Main Subscription Agreement
Customer Full Legal Name: City of Santa Rosa
Customer Address:
This Main Subscription Agreement is between Reveal Data Corporation, a Delaware corporation, or its Affiliate named as a party in an Order Form (“Reveal”) and the Customer named above. This Agreement is effective as of the date the Parties enter into an Order Form (defined below) (the “Effective Date”). Reveal and Customer will each be referred to individually as a “Party” and together as the “Parties”.
The Parties agree as follows:
1. DEFINITIONS
Capitalized terms not otherwise defined in this Agreement shall have the following meaning:
a. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity. b. “Agreement” means this Main Subscription Agreement and any exhibits, Order Form(s), schedules, and addenda hereto.
c. “Customer” means the customer named above together with its Affiliates (for so long as they remain Affiliates) which have signed Order Forms.
d. “Customer Output” means information, data, reporting processes and manipulation and other content that is derived by or through the Customer’s use of the Service and/or On-Premises Deployment and includes, without limitation, new data collection, manipulation and reporting processes prepared using the Service. “
e. “Documentation” means Reveal’s standard information related to the use of the Products, found at https://www.revealdata.com/documentation, and incorporated into this Agreement. f. “Hosted Data” means all information, documents, images, files or materials uploaded, created, modified, or stored (including Customer Output) in the Reveal-hosted Service by Customer or Customer’s Users. g. “Malicious Code ” means code, files, scripts, agents or programs intended to do harm, including, for example, viruses, worms, time bombs and Trojan horses.
h. “Order Form” means an ordering document or online order specifying the Product(s) to be provided hereunder that is entered into between Reveal and Customer or any of their Affiliates, including any addenda and supplements thereto. By entering into an Order Form, an Affiliate agrees to be bound by the terms of this Agreement as if it were an original party hereto.
Exhibit A
2 i. “On-Premises Deployment” (OMITTED).
j. “Privacy Policy” means Reveal’s Privacy Policy, found at: https://www.revealdata.com/privacy-policy. k. “Service” means the Reveal-hosted review, legal hold, and document management solution for online storage, sharing and processing of files, documents, materials, images, videos, or other content, including all updates, modifications, and enhancements thereto, as made generally available by Reveal to its customers, and as set out more specifically on an applicable Order Form. l. “Product” means the Service, and the Site.
m. “Site” means the Reveal website from which the applicable Service may be accessed. n. “User” means any individual who uses a Product on Customer’s behalf or through Customer’s accounts or passwords, whether authorized or not.
2. ACCESS AND USE OF THE SERVICE
a. Provision of Service. Reveal hereby grants Customer a non-exclusive, non-transferable (except in compliance with Section 13.h.), right to access and use the Service during the Term, solely for internal use by Customer and its Users (including use by Customer’s clients as end users of the Service) pursuant to this Agreement and the Documentation. In addition, Reveal will (a) provide applicable support for the Service as described in Exhibit A attached to this Agreement, (b) use commercially reasonable efforts to make the Service available in accordance with the service level addendum set forth in Exhibit B attached to this Agreement, and (c) subject to Customer’s use of the Service in accordance with this Agreement, the Documentation, and Privacy Policy, provide the Service in accordance with U.S. laws applicable to Reveal’s provision of its services to its customers generally (without regard for Customer’s particular use of the Service).
b. Customization. Customer may request features or functionality not already offered through the Service.
If Reveal determines that such requests are feasible, Reveal may choose to provide those features or functionalities to Customer for an additional fee pursuant to a separate written statement of work to be executed by the Parties; provided, such features or functionality will not be exclusive to Customer and may be made generally available to all of Reveal’s customers. c. Suspension of Service. Without limiting Reveal’s termination rights herein, Reveal reserves the right, at any time, in Reveal’s sole and absolute discretion, to temporarily suspend or otherwise deny access to or use of the Service, without incurring obligation or liability, for: (a) emergency maintenance; (b) maintaining the security or integrity of Reveal’s network, hardware, or associated systems or those of Reveal’s third-party providers; (c) unusual spikes in activity or usage of the Service; (d) unplanned technical problems or outages; or (e) judicial or other governmental demand or order, subpoena or law enforcement request that expressly or by reasonable implication requires Reveal to do so. Reveal will use reasonable efforts to notify Customer prior to such suspension where feasible.
3. CUSTOMER RESPONSIBILITIES & RESTRICTIONS
a. Customer Facilities. Customer shall at its sole expense provide, configure and maintain to the extent required for Customer and Users to obtain the benefit of the Services(a) Internet access; (b) systems software for the hardware and access devices; (c) software required to access the Services (such as a
3 compatible Internet browser); and (d) third party office applications and other software (collectively “Customer Facilities”).
b. Customer Responsibilities. Customer will be responsible and liable for (i) Users’ compliance and noncompliance with this Agreement, Documentation, and applicable laws and government regulations, (ii) all information, instructions and materials provided by Customer or any User in connection with the Service; (iii) Customer’s information technology infrastructure, including computers, software, databases, electronic systems (including database management systems), and networks, whether operated directly by Customer or through the use of third-party services; (iv) the security and use of Customer’s and its Users’ account access credentials; and, (v) all access to and use of the Service, directly or indirectly by or through the Customer Facilities or Customer’s and Users’ account access credentials, with or without Customer’s knowledge or consent, including the Customer Output, and all conclusions, decisions, and actions based on, such access or use. Any use of the Service that in Reveal’s reasonable judgment threatens the security, integrity or availability of the Service, may result in Reveal’s immediate suspension of Customer’s use of the applicable Product. Customer shall use reasonable efforts to make all Users aware of this Agreement’s provisions as applicable to such User’s use of the Products and shall cause Users to comply with such provisions.
c. Omitted.
d. Customer Security; Unauthorized Use. Customer shall employ all physical, administrative, and technical controls, screening, and security procedures and other safeguards necessary to securely administer the distribution and use of all account access credentials and protect against any unauthorized access to or use of the Service. Customer shall use commercially reasonable efforts to prevent unauthorized access to or use of the Service and terminate or mitigate the effects of such unauthorized usage. Customer will notify Reveal immediately of any actual or threatened unauthorized access or use at [email protected]. Additionally, Customer will provide Reveal with such cooperation and assistance related to any such unauthorized use as Reveal may reasonably request. e. Hosted Data. Customer shall control the content and use of Hosted Data, including the uploading or other provision of Hosted Data for processing by the Service and the deletion of the Hosted Data from the Services. Customer shall retain sole responsibility for all Hosted Data, including its content, use and legality, and the means by which Customer acquired the Hosted Data. Reveal will have no responsibility or liability for the accuracy of data uploaded to the Service by Customer, including without limitation Hosted Data. REVEAL SHALL BEAR NO LIABILITY WITH RESPECT TO HOSTED DATA THAT IS
LOST OR DAMAGED AS A RESULT OF THE ACTIONS OF CUSTOMER OR THE ACTIONS OF ANY INDIVIDUAL WHO USES THE SERVICE ON CUSTOMER’S BEHALF OR THROUGH CUSTOMER’S ACCOUNT OR PASSWORDS, WHETHER AUTHORIZED OR NOT.
