoperate with iSIGHT Subscriptions for the Customer’s internal use. FireEye agrees to provide Support for the latest version of the API in accordance with Section 3 below.
(c) download, install and use the Software Development Kit (“SDK”) to design, develop and test an Application(s), for the Customer’s internal use only, for the purpose of customizing access to the Content. The Customer may modify the source code versions of sample files, if any, included with the SDK for the purpose of creating Customer’s Application(s), and may make a reasonable number of copies of the SDK as necessary to develop Customer’s Application(s), provided that Customer must reproduce complete copies of the SDK, including without limitation all "read me" files, copyright notices, and other legal notices and terms. FireEye agrees to provide Support for the ISIGHT SDK in accordance with Section 3 below. (d) use the Browser Plugin to search, display and otherwise access the Content for the Customer’s internal use only. Customer may install and use one copy of the Browser Plugin on a single computer per license. FireEye agrees to provide Support for the latest version of the Browser Plugin in accordance with Section 3 below (e) use the ISIGHT App for Splunk to search, display and otherwise access the Content for the Customer’s internal use only. Customer may install and use one copy of the ISIGHT App for Splunk on a single computer per license. FireEye agrees to provide Support for the latest version of the ISIGHT App for Splunk in accordance with Section 3 below.

2.2. Access Keys. Use of the Access Methods and access to the ISIGHT Subscription and the Content by Customer’s End Users is provided through access keys or login credentials. Access keys in association with the Access Methods and ISIGHT Subscription shall be kept in confidence by Customer and Customer’s End Users.

Access keys will be issued to individual End Users by FireEye in accordance with each particular Access Method’s parameters and will not be shared between End Users. Customer may not establish group accounts. Any unauthorized disclosure or dissemination of access keys by Customer or End Users shall be deemed a material breach of this Agreement. Customer shall inform FireEye of any data breach concerning login credentials in a timely manner. FireEye reserves the right to change, suspend, remove, or disable Customer’s access keys to the Access Methods, ISIGHT Subscription , and Content upon notice if a material breach is suspected and not rectified upon notification.

2.3. Latest Version. The license granted to Customer under this Agreement is for the current version of the Access Methods. FireEye may release future versions of the Access Methods as determined in the sole discretion of FireEye. Nothing in this Agreement is a commitment to Customer of compatibility between the existing Access Methods and any future versions of the Access Methods. FireEye reserves the right to discontinue offering particular Access Methods (or any updates thereto) or to modify the Access Methods at any time in its sole discretion.

2.4. Multiple Copies. Customer may receive software for an Access Method in more than one medium and/or in multiple copies. The Customer’s license rights are in accordance with the Order regardless of the number of copies received.

2.5. Additional Licenses. Customer may purchase additional licenses for the Browser Plugin for its authorized End Users through the Chrome Web Store. Customer may purchase additional licenses for the ISIGHT App for Splunk for its authorized End Users through Splunk. Additional licenses for the Browser Plugin and ISIGHT App for Splunk may be purchased and will be valid for the current Subscription Term as provided in the Order.

2.6. Customer Application. The Customer may allow Customer’s employees to access and use the SDK/API on Customer’s behalf to design an Application. The Customer may not rent, lease, sell, transfer, sublicense or time-share the Customer’s Application to any third-party without the express consent of FireEye. Customer shall retain all right, title or interest in the Application and as such, Customer agrees to indemnify and hold harmless FireEye for any claims of infringement made against FireEye in connection with any Application. The Customer’s Application(s) must perform in accordance with the terms of this Agreement and must ensure the security and confidentiality of FireEye’s Confidential Information. Customer assumes full responsibility for any breach of

Page 882299 ends

Confidential FireEye Rev. 8/2016

Page 37 ends

security caused by Customer’s Application(s) in connection with the Content, API, SDK, and specifically to any unauthorized disclosure of any FireEye Materials or FireEye Confidential Information.

2.7. Content Modifications. Customer may access the Content from the MySIGHT Portal, via email, SMS, HTML, API, any other Access Methods as officially distributed by FireEye or an FireEye sanctioned third-party integration.

FireEye reserves the right to modify, amend, augment, reduce or alter the Content’s format, or Access Methods, or mode of retrieval of the Content, that in the sole judgment of FireEye is in its customers’ best interests. Customer will be entitled to retrieve the Content with any updates, modifications, additions or changes in the Content.

These changes may require Customer to upgrade its systems, hardware or software and FireEye will not be responsible for the costs of any such changes.

2.8. Prohibited Usage. Customer must comply with any Intellectual Property rights asserted in any materials contained in the Content. The following conduct and usage restrictions apply during Customer’s download, installation, and use of the Content and/or Access Methods, and survive termination of the Agreement or Subscription Term. Customer and its authorized End Users may not:
a. rent, lease, lend, sell, redistribute or sublicense any part of the ISIGHT Subscription or Access Methods to any other party;
b. share the ISIGHT Subscription , Access Methods, Content or Confidential Information with any third-parties, except as expressly authorized in advance by this Agreement or by FireEye in writing; c. use the ISIGHT Subscription or Access Methods in the operation of a service or in any way to provide services to any third-party;
d. create derivative works for external distribution or use based upon the Content; e. create apps, extensions, or other products and services that use Content except as set forth herein; f. display, post, frame, or scrape the Content, except as allowed under this Agreement; g. use the Access Methods for any other purpose than to access the ISIGHT Subscription and the Content; h. use the Access Methods for any illegal or unauthorized purpose to promote or provide instructional information about illegal activities or to promote stalking, physical harm or injury against any group or individual, or any use that violates the rights of privacy and publicity of others; i. create, place, or disseminate any materials or other items that are inappropriate, defamatory, obscene, pornographic, harassing, threatening, abusive, hateful or otherwise offensive, or is unlawful (including any content that infringes any patent, trademark, service mark, copyright, trade secret or other proprietary right of any third-party without appropriate permissions);
j. transmit any viruses, worms, defects, Trojan horses, time-bombs, malware, spyware, or any other computer code of a destructive or interruptive nature in connection with use of the Access Methods; k. use the Access Methods in connection with or to promote any products, services, or materials that constitute, promote or are used primarily for the purpose of dealing in spyware, adware, or other malicious programs or code, counterfeit goods, unsolicited mass distribution of email ("spam"), hacking, surveillance, interception, descrambling equipment, stolen products and items used for theft; l. create any Application that exposes or provides functionality of the Access Methods to any third party; m. interfere, restrict or inhibit any other customer from using the Access Methods or Content or disrupt any services offered by FireEye through any medium;
n. attempt to exceed or exceed the usage limits established by FireEye for the Customer (http://www.isightpartners.com/doc/sdk-bp-docs/#/rate_limiting).

2.9. Restrictions. FireEye expressly reserves the right to limit the number and/or frequency of requests for Content made through the Access Methods in its sole discretion in line with technical design and performance standards as documented in the publicly available developers guide. FireEye may limit the number of network calls that any Application may make via the Access Methods, the maximum file size, or the maximum amount of ISIGHT material that may be accessed. FireEye may change such usage limitations at any time and without notice. In addition to any other rights under this Agreement, FireEye may utilize technical measures to prevent over-usage or to stop usage of any Access Methods or any Application after any usage limitations are exceeded.

The most current API/SDK documentation and developers guide can be found at http://www.isightpartners.com/doc/sdk-bp-docs/#/, and these documents detail the current rates and capabilities of the API.

2.10. Customer recognizes and agrees that certain information and data that will be provided by Customer to FireEye pursuant to the ISIGHT Subscription is not owned by Customer and is not Confidential Information of

Page 883300 ends

Page 883311 ends

Confidential FireEye Rev. 8/2016

Page 39 ends

3.3. Subscription Availability
(a) The FireEye ISIGHT API will have at least 99% system uptime (“API Uptime Standard”). (b) The iSIGHT MySIGHT Portal will have at least a 99% system uptime (“Portal Uptime Standard”). (c) FireEye realizes that a failure to meet the Response Time Standard, API Uptime Standard and the Portal Uptime Standard (collectively, the “Service Level Standards”) could have an adverse impact to Customer. If FireEye fails to meet any of the Service Level Standards (“Service Level Failure”), FireEye will: (i) promptly investigate and report on the root cause of the problem; (ii) advise Customer of the remedial efforts being undertaken with respect to this failure to meet the Service Level Standards; (iii) use commercially reasonable efforts to correct the problem and begin meeting the Service Level Standards; and (iv) take appropriate preventative measures designed to ensure that the problem does not recur.

Page 883322 ends

Confidential FireEye Rev. 8/2016

Page 40 ends

EXHIBIT C

FIREEYE SUPPORT SERVICES APPLICABLE FOR FIREEYE PRODUCTS

1. SUPPORT PURCHASED SEPARATELY FROM THE PRODUCTS. In the event Customer has purchased the Products and pass-through Support Services from FireEye through a FireEye authorized reseller (a "Reseller"), Customer will be entitled to all the rights herein set forth related to the level of Support Service requested and paid for by it, provided Customer: (a) is the original purchaser of the covered Products, (b) has provided true, accurate, current and complete information to FireEye included with its purchase; and (c) has maintained and updated this information to keep it true, accurate, current, and complete.

2. SUPPORT SERVICES PROVIDED BY FIREEYE.

FireEye offers a range of programs for the support of its Products as described below (“Support Programs”).

Customer shall be entitled to receive the Support Services specified on the applicable support invoice and described below to the extent that Customer has paid in full the applicable Fees for Support Services.

2.1 Software Maintenance Services – include each of the following:

Software Updates. During the Support Term , FireEye shall provide Customer notification of bug fixes, maintenance patches and new releases which may contain minor enhancements to the features or functions of the Product (“Updates”). FireEye may designate a particular release of the Product as an Update at its sole discretion. Customer may obtain Updates either through delivery of a machine-readable copy pursuant to instructions contained in the document notifying Customer of an available Update or by downloading the Update from FireEye’s server via the Internet. FireEye reserves the right to impose additional charges for releases of Products (i) that provide major enhancements to the features or functions of the Products, as determined by FireEye at its sole discretion; or, (ii) that provide additional features or perform additional functions not provided or performed by the Products.

Software Error Corrections. During the Support Term, FireEye shall use commercially reasonable efforts to correct any reproducible programming error in the software associated with the Product attributable to FireEye, employing a level of effort commensurate with the severity of the error, provided, however, that FireEye shall have no obligation to correct all errors in the Products. Upon identification of any programming error, Customer shall notify FireEye of such error in writing and shall provide FireEye with enough information to locate and reproduce the error. FireEye shall not be responsible for correcting any errors not attributable to FireEye. Errors attributable to FireEye shall be those that are reproducible by FireEye on unmodified Products. If it is found that a particular error is fixed in the most current Product release, then FireEye shall have no obligation to fix the error in any prior Product release and Customer will need to upgrade to the current Product release in order to obtain the fix.

2.2 Support Programs
(a) Platinum Support includes all of the services set forth above under Software Maintenance Service (section

2.1) and additionally:
• Email, Live Chat, Web or Telephone Support. During the Support Term, FireEye shall provide Customer technical email, live chat, web or telephone support for the Products twenty-four (24) hours per day, 365 days a year. FireEye’s support technician shall only be obligated to respond to Customer’s fifteen (15) designated contacts.
• FireEye shall use commercially reasonable efforts to respond to the request for support as detailed in the Initial Response Times table found at https://www.fireeye.com/support/programs.html regarding use or installation of the Product that is communicated to FireEye via one of the mechanisms above to the attention of FireEye’s support engineers.
• Product Return. During the term of this Agreement, Customer shall have the right to return to FireEye any defective Product subject to the limited warranty. Additionally, FireEye will fulfill the following Advance Return provisions below.

Page 883333 ends

Confidential FireEye Rev. 8/2016

Page 41 ends

• Advance Replacement. Prior to any return as to which Advance Replacement applies, Customer shall verify that said Product is defective by logging a Support request via one of the mechanisms described above and in accordance with FireEye’s RMA procedures, including providing the part number, serial number, quantity and reason for return, an explanation of all failure symptoms and other relevant information. Upon confirmation by FireEye of a defect, Customer shall obtain from FireEye an RMA number. FireEye shall ship via a recognized express courier service a replacement Product to Customer to arrive no later than next business day after FireEye’s issuance of an RMA number, provided the RMA number was issued prior to the business day cutoff time local to the defective Product, provided the replacement does not require any custom pre-configuration, and provided no external-to-FireEye circumstances prevent the delivery. The replacement Product may be a new or reconditioned Product (of equivalent or better quality) at FireEye’s sole discretion. FireEye shall pay the shipping costs to ship the replacement Product to Customer, but Customer shall bear any and all risk of loss of or damage to said Product at all times after said Product is made available by FireEye to the common carrier. The support service will transfer from the defective Product to the replacement Product. Within five (5) business days after Customer receives the replacement Product from FireEye, Customer shall package said defective Product in its original packing material or equivalent, write the RMA number on the outside of the package and return said defective Product, at FireEye’s cost provided Customer utilizes FireEye’s designated courier service and properly packages the defective Product according to FireEye’s instructions, shipped properly insured, FOB FireEye’s designated facility (except that FireEye shall pay for shipping). Customer shall enclose with the returned Product the applicable RMA form, and any other documentation or information requested by FireEye customer support. Customer shall assume any and all risk of loss of or damage to such Product during shipping. Title to the defective Product shall pass to FireEye upon FireEye’s receipt thereof. When a replacement Product is provided and Customer fails to return the defective Product to FireEye within ten (10) business days after Customer receives the replacement Product from FireEye, FireEye may charge Customer, and Customer shall pay for the replacement Product at the then-current list price.
(b) Platinum Priority Plus Support iincludes all of the services set forth above under Platinum Support [section

2.2(a)] and additionally:
• Access to Support. Customer will be provided with direct priority access to Level 2 Advanced Engineering support who shall respond to Customer’s unlimited number of designated contacts. A Designated Support Engineer (DSE) point of contact, who is available during Customer’s business hours (for single Customer site if Product(s) installed at multiple Customer sites), will be made available to be the focal point of contact within FireEye, to project manage Customer’s technical issues. • Onsite Support. Onsite visits for problem assistance at DSE’s sole discretion. • Reporting. FireEye will supply Customer with monthly reports detailing technical support provided during the previous month. Quarterly business reviews will also be conducted. (c) Government Support, if available, includes all of the services set forth above under Platinum Support [section 2.2(a)] and additionally:
• Email, Live Chat, Web or Telephone Support. For the specified country, access to citizens of that country for the fulfillment of Level 1 and 2 technical support requests. (d) Government Priority Plus Support includes all of the services set forth above under Government Support [section 2.2(c)] and additionally:
• Access to Support. Customer will be provided with direct priority access to Level 2 Advanced Engineering support who are citizens of that country and shall respond to Customer’s unlimited number of designated contacts. A Designated Support Engineer (DSE) point of contact who is a citizen of that country and available during Customer’s business hours (for single Customer site if Product(s) installed at multiple Customer sites), will be made available to be the focal point of contact within FireEye, to project manage Customer’s technical issues.
• Onsite Support. Onsite visits for problem assistance at DSE’s sole discretion. • Reporting. FireEye will supply Customer with monthly reports detailing technical support provided during the previous month. Quarterly business reviews will also be scheduled.

Page 883344 ends

Confidential FireEye Rev. 8/2016

Page 42 ends

(e) Special Services. FireEye agrees to use commercially reasonable efforts to respond to any requests by Customer for support services not specifically provided for above. Customer acknowledges that all such services provided by FireEye shall be at FireEye's discretion and then-current fees and policies.

3. CUSTOMER RESPONSIBILITIES.

3.1 Requesting Support Services. When requesting Support Services from FireEye under this Agreement, Customer should have the following information available to provide to FireEye, if requested: (i) detailed problem description, including operating system (“OS”) version, Product model and serial number(s), of the affected Product, and a detailed description of the troubleshooting that has already been done to try to resolve the problem; (ii) detailed system log files; (iii) configuration and login details to allow FireEye access as needed to the Products via the Internet for the purpose of providing support services and permissions needed in order for FireEye to conduct such remote access; (iv) a detailed description of changes to the environment; and (v) Customer’s unique ID, Account ID, the serial number(s) of the Product(s) covered by this Agreement or other unique customer identifier as assigned to Customer by FireEye. Customer acknowledges and agrees that failure to have any or all information or access available as needed by FireEye in order to provide the Support Services may result in delays in FireEye’s response, may hinder FireEye’s ability to perform the Support Services and/or may cause incorrect Support Program fulfillment. FireEye will not be responsible for any such delays and inability to perform due to causes not due to FireEye.

3.2 Customer Assistance. Customer agrees to: (i) ensure that their site complies with any and all applicable FireEye published system environmental specifications; (ii) follow FireEye’s procedures when requesting Support Services; (iii) provide FireEye reasonable access to all necessary personnel to answer questions or resolve problems reported by Customer regarding the Products; (iv) promptly implement all Updates and error corrections provided by FireEye under this Agreement; (v) maintain FireEye supported versions of required third party software, if any; and (v) notify FireEye promptly of any relocation of the Products from the location to which the Products were originally shipped. Customer agrees to use reasonable efforts to resolve internally any support questions prior to requesting Support Services pursuant to this Agreement. During the Support Term, FireEye may obtain information regarding Customer’s email communication and Customer agrees that, as a condition to FireEye’s provision of Support Services, FireEye may use statistical data generated regarding Customer’s email correspondence with customer support so long as the source or content of the emails is not being disclosed.

3.3 Contact People. Customer shall appoint the specified number of individuals (depending upon the Support Program purchased) within Customer's organization to serve as contacts between Customer and FireEye and to receive support through FireEye's telephone support center. Customer’s contacts shall have been adequately trained on the Products and shall have sufficient technical expertise, training and experience. All of Customer's support inquiries shall be initiated through these contacts.

4. EXCLUSIONS. Notwithstanding anything else contained in this Agreement to the contrary, FireEye shall have no obligation or responsibility to provide any Support Services relating to problems arising out of or related to (i) Customer's failure to implement all Updates to the Product which are made available to Customer under this Agreement; (ii) the failure to provide a suitable installation environment; (iii) any alteration, modification, enhancement or addition to the Products performed by parties other than FireEye; (iv) use of the Products in a manner, or for a purpose, for which they were not designed; (v) accident, abuse, neglect, unauthorized repair, inadequate maintenance or misuse of the Products; or relocation of the Products (including without limitation damage caused by use of other than FireEye shipping containers), (vi) operation of the Products outside of environmental specifications; (vii) interconnection of the Products with other products not supplied by FireEye; (viii) use of the Products on any systems other than the specified hardware platform for such Products; or (ix) introduction of data into any database used by the Products by any means other than the use of the software associated with the Products. Notwithstanding anything else contained in this Agreement to the contrary, FireEye will support all generally available ("GA") versions of the FireEye OS, for a minimum of one (1) year from GA release date, regardless of the number of supported OS GA versions. FireEye will also support the two (2) most current OS GA versions, regardless of the elapsed time from GA release date. If available, and at FireEye’s sole discretion, support for any other OS versions or for other problems not covered under this Agreement may be obtained at FireEye's then-current fees and policies for such services. FireEye’s complete end of life policy can be found at http://www.fireeye.com/support/supported-products.html

5. LAPSED SUPPORT AND UPGRADED SUPPORT.

Page 883355 ends

Confidential FireEye Rev. 8/2016

Page 43 ends

5.1 Lapsed Support. After any lapse of Support Services, the parties subsequently may elect to reinstate such Support Services for Products for which the Support Services lapsed pursuant to the terms and conditions set forth in this Agreement; provided, however, that (i) Customer agrees to pay for the period of time that has lapsed as well as any renewal term, and (ii) such Products must be in good working condition, as solely determined by FireEye or its designee.

