Master Services Agreement

1. Introduction and Definitions

1.1 Parties

This Master Services Agreement (the "Agreement") may be used by Crushable LLC and by Cyber Risk Analysis Group, LLC, doing business as Crushable, each a South Carolina limited liability company located at 25 Goldsmith St, Greenville, SC 29609 (each, a "Crushable Entity"), with the client identified in an Order Document ("Client"). For each Order Document, "Crushable" means only the Crushable Entity that signs that Order Document. That Crushable Entity is the only Crushable party to that Order Document and to this Agreement as it applies to that Order Document, and it alone is responsible for Crushable's obligations under them. The other Crushable Entity is not a party to, and has no liability under, that Order Document, and Client will look solely to the signing Crushable Entity for performance and for any claim arising out of it. Crushable and Client are each a "Party" and together the "Parties." References in this Agreement to intellectual property, materials, or rights owned by Crushable include those owned by either Crushable Entity, and the signing Crushable Entity grants the licenses in this Agreement and the Order Document on behalf of the Crushable Entity that owns the licensed item. Crushable may perform the Services through subcontractors, including the other Crushable Entity, under Section 17.5.

1.2 How This Agreement Works

This Agreement sets the general terms for everything Crushable provides. The specific services, deliverables, fees, and term for each engagement are set out in an Order Document. This Agreement has general terms that apply to every engagement (Sections 1, 2, and 7 through 18) and service-specific terms that apply only when an Order Document includes that type of service:

• Section 3: xOPS Platform and Software Development. Platform licenses, application development and maintenance, license vesting, and source-code escrow.
• Section 4: Managed Services. Managed IT, help desk, security operations, and managed cloud infrastructure.
• Section 5: Professional Services. Project-based cloud, infrastructure, and consulting work.
• Section 6: AI Services and Responsible AI. Applies to every engagement that includes AI capabilities, including xOPS.

1.3 Definitions

• "Affiliate" means an entity that controls, is controlled by, or is under common control with a Party.
• "Application" means a discrete business application that Crushable builds for Client on the Platform, as identified in an Order Document.
• "Application Deliverables" means the application-specific source code, configurations, prompts, workflow definitions, business logic, tests, and infrastructure-as-code that Crushable builds for Client for an Application under an Order Document. Application Deliverables do not include the Platform, Crushable Tools, Third-Party Components, or Client Data.
• "Client Data" means data, content, documents, and business rules that Client or its users submit to, store in, or make available through the Services, including outputs generated from that data for Client.
• "Continuity Event" means Crushable (a) ceases to do business in the ordinary course, (b) becomes insolvent, makes a general assignment for the benefit of creditors, or becomes the subject of a bankruptcy, receivership, or liquidation proceeding that is not dismissed within sixty (60) days, or (c) otherwise becomes unable to continue providing the maintenance and support that Client has elected and is paying for, and does not cure that inability within thirty (30) days after Client's written notice.
• "Crushable Tools" means Crushable's generalized agentic development frameworks, software frameworks, reusable components, templates, scripts, know-how, and delivery tooling, whether they exist before an engagement or are developed during it.
• "Deliverables" means the specific work product identified as a deliverable in an Order Document.
• "Excluded Claims" has the meaning in Section 13.3.
• "Managed Services" means ongoing IT, security, help desk, monitoring, and infrastructure operations services described in Section 4 and an Order Document.
• "Order Document" means a Statement of Work ("SoW"), Platform Agreement, Application Agreement, Infrastructure Services Agreement, quote, or purchase order that references this Agreement and is signed or accepted in writing by both Parties.
• "Platform" means Crushable's xOPS software platform, including its Core services, AI engine (the "Brain"), shared framework, design system, platform infrastructure-as-code, and all updates to them.
• "Professional Services" means project-based consulting, architecture, migration, implementation, and assessment services described in Section 5 and an Order Document.
• "Security Incident" means a confirmed breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to Client Data in Crushable's possession or control.
• "Service Output" means output that the Services generate while operating, including AI-generated responses, recommendations, summaries, classifications, and extractions. Application Deliverables are not Service Output, even though Crushable produces them using AI agents and automation.
• "Services" means everything Crushable provides under an Order Document, including Managed Services, Professional Services, software development, Platform and Application licenses, AI services, and resold products.
• "Third-Party Components" means software, services, AI models, libraries, cloud platforms, and hardware that are provided by someone other than Crushable, including open-source software, even if Crushable selects, resells, integrates, or configures them.

---

2. Order Documents and Order of Precedence

2.1 Order Documents

Services begin only after both Parties approve an Order Document in writing. Each Order Document is a separate contract that incorporates this Agreement. An Affiliate of Client may enter into its own Order Document under this Agreement, and in that case the Affiliate is "Client" for that Order Document.

2.2 Changes

Changes to the scope, schedule, or fees of an Order Document require a written change request ("Change Request") approved by both Parties. Crushable will describe the effect of each requested change on timeline and cost before Client approves it. Until a Change Request is approved, work continues under the existing Order Document.

2.3 Order of Precedence

This Agreement and each Order Document are read together. If they conflict, the following order controls, from highest to lowest:

1. The Order Document's specific provisions on license grant, vesting and survival, retention of materials, license payment and acceleration, and source-code escrow. These control over any contrary term in this Agreement.
2. This Agreement, including its warranties, indemnities, limitations of liability, and disclaimers, except that a provision of an Order Document controls over this Agreement for that Order Document only if it expressly identifies the section of this Agreement it modifies and states the modification.
3. The remainder of the Order Document.
4. Any schedules, appendices, or exhibits to the Order Document.

A Business Associate Agreement controls over all of the above with respect to Protected Health Information, as described in Section 10.3. A purchase order is operative only to identify quantities, prices, and billing references for Services described in another Order Document or a Crushable quote. Other terms in Client's purchase orders, vendor portals, invoicing systems, or click-through terms do not apply and are rejected, even if Crushable accepts or processes the document, unless the Parties expressly agree to them in a signed Order Document.

2.4 General Client Responsibilities

For every engagement, Client will:

• provide timely, reasonable access to the systems, data, credentials, facilities, and personnel Crushable needs, through secure channels;
• designate a primary point of contact who can make decisions and who responds to Crushable's requests within one (1) business day;
• provide accurate and complete information, and have the legal right to provide the data and materials it gives Crushable;
• maintain the licenses, subscriptions, and third-party contracts that Crushable does not provide under an Order Document;
• tell Crushable in advance about material changes to its systems, network, vendors, or operations that may affect the Services; and
• review and approve Crushable's requests, deliverables, and changes within the time periods stated in the Order Document.

Crushable is not responsible for delays, defects, or service-level misses caused by Client's failure to meet these responsibilities. Crushable may charge for reasonable additional costs caused by that failure, with prior notice where practical. Where an Order Document bills reserved capacity (for example, a monthly Development Workstream fee), the fee continues during delays caused by Client.

