FULLY_SIGNED_MCSA0133_SA1.pdf

RPost US Inc. MCSA0133 Service Attachment 1 Page 1

Version date 7.1.23

SERVICE ATTACHMENT FOR SAAS 1

UNDER

MASTER CLOUD SERVICES AGREEMENT #MCSA0133

This Service Attachment for SaaS 1 under Master Cloud Services Agreement #MCSA0133 (the “Service Attachment”) is between RPost US Inc. (“Contractor”), having an office at 6033 West Century Boulevard Suite 1278, Los Angeles, California, 90045, and the State of Ohio (“State”), through the Department of Administrative Services (“DAS”), having its principal place of business at 30 East Broad Street, 40th Floor, Columbus, Ohio 43215. The State and the Contractor are sometimes referred to jointly as the "Parties" or individually as a “Party.” This Service Attachment is effective as of the date signed by the State.

1. Definitions

The defined terms in the Contract will have the same meanings in this Service Attachment as they do in the Contract. There may be additional definitions contained herein.

A. RDocs: Contractor document security services that may be made available as a stand-alone service or within the RMail service implementation.

B. RMail® (Registered Email™): Contractor registered email security and compliance services.

C. RPortal: Contractor’s customer administration web portal to manage user licenses and company settings.

D. RSign®: Contractor e-signature services that may be made available as a standalone service or within the RMail service implementation.

E. RMail® Platform: Contractor software service systems that process RMail services, subsets, and related services unless otherwise specified, including but not limited to Registered Email™, email encryption, RSign Lite (a/k/a RMail E-Sign), File Share ((a/k/a LargeMail), SideNote®, Anti-Whaling services and Pre-Crime services for email.

F. RPost® System: All Contractor software service systems that process Subscriber traffic.

G. RSign® Platform: Contractor software service systems that process all RSign e-signature services other than RSign Lite (a/k/a RMail E-Sign).

H. RMail Unit: Each service plan has a use limit that resets monthly or annually/as-used. Use is measured in “messages”, “message units” also known as “units”; each is defined as per recipient per 5MB transmission. For example, an email sent with two recipients that has 7.5 MB cumulative attachment size is calculated as a total of four “Units”. Exceptions: RMail Large File Sending, one “Message” or “Unit” is per recipient with large message size permitted per plan limits.

I. RSign Unit: One transmission sent to any permitted number of recipients for electronic signature is one “Unit” or “Envelope.”

J. RDocs Unit: One Unit for each of the first ten unique page views per viewer session per document, and in the same viewer session, PLUS one Unit per additional ten unique page views per viewer session of the same document.

K. Per User Plans: RMail Enterprise plans have a fair use limit of 1000 Units per month. RSign Enterprise plans have a fair use limit of 200 Units per month. Higher volume use requires an upgrade to RSign Shared Volume. RDocs Enterprise plans have a fair use limit of 2500 Units per month. These service plans are for human senders and not for automated sending, generic

Signoff Date: 12/04/2023 11:10:20 PM (UTC) 12/04/2023 03:10:20 PM (Local)

RPost US Inc. MCSA0133 Service Attachment 1 Page 2 workflow addresses, or team shared addresses. Service plans permit certain use and feature availably. Use availability is described below. Feature availability is described in service plan descriptions.

L. Shared Volume Plans: These service plans permit up to a certain number of unique senders and a certain number of unique Units per month or per year or as used. Certain features and automated sending systems, shared team sending addresses, API sending, and forms embedded in web pages with static links must use Shared Volume Plans. Fair use is complying with the plans and features assigned to the plans, as well as plan limits, whether or not technically enforced.

