FULLY_SIGNED_MCSA0038_SA2_AMD1.pdf

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 1 of 35

Version 7/23

CBOSS, INC.

MASTER CLOUD SERVICES AGREEMENT (MCSA0038)

SERVICE ATTACHMENT 2

AMENDMENT 1

This Amendment 1 to Service Attachment 2 of contract #MCSA0038 (the “Amendment”) is between the State of Ohio, Department of Administrative Services (the “State”) and CBOSS, Inc. (the “Service Provider”). This Amendment changes the terms of CBOSS, Inc. Master Cloud Services Agreement # MCSA0038 (the “Agreement”).

WHEREAS, the State and Service Provider entered into the Agreement on June 23, 2015 and Service Attachment 2 on September 2, 2015; and

WHEREAS, the State and Service Provider determined that an amendment is necessary to address certain revisions to the Agreement.

NOW, THEREFORE, the Agreement is amended as follows:

1. Delete Service Attachment 2 in its entirety and replace it with the revised Service Attachment 2 attached to this Amendment and incorporated as if fully rewritten herein.

This Amendment shall become effective as of the date of the State’s signature and shall remain in full force and effect for the term of the Agreement. Except as modified by this Amendment, all other terms, conditions and pricing of the Agreement shall remain the same and in full force and effect.

IN WITNESS WHEREOF, the parties have executed this Amendment as of the dates appearing below.

CBOSS, INC. STATE OF OHIO

DEPARTMENT OF ADMINISTRATIVE SERVICES

By: By:

Name: Name: Kathleen C. Madden

Title: Title: Director

Date: Date:

Kathleen A. Duganne

Director of Operations

7/1/2025 me: Kathleen A. Duganne

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 2 of 35

SERVICE ATTACHMENT 2

UNDER

MASTER CLOUD SERVICES AGREEMENT #MCSA0038

This Service Attachment 2 under Master Cloud Services Agreement #MCSA0038 (the “Service Attachment”) is between CBOSS, Inc. (“Service Provider”), having an office at 7332 Southern Boulevard, Boardman, Ohio 44512, and the State of Ohio (“State”), through the Department of Administrative Services (“DAS”), having its principal place of business at 30 East Broad Street, 40th Floor, Columbus, Ohio 43215.

The State and the Service Provider are sometimes referred to jointly as the "Parties" or individually as a “Party.” This Service Attachment is effective as of the date signed by the State and amends that certain Master Cloud Services Agreement #MCSA0038 between the Parties dated June 23, 2015 (the “Agreement”).

1. Definitions

The defined terms in the Contract will have the same meanings in this Service Attachment as they do in the Contract. There may be additional definitions contained herein.

For purposes of this Service Attachment, the Service Provider may be referred to as “Contractor,” Subscribing Entities may be referred to as “Subscribers,” and the Agreement may be referred to as the “Contract.”

2. Services

2.1 Overview. This Service Attachment pertains to all Central Payment Portal (CPP) licensing and services. The Contractor delivers e-payment business solutions (including an enterprise State IT application Service) in connection with the ePayment program described in Section 5.3.5 of Supplement A: State IT Policy, Standard and Service Requirements.

Data security information:

a. The Services do not host or process Subscriber Data outside the United States.

b. The Services comply with the requirements to process Protected Health Information.

c. The Services comply with the requirements to process Federal Tax Information.

d. The Services do not comply with the requirements to process Criminal Justice Information Systems data.

2.2 Standard Service Features. The following Service features are provided as part of this Agreement

2.2.1 Central Payment Portal. The Central Payment Portal (CPP) is an omnichannel payment gateway and ePayment Business Solutions Service that can process credit cards, debit cards, and electronic checks, record cash payments for centralized reporting, and gives Subscribers’ customers the freedom to make payments quickly and conveniently. CPP is the core service on which all other Services in this Agreement are based.

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 3 of 35

2.2.2 CPP Payment Standard Channels.

(i) Online: To facilitate online payments, Service Provider can develop a custom payment form for you or integrate with your existing customer portal with matched branding using CPP Flex Link.

(ii) Point of Service: Conveniently accept credit and debit cards at the point of service. Point-to- Point Encrypted (P2PE) devices are available for purchase through Service Provider processing partners, and swipe devices are available for purchase from Service Provider.

(iii) Virtual Terminal: Subscribing Entity staff can manually enter payments over the phone or at the point of service.

2.2.3 CPP Add-on Payment Channels. Payment Plans: Ability to process and capture recurring payments from customers in CPP, allowing you to guarantee payment, accurately forecast and maximize convenience for customers.

2.2.4 IVR: Allow Subscribers’ customers to pay via phone 24/7 to an automated service. IVR is a frictionless way for internet averse Subscribers’ customers to pay that will save time and money.

2.2.5 Subscriber Front End Application Options.

2.2.5.1 Custom Hosted Payment Form. Service Provider will create a custom hosted payment form that mimics the look and feel of the Subscribing Entity’s website.

Through this form, Service Provider collects the customer information needed to ensure accurate reporting and data security. Five data fields and standard validation are provided for free. Additional fields and custom validation can be added for an additional fee set forth in the Pricing Addenda; or

2.2.5.2 CPP Integration Options.

(i) Hosted Payment Page Integration: With a hosted integration, customers will be redirected from a Subscribing Entity’s website or application to Service Provider’s secure environment. The customers’ experience while making their payments can be customized to match the look and feel of the website to offer a near seamless experience.

