Agenda packet — Santa Ana City Council, February 7, 2023 (part 5 of 7)

3 2
2 9
integrated. iNovah services directly support and are bilaterally integrated with the MUS enQuesta upgrade. Also, the City’s existing iNovah software system is currently integrated with multiple City agencies and their customer information software systems.

Inclusively, the iNovah revenue management and cashiering software system is also scheduled to be integrated into the City’s new Land Management System, the Zoo’s new reservation and ticketing system, the parks and recreation reservation system, the new business license software/platform system, and the new Rental Registry Fee software system. The cost to implement an equivalent City-wide cashiering software service provider is unknown, but would require new software and substantial additional integration expenses to the City as iNovah is fully integrated into all Treasury programs that require revenue processing services. Staff expects a competitive process leading to a new software system would have cost much more due to the conversion of so many integrated systems. System Innovators provides excellent support and maintenance services.

Therefore, staff recommends the approval of a both a master renewal agreement and corresponding support and maintenance agreement with System Innovators, to ensure annual software support for the City’s cashiering system and hardware maintenance for cash drawers, receipt printers, and other associated equipment; System Innovators’ software support and maintenance services includes the right to receive the most recent iNovah version software releases and technical support services. Along with the approval of the renewal agreement, a City-wide upgrade to iNovah software and payment hardware to EMV Chip & PIN contactless payment terminals and PCI DSS compliance will be implemented. By doing so, Treasury will harmonize this agreement with other critical payment processing agreements, as well as enQuesta/AMI integrated agreements.

Included among the other critical payment processing agreements are the City’s walk-in cashiering station merchant processing services, online cloud-based electronic billing and payment presentation/bill print services, 24-7/365 walk-up payment kiosk services, and over-the-phone interactive voice response and payment services. Based on the synchronization of all of these payment processing services, the City will achieve full PCI-DSS compliance, thereby transferring future credit card fraud liability from the City to the payment card providers.

ENVIRONMENTAL IMPACT
There is no environmental impact associated with this action.

FISCAL IMPACT
The current fiscal year funding is available in the FY 22-23 budget and future fiscal year funding will be included in the proposed budgets for City Council consideration. Any remaining balances not expended at the end of the fiscal year will be presented to City

City Council
23 –
3 2/7/2023

Renewal Agreement with System Innovators
February 7, 2023

Page 4 ends

3 2
2 9
Council for approval of carryovers to FY 23-24. Funds for future years expenditure will be in the proposed budgets for City Council consideration as follows:

FY
Accounting
Unit -
Account
No.

Fund
Description
Accounting
Unit -
Accounting
No.

Description
Contracted
Amount
Additional
Contingency
Maximum
Compensation
Amount
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$10,000 $1,500 $11,500
Various-
62300 Various Various $68,880 $10,332 $79,212
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$8,850 $1,328 $10,178
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$55,219 $8,283 $63,502
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$25,272.68
-
$25,272.68
(Prepaid) =
$0
$0 $0
10920149-
66510
Information
Technology IT Projects $0 $80,200 $80,200
01113220-
62300 General Fund PRCSA - Zoo $0 $80,200 $80,200
01113200-
62300 General Fund PRCSA -
Administration $0 $80,200 $80,200
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$0 $80,200 $80,200
FY
2022-
23 41718820-
62300
Community
Development
Inclusionary
Housing Fee $0 $61,028 $61,028
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$58,962 $8,844 $67,806 FY
2023-
24 01110130-
62300 General Fund FMSA -
Treasury & $17,700 $2,656 $20,356

City Council
23 –
4 2/7/2023

Renewal Agreement with System Innovators
February 7, 2023

Page 5 ends

3 2
2 9
Customer
Service
10920149-
66510
Information
Technology IT Projects $0 $5,000 $5,000
01113220-
62300 General Fund PRCSA - Zoo $0 $5,000 $5,000
01113200-
62300 General Fund PRCSA -
Administration $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$0 $5,000 $5,000
41718820-
62300
Community
Development
Inclusionary
Housing Fee $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$62,961 $9,444 $72,405
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$17,700 $2,656 $20,356
10920149-
66510
Information
Technology IT Projects $0 $5,000 $5,000
01113220-
62300 General Fund PRCSA - Zoo $0 $5,000 $5,000
01113200-
62300 General Fund PRCSA -
Administration $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$0 $5,000 $5,000
FY
2024-
25 41718820-
62300
Community
Development
Inclusionary
Housing Fee $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$67,234 $10,085 $77,319
FY
2025-
26 01110130-
62300 General Fund
FMSA -
Treasury & $17,700 $2,656 $20,356

City Council
23 –
5 2/7/2023

Renewal Agreement with System Innovators
February 7, 2023

Page 6 ends

3 2
2 9
Customer
Service
10920149-
66510
Information
Technology IT Projects $0 $5,000 $5,000
01113220-
62300 General Fund PRCSA - Zoo $0 $5,000 $5,000
01113200-
62300 General Fund PRCSA -
Administration $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$0 $5,000 $5,000
41718820-
62300
Community
Development
Inclusionary
Housing Fee $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$71,799 $10,770 $82,569
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service l
$17,700 $2,656 $20,356
10920149-
66510
Information
Technology IT Projects $0 $5,000 $5,000
01113220-
62300 General Fund PRCSA - Zoo $0 $5,000 $5,000
01113200-
62300 General Fund PRCSA -
Administration $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service l
$0 $5,000 $5,000
FY
2026-
27 41718820-
62300
Community
Development
Inclusionary
Housing Fee $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$76,677 $11,501 $88,178
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service l
$17,700 $2,656 $20,356
FY
2027-
28 10920149-
66510
Information
Technology IT Projects $0 $5,000 $5,000

City Council
23 –
6 2/7/2023

Renewal Agreement with System Innovators
February 7, 2023

Page 7 ends

3 2
2 9
01113220-
62300 General Fund PRCSA - Zoo $0 $5,000 $5,000
01113200-
62300 General Fund PRCSA -
Administration $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$0 $5,000 $5,000
41718820-
62300
Community
Development
Inclusionary
Housing Fee $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service l
$81,176 $12,176 $93,352
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service l
$17,700 $2,656 $20,356
10920149-
66510
Information
Technology IT Projects $0 $5,000 $5,000
01113220-
62300 General Fund PRCSA - Zoo $0 $5,000 $5,000
01113200-
62300 General Fund PRCSA -
Administration $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$0 $5,000 $5,000
FY
2028-
29 41718820-
62300
Community
Development
Inclusionary
Housing Fee $0 $5,000 $5,000
01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$41,578 $6,237 $47,815
FY
2029-
30 01110130-
62300 General Fund
FMSA -
Treasury &
Customer
Service
$8,850 $1,328 $10,178
Subtotal Subtotal Grand Total
$718,385 $639,593 $1,357,978

EXHIBIT(S)

City Council
23 –
7 2/7/2023

Renewal Agreement with System Innovators
February 7, 2023

Page 8 ends

3 2
2 9

1. N. Harris Computer Corporation, System Innovators, Cashiering Software & Hardware Upgrades Agreement

2. N. Harris Computer Corporation, System Innovators, Support & Maintenance Agreement
Submitted By: Kathryn Downs, FMSA Executive Director
Approved By: Kristine Ridge, City Manager

City Council
23 –
8 2/7/2023

1 MASTER RENEWAL AGREEMENT FOR PROFESSIONAL SERVICES
THIS AGREEMENT (hereinafter “Master Renewal Agreement”) is made and entered into this 7th day of February, 2023, by and between System Innovators, Inc., a division of N. Harris Computer Corporation (System Innovators), a Florida corporation (“CONSULTANT”), and the City of Santa Ana, a charter city and municipal corporation organized and existing under the Constitution and laws of the State of California (“CITY”). CITY and CONSULTANT shall hereinafter collectively be referred to as “the PARTIES”.

RECITALS
A. The PARTIES entered into that certain Agreement A-2014-073, dated March 18, 2014, (hereinafter “Original Agreement”) by which CONSULTANT has licensed to CITY, cashiering and revenue tracking application software, along with support and maintenance of such software.

B. The PARTIES successively entered into: (1) a First Amendment to that Agreement (A-2014-358) on December 16, 2014 to procure a dditional hardware and professional software services and related maintenance and support in connection with implementation o f an Image Cash Letter Solution (ICL); (2) a Second Amendment to that Agreement (A -2016-099) on May 3, 2016, to amend said Agreement to extend the Term for an additional three year, with options to further extend by 2 additional years and to increase the CITY’s iNovah – SWS – Enterprise software cash
iering license to up to 300,000 annual receipts with corresponding Check 21 – ICL software and hardware support; and (3) a Third Amendment to that Agreement (A -2019-135) on August 20, 2019, to bifurcate the final 2 year extension option into two 1 year options and t o increase c
ompensation and add a 10% contingency.

C. The PARTIES now wish to enter into a Master Renewal Agreement for purposes of expanding CONSULTANT's Scope of Services to include in addition to providing a centralized revenue management services , through a revenue management software system and equipment for purposes of cashiering, point of sales (POS) payment processing, image cash letter (“ICL”) processing, the provision of associated merchant processing (including integration with third- party application providers), together with software and hardware support and maintenance services and receipting services for Europay, MasterCard, Visa, Amex (“EMV”) credit card payment terminals, along with Payment Card Industry Data Security Standard (“PCI DSS”) compliance, plus required cashier drawers, receipt printers, and other associated equipment and software to support such capabilities .

