Professional Services Agreement

Tripwire, Inc., a Delaware corporation and its successors or assignees (“Tripwire”) offers professional services (“Services”) under the following terms and conditions (“Agreement”). By placing an order for Services, Customer agrees to be bound by the Agreement.

1. SCOPE.

Services are governed exclusively by the terms of this Agreement, applicable Service-specific terms at www.tripwire.com/terms, and, for orders placed directly with Tripwire, the applicable Tripwire quotation (collectively the “Order”). Purchase orders issued by Customer are for the sole purpose of identifying quantities, pricing, and delivery address; any additional or conflicting terms in the Customer’s purchase order will not be effective and are expressly declined. Distributors and resellers do not have the right to modify this Agreement or to make any additional representations, commitments or warranties binding on Tripwire. The scope of the Services may be further defined in an engagement letter or statement of work provided by Tripwire.

2. POLICIES AND PROCEDURES; CONFIDENTIAL INFORMATION

2.1 If it is necessary for Tripwire to have access (either on-site or remotely) to Customer’s network or computer systems to perform the Services, Tripwire shall limit its use to those computer systems, files, software or services reasonably required to perform the Services. Tripwire shall follow Customer’s safety and security rules and procedures which are provided to Tripwire in writing.

2.2 Each party will hold the other party’s Confidential Information in confidence and will not disclose any such Confidential Information to any third party without first obtaining the disclosing party’s express written consent. By way of illustration but not limitation “Confidential Information” includes (a) Tripwire software, trade secrets, inventions, ideas, processes, formulas, source and object codes, scripts, data, programs, other works of authorship, know-how, improvements, discoveries, developments, designs and techniques; (b) information regarding plans for research, development, new products, marketing and selling, business plans, budgets and unpublished financial statements, licenses, prices and costs, suppliers and customers; and (c) information regarding the skills and compensation of the employees of the disclosing party.

2.3 Confidential Information does not include information that: (a) is or becomes generally known or available to the public through no act or omission of Recipient; (ii) is rightfully known to or received by Recipient prior to receiving such information from Disclosing Party without restriction as to use or disclosure; or (iii) is independently developed by Recipient without use of Confidential Information and without a breach of this Agreement. The existence of this Agreement and the nature of the business relationship between the parties are not Confidential Information.

2.4 The recipient will use the other party’s Confidential Information only as necessary to perform the recipient’s obligations under this Agreement. The recipient will not disclose Confidential Information to any person or entity except to the recipient’s employees or contractors, whose job performance requires access and who are under confidentiality obligations. The recipient may disclose Confidential Information pursuant to the order or requirement of a court, administrative agency, or other governmental body, only if the recipient gives reasonable notice to the disclosing party to contest such order or requirement. The recipient shall give the disclosing party written notice of any unauthorized disclosure or use of the Confidential Information as soon as the recipient learns or becomes aware of the unauthorized disclosure or use.

2.5 Tripwire may disclose the Confidential Information to its Affiliated Companies. “Affiliated Companies” are companies which control, are controlled by, or under common control with Tripwire, but only so long as such control continues to exist. For purposes of this definition, “control” means ownership, directly or indirectly, of greater than fifty percent (50%) of the voting rights in such entity.

2.6 The Parties shall comply with applicable data protection legislation in regard to the collection, processing, and use of any personal information which may be received in connection with the performance of obligations under this Agreement. Tripwire may store the Customer personal information in databases located and accessible globally by its personnel and use it for purposes reasonably necessary to the administration of this Agreement. Tripwire will use reasonable technical and organizational measures to ensure that the personal information is processed in compliance with applicable data protection laws. Customer may obtain a copy of the personal information held by Tripwire by written request and/or submit updates and corrections by written notice to Tripwire. The parties shall not exchange or allow access to sensitive personal information protected by applicable laws and regulations, such as health information, credit or payment information, or similar protected information regarding individuals.

3. FEES AND INVOICING.

3.1 Services are billed in full-day increments only. A “Day” is defined as 8 hours of scheduled availability of a Tripwire resource. In the event that an engagement requires a partial day of Services, the invoice will reflect a Day of Services. The quoted number of Service Days is an estimate based on the assumptions that Customer will: a) have sufficient staff participation to provide information; b) help with problems specific to Customer; and c) perform required testing in a timely manner. Any changes in scope will be made in writing and must be approved by authorized representatives of Customer and Tripwire.

3.2 For Services ordered by Customer directly from Tripwire: (a) Tripwire will invoice Customer for the Services fees and reimbursable expenses as stated in the Order; and (b) invoices will refer to Customer’s purchase order number, if applicable. For any prepaid Services, Customer agrees that if it has not used the prepaid Services within one year, Tripwire has no further obligations and Customer shall not be entitled to a refund. For any orders placed through a distributor or reseller, Customer shall pay the distributor or reseller in accordance with the terms agreed upon between them. Customer acknowledges that Tripwire’s performance of any Services purchased through a distributor or reseller is contingent upon Tripwire’s receipt and acceptance of an applicable purchase order from the associated reseller or distributor. For such orders, Tripwire shall have no obligation to perform Services in the event that Tripwire does not receive payment from the distributor or reseller.