(ii) Wallet Integration: CPP Wallet is a non-hosted digital wallet and payment gateway solution that launches in an iFrame within the Subscribing Entity’s application with matching branding. Since the customers never leave the website, the Subscribing Entity has full control over their experience. In addition to performing one-time transactions, the CPP Wallet can store customers’ payment information within Service Provider’s secure environment for future use.

2.2.6 Additional Included Services.

(i) Web-based Real-time Reporting Portal: Transactions are available to view and search within minutes in summary or detail form. Reports are in a convenient spreadsheet format and exportable to Excel or PDF.

(ii) Nightly or Real-time Reconciliation: Nightly reconciliation files can be transmitted in a variety of formats. Reconciliation API also available for real-time reconciliation

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 4 of 35

(iii) Initial Admin and User Setup: Initial setup of all users, including an admin who can manage client users and permissions

(iv) Test Environment Access: One Staged testing area and a production area.

2.2.7 Financial Connections.

(i) Credit Card Processor Setup: Service Provider has multiple options (PayPal or Worldpay Integrated Payments) to connect the Subscribing Entity to its processor.

(ii) ACH Bank File Setup1

(iii) ACH Account Validation2: Real-time authorization that satisfies Nacha compliance requirements. Service Provider will be utilizing the industry’s most current and accurate source of collaborative account information to validate accounts and provide responses for high-risk transactions. Additional fees apply.

1 Service Provider can work with the existing merchant bank and the Subscriber is responsible for all setup and integration fees charged by the bank or other third parties.

2 Service required for clients using “WEB” as SEC code for ACH transactions.

2.2.8 Application and Security.

(i) 24x7x365 availability

(ii) SSL Security: Utilizing payments.cboss.com

(iii) PCI Certified Data Processing

(iv) Managed Services of Payment Processing Application

(v) Redundant SaaS Hosting Services

(vi) Off-site Data Backup

2.2.9 Processor Connection Options. The State currently uses Worldpay to process credit/debit cards through their CORE platform. Contractor has two different ways to send payments to Worldpay for the State of Ohio to select for this Service Attachment.

Connection Option1: PayPal

Currently for the State of Ohio, Contractor connects to Worldpay’s CORE Platform through our partnership with PayPal.

Connection Option 2: Worldpay Integrated Payments

Contractor has an integration to Worldpay’s newest platform, Integrated Payments, providing a direct connection between Contractor and Worldpay. The State of Ohio can leverage this integration by migrating to this new platform, eliminating PayPal’s services and fees quoted in option 1.

2.3 Optional Service Features.

Service Provider offers professional services for additional setup and/or modifications that will be scoped and a proposal provided based on the resource rate card in the Pricing Addenda. DAS and the Subscriber must approve a scope of work and/or change request before Service Provider performs any professional services under this Service Attachment.

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 5 of 35

2.4 Provision of Services. The Contractor will make the Services available to the Subscribers for purchase pursuant to the Contract, including this Service Attachment. The Services will be Available to the Subscribers pursuant to the Contract and this Service Attachment during each Order Term. The State agrees that purchases hereunder are neither contingent on the delivery of any future functionality or features nor dependent on any oral or written public comments made by the Contractor regarding future functionality or features.

2.5 Support. The Contractor must provide the Contractor’s basic support for the Services to the Subscribers at no additional charge and upgraded support if available and if purchased by a Subscriber.

Contractor’s support is described in Exhibit I, End User License Agreement, attached to this Service Attachment and incorporated as if fully rewritten herein.

3. Fees and Payment

3.1 Pricing. The specific pricing for this Service Attachment is set forth in the Pricing Addenda attached hereto and incorporated herein. All fees are contingent on use of Contractor APIs. If other APIs are used, Contractor will provide a quote for custom work based on the professional services rates set forth in the Pricing Addenda.

3.2 Fee Structure and Payment. The Subscribers will pay all fees specified in all Orders hereunder, subject to the terms of the Contract. Except as otherwise specified, fees are based on Services purchased and not actual usage, and the number of Object subscriptions (e.g., the number of users) purchased cannot be decreased during the relevant Order Term. They may, however, be increased during an Order Term pursuant to the Contract. Object subscription fees are based on yearly periods that begin on the subscription start date and each yearly anniversary thereof. No Order may specify a Service or provision not identified and/or priced in this Service Attachment, nor may it cover any billable services not listed in this Service Attachment as a Service.

If a Subscriber has not paid the fees specified in an Order by 90 days from the payment due date, the Contractor may suspend a delinquent Subscriber’s access to the unpaid Service(s) until all delinquent amounts are paid, upon written notice to the Subscriber, notwithstanding any prohibition against self-help provided for elsewhere in the Contract. However, Contractor may not suspend Services if the Subscriber is disputing the applicable charges reasonably and in good faith, and is otherwise cooperating diligently to resolve the dispute.

3.3 Invoicing. Fees will be invoiced monthly in arrears and otherwise in accordance with the Contract.

Fees are due in accordance with the terms of the Contract and this Service Attachment, which no Order may alter. Each Subscriber is responsible for providing complete and accurate billing and contact information to the Contractor and notifying the Contractor of any changes to such information.

