City of San Mateo
City Council Meeting
POST PACKET
PUBLIC COMMENT
1 Alby Calles
From: Brian C
Sent: Tuesday, September 22, 2026 12:22 AM
To: Clerk
Subject: Item 13, September 22 Consent Calendar — Reveal Data Corporation agreement Members of the Council,
This week’s agenda, Item 13 approves $238,770, plus a $23,900 conƟngency, for a three-year Public Records Act review plaƞorm. It is on the consent calendar, so it will not be discussed unless a member pulls it.
A public records system is an important part of the City operaƟng transparently and collaboraƟvely with its community, so I read the item closely. Below are ten inconsistencies and concerns I found in the proposed contract, each drawn from its own aƩachments at packet pages
170 through 199, with the quesƟon I would put to staff about each.
1. The storage cost is open-ended and the item gives no baseline. The subscripƟon covers 750 GB for $75,000 a year, or $100 per gigabyte.
Storage above that bills at "$33 per GB per month," or $396 per gigabyte a year, nearly four Ɵmes the bundled rate. As the records volume grows, the data costs will grow over Ɵme. At roughly 190 GB over the cap the overage alone equals the annual subscripƟon, and the $23,900 conƟngency is exhausted at about 60 GB. The order form offers "discounted bulk data packages" as an alternaƟve, but the item does not price them. QuesƟon: what data volume is projected over the full three-year term, and what do the bulk packages cost? Does data age out of the plaƞorm so that the stored volume levels off, or does each year add to the last?
2. The proposal cites body-worn camera footage as a driver, but the Statement of Work describes only handling of documents. It is unclear whether the 750 GB was sized for video or for text. If the proposed budget is sized against documents, it would be consumed very quickly by video. QuesƟon: was the 750 GB sized for a document workload, or for one that includes body-worn camera footage and other larger media files?
3. The City would need the vendor's permission to tell residents that the vendor caused a breach. Exhibit C, secƟon 4(c) provides that "neither Party may idenƟfy or aƩribute fault to the other in any noƟce without the other Party's prior wriƩen consent unless required by law." California Civil Code secƟon 1798.29 requires an agency's breach noƟce to include a general descripƟon of the incident, but does not require naming a third-party vendor as the cause. QuesƟon: in a breach noƟce to residents, may the City state that the breach occurred at its vendor?
4. Private equity owns this vendor and assembles its product line by acquisiƟon. Reveal's majority shareholder is K1 Investment Management, which funded Reveal's purchase of Logikcull and IPRO in August 2023 for more than $1 billion.
Reveal's own company Ɵmeline lists nine acquisiƟons, its website lists eight products, and the IPRO brand is no longer among them. QuesƟon: did staff evaluate the risk that Logikcull is folded into Reveal's main plaƞorm, as IPRO appears to have been?
5. The agreement says nothing about the product changing or going away.
SecƟon 8 allows terminaƟon only for uncured breach or insolvency, so there is no exit for convenience, and SecƟon 15 lets the vendor assign the agreement without the City's consent on a change of control.
QuesƟon: if the product is disconƟnued or materially changed during the three-year term, what is the City's remedy?
6. The agreement grants worldwide rights to City data, while an exhibit requires the data to stay in the United States.
SecƟon 5.6 grants a "nonexclusive, worldwide, royalty-free" license, sublicensable to an unnamed hosƟng subcontractor, 2 including to generate commercial "Benchmarking StaƟsƟcs." Exhibit C, secƟon 7(b) requires "No access or transfer of data to/from outside of the United States." The order of precedence clause ranks the Agreement first and does not rank Exhibit C at all. QuesƟon: does SecƟon 5.6 take precedence, and may City data be processed outside the United States?
7. The agreement and that same exhibit also disagree about destroying City data at the end. Exhibit C, secƟon 8 requires the vendor, on terminaƟon or on request, to "promptly return all City data or securely destroy it and shall cerƟfy destrucƟon in wriƟng." SecƟon 26.2 instead gives the City a thirty-day export window and says the vendor "may delete Customer Data in accordance with its standard retenƟon pracƟces." Again the Agreement is ranked and the exhibit is not.
QuesƟon: is the vendor required to destroy City data and cerƟfy it, or may it keep the data under its own retenƟon policy?
8. The contract is missing the privacy protecƟons its own security exhibit requires. Exhibit C, secƟon 6 requires the vendor to comply with California privacy law "by contractually agreeing to restrict data usage to specified business purposes, forbidding the sale/sharing of personal informaƟon, and enabling consumer rights, such as deleƟon or opƟng out." No such clause appears in the agreement. The only restricƟon to "business purposes" is SecƟon 5.3, which limits the City's use of the service rather than the vendor's use of City data.
QuesƟon: where does the vendor contractually agree to the restricƟons Exhibit C requires?
9. The agreement and the order form are with two different companies.
The agreement defines "VENDOR" as Reveal Data CorporaƟon, a Delaware corporaƟon, and SecƟon 7 obligates the City to pay VENDOR $75,000 annually. The order form, which carries the commercial terms including the storage rate, is "entered into by and between Logik Systems, Inc.
and Customer." Logik Systems is the corporate enƟty behind the Logikcull brand, but the item does not state whether Reveal owns it or whether both are held in common, and no provision makes either answerable for the other. The Statement of Work says the service is provided by "Logikcull Discovery SoluƟon, an affiliate of Reveal Data CorporaƟon." No document in the item names the enƟty that will invoice the City or receive payment. QuesƟon: which enƟty is legally bound, which receives the payments, and which provides the service?
10. When the documents disagree, the contract does not say which one wins. SecƟon 28 states that all four exhibits are "incorporated by reference herein as part of this Agreement," then ranks the Statement of Work and the Insurance Requirements, which are Exhibits A and D, below the Agreement they are said to be part of. It does not rank Exhibit B, the fee schedule, or Exhibit C, the data security requirements, at all, and it does not menƟon the order form. The one other document it ranks, the City's RFQ, is not aƩached to the item. QuesƟon: which document controls the storage rate and the data security requirements?
The order form must be signed on or before September 30, 2026 to be valid, and the next regular meeƟng falls aŌer that date. Pulling Item
13 for discussion would not cost the City that deadline.
Respecƞully,
Brian Cervenka
San Mateo, CA