5.2 Support Program Upgrade. At any time during the Term, Customer may upgrade to FireEye's next level of Support Program by (i) notifying FireEye of Customer's desire to upgrade; (ii) acknowledging in writing the thencurrent terms and conditions for the relevant Support Program; and (iii) paying FireEye the additional Support Fee owed in connection with such upgraded Support Program.

Page 883366 ends

v9/23/2015
Exhibit A
Product Passthrough Terms – Google Apps for Work (for Customers) Customer has entered into a certain written agreement (the “Agreement”) pursuant to which Customer has purchased the right to access and use the Product. These Product Passthrough Terms set forth the terms and conditions under which Customer may access and use such Product.

1. Product.

1.1 Facilities and Data Transfer. All facilities used to store and process Customer Data will adhereto reasonable security standards no less protective than the security standards at facilities where Provider stores and processes its own information of a similar type. Provider has implemented at leastindustry standard systems and procedures to ensure the security and confidentiality of Customer Data,protect against anticipated threats or hazards to the security or integrity of Customer Data, and protectagainst unauthorized access to or use of Customer Data. As part of providing the Product, Provider maytransfer, store and process Customer Data in the United States or any other country in which Provider or its agents maintain facilities. By using the Product, Customer consents to this transfer, processing and storageof Customer Data.

1.2 Modifications.
a. To the Product. Provider may make commercially reasonable changes to the Product, from timeto time. If Provider makes a material change to the Product, Customer may be informed of suchchange, provided that Customer has subscribed with Provider to be informed about such change. b. To URL Terms. Provider may make commercially reasonable changes to the URL Terms from timeto time. If Provider makes a material change to the URL Terms, Customer may be informed ofsuch change through the Notification Email Address or via the Admin Console. If the change has amaterial adverse impact on Customer and Customer does not agree to the change, Customer must sonotify Partner or Provider via the Help Center within thirty days after receiving notice of the change. Upon such notification, Customer will remain governed by the URL Terms in effect immediately prior to the change until the end of the then-current term for the affected Product. If the affected Product is renewed, they will be renewed under Provider’s then current URL Terms.

1.3 Customer Domain Name Ownership. Prior to providing the Product, Provider or Partner may verify that Customer owns or controls the Customer Domain Names. If Customer does not own, or control, the Customer Domain Names, then Provider will have no obligation to provide Customer with the Product.

1.4 Federal Information Security Management Act (FISMA). The Provider’s Product known as “GoogleApps Core Services” received a FISMA “Authorization to Operate” for a Moderate impact system. Provider will continue to maintain a System Security Plan (SSP) for the Google Apps Core Services, based on NIST 800- 53 Rev. 3, or a similarly applicable standard. If Provider does not maintain this SSP as stated, Customer’s sole and exclusive remedy, and Provider’s entire liability, will be Customer’s ability to terminate use of the Product upon thirty days prior written notice.

2. Customer Obligations.

2.1 Compliance. Customer will use the Product in accordance with the Acceptable Use Policy. Provider may make new applications, features or functionality for the Product available from time to time, the use of which may be contingent upon Customer’s agreement to additional terms. In addition, Provider will makeother Non-Google Apps Products (beyond the Product) available to Customer and its End Users inaccordance with the Non-Google Apps Product Terms and the applicable product-specific Provider terms of service. If Customer does not desire to enable any of the Non-Google Apps Products, Customer can enable or disable them at any time through the Admin Console.

2.2 Customer Administration of the Product. Customer may specify one or more Administrators throughthe Admin Console who will have the rights to access Admin Account(s) and to administer the End User Accounts. Customer and Partner are responsible for: (a) maintaining the confidentiality of the password and Admin Account(s); (b) designating those individuals who are authorized to access the Admin Account(s); and (c) ensuring that all activities that occur in connection with the Admin Account(s) comply withthese

Page 883377 ends

v9/23/2015
Product Passthrough Terms. Customer agrees that Provider’s responsibilities do not extend to theinternal management or administration of the Product for Customer and that Provider is merely adata-processor.

2.3 End User Consent. Customer’s Administrators may have the ability to access, monitor, use, or disclose data available to End Users within the End User Accounts. Customer will obtain and maintain all required consents from End Users to allow: (i) Customer’s access, monitoring, use and disclosure of this dataand Provider providing Customer with the ability to do so, and (ii) Provider to provide theProduct.

2.4 Unauthorized Use. Customer will use commercially reasonable efforts to prevent unauthorized use of the Product, and to terminate any unauthorized use. Customer or Reseller will promptly notify Provider of any unauthorized use of, or access to, the Product of which it becomes aware.

2.5 Restrictions on Use. Unless Provider specifically agrees in writing, Customer will not, and will use commercially reasonable efforts to make sure a third party does not: (a) sell, resell, lease, or the functional equivalent, the Product to a third party (unless expressly authorized in these Product Pasthrough Terms); (b) attempt to reverse engineer the Product or any component; (c) attempt to create a substitute orsimilar service through use of, or access to, the Product; (d) use the Product for High Risk Activities; or (e) usethe Product to store or transfer any Customer Data that is controlled for export under Export ControlLaws.

Customer is solely responsible for any applicable compliance with HIPAA.

2.6 Third Party Requests. Customer is responsible for responding to Third Party Requests. Provider will, tothe extent allowed by law and by the terms of the Third Party Request: (a) promptly notify Customer of its receipt of a Third Party Request; (b) comply with Customer’s reasonable requests regarding its efforts to oppose a Third Party Request; and (c) provide Customer with the information or tools required for Customer to respond to the Third Party Request. Customer will first seek to obtain the information required to respond to the Third Party Request on its own, and will contact Provider only if it cannot reasonably obtainsuch information.

3. Technical Support Services.

3.1 By Customer. Customer or Partner will, at its own expense, respond to questions and complaints from End Users or third parties relating to Customer’s or End Users’ use of the Product. Customer or Partner will use commercially reasonable efforts to resolve support issues before escalating them to Provider.

3.2 By Provider. If Customer or Partner cannot resolve a support issue consistent with the above, then Customer or Partner (as applicable based on the agreement between Provider and Partner) may escalate the issue to Provider in accordance with the TSS Guidelines. Provider will provide TSS to Customeror Partner (as applicable) in accordance with the TSS Guidelines.

4. Suspension.

4.1 Of End User Accounts by Provider. If Provider becomes aware of an End User’s violation of theseProduct Passthrough Terms, then Provider may specifically request that Customer Suspend the applicable EndUser Account. If Customer fails to comply with Provider’s request to Suspend an End User Account, then Provider may do so. The duration of any Suspension by Provider will be until the applicable End User has cured the breach which caused the Suspension.

4.2 Emergency Security Issues. Notwithstanding the foregoing, if there is an Emergency Security Issue,then Provider may automatically Suspend the offending use. Suspension will be to the minimum extent and of the minimum duration required to prevent or terminate the Emergency Security Issue. If Provider Suspends an End User Account for any reason without prior notice to Customer, at Customer’s request, Providerwill provide Customer the reason for the Suspension as soon as is reasonably possible.

5. Confidential Information.

5.1 Obligations. Customer and Provider will: (a) protect the other’s Confidential Information with thesame standard of care it uses to protect its own Confidential Information; and (b) not disclose theConfidential Information, except to Affiliates, employees and agents who need to know it and who have agreed in writing to keep it confidential. Customer and Provider (and any Affiliates, employees and agents to whom ithas disclosed Confidential Information) may use Confidential Information only to exercise rights and fulfill its obligations under these Product Passthrough Terms, while using reasonable care to protect it. Customer

Page 883388 ends

v9/23/2015
and Provider, respectively, will be responsible for any actions of its Affiliates, employees and agents in violation of this Section.

5.2 Exceptions. Confidential Information does not include information that: (a) the recipient of the Confidential Information already knew; (b) becomes public through no fault of the recipient; (c) was independently developed by the recipient; or (d) was rightfully given to the recipient by a third party.

5.3 Required Disclosure. Customer and Provider may disclose the other’s Confidential Information when required by law but only after it, if legally permissible: (a) uses commercially reasonable efforts to notify the other; and (b) gives the other the chance to challenge the disclosure.

6. Intellectual Property Rights; Brand Features.

6.1 Intellectual Property Rights. Except as expressly set forth herein, these Product Passthrough Terms does not grant either Customer or Provider any rights, implied or otherwise, to the other’s content or any of the other’s intellectual property. As between the Customer and Provider, Customer owns all Intellectual Property Rights in Customer Data, and Provider owns all Intellectual Property Rights in theProduct.

6.2 Display of Brand Features. Provider may display those Customer Brand Features authorized byCustomer (such authorization is provided by Customer uploading its Brand Features into the Product), andwithin designated areas of the Service Pages. Customer may specify the nature of this use using theAdmin Console. Provider may also display Provider Brand Features on the Service Pages to indicate thatthe Product are provided by Provider. Neither party may display or use the other party’s Brand Features beyond what is allowed in these Product Passthrough Terms without the other’s prior written consent.

6.3 Brand Features Limitation. Any use of Brand Features will inure to the benefit of the entityholding Intellectual Property Rights in those Brand Features. Any right to use its Brand Features pursuant to these Product Passthrough Terms may be revoked at any time with written notice to the other and a reasonable period to stop the use.

7. Publicity. Customer agrees that Provider may include Customer’s name or Brand Features in a list of Provider customers, online or in promotional materials. Customer also agrees that Provider may verbally reference Customer as a customer of the Provider’s Product that is the subject of these Product Passthrough Terms.

8. Representations, Warranties and Disclaimers.

8.1 Representations and Warranties. Customer and Provider represent that each will comply with all laws and regulations applicable to its provision, or use, of the Product, as applicable (including applicable security breach notification law). Provider warrants that it will provide the Product in accordance with the applicable SLA.

8.2 Disclaimers. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT AS EXPRESSLY

PROVIDED FOR HEREIN, NEITHER PARTY MAKES ANY OTHER WARRANTY OF ANY KIND,

WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR USE AND NONINFRINGEMENT.

PROVIDER MAKES NO REPRESENTATIONS ABOUT ANY CONTENT OR INFORMATION MADE ACCESSIBLE BY OR THROUGH THE PRODUCT. CUSTOMER ACKNOWLEDGES THAT THE

PRODUCT IS NOT A TELEPHONY SERVICE AND THAT THE PRODUCT IS NOT CAPABLE OF

PLACING OR RECEIVING ANY CALLS, INCLUDING EMERGENCY PRODUCT CALLS, OVER PUBLICLY SWITCHED TELEPHONE NETWORKS.

9. Term and Termination.

9.1 Term. The term for the Product will be as decided upon between Partner and Customer. These Product Passthrough Terms will remain in effect for the Term.

9.2 Termination for Breach. The Services may be suspended or terminated, if: (i) Customer is in material breach of these Product Passthrough Terms and fails to cure that breach within thirty days after receipt ofwritten notice; (ii) Customer ceases its business operations or becomes subject to insolvency proceedings andthe proceedings are not dismissed within ninety days; or (iii) Customer is in material breach of these Product Passthrough Terms more than two times notwithstanding any cure of such breaches.

Page 883399 ends

v9/23/2015

9.3 Effects of Termination. If Services are terminated, then: (i) the rights granted by Provider to Customer,and Customer to Provider will cease immediately (except as set forth in this Section); (ii) neither Customernor Partner will have access to, or the ability to export, the Customer Data; (iii) Provider will begin todelete Customer Data; and (iv) upon request will promptly use commercially reasonable efforts to return or destroy all other Confidential Information of the other.

10. Miscellaneous.

10.1 Product Development. The Product was developed solely at private expense and is commercial computer software and related documentation within the meaning of the applicable civilian and militaryfederal acquisition regulations and any supplements thereto.

10.2 Force Majeure. Due to circumstances beyond Provider’s controls, Provider may not be able to provide the Product.

10.3 No Waiver. Failure to enforce any provision of these Product Passthrough Terms will not constitute a waiver.

10.4 No Agency. These Product Passthrough Terms do not create any agency, partnership or jointventure.

10.5 No Third-Party Beneficiaries. There are no third-party beneficiaries to these Product PassthroughTerms.

Customer’s sole remedies will be set forth in its agreement with the Partner.

10.6 Survival. The following sections will survive expiration or termination of these Product PassthroughTerms:

Sections 5, 6, 9.3, 10 and 12.

10.7 Severability. If any term (or part of a term) of these Product Passthrough Terms is invalid, illegal, or unenforceable, the rest of these Product Passthrough Terms will remain in effect.

10.8 Conflicting Terms. If there is a conflict between any terms of these Product Passthrough Terms and any other document that makes up the entire agreement as needed for Customer to use the Product,the terms of these Product Passthrough Terms will take precedence.

11. Additional Product Terms.

11.1 Ads. Provider does not serve Ads in the Product or use Customer Data for Ads purposes.

11.2 Aliases. Customer is solely responsible for monitoring, responding to, and otherwise processing emails sent to the “abuse” and “postmaster” aliases for Customer Domain Names but Provider maymonitor emails sent to these aliases for Customer Domain Names to allow Provider to identify Productabuse.

11.3 Google Apps Vault Retention. If Customer is using Google Apps Vault, Provider will have no obligation to retain any archived Customer Data beyond the retention period specified by Customer. If Customerdoes not renew Google Apps Vault, Provider will have no obligation to retain any archived CustomerData.

12. Definitions.
“Acceptable Use Policy” means the acceptable use policy for the Product available at http://www.google.com/a/help/intl/en/admins/use policy.html. The Acceptable Use Policy and such URLlink may be updated or modified by Provider from time to time. “Admin Account(s)” means the administrative account(s) provided to Customer for the purpose of administering the Product. The use of the Admin Account(s) requires a password, which Provider will provide to Customer or Partner.
“Admin Console” means the online tool Customer may use in reporting and certain other administration functions.
“Administrators” mean the Customer-designated technical personnel who administer the Product to End Users on Customer’s behalf.

Page 884400 ends

v9/23/2015
“Ads” means online advertisements displayed by Provider to End Users, excluding advertisements provided by any advertising products that are not part of the Product that Customer chooses to use in connection with the Product.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with an entity.
“Brand Features” means the trade names, trademarks, service marks, logos, domain names, and other distinctive brand features of each party, respectively, as secured from time totime. “Confidential Information” means information disclosed or exchanged under these Product PassthroughTerms that is marked as confidential or would normally be considered confidential under the circumstances. Customer Data is Customer’s Confidential Information.
“Customer Data” means data, including email, provided, generated, transmitted or displayed via the Product by Customer, End Users, or Partner on behalf of Customer.
“Customer Domain Names” mean the domain names owned or controlled by Customer, which will be usedin connection with the Product.
“Emergency Security Issue” means either: (a) Customer’s use of the Product in violation of the AcceptableUse Policy, which could disrupt: (i) the Product; (ii) other customers’ use of the Product; or (iii) the Providernetwork or servers used to provide the Product; or (b) unauthorized third party access to the Product. “End Users” means the individuals Customer permits to use the Product. “End User Account” means a Provider-hosted account established by Customer through the Product for anEnd User.
“Export Control Laws” means all applicable export and reexport control laws and regulations, including trade and economic sanctions maintained by the Treasury Department’s Office of Foreign Assets Control, and the International Traffic in Arms Regulations (“ITAR”) maintained by the Department ofState. “Google Apps Core Services” means the applicable Product purchased by Customer from Partner whichare more fully described here: http://www.google.com/a/help/intl/en/users/user features.html. The GoogleApps Core Services and such URL link may be updated or modified by Provider from time to time. “Help Center” means the Provider help center accessible at http://www.google.com/support/. The HelpCenter and such URL link may be updated or modified by Provider from time totime. “High Risk Activities” means uses such as the operation of nuclear facilities, air traffic control, or lifesupport systems, where the use or failure of the Product could lead to death, personal injury, or environmental damage. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, as may be amended fromtime to time, and any regulations issued thereunder.
“Intellectual Property Rights” means current and future worldwide rights under patent law, copyright law, trade secret law, trademark law, moral rights law, and other similarrights. “Non-Google Apps Products” means Provider products which are not part of the Product, but which may be accessed by End Users using their End User Account login and password. The Non-Google Apps Productsare set forth at the following URL: http://www.google.com/support/a/bin/answer.py?hl=en&answer=181865. The Non-Google Apps Products and such URL link may be updated or modified by Provider from time totime. “Non-Google Apps Product Terms” means the terms found at the following URL:
http://www.google.com/apps/intl/en/terms/additional services.html. The Non-Google Apps Product Termsand such URL link may be updated or modified by Provider from time totime. “Notification Email Address” means the email address designated by Customer to receive emailnotifications from Provider. Customer may provide a Partner email address for this purpose if it so chooses. Customer may change this email address through the AdminConsole.

Page 884411 ends

v9/23/2015
“Provider” means the third party provider of the Product. “Partner” means the entity Customer is paying to provide access to and use of the Product. “Service Pages” mean the web pages displaying the Product to EndUsers. “Product” means, as applicable, the Google Apps Core Services purchased from Partner. “SLA” means the Service Level Agreement located here for applicable Google Apps Core Services:
http://www.google.com/apps/intl/en/terms/reseller sla.html. The SLA and such URL link may be updated or modified by Provider from time to time.
“Suspend” means the immediate disabling of access to the Product, or components of the Product, as applicable, to prevent further use of theProduct.
“Term” means the term of these Product Passthrough Terms, which will continue for as long as Customeris receiving Product from Provider, unless terminated earlier pursuant to these Product Passthrough Terms, or pursuant to Customer’s agreement with Partner.
“Third Party Request” means a request from a third party for records relating to an End User’s use of the Product. Third Party Requests can be a lawful search warrant, court order, subpoena, other valid legal order, or written consent from the End User permitting the disclosure. “TSS” means the technical support Product provided by Provider to the Administrators during the Term pursuant to the TSS Guidelines.
“TSS Guidelines” means Provider’s technical support Product guidelines then in effect for the Product. TSS Guidelines are at the following URL: http://www.google.com/a/help/intl/en/admins/tssg.html. The TSSGuidelines and such URL link may be updated or modified by Provider from time totime. “URL Terms” means the Acceptable Use Policy, the SLA and the TSSGuidelines.

Page 884422 ends

SALESFORCE Service Terms
"AppExchange" means the online directory of on-demand applications that work with the Service, located at http://www.appexchange.com or at any successor websites. "Service" means the online, Web-based application provided by Salesforce.com (sometimes referred to as “SFDC”) via http://www.salesforce.com and/or other designated websites, including associated offline components but excluding AppExchange applications.
“Third-Party Applications” means online, Web-based applications and offline software products that are provided by third parties, interoperate with the Service, and are identified as third-party applications, including but not limited to those listed on the AppExchange. “User Guide” means the online user guide for the Services, accessible via http://www.salesforce.com, as updated from time to time.
"Users" means Your employees, representatives, consultants, contractors or agents who are authorized to use the Service and have been supplied user identifications and passwords by You (or by Salesforce.com or Your reseller at Your request).
“You” and “Your” means the customer entity which has contracted to purchase subscriptions to use the Service subject to the conditions of these SFDC Service Terms. "Your Data" means all electronic data or information submitted by You to the Service.