2. Services.

2.1 Overview.

Contractor will provide the following Services purchased by a Subscriber pursuant to an Order:

A. Registered Email™ (RMail®) proof of email delivery and content;

B. RMail® email security: Email encryption for privacy and compliance, human error prevention, data leak prevention (DLP), and business email compromise (BEC) targeted attack pre-emption;

C. RSign® eSignatures and Forms; and

D. RDocs™ document rights management.

Data security information:

a. The Services do not host for primary processing Subscriber Data outside the United States.

b. The Services comply with the requirements to process Protected Health Information.

c. The Services comply with the requirements to process Federal Tax Information.

d. The Services comply with the requirements to process Criminal Justice Information Systems data.

2.2 Standard Service Features. The following Service features are included as part of the standard cost:

A. Standard installations of RMail for Outlook application, RMail web application, RSign web application, RDocs web application, and RApp Windows application.

B. RMail Enterprise service.

a) Registered Email™ and its Registered Receipt™ E-Delivery Evidence (evidence of the delivery status of an RMail message):

i. Deliverability and Timestamps. Messages are sent with times recorded for: (a) proof of time of delivery (“POD”) which is the time the message that left the sender system was inducted into the RMail system for processing, and (b) proof of time of receipt (“POR”) which is the time the message was inducted into the email system under the control of the recipient or authorized by the recipient to accept email on their behalf. This POR timestamp can be the time of receipt by the recipient mail server, time the email was placed in the recipient mailbox directory, or the time opened by the recipient.

ii. For non-deliveries, RMail may return an immediate notice or may return the Registered Receipt email recording the delivery failure.

RPost US Inc. MCSA0133 Service Attachment 1 Page 3

iii. Delivery Failure status is presented to the sender in these receipt emails, and it is the sender’s responsibility to contact Contractor to further investigate any deliverability issues.

b) Accessibility: Registered Receipt™ emails that are delivered to the sender are purged within the same day of delivery (24-hour period).

i. Delivery is defined herein as the collection or transmission of the Registered Receipt™ email by the Application Programming Interface (API) to the sending organization or sender controlled systems, or as the time of first attempt to transmit the Registered Receipt™ record by email to the sending email address, the sending organization, or sender controlled systems, except (a) if the Registered Receipt™ email has not been collected by the sending organization or sender controlled systems by API, this Registered Receipt™ record shall be retained for a maximum of 14-days, or (b) if the Registered Receipt™ email has not been deliverable by Simple Mail Transfer Protocol (SMTP) to the sending email address, the sending organization, or sender controlled systems (as configured in normal settings or otherwise in the RPortal on first attempt, the Registered Receipt™ email record shall remain available for delivery retries for a maximum of 14-days from the original send attempt, unless (c) an alternate arrangement has been established for a specific Subscriber.

ii. Registered Receipt™ emails that are larger than the threshold set in the RPortal for the feature (the “Automatically send Registered Receipt email by LargeMail file share when over this size” setting) will be sent by the RMail File Share service and will be retained for a maximum of seven days.

iii. In the case where RMail cannot deliver the Registered Receipt™ email record to the sender due to problems with the sender mail system receiving email address, size limitations, receipt retrieval deficiencies, administrator data entry or otherwise misconfiguration of Registered Receipt™ email destination addresses in the RPortal, or otherwise, and if the Registered Receipt™ email record is no longer available, the sender must rely on delivery information (Transaction Metadata) in the Usage Report (which is available in the RPortal for customer administrators) for that transaction.

iv. It is the responsibility of the users to retrieve their Registered Receipt™ emails before the retention time period expiration.

c) Authentication: Registered Receipt™ email records may be automatically authenticated by an active user if the person who sent the original message that generated the Registered Receipt email record maintains a service for automatic authentication and a properly maintained Registered Receipt™ email record. Once a Subscriber cancels its service account or ceases to pay fees due, Contractor does not have any responsibility to continue to provide authentication services. Contractor has no obligation to authenticate the same Registered Receipt for more than ten authentication requests or for more than seven years from original creation, although it may do so at its sole discretion. Subscribers may use their own experts to authenticate the receipt information at any time.

