Main Services Agreement

Main Services Agreement
Written By Shayne Adler

This Main Services Agreement (the "Agreement") is entered into as of the effective date of the relevant Order Form or Statement of Work ("SOW") and binds Aetos Data Consulting LLC, a Delaware limited liability company at 8 The Green, Suite B, Dover, DE 19901 ("Aetos") and the party that countersigns the Order Form or the SOW ("Client").

Aetos provides privacy, AI governance, security compliance, and incident readiness services, and operates software tools that support those services. Client wants to buy some of them. The parties agree as follows.

Contents

How this Agreement works

This Agreement sets the general terms. Each purchase made via an Order Form or Statement of Work ("SOW") incorporates these terms by reference. Schedules A, B, and C apply only when selected; Schedule D applies automatically to Platform use associated with that purchase under Section 3.3.

DocumentCoversPurchased through
Schedule A, Retainer ServicesTrust as a Service: monthly retainers by Tier, prepaid hour blocks, and Office HoursOrder Form
Schedule B, Project ServicesFixed-scope work, including the Readiness Sprint, the TPS Report, and readiness projectsSOW
Schedule C, Designated Role ServicesData Protection Officer as a Service and HIPAA Privacy Officer as a ServiceOrder Form
Schedule D, Platform AccessClient use of Aerie and the Talon Peak tabletop platformOrder Form
Business Associate Agreement ("BAA")PHI, where Schedule C HIPAA services or an Order Form require itSigned before any PHI is shared

If documents conflict for a purchase under this Agreement, mandatory terms of an applicable international data transfer instrument control first, followed by the BAA (for PHI only), the DPA (for personal data only), the Order Form or SOW (for that engagement only, and only where it expressly overrides a named section), the applicable Schedules, then the rest of this Agreement. A purchase made through a signed Order Form or SOW is governed by this Agreement, not Aetos's online Terms of Use. A separate online purchase is governed by the Terms of Use accepted at checkout unless the parties expressly bring it under an Order Form or SOW. Separate free services are governed by the free-service terms expressly accepted for them. Services included in a paid engagement remain governed by this Agreement even if no separate fee is allocated to them. Individual Platform Terms govern users' conduct but cannot change Client's fees, ownership, remedies, or liability under this Agreement. A website update does not amend this Agreement or an existing order.

1. Definitions

TermMeaning
Aetos MaterialsAetos's methods, frameworks, questionnaires, scoring logic, templates, scenario libraries, software, and know-how, whether created before or during this Agreement, and all improvements to them.
AI FeaturesUse of artificial intelligence tools to process Client Materials in performing the Services, including Platform drafting features, business-account AI assistants, and AI recording and transcription, as described in Section 7.4.
Authorized UserAn employee or contractor of Client whom Client invites to use a Platform. Participants and Share Room visitors are not Authorized Users. Individual use terms apply as described in Schedule D.
Client MaterialsDocuments, data, answers, policies, exercise records, and other information provided by or on behalf of Client, its Authorized Users, Participants, or invited reviewers for the Services.
Client Personal DataPersonal data within Client Materials that Aetos processes on Client's behalf, as further defined in the DPA.
DeliverablesThe reports, plans, registers, policies, scenarios, and other work product named in an Order Form or SOW and created for Client. Inclusion as a Deliverable does not transfer ownership of Aetos Materials or tabletop scenarios reserved under Sections 8.3 and 8.5.
Monthly ServicesThe recurring Trust as a Service retainer described in Schedule A.
Order FormA document signed by both parties that buys Services under Schedule A or C, together with any associated Platform use under Schedule D.
ParticipantA person who joins a tabletop session by session code without an account.
PHIProtected health information, as defined in 45 C.F.R. 160.103.
PlatformsAerie (aerie.aetos-data.com) and the Talon Peak tabletop platform (talonpeak.aetos-data.com), and any successor addresses.
Platform TermsAny individual-use terms separately presented and expressly accepted as described in Section D.1.
ServicesThe consulting services, Deliverables, and Platform access described in an Order Form or SOW.
Share RoomAn Aerie area through which Client gives named outside reviewers, such as investors or auditors, controlled access to selected documents.
SOWA statement of work signed by both parties that buys Services under Schedule B.
TierThe service tier stated in an Order Form, which sets included volumes and rates under Schedule A.
TPS ToolsThe Trust Plan Summary (TPS) Snapshot questionnaire and TPS Report tooling available through aetos-data.com, and any successor addresses.

2. Services and ordering

2.1 Orders. Aetos will perform the Services described in each signed Order Form or SOW. An Order Form or SOW binds the parties only once both have signed it. Work starts on the date it states, or after signature and any required deposit if it states none. Monthly Services start as Section A.10 provides.

2.2 Scope. The Services are limited to what the Order Form or SOW describes. Anything else, including additional frameworks, jurisdictions, entities, audits, or document reviews, is out of scope until added by a change order.

2.3 Change orders. Either party may propose a change in writing. Aetos will state the effect on fees and schedule, and the change applies once both parties sign or email their approval. Approval must come from each party's authorized commercial contact. Routine task instructions do not authorize extra charges or a change to legal terms.

2.4 Personnel. Aetos chooses its personnel, including members, employees, facilitators, individual contractors, and subcontractors. Each must be bound by written confidentiality duties at least as protective as this Agreement and have access to Client Materials only as needed for assigned work. This includes lawyers acting in operational roles. Aetos remains responsible for their performance and compliance. Section 7.5 also applies to subprocessors.

2.5 Independent contractor. Aetos is an independent contractor. Nothing in this Agreement makes either party the employee, partner, agent, or fiduciary of the other. Aetos may provide similar services to others, including Client's competitors, subject to Section 6. Neither party may bind the other except to the extent expressly authorized in an Order Form or SOW for a designated role.

2.6 Designated roles. Where an Order Form names Aetos to act in a role such as fractional Chief Trust Officer, Data Protection Officer, or HIPAA Privacy Officer, Aetos acts in an advisory and operational capacity. Except for the independence terms for a Data Protection Officer in Section C.2(b), Aetos acts under Client's direction. Client keeps final decision-making authority and legal responsibility for its compliance program, and the designation does not make Aetos or any of its personnel an officer, director, or employee of Client.

3. Service schedules

3.1 Applicability. Schedules A, B, and C apply only when selected in the relevant Order Form or SOW, and only to the Services they cover. Schedule D applies automatically as stated in Section 3.3, whether or not separately checked in an order.

3.2 Combining services. One Order Form may select more than one Schedule. Fees, included volumes, and prepaid hours under one Schedule do not apply to Services under another unless the Order Form says so.

3.3 Platform use. Schedule D applies whenever Client, its Authorized Users, its Participants, or its invited Share Room visitors use a Platform in connection with a purchase governed by this Agreement. Unchecked Platform selections do not exclude Schedule D. Purchases governed separately by online Terms of Use follow those terms.

4. Fees and payment

4.1 Fees. Client pays the fees in each Order Form or SOW. Monthly Services and Schedule C fees are invoiced monthly in advance. Prepaid hour blocks are paid on purchase. Hourly work outside a prepaid block, including overages and Crisis Support under Schedule A, is invoiced twice a month in arrears. Project fees follow the SOW's payment schedule. The Onboarding Fee is due as Section A.9 provides.