1. Use of Service
(a) User subscriptions cannot be shared or used by more than one User (but may be reassigned from time to time to new Users who are replacing former Users who have terminated employment with You or otherwise changed job status or function and no longer require use of the Service).
(b) You (i) are responsible for all activities occurring under Your User accounts; (ii) are responsible for the content of all Your Data; (iii) shall use commercially reasonable efforts to prevent unauthorized access to, or use of, the Service, and shall notify Your reseller or Salesforce.com promptly of any such unauthorized use You become aware of; and (iv) shall comply with all applicable federal laws and regulations in using the Service.
(c) You shall use the Service solely for Your internal business purposes and shall not: (i) license, sublicense, sell, resell, rent, lease, transfer, assign, distribute, time share or otherwise commercially exploit or make the Service available to any third party, other than to Users or as otherwise contemplated by these SFDC Service Terms; (ii) send spam or otherwise duplicative or unsolicited messages in violation of applicable laws; (iii) send or store infringing, obscene, threatening, libelous, or otherwise unlawful or tortious material, including material that is harmful to children or violates third party privacy rights; (iv)send or store viruses, worms, time bombs, Trojan horses and other harmful or malicious code, files, scripts, agents or programs; (v) interfere with or disrupt the integrity or performance of the Service or the data contained therein; or (vi) attempt to gain unauthorized access to the Service or its related systems or networks.

Page 884433 ends

(d) You shall not (i) modify, copy or create derivative works based on the Service; (ii) frame or mirror any content forming part of the Service, other than on Your own intranets or otherwise for its own internal business purposes; (iii) reverse engineer the Service; or (iv) access the Service in order to (A) build a competitive product or service, or (B) copy any ideas, features, functions or graphics of the Service.

2. Service Provision. Salesforce.com will use commercially reasonable efforts to make the Services available 24 hours a day, 7 days a week, except for: (a) planned downtime (of which SFDC shall give at least 8 hours notice via the Services and which SFDC shall schedule to the extent practicable during the weekend hours from 6:00 p.m. Pacific time Friday to 3:00 a.m. Pacific time Monday), or (b) any unavailability caused by circumstances beyond SFDC’s reasonable control, including without limitation, acts of God, acts of government, flood, fire, earthquakes, civil unrest, acts of terror, strikes or other labor problems (other than those involving SFDC employees), or Internet service provider failures or delays.

Salesforce.com will provide the Services only in accordance with applicable laws and government regulations.

3. Acquisition of Third-Party Products and Services. Any acquisition by You of third-party products or services, including but not limited to Third-Party Applications and implementation, customization and other consulting services, and any exchange of data between You and any thirdparty provider, is solely between You and the applicable third-party provider. Salesforce.com does not warrant or support third-party products or services, whether or not they are designated by Salesforce.com as “certified” or otherwise. No purchase of third-party products or services is required to use the Service as provided by Salesforce.com.

4. Third-Party Applications and Your Data. If You install or enable Third-Party Applications for use with the Service, You acknowledge that Salesforce.com may allow providers of those ThirdParty Applications to access You Data as required for the interoperation of such Third Party Applications with the Service. Salesforce.com shall not be responsible for any disclosure, modification or deletion of You Data resulting from any such access by Third-Party Application providers. The Service shall allow You to restrict such access by restricting Users from installing or enabling such Third-Party Applications for use with the Service.

5. Google Services. Service features that interoperate with Google services depend on the continuing availability of the Google application programming interface (“API”) and program for use with the Service. If Google Inc. ceases to make the Google API or program available on reasonable terms for the Service, Salesforce.com may cease providing such Service features without entitling You to any refund, credit, or other compensation.

6. Proprietary Rights. Subject to the limited rights expressly granted hereunder, Salesforce.com reserves all rights, title and interest in and to the Service, including all related intellectual property rights. The Service is deemed Salesforce.com confidential information, and You will not use it or disclose it to any third party except as permitted in these SFDC Service Terms and except as required by law, upon notice to Salesforce.com.

7. Your Data. As between Salesforce.com and You, You exclusively own all rights, title and interest in and to all of Your Data. Your Data is deemed your confidential information, and Salesforce.com shall not access Your User accounts, including Your Data, except to respond to service or technical problems or at your request.

8. Compelled Disclosure. If either You or Salesforce.com is compelled by law to disclose confidential information of the other party, it shall provide the other party with prior notice of such

Page 884444 ends

compelled disclosure (to the extent legally permitted) and reasonable assistance, at the other party’s cost, if the other party wishes to contest the disclosure.

9. Suggestions You agree that Salesforce.com shall have a royalty-free, worldwide, transferable, sublicenseable, irrevocable, perpetual license to use or incorporate into the Service any suggestions, enhancement requests, recommendations or other feedback provided by You or Your Users relating to the operation of the Service.

10. Fees. Contracted for fees for use of the Service represent a firm commitment and the number of User subscriptions contracted for cannot be reduced in the middle of a subscription term.

11. Termination. The master contract governs your termination (FAR 52.212-4(l) & (m)) and cancellation rights with the contractor, and the contract requires continued performance while any disputes are resolved (FAR 52.233-1(i)).

12. Data Storage. You are entitled to a cumulative amount of storage per User subscription for no additional charge as set forth in the User Guide for the Service subscription type purchased. You may purchase additional storage if necessary, and you may contact Your reseller for then-current rates listed in master contract price list.

13. Support. SFDC will provide You with basic support as described from time to time by SFDC at www.salesforce.com. In the event that You have purchased an upgraded support package, then upgraded support contact information will be provided to You together with your initial account set up information.

14. No Warranty. SALESFORCE.COM MAKES NO WARRANTIES OF ANY KIND,

WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE REGARDING

THE SERVICE AND/OR SUPPORT, AND SPECIFICALLY DISCLAIMS ALL

IMPLIED WARRANTIES, INCLUDING ANY WARRANTIES OF

MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW. IN THE EVENT

THAT YOUR AGREEMENT WITH YOUR RESELLER PROVIDES ANY

WARRANTIES WITH RESPECT TO THE SERVICE AND/OR SUPPORT, SUCH WARRANTIES ARE SOLELY BETWEEN YOU AND YOUR RESELLER. This clause does not disclaim any warranties expressly provided in a contract with the U.S.

Government.”

15. No Liability. IN NO EVENT SHALL SALESFORCE.COM HAVE ANY LIABILITY TO YOU

OR ANY USER FOR ANY DAMAGES WHATSOVER, INCLUDING BUT NOT LIMITED TO

DIRECT, INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL

DAMAGES, OR DAMAGES BASED ON LOST PROFITS, HOWEVER CAUSED AND,

WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, WHETHER OR NOT EITHER YOU OR SALESFORCE.COM HAVE BEEN ADVISED OF THE POSSIBILI TY OF SUCH DAMAGES. This clause shall not impair the

Page 884455 ends

U.S. Government’s right to recover for fraud or crimes arising out of or related to this Contract under any federal fraud statute, including the False Claims Act, 31 U.S.C. §§ 3729-3733. Furthermore, this clause shall not impair nor prejudice the U.S.

Government’s right to EXPRESS remedies provided in the Contract (i.e. clause 552.238- 72 – Price Reductions, clause 52.212-4(h) – Patent Indemnification, Liability for Injury or Damage (Section 3 of the Price List), and GSAR 552.215-72 – Price Adjustment – Failure to Provide Accurate Information).

16. Further Contact. Salesforce.com may contact you regarding new Salesforce.com service features and offerings.

17. Third Party Beneficiary. SFDC shall be a third party beneficiary to the agreement between You and Reseller solely as it relates to these SFDC Service Terms.

Page 884466 ends

SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
1 SOFTWARE LICENSE AND SUPPORT AGREEMENT
General Terms and Conditions
("GTC")

1. DEFINITIONS.

1.1 “Add-on” means any development using SAP API’s that adds new and independent functionality, but does not modify existing SAP functionality.

1.2 “Agreement” means these GTCs, any Order Form referencing these GTCs, and the Use Terms and Schedules referenced by these GTCs and/or such Order Forms. All such components are integral to the agreement, and collectively are referred to herein as the “Agreement”.

1.3 “API” means SAP’s application programming interfaces, as well as other SAP code that allow other software products to communicate with or call on SAP Software (for example, SAP Enterprise Services, BAPIs, Idocs, RFCs and ABAP or other user exits) provided under this Agreement.

1.4 “Affiliate” mean any legal entity in the Territory in which the Licensee, directly or indirectly, holds more than fifty percent (50%) of the shares or voting rights. Any such legal entity shall be considered an Affiliate for only such time as such equity interest is maintained.

1.5 “Business Partner” means a legal entity that requires access to the Software in connection with Licensee’s internal business operations, such as customers, distributors and/or suppliers of Licensee.

1.6 "Confidential Information" means, with respect to SAP, all information which SAP protects against unrestricted disclosure to others, including but not limited to: (a) the Software and Documentation and other SAP Materials, including without limitation the following information regarding the Software: (i) computer software (object and source codes), programming techniques and programming concepts, methods of processing, system designs embodied in the Software; (ii) benchmark results, manuals, program listings, data structures, flow charts, logic diagrams, functional specifications, file formats; and (iii) discoveries, inventions, concepts, designs, flow charts, documentation, product specifications, application program interface specifications, techniques and processes relating to the Software; (b) the research and development or investigations of SAP; (c) product offerings, content partners, product pricing, product availability, technical drawings, algorithms, processes, ideas, techniques, formulas, data, schematics, trade secrets, know-how, improvements, marketing plans, forecasts and strategies; and (d) any information about or concerning any third party (which information was provided to SAP subject to an applicable confidentiality obligation to such third party). With respect to Licensee, “Confidential Information” means all information which Licensee protects against unrestricted disclosure to others and which (i) if in tangible form, Licensee clearly identifies as confidential or proprietary at the time of disclosure; and (ii) if in intangible form (including disclosure made orally or visually), Licensee identifies as confidential at the time of disclosure, summarizes the Confidential Information in writing, and delivers such summary within thirty (30) calendar days of any such disclosure.

1.7 "Documentation" means SAP's documentation which is delivered or made available to Licensee with the Software under this Agreement.

1.8 “Intellectual Property Rights” means patents of any type, design rights, utility models or other similar invention rights, copyrights, mask work rights, trade secret or confidentiality rights, trademarks, trade names and service marks and any other intangible property rights, including applications and registrations for any of the foregoing, in any country, arising under statutory or common law or by contract and whether or not perfected, now existing or hereafter filed, issued, or acquired.

1.9 "Modification" means (i) a change to the delivered source code or metadata; or (ii) any development, other than a change to the delivered source code or metadata, that customizes, enhances, or changes existing functionality of the Software including, but not limited to, the creation of any new application program interfaces, alternative user interfaces or the extension of SAP data structures; or (iii) any other change to the Software (other than an Add-on) utilizing or incorporating any SAP Materials (defined below).

1.10 “Professional Services Schedule” means the terms and conditions governing SAP’s delivery of professional services, attached hereto and made a part hereof.

1.11 “SAP Materials” means any software, programs, tools, systems, data, or other materials made available by SAP to Licensee in the course of the performance under this Agreement including, but not limited to, the Software and Documentation, as well as any information, materials or feedback provided by Licensee to SAP relating to the Software and Documentation.

1.12 “SAP Support” means SAP’s then-current SAP support offering specified in the applicable Order Forms and made available to Licensee as stated in the applicable SAP Support Schedule found at www.sap.com/company/legal/index.epx as of the effective date of the first Software Order Form issued under these GTCs. Such SAP Support Schedule is incorporated herein by reference. For the avoidance of doubt, such SAP Support Schedule shall apply to all Order Forms issued under these GTCs, unless otherwise agreed by the parties. SAP recommends Licensee prints a copy of the applicable SAP Support Schedule for Licensee’s own records.

1.13 "Software" means (i) any and all software products licensed to Licensee under this Agreement as specified in Software Order Forms hereto, all as developed by or for SAP, SAP AG, Business Objects Software Limited and/or any of their affiliated companies and delivered to Licensee hereunder; (ii) any new releases thereof made available through unrestricted shipment pursuant to the respective support agreement and (iii) any complete or partial copies of any of the foregoing.

1.14 “Software Order Form” means the order form for the Software and related SAP Support ordered by Licensee thereunder, including information on Software, SAP Support, fees, and other information necessary for the delivery of such items to Licensee.

Page 884477 ends

SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
2 The Software Order Form does not include fees for professional services, which shall be billed under separate statements of work in accord with the Professional Services Schedule.

1.15 "Territory" means the world except for those countries prohibited by United States’ export laws, and further subject to Section

12.4 of the GTC.

1.16 “Third Party Software” means (i) any and all software products and content licensed to Licensee under this Agreement as specified in Software Order Forms hereto, all as developed by companies other than SAP, SAP AG, Business Objects Software Limited and/or any of their affiliated companies and delivered to Licensee hereunder; (ii) any new releases thereof made available through unrestricted shipment pursuant to the respective SAP Support Schedule and (iii) any complete or partial copies of any of the foregoing.

1.17 "Use" means to activate the processing capabilities of the Software, load, execute, access, employ the Software, or display information resulting from such capabilities.

1.18 “Use Terms” means, with regard to Software specified in a Software Order Form, the SAP Software Use Rights document current at the time of execution of such Software Order Form, copies of which are found at www.sap.com/company/legal/index.epx and made a part hereof. Such SAP Software Use Rights documents are incorporated herein by reference. SAP recommends Licensee prints copies of the applicable SAP Software Use Rights documents for Licensee’s own records

2. LICENSE GRANT.

2.1 License.

2.1.1 Subject to Licensee’s compliance with all the terms and conditions of this Agreement, SAP grants to Licensee a nonexclusive, perpetual (except for subscription based or term licenses) license to Use the Software, Documentation, and other SAP Materials at specified site(s) within the Territory to run Licensee’s and its Affiliates’ internal business operations (including customer back-up and passive disaster recovery) and to provide internal training and testing for such internal business operations and as further set forth in the Software Order Form, unless terminated in accordance with Section 5 herein. This license does not permit Licensee (without being limited specifically to such restrictions) to: (i) use the SAP Materials to provide services to third parties (e.g., business process outsourcing, service bureau applications or third party training) other than to Affiliates (subject to Section 2.2); (ii) lease, loan, resell, sublicense or otherwise distribute the SAP Materials, other than distribution to Affiliates (subject to Section 2.2); (iii) make any Use of or perform any acts with respect to the SAP Materials other than as expressly permitted in accordance with the terms of this Agreement; or (iv) use Software components other than those specifically identified in the Software Order Form, even if it is also technically possible for Licensee to access other Software components. Business Partners may Use the Software only through screen access and solely in conjunction with Licensee’s Use and may not Use the Software to run any of Business Partners’ business operations.

2.1.2 Licensee agrees to install the Software only on information technology devices (e.g. hard disks or central processing units) identified by Licensee pursuant to this Agreement and that has been previously approved by SAP in writing or otherwise officially made known to the public as appropriate for Use or interoperation with the Software (the “Designated Unit”). Licensee must hold the required licenses as stated herein and in the applicable Order Forms, for any individuals that Use the Software, including employees or agents of Affiliates and Business Partners. Use may occur by way of an interface delivered with or as a part of the Software, a Licensee or third-party interface, or another intermediary system.

2.1.3 The terms and conditions of this Agreement relative to “Software” apply to Third Party Software except as otherwise stated in the Software Use Rights Schedule, a Schedule, an Order Form, or an Amendment.

2.2 Affiliate Use. Affiliates’ Use of the Software, Documentation and other SAP Materials to run their internal business operations as permitted under Section 2.1.1 is subject to the following: (i) the Affiliate agrees to be bound by the terms herein in the form of Schedule A (“Affiliate Use Agreement”) attached hereto; and (ii) a breach of such Affiliate Use Agreement by Affiliate shall be considered a breach by Licensee hereunder. If Licensee has an affiliate or subsidiary with a separate agreement for SAP software licenses and/or support services with SAP AG, any SAP AG affiliate (including SAP) or any other distributor of SAP software, the Software shall not be Used to run such affiliate’s or subsidiary’s business operations and such affiliate or subsidiary shall not receive any support services under this Agreement even if such separate agreement has expired or is terminated, unless otherwise agreed to in writing by the parties.

2.3 Outsourcing Services. With SAP’s prior written consent, Licensee may permit services providers to access the Software solely for the purpose of providing facility, implementation, systems, application management or disaster recovery services to Licensee in connection with the business of Licensee for which the Software is herein licensed provided: (i) Licensee and such services provider execute a written agreement that includes provisions requiring such services provider’s compliance with the terms of this Agreement prior to such access, including without limitation non-disclosure of SAP Confidential Information; (ii) Licensee shall hold the required licenses as stated in the Use Terms for all employees of such services provider authorized to access the Software; (iii) such services provider shall be permitted to Use the Software solely to install and configure the Software in accordance with the business of Licensee as set forth herein (or in the case of a disaster recovery vendor, to provide disaster recovery services only); (iv) under no circumstances may such services provider Use the Software to operate or provide processing services to Licensee or any other party, or in connection with such services provider’s own business operations; (v) Licensee shall be responsible for any additional Software, migration tools, or third party software needed to effect such transition; and (vi) Licensee expressly agrees to indemnify SAP, its officers, employees, agents and subcontractors from and against all claims, liabilities, losses, damages and costs (including reasonable attorney fees) suffered by SAP arising from a breach by the services provider of the conditions of this Agreement. Upon SAP request, Licensee shall provide written confirmation to SAP that items (i)-(iv) are fulfilled.

3. VERIFICATION. SAP shall be permitted to audit (at least once annually and in accordance with SAP standard procedures, which may include on-site and/or remote audit) the usage of the SAP Materials. Licensee shall cooperate reasonably in the conduct of such audits. In the event an audit reveals that (i) Licensee underpaid license fees and/or SAP Support fees to SAP and/or (ii) that Licensee has Used the Software in excess of the license quantities or levels stated in the Software Order Form, Licensee shall pay such underpaid fees and/or for such excess usage based on SAP List of Prices and Conditions Software and Support governing use in effect at the time of the audit, and shall execute an additional Software Order Form in accordance with the terms of this Agreement

Page 884488 ends

SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
3 to affect the required licensing of any additional quantities or levels. Reasonable costs of SAP’s audit shall be paid by Licensee if the audit results indicate usage in excess of the licensed quantities or levels. SAP reserves all rights at law and equity with respect to both Licensee’s underpayment of License fees or SAP Support fees and usage in excess of the license quantities or levels.

4. PRICE, PAYMENT, AND DELIVERY.

4.1 Fees. Licensee shall pay to SAP license fees for the Software and fees for SAP Support on the terms in Software Order Forms hereto. Fees for consulting services will be paid as set forth in the Professional Services Schedule. Any fees not paid when due shall accrue interest at the rate of 18% (eighteen percent) per annum, but not to exceed the maximum amount as allowed by law.

4.2 Taxes. Fees and other charges described in this Agreement do not include federal, state or local sales, foreign withholding, use, property, excise, service, or similar transaction taxes (“Tax(es)”) now or hereafter levied, all of which shall be for Licensee’s account. Any applicable direct pay permits or valid tax-exempt certificates must be provided to SAP prior to the execution of this Agreement. If SAP is required to pay Taxes, Licensee shall reimburse SAP for such amounts. Licensee hereby agrees to indemnify SAP for any Taxes and related costs, interest and penalties paid or payable by SAP.