f. Restrictions. Customer shall not use the Service for any purposes beyond the scope of the access granted in this Agreement. Customer shall not at any time, directly or indirectly, and shall not permit any Users to: (i) copy, modify, or create derivative works of the Service or Documentation, in whole or in part; (ii) except as provided elsewhere in the Agreement, rent, lease, lend, sell, license, sublicense, assign, distribute, publish, transfer, or otherwise make available the Service or Documentation; (iii) reverse engineer, disassemble, decompile, decode, adapt, or otherwise attempt to derive or gain access to any software component of the Service, in whole or in part; (iv) remove any proprietary notices from the Service or Documentation; (v) use the Service in a manner that comprises the integrity of Service or the
4 confidentiality of other users of the Service; (vi) input, upload, transmit, or otherwise provide to or through the Service or Provider Systems, any information or materials that are unlawful or injurious, or contain, transmit, or activate any Malicious Code; or (vii) use the Service or Documentation in any manner or for any purpose that infringes, misappropriates, or otherwise violates any intellectual property right or other right of any person, or that violates any applicable law.
4. PRIVACY, PROCESSING, AND SECURITY
a. Privacy Policy. This Agreement and use of the Service and Site are subject to the Privacy Policy. The Privacy Policy applies only to the Service and Site, and does not apply to any third-party website or service linked to the Service. Except otherwise set forth in this Agreement, Reveal shall not disclose Hosted Data to any third party for any purpose other than to provide the Service, support, or related services to Customer.
b. Protection of Hosted Data. Reveal will maintain appropriate administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Hosted Data, in accordance with the terms of the security addendum attached as Exhibit C to this Agreement. Those safeguards will include, but will not be limited to, measures designed to prevent unauthorized access to or disclosure of Hosted Data (other than by Customer or Users), such as encryption of Hosted Data at rest and in internet transmission (using TLS or similar technologies).
c. Data Processing Addendum. To the extent the parties determine it is required by applicable law, the Parties agree to comply with the additional terms and conditions set forth in Reveal’s Data Processing Addendum which can be found in Reveal’s Trust Center at security.revealdata.com. To the extent there is a conflict between this Agreement and the Data Processing Addendum, the terms of the Data Processing Addendum shall control.
d. Export and Destruction of Hosted Data. During the Term or a trial period, Customer will have the ability to export or retrieve Hosted Data from the Service at any time. Within thirty (30) days after the effective date of termination or expiration of this Agreement, Reveal will make Hosted Data available to Customer for export or download. After such 30-day period, Reveal will have no obligation to maintain or provide any Hosted Data, and will thereafter delete or destroy all copies of Hosted Data in its systems or otherwise in its possession or control, unless legally prohibited. Customer acknowledges that the Service is not intended to be utilized as a document or file storage system for record retention purposes, and it is the Customer’s sole responsibility to ensure it maintains a separate system to retain the Hosted Data as required under its own internal record retention policies or as required under applicable law relating to record retention.
e. Processing of Data. Customer understands and acknowledges that it may submit, upload, or process through a Product a variety of different data types, and any such data may have existing encryption, or automatic image conversion issues. As a result of these potential pre-existing issues, there may be times when: (i) such data cannot be extracted and processed; (ii) a certain amount of such data may not be suitable or available for extraction from text, metadata or other information; or (iii) file images may not correctly format when image files are created from native documents for purposes of review or production (collectively, “Exceptions”). Such Exceptions may limit the function of any searching, filtering, or other analysis of the impacted data within the Product.
5 5. FEES AND PAYMENT
a. Fees. Customer agrees to pay all fees as specified in an Order Form (“Fee”). Fees will be invoiced on an annual basis, unless otherwise indicated on the Order Form. Customer may upgrade its subscription to the Service, if such upgrades are available, at any time to accommodate additional requirements. If the Parties agree to an upgrade, Customer’s existing Fee arrangement will be terminated and replaced by a new prorated Fee arrangement reflecting the upgrades. Customer is responsible for providing complete and accurate billing and contact information to Reveal and notifying Reveal of any changes to such information.
b. Payment Terms. Customer will have the option of paying electronic debit or being invoiced. All payments are due within thirty (30) days of the billing date. If payment is not received in forty-five (45) days of the billing date Reveal reserves the right to suspend the Service or use of the On-Premises Deployment (as applicable) until Reveal receives and processes all payments. If payment is not received at the end of sixty (60) days from the billing date, Reveal reserves the right to terminate this Agreement and delete all Hosted Data (subject to Section 4(d)), or, in the case of an On-Premises Deployment, terminate the Customer’s license. Alternatively, at Reveal’s sole discretion, in the event that payment is late, Reveal reserves the right to charge interest at the rate of twelve percent (12%) per annum or the highest legal rate, whichever is lower, calculated from the payment due date until the date that full payment is received.
c. No Refunds. Except as detailed in Section 12.c., all Fees associated with the Service are non-refundable. d. Payment Disputes. Reveal will not exercise its rights to suspend or terminate the Service or applicable license pursuant to Section 5.b. so long as Customer: (i) is disputing the applicable charges reasonably and in good faith and is cooperating diligently to resolve the dispute (“Payment Dispute”), (ii) Customer notifies Reveal in writing of such Payment Dispute no later than ten days following Customer’s receipt of the relevant invoice, and (iii) Customer diligently and reasonably cooperates with Reveal to expeditiously resolve the Payment Dispute within 20 days of the date on which Customer first provides timely notice of a Payment Dispute.
e. Taxes. The Fees do not include any taxes, levies, duties or similar governmental assessments of any nature, including, for example, value-added, sales, use or withholding taxes, assessable by any jurisdiction whatsoever (collectively, “Taxes”). Customer is responsible for paying all Taxes associated with its purchase of the Service. If Reveal has the legal obligation to pay or collect Taxes for which Customer is responsible under this section, Reveal will invoice Customer and Customer will pay that amount unless Customer provides Reveal with a valid tax exemption certificate authorized by the appropriate taxing authority. For clarity, Reveal is solely responsible for taxes assessable against it based on its income, property and employees.
6. LICENSES
a. Reservation of Rights. Subject to the limited rights expressly granted under this Agreement, Reveal, its Affiliates, and its licensors reserve all their right, title and interest in and to the Service, including all of their related intellectual property rights. Reveal reserves the right, in its sole discretion, to update, modify, or remove the features, functionality, or other aspects of the Service at any time. No rights are granted to Customer under this Agreement other than as expressly set forth in this Agreement.