4.2 Payment terms. Invoices are due within 15 days of the invoice date, in US dollars, by ACH, wire, or card. Online purchases are paid at checkout through Aetos's payment processor.

4.3 Late payment. If an undisputed invoice is more than 15 days overdue, Aetos may charge interest at 1% per month or the highest lawful rate, if lower, may recover reasonable, documented external collection costs, including reasonable attorneys' fees, for overdue undisputed amounts to the extent permitted by law, and may pause the Services and Platform access after 10 days' written notice. Pausing does not end Client's obligation to pay. Suspension must be limited to the affected Services where practicable, does not prevent return of Client Materials under Section D.8, and does not excuse the Schedule C handoff or Aetos's statutory duties. Aetos will restore suspended Services promptly after the overdue undisputed amount is paid, subject to Section A.11.

4.4 Disputes. Client must dispute an invoice in writing within 15 days of its date, explain the dispute, and pay the undisputed portion on time. Aetos will not suspend Services for a timely, good-faith disputed amount while the parties work to resolve it. They will try to do so within 30 days.

4.5 Expenses. Client reimburses reasonable, pre-approved travel and out-of-pocket expenses at cost.

4.6 Taxes. Fees exclude sales, use, VAT, and similar taxes, which Client pays, except taxes on Aetos's income. Despite that exception, if law requires withholding from a fee payment, Client will increase the payment so Aetos receives the invoiced amount, remit the withholding, and provide evidence. No increase is due to the extent withholding results from Aetos's failure to provide reasonably requested tax forms. The parties will cooperate to obtain available exemptions or treaty relief.

4.7 Refunds. Fees are non-refundable except as Sections 7.5, 9.2, 10.4, 11.4, 12.6, A.7, A.12, and D.7 provide, or as a signed Order Form or SOW expressly states. This Section does not limit rights that cannot lawfully be excluded.

4.8 Rate adjustments. Aetos may increase recurring fees and hourly rates by up to 5% once in each 12-month period, measured from Client's first Order Form, on 30 days' written notice. No increase applies during an Initial Term, to an existing fixed-fee SOW, or to purchased hours. Rates on resumption follow Section A.11.

4.9 Third-party payers. If a third party agrees to pay fees on Client's behalf and does not, Client remains responsible for them.

5. Client responsibilities

5.1 Cooperation. Client will name a primary contact, provide complete and accurate Client Materials, and make its people available as the Order Form or SOW requires. Aetos relies on Client Materials as given and is not responsible to the extent an error is caused by inaccurate or incomplete information that reasonable performance of the agreed Services would not identify. Aetos will flag material inconsistencies it discovers.

5.2 Rights to Client Materials. Client confirms it has the rights and, where needed, the notices and consents to provide Client Materials to Aetos for the Services, including any personal data and any third-party documents such as vendor contracts.

5.3 Account security. Client is responsible for compliance with this Agreement by its Authorized Users and people it invites, for keeping credentials and authenticator devices secure, and for telling Aetos promptly at security@aetos-data.com of suspected unauthorized access. Client is not responsible to the extent unauthorized activity is caused by Aetos's breach of this Agreement.

5.4 Acceptable use. Client will not, and will not permit its users to:

5.4.1 bypass access controls, access another customer's data, or interfere with the Platforms;

5.4.2 probe, scan, or test their security without Aetos's written consent;

5.4.3 upload malware or unlawful content;

5.4.4 copy, resell, or exploit the Platforms, scenarios, or Aetos Materials except as licensed under Section 8, including using them to train a competing AI model or build a competing product;

5.4.5 share session codes or Share Room links with unauthorized people; or

5.4.6 reverse engineer the Platforms or extract their proprietary scoring methods, except to the extent applicable law prohibits that restriction. These restrictions do not prevent Client from using its own data or implementing Deliverables as Section 8 permits.

5.5 Decisions remain Client's. Client decides whether and how to act on Aetos's recommendations, and is responsible for its own compliance, filings, notifications to regulators and affected individuals, and certifications, subject to Aetos's specific duties under Schedule C.

5.6 Protective suspension. Aetos may suspend affected access or processing when reasonably necessary to address an active security threat, unlawful use, a material breach of Section 5.4, or a binding legal requirement. Aetos will give advance notice where practicable, otherwise prompt notice unless legally prohibited, limit the suspension to what is necessary, and restore access promptly when the cause is resolved. Aetos will reasonably cooperate on secure return of Client Materials. Sections 7, 11.4, and C.1(b) continue to apply; suspension is not a substitute for termination.

6. Confidentiality

6.1 Confidential Information. "Confidential Information" means non-public information one party (the "Discloser") discloses or makes available to the other before or during the engagement (the "Recipient") that is marked confidential or that a reasonable person would understand to be confidential. Client Materials, security findings, and incident details are Client's Confidential Information. Aetos Materials, pricing, and scenario content are Aetos's Confidential Information.

6.2 Exclusions. Confidential Information excludes information that

6.2.1 is or becomes public through no fault of the Recipient; (b) the Recipient already knew without a duty of confidence; (c) the Recipient receives lawfully from a third party without a duty of confidence; or (d) the Recipient develops independently without using the Discloser's information.

6.3 Use and protection. The Recipient will use Confidential Information only to perform or receive the Services, will protect it with at least reasonable care, and will share it only with its personnel, subcontractors, subprocessors, and advisors who need it and are bound by confidentiality duties at least as protective as this Section. Disclosures and public deployment expressly permitted by Section 8.4 are authorized exceptions. The Recipient remains responsible for compliance by people to whom it discloses the information, subject to this Agreement's liability limits.

6.4 Required disclosure. The Recipient may disclose Confidential Information when required by law or court order, after giving the Discloser prompt notice where lawful and reasonable help to seek protective treatment.

6.5 Duration. These duties last during this Agreement and for [three] years after it ends. They continue for trade secrets for as long as legally protected, and for personal data, Client security information, and retained Confidential Information for as long as the Recipient retains that information or a longer period required by law.

6.6 Privilege. Aetos is not a law firm. This engagement does not itself create an attorney-client relationship or privilege. Client should arrange separate legal advice or counsel-directed work before disclosing privileged materials; counsel's involvement does not make all work privileged. A lawyer working for Aetos acts in an operational role here unless a separate legal engagement states otherwise.

7. Data protection, security, and AI

7.1 Data protection roles and DPA. Before processing personal data on Client's behalf, the parties must complete a DPA covering the processing, safeguards, subprocessors, transfers, assistance, audits, and return/deletion. It forms part of this Agreement. Client is controller or an authorized processor for its upstream controller; Aetos is processor or subprocessor and acts only on documented instructions, subject to the DPA and law. Section 7.8 covers Aetos's separate controller activities.

7.2 Location. The primary storage for Client Materials in Aerie, Talon Peak, and the TPS Tools is in the United States. This is not a promise of US-only processing: delivery tools, support access, and network services may process Client Materials in other locations identified in the DPA's subprocessor schedule. The DPA governs applicable EU and UK transfer mechanisms and onward transfers.