4.3 Delivery of the Software and SAP Support. SAP will deliver the Software and SAP Support by making it available for electronic download through the SAP ServiceMarketplace (http://service.sap.com/swdc) to Licensee. Risk of loss passes at the time of such electronic delivery. Licensee agrees not to request any physical delivery of Software or SAP Support and should it occur that any such delivery will be rejected by Licensee. Licensee agrees and understands that the calculation of Taxes may be affected by the delivery method and delivery location of the Software and corresponding SAP Support.

5. TERM.

5.1. Term. This Agreement and the license granted hereunder shall become effective as of the date first set forth in the first Software Order Form issued under these GTCs, and shall continue in effect thereafter unless this Agreement is terminated upon the earliest to occur of the following: (i) thirty days after Licensee gives SAP written notice of Licensee's direction to terminate this Agreement, for any reason, but only after payment of all license and SAP Support fees then due and owing; (ii) thirty days after SAP gives Licensee notice of Licensee's material breach of any provision of the Agreement (other than Licensee's breach of its obligations under Sections 6, 10 or 11, which breach shall result in immediate termination), including more than thirty days delinquency in Licensee's payment of any money due hereunder, unless Licensee has cured such breach during such thirty day period; (iii) immediately if Licensee files for bankruptcy, becomes insolvent, or makes an assignment for the benefit of creditors. For the avoidance of any doubt, termination of the Agreement shall strictly apply to all licenses under the Agreement, its appendices, schedules, addenda and order documents and any partial termination of the Agreement by Licensee shall not be permitted in respect of any part of the Agreement, its appendices, schedules, addenda, order documents.

5.2 End of Term Duties. Upon any termination hereunder, Licensee and its Affiliates shall immediately cease Use of all SAP Materials and Confidential Information. Within thirty (30) days after any termination, Licensee shall irretrievably destroy or upon SAP’s request deliver to SAP all copies of the SAP Materials and Confidential Information in every form, except to the extent it is legally required to keep it for a longer period in which case such return or destruction shall occur at the end of such period. Licensee must certify to SAP in writing that it has satisfied its obligations under this Section 5.2. Licensee agrees to certify in writing to SAP that it and each of its Affiliates has performed the foregoing. Sections 3, 4, 5.2, 6, 7.2, 8, 9, 10, 12.4, 12.5, 12.6 and 12.8 shall survive such termination. In the event of any termination hereunder, Licensee shall not be entitled to any refund of any payments made by Licensee. Termination shall not relieve Licensee from its obligation to pay fees that remain unpaid.

6. INTELLECTUAL PROPERTY RIGHTS.

6.1 Reservation of Rights. The SAP Materials, and all Intellectual Property Rights embodied in the foregoing, shall be the sole and exclusive property of SAP, SAP AG (the parent company of SAP) or its or their licensors, subject to any rights expressly granted to Licensee in Section 2 and 6.3 herein. Except for the rights set forth in Section 6.3 herein, Licensee is not permitted to modify or otherwise make derivative works of the Software. Any such unauthorized works developed by Licensee, and any Intellectual Property Rights embodied therein, shall be the sole and exclusive property of SAP or SAP AG.

6.2 Protection of Rights. Licensee shall not copy, translate, disassemble, or decompile, nor create or attempt to create the source code from the object code of the Software in any manner. Reverse engineering of the Software and other SAP Materials is prohibited. Licensee is permitted to back up data in accordance with good information technology practice and for this purpose to create the necessary backup copies of the Software. Backup copies on transportable discs or other data media must be marked as backup copies and bear the same copyright and authorship notice as the original discs or other data media. Licensee must not change or remove SAP’s copyright and authorship notices.

6.3 Modifications/Add-ons.

6.3.1 Conditioned on Licensee’s compliance with the terms and conditions of this Agreement, Licensee may make Modifications and/or Add-ons to the Software in furtherance of its permitted Use under this Agreement, and shall be permitted to use Modifications and Add-ons with the Software in accordance with the License grant to the Software set forth in Section 2.1.1 herein. Licensee shall comply with SAP’s registration procedure prior to making Modifications or Add-ons. All Modifications and all rights associated therewith shall be the exclusive property of SAP and SAP AG. All Add-ons developed by SAP (either independently or jointly with Licensee) and all rights associated therewith shall be the exclusive property of SAP and SAP AG. Licensee agrees to execute those documents reasonably necessary to secure SAP’s rights in the foregoing. All Add-ons developed by or on behalf of Licensee without SAP’s participation (“Licensee Add-on”), and all rights associated therewith, shall be the exclusive property of Licensee subject to SAP’s rights in and to the Software; provided, Licensee shall not commercialize, market, distribute, license, sublicense, transfer, assign or otherwise alienate any such Licensee Add-ons. SAP retains the right to independently develop its own Modifications or Add-ons to the Software, and Licensee agrees not to take any action that would limit SAP’s sale, assignment, licensing or use of its own Software or Modifications or Add-ons thereto.

6.3.2 Any Modification developed by or on behalf of Licensee without SAP’s participation or Licensee Add-on must not (and subject to other limitations set forth herein): enable the bypassing or circumventing any of the restrictions set forth in this Agreementand/or provide Licensee with access to the Software to which Licensee is not directly licensed; nor permit mass data extraction from

Page 884499 ends

SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
4 Software to any non-SAP software, including use, modification saving or other processing of data in the non-SAP software; nor unreasonably impair, degrade or reduce the performance or security of the Software; nor render or provide any information concerning SAP software license terms, Software, or any other information related to SAPproducts.

6.3.3 Licensee covenants, on behalf of itself and its successors and assigns, not to assert against SAP or its affiliated companies, or their resellers, distributors, suppliers, commercial partners and customers, any rights in any Modifications developed by or on behalf of Licensee without SAP participation or Licensee Add-ons , or any other functionality of the SAP Software accessed by such Modification developed by or on behalf of Licensee without SAP participation or Licensee Add-on.

7. PERFORMANCE WARRANTY.

7.1 Warranty. SAP warrants that the Software will substantially conform to the specifications contained in the Documentation for six months following delivery. The warranty shall not apply: (i) if the Software is not used in accordance with the Documentation; or (ii) if the defect is caused by a Modification or Add-on (other than a Modification or Add-on made by SAP and which is provided through SAP Support or under warranty), Licensee or third-party software. SAP does not warrant that the Software will operate uninterrupted or that it will be free from minor defects or errors that do not materially affect such performance, or that the applications contained in the Software are designed to meet all of Licensee's business requirements. Provided Licensee notifies SAP in writing with a specific description of the Software’s nonconformance within the warranty period and SAP validates the existence of such nonconformance, SAP will, at its option: a) repair or replace the nonconforming Software, or b) refund the license fees paid for the applicable nonconforming Software in exchange for a return of such nonconforming Software. This is Licensee’s sole and exclusive remedy under this warranty.

7.2 Express Disclaimer. SAP AND ITS LICENSORS DISCLAIM ALL OTHER WARRANTIES EXPRESS OR IMPLIED, INCLUDING

WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE EXCEPT TO THE EXTENT THAT ANY WARRANTIES IMPLIED BY LAW CANNOT BE VALIDLY WAIVED.

8. INDEMNIFICATION.

8.1 Infringement and Defense of Licensee. SAP shall defend Licensee against claims brought against Licensee in the Territory by any third party alleging that Licensee's Use of the Software, in accordance with the terms and conditions of this Agreement, constitutes a direct infringement or misappropriation of a patent claim(s), copyright or trade secret rights, and SAP will pay damages finally awarded against Licensee (or the amount of any settlement SAP enters into) with respect to such claims. This obligation of SAP shall not apply if the alleged infringement or misappropriation results from Use of the Software in conjunction with any other software, an apparatus other than a Designated Unit, failure to use an update promptly provided by SAP if such infringement or misappropriation could have been avoided by use of the update, or unlicensed activities. This obligation of SAP also shall not apply if Licensee fails to timely notify SAP in writing of any such claim. SAP is permitted to control fully the defense and any settlement of any such claim as long as such settlement shall not include a financial obligation on Licensee. In the event Licensee declines SAP’s proffered defense, or otherwise fails to give full control of the defense to SAP’s designated counsel, then Licensee waives SAP’s obligations under this Section 8.1. Licensee shall cooperate fully in the defense of such claim and may appear, at its own expense, through counsel reasonably acceptable to SAP. SAP expressly reserves the right to cease such defense of any claim(s) in the event the Software is no longer alleged to infringe or misappropriate, or is held not to infringe or misappropriate, the third party’s rights.

SAP may settle or mitigate damages arising from any claim or potential claim, by substituting alternative substantially equivalent non-infringing programs and supporting documentation for the Software. Licensee shall not undertake any action in response to any infringement or misappropriation, or alleged infringement or misappropriation of the Software that is prejudicial to SAP’s rights.

8.2 THE PROVISIONS OF THIS SECTION 8 STATE THE SOLE, EXCLUSIVE, AND ENTIRE LIABILITY OF SAP AND ITS LICENSORS TO

LICENSEE, AND IS LICENSEE'S SOLE REMEDY, WITH RESPECT TO THE INFRINGEMENT OR MISAPPROPRIATION OF THIRD-PARTY INTELLECTUAL PROPERTY RIGHTS.

9. LIMITATIONS OF LIABILITY.

9.1 Not Responsible. SAP and its licensors will not be responsible under this Agreement (i) if the Software is not used in accordance with the Documentation; or (ii) if the defect or liability is caused by Licensee, a Modification or Add-on (other than a Modification or Add-on made by SAP which is provided through SAP Support or under warranty), or third-party software. SAP AND

ITS LICENSORS SHALL NOT BE LIABLE FOR ANY CLAIMS OR DAMAGES ARISING FROM INHERENTLY DANGEROUS USE OF THE SOFTWARE AND/OR THIRD-PARTY SOFTWARE LICENSED HEREUNDER.

9.2 Exclusion of Damages; Limitation of Liability. ANYTHING TO THE CONTRARY HEREIN NOTWITHSTANDING, EXCEPT FOR

DAMAGES RESULTING FROM UNAUTHORIZED USE OR DISCLOSURE OF CONFIDENTIAL INFORMATION OR DEATH OR PERSONAL INJURY ARISING FROM EITHER PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, UNDER NO CIRCUMSTANCES AND

REGARDLESS OF THE NATURE OF ANY CLAIM SHALL SAP, ITS LICENSORS OR LICENSEE BE LIABLE TO EACH OTHER OR ANY OTHER

PERSON OR ENTITY FOR AN AMOUNT OF DAMAGES IN EXCESS OF THE PAID LICENSE FEES FOR THE SOFTWARE DIRECTLY

CAUSING THE DAMAGES OR BE LIABLE IN ANY AMOUNT FOR SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR INDIRECT DAMAGES, LOSS OF GOOD WILL OR BUSINESS PROFITS, WORK STOPPAGE, DATA LOSS, COMPUTER FAILURE OR MALFUNCTION, ATTORNEYS’ FEES, COURT COSTS, INTEREST OR EXEMPLARY OR PUNITIVE DAMAGES. The provisions of this Agreement allocate the risks between SAP and Licensee. The license fees reflect this allocation of risk and the limitations of liability herein.

10. CONFIDENTIALITY.

10.1. Use of Confidential Information. Confidential Information shall not be reproduced in any form except as required to accomplish the intent of this Agreement. Any reproduction of any Confidential Information of the other shall remain the property of the disclosing party and shall contain any and all confidential or proprietary notices or legends which appear on the original. With respect to the Confidential Information of the other, each party : (a) shall take all Reasonable Steps (defined below) to keep all Confidential Information strictly confidential; and (b) shall not disclose any Confidential Information of the other to any person other than its bona fide individuals whose access is necessary to enable it to exercise its rights hereunder. As used herein “Reasonable Steps” means those steps the receiving party takes to protect its own similar proprietary and confidential information, which shall not be less than a reasonable standard of care. Confidential Information of either party disclosed prior to execution of this Agreement shall be subject to the protections afforded hereunder.

Page 885500 ends

SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
5 10.2 Exceptions. The above restrictions on the use or disclosure of the Confidential Information shall not apply to any Confidential Information that: (a) is independently developed by the receiving party without reference to the disclosing party’s Confidential Information, or is lawfully received free of restriction from a third party having the right to furnish such Confidential Information; (b) has become generally available to the public without breach of this Agreement by the receiving party; (c) at the time of disclosure, was known to the receiving party free of restriction; or (d) the disclosing party agrees in writing is free of suchrestrictions.

10.3 Confidential Terms and Conditions; Publicity. Licensee shall not disclose the terms and conditions of this Agreement or the pricing contained therein to any third party. Neither party shall use the name of the other party in publicity, advertising, or similar activity, without the prior written consent of the other, except that Licensee agrees that SAP may use Licensee's name in customer listings or, at times mutually agreeable to the parties, as part of SAP's marketing efforts (including without limitation reference calls and stories, press testimonials, site visits, SAPPHIRE participation).

11. ASSIGNMENT. Licensee may not, without SAP's prior written consent, assign, delegate, pledge, or otherwise transfer this Agreement, or any of its rights or obligations under this Agreement, or the SAP Materials or SAP Confidential Information, to any party, whether voluntarily or by operation of law, including by way of sale of assets, merger or consolidation. SAP may assign this Agreement to any of its affiliates.

12. GENERAL PROVISIONS.

12.1 Severability. It is the intent of the parties that in case any one or more of the provisions contained in this Agreement shall be held to be invalid or unenforceable in any respect, such invalidity or unenforceability shall not affect the other provisions of this Agreement, and this Agreement shall be construed as if such invalid or unenforceable provision had never been contained herein.

12.2 No Waiver. If either party should waive any breach of any provision of this Agreement, it shall not thereby be deemed to have waived any preceding or succeeding breach of the same or any other provision hereof.

12.3 Counterparts. This Agreement may be signed in two counterparts, each of which shall be deemed an original and which shall together constitute one Agreement.

12.4 Regulatory Matters. The Software, Documentation and SAP Materials are subject to the export control laws of various countries, including without limit the laws of the United States and Germany. Licensee agrees that it will not submit the Software, Documentation or other SAP Materials to any government agency for licensing consideration or other regulatory approval without the prior written consent of SAP, and will not export the Software, Documentation and SAP Materials to countries, persons or entities prohibited by such laws. Licensee shall also be responsible for complying with all applicable governmental regulations of the country where Licensee is registered, and any foreign countries with respect to the use of the Software, Documentation or other SAP Materials by Licensee and/or its Affiliates.

12.5 Governing Law; Limitations Period. This Agreement and any claims arising out of or relating to this Agreement and its subject matter shall be governed by and construed under the laws of Commonwealth of Pennsylvania without reference to its conflicts of law principles. In the event of any conflicts between foreign law, rules, and regulations, and United States law, rules, and regulations, United States law, rules, and regulations shall prevail and govern. The United Nations Convention on Contracts for the International Sale of Goods shall not apply to this Agreement. The Uniform Computer Information Transactions Act as enacted shall not apply. Licensee must initiate a cause of action for any claim(s) arising out of or relating to this Agreement and its subject matter within one (1) year from the date when Licensee knew, or should have known after reasonable investigation, of the facts giving rise to the claim(s).

12.6 Notices. All notices or reports which are required or may be given pursuant to this Agreement shall be in writing and shall be deemed duly given when delivered to the respective executive offices of SAP and Licensee at the addresses first set forth in any Software Order Form. Where in this section 12.6 or elsewhere in this Agreement written form is required, that requirement can be met by facsimile transmission, exchange of letters or other written form.

12.7 Force Majeure. Any delay or nonperformance of any provision of this Agreement (other than for the payment of amounts due hereunder) caused by conditions beyond the reasonable control of the performing party shall not constitute a breach of this Agreement, and the time for performance of such provision, if any, shall be deemed to be extended for a period equal to the duration of the conditions preventing performance.

12.8 Entire Agreement. This Agreement constitutes the complete and exclusive statement of the agreement between SAP and Licensee, and all previous representations, discussions, and writings are merged in, and superseded by this Agreement and the parties disclaim any reliance on any such representations, discussions and writings. This Agreement may be modified only by a writing signed by both parties. This Agreement shall prevail over any additional, conflicting, or inconsistent terms and conditions which may appear on any purchase order or other document furnished by Licensee to SAP. This Agreement shall prevail over any additional, conflicting or inconsistent terms and conditions which may appear in any clickwrap end user agreement included in the Software. Signatures sent by electronic means (facsimile or scanned and sent via e-mail) shall be deemed original signatures. This Agreement does not create any partnership, joint venture or principal and agent relationship.

12.9 Hierarchy. The following order of precedence shall be applied in the event of conflict or inconsistency between provisions of the components of this Agreement: (i) the Software Order Form; (ii) the Schedules; (iii) the Use Terms; and (iv) the GTC.

Page 885511 ends

SAP Confidential
SAP General Terms and Conditions enUS.v.5-2011
7 Schedule B to the GTC
“Professional Services Schedule”
The parties agree that this Schedule is hereby annexed to and made a part of the GTC. In each instance in which provisions of this Schedule contradict or are inconsistent with the provisions of the GTC, the provisions of this Schedule shall prevail andgovern.

WHEREAS, Licensee licensed from SAP the right to Use SAP Software pursuant to the Agreement and SAP provides, through its employees, affiliates, and third party contractors (“Consultants”), consulting and professional services (“Services”) including support of installation and implementation of the licensed Software in the United States.

1. Services. Upon request by Licensee, SAP will provide a Consultant(s) to perform, at Licensee’s direction, consulting and professional services including support of installation and implementation of the applicable SAP Software (“Services”). Any Statement(s) of Work (“SOW”) more fully describing the project assumptions, scope, duration and fees for the Services shall reference this Schedule. All Services of the SAP Consultant(s) will be coordinated with the designated Licensee representative. Licensee is responsible for making the necessary internal arrangements for the carrying out of the Services on a non-interference basis.

2. Satisfaction with Performance. If at any time Licensee or SAP is dissatisfied with the material performance of an assigned Consultant or a Licensee project team member, the dissatisfied party shall immediately report such dissatisfaction to the other party in writing and may request a replacement. The other party shall use its reasonable discretion in accomplishing any such change.

3. Compensation of SAP. All Services will be provided by SAP on a time and expense basis at SAP’s then current rates, unless otherwise agreed by the parties in a SOW.

4. Taxes. The fees listed in the applicable SOW do not include taxes. If SAP is required to pay sales, use, property, value-added or other taxes based on the Services provided under this Schedule, then such taxes shall be billed to and paid by Licensee.

This section shall not apply to taxes based on SAP’s income. Licensee also agrees to pay SAP for additional tax amounts if any, created by the taxability of Consultants reimbursed travel and living expenses resulting from long term assignments at Licensee’s locations.

5. Work Product. Unless otherwise agreed to in writing by the parties in a SOW, SAP shall have the sole and exclusive right, title and ownership to any and all ideas, concepts, or other intellectual property rights related in any way to the techniques, knowledge or processes of the SAP Services and deliverables, whether or not developed for Licensee.

6. Warranty. SAP warrants that its Services shall be performed consistent with generally accepted industry standards. SAP

MAKES NO WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, NOR ANY OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, IN CONNECTION WITH THIS SCHEDULE AND THE SERVICES PROVIDEDHEREUNDER.

