This order, including any subject matter addressed in the Service Specifications, shall supersede any inconsistent term, similar subject matter or scope of service delivery in the Agreement referenced above in Section A.1; however, unless expressly stated otherwise in this order, the terms of the Data Processing Agreement shall take precedence over any inconsistent terms in this order, the Agreement or other Service Specifications. This order will control over the terms contained in any purchase order.
C. Quote Reference:
05/02 NEW SaaS Renewal for CITY OF ROSEVILLE_Opower HER_Web.
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG CPQ-3737135_CITY OF ROSEVILLE_Q 18102657_TG
PUBLIC SECTOR AGREEMENT FOR ORACLE CLOUD SERVICES
This Public Sector Agreement for Oracle Cloud Services (this is between Oracle America, Inc. or and the entity that has executed this Agreement as identified in the signature block below or This Agreement sets forth the terms and conditions that govern orders placed under this Agreement.
1. USE OF THE SERVICES
1.1. Agreement and Your order. Except as otherwise stated in this Agreement or Your order, You have the nonexclusive, worldwide, limited right to use the Services during the period defined in Your order, unless earlier terminated in accordance with this Agreement or Your order (the business operations. You may allow Your Users (as defined below) to use the Services for this purpose, and You are responsible for their compliance with this Agreement and Your order.
1.2. The Service Specifications describe and govern the Services. During the Services Period, we may update the Services and Service Specifications to reflect changes in, among other things, laws, regulations, rules, technology, industry practices, patterns of system use, and availability of Third Party Content (as defined below).
Oracle updates to the Services or Service Specifications will not materially reduce the level of performance, functionality, security or availability of the Services during the Services Period of Your order.
1.3. You may not, and may not cause or permit others to: (a) use the Services to harass any person; cause damage or injury to any person or property; publish any material that is false, defamatory, harassing or obscene; violate privacy rights; promote bigotry, racism, hatred or harm; send unsolicited bulk e-mail, junk mail, spam or chain letters; infringe intellectual or other property rights; sell, manufacture, market and/or distribute any product or service in violation of applicable laws; or otherwise violate applicable laws, ordinances or regulations; (b) perform or disclose any benchmarking or availability testing of the Services, except as permitted in the Service prior written approval, except as permitted in the Service Specifications, or perform or disclose network discovery, port and service identification, vulnerability scanning, password cracking or remote access testing of the Services; or (d) use the Services to perform cyber currency or crypto currency mining ((a) through (d) collectively, the In addition to other rights that we have in this Agreement and Your order, we have the right to take remedial action if the Acceptable Use Policy is violated, and such remedial action may include removing or disabling access to material that violates the policy.
2. FEES AND PAYMENT
2.1. All fees payable are due within 30 days from the invoice date. Once placed, Your order is non-cancelable and the sums paid nonrefundable, except as provided in this Agreement or Your order. You will pay any sales, valueadded or other similar taxes imposed by applicable law that we must pay based on the Services You ordered, except for taxes based on our income. Fees for Services listed in an order are exclusive of taxes and expenses, unless expressly stated otherwise in Your order.
2.2. If You exceed the quantity of Services ordered, then You promptly must purchase and pay fees for the excess quantity.
2.3. You understand that You may receive multiple invoices for the Services. Invoices will be submitted to You pursuant to Oracle's Invoicing Standards Policy, available at https://www.oracle.com/contracts/cloud-services. 3. OWNERSHIP RIGHTS AND RESTRICTIONS
3.1. You or Your licensors retain all ownership and intellectual property rights in and to Your Content (as defined below). We or our licensors retain all ownership and intellectual property rights in and to the Services, derivative works thereof, and anything developed or delivered by or on behalf of us under this Agreement.
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG CPQ-3737135_CITY OF ROSEVILLE_Q 18102657_TG
3.2. You may have access to Third Party Content through use of the Services. Unless otherwise stated in Your order, all ownership and intellectual property rights in and to Third Party Content and the use of such content is governed by separate third party terms between You and the third party.
3.3. You have the authority to and do grant us the right to host, use, process, display and transmit Your Content to provide the Services pursuant to and in accordance with this Agreement and Your order. You have sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of Your Content, and for obtaining all rights related to Your Content required by Oracle to perform the Services.
3.4. Except as permitted by this Agreement or Your order, You may not, and may not cause or permit others to:
(a) modify, make derivative works of, disassemble, decompile, reverse engineer, reproduce, republish, download, or copy any part of the Services (including data structures or similar materials produced by programs); (b) access or use the Services to build or support, directly or indirectly, products or services competitive to Oracle; or (c) license, sell, transfer, assign, distribute, outsource, permit timesharing or service bureau use of, commercially exploit, or make available the Services to any third party.
4. NONDISCLOSURE
4.1. By virtue of this Agreement, the parties may disclose to each other information that is confidential idential Confidential Information shall be limited to the terms and pricing under this Agreement and Your order, Your Content residing in the Services, and all information clearly identified as confidential at the time of disclosure.
4.2. (a) is or becomes a part of the public
disclosure and had not been obtained by the other party either directly or indirectly from the disclosing party; (c) is lawfully disclosed to the other party by a third party without restriction on the disclosure; or (d) is independently developed by the other party.
4.3 Su
third party other than as set forth in the following sentence for a period of five years from the date of the disclosing disclosure of the Confidential Information to the receiving party; however, we will protect the confidentiality of Your Content residing in the Services for as long as such information resides in the Services. Each party may disclose Confidential Information only to those employees, agents or subcontractors who are required to protect it against unauthorized disclosure in a manner no less protective than required under this Agreement, and each party required by law.
4.4 The parties acknowledge and agree that You and this Agreement are subject to applicable freedom of information or open
Confidential Information to a third party, in order to allow Oracle sufficient time to seek injunctive relief or other relief against such disclosure.
5. PROTECTION OF YOUR CONTENT
5.1. In order to protect Your Content provided to Oracle as part of the provision of the Services, Oracle will comply with the applicable administrative, physical, technical and other safeguards, and other applicable aspects of system and content management, available at https://www.oracle.com/contracts/cloud-services. 5.2. To the extent Your Content includes Personal Information (as that term is defined in the applicable data privacy policies and the Data Processing Agreement (as defined below)), Oracle will furthermore comply with the following:
a. the relevant Oracle privacy policies applicable to the Services, available at http://www.oracle.com/us/legal/privacy/overview/index.html; and b.
The version of the Data Processing Agreement
applicable to Your order (i) is available at https://www.oracle.com/contracts/cloud-services and is incorporated herein by reference, and (ii) will remain in force during the Services Period of Your order. In
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG CPQ-3737135_CITY OF ROSEVILLE_Q 18102657_TG
the event of any conflict between the terms of the Data Processing Agreement and the terms of the Service Specifications (including any applicable Oracle privacy policies), the terms of the Data Processing Agreement shall take precedence.
5.3. Without prejudice to Sections 5.1 and 5.2 above, You are responsible for (a) any required notices, consents and/or authorizations related to Your provision of, and our processing of, Your Content (including any Personal Information) as part of the Services, (b) any security vulnerabilities, and the consequences of such vulnerabilities, arising from Your Content, including any viruses, Trojan horses, worms or other harmful programming routines contained in Your Content, and (c) any use by You or Your Users of the Services in a manner that is inconsistent with the terms of this Agreement and/or Your order. To the extent You disclose or transmit Your Content to a third
5.4. Unless otherwise specified in Your order (including in the Service Specifications), Your Content may not include any data that imposes specific data security, data protection, or regulatory obligations on Oracle in addition to or different from those specified in the Data Processing Agreement, Service Specifications or this Agreement.
If Your Content includes any of the foregoing data (e.g., certain regulated health or payment card information), Oracle will process such data only pursuant to the terms of Your order, the Data Processing Agreement, Service Specifications and this Agreement. You are responsible for complying with Your specific regulatory, legal or data security obligations which may apply to such data. If available for the Services, You may purchase additional services from us (e.g., Oracle Payment Card Industry Compliance Services) designed to address specific data security, data protection or regulatory requirements applicable to such data.
6. WARRANTIES, DISCLAIMERS AND EXCLUSIVE REMEDIES
6.1. Each party represents that it has validly entered into this Agreement and that it has the power and authority to do so. We warrant that during the Services Period we will perform the Services using commercially reasonable care and skill and in all material If
the Services provided to You were not performed as warranted, You must promptly provide us with a written notice that describes the deficiency in the Services (including, as applicable, the service request number notifying us of the deficiency in the Services).
6.2. WE DO NOT WARRANT THAT THE SERVICES WILL BE PERFORMED ERROR-FREE OR
UNINTERRUPTED, THAT WE WILL CORRECT ALL SERVICES ERRORS, OR THAT THE SERVICES WILL MEET YOUR REQUIREMENTS OR EXPECTATIONS. WE ARE NOT RESPONSIBLE FOR ANY ISSUES
RELATED TO THE PERFORMANCE, OPERATION OR SECURITY OF THE SERVICES THAT ARISE FROM YOUR CONTENT OR THIRD PARTY CONTENT OR SERVICES PROVIDED BY THIRD PARTIES.
FOR ANY BREACH OF THE SERVICES WARRANTY, YOUR EXCLUSIVE REMEDY AND OUR ENTIRE
LIABILITY SHALL BE THE CORRECTION OF THE DEFICIENT SERVICES THAT CAUSED THE BREACH OF
WARRANTY, OR, IF WE CANNOT SUBSTANTIALLY CORRECT THE DEFICIENCY IN A COMMERCIALLY
REASONABLE MANNER, YOU MAY END THE DEFICIENT SERVICES AND WE WILL REFUND TO YOU THE
FEES PAID FOR THE DEFICIENT SERVICES FOR THE PERIOD OF TIME DURING WHICH THE SERVICES WERE DEFICIENT.
6.3. TO THE EXTENT NOT PROHIBITED BY LAW, THESE WARRANTIES ARE EXCLUSIVE AND THERE ARE
NO OTHER EXPRESS OR IMPLIED WARRANTIES OR CONDITIONS, INCLUDING FOR SOFTWARE,
HARDWARE, SYSTEMS, NETWORKS OR ENVIRONMENTS OR FOR MERCHANTABILITY, SATISFACTORY QUALITY AND FITNESS FOR A PARTICULAR PURPOSE.
7. LIMITATION OF LIABILITY
7.1. IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES BE LIABLE FOR ANY INDIRECT,
CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OR ANY LOSS OF
REVENUE, PROFITS (EXCLUDING FEES UNDER THIS AGREEMENT), SALES, DATA, DATA USE, GOODWILL, OR REPUTATION.
7.2. IN NO EVENT SHALL THE AGGREGATE LIABILITY OF ORACLE AND OUR AFFILIATES ARISING OUT
OF OR RELATED TO THIS AGREEMENT OR YOUR ORDER, WHETHER IN CONTRACT, TORT, OR
OTHERWISE, EXCEED THE TOTAL AMOUNTS ACTUALLY PAID UNDER YOUR ORDER FOR THE ORACLE
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG CPQ-3737135_CITY OF ROSEVILLE_Q 18102657_TG
PRODUCTS OR SERVICES GIVING RISE TO THE LIABILITY DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE DATE OF THE EVENT GIVING RISE TO SUCH LIABILITY.
8. INDEMNIFICATION
If a third party makes a claim against either You or Oracl upon which party received the Material), that any information, design, specification, instruction, software, service, the Provider, at the sole cost and expense, will, to the extent not prohibited by law, defend the Recipient against the claim and indemnify the Recipient from the damages, liabilities, costs and expenses awarded by the court to the third party claiming infringement or the settlement agreed to by the Provider, if the Recipient does the following:
a. notifies the Provider promptly in writing, not later than 30 days after the Recipient receives notice of the claim (or sooner if required by applicable law);
b. gives the Provider sole control of the defense and any settlement negotiations to the extent permitted by law; and
c. gives the Provider the information, authority and assistance the Provider needs to defend against or settle the claim.
8.1. If the Provider believes or it is determined that any of the Material may have violated a third intellectual property rights, the Provider may choose to either modify the Material to be non-infringing (while substantially preserving its utility or functionality) or obtain a license to allow for continued use, or if these alternatives are not commercially reasonable, the Provider may end the license for, and require return of, the applicable Material and refund any unused, prepaid fees the Recipient may have paid to the other party for such Material. If such return materially affects our ability to meet obligations under the relevant order, then we may, upon 30 prior written notice, terminate the order and refund any unused, prepaid fees for the Services under the terminated order. If such Material is third party technology and the terms of the third party license do not allow us to terminate the license, then we may, upon 30 prior written notice, end the Services associated with such Material and refund any unused, prepaid fees for such Services.
8.2. The Provider will not indemnify the Recipient if the Recipient (a) alters the Material or uses it outside the scope s user or program documentation or Service Specifications, or (b) uses a version of the Material which has been superseded (and the Recipient has been notified in writing of the new version), if the infringement claim could have been avoided by using an unaltered current version of the Material which was made available to the Recipient. The Provider will not indemnify the Recipient to the extent that an infringement claim is based upon any material not furnished by the Provider. We will not indemnify You to the extent that an infringement claim is based on Third Party Content or any material from a third party portal or other external source that is accessible or made available to You within or by the Services (e.g., a social media post from a third party blog or forum, a third party web page accessed via a hyperlink, marketing data from third party data providers, etc.).
8.3. This Section 8 provides the exclusive remedy for any claims or damages under Section 8.1.
9. TERM AND TERMINATION
9.1. Unless this Agreement is terminated earlier, You may place orders governed by this Agreement for a period of five years from the date You accept this Agreement. Even if terminated, this Agreement will continue to govern any order for the duration of the Services Period of such order.
9.2. Services shall be provided for the Services Period defined in Your order. Notwithstanding anything to the contrary in the Service Specifications, the Services You order will not be automatically renewed.
9.3. significant threat to the functionality, security, integrity, or availability of the Services or any content, data, or applications in the Services; (b) You or Your Users are accessing or using the Services to commit an illegal act; (c) there is a violation of the Acceptable Use Policy; or (d) You provided false account or payment information or Your digital payment method is refused. When reasonably practicable and lawfully permitted, we will provide You with advance notice of any such suspension. For Services with the applicable operational capability, Oracle will
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG CPQ-3737135_CITY OF ROSEVILLE_Q 18102657_TG
use reasonable efforts to limit any suspension only to the portion of the Services related to the issue causing suspension. We will use reasonable efforts to re-establish the Services promptly after we determine that the issue causing the suspension has been resolved. During any suspension period, we will make Your Content (as it existed on the suspension date) available to You. Any suspension under this Section shall not excuse You from Your payment obligations.
9.4. If either of us breaches a material term of this Agreement or any order and fails to correct the breach within 30 days of written specification of the breach (provided in accordance with Section 16.1 below), then the breaching party is in default and the non-breaching party may terminate (a) in the case of breach of any order, the order under which the breach occurred; or (b) in the case of breach of this Agreement, this Agreement and any orders that have been placed under this Agreement. If we terminate any orders as specified in the preceding sentence, You must pay within 30 days all amounts that have accrued prior to such termination, as well as all sums remaining unpaid for the terminated order(s) plus related taxes and expenses. Except for nonpayment of fees, the nonbreaching party may agree in its sole discretion to extend the 30 day period for so long as the breaching party continues reasonable efforts to cure the breach. You agree that if You are in default under this Agreement and/or Your order, You may not use those Services ordered.
9.5 You may terminate this Agreement at any time without cause by giving Oracle 30 days prior written notice of such termination. Termination of the Agreement will not affect orders that are outstanding at the time of termination.
Those orders will be performed according to their terms as if this Agreement were still in full force and effect.
However, those orders may not be renewed or extended subsequent to termination of this Agreement.
9.6 At the end of the Services Period, we will make Your Content (as it existed at the end of the Services Period) available for retrieval by You during a retrieval period specified in the Service Specifications. Following the retrieval period, and except as may be required by law, we will delete any of Your Content that remains in the Services.
Our data deletion practices are described in more detail in the Service Specifications.
9.7 Provisions that survive termination or expiration of this Agreement are those relating to limitation of liability, indemnification, payment and others which by their nature are intended to survive.
10. THIRD PARTY CONTENT, SERVICES AND WEBSITES
10.1. The Services may enable You to link to, transfer Your Content or Third Party Content to, or otherwise access, Oracle
does not control and is not responsible for Third Party Content or Third Party Services. You are solely responsible for complying with the terms of access and use of Third Party Services, and if Oracle accesses or uses any Third Party Services on Your behalf to facilitate performance of the Services, You are solely responsible for ensuring that such access and use, including through passwords, credentials or tokens issued or otherwise made available to You, is authorized by the terms of access and use for such services. If You transfer or cause the transfer of Your Content or Third Party Content from the Services to a Third Party Service or other location, that transfer constitutes a distribution by You and not by Oracle.
10.2. -
warranty of any kind. We disclaim all liabilities arising from or related to Third Party Content.
10.3. You acknowledge that: (a) the nature, type, quality and availability of Third Party Content may change at any time during the Services Period, and (b) features of the Services that interoperate with Third Party Services, such as Facebook , YouTube and Twitter , etc., depend on respective application programming interfaces (APIs). We may need to update, change or modify the Services under this Agreement as a result of a change in, or unavailability of, such Third Party Content, Third Party Services or APIs. Any change to Third Party Content, Third Party Services or APIs, including their unavailability, during the Services Period does not affect Your obligations under this Agreement or the applicable order, and You will not be entitled to any refund, credit or other compensation due to any such changes.
11. SERVICE MONITORING, ANALYSES AND ORACLE-PROVIDED SOFTWARE
11.1. s operation of the Services; to help resolve Your service requests; to detect and address threats to the functionality, security, integrity, and availability of the Services as well as any content, data, or applications in the Services; and to detect and address illegal acts or violations of the Acceptable Use Policy. Oracle monitoring tools do not collect or store any of Your Content residing
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG CPQ-3737135_CITY OF ROSEVILLE_Q 18102657_TG
in the Services, except as needed for such purposes. Oracle does not monitor, and does not address issues with, non-Oracle software provided by You or any of Your Users that is stored in, or run on or through, the Services.
Information collected by Oracle monitoring tools (excluding Your Content) may also be used to assist in managing product and service portfolio, to help Oracle address deficiencies in its product and service offerings, and for license management purposes.
11.2. We may (a) compile statistical and other information related to the performance, operation and use of the Services, and (b) use data from the Services in aggregated form for security and operations management, to create statistical analyses, and for research and development purposes (above clauses (a) and (b) are collectively We retain all intellectual property rights in Service Analyses.
11.3. We may provide You with the ability to obtain certain Oracle-provided Software (as defined below) for use with the Services. Unless we specify that separate terms will apply to Oracle-provided Software, any Oracleprovided Software is provided as part of the Services and You have the non-exclusive, worldwide, limited right to use, and allow Your Users to use, such Oracle-provided Software, subject to the terms of this Agreement and Your order, solely to facilitate Your authorized use of the Services. Your right to use any Oracle-provided Software will terminate upon the earlier of our notice (by web posting or otherwise) or the end of the Services associated with the Oracle-provided Software. Your right to use any part of the Oracle-provided Software that is licensed under the separate terms is not restricted in any way by this Agreement.
12. HARDWARE DEVICES
The terms in this Section 12 (Hardware Devices) only apply to an order which includes a Hardware Device.
12.1. Your order may include a Hardware Device (as defined below), which You may use with the applicable Services as described in the Service Specifications. The terms of this Agreement and Your order (including those terms that refer to Services) govern Hardware Devices, the Operating System and Integrated Software (both as defined below), unless expressly stated otherwise in this Section 12, or if the terms by their nature would be inapplicable to Hardware Devices.
12.2. We provide a limited warranty for Hardware Devices as described in the Oracle Hardware Warranty available at http://www.oracle.com/contracts/hardware. Any changes to the Oracle Hardware Warranty will not apply to Hardware Devices ordered prior to such change.
12.3. We provide technical support services for Hardware Devices as described in the Service Specifications provided (available at http://www.oracle.com/contracts/hardware), as applicable.
12.4. With respect to our indemnification for Hardware Devices under Section 8, notwithstanding the provisions of Section 8.2, if we believe or it is determined that the Hardware Device (or portion thereof) may have violated a third intellectual property rights, we may choose to either replace or modify the Hardware Device (or portion thereof) to be non-infringing (while substantially preserving its utility or functionality) or obtain a right to allow for continued use, or if these alternatives are not commercially reasonable, we may remove the applicable Hardware Device (or portion thereof) and refund the net book value for the Hardware Device.
12.5. is defined as hardware that meets both of the following requirements: (a) the hardware is managed by or used as part of the Services, and (b) the hardware is designated as a Hardware Device by Oracle. Title to Hardware Devices will transfer to You upon delivery to You unless otherwise specified in Your order.
12.6. refers to the software that manages the Hardware Device. You have the right to use the Operating System delivered with the Hardware Device (and any updates acquired through our technical support services) only as incorporated in, and as part of, the Hardware Device and subject to the terms of the license agreement(s) delivered with or on the Hardware Device. Current versions of the license agreements are located in the documentation for the Hardware Device.
12.7. Hardware Device and enables the functionality of the Hardware Device. Integrated Software does not include and You do not have rights to (a) code or functionality for diagnostic, maintenance, repair or technical support services; or (b) separately licensed applications, development tools, or system management software or other code that is separately licensed by us or a third party. You have the limited, non-exclusive right to use Integrated Software
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG CPQ-3737135_CITY OF ROSEVILLE_Q 18102657_TG
delivered with a Hardware Device (and any updates acquired through our technical support services) only as incorporated in, and as part of, the Hardware Device and subject to any terms delivered with or on the Hardware Device and/or in the applicable documentation.
12.8. We or our licensors retain all ownership and intellectual property rights in and to the Operating System and Integrated Software. The Hardware Device may contain or require the use of third party technology that is provided with or pre-installed on the Hardware Device. Third party technology is licensed under terms which we may provide to You (i) with or on the Hardware Device, (ii) in the applicable product documentation, (iii) in the readme files, or (iv) in the notice files. Your right to use this third party technology under separate license terms are not restricted in any way by this Agreement. We do not warrant or provide any technical support services for this third party technology.
12.9. The Operating System or Integrated Software may include separate works, identified in a readme file, notice file or the applicable documentation, which are licensed under open source or similar license terms; Your rights to use the Operating System and Integrated Software under such terms are not restricted in any way by this Agreement. The appropriate terms associated with these separate works can be found in the readme files, notice files or in the documentation accompanying the Operating System and Integrated Software. For software (i) that is part of the Operating System or Integrated Software and (ii) that You receive from us in binary form and (iii) that is licensed under an open source license that gives You the right to receive the source code for that binary, You may obtain a copy of the applicable source code from https://oss.oracle.com/sources/ or http://www.oracle.com/goto/opensourcecode. If the source code for the software was not provided to You with the binary, You may also receive a copy of the source code on physical media by submitting a written request pursuant to the instructions in the "Written Offer for Source Code" section of the latter website.
13. EXPORT
13.1. other relevant local export laws apply to the Oracle Products and Services ordered under this Agreement. Such export laws govern use of the Oracle Products and Services (including technical data) and any Oracle products or services deliverables provided under this Agreement, and You and we each agree to comply with all such export -
software programs and/or materials resulting from the Oracle products or services (or direct product thereof) will be exported, directly or indirectly, in violation of these laws, or will be used for any purpose prohibited by these laws including, without limitation, nuclear, chemical, or biological weapons proliferation, or development of missile technology.
13.2. You acknowledge that the Services are designed with capabilities for You and Your Users to access the Services without regard to geographic location and to transfer or otherwise move Your Content between the Services and other locations such as User workstations. You are solely responsible for the authorization and management of User accounts across geographic locations, as well as export control and geographic transfer of Your Content.
14. FORCE MAJEURE
Neither You nor we shall be responsible for failure or delay of performance if caused by: an act of war, hostility, or sabotage; act of God; pandemic; electrical, internet, or telecommunication outage that is not caused by the obligated party; government restrictions (including, without limitation, an embargo, economic sanction or the denial or cancelation of any export, import or other license); or other event outside the reasonable control of the obligated party. Both You and we will use reasonable efforts to mitigate the effect of a force majeure event. If such event continues for more than 30 days, either of You or we may cancel unperformed Services and affected orders upon written agreement. take reasonable steps to follow its
normal disaster recovery procedures or Your obligation to pay for the Services.
15. UCITA
The Uniform Computer Information Transactions Act does not apply to this Agreement or to orders placed under it.
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG CPQ-3737135_CITY OF ROSEVILLE_Q 18102657_TG
16. NOTICE
16.1. Any notice required under this Agreement shall be provided to the other party in writing. If You have a legal dispute with us or if You wish to provide a notice under the Indemnification Section of this Agreement, or if You become subject to insolvency or other similar legal proceedings, You will promptly send written notice to: Oracle America, Inc., 500 Oracle Parkway Redwood Shores, CA 94065, Attention: General Counsel, Legal Department.
16.2. We may give notices applicable to our Services customers by means of a general notice on the Oracle portal for the Services, and notices specific to You (a) by electronic mail to Your e-mail address on record in our account information or (b) by written communication sent by first class mail or pre-paid post to Your address on record in our account information.
16.3. You may register to receive notice of updates to the Oracle Cloud Hosting and Delivery Policies and the Data Processing Agreement (and certain other Service Specifications made available by Oracle) at http://www.oracle.com/contracts/cloud-services. 17. ASSIGNMENT You may not assign this Agreement or give or transfer the Services or any interest in the Services to another individual or entity.
18. OTHER
18.1. We are an independent contractor, and each party agrees that no partnership, joint venture, or agency relationship exists between the parties.
18.2. Our business partners and other third parties, including any third parties with which the Services have integrations or that are retained by You to provide consulting services, implementation services or applications that Even if recommended by us,
we are not liable for, bound by, or responsible for any problems with the Services or Your Content arising due to any acts or omissions of any business partner or third party, unless the business partner or third party is providing Services as our subcontractor or is otherwise engaged by Oracle in connection with performance of its obligations under this Agreement, and, if so, then only to the same extent as we would be responsible for our resources under this Agreement.
18.3. If any term of this Agreement is found to be invalid or unenforceable, the remaining provisions will remain effective and such term shall be replaced with another term consistent with the purpose and intent of this Agreement.
18.4. Except for actions for
arising out of or relating to this Agreement may be brought by either party more than two years after the cause of action has accrued.
18.5. Prior to entering into an order governed by this Agreement, You are solely responsible for determining whether the Services meet Your technical, business or regulatory requirements. Oracle will cooperate with Your efforts to determine whether use of the standard Services are consistent with those requirements. Additional fees may apply to any additional work performed by Oracle or changes to the Services. You remain solely responsible for Your regulatory compliance in connection with Your use of the Services.
19. ENTIRE AGREEMENT
19.1. You agree that this Agreement and the information which is incorporated into this Agreement by written reference (including reference to information contained in a URL or referenced policy), together with the applicable order, is the complete agreement for the Oracle Products and Services ordered by You and supersedes all prior or contemporaneous agreements, proposals, negotiations, demonstrations or representations, written or oral, regarding such Oracle Products and Services.