7.3 Security. Aetos will maintain reasonable safeguards appropriate to the data and risks, including limited personnel access, Aerie multi-factor authentication, separate client workspaces, encryption in transit and at rest, malware scanning, access logs, and backup and recovery procedures. The DPA states the agreed measures. Updates must not materially reduce protection. Aetos will notify Client without undue delay and within 48 hours after learning of a security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Data or Client Materials in its or its providers' custody. Initial notice may be preliminary and must not await a completed investigation. Aetos will take reasonable response steps, preserve relevant evidence, cooperate with Client, and provide material updates on affected data, consequences, response measures, and a contact point. Unsuccessful attempts that do not result in any such event are excluded. More protective law, DPA, or BAA duties control; the outside limit does not permit undue delay.

7.4 AI use. AI is standard in the Services and their price. Aetos may use the business or API tools identified in the DPA to draft, summarize, transcribe, and analyze Client Materials. A qualified person will review each AI-drafted Deliverable before release. Aetos remains responsible for the Services. It will limit data sent to what the task needs. Neither Aetos nor its providers may use Client Materials or Deliverables to train or fine-tune general-purpose or shared models, including through voluntary feedback, without Client's separate written permission. The DPA must identify approved products, models, uses, retention, and exceptions. Business-account status does not establish zero retention; any zero-retention commitment must identify the covered products, models, features, and exceptions. Materially wider data use or retention requires Client's written agreement. PHI requires the applicable BAA and safeguards. A no-AI engagement requires an express Order Form or SOW override and agreed price; declining recording under Section 7.7 is not a no-AI engagement. AI Features may not make external communications, filings, system changes, or commitments for Client unless the Order expressly authorizes them and sets approval controls.

7.5 Subprocessors. The completed DPA lists the authorized subprocessors, purposes, locations, and retention terms. Aetos will bind them to appropriate written data protection duties and remains responsible for them. It will give at least 30 days' advance email notice of an addition or replacement. Client may object during that period on reasonable data protection grounds. Aetos will not send affected data to the disputed provider while unresolved and will offer a reasonable alternative where available. If no solution is agreed within 30 days after objection, either party may end the affected Service, with the refund under Section 11.4. Aetos need not retain a provider indefinitely. Providers for Aetos's own controller activities are addressed in the Privacy Notice; their role depends on actual use.

7.6 Retention and deletion. The DPA sets return, deletion, and backup periods by engagement and data type, including profiles, custom scenarios, exercise logs, and recordings. Aetos will follow those periods and Client's lawful instructions for earlier return or deletion, except where law requires retention. Another open order does not extend them. Aetos will give at least seven days' notice before scheduled deletion and an opportunity to obtain the data. Retained data stays protected and may be used only for its permitted retention purpose.

7.6.1 Client may request a copy under Section D.8 before deletion, including after access closes. Backups expire on the DPA's cycle; deleted data restored during recovery must be deleted again. Aetos will confirm deletion on request and identify any lawful retention exception. More protective DPA or BAA duties control. For Schedule C roles, the Order Form identifies the required records custodian.

7.7 Meeting recordings. Aetos may use an approved recording or transcription provider only after notifying every participant and obtaining affirmative consent before capture, including from late joiners. Aetos will keep a consent record and stop capture if anyone objects or withdraws consent. The meeting may continue unrecorded. A bot's presence is not consent. Recordings and transcripts are Client Materials under the DPA retention schedule.

7.8 Aetos's own records. Aetos is controller for the contact, billing, account, security, and relationship records it uses for its lawful business, as described in the Privacy Notice supplied before collection. Client service content does not become Aetos's own record merely because it enters an internal tool. Separate sales use requires an identified lawful basis and notice; it is not a processor instruction. Newsletter enrollment requires a separate opt-in. The DPA records these roles without expanding permitted uses.

8. Intellectual property

8.1 Client Materials. Client keeps all rights in Client Materials. Client grants Aetos a non-exclusive license to use them to perform the Services and, after the engagement, only as needed for permitted export, return, transition, retention, and deletion under this Agreement. This license is subject to the DPA, BAA, and Section 7.4.

8.2 Deliverables. Once Client has paid all fees for a Deliverable, or as Section A.12 provides, Aetos assigns to Client its rights in the parts of that Deliverable written specifically for Client, excluding Aetos Materials and the tabletop scenarios reserved under Section 8.5. Until then, Client may use draft Deliverables only for internal review. The license in Section 8.3 supports Client's intended use of paid Deliverables and those retained under Section A.12. Aetos will obtain the personnel rights needed for this assignment. AI-generated portions may not support exclusive intellectual property rights; Aetos assigns only rights it holds and does not promise that all such content is copyrightable or unique.

8.3 Aetos Materials. Aetos keeps all rights in Aetos Materials, including the TPS questionnaire and scoring, scenario libraries, templates, and the Platforms. Where Aetos Materials are embedded in a paid Deliverable or one retained under Section A.12, Aetos grants Client a perpetual, royalty-free, non-exclusive license to use, copy, adapt, implement, and disclose them as part of that Deliverable for its intended business purpose. This includes operating Client's compliance program, publishing policies and notices intended for public use, and sharing supporting materials under Section 8.4. Client may permit its personnel and service providers to exercise these rights on its behalf. The license transfers only with a permitted assignment under Section 12.5. It does not permit extracting reusable Aetos Materials for unrelated use, selling or licensing them as a standalone product, or creating a competing product. Platform access and use of scenario libraries remain subject to Sections 8.5 and D.1.

8.4 Sharing and publication. Client may share paid Deliverables and those retained under Section A.12 with its auditors, investors, insurers, regulators, advisors, customers, and service providers, including through a Share Room, for their intended business purpose. Confidential Deliverables must remain subject to appropriate confidentiality protections, except disclosures required by law or to regulators exercising their authority. Client may publish and adapt policies, notices, and other Deliverables intended for public deployment without separate consent; that authorized publication does not breach Section 6. Client may not sell Deliverables or reusable Aetos Materials as a product, attribute its modifications to Aetos, or publish them as Aetos's work or endorsement without consent.

8.5 Tabletop scenarios. Despite the Deliverables definition and Section 8.2, Talon Peak scenarios, including customized scenarios and their reusable structure and logic, remain Aetos Materials. If a scenario is supplied to Client as a paid Deliverable or retained under Section A.12, Section 8.3 permits its use and adaptation for Client's own internal exercises and Section 8.4 permits confidential review; it does not authorize public distribution, resale, or access to the Platforms after access ends. Client's facts remain Client's Confidential Information, and Aetos will not reuse them for another client.

8.6 Aggregated data. Subject to the DPA, Aetos may use de-identified, aggregated information to improve its methods and benchmarks only if it cannot reasonably identify Client or any individual, or reveal Client Confidential Information. Aetos will not attempt re-identification and will require the same of permitted recipients. Pseudonymized records or removal of names alone do not satisfy this standard. This permission does not authorize model training prohibited by Section 7.4.

8.7 Feedback. Client may voluntarily provide suggestions about the Services. Aetos may use those suggestions without compensation, but receives no rights to personal data, Client Confidential Information, or Client Materials merely because they accompany feedback.

8.8 Third-party materials. Aetos will identify third-party materials included in Deliverables if they carry separate license restrictions, and obtain rights sufficient for Client's intended use. Material additional charges or use restrictions require Client's approval before inclusion. Publicly available standards and third-party tools remain subject to their applicable terms.

9. Warranties and disclaimers

9.1 Mutual. Each party has the authority to enter into this Agreement and will comply with laws that apply to it in performing it.

