|
PROGRESSIVE SOLUTIONS INC. EXHIBIT A: SOFTWARE
<br />MAINTENANCE AGREEMENT
<br />AGSOFTMT(4.2) Page 6 of 6
<br />written, and all previous and current negotiations and other communications between
<br />the parties pertaining to the subject matter herein. Any payment related obligations that
<br />occur one year after execution of this agreement shall be construed in accordance with
<br />and governed by Federal or state law where any resulting action is filed. All other
<br />obligations set forth in this Agreement shall be construed in accordance with and
<br />governed by Federal law or the laws of the state in which the software is situated, except
<br />when software licenses are granted for use in the state of Louisiana or in countries such
<br />as Canada or Mexico where the laws of California will apply. When California law
<br />applies, the Court of Orange County, California shall have non-exclusive jurisdiction
<br />over all disputes relating to this Agreement. This Agreement will not be governed by the
<br />conflict of law rules of any jurisdiction or the United Nations Convention on Contracts for
<br />the International Sale of Goods, the application of which is expressly excluded. This
<br />Agreement may be signed in several counterparts, each of which shall be deemed an
<br />original.
<br />Any controversy or claim arising out of or relating to this Agreement or the breach
<br />thereof, may be settled by arbitration, if agreeable to both parties at in accordance with
<br />the rules of the American Arbitration Association, and judgment upon the award
<br />rendered by the arbitrator(s) may be entered in any court having jurisdiction thereof.
<br />(h)Any change or revision to the terms and conditions hereof shall be made by written
<br />amendment and shall be executed by persons authorized to do so by the respective
<br />parties. No changes in specifications, requested or suggested by either party, shall be
<br />made except by written agreement of both parties.
<br />Congress enacted the Electronic Signatures in Global and National Commerce Act (E-
<br />Sign Act) on June 30, 2000, to validate the legality of electronic contracts. Should either
<br />party receive a document signed with a valid electronic signature, such documents shall
<br />be accepted as if they were signed with a pen.
<br />(i) Allocation of Security Responsibility: The Software is deployed on premises within
<br />the Licensee's environment ("Licensee Environment"). Licensee is solely responsible for
<br />the security, operation, and maintenance of the Licensee Environment, including
<br />network and perimeter security, firewalls, operating system and database hardening and
<br />patching, anti-malware protection, physical security, encryption, backup and recovery,
<br />logging and monitoring, and the provisioning, management, and deprovisioning of all
<br />user and administrator accounts.
<br />Licensee is also solely responsible for the provisioning, configuration, security,
<br />monitoring, and revocation of any connectivity, credentials, accounts, permissions, VPN
<br />access, remote access solutions, network pathways, identity systems, or other
<br />mechanisms through which Licensor may access the Licensee Environment. Licensee
<br />shall promptly disable or modify such access upon personnel changes, security events,
<br />or at the Licensee's discretion.
<br />Licensor does not host, possess, store, manage, or control the Licensee's infrastructure
<br />or data within the Licensee Environment and does not have custody of Licensee data
<br />stored therein. Licensee acknowledges that it is the owner and custodian of all data
<br />processed by the Software and is solely responsible for safeguarding such data within
<br />the Licensee Environment.
<br />(k) Licensor Security Incident Notification: Licensor shall notify the Licensee's
<br />designated contact without undue delay and within seventy two (72) hours after
<br />becoming aware of: (a) a Security Incident that materially affects Licensee data and that
<br />occurs within systems owned, operated, or controlled by Licensor, or results from the
<br />acts or omissions of Licensor personnel; or (b) a Security Incident affecting:
<br />(I) the systems, environments, credentials, repositories, certificates, signing
<br />infrastructure, or tools used by Licensor to develop, build, test, store, package, sign,
<br />deliver, or distribute software, updates, patches, releases, or other deliverables provided
<br />to the Licensee; or (II) the credentials, remote access methods, or tools owned,
<br />managed, or controlled by Licensor and used to access the Licensee Environment;
<br />where such Security Incident could reasonably present a risk to the integrity, security,
<br />or availability of software, updates, releases, or access provided by Licensor to
<br />Licensee, regardless of whether Licensee data is known to be affected and regardless
<br />of whether Licensor caused the Security Incident.
<br />Such notice shall include, to the extent known at the time, a description of the nature of
<br />the Security Incident, the systems or services affected, the categories of information
<br />potentially involved, the known or suspected impact on the Licensee, and the corrective
<br />actions taken or planned by Licensor.
<br />Notification under this Section shall not constitute an admission of fault, liability, or
<br />wrongdoing by Licensor.
<br />For the avoidance of doubt, Licensor has no obligation to monitor the Licensee
<br />Environment for Security Incidents and shall have no responsibility to detect, investigate,
<br />report, or provide notice of Security Incidents that originate within, are caused by, or are
<br />confined to the Licensee Environment, including incidents involving Licensee owned or
<br />Licensee managed networks, servers, workstations, identity providers, VPNs,
<br />credentials, remote access systems, or user accounts, except to the extent such
<br />incidents are directly related to a Security Incident described in subsection (b) above.
<br />(l) Cooperation In the event of a Security Incident described in Section (k) above,
<br />Licensor shall provide reasonable cooperation to the Licensee, including preserving and
<br />providing relevant logs, records, and information within Licensor’s possession or control
<br />that are reasonably necessary for the Licensee's investigation and response.
<br />Licensee shall remain solely responsible for conducting any forensic investigation of the
<br />Licensee Environment, determining whether notification obligations exist under
<br />applicable law, and making any required notifications to affected individuals, regulators,
<br />payment card entities, law enforcement agencies, or other third parties.
<br />Docusign Envelope ID: 4B3DD47E-7332-8163-807C-64B627C64358
|