Master Services Agreement

This Agreement is made between Cyber Risk Analysis Group, LLC, a limited liability company organized under the laws of South Carolina and doing business as Crushable, and Crushable, LLC, a limited liability company organized under the laws of South Carolina (together, “Crushable”), located at 25 Goldsmith St, Greenville, SC 29609, and the Client, collectively the “Parties” and individually a “Party.”

This Agreement is effective as of the date first shown above.

The purpose of this Agreement is to establish the general terms and conditions under which Crushable will provide information technology, cloud and professional services, AI development services, and the xOPS software platform to the Client. These services are further detailed in and governed by subsequent Statements of Work (“SoWs”), quotes, or purchase orders (“POs”) that define specific projects, deliverables, subscriptions, and responsibilities. This Agreement forms the foundational contract setting forth the obligations and expectations of both Parties.

Services provided under this Agreement are detailed in quotes, POs, or SoWs accepted by both Parties.

Each SoW, quote, or PO must be formally documented and receive written approval from both Parties before services commence. A SoW, quote, or PO will detail the specific services to be provided, including but not limited to Managed Services, Support Services, Professional Services, AI Development Services, xOPS Platform subscriptions, Hardware, and Software. Any change to scope or terms must be made through a formal Change Request process and becomes effective only upon written approval from both Parties.

Client shall provide Crushable with timely, reasonable access to Client’s systems, networks, premises, and personnel as needed for service delivery, designate a primary contact, and respond within approximately one business day. Client shall ensure its environment meets applicable vendor specifications, maintain required licenses, maintain responsibility for its own data backups unless backup is purchased from Crushable, implement and maintain reasonable security measures, comply with applicable third-party vendor terms, and inform Crushable in advance of any material changes to its systems, network, or operations that affect service delivery. Client shall not modify, tamper with, or attempt to repair resold software or hardware unless expressly authorized by Crushable in writing.

All resold products are subject to the original vendor’s terms and conditions, including end-user license agreements, warranties, usage policies, and support limitations. Crushable makes no additional warranties, express or implied, regarding the performance, merchantability, or fitness for a particular purpose of resold products beyond those provided by the vendor, and is not liable for defects, failures, or interruptions caused by the vendor’s design, manufacturing, or service limitations.

Crushable guarantees the quality of its services as detailed in each SoW, quote, or PO. For a dissatisfied Client, Crushable will rectify the issue or provide a refund for the services in the 30 days preceding written notice, if and as specified in the applicable SoW.

The xOPS platform, including its shared Core, application framework, AI engine (the “Brain”), and all related software, tooling, and intellectual property (the “Platform”), is and remains the exclusive property of Crushable. Subject to this Agreement and payment of applicable fees, Crushable grants Client a non-exclusive, non-transferable license to access and use its dedicated Platform instance for Client’s internal business operations during the subscription term.

Each Client instance is single-tenant. By default, Crushable deploys the instance into Client’s own environment (Client’s cloud, Client’s data). Where Client prefers, Crushable may host the instance on Client’s behalf as a managed service, in which case availability, support, and maintenance terms will be specified in the applicable SoW.

Client owns all Client data within its instance. Client data is exportable in a commercially reasonable format at any time and upon termination. Crushable will not use Client data other than to operate, support, and improve Client’s own instance, and will not use Client data to train models for the benefit of any third party.

Bug fixes, feature enhancements, and maintenance for licensed applications are included in the subscription and delivered on a continuous basis, with no separate implementation project, change orders, or version-upgrade fees, except where new, out-of-scope applications or integrations are ordered under a new SoW, quote, or PO.

Each Client instance is maintained as a self-contained codebase on a mainstream technology stack. On request, the Parties may agree in a SoW to source-code escrow or handover terms that take effect on termination or on defined continuity events, to ensure Client can continue to operate its instance.

Crushable’s AI capabilities operate under a human-in-the-loop doctrine: AI drafts, a human approves, and consequential actions are audited. AI-generated output is provided as decision support for human review. Client is responsible for reviewing AI output and for any decision or action it takes based on that output.

Client acknowledges that AI systems are probabilistic and may produce output that is incomplete or inaccurate. Except for the professional-services warranty in Section 8, Crushable makes no warranty as to the accuracy, completeness, or fitness for a particular purpose of any AI-generated output, and Client shall not rely on such output without appropriate human verification.

Client data and inputs remain the property of Client. AI models, weights, prompts, pipelines, and tooling developed or provided by Crushable remain the property of Crushable, except as otherwise agreed in a SoW. Crushable will not use Client data to train models made available to third parties.

Client agrees to pay the fees specified in each SoW, quote, or PO. Fee structures, including fixed fees, hourly rates, and recurring subscription fees, are detailed in the applicable document. Except as otherwise stated in this Agreement or a SoW, all fees are non-refundable.

Unless otherwise specified in a SoW, xOPS Platform subscriptions are billed on a flat, recurring per-application basis with unlimited users, invoiced monthly or annually in advance, and renew automatically in alignment with the subscription term. Included continuous development is provided at no additional charge as described in Section 3.4.