4. Proprietary Rights

4.1 Reservation of Rights in Services. Subject to the limited rights expressly granted hereunder, the Contractor reserves all rights, title, and interest in and to the Services, including all related intellectual property rights. No rights are granted to the State or Subscribers hereunder other than as expressly set forth herein or elsewhere in the Contract.

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 6 of 35

4.2 Reservation of Rights in Subscribers’ Data. Subject to the limited rights granted by a Subscriber hereunder, the Contractor acquires no right, title, or interest from a Subscriber or its licensors under this Contract in or to the Subscriber’s Data, including any intellectual property rights therein.

4.3 Restrictions. Subscribers will comply with the requirements set forth in the Contract. Nothing herein prohibits a Subscriber from porting and hosting Generated Files, as defined in this Contract, to other sites to support its own business purposes during and after any term of an Order.

4.4 Subscriber Applications and Code. If a Subscriber, a third party acting on a Subscriber’s behalf, or a user creates applications data or code using the Services, such will be part of the Subscriber Data.

The Subscriber authorizes the Contractor to host, copy, transmit, display, and adapt such Subscriber Data solely as necessary for the Contractor to provide the Services in accordance with this Contract. Further, the Subscriber will be entitled to port, use, modify, disclose, license, sell, and host such anywhere.

5. Service Levels and Response Times

5.1 General. The Contractor must use commercially reasonable efforts to make the Services Available 24 hours a day, 7 days a week to Subscribers during the Order Term, except for scheduled downtime described below or any Unavailability covered by the Contract’s Excusable Delay clause or by this Service Levels section.

5.2 SLAs for the Services. This Service Attachment includes Service Level Agreements (“SLAs”) that will be used to monitor and manage the Contractor’s performance of the Services. The minimum SLAs are listed below and additional SLAs are described in Exhibit III, Service Level Requirements, attached to this Service Attachment and incorporated as if fully rewritten herein. The Contractor may supplement them with additional SLAs that are generally applicable to its other Services customers, so long as those additional SLAs cover parameters not addressed in the below SLAs or are more stringent than those listed below. Modifications to the SLAs provided below may only be made by the written agreement of the State and the Contractor, except with respect to SLAs the Contractor offers generally to other customers that are more stringent or in addition to those below.

5.3 Availability. “Availability” or “Available” means the Subscriber’s users are able to access a Service and use all material features and functions of the Service effectively and efficiently, and the Service meets all of the SLAs contained in this Service Attachment. “Unavailable” or “Unavailability” means the Subscriber’s users are unable to access the Service or use all of the Service’s material features and functions effectively and efficiently or they do not otherwise meet all SLAs in this Service Attachment, subject to the following:

5.3.1 A Service may be Unavailable to a Subscriber’s users during scheduled downtime.

Contractor must give Subscribers at least 30 days’ notice via the Services of any scheduled downtime.

Scheduled downtime will only occur for less than three hours between 10:00 p.m. and 6:00 a.m. Eastern Time and on Saturdays., and not more than once monthly. The Contractor may change the scheduled downtime to other non-business hours upon reasonable notice to the affected Subscribers. Scheduled downtime will not be considered times when the Services are Unavailable.

5.3.2 In addition to scheduled downtime, the following will not be considered times when a Service is Unavailable:

(i) Outages resulting from a Subscriber’s equipment or its Internet service provider;

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 7 of 35

(ii) A Subscriber’s negligence or breach of its material obligations under this Contract;

(iii) Excusable Delays, as provided for and handled in accordance with the Contract;

(iv) Downtime resulting from emergency correction actions or maintenance; and

(v) Outages outside of the Contractor’s reasonable control. For clarity, outages due to any third party hosting provider outage are not considered outside of the Contractor’s reasonable control.

5.4 SLA Credits.

The “Target Availability Level” is the Service’s Availability level that the Contractor plans to meet or exceed during each calendar month. The “Service Availability Level” is the number of hours during a particular period that the Service was Available to the Subscriber, excluding scheduled downtime permitted above, divided by the total number of hours during such period. The Target Availability Level is provided in the next section.

The Contractor shall use commercially reasonable efforts to monitor and upon request, report to the State and each Subscriber any and all Unavailability of a Service monthly, along with reasonable details regarding such Unavailability. The Contractor also must provide each Subscriber that uses the Service a credit for any calendar month in which the Service Availability Level is below the Target Availability Level, calculated as set forth herein.

The applicable credit will be calculated as follows: If the Service fails to meet the Target Availability Level by up to four hours, each affected Subscriber will be entitled to the equivalent of one day’s fee for the Service. That is, if the fee is an annual fee, the credit would be 1/365th of that annual fee, or if it is a monthly fee, the Subscriber would be entitled to 1/30th of its monthly fee as a credit. Further, the credit will double if the Target Availability Level is missed by more than four but less than eight hours for any calendar month.

Any such credits must be paid to the Subscriber within 30 days after the month in which the Service fails to meet the Target Availability Level. The credit will appear on the affected Subscriber’s next invoice, or if no future invoices are forthcoming or if the Subscriber so requests, the Contractor will issue a check to the Subscriber as payment within 30 days of the request.

If the Service fails to meet the Target Availability Level for three consecutive calendar months, any affected Subscriber may terminate any or all Orders for that Service for cause pursuant to the Contract.