2.5 Satisfaction Guarantee

If an Order Document expressly includes Crushable's satisfaction guarantee and Client is dissatisfied with the Services, Crushable will work to fix the issue. If Crushable cannot fix it to Client's reasonable satisfaction, Crushable will refund the fees paid for the affected Services during the thirty (30) days before Crushable received Client's written notice. The guarantee does not apply to license fees, pass-through costs, or resold products.

---

3. xOPS Platform and Software Development

This Section applies to Order Documents that include a Platform license, an Application, or software development and maintenance services.

3.1 Platform License

(a) Grant. Subject to this Agreement and payment of the applicable fees, Crushable grants Client a non-exclusive, non-transferable (except under Section 17.4) license to use and operate the Platform components required to run Client's Applications, for Client's internal business purposes, during the term of the applicable Order Document. This license does not depend on Client continuing to buy development, maintenance, or infrastructure services, unless the Order Document says otherwise.

(b) License models. Each Order Document states whether the Platform license is:

• a Subscription License, which lasts for the subscription term and ends when the subscription ends; or
• a Vesting License, which is paid through a license fee and becomes perpetual under Section 3.6.

If the Order Document does not say, the license is a Subscription License.

(c) Ownership. Crushable owns the Platform and Crushable Tools. No ownership transfers to Client. Client may not redistribute, sublicense, resell, or offer the Platform to third parties, or use it to build a competing product or service.

3.2 Application Deliverables

(a) Grant. Subject to payment of the applicable fees, Crushable grants Client a non-exclusive license to use, operate, maintain, support, modify, and extend the Application Deliverables for Client's internal business purposes, on the licensed Platform. Client may exercise these rights itself or through a third-party contractor of its choice who is bound by written confidentiality obligations at least as protective as Section 9.

(b) Ownership. Crushable retains ownership of the Application Deliverables unless an Order Document expressly assigns ownership to Client. The license to the Application Deliverables includes the right to run them on the licensed Platform, but it does not transfer ownership of, or grant rights to redistribute, the Platform.

(c) Client business content. Client's business content and configuration data remain Client's property. This includes Client's process definitions, routing assignments, mappings, interpretation rules, and the contents of Client's source systems and repositories. Application Deliverables include the software that applies and processes this content, not the content itself.

3.3 Development Workstreams and Application States

Unless an Order Document provides otherwise, each Application is always in one of three states. Only the fee for the current state is billed.

State	What's included	What's not included
Development (also called "Active")	Designing, building, and deploying new features, enhancements, fixes, and polish; adopting Platform advances, security updates, and dependency updates into the Application ("base updates"); fixing defects	Entirely new Applications, which need their own Order Document
Maintenance	Bug fixes (the Application isn't doing what was already built and accepted), security fixes, dependency upkeep, and small polish that doesn't add capability	New features or capabilities beyond what was accepted; adoption of new Platform capabilities
Retired	The Application keeps running in its then-current state under Client's license	Maintenance, support, corrections, security updates, and compatibility updates

(a) Changing states. Client chooses each Application's state, subject to any minimum commitment in the Order Document. A change takes effect at the start of the next billing month. If Client requests a new feature for an Application in Maintenance, Crushable will provide a written estimate, and once Client approves it in writing, the Application moves to Development for that work and returns to Maintenance when the work is accepted.

(b) Classification. Crushable will classify each request as a defect, polish, or new feature in good faith and explain its reasoning. If Client disagrees, the Parties will discuss it, but work continues under Crushable's classification until the Parties agree on a change.

(c) Retired Applications. Crushable has no obligation to maintain or support a Retired Application. Maintenance may be reinstated at Crushable's then-current rates, which may include a reasonable fee to bring the Application current. Retiring an Application does not reduce or cancel any unpaid license balance.

(d) Platform maintenance. If the Order Document includes Platform maintenance and support, Crushable keeps the licensed Platform healthy for as long as Client pays for it: patching, dependency and security upkeep, monitoring of Platform components Crushable operates, and support for the Core services Client's Applications rely on. New Platform capabilities are adopted into an Application only while that Application is in Development.

3.4 Continuous Development

Unless an Order Document replaces these terms with a different structure (for example, fixed-scope Development and Maintenance Workstreams with UAT acceptance), development is continuous:

(a) Fixes, enhancements, polish, and base updates for an Application in Development are delivered on an ongoing basis within the monthly Development fee, with no separate implementation project, change orders, or version-upgrade fees.

(b) Crushable prioritizes the backlog with Client at a regular cadence. The monthly Development fee buys reserved capacity, not a fixed list of features. Crushable does not guarantee that any particular feature will be delivered by a particular date unless the Order Document says so.

(c) Because development is continuous, Crushable corrects defects on an ongoing basis at no additional charge for as long as the Application is in Development or Maintenance, rather than for a fixed warranty period after a release. This is Client's remedy for defects in Application Deliverables, and it replaces the warranty period in Section 11.2 for Application Deliverables. A "defect" is a failure of the Application Deliverables to perform materially as designed or as accepted.

(d) Entirely new Applications and new integrations with systems not identified in the Order Document require a new Order Document or Change Request.

3.5 Agentic Development, Change Control, and Acceptance

(a) Agentic development. Crushable builds software and infrastructure-as-code using AI agents and automation directed and supervised by Crushable personnel. Client accepts that its software and infrastructure are produced this way. Crushable follows a secure agentic development lifecycle, which includes code review, dependency scanning, open-source license scanning, automated testing, security testing, and auditable pull request and release records. Controls may be performed by agents or automation except where the Order Document specifies human performance.

(b) Human approval before production. Every change to a production Application is raised as a pull request, and it merges and deploys only after Client's approval, unless Client has delegated approval authority to Crushable in writing. Client may review pull requests and release evidence, and acknowledges that detailed human review may slow delivery. Crushable provides release notes with each production release and keeps audit records available on request.

(c) Acceptance. Unless an Order Document provides for milestone or UAT acceptance, Client's approval of a pull request is acceptance of that change. If an Order Document provides for UAT acceptance:

• the Order Document or an approved written test plan defines the acceptance criteria;
• a deliverable is accepted when it meets those criteria and no Critical or High issues remain open (Medium and Low issues go on a punch list that Crushable resolves during Maintenance);
• a deliverable is deemed accepted if Client does not report an open Critical or High issue within five (5) business days after the UAT window ends, or if Client starts using it for live business activity rather than testing; and
• a request for something outside the agreed scope is a new feature, not a reason to withhold acceptance.

(d) Emergency changes. Crushable may apply emergency security fixes without prior approval when waiting would expose Client to material risk. Crushable will notify Client promptly and submit the change for after-the-fact review.

3.6 License Fees, Vesting, and Acceleration

This Section applies to Vesting Licenses.

(a) Fee and installments. The Order Document states the license fee for the Platform and each Application, and whether it is paid in installments. Installments are an accommodation for payment of a single license fee. They are not a subscription.

(b) Earning and acceleration. The license fee for the Platform is fully earned when the Order Document is signed or, if the Order Document states a later License Start Date, on that date. The license fee for each Application is fully earned when that Application is first deployed to production or, if the Order Document provides for UAT acceptance, when it is accepted, unless the Order Document states a different earning event. If the Order Document ends before the earned license fees are paid in full, for any reason other than Crushable's uncured material breach or Crushable's termination for convenience, or if a Continuity Event occurs, the unpaid balance of the earned license fees accelerates and becomes due immediately. License fees for an Application that has not been earned when the Order Document ends are not due, and Client receives no license to that Application. Client may pay the remaining earned balance at any time.