6 i. Omitted.
b. Ownership of Hosted Data and Customer Output. Customer is and will remain the sole and exclusive owner of all right, title and interest in and to all Hosted Data and Customer Output. Customer grants Reveal a non-exclusive, royalty-free, worldwide license to perform all acts with respect to the Hosted Data as may be necessary for Reveal, Reveal’s personnel, and Reveal’s authorized third parties to provide the Service, including, but not limited to, maintenance of the Services and Customer’s account, improving search, sorting, and tagging functions, discovery processing efficiency activities, and supporting the integrity of the Service and data processing systems. Subject to the limited licenses granted in this Agreement, Reveal acquires no right, title or interest from Customer or its licensors under this Agreement in or to any Hosted Data. Customer consents to Reveal’s use of Customer’s name and logos in marketing materials, including on the Site, and for other legitimate business purposes. c. Feedback. Customer grants to Reveal and its Affiliates a worldwide, perpetual, irrevocable, royalty-free license to use and incorporate into its services any suggestion, enhancement request, recommendation, correction or other feedback provided by Customer or Users (collectively, “Feedback”). d. Aggregated Statistics. In the course of providing the Service, Reveal may monitor Customer’s use of the Service and collect and compile statistical data and performance information, including without limitation, the number of records in the Service, the number and types of transactions, configurations, and reports processed analytics, meta-data, or similar information, generated through instrumentation and logging systems, regarding the operation of the Service, including Customer’s use of the Service (“Aggregated Statistics”). All right, title, and interest in Aggregated Statistics, and all intellectual property rights therein, are business records of and are retained solely by Reveal. Aggregated Statistics will not include any Hosted Data. Nothing in this Agreement shall restrict Reveal’s right to collect Aggregated Statistics or to use them for any internal business purpose, or in the manner permitted under applicable U.S. law; provided that such Aggregated Statistics do not identify Customer, Users, or Customer’s Confidential Information.
e. Intellectual Property. As between Reveal and Customer, Reveal (and/or its applicable Affiliate(s)) and its licensors own all right, title, and interest in and to the Service, and the Site (including without limitation all software used to provide the Service and all graphics, user interfaces, logos, and trademarks reproduced through the Service), Reveal’s Confidential Information (defined below), and the Feedback including all intellectual property rights contained therein. A Product may contain references to other entities’ trademarks and service marks, but such references are for identification purposes only and are used with permission of their respective owners. Reveal does not claim ownership in, or any affiliation with, any third-party trademarks or service marks appearing in any Product or the Site. Customer will not use or display Reveal’s trademarks without Reveal’s prior written consent.
7. CONFIDENTIALITY
a. Definition of Confidential Information. “Confidential Information” means all information disclosed by a Party (“Disclosing Party”) to the other Party (“Receiving Party”), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information of Customer includes Hosted Data and data stored on Customer Facilities; Confidential Information of Reveal includes all Reveal Products; and Confidential Information of each Party includes the terms and conditions of this Agreement (including pricing), as well as business and marketing plans, technology and technical
7 information, product plans and designs, security posture and audit reports, and business processes disclosed by such Party. However, Confidential Information does not include any information that (i) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party, (ii) was known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any obligation owed to the Disclosing Party, (iii) is received from a third party without breach of any obligation owed to the Disclosing Party, or (iv) was independently developed by the Receiving Party without breach of this Agreement. For the avoidance of doubt, the non-disclosure obligations set forth in this “Confidentiality” section apply to Confidential Information exchanged between the Parties in connection with the evaluation of additional Reveal services. b. Protection of Confidential Information. As between the Parties, each Party retains all ownership rights in and to its Confidential Information. The Receiving Party will use the same degree of care that it uses to protect the confidentiality of its own confidential information of like kind (but not less than reasonable care) to (i) not use any Confidential Information of the Disclosing Party for any purpose outside the scope of this Agreement, and (ii) except as otherwise authorized by the Disclosing Party in writing, limit access to Confidential Information of the Disclosing Party to those of its and its Affiliates’ employees and contractors who need that access for purposes consistent with this Agreement and who are bound by confidentiality obligations to the Receiving Party containing protections not materially less protective of the Confidential Information than those in this Agreement. Neither Party will disclose the terms of this Agreement or Confidential Information to any third party other than its Affiliates, legal counsel and accountants (i) without the other Party’s prior written consent, provided that a party that makes any such disclosure to its Affiliate, legal counsel or accountants will remain responsible for such Affiliate’s, legal counsel’s or accountant’s compliance with this “Confidentiality” section, or (ii) unless required by law. This Agreement is subject to the California Government Code Section 7920, Access to Public Records. Notwithstanding the foregoing, Reveal may disclose the terms of this Agreement to a subcontractor to the extent necessary to perform its obligations under this Agreement, under terms of confidentiality materially as protective as set forth in this Agreement. c. Compelled Disclosure. The Receiving Party may disclose Confidential Information of the Disclosing Party to the extent compelled by law to do so, provided the Receiving Party makes reasonable efforts to notify the Disclosing Party not later than ten (10) days after Disclosing Party receives or is served with any request, claim, action, lawsuit or other proceeding. The Receiving Party shall then have five (5) days from the date it receives such notice to enter into an agreement with Disclosing Party, satisfactory to the City of Santa Rosa City Attorney, providing for the defense of, and complete indemnification and reimbursement for all costs (including attorneys’ fees) incurred in any legal action to compel the disclosure of such information under the California Public Records Act. The parties understand and agree that any failure by Disclosing Party to respond to the notice provided by Receiving Party and/or to enter into an agreement, in accordance with the provisions above, shall constitute a complete waiver by Disclosing Party of any rights regarding the information, and such information shall be disclosed pursuant to applicable procedures required by the Public Records Act. If the Disclosing Party waives compliance or, if after providing notice and assistance, the Receiving Party remains required by law to disclose the Disclosing Party’s Confidential Information, the Receiving Party shall disclose only that portion of the Confidential Information that, on the advice of legal counsel, the Receiving Party is legally required to disclose.
8 8. REPRESENTATIONS, WARRANTIES, EXCLUSIVE REMEDIES AND DISCLAIMERS a. Representations. Each Party represents that it has validly entered into this Agreement and has the legal power to do so.
b. Reveal Warranties. Reveal warrants that during Term (a) Reveal will not materially decrease the overall security of the Products, and (b) the Products will perform materially in accordance with the applicable Documentation. For any breach of a warranty above, Customer’s exclusive remedies are those described in the “Termination” and “Refund or Payment upon Termination” sections below. EXCEPT FOR THE
WARRANTIES EXPRESSLY PROVIDED IN THIS AGREEMENT, THE PRODUCTS ARE PROVIDED TO CUSTOMER ON AN “AS IS” AND “AS AVAILABLE” BASIS.
c. Disclaimers. EXCEPT AS EXPRESSLY PROVIDED HEREIN, NEITHER PARTY MAKES ANY
WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND
EACH PARTY SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING ANY
IMPLIED WARRANTY OF MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW.
REVEAL DOES NOT WARRANT THAT ANY PRODUCT WILL OPERATE WITHOUT
INTERRUPTION, ACHIEVE ANY INTENDED RESULT, BE COMPATIBLE OR WORK WITH ANY
SOFTWARE, SYSTEM OR OTHER SERVICES, OR BE SECURE, ACCURATE, COMPLETE, FREE OF HARMFUL CODE OR ERROR FREE, OR THAT DEFECTS CAN BE CORRECTED. ADDITIONALLY, ALL THIRD-PARTY MATERIALS ARE PROVIDED “AS IS” AND REVEAL EXPRESSLY DISCLAIMS
ALL WARRANTIES RELATED TO THE THIRD-PARTY SOFTWARE, MATERIALS OR WEB BROWSERS THAT CUSTOMER MAY NEED TO USE IN CONJUNCTION WITH THE PRODUCTS.
