Master Services Agreement

Scope

This Master Services Agreement (“Agreement”) is between Proactive Risk Inc. (“Proactive Risk,” “we,” “us,” or “our”) and the client identified in an executed Work Order (“Client,” “you,” or “your”). It establishes the terms for CyberAdvisor™ governance, risk, compliance, and related advisory services described in a Work Order.

This Agreement is governed under the Services Guide. Each Work Order, statement of work, or order form will identify the advisory services, deliverables, schedule, dependencies, fees, assumptions, service levels, and contacts. The Services Guide describes the CyberAdvisor™ scope and operating approach available under this Agreement. The applicable Work Order controls over the Services Guide if it expressly states a different engagement-specific term.

Proactive Risk Inc. · 36 First Avenue, Suite 203, Denville, NJ 07834 · (973) 298-1160 · proactiverisk.com.

Fees & Payment

Fees, recurring charges, expenses, payment terms, renewal terms, and rate adjustments are set out in the applicable Work Order or commercial schedule. Client will pay undisputed invoices when due and reimburse pre-approved expenses. Client is responsible for applicable taxes other than taxes on Proactive Risk’s net income. A good-faith invoice dispute should be raised promptly with reasonable detail.

Term & Termination

This Agreement begins on the effective date of the first executed Work Order and continues until terminated. A party may terminate for material breach that remains uncured after written notice, and a Work Order may specify termination rights for convenience. On termination, Client will pay for services performed and approved expenses through the effective date. Each party will return or securely dispose of confidential information as required, subject to lawful retention.

Ownership

Client retains ownership of Client data and materials. Each party retains its pre-existing tools, methods, templates, know-how, software, and other intellectual property. Subject to payment, Proactive Risk grants Client a non-exclusive, non-transferable license to use deliverables created specifically for Client for its internal business purposes. Proactive Risk may use generalized ideas, skills, techniques, and de-identified learnings that do not disclose Client confidential information.

Confidentiality

Each party will protect the other party’s confidential information using reasonable care, use it only for the relationship, and disclose it only to people who need it and are bound to protect it. Client authorizes Proactive Risk to access and process systems and data as reasonably necessary to perform an approved Work Order. The parties will follow the Privacy Policy and any signed data-processing, security, or privacy addendum that applies to the engagement.

Representations & Warranties

Each party represents that it has authority to enter into this Agreement. Proactive Risk will perform the services in a professional and workmanlike manner consistent with the applicable Work Order. Except for express commitments in this Agreement or a Work Order, services and deliverables are provided without warranties to the maximum extent permitted by law. Cybersecurity reduces risk but cannot guarantee that an incident will not occur or that every vulnerability will be found.

Indemnification

Each party will defend and indemnify the other against third-party claims to the extent caused by its own gross negligence, willful misconduct, or material breach of this Agreement, subject to the procedures and limits stated in the applicable Work Order. Client is responsible for claims arising from Client data, instructions, systems, or activities that violate law or the rights of another person.

Independent Contractor Status

The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, fiduciary relationship, or employment relationship. Neither party may bind the other or represent that it has authority to do so. Proactive Risk controls the manner and means of its work while coordinating with Client’s authorized contacts.

Arbitration

Except for a party’s right to seek temporary or preliminary equitable relief to protect confidential information, intellectual property, systems, or data, disputes arising from this Agreement will be resolved by confidential, binding arbitration in New Jersey before a mutually agreed arbitrator. The parties will first make a good-faith effort to resolve the dispute through authorized business contacts. The arbitrator may award remedies available under applicable law, and judgment may be entered in a court of competent jurisdiction.

Miscellaneous

New Jersey law governs this Agreement unless the parties agree otherwise in writing. Neither party may assign this Agreement without the other’s consent, except in connection with a merger, reorganization, or sale of substantially all assets. Notices must be sent to the contacts in the applicable Work Order. This Agreement, its Work Orders, the Services Guide, and incorporated addenda are the complete agreement for the services and may be amended only in writing. If a provision is unenforceable, the remaining provisions remain effective. A waiver must be in writing and applies only to the specific instance.