19.2. It is expressly agreed that the terms of this Agreement and any Oracle order shall supersede the terms in any purchase order, procurement internet portal, or other similar non-Oracle document, and no terms included in
Cloud_Cloud Services Agreement (CSA)_US Public Sector_v062223_US_ENG CPQ-3737135_CITY OF ROSEVILLE_Q 18102657_TG
any such purchase order, portal, or other non-Oracle document shall apply to Your order. In the event of any inconsistencies between the terms of an order and the Agreement, the order shall take precedence; however, unless expressly stated otherwise in an order, the terms of the Data Processing Agreement shall take precedence over any inconsistent terms in an order. This Agreement and orders hereunder may not be modified and the rights and restrictions may not be altered or waived except in a writing signed or accepted online by authorized representatives of You and of Oracle; however, Oracle may update the Service Specifications, including by posting updated documents on No third party beneficiary relationships are created by this Agreement.
20. AGREEMENT DEFINITIONS
20.1. -provided Software means any software agent, application or tool that Oracle makes available to You specifically for purposes of facilitating Your access to, operation of, and/or use with, the Services.
20.2. Program Documentation refers to the user manuals, help windows, readme files for the Services and any Oracle-provided Software. You may access the documentation online at http://oracle.com/contracts or such other address specified by Oracle.
20.3. Service Specifications means the following documents, as applicable to the Services under Your order:
(a) the Oracle Cloud Hosting and Delivery Policies, the Program Documentation, the Oracle service descriptions, that are referenced in or incorporated into Your order. The following do not apply to any non-Cloud Oracle service offerings acquired under Your order, such as professional services: the Oracle Cloud Hosting and Delivery Policies and Program Documentation. The following do not apply to any Oracle-provided Software: the Oracle Cloud Hosting and Delivery Policies.
20.4. Third Party Content means all software, data, text, images, audio, video, photographs and other content and material, in any format, that are obtained or derived from third party sources outside of Oracle that You may access through, within, or in conjunction with Your use of, the Services. Examples of Third Party Content include data feeds from social network services, rss feeds from blog posts, Oracle data marketplaces and libraries, dictionaries, and marketing data. Third Party Content includes third-party sourced materials accessed or obtained by Your use of the Services or any Oracle-provided tools.
20.5. Users means, for Services, those employees, contractors, and end users, as applicable, authorized by You or on Your behalf to use the Services in accordance with this Agreement and Your order. For Services that are specifically designed to allow Your clients, agents, customers, suppliers or other third parties to access the Services to interact with You,
and Your order.
20.6. Your Content
photographs, non-Oracle or third party applications, and other content and material, in any format, provided by You or any of Your Users that is stored in, or run on or through, the Services. Services under this Agreement, Oracle-provided Software, other Oracle Products and Services, and Oracle intellectual property, and all derivative Your Content includes any Third Party
Content that is brought by You into the Services by Your use of the Services or any Oracle-provided tools.
Oracle Corporate Security
Practices
December 2024 | Version 3.4
Copyright © 2024, Oracle and/or its affiliates
Oracle Public
1 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public
INTRODUCTION
Oracle, a global provider of enterprise cloud computing, is empowering businesses of all sizes. Oracle cloud services provide leading capabilities in software as a service, infrastructure as a service and data as a service. ractices are multidimensional and reflect the various ways Oracle engages with its customers:
security programs and guide Oracle for its operational and services infrastructure under its control, including accessed by or provided to Oracle while perfo
contractually commit to materially equivalent security practices.
Oracle continually works to strengthen and improve the security controls and practices for Oracle internal operations and Companies that Oracle acquires are required to align with these security practices as part of the integration process. This duration and outcome of each aspect of the integration process relies on the size, complexity, prior contractual commitments and reg
operations.
that apply to many of their service offerings. These are available for review and incorporated into the applicable order. describe all security practices and programs which may be applicable and relevant to individual lines of business, products or services procured by customers.
2 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public
TABLE OF CONTENTS
Introduction 1
Oracle Corporate Security 3
Organizational Security 3
Oracle Security Oversight Committee 3
Corporate Security Organizations 3
Global Information Security 3
Global Product Security 3
Global Physical Security 3
Corporate Security Architecture 4
Global Trade Compliance 4
Line of Business Security Organizations 4
Oracle Information Technology Organizations 4
Independent Review of Information Security 4
Privacy 4
Customer Data Protection 4
Asset Classification and Control 5
Responsibility, Inventory, and Ownership of Assets 5
Asset Classification and Control 5
Human Resources Security 5
Employee Screening 5
Confidentiality Agreements 5
Security Awareness Education and Training 6
Physical Security 6
Operations Management 6
Protection Against Malicious Code 6
Monitoring and Protection of Audit Log Information 6
Network Controls 7
Access Control 7
User Access Management 7
Privilege Management 7
Password Management 8
Access Review and Revocation 8
Information Systems Development, and Maintenance 8
Technical Vulnerability Management 8
Information Security Incident Response 8
Security Incident Policy and Operations 9
Notifications 9
Oracle Software Security Assurance (OSSA) 9
Coding Standards & Security Training 9
Security Analysis & Testing 10
Security Fixing Policies 10
Applicability of Critical Patch Updates and Security Alerts to Oracle Cloud Environments 10 Source Code Protection 10
External Security Evaluations 11
Resilience Management 11
Revision History 11
3 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public
ORACLE CORPORATE SECURITY
The mission-critical systems that customers rely upon for cloud services, technical support and other services Oracle source code and other sensitive data against theft and malicious alteration Personal and other sensitive information that Oracle collects in the course of its business, including customer, partner
provides to its customers, and apply to all Oracle personnel, such as employees and contractors. These policies are generally aligned with the ISO/IEC 27002:2022 and ISO/IEC 27001:2022 standards and guide all areas of security within Oracle.
Reflecting the recommended practices in security standards issued by the International Organization for Standardization (ISO), the United States National Institute of Standards and Technology (NIST), and other industry sources, Oracle has implemented a wide variety of preventive, detective and corrective security controls with the objective of protecting information assets.
ORGANIZATIONAL SECURITY
information security policy.
The Chief Corporate Architect is one of the directors of the Oracle Security Oversight Committee (OSOC). The Chief Corporate Architect manages the Corporate Security departments which guide security at Oracle. These departments manage the corporate security programs and define corporate security policies and provide global direction.
Oracle Security Oversight Committee
Oracle Security Oversight Committee (OSOC) oversees the implementation of Oracle-wide security programs, including Corporate Security Organizations
Global Information Security
Global Information Security (GIS) defines policies for the management of information security across Oracle. GIS provides direction and advice to help Lines of Business (LoBs) protect Oracle information assets (data), as well as the data entrusted to Oracle by our customers, partners and employees. GIS also coordinates the reporting of information security risk to senior leadership such as the Oracle Security Oversight Committee and Board of Directors. GIS programs direct and advise on the protection of data developed, accessed, used, maintained, and hosted by Oracle.
Global Product Security
The Global Product Security organization acts as a central resource to help Oracle development teams improve the security of Oracle products. Encompassing every phase of the product development lifecycle, Oracle Software Security Assurance is Oracle's methodology for building security into the design, build, testing, and maintenance of its products.
Security promotes the use of Oracle Software Security
Assurance standards throughout Oracle, acts as a central resource to help development teams improve the security of their products, and handles specialized security functions.
Global Physical Security
Global Physical Security is responsible for defining, developing, implementing, and managing physical security for the ies
have been developed to generally align with several physical security industry guidance, including the International Organization for Standardization (ISO), United States Customs Trade Partnership Against Terrorism (CTPAT), and the Payment Card Industry Security Standards Council. Physical security controls are described later in this document.
4 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public Corporate Security Architecture
The Oracle corporate security architect helps set internal informationdepartments and lines of business towards deploying information security and identity management solutions that advance Oracle's information security goals. The corporate security architect works with Global Information Security and Global Product Security, and the Development Security Leads to develop, communicate and implement secure architectures.
Corporate Security Architecture (CSA) manages a variety of programs and leverages multiple methods of engaging with leadership and operational security teams responsible for Oracle operations, services, cloud and all other lines of business.
Global Trade Compliance
Oracle Global Trade Compliance (GTC) is responsible for import and export oversight, guidance and enforcement to enable worldwide trade compliant business processes across Oracle in order to uphold and protect Oracle's global trade privileges.
GTC manages Oracle's global trade compliance portfolio and is responsible for global trade regulatory interpretation and coordination of policy advocacy, Global Brand Protection, Hardware Compliance Strategy and Market Access programs.
Further, GTC reviews and resolves global trade compliance matters; serves as the clearinghouse for all global trade compliance information, including product classification, and is empowered to take actions necessary to ensure Oracle remains compliant with U.S. and applicable local Customs, import, and export laws, regulations and statutes.
Line of Business Security Organizations
Lines of Business (LoB) have security teams which oversee their products, systems and cloud services managed by that well as drive compliance to Oracle policies and standards within their organization and cloud service teams. LoBs are also specific security organizations, standards, and programs.
Oracle Information Technology Organizations
Oracle information technology (IT) and cloud DevOps organizations are responsible for IT security strategy, architectural design of security solutions, engineering, risk management, security infrastructure operations and support, standards and compliance, threat intelligence and remediation and security technical assessment for new infrastructure.
Independent Review of Information Security
regional reviews. These reviews examine key business risk management protocols and compliance with Oracle policies,
PRIVACY
The Oracle General Privacy Policy addresses information we collect in connection with your use of Oracle websites, mobile applications, and social media pages that link to the General Privacy Policy, your interactions with Oracle during in-person meetings at Oracle facilities or at Oracle events, and in the context of other online or offline sales and marketing activities.
The Oracle Services Privacy Policy describes our privacy and security practices that apply when handling (i) services personal information in order to perform Consulting, Technical Support, Cloud and other services on behalf of Oracle customers; and (ii) personal information contained in systems operation data generated by the interaction of (end-)users of these services with Oracle systems and networks.
CUSTOMER DATA PROTECTION
Or
media (sanitization) and disposal of information which is no longer required against unauthorized retrieval and data reconstruction. Electronic storage media include laptops, hard drives, storage devices and removable media.
5 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public
ASSET CLASSIFICATION AND CONTROL
Responsibility, Inventory, and Ownership of Assets
information protection policy provides guidelines for all Oracle information classification and minimum handling requirements for each classification.
Developing and maintaining accurate system inventory is a necessary element for effective general information systems information systems asset inventory policy requires that Lines of Business (LoBs) mantain accurate and comprehensive inventories of information systems, hardware and software. This policy applies to all information assets held on any Oracle system, including both enterprise systems and cloud services.
Asset Classification and Control
Oracle categorizes information into four classes Public, Internal, Restricted, and Highly Restricted with each classification requiring corresponding levels of security controls, such as encryption requirements for non-Public data:
Oracle has formal requirements for managing data retention. These operational policies define requirements per data type and category, including examples of records in various Oracle departments. Retention of customer data in cloud services is controlled by the customer and is subject to terms in their contract.
Customer data is classified under one of Oracle's top two categories of confidential information for the purpose of placing limits on access, distribution and handling of such data. Oracle keeps the information confidential in accordance with the
HUMAN RESOURCES SECURITY
Oracle places a strong emphasis on personnel security. The company maintains ongoing initiatives intended to help minimize risks associated with human error, theft, fraud and misuse of facilities, including personnel screening, confidentiality agreements, security awareness education and training, and enforcement of disciplinary actions.
Oracle maintains high standards for ethical business conduct at every level of the organization, and at every location where Oracle does business around the world. These apply to Oracle employees, contractors, and temporary employees, and cover legal and regulatory compliance and business conduct and relationships. Oracle requires its employees to receive training in ethics and business conduct every two years.
Employees who fail to comply with Oracle policies, procedures and guidelines may be subject to disciplinary action up to and including termination of employment.
Employee Screening
In the United States, Oracle currently uses an external screening agency to perform pre-employment background investigations for newly hired U.S. personnel. Personnel screening in other countries varies according to local laws, employment regulations and local Oracle policy.
Confidentiality Agreements
Oracle employees are required to maintain the confidentiality of customer data. Employees must sign a confidentiality agreement and comply with company policies concerning protection of confidential information as part of their initial terms of employment. Oracle requires a written confidentiality agreement from each subcontractor before that subcontractor provides services.
6 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public Security Awareness Education and Training
Oracle promotes security awareness and educates employees through regular newsletters and security awareness campaigns. Each employee is required to complete information-protection awareness training upon hiring and every two years thereafter. The course instructs employees on their obligations under Oracle privacy and security policies. This course also covers privacy principles and data handling practices required by company policy.
PHYSICAL SECURITY
Oracle Global Physical Security is responsible for defining, developing, implementing, and managing physical security for Oracle currently has implemented the following protocols in Oracle facilities:
Physical access to facilities is limited to Oracle employees, contractors, and authorized visitors.
Oracle employees, subcontractors, and authorized visitors are issued identification cards that must be worn while on Oracle premises.
Visitors are required to register before entry and must be escorted by Oracle personnel in Oracle facilities. employment must return keys/cards and key/cards are deactivated upon termination.
Security authorizes all repairs and modifications to the physical security barriers or entry controls at service locations.
Mixture of 24/7 onsite security officers or patrol officers, depending on the risk/protection level of the facility. In all cases officers are responsible for patrols, alarm response, and recording of physical security events.
Centrally managed electronic access control systems with integrated intruder alarm capability and CCTV monitoring and recording. The access control system logs and CCTV recordings are retained for a period of 30-90
OPERATIONS MANAGEMENT
Protection Against Malicious Code
Oracle policy requires the use of antivirus protection and firewall software on endpoint devices such as laptops, desktops and mobile devices. Additionally, all computers running a Windows operating system that hold Oracle data must have automated Microsoft security updates enabled. Security updates for all other devices and operating systems must be installed upon notification of their availability. Desktops and laptops that process Oracle or customer information must be encrypted using approved software. Reports enable lines of business management to verify deployment of laptop encryption for their organization.
Antivirus software must be scheduled to perform daily threat-definition updates and virus scans.
Oracle information technology (OIT) organization keeps antivirus products and Windows Server Update for Business up to date with virus definitions and security updates. OIT is responsible for notifying internal Oracle system users of both any credible virus threats and when security updates are available. OIT provides automation to verify antivirus configuration.
Employees are prohibited from altering, disabling or removing antivirus software and the security update service from any computer. Any Oracle employee who is discovered violating this standard may be subject to disciplinary action up to and including termination of employment.
Monitoring and Protection of Audit Log Information
Oracle requires that system owners capture and retain logs for certain security-related activities on operating systems, applications, databases and network devices. Systems are required to log access to Oracle systems and applications, as well record system alerts, console messages and system errors. Oracle implements controls designed to protect against operational problems, including log file media becoming exhausted, failing to record events and/or logs being overwritten.
Oracle policy requires that Lines of Business (LoBs) monitor logs for security event investigation and forensic purposes.
Identified anomalous activities feed into security event management processes for the LoB owning that system. Access to security logs is provided on the basis of need-to-know and least privilege. Where available for cloud services, log files are
7 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public protected by strong cryptography and other security controls, and access is monitored. Logs generated by internetaccessible systems are required to be relocated to systems that are not internet-accessible.
Network Controls
Oracle requires strong network controls for the protection and control of both Oracle and customer data during its network device management, including authentication and authorization requirements for both physical devices and software-based systems. Unused network ports must be deactivated.
For administration of network security and network-management devices, Oracle requires IT personnel to use secure protocols with authentication, authorization and strong encryption. Network devices must be located in an environment protected with physical access controls and other physical security measures defined by Global Physical Security (GPS).
Communications to and from the Oracle corporate network must pass through network security devices at the border of virtual private networks (VPNs). Corporate systems available outside the corporate network are protected by alternative security controls such as multifactor authentication.
connectivity to access the Oracle corporate network, including network segmentation requirements. Oracle IT manages wireless networks and monitors for unauthorized wireless networks.
Access to the Oracle corporate network by suppliers and third parties is subject to limitations and prior approval per Oracle third-party access policy.
ACCESS CONTROL
Access control refers to the policies, procedures and tools that govern access to and use of resources. Examples of resources include a physical server, file, application, data in a database and network device.
Least privilege is a system-oriented approach in which user permissions and system functionality are carefully evaluated and access is restricted to the resources required for users or systems to perform their duties.
Default-deny is a network-oriented configuration approach that implicitly denies the transmission of all traffic, and then specifically allows only required traffic based on protocol, port, source network address, and destination network address.
-
processing facility for which Oracle has administrative authority. Logical access controls for applications and systems must provide identification, authentication, authorization, accountability and auditing functionality. This policy does not apply to customer end user accounts for Oracle cloud services.
User Access Management
Oracle user access is provisioned through an account provisioning system that is integrated with Oracle's Human Resources database. Access privileges are granted based on job roles and require management approval. Operations are organized into functional groups, where each function is performed by separate groups of employees. Examples of functional groups include developers, database administrators, system administrators, and network engineers.
Privilege Management
Authorization is dependent on successful authentication, since controlling access to specific resources depends upon establishing an entity or individual's identity. Oracle requires that authorization decisions for granting, approving and reviewing access are based on the following principles:
Need to know: Does the user require this access for his job function? Segregation of duties: Will the access result in a conflict of interest? Least privilege: Is access restricted to only those resources and information required for a legitimate business purpose?
8 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public Password Management
The use of passwords is addressed in the Oracle password policy. Oracle has strong password policies (including length and complexity requirements) for the Oracle network, operating system, email, database and other accounts to reduce the chances of intruders gaining access to systems or environments through exploitation of user accounts and associated passwords. System-generated and assigned passwords are required to be changed immediately on receipt.
Oracle personnel are obligated to follow rules for password length, complexity, and other password requirements.
Employees must keep their authentication credentials, such aspasswords, confidential and secured at all times and are prohibited from sharing their individual account passwords with anyone. Employees are prohibited from using Oracle system or applications passwords for non-Oracle applications or systems.
Access Review and Revocation
Oracle requires regular reviews of network and operating system accounts with regard to the appropriate employee access levels. In the event of employee terminations, deaths, or resignations, Oracle takes appropriate actions to promptly terminate network, and physical access.
INFORMATION SYSTEMS DEVELOPMENT, AND MAINTENANCE
Technical Vulnerability Management
Oracle has formal requirements designed to identify, analyze, and remediate the technical security vulnerabilities that may affect our enterprise systems and your Oracle Cloud environment.
Oracle IT, security and development teams are required tomonito own security advisories, to identify and assess relevant security patches. Additionally, Oracle requires that vulnerability scanning using automated scanning systems be periodically performed against the internal and externally facing systems it manages. Cloud service environments are subject to penetration testing depending on system risk level. iate these issues
according to their severity and the potential impact. The Common Vulnerability Scoring System (CVSS) Base Score is one of the criteria used in assessing the relative severity of vulnerabilities. Oracle requires that identified security vulnerabilities be identified and tracked in a defect tracking system.
Oracle aims to complete cloud remediation activities, including testing, implementation, and reboot (if required) within planned maintenance windows. However, additional security maintenance outside of scheduled maintenance windows may be performed as described in the Oracle Cloud Hosting and Delivery Policies and applicable Pillar documentation. gn, build, testing, and
maintenance of its products, whether they are used on-premises by customers, or delivered through Oracle Cloud.
Customers and security researchers can report suspected security vulnerabilities: How to Report Security Vulnerabilities to Oracle or by submitting a Service Request in their designated support system. describes the security testing activities (such as penetration testing and vulnerability scanning) that can be performed by customers against their Oracle On-Premises Products and Oracle Cloud Services.
INFORMATION SECURITY INCIDENT RESPONSE
A security incident is a security event that Oracle, per its incident response process, has determined results in the actual or potential loss of confidentiality, integrity, or availability of Oracle managed assets (systems and data).
Oracle will respond to information security events when Oracle suspects unauthorized access to Oracle-managed assets.
Cloud customers are responsible for controlling user access and monitoring their cloud service tenancies via available tooling and logging.
9 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public Security Incident Policy and Operations
events and incidents. This policy authorizes the Oracle Global Information Security organization to provide overall direction for security event and incident preparation, detection, investigation, resolution and forensic evidence handling across s of Business (LoB). This policy does not apply to availability issues (outages) or to physical security events.
Global Information Security further defines roles and responsibilities for the incident response teams within the LoBs. All LoBs must comply with Global Information Security guidance for managing information security events and implementing timely corrective actions.
Upon discovery of a security event, Oracle incident response plans support rapid and effective event triage, including investigation, response, remediation, recovery, and post-incident analysis. LoB incident response teams, as required by the Security Incident Management Policy, conduct post-event analysis to identify opportunities for reasonable measures which improve security posture and defense in depth. Formal procedures and systems are utilized within the LoBs to collect information and maintain a chain of custody for evidence during event investigation. Oracle can support legally admissible forensic data collection when necessary.
Notifications
If Oracle determines a security incident involving assets managed by Oracle has occurred, Oracle will promptly notify impacted customers or other third parties in accordance with its contractual and regulatory responsibilities as defined in the Data Processing Agreement for Oracle Services. Information about malicious attempts, suspected incidents and incident history are not shared externally.
ORACLE SOFTWARE SECURITY ASSURANCE
methodology for building security into the design, build, testing and maintenance of its products, whether they are used onpremises by customers or delivered through Oracle cloud services. for the
most cost-effective ownership experience. Oracle Software Security Assurance is a set of industry-leading standards, technologies, and practices aimed at:
Fostering security innovations. Oracle has a long tradition of security innovations. Today this legacy continues with solutions that help organizations implement and manage consistent security controls across the technical environments in which they operate, on-premises and in the cloud.
Reducing the incidence of security weaknesses in all Oracle products. Oracle Software Security Assurance key of security leaders within development groups and the use of automated analysis and testing tools.
Reducing the impact of security weaknesses in released products on customers. Oracle has adopted transparent security vulnerability disclosure and remediation policies. The company is committed to treating all customers equally and delivering the best possible security patching experience through the Critical Patch Update and Security Alert programs.
Coding Standards & Security Training
Developing secure software requires consistently applied methodologies across the organization; methodologies that co
requires that all of development abide by secure coding principles that are documented and maintained to remain relevant.
Oracle developers must be familiar with these standards and apply them when designing and building products.
Oracle Secure Coding Standards and related guidance have evolved and expanded over time to encompass emerging technologies such as Artificial Intelligence and Machine Learning (AI/ML) and address the most common issues affecting Oracle code, new threats as they are discovered, and new customer use cases for Oracle technology.
All Oracle staff are required to take security training. Technical development staff, up to and including vice presidents, who are involved in building, maintaining, customizing or testing product code are required to take an OSSA awareness course.
Additionally, Oracle adapted its secure coding principles and created training material for use by its consulting and services organizations when they are engaged in producing code on behalf of customers.
10 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public Security Analysis & Testing
Oracle requires that security testing be performed for its on-premises and cloud products. Security testing of Oracle code includes both functional and non-functional activities for verification of product features and quality. Although these types of tests often target overlapping product features, they have orthogonal goals and are carried out by different teams.
Functional and non-functional security tests complement each other to support comprehensive security testing coverage of Oracle products.
Functional security testing is typically executed by regular product Quality Assurance (QA) teams as part of normal product testing cycle. During this testing, QA engineers verify conformance of implemented security features to what had been previously agreed upon in the functional specifications during the architectural and checklist reviews process.
Security assurance analysis and testing verify security qualities of Oracle products against various types of attacks. There are two broad categories of tests employed for testing Oracle products: static and dynamic analysis:
Static security analysis of source code is the initial line of defense used during the product development cycle.
Oracle uses a commercial static code analyzer as well as a variety of internally developed tools, to catch problems while code is being written.
Dynamic analysis activity takes place during latter phases of product development: at the very least, the product or component should be able to run. Dynamic analysis is aimed at externally visible product interfaces and APIs, and frequently relies on specialized tools for testing. Both manual and automatic tools are used for testing at Oracle.
Automatic tools employ fuzzing technique to test network-accessible product interfaces and protocols, while manual tools require making the modifications by hand.
Oracle will not provide customers sensitive security assurance artifacts (including but not limited to static code analysis reports). Oracle will not submit its product to third-party static code assessments. For more information, see MOS Article:
General Instructions for Submitting Security Questionnaires to Oracle (Doc ID 2337651.1).
Security Fixing Policies
The Critical Patch Update (CPU) is the primary mechanism for the backport of security bug fixes for all Oracle on-premises products. Critical Patch Updates are available to customers with valid support contracts. Critical Patch Updates are released quarterly on the third Tuesday of January, April, July, and October. Oracle retains the ability to issue out of schedule patches or workaround instructions in case of particularly critical vulnerabilities and/or when active exploits are reported in the wild.
This program is known as the Security Alert program.
Vulnerabilities are remediated by Oracle in order of the likely risk they pose to users. This process is designed to patch the security defects with the greatest associated risk first in the Critical Patch Update, resulting in optimizing the security posture of all Oracle customers.
A standardized CPU schedule helps organizations plan their security maintenance windows. The CPU schedule is designed to avoid typical blackout dates during which customers cannot typically alter their production environments. Oracle recommends that customers use the CPU as the primary means for keeping up with security fixes for all affected products.
As much as possible, Oracle tries to make Critical Patch Updates cumulative; that is, each Critical Patch Update contains the security fixes from all previous Critical Patch Updates. This provides customers the ability to catch up quickly to the current security release level, since the application of the latest cumulative CPU resolves all previously addressed vulnerabilities.
Applicability of Critical Patch Updates and Security Alerts to Oracle Cloud Environments ell
as relevant third-party security updates as they become available and apply the relevant patches in accordance with applicable change management processes.
Source Code Protection
Oracle requires strong security controls to protect its source code. Orac -code protection policies provide limits on access to source code (enforcement of the need to know), requirements for independent code review, and periodic auditing of source-code repositories.
Oracle Software Security Assurance policies and practices are designed to prevent the introduction of security vulnerabilities in Oracle-developed code. Additionally, Oracle maintains strong controls over the technical description of security Information Protection Policy defines the classification and
11 Oracle Corporate Security Practices | Version 3.4
Copyright © 2024, Oracle and/or its affiliates | Oracle Public handling of information related to product security vulnerabilities and requires that information concerning security bugs be recorded in a tightly controlled database.
t the introduction of backdoors into its products. Backdoors are deliberately (and maliciously) introduced code intended to bypass security controls of the application in which it is embedded. Backdoors do not include:
Unintentional defects in software that could lead to a weakening of security controls (security bugs) Undocumented functionality designed to be generally inaccessible by customers but serves a valid business or technical purpose (diagnostics and troubleshooting utilities) Oracle assesses third-party software and hardware to avoid the use of products:
With known vulnerabilities
Developed with poor security assurance
That may potentially include backdoors
External Security Evaluations
Oracle submits certain products for external security evaluations. These evaluations involve rigorous testing by Independent verification helps provide additional assurance to Oracle customers with regards to the security posture of the validated products. Organizaations in many industries have business and compliance requirements that imply the use of validated products. Such evaluations include Common Criteria and FIPS 140.
RESILIENCE MANAGEMENT
for and response to business disruption events. It also specifies the functional roles and responsibilities required to create, maintain, test and evaluate business continuity capability for Oracle across lines of business and geographies. It authorizes a centralized Risk Management Resiliency Program (RMRP) Program Management Office (PMO) and defines the compliance oversight responsibilities for the program. The policy mandates an annual operational cycle for planning, evaluation, training, validation and executive approvals for critical business operations.
