Loading...
HomeMy WebLinkAboutOrigami Software Subscription DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF . . ORIGAMI RISK CONFIDENTIAL SOFTWARE SUBSCRIPTION AGREEMENT This SOFTWARE SUBSCRIPTION AGREEMENT (this "Agreement") is entered into as Of D,ecethber 8, 2021 (the "Effective Date") by and between ORIGAMI RISK LLC, a Delaware limited liability company ("Origami"), and City of Auburn,a city in King County,Washington ("Client"). Origami and Client hereby agree as follows: 1. DEFINITIONS. parties pursuant to this Agreement from time to time. The "Affiliate" means, with respect to a party, its initial Statement of Work is attached hereto as Exhibit A, parent company and subsidiaries and/or controlled and the pricing detail with respect to such Statement of corporations or entities which are directly or indirectly Work is attached hereto as Exhibit B. controlled by, or under common control with, such party. "User" means any employee, contractor, agent, "Client'Data"means the data provided or inputted customer, investor, consultant or service provider of Client by or on behalf of Client or any User or Affiliate of Client or any of Client's Affiliates who uses or accesses the for use with the Service. Service or any other person or entity that is provided user credentials to the Service by or on behalf Of Client or any "Client Party" means Client and each of its of Client's Affiliates. Affiliates and Users. "Work Product" means Customizations and any "Confidential Information" means all software, programming, tools, documentation, and confidential and proprietary information of a party, materials that arc used, created, developed, or delivered by including, without limitation, business plans, strategies, Origami to Client in connection with Customizations, and products, software, source code, object code, clients, data all Intellectual Property Rights subsumed therein. models, discoveries,.inventions, developments, know-how, 2. SERVICE. . improvements, works of authorship, concepts, or expressions thereof, whether or not subject to patents, (a) Service. Subject to the terms and copyright, trademark, trade secret protection or other conditions of this Agreement, during the term of this intellectual property right-protection. Agreement, Origami hereby grants Client a non-exclusive "Customizations" means specifically modified right to permit its Users to access the Service via the reports, dashboard panels, or other configurations, features Internet. Client, its Affiliates and Users may use the or modules of the Service customized for Client. Service solely for internal business of Client, its Affiliates and Users. Users shall use the Service in accordance with "Documentation" means all user guides, videos, this Agreement and the applicable Statement of Work and embedded help text, and other reference materials Documentation. generally furnished with respect to the Service, whether in printed or electronic format. (b) Storage. Client may store Client Data through the Service up to the amount set forth in the "Fees" means the fees payable pursuant to this applicable Statement of Work. If the amount of storage Agreement as set forth in any Statement of Work. used exceeds this limit; Client will be charged, on a "Intellectual Property Rights" means worldwide monthly basis, the. excess storage fees pursuant to the intellectual and proprietary property owned or properly Statement of Work: licensed by a party and all intellectual or proprietary (c) Service Level Agreement. Origami's property rights subsumed, therein, including copyright; Service Level Agreement with respect to the Service is set patent, trademark (including goodwill), trade dress, trade forth as Exhibit_C (the"Service'Level Agreement") Any secret and know-how rights. Excluded Event (as defined in such Service Level "Professional Services" means professional Agreement) and any unavailability of the Service that does services provided by Origami to Client as set forth in any not constitute a failure of the Availability Requirement set Statement of Work. forth in such Service Level Agreement shall not constitute a breach of this Agreement. "Service" means Origami's software-as-a-service identified in the Statement of Work and accessible by (d) Restrictions. Nothing in this Agreement Client via https://live.OrigamiRisk.com or another shall be construed as a grant to Client of any right to, and designated'web site or IP address or mobile application, Client shall not, and shall not permit any User or any other rendered to Client by Origami. third party to: (i)reproduce, license, sublicense, sell,resell, "Statement of Work" means any statement of transfer, assign, distribute Or otherwise commercially work entered into and mutually approved in writing by the exploit or make available to any third party the Service or DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ORIGAMI RISK CONFIDENTIAL any portion thereof; (ii) distribute, disclose or allow use of any other User. Client's failure to cause a User to comply any of the Service, or any portion thereof, in any format, with the terms of, this Agreement or any uncured User through any timesharing service, service bureau, network noncompliance shall constitute a material breach of this or by any other means, to or by any third party; (iii) Agreement by Client. decompile, disassemble; or otherwise reverse engineer or (1). Third Party Access. Client shall also attempt to reconstruct or discover any source code or have the rght for. Client and its.Affiliates to permit third underlying ideas or algorithms of the Service in any party Users to access or use the Service in accordance with manner; (iv) create derivative works from, modify Or alter the terms and conditions of this Agreement and the any of the Service in any manner whatsoever; (v) use or applicable Statement of Work, provided that each such access the Service in a manner that would reasonably be third party User has agreed in writing to Origami's Third expected to damage, disable, overburden, or impair any Party User Agreement ("Third Party Terms") prior to or Origami servers or the networks connected to any Origami upon such User's initial login to the Service..Such Third server (and if any access or use of the Service does Party Terms are available from Origami upon request. damage, disable, overburden, or impair any Origami Clientmay meet this requirement with respect to any third servers or the networks connectedto any Origami server, party User by requiring such third party User to accept the then Client shall promptly discontinue such access or use Third Party Terms as part of a click-through that can be upon written notice of such by Origami); (vi) take any enabled to appear upon such third party User's initial login action that would reasonably be expected to interfere with to the Service. Any rights granted hereunder or under the any third party's use and enjoyment of the Service (and if Third Party Terms with respect to the Service to third party any Client action does interfere with any third party's use Users shall expire or terminate immediately upon the and enjoyment of the Service, then Client shall promptly termination of this Agreement in accordance with its discontinue such action upon written notice of such by terms. Client shall be fully responsible for(i) ensuring the Origami); (yii) attempt to gain unauthorized access to the compliance of each Client Party with the terms and Service, accounts, computer systems,. or networks - conditions of this Agreement; the applicable Statement of connected to any Origami server; (viii) use any robot, Work and Documentation, and the applicable Third Party spider or other automatic device or manual process to User Agreement, and (ii) all violations of the terms or monitor or copy portions of the Service; (ix) use the Service in a manner intended to abuse or violate the conditions of this Agreement, the applicable Statement of Work and Documentation, and the applicable Third Party privacy or property rights of others; (x) perform any Terms by each Client Party. vulnerability scanning or penetration testing on the Service or Origami's systems or networks without Origami's (g) Professional Services. During the term of explicit prior written consent for each such scan or test; or this Agreement, Origami will make available to Client (xi) access the Service in order to (A) build a competitive certain Professional Services to the extent set forth in the product or service, or (B) build a product using similar Statement of Work. Client may also contract for expanded unique and confidential ideas, features, functions or services for