3.3 Tripwire shall be reimbursed for reasonable out-of-pocket expenses incurred in connection with the Services, in accordance with Tripwire’s guidelines which will be provided upon request. Expenses may include, but are not limited to, airfare and other transportation, lodging, meals, and incidentals. Total expenses shall not exceed the not-to-exceed amount as quoted by Tripwire. Expenses will be invoiced monthly as incurred at Tripwire’s cost, and may be invoiced separately from fees.

3.4 During the term of a Services engagement and for six months after completion, if Customer employs or engages as a consultant an individual who has been assigned by Tripwire as a resource for a Services engagement, then Customer shall pay to Tripwire a fee of $150,000, as liquidated damages and not as a penalty.

4. Scheduling

4.1 On Tripwire’s acceptance of an Order for Services, Tripwire will contact Customer to set an agreed-upon schedule for the Services engagement based on availability of Tripwire and Customer resources. If Customer purchases 5 or more Days of Services, Customer may choose to schedule Tripwire resources for 4 consecutive 10-hour work days, to be invoiced as 5 Days.

4.2 Tripwire requires at least 10 business days’ notice if Customer chooses to reschedule a scheduled Services engagement. If Customer reschedules an engagement with less than 10 business days’ notice prior to the scheduled start of Services, Tripwire will invoice Customer a fee equal to 20% of the total fees for the scheduled Services (“Rescheduling Fee”). For scheduling changes made less than 5 business days prior to the scheduled commencement, the Rescheduling Fee will be equal to 50% of the fees for scheduled Services. In addition, Customer will be responsible for payment of Tripwire’s out-of-pocket expenses incurred prior to or resulting from such changes in schedule (such as nonrefundable airfares or airline change fees).

5. OWNERSHIP. It is the intent of the parties that the Services are a configuration and/or installation of Tripwire’s commercially available software on Customer’s IT infrastructure. Tripwire does not offer custom development engagements for new software applications or other software products under this Agreement. All intellectual property rights that are owned or controlled by a party at the commencement of the Services shall remain under the ownership or control of such party throughout the term of the Services engagement and thereafter. Neither party intends that the Services shall result in the creation, conception or development of any creative work, inventions, or innovations ("Created Work"). In the event Tripwire does create, conceive or develop Created Work as a result of the performance of the Services, Tripwire shall own such Created Work, and hereby grants to Customer a royalty-free, non-exclusive, world-wide, fully paid, limited license to use and practice the Created Work for its internal business purposes in conjunction with the authorized use of the associated Product.

6. LIMITED WARRANTY. Tripwire will provide the Services in a professional and workmanlike manner and to standards not less than those generally accepted in the industry. TRIPWIRE’S ENTIRE LIABILITY AND CUSTOMER’S EXCLUSIVE REMEDY WILL BE RE-PERFORMANCE OF THE SERVICES THAT DO NOT MEET THIS LIMITED WARRANTY, PROVIDED CUSTOMER HAS GIVEN TRIPWIRE DETAILED WRITTEN NOTICE OF THE DEFICIENCY WITHIN 10 DAYS OF PERFORMANCE OF THE NON-CONFORMING SERVICE.

7. LIMITATION OF LIAIBLITY.

7.1 Tripwire’s liability shall not be limited or excluded in relation to: (a) death or personal injury caused by its negligence or intentional misconduct (or that of its employees or agents); (b) fraudulent misrepresentation; or (c) any other liability that cannot under applicable law be limited or excluded. Subject to the foregoing, TRIPWIRE SHALL NOT BE LIABLE FOR: LOSS OF PROFITS, LOSS OF DATA, LOSS OF REVENUE, LOSS OF USE, OR PUNITIVE, EXEMPLARY, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER BASED ON CONTRACT, TORT OR ANY OTHER LEGAL THEORY, EVEN IF TRIPWIRE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Subject to the first sentence above, TRIPWIRE’S LIABILITY UNDER THIS AGREEMENT SHALL NOT EXCEED IN AGGREGATE, THE GREATER OF: (A) THE AMOUNT PAID OR PAYABLE BY CUSTOMER IN THE 12 MONTHS PRIOR TO THE CLAIM FOR THE SERVICE GIVING RISE TO THE CLAIM: OR (B) $10,000. The fees reflect the allocation of risk set forth in this Agreement. The parties would not enter into this Agreement without this allocation.