The Risk Management Resiliency Program (RMRP) objective is to establish a business-resiliency framework to help provide The RMRP is comprised of several subprograms: emergency response to unplanned and emergent events, crisis management of serious incidents, technology disaster recovery and business-continuity management. The goal of the program is to minimize negative impacts to Oracle and maintain critical business processes until regular operating conditions are restored. Each of these subprograms is a uniquely diverse discipline. Consolidation of these subprograms enables a robust collaborative and communicative system.
REVISION HISTORY
Version 3.4 12 Dec 2024 Added Customer Security Testing Policy.
Version 3.3 04 Apr 2024 Updated information security incident response and Oracle Software Security Assurance sections
Version 3.2 12 Sep 2023 Clarified physical security and technical vulnerability management controls Version 3.1 20 Jan 2023 Expanded Oracle Software Security Assurance (OSSA) section and updated the order of sections.
Verison 3.0 30 Sep 2022 Updates to all sections.
Version 2.1 20 May 2021 Clarified operational responsibilities for Incident Response.
Version 2.2 10 Sep 2021 Added wireless network management practices. Updated Operations Management, Incident Response, Technical Vulnerability Management and Access Control sections.
Version 2.3 22 Apr 2022 Clarified Global Information Security and Incident Response sections
CONNECT WITH US
Call +1.800.ORACLE1 or visit oracle.com.
Outside North America, find your local office at oracle.com/contact. blogs.oracle.com facebook.com/oracle
Copyright © 2024, Oracle and/or its affiliates. Unless this document is affirmatively incorporated into Your order for Cloud Services as part of its Service Specifications, the following terms apply:
This document is provided for information purposes only, and the contents hereof are subject to change without notice.
This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. We specifically disclaim any liability with respect to this document, and no contractual obligations are formed either directly or indirectly by this document.
This document may not be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without our prior written permission.
Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.
Oracle Corporate Security Practices
December, 2024
Data Processing Agreement for Oracle Services_v01012023 Page | 1
Data Processing Agreement for Oracle Services
(“Data Processing Agreement”)
Version January 1, 2023
1. Scope and Applicability
This Data Processing Agreement applies to Oracle’s Processing of Personal Information on Your behalf as a Processor for the provision of the Services specified in Your Services Agreement. Unless otherwise expressly stated in Your Services Agreement, this version of the Data Processing Agreement shall be effective and remain in force for the term of Your Services Agreement.
2. Responsibility for Processing of Personal Information and Description of Processing Activities
2.1 You are a Controller and Oracle is a Processor for the Processing of Personal Information as part of the provision of the Services. Each party is responsible for compliance with its respective obligations under Applicable Data Protection Law.
2.2 Oracle will Process Personal Information during the term of the Services Agreement solely for the purpose of providing the Services in accordance with the Services Agreement and this Data Processing Agreement.
2.3 In particular and depending on the Services, Oracle may Process Personal Information for hosting and storage; backup and disaster recovery; service change management; issue resolution; applying new product or system versions, patches, updates and upgrades; monitoring and testing system use and performance; IT security purposes including incident management; maintenance and performance of technical support systems and IT infrastructure; and migration, implementation, configuration and performance testing.
2.4 As part of the provision of the Services and depending on the Services, Oracle may Process Personal Information about Your Individuals, including Your end users, employees, job applicants, contractors, collaborators, partners, suppliers, customers and clients.
2.5 Personal Information about Your Individuals may include, but is not limited to, personal contact information such as name, home address, home telephone or mobile number, fax number, email address, and passwords; information concerning family, lifestyle and social circumstances including age, date of birth, marital status, number of children and name(s) of spouse and/or children; employment details including employer name, job title and function, employment history, salary and other benefits, job performance and other capabilities, education/qualification, identification numbers, and business contact details; financial details; goods and services provided; unique IDs collected from mobile devices, network carriers or data providers; geolocation data; IP addresses and online behavior and interest data.
2.6 Unless otherwise specified in the Services Agreement, You may not provide Oracle with any data that imposes specific data security or data protection obligations on Oracle in addition to or different from those
Data Processing Agreement for Oracle Services_v01012023 Page | 2
specified in the Data Processing Agreement or Services Agreement (e.g. certain regulated health or payment card information). If available for the Services, You may purchase additional services from Oracle (e.g., Oracle Payment Card Industry Compliance Services) designed to address specific data security or data protection requirements applicable to sensitive or special data You seek to include in Your Content.
You remain responsible for compliance with Your specific regulatory, legal or industry data security obligations which may apply to such data.
2.7 Additional or more specific descriptions of Processing activities may be included in the Services Agreement.
2.8 Oracle is a Service Provider in respect to Personal Information processed in performance of the Services. Oracle will not: (a) Sell or Share any Personal Information; (b) retain, use, or disclose any Personal Information (i) for any purpose other than for the Business Purposes specified in the Services Agreement, including for any Commercial Purpose, or (ii) outside of the direct business relationship between Oracle and You; or (c) combine Personal Information received from or on behalf of You with Personal Information received from or on behalf of any third party, or collected from Oracle’s own interaction with Individuals, except to perform a Business Purpose that is permitted by the CCPA and the Services Agreement. Oracle will notify You of its use of Oracle Affiliates and Third Party Subprocessors in accordance with Section 5 of this Data Processing Agreement; and ensure Oracle Affiliates and Third Party Subprocessors are subject to applicable written agreements per Section 5 of this Data Processing Agreement. The parties acknowledge that the Personal Information You disclose to Oracle is provided only for the limited and specified Business Purposes set forth in the Services Agreement. Oracle shall provide the same level of protection to Personal Information as required by the CCPA and as more fully set out in the Services Agreement. You may take such reasonable steps as may be necessary (a) to remediate Oracle’s unauthorized use of Personal Information, and (b) to ensure that Personal Information is used in accordance with the terms of this Data Processing Agreement by exercising Your rights under Section 8 of this Data Processing Agreement. Oracle shall notify You if it makes a determination that it is not able to meet its obligations under the CCPA in connection with its provision of the Services.
3. Your Instructions
3.1 In addition to Your instructions incorporated into the Services Agreement, You may provide additional instructions in writing to Oracle with regard to Processing of Personal Information in accordance with Applicable Data Protection Law. Oracle will promptly comply with all such instructions to the extent necessary for Oracle to (i) comply with its Processor obligations under Applicable Data Protection Law; or (ii) assist You to comply with Your Controller obligations under Applicable Data Protection Law relevant to Your use of the Services.
3.2 Oracle will follow Your instructions at no additional cost to You and within the timeframes reasonably necessary for You to comply with your obligations under Applicable Data Protection Law. Oracle will immediately inform You if, in its opinion, Your instruction infringes Applicable Data Protection Law. Oracle is not responsible for providing legal advice to You.
3.3 To the extent Oracle expects to incur additional charges or fees not covered by the fees for Services payable under the Services Agreement, such as additional license or third party contractor fees, it will promptly inform You thereof upon receiving Your instructions. Without prejudice to Oracle’s obligation to comply with Your instructions, the parties will then negotiate in good faith with respect to any such charges or fees.
Data Processing Agreement for Oracle Services_v01012023 Page | 3
4. Privacy Inquiries and Requests from Individuals
4.1 If You receive a request or inquiry from an Individual related to Personal Information Processed by Oracle under the Services Agreement, including Individual requests to access, delete or erase, restrict, rectify, receive and transmit (data portability), block access to or object to Processing of specific Personal Information, You can securely access Your Services environment that holds Personal Information to address the request. Additional information on how to access the Services to address privacy requests or inquiries from Individuals is available in the applicable Oracle Product or Service Feature Guidance documentation available on My Oracle Support (or other applicable primary support tool or support contact provided for the Services).
4.2 To the extent access to the Services is not available to You or otherwise not responsive to the request or inquiry, You can submit a “service request” via My Oracle Support (or other applicable primary support tool or support contact provided for the Services, such as Your project manager) with detailed written instructions to Oracle on how to assist You with such request.
4.3 If Oracle directly receives any requests or inquiries from Individuals that have identified You as the Controller, it will promptly pass on such requests to You without responding to the Individual. Otherwise, Oracle will advise the Individual to identify and contact the relevant controller(s).
5. Oracle Affiliates and Third Party Subprocessors
5.1 You provide Oracle general written authorization to engage Oracle Affiliates and Third Party Subprocessors as necessary to assist in the performance of the Services.
5.2 To the extent Oracle engages such Third Party Subprocessors and/or Oracle Affiliates, it requires that such entities are subject to the same level of data protection and security as Oracle under the terms of this Data Processing Agreement and Applicable Data Protection Law. You will be entitled, upon written request, to receive copies of the relevant privacy and security terms of Oracle’s agreement with any Third Party Subprocessors and Oracle Affiliates that may Process Personal Information. Oracle remains responsible for the performance of the Oracle Affiliates’ and Third Party Subprocessors’ obligations in compliance with the terms of the Services Agreement.
5.3 Oracle maintains lists of Oracle Affiliates and Third Party Subprocessors that may Process Personal Information. These lists are available via My Oracle Support, Document ID 2121811.1 (or other applicable primary support tool, user interface or contact provided for the Services, such as the NetSuite Support Portal or Your Oracle project manager). To receive notice of any intended changes to these lists of Oracle Affiliates and Third Party Subprocessors, You can (i) sign up per the instructions on My Oracle Support, Document ID 2288528.1; or (ii) Oracle will provide you notice of intended changes where a sign up mechanism is not available. For ACS and Consulting Services, any additional Third Party Subprocessors that Oracle intends to use will be listed in Your order for ACS or Consulting Services, or in a subsequent “Oracle Subprocessor Notice”, which Oracle will send to you by e-mail as necessary.
5.4 Within thirty (30) calendar days of Oracle providing such notice to You under Section 5.3 above, You may object to the intended involvement of a Third Party Subprocessor or Oracle Affiliate in the performance of the Services by submitting a “service request” via (i) My Oracle Support (or other applicable primary support tool) or (ii) for ACS and Consulting Services, the project manager for the Services. You and Oracle
Data Processing Agreement for Oracle Services_v01012023 Page | 4
will work together in good faith to find a mutually acceptable resolution to address such objection, including but not limited to reviewing additional documentation supporting the Third Party Subprocessor’s or Oracle Affiliate’s compliance with the Data Processing Agreement or Applicable Data Protection Law, or delivering the Services without the involvement of such Third Party Subprocessor. To the extent You and Oracle do not reach a mutually acceptable resolution within a reasonable timeframe, You shall have the right to terminate the relevant Services (i) upon serving thirty (30) days prior notice; (ii) without liability to You or Oracle and (iii) without relieving You from Your payment obligations under the Services Agreement up to the date of termination. If the termination in accordance with this Section 5.4 only pertains to a portion of Services under an order, You will enter into an amendment or replacement order to reflect such partial termination.
6. Cross-border data transfers
6.1 For Cloud Services, Personal Information will be stored in the data center region specified in Your order for such Services or, if applicable, the geographic region that You have selected when activating the production instance of such Services.
6.2 Without prejudice to Section 6.1 above, Oracle may Process Personal Information globally as necessary to perform the Services, such as for support, incident management or data recovery purposes.
6.3 To the extent such global access involves a transfer of Personal Information subject to cross-border transfer restrictions under Applicable European Data Protection Law to countries outside Europe not covered by an adequacy decision, such transfers are subject to (i) Oracle’s Binding Corporate Rules for Processors or BCR-p (also referred to as the Oracle Processor Code) and (ii) the terms of Module 2 (Controller to Processor) of the EU Standard Contractual Clauses 2021/914 of 4 June 2021.
The most current version of Oracle’s Binding Corporate Rules for Processors (Oracle Processor Code) is available on https://www.oracle.com/corporate/contracts/cloud-services/contracts.html#data-processing, and is incorporated by reference into the Services Agreement and this Data Processing Agreement. Oracle has obtained EEA authorization for its Binding Corporate Rules for Processors (Processor Code) and will maintain such authorization for the duration of the Services Agreement. Transfers to Third Party Subprocessors shall be subject to security and data privacy requirements consistent with Oracle’s Binding Corporate Rules for Processors (Oracle Processor Code), the terms of Module 2 (Controller to Processor) of the EU Standard Contractual Clauses 2021/914 of 4 June 2021, this Data Processing Agreement and the Services Agreement.
6.4 To the extent such global access involves a transfer of Personal Information subject to cross-border transfer restrictions under Applicable UK Data Protection Law, to countries outside the United Kingdom not covered by an Adequacy Decision by the UK ICO, such transfers are subject to (i) the terms of Module 2 (Controller to Processor) of the EU Standard Contractual Clauses 2021/914 of 4 June 2021 as supplemented by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses version B1.0 (the “IDTA”), which are incorporated herein by reference; and (ii) when approved by the UK ICO, the approved UK Binding Corporate Rules for Processors, in the form that will be approved by the UK ICO for use in the UK and will be published on Oracle’s public websites. The IDTA will be read in conjunction with the Services Agreement and the Data Processing Agreement.
6.5 The parties will review any supplemental measures, which may be required based on applicable Data Protection Law for the transfer of Personal Information to countries that do not offer an adequate level of
Data Processing Agreement for Oracle Services_v01012023 Page | 5
protection. The parties will work together in good faith to find a mutually acceptable resolution to address such supplementary measures, including but not limited to reviewing technical documentation for the Services, and discussing additional available technical safeguards and security services.
6.6 To the extent such global access involves a transfer of Personal Information subject to cross-border transfer restrictions under other Applicable Data Protection Laws globally, such transfers shall be subject to (i) for transfers to Oracle Affiliates, the terms of the Oracle Intra-Company Data Transfer and Mandate Agreement, which requires all transfers of Personal Information to be made in compliance with Applicable Data Protection Law and all applicable Oracle security and data privacy policies and standards globally; and (ii) for transfers to Third Party Subprocessors, security and data privacy requirements consistent with the relevant requirements of this Data Processing Agreement and Applicable Data Protection Law.
7. Security and Confidentiality
7.1 Oracle has implemented and will maintain appropriate technical and organizational security measures for the Processing of Personal Information designed to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information. These security measures govern all areas of security applicable to the Services, including physical access, system access, data access, transmission and encryption, input, data backup, data segregation and security oversight, enforcement and other security controls and measures. Additional details regarding the specific security measures that apply to the Services You have ordered are set out in the relevant security practices for these Services:
For all Services: Oracle’s Corporate Security Practices, available at https://www.oracle.com/corporate/security-practices/;
For Cloud Services: Oracle’s Hosting & Delivery Policies, available at http://www.oracle.com/us/corporate/contracts/cloud-services/index.html; For NetSuite (NSGBU) Services: NetSuite’s Terms of Service, available at:
http://www.netsuite.com/portal/resource/terms-of-service.shtml; For Global Customer Support Services: Oracle’s Global Customer Support Security Practices available at: https://www.oracle.com/support/policies.html; For Consulting and Advanced Customer Support (ACS) Services: Oracle’s Consulting and ACS Security Practices available at: http://www.oracle.com/us/corporate/contracts/consultingservices/index.html.
7.2 All Oracle and Oracle Affiliates employees, and Third Party Subprocessors that Process Personal Information, are subject to appropriate written confidentiality arrangements, including confidentiality agreements, regular training on information protection, and compliance with Oracle policies concerning protection of confidential information.
8. Audit Rights and Assistance with Data Protection Impact Assessments
8.1 You may audit Oracle’s compliance with its obligations under this Data Processing Agreement up to once per year, including inspections of the applicable Services data center facility that hosts Personal Information. In addition, to the extent required by Applicable Data Protection Law, You or Your Regulator may perform more frequent audits.
8.2 If You engage a third party auditor, the third party must be mutually agreed to by You and Oracle
Data Processing Agreement for Oracle Services_v01012023 Page | 6
(except if such third party is a Regulator). Oracle will not unreasonably withhold its consent to a third party auditor requested by You. The third party must execute a written confidentiality agreement acceptable to Oracle or otherwise be bound by a statutory or legal confidentiality obligation.
8.3 To request an audit, You must submit a detailed proposed audit plan to Oracle at least two weeks in advance of the proposed audit date. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Oracle will review the proposed audit plan and provide You with any concerns or questions. Oracle will work cooperatively with You to agree on a final audit plan within a reasonable timeframe.
8.4 The audit must be conducted during regular business hours at the applicable facility, subject to the agreed final audit plan and Oracle’s health and safety or other relevant policies, and may not unreasonably interfere with Oracle business activities.
8.5 Upon completion of the audit, You will provide Oracle with a copy of the audit report, which is subject to the confidentiality terms of Your Services Agreement. You may use the audit reports only for the purposes of meeting Your regulatory audit requirements and/or confirming compliance with the requirements of this Data Processing Agreement.
8.6 Each party will bear its own costs in relation to the audit, unless Oracle promptly informs you upon reviewing Your audit plan that it expects to incur additional charges or fees in the performance of the audit that are not covered by the fees payable under Your Services Agreement, such as additional license or third party contractor fees. The parties will negotiate in good faith with respect to any such charges or fees.
8.7 Without prejudice to the rights granted in Section 8.1 above, if the requested audit scope is addressed in a SOC, ISO, NIST, PCI DSS, HIPAA or similar audit report issued by a qualified third party auditor within the prior twelve months and Oracle provides such report to You confirming there are no known material changes in the controls audited, You agree to accept the findings presented in the third party audit report in lieu of requesting an audit of the same controls covered by the report.
8.8 You may also request that Oracle audit a Third Party Subprocessor or provide confirmation that such an audit has occurred (or, where available, obtain or assist You in obtaining a third-party audit report concerning the Third Party Subprocessor’s operations) to verify compliance with the Third Party Subprocessor’s obligations.
8.9 Oracle provides You with information and assistance reasonably necessary for You to conduct Your data protection impact assessments or consult with Your Regulator(s), by granting You electronic access to a record of Processing activities and Oracle Product/Service privacy & security functionality guides for the Services. This information is available via (i) My Oracle Support, Document ID 111.1 or other applicable primary support tool provided for the Services, such as the NetSuite Support Portal, or (ii) upon request, if such access to My Oracle Support (or other primary support tool) is not available to You.
9. Incident Management and Breach Notification
9.1 Oracle has implemented controls and policies designed to detect and promptly respond to incidents that create suspicion of or indicate destruction, loss, alteration, unauthorized disclosure or access to Your Content (as such term is defined in the Services Agreement) transmitted, stored or otherwise Processed.
Oracle will promptly define escalation paths to investigate such incidents in order to confirm if an
Data Processing Agreement for Oracle Services_v01012023 Page | 7
Information Breach has occurred, and to take reasonable measures designed to identify the root cause(s) of the Information Breach, mitigate any possible adverse effects and prevent a recurrence.
9.2 Oracle will notify you of a confirmed Information Breach without undue delay but at the latest within 24 hours. As information regarding the Information Breach is collected or otherwise reasonably becomes available to Oracle, Oracle will also provide You with (i) a description of the nature and reasonably anticipated consequences of the Information Breach; (ii) the measures taken to mitigate any possible adverse effects and prevent a recurrence; and (iii) where possible, information about the types of information that were the subject of the Information Breach. You agree to coordinate with Oracle on the content of Your intended public statements or required notices for the affected Individuals and/or notices to the relevant Regulators regarding the Information Breach.
10. Return and Deletion of Personal Information
10.1 Upon termination of the Services, Oracle will promptly return, including by providing available data retrieval functionality, and subsequently delete any remaining copies of Personal Information on Oracle systems or Services environments, except as otherwise stated in the Services Agreement.
10.2 For Personal Information held on Your systems or environments, or for Services for which no data retrieval functionality is provided by Oracle as part of the Services, You are advised to take appropriate action to back up or otherwise store separately any Personal Information while the production Services environment is still active prior to termination.
11. Legal Requirements
11.1 Oracle may be required by law to provide access to Personal Information, such as to comply with a subpoena or other legal process, or to respond to government requests, including public and government authorities for national security and/or law enforcement purposes.
11.2 Oracle will promptly inform You of requests to provide access to Personal Information and use reasonable efforts to redirect the authority that made the request to You, unless otherwise required by law.
11.3 To the extent Oracle is required to respond to the request, it will first assess on a case-by-case basis whether the request is legally valid and binding on Oracle, including whether the request is consistent with Applicable Data Protection Law. Any request that is not legally valid and binding on Oracle will be resisted in accordance with applicable law.
12. Data Protection Officer
12.1 Oracle has appointed a Chief Privacy Officer and a local Data Protection Officer in certain countries.
Further details on how to contact Oracle’s Chief Privacy Officer and, where applicable, the local Data Protection Officer, are available at https://www.oracle.com/legal/privacy/index.html.
12.2 If You have appointed a Data Protection Officer, You may request Oracle to include the contact details of Your Data Protection Officer in the relevant Services order.
Data Processing Agreement for Oracle Services_v01012023 Page | 8
13. Definitions
“Applicable Data Protection Law” means all data privacy or data protection laws or regulations globally that apply to the Processing of Personal Information under this Data Processing Agreement, including Applicable European Data Protection Law, Applicable UK Data Protection Law, the California Consumer Privacy Act as amended (“CCPA”) and other US State laws. “Applicable European Data Protection Law” means (i) the EU General Data Protection Regulation EU/2016/679, as supplemented by applicable EU Member State law and as incorporated into the EEA Agreement; and (ii) the Swiss Federal Act of 19 June 1992 on Data Protection, as amended. “Applicable UK Data Protection Law” means (i) the UK GDPR, meaning the EU General Data Protection Regulation EU/2016/679, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 pursuant to amendments to the EU General Data Protection Regulation EU/2016/679 made by The Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 and 2020; and (ii) the UK Data Protection Act 2018, as amended.
“Europe” means for the purposes of this Data Processing Agreement (i) the European Economic Area, consisting of the EU Member States, Iceland, Liechtenstein and Norway; and (ii) Switzerland. “Individual” shall have the same meaning as the term “data subject” or the equivalent term under Applicable Data Protection Law.
“Information Breach” means a breach of security leading to the misappropriation or accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Your Content transmitted, stored or otherwise Processed on Oracle systems or the Services environment that compromises the security, confidentiality or integrity of Your Content.
“Process/Processing”, “Controller”, “Processor” and “Binding Corporate Rules” (or the equivalent terms) have the meaning set forth under Applicable Data Protection Law. “Service Provider”, “Sell”, “Share”, “Business Purpose”, and “Commercial Purpose” have the meaning set forth under the CCPA.
“Oracle Affiliate(s)” means the subsidiar(y)(ies) of Oracle Corporation that may Process Personal Information as set forth in this Data Processing Agreement. “Oracle Intra-Company Data Transfer and Mandate Agreement” means the Oracle Intra-Company Data Transfer and Mandate Agreement for Customer Services Personal Information entered into between Oracle Corporation and the Oracle Affiliates.
“Oracle Binding Corporate Rules for Processors” or “Oracle Processor Code” means the EU or UK Oracle’s Privacy Code for Processing Personal Information of Customer Individuals, as the case may be. “Oracle” means the Oracle Affiliate that has executed the Services Agreement. “Personal Information” shall have the same meaning as the term “personal data”, “personally identifiable
Data Processing Agreement for Oracle Services_v01012023 Page | 9
information (PII)” or the equivalent term under Applicable Data Protection Law. “Regulator” shall have the same meaning as the term “supervisory authority”, “data protection authority” or the equivalent term under Applicable Data Protection Law. “Services” or the equivalent terms “Service Offerings” or “services” means the Cloud, Advanced Customer Support, Consulting, or Global Technical Support services specified in the Services Agreement. “Services Agreement” means (i) the applicable order for the Services you have purchased from Oracle; (ii) the applicable master agreement referenced in the applicable order, and (iii) the Service Specifications. “Third Party Subprocessor” means a third party, other than an Oracle Affiliate, which Oracle subcontracts with and which may Process Personal Information as set forth in this Data Processing Agreement. “You” means the customer entity that has executed the Services Agreement.
Other capitalized terms have the definitions provided for them in the Services Agreement.
Oracle Cloud Hosting and Delivery Policies Page 1 of 18 Oracle Cloud Hosting and
Delivery Policies
Effective Date: February 2025; Version 3.8
Oracle Cloud Hosting and Delivery Policies Page 2 of 18
TABLE OF CONTENTS
Overview 4
1. Oracle Cloud Security Policy 5
1.1 Oracle Information Security Practices - General 5
1.2 Physical Security Safeguards 6
1.3 System Access Controls 6
1.4 Data Access Controls 6
1.5 User Encryption for External Connections 7
1.6 Input Control 7
1.7 Data and Network Segregation 7
1.8 Confidentiality and Training 7
1.9 Asset Management 7
1.10 Oracle Internal Information Security Policies 7
1.11 Internal Security Reviews and Enforcement 8
1.12 External Reviews 8
1.13 Oracle Software Security Assurance 8
1.14 Security Logs 8
1.15 Other Customer Security Related Obligations 8
2. Oracle Cloud Service Continuity Policy 9
2.1 Oracle Cloud Services High Availability Strategy 9
2.2 Oracle Cloud Services Backup Strategy 9
2.3 Oracle Business Continuity 9
3. Oracle Cloud Service Level Agreement 10
3.1 Hours of Operation 10
3.2 Service Availability 10
3.2.1 Measurement of Availability 10
3.2.2 Reporting of Availability 10
3.2.3 Service Credits 11
3.3 Definition of Unplanned Downtime (Unavailability) 11
3.4 Monitoring 11
3.4.1 Customer Monitoring & Testing Tools 11
4. Oracle Cloud Change Management Policy 12
4.1 Oracle Cloud Change Management and Maintenance 12
4.1.1 Security Maintenance 13
4.1.2 Data Center Migrations 13
4.2 Software Versioning 13
4.2.1 Software Updates 13
4.2.2 End of Life 13
5. Oracle Cloud Support Policy 14
5.1 Oracle Cloud Support Terms 14
5.1.1 Support Fees 14
Oracle Cloud Hosting and Delivery Policies Page 3 of 18
5.1.2 Support Period 14
5.1.3 Technical Contacts 14
5.1.4 Oracle Cloud Support 14
5.2 Oracle Cloud Customer Support Systems 15
5.2.1 Oracle Cloud Customer Support Portal 15
5.2.2 Live Telephone Support 15
5.3 Severity Definitions 15
5.3.1 Severity 1 (Critical Outage) 15
5.3.2 Severity 2 (Significant Impairment) 16
5.3.3 Severity 3 (Technical Issue) 16
5.3.4 Severity 4 (General Guidance) 16
5.4 Change to Service Request Severity Level 16
5.4.1 Initial Severity Level 16
5.4.2 Downgrade of Service Request Levels 16
5.4.3 Upgrade of Service Request Levels 16
5.4.4 Adherence to Severity Level Definitions 17
5.5 Service Request Escalation 17
6. Oracle Cloud Suspension and Termination Policy 17
6.1 Termination of Oracle Cloud Services 17
7 Use of Services 18
Oracle Cloud Hosting and Delivery Policies Page 4 of 18
OVERVIEW
These Oracle Cloud Hosting and Delivery Policies
Services ordered by You. These Delivery Policies may reference other Oracle Cloud policy documents; any reference to "Customer" in these Delivery Policies or in such other policy documents shall be dee All commitments in these Delivery Policies apply to production Cloud Services unless otherwise specified.