additional days and hours in accordance with graphics of the'Service. the rates set forth in the Statement of Work, or if no such rates are specified, Origami's then-current policies and (e) Users. Client may permit the number of prices. Notwithstanding the foregoing, Origami will not be authorized Users as set forth in the Statement of Work to obligated to provide any support required as a result of, or use the Service. Each authorized User shall access and use with respect to, (i) Client's operating systems, networks, the Service (i) in accordance with the terms of this hardware; or other related equipment of Client, or (ii) Agreement and the applicable Statement of Work and Client's or any of its Users' use of the Service other than Documentation, and, (ii) when applicable, through a in accordance with the applicable Statement of Work and unique and reasonably secure username and password as Documentation and as permitted under this Agreement. further described in the applicable Statement of Work or Documentation. The Service allows Client to grant (11) Client Obligations. Client shall: (i) different levels of'access to Client Data, to different Users, provide Origami with reasonable access to Client's as described in more detail in the Statement of Work. It is premises to the extent necessary to enable Origami. to Client's responsibility to designate the applicable access to perform its obligations hereunder; (ii) provide adequate be granted to each User. Client shall cause all Users to resources to participate in or facilitate the performance of comply with all obligations of Client hereunder, to the the Service; (iii) timely participate in meetings relating to extent applicable to Users. Except for Client's and its the Service; (iv) assign personnel with relevant training Affiliates' system administrators where reasonably and experience to work in consultation with Origami; (v) necessary for administrative or security purposes, no Uscr meet the requirements to use the Service as set forth at may use the username/user identification or password of http://www.origamirisk.com/product-requirements; (vi) 2 • DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ;',f• ORIGAMI RISK CONFIDENTIAL safeguard the usernames, passwords and other security software (other than the Service); or (3) Force Majeure data, methods and devices furnished to Client in Event. connection with the Service and prevent unauthorized (k) Mobile Service. The Servicemay include access to or use of the Service and promptly notify certain services that are available via an. .application Origami if it becomes aware of any such unauthorized downloaded and installed on a mobile device. To the access or that the security of its usernames or passwords extent Client chooses to use such application, Client has been compromised; (vii) be responsible for Client acknowledges and agrees that Client Data may be stored networks, equipment and system security required or locally on a mobile device as part of such service and that appropriate in connection with the Service; (viii) have sole the physical security of any mobile device used to access responsibility for the accuracy, quality, legality, reliability such services is Client's responsibility. If Client or any and appropriateness of all Client Data; (ix) transmit Client User elects to store data on a mobile device, Origami shall Data only in an encrypted format as set forth in the Service not be responsible for any loss of Client Data or any other Level Agreement or as otherwise mutually agreed by the data on such device. parties; (x) obtain'all consents and authorizations from any third parties that Client requires in order for Origami to 3. INTELLECTUAL PROPERTY provide the Service and perform the Professional Services RIGHTS. (and Origami shall not be required to enter into agreements with any such third parties), and (xi) take such other (a) Origami Intellectual Property Rights. actions as are required of Client pursuant to this As between Origami and Client, Origami owns all right, Agreement, including any Statement of Work. title and interest; including all related Intellectual Property Rights in and to, or related to the Service and Work (i) Client Warranty. The parties Product, including all software programs contained acknowledge and agree that during the term of this therein. To the extent that any such Intellectual Property Agreement a Client Party or other third parties may Rights do not otherwise vest in Origami or its licensors, disclose certain Client Data, including personally Client hereby agrees to promptly assign such intellectual identifiable data regarding employees or other individuals, Property Rights to Origami or its licensors, and to do all to Origami for the benef t of a Client Party. With respect to other acts reasonably necessary to perfect-Origami's or its any Client Data so disclosed by, or on behalf of, a Client licensors' ownership thereof, without additional Party to Origami, Client represents and warrants to consideration of any kind. The Origami name;the Origami Origami that: (i) each such Client Party, and such other logos, and the product names associated with the Service third parties operating on Client's behalf are authorized to are trademarks of Origami or third parties, and no right or collect,use and disclose the Client Data to Origami for use license is granted with respect to their use. The Service and storage pursuant to this Agreement; (ii) such may contain intellectual property belonging to third disclosure, use or. storage does not and shall not violate parties. All such intellectual property is and shall remain applicable law or, if applicable, such Client Party's the property of•its respective owners. Except for the agreements with or privacy notices to individuals with limited rights expressly granted herein, all right, title and respect to whom the Client Data relates; and (iii) Client interest in and to the Service and Work Product are shall not request Origami to use, store, disclose or reserved by Origami, and, except as expressly granted otherwise process Client Data in any manner that would herein, nothing contained in this Agreement shall be riot be permissible under applicable law or, if applicable, construed as conferring any right, title, interest or license such Client Party's agreements with or privacy notices to with respect to the Service or Work Product upon Client, individuals with respect to whom the Client Data relates, if by implication, estoppel or otherwise. In addition, Client done by Client. agrees and acknowledges that Origami shall have an (j) Nan-Origami Events. Client unlimited right to incorporate into any updates, upgrades, acknowledges and agrees that Origami shall not be or modifications to the Service all suggestions, ideas, responsible or liable for any delay or failure in its enhancement requests, feedback, recommendations or performance of any duties or obligations pursuant to this other information provided by Client or any User relating Agreement, including any Statement of Work, to the extent to the Service. Such Service, as updated, upgraded, or such delays or failures result or ariSe from any (I) act or modified, Shall be owned by Origami as provided in this omission of any Client Party, including any delays in their Section. Client expressly acknowledges and agrees-that the performance or cooperation with respect to the obligations Work Product Shall not constitute work Made-for-hire or warranties set forth in this Agreement or any Statement under the United States Copyright Act, and that Origami of Work; (2) failure of any Client Party's equipment or shall have the exclusive right to protect the Work Product by patent, copyright, or any other means. Work Product 3 DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ORIGAMI RISK CONFIDENTIAL shall be made available to Client as part of the Service to reasonably incurred by Origami in the course of the extent set forth in the Statement of Work, and Client performing the Service. shall have no other right to use any Work Product provided (c) Taxes. Client shall be liable for any taxes that Client may disclose Work Product to third parties to (including without limitation sales, use, excise and gross the extent required by the public records laws of receipts taxes), charges, tariffs, and duties and any interest Washington State(e.g. RCW 42.56). and penalties arising under this Agreement, excluding (b) Client Data. Client Data shall be taxes based upon Origami's income. All such taxes may be Confidential Information of Client under this Agreement. included in amounts invoiced by Origami to Client. As