d) Encrypted Content: Registered Receipt™ email records may be automatically authenticated and if so, can reconstruct the original message content. This original message content is not stored by RMail. It is reconstructed from data embedded within the

RPost US Inc. MCSA0133 Service Attachment 1 Page 4

Registered Receipt itself. For encrypted messages, the reconstructed message will remain encrypted.

e) Registered Encryption™: The different email encryption options include the following:

i. Transmission Encryption: Subscribers are responsible for selecting the minimum level of transmission layer security that they would like to enforce (current default is TLS 1.0 with options of 1.1, 1.2, 1.3) and, if the minimum set level cannot be met, the system transmission dynamically reverts to an alternate AES 256-bit PDF Message Level transmission method.

ii. Message Level Encryption: Subscribers are responsible for selecting the encryption method from the Subscriber to a recipient’s system of which default varies depending on the sending application, sender configuration or preferences.

The default password options for message level encryption vary depending on the sender application, and preferences. Subscribers are responsible for setting any short-term encrypted message attachment download alternate options (current default is a seven day attachment download option enabled, with options to disable any attachment download option or extend the storage for up to 90-days).

iii. Encrypted Reply: The reply message and its attachments transmit back to the sender encrypted using the same settings set by the originating message if the encrypted reply service is used.

iv. Auditable Record of Encrypted Transmission: The Registered Receipt™ email record provides a fact record of the encrypted transmission.

f) Digital Seal® Sent Message Authentication at Recipient: Recipient can authenticate the sender of a received message.

i. Digital Seal Service Requires Seal HTML File. Recipients of messages from senders originating their messages and sending with: (a) the RMail for Outlook application, or (b) other Contractor applications with the Digital Seal Sender Authentication, or API and automated sending options specially configured to enable the Digital Seal® service option can verify the integrity of the sent message, original sender address, original content, and original time of transmission so long as the Digital Seal HTML file (“Digital Seal Mark”) is available.

1. Contractor makes no warranty that the Digital Seal Mark will remain valid in all email systems of all recipients and as that email sent with a Digital Seal Mark is forwarded. Contractor makes no representation that a Registered Email™ message with a Digital Seal Mark will have the Digital Seal remain associated with the Registered Email™ message at or after that Registered Email message reaches its first destination.

2. Contractor makes no representation that the service will be capable of sending all email tagged by a user for Digital Seal protection with a Digital Seal.

3. Contractor does not claim that the Digital Seal Mark can prove the human identity of the user or sender of the Registered Email™ message that has Digital Seal protection.

RPost US Inc. MCSA0133 Service Attachment 1 Page 5

ii. Authentication: The Digital Seal® Mark may be automatically authenticated by an active user or the message recipient as long as the user who sent the original message that generated the Digital Seal Mark maintains a commercial fee-for-service plan (active paying customer account). Once a Subscriber cancels its service account or ceases to pay fees due, Contractor does not have any responsibility to continue to provide authentication services. Contractor has no obligation to authenticate the same Digital Seal Mark for more than ten authentication requests or for more than seven years from original creation, although it may do so at its sole discretion. Subscribers may use their own experts to authenticate the Digital Seal® Mark information at any time.

g) File Share: File share services store message content for short terms, and after the term, the message content is automatically purged. It is the responsibility of the Subscriber to maintain the privacy of this content by choosing the encrypted File Share option or otherwise using methods not to publicize the link to retrieve the message or files sent.

i. RMail secures the internet connection in the browser and may additionally secure access to the files shared if the encryption option is selected.

ii. File(s) are stored for 14-days from when the message was received by RMail for processing by default. Subscribers may change storage times with default parameters from one to 90 days.

h) RMail Recommends™: Automated user recommendations to select certain service features based on message content or recipient.

i. RMail Recommends default settings include standardized packages of message filter and processing rules.

ii. Contractor does not attest to any rule set guaranteeing compliance with any regulation or requirement, regardless of what the rule set is named or how it is referenced.

iii. It is the Subscriber’s sole responsibility to determine which filter and service processing rules are suitable for their business needs, regulations, and/or requirements.

i) Transaction Metadata: Contractor retains transaction metadata during the Order term associated with each RMail transaction (one message). Contractor retains RMail transaction metadata (which excludes message body or attachment content) during the Order term associated with each Subscriber and pursuant to the Contract.