Data Center R geographic
region listed in Your order for such Services or, if applicable, the geographic region that You have selected when activating the instance of such Services. For purposes of the Data Center Region applicable to Your ordered Cloud Services, the following applies:
Switzerland, collectively; and
Asia-Pacific geography, except China as Oracle has no data centers in China
to geographical regions made up of the continental United States of America and Canada; except where the entity purchasing Cloud Services elects to be initially provisioned in the country of Mexico, in which case, North America refers to the geographical regions made up of the continental United States of America, Canada and Mexico.
With respect to Your ordered Oracle Cloud Services, Your Content will be stored in the Data Center Region applicable to such Services. Oracle may replicate Your Content to other locations within the identified Data Center Region in support of data redundancy. Capitalized terms that are not otherwise defined in these Delivery Policies shall have the meaning ascribed to them in the Oracle agreement, Your order or the policy, as applicable. These Delivery Policies are updated on a biannual basis.
as defined in Your agreement for Oracle Cloud Services
which includes Oracle Cloud Services Pillar documentation, Service Descriptions and additional definitions provided in the Oracle Cloud Services Agreement) may include additional details or exceptions related to specific Oracle Cloud Services. The Oracle Cloud Service Pillar documentation, the Service Descriptions and the Program Documentation for Oracle Cloud Services are available at www.oracle.com/contracts.
Oracle Cloud Services are provided under the terms of the Oracle agreement, Your order, and Service Specifications applicable to such Services.
conditioned on Your and Your U
such documents and incorporated policies. These Delivery Policies, and the documents referenced herein, are subject to change at Oracle's discretion; however, Oracle policy changes will not result in a material reduction in the level of performance, functionality, security, or availability of the Oracle Cloud Services provided during the Services Period of Your order.
Oracle Cloud Hosting and Delivery Policies Page 5 of 18 Oracle Cloud Services are deployed at data centers or third-party infrastructure service providers retained by Oracle, with the exception of Oracle Cloud at Customer Services. Oracle Cloud at Customer Services are Public Cloud Services that are deployed at Your data center or at a third-party data center retained by You. You may purchase these Services standalone or they may be deployed as the underlying platform for other Oracle Cloud Services. For Oracle Cloud at Customer Services, Oracle will deliver to Your data center certain hardware components, including gateway equipment, needed by Oracle to operate these Services. You are responsible for providing adequate space, power, and cooling to deploy the Oracle hardware (including gateway equipment) and for ensuring adequate network connectivity for Oracle Cloud Operations to access the services. Oracle is solely responsible for maintenance of the Oracle hardware components (including gateway equipment).
These Delivery Policies do not apply to Oracle BigMachines Express or such other Oracle Cloud offerings as specified by Oracle in Your order or the applicable Service Descriptions.
1. ORACLE CLOUD SECURITY POLICY
1.1 Oracle Information Security Practices - General
Oracle has adopted security controls and practices for the Oracle Cloud Services that are designed to protect the confidentiality, integrity, and availability of Your Content that is hosted by Oracle in Your Oracle Cloud Services and to protect Your Content from any unauthorized processing activities such as loss or unlawful destruction of data. Oracle continually works to strengthen and improve those security controls and practices.
Oracle Cloud Services operate under practices which are aligned with the ISO/IEC 27002 Code of Practice for information security controls, from which a comprehensive set of controls are selected.
Oracle Cloud Services are aligned with National Institute of Standards and Technology ( NIST ) 800- 53 and 800-171.
Oracle Cloud information security practices establish and govern areas of security applicable to Oracle Cloud Services and to Your use of those Oracle Cloud Services.
Oracle personnel (including employees, contractors, and temporary employees) are subject to the Oracle information security practices and any additional policies that govern their employment or the services they provide to Oracle.
Oracle takes a holistic approach to information security, implementing a multi-layered defense security strategy where network, operating system, database, and software security practices and procedures complement one another with strong internal controls, governance and oversight.
For those Oracle Cloud Services which enable You to configure Your security posture, unless otherwise specified, You are responsible for configuring, operating, maintaining, and securing the operating systems and other associated software of these select Oracle Cloud Services (including Your Content) that is not provided by Oracle. You are responsible for maintaining appropriate security, protection, and backup of Your Content, which may include the use of encryption
Oracle Cloud Hosting and Delivery Policies Page 6 of 18 technology to protect Your Content from unauthorized access and the routine archiving of Your Content.
1.2 Physical Security Safeguards
Oracle employs measures designed to prevent unauthorized persons from gaining access to Oraclemanaged computing facilities in which Your Content is hosted, such as the use of security personnel, secured buildings, and designated data center premises. Oracle-managed office locations and cloud infrastructure facilities are secured. Oracle also requires its suppliers to similarly secure facilities hosting Your Content. Common controls between office locations and Oracle controlled colocations/data centers currently include, for example:
Physical access requires authorization and is monitored All employees, subcontractors and authorized visitors must visibly wear official identification while onsite
Visitors are required to register and must be escorted by Oracle personnel in Oracle facilities Possession of keys/access cards and the ability to access the locations is monitored. Staff leaving Oracle employment must return keys/cards.
This section does not apply to Oracle Cloud at Customer Services. You must provide Your own secure computing facilities for the hosting and operation of the Oracle Cloud at Customer Services-related hardware (including the gateway equipment) and network connections required for Oracle to provide the Oracle Cloud at Customer Services.
1.3 System Access Controls
Oracle policies require the following controls to be applied: authentication via multi-factor authentication, documented authorization controls, and logging of access. All remote access to the Oracle Cloud Network by Oracle personnel that have access to Your Content is restricted through the use of a Virtual Private Network which utilizes multi-factor authentication. In addition to the required use of a Virtual Private Network, before Oracle personnel are granted access to the Oracle Cloud Network, Oracle performs device posture checks and has in place controls, such as bastion hosts.
Oracle prohibits (through both policy and technical controls) the use of personal devices to access the Oracle Cloud Network and the Oracle Cloud Services.
1.4 Data Access Controls
authorized staff.
With respect to Oracle personnel accessing the Oracle Cloud Services (including Your Content residing in the Oracle Cloud Services), Oracle enforces Role Based Access Controls (RBAC) and In addition, Oracle provides a mechanism by which You control Your access to the Oracle Cloud Services and to Your Content.
Oracle Cloud Hosting and Delivery Policies Page 7 of 18
1.5 User Encryption for External Connections
Your access to Oracle Cloud Services is through a secure communication protocol provided by Oracle.
If access is through a Transport Layer Security (TLS) enabled connection, that connection is negotiated for at least 128 bit encryption. The private key used to generate the cipher key is at least 2048 bits. TLS is implemented, or configurable, for all web-based applications deployed at Oracle. It is recommended that the latest available browsers, which are compatible with higher cipher strengths and have improved security, be utilized for connecting to the Cloud Services. The list of recommended browsers for each release of Oracle Cloud Services will be made available via a portal accessible to You or in the corresponding Service Description for the Oracle Cloud Services. In some cases, a third party site that You wish to integrate with the Oracle Cloud Services, such as a social media service, may not accept an encrypted connection. For Oracle Cloud Services where HTTP connections with the third party site are permitted by Oracle, Oracle will enable such HTTP connections in addition to the HTTPS connection.
1.6 Input Control
The source of Your Content is under Your control and Your responsibility, and integrating Your Content into the Oracle Cloud Services, is managed by You.
1.7 Data and Network Segregation
Your Content is logically or physically segregated from the content of other customers hosted in the Oracle Cloud Services. All Oracle Cloud networks are segregated from Oracle's corporate networks.
1.8 Confidentiality and Training
Oracle personnel are subject to confidentiality agreements and are required to complete informationprotection awareness training upon hiring. Thereafter, all Oracle personnel must complete training periodically in accordance with applicable Oracle security and privacy awareness training policies.
1.9 Asset Management
Oracle follows formal procedures for tracking, managing, protecting and retiring assets. These responsibilities may include reviewing and authorizing access requests to those who have a business need and maintaining an inventory of assets.
You are responsible for the assets You control that utilize or integrate with the Oracle Cloud Services, including determining the appropriate information classification for Your Content, and whether the documented controls provided by Oracle Cloud Services are appropriate for Your Content.
1.10 Oracle Internal Information Security Policies
Oracle Cloud information security policies establish and govern areas of security applicable to Oracle Cloud Services and to Your use of Oracle Cloud Services. Oracle personnel are subject to the Oracle Corporate Information Security Policies and any additional policies that govern their employment or the services they provide to Oracle. Oracle's Information Security Program ("ISP") is comprised of documented policies that consider risk factors including cyber and security factors, with accompanying derivative procedures, standards and guidelines required for the effective
Oracle Cloud Hosting and Delivery Policies Page 8 of 18 operationalization of policy. Oracle's ISP is designed to ensure the confidentiality, integrity, privacy, continuity and availability of Your Content that is hosted by Oracle in Your Oracle Cloud Services through effective security management practices and controls. reviewed annually by the Oracle Security Oversight Committee and updated as required.
1.11 Internal Security Reviews and Enforcement
Oracle employs internal processes for regularly testing, assessing, evaluating and maintaining the effectiveness of the technical and organizational security measures described in this section.
1.12 External Reviews
Oracle may conduct independent reviews of Oracle Cloud Services utilizing third parties in the following areas (the scope of any such reviews may vary by Service and country):
SOC 1 (based on Statement on Standards for Attestation Engagements (SSAE) No 18) and/or SOC 2 reports (based upon Trust Services Criteria) Other independent third-party security testing to review the effectiveness of administrative and technical controls
Relevant information from these reviews may be made available to customers.
1.13 Oracle Software Security Assurance
Oracle Software Security Assurance (OSSA) is Oracle's methodology for building security into the design, build, testing, and maintenance of its products, whether they are used on-premises by customers, or delivered through Oracle Cloud. The OSSA program is described at https://www.oracle.com/corporate/security-practices/assurance/.
1.14 Security Logs
Oracle logs certain security-related activities on operating systems, applications, databases and network devices. Systems are configured to log default security activities, access to information or programs, system events such as alerts, console messages, and system errors.
Oracle reviews logs for security event investigation and forensic purposes. Identified anomalous activities feed into the security event management process. Security logs are stored within the Security Information and Event Management system (or equivalent system) in a native, unaltered format and retained in accordance with Oracle's internal policies. Security logs are retained online for a minimum of 1 year. These logs are retained and used by Oracle for our internal security operations.
1.15 Other Customer Security Related Obligations
You are responsible for:
Implementing Your own comprehensive system of security, operational policies, standards and procedures;
Oracle Cloud Hosting and Delivery Policies Page 9 of 18 Performing integrity and security checks, such as scanning for vulnerabilities, viruses, and malware of (i) Your data and files, prior to importing or uploading them into the Oracle Cloud Services, as well as (ii) Your Content, for Oracle Cloud Services which You configure and manage the Service environments; and
Maintaining Customer-managed accounts according to Your policies and security best practices;
Additionally, for Oracle Cloud at Customer Services, You are responsible for the following:
o Adequate physical and network security
o Security controls and network monitoring to reduce the risk of events which could threaten data confidentiality, availability or integrity
2. ORACLE CLOUD SERVICE CONTINUITY POLICY
2.1 Oracle Cloud Services High Availability Strategy
Oracle deploys the Oracle Cloud Services on resilient computing infrastructure designed to maintain service availability and continuity in the case of an incident affecting the Services. Data centers retained by Oracle to host Oracle Cloud Services have component and power redundancy with backup generators in place, and Oracle may incorporate redundancy in one or more layers, including network infrastructure, program servers, database servers, and/or storage.
2.2 Oracle Cloud Services Backup Strategy
Oracle periodically makes backups of Your Content in your instance of the Oracle Cloud Services for Oracle's sole use to minimize data loss in the event of an incident. Backups are stored at the primary site used to provide the Oracle Cloud Services and may also be stored at an alternate location for retention purposes. A backup is typically retained online or offline for a period of at least 60 days after the date that the backup is made. Oracle typically does not update, insert, delete or restore Your data on Your behalf. However, on an exception basis and subject to written approval, Oracle may assist You to restore data which You may have lost as a result of Your own actions.
For Oracle Cloud Services which enable You to configure backups in accordance with Your own policies, You are responsible for performing backups and restores of Your Content. Additionally, You are encouraged to develop a business continuity plan to ensure continuity of Your own operations in the event of a disaster.
2.3 Oracle Business Continuity
rations with the goal of
minimizing any disruption to the Services if any disaster, disruption or force majeure event occurs
The BC Plan establishes, documents and implements processes, procedures and controls to ensure the provisions applicable to the Oracle Cloud Services are not diminished in the event the BC Plan is
Oracle Cloud Hosting and Delivery Policies Page 10 of 18 invoked.
continuity of the Oracle Cloud Services regardless of cause.
3. ORACLE CLOUD SERVICE LEVEL AGREEMENT
3.1 Hours of Operation
The Oracle Cloud Services are designed to be available 24 hours a day, 7 days a week, 365 days a year, except during maintenance periods, technology upgrades and as otherwise set forth in the Oracle agreement, Your order and this Oracle Cloud Service Level Agreement.
3.2 Service Availability
Service Availability Level, or Target Service Uptime of 99.9%. This is in accordance with the terms set forth in the Oracle Cloud Service Pillar documentation for the applicable Oracle Cloud Service (or such other Target Service Availability Level or Target Service Uptime specified by Oracle for the applicable Oracle Cloud Service in such documentation).
3.2.1 Measurement of Availability
Following the end of each calendar month of the applicable Services Period, Oracle measures the Service Availability Level or Service Uptime over the immediately preceding month by dividing the difference between the total number of minutes in the monthly measurement period and any Unplanned Downtime (as defined below) by the total number of minutes in the measurement period and multiplying the result by 100 to reach a percent figure.
Number of minutes in a 30 day month = 30 days * 24 hours in the day *60 minutes in an hour Number of unplanned minutes in the month = minutes of unplanned downtime defined in the section Definition of Unplanned Downtime .
Example: June has 30 days = 30*24*60 = 43,200 minutes in the month If 90 minutes of unplanned downtime occurred in the month of June the equation would be:
( 43,200) * 100 = 99.8% Service Level Availability
3.2.2 Reporting of Availability
Oracle will provide you metrics on the Service Availability Level for Oracle Cloud Services that You purchased under Your order, either in a self-service manner or via a Service Request submitted by You to Oracle requesting the metrics.
Oracle Cloud Hosting and Delivery Policies Page 11 of 18
3.2.3 Service Credits
You may receive Service Credits in the event that the Target Service Availability Level or Target Service Uptime for Oracle Cloud Services that You purchased under Your order is below the defined Target Service Availability Level or Target Service Uptime applicable to such Services. Service Credits are defined in the Oracle Cloud Service Pillar documentation or Service Descriptions applicable to Your purchased Oracle Cloud Services. Notwithstanding the provisions of this section, if Your order with Oracle, or Service Specifications applicable to your order, for a particular Oracle Cloud Service provides a right to receive a higher amount of Service Credits, then You may receive the Service Credits under the provision which provides for the highest amount of Service Credits to You, but You may not recover Service Credits under multiple provisions for the same event.
3.3 Definition of Unplanned Downtime (Unavailability)
Oracle Cloud Services are deployed in resilient computing facilities with resilient infrastructure, redundant network connections, and power at each hosting facility. when a problem with the applicable Oracle Cloud Services prevents Your connectivity to Your production instance of such Cloud Services. Unplanned Downtime does not include any time during which the Oracle Cloud Services or any Oracle Cloud Services components are not available due to: (i) scheduled maintenance periods, (ii) circumstances/infrastructure
actions or inactions of You, Your Users or any third party (other than any Oracle agents and contractors that Oracle has engaged to support the Services) or (iv) any permitted suspension by Oracle.
In addition, with respect to Oracle Cloud at Customer Services, Unplanned Downtime also does not include downtime or other unavailability (i) of Your data center (e.g., due to maintenance) or (ii) occurring outside the on-site hours defined under Your order for Oracle Cloud Operations personnel at Your data center.
3.4 Monitoring
Oracle uses a variety of software tools to monitor the availability and performance of the Cloud Services and the operation of infrastructure and network components (such as CPU, memory, storage, database and other components). Oracle generates alerts associated with deviations to defined thresholds, and Oracle staff investigates and resolves any identified underlying issues. Oracle does not monitor, or address deviations experienced by any non-Oracle managed components used by You in the Oracle Cloud Services, such as non-Oracle applications.
3.4.1 Customer Monitoring & Testing Tools
Oracle permits You to conduct limited functional testing for Oracle Cloud Services in Your test instance. Specific rules for testing may be found in the Program Documentation.
Oracle regularly performs penetration and vulnerability testing and security assessments against Oracle Cloud infrastructure, platforms, and applications in order to validate and improve the overall
Oracle Cloud Hosting and Delivery Policies Page 12 of 18 security of Oracle Cloud Services. The Oracle Cloud Services Program Documentation outlines when and how You may assess or test any components that You manage or create in Oracle Cloud Services, including non-Oracle applications, non-Oracle databases, other applicable non-Oracle software, code, or the use of data scraping tools.
Oracle reserves the right to remove or disable access to any tools or technologies that violate the guidelines in this section or the applicable Oracle Cloud Services Program Documentation, without any liability to You.
4. ORACLE CLOUD CHANGE MANAGEMENT POLICY
4.1 Oracle Cloud Change Management and Maintenance
Oracle performs changes to cloud hardware infrastructure, operating software, product software, and supporting application software that is provided by Oracle as part of the Oracle Cloud Services, to maintain operational stability, availability, security, performance, and currency of the Oracle Cloud Services. You agree to provide Oracle with all information, access, and cooperation, and to take such actions as reasonably necessary to enable Oracle to implement and maintain the Oracle Cloud Services, including any changes to such Services in accordance with this section. Oracle follows formal change management procedures to review, test, and approve changes prior to application in the service.
Changes made through change management procedures include system and service maintenance activities, upgrades and updates, and customer specific changes. Oracle Cloud Services change management procedures are designed to minimize service interruption during the implementation of changes.
Oracle reserves specific maintenance periods for changes that may require the Oracle Cloud Services to be unavailable during the maintenance period. Oracle works to ensure that change management procedures are conducted during scheduled maintenance periods (of which Oracle shall give advanced notice), while taking into consideration low traffic periods and geographical requirements.
Oracle will provide prior notice of modifications to the maintenance period schedule. For Customerspecific changes and upgrades, where feasible, Oracle will coordinate the maintenance periods with You.
For changes that are expected to cause service interruption, the durations of the scheduled maintenance periods are not included in the calculation of Unplanned Downtime minutes in the monthly measurement period for Service Availability Level (see the Oracle Cloud Service Level Agreement above). Oracle uses commercially reasonable efforts to minimize the use of scheduled maintenance and to minimize the duration of maintenance periods that cause service interruptions.
For Oracle Cloud Services which enable You to perform maintenance activities, You are responsible for configuring and maintaining the operating systems and other associated software.
Oracle Cloud Hosting and Delivery Policies Page 13 of 18
4.1.1 Security Maintenance
Oracle may be required to execute additional security maintenance outside of scheduled maintenance windows to address an exigent situation (e.g., security vulnerability) with the Oracle Cloud Service or Oracle infrastructure that cannot be addressed except on an emergency basis. Oracle works to minimize additional security maintenance that requires a service interruption outside of scheduled maintenance periods and to the extent reasonable, will work to provide 24 hours prior notice for such maintenance.
4.1.2 Data Center Migrations
Oracle may migrate Your Oracle Cloud Services deployed in data centers retained by Oracle between data centers in the same Data Center Region as deemed necessary by Oracle. Oracle will provide a obligation does not apply to disaster recovery scenarios or to ensure Service continuity, as further described, where applicable, in the relevant Oracle Cloud Services Pillar documentation.
4.2 Software Versioning
4.2.1 Software Updates
Oracle requires all Oracle Cloud Services customers to keep the software versions of the Oracle Cloud Services current with the software versions that Oracle designates as supported releases for such Oracle Cloud Services. Software updates are required for the Oracle Cloud Services in order to maintain version currency. Oracle
Cloud Service Continuity Policy, the Oracle Cloud Service Level Agreement, and the Oracle Cloud Support Policy) are dependent on You maintaining the currently supported versions of Your Oracle Cloud Services. Oracle is not responsible for performance, functionality, availability or security issues experienced with Oracle Cloud Services that may result from running earlier versions.
4.2.2 End of Life
Oracle will host and support only the supported releases of an Oracle Cloud Service. All other versions You are required to complete the
Oracle Cloud Services update to the latest version before the EOL of a given version. You acknowledge that failure to complete the update prior to the EOL of an Oracle Cloud Service version may result in an update automatically performed by Oracle or a suspension of the Oracle Cloud Services.
In certain circumstances where an Oracle Cloud Service reaches the Service EOL and Oracle does not make available an updated version, Oracle may designate, and require You to transition to, a successor Oracle Cloud Service. Oracle will provide You with no less than 12 months advance notice prior to the date when the Oracle Cloud Services are no longer generally available as a service (i.e., Oracle will no longer support, or make available for use, any versions of the Cloud Services), where reasonably practical.
Oracle Cloud Hosting and Delivery Policies Page 14 of 18
5. ORACLE CLOUD SUPPORT POLICY
The support described in this Oracle Cloud Support Policy applies only for Oracle Cloud Services and is provided by Oracle as part of such Oracle Cloud Services under Your order. Oracle may make available, and You may order for additional fees, additional support service offerings made available by Oracle for the Oracle Cloud Services.
5.1 Oracle Cloud Support Terms
5.1.1 Support Fees
The fees paid by You for the Oracle Cloud Services under Your order include the support described in this Oracle Cloud Support Policy. Additional fees are applicable for additional Oracle support services offerings purchased by You.
5.1.2 Support Period
Oracle Cloud support becomes available upon the Oracle Cloud Services start date and ends upon the expiration or termination of the Services (the "support period"). Oracle is not obligated to provide the support described in this Oracle Cloud Support Policy beyond the end of the support period.
5.1.3 Technical Contacts
Your technical contacts are the sole liaisons between You and Oracle for Oracle support for Oracle Cloud Services. Those technical contacts must have, at a minimum, initial basic service training and, as needed, supplemental training appropriate for specific role or implementation phase, specialized service/product usage, and migration. Your technical contacts must be knowledgeable about the Oracle Cloud Services in order to help resolve system issues and to assist Oracle in analyzing and resolving service requests. When submitting a service request, Your technical contact should have a baseline understanding of the problem being encountered and an ability to reproduce the problem in order to assist Oracle in diagnosing and triaging the problem. To avoid interruptions in Oracle support for Oracle Cloud Services, You must notify Oracle whenever technical contact responsibilities are transferred to another individual.
5.1.4 Oracle Cloud Support
Oracle support for Oracle Cloud Services consists of:
Diagnoses of problems or issues with the Oracle Cloud Services Reasonable commercial efforts to resolve reported and verifiable errors in the Oracle Cloud Services so that those Oracle Cloud Services perform in all material respects as described in the associated Service Specifications
Support during Change Management activities described in the Oracle Cloud Change Management Policy (see above)
Assistance with technical service requests 24x7x365
24x7x365 access to a Cloud Customer Support Portal designated by Oracle and Live Telephone Support to log service requests
Oracle Cloud Hosting and Delivery Policies Page 15 of 18 Access to community forums
Non-technical customer service assistance during normal Oracle business hours (8:00 to 17:00) local country time
5.2 Oracle Cloud Customer Support Systems
5.2.1 Oracle Cloud Customer Support Portal
Oracle provides support for the Oracle Cloud Service acquired by You, under an Order, through the Cloud Customer Support Portal (support portal) designated for that Oracle Cloud Service. While Oracle Cloud Support and the portals (including any portion of the Services they may provide) may be part of Your order, they are not an Oracle Cloud Service offering, and they may be delivered globally, with access to them governed by the Terms of Use posted on the applicable portal web sites, which terms of use are subject to change. Where such portals allow You to upload information, You are responsible for ensuring that You and Your Users do not submit any government-issued identification numbers or any health, financial, payment card, controlled unclassified information, or other sensitive personal information into such portals, unless otherwise expressly permitted by the terms of the support portal or Your applicable Cloud Services order. Access to the support portal is limited to Your designated technical contacts and other authorized users of the Oracle Cloud Services.
Where applicable, the support portal provides support details to Your designated technical contacts to enable use of Oracle support for Oracle Cloud Services. Support notifications and alerts relevant to your service requests are posted in the support portal.
5.2.2 Live Telephone Support
Your technical contacts may access live telephone support via the phone numbers and contact https://www.oracle.com/support/contact.html.
5.3 Severity Definitions
Service requests for Cloud Services may be submitted by Your designated technical contacts via the support portal. The severity level of a service request is assigned based on inputs from You, and will be based on the following severity definitions:
5.3.1 Severity 1 (Critical Outage)
Your production use of the Oracle Cloud Services is stopped or so severely impacted that You cannot reasonably continue work. You experience a complete loss of service. The impacted operation is mission critical to the business and the situation is an emergency. A Severity 1 service request has one or more of the following characteristics:
Data corrupted
A critical documented function is not available
Service hangs indefinitely, causing unacceptable or indefinite delays for resources or response
Service crashes, and crashes repeatedly after restart attempts
Oracle Cloud Hosting and Delivery Policies Page 16 of 18 Security Incident with the potential to impact the confidentiality, integrity or availability of the service
Oracle will use reasonable efforts to respond to Severity 1 service requests within fifteen (15) minutes.
Throughout the period during which Oracle is working to address a Severity 1 service request, You agree to make available Your technical contact 24x7. Oracle will work 24x7 until the Severity 1 service request is resolved, a reasonable work-around is put in place, an approved action plan is in place or longer available. You must provide Oracle with a technical contact during this 24x7 period to assist with data gathering, testing, and applying fixes. You are required to propose this severity classification with great care, so that valid Severity 1 situations obtain the necessary resource allocation from Oracle.
5.3.2 Severity 2 (Significant Impairment)
You experience a severe loss of service. Important features of the Oracle Cloud Services are unavailable with no acceptable workaround; however, operations can continue in a restricted fashion.
5.3.3 Severity 3 (Technical Issue)
You experience a minor loss of service. The impact is an inconvenience, which may require a workaround to restore functionality.
5.3.4 Severity 4 (General Guidance)
You request information, enhancement, or documentation clarification regarding the Oracle Cloud Services, but there is no impact on the operation of such service. You experience no loss of service.
5.4 Change to Service Request Severity Level
5.4.1 Initial Severity Level
At the time when the service request is created, Oracle will record an initial severity level of the service request based on the above severity definitions and/or Your inputs. creation of a service request, will be to resolve the issues underlying the service request. The severity level of a service request may be adjusted as described below.
5.4.2 Downgrade of Service Request Levels
As work on the underlying issue progresses, if the issue no longer warrants the severity level currently assigned based on its current impact on the operation of the applicable Oracle Cloud Service, then the severity level will be downgraded to the severity level that most appropriately reflects its current impact.