7.2 Tripwire’s Services are developed for general use in a variety of information management environments. The Services not designed for use in a situation in which use or failure of the Service could lead to death or serious bodily injury of any person, or severe physical or environmental damage (“High Risk Activities”). Examples of High Risk Activities include, without limitation, the design or operation of nuclear facilities, aircraft navigation or communication systems, air traffic control, weapons systems, or direct life-support systems. If Customer uses Services in High Risk Activities, then Customer shall be responsible to take all appropriate fail-safe, backup, redundancy and other measures to ensure the safe use of such Services. Notwithstanding anything to the contrary in Section 7.1, TRIPWIRE DISCLAIMS ANY LIABILITY FOR ANY DAMAGES CAUSED BY USE OF THE SERVICES IN HIGH RISK ACTIVITIES.

8. RELATIONSHIP. The relationship of Customer and Tripwire with respect to the performance of Services is that of independent contractors. Tripwire will be solely responsible for compensating and providing required workers compensation insurance for its employees who provide the Services to Customer. Subject to the protection of Customer’s Confidential Information, nothing in this Agreement prohibits Tripwire from performing similar or identical services for other parties.

9. INSURANCE.Tripwire will maintain, at no additional cost to Customer, the insurance coverage types and minimum amounts of insurance shown below during the period of any Services provided hereunder:

Commercial General Liability (Occurrence): $1,000,000 each occurrence; $2,000,000 general aggregate

Automobile Liability, including hired autos and non-owned autos: $1,000,000 combined single limit

Umbrella Liability (Occurrence): $6,000,000 each occurrence; $6,000,000 aggregate

Workers Compensation and Employers’ Liability: Statutory limits for Workers Compensation; $1,000,000 each accident

Professional & Technical Errors and Omissions: $3,000,000 aggregate

All policies required by this Agreement will be written by insurance carriers who are rated A- or better by A.M. Best, except for a state compensation insurance fund when not specifically rated. Upon request, Tripwire will provide to Customer a certificate of insurance indicating the coverage required in this section.

10. TERMINATION. Either party may terminate the performance of the Services for a material breach of this Agreement by the other party and failure to cure the breach within 30 days after written notice specifying the breach. Customer will remain liable to pay Tripwire for any Services performed prior to the termination. If Tripwire terminates due to Customer’s material breach, Customer will cease use of all Services deliverables as of the effective date of the termination and return or destroy all copies and will, upon request, provide Tripwire with a certification signed by an authorized representative of Customer that all such deliverables have been returned or destroyed. Once a Services Order is accepted by Tripwire, neither party may terminate the engagement for convenience without the written consent of the other party. The following sections will survive any termination of this Agreement: 2 (Policies and Procedures; Confidential Information), 5 (Ownership, Grant of License), 6 (Limited Warranty), 7 (Limitation of Liability), 8 (Relationship), 10 (Termination), 11 (Additional Terms).

11. ADDITIONAL TERMS.

11.1 Governing Law; Venue. This Agreement shall be governed by and construed under the laws of the State of Oregon, USA, excluding choice of laws rules. Any action or proceeding arising from or relating to this Agreement, must be brought in a federal court in the District of Oregon or in state court in Multnomah County, Oregon, and each party irrevocably submits to the jurisdiction and venue of any such court in any such action or proceeding. This Section 11.1 shall not restrict Tripwire’s right to bring an action against Customer in the jurisdiction where Customer’s place of business is located.

11.2 Assignment. Any assignment or transfer of this Agreement by the Customer is prohibited without the prior written consent of Tripwire, and any attempted transfer or assignment without such consent shall be void and without force or effect. The terms of this Agreement shall be binding on permitted successors in interest and assigns.

11.3 Force Majeure. Neither party shall be liable for default or delay in performing its obligations due to causes beyond its reasonable control, as long as such causes continue and the party continues to use commercially reasonable efforts to resume performance. If such default or delay extends for more than 60 days, the other party shall have the right, without obligation or liability, to cancel any Order or portion thereof affected by such default or delay.

11.4 Severability; Modification; Notice; Waiver. If a court of competent jurisdiction finds any provision of this Agreement invalid or unenforceable, that provision will be enforced to the maximum extent permissible and the other provisions of this Agreement will remain in full force and effect. This Agreement may only be modified in writing by authorized representatives of the parties. All notices required or authorized under this Agreement must be in writing. All notices shall be effective upon delivery if: (a) delivered in person; or (b) delivered by email, with proof of delivery or if receipt is acknowledged; or (c) delivered by mail, if mailed in a form of priority mail, express mail or courier service addressed to the other party at its principal business address or at such other address that either party provides by advance written notice to the other party. Waiver of terms or excuse of breach must be in writing and shall not constitute subsequent consent, waiver or excuse. This Agreement supersedes all prior agreements between the parties with respect to its subject matter and constitutes the complete and exclusive statement of the terms of the agreement between the parties with respect to its subject matter.