9. MUTUAL INDEMNIFICATION
a. Indemnification by Reveal. Reveal will indemnify, defend, and hold harmless Customer against any claim, demand, suit or proceeding made or brought against Customer by a third party alleging that applicable Product(s) infringes or misappropriates such third party’s intellectual property rights (a “Claim Against Customer”), and will indemnify Customer from any damages, attorney fees and costs finally awarded against Customer as a result of, or for amounts paid by Customer under a settlement approved by Reveal in writing of, a Claim Against Customer, provided Customer (i) promptly gives Reveal written notice of the Claim Against Customer, (ii) gives Reveal sole control of the defense and settlement of the Claim Against Customer, and (iii) gives Reveal all reasonable assistance, at Reveal’s expense. If Reveal receives information about an infringement or misappropriation claim related to the Service, Reveal may in its discretion and at no cost to Customer (A) modify the applicable Product so that it is no longer claimed to infringe or misappropriate, without breaching Reveal’s warranties under “Reveal Warranties” above, (B) obtain a license for Customer’s continued use of that Product in accordance with this Agreement, or (C) terminate Customer’s subscriptions for that Product upon 30 days’ written notice and refund Customer any prepaid fees covering the remainder of the Term. The above defense and indemnification obligations do not apply if (1) the allegation does not state with specificity that the Product is the basis of the Claim Against Customer; (2) a Claim Against Customer arises from the use or combination of the applicable Product or any part thereof with software, hardware, data, or processes not provided by Reveal, if the Product or use thereof would not infringe without such combination; (3) a Claim Against Customer arises from a Product under an Order Form for which there is no charge; (4) if the alleged infringement arises from third-party materials or data; (5) if the alleged infringement arises from a modification of the materials other than by or on behalf of Reveal; (6) if the alleged infringement
9 arises from a failure to timely implement modifications, upgrades, replacements, or enhancements made available to Customer by or on behalf of Reveal; or (7) a Claim Against Customer arises from a Customer’s breach of this Agreement or the Documentation. If any successful Claim Against Customer is made against the Customer, Reveal may at its sole option and expense:
i. procure for the Customer the right to continue to use the applicable Product in accordance with the terms of this Agreement; or
ii. modify the Product so that it ceases to be infringing; or iii. replace the Product with a non-infringing service; or iv. terminate the portion of the Order Form made under this Agreement and repay to Customer the prepaid subscription fee to the Customer attributable to such infringing Product for every full calendar month of the subscription term during which the Infringement Claim prevented the Customer from using the applicable Product to which it is otherwise entitled to use under this Agreement. b. Indemnification by Customer. Customer will indemnify, defend, and hold harmless Reveal, its subcontractors, and Affiliates against any claim, demand, suit or proceeding made or brought against Reveal by a third party (i) alleging that any Hosted Data or Customer’s use of Hosted Data with the Service infringes or misappropriates such third party’s privacy rights, or (ii) arising out of, related to or in connection with Customer’s use of a Product in an unlawful manner or in violation of the Agreement and the Documentation (each a “Claim Against Reveal”), and will indemnify Reveal from any damages, attorney fees and costs finally awarded against Reveal as a result of, or for any amounts paid by Reveal under a settlement approved by Customer in writing of, a Claim Against Reveal, provided Reveal (A) promptly gives Customer notice of the Claim Against Reveal, (B) gives Customer sole control of the defense and settlement of the Claim Against Reveal (except that Customer may not settle any Claim Against Reveal unless it unconditionally releases Reveal of all liability), and (C) gives Customer all reasonable assistance, at Customer’s expense. The above defense and indemnification obligations do not apply if a Claim Against Reveal arises from Reveal’s breach of this Agreement or the Documentation. c. Exclusive Remedy. This “Mutual Indemnification” section states the indemnifying party’s sole liability to, and the indemnified party’s exclusive remedy against, the other party for any third party claim described in this section.
10. LIMITATION OF LIABILITY
a. Limitation of Liability. IN NO EVENT SHALL THE AGGREGATE LIABILITY OF EITHER PARTY
TOGETHER WITH ALL OF ITS RESPECTIVE AFFILIATES ARISING OUT OF OR RELATED TO THIS
AGREEMENT EXCEED THE TOTAL AMOUNT PAID BY CUSTOMER AND ITS AFFILIATES UNDER
THIS AGREEMENT FOR THE PRODUCT GIVING RISE TO THE LIABILITY IN THE TWELVE MONTHS PRECEDING THE FIRST INCIDENT OUT OF WHICH THE LIABILITY AROSE. THE
FOREGOING LIMITATION WILL APPLY WHETHER AN ACTION IS IN CONTRACT OR TORT
AND REGARDLESS OF THE THEORY OF LIABILITY BUT WILL NOT LIMIT CUSTOMER'S AND ITS AFFILIATES’ PAYMENT OBLIGATIONS UNDER THE “FEES AND PAYMENT” SECTION ABOVE. b. Exclusion of Consequential and Related Damages. IN NO EVENT WILL EITHER PARTY OR ITS
RESPECTIVE AFFILIATES HAVE ANY LIABILITY ARISING OUT OF OR RELATED TO THIS
AGREEMENT FOR ANY LOST PROFITS, REVENUES, GOODWILL, OR INDIRECT, SPECIAL,
INCIDENTAL, CONSEQUENTIAL, COVER, BUSINESS INTERRUPTION OR PUNITIVE DAMAGES,
WHETHER AN ACTION IS IN CONTRACT OR TORT AND REGARDLESS OF THE THEORY OF
10 LIABILITY, EVEN IF A PARTY OR ITS AFFILIATES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR IF A PARTY’S OR ITS AFFILIATES’ REMEDY OTHERWISE FAILS OF ITS ESSENTIAL PURPOSE. THE FOREGOING DISCLAIMER WILL NOT APPLY TO THE EXTENT PROHIBITED BY LAW.