C. RSign Enterprise Service.

a) RSign Storage: Subscribers may opt for RSign to store copies of transaction data (e.g., the document content sent for signoff with signer data and signing timestamps) and completed transactions in a repository (e.g. RSign transaction history) available to the Subscriber.

i. It is the responsibility of the Subscriber to manage their desired retention policies and remain current for fees associated with storage. RSign transaction data will be maintained for users according to these policies.

ii. Once a Subscriber cancels its service account or ceases to pay fees due, Contractor retains the right to purge archived transaction data after a Subscriber

RPost US Inc. MCSA0133 Service Attachment 1 Page 6 ceases to make timely payments for services or otherwise cancels its service agreement, subject to the requirements of the Contract.

iii. If fees are less than 90 days past due on an undisputed invoice, Contractor shall provide at least one notice recorded as sent electronically with a record of sending attempt, to the last recorded administrator email address associated with the Subscriber account prior to purging an archive. Contractor will not purge an archive before the 90 days have passed.

iv. Contractor may continue to retain billing audit records unless Subscriber requests a data purge at cancelation.

b) RSign Privacy Modes and Storage Opt-Out: Subscribers may opt out from any storage of completed transactions. Contractor may continue to retain billing audit records unless Subscriber requests a data purge at cancelation. RSign includes three advanced data privacy, masking and deletion settings that may be available to Subscribers based on their geographic location or service plans; and may be relied upon for privacy compliance with the European General Data Protection Regulation (GDPR). These include:

i. RSign Private Mode, that may be enabled: (a) on a transaction-by-transaction basis by the Subscriber (at the time of sending), (b) on a transaction-by-transaction basis with a template or rule configuration setting, (c) enabled for all of the Subscriber’s user’s e-sign transactions by default or for a set period of time (when Private Mode is enabled), or (d) enabled for all users in a Subscriber’s account for all e-sign transactions by default for a set period of time (when the setting is enabled).

1. This setting, only for transactions that are initiated while Private Mode is enabled, permanently prevents viewing of a specific RSign transaction document sent for e-signature and e-sign record content, other than for the user initiating the transaction and for the participants in the transaction.

2. It is important to note that this setting is timestamp-transaction dependent, meaning Private Mode applies to specific transactions that are initiated at a time when the setting is enabled for a user, or for a transaction that the user applies it to, and it cannot be reversed for that or those particular transactions (e.g., enabling Private Mode permanently prevents administrator access to the content of a particular transaction).

ii. RSign Masking Mode, that may be enabled for all Subscriber records and may be disabled at any time by the Subscriber administrator, and while enabled, obfuscates the message transmission data in the RSign interface and prevents record or document download for all records for any Subscriber user except for the Subscriber administrator and the initiator of the transaction.

1. It is important to note that this setting works like a “toggle” that may be adjusted by the Subscriber administrator and if enabled (Masking On), it will apply to all past and future transactions; if later disabled (Masking Off), it will disable for all past and future transactions.

2. Contractor recommends enabling RSign Masking Mode by default for Subscribers that use RSign for transactions across a variety of Subscriber groups or Subscriber roles within a Subscriber group.