(c) Vesting. Until the license fee is paid in full, Client has the right to use and operate the licensed Platform components and Application Deliverables during the term of the Order Document. When the license fee is paid in full, whether through scheduled installments, prepayment, or the accelerated balance, or upon a Continuity Event (with any unpaid balance then due), the license automatically becomes a perpetual, irrevocable, worldwide, fully paid-up, non-exclusive license (i) to use, execute, maintain, modify, and support the Application Deliverables, and (ii) to use, execute, and maintain the licensed Platform components in the form deployed for Client, in each case for Client's internal business purposes. After a Continuity Event, the vested license also includes the right to modify and support the licensed Platform components as needed to keep Client's Applications operating. Client may exercise the license itself or through a third party bound by confidentiality obligations.

(d) Survival. A vested license survives expiration or termination of this Agreement, the Order Document, and any maintenance or infrastructure service. It controls over any conflicting return, deletion, or license-termination provision in this Agreement. After vesting, Client may keep and use the code, configurations, prompts, documentation, and escrow materials needed to use, operate, maintain, modify, support, and transition its Applications, subject to the vested license.

(e) Limits. A vested license does not include ownership, rights to redistribute or sublicense to third parties (other than contractors acting for Client), future updates (which are provided only while maintenance is paid for), or rights to Third-Party Components beyond what their own licenses allow. The restrictions in Sections 3.1(c) and 8.3 continue to apply after vesting, except to the extent the vested license expressly permits the restricted activity.

3.7 Source-Code Escrow and Continuity

(a) Election. Escrow applies only if the Order Document includes it or Client elects it in writing. Client selects the escrow agent, contracts with the escrow agent directly, and pays the escrow agent's fees, including verification fees. Crushable will sign the escrow agent's standard depositor agreement, as long as it is consistent with this Section.

(b) Deposits. Crushable deposits the Application source code, prompts, configurations, workflow definitions, tests, deployment artifacts, infrastructure-as-code, runbooks, release notes, administrator documentation, and dependency manifests, together with the Platform components needed to build and run Client's Applications ("Escrow Materials"). Each deposit includes a list of Third-Party Components (libraries, models, services, and versions) and the build and configuration instructions needed to rebuild the Applications. Crushable deposits copies of Third-Party Components only where their licenses permit it; otherwise Client obtains them from their sources.

(c) Frequency. Crushable refreshes the deposit at least quarterly. If the escrow solution supports fully automated deposits with no manual steps, Crushable will deposit on each production release.

(d) Release. Once Client's license has vested, Client may direct the escrow agent to release the Escrow Materials for Client's Applications, other than Platform components, without further consent from Crushable. On a Continuity Event, Client may direct the escrow agent to release all Escrow Materials, including Platform components, without further consent from Crushable. These release rights survive any Continuity Event affecting Crushable.

(e) Scope of release. Released Escrow Materials are provided so Client can exercise its license. The release gives Client the materials, not broader rights than the license grants.

(f) Verification. Client or its escrow agent may verify the completeness and usability of the deposit, including build verification, once per year. Crushable will reasonably cooperate by providing current build and deployment instructions, a technical contact, and timely answers, and will fix any material deficiency within a reasonable period. If verification finds a material deficiency, Crushable bears the reasonable cost of re-verifying the corrected deposit.

(g) Without escrow. Each Client instance is maintained as a self-contained codebase on a mainstream technology stack. Where Crushable deploys into Client's environment, the code and infrastructure-as-code reside there.

3.8 Service-Level Targets for Software

(a) Targets. The Order Document states the service-level targets for the Platform and each Application. If it does not, these defaults apply to Applications in Development or Maintenance:

Severity	Definition	Response	Fix target
Critical	Application unusable or a core function down, data lost or corrupted, or sensitive data exposed to the wrong role; no workaround	4 business hours	Deployment-ready fix within 2 business days
High	Significant function impaired or results materially inaccurate; limited workaround	1 business day	Deployment-ready fix within 5 business days
Medium / Low	Minor, cosmetic, or polish	2 business days	Next scheduled release

A "deployment-ready fix" is a correction, patch, workaround, or update that is implemented, tested, and raised as a pull request for Client's approval. When the fix merges and deploys depends on Client's approval.

(b) Reproducibility. Fix targets apply to issues that are reproducible and diagnosable. The fix clock starts when Crushable has enough information (steps, inputs, timing, and context) to reproduce the issue and has confirmed it. For intermittent issues, issues of unknown cause, or issues arising from AI model behavior or Third-Party Components, Crushable will investigate in good faith and keep Client informed, but fix targets begin only once the issue is reproducible and attributable to the Application Deliverables or Platform.

(c) AI behavior. Behavior that reflects the inherent, expected characteristics of AI models, including variation in outputs, is not a defect. Crushable will work to tune and improve results as part of the ongoing service.

(d) Exclusions. Targets exclude time spent waiting on Client for access, information, or approvals; outages or changes of Microsoft Azure, AI model providers, or other third-party services; issues caused by Client's environment, data, or source systems; agreed maintenance windows; and force majeure events.

(e) Remedy. Service levels are targets, not guarantees. Crushable measures and reports performance against them at the regular business cadence. If Crushable misses the same target in two (2) consecutive months for reasons within its control, Client may require a written remediation plan identifying the root cause, corrective actions, a named senior contact, and a timeline. Crushable will then have at least thirty (30) days (or a longer agreed period for structural fixes) to cure. If the failure continues after the cure period for reasons within Crushable's control, it may be a material breach of the affected maintenance or support obligations, subject to Section 13. This cure process is Client's sole remedy for missed software service-level targets, in place of service credits, unless the Order Document provides otherwise.

3.9 Outcome Measures

An Order Document may list business outcome measures (sometimes called experience-level agreements or "XLAs"), such as reduction in manual effort, accuracy rates, or user adoption. The Parties may establish baselines after production use and set directional targets by mutual written agreement. Outcome measures depend materially on Client's data quality, mappings, and user adoption. They are informational and used for governance only. They are not acceptance criteria, warranties, or service levels, and a missed outcome target is not a breach or a service-level miss.

3.10 Source Systems and Upstream Dependencies

(a) Source systems. Client is responsible for the availability, access, credentials, and quality of its source systems and source data. Crushable is responsible for correctly processing the data it receives. When a source system is unavailable or returns incomplete, unreadable, or invalid data, the Application flags the gap rather than processing incomplete data. These conditions are not Crushable defects or service-level misses.

(b) Third-party changes. Applications connect to systems Crushable does not control, including ERPs, EHRs, payer portals, clearinghouses, document repositories, Microsoft Azure, and AI model providers. If one of them changes, retires, or breaks something, that is not a defect caused by Crushable. Crushable will tell Client what changed and, at Client's choice, address it within the Application's current state if it reasonably fits, or scope it as Development work.