11. Audits/Assessments
a. Customer Audit/Assessment Rights. During the term of any subscription to the Service hereunder, once per twelve-month period during the Term, Customer or its designee may perform an onsite security assessment of Reveal’s security program upon thirty (30) days’ advance written notice to Reveal. The onsite security assessment shall be performed during normal business hours, limited to two (2) business days’ duration, and shall include information, topics, and domains outside of the scope of Reveal’s SOC 2, Type II report, which report will be made available to Customer upon written request to Reveal. In addition, at Customer’s request, Reveal will provide the current SOC 2 audit report and a copy of its most recent Cloud Security Alliance Consensus Assessments Initiative Questionnaire (CSA CAIQ) as evidence that Reveal is maintaining the above controls for the Services. Customer acknowledges and agrees that information provided by Reveal pursuant to this section constitutes Reveal’s Confidential Information, and should Customer elect to utilize a designee to perform an onsite security assessment or review a written questionnaire as set forth herein, Customer agrees to enter into a confidentiality agreement or other similar instrument, subject to approval by the City of Santa Rosa City Attorney. with such designee that is as protective of Reveal’s Confidential Information as are the applicable provisions of the Agreement.
b. Omitted
12. TERM AND TERMINATION
a. Term of Agreement. This Agreement commences on the Effective Date and continues until all Order Forms entered into pursuant hereto have expired or been terminated (“Term”). b. Termination. A Party may terminate this Agreement (including each Order Form) for cause (i) upon 30 days written notice to the other Party of a material breach if such breach remains uncured at the expiration of such period, or (ii) if the other Party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation or assignment for the benefit of creditors.
c. Refund or Payment Upon Termination. If this Agreement is terminated by Customer in accordance with the “Termination” section above, Reveal will refund Customer any prepaid fees covering the remainder of the term of all Order Forms after the effective date of termination. If this Agreement is terminated by Reveal in accordance with the “Termination” section above, Customer will pay any unpaid fees covering the remainder of the term of all Order Forms to the extent permitted by applicable law. In no event will termination relieve Customer of its obligation to pay any fees payable to Reveal for the period prior to the effective date of termination.
d. Upon the termination of this Agreement or an applicable Order Form, however arising, the grant of the rights to the Customer (Sections 4 and 6.b) as well as support services (Exhibit A) shall terminate and the Customer shall destroy any copies of the Documentation in its possession (if any), and within 10 days of the termination shall certify in writing to Reveal that it has done so.
11 e. Surviving Provisions. The sections titled “Fees and Payment,” “Proprietary Rights and Licenses,” “Privacy Policy,” “Confidentiality,” “Disclaimers,” “Mutual Indemnification,” “Limitation of Liability,” “Refund or Payment upon Termination,” “Surviving Provisions” and “General Provisions” will survive any termination or expiration of this Agreement and the section titled “Protection of Hosted Data” will survive any termination or expiration of this Agreement for so long as Reveal retains possession of Hosted Data.
13. GENERAL PROVISIONS
a. Technology Export. Customer shall comply with all applicable U.S. export control laws and regulations for the exportation of software and technology. Customer acknowledges that the laws and regulations of the United States of America and foreign jurisdictions may restrict the export and re-export of certain commodities and technical data of United States of America or foreign origin, including the Products and/or the Service. Customer agrees that it will not export or re-export any Product without the appropriate United States or foreign government license or permits. Nothing in the section shall be deemed to grant any implied license to Customer that is not expressly set forth in this Agreement.
Without limiting the foregoing, Customer hereby represents that the following statements are true and will remain to be true during the Agreement Term: (a) Customer is not a citizen, national, or resident of, and are not under control of, the government of Cuba, Iran, North Korea, Syria, Venezuela, Russia, certain regions of the Ukraine (Donetsk, Luhansk and Crimea), nor any other country to which the United States has prohibited export; (b) Customer will not download or otherwise export or re-export any Product nor provide access to the Service, directly or indirectly, to the above mentioned countries nor to citizens, nationals or residents of those countries; (c) Customer is not listed on the United States Department of Treasury lists of Specially Designated Nationals, Specially Designated Terrorists, and Specially Designated Narcotic Traffickers, nor is Customer listed on the United States Department of Commerce Table of Denial Orders; and (d) Customer will not download or otherwise export or re-export the Products nor provide access to the Service, directly or indirectly, to persons on the above mentioned lists. The Customer shall defend, indemnify and hold the Reveal Group harmless from and against all claims and liability relating to a breach of this Section 13.a. b. Anti-Corruption. Neither Party has received or been offered any illegal or improper bribe, kickback, payment, gift, or thing of value from an employee or agent of the other Party in connection with this Agreement.
c. Government Restricted Rights. This section applies to all acquisitions of the Products or Services subject to this Agreement by or for the United States federal government, including by any prime contractor or subcontractor (at any tier) under any contract, grant, cooperative agreement, or other activity with the Federal government. The Products and Services and related documentation were developed at private expense and are “Commercial Items,” as that term is defined at 48 C.F.R. § 2.101, consisting of “Commercial Computer Software” and “Commercial Computer Software Documentation,” as such terms are used in 48 C.F.R. § 12.212 (for civilian agencies) and 48 C.F.R. § 227.7202 (for Department of Defense agencies), as applicable. Consistent with and subject to 48 C.F.R. § 12.212 and 48 C.F.R. §§ 227.7202-1 through 227.7702-4, as applicable, the Commercial Computer Software and Commercial Computer Software Documentation are being licensed to U.S. Government end users (a) only as Commercial Items and (b) with only such rights as are granted to all other end users pursuant to the terms herein. Any provisions of this Agreement inconsistent with federal procurement regulations or other federal law are not enforceable against the U.S. Government. Unpublished rights are reserved under the copyright laws of the United States. Customer shall not remove or deface any restricted rights notice or other legal
12 notice appearing in the Products and Services or on any packaging or other media associated therewith.
This section does not grant Customer or any and user any rights not specifically set forth in this Agreement, including without limitation any right to distribute the Products or Service to the United States federal government.
d. Entire Agreement and Order of Precedence. This Agreement is the entire agreement between Reveal and Customer regarding Customer’s use of the Service and supersedes all prior and contemporaneous agreements, proposals or representations, written or oral, concerning its subject matter. Neither Reveal nor Customer has entered into this Agreement in reliance upon any representation, warranty, covenant or undertaking of the other party that is not set out in this Agreement, including any Order Form, Exhibit or Appendix to this Agreement. The Parties agree that any term or condition stated in a Customer purchase order or in any other Customer order documentation (excluding Order Forms) is void. In the event of any conflict or inconsistency among the following documents, the order of precedence shall be:
(1) the applicable Order Form, including any attachment (2) any exhibit, schedule or addendum to this Agreement, (3) the body of this Agreement, and (4) the Documentation. Titles and headings of sections of this Agreement are for convenience only and shall not affect the construction of any provision of this Agreement.
e. Amendment. No amendment or modification of this Agreement shall be effective unless it is set out in writing, expressed to amend this Agreement and signed by or on behalf of each of the parties. f. Relationship of the Parties. The Parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the Parties.
Each Party will be solely responsible for payment of all compensation owed to its employees, as well as all employment-related taxes.
g. Third-Party Beneficiaries. There are no third-party beneficiaries under this Agreement. h. Waiver. No failure or delay by either Party in exercising any right under this Agreement will constitute a waiver of that right.
i. Force Majeure. No delay, failure, or default, other than a failure to pay fees when due, will constitute a breach of this Agreement to the extent caused by hurricanes, earthquakes, epidemics, other acts of God or of nature, strikes or other labor disputes, riots or other acts of civil disorder, acts of war, terrorism, acts of governments such as expropriation, condemnation, embargo, changes in laws, and shelter-in- place or similar orders, or other causes beyond the performing Party’s reasonable control. j. Severability. If any provision of this Agreement is held by a court of competent jurisdiction to be contrary to law, the provision will be deemed null and void, and the remaining provisions of this Agreement will remain in effect.
k. Assignment. Neither Party may assign any of its rights or obligations hereunder, whether by operation of law or otherwise, without the other Party’s prior written consent (not to be unreasonably withheld); provided, however, either Party may assign this Agreement in its entirety (including all Order Forms), without the other Party’s consent to its Affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Notwithstanding the foregoing, if a Party is acquired by, sells substantially all of its assets to, or undergoes a change of control in favor of, a direct competitor of the other Party, then such other Party may terminate this Agreement upon written notice.