between Origami and Client, Client shall own all right, title and interest in and to the Client Data, which shall (d) Payments. All Fees under this Agreement never be deemed to be the Service or Work Product, even shall be payable by Client in accordance with the if delivered or incorporated therewith. Origami shall have applicable Statement of Work or as otherwise agreed by no responsibility, whatsoever, for the accuracy, quality, the parties. Fees shall be due within 30 days of invoice legality, reliability, appropriateness, and intellectual date. Payments remitted after 30 days shall bear interest at property ownership of Client Data, and Origami shall not 1.5 percent per month. Except as provided in Sections 7(b) review, monitor or check the Client Data except as and 9(a), all Fees paid hereunder are non-refundable. necessary to provide the Service to Client. Origami shall Without limiting Origami's other rights and remedies, if not be responsible or liable for the deletion, destruction, Client does not pay a correct overdue invoice within 15 damage or loss of any Client Data through no fault of days after receiving notice from Origami of nonpayment Origami or its providers without' limiting Origami's unless Client has notified Origami of a good faith dispute liability to maintain backup data as set forth in the Service prior to such time, then Origami may suspend Client's Level Agreement. Upon Client's written request within,30 access to the Service and the Professional Services until days following the termination of this Agreement, Origami Origami receives such payment, and Fees shall continue to will at its expense provide electronic files to Client in accrue during any such period;provided that this shall not delimited text:format containing Client's Client Data and be deemed to limit Client's right to the return of its Client will then destroy and/or erase all copies of Client Data. Data pursuant to Section 3(b) of this Agreement. Subject to Origami's confidentiality obligations set forth in 5. CONFIDENTIALITY. this Agreement, Client agrees that Origami shall have the right to collect and'use data or information resulting from a (a) Confidential Information. Each party Client Party's use of the Service, but not Client Data, so acknowledges and agrees that during the term of this long as such data and, information is de-identified and Agreement it may be furnished with or otherwise have aggregated so that it cannot identify, be traced back to or access to Confidential Information of the other party. The otherwise be associated in any manner with Client or any party that has received Confidential' Information (the particular individual. "Receiving Party"), in fulfilling its obligations under this Section, shall exercise the same degree of care and (c) Notices of Infringement. in the event protection with respect to the Confidential Information of Client discovers or is notified of an actual or suspected the party that has disclosed Confidential information to the infringement of the rights of Origami or its licensors in or Receiving Party (the "Disclosing Party") that it exercises to the Service or any unauthorized access to or use of the with respect to its own Confidential Information, but in no Service (each, an,"infringement"), Client shall promptly event shall the Receiving Party exercise less than a notify Origami of-such known or suspected Infringement reasonable standard of care.. The Receiving Party shall and terminate' such infringement to the extent within only use, access and disclose Confidential [nformation as Client's control. Client agrees to reasonably cooperate necessary to fulfill its obligations under 'this Agreement, with and assist Origami (at Origami's sole expense) in including any Statement of Work, or in exercise of its 'protecting, enforcing and defending Origami's rights in rights expressly granted hereunder. 'Receiving Party shall and to the Service. not directly or indirectly disclose, sell, copy, distribute, 4. FINANCIAL TERMS. republish, create derivative works from, demonstrate or allow any third party to have access to any of Disclosing (a) Fees. Client shall pay to Origami the Fees Party's Confidential Information; provided that the set forth in any Statement of Work or as otherwise agreed Receiving Party may disclose the Disclosing Party's in writing by the parties. Confidential Information to its directors, officers, (b) Expenses. Client shall reimburse Origami employees, subcontractors, agents, Affiliates orother for all pre-authorized in writing, reasonable, documented representatives (collectively, the "Representatives") who out of pocket travel, lodging, meal and other expenses have a need to know and who are bound,by confidentiality 4 DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF 'Nt'' ORIGAMI RISK CONFIDENTIAL obligations with respect to such Confidential Information event during the term of this Agreement will Origami that are substantially similar to those set. forth in this materially diminish the protections provided by the Section. The :Receiving Party shall be responsible and controls set forth in such SOC 2 Report. Such safeguards liable for any breach of this Section by any of its shall comply with data privacy laws that are applicable to Representatives. This Agreement (including all Statements Origami in its performance of this Agreement, including, of Work and pricing thereunder) and all Intellectual without limitation, any applicable data privacy laws Property Rights with respect to the Service and Work addressing personally identifiable information that may be Product shall be deemed to be Confidential Information of contained in the Client Data. Origami shall also maintain Origami under this Agreement. an internal information security management program that (b) Exclusions. The following information addresses data security and the security controls employed shall not be considered Confidential Information subject to by Origami in compliance with this Agreement. Origami this Section: (i) information that is publicly available or shall encrypt Client Data as set forth in the Service Level later becomes available other than through a breach of this Agreement. Agreement; (ii) information that is known to the Receiving Party or its Representatives prior to such disclosure or is (c) Notification. Origami shall inform Client promptly and without undue delay in the event that it independently developed by the Receiving Party or its learns of any breach of Origami's systems resulting in Representatives subsequent to such disclosure; or (iii) unauthorized disclosure of, or access to, any Client Data. information that is subsequently lawfully obtained by the Any such notice will provide a description about the Client Receiving Party or its Representatives from a third party Data that was accessed to the extent available at the time without obligations of confidentiality. If the Receiving of the notice. Origami will provide regular updates to Party is required by law to disclose any portion of the Client as additional details about the nature of the affected Disclosing .Party's Confidential Information that is Client Data become available. Origami agrees to mitigate, expressly marked as confidential, Receiving Party shall to the extent practicable,, any harmful effects from such give prior timely notice of such disclosure to Disclosing breach that are or become known to Origami. Party to permit Disclosing Party to seek a protective or similar order, and, absent the entry of such an order, 7. TERM AND TERMINATION. Receiving Party shall disclose only. such Confidential Information as is necessary he disclosed in response to (a) Term. This Agreement shall commence such subpoena, court Order or other similar document. on the Effective Date and continues until all Statements of Work have expired or have been terminated sooner in (c) Return of Confidential Information. accordance with this Section. The term of each Statement Upon termination or expiration of this Agreement, the of Work shall be as specified therein (or, if not specified, Receiving Party will promptly return or destroy any shall run until the completion of the applicable Confidential Information in the possession or control of Professional Services thereunder). the Receiving Party, unless required by law to retain the information. Origami's obligation to return and destroy (b) Termination for Breach. This Client Data is set forth in Section 3(b). Agreement may be terminated by either party upon written notice to the other party if the other party breaches any 6. DATA SECURITY. material term and fails to cure such breach within 