9.2 Services. Aetos will perform the Services in a professional manner consistent with generally accepted industry standards and materially in accordance with the Order Form or SOW. Client must describe a breach of this warranty in writing within 30 days after discovery and no later than 90 days after delivery of the affected work. Aetos will re-perform or correct the work without charge within a reasonable period, ordinarily no more than 30 days after notice unless the parties agree otherwise. If Aetos cannot cure within that period, Client may end the affected Service and receive a refund of fees paid for the non-conforming work and the unperformed prepaid portion. These are the exclusive remedies for breach of this warranty, but do not limit independent claims under Sections 6, 7, 10.4, or the DPA or BAA. Acceptance under Section B.3 does not shorten this warranty period.

9.3 Not legal advice. Aetos is not a law firm and does not provide legal advice, and engaging Aetos does not create an attorney-client relationship. Deliverables describe regulatory requirements and practices for compliance and operational purposes. Aetos can help Client identify and work with local counsel, but Client should have its own counsel confirm legal conclusions before relying on them. This Section applies equally to Services under Schedule C.

9.4 No guaranteed outcome. Aetos does not guarantee that Client will pass an audit, obtain or keep a certification or attestation, avoid a security incident, or avoid regulatory action. Readiness work prepares Client for an assessment; the auditor or certification body decides the outcome independently of Aetos.

9.5 Scores and AI-assisted content. TPS scores, gap analyses, tabletop outcome reports, and AI-assisted drafts are tools that depend on the answers and materials Client provides. Fines and outcomes shown in a tabletop exercise are illustrative. These tools are a starting point for Client's judgment, not a complete assessment of every risk. Aetos does not warrant that AI-assisted content is eligible for copyright or other intellectual property protection.

9.6 Disclaimer. EXCEPT FOR THE EXPRESS WARRANTIES AND OBLIGATIONS IN THIS AGREEMENT, THE SERVICES, PLATFORMS, AND DELIVERABLES ARE PROVIDED "AS IS." TO THE EXTENT PERMITTED BY LAW, AETOS DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. AETOS DOES NOT GUARANTEE ERROR-FREE OR UNINTERRUPTED OPERATION. THIS DISCLAIMER DOES NOT NEGATE THE DPA, BAA, OR OTHER EXPRESS COMMITMENTS IN THIS AGREEMENT.

10. Liability and indemnities

10.1 Base Cap. Subject to Section 10.3, each party's aggregate liability under this Agreement, under any legal theory, is limited to the greater of $[1,000] or the applicable fees (the "Base Cap"). For a fixed-fee project, use the full affected SOW fee. For recurring or hourly Services, use affected fees paid or payable during the 12 months before the first event giving rise to the claim, or the elapsed engagement if shorter. Bundled access uses the engagement fee. Related claims count as one; affected order fees count once and unrelated orders do not increase the cap. Defense costs, settlements, and awards count toward it. Express refunds are outside the cap, without double recovery.

10.2 Excluded damages. Neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill, even if advised they were possible. This exclusion does not apply to:

10.2.1 third-party damages and defense costs payable under Sections 10.4 and 10.5;

10.2.2 the following costs arising from a breach of Section 6 or 7, which the parties agree are direct damages: reasonable and necessary investigation and forensic costs, legally required notices, reasonable credit or identity monitoring and call-center support where legally required or agreed by the parties, reasonable data restoration costs, and fines or penalties attributable to the breaching party to the extent lawfully recoverable; or

10.2.3 the uncapped matters in Section 10.3.2. Items 10.2.1 and 10.2.2 remain subject to the applicable cap.

10.3 Higher cap and uncapped matters.

10.3.1 Each party's total aggregate liability for breach of Section 6 or 7, including the DPA or BAA, and either party's liability under Sections 10.4 and 10.5, is limited to two times the Base Cap. This higher cap replaces rather than adds to the Base Cap; all capped claims together may not exceed that higher limit.

10.3.2 The caps and excluded-damages clause do not limit Client's obligation to pay agreed fees, either party's fraud, gross negligence, willful misconduct, Client's intentional breach of Section 5.4, or intentional misappropriation or infringement of the other party's intellectual property, or liability that law prohibits limiting. The caps allocate liability between the parties only and do not restrict a regulator's powers or an individual's nonwaivable rights, including under applicable transfer clauses.

10.4 Aetos indemnity. Aetos will defend Client against third-party claims that a Deliverable or Platform, as provided by Aetos and used as authorized, infringes that party's US intellectual property rights, and pay damages and reasonable costs finally awarded or agreed in settlement, subject to Sections 10.1 through 10.3. This excludes claims to the extent caused by Client Materials, changes not made or authorized by Aetos, or combination with items Aetos did not provide or require, where the claim would not otherwise arise. If a claim is likely, Aetos may obtain continued use rights, modify or replace the item without materially reducing the agreed functionality, or, if neither is reasonably available, end the affected Service and refund fees paid for the unusable Deliverable or the unused prepaid recurring period. This is the exclusive contractual indemnity for IP infringement, without limiting Section 10.3.2. Withdrawal does not end obligations for covered claims.

10.5 Client indemnity. Client will defend Aetos against third-party claims to the extent arising from Client Materials that infringe that party's intellectual property or privacy rights or breach its confidentiality or contractual rights, an unauthorized disclosure directed by Client through a Share Room, or Client's unlawful use of the Services or material breach of Section 5.4. Client will pay damages and reasonable costs finally awarded or agreed in settlement, subject to Sections 10.1 through 10.3. This does not apply to the extent a claim results from Aetos's breach, negligence, or willful misconduct.

10.6 Process. The indemnified party will promptly notify the other of a claim; delay excuses obligations only to the extent materially prejudicial. The indemnifying party controls the defense with qualified counsel and pays reasonable assistance costs. The other may participate at its expense. A settlement admitting its fault, imposing nonmonetary obligations, or lacking a full release needs its consent, not unreasonably withheld. If the defense is not assumed promptly after notice, it may reasonably defend and recover covered costs within the applicable cap.

10.7 Insurance. Aetos will maintain the coverage expressly agreed in the Order Form or SOW and provide evidence on request. Insurance does not increase or replace this Agreement's liability limits.

11. Term and termination

11.1 Term. This Agreement starts on the Effective Date and remains in force until terminated under this Section. Each Order Form or SOW continues for its stated term or until it is completed or terminated under this Agreement. For a standalone hourly engagement, three consecutive months without hourly work constitutes the end of that engagement, measured from the last date Aetos performed hourly work, or from its start date if no work was performed. That date starts the access-closure period in Section D.8. An unexpired purchased hour block keeps the hourly engagement open through its expiry under Section A.7. Unused hours do not otherwise extend access.

11.2 For convenience. Either party may end this Agreement on written notice when no Order Form or SOW is active. Otherwise, convenience termination applies per engagement:

11.2.1 either party may end Monthly Services on 30 days' written notice, effective no earlier than the end of the Initial Term, except under Sections A.6 and A.12;

11.2.2 Client may end a Schedule B project on 30 days' written notice, and Aetos may not end a project for convenience; and

11.2.3 either party may end other Services on 30 days' written notice, subject to the Schedule C handoff. Ending one engagement does not end the others.