D. Subject to Section 18 of this agreement, the PARTIES now also wish to add options individually exercisable by CITY f or CONSULTANT to expand their services to provide CITY with integrations into CONSULTANT’s software platform to allow third party integrations linking CONSULTANT’s software platform to: (1) the CITY’s Clariti Land Management System (real- time integration); (2) the CITY’s CivicPlus CivicRec Parks and Recreation Reservation System (real-time integration); (3) the CITY’s Centaman Zoo Ticketing System (file export integration); (
4) t
he CITY’s 3Di Systems Rental Registry Fee Program System (custom file export); (5) iNovah C
ustom Import Scheduler; and ( 6) to allow CITY to obtain a peripheral bundle for additional CITY cashier workstations, thus allowing City fullest access to agreed-to services and support.

EXHIBIT 1

City Council
23 –
9 2/7/2023

2 E. In undertaking the performance of this Master Renewal Agreement, CONSULTANT represents that it is knowledgeable in its field and that any services performed by CONSULTANT under this Master Renewal Agreement will be performed in compliance with such standards as may reasonably be expected from a professional consulting firm in the field.

NOW THEREFORE, in consideration of the mutual respective promises, and subject to the terms and conditions hereinafter set forth, the PARTIES agree as follows:

1. SCOPE OF SERVICES
CONSULTANT shall during the Term of this Master Renewal Agreement, including any extensions thereto exercised by CITY, perform the tasks and obligations attached hereto designated in CONSULTANT's “Santa Ana EMV – Additional Request for Service – EMV PayConex Implementation”, and CONSULTANT's “Santa Ana Budgetary Quote (Optional Clariti -CivicPlus- Centaman-3 Di Systems + Peripheral Bundle for Additional Cashier Workstations)”which are both hereby fully incorporated h erein by reference as EXHIBIT A as follows:

EXHIBIT A

1. “Santa Ana EMV – Additional Request for Service – EMV PayConex Implementation”
a. iNovah – EMV PayConex Solution Overview
b. PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service P
roviders, Rev. 1.0

2. “
Santa Ana Budgetary Quote (Optional Clariti-CivicPlus-Centaman-3Di Systems + P
eripheral Bundle for Additional Cashier Workstations)”
CONSULTANT's “Santa Ana EMV – Additional Request for Service – EMV PayConex Implementation” together with CONSULTANT's “Support and Maintenance Agreement” shall be subject to the terms and conditions of this Master Renewal Agreement. In the event of conflict between this Master Renewal Agreement and CONSULTANT's Statement of Work /Proposal(s) or any attachment thereto and CONSULTANT's Support and Maintenance Agreement, the terms of this Master Renewal Agreement or any duly executed Change Order entered into under this Agreement shall prevail.

2. CO

MPENSATION
C
ITY agrees to pay, and CONSULTANT agrees to accept as total payment for its services as described in EXHIBIT A, the fees as set -out respectively by reference in subsection (a) and (b) below, in an aggregate base amount of $202,780, with a further aggregate contingency amount of $562,252, for a total combined not to exceed amount of $765,032 as set-out in EXHIBIT B (Maximum Fiscal Year Compensation Table) which is hereby fully incorporated herein by reference. (a) Scope of Work (including)
i. Exhibit A
(b) Fees. In consideration of providing the Services, CITY agrees to pay the fees, including Custom Support or Development fees set out in any applicable Statement of Work/Proposal

City Council
23 –
10 2/7/2023

3 incorporated herein by reference and any Change Order duly adopted and agreed to by t he PARTIES (the "Fees") to CONSULTANT. Fees are subject to increase based on CONSULTANT’s then-prevailing policies, terms and fees related to pricing and hourly rates.

(c) Invoices. During the term of this Master Renewal Agreement, CONSULTANT shall deliver invoices to CITY. Unless otherwise stated in the applicable Statement of Work/Proposal or duly executed Change Order, each invoice delivered to CITY by CONSULTANT shall be due and payable upon forty -five (45) days receipt thereof by CITY.

(d) Taxes. The Fees are exclusive of taxes. CITY agrees to pay all applicable sales and use taxes, if any (excluding taxes on CONSULTANT's net income) ("Taxes") unless it provides CONSULTANT with a tax exemption certificate acceptable to the applicable taxing authorities.

3. TERM.

The base term of this Agreement shall commence on the date first written above and shall expire on December 31, 2025, with provision for two extension options of three years, and one year; respectively, ending December 31, 2029, unless amended by the PARTIES for a longer term or terminated earlier in accordance with Section 12, below. This Agreement shall cover all services provided by Consultant since January 1, 2022. The initial term and the extension options thereto shall collectively be referred to as the “Term”.

4. INDEPENDENT CONTRACTOR

CONSULTANT shall, during the entire term of this Master Renewal Agreement, be construed to be an independent contractor and not an employee of CITY. This Master Renewal Agreement is not intended nor shall it be construed to create an employer-employee relationship, a joint venture relationship, or to allow CITY to exercise discretion or control over the professional manner in which CONSULTANT performs the services which are the subject matter of this Master Renewal Agreement; however, the services to be provided by CONSULTANT shall be provided in a manner consistent with all applicable standards and regulations governing such services. CONSULTANT shall pay all salaries and wages, employer's social security taxes, unemployment insurance and similar taxes relating to employees and shall be responsible for all applicable withholding taxes.

5. INSURANCE

Prior to undertaking performance of work under this Agreement, Consultant shall produce and maintain for the duration of the Agreement claims for security breaches, system failures, injuries to persons, damages to software, or damages to property (including computer equipment) which may arise from or in connection with the performance of the work hereunder by the Consultant and shall require its subcontractors, agents, representatives, or employees, if any, to obtain and maintain insurance as described below. Consultant shall procure and maintain for the duration of the contract insurance claims arising out of their services and including, but not limited to loss, damage, theft or other misuse of data, infringement of intellectual property, invasion of privacy and breach of data.

a. Minimum Scope and Limit of Insurance

1. Commercial General Liability (CGL): Insurance Services Office Form CG 00 01 covering CGL on an “occurrence” basis, including products and completed

City Council
23 –
11 2/7/2023

4 operations, property damage, bodily injury and personal & advertising injury with limits no less than $2,000,000 per occurrence, $4,000,000 aggregate.

2. Automobile Liability: Insurance Services Office Form Number CA 0001 covering, Code 1 (any auto), or if Consultant has no owned autos, Code 8 (hired) and 9 (non- owned), with limit no less than $2,000,000 per accident for bodily injury and property damage.

3. Workers’ Compensation insurance as required by the State of California, with Statutory Limits, and Employer’s Liability Insurance with limit of no less than $1,000,000 per accident for bodily injury or disease.

4. Cyber Liability Insurance, with limits not less than $2,000,000 per occurrence or claim, $2,000,000 aggregate. Coverage shall be sufficiently broad to respond to the duties and obligations as is undertaken by Consultant in this agreement and shall include, but not be limited to, claims involving security breach, system failure, data recovery, business interruption, cyber extortion, social engineering, infringement of intellectual property, including but not limited to infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, and alteration of electronic information. The policy shall provide coverage for breach response costs, regulatory fines and penalties as well as credit monitoring expenses.

5. Technology Professional Liability Errors and Omissions Insurance appropriate to the Consultant’s profession and work hereunder, with limits not less than $2,000,000 per occurrence, $2,000,000 aggregate. Coverage shall be s ufficiently broad to respond to the duties and obligations as is undertaken by the Consultant in this agreement and shall include, but not be limited to, claims involving security breach, system failure, data recovery, business interruption, cyber extortion, social engineering, infringement of intellectual property, including but not limited to infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, and alteration of electronic information. The policy shall provide coverage for breach response costs, regulatory fines and penalties as well as credit monitoring expenses.

i. The Policy shall include, or be endorsed to include, property damage liability coverage for damage to, alteration of, loss of, or destruction of electronic data and/or information “property” of the Agency in the care, custody, or control of the Consultant. If not covered under the Consultant’s liability policy, such “property” coverage of the Agency may be endorsed onto the Consultant’s Cyber Liability Policy.

6. Crime Liability Insurance with a limit of not less than $1,000,000 per claim with $2,000,000 in the aggregate. The following requirements apply to the insurance to be provided by Consultant pursuant to this section:

i. Consultant shall maintain all insurance required above in full force and effect for the entire period covered by this Agreement.

City Council
23 –
12 2/7/2023

5 ii. Certificates of insurance shall be furnished to the City upon execution of this Agreement and shall be approved by the City.

iii. City of Santa Ana, its officers, employees, agents and representatives shall be Additional Insureds with respect to General Liability Insurance and Auto Liability Insurance is Primary and Non-Contributory.

iv. Certificates and policies shall state that the policies shall not be canceled without thirty (30) days prior written notice to the City of cancellation with ten (10) days prior notice for non- payment of premium in accordance with policy provisions. Similar notice of reduction or material change shall be given if coverage falls below or is not in compliance with the contract requirements.

v. Consultant shall supply City with a fully executed additional insured endorsement.

vi. Certificates of insurance endorsements shall show the City as a certificate holder as follows:

City of Santa Ana
Risk Management Division, 4th Floor 20 Civic Center Plaza Santa Ana, CA 92701

vii. Where the amounts or coverage provided by the certificates of insurance provides coverage greater than those listed by this Agreement, the amounts provided by the certificates of insurance shall be incorporated by reference into the Agreement.

7. Broader Coverage: If the Consultant maintains broader coverage and/or higher limits than the minimums shown above, the Entity requires and shall be entitled to the broader coverage and/or the higher limits maintained by the contractor. Any available insurance proceeds in excess of the specified minimum limits of insurance and coverage shall be available to the Entity.