30 days after receipt of written notice of such breach. If Client (a) Audit Report. Upon Client's written terminates the Agreement for Origami's breach in request to Origami during the term of this Agreement (no accordance with this paragraph,.Origami shall refund to more than once in any 12-month period), Origami shall Client, within 45 days of the effective date of such provide a copy of its Service Organization Control (SOC) termination, any prepaid but unearned Fees paid to 2 audit report (or an equivalent audit report or pursuant to Origami in advance by Client. a successor standard) ("SOC 2 Report") to Client, and such report shall contain an unqualified opinion. Such (c) Termination for Insolvency. Either party audit report shall be deemed Confidential Information may terminate this Agreement immediately upon notice to under the terms of this Agreement. the other party if the other party (i) becomes insolvent or (b) Safeguards. Origami shall maintain admits its inability to pay its debts generally as they commercially reasonable administrative, technical and become due, (ii) becomes subject, voluntarily or physical safeguards designed to protect the security and involuntarily, to any proceeding under any bankruptcy or privacy of Client Data. Such safeguards are described in insolvency law, which is notfully stayed within seven . business days or is not dismissed or vacated within 45 days Origami's most recently completed SOC 2 Report. In no after filing, (iii) is dissolved or liquidated or takes any 5 DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ` ± ORIGAMI RISK CONFIDENTIAL company action for such purpose or ceases to exist as a PROFESSIONAL SERVICES, OR ANY OTHER going concern, (iv) makes. a general assignment for the SERVICES PROVIDED HEREUNDER OR THE USE benefit of creditors, or (v) has a receiver, trustee, THEREOF BY CLIENT AND ITS USERS, INCLUDING custodian, or similar agent appointed by order of any court QUALITY, PERFORMANCE; MERCI-IANTABILITY, of competent jurisdiction to take charge of or sell all or FITNESS FOR A PARTICULAR PURPOSE OR NON- substantially all of its property or business. INFRINGEMENT, AND ORIGAMI HEREBY DISCLAIMS THE SAME. EXCEPT AS OTHERWISE (d) Events Upon Termination. Upon the SET FORTH IN THIS AGREEMENT, ORIGAMI AND termination of this Agreement: (i) Origami shall cease ITS LICENSORS DO NOT REPRESENT OR providing the Service to Client, and Client and its Users WARRANT THAT: (a) THE USE OF THE SERVICE shall cease use of the Service; and (ii) Origami shall WILL BE UNINTERRUPTED OR ERROR-FREE; OR invoice Client for all accrued Fees and all reimbursable (b) THE SERVICE 'WILL MEET CLIENT'S expenses. Client shall pay the invoiced.amounts, including REQUIREMENTS OR EXPECTATIONS; OR (c) ALL from,previously issued invoices,within 30 days of the date ERRORS OR DEFECT S IN THE SERVICE WILL BE of such invoice. CORRECTED. (e) Survival. Except as otherwise set forth (ii) CLIENT ACKNOWLEDGES herein, in the event of termination of this Agreement for AND AGREES THAT THE.SERVICE IS A TOOL TO BE USED BY CLIENT .IN THE COURSE OF any reason, the provisions,of Sections 2(i), 2(j), 3, 5, 7(d), EXERCISING ITS PROFESSIONAL JUDGMENT. THE and 9 through 13, as well as all payment SERVICE MAY BE SUBJECT TO LIMITATIONS, obligations„ s, shall survive. DELAYS, AND OTHER PROBLEMS INHERENT IN 8. LIMITED WARRANTY. Ti-IE USE OF THE INTERNET AND ELECTRONIC (a) Service Warranty. Origami warrants that COMMUNICATIONS. ORIGAMI IS NOT the Service will perform in all material respects in RESPONSIBLE FOR ANY DELAYS, 'DELIVERY accordance with the Documentation when used in FAILURES, OR OTHER DAMAGE RESULTING accordance with the terms of this Agreement on the FROM SUCH PROBLEMS OUTSIDE: OF ITS hardware and with the third-party software specified by REASONABLE CONTROL. NO ORIGAMI AGENT OR Origami from time to time. Client's sole remedy for any EMPLOYEE IS AUTHORIZED TO MAKE ANY breach by Origami of the warranty provided in this Section EXPANSION, MODIFICATION OR ADDITION TO shall be replacement of the nonconforming Service, at THIS LIMITATION AND EXCLUSION OF Origami's sole expense, as described herein. Origami shall WARRANTIES IN THIS AGREEMENT. deliver to Client replacement Service, a work-around (iii) Origami shall not be responsible and/or an error/bug fix as may be necessary to correct the for: (A) any non-conformities of the Service with nonconformity. Documentation, Omissions, delays, inaccuracies or any (b) Professional Services Warranty. other failure caused by a Client Party's computer systems, Origami represents and warrants that. the Professional hardware or software(other than the Service), including by Services shall be performed in a professional and interfaces with such third party software, or any commercially reasonable manner consistent with the inaccuracies that such systems may cause within the standard of care exercised in the industry. Client's sole Service; or (B) any data that Origami receives from a remedy for breach of this warranty Shall be re-performance Client Party or third party sources and including the data's of the nonconforming Professional Services, provided that accuracy or completeness, or Client's claim handling or Origami must have received written notice of the other decisions. Origami disclaims any liability for nonconformity from Client no later than 30 days after the interception of any such data or communications, original performance of the applicable Professional including of encrypted data. Client agrees that Origami Services by Origami. shall have no responsibility or liability for any damages arising in connection with access to or.use of the Service (c) Disclaimers. by any Client Party to the extent such access or use is not (i) EXCEPT AS OTHERWISE authorized by this Agreement. EXPRESSLY STATED IN THIS AGREEMENT, 9. INDEMNIFICATION BY ORIGAMI. ORIGAMI MAKES NO WARRANTY OR REPRESENTATION WHATSOEVER, EITHER (a) Indemnification. Origami agrees to EXPRESS, IMPLIED OR STATUTORY, WITH indemnify, defend, settle, or pay any third party claim or RESPECT TO THE SERVICE, WORK PRODUCT, action against a Client Party for infringement of any U.S. 6 DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ORIGAMI RISS CONFIDENTIAL patent or copyright arising from Client's use of the Service CONSEQUENTIAL DAMAGES ARISING UNDER OR in accordance with,this Agreement. If the Service or any IN CONNECTION WITH THIS AGREEMENT, THE part of the Service is held to infringe and the use thereof is SERVICE OR THE PROFESSIONAL SERVICES, enjoined or restrained or, if as a result of a settlement or WIIETI-IER BASED IN CONTRACT, TORT, compromise, such use is materially adversely restricted, INTENDED CONDUCT OR OTHERWISE, Origami shall, at its own expense and as Client's sole INCLUDING WITHOUT LIMITATION, DAMAGES remedy therefor (other than the indemnification obligation RELATING TO THE LOSS OF PROFITS, INCOME, set forth above), either: (i) procure for Client the right to GOODWILL OR REVENUE, COSTS INCURRED:AS A continue to use the Service; or (ii) modify the Service to RESULT OF DECISIONS ,MADE, iN RELIANCE ON make it non-infringing, provided that such modification THE SERVICE, LOSS OF USE OF THE SERVICE OR does not materially adversely affect Client's authorized ANY OTHER SOFTWARE OR OTHER PROPERTY, use of the Service; or (iii) replace 'the Service with a LOSS OF DATA, THE COSTS OF RECOVERING OR functionally equivalent non=infringing program at no RECONSTRUCTING SUCH DATA OR THE COST OF additional charge to Client; or(iv) if none of the foregoing SUBSTITUTE SOFTWARE, SERVICES OR DATA, OR alternatives is'reasonably available to Origami, terminate FOR CLAIMS BY THIRD PARTIES, EVEN IF this Agreement and refund to Client any prepaid but ADVISED OF THE POSSIBILITY OF SUCH unearned Fees paid to.Origami in advance by Client prior DAMAGES. to the effective date of the termination. (b) Limitation of Liability. UNDER NO (b) 'Exclusions. Origami's indemnification CIRCUMSTANCES SHALL ORiGAMI.'S obligations under Section 9(a) shall not apply to the extent AGGREGATE MAXIMUM LIABILITY' ARISING the claim is based on: (i) modifications to the Service or UNDER OR 1N CONNECTION WITH THIS any component thereof made by anyone other than AGREEMENT, TI,II SERVICE OR THE Origami or on behalf of Origami; (ii) use of any Service in PROFESSIONAL SE.RV10ES EXCEED THE combination with a product not supplied by Origami; or PAYMENTS ACTUALLY MADE TO ORIGAMI (iii) use of any Service other than in accordance with this HEREUNDER DURING THE 12 MONTHS Agreement and the Documentation. PRECEDING THE DATE ON WHICH ANY CLAiM IS (c) Conduct. Origami shall have the sole MADE