11.3 For cause. Either party may end an affected Service, Order Form, or SOW on written notice if the other party materially breaches it and does not cure within 30 days after written notice describing the breach. Either party may terminate immediately on notice for a material breach that cannot be cured, dissolution without a successor, or insolvency proceedings that remain undismissed for 60 days, in each case only to the extent permitted by law. A breach affecting this Agreement as a whole may support termination of this Agreement and its active orders on the same basis. Section 9.2 separately governs termination after unsuccessful warranty re-performance, and Section A.12 governs the guarantee. Section C.2(b) continues to protect proper performance of DPO tasks.

11.4 Payment on termination. Client pays for Services performed, authorized work in progress, and approved expenses through termination. Work in progress is valued at the SOW's rates or milestones, or a reasonable share of the fixed fee if none is stated. Total charges cannot exceed the agreed fees plus approved changes and expenses. If Client ends a project for convenience, prepaid project fees remain non-refundable under Section 4.7 and a credit or discount conditional on completing the project no longer applies, unless the SOW states otherwise. Aetos refunds the unperformed prepaid portion if Client ends for Aetos's uncured material breach, Aetos ends for convenience, or either party ends under Section 7.5, 12.6, or D.7. Sections 9.2, 10.4, and A.12 govern their own refunds. Refunds are paid within 30 days, without double recovery.

11.5 Effect and access. Service performance ends on the effective termination or completion date, except for an expressly surviving obligation or agreed transition. Platform access continues or ends solely as Section D.8 provides. Access closure does not itself require immediate data deletion: return, restricted retention, and deletion follow Section 7.6 and the DPA or BAA. Each party returns or destroys the other's Confidential Information on request, subject to those provisions, legally required records, routine backups, and Client's continuing rights in paid Deliverables or Deliverables retained under Section A.12. Retained copies remain confidential and may be used only for their permitted retention purpose. Ending one engagement does not remove access needed for a separate active engagement.

11.6 Survival. Sections 4, 6, 7 (while Aetos retains Client Materials), 8, 9, 10, 11.4 through 11.6, and 12 survive termination, as do the Deliverable rights in Section A.12, the handoff in Section C.1(b), Section D.8, any check-back included under Section B.4, and Schedule D for any permitted post-engagement use.

12. General

12.1 Governing law. Delaware law governs this Agreement, without regard to its conflict-of-laws rules.

12.2 Disputes. Senior representatives will first try to resolve a dispute within 30 days after written notice. If unresolved, the parties will mediate in [Washington, DC] for up to 30 days, then use binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before one arbitrator seated in Washington, DC. The AAA Expedited Procedures apply where no claim or counterclaim exceeds $100,000, excluding interest, attorneys' fees, and arbitration fees and costs. Documents-only proceedings and hearings follow those Rules. Either party may instead bring an eligible claim in small claims court. Escalation does not prevent urgent court relief to protect confidential information, data, or intellectual property, or a filing needed to preserve a claim. Judgment on the award may be entered in any competent court. The parties will keep the proceedings and award confidential, except as needed for legal compliance, enforcement, or confidential advice from counsel, insurers, or auditors. Section 6.4 and mandatory data protection or transfer rights remain unaffected.

12.3 Publicity.

12.3.1 Aetos's use of Client's name. Aetos will not use Client's name or logo, or describe the engagement publicly, without Client's consent. Client may opt in through an Order Form, for example in exchange for a Brand Partner Discount; opting in is optional and not required for standard pricing. If Client opts in, Aetos may use Client's name and logo during the term to identify Client as a customer on its website, in sales materials and conference slides, and on social media. Aetos will follow Client's brand rules, will only resize logos, and will imply no endorsement beyond being a customer. Client may revoke consent by email, and Aetos will then stop new uses and remove Client's name and logo from its website and social media within ten (10) business days, but need not recall printed or third-party materials already in circulation. Aetos will not disclose Confidential Information or specific details of the Services without Client's prior written consent. If consent supported a Brand Partner Discount, withdrawal ends that discount prospectively after 30 days' notice, without retroactive charges or any other price increase.

12.3.2 Client's designation of Aetos. While Client buys Monthly Services, Client may describe Aetos on its website and in its marketing materials as its "Chief Trust Officer" or "Office of Trust," with a link to aetos-data.com. While Client buys a Schedule C service, Client may also name Aetos in that role. Client will use only logos Aetos approves, following Aetos's brand guidelines, and will remove Aetos's name and logo within ten (10) business days after the relevant Services end. Otherwise, Client may not use Aetos's name or logo publicly without Aetos's consent. Any designation must accurately describe the agreed services and must not imply an audit opinion, certification, legal representation, or an appointment as a corporate officer.

12.4 Notices. Legal notices must be in writing and sent by email to the addresses stated in this Agreement or the Order Form, with the subject line marked "Legal notice," and are effective on the next business day after sending unless the sender receives a delivery failure. Notices to Aetos go to hello@aetos-data.com. A notice of termination for cause or of a claim must also be sent by courier or registered mail to the address above. Operational messages may be sent through Aerie or email. Where a provision expressly permits email notice, including Section A.12, no courier copy is required. Security incidents must also be sent to Client's designated security contact, or its primary contact if none is designated. Either party may update its address by notice. This Section does not govern service of court process.

12.5 Assignment. Neither party may assign this Agreement without the other's written consent, except to a successor in a merger or sale of substantially all of its business or assets, on notice to the other party. The successor must assume the Agreement in writing. Assignment does not excuse obligations already accrued, override data protection or transfer restrictions, or automatically transfer a statutory role without the required designation and qualifications.

12.6 Force majeure. Neither party is liable for delay beyond its reasonable control if it promptly gives notice, mitigates the impact, and resumes when practicable. Lack of funds, ordinary staffing shortages, or a preventable security failure do not by themselves qualify. This does not excuse payment, data protection, incident notice, confidentiality, return, or other duties that can still be performed. After 30 days of material interruption, either party may end the affected Service on notice, with refunds under Section 11.4.

12.7 Export and sanctions. Each party will comply with export controls and economic sanctions applicable to it. Client will not permit access or use prohibited by applicable sanctions, export restrictions, or Aetos's disclosed geographic service restrictions. Aetos may restrict access where reasonably necessary to comply. A geographic service restriction is not a representation that every person in that country is legally prohibited from using the Services.

12.8 Entire agreement. This Agreement, with its Order Forms, SOWs, Schedules, the DPA, and any BAA, is the parties' entire agreement on its subject and replaces earlier proposals and understandings. Amendments must be in writing and signed by both parties, except the email approvals Section 2.3 and Section A.11 allow. Terms on a Client purchase order do not apply.

12.9 Other terms. If a provision is unenforceable, it will be enforced to the maximum extent permitted and the rest remains in effect. A failure to enforce a provision is not a waiver. This Agreement may be signed electronically and in counterparts. Except for rights expressly required by applicable data protection or transfer law, this Agreement creates no third-party beneficiary or reliance rights. Permitted sharing of Deliverables does not give a recipient an independent right to rely on Aetos's work. Any third-party reliance requires a separate written agreement with Aetos.

Signatures

Aetos Data Consulting LLC[Client legal name]
Signature
NameH. Shayne Adler
TitleChief Executive Officer
Date

Schedule A: Retainer Services (Trust as a Service)

This Schedule applies when an Order Form selects Monthly Services, a prepaid hour block, or other hourly services. Only the provisions relevant to the selected service apply.

A.1 Monthly Services. During an Order Form for Monthly Services, Aetos provides the following trust and compliance operations and advisory services, within the Standard Monthly Volume for Client's Tier:

A.1.1 Framework alignment: aligning business operations and product development to the industry certifications and compliance frameworks that apply to Client.