7. Limitation of Liability. WITH RESPECT TO SERVICES, ANYTHING TO THE CONTRARY NOTWITHSTANDING, EXCEPT FOR DAMAGES RESULTING FROM UNAUTHORIZED USE OR DISCLOSURE OF THE PROPRIETARY INFORMATION AND SAP’S RIGHT

TO COLLECT UNPAID FEES, UNDER NO CIRCUMSTANCES SHALL SAP, ITS CONSULTANTS OR LICENSEE BE LIABLE TO EACH

OTHER OR ANY OTHER PERSON OR ENTITY FOR AN AMOUNT OF DAMAGES IN EXCESS OF THE FEES PAID FOR THE

APPLICABLE SERVICES HEREUNDER OR BE LIABLE IN ANY AMOUNT FOR SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR

INDIRECT DAMAGES, LOSS OF GOOD WILL OR BUSINESS PROFITS, WORK STOPPAGE, DATA LOSS, COMPUTER FAILURE OR MALFUNCTION, OR EXEMPLARY OR PUNITIVE DAMAGES. The provisions of the Schedule allocate the risks between SAP and Licensee. The License Fees reflect this allocation of risk and the limitations of liability herein.

8. Termination. The terms of this Schedule shall be effective as of the Effective Date of the Agreement and shall remain in effect until terminated by either party upon thirty (30) days prior written notice or otherwise in accordance with a particular SOW.

Licensee shall be liable for payment to SAP for all Services provided prior to the effective date of any such termination, including any expenses incurred pursuant to the provision of such Services, in accord with the applicable SOW.

9. General Provisions.

9.1 SAP may subcontract all or part of the Services to be performed to a qualified third party.

9.2 With respect to the Services provided by SAP under this Schedule and any SOW hereto, the relationship of SAP and Licensee is that of an independent contractor.

9.3 This Schedule, including any applicable SOWs, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements between the parties, whether written or oral, relating to the same subject matter. In the event of any inconsistencies between this Schedule and a SOW, the SOW shall take precedence over the Schedule. Any purchase order or other document issued by Licensee is for administrative convenience only.

10. Survival. Sections 5 and 7 above shall survive any termination of this Schedule.

Page 885522 ends

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 1 (version 11/4/2014)

SUBSCRIPTION SERVICE AGREEMENT
This Subscription Service Agreement (including the Subscription Service Guide, attached hereto) (“Agreement”) is made between the ServiceNow entity (“ServiceNow”) and the customer entity (“Customer”) on the ordering document and becomes effective on the last signature date of the ordering document issued by ServiceNow (“Effective Date”).

The Subscription Service Guide includes: (1) the Customer Support Policy; (2) the Upgrade Policy; (3) the Data Security Guide; and (4) any other attachment set forth or referenced in the Subscription Service Guide. The Subscription Service Guide is posted on www.servicenow.com/schedules.do and incorporated herein by reference.

Pursuant to a separate transaction between Customer and ServiceNow’s authorized reseller (“Reseller”), Customer has purchased from Reseller certain services to be delivered by ServiceNow. This Agreement specifies the terms and conditions under which those services will be provided, apart from price, payment and other terms specified in the separate agreement between Customer and Reseller.

1. DEFINITIONS

1.1. “Confidential Information” means: (a) ServiceNow Core Technology (which is Confidential Information of ServiceNow); (b) Customer Data and Customer Technology (which are Confidential Information of Customer); (c) any other information of a party that is disclosed in writing or orally and is designated as Confidential or Proprietary at the time of disclosure (and, in the case of oral disclosures, summarized in writing within thirty (30) days of the initial disclosure and delivered to the receiving party), or that due to the nature of the information the receiving party would clearly understand it to be confidential information of the disclosing party; and (d) the specific terms and conditions of this Agreement, any Use Authorization, any SOW, and any amendment and attachment thereof, between the parties. Confidential Information shall not include any information that: (i) is or becomes generally known to the public through no fault or breach of this Agreement by the receiving party; (ii) was rightfully in the receiving party’s possession at the time of disclosure without restriction on use or disclosure; (iii) is independently developed by the receiving party without use of the disclosing party's Confidential Information; or (iv) was or is rightfully obtained by the receiving party from a third party not under a duty of confidentiality and without restriction on use or disclosure.

1.2. “Customer Data” means electronic data uploaded by or for Customer and Customer’s agents, employees and contractors, and processed in the Subscription Service, excluding the ServiceNow Core Technology.

1.3. “Customer Technology” means software, methodologies, templates, business processes, documentation or other material authored, invented or otherwise created or licensed (other than by or from ServiceNow) by Customer using or for use with the Subscription Service, excluding the ServiceNow Core Technology.

1.4. “Development Tools” means source code, application programming interfaces (APIs), executable software and tools in human readable format made available by ServiceNow for the implementation, customization, configuration, and use of the Subscription Service, such as scripts, code snippets, sample code, and development tools published by ServiceNow.

1.5. “Documentation” means the ServiceNow product documentation relating to the operation and use of the Subscription Service, Software and Development Tools, including technical program or interface documentation, user manuals, operating instructions and release notes, as updated from time to time by ServiceNow.

1.6. “Product Overview” means the description of the ordered products and their functionalities attached to a Use Authorization or referenced therein.

1.7. “Professional Services” means any services provided by ServiceNow pursuant to an agreed SOW or Service Description.

Page 885533 ends

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 2 (version 11/4/2014)

1.8. “Service Description” means the written description for a packaged Professional Service, attached to a Use Authorization or referenced therein.

1.9. “ServiceNow Core Technology” means: (a) the Subscription Service; Software; Development Tools, Documentation; and ServiceNow technology and methodologies (including, without limitation, products, software tools, hardware designs, algorithms, templates, software (in source and object forms), architecture, class libraries, objects and documentation) existing as of the Effective Date or otherwise arising outside of work under a Professional Service; (b) updates, upgrades, improvements, configurations, extensions, and derivative works of the foregoing and related technical or end user documentation or manuals; and (c) intellectual property anywhere in the world relating to the foregoing.

1.10. “Software” means software provided by ServiceNow to Customer that operates on Customerprovided machines solely to facilitate the use of the Subscription Service.

1.11. “SOW” means a statement of work for Professional Services.

1.12. “Subscription Service” means the ServiceNow software as a service (SaaS) offering identified in a Use Authorization.

1.13. “Subscription Term” means the term of authorized use of the Subscription Service as set forth in the Use Authorization.

1.14. “Use Authorization” means a written document provided to Customer specifying the services that Customer has purchased, along with the term and scope of the authorized use thereof.

2. GRANT OF USE RIGHTS

2.1. SUBSCRIPTION SERVICE. Subject to the terms of this Agreement, ServiceNow authorizes Customer to access and use the purchased Subscription Service during the Subscription Term as set forth in an applicable Use Authorization for its internal business purposes in accordance with the Documentation. Customer shall not use or otherwise access the Subscription Service in a manner that exceeds Customer’s authorized use as set forth in this Agreement and the applicable Use Authorization.

2.2. SOFTWARE. ServiceNow grants Customer a limited, personal, worldwide, non-sublicensable, non-transferable (except as set forth in Section 10.1 (Assignment)), non-exclusive license during the Subscription Term to install and execute Software on machines operated by or for Customer solely to facilitate Customer’s authorized access to and use of the purchased Subscription Service. The Software may include code that is licensed under third party license agreements, including open source made available or provided with the Software. Software is licensed and not sold even if for convenience ServiceNow makes reference to words such as sale or purchase.

2.3. DEVELOPMENT TOOLS. In support of Customer’s authorized internal business use of the Subscription Service during the Subscription Term, ServiceNow grants to Customer a limited, personal, worldwide, non-sublicensable, non-transferable (except as set forth in Section 10.1 (Assignment)), non-exclusive license to download and make a reasonable number of copies of the Development Tools, and to use, copy, modify and create derivative works of the Development Tools, in: (a) using, implementing and integrating the ServiceNow applications with other software and systems; and (b) creating applications on the ServiceNow platform (to the extent Customer has purchased authorized use of the Subscription Service to create applications on the ServiceNow platform). Customer shall not use the Development Tools in a manner that causes it to exceed the limits of its authorized use of the Subscription Service as set forth in this Agreement and the Use Authorization. From time to time, ServiceNow may provide Development Tools subject to the terms and conditions of separate agreements which will be provided to Customer for review and to which Customer will be required to agree prior to use of such Development Tools; provided that ServiceNow shall not require Customer to agree to separate terms and conditions for any Development Tool that is necessary for Customer’s use of its ordered Subscription Service in conformance with the Product Overview unless set forth on the Use Authorization.

Page 885544 ends

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 3 (version 11/4/2014)

2.4. RESTRICTIONS. Customer shall not (and shall not permit others to) do the following with respect to the ServiceNow Core Technology: (i) use the Subscription Service with external programs in a manner that intentionally circumvents contractual usage restrictions; (ii) license, sub-license, sell, re-sell, rent, lease, transfer, distribute or time share or otherwise make any of it available for access by third parties except as otherwise expressly provided in a Use Authorization; (iii) access it for the purpose of developing or operating products or services intended to be offered to third parties in competition with the Subscription Service; (iv) disassemble, reverse engineer or decompile it; (v) copy, create derivative works based on or otherwise modify it except as permitted in this Agreement; (vi) remove or modify a copyright or other proprietary rights notice in it; (vii) use it to reproduce, distribute, display, transmit or use material protected by copyright or other intellectual property right (including the rights of publicity or privacy) without first obtaining the permission of the owner; (viii) use it to create, use, send, store or run viruses or other harmful computer code, files, scripts, agents or other programs or otherwise engage in a malicious act or disrupt its security, integrity or operation; or (ix) access or disable any ServiceNow or third party data, software or network (other than Customer’s instance of the Subscription Service in accordance with this Agreement). Before Customer exercises any of the foregoing actions that Customer believes it is entitled to, Customer shall provide ServiceNow with thirty (30) days’ prior written notice to [email protected] (or, if applicable law or the relevant court order does not allow for such notice, then the maximum amount of notice allowable), and provide reasonably requested information to allow ServiceNow to assess Customer’s claim and, at ServiceNow’s sole discretion, provide alternatives that reduce adverse impacts on ServiceNow’s intellectual property and other rights.

3. ORDERING

3.1. RESELLER ORDERS. Customer shall order and purchase the Subscription Service and Professional Services directly from Reseller pursuant to a separate agreement specifying price, payment and other commercial terms. ServiceNow is not a party to such separate agreement but will provide the purchased services pursuant to this Agreement. For each order, Reseller or ServiceNow will provide Customer with a Use Authorization for Customer to sign and return to ServiceNow. ServiceNow will have no obligation to provide services unless and until it has received a Use Authorization signed by Customer. Reseller is not authorized to make any changes to this Agreement (including any Use Authorizations issued hereunder) or bind ServiceNow to any additional or different terms or conditions. Additional orders for ServiceNow products or services may be placed either through Reseller or ServiceNow, provided that if Customer places an order directly through ServiceNow, Customer shall sign an addendum to this Agreement setting forth pricing, payment and other commercial terms between Customer and ServiceNow.

3.2. USE VERIFICATION. ServiceNow or Reseller may remotely review Customer’s use of the Subscription Service, and upon ServiceNow or Reseller’s written request Customer shall provide any reasonable assistance, to verify Customer’s compliance with the Agreement. If ServiceNow determines that Customer has exceeded its permitted use of the Subscription Service then ServiceNow will notify Customer and within thirty (30) days thereafter Customer shall either: (i) disable any unpermitted use or (ii) purchase additional subscriptions commensurate with Customer’s actual use. If Customer fails to regain compliance within such thirty (30) day period or fails to make payment as provided in its agreement with Reseller, ServiceNow may suspend Customer’s use of the Subscription Service or terminate this Agreement for cause in accordance with Section 9 (Term and Termination), in addition to any other rights or remedies ServiceNow may have.

4. INTELLECTUAL PROPERTY

4.1. SERVICENOW OWNERSHIP. As between ServiceNow and Customer, all rights, title, and interest in and to all intellectual property rights in the ServiceNow Core Technology are owned exclusively by ServiceNow notwithstanding any other provision in this Agreement. Except as expressly provided in this Agreement, ServiceNow reserves all rights in the ServiceNow Core Technology and does not grant Customer any rights, express or implied or by estoppel.

4.2. CUSTOMER OWNERSHIP. As between Customer and ServiceNow, Customer shall retain all of its rights, title, and interest in and to its intellectual property rights in Customer Data and Customer Technology.

Customer hereby grants to ServiceNow a royalty-free, fully-paid, non-exclusive, non-transferable (except as set

Page 885555 ends

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 4 (version 11/4/2014)
forth in Section 10.1 (Assignment)), sub-licensable, worldwide right to use Customer Data and Customer Technology solely for the purpose of providing the Subscription Service and Professional Services to Customer.

4.3. FEEDBACK. ServiceNow encourages Customer to provide suggestions, proposals, ideas, recommendations or other feedback regarding improvements to ServiceNow’s services and related resources. To the extent Customer provides such feedback, Customer grants to ServiceNow a royalty-free, fully paid, sublicensable, transferable (notwithstanding Section 10.1 (Assignment)), non-exclusive, irrevocable, perpetual, worldwide right and license to make, use, sell, offer for sale, import and otherwise exploit feedback (including by incorporation of such feedback into the ServiceNow Core Technology) without restriction.

4.4. PROFESSIONAL SERVICES. Subject to the provisions of this Section 4.4, ServiceNow shall assign to Customer any Newly Created IP (as defined below) in Deliverables upon payment in full by Customer of all amounts due for the Professional Service under which the Deliverable was created. A “Deliverable” is a deliverable that is identified in the applicable SOW or Service Description and that is created by ServiceNow for Customer in the performance of the Professional Services. “Newly Created IP” means intellectual property in any inventions or works of authorship that are made by ServiceNow specifically for Customer in the course of performing Professional Services for Customer that is identified as “Newly Created IP” in an SOW, excluding the ServiceNow Core Technology. To the extent (if at all) any ServiceNow Core Technology is incorporated into a Deliverable, ServiceNow grants to Customer a non-exclusive, royalty-free, non-transferable, non-sublicensable worldwide license to use the ServiceNow Core Technology solely to use the Deliverable in connection with the Subscription Service as contemplated under this Agreement during the Subscription Term. Nothing in this Agreement shall be deemed to restrict or limit ServiceNow’s right to perform similar Professional Services for any other party or to assign any employees or subcontractors to perform similar Professional Services for any other party or to use any information incidentally retained in the unaided memories of its employees providing Professional Services.

5. WARRANTIES

5.1. LIMITED SUBSCRIPTION SERVICE WARRANTY. ServiceNow warrants that during the Subscription Term Customer’s production instances of the Subscription Service shall materially conform to the Product Overview. To submit a warranty claim under this Section, Customer shall (1) reference this Section; and (2) submit a support request to resolve the non-conformity as provided in the Subscription Service Guide. If the non-conformity persists without relief more than thirty (30) days after written notice of a warranty claim provided to ServiceNow under this Section 5.1, then Customer may terminate the affected Subscription Service and submit to Reseller a claim for refund of any prepaid subscription fees covering the remainder of the Subscription Term of the affected Subscription Service after the date of termination. Notwithstanding the foregoing, this warranty shall not apply to any non-conformity due to a modification of or defect in the Subscription Service that is made or caused by any person other than ServiceNow or a person acting at ServiceNow’s direction. THIS SECTION 5.1 SETS FORTH CUSTOMER’S EXCLUSIVE RIGHTS AND REMEDIES (AND SERVICENOW’S SOLE LIABILITY) IN CONNECTION WITH THIS WARRANTY.

5.2. LIMITED PROFESSIONAL SERVICES WARRANTY. ServiceNow warrants that the Professional Services will be performed in a competent and workmanlike manner in accordance with accepted industry standards and practices and all material requirements set forth in the SOW or Service Description. Customer shall notify ServiceNow in writing of any breach within thirty (30) days after performance of the non-conforming Professional Services. Upon receipt of such notice, ServiceNow, at its option, shall either use commercially reasonable efforts to re-perform the Professional Services in conformance with these warranty requirements or shall terminate the affected Professional Services, in which case Customer may submit to Reseller a claim for a refund of any amounts paid for the nonconforming Professional Services. THIS SECTION 5.2 SETS FORTH CUSTOMER’S EXCLUSIVE RIGHTS AND REMEDIES (AND SERVICENOW’S SOLE LIABILITY) IN CONNECTION WITH THIS WARRANTY.

5.3. DISCLAIMER OF WARRANTIES. EXCEPT FOR THE WARRANTIES EXPRESSLY STATED IN

THIS AGREEMENT, TO THE MAXIMUM EXTENT ALLOWED BY LAW, SERVICENOW DISCLAIMS ALL

WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, ORAL OR WRITTEN, INCLUDING WARRANTIES

Page 885566 ends

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 5 (version 11/4/2014)
ARISING UNDER STATUTE, WARRANTIES OF MERCHANTABILITY, ACCURACY, TITLE, NONINFRINGEMENT OR FITNESS FOR A PARTICULAR PURPOSE OR ANY WARRANTIES ARISING FROM USAGE OF TRADE, COURSE OF DEALING OR COURSE OF PERFORMANCE. WITHOUT LIMITING THE

GENERALITY OF THE FOREGOING, SERVICENOW SPECIFICALLY DOES NOT WARRANT THAT THE

SUBSCRIPTION SERVICE, SOFTWARE, PROFESSIONAL SERVICES, DEVELOPMENT TOOLS,

DOCUMENTATION OR DELIVERABLES WILL MEET THE REQUIREMENTS OF CUSTOMER OR OTHERS OR THAT THEY WILL BE ACCURATE OR OPERATE WITHOUT INTERRUPTION OR ERROR. CUSTOMER

ACKNOWLEDGES THAT IN ENTERING THIS AGREEMENT IT HAS NOT RELIED ON ANY PROMISE, WARRANTY OR REPRESENTATION NOT EXPRESSLY SET FORTH HEREIN.

6. CONFIDENTIAL INFORMATION

6.1. CONFIDENTIALITY OBLIGATIONS. The recipient of Confidential Information shall: (i) at all times protect it from unauthorized disclosure with the same degree of care that it uses to protect its own confidential information, and in no event using less than reasonable care; and (ii) not use it except to the extent necessary to exercise rights or fulfill obligations under this Agreement. Each party shall limit the disclosure of the other party’s Confidential Information to those of its employees and contractors with a need to access such Confidential Information for a party’s exercise of its rights and obligations under this Agreement, provided that all such employees and contractors are subject to binding disclosure and use restrictions at least as protective as those set forth herein. Each party’s obligations set forth in this Section 6 shall remain in effect during the term and three (3) years after termination of this Agreement. The receiving party shall, at the disclosing party’s request or upon termination of this Agreement, return all originals, copies, reproductions and summaries of Confidential Information and other tangible materials and devices provided to the receiving party as Confidential Information, or at the disclosing party's option, certify destruction of the same. Provisions for the return of Customer Data are set forth in Section 9.3 (Return of Customer Data).

6.2. REQUIRED DISCLOSURES. A party may disclose the disclosing party’s Confidential Information to a court or governmental body pursuant to a valid court order, law, subpoena or regulation, provided that the receiving party: (a) promptly notifies the disclosing party of such requirement as far in advance as possible to the extent advanced notice is lawful; and (b) provides reasonable assistance to the disclosing party in any lawful efforts by the disclosing party to resist or limit the disclosure of such Confidential Information.

6.3. EQUITABLE REMEDIES. The parties agree that the receiving party’s disclosure of Confidential Information except as provided herein may result in irreparable injury for which a remedy in money damages may be inadequate. The parties further agree that in the event of such disclosure or threatened disclosure, the disclosing party may be entitled to seek an injunction to prevent the breach or threatened breach without the necessity of proving irreparable injury or the inadequacy of money damages, in addition to remedies otherwise available to the disclosing party at law or in equity.

