Standard Mutual Non-Disclosure Agreement

1. Purpose

The Disclosing Party operates a trust center to communicate its security and compliance posture. The Receiving Party wishes to access confidential security documentation shared through the trust center's dataroom for the purpose of evaluating the Disclosing Party's security practices in connection with a current or potential business relationship (the "Purpose").

2. Definition of Confidential Information

"Confidential Information" means all non-public information disclosed by either Party to the other through the iNeedTrust platform or in connection with the Purpose, including but not limited to:

• Security audit reports (SOC 1, SOC 2, SOC 3, ISO 27001 audit reports)
• Penetration test results, vulnerability assessments, and remediation plans
• Architecture diagrams, network topology, and data flow documentation
• Security policies, procedures, and incident response plans
• Business continuity and disaster recovery plans
• Compliance certifications and related assessment documentation
• Subprocessor lists, vendor risk assessments, and data processing records
• Insurance certificates and coverage details
• Any other materials designated as confidential or shared through the trust center's gated dataroom

Confidential Information includes information in any form - written, oral, electronic, visual, or otherwise - and includes copies, summaries, and derivative works.

3. Exclusions

Confidential Information does not include information that the Receiving Party can demonstrate:

1. Was publicly available at the time of disclosure, or becomes publicly available through no fault or action of the Receiving Party
2. Was already known to the Receiving Party at the time of disclosure, as evidenced by written records predating the disclosure
3. Was independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information
4. Was lawfully received from a third party without restriction on disclosure and without breach of any obligation of confidentiality
5. Is required to be disclosed by law, regulation, or valid court order, provided that the Receiving Party gives the Disclosing Party prompt written notice (where legally permitted) and reasonable opportunity to seek a protective order or other appropriate remedy

4. Obligations

Each Party agrees to:

• Protect the other Party's Confidential Information using at least the same degree of care it uses to protect its own confidential information of similar nature, but in no event less than reasonable care
• Limit access to Confidential Information to its employees, contractors, advisors, and agents ("Representatives") who have a need to know for the Purpose and who are bound by confidentiality obligations at least as protective as those in this Agreement
• Not disclose Confidential Information to any third party without the Disclosing Party's prior written consent
• Not use Confidential Information for any purpose other than the Purpose
• Not copy or reproduce Confidential Information except as reasonably necessary for the Purpose

Each Party is responsible for any breach of this Agreement by its Representatives.

5. No License or Obligation

Nothing in this Agreement grants either Party any license, right, or interest in the other Party's intellectual property, trade secrets, or proprietary rights. Disclosure of Confidential Information does not create any obligation to enter into any further agreement, business relationship, or transaction.

6. Return and Destruction

Upon the Disclosing Party's written request, or upon termination of this Agreement, the Receiving Party shall:

• Cease accessing the Disclosing Party's trust center dataroom
• Promptly delete all downloaded copies of Confidential Information from its systems
• Upon request, provide written confirmation of such deletion within fifteen (15) business days

Notwithstanding the foregoing, the Receiving Party may retain copies of Confidential Information to the extent required by applicable law, regulation, or its standard document retention policies, provided such retained copies remain subject to the confidentiality obligations of this Agreement.

7. Term and Survival

Term: This Agreement is effective from the date of acceptance and remains in effect for as long as the Receiving Party maintains access to the Disclosing Party's trust center, plus two (2) years following the termination or expiration of such access.

Revocation: The Disclosing Party may revoke the Receiving Party's access at any time through the platform. Revocation of access does not release the Receiving Party from its confidentiality obligations, which survive for the period stated above.

Expiration: If the trust center operator has configured an NDA expiration period, this Agreement expires at the end of that period. The Receiving Party will be prompted to re-accept the Agreement to maintain access.

8. Remedies

Each Party acknowledges that a breach of this Agreement may cause irreparable harm to the Disclosing Party that cannot be adequately compensated by monetary damages alone. Accordingly, the Disclosing Party shall be entitled to seek injunctive or other equitable relief from any court of competent jurisdiction, without the necessity of proving actual damages or posting a bond, in addition to any other remedies available at law or in equity.

9. Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, United States, without regard to its conflict of law provisions. The Parties consent to the exclusive jurisdiction of the state and federal courts located in Wilmington, Delaware for any disputes arising under this Agreement.

10. General

Severability: If any provision of this Agreement is held unenforceable, the remaining provisions shall continue in full force and effect, and the unenforceable provision shall be modified to the minimum extent necessary to make it enforceable.

Entire Agreement: This Agreement constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous oral or written understandings. This Agreement may not be amended except by written agreement signed or electronically accepted by both Parties, or by the trust center operator updating the NDA template through the platform (in which case the Receiving Party will be prompted to accept the updated terms).

Waiver: The failure of either Party to enforce any right under this Agreement shall not constitute a waiver of that right.

Assignment: Neither Party may assign this Agreement without the other Party's prior written consent, except in connection with a merger, acquisition, or sale of substantially all assets.

Platform Facilitation: This Agreement is facilitated by iNeedTrust. iNeedTrust is not a party to this Agreement and assumes no liability for the obligations of either Party hereunder. Acceptance records (timestamp, identity, and version accepted) are maintained by the platform for audit purposes.