5.4.3 Upgrade of Service Request Levels
If, during the service request process, the issue warrants the assignment of a higher severity level than that currently assigned based on the current impact on the production operation of the applicable Oracle Cloud Service, then the severity level will be upgraded to the severity level that most appropriately reflects its current impact.
Oracle Cloud Hosting and Delivery Policies Page 17 of 18
5.4.4 Adherence to Severity Level Definitions
You shall ensure that the assignment and adjustment of any severity level designation is accurate based on the current impact on the production operation of the applicable Oracle Cloud Service.
5.5 Service Request Escalation
For service requests that are escalated by You, the Oracle support analyst will engage the Oracle service request escalation manager who will be responsible for managing the escalation. The Oracle service request escalation manager will work with You to develop an action plan and allocate the appropriate Oracle resources. If the issue underlying the service request continues to remain unresolved, You may contact the Oracle service request escalation manager to review the service request and request that it be escalated to the next level within Oracle as required. To facilitate the resolution of an escalated service request, You are required to provide contacts within Your organization that are at the same level as that within Oracle to which the service request has been escalated.
6. ORACLE CLOUD SUSPENSION AND TERMINATION POLICY
6.1 Termination of Oracle Cloud Services
For a period of 60 days after the end of the Services Period for the Oracle Cloud Services or, if applicable, the 60 day period following Your termination of Cloud Services that You consume in a Pay as You Go model, following the end of their associated Services Period, Oracle will make available, via secure protocols and in a structured, machine-readable format, Your Content residing in the Oracle Cloud Services, or keep the service system accessible, for the purpose of data retrieval by You. At the end of the Services Period Your right to use such Services expires, except as otherwise permitted under the terms of the Oracle agreement, Your Order and the Service Specifications applicable to Your Oracle Cloud Services.
For free trials and pilots of Oracle Cloud Services, Oracle will make Your Content available for a period of 30 days following end of the trial or pilot.
Agreement does not apply and the service system may not be used for any production activities.
Oracle has no obligation to retain Your Content after this retrieval period.
If You need assistance from Oracle to obtain access to or copies of Your Content, You must create a service request in the support portal.
Data retrieval and any related assistance by Oracle is not applicable for Oracle Cloud Services that do not store Your Content. You are responsible for ensuring that if those Oracle Cloud Services are dependent on separate Oracle Cloud Services (such as Storage Cloud Service or Database Cloud Services) for the storage of data, those separate Oracle Cloud Services must have a valid duration through the end of the terminating Oracle Cloud Service to enable data retrieval, or for otherwise taking appropriate action to back up or otherwise store separately Your Content while the production Oracle Cloud Services is still active prior to the end of the Services Period.
Oracle Cloud Hosting and Delivery Policies Page 18 of 18 Following expiry of the retrieval period, Oracle will delete Your Content from the Oracle Cloud Services (unless otherwise required by applicable law).
For Oracle Cloud at Customer Services, You must make available for retrieval by Oracle any Oracle Cloud at Customer Service-related hardware components (including the gateway equipment) provided by Oracle in good working order and the same condition as at the start of the Oracle Cloud at Customer Services subject to reasonable wear and tear for appropriate use. 7 USE OF SERVICES
You are responsible for ensuring that access and use of acquired Oracle Cloud Services, and the benefit received from such Cloud Services, is only by and for Users in countries in accordance with Oracle's Global Trade Compliance policy described at https://www.oracle.com/corporate/securitypractices/corporate/governance/global-trade-compliance.html.
Oracle Utilities Opower Professional Services Descriptions v030724 Page 1 of 22 Oracle Utilities Opower
Professional Services
Descriptions
Oracle Utilities Opower Professional Services Descriptions Page 2 of 22
TABLE OF CONTENTS
Oracle Utilities Opower Setup Fees 3
Oracle Utilities Opower Customer/Billing Integration & Platform Cloud Service Setup Fee 3 Oracle Utilities Opower AMI Integration and Platform Cloud Service Setup Fee 5 Oracle Utilities Opower Single Sign-On Setup Fee 7
Oracle Utilities Opower Custom Outbound Email Setup Fee 8 Oracle Utilities Opower Platform Insight Setup Fee 11
Oracle Utilities Opower Professional Services Other Fees 12 Oracle Utilities Opower CIS Upgrade Fee 12
Oracle Utilities Opower Customer Classification File Data Integration Fee 14 Oracle Utilities Opower Third-Party Randomization Fee 16 Oracle Utilities Opower Hourly Program Services Fixed Price - Hour 17 Oracle Utilities Opower Rates Integration and Modeling Fee 19
Oracle Utilities Opower Professional Services Descriptions Page 3 of 22 Oracle Utilities Opower Setup Fees
Oracle Utilities Opower Customer/Billing Integration & Platform Cloud Service Setup Fee Part# [B87456]
[United States and Canada]
A. Description of Services
Oracle will provide You with up to seven hundred twelve (712) hours of project initiation, data integration and platform setSuch Services include the following:
1. Project Initiation Services
a. Conduct a remote project kick-off meeting via web conference. b. Provide an estimated deployment timeline in a mutually agreed Microsoft file format. c. Deliver to You a copy of the Oracle Utilities Opower Core Data Transfer Standards document.
2. Data Integration and Platform Set-up Services
a. Guide You through the process and timeline for You to generate all files. b. Assist You with completion of the template that maps Your data fields to data fields Oracle collects as specified in the Oracle Utilities Opower Core Data Transfer Standards. c. Analyze and validate that the sample historical data file(s) provided by You contain the same columns, follow the same formatting and naming standards and otherwise conform to the Oracle Utilities Opower Core Data Transfer Standards, and provide You with a list of any issues.
d. Analyze and validate that the full historical data file(s) provided by You contain the same columns, follow the same formatting and naming standards and otherwise conform to the Oracle Utilities Opower Core Data Transfer Standards.
e. Analyze and validate that the iterative, incremental data files provided by You contain the same columns and follow the same formatting and naming standards and otherwise conform to the Oracle Utilities Opower Core Data Transfer Standards. f. and
parcel data for Your customer service territory, where available from licensed third party providers.
g. Load demographic data, weather data and parcel data obtained from licensed third party providers, where available, to the Oracle Utilities Opower platform. h. Load Your customer and billing data file(s) to the Oracle Utilities Opower platform. i. Set-up the secure file transfer protocol (SFTP) to enable the regular transfer of data file(s) between You and Oracle.
j. Schedule and execute Oracle Utilities Opower batch processes to calculate Oracle Utilities Opower data insights for use in the Oracle Utilities Opower products.
B. Your Cooperation and Project Assumptions
ability to perform the Services depends upon Your fulfillment of the following obligations and the following project assumptions:
1. Your Cooperation
a. Participate in the project kick-off meeting.
Oracle Utilities Opower Professional Services Descriptions Page 4 of 22 b. Confirm Your agreement with the deployment timeline and allocate appropriate resources to provide the assistance described below.
c. Acknowledge that You have received the Oracle Utilities Opower Core Data Transfer Standards, can meet such requirements, and have the information technology resources and the consents required to securely send data to Oracle. d. Work with Oracle to complete a template that maps Your data fields to data fields Oracle collects as specified in the Oracle Utilities Opower Core Data Transfer Standards. e. Provide production quality billed usage data for a random sample of 10,000-20,000 customers (both active and inactive), and all billed usage reads recorded dating back to January of the previous calendar year for such customers within the timeline mutually agreed upon between You and the Oracle project manager. f. Participate in analyzing and validating the sample historical data file(s). g. Provide the iterative, incremental data file(s) within the timeline mutually agreed upon between You and the Oracle project manager, delivered either daily or weekly as mutually agreed by the parties.
h. Participate in analyzing and validating the iterative, incremental data file(s). i. Provide the full historical data file(s) in accordance with the Oracle Utilities Opower Core Data Transfer Standards within the timeline mutually agreed upon between You and the Oracle project manager.
j. Participate in analyzing and validating the full historical data file(s). k. Address data issues with the sample historical data file(s), full historical data file(s) and iterative, incremental data file(s) within one business day of Oracle notifying You of same. l. Generate an automated incremental data file that includes any new customer information and billed usage data recorded since the most recent record in the full historical file, including customer move-in and move-out data and any corrections. m. Coordinate with Oracle to set-up the SFTP to enable the regular transfer of data file(s) between You and Oracle.
n. Send iterative, incremental data files to Oracle on a weekly or daily basis, as mutually agreed by the parties.
2. Project Assumptions
a. The Services shall be performed remotely unless otherwise noted in Section A. At Your request, Oracle may agree to conduct onsite visits at Your location during the Professional Services Period defined below.
b. Any timelines or expected completion dates discussed with You are estimated dates and are intended for planning purposes only.
C. Expenses
In addition to the fees set forth in Your order, You agree to reimburse Oracle for travel and out of pocket expenses related to providing any on-site Services. All expenses invoiced monthly hereunder are due and payable in accordance with the payment terms of Your order.
D. Unused Services
The Services must be used within the Services Period for the underlying cloud service, unless otherwise stated in Your order (the
Services Period will be automatically forfeited by You, with no further action required of either party, and You will not be entitled to a refund, or any credit toward additional or other services, for any unused
Oracle Utilities Opower Professional Services Descriptions Page 5 of 22 portion of the fees paid for any unused Services. You may not use the fees for any services other than the Services stated herein.
E. Project Management
You and Oracle further agree to each designate a project manager who shall work together with the Oracle Utilities Opower AMI Integration and Platform Cloud Service Setup Fee Part #B87457
[United States and Canada]
A. Description of Services
Oracle will provide You with up to two hundred fifty-six (256) hours of project initiation, data integration and platform setServices include the following:
1. Project Initiation Services
a. Conduct a remote project kick-off meeting via web conference. b. Provide an estimated deployment timeline in a mutually agreed Microsoft fileformat. c. Deliver to You a copy of the Oracle Utilities Opower Interval Data Transfer Standards document.
2. Data Integration and Platform Set-up Services
a. Guide You through the process and timeline for You to generate all advanced metering infrastructure (AMI) data file(s) that You will provide to Oracle for use in the Oracle Utilities Opower platform.
b. Assist You with completion of the template that maps Your data fields to data fields to Oracle collects as specified in the Oracle Utilities Opower Interval Data Transfer Standards. c. Analyze and validate that the sample historical data file(s) provided by You contain the same columns, follow the same formatting and naming standards and otherwise conform to the Oracle Utilities Opower Interval Data Transfer Standards, and provide You with a list of any issues.
d. Analyze and validate that the full historical data file(s) provided by You contain the same columns, follow the same formatting and naming standards and otherwise conform to the Oracle Utilities Opower Interval Data Transfer Standards. e. Analyze and validate that the iterative, incremental data file(s) provided by You contain the same columns, follow the same formatting and naming standards and otherwise conform to the Oracle Utilities Opower Interval Data Transfer Standards. f. Load Your data file(s) to the Oracle Utilities Opower platform. g. Update the secure file transfer protocol (SFTP) to enable the regular transfer of AMI data file(s) between You and Oracle.
h. Schedule and execute Oracle Utilities Opower batch processes to calculate Oracle Utilities Opower data analytics for use in the Oracle Utilities Opower products.
B. Your Cooperation and Project Assumptions
Oracle Utilities Opower Professional Services Descriptions Page 6 of 22 ability to perform the Services depends upon Your fulfillment of the following obligations and the following project assumptions:
1. Your Cooperation
a. Participate in the project kick-off meeting.
b. Confirm Your agreement with the deployment timeline and allocate appropriate resources to provide the assistance described below.
c. Acknowledge that You have received the Oracle Utilities Opower Interval Data Transfer Standards provided to You by Your Oracle project manager in electronic format, that You can meet such requirements, and that You have the information technology resources and the consents required to securely send data to Oracle.
d. Work with Oracle to complete a template that maps Your data fields to data fields Oracle collects as specified in the Oracle Utilities Opower Interval Data Transfer Standards. e. Provide production quality billed usage data for a random sample of 10,000-20,000 customers (both active and inactive), and all billed usage reads recorded dating back to January of the previous calendar year for such customers within the timeline mutually agreed upon between You and the Oracle project manager. f. Participate in analyzing and validating such sample historical data file(s). g. Provide the iterative, incremental data file(s) within the timeline mutually agreed upon between You and the Oracle project manager.
h. Participate in analyzing and validating the iterative, incremental data file(s). i. Provide the full historical data file(s) in accordance with the Oracle Utilities Opower Interval Data Transfer Standards within the timeline mutually agreed upon between You and the Oracle project manager.
j. Participate in analyzing and validating the full historical data file(s). k. Address data issues with the sample historical data file(s), full historical data file(s) and iterative, incremental data file(s) within one business day of Oracle notifying You of same. l. Generate an automated incremental data file that includes any new customer information and billed usage data recorded since the most recent record in the full historical file, including customer move-in and move-out data and corrections. m. Coordinate with Oracle to update the SFTP to enable the regular transfer of data file(s) between You and Oracle.
n. Send iterative, incremental data files to Oracle on a weekly or daily basis, as mutually agreed by the parties.
2. Project Assumptions
a. The Services shall be performed remotely unless otherwise noted in Section A. At Your request, Oracle may agree to conduct onsite visits at Your location during the Professional Services Period defined below.
b. Any timelines or expected completion dates discussed with You are estimated dates and are intended for planning purposes only.
C. Expenses
In addition to the fees set forth in Your order, You agree to reimburse Oracle for travel and out of pocket expenses related to providing any on-site Services. All expenses invoiced monthly hereunder are due and payable in accordance with the payment terms of Your order.
D. Unused Services
Oracle Utilities Opower Professional Services Descriptions Page 7 of 22 The Services must be used within the Services Period for the underlying cloud service unless otherwise stated in Your order (the
Services Period will be automatically forfeited by You, with no further action required of either party, and You will not be entitled to a refund, or any credit toward additional or other services, for any unused portion of the fees paid for any unused Services. You may not use the fees for any services other than the Services stated herein.
E. Project Management
You and Oracle further agree to each designate a project manager who shall work together with the Oracle Utilities Opower Single Sign-On Setup Fee
Part #B89686
[United States and Canada]
A. Description of Services
Oracle will provide You with up to eighty (80) hours of project initiation, product setup services and Oracle Utilities Opower Single Sign-On (SSO)
Such Services shall include the following:
1. Project Initiation Services
a. Conduct a remote project kick-off meeting via web conference. b. Provide an estimated deployment timeline in a mutually agreed Microsoft file format. c. Provide a copy of the Oracle Utilities Opower Single Sign-On (SSO) Configuration Guide.
2. Product Setup Services
a. Implement the SSO feature of the Oracle Utilities Opower Energy Efficiency Web Portal as per the Oracle Utilities Opower Single Sign-On (SSO) Configuration Guide document; and b. Troubleshoot Oracle SSO test logs during SSO testing and provide logs output to Your technical team.
3. Product Launch Services
a. Provide to You one (1) test environment for Your review of SSO prior to product launch; b. Deploy SSO to production; and
c. Notify Oracle platform operations team to conduct product launch.
B. Your Cooperation and Project Assumptions
ability to perform the Services depends upon Your fulfillment of the following obligations and the following project assumptions:
1. Your Cooperation
a. Participate in the project kick-off meeting.
Oracle Utilities Opower Professional Services Descriptions Page 8 of 22 b. Implement security assertion markup language (SAML) 2.0 (a requirement for SSO implementation) within eight (8) weeks of project kick-off and prior to implementation of SSO;
c. Work with Oracle to implement SSO of the Energy Efficiency Web Portal within Your website as per the Oracle Utilities Opower Single Sign-On (SSO) Configuration Guide document; and d. Make Your IT resources available to assist with the Services as stated herein and as part of the project implementation timeline.
2. Project Assumptions
a. The Services shall be performed remotely unless otherwise noted in Section A. At Your request, Oracle may agree to conduct onsite visits at Your location during the Professional Services Period defined below.
b. Any timelines or expected completion dates discussed with You are estimated dates and are intended for planning purposes only.
C. Expenses
In addition to the fees set forth in Your order, You agree to reimburse Oracle for travel and out of pocket expenses related to providing any on-site Services. All expenses invoiced monthly hereunder are due and payable in accordance with the payment terms of Your order.
D. Unused Services
The Services must be used within the Services Period for the underlying cloud service, unless otherwise Services Period will be automatically forfeited by You, with no further action required of either party, and You will not be entitled to a refund, or any credit toward additional or other services, for any unused portion of the fees paid for any unused Services. You may not use the fees for any services other than the Services stated herein.
E. Project Management
You and Oracle further agree to each designate a project manager who shall work together with the Oracle Utilities Opower Custom Outbound Email Setup Fee Part # B93541
[United States and Canada]
A. Description of Services
Oracle will provide You with up to one hundred four (104) hours of project initiation, design, an Opower outbound email campaign
of the following:
1. Project Initiation Services
Oracle will:
a. Conduct a remote project kick-off meeting via web conference.
Oracle Utilities Opower Professional Services Descriptions Page 9 of 22 b. Provide an estimated deployment timeline in a mutually agreed Microsoft file format.
c. Provide an outbound email configuration guide document to You, in a mutually agreed Microsoft file format, for the purposes of documenting Your configuration inputs.
2. Design, configuration, and email generation Services Oracle will:
a. Assist You in defining the content and approach for the outbound email communication, such as the frequency of communications, content of communications and customer groups to be targeted with such communications. Oracle will demonstrate the library of modules that may be displayed on Opower outbound email during the design Services. b. Provide You with a list of standard branding inputs required by Oracle to design the email.
c. Participate in the review and finalization of the outbound email template. d. Configure the outbound email template based on the mutually-agreed inputs in the design.
e. Finalize the customer segmentation and select a group of target customers to receive the Opower outbound email.
f. Perform final quality assurance checks for content and collateral designed, created and configured in this section after deploying these elements to a testing environment.
g. Generate a test batch of up to ten (10) Opower outbound emails to conduct quality assurance checks over content and collateral, after deploying the outbound email configuration to a test environment.
3. Product Launch Services
a. Generate an initial one (1)-time batch of personalized outbound emails for Your customers.
b. Dispatch the initial one (1)-time batch of personalized outbound emails to Your customers.
c. After generating and dispatching the initial one (1)-time batch, generate and dispatch up to two (2) re-sends of the initial batch to Your customers who did not open the email from the initial batch.
d. Provide You with one (1) customer engagement reports. This report will be sent once within one (1) business day after each email dispatch and then once again within six (6) business days after each email dispatch. The reports will include metrics such as, but not necessarily limited to, number of emails sent, opened and clicks.
B. Your Cooperation and Project Assumptions
In addition to the obligations and assumptions stated in Your order, You acknowledge that ends upon Your fulfillment of the following
obligations and the following project assumptions:
1. Your Cooperation
Oracle Utilities Opower Professional Services Descriptions Page 10 of 22 a. Participate in the project kick-off meeting.
b. Confirm Your agreement with the deployment timeline and allocate appropriate resources to provide the assistance described below.
c. Provide final inputs for product configurations within the timeline as mutually agreed upon between You and the Oracle Project Manager.
d. Review and finalize the marketing materials created in the project design and configuration phase within the timeline as mutually agreed upon between You and the Oracle Project Manager.
e. Review and finalize the outbound email template within two (2) review iterations. f. Define branding requirements.
g. Define targeted customer segments for the project.
h. Participate in final review of outbound email contents. i. Participate in customer service representatives training. j. Provide any notices, and obtain any consents, required for Oracle to perform Services.
2. Project Assumptions
a. The Services shall be performed remotely unless otherwise noted in Section A. At Your request, Oracle may agree to conduct onsite visits at Your location during the Professional Services Period defined below.
b. Any timelines or expected completion dates discussed with You are estimated dates and are intended for planning purposes only.
c. Customer service representatives will not be able to access the Opower outbound emails via the Oracle Utilities Opower Customer Service Interface Cloud Service. d. The Services include designing and configuring one (1) new email template.
Designing and configuring more than one (1) email template will require contracting additional services.
e. The final email template may include personalized customer data which is currently available in the Opower database. No new insights will be calculated. f. domain email address.
C. Expenses
In addition to the fees set forth in Your order, You agree to reimburse Oracle for travel and out of pocket expenses related to providing any on-site Services. All expenses invoiced monthly hereunder are due and payable in accordance with the payment terms of Your order.
D. Unused Services
The Services must be used within the Services Period for the underlying cloud service, unless otherwise stat
the Professional Services Period will be automatically forfeited by You, with no further action required of either party, and You will not be entitled to a refund, or any credit toward additional or other services, for any unused portion of the fees paid for any unused Services. You may not use the fees for any services other than the Services stated herein.
E. Project Management
You and Oracle further agree to each designate a project manager who shall work together with
Oracle Utilities Opower Professional Services Descriptions Page 11 of 22 Oracle Utilities Opower Platform Insight Setup Fee
Part # B94957
[United States and Canada]
A. Description of Services
Oracle will provide You with up to sixty four (64) hours of project initiation, design, platform insight provided that such hours of Services may only be used fo performance of any of the following:
1. Project Initiation Services
a. Conduct a remote project kick-off meeting via web conference. b. Provide an estimated deployment timeline in a mutually agreed Microsoft file format.
c. Provide a list of available platform insights that can be generated through this service.
2. Configuration and insight generation Services
a. Assist You in defining the Oracle Utilities Opower platform insight to support Your program goals.
b. Participate in the review and finalization of the Oracle Utilities Opower platform insight calculation logic.
c. Finalize the customer segmentation and select a group of target customers to be included in the Oracle Utilities Opower platform insight extract. d. Perform final quality assurance checks for Oracle Utilities Opower platform insight within content and collateral designed, created and configured in this section after deploying these elements to a testing environment. e. Generate a test batch of up to ten (10) data records of the Oracle Utilities Opower platform insights to conduct quality assurance checks.
3. Product Launch Services
a. Generate a one (1)-time batch file of the Oracle Utilities Opower platform insight for Your selected customers.
B. Your Cooperation and Project Assumptions
In addition to the obligations and assumptions stated in Your order, You acknowledge that obligations and the following project assumptions:
1. Your Cooperation
a. Participate in the project kick-off meeting.
b. Confirm Your agreement with the deployment timeline and allocate appropriate resources to provide the assistance described below.
c. Review and finalize the Oracle Utilities Opower platform insight within the timeline as mutually agreed upon between You and the Oracle Project Manager. d. Define targeted customer segments for the project.
Oracle Utilities Opower Professional Services Descriptions Page 12 of 22 e. Provide any notices, and obtain any consents, required for Oracle to perform Services.
2. Project Assumptions
a. The Services shall be performed remotely unless otherwise noted in Section A.
At Your request, Oracle may agree to conduct onsite visits at Your location during the Professional Services Period defined below.
b. The Services include designing and providing one (1) Oracle Utilities Opower platform insight. Creating more than one (1) Oracle Utilities Opower platform insight will require contracting additional services.
c. The personalized customer data is currently available from the Oracle Utilities Opower platform.
d. This Service can only be used to generate insights from the list of available platform insights which Oracle will provide to You.
e. Any timelines or expected completion dates discussed with You are estimated dates and are intended for planning purposes only.
C. Expenses
In addition to the fees set forth in Your order, You agree to reimburse Oracle for travel and out of pocket expenses related to providing any on-site Services. All expenses invoiced monthly hereunder are due and payable in accordance with the payment terms of Your order.
D. Unused Services
The Services must be used within the Services Period for the underlying cloud service, unless the Professional Services Period will be automatically forfeited by You, with no further action required of either party, and You will not be entitled to a refund, or any credit toward additional or other services, for any unused portion of the fees paid for any unused Services. You may not use the fees for any services other than the Services stated herein.
E. Project Management
You and Oracle further agree to each designate a project manager who shall work together with the Services.
Oracle Utilities Opower Professional Services Other Fees Oracle Utilities Opower CIS Upgrade Fee
Part #B87476
[United States and Canada]
A. Description of Services
Oracle will provide You with up to four hundred (400) hours of project initiation and platform setup include the following:
1. Project Initiation Services
a. Conduct a remote project kick-off meeting via web conference. b. Provide an estimated deployment timeline in a mutually agreed Microsoft file format.
Oracle Utilities Opower Professional Services Descriptions Page 13 of 22 c. Deliver to You the Oracle Utilities Opower Core Data Transfer Standards document.
2. Platform Setup Services
a. Define a data mapping approach with Your technical team, utilizing the standards defined in the Oracle Utilities Opower Core Data Transfer Standards document. b. Provide a process to discontinue data file transfer from Your existing CIS application. c. Update the Oracle Utilities Opower platform to accept data file transfers from Your new CIS application.
d. Replace the entity identifiers in the Oracle Utilities Opower platform with the new entity identifiers that You provide from Your new CIS application. e. Update t
the new entity identifier that You provide from Your new CIS application. f.
functionality to use the new account number that You provide from Your new CIS application.
g. , incremental data file(s)
provided by You to verify that Your new identifiers match the new entity identifiers in the Oracle Utilities Opower platform. During the test, Oracle will provide an analysis of Your data and generate a test Home Energy Report batch and identify any data issues for You to correct in Your iterative, incremental data file(s). This test will be carried out twice, allowing You to make necessary adjustments over a period of no more than two (2) weeks.
B. Your Cooperation and Project Assumptions
ability to perform the Services depends upon Your fulfillment of the following obligations and the following project assumptions:
1. Your Cooperation
a. Participate in the project kick-off meeting.
b. After migrating to Your new CIS application, confirm to Oracle that there will be no more changes to such CIS application before starting testing and QA. c. Discontinue data transfer from the existing CIS application and to establish additional data transfer from Your new CIS application.
d. Provide separate mapping files for all Oracle data elements for all of Your customers that have changed from the existing CIS application to the new CIS application. e. Provide new iterative, incremental data file(s) of customer billing data as specified in the Oracle Utilities Opower Core Data Transfer Standards document. f. Provide the customer billing data file(s) on an on-going weekly incremental basis. g. Correct any issues in Your iterative, incremental data file(s) as identified by Oracle during the implementation and provide updated files to Oracle.
2. Project Assumptions
a. The Services shall be performed remotely unless otherwise noted in Section A. At Your request, Oracle may agree to conduct onsite visits at Your location during the Professional Services Period defined below.
b. Any timelines or expected completion dates discussed with You are estimated dates and are intended for planning purposes only.
Oracle Utilities Opower Professional Services Descriptions Page 14 of 22 c. You will complete migration to Your new CIS application in the timeframe mutually-agreed with Oracle.
d. Prior to the start of testing and QA and finalization of new data feeds, the legacy data feeds that have been mutually-agreed and configured during implementation will not be changed during the Services Period for the underlying cloud service, except as otherwise agreed by Oracle.
e. During testing and QA, the Web Portal and customer service tools may be unavailable for a limited period of time, temporarily preventing the use of printed and email reports. Oracle will notify You of any circumstances that may result in platform unavailability and will use reasonable efforts to minimize any such down time.
C. Expenses
In addition to the fees set forth in Your order, You agree to reimburse Oracle for travel and out-ofpocket expenses related to providing any onsite Services. All expenses invoiced monthly hereunder are due and payable in accordance with the payment terms of Your order.