8. If Consultant fails or refuses to produce or maintain the insurance required by this section or fails or refuses to furnish the City with required proof that insurance has been procured and is in force and paid for, the City shall have the right, at the City’s election, to forthwith terminate this Agreement. Such termination shall not affect Consultant’s right to be paid for its time and materials expended prior to notification of termination. Consultant waives the right to receive compensation and agrees to indemnify the City for any work performed prior to approval of insurance by the City.

b. Other Insurance Provisions

1. Additional Insured Status : The Entity, its officers, officials, employees, and volunteers are to be covered as additional insureds on the CGL policy with respect to liability arising out of work or operations performed by or on behalf of the Consultant including materials, parts, or equipment furnished in connection with such work or operations. General liability coverage can be provided in the form of

City Council
23 –
13 2/7/2023

6 an endorsement to the Consultant’s insurance (at least as broad as ISO Form CG 20 10 11 85 or both CG 20 10, CG 20 26, CG 20 33, or CG 20 38; and CG 20 37 forms if later revisions used). Please note, if there is an insured vs. insured exclusion on the Consultant’s policy, carefully review with the Consultant and their insurance carrier on whether being added as an additional insured onto the Consultant’s policy removes your organization’s ability to file suit against the Consultant and draw upon the policy should final adjudication in a lawsuit state that the Consultant shall pay damages to your organization.

2. Primary Coverage : For any claims related to this contract, the Consultant’s insurance coverage shall be primary. Coverage for commercial liability shall be at least as broad as ISO CG 20 01 04 13 as respects the Entity, its officers, officials, employees, and volunteers. Any insurance or self -insurance maintained by the Entity, its officers, officials, emp loyees, or volunteers shall be excess of the Consultant’s insurance and shall not contribute with it.

3. Notice of Cancellation : Each insurance policy required above shall state that coverage shall not be canceled, except with notice to the Entity.

4. Waiver of Subrogation: Consultant hereby grants to Entity a waiver of any right to subrogation which any insurer of said Consultant may acquire against the Entity by virtue of the payment of any loss under such insurance. Consultant agrees to obtain any endorsement that may be necessary to affect this waiver of subrogation, but this provision applies regardless of whether or not the Entity has received a waiver of subrogation endorsement from the insurer.

5. Self-Insured Retentions: Self-insured retentions must be declared to and approved by the Entity. The Entity may require the Consultant to provide proof of ability to pay losses and related investigations, claim administration, and defense expenses within the retention. The policy language shall provide, or be endorsed to provide, that the self-insured retention may be satisfied by either the named insured or Entity.

6. Acceptability of Insurers: Insurance is to be placed with insurers authorized to conduct business in the state with a current A.M. Best’s rating of no less than A - :VII, unless otherwise acceptable to the Entity.

7. Claims Made Policies: If any of the required policies provide coverage on a claims- made basis:
i. The Retroactive Date must be shown and must be before the date of the contract or the beginning of contract work.
ii. Insurance must be maintained and evidence of insurance must be provided for at least five (5) years after completion of the contract of work.
iii. If coverage is canceled or non -renewed, and not replaced with another claims-made policy form wi th a Retroactive Date prior to the contract effective date, the Consultant must purchase “extended reporting” coverage for a minimum of five (5) years after completion of contract work.

City Council
23 –
14 2/7/2023

7 8. Verification of Coverage : Consultant shall furnish the Entity with or iginal Certificates of Insurance including all required amendatory endorsements (or copies of the applicable policy language effecting coverage required by this clause) and a copy of the Declarations and Endorsement Page of the CGL policy listing all policy endorsements to the Entity before work begins. However, failure to obtain the required documents prior to the work beginning shall not waive the Consultant’s obligation to provide them. The Entity reserves the right to require complete, certified copies of all required insurance policies, including endorsements required by these specifications, at any time.

9. Subcontractors: Consultant shall require and verify that all subcontractors maintain insurance meeting all the requirements stated herein, and Consultant shall ensure that Entity is an additional insured on insurance required from subcontractors.

10. Special Risks or Circumstances: Entity reserves the right to modify these requirements, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other special circumstances.

c. If CONSULTANT fails or refuses to maintain the insurance required by this section
or fails or refuses to furnish CITY with required proof that insurance has been procured and is in force pursuant to the provision of certificates of insurance as detailed in this Master Renewal Agreement, then the CITY shall have the right, at CIT Y's election, to forthwith terminate this Master Renewal Agreement. Such termination shall not affect CONSULTANT's right to be paid for its time and materials expended prior to notification of termination.

6. CONFIDENTIALITY

(a) Definition. Each party acknowledges that it may receive Confidential Information from the other party or otherwise in connection with this Master Renewal Agreement. "Confidential Information" means all information or material that the disclosing party treats as confidential and any information relating to third parties that the disclosing party has an obligation to treat as confidential, which is disclosed by or obtained by a party in connection with this Master Renewal Agreement, whether such information is in oral, written, gra phic or electronic form, which is: (A) marked "Confidential ," "Restricted," or "Proprietary Information" or other similar marking, or (B) known by the PARTIES to be considered confidential or proprietary, or (C) which should be known or understood to be confidential or proprietary by an individual exercising reasonable commercial judgment in the circumstances. Confidential Information does not include infom1ation to the extent that such information: (i) is or becomes generally known to the public by any me ans other than a breach of the obligations of a receiving party hereunder; (ii) was previously known to the receiving party as evidenced by its written records; (iii) is tightly received by the receiving party from a third party who is not under an obligation of confidentiality; or (iv) is independently developed by the receiving party without reference to or use of the other party's Confidential Information which such independent development can be established by evidence that would be acceptable to a cour t of competent jurisdiction.

(b) Confidentiality Obligations. Each of the PARTIES agrees:

City Council
23 –
15 2/7/2023

8 i. to maintain the Confidential Inforn1ation of the other party in confidence and to take all reasonable steps, which shall be no less than those steps it takes to protect its own confidential and proprietary information, to protect the Confidential Information of the other party from unauthorized use, disclosure, copying or publication;

ii. not to use the Confidential Information of the other party other than in the course of exercising its rights or performing its obligations under this Master Renewal Agreement;

iii. not to disclose or release such Confidential Information except to the extent required by applicable law or during the course of or in connection with any litigation, arbitration or other proceeding based upon or in connection with the subject matter of this Master Renewal Agreement, provided that the receiving party shall first give reasonable notice to the disclosing party prior to such disclosure so that the disclosing party may obtain a protective order or equivalent and provided that the receiving party shall comply with any such protective order or equivalent.

iv. not to disclose or release such Confidential Information to any third person without the prior written consent of the disclosing party, except for authorized employees or agents of the receiving party who have a need to know such information for the purpose of perfom1ance under this Master Renewal Agreement and exercising its rights under this Master Renewal Agreement, and who are bound by confidentiality obligations at least as protective of the disclosing party's Confidential Information as this Master Renewal Agreement; and

v. to take such actions as may be reasonably necessary to enforce its Master Renewal Agreements with its employees and agents, including commencing legal proceedings.

7. INTELLECTUAL PROPERTY INDEMNIFICATION

CONSULTANT shall defend and indemnify CITY, its officers, agents, representatives, and employees against any and all liability, inclu ding costs, for infringement of any United States' letters patent, trademark, or copyright infringement, including costs, contained in the work product or documents provided by CONSULTANT to CITY pursuant to this Master Renewal Agreement.

8. RECORDS

CONSULTANT shall keep records and invoices in connection with the work to be performed under this Master Renewal Agreement. CONSULTANT shall maintain complete and accurate records with respect to the costs incurred under this Master Renewal Agreement and any services, expenditures, and disbursements charged to CITY for a minimum period of four (4) years, or for any longer period required by law, from the date of final payment to CONSULTANT under this Master Renewal Agreement. All such records and invoices shall be clearly identifiable. CONSULTANT shall allow a representative of CITY to examine, audit, and make transcripts or copies of such records and any other documents created pursuant to this Master Renewal Agreement during regular business hours. CONSULTANT shall allow inspection of all work, data, documents, proceedings, and activities related to this Master Renewal Agreement for a period of three (3) years from the date of final payment to CONSULTANT under this Master Renewal Agreement.

City Council
23 –
16 2/7/2023

9 9. CONFLICT OF INTEREST CLAUSE

CONSULTANT covenants that it presently has no interests and shall not have interests, direct or indirect, which would conflict in any manner with performance of services specified under this Master Renewal Agreement.

10. MUTUAL OBLIGATIONS – OWNERSHIP

(a) CONSULTANT's Obligations. CONSULTANT shall use commercially reasonable efforts to provide the professional services set out in the applicable Statement of Work (the "Services").

(b) CITY's Obligations. To enable CONSULTANT to perform the Services, CITY agrees to provide the following to CONSULTANT:

i. Information relative to CITY's hardware and software required for CONSULTANT to provide its Services;
ii. Access to and use of CITY's facilities, equipment, hardware and software required by CONSULTANT to perform the Services;
iii. Personnel and assistance as is reasonably required to enable CONSULTANT to perform the Services; and
iv. A representative with authority to approve the plans and deliverables described in the applicable Statement of Work if so required.

(c) Ownership. CITY may retain a PDF copy of any reports or other deliverables provided by CONSULTANT to CITY as part of the Services ("Deliverables"); however, CONSULTANT is and shall remain the owner of all copyright, patents, trademarks, trade secrets and other intellectual property rights.

11. WARRANTY AND LIMITATION OF LIABILITY

CONSULTANT warrants that the Services will be performed in a professional and diligent manner by personnel who are competent in performing their individual tasks.