13 Subject to the foregoing, this Agreement will bind and inure to the benefit of the Parties, their respective successors and permitted assigns.
l. Notices. Except as otherwise specified in this Agreement, shall be in writing and shall be sent to the other Party at the address for the Customer specified in an Order Form or as may be updated pursuant to this Agreement. Notices shall be delivered by courier (e.g., registered mail, Federal Express, UPS), etc., and shall be deemed communicated when delivered. Notices to Reveal shall be sent to:
Reveal Data Corporation
145 S. Wells St., Ste. 600
Chicago, Illinois 60606
Attn: Chief Revenue Officer
[email protected]
With a copy (which shall not constitute notice) to:
[email protected]
m. Governing Law. This Agreement, and any disputes arising out of or related hereto, will be governed exclusively by the internal laws of the State of California, USA without regard to its conflicts of laws rules.
n. Dispute Resolution. If a dispute arises out of or relates to this Agreement, or the breach thereof, and if said dispute cannot be settled through negotiation, Customer and Reveal agree first to try in good faith to settle the dispute by mediation to be held in Sonoma County, California and administered by the American Arbitration Association under its Commercial Mediation Rules, before resorting to arbitration, litigation, or some other dispute resolution procedure. The foregoing process shall not apply to Reveal’s collection of unpaid amounts or to any action by Customer or Reveal to seek injunctive or other equitable relief.
o. Venue. In the event that a dispute cannot be remedied through negotiation, mediation, or other dispute resolution methods, the state and federal courts located in Sonoma County, California will have exclusive jurisdiction over any dispute relating to this Agreement, and each Party consents to the exclusive jurisdiction of those courts.
p. Counterparts. Any Order Form made pursuant to this Agreement may be executed electronically and in counterparts.
Signed by each Party’s authorized representative:
Reveal
By: _________________________________
Print Name:__________________________
Title: _______________________________
Customer:
By:_________________________________
Print Name:__________________________
Title:____Mayor________________________
14 Date: _______________________________
Print Name:__________________________
Title: _______________________________
Date: _______________________________
Date: _______________________________
APPROVED AS TO FORM:
____________________________
Office of the City Attorney
15 Exhibit List:
Exhibit A – Support Guide
Exhibit B – Service Level Agreement (for the Service)
Exhibit C – Security Guide
16 Exhibit A –Support Guide
This Support Guide (“Guide”) is subject to, incorporated in, and being entered into pursuant to the Main Subscription Agreement (“Agreement”) between Reveal and Customer. Any capitalized terms used but not defined in this Guide shall have their meanings set out in the Main Agreement.
1. HELP DESK
Reveal shall operate a Help Desk facility to provide the Customer with assistance relating to day- to- day inquiries in respect of the use or operation of the Service. If Reveal receives excessive requests for such technical assistance which are reasonably attributable to lack of training in the use of a Product on the part of the Customer’s Users, then Reveal reserves the right to provide such additional technical advice for a fee and pursuant to a written statement of work executed by Customer and Reveal..
2. FAULT CORRECTION
For the purpose of this Maintenance & Support Guide, a “Fault” shall mean an error or type of action or incident that occurs when a Product fails to perform as warranted under this Agreement. The Customer shall arrange for all Fault reports to be coordinated through a single point of contact before being passed to Reveal’s Help Desk for action.
Faults shall be categorized according to their severity, as follows:
Level 1 - means an error that has a material to critical business impact on a production system, resulting in Customer’s production system being either down, or functioning at a materially reduced capacity or with materially reduced functionality.
Level 2 – means an error that has some business impact on a production system, resulting in some non-material functionality or loss on Customer’s production system. The Product is usable, but does not provide a non-material function in the most convenient or expeditious manner.
Level 3 - means an Error that does not rise to the level of Medium Severity or High Severity, questions including general usage questions, issues related to a non-production environment, or feature requests. There is no impact on the quality, performance or functionality on Customer’s production system.
2.1 Reveal shall endeavor to correct Faults in a reasonable timescale with due regard to their impact on the Customer’s business.
2.2 Reveal shall use commercially reasonable efforts to advise Customer within the specific initial response timeframe set forth in paragraph 2.5 the proposed action or interim strategy to be adopted in response to a reported Fault, according to the severity level defined in paragraph 2.3.
2.3 Upon receipt of reporting a Fault by email to [email protected], portal at support.revealdata.com, or by phone at 877.351.3282, the Reveal Support Team will respond as detailed below.
Priority Initial Response Time Target Resolution Time Level 1 Issue 1 hours 1 business day Level 2 Issue 2 hours 5 business days Level 3 Issue 4 hours Next maintenance update
If Customer’s staff member who submitted the support ticket or alternative point of contact as designated in said support ticket is not available, Reveal will not be responsible for adhering to the Initial
17 Response Time set forth in this paragraph 2.5. At no time does Reveal guarantee a “fix” or correction during a Target Resolution Time. In connection with reporting any Fault, the Customer will be required to provide Reveal’s Support team with a sample of the items perceived to be causing the error. Reveal will provide support and Fault correction services without these items, but providing these items immediately will help to reach resolution for any Fault more quickly. In addition, in some cases the Service may not conform to the Documentation because of a documentation error, rather than a software error, in which case Reveal shall provide corrections to, or corrected, Documentation.
2.4 Level of Effort: Reveal will use commercially reasonable efforts commensurate with the then applicable industry standards to provide the Support and Fault correction in a professional and workmanlike manner, but Reveal does not guarantee that every question or problem raised by the Customer will be resolved.
2.5 Exclusions to Support and Fault Correction Support and Fault Correction does not include custom development, consulting, or professional services. Furthermore, the following do not constitute Support or Fault correction covered by this Agreement:
a) Administrator or end user training; b) Customer requested enhancements and features; c) Environment provisioning; d) Environment configuration; e) Environment troubleshooting issues not associated with the Service; f) Troubleshooting problems with data that was not formatted in accordance with Reveal’s standard load file specifications; g) Environment monitoring tools (On-Premises Deployments); h) Autoscaling automations (On-Premises Deployments); and i) Multitenancy automations (On-Premises Deployments).
2.6 Reveal shall notify the Customer of all Fault corrections once complete. The Customer shall comply with all instructions provided by Reveal relating to the implementation of the Fault correction, if any.
2.7 If, after investigation by Reveal and the Customer, Reveal reasonably determines that the suspected Fault arose due to: (a) the Customer’s improper use of the Service (including failure to use the Service in accordance with the Documentation), (b) any fault in the Customer Facilities; (c) the Service’s failure to function or provide accurate results because of erroneous or incomplete Hosted Data, or (d) operator error, then Reveal shall be entitled to charge the Customer on a time and materials basis at its then current rates for consulting services for any work carried out in respect of that suspected Fault, pursuant to a statement of work entered into by and between the parties.