D. Unused Services
The Services must be used within the Services Period for the underlying cloud service, unless otherwise Professional Services Period will be automatically forfeited by You, with no further action required of either party, and You will not be entitled to a refund, or any credit toward additional or other services, for any unused portion of the fees paid for any unused Services. You may not use the fees for any services other than the Services stated herein.
E. Project Management
You and Oracle further agree to each designate a project manager who shall work together with the Oracle Utilities Opower Customer Classification File Data Integration Fee Part #B87477
[United States and Canada]
A. Description of Services
Oracle will provide You with up to sixty (60) hours of project initiation and data integration services .
of the following:
1. Project Initiation Services
a. Conduct a remote project kick-off meeting via web conference. b. Provide You with an estimated deployment timeline in a mutually agreed Microsoft file format.
c. Provide You a copy of the Oracle Utilities Opower Customer Classification Data Transfer Standards document.
2. Data Integration Services
Oracle Utilities Opower Professional Services Descriptions Page 15 of 22 a.
questions about the specification.
b. Confirm with You the customer attributes that You will provide in the CCF file. c. Confirm that Your CCF is in a format that can be loaded into the Oracle Utilities Opower platform.
d. Load Your CCF to the Oracle Utilities Opower platform. e. Configure the Oracle Utilities Opower platform to load Your regular transfer of CCF data file(s) to Oracle.
f. Coordinate two (2) one (1) hour remote telephone conference calls to validate the customer classification data within the applicable Oracle Utilities Opower application.
B. Your Cooperation and Project Assumptions
In addition to the obligations and assumptions st
ability to perform the Services depends upon Your fulfillment of the following obligations and the following project assumptions:
1. Your Cooperation
a. Participate in the project kick-off meeting.
b. Confirm Your agreement with the deployment timeline and allocate appropriate resources to perform the required assistance described herein.
c. Acknowledge that You have received the Oracle Utilities Opower Customer Classification Data Transfer Standards, that You can meet such requirements, and that You have the information technology resources and the consents required to securely send data to Oracle.
d. Provide input for the identification of relevant customer attributes or segments that will be used to assemble the CCF.
e.
that is mutually acceptable to both parties and as specified in the Oracle Utilities Opower Customer Classification Data Transfer Standards.
f. Automate the CCF file transfer to Oracle as specified in Oracle Utilities Opower Customer Classification Data Transfer Standards.
g. Participate in the confirmation and approval of the CCF to verify that it can be incorporated into the Oracle Utilities Opower platform.
2. Project Assumptions
a. The Services shall be performed remotely unless otherwise noted in Section A. At Your request, Oracle may agree to conduct onsite visits at Your location during the Professional Services Period defined below.
b. Any timelines or expected completion dates discussed with You are estimated dates and are intended for planning purposes only.
C. Expenses
In addition to the fees set forth in Your order, You agree to reimburse Oracle for travel and out-ofpocket expenses related to providing any onsite Services. All expenses invoiced monthly hereunder are due and payable in accordance with the payment terms of Your order.
D. Unused Services
Oracle Utilities Opower Professional Services Descriptions Page 16 of 22 The Services must be used within the Services Period for the underlying cloud service, unless otherwise stated in
Services Period will be automatically forfeited by You, with no further action required of either party, and You will not be entitled to a refund, or any credit toward additional or other services, for any unused portion of the fees paid for any unused Services. You may not use the fees for any services other than the Services stated herein.
E. Project Management
You and Oracle further agree to each designate a project manager who shall work together with the Oracle Utilities Opower Third-Party Randomization Fee
Part #B87479
[United States and Canada]
A. Description of Services
Oracle will provide You with up to one hundred four (104) hours of project initiation, data integration include the following:
1. Project Initiation Services
a. Conduct a remote project kick-off meeting via conference call via web conference. b. Provide You with an estimated deployment timeline in a mutually agreed Microsoft file format.
2. Data Integration and Platform Setup Services
a. Participate in calls to coordinate third-party randomization with Your project team and Your designated third-party evaluator.
b.
eligible customers targeted for the Oracle Utilities Opower program along with desired sizes for treatment and control groups.
c. Receive and review an updated CSV file from Your third-party evaluator with treatment and control group designations.
d. Load the updated CSV file with customer treatment or control group designation into the Oracle Utilities Opower platform.
e. Perform Oracle standard quality assurance checks to verify treatment and control group randomization.
B. Your Cooperation and Project Assumptions
In addition to the obligations and assumpti
ability to perform the Services depends upon Your fulfillment of the following obligations and the following project assumptions:
1. Your Cooperation
a. Participate in the project kick-off meeting.
Oracle Utilities Opower Professional Services Descriptions Page 17 of 22 b. Confirm Your agreement with the deployment timeline and allocate appropriate resources to perform the assistance described below.
c. Retain the services of a third-party evaluator to perform randomization for Your program. d. Coordinate communications between Oracle and Your designated third-party evaluator. e. Confirm that the third-party evaluator randomly assigns the account numbers in the CSV file to a treatment or control group for statistical equivalence of both groups based on annual energy consumption.
f. Confirm that the third-party evaluator returns the CSV file to Oracle, updated with a new column identifying customer treatment or control group status.
2. Project Assumptions
a. The Services shall be performed remotely unless noted otherwise in Section A. At Your request, Oracle may agree to conduct onsite visits at Your location during the Professional Services Period defined below.
b. The project implementation timeline is dependent upon the thirdcompletion of randomization work. c. Any timelines or expected completion dates discussed with You are estimated dates and are intended for planning purposes only.
C. Expenses
In addition to the fees set forth in Your order, You agree to reimburse Oracle for travel and out of pocket expenses related to providing any on-site Services. All expenses invoiced monthly hereunder are due and payable in accordance with the payment terms of Your order.
D. Unused Services
The Services must be used within the Services Period for the applicable underlying cloud service(s), Period will be automatically forfeited by You, with no further action required of either party, and You will not be entitled to a refund, or any credit toward additional or other services, for any unused portion of the fees paid for any unused Services. You may not use the fees for any services other than the Services stated herein.
E. Project Management
You and Oracle further agree to each designate a project manager who shall work together with the Oracle Utilities Opower Hourly Program Services Fixed Price - Hour Part #B90604
[United States and Canada]
A. Description of Services
At Your direction, Oracle will provide You the quantity of professional services hours identified in Your any of the
following:
Oracle Utilities Opower Professional Services Descriptions Page 18 of 22
1. Project Consulting Services
a. Assistance to You with the configuration of Your:
i. Cloud Services content
ii. Cloud Services content targeting
iii. Cloud Services customer segmentation
iv. Cloud Services web portal
v. Cloud Services platform
vi. Cloud Services rates data presentment
b. Assistance to You with minor technical updates of Your:
i. Cloud Services single sign-on integration
ii. Cloud Services
iii. Cloud Services data integration
iv. Cloud Services data extracts
v. Cloud Services rates modelling
c. Recommendations on how to use Cloud Services and the features licensed for Your projects. d. C
e. Assistance in coordinating the scoping of new projects. f. Planning and budgeting of Oracle resources for Your projects.
B. Your Cooperation and Project Assumptions
ability to perform the Professional Services depends upon Your fulfillment of the following obligations and the following project assumptions:
1. Your Cooperation
a.
Services within the Professional Services Period, which Professional Services will be scheduled at a date and time mutually agreed to by the project managers. b. Confirm Your agreement with any timelines.
c. Allocate appropriate resources to perform any necessary assistance. d. If applicable, provide access to Your content and branding lead who will work with Oracle on consumer content, presentation, branding, segmentation, and collateral approvals. e. Provide any notices, and obtain any consents, required for Oracle to perform Professional Services.
f.
to the extent necessary for Oracle to perform Professional Services. g. Participate in Oracle Utilities Opower product demonstrations. h. Ensure Your tasks are completed in the agreed on timeframe.
2. Project Assumptions
a. The Professional Services shall be performed remotely. At Your request, Oracle may agree to conduct onsite visits at Your location during the Professional Services Period defined below.
b. The Professional Services will be performed from Monday to Friday during business hours unless otherwise agreed by You and Oracle.
c. You understand and acknowledge that Oracle shall only provide the Professional Services for up to the quantity of hours identified in Your order and that Oracle is not obligated to continue providing the Professional Services beyond that quantity of hours.
Oracle Utilities Opower Professional Services Descriptions Page 19 of 22 d. Any timelines or expected completion dates discussed with You are estimated dates and are intended for planning purposes only.
C. Fees and Expenses
As the Professional Services are provided on an hourly basis, You shall pay the fees set forth in the order regardless of whether any output has been delivered or Your projects have been completed. In addition to the fees set forth in Your order, You agree to reimburse Oracle for travel and out of pocket expenses related to providing any on-site Professional Services. All expenses invoiced monthly hereunder are due and payable in accordance with the payment terms of Your order. The fees for the acceptance of this order in advance of service performance.
D. Unused Professional Services
The Professional Services must be used within the Services Period for the underlying cloud service, not used within the Professional Services Period will be automatically forfeited by You, with no further action required of either party, and You will not be entitled to a refund, or any credit toward additional or other services, for any unused portion of the fees paid for any unused Professional Services. You may not use the fees for any services other than the Professional Services stated herein.
E. Project Management
You and Oracle further agree to each designate a project manager who shall work together with the Oracle Utilities Opower Rates Integration and Modeling Fee Part Number B92660
[United States and Canada]
A. Description of Services
Oracle will provide You with up to three hundred fifteen (315) hours of project initiation, rate data integration, rate modeling, and platform setOpower products. Such Services include vision of the following:
1. Project Initiation Services:
a. Conduct a remote project kick-off meeting via web conference. b. Provide an estimated deployment timeline in a mutually agreed Microsoft file format. c. Provide You access to the Oracle Utilities Opower Rates
2. Rate Integration and Modelling:
a. Review, with You, up to five (5) low-to-moderate complexity residential energy rates. b. Analyze and model the rate plan, structure, pricing, and schedule, based on the published rate tariff documentation provided by You.
c. Assist You with completion of the templates that map the applicable parameters, resulting from the analysis above, as inputs to one or more of the following rates data file i. Rate Attributes File(s)
Oracle Utilities Opower Professional Services Descriptions Page 20 of 22 ii. Baselines File(s)
iii. Rate Price File(s)
iv. Rate Plan Configuration File(s)
v. Peak Pricing Event File(s)
vi. Peak Time Rebates File(s)
d. Analyze and validate that the sample historical data file(s) provided by You contain the same columns, follow the same formatting and naming standards and otherwise conform to the RDTS, and provide You with a list of any issues.
e. Analyze and validate that the full historical data file(s) provided by You contain the same columns, follow the same formatting and naming standards and otherwise conform to the RDTS.
f. Analyze and validate that the iterative, incremental data file(s) provided by You contain the same columns, follow the same formatting and naming standards and otherwise conform to the RDTS.
g. Load validated data files to the Oracle Utilities Opower platform. h. Update the secure file transfer protocol (SFTP) as needed to enable the regular transfer of data files between You and Oracle.
i. Deploy the modelled rates to production.
B. Your Cooperation and Project Assumptions
ability to perform the Services depends upon Your fulfillment of the following obligations and the following project assumptions:
1. Your Cooperation
a. Participate in the kick-off meeting.
b. Confirm Your agreement with the deployment timeline and allocate appropriate resources to provide the required assistance described herein.
c. Make Your information technology (IT) resources, billing department, and rate tariff/regulatory resources available to assist with the Services as stated herein and as part of the implementation timeline.
d. Provide Oracle with rate plan, structure, pricing, and schedules for the energy rates noted above within two (2) weeks of project kick-off.
e. Provide rider and appender values, in the Rate Prices File, calculated by You. f. Acknowledge that You: (i) have received the RDTS and RDFS provided to You by Your Oracle project manager in electronic format, (ii) can meet such requirements, and (iii) have the information technology resources and the consents required to securely send data to Oracle.
g. Participate in the review of the five (5) low-to-moderate complexity energy rates for up to three (3) one-day iterations.
h. Work with Oracle, for up to two (2) one-week iterations, to complete a template that maps Your data fields to data fields Oracle collects as specified in the RDFS. i. Provide production quality rate data for a random sample of 10,000-20,000 customers (both active and inactive) dating back to January of the previous calendar year for such customers within the timeline mutually agreed by the parties. j. Provide up to five (5) sample customer bills, per rate modelled by Oracle. k. Participate in analyzing and validating such sample historical data file(s).
Oracle Utilities Opower Professional Services Descriptions Page 21 of 22 l. Provide the full historical data file(s) in accordance with the RDTS and RDFS within the timeline mutually agreed by the parties.
m. Participate in analyzing and validating the full historical data file(s). n. Provide the iterative, incremental data file(s) within the timeline mutually agreed by the parties.
o. Participate in analyzing and validating the iterative, incremental data file(s). p. Address data issues with the sample historical data file(s), full historical data file(s) and iterative, incremental data file(s) within one (1) business day of Oracle notifying You of same. q. Generate automated iterative, incremental file(s) that include any new rate data recorded since the most recent record in the full historical file, including rate plan changes and corrections.
r. Coordinate with Oracle to update as needed the SFTP to enable the regular transfer of data files between You and Oracle.
s. Send iterative, incremental file(s) to Oracle on a weekly or daily basis, as mutually agreed by the parties.
2. Project Assumptions
a. The Services shall be performed remotely.
b. Any timelines or expected completion dates discussed with You are estimated dates and are intended for planning purposes only.
c. An advanced metering infrastructure energy usage data integration is already in place between You and Oracle to provide energy usage and/or energy demand interval readings of fifteen (15) minutes, thirty (30) minutes, sixty (60) minutes, or one thousand four hundred forty (1440) minutes.
d. Low complexity energy rates consist of either flat rates or tiered rates, are billed against kilowatt hour (kWh) usage, and may vary by time of year but not time of day. Low complexity rates may alternatively consist of a demand charge for a peak demand value, expressed in kilowatts (kW).
e. Moderate complexity energy rates may consist of time-of-use (TOU) rates and are defined as rate structures with price per kWh that vary at prescribed energy use thresholds based on time of day in which energy use occurs. Moderate complexity rates may alternatively consist of combinations of flat, tiered, and demand rates, or rates or TOU and demand rates. f. Consumer energy costs are estimated values only and are not intended to provide revenuegrade rate analysis or match actual consumer bills. g. TOU rate structure may include up to three (3) time periods: off-peak, on-peak, and superpeak (or similar designation). h. Seasonality within any rate structure may include up to two (2) different seasonal periods. i. Rate structure components based on energy demand are limited to fixed/flat fees or peak kW within a single billing period and calculated based on average interval demand. j. No recursive rate modelling algorithms are in scope. k. Rate riders and appenders are defined as additional data, provided by You in the rates data transfer files, that is associated with a single rate and imposes special conditions on the way the rate is calculated.
l. Up to two (2) rate riders/appenders per rate are included in the Services. m. Any additional rate riders/appenders beyond those noted above require separate and additional scoping and estimation.
n. No new rate calculators or variations of current rate calculators will be developed in the course of the Services.
Oracle Utilities Opower Professional Services Descriptions Page 22 of 22 o. Any future structural changes to rates and riders or rate riders/appenders will require separate and additional scoping and estimation.
p. Sample historical data file(s) are defined as one-time files that contain all required data fields from the RDFS but that only contain a limited number of customers over a limited timeframe.
q. Full historical data file(s) are defined as one-time files that contain all required data fields from the RDFS. They contain all rates data for Your utility customers over a typical period of one (1) to two (2) years.
r. Iterative, incremental data file(s) are defined as files that are provided by You to Oracle on a recurring basis and contain (i) required data fields exactly the same as those provided in sample historical data file(s) and full historical data file(s) and (ii) only data records that are incremental to those historical files and/or replace and/or iterate on older data records in any previously received files. These files are typically provided by You to Oracle on a daily, weekly, or monthly basis.
s. Only electricity and gas rates are in scope.
C. Expenses
In addition to the fees set forth in Your order, You agree to reimburse Oracle for travel and out of pocket expenses related to providing any on-site Services requested by You. All expenses invoiced monthly hereunder are due and payable in accordance with the payment terms of Your order.
D. Unused Services
The Services must be used within twelve (12) months, unless otherwise stated in Your order (the Services not used within the Professional Services Period will be automatically forfeited by You, with no further action required of either party, and You will not be entitled to a refund, or any credit toward additional or other services, for any unused portion of the fees paid for any unused Services. You may not use the fees for any services other than the Services stated herein.
E. Project Management
You and Oracle further agree to each designate a project manager who shall work together with the other pa
City Council
Communication
Meeting Date: 6/18/2025
Item #: VII.7
File #: 0203-07
Item ID: 2025-268
Title: Production Cost Modeling Software - Contract Purchase Agreement Contact: Long Zhang 916-774-5652 [email protected]
SUMMARY
Staff recommends approval of a five-year contract purchase agreement with cQuant.io, Inc. in the amount of $988,768 to provide production cost modeling software services. The software provides budgeting, financial forecasting, power supply portfolio management, resource planning, project evaluation, and risk management, supporting the identification, quantification, and analysis of exposure to market volatility, regulatory changes, and operational uncertainties. The initial year's cost is $190,000 and funding is included in the Electric Department's proposed FY2025-26 budget in the Electric Fund. Future funding is contingent on the City Council's approval of the respective yearly budgets.
RECOMMENDATION
Staff recommends that the City Council adopt a resolution to approve a five-year contract purchase agreement with cQuant.io, Inc. for production cost modeling software services and authorize the City Manager to execute it on behalf of the City of Roseville.
BACKGROUND
A robust and modern modeling software is essential to the success of the Electric Department operations.
It supports a wide range of critical activities, including budgeting, financial forecasting, power supply portfolio management, resource planning, and project evaluation. In addition to these operational uses, the modeling software is a key risk management tool, supporting the identification, quantification, and analysis of exposure to market volatility, regulatory changes, and operational uncertainties. Its outputs directly inform the Electric Department’s risk oversight processes and ensure compliance with the Electric Utility Risk Management policies, while supporting sound, data-driven decision-making.
The current modeling software in use, the Energy Book System (EBS), is no longer supported by its vendor. Staff issued a Request for Proposals (RFP) in 2024 to identify a new production cost modeling software that meets the City’s evolving needs. The RFP process attracted proposals from five qualified vendors. The Electric Department conducted a thorough evaluation of the submissions, scoring them based on predefined criteria, including technical capabilities, demonstration performance, pricing, experience, and industry expertise.
Based on this comprehensive review, the evaluation team determined that cQuant.io, Inc. (“cQuant”) offers the best overall value and is the most aligned with the City’s operational goals. As a result, staff recommends selecting cQuant as the new provider for production cost modeling software. With cQuant in place, staff anticipates improved efficiency, enhanced reporting and analytical capabilities, and a significant reduction in staff time spent on manual processes.
FISCAL IMPACT
The total cost of the five-year contract purchase agreement is $988,768. The initial year's cost is $190,000 and funding is included in the Electric Department's proposed FY2025-26 budget in the Electric Fund.
Future annual costs are as follows:
• Year 2: $193,800
• Year 3: $197,676
• Year 4: $201,630
• Year 5: $205,662
Future funding is contingent on the City Council's approval of the respective yearly budgets.
ENVIRONMENTAL REVIEW
The California Environmental Quality Act (CEQA) does not apply to activities that will not result in a direct or reasonably foreseeable indirect physical change in the environment, or is otherwise not considered a project as defined by CEQA Statute §21065 and CEQA State Guidelines §15060(c)(3) and §15378. The approval of the service agreement meets the above criteria and is not subject to CEQA. No additional environmental review is required.
CITY COUNCIL STRATEGIC PLAN/OVERARCHING GOALS
2. Remain fiscally responsible in a changing world
Respectfully Submitted,
Long Zhang, Electric Business Analyst
Daniel Beans, Electric Utility Director
ATTACHMENTS:
1. Resolution 25-201
2. Contract Purchase Agreement
REVIEWERS:
Long Zhang, Electric Department - Resource Planning & Generation Created/Initiated - 5/30/2025 William Forsythe, City Attorney Department Approved - 5/30/2025 Shawn Matchim, City Attorney Department Approved - 5/30/2025 Daniel Beans, City Attorney Department Approved - 5/30/2025 Gretchen Hakala, City Attorney Department Approved - 5/30/2025 Katrina Six, City Clerk Department Approved - 6/3/2025
Ryan DeVore, City Manager Department - Assistant City Manager Approved - 6/3/2025 Dennis Kauffman, City Manager Department - Assistant City Manager Approved - 6/5/2025 Michelle Sheidenberger, City Attorney Department Approved - 6/6/2025 Dominick Casey, City Manager Department - City Manager Approved - 6/6/2025 Katrina Six, City Clerk Department Final Approval - 6/6/2025
RESOLUTION NO. 25-201
APPROVING A CONTRACT PURCHASE AGREEMENT, BY AND BETWEEN THE CITY OF ROSEVILLE AND CQUANT.IO, INC., AND AUTHORIZING THE CITY MANAGER
TO EXECUTE IT ON BEHALF OF THE CITY OF ROSEVILLE
WHEREAS, a contract purchase agreement (3004607) for production cost modeling software, by and between the City of Roseville and cQuant.io, Inc., has been reviewed by the City Council; and
NOW, THEREFORE, BE IT RESOLVED by the Council of the City of Roseville that said agreement is hereby approved and the City Manager is authorized to execute it on behalf of the City of Roseville.
PASSED AND ADOPTED by the Council of the City of Roseville this ___ day of ______________, 2025, by the following vote on roll call:
AYES COUNCILMEMBERS:
NOES COUNCILMEMBERS:
ABSENT COUNCILMEMBERS:
______________________________
MAYOR
ATTEST:
________________________
City Clerk
Contract Purchase Agreement 3004607
Supplier Details:
Company cQuant.io Inc
Contact Skylar Chance
Address 357 McCaslin Blvd Ste 200
Louisville, CO 80027
Submit your response to:
Company City of Roseville
Contact Erica Kaminski
Address Purchasing Division
311 Vernon St
Roseville, CA 95678
Phone (916) 746-1108
Fax (916) 746-1115
E-mail [email protected]
This Contract Purchase Agreement is sent for your review and acceptance. Notify the Buyer via email of any needed changes to the company name, address, and contact information. The Buyer will update the agreement prior to you signing the document.
Return signed copies of the agreement to the Buyer noted on the agreement. Alterations or modifications to the agreement are not allowed. Upon receipt of all necessary documents, the City will sign the agreement and return a fully executed copy to you. Receipt of the signed copy will be your notice to proceed with the work in accordance with the terms and conditions of the agreement. Work must not begin until the contract has been fully executed.
The following guidelines must be followed for the signature block on the agreement:
Sole proprietorship - By owner
Partnership - Any general partner
Corporation - Two options:
(1) A signature from the President and the corporate seal; OR (2) One signature from the Chairman of the Board, President, or any Vice President AND one signature from the Secretary, any Assistant Secretary, Chief Financial Officer, or any Treasurer or Assistant Treasurer of the corporation
*General Manager, Office Manager and/or Sales Manager are not corporate officer titles. The agreement will be rejected if not signed in accordance with these guidelines.
Insurance requirements:
The City's insurance requirements are referenced on Attachment A of the agreement. By signing the agreement, you are confirming that your company has the minimum insurance limits required. 1 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Contract Purchase Agreement 3004607
Agreement 3004607
Agreement Date 28-MAY-2025
Revision 0
Agreement Amount 988,768.00 USD
Invoice To City of Roseville
Accounts Payable
311 Vernon St
ROSEVILLE CA 95678
Supplier cQuant.io Inc
357 McCaslin Blvd Ste 200
Louisville, CO 80027
Phone:
Fax:
Email:
(916) 774-5488
(916) 784-3796
[email protected]
Phone:
Fax:
Email:
()
()
[email protected]
Description of
Labor,
equipment
and/or materials
THE VENDOR SHALL PROVIDE THE SERVICES CALLED FOR UNDER THE CITY OF ROSEVILLE REQUEST FOR PROPOSAL (RFP) 07-110 FOR PRODUCTION
COST MODELING SOFTWARE AND CONTRACTOR'S PROPOSAL THERETO TITLED "CITY OF ROSEVILLE CALIFORNIA PRODUCTION COST MODELING SOFTWARE RFP 07-110 CQUANT.IO RESPONSE" (HEREINAFTER "PROPOSAL") DATED 1/2/25. THE TERMS AND SCOPE OF WORK OF CITY OF ROSEVILLE RFP 07-110 AND CONTRACTOR'S PROPOSAL ARE HEREIN MADE PART OF THIS AGREEMENT AND FULLY INCORPORATED BY REFERENCE. ADDITIONALLY, THE ATTACHED CQUANT.IO NEGOTIATED ORDER FORM IS FULLY INCORPORATED BY REFERENCE ONTO THIS AGREEMENT.
IN THE EVENT OF ANY INCONSISTENCIES OR CONFLICTS IN TERMS BETWEEN THE CITY'S CPA AND CQUANT.IO, INC.'S ATTACHED TERMS, THE ATTACHED CQUANT.IO, INC. TERMS SHALL CONTROL ANY INTERPRETATION.
START DATE: EXECUTED AGREEMENT
END DATE: 60 MONTHS FROM DATE OF EXECUTED AGREEMENT
PLEASE CONTACT LONG ZHANG IN THE ELECTRIC DEPT. AT
[email protected] FOR QUESTIONS REGARDING THIS AGREEMENT.
Customer # Supplier # Payment Terms Freight Terms FOB Shipping Method 16532 Net 30 Freight on Board at the destination Destination Best Method Start Date End Date Confirm To
Erica Kaminski Phone 1-916-746-1108
Attention: Total Cost not to exceed the agreement amount without prior approval of the Purchasing office. 2 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Contract Purchase Agreement 3004607
Contract Terms and Conditions
1. To the fullest extent allowed by law, Consultant shall defend, indemnify, and save and hold harmless City, its officers, agents, employees and volunteers from any claims, suits or actions of every name, kind and description brought forth, or on account of, injuries to or death of any person (including but not limited to workers and the public), or damage to property, resulting from or arising out of Consultant's willful misconduct or negligent act or omission while engaged in the performance of obligations or exercise of rights created by this Agreement, except those matters arising from City's sole negligence or willful misconduct. The parties intend that this provision shall be broadly construed. Consultant's responsibility for such defense and indemnity obligations shall survive the termination or completion of this Agreement for the full period of time allowed by law. The defense and indemnity obligations of this agreement are undertaken in addition to, and shall not in any way be limited by, the insurance obligations contained in this Agreement.
2. Consultant is an independent contractor, and shall not be considered an officer, agent, or employee of the City.
3. Except in the event of a change in control, without the written consent of the City, this Agreement is not assignable by Consultant either in whole or in part.
4. Time is of the essence of this Agreement.
5. This section has been intentionally deleted.
6. This Agreement may only be amended or modified in writing. It is integrated and contains the complete understanding of the parties.
7. All equipment, supplies and services sold to the City of Roseville shall conform to the general safety orders of the State of California.
8. Unless notified to the contrary, in writing, the City assumes that the Consultant has accepted the work in accordance with the plans and specifications (if any) and agrees to do the work in compliance with this Agreement. Any work product created for City pursuant to this Agreement is deemed owned by City.