AGAINST ORIGAMI. right to conduct. the defense of any such infringement 12. EXPORT CONTROL. claim or action and all negotiations for its settlement or compromise, and to settle or compromise any such claim. (a) Export. Client shall not export the Service or any Work Product in violation of applicable United Client agrees to cooperate and ensure that each Client States laws and regulations. Client also agrees that it will Party cooperates with Origami in doing so. Client agrees to not knowingly export, directly or indirectly, the Service or give Origami prompt written notice, in no case longer than any Work Product (i) that it knows will.directly assist in within seven days of receipt or discovery, of any threat, the design, development, production, stockpiling or use of warning, or notice of any such claim or action, with copies missiles,nuclear weapons or chemical/biological weapons; of any and all documents each Client Party may receive (ii) to any entity on the Department of Commerce Entity relating thereto. List or any person or entity on the Department of 10. INDEMNIFICATION BY CLIENT. Commerce Denied Persons List, each currently available at Client agrees to indemnify, defend and hold harmless http://www.bis.doc.gov; or (iii) to any country subject to Origami, its Affiliates, and all their officers, directors, sanctions administered by the Department of the members, managers, shareholders, employees and other Treasury's Office Of Foreign Assets Control or to any agents for and against any damage, cost, liability, expense, person or entity on the lists of prohibited entities and claim, suit, action or other proceeding, to the extent based persons maintained by such office, currently_ available at on or arising in connection with: (a) .any breach of this httlr//www.ustreas.gov/of.ac._ Agreement by a Client Party in connection with Client (b) Disclaimer. Origami makes no Data; or (b) a,Client Party's violation of any Federal, state representation that the Service is appropriate or available or local law, rule or regulation relating to such Client for use in other locations. If Client uses the Service from Party's collection and use of any Client Data. outside the United States of America, Canada, the United 11. LIMITATION OF LIABILITY. Kingdom and/or the European Union, Client is solely (a) Disclaimer of Damages. IN NO EVENT responsible for compliance with all applicable laws, WILL ORIGAMI BE LIABLE FOR. ANY INDIRECT, including export and import regulations of other countries. SPECIAL, PUNITIVE, INCIDENTAL OR DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ` ' ORIGAMI RISK CONFIDENTIAL Any diversion of the Service contrary to applicable law is an agreement between the parties. The parties may amend prohibited. this Agreement only by a written agreement of the parties 13. GENERAL. that identifies itself as an amendment to this Agreement. (a) Notices. Any notice, request, demand or (0 Waivers. The parties may waive any other communication (each, a "Notice") given pursuant to provision in this Agreement only by a writing.executed by this Agreement must be in writing and delivered to the the party against whom the waiver is sought to be other party by either personal delivery, Certified Mail enforced. No failure or delay in exercising any right or (return receipt requested and postage prepaid), nationally remedy, or in requiring the satisfaction of any condition, recognized overnight courier (with all fees prepaid) or e- under this Agreement, and no act, omission or course of mail at the address of such party listed on the signature dealing between the parties, operates as a waiver or page to this Agreement. A party may change'its address by estoppel of any right, remedy or condition. A waiver once giving Notice pursuant to this Section. given is not to be construed as a waiver on any future (b) Assignment. Neither party shall have the occasion or against any other person. right to assign, transfer, or sublicense any obligations or (g) Severability. In the event that any benefit under this Agreement without the prior written provision of this .Agreement shall be determined to be consent of the other party; provided, however, that no illegal or unenforceable, such provision shall be limited or written consent shall be required to assign or transfer this eliminated to the minimum extent necessary so that this Agreement to any parent or wholly owned subsidiary of a Agreement shall otherwise remain in full force and effect party, and further provided that Origami may assign or and enforceable. transfer this Agreement without Client's prior written (h) Governing Law. The laws of the State of consent to a successor by way of a merger, acquisition, Washington (without giving effect to its conflicts of law sale, transfer or other disposition of all or'substantially all principles) govern all matters arising out of or relating to of its assets. Except as 'otherwise provided herein, this this Agreement and the transactions it. contemplates, Agreement shall be binding on and inure to the benefit of including, without limitation, its interpretation, the respective successors and permitted assigns of the construction,performance and enforcement. parties. (i) Mediation. If a dispute arises out of or (c) Third Party Beneficiaries. This relates to this Agreement or a breach thereof, the parties Agreement does not and is not intended to confer any shall first try to resolve their dispute through informal and rights or remedies upon any party other than the parties to good faith negotiation. If the parties fail to resolve the this.Agreement dispute within 30 days, then the parties agree first to try in (d) Publicity. Without prior written approval good faith to settle the dispute by mediation under the of the other party or as otherwise set forth in a SOW, rules established by ADR Systems of America in Chicago, neither party shall, directly or indirectly, make any public Illinois, before resorting to arbitration, litigation, or some announcement related to this Agreement or the Service. other dispute resolution procedure. Notwithstanding the foregoing, Origami may disclose the (i) Arbitration. Any demands, claims or fact that Client has procured a license for the Service; controversies arising out of or relating to this Agreement, provided that Origami will not state or imply that Client (including, but not limited to, fees or costs, breach of endorses or recommends the Service without the written contract, or tort claims), shall be settled by binding permission of Client. arbitration before JAMS in Seattle, Washington and in (e) Entire Agreement; Amendments. This accordance with the Arbitration Rules of JAMS, and Agreement (including all exhibits, appendices, schedules judgment upon the award rendered by the arbitrator may and attachments hereto) constitutes the final agreement be entered in any court or tribunal having jurisdiction between the parties. All prior and contemporaneous oral thereof. Either party may commence the arbitration and written communications, negotiations and agreements process called for in this.Agreement by filing a written between the parties on. the matters contained in this demand for arbitration with JAMS. The arbitration will be Agreement, including, without limitation, any conducted in accordance with the.JAMS Arbitration Rules nondisclosure or confidentiality agreements entered into and Procedures in effect at the time of filing of the demand between the parties prior to the date of this Agreement, are for arbitration. The parties will select one arbitrator from expressly merged into and superseded by this Agreement. JAMS s panel of neutrals and will share equally in the No terms or conditions contained in any purchase order costs. The prevailing party shall be awarded attorneys' shall amend this Agreement or shall otherwise constitute fees, costs, fees and expenses. The arbitration proceedings and arbitration award shall be maintained by the parties as 8 DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ,y.. ORIGAMI OW CONFIDENTIAL strictly confidential, except as is otherwise required by court order, by Washington law, or as is necessary to confirm, vacate or enforce the award and for disclosure in confidence to the parties' respective attorneys and advisors. (k) Force Majeure. Neither party shall have any liability for any failure or delay in performance of its obligations under this Agreement (except for payment) because of circumstances beyond its reasonable control, including without limitation, acts of God, fires, floods, earthquakes, wars, civil disturbances, terrorism, sabotage, accidents, unusually severe weather, labor