5.5 Specific SLAs.

The Target Availability Level for the Service(s) is 99.9% in any calendar month, unless otherwise specifically set forth in this Service Attachment. Additional SLAs are set forth in Exhibit III attached to this Service Attachment and incorporated as if fully rewritten herein.

5.6 Response Times

Response times are as set forth in Schedule A of Exhibit I.

6. Term and Modification

6.1 Term of Service Attachment. This Service Attachment is effective on the date of State signature below and remains in effect for the term of the Contract unless earlier terminated pursuant to the Contract.

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 8 of 35

6.2 Term of Services. Services purchased under this Service Attachment commence on the start date specified in the applicable Order and continue for the term specified therein, subject to relevant provisions in the Contract, such as the Contract’s termination and non-appropriation provisions. Should a Subscriber elect to renew a Services subscription, provided this Contract and Service Attachment remain in effect, the renewal will be at the Subscriber’s option and will be for the same or greater discount from list as the Services subscription being renewed and under the same terms and conditions.

6.3 Modification. If a change in law, rules, or regulations requires a modification of the renewal price or any terms and conditions in this Service Attachment, the Parties will in good faith negotiate the modifications necessitated by such a change, and any modifications will only be effective upon a written agreement signed by the Parties.

7. Miscellaneous

7.1 Affirmation and Disclosure Form. Contractor must complete an Affirmation and Disclosure Form for this Service Attachment (available at https://dam.assets.ohio.gov/image/upload/procure.ohio.gov/pdf/StateLocalAgencies/Resources_Forms/Af firmation_and_Disclosure_Form_fillable_form.pdf) affirming the Contractor understands and will meet the requirements of Section 9.12 of the Contract. During the performance of the Services under this Service Attachment, if the Contractor changes the location(s) disclosed on an Affirmation and Disclosure Form, Contractor must complete and submit a revised Affirmation and Disclosure Form reflecting such changes.

7.2 Service-Specific Terms. Use of the Services is pursuant to the End User License Agreement in Exhibit I. If DAS decides to use PayPal as the payment processing vendor, such use of PayPal is pursuant to the terms in Schedule B to Exhibit l. If any conflict exists between the provisions in Exhibit I and the Agreement or this Service Attachment, the terms of the Agreement prevail first, then this Service Attachment, then Exhibit I. If any provisions in Exhibit I do not comply with Ohio law, they are considered stricken and of no force and effect.

7.3 Subscribers Onboarding and Ongoing Maintenance. Service Provider must include DAS in communications regarding existing and new engagements with the Service Provider.

(signatures on next page)

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 9 of 35

IN WITNESS WHEREOF, the Parties have executed this Service Attachment as of the dates written below.

CBOSS, INC. STATE OF OHIO, DEPARTMENT OF

ADMINISTRATIVE SERVICES

Signature Signature

Printed Name Printed Name

Title Title

Date Effective Date

Kathleen A. Duganne

Director of Operations

7/1/2025

Signature

CBOSS, INC.

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 10 of 35

PRICING ADDENDUM 1

Service Attachment 2 Pricing July 1, 2025

CPP General Pricing

CPP Item Description Unit of Measure Fees

Service Provider Originator Setup

Service Provider Setup Fee

Per new Originator $100

CPP Transaction Fee Transaction Fee Per Transaction* See Tables A and B CPP Recurring Payments Module

Recurring Payment Fee Per Recurring Transaction

See Tables A and B

POS Devices Type is dependent on usage (i.e. swipe only, EMV, etc.)

Per Device Quote will be provided

Flat Fee Per Transaction Based on Volume *

Table A: Connection Option 1 (PayPal) **

Annual Transactions Quarterly Transaction Threshold

Cost per Transaction

Cost per Recurring Payment

0 - 1,000,000 0 $0.220 $0.15 1,000,001 - 1,500,000 250,000 $0.220 $0.15 1,500,001 - 2,000,000 375,000 $0.215 $0.15 2,000,001 - 2,500,000 500,000 $0.215 $0.15 2,500,001 - 3,000,000 625,000 $0.215 $0.15 3,000,001 - 5,000,000 750,000 $0.215 $0.15 5,000,001 - 10,000,000 1,250,000 $0.209 $0.15 10,000,001 - 15,000,000 2,500,000 $0.204 $0.15 15,000,001 - 20,000,000 3,750,000 $0.198 $0.15 20,000,001 - 25,000,000 5,000,000 $0.193 $0.15 25,000,001 + 6,250,000 $0.187 $0.15

Table B: Connection Option 2 (Worldpay Integrated Payments) ***

Annual Transactions Quarterly Transaction Threshold

Cost per Transaction

Cost per Recurring Payment

0 - 1,000,000 0 $0.240 $0.15 1,000,001 - 1,500,000 250,000 $0.240 $0.15 1,500,001 - 2,000,000 375,000 $0.234 $0.15 2,000,001 - 2,500,000 500,000 $0.234 $0.15 2,500,001 - 3,000,000 625,000 $0.234 $0.15

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 11 of 35

3,000,001 - 5,000,000 750,000 $0.234 $0.15 5,000,001 - 10,000,000 1,250,000 $0.228 $0.15 10,000,001 - 15,000,000 2,500,000 $0.222 $0.15 15,000,001 - 20,000,000 3,750,000 $0.216 $0.15 20,000,001 - 25,000,000 5,000,000 $0.210 $0.15 25,000,001 + 6,250,000 $0.204 $0.15

* See Connection Options 1 and 2 below and in Section 2.2.9 of the Service Attachment.