9. All prevailing wages and fair employment practices must be adhered to. For prevailing wage contracts over $25,000, copies of certified payroll must be submitted with invoices. Prevailing wage rates may be obtained from the State Department of Industrial Relations and/or the following website address:
http://www.dir.ca.gov/dlsr/DPreWageDetermination.htm . In compliance with Labor Code Section 1773.2, as may be amended from time to time, Contractor shall cause a copy of this website to be posted at each jobsite, as applicable.
10. Consultant agrees to the below insurance requirements:
a. Unless otherwise specified, the Consultant shall maintain the policies of insurance outlined in Attachment A, incorporated herein by this reference, in full force and effect during the term of this Agreement. The City of Roseville retains sole discretion in determining the types and proper levels of insurance coverage. b. Form. Consultant shall submit a certificate evidencing such coverage for the period covered by this Agreement in a form satisfactory to Risk Management and the City Attorney, prior to undertaking any work hereunder. Any insurance written on a claims made basis is subject to the approval of Risk Management and the City Attorney. 3 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Contract Purchase Agreement 3004607
c. Additional Insureds. Consultant shall also provide a separate endorsement or section of the policy showing City, its officers, agents, employees, and volunteers as additional insureds for each type of coverage, except for Workers' Compensation and Professional Liability. Such insurance shall specifically cover the contractual liability of Consultant.
The additional insured coverage under the Consultant's policy shall be primary and noncontributory, as evidenced by a separate endorsement or section of the policy and shall not seek contribution from City's insurance or self-insurance. In addition, the additional insured coverage shall be at least as broad as the Insurance Services Office (ISO) CG 20 01 Endorsement. Any available insurance proceeds in excess of the specified minimum insurance coverage requirements and limits shall be available to the additional insureds. Furthermore, the requirements for coverage and limits shall be:
(1) the minimum coverage and limits specified in this Agreement; or (2) the full coverage and maximum limits of any insurance proceeds available to the named insureds, whichever is greater.
d. Cancellation/Modification. Consultant shall provide thirty (30) days written notice to City prior to cancellation or modification of any insurance required by this Agreement. e. Umbrella/Excess Insurance. The limits of insurance required in this Agreement may be satisfied by a combination of primary and excess insurance. Any excess insurance shall contain or be endorsed to contain a provision that such coverage shall also apply on a primary and noncontributory basis for the benefit of City (if agreed to in a written contract) before City's own insurance shall be called upon to protect it as a named insured.
f. Subconsultants. Consultant agrees to include in its contracts with all subconsultants the same requirements and provisions of this Agreement, including the indemnity and insurance requirements, to the extent they apply to the scope of the subconsultants work.
Furthermore, Consultant shall require its subconsultants to agree to be bound to Consultant and City in the same manner and to the same extent as Consultant is bound to City under this Agreement. Additionally, Consultant shall obligate its subconsultants to comply with these same provisions with respect to any tertiary subconsultant, regardless of tier. A copy of City's indemnity and insurance provisions will be furnished to the subconsultant or tertiary subconsultant upon request.
g. Self-Insured Retentions. All self-insured retentions (SIR) must be disclosed to Risk Management for approval and shall not reduce the limits of liability. Policies containing any SIR provision shall provide or be endorsed to provide that the SIR may be satisfied by either the named insured or City. City reserves the right to obtain a full certified copy of any insurance policy and endorsements. The failure to exercise this right shall not constitute a waiver of such right.
h. Waiver of Subrogation. Consultant hereby agrees to waive subrogation which any insurer of Consultant may acquire from Consultant by virtue of the payment of any loss under a Workers Compensation, Commercial General Liability or Automobile Liability policy.
All Workers Compensation, Commercial General Liability and Automobile Liability policies shall be endorsed with a waiver of subrogation in favor of City, its officers, agents, employees, and volunteers for all worked performed by Consultant, its employees, agents, and sub consultants.
i. Liability/Remedies. Insurance coverage in the minimum amounts set forth herein shall not be construed to relieve Consultant of liability in excess of such coverage, nor shall it preclude City from taking such other actions as are available to it under any other provisions of this Agreement or law.
11. Consultant shall comply with all federal, state, local laws, ordinances, and policies as may be 4 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Contract Purchase Agreement 3004607
applicable to the performance of services under this Agreement. Failure to comply with local ordinances may result in monetary fines and cancellation of this Agreement.
12. In the event that the terms of any attachment or exhibit conflict with any terms of this Agreement, the terms of the cQuant.IO Order Form and Standard Terms and Conditions document shall control.
13. This Agreement may be executed in one or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument. In the event that any signature is delivered by facsimile transmission or by e-mail delivery of a ". pdf" format data file, such signature shall create a valid and binding obligation of the party executing (or on whose behalf such signature is executed) with the same force and effect as if such facsimile or ".pdf" signature page were an original thereof.
14. If either party commences any legal action against the other party arising out of this Agreement or the performance thereof, the prevailing party in such action shall be entitled to recover its reasonable litigation expenses, including but not limited to, court costs, expert witness fees, discovery expenses, and attorneys' fees. Any action arising out of this Agreement shall be brought in Placer County, California, regardless of where else venue may lie. This Agreement shall be governed by and construed in accordance with the laws of the State of California.
15. This Agreement shall be binding upon the heirs, successors, executors, administrators and assigns of the respective parties hereto.
16. If any of the provisions contained in this Agreement are for any reason held invalid or unenforceable, such holding shall not affect the remaining provisions or the validity and enforceability of the Agreement as a whole.
17. For purposes of this Agreement, the terms "Contractor," "Consultant," and "Supplier" are used interchangeably.
18. Consultant agrees that any and all information furnished by City shall be deemed proprietary and confidential. All such information, to the extent previously, presently, or subsequently disclosed to Consultant and/or processed and derived by Consultant services is the property of City and such property shall be deemed and treated as "Confidential Information" of City.
Consultant acknowledges that such Confidential Information may contain information provided and/or generated by third-parties. Consultant agrees that such Confidential Information shall not be disclosed to any third party without written permission from City, except as required by law. Consultant shall not use the Confidential Information except to perform Consultant's services as directed by City.
19. All facilities, devices, networks, and services used to store, deliver, process, backup or purge Confidential Information will employ administrative, physical, technical, and procedural safeguards and best practices at a level sufficient to secure Confidential Information from unauthorized access, destruction, use, modification, or disclosure. Such measures will be no less protective than those used to secure Consultant's own information of a similar type, and in no event less than reasonable in view of the type and nature of the information involved. It is the City's expectation that Consultant, at its own expense, shall perform annual audits for any data centers that house Confidential Information, using an independent third-party audit that meets industry standards applicable to the services under this Agreement, and provide the audit report or certification upon request to City.
20. Consultant will retain Confidential Information until deleted by City or City-authorized third party, or for a time period mutually agreed upon by the parties to this Agreement.
21. Upon termination or expiration of this Agreement, Consultant will ensure that all Confidential Information is securely transferred to City within thirty (30) calendar days. Consultant will 5 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Contract Purchase Agreement 3004607
ensure that any transfer of Confidential Information is accomplished by methods that are compatible with the relevant City systems, and that City will have access to all Confidential Information during any such transfer. Consultant shall securely dispose of all Confidential Information when requested by City and Consultant will provide written notification to City once all Confidential Information has been securely disposed of.
22. Consultant shall report to City any data compromise or unauthorized access to Confidential Information within twenty-four (24) hours after Consultant discovers such data compromise or unauthorized access. Consultant will take commercially reasonable measures to address any such data compromise or unauthorized access in a timely manner. Except as otherwise required by law, Consultant will not provide notice to end users or other entities of any such data compromise or unauthorized access without written permission from City. Consultant will promptly reimburse City in full for all fees and costs incurred by City in any investigation, remediation or litigation resulting from any such data compromise or unauthorized access, including identity protection and restoration services for each person, who in the City's sole discretion, could be impacted by identity theft.
23. Consultant may not advertise that City is a client, list City as a reference or otherwise use City's name, logos, trademarks, or service marks without prior written permission from City.
24. Consultant acknowledges that services rendered under this agreement (including but not limited to service levels and operational levels) shall be performed in accordance with industry standards.
25. This section has been intentionally deleted.
26. This section has been intentionally deleted.
27. Contractor/consultant's duties and services under this agreement shall not include preparing or assisting the public entity with any portion of the public entity's preparation of a request for proposals, request for qualifications, or any other solicitation regarding a subsequent or additional contract with the public entity. The public entity entering this agreement shall at all times retain responsibility for public contracting, including with respect to any subsequent phase of this project. Contractor/consultant's participation in the planning, discussions, or drawing of project plans or specifications, if any, shall be limited to conceptual, preliminary, or initial plans or specifications. Contractor/consultant shall cooperate with the public entity to ensure that all bidders for a subsequent contract on any subsequent phase of this project have access to the same information, including all conceptual, preliminary, or initial plans or specifications prepared by contractor pursuant to this agreement.
28. Consultant certifies that Consultant, its employees, directors, officers, agents, subcontractors, vendors, and volunteers are not presently debarred, excluded, suspended, declared ineligible, voluntarily excluded, or proposed for debarment, exclusion, suspension, or ineligibility by any federal, state, or local department or agency.
29. The Levine Act (Govt. Code, Section 84308) requires a Party (and its agent(s), if any) to a Proceeding before the City of Roseville that involves any action or consideration related to their contract, license, permit, or other entitlement for use, to disclose any campaign contributions made to City elected or appointed officers totaling more than $250 within the twelve (12) months prior to the City decision and while a proceeding is pending, and includes certain prohibitions on contribution activity thereafter. If applicable campaign contributions have been made by Contractor and/or its agent(s), Contractor is responsible for compliance, including for its disclosure obligations, if any, as further described at: https://www.roseville. ca.us/government/departments/city_clerk/transparency/levine_act.
30. This Agreement may be amended via change order, but only if such change order is made in writing, approved by the City, and signed by both parties. 6 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Contract Purchase Agreement 3004607
31. CONSULTANT agrees to defend and indemnify CITY if, despite the parties intent and practice, any venue, agency, or court with competent jurisdiction determines that CONSULTANT and/or any of its agents, officers, employees, volunteers, independent contractors, or subcontractors, are characterized as employee(s) of CITY.
CONSULTANT and CITY agree that: (a) CONSULTANT is free from the control and direction of CITY in connection with the performance of the work; (b) CONSULTANT is providing services directly to CITY; (c) CONSULTANT has and will maintain at all relevant times a business license; (d) CONSULTANT maintains a business location that is separate from CITY; (e) CONSULTANT is customarily engaged in an independently established business of the same nature as that involved in the work performed hereunder; (f) CONSULTANT actually contracts with other businesses to provide the same or similar services and maintains a clientele without restrictions from CITY; (g) CONSULTANT advertises and holds itself out to the public as available to provide the same or similar services; (h) CONSULTANT provides its own tools, vehicles, and equipment to perform the services; (i) CONSULTANT has negotiated its own rates; (j) CONSULTANT set its own hours and location of work in accomplishing CITY's on-call needs; and (k) CONSULTANT has the right to control the manner and means of accomplishing the result desired and exercises its own expert independent judgement.
The supplier named hereon by the acceptance of this order agrees to the provisions of this document titled "Contract Purchase Agreement" and all accompanying terms, conditions, and attachments.
Roseville Business License No. ____________________________________ Contractor License No. ____________________________________________ DIR Registration No. _______________________________________________ Check mark the applicable company type below:
_____X______ Corporation
___________ Limited Liability Company
___________ Partnership
___________ Sole Proprietor
City reserves the right to withhold any payments to Consultant in the event of noncompliance with insurance requirements or if required by law.
Information Technology T&C Negotiated for cQuant.io, Inc.
REV 5/21/25 JM
7 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970 NA
NA
NA
Contract Purchase Agreement 3004607
ATTACHMENT A
HUMAN RESOURCES/RISK MANAGEMENT DIVISION
INSURANCE REQUIREMENTS
AGREEMENT OVER FORMAL BID LIMIT OR INVOLVING HIGH RISK ACTIVITIES General - Required Coverage/Documentation
● General Liability: $1 Million per occurrence /$2 Million aggregate ● Automobile Liability: $1 Million combined single limit ● Workers' Compensation: Statutory *Must provide a Waiver of subrogation ● Additional Insured Endorsement (AIE) - General Liability policy: CG 20 38 04 13 or an equivalent, blanket endorsement or section of the policy. Endorsement shall cover the City of Roseville, its officers, agents, employees and volunteers as additional insured. ● Policies must be primary and non-contributory
● A 30 day notice of cancellation must be provided
● List certificate holder as: The City of Roseville - Insurance Compliance, PO Box 100085-R1, Duluth, GA 30096
Additional Liability/Insurance Requirements if required by Agreement (and marked below):
Construction:____
General Liability:
$2 Million/occurrence
$4 Million aggregate
Design Professional:____
General Liability:
$2 Million/occurrence
$4 Million aggregate
Professional Liability:
$2 Million/occurrence
Professional Consultant:____
Professional Liability:
$1 Million/occurrence
IT Services:_X___
Professional Liability:
$1 Million/occurrence
No auto required
Cyber Liability:
$1 Million/occurrence
Hazardous Materials:____
Pollution Liability:
$1 Million/occurrence
Special Events/Caterers-Vendors:____
No auto required
No workers' comp required
Professional Counseling/ Psychological:____
Professional Liability:
$1 Million/occurrence
No auto required
8 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Contract Purchase Agreement 3004607
Pyrotechnics:____
General Liability:
$5 Million/occurrence
$10 Million aggregate
Auto - $2 Million/occurrence
Chemical/Environmental:____
General Liability:
$3 Million/occurrence
$6 Million aggregate
Pollution – $2 Million/Occurrence
Auto - $2 Million/Occurrence
Insurance Submission Process
The City of Roseville Human Resources/Risk Management Department uses a service called EBIX to manage our insurance certificate tracking.
How It Works
● The vendor's contact information is entered into EBIX. EBIX will contact the vendor to request proof of insurance.
● The Vendor can forward the request to their Insurance Agent(s) if necessary. ● Vendor/Insurance Agent submits insurance to EBIX by email to [email protected] or by fax to (770) 325-5727. After faxing or emailing the certificate, please DO NOT send the certificate by mail to EBIX. Please do not mail, email or fax any certificates to the City of Roseville. ● Once submitted, EBIX reviews the insurance documentation. If there are deficiencies, EBIX will send a follow up letter or email requesting additional information.
Questions Regarding Insurance Submission: Contact EBIX at (951) 652-4239 Questions Regarding Insurance Requirements Contact Risk Management at (916) 774-5202 9 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Contract Purchase Agreement 3004607
Supplier
Signature:______________________________________________ Print Name:_____________________________________________ Title:__________________________________________________ Date: __________________________________________________ Supplier
Signature:______________________________________________ Print Name:_____________________________________________ Title:__________________________________________________ Date: __________________________________________________ City of Roseville, A Municipal Corporation
Signature:______________________________________________ Print Name: Dominick Casey
Title: City Manager
Date:__________________________________________________ 10 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970 Chief Executive Officer
Secretary, Chief Financial Officer
5/29/2025
David Leevan
Neil Nordby
5/29/2025
!"#$%$$
&'()*+,-./,*-.+01-.+,22)*3456.+/276,8'/*+*36/9.+/,6*+:;34*:206+ &2:4*+:2,*&<::6.=:>/,6*+:[email protected]+2
ABC DBEFG H
IEJC KLM#$%$$#NGOB EG NCO!EPBQRGS!RRTBFUVBKTW!OBI FB PXYX$$ZUI[ B\C F!E\RCEKW!GER!E BR GERBWG]TRR!CEC\\ BRR!GE!E^_ C!EB`aLBUI!R"GKCWBFCW LWW RHbbQQQ`\GO`KC`\GObQ XKGEWBEWbT "GCFRb$%$$b%cbc`M`$$X]TRR!CX^_ C!EBXUVBKTW!OBX I FB ` Fd`
aLBUIF! BKWRC""C\BEK!BRCEFFB C WSBEWRWLCWC BRTefBKWWGWLBNGOB EG gRCTWLG !Wh WGWC_BKB WC!E!SSBF!CWBRWB R#!EK"TF!E\EGW!dh!E\C""KGEW CKWG RCEF\ CEWBBRGdWLB! Ge"!\CW!GERWGKGS "hQ!WLBV!RW!E\BKGEGS!KRCEKW!GER!S GRBFehWLB^`i`\GOB ESBEW!E BR GERBWG]TRR!CjRCKW!GER!E^_ C!EB#CRQB""CRCEhRCEKW!GER!S GRBFTEFB RWCWB "CQ`
aL!RKG BR GEFBEKBRB OBRCRCEGW!KBTEFB WLBUIWLCWCRCKGEW CKWG G \ CEWBB# KGS "!CEKBQ!WLWLBBKGEGS!KRCEKW!GER!S GRBF!E BR GERBWG]TRR!CgRCKW!GER!E ^_ C!EB!R BkT! BF#!EK"TF!E\Q!WL BR BKWWG#eTWEGW"!S!WBFWG#WLBdBFB C"BVBKTW!OB G FB R!FBEW!d!BF!EWLBUICEFWLBRCEKW!GER!FBEW!d!BFGEWLB^`i`AB C WSBEWGdWLB a BCRT hQBeR!WBZLWW RHbbLGSB`W BCRT h`\GOb G"!KhX!RRTBRbd!ECEK!C"XRCEKW!GERbRCEKW!GERX G\ CSRXCEFXKGTEW hX!EdG SCW!GEbT_ C!EBX TRR!CX B"CWBFXRCEKW!GER[`lC!"T BWGKGS "h SCh BRT"W!EWLBWB S!ECW!GEGdKGEW CKWRG \ CEWR#CRC "!KCe"B`
m"BCRBEGWBWLCWdG CEhC\ BBSBEWRG \ CEWROC"TBFCWnoS!""!GEG SG BhGTSTRW B G WWGWLBp!WhGd]GRBO!""BhGT KGS "!CEKBQ!WLBKGEGS!KRCEKW!GER!EK"TF!E\RWB R hGTLCOBWC_BE!E BR GERBWG]TRR!CjRCKW!GER!E^_ C!EB#!EK"TF!E\#eTWEGW"!S!WBFWG# FBR!RW!E\d GSSC_!E\EBQ!EOBRWSBEWR!E#G BE\C\!E\!Ed!ECEK!C"W CERCKW!GERQ!WL# ]TRR!CEBEW!W!BR#EGWW CERdB !E\WBKLEG"G\hWG]TRR!CG ]TRR!CEBEW!W!BR#CEFF! BKW"h GO!F!E\RT G WWGWLB\GOB ESBEWCEF BG "BGd^_ C!EB`
i!EKB B"h#
Mb$ob$%$$
iLCEEGEq!BRW
p!WhGd]GRBO!""B
mT KLCR!E\CEFqC BLGTRBJCEC\B
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Table of Contents Page 1 of 37
City of Roseville California
Production Cost Modeling
Software RFP 07-110
cQuant.io Response
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Table of Contents Page 2 of 37
Table of Contents
Table of Contents...........................................................................................................................................2 Tab A. cQuant’s Qualifications ...................................................................................................................4 Tab B. Experience and References ..............................................................................................................7 Tab C. Qualifications of Team ....................................................................................................................8 Tab D. Project Understanding...................................................................................................................10
4.1 Requirements ...............................................................................................................................10
4.1.1 Stochastics.................................................................................................................................................................................10
4.1.2 Resource Modeling....................................................................................................................................................................11
4.1.3 Simulate Dispatch Operations...................................................................................................................................................12
4.1.4 Asset Valuation..........................................................................................................................................................................12
4.1.5 Portfolio and Risk Reporting......................................................................................................................................................12
4.1.6 Outage and Maintenance Scheduling .......................................................................................................................................13
4.1.7 Pricing ........................................................................................................................................................................................13
4.1.8 Hedge Analysis...........................................................................................................................................................................13
4.1.9 Granularity.................................................................................................................................................................................13
4.1.10 Time Horizon.........................................................................................................................................................................14
4.1.11 Data.......................................................................................................................................................................................14
4.1.12 Data Accuracy and Validation...............................................................................................................................................14
4.1.13 User-friendly Interface .........................................................................................................................................................14
4.1.14 Training and Technical Support............................................................................................................................................15
4.1.15 Budgeting and Forecasting ...................................................................................................................................................15
4.1.16 Security and Compliance ......................................................................................................................................................16
4.1.17 Backup ..................................................................................................................................................................................16
4.1.18 Regulatory Risk Simulation...................................................................................................................................................16
4.2 Additional Desired Functionalities .................................................................................................16
4.2.1 Capacity Expansion....................................................................................................................................................................16
4.2.2 Weather Driven Stochastics ......................................................................................................................................................17
4.2.3 Dashboard/Reporting................................................................................................................................................................17
4.2.4 Run Times..................................................................................................................................................................................18
4.2.5 Market Participation..................................................................................................................................................................18
4.2.6 Future Proof...............................................................................................................................................................................18
4.2.7 Forecast Energy Prices...............................................................................................................................................................18
4.2.8 Congestion Revenue Rights.......................................................................................................................................................18
4.2.9 Rates..........................................................................................................................................................................................19
4.2.10 Market Knowledge ...............................................................................................................................................................19
4.2.11 Data.......................................................................................................................................................................................19
4.2.12 Report History.......................................................................................................................................................................19
4.2.13 Report Comparisons.............................................................................................................................................................20
4.2.14 Hedge Effectiveness Analytics..............................................................................................................................................20
4.2.15 Backtesting for risk mitigation decisions..............................................................................................................................20
4.2.16 Financial and operational risk consolidation........................................................................................................................20
4.2.17 Scenario Comparison............................................................................................................................................................20
4.2.18 Constraints............................................................................................................................................................................20
4.2.19 Market Sales.........................................................................................................................................................................21
4.2.20 Risk Mitigation Strategy........................................................................................................................................................21 Tab E. Project Plan...................................................................................................................................22 Tab F. Cost Proposal ................................................................................................................................24 Tab G. Required Statements/Documents ..................................................................................................25 Tab. H Exceptions.....................................................................................................................................36 Tab I. Competency of Proposers ..............................................................................................................37 Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Table of Contents Page 3 of 37
January 2, 2025
Mr. Brian Schinstock
City of Roseville, Civic Center
311 Vernon Street
Roseville, CA 95678
Dear Mr. Schinstock
cQuant.io (cQuant) is pleased to submit this response to Roseville’s Production Cost Modeling Software Request for a Proposal. The cQuant platform has been built to empower Utilities to manage complex portfolios through the processes of resource planning, power procurement, risk assessment, position management, and hedge optimization.
The cQuant platform provides powerful and transparent analytical capability through an easy-to-use cloud-based user interface. Our mission of making complex analysis easy to perform has resulted in broad-based adoption of the cQuant platform by California CCA’s and many of the largest IPP’s and Developers. The cQuant team has extensive experience supporting resource planning and portfolio management in the CAISO market. In addition to resource planning and power procurement, cQuant supports CA customers with open position management, Slice of Day reporting, hedge analysis, rate analysis, and cash reserve requirements.
At cQuant, our mission is to provide superior analytic tools on a modern platform at a great value. The energy markets are rapidly evolving toward more data complexity, shorter decision timeframes, and increased regulatory requirements. cQuant's modern analytic platform is well-suited to address these needs. At cQuant, we are 100% committed to meeting industry challenges at the pace that they are occurring. In this response, I am happy to confirm the following:
• cQuant will perform the services and adhere to the requirements described in this RFP. • cQuant has executed the Proposer’s Certification (Attachment A), which states that the proposal is valid for ninety (90) days.
cQuant understands the importance of obtaining comprehensive analytic tools for your growing portfolio and believes that we are in the best possible position to support your goals, both long and short-term. At cQuant, we strive for transparency and integrity in everything we do. cQuant is a partner that you can trust.
Thank you for your consideration!
David Leevan, CEO, cQuant.io
P: 1-720-370-9280 (desk)
E: [email protected]
357 McCaslin Blvd #200, Louisville, CO 80027
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab A. cQuant’s Qualifications Page 4 of 37
Tab A. cQuant’s Qualifications
Describe your firm and provide a statement of your firm's qualifications for performing the requested services.
cQuant.io, founded in 2016 and headquartered in Boulder, Colorado, is a leading provider of sophisticated energy analytics solutions. Our team of approximately 40 experts, including senior quantitative model developers, experienced energy analysts, software developers, and cloud infrastructure specialists, delivers cutting-edge solutions for energy portfolio planning, budgeting, rate design, and risk assessment. Our team has extensive experience in California, including the support of market modeling, Integrated Resource Planning, and power procurement within California over the last 3 decades.
Our cloud-native analytics platform empowers energy companies to manage their portfolios through:
• Advanced price forecasting and simulation
• All-inclusive power procurement and structuring analysis • Renewable energy and carbon analytics
• Resource Adequacy and Slice of Day Management
• Extensive portfolio analysis and hedge optimization
• Robust risk assessment
Key advantages of our platform include:
1. Comprehensive portfolio modeling
2. Intuitive user interface requiring minimal training
3. High-performance, transparent analytics
4. Risk-based analysisfor managing uncertainty in the full lifecycle of planning through operations
5. Cloud-native architecture offering unparalleled scalability, security, and accessibility
6. Flexible API for seamless integration with existing systems and data sources
7. Powerful in-application reporting and dashboards for actionable insights cQuant.io's commitment to innovation and customer satisfaction has positioned us as one of the fastest-growing companies in the analytics sector. Our platform is designed to address the evolving needs of the energy industry, particularly in renewable energy, emerging technologies, and evolving regulation.
By leveraging our expertise and state-of-the-art platform, cQuant.io equips clients with the tools and insights needed to navigate the complexities of modern energy markets and make informed decisions for their portfolios.
Identify the services which would be completed by your firm’s staff and those that would be provided by sub-consultants or sub-contractors, if any. cQuant.io delivers an all-inclusive suite of energy analytics services through its proprietary cloud-native platform.
As indicated within our detailed responses, cQuant meets Roseville’s full requirements. All implementation and support services are provided by cQuant without the need for sub-consultants or sub-contractors.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab A. cQuant’s Qualifications Page 5 of 37
Identify any sub-consultants or sub-contractors you propose to utilize to supplement your firm’s staff.
cQuant.io will not utilize subcontractors.