To the greatest extent permitted by applicable law, CONSULTANT, its affiliates, and each of their respective directors, officers, employees and shareholders’ entire liability and customer’s exclusive remedy with respect to the services and any other products, materials supplied by CONSULTANT in connection with this agreement for damages for any cause and regardless of the cause of action, whether in contract or in tort, including fundamental breach, ne gligence, strict liability or otherwise, shall not exceed in the aggregate an amount that is equal to three hundred thousand dollars or the total fees paid to CONSULTANT under this Master Renewal Agreement in the preceding 12 months , whichever is higher. In respect of any liability that arises under the terms of the support and maintenance agreement, the limitation of liability provisions of the support and maintenance agreement shall apply to such liability and not this section 11.

In no event shall either CONSULTANT and customer, their respective affiliates and each of their respective directors, officers, elected officials, employees and shareholders, be liable for any consequential, incidental, indirect, exemplary, punitive, or special damages whatsoever, including but not limited to for lost revenue or loss of profits, loss of business, loss of data, failure to realize expected savings, or cost of substitute goods or services arising out of or in connection with this

City Council
23 –
17 2/7/2023

10 agreement, even if it has b een advised of the likelihood of the occurrence of such loss or damage or such loss or damage is foreseeable and notwithstanding any failure of essential purpose of any limited remedy.

In no event does this limitation of liability clause apply to CONSULTANT ’s obligations under section 7 of this Master Renewal Agreement.

12. TERMINATION

(a) Termination. This Master Renewal Agreement may be terminated as follows:

i. In addition to any other rights and remedies available to it, either party may immediately terminate this Master Renewal Agreement in the event of material breach by the other party of its obligations and that breach is not cured within thirty (30) days of receipt of written notice to that effect;

ii. Either party may terminate this Master Renewal Agreement effective immediately upon written notice to the other party if the other party: (i) becomes insolvent; (ii) becomes the subject of any proceeding under any bankruptcy, insolvency or liquidation law, whether domestic or foreign, and whether voluntary or involuntary, which is not resolved favorably to the subject party within ninety (90) days of commencement thereof; or (iii) becomes subject to property seizure under court order, court injunction or other court order which has a material adverse effect on its ability to perform hereunder.

(b) Effect of Termination. In the event of termination of this Master Renewal Agreement, CITY shall immediately pay all outstanding Fees and other amounts owing to CONSULTANT for work completed or services already rendered under this Master Renewal Agreement.

13. GENERAL

(a) Mediation. The PARTIES agree to submit any claim, controversy or dispute arising out of or relating to this Master Renewal Agreement or the relationship created by this Master Renewal Agreement to non -binding mediation before bringing a claim, controversy or dispute in a court or before any other tribunal. The mediation is to be conducted by either an individual mediator or a mediator appointed by mediation services mutually agreeable to the PARTIES. Such media tor shall be knowledgeable in software system Master Renewal Agreements. The mediation shall take place at a time and location which is also mutually agreeable; provided; however, in no event shall the mediation occur later than ninety (90) days after either party notifies the other of its desire to have a dispute be placed before a mediator. The costs and expenses of mediation, including compensation and expenses of the mediator (and except for the attorney's fees incurred by either party), is to be shared by the PARTIES equally. If the PARTIES are unable to resolve the claim, controversy or dispute within ninety (90) days after the date either party provides the other notice of mediation, then either party may bring and initiate a legal proceeding to res olve the claim, controversy or dispute unless the time period is extended by a written Amendment to Master Renewal Agreement. Nothing in this section shall inhibit a party’s right to seek injunctive relief at any time.

(b) Notice. Any notice, tender, demand, delivery, or other communication pursuant to this Master

City Council
23 –
18 2/7/2023

11 Renewal Agreement shall be in writing and shall be deemed to be properly given if delivered in person or mailed by first class or certified mail, postage prepaid, or sent by facsimile or other telegraphic communication in the manner provided in this Section, to the appropriate address set out below:

To CITY: Clerk of the City Council City of Santa Ana
20 Civic Center Plaza (M-30)
P.O. Box 1988
Santa Ana, CA 92702-1988
Facsimile: (714) 647-6956

Copies to: Executive Director
Finance and Management Services Agency
City of Santa Ana
20 Civic Center Plaza (M - 17)
Santa Ana, CA 92702
Phone: (714) 647-6960
Fax: (714) 647-5414

To CONSULTANT: System Innovators, A Division of
N. Harris Computer Corporation
10550 Deerwood Park Blvd, Suite 700
Jacksonville, FL 32256
Attention: Jeff rey Sumner,
Executive Vice President
Phone: (800) 963 -5000
Email: [email protected]

A party may change its address by giving notice in writing to the other party. Thereafter, any notice, tender, demand, delivery, or other communication shall be addressed and transmitted to the new address. If sent by mail, any notice, tender, demand, delivery, or other communic ation shall be effective or deemed to have been given three (3) days after it has been deposited in the United States mail, duly registered or certified , with postage prepaid , and addressed as set forth above. If sent by facsimile, any notice, tender, demand, delivery, or other communication shall be effective or deemed to have been given twenty-four (24) hours after the time set forth on the transmission report issued by the transmitting facsimile machine, addressed as set forth above. For purposes of calculating these time frames, weekends, federal, state, County or City holidays, or City Hall Closure dates shall be excluded.

14. DISCRIMINATION

CONSULTANT shall not discriminate because of race, color, creed, religion, sex, marital status, sexual orientation, age, national origin, ancestry, or disability, as defined and prohibited by applicable law, in the recruitment, selection, training, utilization, promotion, termination or other employment related activities. CONSULTANT affirms that it is an equal opportunity employer and shall comply with all applicable federal, state and local laws and regulations.

15. JURISDICTION - VENUE

This Master Renewal Agreement and all questions relating to its validity, interpretation, performance, and enforcement shall be governed and construed in accordance with the laws of the State of California. This Master Renewal Agreement has been executed and delivered in the State of California

City Council
23 –
19 2/7/2023

12 and the validity, interpretation, performance, and enforcement of any of the clauses of this Master Renewal Agreement shall be determined and governed by the laws of the State of California. Both PARTIES further agree that Orange County, California, shall be the venue for any action or proceeding that may be brought or arise out of, in connection with or by reason of this Master Renewal Agreement.

16. PROFESSIO NAL LICENSES

CONSULTANT shall, throughout the term of this Master Renewal Agreement, maintain all necessary licenses, permits, approvals, waivers, and exemptions necessary for the provision of the services hereunder and required by the laws and regulations of the United States, the State of California, the City of Santa Ana and all other governmental agencies. CONSULTANT shall notify CITY immediately and in writing of her inability to obtain or maintain such permits, licenses, approvals, waivers, and exemptions.

Said inability shall be cause for termination of this Master Renewal Agreement.

17. COORDINATION OF WORK OR SERVICES

(a) Contract Officer

CITY will appoint a Contract Officer who will be in charge of the contract maintenance. The CITY'S appointed Contract Officer shall be the City Manager, or designee of the City Manager. CITY’s Contract Officer shall have authority to enter into Change Orders with CONSULTANT pursuant to this Master Renewal Agreement. It shall be CONSULTANT's responsibility to assure that CITY's Contract Officer is kept informed of the progress of the performance of the consulting services set forth in this Master Renewal Agreement and CONSULTANT shall refer any decisions which must be made by CITY to the Contract Officer. The Contract Officer shall have authority to sign all documents on behalf of CITY required hereunder to carry out the terms of this Master Renewal Agreement. Unless otherwise specified herein, any approval of CITY required hereunder shall mean the approval of the Contract Officer. All notices regarding consulting services or requested changes in said Master Renewal Agreement together with all requests for adjustment in the contract and/or the time to perform this Master Renewal Agreement are subject to the written approval of CONSULTANT.

18. ADDITIONAL WORK OR SERVICES

(a) Extra Work or Services

CITY shall have the right at any time during the performance of the work or services set forth in this Master Renewal Agreement, without invalidating said Master Renewal Agreement or any amendments thereto, to elect to exercise any existing option specified in the Scope of Services for extra work or services directly related to the general scope of services, including third party integrations to allow City fullest access to agreed-to services and support, or to change the time or manner of delivery of any work or services, or to order extra work or services pursuant to a duly executed Change Order or to expend previously appropriated, but unspent contingency funds authorized to be carried forward by the Executive Director of Finance and Management Services to cover expenses for work or services agreed to by the PARTIES but exceeding any annual City fiscal yea r compensation amount cap initially specified under the Compensation provisions of this Agreement or thereby make changes by altering, adding to or deducting from said work or services.

(b) Change Order

No extra work or services as set forth in subsection (a) above may be undertaken unless a written "Change Order" is first signed by the Contract Officer to the CONSULTANT, incorporating therein

City Council
23 –
20 2/7/2023

13 any material adjustment in the contract and/or the time to perform this Master Renewal Agreement, which said adjustments are subject to the written approval of the CONSULTANT.

Net total compensation to Consultant shall not, as the result of any Change Order, exceed the maximum contract compensation amount set forth under Section 2 (“COMPENSATION”) of this Agreement, unless an increase in maximum contract compensation is agreed to by the parties pursuant to a duly executed amendment of this Agreement.

19. ENTIRE AGREEMENT

This Master Renewal Agreement, including any duly executed change order, shall constitute the entire agreement between the PARTIES hereto with respect to the matters covered herein. No other understandings, agreements, representations, warranties or other matters, oral or written, purportedly agreed to or represented by or on behalf of CONSULTANT by any of its employees or agents, or contained in any sales material s or brochures, shall be deemed to bind the PARTIES hereto with respect to the subject matter hereof. CITY acknowledges that it is entering into this Agreement solely on the basis of the representations contained herein. The terms of this Agreement may not be changed except by an amendment or change order signed by an authorized representative of each PARTY. No provisions in any purchase orders, invoices, or in any other documentation employed by or on behalf of either party in connection with this Mas ter Renewal Agreement, regardless of the date of such documentation, shall affect the terms of this Master Renewal Agreement, even if such document is accepted by either or both PARTIES, with such provisions being deemed deleted.