* Transaction based fees will be billed monthly based on the tiered transaction level of the previous quarter. Quarters are defined as: Jan-Mar, Apr-Jun, Jul-Sep and Oct-Dec. For example: the monthly billing for July, August and September is based on the Apr-Jun quarterly transaction tier.

* Once A higher tier is reached (lower pricing), pricing will not revert to a lower transaction tier (higher pricing) based on quarterly transactions. However, transaction volumes are not cumulative over fiscal biennia. Volumes are counted from the start of each fiscal biennium.

* A transaction is defined as an authorized, a rejected, or a voided transaction; or a refunded transaction processed under this Agreement.

* Any merchant fees or bank fees, whether billed directly by the bank/processor or passed through Service Provider, would be in addition to the per transaction fee.

* After two years from the effective date of this Service Attachment 2, Service Provider may increase the fees up to 5% upon the renewal of the applicable orders, and every two years after such renewals.

** Applies to both credit/debit card and ACH transactions.

*** Applies to credit/debit card transactions only. ACH transactions continue with Table A pricing.

Connection to Worldpay

The State currently uses Worldpay to process credit/debit cards through their CORE platform. Service Provider has two different ways to send payments to Worldpay for the State of Ohio.

1. Connection Option1: PayPal

Item Description Unit of Measure Fees PayPal Monthly Account Fee

Monthly Fee for PayPal Account Per PayPal Account per Month $15

PayPal Authorizations

Credit/Debit Card Authorization Fee

Per Authorization $0.08

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 12 of 35

2. Connection Option 2: Worldpay Integrated Payments

Item Description Unit of measure Fees Integration Fee Monthly Fee for Integration to

Worldpay Per Merchant Account per Month

$5

Additional Service: ACH AVS (Account Validation Service)

Item Description Unit of Measure Fees Transaction Validation Fee Transaction Fee

Per ACH Transaction Validation*

$0.50

Monthly Fee per Originator

Monthly Fee Per Originator per Month $15

*A Transaction Validation is defined as any transaction sent to Early Warning Services’ National Shared DatabaseSM. Upon activation of the Service, each Service Provider client transaction is sent to EWS for an initial validation. Future use of the account will not require validation, as long as the account remains in good standing.

Additional Service: IVR and Outbound Communications One-Time Fees

One-Time IVR Fees Item and Description Unit of Measure Fees Onboarding (each IVR System)

Configuration of Payment IVR Solution SFTP setup for Import and Post files to transfer payment data

Per Onboarding $3,500

Custom API Integrations Optional integration if a Subscriber desires API integration to billing system instead of SFTP file sharing Integration based on API specifications All API integrations will be quoted based on an approved Statement of Work (SOW) and scheduled after a signed Change request (CR).

Per Integration Quoted based on

SOW

Usage and Recurring IVR Fees Item and Description Unit of Measure Fees Monthly Platform Fee – Minimum Usage Commitment

• Monthly platform fee to include hosting the application, administrative maintenance, security, infrastructure, and monitoring

Per Month $100

Transaction Fee – Payment

• Completing a credit card transaction (approved or declined)

• Includes up to 8 Voice (IVR) minutes per transaction, billed in 1-minute increments, US only, aggregated across all transactions

Per Transaction $1.50

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 13 of 35

• Includes up to 1 Text (SMS) segment per transaction, aggregated across all transactions

Voice (IVR) Fee - Inbound and Outbound - 50 US States

• Applies for Inbound minutes if subscriber’s customer exceeds minutes allocated in the Transaction Fee.

• Applies for all Outbound minutes

• Billed in 1-minute increments

• US rate, international rates vary

Per Minute $0.11

Voice (IVR) Fee - Transfer - 50 US States

• If an Inbound or Outbound call is transferred/forwarded to another number (e.g. the subscribers contact center), then a second call leg will be opened and additional minutes will be accrued. This is in addition to the IVR minutes for the original call leg.

• Billed in 1-minute increments

• US rate, international rates vary

Per Minute $0.07

Text (SMS) Fee - 50 US States

• For usage in the Payment IVR Solution, fee applies for all inbound and outbound segments if subscriber’s customer exceeds segments allocated in the Transaction Fee

• For usage in the Outbound Notification Solution, fee applies for all inbound and outbound segments

• Billed in segments per individual text messages

• US rate, international rates vary

Per SMS Segment (160 characters)

$0.08

Email Fee - 50 US States

• Billed in individual email messages

• Outbound email message usage

Message $0.05

Phone Number – Local or Toll-Free Per number / month

$5.00

Regulatory Fee The Regulatory Recovery Fee relates to certain fees and programs of the FCC within the telecommunications industry to conduct business.