A.1.2 Certification readiness and maintenance: operational guidance and project support to obtain and maintain relevant certifications.

A.1.3 Privacy operations: managing cookie consent mechanisms and consent management platforms, data subject requests, subprocessor management, security-related RFPs from Client's prospective customers, and related privacy operations tasks.

A.1.4 Governance advisory: strategic guidance on data privacy, AI, and cybersecurity compliance matters, including cross-border data transfer mechanisms.

A.1.5 Compliance administration: routine, recurring compliance tasks, including data subject requests and vendor risk assessments.

A.2 Tiers and Standard Monthly Volume. The Order Form states Client's Tier and the included monthly scope and capacity for Section A.1 (the "Standard Monthly Volume"). The following limits apply separately each calendar month; a combined item category uses one combined allowance. The Order must state included capacity for unquantified work. Unused volume does not roll over. No Tier includes unlimited work; a scope change requires Section 2.3 approval.

ItemTier 1Tiers 2 and 3Tiers 4 and 5
Data subject requests: processing and responding to access, deletion, correction, and similar requestsUp to 1 a monthUp to 5 a monthUp to 15 a month
Security questionnaires, RFP responses, and vendor risk reviews, including new vendor onboarding and subprocessor managementNot includedUp to 2 a monthUp to 5 a month

A.2.1 Security questionnaires and RFP responses cover requests Client receives from its own prospective customers. Vendor risk reviews cover Client's review of its own vendors.

A.3 Overage. Work Client requests within the agreed scope above the Standard Monthly Volume is billed at the stated per-item rate (default $[250]) or hourly rate, but not both for the same work. Aetos will notify Client when approaching a limit and state the expected extra work and charges. Client may object within [two] business days; Aetos will then pause non-critical extra work and agree a plan. Before that period ends, urgent work needed for a statutory deadline may proceed at the agreed rate, with prompt notice. Silence does not approve a new scope or rate. Schedule C duties continue.

A.4 Rush work. Work above the included volume, and hourly work, that Client asks Aetos to complete the same day or within [two] business days, or on US federal holidays, weekends, or outside [9:00 a.m. to 6:00 p.m. Eastern Time, Monday to Friday], is billed at 1.5 times the applicable rate. Rush work requires Aetos's acceptance and Client's advance approval of the premium. No emergency availability or response time is promised.

A.5 Surge Events. A "Surge Event" is a systemic spike, such as a data breach or mass-action requests, above 150% of an applicable numerical monthly allowance or other threshold stated in the Order Form. Aetos will notify Client, describe the expected work and charges, and may prioritize statutory deadlines and pause non-critical advisory work. Extra work within the agreed scope is billed hourly, in addition to the monthly fee, at a Crisis Support rate of 120% of Client's standard hourly rate. The notice, objection, and urgent-work rules in Section A.3 apply. Without an agreed threshold, surge pricing requires written agreement. Aetos will notify Client when the Surge Event ends. The Crisis Support rate replaces, and does not stack with, the Section A.4 rush rate.

A.6 Conversion. If Client's usage exceeds the Standard Monthly Volume in 3 consecutive months, the parties will negotiate in good faith to move Client to another Tier or to hourly services. If they do not agree within 30 days, either party may end the Monthly Services on 30 days' written notice, even during the Initial Term.

A.7 Prepaid hour blocks. Hours are purchased in advance and expire [three] months after purchase unless the Order Form provides a longer period. Aetos records actual time in 15-minute increments, with a 30-minute minimum [per separately authorized task]; one task will not be split to multiply minimums. Usage is limited to [15] hours per month unless the Order Form states otherwise. Aetos will not sell a block that cannot reasonably be used within its term at that limit. Time Aetos cannot make available despite timely, reasonable scheduling requests will be extended or refunded. Expiration is extended for an Aetos-caused service suspension. Otherwise unused hours are non-refundable except under Section 11.4. Prepaid hours may not be applied to Schedule B or C Services. The Monthly Services guarantee does not apply. Purchase of a new block keeps the hourly engagement open through that block's stated expiry, without reviving an expired block.

A.8 Office Hours. Client may attend Aetos Office Hours, periodic open sessions for general questions in Aetos's areas of practice, at no charge. Office Hours do not count against included volume or prepaid hours. Office Hours are shared sessions, not private advice; attendees must not disclose confidential, privileged, or personal information about others. No service level or designated role is created.

A.9 Onboarding Fee. For Monthly Services, Client pays a one-time onboarding fee equal to 150% of one month's Monthly Services fee, or the amount stated in the Order Form (the "Onboarding Fee"), on signature and before Services start. It covers initial onboarding work such as discovery, environment setup, and planning.

A.10 Start, Initial Term, and renewal. Monthly Services start on the later of the Order Form's start date and Aetos's receipt of the Onboarding Fee and the first monthly fee. They run for the initial term stated in the Order Form (default three (3) months, the "Initial Term") and then renew month to month. Termination and its financial effects follow Section 11, subject to Sections A.6 and A.12.

A.11 Pauses and resumption. Client may pause Monthly Services only by written agreement stating dates, billing, access, and any Initial Term change. Otherwise fees and the term continue during a valid payment suspension. After an agreed pause or ended engagement, restart requires written agreement on rates, access, and timing; [the Onboarding Fee applies again / any restart fee is limited to the agreed re-onboarding work]. Prior discounts do not carry over unless agreed, and the guarantee does not restart. A payment suspension cured within the notice or cure period resumes on existing terms without a new Onboarding Fee. Other restarts depend on Aetos's capacity and agreement. Aetos may not charge a restart fee to remedy its own breach.

A.12 Thirty-day risk-free guarantee. This guarantee applies only to the first start of Monthly Services under Client's first Order Form for them. If Client is not convinced that Aetos has added actionable value within the first 30 days, Client may end those Monthly Services immediately by email received within that period. Aetos will refund all fees paid for them, including the Onboarding Fee, within 30 days. The guarantee does not cover hourly work, hour blocks, projects, designated roles, separately purchased Platform services, or expenses, which continue unless separately ended. Client keeps the Deliverables created for the refunded Monthly Services as though fully paid under Section 8.2, with the license in Section 8.3. Platform access for that engagement ends immediately under Section D.8. The guarantee does not apply on a restart and governs over conflicting terms unless an Order Form expressly overrides it.

Schedule B: Project Services

This Schedule applies only when a SOW selects it.

B.1 Fixed scope and payment. A SOW states the Deliverables, fee, payment schedule, and target timeline. Unless it says otherwise:

B.1.1 a TPS Report is paid 100% in advance;

B.1.2 a Readiness Sprint is invoiced [50]% on signature and [50]% when Aetos delivers the core work and notifies Client that the evidence pack is ready, and the evidence pack is released once all Sprint fees are paid; and

B.1.3 other projects are invoiced [50]% on signature and [50]% on delivery of the final Deliverable. The 60-day check-back never delays an invoice.

B.2 Client delays. Timelines assume Client provides the materials, people, and decisions the SOW lists. If Client's delay pauses the project for more than [10] business days, Aetos may reschedule the remaining work to its next available slot. Aetos will give notice of the revised timeline and any proposed added cost; additional charges require a change order.