disputes, governmental actions, power failures, viruses that are not preventable through generally available retail products, inability to obtain labor, material or equipment, catastrophic hardware failures, usage spikes, attacks on servers; or any inability to transmit or receive information over the Internet (each, a "Force Majeure Event"), nor shall any such failure or delay give any party the right to terminate this Agreement. (I) Certain Remedies. Each party acknowledges and agrees that (i) it would be extremely difficult, if not impossible, to calculate the actual damages in the event of Origami's breach of Section 3(b) or 5 of this Agreement or Client's breach of Section 2, 3 or 5 of this Agreement; and (ii) breach of any such provision of this Agreement would result in ongoing damages to the non-breaching party that could not be adequately compensated by monetary damages. Accordingly, each party agrees that in the event of any actual or threatened breach of any such provision of this Agreement, the non- breaching party shall be entitled, in.addition to all other rights and remedies existing in its favor at law, in equity or otherwise, to seek injunctive or other equitable relief (including without limitation a temporary restraining order, a. preliminary injunction and a final injunction) against the other party to prevent any actual or threatened breach of any such provision and to enforce this Agreement specifically, without the necessity of proving actual damages. (m) Counterparts. This Agreement and each Statement of Work may be executed in counterparts, each of which will be deemed an original but all of which together shall constitute one and the same Agreement. Delivery of an executed counterpart of a signature page to this Agreement or any Statement of Work by PDF or other electronic means shall be as effective as delivery of a manually executed counterpart of this Agreement or such Statement of Work. 9 DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF IN WITNESS WHEREOF,the parties have executed this Agreement as of the Effective Date. ORIGAMI RISK LLC CITY OF AUBURN,WA 7 , / Orgami Risk DocuSipned Dy. Y PGrvvo� i,GrV 76l: C BY F7cs By: � &37354C.. F76' Nancy Backus Name: Earnest Bentley Name: (Print Name) (Print Name) Mayor Title: President,Risk Solutions Title: 25 W Main St Address: 222 N. LaSalle St. Address: Suite 2100 Auburn, WA 98001 Chicago,IL 60601 nbackus@auburnwa.gov Email:legal@origamirisk.com Email: 10 DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ORIGAMI RISK CONFIDENTIAL EXIIIBIT A STATEMENT OF WORK This Statement of Work("SOW")describes services to be performed by Origami Risk LLC ("Origami")for City of Auburn, WA("Client"). This SOV is subject to all the terms and conditions of the Software Subscription Agreement between Client and Origami, into which it will now be integrated as Exhibit A. PROJECT SCOPE AND TERM Provide and implement Origami's COV1D solutions(the "Service") to help ensure accurate and consistent tracking and reporting of exposure incidents, vaccine and testing tracking, as applicable. The term of this SOW shall commence on the Effective Date and remain in effect for one year. Implementation of the following pre-configured solution for Client: • Vaccination Tracking to record the initial vaccination and subsequent booster per employee. Functionality allows tracking of employees who opt-out,track upcoming or overdue vaccinations;as well as trending towards the goal of vaccinated employees. • COVID Testing Tracking—track and manage testing for employees/contractors to return.to work based on local testing requirements. • COVID-19 Incident Type—fields and form standard configuration for intake of COVID-19 incidents/positive cases • COVID-19 Dashboard with pre-configured widgets to provide analysis on incidents, outbreaks,and vaccinations. CLIENT ROLES AND RESPONSIBILITIES Client will identify a System Administrator("Client SA")who will be responsible for working with Origami to implement the Service and to provide ongoing production support to Client's Users. The Client SA and, from time to time,other Client employees will be available to provide timely direction and feedback as needed by Origami to complete the Origami tasks in this SOW. The Client SA will also be responsible for setting up, assigning security rights, and maintaining user IDs for all Users. Client will have final responsibility for decisions regarding the configurations or customizations(such as forms, dashboards,interfaces,reports, workflows and data flows) created by or for Client or Client's users in the Service. .For all such configurations and customizations, Client shall be responsible for quality assurance to ensure that such configurations and customizations operate as intended(including functionality,usability and.data access rights), and Origami shall not be responsible for any damages caused by any such configurations or customizations. DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ORIGAMI RISK CONFIDENTIAL LICENSES Bak 1E anctionalit(r s w= g '; ;: . '4, `� T -- „ ^("JN.c ..i .1.,»b3•v.S,.., .•�Y^.t'".h',°a£?. - - E�', ..-, .i__ - 1,'„d Functionality Selected Description . r. ; COViD Solution Yes Includes functionality related to COViD management,including incidents, vaccine tracking,testing tracking,locations,employee management,and portal entry: *Origami may also offer other base functionality not included under this SOW. Named.User•Licenses ..• a ;h. License Quantity Description Full User 2 These licenses have access to all the capabilities and features of the Service under the base functionality selected above.These licenses also have access to the extended functionality features to the extent selected below. Non.Aamed-User Access.:Licenses :f ,, ;4 • License :Selected Quantity f Description x: COVID Yes Unlimited These licenses are non-named licenses and have access to add records either by an anonymous Entry collection portal,by clicking an anonymous collection link generated via Origami's Portal administration features,or via Origami's mobile forms application to capture only COViD related information such as exposure,vaccine data,health check and testing information.For the avoidance of doubt,the unlimited records as set forth herein is limited to the COVID solution set forth in this SOW and shall not apply to any other base functionality which may be purchased under a separate Statement of Work. ExfendedrEunctionaitiY4..461ses; ". ,_ .' °rv'r- License Selected. Quantitti:;. • Description; Mobile Forms App Yes Included Origami's Mobile Forms App may be used by any named user for no additional license fee,but service hours are required for configuration. License Notes: I. Origami adds generally available features from time to time that may require configuration prior to use. If Client requests Origami's assistance in this configuration, Professional Services hours may be applied for any such configuration. 2. In addition to the generally available features, Origami may occasionally deploy new functionality that will require an Extended Functionality License similar to those listed in the Extended Functionality License section above. These features may require additional fees based on record volume, number of additional Users accessing the new features, or some other incremental cost driver. Client may agree to add such an Extended Functionality License in a separate Statement of Work. 3. The pricing for the base COVID Solution is based on the number of Personnel Client is tracking for purposes of the COVID Solution. At the execution of this SOW, Client certifies to Origami that it is tracking up to 499 Personnel. "Personnel" is defined herein as full-time employees, contractors,part-time employees, temps, or any other Client personnel that Client will be tracking for purposes of the COVID Solution DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ORIGAMI RISK CONFIDENTIAL HOSTING Origami will provide data hosting for up to 1GB of database storage(excluding.file attachments). In addition,Origami will provide 50GB of searchable file attachment hosting. Additional hosting is available;atany tine during the term of this SOW as set forth in the Pricing section below. Origami will host the application and data in a secure internet accessible environment. Origami will backup Client data at periodic intervals each day. IMPLEMENTATION PROCESS Implementation is the process of configuring the Service for use by Client including system settings, supporting Client in loading data,training users, and other work identified in this section of the SOW. The implementation phase is completed when Client is