RPost US Inc. MCSA0133 Service Attachment 1 Page 7

3. RSign Masking is compatible with “RSign Private Mode,” meaning, a Subscriber user may select a transaction for Private Mode even if RSign Masking Mode is enabled, and that particular transaction is private from that Subscriber administrator per the Private Mode functionality; the Private Mode functionality remaining for transactions that occurred with Private Mode enabled, even if RSign Masking Mode is later toggled off (disabled).

iii. RSign Delete Mode, that permanently obfuscates the message transmission data in the RSign interface and prevents record download for all Subscriber users including the administrator and the initiator of the transaction (other than for the record that the transaction parties receive by email) and auto-purges the transaction record after a pre-defined number of days (7, 10, 14, 30, 60, 90, 180 or 365 days) from the transaction initiation date, with the Contractor system only maintaining base transaction metadata for billing records purposes.

c) Transaction Data and Metadata: When RSign Delete Mode does not apply, then Contractor retains transaction data and metadata during the Order period associated with each RSign transaction.

i. Contractor retains RSign transaction data and metadata (metadata excludes message body, attachment, or transaction complete content) during the Order period associated with each Subscriber and pursuant to the Contract.

ii. The content in this Transaction Data and Metadata section does not relate to the authentication capabilities associated with a valid RSign applied digital signature on an RSign transaction record of which operates independent of the abovementioned retention of transaction data and metadata.

d) RSign End-to-End Encryption Feature, when used with RSign Privacy Modes and Storage

Opt-Out, changes the ability to access unencrypted transaction records as downloads from within the RSign web interface (or API). Transaction record content will be accessible for viewing and download without a password associated with that transaction record after log-in to the relevant RSign account unless RSign Privacy Modes and Storage Opt-Out options maintain the privacy, masking, or deletion of that particular transaction or views per these settings.

e) RSign API Record Retrieve, when used with RSign Privacy Modes and Storage Opt-Out, will only retrieve transactions that would be permissible to view under the Subscriber’s (API key Subscriber’s) permissions per the RSign Privacy Modes and Storage Opt-Out options associated with the user or the transaction.

D. RDocs Enterprise service. Trace document open location and Subscriber authentication rules, with the ability to prevent access or disable access to documents based on document owner settings or ad-hoc preferences.

2.3 Optional Service Features.

2.4 Provision of Services. The Contractor will make the Services available to the Subscribers for purchase pursuant to the Contract, including this Service Attachment. The Services will be Available to the Subscribers pursuant to the Contract and this Service Attachment during each Order Term. The State agrees that purchases hereunder are neither contingent on the delivery of any future functionality or features nor dependent on any oral or written public comments made by the Contractor regarding future functionality or features.

RPost US Inc. MCSA0133 Service Attachment 1 Page 8

2.5 Support. The Contractor must provide the Contractor’s basic support for the Services to the Subscribers at no additional charge and upgraded support if available and if purchased by a Subscriber.

Contractor’s basic and upgraded support options are described in Exhibit II attached to this Service Attachment and incorporated herein.

3. Fees and Payment

3.1 Pricing. The specific pricing for this Service Attachment is set forth in the Pricing Addenda attached hereto and incorporated herein.

3.2 Fee Structure and Payment. The Subscribers will pay all fees specified in all Orders hereunder, subject to the terms of the Contract. Except as otherwise specified, fees are based on Services purchased and not actual usage, and the number of Object subscriptions (e.g., the number of users) purchased cannot be decreased during the relevant Order Term. They may, however, be increased during an Order Term pursuant to Section 5.2, Orders and Modification, of the Contract. Object subscription fees are based on annual periods that begin on the subscription start date and each annual anniversary thereof. No Order may specify a Service or provision not identified and/or priced in this Service Attachment, nor may it cover any billable services not listed in this Service Attachment as a Service.

If a Subscriber has not paid the fees specified in an Order by 90 days from the payment due date, the Contractor may suspend a delinquent Subscriber’s access to the unpaid Service(s) until all delinquent amounts are paid, upon written notice to the Subscriber, notwithstanding any prohibition against self-help provided for elsewhere in the Contract. However, Contractor may not suspend Services if the Subscriber is disputing the applicable charges reasonably and in good faith, and is otherwise cooperating diligently to resolve the dispute.