Provided, however that the applicable terms of the PARTIES' Original Agreement along with the applicable terms of the First and Second Amendments to said Original Agreement relating to CITY's licensing rights to operate the CITY’s iNovah – SWS – Enterprise software cashiering license to up to 300,000 annual receipts with corresponding Check 21 – ICL software and hardware support rights, shall remain in full force and effect until the PARTIES have completed the upgrade of the CITY's iNovah system to include CONSULTANT’s “ Santa Ana EMV – Additional Request for Service – EMV PayConex Implementation” and user acceptance has been verified to CONSULTANT by CITY, at which time, only the licensing rights shall continue pursuant to the terms of the Original Agreement as amended and the iNovah software definition shall incorporate all versions/elements of the iNovah software to which this Master Renewal Agreement applies.

20. SEVERABILITY

The invalidity or unenforceability of any provision or covenant contained in this Master Renewal Agreement shall not affect the validity or enforceability of any other provision or covenant herein contained and any such invalid provision or covenant shall be deemed modified to the extent necessary in order to render such provision valid and enforceable; if suc h provision may not be so saved, it shall be severed and the remainder of this Master Renewal Agreement shall remain in full force and effect.

21. WAIVER

No waiver of any breach of any provision of this Master Renewal Agreement shall constitute a waiver of any prior, concurrent, or subsequent breach of the same or any other provisions hereof, and no waiver shall be effective unless made in writing and signed by an authorized representative

City Council
23 –
21 2/7/2023

14 of the waiving party.

22. FORCE MAJEURE

No default, delay or failure to perform on the part of CONSULTANT shall be considered a breach of this Master Renewal Agreement where such default, delay or failure is due to a force majeure or to circumstances beyond its control. Such circumstances will include, without limitation, strikes, riots, civil disturbances, actions or inactions concerning government authorities, epidemics, war, terrorist acts, embargoes, severe weather, fire, earthquakes, acts of God or the public enemy or default of a common carrier or other disasters or events.

23. MISCELLANEOUS PROVISIONS

(a) Each undersigned represents and warrants that its signature hereinbelow has the power, authority and right to bind their respective parties to each of the terms of this Agreement, and shall indemnify CITY fully, including reasonable costs and attorney's fees, for any injuries or damages to CITY in the event that such authority or power is not, in fact, held by the signatory or is withdrawn.

(b) All Exhibits referenced herein and attached hereto shall be incorporated as if fully set forth in the body of this Master Renewal Agreement.

(c) Subject to section 19 of this Master Renewal Agreement, the mutual execution of this Master Renewal Agreement by the PARTIES hereto shall supersede the PARTIES’ Orig inal Agreement and all amendments thereto, including any contract extension currently in effect, which by mutual consent of the parties shall be hereby cancelled. All support and maintenance fees paid by CITY thereon for calendar year 2022 shall be fully applied on a semi -annual basis. All invoices and related payments for the period beginning July 1, 2022, shall be subject to the provisions of this Master Renewal Agreement.

(d) This Master Renewal Agreement must be signed below and may be signed in counterpart and delivered by fax, email as a PDF (Portable Document Format) file attachment, or by other means that displays the original or a copy of the signatures. Any subsequent amendments may be signed and delivered in the same manner.

//
//

{Signatures on following page}

City Council
23 –
22 2/7/2023

15 IN WITNESS WHEREOF, the PARTIES hereto have executed this Master Renewal Agreement the date and year first above written.

ATTEST: CITY OF SANTA ANA

Clerk of the Council

Kristine Ridge
City Manager

APPROVED AS TO FORM:

SONIA R. CARVALHO
City Attorney

____________________________________________________________ By: John Funk
Assistant City Attorney

CONSULTANT
System Innovators, A Division of
RECOMMENDED FOR APPROVAL: N. Harris Computer Corporation

Kathryn Downs Executive Director
Finance & Management Services Agency
Name: Jeffrey Sumner
Title: Executive Vice President
Kathryn Downs (Jan 23, 2023 09:05 PST)

City Council
23 –
23 2/7/2023

16 EXHIBIT A

1. “Santa Ana EMV – Additional Service Request EMV PayConex Implementation”

City Council
23 –
24 2/7/2023

Additional Service Request
Santa Ana, City
Deal # 3998634471
Nov 10, 2022
Santa Ana EMV
This Additional Service Request (“ASR”) is an addendum to the existing agreement between Santa Ana, City (Customer) and System Innovators, a Division of N. Harris Computer Corporation for the delivery and implementation of the iNovah EMV PayConex module, and is subject to all terms and conditions of the “PURCHASE AND SOFTWARE LICENSE AGREEMENT.” The parties have entered into the Agreement for the provision of certain services and deliverables to the Customer. All terms of the Agreement are incorporated herein by this reference. In the event of a conflict, the terms of the Agreement maintain control over the terms of this ASR unless specifically stated herein.
$0.00
Component1 QTY Price ( USD) Subtotal
Professional Services
Professional Services 1 $10,000.00 $10,000.00
Hardware
PAX A80 Pin Pad Terminals 10 $425.00 $4,250.00
Subtotal $14,250.00
Tax
Total (USD) $14,250.00

1. Hardware prices are subject to change. Harris will provide 30 days’ notice prior to any price increase.

City Council
23 –
25 2/7/2023

Fee Summary2
Item Unit (qty) Price (USD)
Per Transaction Fee for Gateway to TSYS
(billed monthly as incurred)
48,000 Transactions per
year (estimated)
$0.35 per transaction
P2PE Device Managment Fee (Billed
Monthly per Terminal Device)
10 $5.00 per device

2. Additional fees may be incurred as specifically defined in the Merchant Services Agreement.

Warranty Services (as needed)
Hardware Services and Warranty Support3
OEM Warranty Repair Management $25.00/device
OEM Out-of-Warranty Repair Management $35.00/device, plus cost of quoted repair

3. Prices are subject to change. Harris will provide 30 days’ notice prior to any price increase.

Payment Schedule
This schedule represents the fixed-price professional services investment for the design, development, coding, testing, and implementation of the requested modification described in the Statement of Work. This investment will be paid in installments based on the milestones identified in the following payment schedule.

Payment
Number
Milestones Payment Amount
1 Project initiation - Due upon project start $10,000.00 2 Hardware Purchase - EMV Terminals; Due upon receipt of order$4,250.00 Payment Milestones Totals $14,250.00

City Council
23 –
26 2/7/2023

Appendix A
EMV PayConex Implementation - Scope of Work
The Organization is requesting an update to their existing in-person credit card process with iNovah to the P2PE-validated PayConex EMV solution. System Innovators will set up the PayConex solution to gateway in-person payment card processing to the Organization's existing processor, TSYS.

The Organization will need to upgrade to the most recent iNovah release (currently v2.61.* MR10) to support EMV PayConex.

The new credit card devices must be ordered directly from SI for use with this solution. The Organization will be billed monthly for the P2PE Device Management fees and gateway transaction fees as listed in the table above.

City Council
23 –
27 2/7/2023

Timeline
Once the Organization has authorized this additional service, System Innovators will prepare a project schedule for this additional service. The project schedule will identify the project start date and end date as well as a timeline for all project milestones. The project schedule will be mutually monitored and managed by the Organization and System Innovators. Any variation to the dates and milestones defined in the project schedule must be mutually agreed upon by the Organization and System Innovators. The following project timeline identifies the duration of the milestones for this additional service project. Specific dates for this additional service will be defined in the project schedule.

Assumptions

1. The Organization acknowledges this project is fixed in scope and duration as defined in Appendix A.

Modifications to the scope, duration, and other terms of this agreement will be processed in accordance with the Project Change Control procedure as described herein.

2. The Organization will employ the human resources necessary to ensure the project is successfully completed on schedule. These resources will include
• Project Manager who has the authority to represent the Organization in all aspects of this agreement • Subject matter experts who can define the requirements and business rules that dictate the design of the customizations
• Technical staff who can provide System Innovators with support for the Organization’s computing environment (personal computers, servers, network, software, and so forth) as well as technical support for third-party systems that interface with System Innovators’ software.

3. The Organization or Organization’s delegate will produce a tested and documented application programming interface (API) to any application to be interfaced with System Innovator products and/or software.

4. The Organization will provide System Innovators with remote access to their computing environment so that System Innovators may support the Organization with delivery, implementation, and testing of the customized software. System Innovators’ access to the Organization’s computing environment may be accomplished through such means as a high-speed virtual private network (VPN) or an Internet-based remote access tool (such as Go To Meeting or Turbo Meeting).

5. The Organization will provide a fully functional test system including hardware, software, documentation and any system software and/or upgrades necessary to complete acceptance testing.

6. The Organization will install and configure all required personal computers, hardware, software, and communications networking in advance of planned delivery of Systems Innovator’s software and/or services.

7. System Innovators’ pricing does not include the cost for changes to 3rd party systems.

8. Travel to the Organization location will be billed as incurred.

City Council
23 –
28 2/7/2023

17 EXHIBIT A

1. a. iNovah – EMV PayConex Solution Overview

City Council
23 –
29 2/7/2023

 
City Council
 23 – 30
2/7/2023
 

18 EXHIBIT A

1. b. PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0

City Council
23 –
31 2/7/2023

Payment Card Industry (PCI)
Data Security Standard

Attestation of Compliance for
Onsite Assessments – Service Providers
Version 3.2.1
June 2018

City Council
23 –
32 2/7/2023

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 1 Section 1: Assessment Information
Instructions for Submission
This Attestation of Compliance must be completed as a declaration of the results of the service provider’s assessment with the Payment Card Industry Data Security Standard Requirements and Security Assessment Procedures (PCI DSS). Complete all sections: The service provider is responsible for ensuring that each section is completed by the relevant parties, as applicable. Contact the requesting payment brand for reporting and submission procedures.