3.11 Hosting, AI Providers, and Data Use

(a) Deployment. Each Client instance is single-tenant. By default, Crushable deploys the Platform and Applications into Client's own cloud environment, and Client Data stays there. Where Client prefers, Crushable may host the instance for Client as described in the Order Document.

(b) Approved AI providers. The Order Document or its schedules list the approved AI model providers and services. Crushable may make routine model-routing changes among approved providers without prior approval. Crushable will not add a production AI model provider, subprocessor, or inference endpoint outside the approved set, or change data residency locations, without Client's approval. The exception is emergency security remediation, which Crushable will promptly notify Client of.

(c) Data use. Crushable, and approved AI providers acting within the established environment, may process Client Data as needed to provide the Services. Crushable will not expose credentials, secrets, or data that Client designates in writing as restricted to third-party AI providers. Client may update the restricted list on reasonable written notice, and updates apply going forward. If a restriction materially impairs an Application's functionality, the Parties will handle it as a change, and the resulting limitation is not a defect or service-level miss.

(d) Data retention. Where the instance runs in Client's environment, Crushable does not copy Client's operational data out of that environment except as needed to provide support and with Client's knowledge. Crushable retains the code and the contents of improvement requests, and purges improvement-request contents within ninety (90) days after the request is resolved.

(e) Consumption costs. Unless the Order Document says otherwise, cloud consumption, AI model usage (tokens), and third-party licensing are billed directly to Client by those providers or passed through at cost. They are not included in Crushable's fees. Crushable will report consumption at the cadence stated in the Order Document.

3.12 Commercial Review and Fee Adjustments

(a) Annual adjustment. Unless an Order Document states otherwise, recurring maintenance, support, and development fees increase by three percent (3%) on each anniversary of the Order Document's effective date. License fees are fixed.

(b) Commercial review. At least once a year, the Parties will review recurring fees, included capacity, and service levels. If Crushable materially reduces its cost to serve through AI automation or delivery tooling, Crushable may share those savings with Client through adjustments agreed at the review. Any adjustment is effective only if both Parties agree in writing.

---

4. Managed Services

This Section applies to Order Documents that include Managed Services.

4.1 Scope and Coverage

The Order Document defines the covered users, devices, locations, systems, cloud subscriptions, and service tiers. Work outside that coverage, including new projects, office moves, major upgrades, migrations, and support for systems not listed, is out of scope and is billed at Crushable's then-current rates or under a separate Order Document. Crushable will tell Client before performing out-of-scope work.

4.2 Onboarding

Crushable will onboard Client using the process and timeline in the Order Document, which typically includes discovery, documentation, deployment of Crushable's monitoring and security agents, and credential and access setup. Timelines depend on Client granting timely access. Any onboarding fee is stated in the Order Document.

4.3 Help Desk

(a) Requests. Client's users submit support requests through Crushable's designated channels (ticketing portal, email, or phone) and include enough detail to act on them, such as error messages and affected systems.

(b) AI-assisted support. Crushable operates its help desk on the Platform. AI agents may classify, diagnose, respond to, and resolve requests, with escalation to Crushable personnel when needed. Actions that could materially affect Client's systems or data follow the human-oversight practices in Section 6.

(c) Reasonable use. Help desk services support Client's use of covered systems. They do not include basic user training unless the Order Document says so. Client will not overwhelm the help desk with excessive or frivolous requests.

4.4 Security Services

(a) Services. Security services may include endpoint protection, email and collaboration security, cloud data protection, security awareness training and phishing simulation, vulnerability management, external risk monitoring, and security operations center monitoring, as specified in the Order Document.

(b) No guarantee of prevention. Security services reduce risk but cannot prevent every threat. Crushable does not warrant that the Services will detect or prevent every intrusion, malware infection, data loss, or security incident.

(c) Recommendations. Crushable will make security recommendations in writing. If Client declines or delays a recommendation that Crushable identifies as material, Client accepts the resulting risk, and Crushable is not responsible for incidents that the recommendation would reasonably have prevented.

(d) Incident response. Crushable will respond to security incidents affecting covered systems as described in the Order Document. Forensic investigation, legal and regulatory notification, ransom negotiation, and extended recovery work are out of scope unless the Order Document includes them.

4.5 Backup and Recovery

Client is responsible for backing up its data unless the Order Document includes backup services. Where backup is included, Crushable will operate backups and test restores at the frequency in the Order Document. Crushable is not liable for data loss that results from Client not purchasing backup services, excluding data from backup, or refusing Crushable's backup recommendations.

4.6 Managed Cloud Infrastructure

Where the Order Document includes managed cloud infrastructure (for example, a managed Microsoft Azure subscription):

(a) Ownership. The subscription is owned by Client and, where practical, dedicated to the Services so that Crushable can operate it without standing access to Client's broader tenant. Client Data stays in Client's subscription.

(b) Operations. Crushable provisions the landing zone, networking, identity integration, and infrastructure-as-code, and operates monitoring, alerting, backups, patching, security guardrails, and cost management, as described in the Order Document.

(c) Consumption. Cloud consumption charges are Client's responsibility and are billed by the provider or passed through at cost. Crushable manages consumption within the subscription, reports on it, and will get Client's approval before material scaling changes that exceed the thresholds in the Order Document.

(d) Handover. On termination, Crushable provides the handover and transition assistance described in Section 14.5. Ending infrastructure services does not affect Client's Platform or Application licenses, which continue under their own Order Documents.

4.7 Service Levels and Service Credits

The Order Document states any service levels for Managed Services, such as response times, availability, restore times, and patch compliance. Service levels exclude outages or failures of third-party providers (including Microsoft Azure), issues caused by Client or by changes Client requested, agreed maintenance windows, and force majeure events. Availability is measured on the components Crushable operates. Service credits apply only if the Order Document provides for them. Where it does, Client must request a credit in writing within thirty (30) days after the missed target, credits are applied to a future invoice, total credits in any month may not exceed thirty percent (30%) of that month's fee for the affected service, and credits are Client's sole and exclusive remedy for missed service levels.

4.8 Resold Products

(a) Vendor terms. Hardware, software, subscriptions, and security tools that Crushable resells or provisions (for example, endpoint, email-security, vulnerability-management, backup, or productivity licenses) are subject to the vendor's terms, including end-user license agreements, warranties, usage policies, and support limitations ("Vendor Terms"). Client agrees to comply with Vendor Terms that Crushable makes available.

(b) Warranties. Resold products carry only the warranties the vendor provides, which Crushable passes through to the extent permitted. Crushable makes no additional warranty for resold products and is not liable for defects, failures, discontinuation, or changes to Vendor Terms caused by the vendor. Crushable will try to tell Client about material vendor changes it becomes aware of.

(c) Use. Client will not modify, tamper with, reverse engineer, or attempt to repair resold products unless Crushable authorizes it in writing. For resold hardware, Client provides a suitable environment (power, cooling, and physical security) and promptly reports malfunctions.