7. INDEMNIFICATION

7.1. SERVICENOW OBLIGATION. Subject to the exclusions set forth below, ServiceNow shall: (i) defend Customer, its officers, directors and employees against any third party suit, claim, action or demand (each a “Claim”) to the extent alleging: (A) that the Subscription Service used in accordance with this Agreement infringes any third party patent, copyright or trademark, or misappropriates any third party trade secret; or (B) that ServiceNow’s personnel when onsite at Customer’s premises caused death, bodily harm or damage to tangible personal property due to their negligence or willful misconduct; and (ii) pay any court-ordered award of damages or settlement amount to the extent arising from any such Claims. If any portion of the Subscription Service becomes the subject of a Claim under Section 7.1(i)(A), ServiceNow may: (a) contest the Claim; (b) obtain permission from the claimant for Customer’s continued use of the Subscription Service; (c) replace or modify the Subscription Service to avoid infringement, if such replacement or modification has substantially the same capabilities as the Subscription Service; or, if the foregoing (a), (b), and (c) are not available on commercially reasonable terms in ServiceNow’s judgment, then (d) terminate Customer’s use of the affected Subscription Service upon sixty (60) days’ written notice, whereupon Customer may submit to Reseller a claim for a refund of any prepaid subscription fees covering the remaining portion of the applicable Subscription Term for the affected

Page 885577 ends

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 6 (version 11/4/2014)
Subscription Service after the date of termination. Notwithstanding the above, ServiceNow shall have no obligation or liability for any Claim under Section 7.1(i)(A) arising in whole or in part from: (1) any use of the Subscription Service which exceeds the authorized use permitted under this Agreement or not in accordance with the Documentation; (2) Customer Data or Customer Technology; (3) use of the Subscription Service by Customer in violation of applicable law; (4) use of the affected Subscription Service after termination in accordance with clause (d) of this Section 7.1; (5) modifications to the Subscription Service made to Customer’s specifications or otherwise made by any person other than ServiceNow or a person acting at ServiceNow’s direction if the Claim would have been avoided by use of the unmodified Subscription Service; or (6) use of the Subscription Service in combination with any hardware, software, application or service that was not provided by ServiceNow, if the Claim would have been avoided by the non-combined or independent use of the Subscription Service.

7.2. CUSTOMER OBLIGATION. Customer shall: (i) defend ServiceNow, its officers, directors and employees against any Claim alleging that: (A) Customer Data, (B) Customer Technology or (C) a modification to the Subscription Service made to Customer’s specifications or otherwise made by or on behalf of Customer by any person other than ServiceNow or a person acting at ServiceNow’s direction (but only if the Claim would have been avoided by use of the unmodified Subscription Service), infringes any patent, copyright or trademark, misappropriates any third party trade secret, or violates any third party privacy rights; and (ii) pay any courtordered award of damages or settlement amount to the extent arising from such Claim.

7.3. PROCESS. All of the foregoing indemnity obligations of ServiceNow and Customer are conditioned on the indemnified party notifying the indemnifying party promptly in writing of any actual or threatened Claim, the indemnified party giving the indemnifying party sole control of the defense thereof and any related settlement negotiations, and the indemnified party cooperating and, at the indemnifying party’s request and expense, assisting in such defense. SECTION 7 STATES EACH PARTY’S ENTIRE LIABILITY AND THE OTHER PARTY’S EXCLUSIVE REMEDY FOR THIRD PARTY CLAIMS AND ACTIONS.

8. LIMITATIONS OF LIABILITY

8.1. LIMITATIONS OF LIABILITY. SERVICENOW SHALL HAVE NO LIABILITY FOR ANY REFUND THAT, IN ACCORDANCE WITH THE TERMS OF THIS AGREEMENT, IS TO BE PAID BY RESELLER. TO THE

EXTENT PERMITTED BY LAW, THE TOTAL, CUMULATIVE LIABILITY OF EACH PARTY ARISING OUT OF

OR RELATED TO THIS AGREEMENT OR THE PRODUCTS OR SERVICES PROVIDED HEREUNDER

WHETHER BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE) OR ANY OTHER LEGAL OR

EQUITABLE THEORY, SHALL BE LIMITED TO THE AMOUNTS PAID BY CUSTOMER FOR THE PRODUCTS OR SERVICES GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTH PERIOD PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY. THE EXISTENCE OF MORE THAN ONE CLAIM SHALL NOT ENLARGE THIS LIMIT. THE FOREGOING LIMITATION OF LIABILITY SHALL NOT APPLY TO:
(1) CUSTOMER’S OBLIGATION TO PAY FOR PRODUCTS, SERVICES OR TAXES; (2) A PARTY’S OBLIGATIONS IN SECTION 7 (INDEMNIFICATION); AND (3) INFRINGEMENT BY A PARTY OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS.

8.2. EXCLUSION OF DAMAGES. TO THE EXTENT PERMITTED BY LAW, NEITHER

SERVICENOW NOR CUSTOMER SHALL BE LIABLE TO THE OTHER OR ANY THIRD PARTY FOR LOST

PROFITS (WHETHER DIRECT OR INDIRECT) OR LOSS OF USE OR DATA, COVER, SUBSTITUTE GOODS

OR SERVICES, OR FOR INCIDENTAL, CONSEQUENTIAL, PUNITIVE, SPECIAL OR EXEMPLARY DAMAGES (INCLUDING DAMAGE TO BUSINESS, REPUTATION OR GOODWILL), OR INDIRECT DAMAGES OF ANY

TYPE HOWEVER CAUSED, WHETHER BY BREACH OF WARRANTY, BREACH OF CONTRACT, IN TORT (INCLUDING NEGLIGENCE) OR ANY OTHER LEGAL OR EQUITABLE CAUSE OF ACTION EVEN IF SUCH

PARTY HAS BEEN ADVISED OF SUCH DAMAGES IN ADVANCE OR IF SUCH DAMAGES WERE FORESEEABLE. THE FOREGOING EXCLUSIONS SHALL NOT APPLY TO: (1) PAYMENTS TO A THIRD PARTY ARISING FROM A PARTY’S OBLIGATIONS UNDER SECTION 7 (INDEMNIFICATION); AND (2) INFRINGEMENT BY A PARTY OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS.

8.3. GROSS NEGLIGENCE; WILFUL MISCONDUCT. AS PROVIDED BY LAW, NOTHING HEREIN SHALL BE INTENDED TO LIMIT A PARTY’S LIABILITY IN AN ACTION IN TORT (SEPARATE AND DISTINCT

Page 885588 ends

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 7 (version 11/4/2014)
FROM A CAUSE OF ACTION FOR BREACH OF THIS AGREEMENT) FOR THE PARTY’S GROSS NEGLIGENCE OR WILFUL MISCONDUCT.

9. TERM AND TERMINATION

9.1. TERM AND TERMINATION. This Agreement continues until terminated under the terms of this Agreement. Each party may terminate this Agreement in its entirety either: (i) upon thirty (30) days’ prior written notice to the other party, if at the time of notice there are no Use Authorizations in effect; or (ii) upon written notice if the other party becomes the subject of a petition in bankruptcy or any proceeding related to its insolvency, receivership or liquidation, in any jurisdiction, that is not dismissed within sixty (60) days of its commencement or an assignment for the benefit of creditors. Either party may terminate a Subscription Service or Professional Services upon written notice if the other party materially breaches this Agreement or the applicable Use Authorization for the affected service and does not cure the breach within thirty (30) days after receiving written notice thereof from the non-breaching party. Professional Services are separately ordered from the Subscription Service, and are not required for the Subscription Service. A breach by a party of its obligations with respect to Professional Services shall not by itself constitute a breach by that party of its obligations with respect to the Subscription Service even if the services are enumerated in the same Use Authorization.

9.2. EFFECT OF TERMINATION OF SUBSCRIPTION SERVICE. Upon termination of the Subscription Service for any reason, Customer shall stop using, and ServiceNow shall stop providing, the Subscription Service and all rights granted to Customer in this Agreement shall terminate. If the Subscription Service is terminated by Customer due to ServiceNow’s breach, then Customer may submit to Reseller a claim for refund of all prepaid fees for the remaining portion of the Subscription Term for the terminated Subscription Service after the effective date of termination. Within thirty (30) days following the effective date of a termination by ServiceNow for Customer’s breach, Customer shall pay all remaining amounts for the Subscription Term applicable to the Subscription Service covering the remainder of the Subscription Term regardless of the due dates specified in Reseller’s order form to Customer.

9.3. TRANSITION SERVICES. At least thirty (30) days prior to either the expiration of the Subscription Term (where Customer elects not to renew) or in connection with the termination by Customer of the Subscription Service in accordance with Section 9.1, provided that Customer signs an addendum to this Agreement setting forth payment and other commercial terms between Customer and ServiceNow, Customer may purchase the following services from ServiceNow: (i) one (1) extension of the Subscription Service for up to six (6) months (“Transition Subscription Service”); and (ii) Professional Services. Prior to the commencement of any Transition Subscription Service or Professional Services, Customer shall sign an ordering document and shall pay in advance for the Transition Subscription Service and any Professional Services plus verifiable travel and expenses.

9.4. RETURN OF CUSTOMER DATA. ServiceNow shall provide Customer Data in its standard database export format, excluding the ServiceNow Core Technology, to Customer upon Customer’s written request and at no additional cost to Customer, provided that ServiceNow receives such request from Customer within forty-five (45) days following the expiration or termination of this Agreement for the Subscription Service (including any Transition Subscription Service term, if applicable).If ServiceNow has not received a request within the foregoing time frame, ServiceNow shall have no obligation to maintain or provide any Customer Data and shall thereafter, unless legally prohibited, have the right to delete all Customer Data in its systems or otherwise in its possession or under its control and delete Customer’s instances of the Subscription Service.

9.5. SURVIVAL. Sections 2.4 (Restrictions), 4.1 (ServiceNow Ownership), 4.2 (Customer Ownership), 4.3 (Feedback) and 6 (Confidential Information) through 10 (General Provisions) of this Agreement, together with any other provision required for their construction or enforcement, shall survive termination of this Agreement for any reason.

10. GENERAL PROVISIONS

10.1. ASSIGNMENT. Neither party may assign its rights or obligations under this Agreement, whether by operation of law or otherwise, without the prior written consent of the other party. Notwithstanding the

Page 885599 ends

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 8 (version 11/4/2014)
foregoing, either party may, upon notice and without the other party’s consent: (i) in connection with a merger, reorganization or sale of all or substantially all of the assets or equity of such party, assign this Agreement in its entirety to such party’s successor; and (ii) assign this Agreement in its entirety to any Affiliate. “Affiliates” shall mean any person or entity directly or indirectly Controlling, Controlled by or under common Control with a party to the Agreement, where “Control” means the legal power to direct or cause the direction of the general management of the company, partnership or other legal entity. Any attempted or purported assignment in violation of this Section 10.1 will be null and void. Subject to the foregoing, this Agreement shall bind and inure to the benefit of the parties, their respective successors and permitted assigns.

10.2. COMPLIANCE W ITH LAWS. ServiceNow shall comply with any statutes and regulations that apply to its provision of the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables, under the Agreement, including but not limited to those applicable to the privacy and security of personal information, including trans-border data transfers and data breach notification requirements as required of ServiceNow by law. Customer shall comply with all laws that apply to its use of the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables, under the Agreement, including but not limited to those applicable to collection and processing of Customer Data in ServiceNow systems through the Subscription Service. Customer agrees to provide any required disclosures to and obtain any required consents for the transfer of Customer Data to ServiceNow. ServiceNow shall not be responsible for compliance with any laws applicable to Customer and its industry that are not generally applicable to information technology service providers.

10.3. EXPORT COMPLIANCE. Each party shall comply with United States and foreign export control laws and regulations. Customer acknowledges that the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables are subject to the U.S. Export Administration Regulations (the “EAR”) and that Customer shall comply with the EAR. Without limiting the foregoing, Customer represents and warrants that: (i) Customer is not located in, and shall not use the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables from, any country that is subject to U.S. export restrictions (currently including, but not necessarily limited to, Cuba, Iran, North Korea, Sudan and Syria); (ii) Customer shall not use the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables in the design, development or production of nuclear, chemical or biological weapons, or rocket systems, space launch vehicles, sounding rockets or unmanned air vehicle systems; and (iii) Customer is not prohibited from participating in U.S. export transactions by any federal agency of the U.S. government. In addition, Customer is responsible for complying with any local laws which may impact Customer’s right to import, export or use the Subscription Service, Professional Services, Software, Documentation, Development Tools and Deliverables.

10.4. US GOVERNMENT RIGHTS. All ServiceNow software (including Software) is commercial computer software and all services are commercial items. “Commercial computer software” has the meaning set forth in Federal Acquisition Regulation (“FAR”) 2.101 for civilian agency purchases and the Department of Defense (“DOD”) FAR Supplement (“DFARS”) 252.227-7014(a)(1) for defense agency purchases. If the software is licensed or the services are acquired by or on behalf of a civilian agency, ServiceNow provides the commercial computer software and/or commercial computer software documentation and other technical data subject to the terms of this Agreement as required in FAR 12.212 (Computer Software) and FAR 12.211 (Technical Data) and their successors. If the software is licensed or the services are acquired by or on behalf of any agency within the DOD, ServiceNow provides the commercial computer software and/or commercial computer software documentation and other technical data subject to the terms of this Agreement as specified in DFARS 227.7202-3 and its successors. Only if this is a DOD prime contract or DOD subcontract, the Government acquires additional rights in technical data as set forth in DFARS 252.227-7015. This U.S. Government Rights clause is in lieu of, and supersedes, any other FAR, DFARS or other clause or provision that addresses Government rights in computer software or technical data.

10.5. NOTICE. Except as otherwise provided herein, all notices shall be in writing and deemed given upon: (i) personal delivery; (ii) when received by the addressee if sent by a recognized overnight courier (receipt requested); (iii) the second business day after mailing; or (iv) the first business day after sending by email with

Page 886600 ends

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 9 (version 11/4/2014)
confirmation of receipt, except that email shall not be sufficient for notices regarding a Claim. Notices shall be sent to the parties as set forth on the signature page of this Agreement or as subsequently updated in writing.

10.6. FORCE MAJEURE. No party shall be liable or responsible to the other party, nor be deemed to have defaulted under or breached this Agreement, for any failure or delay in fulfilling or performing any term of this Agreement (excluding Customer’s failure to pay amounts owed when due), when and to the extent such failure or delay is caused by or results from acts beyond the affected party’s reasonable control, including without limitation: strikes, lock-outs or other industrial disputes (whether involving its own workforce or a third party’s), trespassing, sabotage, theft or other criminal acts, failure of energy sources or transport network, acts of God, export bans, sanctions and other government actions, war, terrorism, riot, civil commotion, interference by civil or military authorities, national or international calamity, armed conflict, malicious damage, breakdown of plant or machinery, nuclear, chemical or biological contamination, explosions, collapse of building structures, fires, floods, storms, earthquakes, epidemics or similar events, natural disasters or extreme adverse weather conditions (each a “Force Majeure Event”). The party suffering a Force Majeure Event shall use reasonable efforts to mitigate against the effects of such Force Majeure Event.

10.7. HIGH RISK ACTIVITIES. Customer shall use the ServiceNow Core Technology within the intended business purposes described in the Documentation, and not for any purpose that requires fail-safe performance including, but not limited to, stock trading, financial transaction processing, management of hazardous facilities or applications for which failure could result in death, personal injury, or severe physical or environmental damage (“High Risk Activity”). ServiceNow, its licensors and suppliers expressly disclaim all warranties of fitness for any such use and Customer shall release and hold ServiceNow, its licensors and suppliers harmless from liability arising out of the use of the ServiceNow Core Technology for High RiskActivity.

10.8. USE OF AGGREGATE DATA. Customer agrees that ServiceNow may collect, use and disclose quantitative data derived from the use of the Subscription Service for industry analysis, benchmarking, analytics, marketing, and other business purposes. All data collected, used, and disclosed will be in aggregate form only and will not identify Customer or its users.

10.9. ENTIRETY. This Agreement, together with the Use Authorizations, Product Overviews, SOWs, Service Descriptions, and the Subscription Service Guide (including the Customer Support Policy, the Upgrade Policy and the Data Security Guide), is the final and entire agreement between the parties regarding the products and services provided hereunder and supersedes all prior or contemporaneous oral or written agreements, representations, understandings, undertakings and negotiations with respect to the subject matter hereof. The terms of this Agreement apply to the exclusion of any other terms that Customer seeks to impose or incorporate, or which are implied by trade, custom, practice or course of dealing. Customer acknowledges that it has not relied on any statement, promise or representation made or given by or on behalf of ServiceNow that is not set out in this Agreement. Customer’s orders are not contingent on, and Customer has not relied on, the delivery of any future functionality regardless of any verbal or written communication about ServiceNow’s future plans. This Agreement may be executed in counterparts, each of which shall be deemed to be an original.

10.10. WAIVER AND AMENDMENT. A waiver of any right is only effective if it is in writing and only against the party who signed such writing and for the circumstances given. Any modification of this Agreement must be in writing and signed by authorized representatives of both parties.

10.11. RELATIONSHIP OF THE PARTIES. The parties are independent contractors. Nothing in this Agreement shall be construed to create a partnership, joint venture or agency relationship. Neither party shall have any right or authority to assume or create any obligation of any kind expressed or implied in the name of or on behalf of the other party.

10.12. GOVERNING LAW; JURISDICTION AND VENUE. This Agreement shall be governed by the laws of the state of California, without regard to its conflict of laws principles. The parties hereby irrevocably consent to the exclusive jurisdiction of, and venue in, any federal or state court of competent jurisdiction located in Santa Clara County, California, for the purposes of adjudicating any dispute arising out of this Agreement. Each party hereto expressly consents to service of process by registered mail. To the extent permitted by law, choice of law rules and the United Nations Convention on Contracts for the International Sale of Goods shall not apply.

Page 886611 ends

SUBSCRIPTION SERVICE AGREEMENT EFFECTIVE DATE: NOVEMBER 4, 2014 SERVICENOW CONFIDENTIAL Page 10 (version 11/4/2014)
Notwithstanding the foregoing, either party may at any time seek and obtain appropriate legal or equitable relief in any court of competent jurisdiction for claims regarding such party’s intellectual propertyrights.

10.13. CONSTRUCTION. Products and services shall be provided in the English language unless agreed otherwise. The parties confirm that they have requested that this Agreement and all related documents be drafted in English at the express wishes of the parties. Les parties confirment avoir expressément exigé que le présent contrat et les documents de ServiceNow qui y sont attachés soient rédigés en anglais. Section headings are for convenience only and are not to be used in interpreting this Agreement.

Page 886622 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 1 (version 11/12/2014)

SUBSCRIPTION SERVICE GUIDE
Capitalized terms not defined herein shall have the meaning set forth in the ordering agreement or the use agreement between Customer and ServiceNow.

1. SUPPORT
During the Subscription Term, ServiceNow or its authorized reseller, as applicable, shall provide support for the Subscription Service as set forth in the Customer Support Policy attached hereto, and incorporated herein by reference.

2. UPGRADES
ServiceNow determines whether and when to develop, release and apply any Upgrade (as defined in the Upgrade Policy attached hereto, and incorporated herein by reference) to Customer’s instances of the Subscription Service.