3.3 Invoicing. Fees will be invoiced annually in advance and otherwise in accordance with the Contract. Fees are due in accordance with the terms of the Contract and this Service Attachment, which no Order may alter. Each Subscriber is responsible for providing complete and accurate billing and contact information to the Contractor and notifying the Contractor of any changes to such information.

4. Proprietary Rights

4.1 Reservation of Rights in Services. Subject to the limited rights expressly granted hereunder, the Contractor reserves all rights, title, and interest in and to the Services, including all related intellectual property rights. No rights are granted to the State or Subscribers hereunder other than as expressly set forth herein or elsewhere in the Contract.

4.2 Restrictions. Subscribers will comply with the requirements set forth in Section 2.7, State and Subscriber Responsibilities, of the Contract. Nothing herein prohibits a Subscriber from porting and hosting Generated Files, as defined in this Contract, to other sites to support its own business purposes during and after any term of an Order.

4.3 Subscriber Applications and Code. If a Subscriber, a third party acting on a Subscriber’s behalf, or a user creates applications data or code using the Services, such will be part of the Subscriber Data.

The Subscriber authorizes the Contractor to host, copy, transmit, display, and adapt such Subscriber Data solely as necessary for the Contractor to provide the Services in accordance with this Contract. Further, the Subscriber will be entitled to port, use, modify, disclose, license, sell, and host such anywhere.

5. Service Levels and Response Times

5.1 General. The Contractor must use commercially reasonable efforts to make the Services Available 24 hours a day, 7 days a week to Subscribers during the Order Term, except for scheduled downtime

RPost US Inc. MCSA0133 Service Attachment 1 Page 9 described below or any Unavailability covered by the Contract’s Excusable Delay clause or by this Service Levels section.

5.2 SLAs for the Services. This Service Attachment includes Service Level Agreements (“SLAs”) that will be used to monitor and manage the Contractor’s performance of the Services. The minimum SLAs are listed below, but the Contractor may supplement them with additional SLAs that are generally applicable to its other Services customers, so long as those additional SLAs cover parameters not addressed in the below SLAs or are more stringent than those listed below. Modifications to the SLAs provided below may only be made by the written agreement of the State and the Contractor, except with respect to SLAs the Contractor offers generally to other customers that are more stringent or in addition to those below.

5.3 Availability. “Availability” or “Available” means the Subscriber’s users are able to access a Service and use all material features and functions of the Service effectively and efficiently and the Service meets all the SLAs contained in this Service Attachment. “Unavailable” or “Unavailability” means the Subscriber’s users are unable to access the Service or use all the Service’s features and functions effectively and efficiently or they do not otherwise meet all SLAs in this Service Attachment, subject to the following:

5.3.1 A Service may be Unavailable to a Subscriber’s users during scheduled downtime.

Contractor must give Subscribers at least eight hours’ notice via the Services of any scheduled downtime. Scheduled downtime will only occur for less than one hour between 9:00 p.m. and 6:00 a.m.

Eastern Time and on Saturdays, and not more than once every three weeks per Service, unless an emergency security patch or critical service issue must be deployed. The Contractor may change the scheduled downtime to other non-business hours upon reasonable notice to the affected Subscribers.

Scheduled downtime will not be considered times when the Services are Unavailable.

5.3.2 In addition to scheduled downtime, the following will not be considered times when a Service is Unavailable:

(i) Outages resulting from a Subscriber’s equipment or its Internet service provider;

(ii) A Subscriber’s negligence or breach of its material obligations under this Contract; and

(iii) Excusable Delays, as provided for and handled in accordance with the Contract.

5.4 SLA Credits.

The “Target Availability Level” is the Service’s Availability level that the Contractor plans to meet or exceed during each calendar month. The “Service Availability Level” is the number of hours during a particular period that the Service was Available to the Subscriber, excluding scheduled downtime permitted above, divided by the total number of hours during such period. The Target Availability Level is provided in the next section.