B.3 Acceptance. A Deliverable is accepted when Client approves it in Aerie or in writing, or 10 business days after delivery if Client has not described a material nonconformity in writing. Aetos will correct a material nonconformity with the SOW at no charge and redeliver within 10 business days or another reasonable agreed period; the review period restarts for the corrected portion. Minor defects do not prevent acceptance but must be corrected. A separate included check-back does not reopen acceptance of earlier Deliverables. The evidence pack's acceptance period begins on its actual release, without delaying the payment milestone in Section B.1. Acceptance does not waive timely warranty claims or independent confidentiality, data protection, or indemnity rights. Refund remedies follow Sections 4.7 and 9.2.

B.4 Readiness Sprint. The Readiness Sprint is a project of about four weeks that typically includes an assessment, an incident response plan, a commitments register, a facilitated tabletop exercise on Talon Peak, an after-action report, an evidence pack, and a check-back with a scorecard about 60 days after close. The SOW states the option purchased (Full, Exercise Only, or Annual Retest) and its fee. Client names 4 to 8 exercise participants, with backups, in Aerie, and each accepts the participant terms identified in Section D.5 before the exercise. Payment and release of the evidence pack follow Section B.1. The Sprint closes when its core Deliverables, including any evidence pack, have been delivered; an included 60-day check-back survives that close but does not defer payment, extend Platform access, or reopen acceptance of earlier work. Aetos will arrange the check-back and deliver its scorecard securely even if Platform access has ended.

B.5 TPS Report. The TPS Report is a written risk report based on Client's TPS Snapshot answers, with detailed scores and gaps and a 90-day plan. Aetos drafts it with AI Features and reviews and edits it before release. It is paid 100% in advance, and Aetos aims to release it within 10 business days after payment and receipt of required inputs unless a different timeline is agreed under Section 2.3. If Client books a Readiness Sprint within 30 days after Client completes the TPS Snapshot, the TPS Report fee is credited against the Sprint fee. A TPS Report bought online without a signed SOW is governed by the online Terms of Use accepted at checkout. The credit applies once, cannot exceed the Sprint fee, is not redeemable for cash, and cannot be combined with another discount unless agreed in the SOW. The SOW must state whether the credit requires Sprint completion.

Schedule C: Designated Role Services

This Schedule applies only when an Order Form selects Data Protection Officer as a Service or HIPAA Privacy Officer as a Service.

C.1 General terms

C.1.1 Fees and scope. The Order Form states each role's monthly fee, covered entities and jurisdictions, included operational work, expected workload, and escalation contacts. Schedule A volume caps and prepaid hours apply only if the Order Form says so. Extra operational work or a material increase in workload requires a change order under Section 2.3, but scope limits never excuse duties the designation legally requires. If resources become inadequate, the parties will promptly agree on added support or an orderly replacement that keeps DPO independence and statutory deadlines intact.

C.1.2 Responsibility and handoff. Client remains the controller, covered entity, or business associate responsible for its obligations, and Section 9.3 applies. Before a role ends, Aetos will give Client a handoff listing pending requests, incidents, regulatory communications, deadlines, and records, delivered outside the Platforms if access has closed. Client will name a successor and update its public and regulatory contact details promptly. Ordinary handoff is included in the fee; extra transition work needs a change order. Neither party may hold back required notices or records over a fee dispute. For 30 days after the role ends, Aetos will forward misdirected role-related messages without acting in the role.

C.2 Data Protection Officer as a Service

C.2.1 Designation. Aetos serves as Client's designated external data protection officer under Article 37 of the EU GDPR, the UK GDPR, or both, as the Order Form states. Client will publish Aetos's contact details as its DPO and communicate them to its supervisory authority, and Aetos will help prepare that filing. The Order Form must name the qualified lead individual, any approved backup, and how the function remains available during absence. Appointment begins only when those arrangements and the required access and resources are in place.

C.2.2 Independence and conflicts. Despite Section 2.6, Client will not instruct Aetos on how it performs its DPO tasks, will involve Aetos properly and promptly in personal data matters, will provide necessary access and resources, and will not penalize Aetos for properly performing those tasks. Aetos reports to Client's highest management level. Before accepting other duties and throughout the engagement, the parties will assess whether those duties create a conflict, including determining the purposes or means of processing that the DPO must independently monitor. Aetos will disclose identified conflicts, and the parties will separate decision-making and oversight, reassign conflicting operational duties, or appoint a different DPO where separation cannot resolve the conflict. Pending resolution, Aetos will not undertake the conflicting additional duty. Client may end this service under Section 11 with the handoff in Section C.1(b), but not because of proper performance of DPO tasks.

C.2.3 Regulatory contact. Aetos acts as contact point for the supervisory authorities and data subjects covered by the Order Form. Before designation, the Order Form must specify accessible contact channels, working languages, time-zone coverage, and any location or local-support arrangements needed for the applicable EU or UK role. A US address alone does not establish adequate accessibility.

C.2.4 Statutory tasks and Deliverables. Aetos informs and advises Client and personnel who process personal data about applicable data protection obligations; monitors compliance with applicable data protection law and Client policies, including allocation of responsibilities, awareness, training, and related audits; advises on and monitors performance of data protection impact assessments; and cooperates with supervisory authorities, including on prior consultation. Aetos considers processing risks in prioritizing its work, reports findings to Client's highest management level, and monitors Client's response. Client retains operational decisions and remediation responsibility. In addition, Aetos provides:

C.2.4.1 Data protection impact assessments: advice on and monitoring of assessments for high-risk processing, including large-scale tracking and special category data. Drafting support may be provided only where consistent with Section C.2(b)'s conflict safeguards; Client approves and remains responsible for each assessment.

C.2.4.2 Transfer impact assessments: review of cross-border transfer mechanisms, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses, for transfers from the EEA or UK to third countries.

C.2.4.3 Data subject rights management: mediation and operational guidance on complex requests, such as erasure versus anonymization, so responses meet regulatory standards without disrupting operations.

C.2.4.4 Training: employee training on GDPR requirements relevant to Client's business.

C.2.5 Not a representative. This service does not appoint Aetos as Client's representative under Article 27 of the EU GDPR or the UK GDPR. Client is responsible for appointing any representative it needs.

C.2.6 Confidentiality. Section 6 applies, and Aetos keeps confidential the matters it learns in performing DPO tasks.

C.3 HIPAA Privacy Officer as a Service

C.3.1 BAA first. Aetos provides this service only after the parties sign a BAA, and Client will not share PHI with Aetos before then. The BAA controls for PHI.

C.3.2 Designation. For a covered entity, the qualified individual named in the Order Form serves through Aetos as Client's designated privacy official under 45 C.F.R. 164.530(a), responsible for developing and implementing Client's HIPAA privacy policies and procedures within the agreed engagement, with Client supplying the authority, resources, workforce cooperation, and approvals needed. Aetos also acts as the designated privacy contact for complaints and patient inquiries, is identified in Client's Notice of Privacy Practices and on its website, and serves as administrative liaison for HHS and OCR inquiries. Client documents the designation and retains decisions reserved to its management, including sanctions, legal positions, and approval of external notices. This is not a designation as HIPAA Security Officer unless separately agreed.

C.3.3 Deliverables. Aetos provides:

C.3.3.1 Vendor review and BAA management: reviewing prospective vendors for compliance risk and managing the execution of BAAs with them.