3. DATA SECURITY
ServiceNow shall implement and maintain security procedures and practices appropriate to information technology service providers to protect Customer Data from unauthorized access, destruction, use, modification, or disclosure, as described in the Data Security Guide attached hereto, and incorporated herein by reference.

4. INSURANCE
ServiceNow agrees to maintain in effect during the Subscription Term, at ServiceNow’s expense, the following minimum insurance coverage:
(i) (a) Workers’ Compensation Insurance, in accordance with applicable statutory, federal, and other legal requirements and (b) Employers’ Liability Insurance covering ServiceNow’s employees in an amount of not less than $1,000,000 for bodily injury by accident, $1,000,000 policy limit for bodily injury by disease, and $1,000,000 each employee for bodily injury by disease; (ii) Commercial General Liability Insurance written on an occurrence form and including coverage for bodily injury, property damage, products and completed operations, personal injury, advertising injury arising out of the services and/or products provided by ServiceNow under this Agreement with minimum limits of $1,000,000 per occurrence/$2,000,000 aggregate; (iii) Commercial Automobile Liability Insurance providing coverage for hired and non-owned automobiles used in connection with this Agreement in an amount of not less than $1,000,000 per accident combined single limit for bodily injury and property damage; (iv) Combined Technology Errors’ & Omission Policy with a $5,000,000 per Claim limit, including: (a) Professional Liability Insurance providing coverage for the services and software in this Agreement.

Such coverage to be maintained for at least two (2) years after the termination of this Agreement; and (b) Privacy, Security, and Media Liability Insurance providing liability coverage for unauthorized access or disclosure, security breaches or system attacks, as well as infringements of copyright and trademark that might result from this Agreement; and
(v) Excess Liability over Employers’ Liability, Commercial General Liability and Commercial Automobile Liability with a $5,000,000 aggregate limit.

For the purpose of this Section, a “Claim” means a written demand for money or a civil proceeding which is commenced by service of a complaint or similar pleading.

5. AVAILABILITY SERVICE LEVEL

5.1. DEFINITIONS
(a) “Available” means that the Subscription Service can be accessed by authorized users.

Page 886633 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 2 (version 11/12/2014)
(b) “Excused Downtime” means: (i) Maintenance Time of up to two (2) hours per month; and (ii) any time the Subscription Service is not Available due to circumstances beyond ServiceNow’s control, including without limitation modifications of the Subscription Service by any person other than ServiceNow or a person acting at ServiceNow’s direction, a Force Majeure Event, general Internet outages, failure of Customer’s infrastructure or connectivity (including without limitation, direct connectivity and virtual private network (VPN) connectivity to the Subscription Service), computer and telecommunications failures and delays, and network intrusions or denial-of-service or other criminal attacks. (c) “Maintenance Time” means the time the Subscription Service is not Available due to service maintenance.
(d) “Availability SLA” means the percentage of total time during which Customer’s production instances of the Subscription Service are Available during a calendar month, excluding Excused Downtime.

5.2. AVAILABLITY
If Customer’s production instances of the Subscription Service fall below the Availability SLA of ninety-nine and eight-tenths percent (99.8%) during a calendar month, Customer’s exclusive remedy for failure of the Subscription Service to meet the Availability SLAs is either: (1) to request that the affected Subscription Term be extended for the number of minutes the Subscription Service was not Available in the month in accordance with the Availability SLA; or (2) to request that ServiceNow issue a service credit to Customer for the dollar value of the number of minutes the Subscription Service was not Available in the month in accordance with the Availability SLA (determined at the deemed per minute rate ServiceNow charges to Customer for Customer’s use of the affected Subscription Service), which Customer may request ServiceNow apply to the next invoice for subscription fees.

5.3. REQUESTS
Customer must request all service credits or extensions in writing to ServiceNow within thirty (30) days of the end of the month in which the Availability SLA was not met, identifying the support requests relating to the period Customer’s production instances of the Subscription Service was not Available. The total amount of service credits for any month may not exceed the subscription fee for the affected Subscription Service for the month, and has no cash value. ServiceNow may delay issuing service credits until such amounts reach one thousand U.S. dollars ($1,000) or equivalent currency specified in the applicable Order Form.

Page 886644 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 3 (version 11/12/2014)

CUSTOMER SUPPORT POLICY
This Customer Support Policy governs the support that ServiceNow or its authorized reseller, as applicable, will provide for the Subscription Service. This Policy may be updated from time to time.

Scope
The purpose of Customer Support is to resolve defects that cause the Subscription Service to perform not in substantial conformance to the Product Overview. A resolution to a defect may consist of a fix, workaround or other relief ServiceNow deems reasonable.

Customer Support does not include:
• implementation services
• configuration services
• integration services
• customization services or other custom software development • training
• assistance with administrative functions
Customer Support is not required to provide resolutions for immaterial defects or defects due to modifications of the Subscription Service made by any person other than ServiceNow or a person acting at ServiceNow’s direction.

Business Hours
Customer Support is available 24 hours a day, 7 days a week, including allholidays.

Access Contacts
Customer may contact ServiceNow using one of the following means:
• Support Portal at https://hi.service-now.com/. Customer may get login access to this self-service portal by contacting its ServiceNow administrator.
• Phone using one of the numbers at http://servicenow.com/support/contact-support.html.

Customer shall contact ServiceNow’s authorized reseller in accordance with its agreement with thereseller.

Incident Priority
Incident priority for a defect is determined using the guidelines below:

Priority Definition
P1 Any defect that causes an instance to be unavailable.

P2 Any defect that causes a critical function to fail.

P3 Any defect that significantly impedes work or progress.

P4 Any defect that does not significantly impede work or progress.

Response Times and Level of Effort
Customer submits an incident with ServiceNow via phone or web and with ServiceNow’s authorized reseller as directed by reseller. All support requests are tracked online and can be viewed by Customer’s authorized contacts. Response times do not vary if the incident was filed via phone or web.

Page 886655 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 4 (version 11/12/2014)
ServiceNow or its authorized reseller, as applicable, will use reasonable efforts to meet the target response times and target level of effort stated in the table below. Support from the reseller may be limited to business hours only.

Priority Target Response Times Target Level of Effort
P1 30 minutes Continuously, 24 hours per day, 7 days per week
P2 2 hours Continuously, but not necessarily 24 hours per day, 7 days per week
P3 1 business day As appropriate during normal business hours P4 N/A Varies
Customer Responsibilities
Customer’s obligations are as follows:
(a) Customer agrees to receive from ServiceNow or its authorized reseller, as applicable, communications via email, phone or through the Support Portal regarding the Subscription Service.
(b) Customer shall appoint no more than five (5) contacts (“Customer Authorized Contacts”) to engage Customer Support for questions and/or technical issues. (i) Only Customer Authorized Contacts are authorized to contact Customer Support. (ii) Customer must ensure the information for these contacts is current in the Support Portal at https://hi.service-now.com/.
(iii) Customer Authorized Contacts are trained on the use and administration of the Subscription Service.
(c) Customer shall cooperate to enable ServiceNow to deliver the Subscription Service and support for the service.
(d) Customer is solely responsible for the use of the Subscription Service by its authorized users.

Support Resources
• ServiceNow Website (http://www.servicenow.com/services/overview.html) • ServiceNow Community (https://community.servicenow.com/welcome) • Release Notes (http://wiki.service-now.com/index.php?title=Main_Page) • Product Documentation (http://wiki.service-now.com/index.php?title=Main_Page) • Knowledge Base (https://hi.service-now.com/nav_to.do?uri=kb_home.do) • Support Community (https://community.servicenow.com/community/support)

Page 886666 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 5 (version 11/12/2014)

UPGRADE POLICY

1. UPGRADES
“Upgrades” are ServiceNow’s releases of the Subscription Service for repairs, enhancements or new features applied by ServiceNow to Customer’s instances of the Subscription Service at no additional fee during the Subscription Term. ServiceNow has the discretion to provide new functionality as an Upgrade or as different software or service for a separate fee. ServiceNow determines whether and when to develop, release and apply any Upgrade to Customer’s instances of the Subscription Service.

2. NOTICE; MAINTENANCE DOWNTIME
ServiceNow shall use reasonable efforts to give Customer thirty (30) days prior notice of any Upgrade to the Subscription Service. ServiceNow shall use reasonable efforts to give Customer ten (10) days prior notice of any Upgrade to the cloud infrastructure network, hardware, or software used by ServiceNow to operate and deliver the Subscription Service if ServiceNow in its reasonable judgment believes that the infrastructure Upgrade will impact Customer’s use of its production instances of the Subscription Service. ServiceNow will use commercially reasonable efforts to limit the period of time during which the Subscription Service is unavailable due to the application of Upgrades to no more than two (2) hours per month. Notwithstanding the foregoing, ServiceNow may provide Customer with a shorter or no notice period of an Upgrade if necessary, in the reasonable judgment of ServiceNow, to maintain the availability, security or performance of the Subscription Service or the ability of ServiceNow to efficiently provide the Subscription Service.

3. NOMENCLATURE
A pending Upgrade may be a “Feature Release”, “Patch” or “Hotfix.” A “Feature Release” is an Upgrade that includes new features or enhancements. A “Patch” or a “Hotfix” is an Upgrade to a Feature Release that maintains the functionality of the Feature Release and does not include new functionality. ServiceNow refers to each Feature Release and its associated Patches and Hotfixes as a “Release Family.” For example, ServiceNow’s Feature Release “Aspen” established the “Aspen” Release Family, and ServiceNow’s subsequent Feature Release “Berlin” established the “Berlin” Release Family.

4. PINNING REQUESTS
Customer may submit a support request for “no Upgrade” not fewer than five (5) business days’ prior to a pending Upgrade of the Subscription Service. Subject to the terms and conditions of this Upgrade Policy, Customer’s “no Upgrade” request shall be granted, and the Upgrade shall not be applied to Customer’s instances of the Subscription Service.

5. SUPPORTED AND NON-SUPPORTED RELEASE FAMILIES
ServiceNow offers support for the then current Release Family and the prior two (2) Release Families (“Supported Release Families”) as set forth in the Customer Support Policy. A Customer using a Supported Release Family may be required to Upgrade to a Patch or Hotfix within the Supported Release Family to correct a defect. At its discretion, ServiceNow may offer limited support for additional Release Families (“Non-Supported Release Families”). Without limiting ServiceNow’s discretion to determine the availability of support for NonSupported Release Families, a Customer using a Non-Supported Release Family may be required to Upgrade to a Supported Release Family to correct a defect. Any service level agreements, recovery time objectives or recovery point objectives are not applicable to Non-Supported Release Families. Details of ServiceNow support are further set forth in the Customer Support Policy.

Customer acknowledges that the current Release Family is the most current feature, availability, performance and security version of the Subscription Service. Within a Supported Release Family, the most recent Patch contains the most current feature, availability, performance and security version of the Subscription Service for that Release Family. A Customer that has submitted a “no Upgrade” request may experience defects, for which Customer hereby agrees that ServiceNow is not responsible, including without limitation those that affect the features, availability, performance and security of the Subscription Service, that are fixed in the most

Page 886677 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 6 (version 11/12/2014)
current version of the Subscription Service.

6. REQUIRED UPGRADES
If Customer has requested “no Upgrade” it may nevertheless be required to Upgrade if in the reasonable judgment of ServiceNow the Upgrade is necessary to maintain the availability, security or performance of the Subscription Service or the ability of ServiceNow to efficiently provide the Subscription Service, as follows:

6.1. SUPPORTED RELEASE FAMILY. If Customer is using a Supported Release Family, it may be required to Upgrade to a Patch or Hotfix within the Supported Release Family.

6.2. NON-SUPPORTED RELEASE FAMILY. If Customer is using a Non-Supported Release Family, it may be required to Upgrade to a Supported Release Family.

7. EXCEPTIONS
Notwithstanding the other provisions of this Upgrade Policy, Customer may not submit a support request for “no Upgrade” for any Upgrade to, or that is essential for, the infrastructure network, hardware, or software used by ServiceNow to operate and deliver the Subscription Service.

Page 886688 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 7 (version 11/12/2014)

DATA SECURITY GUIDE
Security Statement of an Enterprise IT Cloud Company
The ServiceNow cloud is built for the enterprise customer with every aspect aimed towards meeting the customer’s demand for reliability, availability and security. ServiceNow’s comprehensive approach to address this demand is enabled by the following: (a) ServiceNow’s robust cloud infrastructure runs on its own applications and utilizes industry best-of-breed technology to automate mission critical functionalities in the cloud service with around-the-clock and around-the-world delivery; (b) ServiceNow achieves flexibility and control in its ability to deliver a stable user experience to the customer by having a logical single tenant architecture; (c) ServiceNow’s application development which has a paramount focus on quality, security, and the user experience is closely connected to the operations of delivering those applications in a reliable and secure cloud environment; (d) ServiceNow invests in a comprehensive compliance strategy that allows its customers to attain their own compliance to applicable laws by obtaining attestations and certifications and running its subscription service from paired data centers situated close to where its customers are located; and (e) ServiceNow’s homogeneous environment where all applications are on a single platform offers ServiceNow a competitive advantage in being able to concentrate its efforts to make the customer’s user experience the best possible.

This Data Security Guide describes the measures ServiceNow takes to protect Customer Data when it resides in the ServiceNow cloud. This Data Security Guide forms a part of any legal agreement into which this Data Security Guide is explicitly incorporated by reference (the “Agreement”) and is subject to the terms and conditions of the Agreement. Capitalized terms that are not otherwise defined herein shall have the meaning given to them in the Agreement.

1. SECURITY PROGRAM
While providing the Subscription Service, ServiceNow shall maintain a written information security program of policies, procedures and controls (“Security Program”) governing the processing, storage, transmission and security of Customer Data. The Security Program includes industry standard practices designed to protect Customer Data from unauthorized access, acquisition, use, disclosure, or destruction. ServiceNow may periodically review and update the Security Program to address new and evolving security technologies, changes to industry standard practices, and changing security threats, provided that any such update does not materially reduce the commitments, protections or overall level of service provided to Customer as describedherein.

2. CERTIFICATIONS AND ATTESTATIONS

2.1. Certifications and Attestations. ServiceNow shall establish and maintain sufficient controls to meet the objectives stated in ISO 27001 and SSAE 16 / SOC 1 and SOC 2 Type 2 (or equivalent standards) (collectively, the “Standards”) for the information security management system supporting the Subscription Service. At least once per calendar year, ServiceNow shall perform an assessment against such Standards (“Assessment”). Upon Customer’s written request, which shall be no more than once per calendar year, ServiceNow shall provide a summary of the Assessment(s) to Customer. Assessments shall be Confidential Information of ServiceNow.

2.2. Safe Harbor. ServiceNow shall maintain self-certified compliance under the U.S.-EU and U.S.- Swiss Safe Harbor Frameworks developed by the U.S. Department of Commerce regarding the collection, use and retention of Personal Data (defined in Section 6 below) from European Union member countries and Switzerland.

3. PHYSICAL, TECHNICAL AND ADMINISTRATIVE SECURITY MEASURES The Security Program shall include the following physical, technical and administrative measures designed to protect Customer Data from unauthorized access, acquisition, use, disclosure, ordestruction:

3.1. Physical Security Measures
(a) Data Center Facilities: (i) Physical access restrictions and monitoring that may include a combination of any of the following: multi-zone security, man-traps, appropriate perimeter deterrents (for example,

Page 886699 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 8 (version 11/12/2014)
fencing, berms, guarded gates), on-site guards, biometric controls, CCTV, and secure cages; and (ii) fire detection and fire suppression systems both localized and throughout the data centerfloor. (b) Systems, Machines and Devices: (i) Physical protection mechanisms; and (ii) entry controls to limit physical access.
(c) Media: (i) Industry standard destruction of sensitive materials before disposition of media; (ii) secure safe for storing damaged hard disks prior to physical destruction; and (iii) physical destruction of all decommissioned hard disks storing Customer Data.

3.2. Technical Security Measures
(a) Access Administration. Access to the Subscription Service by ServiceNow employees and contractors is protected by authentication and authorization mechanisms. User authentication is required to gain access to production and sub-production systems. Access privileges are based on job requirements and are revoked upon termination of employment or consulting relationship. Production infrastructure includes appropriate user account and password controls (for example, the required use of virtual private network connections, complex passwords with expiration dates, and a two-factored authenticated connection) and is accessible for administration.
(b) Logging and Monitoring. The production infrastructure log activities are centrally collected and are secured in an effort to prevent tampering and are monitored for anomalies by a trained security team.
(c) Firewall System. An industry-standard firewall is installed and managed to protect ServiceNow systems by residing on the network to inspect all ingress connections routed to the ServiceNow environment.
(d) Vulnerability Management. ServiceNow conducts periodic independent security risk evaluations to identify critical information assets, assess threats to such assets, determine potential vulnerabilities, and provide for remediation. When software vulnerabilities are revealed and addressed by a vendor patch, ServiceNow will obtain the patch from the applicable vendor and apply it within an appropriate timeframe in accordance with ServiceNow's then current vulnerability management and security patch management standard operating procedure and only after such patch is tested and determined to be safe for installation in all production systems.
(e) Antivirus. ServiceNow updates anti-virus, anti-malware, and anti-spyware software on regular intervals and centrally logs events for effectiveness of such software. (f) Change Control. ServiceNow ensures that changes to platform, applications and production infrastructure are evaluated to minimize risk and are implemented following ServiceNow’s standard operating procedure.

3.3. Administrative Security Measures
(a) Data Center Inspections. ServiceNow performs routine reviews at each data center to ensure that it continues to maintain the security controls necessary to comply with the Security Program. (b) Personnel Security. ServiceNow performs background and drug screening on all employees and all contractors who have access to Customer Data in accordance with ServiceNow’s then current applicable standard operating procedure and subject to applicable law. (c) Security Awareness and Training. ServiceNow maintains a security awareness program that includes appropriate training of ServiceNow personnel on the Security Program. Training is conducted at time of hire and periodically throughout employment at ServiceNow. (d) Vendor Risk Management. ServiceNow maintains a vendor risk management program that assesses all vendors that access, store, process or transmit Customer Data for appropriate security controls and business disciplines.

Page 887700 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 9 (version 11/12/2014)

4. DATA PROTECTION AND SERVICE CONTINUITY

4.1. Data Centers; Data Backup. ServiceNow shall host Customer’s instances in primary and secondary SSAE 16 Type II or ISO 27001 certified (or equivalent) data centers in the geographic regions specified on the Order Form for the Subscription Term. Each data center includes full redundancy (N+1) and fault tolerant infrastructure for electrical, cooling and network systems. The deployed servers are enterprise scale servers with redundant power to ensure maximum uptime and service availability. The production database servers are replicated in near real time to a mirrored data center in a different geographic region. Each customer instance is supported by a network configuration with multiple connections to the Internet. ServiceNow backs up all Customer Data in accordance with ServiceNow’s standard operating procedure.

4.2. Personnel. In the event of an emergency that renders the customer support telephone system unavailable, all calls are routed to an answering service that will transfer to a ServiceNow telephone support representative, geographically located to ensure business continuity for support operations.

5. INCIDENT MANAGEMENT AND BREACH NOTIFICATION

5.1. Incident Monitoring and Management. ServiceNow shall monitor, analyze and respond to security incidents in a timely manner in accordance with ServiceNow’s standard operating procedure. Depending on the nature of the incident, ServiceNow security group will escalate and engage response teams necessary to address an incident.