2.8 Reveal shall use its commercially reasonable efforts to provide Fault correction on a 24-7 basis when the Customer reasonably stipulates that the Fault is a Level 1 Fault.
2.9 Global Support. Reveal provides Products to Customers around the globe and deploys a worldwide team to support this global reach. Customer is advised that Reveal and its Affiliates’ Support staff will be located in the applicable jurisdictions in which such Support staff are located, which, as of the date of this Agreement, are: the United States, Canada, United Kingdom, Europe, India and Australia.
2.10 Access to Hosted Data. If required to address a Fault, Reveal and its Affiliates may be required to access Customer’s account or Hosted Data for the exclusive purpose of addressing a Fault. Such access will be made in accordance with Reveal’s security, privacy, and confidentiality policies and procedures as outlined in the Main Agreement, the Security Guide and Privacy Policy. In addition, Customer will, upon request, send Reveal screenshots or share screens with Reveal via a videoconference or remote session or provide other assistance and cooperation reasonably required for Reveal to address a Fault.
2.11 Changes to Customer Support Plans. Reveal, in its sole discretion, may change any aspect of
18 its Customer Support plans at any time. In the case that a change results in a material reduction or material adverse effect on the support to be rendered to Customer, such material reduction or effect will not take place during the Customer’s paid subscription term without prior consultation with and agreement by the Customer.
3. DOCUMENTATION
The Documentation may be updated from time to time to reflect the changes by Reveal to the Products and such updates shall be made available to the Customer online.
OMITTED.
19 Exhibit B – Service Level Agreement
This Service Level Addendum (“SLA”) is subject to, incorporated in, and being entered into pursuant to the Main Subscription Agreement (“Main Agreement”) between Reveal and Customer. Any capitalized terms used but not defined in this SLA shall have their meanings set out in the Main Agreement.
1. DEFINITIONS
a. “Customer Cause” means any of the following causes of an Service Level Failure: (a) any negligent or improper use, misapplication, misuse, or abuse of, or damage to, the Service by Customer; (b) any maintenance, update, improvement, or other modification to or alteration of the Service by Customer; (c) any use of the Service in a manner inconsistent with the then-current Documentation; (d) any use by Customer of any third-party products that Reveal has not provided or caused to be provided to Customer; (e) any use by Customer of a non-current version or release of the Services; or (f) the Customer Systems;. b. “Customer Systems” means Customer's information technology infrastructure, including Customer's computers, software, databases, electronic systems (including database management systems), and networks.
c. “Earn Back” means, following a claimed Service Level Failure, Reveal revokes or reduces the Service Credits granted to Customer.
d. “Service Credits” means an option, granted to Customer, to extend Customer’s subscription for the Service at no additional charge for the specified time period. e. “Service Level Failure” means a violation of the Uptime Guarantee that results in the issuance of a Service Credit by Reveal to Customer.
2. CUSTOMER RESPONSIBILITIES
a. In order to qualify for a Service Credit pursuant to this SLA, Customer shall:
i. Provide information, support, cooperation and any necessary authorizations as required by Reveal for performing the Services and complying with this SLA. Any information, support, cooperation or authorizations provided by Customer to Reveal as required to provide the Services and comply with this SLA shall be accurate and timely.
ii. Comply with all terms of the Main Agreement, including adhering to policies and processes established by Reveal for reporting Service Level Failures and incidents and prioritizing service requests. iii. Pay all Fees and other costs and expenses as required pursuant to the Main Agreement.
3. UPTIME GUARANTEE AND SERVICE CREDITS
a. The Services will be available at least 99% of the time, as measured on a per-minute basis every month, subject to the exclusions set forth below (“Uptime Guarantee”). b. Reveal will make commercially reasonable efforts to promptly notify Customers of any known period of unavailability and a further notice when the Service disruption has ended.
20 c. Reveal reserves the right, at any time, in Reveal’s sole and absolute discretion, to temporarily suspend or otherwise deny access to or use of the Service, without incurring obligation or liability under this SLA or the Main Agreement, for: (a) emergency maintenance; (b) maintaining the security or integrity of Reveal’s network, hardware, or associated systems or those of Reveal’s third party cloud provider; (c) unusual spikes in activity or usage of the Service; or (d) judicial or other governmental demand or order, subpoena or law enforcement request that expressly or by reasonable implication requires Reveal to do so. Any such interruption shall not be considered in determining whether the Uptime Guarantee has been met.
d. Reveal's procedures, delivery of Services, and ability to comply with this SLA may be affected by Customer Causes or changes in applicable laws or regulations. In such cases, Reveal shall bear no responsibility for any directly resulting harm incurred by Customer, and any such harm shall not be considered in determining whether the Uptime Guarantee has been met.
e. Maintenance shall include, but is not limited to, quarterly planned maintenance window if needed, brief planned maintenance windows (scheduled in advance, as needed), and emergency maintenance windows (critical, unforeseen maintenance needed for the security or performance of the platform). Any such interruption shall not be considered in determining whether the Uptime Guarantee has been met.
Reveal will make commercially reasonable efforts to provide notice of scheduled maintenance that may materially affect the access and use of the Service at least twenty-four (24) hours in advance. f. If Reveal fails to meet the Uptime Guarantee in any calendar month, provided such error did not result from a Customer Cause, Customer will be eligible to receive a Service Credit as specified below, which will be the sole and exclusive remedy for any failure by Reveal to meet its commitments under this SLA.
Customer shall not be entitled to any other rights or remedies set forth in the Main Subscription Agreement or elsewhere for a Service Level Failure.
Monthly uptime percentage Unpermitted Downtime Subscription Extension ≥ 98% < 99% uptime >7 hrs 5 days
≥ 96% < 98% uptime >14 hrs 15 days
< 96% uptime >24 hrs 30 days
4. NOTIFICATION PROCESS
a. Customer must notify Reveal at [email protected] within 30 days after the end of the month in which Reveal allegedly violated the Uptime Guarantee (“Violation Notification”) in order to receive a Service Credit.
b. For any partial calendar month during which Customer subscribes to the Service, availability and compliance with the Uptime Guarantee will be calculated based on the entire calendar month, not just the portion for which Customer subscribed.
5. EARN BACK PROCESS
21 a. Reveal may Earn Back some or all Service Credits granted to Customer for a violation of the Uptime Guarantee as follows:
i. Within 30 days following Reveal’s receipt of a Violation Notification, Reveal shall submit to Customer a report including:
1. Statistics showing Reveal's performance of the applicable Service for the month in which a Service Level Failure is alleged to have occurred
2. The type of Service Credits imposed for such Service Level Failures. b. If Reveal's average performance during the relevant month equals or exceeds the Uptime Guarantee, then Reveal shall be relieved from paying any Service Credits assessed during the relevant month.