Monthly services 7%

Professional Services Rate Card

Resource Rate Card Resource Fixed Hourly RateProject Resources

Management / Leadership ePayment Application

Modification/Development

Senior Executive $285.00 Program Manager /Unit Lead $225.00 Technical Architect / SME $300.00 Project Manager $250.00 Functional Lead / Manager $175.00 Solution Architect $200.00 Integration Architect / Lead $175.00 Database Administrator $210.00

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 14 of 35

Technical Lead $200.00 Programmer/Developer $250.00 Jr Programmer/Developer $110.00

Change Management

Change Management Lead $185.00 Process Change Analyst $170.00 Communications/Change Mngt. SME $200.00 Training Lead/Manager $165.00 Training Delivery Consultant $125.00

Specialist / Support

Business Analyst $180.00 Web Design Expert $175.00 Security Specialist SME $255.00 System Analyst $210.00 Performance Expert $165.00 Technical Writer $130.00 Test Lead/Manager $125.00 Functional Tester $115.00 Technical Tester $115.00 Help Desk Process Expert $125.00 Help Desk Process Analyst $125.00

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 15 of 35

EXHIBIT I

End User License Agreement

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 16 of 35

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 16 of 35

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 17 of 35

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 17 of 3555

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 18 of 35

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 18 of 3555

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 19 of 35

SCHEDULE A – Support Terms

1. Service. During the term of this Agreement, Service Provider shall furnish the support and maintenance services to Subscribers (“Customers”) for the Software as set forth in Section 2 ("Support Services").

2. Service Provider's Support Obligations. During the term of this Agreement, Service Provider shall provide the following Support Service to Customer:

a) Respond to Customer's inquiries, e-mail or phone call, pertaining to all licensed Services (“Licensed Products”) operation procedures not covered in the documentation and manuals provided by Service Provider, except as indicated below in Section 4.

b) Provide emergency phone assistance during normal Support Hours for Emergency Level issues.

c) Provide emergency non-Support Hours support for Emergency Level issues via e-mail or on call support through a web based application.

d) Provide document support and access to free online resources (available 24X7) through Service Provider's web site.

e) Provide updates to the Software to Customer at no additional charge to Customer. Updates shall not include any options or future products which Service Provider licenses at additional charge or under separate agreement to other customers.

f) Direct technical assistance by email and phone which shall be available during normal business hours from 8:00 –am - 5:00 pm EST/EDT ("Support Hours").

g) Provide reconciliation support if there is a file reconciliation issue, in which case Service Provider will during Support Hours, provide reasonable assistance with review of the file submission issue that was reported, address the problem using commercially reasonable efforts and resubmit the reconciliation file to the Customer.

h) Provide settlement support if there is a bank settlement issue, in which case Service Provider will work with Customer to provide reasonable assistance to resolve the problem relating to bank settlement.

i) Service Provider will not be communicating directly to Customer's customers for support.

In the event Customer needs to have Service Provider address transaction specific issues or perform Support Services beyond the scope of services listed in this Section 2, Service Provider will perform these as requested at the hourly rate for providing such services set forth in the Agreement.

3. Customer's Support Obligations. Customer shall:

a) Operate the Licensed Products in accordance with the procedures outlined in the relevant Service Provider help text or online document.

b) Notify Service Provider if any new software or hardware is added to the system and notify Service Provider in event of any errors in the Licensed Products.

c) Notify Service Provider within a reasonable amount of time of any and all systems and network interruptions or catastrophes in the event such interruption or catastrophe causes interruption to Licensed Product or delays with access to Licensed Product. Failure to do so shall void the support provisions of this Agreement, unless Customer pays time and material charges to resolve problems resulting from unreported interruptions or catastrophes at the rates set forth in the Agreement.

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 20 of 35

d) Maintain staff on site that has successfully completed training by Service Provider.

4. Support Exclusions. Support Service does not include service to the Licensed Products resulting from, or associated with:

a) Any cause external to the Licensed Products including, but not limited to, electrical work, fire, flood, water, wind, lightning and transportation, or any act of God; or

b) Customer's improper use, management or supervision of the Licensed Products or other failure to use the Licensed Products in accordance with Service Provider's specifications; or

c) Customer's repair, attempted repair or modification of the Licensed Products without prior authorization from Service Provider; or

d) Customer's use of the Licensed Products for purposes other than those for which they are designed or the use of any hardware or software not approved by Service Provider; or

e) Customer's computer or operating system malfunctions; or

f) Services required for application programs and/or conversions from hardware or software not supplied by Service Provider; or

g) Reprogramming, including reconfiguration of the Licensed Products or the rebuilding of

Customer's database.

5. Service Not Furnished. In addition to the support exclusions above, the following services are NOT covered and are subject to the applicable Service Provider time and material rates as set forth in the Agreement:

a) Licensed Products or system modification, customizations (including generation of custom reports), configuration changes, reprogramming, new programming requested by Customer.

b) Disaster recovery, database backup strategy and/or setup.

c) Troubleshooting environmental issues such as, but not limited to, operating system, network issues, firewalls, servers, workstations, sign on.

d) Importing data.

e) Support Service required by the failure of the Licensed Products caused by the negligence of

Customer, by operator error or by improper use or misuse of the Licensed Products or hardware.

f) Support Service required as the result of Customer's failure to perform its obligations set forth above.

g) Support Services required due to acts or omissions of Customer, its employees, agents, subcontractors, third party providers, financial institutions or unavailability of services provided by third parties to Customer, that cause failure or error in the performance of the Licensed Products

In the event of Service Provider addresses any problems and/or errors to the Central Payment Portal caused due to issues listed in Sections 4 and 5, Customer shall be charged on a time and material basis to review, resolve and fix the problem and/or error at the rates set forth in the Agreement.

