Terms of Service

This Software as a Service Agreement (this "Agreement") is entered into as of the date of this agreement (the "Effective Date") by and between The Commonwealth Technology Group, a Tennessee Corporation with its principal place of business at 485 S. Main St. Middleton, TN 38052 ("Provider"), and the party executing this agreement (“Customer”). Provider and Customer are each referred to individually as a "Party" and collectively as the "Parties."

RECITALS

WHEREAS, Provider has developed and operates a proprietary, cloud-based software-as-a-service platform designed to support quality control policies, procedures, and workflows for mortgage loan origination, seller/servicer eligibility, and related compliance functions (the "Services," as further defined below);

WHEREAS, Customer desires to access and use the Services, and Provider desires to make the Services available to Customer, in each case subject to the terms and conditions set forth in this Agreement and any Order Form(s) executed by the Parties;

NOW, THEREFORE, in consideration of the mutual covenants, representations, and warranties set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

1. DEFINITIONS

1.1 “Authorized Users” means Customer's employees, contractors, and agents who are authorized by Customer to access and use the Services on Customer's behalf, subject to the terms of this Agreement and the applicable Order Form.

1.2 “Customer Data” means any data, information, or content submitted, uploaded, or transmitted to the Services by or on behalf of Customer or its Authorized Users, including, without limitation, any nonpublic personal information (“NPI”) regarding mortgage applicants, borrowers, or sellers, as defined under the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) and Regulation P.

1.3 “Documentation” means Provider's then-current user guides, manuals, and technical documentation describing the functionality of the Services, as made available to Customer.

1.4 “Order Form” means an ordering document executed by both Parties that specifies, among other things, the Subscription Plan, number of Authorized Users, applicable Fees, and Subscription Term, and that is incorporated into and governed by this Agreement.

1.5 “Services” means Provider's proprietary software-as-a-service platform, including any associated application programming interfaces, made available to Customer on a subscription basis as described in the Documentation and the applicable Order Form.

1.6 “Subscription Plan” means the tier of Services access purchased by Customer, as described in Exhibit A and identified on the applicable Order Form.

1.7 “Subscription Term” means the initial term and any renewal term(s) during which Customer is entitled to access and use the Services, as set forth in Section 3.

2. ACCESS AND USE OF SERVICES

2.1 Grant of Access. Subject to the terms of this Agreement, the applicable Order Form, and Customer's timely payment of Fees, Provider grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the Subscription Term for Customer's Authorized Users to access and use the Services and Documentation solely for Customer's internal business purposes.

2.2 Authorized Users. Customer is responsible for all activities that occur under its Authorized Users' accounts and for maintaining the confidentiality of login credentials. Customer shall promptly notify Provider of any unauthorized access to or use of the Services.

2.3 Use Restrictions. Customer shall not, and shall not permit any Authorized User or third party to: (a) reverse engineer, decompile, or disassemble the Services; (b) sublicense, resell, rent, lease, or distribute access to the Services to any third party; (c) use the Services to build a competing product or service; (d) remove or obscure any proprietary notices; or (e) use the Services in violation of any applicable law, including laws governing consumer financial information.

2.4 Reservation of Rights. Provider reserves all rights in the Services and Documentation not expressly granted to Customer under this Agreement.

3. SUBSCRIPTION TERM; ORDER FORMS

3.1 Order Forms. Customer's access to the Services is governed by one or more Order Forms, each of which will specify the applicable Subscription Plan (as described in Exhibit A), number of Authorized Users, Fees, and Subscription Term. Each Order Form is incorporated into this Agreement by reference.

3.2 Initial Term and Renewal. The initial Subscription Term will begin on the Effective Date (or such other date specified in the applicable Order Form) and continue for the period stated therein (the “Initial Term”). Unless otherwise specified in the Order Form, the Subscription Term will automatically renew for successive twelve (12) month periods (each, a “Renewal Term”) unless either Party provides the other with written notice of non-renewal at least thirty (30) days prior to the end of the then-current Subscription Term.

3.3 Plan Changes. Customer may request to upgrade or downgrade its Subscription Plan by submitting a new or amended Order Form. Upgrades will take effect upon Provider's acceptance of the applicable Order Form; downgrades will take effect at the start of the next Renewal Term unless otherwise agreed in writing.

4. FEES AND PAYMENT

4.1 Fees. Customer shall pay the fees set forth in the applicable Order Form, based on the Subscription Plan tiers described in Exhibit A (the “Fees”). All Fees are stated and payable in U.S. dollars.