able to utilize the Service platform for the purposes described in the Project Scope above, referred to by Origami as being Live in.thc system. Origami will manage the overall implementation process, including scheduling and • leading meetings, communicating with the team, follow up documentation, and maintaining the project schedule through the Go-Live date. Upon Go-Live, Origami will move Client from its staging environment to its live production environment,and continued use ofOrigami's staging environment after Go-Live will incur additional hosting.fees. Client's provision of timely and accurate specifications, direction and feedback is essential to the implementation. Origami provides implementation for a fixed price based on reasonable estimates from Client and Client's continued and uninterrupted effort toward Go-Live. Both parties understand that time is of the essence with regard to the implementation and agree to use reasonable and good faith efforts to promptly complete the implementation. If necessary, Client will be allowed up to one implementation "pause" not to exceed 30 days. Any additional pauses in implementation or failures to meet the obligations above will result in the conversion of the implementation to a time and expense engagement,effective upon email notice from Origami to Client and billed monthly as incurred at Origami's bundled hourly rate set forth below after crediting.Client for any retraining unused portion of the fixed price. Origami may pause and reallocate its resources as reasonable in the event of significant delays. System Configuration Origami will: - Provide Origami standard form for COVID-19 Vaccine&Testing submission layouts. - Mobile Forms App will be implemented using standard mobile forms configuration. - Communication Workflow—Up to 5 hours for creation of email notifications lists to notify employees/management of outbreaks, booster reminders and testing requirements. - Provide Origami standard dashboard and reports for COVID - Location'Structure Import—One time import of physical location structure via Origami Data.Import Center's standard location import template to support COVID-19 workflow. - Employee Import—One time import of employee data via Origami Data Import Center's standard employee template • - Configure up to 2 User Security Profiles Client will: - Provide the Locations and Employees to be added in Origami's standard template format • Provide specifications,direction;and feedback as needed by Origami in.a timely manner. - Configure additional default dashboards,fields,forms,user roles, distribution lists,reports.and other features as needed by Client. DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF " ;. ORIGAMI RISK CONFIDENTIAL Training Origami will: - Provide 3 hours of training to Client.Training will be provided online at Client's request.. Training can be provided in one session or several on mutual agreement between Client and Origami. Travel&Expenses associated with any on-site training will be pre-approved by Client and billed as incurred. Client will: - Provide Origami with guidance about the employees to be trained and any training requirements or a preferred approach. - if training is to be provided in Client office,provide appropriate meeting space and interne access so Origami can perform the training and also provide for transportation and other expenses for Client'employees who attend the training. • DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF , ` ORIGAMI RISK CONFIDENTIAL PROJECT MANAGEMENT OPTION SELECTED: Origami is founded on a set of ITERATIVE processes from top to bottom. These contemporary tenets are the foundation of Origami.'s ability to deliver better service and faster and more accurate implementations. Origami also maintains a set of best.practices,tools and,experts for our clients who require a more TRADITIONAL approach to managing their implementation project. The selection below indicates the project management model included within this SOW: This SOW includes: Included -Iterative Project Management Not Included -Traditional Project Management Iterative Project Management-Included Origami will: o Schedule and lead initial kickoff call or meeting o Maintain schedule with key deliverables and expected dates o Lead status calls twice per.month o Maintain project status document containing priority list, open items and changes which may impact timeline o Coordinate all activity within Origami to complete Origami's tasks on the project schedule and assign project management as shared role of team members o The Service's administrative tools and screens serve as documentation of the implementation for Client's System Administrator to reference. Client will: o Participate in status calls and working meetings o Coordinate all activity within Client's organization to complete Client's tasks on the project schedule o Coordinate all activity of Client's 3rd party providers required to complete tasks on the project schedule Traditional Project Management—Not Included If included, in addition to the responsibilities listed in Iterative Project Management above, Origami will designate a Project Manager to provide a specified number of hours of project management during the implementation. This Project Manager will (1) manage the Origami tasks listed in Iterative Project Management above, (2)coordinate meetings and discussions with stakeholders as needed to maintain project progress, and (3)maintain a library of written artifacts and documentation including: o Formal project kickoff agenda o On site agendas o Communication plan o Change control management o Formal stakeholder analysis o Executive steering committee status call agenda(as o Project charter needed) o Collaboration website o Origami governance decision management document o Detailed work breakdown structure o UAT test plan for critical items(dependent on Client o Weekly project status calls, agenda, meeting notes input and test cases provided) o Detailed issues and risks log o Executive project dashboard o Action items list o Lessons learned analysis o Detailed project plan • DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ORIGAMI RISK CONFIDENTIAL ONGOING SUPPORT After the Implementation is completed or Client is using the Service in production for greater than 30 days,this section of the SOW describes Origami services through the remainder of the term of this SOW. If the parties agree that-certain parts of the Service will go LiVe before others,this section will apply to each part upon going Live. Professional Services This SOW includes up to 5 hours of Professional Services in the first year. Professional Services include any work performed by Origami professionals on behalf of Client. Examples include: • Helpdesk support for users • Additional user training • General assistance utilizing the Service • configuration of features for Client's use • • Maintenance of screens and system configurations as workflows evolve • Configuration of customized reports • Attendance in meetings • Project management tasks and administration DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ` ' ORIGAMI RISK CONFIDENTIAL PRICING AND INVOICE SCHEDULE The price for the licenses and services listed above in this SOW is$14,925 for the first year of this SOW. Exhibit B provides a detailed breakdown of the components of the price. Payment for Year 1 will be invoiced and due upon execution of this SOW. If needed,additional services can be purchased through an addendum to this SOW. All fees are subject to state sales tax, where applicable. All travel costs and expenses will be pre-approved by Client in writing and billed to Client as incurred. ADDITIONAL PRICING: 1. if Client requires additional hosting during the term of this SOW, additional hosting fees will apply as follows: -Current annual fee for hosting of up to 1GB=$7,500 -Annual fee for hosting over l GB and up to 5 GB=$15,000 -Annual fee for hosting over 5 GB and up to 15 GB=$25,000 -Current annual hosting fee includes 50CB of searchable File Attachment hosting -Additional searchable File Attachment hosting is $2,500 per 50GB per year 2. Additional Professional Service hours will be invoiced as incurred at Origami's unbundled rate. Bundled hours (minimum of 10)may be added prior to the start of each contract year at Origami's bundled rate. 3. Additional users, additional licenses or additional use beyond that Which is listed above in the Licenses section of this SOW shall require additional fees. Origami shall invoice Client, and Client shall pay for any additional licenses, hosting,service hours or other usage in excess of what is specified in this SOW. 4. For clarity,this SOW is specifically for the implementation of the COVID tracking solution. Should Client wish to purchase the full Risk Management Information System ("RMIS") functionality provided by Origami,Origami and the Client will enter into.a separate Statement of Work which will set forth such additional functionality and the costs associated therewith. If the Client and Origami execute a separate Statement of Work for Client's purchase of Origami's RMIS functionality within 12 months of the execution of this SOW,Origami will provide a discount towards the fees owed for the RMiS functionality and such discount will equal an amount of$5,000 (Five Thousand Dollars). 