Part 1. Service Provider and Qualified Security Assessor Information Part 1a. Service Provider Organization Information
Company Name: Bluefin Payment Systems
LLC
DBA (doing
business as):

Bluefin Payment Systems
Contact Name: Brent Johnson Title: CISO
Telephone: 770.299.8533 E-mail: [email protected]
Business Address: 8200 Roberts Drive, Suite
150
City: Atlanta
State/Province: GA Country: United States Zip: 30350
URL: https://www.bluefin.com

Part 1b. Qualified Security Assessor Company Information (if applicable) Company Name: Foregenix Ltd
Lead QSA Contact Name: Shawn Shifflett Title: Managing Consultant Telephone: +1 972.292.8039 E-mail: [email protected] Business Address: 1st Floor, 8-9 High Street City: Marlborough State/Province: Wiltshire Country: UK Zip: SN8 1AA
URL: http://www.foregenix.com

City Council
23 –
33 2/7/2023

Part 2. Executive Summary
Part 2a. Scope Verification
Services that were INCLUDED in the scope of the PCI DSS Assessment (check all that apply):

Name of service(s) assessed: Payment Gateway Services
Type of service(s) assessed:

Hosting Provider:
☐ Applications / software
☐ Hardware
☐ Infrastructure / Network
☐ Physical space (co-location)
☐ Storage
☐ Web
☐ Security services
☐ 3-D Secure Hosting Provider
☐ Shared Hosting Provider
☐ Other Hosting (specify):

N/A
Managed Services (specify):
☐ Systems security services
☐ IT support
☐ Physical security
☐ Terminal Management System
☐ Other services (specify):

N/A

Payment Processing:
☒ POS / card present
☒ Internet / e-commerce
☒ MOTO / Call Center
☐ ATM
☐ Other processing (specify):

N/A

☐ Account Management ☐ Fraud and Chargeback ☒ Payment Gateway/Switch ☐ Back-Office Services ☐ Issuer Processing ☐ Prepaid Services ☐ Billing Management ☐ Loyalty Programs ☐ Records Management ☒ Clearing and Settlement ☐ Merchant Services ☐ Tax/Government Payments ☐ Network Provider
☒ Others (specify): Tokenization
Note: These categories are provided for assistance only, and are not intended to limit or predetermine an entity’s service description. If you feel these categories don’t apply to your service, complete “Others.” If you’re unsure whether a category could apply to your service, consult with the applicable payment brand.

City Council
23 –
34 2/7/2023

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 3 Part 2a. Scope Verification (continued)
Services that are provided by the service provider but were NOT INCLUDED in the scope of the PCI DSS Assessment (check all that apply):

Name of service(s) not assessed: Not applicable.

Type of service(s) not assessed:

N/A
Managed Services (specify):
☐ Systems security services
☐ IT support
☐ Physical security
☐ Terminal Management System
☐ Other services (specify):

N/A

Payment Processing:
☐ POS / card present
☐ Internet / e-commerce
☐ MOTO / Call Center
☐ ATM
☐ Other processing (specify):

N/A

☐ Account Management ☐ Fraud and Chargeback ☐ Payment Gateway/Switch ☐ Back-Office Services ☐ Issuer Processing ☐ Prepaid Services ☐ Billing Management ☐ Loyalty Programs ☐ Records Management ☐ Clearing and Settlement ☐ Merchant Services ☐ Tax/Government Payments ☐ Network Provider
☐ Others (specify): N/A
Provide a brief explanation why any checked services
were not included in the assessment:

Not applicable.

City Council
23 –
35 2/7/2023

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 4 Part 2b. Description of Payment Card Business
Describe how and in what capacity your business
stores, processes, and/or transmits cardholder data.

Bluefin Payment Systems LLC (Bluefin), designated and
assessed as a Level 1 Service Provider, maintains
payment gateway and independent sales organization
(ISO) functions. Bluefin enables merchants to accept
CHD transactions via a virtual terminal solution and
facilitates the connection of merchants to payment
processors for processing CHD transactions.

Bluefin stores, processes, and transmits cardholder via:

Card-Present:
• Merchant-Owned POI: Full Track Data
Card-Not-Present:

Virtual Terminal: PAN, Expiry, Cardholder Name, Card
Validation Code
E-Commerce: PAN, Expiry, Card Validation Code
API: PAN, Expiry, Card Validation Code

PIN / Debit:

Merchant-Owned POI: Full Track Data, PIN / PIN Block
Describe how and in what capacity your business is
otherwise involved in or has the ability to impact the
security of cardholder data.

Bluefin stores, processes, and transmits cardholder via:

Card-Present:
• Merchant-Owned POI: Full Track Data
Card-Not-Present:

Virtual Terminal: PAN, Expiry, Cardholder Name, Card
Validation Code
E-Commerce: PAN, Expiry, Card Validation Code
API: PAN, Expiry, Card Validation Code

PIN / Debit:

Merchant-Owned POI: Full Track Data, PIN / PIN Block

Part 2c. Locations
List types of facilities (for example, retail outlets, corporate offices, data centers, call centers, etc.) and a summary of locations included in the PCI DSS review.

Type of facility
Number of facilities
of this type Location(s) of facility (city, country)
Corporate Office 3 Atlanta, GA US
Tulsa, OK, US
Waterford, Ireland (NOC, Dev)
Data Center 2 Atlanta, GA US

City Council
23 –
36 2/7/2023

Part 2d. Payment Application
Does the organization use one or more Payment Applications? ☐ Yes ☒ No Provide the following information regarding the Payment Applications your organization uses:

Payment Application
Name
Version
Number
Application
Vendor
Is application
PA-DSS Listed?
PA-DSS Listing Expiry
date (if applicable)
N/A N/A N/A ☐ Yes ☒ No N/A

Part 2e. Description of Environment
Provide a high-level description of the environment covered by this assessment.

For example:
• Connections into and out of the cardholder data
environment (CDE).
• Critical system components within the CDE, such as POS devices, databases, web servers, etc., and any other
necessary payment components, as applicable.

Bluefin provides (4) applications specific to the
storage, process, and transmit payment card
transactions:

• PayConex provides stand-alone or
integrated payment processing with
P2PE for direct merchants and
software vendors. The P2PE
decryption environment is included in
the scope of this assessment.

PayConex additionally supports E2EE
and e-Commerce transactions
(hosted e-commerce), and
tokenization services
• Decryptx enables acquirers,
processors, and gateways to offer
Bluefin's P2PE solution on their
platform and direct to their merchants
through an API connection with
Bluefin

• QuickSwipe Mobile is a payment
application installed on mobile
devices
• ShieldConex provides tokenization of
non-card branded data

For the purposes of this assessment
cardholder data (CHD) is stored encrypted
(AES-256 bit) within MySQL databases in
accordance with the Bluefin retention policy.

Bluefin maintains in-scope data centers
located in Atlanta, GA and Tulsa, OK. All
vendor, merchant, and partner connections
utilize TLS 1.2, IPsec VPN, and / or VPLS
network connections.

City Council
23 –
37 2/7/2023

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 6 Does your business use network segmentation to affect the scope of your PCI DSS environment?
(Refer to “Network Segmentation” section of PCI DSS for guidance on network segmentation)
☒ Yes ☐ No
Part 2f. Third-Party Service Providers
Does your company have a relationship with a Qualified Integrator & Reseller (QIR) for the purpose of the services being validated? ☐ Yes ☒ No
If Yes:

Name of QIR Company: N/A
QIR Individual Name: N/A
Description of services provided by QIR: N/A
Does your company have a relationship with one or more third-party service providers (for example, Qualified Integrator Resellers (QIR), gateways, payment processors, payment service providers (PSP), web-hosting companies, airline booking agents, loyalty program agents, etc.) for the purpose of the services being validated? ☒ Yes ☐ No
If Yes:

Name of service provider: Description of services provided:

Elavon Processor
FirstData Processor
Chase Paymentech Processor
Vital/TSYS Processor
Ezic Payment Gateway
/n Software Payment Processing
Note: Requirement 12.8 applies to all entities in this list.

City Council
23 –
38 2/7/2023

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 7 Part 2g. Summary of Requirements Tested
For each PCI DSS Requirement, select one of the following:
• Full – The requirement and all sub-requirements of that requirement were assessed, and no sub- requirements were marked as “Not Tested” or “Not Applicable” in the ROC. • Partial – One or more sub-requirements of that requirement were marked as “Not Tested” or “Not Applicable” in the ROC.
• None – All sub-requirements of that requirement were marked as “Not Tested” and/or “Not Applicable” in the ROC.

For all requirements identified as either “Partial” or “None,” provide details in the “Justification for Approach” column, including:
• Details of specific sub-requirements that were marked as either “Not Tested” and/or “Not Applicable” in the ROC
• Reason why sub-requirement(s) were not tested or not applicable Note: One table to be completed for each service covered by this AOC. Additional copies of this section are available on the PCI SSC website.