4.2 Invoicing; Payment Terms. Unless otherwise specified in the Order Form, Provider will invoice Customer in advance on a monthly or annual basis, and Customer shall pay all undisputed invoiced amounts immediately upon receipt.

4.3 Taxes. Fees are exclusive of all applicable sales, use, value-added, and similar taxes, which Customer shall be responsible for, excluding taxes based on Provider's net income.

4.4 Late Payments. Any undisputed amount not paid when due shall accrue interest at the rate of one and one-half percent (1.5%) per month, or the maximum rate permitted by applicable law, if lower, from the date such payment was due until paid in full.

4.5 Fee Changes. Provider may adjust the Fees for a Subscription Plan effective as of any Renewal Term by providing Customer at least sixty (60) days' prior written notice.

5. CUSTOMER DATA; DATA SECURITY AND PROCESSING

5.1 Ownership. As between the Parties, Customer owns all right, title, and interest in and to the Customer Data. Provider acquires no rights in Customer Data except the limited rights necessary to provide the Services as described in this Agreement.

5.2 License to Provider. Customer grants Provider a limited, non-exclusive license to access, use, process, store, and transmit Customer Data solely as necessary to provide, maintain, secure, and support the Services, and as otherwise authorized by Customer or required by law.

5.3 Nonpublic Personal Information; Regulatory Compliance. Customer Data may include NPI relating to mortgage applicants, borrowers, or sellers that is subject to the Gramm-Leach-Bliley Act, Regulation P, and other applicable federal and state privacy and data security laws (collectively, “Financial Privacy Laws”). With respect to any NPI processed in connection with the Services, Provider shall:

(a) implement and maintain a comprehensive, written information security program with administrative, technical, and physical safeguards reasonably designed to protect the security, confidentiality, and integrity of NPI, consistent with the safeguards required under the Financial Privacy Laws;

(b) restrict access to NPI to Provider personnel and subcontractors with a legitimate need to know such information in order to provide the Services;

(c) not use, sell, rent, or disclose NPI for any purpose other than providing the Services to Customer, except as required by law; and

(d) cooperate with Customer's reasonable requests for information necessary for Customer to demonstrate compliance with the Financial Privacy Laws to its regulators.

5.4 Security Measures. Without limiting Section 5.3, Provider shall maintain administrative, technical, and physical safeguards designed to protect Customer Data, including, at a minimum: (a) encryption of Customer Data in transit and at rest using industry-standard algorithms; (b) role-based access controls and multi-factor authentication for administrative access; (c) periodic vulnerability scanning and at least annual third-party penetration testing; (d) logging and monitoring of access to production systems; and (e) background checks and periodic security awareness training for personnel with access to Customer Data.

5.5 Subprocessors. Provider may engage third-party subprocessors to assist in providing the Services. Provider shall maintain a list of subprocessors that process Customer Data, remain responsible for such subprocessors' compliance with this Section 5, and provide Customer with at least fifteen (15) days' advance notice of any new subprocessor that will process NPI, during which Customer may object on reasonable data-protection grounds.

5.6 Security Incident Notification. Provider shall notify Customer without undue delay, and in no event later than seventy-two (72) hours, after becoming aware of any unauthorized access to, or acquisition, disclosure, or use of, Customer Data (a “Security Incident”). Provider shall promptly investigate the Security Incident, take reasonable steps to mitigate its effects, and provide Customer with information reasonably necessary for Customer to comply with its own notification obligations to affected individuals or regulators.

5.7 Audit Rights. Upon Customer's written request, no more than once per calendar year (unless required by a regulator or in connection with an actual Security Incident), Provider shall make available its then-current SOC 2 Type II report (or a comparable industry-standard audit report) and shall reasonably cooperate with Customer's regulator-mandated inquiries regarding Provider's handling of Customer Data.

5.8 Data Return and Deletion. Upon expiration or termination of this Agreement, or upon Customer's written request, Provider shall, within thirty (30) days, make available to Customer an export of Customer Data in a commonly used format and thereafter securely delete Customer Data from its production systems, except as required to be retained by applicable law, and shall certify such deletion upon Customer's request.

5.9 Data Location. Provider shall store Customer Data in data centers located within the United States unless otherwise agreed in writing by the Parties.

6. CONFIDENTIALITY

6.1 Definition. “Confidential Information” means any non-public information disclosed by one Party (the “Disclosing Party”) to the other (the “Receiving Party”) that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure, including Customer Data, business and financial information, and the terms of this Agreement.