Include the firm’s organizational chart, including its constituent parts, and size variation of staffing levels in the past five (5) years.
cQuant.io's organizational structure is designed to provide comprehensive support for energy analytics projects, reflecting the company's growth and commitment to delivering cutting-edge solutions. cQuant is a rapidly growing company and has achieved >50% revenue growth in each of the last three years. Our staffing level has been growing along with our customer base. cQuant is now 40+ employees and will likely be 60+ employees by the end of 2025. The current organizational chart includes:
Leadership Team (6 members)
• David Leevan, CEO
• Neil Nordby, CFO
• Sasi Moova, CTO
• Brock Mosovsky, Head of Commercial Analytics
• Steven Broad, Head of Product and Solutions
• Dan Mooy, SVP
Departmental Structure
1. Analyst (9 members)
2. Business Development (1 member)
3. Customer Success (1 member)
4. Finance/HR (2 members)
5. Marketing (1 member)
6. Software Development (7 members)
7. Operations (7 members)
8. Sales/Account Management (10 members)
For each project, cQuant.io assembles a dedicated team comprising:
Project Manager (PM)
• Coordinates resources and manages timelines
• Monitors scope and leads non-technical communications Subject Matter Expert (SME)
• Leads technical conversations and methodological training Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab A. cQuant’s Qualifications Page 6 of 37
• Advises on best practices and identifies modeling solutions Support Analyst (SA)
• Specializes in data manipulation and validation
• Interfaces directly with the customer's analytical staff Executive Support (as needed)
• Brock Mosovsky, Head of Commercial Analytics
• Steven Broad, Head of Product and Solutions
• Matt Kocoloski, VP of Quantitative Development
• Additional executive sales and account management staff This structure allows cQuant.io to deliver tailored solutions while leveraging its growing pool of expertise across various energy analytics domains.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab B. Experience and References Page 7 of 37
Tab B. Experience and References
Provide a summary of your firm’s experience in providing these or similar services. Provide a minimum of three (3) references for projects or services similar in nature and scope that your firm’s team members have completed in the last five (5) years. Include brief descriptions of the projects, dates, client names, and contact persons’ names, addresses and telephone numbers.
Public sector references are preferred.
cQuant is comprised of 40+ seasoned energy industry experts with many decades of experience across energy markets but with a particular focus on CAISO. The experience of our experts has informed and led to the development of an outstanding software product focused on meeting the needs of load-serving entities and power market participants. Our 40+ customersinclude many of the most recognizable energy market participants.
While most customer relationships are confidential, some publicly referenceable current customers similar to the City of Roseville are:
• San Francisco Public Utilities Commission
• San Jose Clean Energy
• San Diego Community Power
• Clean Energy Alliance
• Pioneer Community Energy
• Portland General Electric
• AES Utilities
Among the customers listed above, the most common cQuant use cases are resource planning, procurement analysis, budgeting, rate analysis, reserve requirements analysis, open position tracking, and Slice of Day. cQuant has a loyal and dedicated customer base that is eager to share their experiences with the platform and with our excellent support team. cQuant kindly requests the opportunity to make introductions at the appropriate time.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab C. Qualifications of Team Page 8 of 37
Tab C. Qualifications of Team
Provide a brief summary of the role, qualifications and experience of each team member and designated project manager/lead assigned to this project, including length of service with the firm and the qualifications/experience of any sub-consultant or sub-contractor staff on your project team. A project team organizational diagram and brief resume of each team member and the designated project manager/lead for each applicable category shall be included. The geographic location of the firm and key personnel shall also be identified. Any proposed subconsultants or sub-contractors shall be listed. Include sub-consultant’s and sub-contractor’s assigned task(s) and experience. Full resumes may be included in the appendix. cQuant's team is comprised of senior quantitative model developers, experienced energy analysts, software developers, and cloud infrastructure experts. We are proud to claim a very high customer satisfaction rate, which reflects the talent and dedication of the cQuant team and product quality. cQuant is headquartered in Louisville, Colorado. Key personnel likely to participate in the Roseville project include:
Steven Broad, Ph.D., Head of Product and Solutions
Steven Broad is a seasoned technical leader with over 25 years of experience in the energy and technology sectors.
He leads the Product and Solutions team at cQuant.io, focusing on creating and demonstrating first-rate energy analytics experiences. Steven has guided the development of several well-known software products (including PLEXOS and Aurora) and delivered hundreds ofsoftware implementations for energy companies around the world (including SMUD, PG&E, CAISO, CEC, CPUC, SCE, SDG&E, LADWP, WECC, and E3), including power and gas utilities, system operators, market operators, independent power producers, project developers, energy consultants, research institutes, regulators and policy advisors. Steven holds a Ph.D. and M.S. in Mathematics from the University of Notre Dame, an M.A. in Mathematics from Washington University in St. Louis, and a B.S. in Mathematics and Physics from the University of Evansville. Steven is a (post-doctoral) Fulbright Scholar, recipient of the Lilly Foundation Grant, as well as several grants from DOE and NSF.
Dan Mooy, Senior Vice President
Dan has 25 years of energy market software experience. Dan has held senior leadership positions at Hitachi Energy (Enterprise Software), GE (Grid Solutions), and Energy Exemplar. Dan has extensive experience in supporting resource planning functions at Western utilities, including PG&E, SCE, SDG&E, LADWP, PacifiCorp, and NV Energy.
Dan holds a Bachelor of Science from Brigham Young University and an MBA from the University of California, Davis. Dan currently resides in Folsom, CA, and remains active in energy policy forums.
Brock Mosovsky, Ph.D., Head of Commercial Analytics
Brock Mosovsky has more than twelve years of experience developing, validating, and maintaining analytical models, with an emphasis on energy risk management, market analysis, and renewable energy valuation. He has worked with some of the country’s largest utilities and independent power producers to help forecast value and mitigate risk for their diverse portfolios of physical and financial assets. Brock holds a Ph.D. in Applied Mathematics from the University of Colorado, Boulder, and received a U.S. Fulbright Scholarship for study in the Netherlands.
Noah Meyer, M.S., Lead Analyst
Noah Meyer is responsible for leading the technical side of client engagements in the implementation and pilot phase. In his time at cQuant, he has worked with 25+ businesses to implement, model, and validate a wide array of energy portfolios, including extensive experience working directly in the CCA space. He is an expert on Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab C. Qualifications of Team Page 9 of 37
renewable energy and battery modeling, specifically on complicated power purchase agreements and structured transactions. Noah holds MS and BS degrees in Quantitative Economics from California Polytechnic State University, San Luis Obispo.
Luke Epp, Energy Analyst
Luke Epp serves as a subject matter expert on various projects across a broad spectrum of energy portfolios at cQuant. He has modeled some of the most complex renewable projects at the cutting edge of ever-changing market and regulatory conditions. With a background in Data Science and Statistics, Luke is an expert in precisely capturing portfolio dynamics in the cQuant platform. Luke holds a BS in Statistics from the Colorado School of Mines.
Cody Lysher, Solution Engineer
Cody has over 9 years of experience leading technical discussions on the optimization of assets in the utility sector at Consumers Energy. As a solution engineer, he is responsible for providing technical expertise and aligning the client’s needs with our platform. Cody holds a bachelor's degree in mechanical engineering from Michigan State University and an MBA in Leadership and Management from Spring Arbor University Gainey School of Business.
Laura Mares, Project Manager
In her role as a project manager at cQuant, Laura Mares is instrumental in orchestrating the strategic implementation and execution of client engagements. With experience garnered from her tenure in the SaaS industry, Laura brings a finely honed skill set to the table. Specializing in renewable energy, Laura's insights are invaluable in shaping innovative solutions for clients. Laura holds a B.A. in Psychology from the University of New Mexico.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 10 of 37
Tab D. Project Understanding
Based on the available information, supplemental research, field observations, and experience with similar projects, provide a narrative describing your understanding of the services requested in this RFP, your general approach and any major challenges to achieving the City’s stated goals. Include any issues that you believe will require special consideration for this project. Also identify any unique approaches or strengths that your firm may have related to this project. City staff will assess your understanding of all aspects of the project based on the overview.
cQuant understands that the City of Roseville is seeking Production Cost Modeling software to manage Roseville’s portfolio and support activities such as budgeting, managing utility positions, hedge analysis, outage planning, project determination and optimization, portfolio optimization, and auditing third-party results. Many Production Cost Software models were built to provide a detailed but highly deterministic view of optimized resources under a specific set of assumptions. Production cost software has also been developed with broad market modeling in mind, leading to highly complex models that become cumbersome and difficult to use. cQuant was built expressly for the purpose of portfolio management. To perform high-quality portfolio management, the following capabilities must exist:
1. All assets in the portfolio must be modeled easily and accurately.
2. Forecast uncertainty must be modeled appropriately, and its impacts should be clear in analytics.
3. Proper risk metrics should be calculated consistently and transparently.
4. Scenario analysis(in addition to uncertainty analysis) should be easy to perform.
5. Changes in portfolio position and market dynamics should be easily captured and recalculated.
6. Hedge analysis and optimization should provide insight into strategies to meet risk management objectives.
7. Results should be easily accessible and transparent.
These guiding principles led to the development of the cQuant platform. Our understanding of the Project and platform capabilities are highly aligned, and we believe that cQuant is uniquely positioned to meet the City of Roseville’s requirements as specified in the RFP. In this section, you will find a direct response to each base requirement and desired functional item. At the appropriate time, we look forward to demonstrating platform capabilities and connecting the City of Roseville with similar cQuant customers running similar use cases as references to the value of the platform and the quality of our team.
4.1 Requirements
4.1.1 Stochastics
Stochastic simulation is the central core of cQuant. Our CORE risk factor simulation generates a user-specified number of stochastic samples around expected value forecasts using historical data to determine the shaping and volatility of the risk factors. The cQuant risk factor simulation also preserves the co-variant relationships amongst those risk factors. The stochastic simulation is fully transparent, allowing Roseville Electric to inspect (and modify, if desired) the correlations between risk factors as well as the full detail of the samples generated. Typical risk factors include: forward power prices, spot power prices, fuel prices, renewable energy availability, weather, and load. Prices for attributes such as greenhouse gases, RECs, hydrogen, and hydropower energy availability are also available risk factors in cQuant simulations.
cQuant has a sophisticated but transparent and configurable approach to risk factor simulation. The shaping of Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 11 of 37
those risk factor curves is normalized around monthly-daily shapes, i.e., the aggregation of all of the daily curves for each month with separate statistical parameters for each hour of the day that varies on a monthly basis. The risk factor simulation also considers the relationship amongst the risk factors, e.g., load and price vary together.
The cQuant risk factor simulation is innovative and powerful because it • is non-parametric in that it uses the historical distributions provided for each variable in the Historical Data input to simulate seasonality and uncertainty in each variable going forward. • does not require manually tuned parameters in order to provide robust simulations that reflect the historically observed seasonality and volatility of each variable.
• always incorporates the most recently observed historical data as uploaded to the model, therefore, it does not generally require re-calibration like a traditional parametric simulation model. • is a correlated sampling model in that it uses time-coincident historical distributions to calculate correlations among variables in the simulations.
• respects the historically observed correlations when simulating forward to represent covariance risks as present in the portfolio (for example, the covariance between air temperature and price). • can run either stand-alone (so the user can see and evaluate the sampling prior to use in other analyses) or integrate the simulated risk factors directly into other downstream analyses. • leads to analysis results (such as fuel burn, forecast cash flow, etc.) expressed either as deterministic curves or as stochastic curves, i.e., curves with confidence intervals around them that represent the impacts of uncertainty.
These innovations make cQuant a platform that provides excellent stochastic modeling forecasts with easy configuration, allowing Roseville Electric to get excellent forecasts after an expeditious implementation.
4.1.2 Resource Modeling
cQuant can model all types of electric power generation technologies and electric power contractual structures. cQuant also has capabilities to model all types of power and gas energy storage resources. This includes all the items on the list provided by Roseville Electric. Indeed, these resource types and more are already being modeled in cQuant by our large and growing client base.
• Natural Gas. One of our first customers operates more than 6,000 MW of gas-fired power plants, including one that can switch between gas and coal. Many of our other customers have gas-fired plants in their portfolios. This is one of the earliest and strongest capabilities of the software. • Hydroelectric. One of our largest customers has more than 100 hydro facilities of varying sizestotaling nearly 3,000 MW, many of which are cascaded on the same watershed. Many other customers model hydropower resources of various sizes and dispositions.
• Biomass, Geothermal, Nuclear, and Distributed Generation. Numerous cQuant customers model these technologies and deploymentsin their portfolios. cQuant understands the correct attribution of renewable energy and carbon impacts for these resources.
• Utility-scale Solar PV, Wind. cQuant is widely renowned for its extensive modeling capability for stochastic modeling of these intermittent renewable resources. A portfolio that includes wind, solar, hydropower, and load requires high-quality stochastic modeling with cross-variable relationships that are honored since all of these depend in one way or another on the weather.
• Energy Storage. The Advanced Battery Storage Optimization model is specifically designed to provide a high-fidelity model of the participation of energy storage resources in energy portfolios. cQuant also offers our Advanced Gas Storage Optimization model, which allows natural gas and hydrogen storage to be included as well.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 12 of 37
• Bilateral trades, options, and transmission. cQuant models complete portfolios, including excellent fidelity on contracts, trades, options, and interconnection, including complex, bespoke PPA terms. cQuant specializes in modeling the entirety of our clients’ portfolios, including retail load as well. cQuant is prized by our customers for its ability to incorporate all technologies in a single portfolio with transparent and easily configured modeling of each element. Complex and evolving portfolios are a specialty of cQuant, and many of our customers rely on cQuant to give them confidence when they are developing and executing their vision.
4.1.3 Simulate Dispatch Operations
cQuant’s Plant Dispatch Optimization (PDO) model was specifically designed to simulate plant operations over a variety of scenarios defined both probabilistically (Monte Carlo, per above) and for scenario analysis (alternate forecasts, etc.). This includes multi-point heat rate curves, fuel switching, price-based curtailment, maintenance outages, ramp rates, start costs and run-up times conditioned on the length of downtime, and numerous other constraints to dispatch. cQuant has several similar capabilities for dispatching BESS, renewable projects, options, and other resources that have some amount of dispatchability.
4.1.4 Asset Valuation
cQuant’s simulation-based asset valuation methodology computes expected future asset value for physical and financial assets. The stochastic risk factor simulation provides a realistic spread of prices and other risk factors, which in turn leads to a stochastic valuation of assets, which leads to the likely range of mark-to-market valuations. cQuant’s asset valuation analyses paint a complete picture of asset value and risk, providing actionable insight to enable better operational decision-making and risk mitigation strategies. cQuant has several feature-rich dashboards to drive quick and unique insights into asset valuation analytics. For example, cQuant’s violin plot allows users to easily view the distribution of valuations for several projects side-byside, a feature that can be very useful when comparing possible acquisitions.
4.1.5 Portfolio and Risk Reporting
In addition to providing a valuation for each asset, cQuant also provides portfolio valuation as well as userspecified sub-portfolio valuations. This is especially helpful as it identifies the diversification benefits of assets or asset groupings in the portfolio. Roseville Electric can also compute the risk impacts associated with adding assets to the portfolio, such as increased or decreased cash flow risk, portfolio value risk, open position risk, etc. Asset valuation in cQuant extends far beyond the expected valuation of individual assets to a solution for understanding your overall portfolio.
cQuant portfolio and risk reporting are designed for combined ease of use and powerful analytics. cQuant automatically aggregates your simulation results by time period, attribute, sub-portfolio, asset type, commodity, counterparty, and several other dimensions. You can then select which aggregations to use in your portfolio analytics to show the value, timing, confidence level, and risk driver. Roseville Electric analysts can then easily identify situations that require risk mitigation and the means of mitigating those situations. cQuant’s portfolio and risk management solution allows portfolio managers to focus on when and where the downside events are most likely to occur. cQuant’s Advanced Net Position at Risk report is the center of our extensive collection of energy and risk analytics reporting. Analysts can quickly and easily display visualizations highlighting cash flow at risk, mark-to-market value at risk, and attribute (energy, capacity, REC, carbon) at risk for individual assets, user-specified sub-portfolios, and most importantly, across the portfolio as a whole.
Numerous other reports and metrics (including user-customized metrics) are available in cQuant. Currently, Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 13 of 37
cQuant has thirty-seven (37) built-in reports, and this number continues to grow due to many excellent requests from our users as well as our proactive approach to development, which allows our industry experts to review market trends and identify needs that our customers will encounter such as our new Slice of Day report. cQuant is committed to maintaining and continuing to expand the best collection of energy and risk analytics reports out of the box in the industry.
4.1.6 Outage and Maintenance Scheduling
Outages can be represented as forced or scheduled outages. Scheduled outages have the same timing across all risk factor simulations, whereas seasonal forced outages can be applied probabilistically over time. cQuant’s Advanced Net Position at Risk and Open Position Reports help to identify windows in which maintenance should be scheduled by identifying likely capacity surplus periods and periods in which the mark-to-market value of the asset is lowest (i.e., it is contributing the least economic value to the portfolio). Either or both of these approaches can inform a good planning approach to outage scheduling.
4.1.7 Pricing
cQuant’s CORE risk factor simulation uses historical data to simulate variability. This is crucially important to the price simulation because many factors simultaneously influence spot price and basis variability. cQuant’s price simulation models capture all the important drivers of seasonality and uncertainty automatically while also giving users the ability to tune detailed model parameters for the purposes of stress testing and sensitivity/scenario analysis. cQuant specifically analyzes and simulates a hub-to-node basis for nodal power pricing at any number of nodes of interest.
The simulation methodology captures the asymmetric nature of basis relationships in a robust manner, accurately accounting for changes in both expected basis and uncertainty in basis by hour of the day, day of the week, and month of the year for any user-specified price location. Correspondingly, time series dynamics and distributional properties of nodal prices themselves are also robustly maintained within the simulation. This gives Roseville Electric the ability to accurately model basis relationships and value projects down to the nodal level.
4.1.8 Hedge Analysis
As discussed in 4.1.5, the cQuant Analysts can use our built-in reporting tools to easily identify situations that require risk mitigation and the means of mitigating those situations. Analyzing hedge instruments is a key use for this capability. Within our platform, Roseville Electric can perform scenario analysis on various hedging strategies and determine the best combination of choices to reduce the risk on your portfolio or monitor the risk impact of your current hedge positions.
cQuant’s Hedge Optimization model allows you to take the additional step of optimizing the use of linear hedges to meet your portfolio goals. Hedge Optimization selects one or more hedge alternatives to optimally achieve Roseville Electric’s portfolio-level objectives, such as minimizing risk subject to policy constraints. Hedge Analysis is a primary use case for cQuant and is commonly implemented by cQuant customers.
4.1.9 Granularity
cQuant’s simulation engine typically simulates key risk factors and plant dispatch at the hourly level (down to the 5-minute level as appropriate) that drive the value and uncertainty in portfolio value. cQuant’s dashboard reports typically aggregate to monthly, annual, daily, or “month-hour” (shaping) mostly to create excellent and useful reports. The full [sub-]hourly detailed output is available for download in .csv and .parquet formats. The latter format is compact and easily loaded into additional reporting platforms such as PowerBI. cQuant users typically run dozens to hundreds of Monte Carlo paths for 5+ years of forecast horizon at this level of granularity. Most cQuant users run 10+ year analyses in this way (ifsomewhat less frequently, perhaps monthly Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 14 of 37
instead of daily or weekly) with large portfolios.
4.1.10 Time Horizon
cQuant is commonly used for a variety of study time horizons, depending on the customer’s use cases. cQuant supports many energy and risk analytics use cases, each with different typical time horizons. cQuant users apply the cQuant software to use cases ranging from daily position analysis with prompt week analysis to monthly risk reports with prompt year analysis to asset valuation and procurement for 10 to 20-year analysis (depending mostly on project type). These use cases (and many more) leverage the underlying hourly analytics to ensure that value forecasts for all portfolio and expansion resources are represented in the model as in actuality.
4.1.11 Data
Users typically supply one to three years of historical data for various risk factor simulations. Some of this data can be introduced via our integrations to data products from Yes Energy, NRGStream, and similar, especially when it comes to historical spot prices. Other data, such as portfolio load, renewable project power production, historical temperatures, etc., are generally provided by our users since they often have access to proprietary information about the projects that they own or hold a share.
Roseville Electric may supply forecasts for each risk factor or leverage cQuant integrations to obtain some forecast data. cQuant is very flexible to the type or granularity of forecast that is provided; the CORE risk factor simulation can turn daily/on-peak/off-peak power price forecasts into highly accurate hourly or sub-hourly forecasts using its advanced stochastic simulation capabilities. Likewise, monthly or annual gas price forecasts are simulated into daily spot gas price forecasts that are highly realistic. Roseville Electric benefits significantly from this flexible and powerful cQuant simulation since any continuous forecast can be utilized as the basis for robust simulation. cQuant also integratesforecast data provided by E3 (energy spot price, ancillary services prices, REC prices, carbon prices, etc.), which is likely of interest.
4.1.12 Data Accuracy and Validation
cQuant is built for energy analysts and thus includes many of the features required to monitor data accuracy and to help validate Roseville Electric’s data inputs. The entirety of the cQuant analytics workflow is transparent, allowing Roseville Electric to view, download, manipulate, and adjust the modeling assumptions. Several dashboards are built specifically for diagnostic and data validation purposes. cQuant utilizes plain CSV files to upload data, configure models, and view results. When configuring and uploading the data, the platform validates whether the files are formatted correctly. After successfully running the model, the results and accuracy of the simulation can be downloaded or viewed within a dashboard. cQuant remains transparent by allowing the user to view and download all output files from the model chain. The user can choose to either download all output files into a zip file or download each output file individually.
Within the risk factor simulation dashboard, you can view the accuracy of the fit of historical data to simulated data. Comparing the historical and simulated time series is useful for verifying that CORE is replicating the trends in the historical data. Roseville Electric can view and adjust the uncertainty, shape, and correlation for each of the simulated risk factors, enabling scenario analysis.
4.1.13 User-friendly Interface
cQuant is a user-friendly energy analytics software. Indeed, many of our customers rank this as a top differentiator for cQuant in comparison to other alternatives. Our web-based user interface, simple Excel-like data entry, wellorganized and configurable modeling workflow combined with our excellent collection of analytics dashboards are easy to learn, use, collaborate, and unlock powerful insights for Roseville Electric. Many cQuant users Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 15 of 37
comment on the fact that even if they do not use the cQuant platform for a few weeks, it is easy and intuitive to get right back into modeling.
cQuant is fully cloud-native and can be utilized through any modern web browser. Models are retained indefinitely for each modular run. cQuant offers collaboration spaces that allow users from various business units to store and run models in their own respective spaces.
cQuant offers extensive documentation on configuring input files and expected results from specific models. You can preview or create the configuration in a CSV file and upload it through drag-and-drop configuration. Uploading historical data and forecasts is done with drag and drop configuration as well. You can use the Smart Uploader feature that will automatically sort through your data to assign to the respective input options, or you can drop the relevant files into their respective containers. Lastly, you can add the file from the data library, which allows the user to add any relevant file type that they have used in their workspaces.
The results page allows Roseville Electric to view and download all output files from the model chain. You can choose to either download all output files into a zip file or download each output file individually. You can download all results in tabular format but can also view the results visually in the reporting dashboards.
Many out-of-the-box analytics dashboards allow Roseville Electric to easily slice and visually display information about your modeling results. Each of these visuals can be easily exported as an image file for use in written reports, and each is supported by data grids, which can be exported to Excel format if desired. cQuant has an ongoing commitment to making our already excellent user experience even better in 2025 and beyond. Roseville Electric can expect cQuant’s spirit of innovative leadership to include modeling, analytics, visualization, and ease of use.
4.1.14 Training and Technical Support
cQuant subscribers receive unlimited support for software questions during regular business hours in North America. Our software support team members are distributed throughout the United States and are concentrated in the Denver metro area. Our support team is all energy analysts with detailed working knowledge of the cQuant platform and typical energy trading, portfolio analysis, and energy risk analysis use cases. Support is primarily provided by email to [email protected]. Support cases are typically answered within 2 hours and resolved within one day.
cQuant will work with Roseville Electric users during the implementation stage to ensure all are properly trained before handoff. Our extensive and expert team of analysts will work with Roseville Electric’s team to implement your current portfolio in cQuant. More importantly, they will also work with your team to ensure that Roseville Electric can be largely self-supporting for future work in cQuant, whether you are introducing a new use case or adding items to your portfolio. After successfully training you on using the platform, we will let your team set up a portion of your portfolio with our analyst team guiding you through it. Before handing over the keys to the platform, we ensure your team is adequately trained on how to configure, analyze, and use cQuant for your business use cases.
If, at any point, Roseville Electric feels the need for services beyond the normal question-and-answer variety that are typically associated with software support, cQuant also provides professional services at a fee to help you deal with tight deadlines or particularly complex use cases. We offer this service mostly to put our customers at ease; it is not typically required except when our customers are facing time pressure or an unexpectedly large workload apart from cQuant.
4.1.15 Budgeting and Forecasting
As discussed in 4.1.5, the simulated performance of individual assets and contracts are aggregated across Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970
Tab D. Project Understanding Page 16 of 37
geographies and user-defined sub-portfolios to compute portfolio-level metrics within our Advanced Net Position at Risk dashboard. When paired with a forecast, Roseville Electric will receive an accurate valuation of each asset in your portfolio. You can switch the granularity, attributes, and, more specifically, the variable to view the expected net cash flow, revenue, and cost associated with assets and contracts. cQuant’s portfolio-level metric of Cash Flow at Risk (CFaR) provides the insight necessary to make accurate cost estimates for both short-term and long-term financial planning.
Additionally, since cQuant is generally set up to run stochastically, cQuant will provide more than just an accurate estimate if your expected future materializes: it will offer insight as to how uncertainty in markets and weather, etc., affect the precision of that forecast.
4.1.16 Security and Compliance
cQuant is a SOC2 Type 2 certified software-as-a-service (SaaS) platform. This certification represents very high standards of cybersecurity and requires annual audits and vulnerability testing to maintain. Our suppliers are chosen for their excellent posture and performance on security. All data is encrypted both at rest and in transit.
Authentication supports SAML 2.0 for Single Sign On (SSO) implementation. We are confident our security standards will meet the needs of all cQuant customers, including the City of Roseville.
4.1.17 Backup
cQuant is a SaaS application. All customer data that enters the cQuant platform is continually stored with redundancy in the platform. Users have tools in the cQuant platform to differentiate between data that must be retained and data that can be recycled, including retention of input data, output data, reports, etc.
4.1.18 Regulatory Risk Simulation
cQuant is well-prepared to simulate the impacts of alternate future regulatory regimes (via scenario analysis).
Many factors, such as carbon pricing, renewable portfolio mandates, slice-of-day resource adequacy, etc., are directly modeled in cQuant, so changes in these policies are easy to simulate with variations to the future parameters.
cQuant continually reviews the evolving regulatory landscape to identify new policies that require detailed modeling in our platform. We release added functionality to address these as they arise.
4.2 Additional Desired Functionalities
4.2.1 Capacity Expansion
cQuant’s Portfolio Optimization (PORT) model can help plan for future resource additions. This model allows Roseville Electric to specify which resources are potential future resources that could be built to cover various positions, especially volumetric shortfalls in the future. Usually, PORT is driven by valuation analysis from the rest of the cQuant analytics workflow, and then PORT optimizes the application of potential future resources to the portfolio. However, if Roseville Electric has an external sense of the future value of potential resource additions, this knowledge can also be used directly.
cQuant has also been used on many occasions for RFO analysis in which a utility or energy provider solicits proposals for procuring additional resources (e.g., PPAs, etc.). This is a primary use case for many California energy providers. cQuant can provide (and has provided) professional services to assist in these activities, but this is not generally required and is usually limited to the first iteration of using cQuant for this use case. Our goal is to make Roseville Electric (and all of our other clients) self-sufficient on the cQuant platform and to help when, how, and as needed for our customers to be successful.
Docusign Envelope ID: 4DDB1D72-BE7C-4744-B997-D6E91D307970