(d) Commitments. Some vendor licenses carry annual or multi-year commitments that Crushable must pay even if Client ends the Services early. Client is responsible for the remaining vendor commitments Crushable incurred on Client's behalf that are identified in the Order Document or approved by Client.

4.9 Term, Minimum Commitment, and Offboarding

Managed Services continue for the term in the Order Document, including any minimum commitment, and then renew as the Order Document states. On termination, Crushable will remove its monitoring and security agents (or provide instructions for removal), transfer administrative credentials and documentation, and provide transition assistance under Section 14.5. Client will return or pay for any Crushable-owned equipment.

---

5. Professional Services

This Section applies to Order Documents that include Professional Services.

5.1 Projects and Pricing

Each Order Document describes the project scope, Deliverables, assumptions, timeline, and pricing, which may be fixed fee, time and materials, or reserved capacity. For time-and-materials work, estimates are good-faith estimates, not caps, and Crushable will notify Client before exceeding an estimate by more than ten percent (10%). For fixed-fee work, the fee covers only the stated scope and assumptions.

5.2 Changes and Discovery Findings

Work outside the stated scope requires a Change Request under Section 2.2. If discovery or assessment work reveals conditions materially different from the Order Document's assumptions, Crushable will raise them before continuing, and the Parties will adjust the timeline, scope, or fees by Change Request.

5.3 Acceptance of Deliverables

Unless the Order Document says otherwise, Client will review each Deliverable within ten (10) business days after delivery and either accept it or describe in writing how it fails to materially conform to the Order Document. Crushable will correct material nonconformities and resubmit. A Deliverable is deemed accepted if Client does not provide written notice of nonconformity within the review period or uses the Deliverable in production.

5.4 Ownership of Deliverables

Crushable owns Professional Services Deliverables and grants Client a non-exclusive, perpetual license to use them for Client's internal business purposes once the fees for them are paid in full. If an Order Document expressly designates a Deliverable as a work made for hire or assigns it to Client, ownership transfers upon full payment, excluding any Crushable Tools and Third-Party Components incorporated in it, which Crushable licenses to Client for use with the Deliverable. Infrastructure-as-code and configurations that Crushable deploys into Client's environment for Client may be used, modified, and maintained by Client and its contractors.

5.5 Travel and Expenses

Pre-approved, reasonable travel and out-of-pocket expenses are billed at cost unless the Order Document says otherwise.

---

6. AI Services and Responsible AI

This Section applies to every engagement that includes AI capabilities, including the Platform, Applications, AI-assisted help desk services, and AI development.

6.1 Human Oversight

Crushable designs its AI capabilities so that AI drafts, a human approves, and consequential actions are audited. Guardrails, autonomy policies, and approval requirements are configurable and depend on Client's configuration choices. Client is responsible for configuring and staffing appropriate human review for its use of AI outputs.

6.2 AI Output

AI systems are probabilistic and may produce output that is incomplete, inaccurate, or inconsistent. All AI-generated outputs, recommendations, summaries, classifications, extractions, and suggestions are advisory. Except as stated in Section 3.4(c) and Section 11, Crushable makes no warranty as to the accuracy, completeness, or fitness for a particular purpose of AI-generated output. Client is responsible for reviewing AI output before relying on it and for all decisions and actions taken based on it.

6.3 Regulated and High-Stakes Uses

Unless an Order Document expressly states otherwise, the Services are administrative and operational support tools. They are not intended to diagnose or treat patients, practice medicine or law, provide legal, tax, or financial advice, make coverage or eligibility determinations, or replace the independent judgment of licensed professionals, claims staff, engineers, or compliance personnel. Client will not use the Services to make fully automated clinical, legal, employment, credit, or safety-critical decisions without meaningful human review, or to submit false, misleading, or noncompliant claims or filings. Client is solely responsible for the rules, policies, and data configured in the Services and for all final decisions and submissions. Crushable is not liable for claim denials, overpayments, recoupments, audits, penalties, product or quality escapes, or regulatory actions arising from reliance on, or failure to review, Service output.

6.4 Third-Party AI Models

Third-party AI models, their outputs, and third-party AI services that Crushable selects or incorporates are provided on a pass-through basis. Crushable stands behind its selection, integration, and configuration of them, and passes through the provider's terms and warranties to the extent it is permitted to. Crushable is not responsible for model provider outages, changes, deprecations, or the inherent characteristics of a provider's model.

6.5 Training and Data Rights

Crushable will not use Client Data to train AI models that are made available to third parties, and will not permit approved AI providers to do so where the provider's terms allow Crushable to opt out. Crushable may use Client Data within Client's own instance to tune, evaluate, and improve Client's own Applications. Crushable may use de-identified, aggregated operational metrics that do not identify Client or any individual (for example, response times, error rates, and token counts) to operate and improve its Services.

---

7. Fees and Payment

7.1 Fees

Client will pay the fees in each Order Document. Except as stated in this Agreement or an Order Document, fees are non-refundable, and license fees are fully earned as stated in Section 3.6.

7.2 Invoicing and Payment

Unless the Order Document says otherwise, Crushable invoices recurring fees monthly in advance on the first day of the month, and other fees monthly in arrears. Payment is due within thirty (30) calendar days of the invoice date, in U.S. dollars.

7.3 Disputed Invoices

If Client disputes an invoice in good faith, Client must notify Crushable in writing within thirty (30) days of the invoice date with reasonable detail, and must pay the undisputed portion when due. The Parties will work to resolve the dispute promptly. Invoices not disputed within that period are considered accepted.

7.4 Late Payment and Suspension

Overdue amounts accrue interest at the lesser of one and one-half percent (1.5%) per month or the highest rate permitted by law. If any undisputed amount is more than thirty (30) days overdue, Crushable may, after ten (10) days' written notice, suspend Services until it is paid. Suspension does not affect a vested license under Section 3.6, but development, maintenance, support, and hosting services may be suspended. Client is responsible for reasonable collection costs, including attorneys' fees.

7.5 ACH Payments and Surcharge

Client will pay by ACH unless the Order Document says otherwise, and will notify Crushable of bank-account changes within fifteen (15) days. Where permitted by applicable law and card network rules, payments made by credit card are subject to a surcharge equal to the lesser of three percent (3%) or Crushable's actual cost of card acceptance, unless the Order Document says otherwise. No surcharge applies to debit or prepaid cards.

7.6 Taxes

Fees do not include taxes, levies, duties, or similar governmental charges, including sales, use, value-added, and withholding taxes ("Taxes"). Client is responsible for all Taxes on its purchases, except Taxes on Crushable's net income, gross receipts, franchise, employment, or property. If Client is exempt, it will provide a valid exemption certificate, and Crushable will not collect those Taxes. If Crushable collects Taxes from which Client was exempt, Crushable will refund them promptly after receiving appropriate documentation.

7.7 Pass-Through Costs and Expenses

Third-party costs needed to deliver the Services, including cloud consumption, AI model usage, and third-party licensing, are Client's responsibility unless the Order Document includes them in Crushable's fees.