6.2 Obligations. The Receiving Party shall: (a) protect the Disclosing Party's Confidential Information using at least the same degree of care it uses to protect its own confidential information of similar nature, and no less than a reasonable degree of care; (b) use such Confidential Information only as necessary to perform its obligations or exercise its rights under this Agreement; and (c) not disclose such Confidential Information to any third party except to its employees, contractors, and advisors with a need to know, who are bound by confidentiality obligations at least as protective as those herein.

6.3 Exclusions. Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the Receiving Party; (b) was rightfully known to the Receiving Party prior to disclosure; (c) is rightfully received from a third party without breach of any confidentiality obligation; or (d) is independently developed without use of the Disclosing Party's Confidential Information.

6.4 Compelled Disclosure. The Receiving Party may disclose Confidential Information to the extent required by law or a valid order of a court or governmental agency, provided that, where legally permitted, it gives the Disclosing Party prompt notice and reasonably cooperates, at the Disclosing Party's expense, with any effort to seek a protective order.

7. INTELLECTUAL PROPERTY

7.1 Provider IP. Provider retains all right, title, and interest in and to the Services, Documentation, and all related intellectual property rights, including any improvements, modifications, or derivative works thereof.

7.2 Feedback. If Customer provides Provider with any suggestions, ideas, or feedback regarding the Services, Provider may use such feedback without restriction or obligation to Customer.

7.3 Aggregated Data. Provider may compile and use data derived from Customer's use of the Services in an aggregated and de-identified form that does not identify Customer or any individual, for purposes of improving and developing the Services and Provider's other products.

8. SERVICE LEVELS AND SUPPORT

8.1 Availability. Provider will use commercially reasonable efforts to make the Services available with an uptime of at least 99.5% during each calendar month, measured over the applicable Subscription Term, excluding scheduled maintenance and events of Force Majeure.

8.2 Support. Provider will provide technical support in accordance with the severity levels and response targets set forth in Exhibit B.

8.3 Service Credits. If Provider fails to meet the availability commitment in Section 8.1, Customer's sole and exclusive remedy shall be the service credit, if any, described in the applicable Order Form.

9. WARRANTIES; DISCLAIMERS

9.1 Mutual Warranties. Each Party represents and warrants that it has the legal power and authority to enter into this Agreement and that its performance will not conflict with any other agreement to which it is a party.

9.2 Provider Warranty. Provider warrants that the Services will perform materially in accordance with the Documentation during the Subscription Term. Customer's sole and exclusive remedy, and Provider's entire liability, for breach of this warranty shall be prompt correction of the non-conforming Services.

9.3 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE SERVICES AND DOCUMENTATION ARE PROVIDED “AS IS,” AND PROVIDER DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

10. INDEMNIFICATION

10.1 By Provider. Provider shall defend Customer against any third-party claim alleging that the Services, as used in accordance with this Agreement, infringe such third party's intellectual property rights, and shall indemnify Customer for damages finally awarded or amounts agreed to in settlement, provided Customer promptly notifies Provider of the claim and cooperates with Provider's defense. If the Services become, or in Provider's opinion are likely to become, the subject of an infringement claim, Provider may, at its option, procure the right for Customer to continue using the Services, replace or modify the Services to be non-infringing, or terminate the affected Services and refund any prepaid, unused Fees.

10.2 By Customer. Customer shall defend Provider against any third-party claim arising from: (a) Customer Data or Customer's use of the Services in violation of this Agreement; or (b) Customer's violation of applicable law, and shall indemnify Provider for damages finally awarded or amounts agreed to in settlement, subject to the same conditions set forth in Section 10.1.

10.3 Procedure. The indemnifying Party's obligations are conditioned on the indemnified Party providing prompt written notice of the claim, granting the indemnifying Party sole control of the defense and settlement (provided any settlement that imposes liability or obligations on the indemnified Party requires its prior written consent), and providing reasonable cooperation at the indemnifying Party's expense.

11. LIMITATION OF LIABILITY

11.1 Exclusion of Certain Damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, ARISING OUT OF OR RELATED TO THIS AGREEMENT, REGARDLESS OF THE THEORY OF LIABILITY, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

11.2 Liability Cap. EXCEPT FOR (a) EACH PARTY'S INDEMNIFICATION OBLIGATIONS UNDER SECTION 10, (b) A PARTY'S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS UNDER SECTION 6, (c) CUSTOMER'S PAYMENT OBLIGATIONS UNDER SECTION 4, OR (d) A PARTY'S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER TO PROVIDER UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

12. TERM AND TERMINATION

12.1 Term. This Agreement commences on the Effective Date and continues until all Order Forms have expired or been terminated in accordance with their terms and this Agreement.