Name of Service Assessed: Payment Gateway Service

PCI DSS
Requirement
Details of Requirements Assessed
Full Partial None
Justification for Approach
(Required for all “Partial” and “None” responses. Identify which sub-requirements were not tested and the reason.)
Requirement 1: ☒ ☐ ☐
Requirement 2: ☐ ☒ ☐ 2.1.1 – No in-scope wireless

2.2.3 – No insecure services, protocols, or daemons

2.6 – Not a shared hosting provider
Requirement 3: ☐ ☒ ☐ 3.4.1 – No FDE in use

3.6 – No shared keys for transmission of CHD

3.6.6 – No manual clear-text key-management
Requirement 4: ☐ ☒ ☐ 4.1.1 – No in-scope wireless
Requirement 5: ☒ ☐ ☐
Requirement 6: ☐ ☒ ☐ 6.4.6 – No significant changes
Requirement 7: ☒ ☐ ☐
Requirement 8: ☐ ☒ ☐ 8.5.1 – No remote access to customer premises Requirement 9: ☐ ☒ ☐ 9.5.1 – CHD is never backed up to removable media

9.6 – CHD is never backed up to removable media

9.6.[2-3] – CHD is never backed up to removable
media

City Council
23 –
39 2/7/2023

9.7 – CHD is never backed up to removable media

9.8.1 – CHD is never stored on hard-copy materials

9.9 – Bluefin does not manage or maintain POS
devices

9.9.[1-3] – Bluefin does not manage or maintain POS
devices
Requirement 10: ☒ ☐ ☐
Requirement 11: ☐ ☒ ☐ 11.2.3 – No significant changes
Requirement 12: ☒ ☐ ☐
Appendix A1: ☐ ☐ ☒
Appendix A2: ☐ ☐ ☒

City Council
23 –
40 2/7/2023

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 9 Section 2: Report on Compliance
This Attestation of Compliance reflects the results of an onsite assessment, which is documented in an accompanying Report on Compliance (ROC).

The assessment documented in this attestation and in the ROC was completed on: 29 Jun 2021 Have compensating controls been used to meet any requirement in the ROC? ☐ Yes ☒ No Were any requirements in the ROC identified as being not applicable (N/A)? ☒ Yes ☐ No Were any requirements not tested? ☐ Yes ☒ No
Were any requirements in the ROC unable to be met due to a legal constraint? ☐ Yes ☒ No

City Council
23 –
41 2/7/2023

Based on the results documented in the ROC noted above, the signatories identified in Parts 3b-3d, as applicable, assert(s) the following compliance status for the entity identified in Part 2 of this document (check one):
☒ Compliant: All sections of the PCI DSS ROC are complete, all questions answered affirmatively, resulting in an overall COMPLIANT rating; thereby Bluefin Payment Systems LLC has demonstrated full compliance with the PCI DSS.
☐ Non-Compliant: Not all sections of the PCI DSS ROC are complete, or not all questions are answered affirmatively, resulting in an overall NON-COMPLIANT rating, thereby Bluefin Payment Systems LLC has not demonstrated full compliance with the PCI DSS.

Target Date for Compliance:

An entity submitting this form with a status of Non-Compliant may be required to complete the Action Plan in Part 4 of this document. Check with the payment brand(s) before completing Part 4. ☐ Compliant but with Legal exception: One or more requirements are marked “Not in Place” due to a legal restriction that prevents the requirement from being met. This option requires additional review from acquirer or payment brand.

If checked, complete the following:

Affected Requirement
Details of how legal constraint prevents
requirement being met

N/A N/A

Part 3a. Acknowledgement of Status
Signatory(s) confirms:
(Check all that apply)
☒ The ROC was completed according to the PCI DSS Requirements and Security Assessment Procedures, Version 3.2.1, and was completed according to the instructions therein. ☒ All information within the above-referenced ROC and in this attestation fairly represents the results of my assessment in all material respects.
☐ I have confirmed with my payment application vendor that my payment system does not store sensitive authentication data after authorization.
☒ I have read the PCI DSS and I recognize that I must maintain PCI DSS compliance, as applicable to my environment, at all times.
☒ If my environment changes, I recognize I must reassess my environment and implement any additional PCI DSS requirements that apply.

City Council
23 –
42 2/7/2023

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 11 Part 3a. Acknowledgement of Status (continued)
☒ No evidence of full track data1, CAV2, CVC2, CID, or CVV2 data2, or PIN data3 storage after transaction authorization was found on ANY system reviewed during this assessment. ☒ ASV scans are being completed by the PCI SSC Approved Scanning Vendor Tenable Network Security

Part 3b. Service Provider Attestation

Signature of Service Provider Executive Officer  Date: 29 Jun 2021 Service Provider Executive Officer Name: Brent Johnson Title: CISO

Part 3c. Qualified Security Assessor (QSA) Acknowledgement (if applicable) If a QSA was involved or assisted with this
assessment, describe the role performed:

Performed PCI DSS assessment, performed review of evidence, performed scope validation, completed Report On Compliance and Attestation Of Compliance.

Signature of Duly Authorized Officer of QSA Company  Date: 29 Jun 2021 Duly Authorized Officer Name: Shawn Shifflett QSA Company: Foregenix Ltd

Part 3d. Internal Security Assessor (ISA) Involvement (if applicable) If an ISA(s) was involved or assisted with
this assessment, identify the ISA personnel
and describe the role performed:

Not applicable.

1 Data encoded in the magnetic stripe or equivalent data on a chip used for authorization during a card-present transaction. Entities may not retain full track data after transaction authorization. The only elements of track data that may be retained are primary account number (PAN), expiration date, and cardholder name. 2 The three- or four-digit value printed by the signature panel or on the face of a payment card used to verify card-not-present transactions.
3 Personal identification number entered by cardholder during a card-present transaction, and/or encrypted PIN block present within the transaction message.

City Council
23 –
43 2/7/2023

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 12 Part 4. Action Plan for Non-Compliant Requirements
Select the appropriate response for “Compliant to PCI DSS Requirements” for each requirement. If you answer “No” to any of the requirements, you may be required to provide the date your Company expects to be compliant with the requirement and a brief description of the actions being taken to meet the requirement.

Check with the applicable payment brand(s) before completing Part 4.

PCI DSS
Requirement Description of Requirement
Compliant to PCI
DSS
Requirements
(Select One)
Remediation Date and
Actions
(If “NO” selected for any
Requirement)
YES NO
1 Install and maintain a firewall
configuration to protect cardholder data
☒ ☐
2 Do not use vendor-supplied defaults for
system passwords and other security
parameters
☒ ☐

3 Protect stored cardholder data ☒ ☐
4 Encrypt transmission of cardholder data
across open, public networks
☒ ☐
5 Protect all systems against malware and
regularly update anti-virus software or
programs
☒ ☐

6 Develop and maintain secure systems
and applications
☒ ☐
7 Restrict access to cardholder data by
business need to know
☒ ☐
8 Identify and authenticate access to
system components
☒ ☐
9 Restrict physical access to cardholder
data
☒ ☐
10 Track and monitor all access to network
resources and cardholder data
☒ ☐
11 Regularly test security systems and
processes
☒ ☐
12 Maintain a policy that addresses
information security for all personnel
☒ ☐
Appendix A1 Additional PCI DSS Requirements for
Shared Hosting Providers
☒ ☐
Appendix A2
Additional PCI DSS Requirements for
Entities using SSL/early TLS for Card-
Present POS POI Terminal Connections
☒ ☐

City Council
23 –
44 2/7/2023

19 EXHIBIT A

2. Santa Ana Budgetary Quote (Optional Clariti-CivicPlus-Centaman-3Di Systems Integrations + Peripheral Bundle for Additional Cashier Workstations)

City Council
23 –
45 2/7/2023

System Innovators
800.963.5000 • Fax: 904.645.8892
9000 Southside Blvd
Jacksonville, FL 32256
December 28, 2022
City of Santa Ana
Budget Quote 2022
Summary
City of Santa Ana (referred to as the “Client”) requested System Innovators Professional Services to provide the following:
1) Real-time Integration to Clariti Government Licensing and Permitting System 2) Real-time Integration to Civic Plus CivicRec Parks and Recreation System 3) File Export Integration - Santa Ana Zoo Ticketing System and selected Vendor - Centaman 4) Peripheral bundle for additional Cashier workstations The Client acknowledges that this is a budgetary quote that was provided with very little definition of scope. Prices are based on an average sized projects of similar interface requirements. Any additions or amendments to the projects listed, or adjustments/clarification to Statements of Work will be handled via the Project Change Request process. This quote is valid for 90 days from the date listed above.

Assumptions

1. The Client will employ the human resources necessary to ensure the proje ct is successfully completed on schedule. These resources will include 1) a Project Manager who has the authority to represent the Client in all aspects of this Agreement; 2) subject matter experts who can define the requirements and business rules that dictate the design of the customizations; and 3) technical staff who can provide System Innovators with support for the Client’s computing environment (personal computers, servers, network, software, and so forth) as well as technical support for third-party systems that interface with System Innovators’ software.

2. The Client or Client’s delegate will produce a tested and documented application programming interface (API) to any application to be interfaced with System Innovator products and/or software.

3. The Client will provide System Innovators with remote access to their computing environment so that System Innovators may support the Client with delivery, implementation, and testing of the customized software. System Innovators’ access to the Client’s computing environment may be accomplished through such means as a high- speed virtual private network (VPN) or an Internet -based remote access tool (such as Go to Meeting or Turbo Meeting).

4. The Client will provide a fully functional test system including hardware, software, documentation and any system software and/or upgrades necessary to complete acceptance testing.

5. The Client will install and configure all required personal computers, hardware, software, and communications networking in advance of planned delivery of Systems Innovator’s software and/or services. The Client will inform System Innovators of any changes related to their system configuration.

6. Professional services hours have been estimated based on known requirements as provided by the Client as of the date of this quote. Services are subject to change based on new, or updated requirements.