5. In the event that Client exceeds the number of Personnel as set forth in the license notes above during the term of this SOW, additional fees may apply: • Annual fee increase for base COVID Solution if Client's Personnel count is between 500 and 999= Increased annual fee of$2,500 • Annual fee increase for base COVID Solution,if Client's Personnel count is between 1,000 and 4,999= Increased annual fee of$7,500 Upon Origami's reasonable request, Client will certify as to the number of Personnel it is tracking. SPECIAL CONDITIONS: If the Client has not used the COVID-19 employee test tracking solution by 12/31/2021,the Client can provide written notice to Origami on or before 12/31/2021 and upon such notice,Origami will remove the COVID-19 employee test tracking functionality and instead provide to the Client 7.5 hours of additional professional service hours. DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ORIGAMI RISK CONFIDENTIAL STATEMENT OF WORK APPROVAL The undersigned agree to this Statement of Work. ORIGAMI RISK LLC CITY OF AUBURN,WA waa O'tgs�ni Riak By: By: Name: Earnest Bentley Name: (Print Name) (Print Name) Title: President, Risk Solutions Title: Date: December 8,2021 Date: Approved as to Form By: City Attorney Date: DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ORIGAMI RISK CONFIDENTIAL EXHIBIT B PRICING DETAIL COVID Tracking Solution (as identified above) $14,925 DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF ORIGAMI RISK CONFIDENTIAL EXHIBIT C SERVICE LEVEL AGREEMENT(SLA) SYSTEM AVAILABILITY Origami Risk will be available 99.5%of the time, excluding unavailability as a result of any Excluded Event(the "Availability Requirement"). This includes holidays,weekends,and n,on-business hours. It does not include planned downtime. In normal circumstances,Origami Risk will schedule downtime between 8:00 PM CT and 7:00 AM CT. Origami Risk will post system availability statistics quarterly. "Excluded Event"means (i)scheduled maintenance windows of which Clientis_notified at least 24 hours in advance and which occur outside of normal business hours; (ii) scheduled.repairs of not more than two hours duration in any one week period of which'Client is notified at least four hours in advance and which occur outside of normal business hours;(iii) critical repairs including security updates where advance notice cannot be reasonably provided; (iv) interruptions caused by transmission errors, Internet service providers,vandalism,user error or other factors beyond Origami's or its direct service providers,' reasonable control; or(v) interruptions caused by any act or omission of Client(including any employee,contractor, agent, customer, investor,consultant or third party user of Client or any of Client's affiliates who uses or accesses the service), including any failure or delay in the performance of its obligations or failure of Client's equipment or non-Origami software. The Availability Requirement applies only to Origami's production environment and not to Origami's staging environment. Service Credits: In the event there is a material failure of Origami's service to meet the Availability Requirement(a"Service Level Failure")in any calendar month,then Client shall have the following sole and exclusive remedy: Origami will provide Client with a service credit on the next annual invoice equal to the pro-rated charges for one (1) full day of the affected services(i.e., 1/30 of the monthly fee, assuming a thirty (30)day month) for each day during which there was a Service Level Failure in such calendar month (a"Service Credit"). For clarity, such Service Credit shall not include credit for hosting fees,data processing fees,professional services fees or any Other prepaid bundled fees other than licensing fees. If Client believes that it is entitled to receive Service Credits, Client shall notify Origami in writing within seven business days after theapplicable calendar month with a description of the Service Level Failure and the date and time of such Service Level Failure. If Client does not notify Origami within such timeframe, then Client shall be deemed to have waived all claims with respect to such Service Level Failure(but not to any future Service Level Failure). Origami will make all determinations regarding Service Credits in its reasonable discretion. For any given month, Client shall in no event be entitled to receive a Service Credit that exceeds 100%of its monthly license fees for such month. Client agrees that Service Credits are the sole and exclusive remedy for any Service Level Failure. BACKUP AND RECOVERY Origami currently backs up transactions every 15 minutes via incremental backups. A differential database backup is performed nightly and a full backup is performed weekly. Backups are stored off site via Amazon S3,which has multiple redundancy and 99.999999999% durability and 99.99%availability of objects over a given year. Periodic database restore tests are performed to validate that backups are valid. Origami retains weekly backups for a minimum of six months. NOTICES Two email subscription options are available to each Origami Risk user. These determine the type of communication that they will receive from Origami Risk. • Emergency: Receive emails concerning outages and other system problems DocuSign Envelope ID:2900CB41-32BB-4897-9FE9-A78F58B291 DF '' ` ORIGAMI RISK CONFIDENTIAL • Maintenance: Receive emails concerning scheduled maintenance on the system. •In addition,any Origami Risk user can visit http:i/status.origamirisk.com/to view the current system status. SERVICE REQUESTS Origami Risk will.respond to service related incidents or issues within the following time frames: Urgent Requests An urgent request for service concerns a new development that significantly affects a major business task with no workaround. Client will request urgent support by sending an email to support(c4oriaamirisk.com with the word"Urgent" in the subject line. An urgent request made between 7:00 AM CT and 8:00 PM CT will typically be responded to immediately,and Client may also call any member of the Origami Risk support team directly. If Client does not receive a prompt response,Client may escalate by contacting any Origami Risk service or support employee or manager via contact information provided to Client. The target resolution time for an Urgent issue is as_soon as possible. Normal Requests A normal.request for service is any service request that is not urgent. A normal service request will typically be responded to within one business day. Client will request support by sending an email to support@origamirisk,com. Client may also call or email any member of the Origami Risk supportteam directly. SECURITY Any access to Origami Risk requires a unique user id and password. Passwords.must adhere to standard password security rules including minimum length and complexity. Origami Risk uses a role-based security model. Client is responsible for-assigning and maintaining role, location,and coverage security for users. Client's system administrators can use the tools in Origami Risk to'review and change security rights, edit the user profile,,arid reset the password. User passwords are encrypted in the Origami database using a SHA-256 hash algorithm. System locks out user after,five login attempts with an incorrect password. An administrative user must then reset the user's password and unlock the user account. Origami Risk uses TLS v1.2 or higher for all communications over https. Origami databases are fully encrypted using 256-bit AES encryption. Claim, Transaction, and Notes data sent to the Origami Risk SFTP site must be encrypted using at least 128 bits. Origami uses Open PGP for file encryption and can provide an encryption key to be used by the client. Origami Risk will keep the files on a secured files system in encrypted format except during the import process. When the import process is completed, unencrypted files are removed from the system.