---

8. Intellectual Property

8.1 Crushable Property

Crushable owns the Platform, Crushable Tools, Application Deliverables (unless an Order Document assigns them), and all intellectual property Crushable develops or uses in providing the Services, including improvements to any of them. Client receives only the licenses expressly granted in this Agreement and the Order Documents. Crushable reserves all other rights.

8.2 Client Property

Client owns Client Data and the materials Client provides. Client grants Crushable a non-exclusive license to use Client Data and materials only as needed to provide the Services and as described in Section 6.5.

8.3 Restrictions

Except as expressly allowed by a license in this Agreement or an Order Document, Client will not (a) copy, modify, or create derivative works of the Platform or Crushable Tools; (b) reverse engineer, decompile, or attempt to derive the source code of any part of the Platform not provided to Client in source form; (c) sell, sublicense, rent, or distribute the Platform or Application Deliverables to third parties; (d) use the Services to build a competing product or service; or (e) remove proprietary notices.

8.4 Feedback

If Client gives Crushable suggestions or feedback about the Services, Crushable may use them without restriction or obligation.

8.5 General Knowledge

Each Party may use the general knowledge, skills, and experience its personnel gain while performing under this Agreement, as long as it does not disclose the other Party's Confidential Information or infringe the other Party's intellectual property.

8.6 Inventions

Inventions made jointly by the Parties' personnel during the Services are disclosed to both Parties, and ownership is determined by written agreement. If the Parties do not agree in writing, inventions relating to the Platform, Crushable Tools, or Crushable's methods belong to Crushable.

8.7 Trademarks

"Crushable," "xOPS," and the Crushable logos are trademarks of Crushable LLC. This Agreement grants Client no right to use them.

8.8 Contractual Nature of Rights

Client's licenses, restrictions, and obligations under this Agreement and each Order Document are contractual and apply to the Platform, Crushable Tools, Application Deliverables, and Deliverables whether or not copyright, patent, or other intellectual property rights subsist in them, including in any portion generated with AI tools.

8.9 Bankruptcy Code Section 365(n)

All licenses granted under this Agreement and each Order Document are, for purposes of Section 365(n) of the U.S. Bankruptcy Code, licenses of rights to "intellectual property" as defined in the Bankruptcy Code. Client may fully exercise its rights and elections under the Bankruptcy Code, and any escrow agreement under Section 3.7 is an agreement "supplementary to" those licenses.

---

9. Confidentiality

9.1 Definition

"Confidential Information" means non-public information that one Party discloses to the other, in any form, that is marked confidential or that a reasonable person would understand to be confidential. Client's Confidential Information includes Client Data. Crushable's Confidential Information includes the Platform, source code, Escrow Materials, pricing, and the terms of Order Documents. Confidential Information does not include information that is or becomes public through no fault of the receiving Party, was known to the receiving Party without restriction before disclosure, is independently developed without use of the disclosing Party's information, or is rightfully received from a third party without a duty of confidentiality.

9.2 Obligations

The receiving Party will protect the disclosing Party's Confidential Information with at least the care it uses for its own, and no less than reasonable care, and will use it only to perform or exercise rights under this Agreement. It may disclose Confidential Information to its employees, contractors, advisors, and approved subprocessors who need to know it and are bound by confidentiality obligations at least as protective as this Section. If disclosure is legally required, the receiving Party will give prompt notice where permitted so the disclosing Party can seek protection.

9.3 Duration and Return

Confidentiality obligations continue for three (3) years after termination of this Agreement, and for trade secrets and source code, for as long as they remain trade secrets or confidential. On termination or written request, the receiving Party will return or destroy the disclosing Party's Confidential Information and certify destruction on request, except for (a) copies kept in routine backups until overwritten, (b) copies it must keep by law, and (c) materials Client keeps under a license that survives termination.

9.4 Remedies

A breach of this Section may cause irreparable harm, and the disclosing Party may seek injunctive relief in addition to other remedies.

---

10. Data Protection, Security, and Regulated Environments

10.1 Security

Each Party will maintain reasonable administrative, technical, and physical safeguards to protect the other's data, including encryption, managed secrets, access controls, and logging appropriate to the Services. Where the Order Document calls for them, Crushable supports enterprise controls including Microsoft Entra ID single sign-on, network isolation with private endpoints, vulnerability scanning, support for Client's penetration testing, and supply-chain safeguards.

10.2 Security Incidents

Crushable will investigate suspected security events affecting Client Data with reasonable diligence. Crushable will notify Client of a Security Incident without undue delay, and within forty-eight (48) hours after confirming it, and will reasonably cooperate in the investigation and response. Client will promptly notify Crushable of suspected incidents in Client's environment that may affect the Services.

10.3 Protected Health Information

Where Crushable creates, receives, maintains, or transmits Protected Health Information on Client's behalf, the Parties will sign a Business Associate Agreement ("BAA") that complies with HIPAA and, where applicable, 42 CFR Part 2. The BAA controls over this Agreement and any Order Document with respect to PHI.

10.4 Subprocessors

Crushable may use subprocessors (including cloud and AI providers) to provide the Services, remains responsible for their performance, and will provide a list of subprocessors that process Client Data on request. Section 3.11(b) governs changes to AI providers for Platform engagements.

10.5 Regulated Environments

For engagements subject to frameworks such as CMMC, ITAR, EAR, DFARS 252.204-7012, HIPAA, or FedRAMP, the Order Document will specify each Party's controls, responsibilities, and compliance obligations. Client is responsible for identifying the regulatory requirements that apply to its data and operations, including export-controlled data, and for telling Crushable before sharing regulated data.

10.6 Data Protection Laws

Each Party will comply with the data protection laws that apply to its processing of personal data under this Agreement. When Crushable processes personal data on Client's behalf, Crushable acts as Client's service provider or processor and will (a) process the personal data only on Client's documented instructions and for the limited and specified business purpose of providing the Services; (b) not sell or share the personal data, or retain, use, or disclose it outside the direct business relationship with Client or for any purpose other than providing the Services; (c) not combine it with personal data received from others, except as permitted by applicable law; (d) provide the same level of privacy protection that applicable law requires of Client; (e) notify Client if it determines it can no longer meet its obligations under applicable law; (f) allow Client to take reasonable and appropriate steps to stop and remediate unauthorized use of the personal data; (g) reasonably assist Client in responding to individuals' requests to exercise their rights; and (h) bind its subprocessors to written obligations at least as protective as this Section. If applicable law requires terms beyond these, the Parties will sign a data processing agreement, which controls over this Section to the extent of any conflict.

---

11. Warranties and Disclaimers

11.1 Mutual Warranties

Each Party warrants that it has the authority to enter into this Agreement and will comply with applicable laws in performing it.

11.2 Services Warranty

Crushable warrants that it will perform the Services in a professional and workmanlike manner consistent with generally recognized industry standards. For Professional Services, this warranty lasts ninety (90) days after the Services are performed or the Deliverable is accepted. For Application Deliverables and Platform maintenance, Section 3.4(c) applies instead of a fixed warranty period. Client's sole remedy for a breach of this warranty is, at Crushable's option, re-performance of the nonconforming Services at no additional charge or a refund of the fees paid for them, as long as Client reports the breach in writing within the warranty period.