6. Severity Levels And Response Times. Service Provider shall effectuate resolution of errors in the Services pursuant to the Emergency Levels and Non-Emergency Levels response times described below (“Severity Levels”).

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 21 of 35

a) “Emergency Level” Error occurs where the Service is inoperable or unavailable. Work cannot reasonably continue and the impact of the error on the business is severe and immediate; there are no workarounds to minimize business impact. Errors occur where central functionality of the Service degrades substantially under reasonable loads, such that there is a severe impact on use; the Service is usable, but materially incomplete; one or more mainline functions or commands is inoperable; or the use is otherwise significantly impacted, and there is no reasonable workaround.

b) “Non-Emergency Level” Error causes minimal interruption to non-central functionality of the Services. The error has a minor impact or is inconvenient, and the user suffers little or no significant impact. Error causes no loss of service. It may be a cosmetic error, a documentation error, or minor incorrect behavior that does not impede the operation of the system and will be considered a development request for feature or functionality.

c) Error Resolution.

i. Reporting of Severity Levels. Reports of Severity Levels (an “Incident Report”) will be made through Service Provider’s Support Center Hotline via telephone, fax or e-mail at numbers to be provided by Service Provider to Subscriber. Service Provider shall determine the classification of the Severity Level. Service Provider shall provide Customer Support Center Hotline coverage during Support Hours.

ii. Emergency Level. With respect to Emergency Level, Service Provider shall: (i) use commercially reasonable efforts to provide an analysis as soon as possible, but in no event later than three hours following receipt of an Incident Report during Support Hours, in the event the Incident Report is received after Support Hours, Service Provider shall use commercially reasonable efforts to provide analysis on the next business day; and (ii) use commercially reasonable efforts to provide a resolution following receipt of an Incident Report.

iii. Non-Emergency Level. With respect to Non-Emergency Level, Service Provider shall respond within 24 hours following receipt of an Incident Report during Service Provider’s Support Hours and use commercially reasonable efforts to provide a resolution within 30 days following receipt of an Incident Report.

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 22 of 35

SCHEDULE B – PayPal Terms https://www.paypal.com/us/legalhub/paypal/payflowresold-full?locale.x=en_US

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 23 of 35

EXHIBIT II

Reserved

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 24 of 35

EXHIBIT III

Service Level Requirements

1. Incident Resolution – Mean Time to Repair (Severity 1 Outages)

Business Intent: Prompt resolution of ePayment outages that impact State processing and processes

Definition: Mean Time to Repair (Severity 1 Outages) will be determined by determining the elapsed time (stated in hours and minutes) representing the statistical mean for all Severity 1 Outage Service Requests for in-scope Services in the Contract Month. “Time to Repair” is measured from time Service Request is received at the Level 2 Service Desk to point in time when the incident is resolved or workaround is in place and the Contractor submits the resolved Service Request to the State for confirmation of resolution.

“Severity 1 Outage” is defined as :

An Incident must be categorized as a “Severity 1 Outage” if the Incident is characterized by the following attributes: the Incident (a) renders a business critical System, Service, Software, Equipment or network component un-Available, substantially un-Available or seriously impacts normal business operations, in each case prohibiting the execution of productive work, and (b) affects either (i) a group or groups of people, or (ii) a single individual performing a critical business function.

This Service Level begins upon completion of agreed production acceptance criteria and a measurement period as documented in the transition to production plan.

The Contractor must report updates and progress to the State every thirty (30) minutes for this SLA until resolved.

Formula:

Mean Time to Repair (Severity 1 Outages)

Total elapsed time it takes to repair Severity 1 Outage Service Requests

Total Severity 1 Outage Service Requests

Measurement Period: Reporting Month

Data Source: Monthly Service Report Frequency of Collection: Per incident

Service Level Measures:

Individual SL GYR State Mean Time to Repair (Severity 1

Outages).

Green 4 hours Yellow > 4 hours and 6 hours

Red > 6 hours

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 25 of 35

2. Incident Resolution – Mean Time to Repair (Severity 2 Outages) Business Intent: Prompt resolution of ePayment outages that impact State processing and processes

Definition: Mean Time to Repair (Severity 2 Outages) will be determined by determining the elapsed time (stated in hours and minutes) representing the statistical mean for all Severity 2 Outage Service Requests for in-scope Services in the Contract Month. “Time to Repair” is measured from time Service Request is received at the Level 2 Service Desk to point in time when the incident is resolved or workaround is in place and the Contractor submits the resolved Service Request to the State for confirmation of resolution.

“Severity 2 Outage” is defined as : An Incident shall be categorized as a “Severity 2 Outage” if the Incident is characterized by the following attributes: the Incident (a) does not render a business critical System, Service, Software, Equipment or network component un-Available or substantially un-Available, but a function or functions are not Available, substantially Available or functioning as they should, in each case prohibiting the execution of productive work, and (b) affects either (i) a group or groups of people, or (ii) a single individual performing a critical business function.

This Service Level begins upon completion of agreed production acceptance criteria and a measurement period as documented in the transition to production plan.