5.2. Breach Notification. Unless notification is delayed by the actions or demands of a law enforcement agency, ServiceNow shall report to Customer the unauthorized acquisition, access, use, disclosure or destruction of Customer Data (a “Breach”) promptly following determination by ServiceNow that a Breach occurred. The initial report shall be made to Customer security contact(s) designated in ServiceNow’s customer support portal. ServiceNow shall take reasonable measures to promptly mitigate the cause of the Breach and shall take reasonable corrective measures to prevent future Breaches. As information is collected or otherwise becomes available to ServiceNow and unless prohibited by law, ServiceNow shall provide information regarding the nature and consequences of the Breach that are reasonably requested to allow Customer to notify affected individuals, government agencies and/or credit bureaus. Customer is solely responsible for determining whether to notify impacted Data Subjects (defined in 6.1 below) and for providing such notice, and for determining if regulatory bodies or enforcement commissions applicable to Customer or Customer Data need to be notified of a Breach.

5.3. Customer Cooperation. Customer agrees to cooperate with ServiceNow in maintaining accurate contact information in the customer support portal and by providing any information that is reasonably requested to resolve any security incident, identify its root cause(s) and prevent a recurrence.

6. DATA PROCESSING GUIDELINES; COMPLIANCE WITH LAWS

6.1. Customer as Data Controller. Customer acknowledges that in relation to Personal Data supplied and/or processed under the Agreement it acts as Controller and it warrants that it will duly observe all of its obligations under all applicable laws and regulations of the European Union, the European Economic Area and their member states regarding the processing of Personal Data (collectively referred to as “Data Protection Laws”) including, without limitation, obtaining and maintaining all necessary notifications and obtaining and maintaining all necessary Data Subject Consents. Customer shall (i) have sole responsibility for the accuracy, quality, integrity, legality and reliability of Personal Data and of the means by which it acquired Personal Data, (ii) ensure that data processing instructions given to ServiceNow comply with applicable Data Protection Laws, and (iii) comply with all applicable Data Protection Laws in collecting, compiling, storing, accessing and using Personal Data in connection with the Subscription Service. For the purposes of this Data Security Guide, “Personal Data”, “Controller”, “Data Subject” and “Data Subject Consent” shall have the meaning given to these terms in Directive 95/46/EC. For clarity, “process” or “processing” means any operation or set of operations performed upon Customer Data.

6.2. ServiceNow as Data Processor. ServiceNow shall process or otherwise use Personal Data (including possible onward transfers) on behalf of Customer solely for the purpose of providing the services

Page 887711 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 10 (version 11/12/2014)
described in the Agreement and only in accordance with Customer’s lawful instructions (limited to those instructions which ServiceNow can reasonably carry out in the provision of the Subscription Service), the terms of the Agreement, and this Data Security Guide. ServiceNow shall ensure that those employees to whom it grants access to such Personal Data are directed to keep such Personal Data confidential and are informed of any additional data protection obligations applicable to such Personal Data. ServiceNow shall, to the extent legally permitted, promptly notify Customer with respect to any request or communication ServiceNow receives from any regulatory authority in relation to any data processing activities ServiceNow conducts on behalf of Customer. In addition, ServiceNow will cooperate and assist Customer, at Customer’s cost, in relation to any such request and to any response to any such communication. ServiceNow will pass on to the Customer any requests of a Data Subject to access, delete, correct, or block Personal Data processed under the Agreement. If ServiceNow is compelled by law to disclose Customer's information as part of a civil proceeding to which Customer is a party, and Customer is not contesting the disclosure, Customer will reimburse ServiceNow for its reasonable cost of compiling and providing secure access to that information.

6.3. Subcontractors. ServiceNow may engage subcontractors for processing Customer Data under the Agreement, provided ServiceNow shall ensure compliance by such subcontractor(s) with the requirements of this Section 6 by entering into written agreements with such subcontractors which provide that the subcontractor will apply the Safe Harbor principles to the processing of Personal Data. ServiceNow’s use of any subcontractor will not relieve, waive or diminish any obligation ServiceNow has under the Agreement or this Data Security Guide.

7. PENETRATION TESTS

7.1. By a Third Party. ServiceNow contracts with third party vendors to perform an annual penetration test on the ServiceNow platform to identify risks and remediation that help increase security.

7.2. By Customer. No more than once per calendar year Customer may request to perform, at its own expense, an application penetration test of its instances of the Subscription Service. Customer shall notify ServiceNow in advance of any test by submitting a request using ServiceNow’s online support portal and completing a penetration testing agreement. ServiceNow and Customer must agree upon a mutually acceptable time for the test; and Customer shall not perform a penetration test without ServiceNow’s express written authorization. The test must be of reasonable duration, and must not interfere with ServiceNow’s day-to-day operations. Promptly upon completion of the penetration test, Customer shall provide ServiceNow with the test results including any detected vulnerability. Upon such notice, ServiceNow shall, consistent with industry standard practices, use all commercially reasonable efforts to promptly make any necessary changes to improve the security of the Subscription Service. Customer shall treat the test results as Confidential Information of ServiceNow.

8. SHARING THE SECURITY RESPONSIBILITY

8.1. Product Capabilities. The Subscription Service has the capabilities to: (i) authenticate users before access; (ii) encrypt passwords; (iii) allow users to manage passwords; and (iv) prevent access by users with an inactive account. Customer manages each user’s access to and use of the Subscription Service by assigning to each user a credential and user type that controls the level of access to the SubscriptionService.

8.2. Customer Responsibilities. ServiceNow provides the cloud environment that permits Customer to use and process Customer Data in the Subscription Service. The architecture in the Subscription Service includes, without limitation, column level encryption functionality and the access control list engine. Customer shall be responsible for using the column level encryption functionality and access control list engine for protecting all Customer Data containing sensitive data, including without limitation, credit card numbers, social security numbers, financial and health information, and sensitive personal data. Customer is solely responsible for the results of its decision not to encrypt such sensitive data. ServiceNow protects all Customer Data in the ServiceNow cloud infrastructure equally in accordance with this Data Security Guide, regardless of the classification of the type of Customer Data. Customer shall be responsible for protecting the confidentiality of each user’s login and password and shall manage each user’s access to the Subscription Service.

Page 887722 ends

SUBSCRIPTION SERVICE GU DE EFFECTIVE DATE: NOVEMBER 12, 2014 SERVICENOW CONFIDENTIAL Page 11 (version 11/12/2014)

8.3. Customer Cooperation. Customer shall promptly apply any application upgrade that ServiceNow determines is necessary to maintain the security, performance or availability of the Subscription Service.

8.4. Limitations. Notwithstanding anything to the contrary in the Agreement or this Data Security Guide, ServiceNow’s obligations extend only to those systems, networks, network devices, facilities and components over which ServiceNow exercises control. This Data Security Guide does not apply to: (i) information shared with ServiceNow that is not data stored in its systems using the Subscription Service; (ii) data in Customer’s virtual private network (VPN) or a third party network; or (iii) any data processed by Customer or its users in violation of the Agreement or this Data Security Guide.

Page 887733 ends

Page 887744 ends

ServiceNow and the ServiceNow logo are trademarks of ServiceNow, Inc. All other brand and product names are trademarks or registered trademarks of their respective holders. 2 ServiceNow Product Overview
Effective Date: May 2, 2016
DemandManagement ConsolidatesIT requests through a service catalog and routesthem in a workflow to stakeholders who gather additional information to prioritize investment decisions.

Discovery Locates physical and virtual devices connected to an enterprise network.

When Discovery locates a device, it explores its configuration, status, software, and relationshipsto other connected devices, and updatesthe Configuration Management Data Base (CMDB).

Edge Encryption Resides on Customer-owned servers and encrypts and decrypts eligible data stored in their instance. Customer controls and manages the encryption keys for the eligible data in theirinstance.

Enterprise Service Portal -HR In support of HR service delivery, provides employee self-service via an HR service catalog and provides HR the capability to assign tasks to employees.

Uses prebuilt layouts, controls, and content. Requires HR Service Management.

Event Management Aggregates events from monitoring tools used by Customer in its infrastructure, de-duplicates and correlatesinputsfrom such eventsto CMDB, and providesthe ability to filter and prioritize eventsto create incidentsfor remediation.

Facilities ServiceManagement Provides capabilitiesto manage the service delivery of a facilities department by offering a self-service catalog and assignment of requests based on fulfillmentrules.

Field ServiceManagement Provides capabilitiesto create work order recordsfor the repair and service of equipment. Requires AssetManagement.

Financial Planning Assists executives and budget owners in the automation of budget and forecast planning, helping to increase efficiency and simplify theplanning process.

Finance Service Management Enables the finance department to define its services and fulfillrequests through workflow capabilities and knowledge management, andprovides visibility into resource utilization and service delivery performance through dashboards.

HR ServiceManagement Provides capabilities to manage HR service delivery using casemanagement to document the interactions between the employee and HR supportedby the knowledge base.

IncidentManagement Facilitates the process of restoring normal IT operations by providing capabilitiesto record, classify, distribute, and manage incidentsthrough to resolution. Includes Performance Analyticslimited to 15 key performance indicators(KPIs), one dashboard and 90 days of data captured by Incident Management.

Legal Service Management Enables the legal department to define its services and fulfill requests through workflow capabilities and knowledge management, and provides visibility into resource utilization and service delivery performance through dashboards.

Marketing Service Enablesthe marketing department to define its services and fulfill requests

Page 887755 ends

ServiceNow and the ServiceNow logo are trademarks of ServiceNow, Inc. All other brand and product names are trademarks or registered trademarks of their respective holders. 3 ServiceNow Product Overview
Effective Date: May 2, 2016
Management through workflow capabilities and knowledge management, andprovides visibility into resource utilization and service delivery performance through dashboards.

Notify Providesthe capability to initiate notification from Customer’sinstance of the subscription service to a supported third-party platform for SMS, voice and other communications protocols.

Customerisrequired to separately purchase any third-party service required to work withNotify.

Orchestration Core Enables orchestration of activities outside Customer’s instance ofthe subscription service. Allows Customer to automate discrete tasks or processes using graphical workflowsthat interact with external systems or services.

Password Reset Providesthe capability to reset User’s passwords that are stored and preauthenticated in a credentialstore outside Customer’sinstance ofthe subscription service,such as Active Directory and othersupported credential stores. Requires Orchestration Core.

PerformanceAnalytics Provides advanced analytics and time series analysisfor KPIs.

PlatformRuntime Allows customer to deploy applications developed on the ServiceNow Platform into production.

Policy andCompliance
Management
Provides a centralized process for creating and managing policies, standards, and internal control proceduresthat are cross-mapped to external regulations and best practices. Additionally, the application providesstructured workflows for the identification, assessment, and continuous monitoringof control activities.

ProblemManagement Facilitates the process of identifying the root causes of errors in the IT infrastructure by providing capabilitiesto record, escalate, and manage problemsthrough to resolution.

Project PortfolioManagement Provides capabilitiesto plan, organize, and manage projects and project portfoliosincluding associated tasks and resources.

ReleaseManagement Facilitatesthe planning, design, build, configuration, testing, and release of hardware and software into the IT infrastructure.

RequestManagement Provides capabilitiesto approve and fulfill requestsfor goods and services defined and presented in the service catalog.

ResourceManagement Provides a view of projects and the availability, allocation, and capacity of assignedresources.

Risk Management Provides an executive view into risk to allow risk managersto quickly identify at-risk assets, perform assessments, and continuously monitor risk exposure.

Security Incident Response Enables SOC/SIRT teams to enact response plans to addresssecurity-related activities, events or incidents. Enables response team collaboration, investigation of network and non-network related activities (i.e.intellectual property theft, criminal activities, etc.) and includes the capability for automated request assignment and remediation across IT and security teams.

Page 887766 ends

Page 887777 ends

ServiceNow and the ServiceNow logo are trademarks of ServiceNow, Inc. All other brand and product names are trademarks or registered trademarks of their respective holders. 5 ServiceNow Product Overview
Effective Date: May 2, 2016
Google Maps ServiceNow may make Google Maps available for use with the subscription service. If Customer uses Google Maps, Customer agrees to the following terms: (i) Customer shall limit its use to 60,000 map views on an annual basis and additional use shall be purchased from Google subject to Google’s terms and conditions, to which ServiceNow is not a party; (ii) Customer agrees, and shall cause its end users to agree, to Google’s Maps Terms (http://maps.google.com/help/terms maps.html or a successor URL as provided by Google), the Legal Notices
(http://www.maps.google.com/help/legalnotices maps.html or asuccessor URL as provided by Google), and the Acceptable Use Policy (http://www.google.com/enterprise/earthmaps/legal/us/maps AUP.html or a successor URL as provided by Google); and (iii) Customer agrees that Google may use Customer data in accordance with its privacy policy and that Google may provide its maps services to Customer. Google Maps may not be available to Customer due to location availability and may not be available during Customer’s entire subscription term. ServiceNow support and warranty do not apply to Google Maps.

Graphical Workflow Provides the capability to automate multi-step processes within Customer’s instance of the subscription service. Each workflow can manage a sequence of activities, such as creating records or running scripts, and the condition-based transitions between them.

Customer is required to purchase Orchestration Core to orchestrate activities using the Graphical Workflow that interact outside Customer’s instance of the subscription service.

KnowledgeManagement Provides role-based tools to create, store, and publish information.

Provides mechanisms for version control and approvals of documents in the reviewprocess.

Live Feed Provides a place to post and sharecontent.

Mobile Provides a customizable ServiceNow interface formobile devices.

On-Call Scheduling Enables creation of on-callschedules and escalation rosters.

OpenFrame An interface technology that enablesreal-time communication channels such astelephone systemsto be integrated into the ServiceNow Platform.

OpenFrame consists of UI elements as well as a set of APIs thatsupport exchange of events and data between ServiceNow and the communications system.

Reporting Providesthe capability to create and share reports and dashboards.

REST API Provides the ability to integrate external systems through REST APIs using standard respond codes, header information, pagination support and streaming data on requests.

Service Catalog Displays a listing of the goods and services that Customer provides within the enterprise to its employees and contractors.

Service Creator Provides capabilities for building no-code service catalog items.

Page 887788 ends

ServiceNow and the ServiceNow logo are trademarks of ServiceNow, Inc. All other brand and product names are trademarks or registered trademarks of their respective holders. 6 ServiceNow Product Overview
Effective Date: May 2, 2016
Service LevelManagement Establishes and monitors status of service contracts and SLAs between the organization and its customers orthird-party service providers.

Service Portal Designer Provides the capability to build portals with a consumer-like experience using both ServiceNow out-of-the-box widgets and templates as well as Customer’s own widgets and styles, while leveraging only HTML andCSS.

SkillsManagement Assigns configured competenciesto groups or users.

Studio Integrated Development Environment (IDE) for professional and low-code (i.e., IT administration) applicationdevelopers.

SurveyManagement Allows for polling and collection of data, including configuration for specific events and/or conditions.

Time Cards Recordstime worked on tasks either manually or automatically.

Visual Task Boards Enables a Kanban-style workspace for either individual or team-based management of tasks.

Visualizations Displays interactive 2-D and 3-D visual representations for any logical data relationships within an instance.

Page 887799 ends

SERVICENOW EXPRESS GENERAL TERMS AND CONDITIONS
SERVICENOW PROPR ETARY AND CONFIDENTIAL Page 1 (version 10/21//2014)

GENERAL TERMS AND CONDITIONS
These General Terms and Conditions and any referenced documents form the agreement (the “Agreement”) under which an Order Form is executed.

1. PROVISION OF SERVICES
ServiceNow will make the following purchased services available to Customer, subject to the terms and conditions of the Agreement and each ordering document signed by Customer and ServiceNow (each, an “Order Form”) and the product overview attached thereto or referenced therein (“Product Overview”), including without limitation:
(a) use of the ServiceNow applications which are made available by ServiceNow as a software as a service (SaaS) (“Subscription Service”); and
(b) professional services and training services (“Professional Services”).

An Order Form for Professional Services shall specify ServiceNow packaged professional services (each offering, a “Packaged Service”), as described in one or more service descriptions (if not attached to the Order Form, then as set forth on www.servicenow.com/be schedules.do) (“Service Description”) or other Professional Services described in one or more written statements of work (“SOW”) signed by ServiceNow and Customer.

2. ORDERING

2.1 ORDERS AND PAYMENT. Upon execution by Customer and ServiceNow, each Order Form is noncancellable and non-refundable except as provided in the Agreement. Prices stated in each Order Form are final. Except as expressly set forth in the applicable Order Form, Subscription Service fees are invoiced annually in advance. Each Subscription Term (as defined in Section 3.1) as set forth in the Order Form is a continuous and non-divisible commitment for the full duration of the Subscription Term regardless of the invoice schedule. Except as expressly set forth in the applicable Order Form or SOW or Service Description, Professional Services fees are invoiced on a time and materials basis monthly in arrears. Customer shall pay each invoice in full within thirty (30) days after the date of invoice. Customer may issue a purchase order consistent with the terms of the Order Form, but a purchase order is not required. If Customer issues a purchase order, then it shall be for the full amount of the Order Form, and any additional or conflicting terms appearing in a purchase order shall not amend the Order Form or the Agreement. Upon request, ServiceNow shall reference the purchase order number on its invoices (solely for administrative convenience) so long as Customer provides the purchase order at least fifteen (15) business days prior to the date of the invoice. Late payments shall accrue interest at a rate of one and one-half percent (1.5%) per month or the legal maximum interest rate, whichever is lower. If Customer is delinquent in payment of amounts for the services owed hereunder, ServiceNow may give notice to Customer of such delinquency and, in such case, Customer shall cure the delinquency within thirty (30) days from the date of ServiceNow’s written notice. If Customer fails to cure the delinquency, ServiceNow may suspend Customer’s use of the Subscription Service or terminate the Agreement for cause in accordance with Section 7 (Term and Termination), in addition to other rights and remedies available.

2.2 TAXES. All payments required by the Agreement are stated exclusive of all taxes, duties, levies, imposts, fines or similar governmental assessments including sales and use taxes, value-added taxes (“VAT”), goods and services taxes (“GST”), excise, business, service, and similar transactional taxes imposed by any jurisdiction and the interest and penalties thereon (collectively, “Taxes”). Customer shall be responsible for and bear Taxes associated with its purchase of, payment for, access to or use of the Subscription Service and Professional Services. Taxes shall not be deducted from the payments to ServiceNow, except as required by law, in which case Customer shall increase the amount payable as necessary so that after making all required deductions and withholdings, ServiceNow receives and retains (free from any Tax liability) an amount equal to the amount it would have received had no such deductions or withholdings been made. Each party is responsible for and shall bear taxes imposed on its net income. If Customer is a tax-exempt entity or claims exemption from any Taxes under the Agreement, Customer shall provide a tax exemption number on the Order Form and a certificate upon execution of the Order Form and, after receipt of valid evidence of exemption, ServiceNow shall not charge Customer any Taxes from which it is exempt. If ServiceNow is required to invoice or collect Taxes associated with Customer’s purchase of, payment for, access to or use of the Subscription Service or Professional Services, ServiceNow will issue an invoice to Customer including the amount of those Taxes, itemized where required by law. Customer shall provide to ServiceNow its VAT or GST identification number(s) on the Order Form for (i) the country where Customer has established its business and/or (ii) any other country where Customer has a fixed establishment. Customer shall use the ordered Subscription Service and Professional Services for Customer's business use in the foregoing location(s) in accordance with the provided VAT or GST identification number(s). The parties’ obligations under this Section shall survive the termination or expiration of the Agreement.

Page 888800 ends

Rancho Cucamonga City CouncilAugust 19, 2026

Rancho Cucamonga City Council
August 19, 2026