11.3 Code Warranties

(a) Malicious code. Crushable warrants that Application Deliverables and Deliverables, as delivered by Crushable, will not contain viruses, ransomware, time bombs, back doors, or other code intentionally designed to disrupt, damage, or provide unauthorized access to Client's systems or data, other than security and monitoring tools disclosed to Client.

(b) Open-source licenses. Crushable warrants that it will not knowingly incorporate into Application Deliverables or Deliverables any open-source software under a license that, as Client uses the Deliverables under this Agreement, would require Client to disclose or license its own proprietary source code to third parties, unless Client approves it in writing. Crushable's open-source license scanning under Section 3.5(a) is its method for meeting this obligation.

(c) Remedy. For a breach of this Section 11.3, Crushable will, at no additional charge, remove the malicious code or replace the affected component with a compliant alternative that does not materially reduce functionality.

11.4 Client Warranties

Client warrants that the data, materials, and instructions it provides are accurate to the best of its knowledge, and that it has the rights and consents needed for Crushable to use them to provide the Services.

11.5 Disclaimer

EXCEPT FOR THE EXPRESS WARRANTIES IN THIS AGREEMENT AND ANY ORDER DOCUMENT, THE SERVICES ARE PROVIDED "AS IS," AND CRUSHABLE DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. CRUSHABLE DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, THAT AI OUTPUT WILL BE ACCURATE, OR THAT SECURITY SERVICES WILL PREVENT ALL INCIDENTS. THIRD-PARTY COMPONENTS AND RESOLD PRODUCTS CARRY ONLY THEIR PROVIDERS' WARRANTIES.

---

12. Indemnification

12.1 By Crushable

Crushable will defend Client against any third-party claim alleging that the Platform or Application Deliverables, as delivered by Crushable and used in accordance with this Agreement, infringe a U.S. patent, copyright, or trademark or misappropriate a trade secret, and will pay the damages and costs finally awarded or agreed in settlement. Crushable has no obligation for claims arising from (a) Third-Party Components, open-source software, or Service Output; (b) Client Data, Client specifications, or Client's instructions; (c) modifications not made by Crushable; (d) combination with items Crushable did not provide; or (e) continued use after Crushable provides a non-infringing alternative. If a claim is made or likely, Crushable may procure the right for Client to continue using the item, modify or replace it so it does not infringe, or, if neither is commercially reasonable, terminate the affected license and refund any prepaid fees for the period after termination. This Section states Crushable's entire liability for infringement claims.

12.2 By Client

Client will defend Crushable against any third-party claim arising from (a) Client Data or materials, or Crushable's use of them as permitted by this Agreement; (b) Client's use of the Services in violation of this Agreement, Vendor Terms, or law, including Section 6.3; (c) decisions, claims, filings, or submissions that Client makes using the Services; or (d) Client's misuse of resold products. Client will pay the damages and costs finally awarded or agreed in settlement.

12.3 Process

The indemnified Party must promptly notify the indemnifying Party of the claim, give it sole control of the defense and settlement (except that a settlement requiring the indemnified Party to admit fault or pay money requires its consent), and provide reasonable cooperation at the indemnifying Party's expense.

---

13. Limitation of Liability

13.1 Exclusion of Indirect Damages

EXCEPT FOR EXCLUDED CLAIMS, NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, BUSINESS, OR DATA, ARISING OUT OF OR RELATING TO THIS AGREEMENT, EVEN IF ADVISED OF THEIR POSSIBILITY.

13.2 Cap

EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO AN ORDER DOCUMENT AND THIS AGREEMENT WILL NOT EXCEED THE FEES PAID AND PAYABLE UNDER THAT ORDER DOCUMENT DURING THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. EACH PARTY'S TOTAL LIABILITY FOR ITS DEFENSE AND INDEMNIFICATION OBLIGATIONS UNDER SECTION 12 WILL NOT EXCEED TWO TIMES (2×) THAT AMOUNT.

13.3 Excluded Claims

"Excluded Claims" are (a) Client's obligation to pay fees, including accelerated license balances; (b) Client's breach of Section 8.3 or infringement or misappropriation of Crushable's intellectual property; (c) Client's defense and indemnification obligations under Section 12.2(b) and (c); and (d) a Party's fraud, gross negligence, or willful misconduct.

13.4 Allocation of Risk

The fees reflect the allocation of risk in this Agreement. The limitations in this Section apply to all theories of liability and survive even if a remedy fails of its essential purpose.

---

14. Term and Termination

14.1 Term

This Agreement starts on the date Client first signs or accepts an Order Document that references it and continues until all Order Documents have ended, unless terminated earlier under this Section. Each Order Document has the term stated in it.

14.2 Termination for Convenience

Either Party may terminate an Order Document for convenience as stated in it. If the Order Document is silent, either Party may terminate it for convenience on ninety (90) days' written notice, subject to any minimum commitment, early-termination fee, vendor commitment under Section 4.8(d), or license acceleration under Section 3.6.

14.3 Termination for Cause

Either Party may terminate an Order Document on written notice if the other Party materially breaches it and does not cure the breach within thirty (30) days after receiving written notice (ten (10) days for non-payment). Crushable may also suspend or terminate Services immediately if Client's use poses a security risk to Crushable, its other clients, or third parties, or violates law.

14.4 Insolvency

Crushable may terminate this Agreement and any Order Document immediately on written notice if Client files a voluntary bankruptcy petition, has an involuntary petition filed against it that is not dismissed within thirty (30) days, becomes insolvent or admits in writing that it cannot pay its debts as they come due, or makes an assignment for the benefit of creditors. To the extent permitted by law, Client waives any right to require Crushable to continue providing Services under a "critical vendor," "essential supplier," or similar designation without full and timely payment of all pre-petition and post-petition amounts. All amounts for Services provided through termination become due immediately to the extent permitted by law.

14.5 Effect of Termination and Transition

(a) On termination of an Order Document, Crushable stops providing the affected Services, and Client pays all fees earned through the termination date, plus any accelerated license balance, minimum commitment, and vendor commitments that apply.

(b) Licenses that have vested under Section 3.6 survive. Subscription Licenses and unvested licenses end, and Client stops using the affected Platform components and Application Deliverables, unless Client pays the accelerated license balance, which vests the license. If Crushable terminates an Order Document for convenience, Client may vest the licenses for the Platform and each Application whose license fee has been earned by paying the unpaid earned balance within sixty (60) days after termination, and Client may continue using those licensed items during that period.

(c) For thirty (30) days after termination, Crushable will make Client Data available for export in a commercially reasonable format, where Crushable hosts it. Client Data in Client's own environment stays there. After that period, Crushable will delete Client Data in its possession unless the law requires otherwise.

(d) Crushable will provide reasonable transition assistance for up to ninety (90) days on request. The Order Document may include a number of transition hours at no charge. Otherwise, or beyond those hours, transition assistance is billed at Crushable's then-current rates. Transition assistance may include a documentation package, runbook walkthrough, transfer of administrative access, rotation of credentials and secrets, handoff of infrastructure-as-code repositories, a final backup and data export, and administrator training. It does not include re-platforming, new development, or migration to another provider's systems.