City Council
23 –
46 2/7/2023

Page 2 of 4 ends

System Innovators
800.963.5000 • Fax: 904.645.8892
9000 Southside Blvd
Jacksonville, FL 32256

7. The Client will prepare an acceptance test plan and test scripts, perform acceptance testing, and report test results and identified defects to the Systems Innovator Project Manager within the specified timeline agreed upon in the project plan.
a. Defect Criteria - Any issue identified during the execution of test scripts during any of the test phases will be assigned a severity level from one to four (defined below) if the issue is a defect. A defect is defined as an item that does not function as designed. The source of truth for the design is the associated functional or integration specification.
b. The standard System Innovators Defect severity levels are defined as follows:
i. Severity 1 – Blocking defect associated with a critical functionality preventing continuation of the testing scenario; no workaround available
ii. Severity 2 – Defect associated with a critical functionality; a workaround is available iii. Severity 3 – Defect associated with non-critical functionality

8. The Client will purchase B2 Test Cards from a compliant third-party for testing EMV terminals. This budgetary quote does not include this purchase.

9. For the Zoo Ticketing Interface, it is the expectation that all work to be completed and billed by the selected vendor, Centaman. Upon completion of said work, the intent is for the license ownership and subsequent annual maintenance beyond the first year will transfer to the City of Santa Ana.

SOFTWARE LICENSES
Real time integration to Clariti Software System – Bi-Directional - Medium Complexity $20,000.00 Real time integration to Civic Plus CivicRec Software System - Bi-Directional - Medium Complexity $20,000.00 Software License Subtotal $40,000.00

PROFESSIONAL SERVICES
Real time integration to Clariti Software System – Bi-Directional - Medium Complexity $ 55,200.00 Real time integration to Civic Plus CivicRec Software System - Bi-Directional - Medium Complexity $ 55,200.00 Professional Services Subtotal $110,400.00
*Peripheral Hardware quotation represents a single cashier workstation requirement. Actual workstation PC not included.

Peripheral Hardware Quantity Unit Cost Total Cost
(Option 1) PAX A80 Credit Card Terminal - Wired 1 $425.00 $425.00 (Option 2) PAX A920 Credit Card Terminal – Wireless 2.4 GHz 1 $560.00 $560.00 Receipt Printer – Epson TM-6000 1 $848.00 $848.00
Cash Drawer - APG 1 $268.00 $268.00
OCR Scanner/Image Reader – Canon CR-L1 1 $620.00 $620.00 Shipping, Handling and Taxes TBD $0.00
Peripheral Hardware Subtotal $2,161.00

City Council
23 –
47 2/7/2023

Page 3 of 4 ends

System Innovators
800.963.5000 • Fax: 904.645.8892
9000 Southside Blvd
Jacksonville, FL 32256
ANNUAL SUPPORT and MAINTENANCE
Real time integration to Clariti Software System $5,000.00 Real time integration to Civic Plus CivicRec Software System $5,000.00 File Export From Centaman Zoo Ticketing System (Starting Year 2, subject to standard annual increases) $2,500.00 Support and Maintenance Subtotal $12,500.00
Notes:
• Rates for each interface above is based on single interface design and implementation at a time. Further license and services discounts may apply if multiple interfaces are combined into a single project. • The annual support and maintenance investment for application interfaces applies only to those interfaces written and maintained by System Innovators. Support fees for interfaces include modifying interfaces to comply with changes forced by legislation or System Innovators system upgrade. Support Fees for all payment collection software produc ts
licensed by System Innovators include help desk support services and upgrades to the latest versions of the licensed software as they become available. The annual Software Support Fee for iNovah entitles the Customer t o
upgrades/updates to iNovah as defined in the master annual support and maintenance agreement. • System Innovators’ pricing does not include the cost for changes to 3rd party systems. • Should the project require travel to the Client’s location, then System Innovators will charge a fixed price of $3,500 for each one (1) person trip, which will be billed as incurred.

City Council
23 –
48 2/7/2023

System Innovators 800.963.5000 • Fax: 904.645.8892 9000 Southside Blvd Jacksonville, FL 32256 December 20, 2022 City of Santa Ana Budget Quote 2022 Summary City of Santa Ana (referred to as the “Organization”) requested System Innovators Professional Services to provide the following: 1) Custom File Export for 3Di Systems’ Data for payment and collection of Rental Registry Fees 2) iNovah Custom Import Scheduler The Organization acknowledges that this is a budgetary quote that was provided with very little definition of scope. Prices are based on an average sized projects of similar interface requirements. Any additions or amendments to the projects listed, or adjustments/clarification to Statements of Work will be handled via the Project Change Request process. This quote is valid for 90 days from the date listed above. Assumptions 1. The Organization will employ the human resources necessary to ensure the project is successfully completed on schedule. These resources will include 1) a Project Manager who has the authority to represent the Organization in all aspects of this Agreement; 2) subject matter experts who can define the requirements and business rules that dictate the design of the customizations; and 3) technical staff who can provide System Innovators with support for the Organization’s computing environment (personal computers, servers, network, software, and so forth) as well as technical support for third-party systems that interface with System Innovators’ software. 2. The Organization or Organization’s delegate will produce a tested and documented application programming interface (API) to any application to be interfaced with System Innovator products and/or software. 3. The Organization will provide System Innovators with remote access to their computing environment so that System Innovators may support the Organization with delivery, implementation, and testing of the customized software. System Innovators’ access to the Organization’s computing environment may be accomplished through such means as a high-speed virtual private network (VPN) or an Internet-based remote access tool (such as Go to Meeting or Turbo Meeting). 4. The Organization will provide a fully functional test system including hardware, software, documentation and any system software and/or upgrades necessary to complete acceptance testing. 5. The Organization will install and configure all required personal computers, hardware, software, and communications networking in advance of planned delivery of Systems Innovator’s software and/or services. The Organization will inform System Innovators of any changes related to their system configuration. 6. Professional services hours have been estimated based on known requirements as provided by the Organization as of the date of this quote. Services are subject to change based on new, or updated requirements.

City Council
23 –
49 2/7/2023

Page 2 of 4 ends

System Innovators 800.963.5000 • Fax: 904.645.8892 9000 Southside Blvd Jacksonville, FL 32256

7. The Organization will prepare an acceptance test plan and test scripts, perform acceptance testing, and report test results and identified defects to the Systems Innovator Project Manager within the specified timeline agreed upon in the project plan. a. Defect Criteria - Any issue identified during the execution of test scripts during any of the test phases will be assigned a severity level from one to four (defined below) if the issue is a defect. A defect is defined as an item that does not function as designed. The source of truth for the design is the associated functional or integration specification. b. The standard System Innovators Defect severity levels are defined as follows: i. Severity 1 – Blocking defect associated with a critical functionality preventing continuation of the testing scenario; no workaround available ii. Severity 2 – Defect associated with a critical functionality; a workaround is available iii. Severity 3 – Defect associated with non-critical functionality SOFTWARE LICENSES Custom File Export - 3Di Systems to iNovah for Rental Registry Payments $10,000.00 Software License Subtotal $10,000.00 PROFESSIONAL SERVICES Custom File Export - 3Di Systems to iNovah for Rental Registry Payments $ 19,360.00 iNovah Custom Import Scheduler $ 19,360.00 Professional Services Subtotal $38,720.00 ANNUAL SUPPORT and MAINTENANCE Custom File Export - 3Di Systems to iNovah for Rental Registry Payments $2,500.00 iNovah Custom Import Scheduler $2,500.00 Support and Maintenance Subtotal $5,000.00 Notes: • Rates for each interface above is based on single interface design and implementation at a time. Further license and services discounts may apply if multiple interfaces are combined into a single project. • The annual support and maintenance investment for application interfaces applies only to those interfaces written and maintained by System Innovators. Support fees for interfaces include modifying interfaces to comply with changes forced by legislation or System Innovators system upgrade. Support Fees for all payment collection software products licensed by System Innovators include help desk support services and upgrades to the latest versions of the licensed software as they become available. The annual Software Support Fee for iNovah entitles the Organization to upgrades/updates to iNovah as defined in the master annual support and maintenance agreement. • System Innovators’ pricing does not include the cost for changes to 3rd party systems. • Should the project require travel to the Organization’s location, then System Innovators will charge a fixed price of $3,500 for each one (1) person trip, which will be billed as incurred.

City Council
23 –
50 2/7/2023

20 EXHIBIT B

Maximum Fiscal Year Compensation Table
(Master Renewal Agreement)

City Council
23 –
51 2/7/2023

Fiscal
Year Activity Description Contracted Compensation
Amount
Additional
Contingency
Maximum
Compensation
Amount
Calendar Year 2023
(January)
One-time EMV
Installtion/Stand-up and
Configuration $10,000 $1,500 $11,500
Calendar Year 2023
(January)
Purchase One-time EMV
Payment Terminals x 30 $68,880 $10,332 $79,212
Calendar Year 2023
(January-June)
Semi-Annual Gateway
Transaction Payment
Processing Fees @ 35¢ per
Transaction
Plus Semi-Annual Device
Management Fee @ $2.50
per Device $8,850 $1,328 $10,178
[Contingency Only]
iNovah Integration into City
of Santa Ana Land
Management System $0 $75,200 $75,200
Calendar Year 2023 Annual
Support & Maintenance $0 $5,000 $5,000
[Contingency Only]
iNovah Integration into City
of Santa Ana Zoo Ticketing
System $0 $75,200 $75,200
Calendar Year 2023 Annual
Support & Maintenance $0 $5,000 $5,000
Maximum Fiscal Year Compensation Table - Santa Ana EMV Services

EXHIBIT B
FY 2022-
23 1

City Council
23 –
52 2/7/2023