In the event of “go live” of new functionality, an Upgrade, or significant change in the architecture of the Application environment, this Service Level will be suspended temporarily from the time the “go live” of the applicable Change through two (2) business days following completion of stabilization criteria in accordance with the transition to production plan.

The Contractor must report updates and progress to the State every sixty (60) minutes for this SLA until resolved.

Formula:

Mean Time to Repair (Severity 2 Outages)

Total elapsed time it takes to repair Severity

2 Outage Service Requests

Total Severity 2 Outage Service Requests Measurement Reporting Month

Data Source: Monthly Service Report

Frequency of Collection: Per incident

Service Level Measures:

Individual SL GYR State Mean Time to Repair (Severity 2

Outages).

Green 8 hours Yellow > 8 hours and 12 hours

Red > 12 hours

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 26 of 35

3. Incident Resolution – Mean Time to Repair (Severity 3 Outages)

Business Intent:

Prompt resolution of ePayment issues and irregularities that impact State processing and processes

Definition: Mean Time to Repair (Severity 3 Outages) will be determined by determining the elapsed time (stated in hours and minutes) representing the statistical mean for all Severity 3 Outage Service Requests in the Contract Month.

“Time to Repair” is measured from time a Service Request for in-scope Services is received at the Level 2/3 Contractor Service Desk to point in time when the incident is resolved or workaround is in place and the Contractor submits the resolved Service Request to the State for confirmation of resolution.

“Severity 3 Outage” Is defined as:

An Incident must be categorized as a “Severity 3 Outage” if the Incident is characterized by the following attributes:

the Incident causes a group or individual to experience an Incident with accessing or using a System, Service, Software, Equipment or network component or, a key feature thereof and a reasonable workaround is not available, but does not prohibit the execution of productive work.

This Service Level begins upon completion of agreed production acceptance criteria and a measurement period as documented in the stabilization and transition to production plan.

The Contractor must report updates and progress to the State every twenty-four (24) hours for this SLA until resolved.

Formula:

Mean Time to Repair (Severity 3 Outages)

(Total elapsed time it takes to repair Severity 3 Outage Service Requests)

Total Severity 3 Outage Service Requests

Measurement Period: Reporting Month

Data Source: Monthly Service Report

Frequency of Collection: Per incident

Service Level Measures:

Individual SL GYR State Mean Time to Repair (Severity 3

Outages).

Green 5 business days Yellow > 5 business days 7 business days

Red > 7 business days

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 27 of 35

4. Service Availability – Application Availability

Business Intent:

ePayment is available to all State users for all Business Functions to support State processes.

Definition: Application Availability for each in-scope Platform, Environment, Module and Business Process

Application Availability means access to the production system is enabled; log-in permitted from the local user LAN and business transactions can be executed. While it is dependent on State provided infrastructure and Third Party software availability the expectation is that the Contractor must implement operational processes, instrumentation, monitoring and controls that validate availability of ePayment to the end-user and development community in the State.

This SLA will be calculated for those Service Elements that are directly in the Contractor’s scope and will be measured from the end-user community desktop to the ability to process transactions to the ePayment databases. If, in determination of the root cause of an “unavailable” condition, the State LAN, WAN and Data Center outages, or the outage of State provided Infrastructure is the cause of the condition, the Contractor must be excused from those outages that arise from such a condition, unless the outage is a direct result of a Contractor created situation.

Critical Environments shall be those that are hosting or supporting State SDLC environments for those projects in excess of $5M in a given 12-month period and Production environments

Non-Critical Environments include routine development, testing, training, demo and the like.

Formula: Application Availability =

Total Application Scheduled Uptime – Total Application Unscheduled Outages

Total Application Scheduled Uptime Measurement Period: Reporting Month

Data Source: Monthly Service Report

Frequency of Collection: Continuous, 24 hours a day

Service Level Measures:

Individual SL GYR State Critical/Production

Environment Non Critical

Environments Green 99.9% 99.0 Yellow 99.7% and < 99.9% 95.0 and < 99.0

Red <99.7% <95.0%

CBOSS, Inc. MCSA0038, Service Attachment 2, Amendment 1 Page 28 of 35

5. Performance and Responsiveness Application

Business Intent:

ePayment Online and Batch Processes perform within expected norms, the end user experience is high performance and responsive and scheduled jobs, processes and reports execute within the established job schedule without intruding upon online application users or other business functions.

Definition: System Performance and Responsiveness will be based upon an end-to-end service class performance baseline (e.g., network time, application/session response time, system time, and network return time) performed by the Contractor during the transition or as mutually agreed will perform for key service elements for a statistically valid sample of ePayment scheduled reports.

Should the Contractor wish to accept State written requirements for each of the above in lieu of benchmarking, or use the aforementioned benchmarking, this sample shall serve as the “Performance Baseline” for this SLA.

Thereafter, the Contractor must perform automated testing on a daily basis for online transaction elements or provide objective evidence from system generated statistics, and provide run-time statistics for scheduled/batch system jobs and scheduled report and compare these to the Performance Baseline.

Two % deviations from the Performance Baseline will be calculated: 1) % Variation Online Transactions and 2) % Variation Batch/Scheduled Operations; The higher variation (i.e., online or batch) shall be used in the below formula for both the numerator and denominator.

Formula:

System Performance and Responsiveness

Observed (Online or Batch Scheduled)…