22 Exhibit C – Security Guide
Introduction
Reveal has architected its infrastructure, software, and processes with the security of our customers’ data as a primary goal. We are committed to maintaining the confidentiality and integrity of Hosted Data while endeavoring to provide you continuous access to our systems and applications. For clarity, this Reveal Security Statement forms part of the Main Agreement. References to “client”, “data owner” or similar terms refer to the Customer and if applicable, its Affiliate(s).
1. Confidentiality, Privacy, and Encryption
• All Hosted Data in motion that traverses open, untrusted networks such as the public Internet are encrypted, and such encryption carried out using a secure version of TLS for all publicly available endpoints.;
• All Hosted Data at rest are encrypted;
• Encryption is implemented with open source and industry-standard technologies to include a secure version of Transport Layer Security (TLS), Secure Shell/Secure FTP (SSH/SFTP), and AES 256 as acceptable encryption algorithms or cryptographic algorithms and process that meet or exceed the guidelines in NIST Special Publication 800-175B or any successor standard; • Services have a default setting so that email messages between Customer and Reveal will be encrypted leveraging Forced Transport Layer Security (TLS). Encryption technology used adheres to applicable legal requirements governing the use of such technology. Email messages to Customer users who do not use the Customer email domain will be encrypted by Opportunistic TLS. • Reveal maintains separate regional environments to provide assurance of data locality. Hosted Data is stored only in the designated production environment in the region which the Customer selects in accordance with the Main Agreement;
• When not restricted by law, we will notify the Customer promptly, upon of the receipt of demand to release data and we will use our best efforts to resist any demand and to obtain the ability to notify data owners of demands where otherwise restricted by law;
• Hosted Data are not shared with third parties except when explicitly requested by the data owner.
2. Availability
• All Hosted Data are stored at Tier III+ data centers that guarantee 99.982% uptime; • We maintain active server and data resources in multiple data centers within each geographic region; • All Hosted Data are replicated to multiple data centers within a region; and • Our application service architecture has been designed to be resilient to outage of entire data centers.
23 3. Application
• The Service maintains robust audit logs detailing actions undertaken by each user account; • The Service implements granular access control policies that control which functions and resources a user may access;
• Password policies and session timeouts are enforced;
• All requests sent to the application are inspected before being sent to the application in order to detect anomalies and to enforce policy;
• Reveal is part of a program sponsored by the major Internet browsers whereby those browsers will not communicate with our resources unless they are encrypted using SSL and using a valid and trusted SSL certificate;
• Services are powered by high availability proxies and load balancers to ensure availability and quality of service; and
• Two-factor authentication can be enabled and enforced for all users on a per case or per-environment basis.
4. Development and Coding Practices
• Development and testing environments are maintained separately from production environments; • No data, work product, or key material are shared between production and test environments; • Releases are tested in our development and staging environments prior to installation; • Development, testing, and compliance teams are separate to provide for separation of duties and maintain software quality;
• All development personnel are trained in security awareness and secure coding, and coding standards have a strong security component. The coding standards are reviewed annually and maintained to be up to date in accordance with the prevailing standards; and • All source code changes go through a mandatory pull request workflow to ensure peer review for code quality and adherence to coding standards. Each commit into a Reveal code base requires an approval from another engineer. The approver reviews for compliance with Reveal’s coding standards prior to accepting any code change.
5. Environmental Integrity
• All Hosted Data are housed at data centers that have implemented controls in alignment with ISO/IEC 27001, and SOC 1/2/3;
• By default, all servers are restricted from sending data to the public Internet;
24 • All servers are configured to only allow communication using those protocols and ports required for operating. All other traffic is denied;
• User applications, such as browsers, that may potentially access untrusted resources on the Internet are executed inside of a sandbox;
• Host-based and network-based intrusion detection systems are in place; • File integrity checks are in place to prevent the modification of application, operating system, and other trusted files;
• Network and system logs are aggregated and monitored to detect anomalies; and • Access to environments containing client data requires two-factor authentication.
6. Administrative Controls
• Human resource process includes background checks, non-disclosure, and acceptance of policies; • Reveal has staff involved at all levels of operation that maintain certification in the practice of information security; and
• Reveal has a robust information security awareness program for all staff members. This includes periodic training programs and frequent drills and tests for all employees.
7. Audit and Certifications
Reveal will ensure that the Service, the infrastructure providing the Service, the management infrastructure used to manage the Service and all data centers used in providing the Service (including for management, back-up or disaster-recovery purposes) are compliant with ISO / IEC 27001 or a comparable security standard related to the processing of Hosted Data. Reveal maintains an SSAE18 SOC 2, Type II audit report covering any system or process that stores or processes Hosted Data.
At Customer’s request, Reveal will provide the current SOC 2 audit report and a copy of its most recent Cloud Security Alliance Consensus Assessments Initiative Questionnaire (CSA CAIQ) as evidence that Reveal is maintaining the above controls for the Services.
8. Disposal
Customer may delete or export Hosted Data from the Service from time to time in Customer’s discretion during the Term of the Main Agreement. Upon receiving Customer’s written request to decommission its Service, Reveal will delete Hosted Data such that Hosted Data is rendered inaccessible, undecipherable, or otherwise unrecoverable and using industry standard deletion procedures.
9. Disaster Recovery / Business Continuity Plans
25 Reveal has disaster recovery / business continuity plans in place and has established RTO and RPO timelines These plans include replicating data and services to multiple availability zones within a region and a formal framework by which an unplanned event will be managed to minimize the loss of vital resources. The formal framework includes a defined back-up policy and associated procedures, including documented policies and procedures designed to: (a) perform back-up of data to multiple availability zones in a scheduled and timely manner; (b) provide effective controls to safeguard backed-up data; (c) securely transfer Hosted Data to and from back-up location; and (d) fully restore applications and operating systems; (e) demonstrate periodic testing of restoration from back-up location. Backups are encrypted in compliance with the encryption requirements noted above.
10. Security Monitoring & Automated Vulnerability Scans
Reveal monitors the Service, including error logs on servers, disks, and security events for any potential problems.
• Subscribing to vulnerability intelligence services or to information security advisories and other relevant sources providing current information about system vulnerabilities (none of which involves the submission of any Hosted Data);
• Reviewing changes affecting systems handling authentication, authorization, and auditing; • Reviewing privileged back-end access to validate privileged access is appropriate; and • Engaging third parties to perform vulnerability assessments and penetration testing on a regular basis (at least annually).
• Maintaining industry standard event logging for servers, applications, and networking equipment to facilitate security incident and event management. Maintaining logs for at least one year (the first 90 days of which is in readily available hot status, and the remainder of which is in cold storage). • Reveal will (i) classify vulnerabilities based on actual risk in accordance with industry standard risk rating methodologies, such as, NIST, and (ii) work in a dedicated and professional manner, taking into account the team’s knowledge, expertise, and relevant factors, to mitigate or remediate vulnerabilities in Service infrastructure or applications that could allow direct unauthorized access to Hosted, whether by applying an available patch or taking other reasonable actions within set time frames. Reveal will provide those time frames on request.
11. Customer Access Control
To ensure secure access to the environment, customer access may be enforced and only be possible through Single Sign-On (SSO). This measure will enhance security by centralizing authentication and providing a seamless login experience for customers.