C.3.3.2 Incident response and breach notification: coordinating internal investigations and preparing required notices and reports. For covered entity clients, this includes affected-individual, HHS, and media notices where applicable. Client approves notices before release, and Aetos submits notices or reports on Client's behalf only to the extent expressly authorized in the Order Form and by the relevant covered entity where required. For business associate clients, the primary reporting path is to the upstream covered entity or business associate under the applicable BAA, as Section C.3(e) provides. Approval workflows do not extend legal or contractual deadlines, and do not delay Aetos's own incident reporting duties under Section 7.3 or the BAA.

C.3.3.3 Audit readiness and documentation: maintaining training logs, policy updates, complaint records, and risk records to support oversight and audits. Client retains required HIPAA documentation for the applicable legal period, including six years from creation or the date last in effect, whichever is later, where required by 45 C.F.R. 164.530(j). Aetos will provide those records through ordinary delivery and the Section C.1(b) handoff; its Platform retention periods are not Client's legal record-retention schedule. Any agreement for Aetos to serve as the long-term records custodian must be stated in the Order Form.

C.3.3.4 Training: employee training on HIPAA requirements relevant to Client's business.

C.3.4 Platforms. PHI may be uploaded to the Platforms only as Section D.3 allows.

C.3.5 Business associate clients. If Client is a business associate rather than a covered entity, Aetos acts as Client's HIPAA privacy lead and, to the extent it handles PHI on Client's behalf, as Client's subcontractor under the BAA. The covered-entity privacy-official designation and Notice of Privacy Practices listing in Section C.3(b) do not apply. Aetos supports Client's applicable HIPAA duties and upstream contractual commitments, including policies, complaints, incident assessment, and notices to the upstream covered entity or business associate. HHS, media, or individual reporting is performed on a covered entity's behalf only with the necessary delegated authority; it is not an automatic duty of a business associate client. Aetos reports its own incidents to Client under Section 7.3 and the BAA without waiting for Client's approval.

Schedule D: Platform Access

This Schedule applies automatically to Platform use associated with purchases governed by this Agreement, including use by Client, Authorized Users, Participants, and invited Share Room visitors.

D.1 Access and individual terms. Aetos grants Client a non-exclusive, non-transferable right for its Authorized Users to use the Platforms to receive the Services during the engagement and any continuation under Section D.8. No software is delivered. Client must inform its users of the applicable use and confidentiality restrictions and is responsible as Section 5.3 provides. Aetos may separately present individual Platform Terms for express acceptance before access, retaining their version and acceptance record. They bind only the accepting user's conduct, do not make that person a purchaser, and do not change Client's commercial terms or remedies. This Agreement binds Client independently of whether a separate individual acceptance flow is used. Participant acknowledgements under Section D.5 remain required.

D.2 Aerie accounts. Aerie is invitation-only. Each Authorized User must use an individual account and multi-factor authentication. Aetos maintains reasonable inactivity and failed-sign-in controls. Client's administrator assigns supported roles, configures file permissions, and promptly removes users who no longer need access. Aetos personnel access remains subject to Sections 2.4, 6, and 7. Aetos may adjust security settings if overall protection is not materially reduced.

D.3 Uploads. Aetos scans uploads for malware and may reject files under reasonable type, size, or security limits communicated through the Platform. Client must not upload payment card data, authentication secrets, or other data excluded by the Order Form. PHI may be uploaded only if the parties have signed a BAA, the Order Form approves the specific Platform and workflow, and Aetos has put the required downstream BAAs and safeguards in place. Other specially regulated data requires prior written agreement on the necessary protections.

D.4 Share Rooms. Client chooses who may enter a Share Room, which documents they see, whether they may download, whether they must accept Client's NDA, and when access expires. Where Share Rooms are enabled, Aetos will use email verification, document watermarking, and access logging as described in the agreed service documentation. These controls do not prevent all copying or redistribution by a recipient. Visitors are invited reviewers, not Authorized Users; they see only the selected documents for the access period and must accept any NDA Client selects and any individual Platform Terms presented for acceptance. Client is responsible for its decision to disclose documents and for any NDA with its recipients. Share Room access ends no later than the engagement's access-close date under Section D.8.

D.5 Tabletop sessions. An Aetos facilitator runs each session. Participants join by session code without an account and must accept a confidentiality acknowledgement and any individual Platform Terms presented for acceptance before joining. Screens carry a watermark with the Participant's nickname. Aetos deletes session nicknames and join tokens when the session ends, and retains exercise records only for the period in the DPA. Comments, roles, and combinations of responses can still identify people; Aetos does not treat them as anonymous merely because nicknames are removed. Client is responsible for inviting only its own personnel or others it is permitted to involve.

D.6 Custom scenarios. Client may provide policies, plans, contracts, and risk registers for a custom scenario. Subject to Section 7.4 and the DPA, Aetos uses AI to build the profile and draft the scenario. The workflow sends Client's real name and key people's names to the AI provider so they can be excluded from the finished scenario. Aetos checks that the finished scenario uses fictional names and reviews it before use. This does not anonymize the source profile, prompts, or provider logs, which remain protected Client Materials. Client must have authority to supply the data, and Aetos must limit it to what the task needs. No prior replacement of names is promised.

D.7 Availability. Aetos will use commercially reasonable efforts to keep the Platforms available, but does not offer a service level unless an Order Form states one. Aetos may change the Platforms if the change does not materially reduce the security or core functions Client relies on. If a material reduction cannot be remedied within 30 days after notice, Client may end the affected Service and receive a refund of its unused prepaid fees. Where Platform access is bundled, the parties will reasonably allocate the affected fee or, if the reduction materially defeats the engagement's purpose, end the affected engagement.

D.8 End of access and export.

D.8.1 Platform access continues for 30 days after an engagement ends, for review and export only. No further consulting, facilitation, or new Deliverables are included.

D.8.2 Access ends immediately if Aetos ends for cause, Client uses Section A.12, or Client ends for convenience before completion a Service other than Monthly Services.

D.8.3 Hourly engagements follow Section 11.1.

D.8.4 Client may export retained Client Materials and paid or Section A.12 Deliverables. If access closes immediately, Aetos will provide one usable export securely and without charge within [10] business days after a request received within 30 days after closure, or during any longer agreed retention period, and sooner where law requires. An export does not restore access or unpaid-work licenses. Client Materials may not be withheld over a fee dispute.

D.8.5 Separate active engagements keep their own access; they do not reopen closed files. Section 7.6 governs retention and Section 4.3 still permits suspension.

D.8.6 Mandatory switching, retrieval, and exit rights under Regulation (EU) 2023/2854, where applicable, prevail over conflicting access periods, deletion terms, or charges in this Agreement.

Shayne Adler

Shayne Adler is the co-founder and Chief Executive Officer (CEO) of Aetos Data Consulting, specializing in cybersecurity due diligence and operationalizing regulatory and compliance frameworks for startups and small and midsize businesses (SMBs). With over 25 years of experience across nonprofit operations and strategic management, Shayne holds a Juris Doctor (JD) and a Master of Business Administration (MBA) and studied at Columbia University, the University of Michigan, and the University of California. Her work focuses on building scalable compliance and security governance programs that protect market value and satisfy investor and partner scrutiny.

Connect with Shayne on LinkedIn

https://www.aetos-data.com
Next

Product Privacy Notice