12.2 Termination for Cause. Either Party may terminate this Agreement or any Order Form if the other Party materially breaches this Agreement and fails to cure such breach within thirty (30) days after written notice describing the breach.

12.3 Termination for Insolvency. Either Party may terminate this Agreement immediately upon written notice if the other Party becomes insolvent, makes an assignment for the benefit of creditors, or becomes subject to bankruptcy or similar proceedings that are not dismissed within sixty (60) days.

12.4 Effect of Termination. Upon expiration or termination of this Agreement: (a) all rights granted to Customer to access and use the Services shall immediately cease; (b) Customer shall pay all Fees accrued through the effective date of termination; and (c) Provider shall handle Customer Data in accordance with Section 5.8. Sections 1, 4 (as to accrued Fees), 5, 6, 7, 9.3, 10, 11, 12.4, and 14 shall survive any expiration or termination of this Agreement.

13. COMPLIANCE WITH LAWS

13.1 General Compliance. Each Party shall comply with all applicable laws and regulations in connection with its performance under this Agreement, including, with respect to Customer's use of the Services in connection with mortgage lending and quality control activities, the Gramm-Leach-Bliley Act, Regulation P, the Fair Credit Reporting Act, and applicable state privacy and data security laws.

13.2 Export Compliance. Each Party shall comply with all applicable export control and economic sanctions laws and regulations in connection with its use of, or access to, the Services.

13.3 Anti-Corruption. Each Party represents that it has not offered or provided, and shall not offer or provide, any improper payment or benefit in connection with this Agreement in violation of applicable anti-corruption laws.

14. GENERAL PROVISIONS

14.1 Governing Law; Venue. This Agreement shall be governed by and construed in accordance with the laws of the State of Tennessee, without regard to its conflict-of-laws principles. The Parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Tennessee for any dispute arising out of or relating to this Agreement.

14.2 Assignment. Neither Party may assign this Agreement without the other Party's prior written consent, except that either Party may assign this Agreement without consent in connection with a merger, acquisition, or sale of all or substantially all of its assets.

14.3 Force Majeure. Neither Party shall be liable for any failure or delay in performance due to circumstances beyond its reasonable control, including acts of God, natural disaster, war, terrorism, labor dispute, or failure of third-party infrastructure or utilities.

14.4 Notices. All notices under this Agreement shall be in writing and delivered by email (with confirmation of receipt), nationally recognized overnight courier, or certified mail, to the addresses specified in the applicable Order Form or as otherwise designated in writing.

14.5 Independent Contractors. The Parties are independent contractors, and nothing in this Agreement shall be construed to create a partnership, joint venture, agency, or employment relationship.

14.6 No Third-Party Beneficiaries. This Agreement does not confer any rights or remedies upon any person other than the Parties and their permitted successors and assigns.

14.7 Waiver; Severability. No waiver of any provision of this Agreement shall be effective unless in writing and signed by the waiving Party. If any provision of this Agreement is held unenforceable, the remaining provisions shall remain in full force and effect, and the unenforceable provision shall be modified to the minimum extent necessary to make it enforceable.

14.8 Entire Agreement; Amendment. This Agreement, together with all Order Forms and exhibits, constitutes the entire agreement between the Parties regarding its subject matter and supersedes all prior or contemporaneous agreements or communications. This Agreement may be amended only by a written instrument signed by both Parties.

14.9 Counterparts; Electronic Signatures. This Agreement may be executed in counterparts, each of which is deemed an original, and may be executed and delivered by electronic signature, each of which shall be binding to the same extent as an original signature.

IN WITNESS WHEREOF, the Parties have executed this Agreement as of the Effective Date.

EXHIBIT A

SUBSCRIPTION PLANS AND FEES

The table below describes the standard Subscription Plan tiers referenced in Section 4. The specific Subscription Plan, Fees, and any negotiated terms applicable to Customer are set forth in the applicable Order Form, which shall control in the event of any conflict with this Exhibit A.

Note: All amounts shown in brackets are placeholders to be completed prior to execution and cross-referenced against the applicable Order Form.

EXHIBIT B

SUPPORT SERVICES

Provider will provide technical support for the Services via email and an online support portal during Provider's standard business hours of 8:00 a.m.– 6:00 p.m., Central Time, Monday through Friday, excluding Provider holidays, with the response and resolution targets below applying based on the severity of the reported issue, as reasonably determined by Provider.