14.6 Survival

Sections that by their nature should survive termination do survive, including Sections 3.6, 3.7(d) and (e), 7, 8, 9, 12, 13, 14.5, 16, and 17.

---

15. Insurance

Each Party will maintain, at its own expense, insurance that is reasonable and customary for its business, including commercial general liability, professional liability (errors and omissions), cyber liability covering data breaches and security incidents, workers' compensation as required by law, and employer's liability. On request, each Party will provide certificates of insurance and will notify the other of material reductions in coverage. Specific limits or additional-insured requirements apply only if stated in an Order Document.

---

16. Dispute Resolution

16.1 Negotiation and Mediation

The Parties will first try to resolve any dispute through good-faith negotiation between senior representatives. If the dispute is not resolved within thirty (30) days, either Party may start mediation with a mutually agreed mediator in Greenville, South Carolina, with costs shared equally.

16.2 Arbitration

If mediation does not resolve the dispute within sixty (60) days after it starts, the dispute will be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator, in Greenville, South Carolina. The arbitrator's award is final and may be entered in any court with jurisdiction.

16.3 Exceptions

Either Party may seek injunctive or other equitable relief in court to protect its intellectual property or Confidential Information or to preserve the status quo pending arbitration. Crushable may bring an action to collect unpaid fees in court. The state and federal courts in Greenville County, South Carolina have exclusive jurisdiction over any court proceedings.

16.4 Costs and Continued Performance

Each Party bears its own costs and attorneys' fees unless the arbitrator or court awards otherwise, except as stated in Section 7.4. Unless the Order Document is terminated, the Parties will continue performing their obligations while a dispute is pending, and Client will continue paying undisputed amounts.

16.5 Jury Waiver

TO THE EXTENT PERMITTED BY LAW, EACH PARTY WAIVES ITS RIGHT TO A JURY TRIAL IN ANY COURT PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT OR ANY ORDER DOCUMENT.

16.6 Governing Law

This Agreement is governed by the laws of the State of South Carolina, without regard to its conflict-of-laws rules.

---

17. General Provisions

17.1 Compliance

Each Party will comply with all laws that apply to its performance under this Agreement, including export-control and sanctions laws and anti-corruption laws such as the U.S. Foreign Corrupt Practices Act. Neither Party will export technical data received from the other without any required license or approval.

17.2 Non-Solicitation

During the term of any Order Document and for twelve (12) months afterward, Client will not directly or indirectly solicit for employment or hire any Crushable employee or contractor who worked on Client's engagement, without Crushable's prior written consent. General advertisements not targeted at Crushable personnel are not solicitation. If Client breaches this Section, Client will pay Crushable, as liquidated damages and not as a penalty, an amount equal to fifty percent (50%) of that person's annual compensation at Crushable.

17.3 Publicity and Non-Disparagement

Neither Party will issue press releases about this Agreement without the other's prior written consent. Crushable may identify Client by name as a customer in client lists unless Client opts out in writing. Client will not make public statements that disparage or defame Crushable, its affiliates, employees, or Services during the term and for three (3) years afterward. This does not restrict truthful statements required by law or made in legal proceedings.

17.4 Assignment

Neither Party may assign this Agreement or an Order Document without the other's prior written consent, which will not be unreasonably withheld. Either Party may assign without consent to a successor in a merger, acquisition, reorganization, or sale of all or substantially all of its assets or the business to which the Agreement relates, as long as the successor assumes its obligations in writing. However, Client may not assign this Agreement, an Order Document, or any license under them, with or without consent, to a competitor of Crushable without Crushable's prior written consent, which Crushable may withhold in its discretion. This Agreement binds and benefits the Parties' permitted successors and assigns.

17.5 Subcontractors

Crushable may use subcontractors, including affiliated companies, AI providers, and automation to perform the Services. Crushable remains responsible for their performance and for their compliance with this Agreement. Subcontractors are not parties to this Agreement or any Order Document, have no authority to sign, amend, or invoice under them, and do not assume Crushable's obligations to Client. Client will look solely to Crushable for performance and for any claim arising out of the Services. Section 3.11(b) governs AI provider changes for Platform engagements.

17.6 Force Majeure

Neither Party is liable for delays or failures caused by events beyond its reasonable control, including natural disasters, war, terrorism, civil unrest, labor disputes, government action, pandemics, and failures of utilities, telecommunications, cloud providers, or AI providers. This does not excuse payment obligations or failures caused by a Party's financial condition or negligence.

17.7 Notices

Notices must be in writing and are effective when received if delivered by hand, by nationally recognized courier, by certified mail, or by email with confirmation of receipt, to the addresses in the Order Document (or to contact@crushable.ai for Crushable). Either Party may change its notice address by notice to the other. Routine operational communications may be sent by email or through the designated collaboration channels.

17.8 Relationship

The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship.

17.9 Third-Party Beneficiaries

There are no third-party beneficiaries, except that (a) an escrow agent may rely on Client's release rights in Section 3.7(d), and (b) the Crushable Entity that did not sign an Order Document may enforce Crushable's rights, and rely on Crushable's protections, under this Agreement and that Order Document, including Sections 8, 9, 12, and 13.

17.10 Entire Agreement, Amendment, and Waiver

This Agreement, the applicable version under Section 18, and the Order Documents, Change Requests, and any BAA are the entire agreement between the Parties about their subject matter, and supersede all prior agreements and understandings about it. Amendments must be in writing and signed by authorized representatives of both Parties. Schedules and exhibits to an Order Document may be updated by written agreement of both Parties, recorded in the Order Document's amendment log, without amending the whole Order Document. A waiver is effective only if it is in writing, and a waiver of one breach is not a waiver of any other.

17.11 Severability and Interpretation

If any provision is found unenforceable, it will be enforced to the maximum extent possible, and the rest of this Agreement remains in effect. Headings are for convenience only. "Including" means "including without limitation."

17.12 Counterparts and Electronic Signatures

Order Documents may be signed in counterparts and with electronic signatures, which are as valid as originals.

---

18. Versions and Acceptance

18.1 Acceptance

This Agreement is published at https://www.crushable.ai/msa. No separate signature is needed on this Agreement. By signing or accepting an Order Document that references this Agreement, Client confirms that it has reviewed and agrees to this Agreement.

18.2 Versions

Each version of this Agreement is identified by its effective date and remains available at https://www.crushable.ai/msa, where a date selector shows every prior version. Each Order Document is governed by the version of this Agreement in effect on the date the Order Document is signed, unless the Order Document names a different version. Crushable may publish new versions from time to time. A new version applies to an existing Order Document only (a) when Client signs a new Order Document or Change Request that references the new version, or (b) on the Order Document's next renewal, if Crushable gives Client at least thirty (30) days' written notice before the renewal date and Client does not object in writing before it. If Client objects, the prior version continues to apply to that Order Document through its renewal term.

---

Contact
Crushable
25 Goldsmith St, Greenville, SC 29609
contact@crushable.ai · 864-794-2001