Crushable will invoice according to the schedule in the applicable SoW; if unspecified, invoicing occurs monthly on the first, billed a month ahead. Payments are due within fifteen (15) calendar days of the invoice date, in U.S. currency. Any payment not made when due is subject to interest at the lesser of one and one-half percent (1.5%) per month or the highest rate permitted by law.

Fees do not include any taxes, levies, duties, or similar governmental assessments. Client is responsible for all applicable taxes unless a valid exemption certificate is provided.

Client is required to pay by Automated Clearing House (ACH) unless otherwise specified in a SoW, quote, or PO, and must notify Crushable of bank-account changes within 15 days. Payments made by methods other than ACH are subject to a surcharge of three percent (3%) of the amount paid, unless otherwise specified in a SoW, quote, or PO.

Client bears responsibility for third-party costs unless otherwise specified in the SoW.

Crushable retains all rights, title, and interest in and to all intellectual property arising out of or created during the performance of services, including the xOPS Platform and AI models and tooling, except as otherwise agreed in writing. Client retains rights to materials and data it provides. The Crushable name and logo are trademarks of Cyber Risk Analysis Group, LLC; nothing in this Agreement grants Client rights to use those marks.

Upon full payment, Crushable grants Client a non-exclusive license to use the deliverables provided under a SoW solely for Client’s internal business operations. Client grants Crushable a non-exclusive license to use Client materials solely to perform the services.

Client agrees not to remove, obscure, or alter proprietary-rights notices. Inventions developed during service delivery are disclosed to both Parties, with ownership determined by written agreement. Crushable warrants it holds the licenses necessary for the third-party products it provides and will inform Client of third-party licensing terms affecting usage. On termination, each Party returns or destroys materials containing the other Party’s intellectual property.

Crushable warrants that services will be performed in a professional and workmanlike manner in accordance with generally recognized industry standards, and in compliance with applicable laws. Client warrants that the data, materials, and information it provides will be accurate, complete, and reliable, and that it has the legal right to provide them.

Except for the express warranties in this Section, Crushable disclaims all other warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement. Crushable makes no warranty regarding third-party products or, except as stated in Section 8.1, regarding AI-generated output.

Neither Party is liable to the other for any indirect, special, incidental, punitive, or consequential damages, including lost profits, even if advised of the possibility. Crushable’s maximum liability under this Agreement will not exceed the total amount paid by Client under the last Statement of Work preceding the event giving rise to the liability.

For a warranty breach, Crushable’s sole obligation and Client’s exclusive remedy is, at Crushable’s option, to re-perform the deficient services at no additional charge or to return the fees paid for those services, provided Client notifies Crushable within 30 days. Warranties continue for ninety (90) days following delivery of the services.

This Agreement commences on the Effective Date and continues for two (2) years, unless a different term is specified in a SoW, quote, or PO. Unless either Party provides written notice of non-renewal at least sixty (60) days before the end of the current term, it renews automatically for successive two (2) year terms.

Either Party may terminate immediately if the other materially breaches and fails to cure within the specified period, violates legal requirements, becomes insolvent, files for bankruptcy, or enters receivership. Client waives any right to compel Crushable to continue services under any “critical vendor” or similar designation without full and timely payment of all pre-petition and post-petition obligations.

On termination, obligations cease except those that continue by nature. Each Party settles final accounts within 30 days, returns or destroys the other’s property and data, and provides destruction certification if requested. Confidentiality, dispute resolution, indemnification, and liability clauses survive. Client may request reasonable transition services for up to 90 days, and — for xOPS — a final export of Client data, subject to fee and scope agreement.

Each Party will implement and maintain reasonable security measures — including encryption, secure storage, and controlled access — to protect personal and sensitive data exchanged under this Agreement, and will comply with all applicable data-protection laws governing the collection, processing, and storage of personal data.

Where Crushable creates, receives, maintains, or transmits Protected Health Information (“PHI”) on behalf of Client — including through the xOPS Healthcare applications — the Parties will execute a Business Associate Agreement (“BAA”) that complies with HIPAA and 42 CFR Part 2. In the event of a conflict between the BAA and this Agreement with respect to PHI, the BAA controls.

For engagements subject to regulatory frameworks — including CMMC, ITAR, EAR, DFARS, HIPAA, or FedRAMP — the applicable SoW will specify the controls, responsibilities, and compliance obligations of each Party.

Neither Party will make public announcements or press releases regarding this Agreement without the other’s prior written consent, unless required by law. Client agrees not to make public statements that disparage, defame, or otherwise harm the reputation of Crushable, its affiliates, employees, or services; this obligation survives termination for three (3) years.

During the term and for two (2) years thereafter, Client will not directly or indirectly solicit or hire Crushable’s employees without prior written consent, and both Parties will refrain from soliciting or inducing the other’s clients, customers, or partners to terminate or diminish their relationship without prior written consent.

This Agreement is for the mutual benefit of the Parties and confers no rights on third parties. Either Party may use subcontractors while remaining responsible for their compliance, subject to notice and, where applicable, consent. Titles and headings are for convenience only. This Agreement binds and benefits the Parties and their permitted successors and assigns. In the event of inconsistency between this Agreement and any attachment, the terms of the applicable SoW, quote, or PO prevail unless otherwise specified.