The Contractor must actively monitor and report to the State and each Subscriber any and all Unavailability of a Service relating to a feature or server operation to which the Subscriber subscribes monthly, along with reasonable details regarding such Unavailability. The Contractor also must provide each Subscriber that uses the Service a credit within 30 days of any calendar month in which the Service Availability Level is below the Target Availability Level, calculated as set forth herein.

The applicable credit will be calculated as follows: If the Contractor fails to meet the Target Availability Level by up to four hours, each affected Subscriber will be entitled to the equivalent of one day’s fee for the Service. That is, if the fee is an annual fee, the credit would be 1/365th of that annual fee, or if it is a monthly fee, the Subscriber would be entitled to 1/30th of its monthly fee as a credit. Further, the credit will double if the Target Availability Level is missed by more than four but less than eight hours for any calendar month.

If the failure to meet the Target Availability Level is greater than eight hours, the Subscriber will be entitled to the entire fee applicable to that month.

RPost US Inc. MCSA0133 Service Attachment 1 Page 10

Any such credits must be paid to the Subscriber within 30 days after the month in which the Contractor fails to meet the Target Availability Level. The credit will appear on the affected Subscriber’s next invoice, or if no future invoices are forthcoming or if the Subscriber so requests, the Contractor will issue a check to the Subscriber as payment within 30 days of the request.

If the Contractor fails to meet the Target Availability Level for three consecutive calendar months, any affected Subscriber may terminate any or all Orders for that Service for cause pursuant to the Contract.

5.5 Specific SLAs.

The Target Availability Level for the Service(s) is 99% in any calendar month, excluding scheduled maintenance.

5.6 Response Times.

In addition to the provisions of Article 8, Support, of the Contract, the following sections also apply.

5.6.1 Response Times. The maximum time that the Contractor takes to initially respond to a support request is based on the support plan. The Contractor’s response time for a Subscriber that has the basic support plan is listed in Exhibit II and response times for an enterprise support plan will be as follows: (i) less than one hour for a Severity Level 1 or 2 support request; (ii) less than two hours for a Severity Level 3 request; and (iii) less than four hours for a Severity Level 4 support request.

5.6.2 Notices. Contractor’s service operations center shall report to affected users with an email notice or by other contact means within a mean time to respond of 72 hours after initial awareness of a Service related issue of Severity Level 1 or 2, with such notice providing a summary of the issue, duration of the issue, resolution of the issue if resolved, actions to mitigate re-occurrence of the issue if known, and impact of the issue with the best information that the knowledge of the Contractor operations staff at the time of the notice is able to obtain. For clarity, this notice requirement is in addition to Contractor’s response times in the Contract and this section 5.6. Contractor’s compliance with this notice requirement does not replace or alter the response time requirements in the Contract or this Service Attachment.

5.6.3 Time to Restore. The mean time to restore from the time of identification of any unplanned Service outage or Service Incident Severity Level 1 or 2 is four hours or as otherwise defined in the Contract. The mean time to restore for a Severity Level 3 problem is one business day or as otherwise defined in the Contract.

5.6.4 Time to Change. The mean time to respond and/or implement automatic change requests is one business day. The mean time to respond and/or implement manual change requests is one business day. Completion time for such requests will be subject to the nature of the request.

5.6.5 Enterprise Support. Subscriber has the option to immediately escalate all support tickets submitted via the Contractor’s web-based support ticket system to Severity Level 3 support for senior manager investigation and oversight. The mean time to intervene is six hours. The mean time to restore after support ticket submission is six hours and if escalated to senior management, three hours from escalation or as otherwise defined in the Contract.

6. Term and Modification

6.1 Term of Service Attachment. This Service Attachment is effective on the date of State signature below and remains in effect for the term of the Contract unless earlier terminated pursuant to the Contract.

RPost US Inc. MCSA0133 Service Attachment 1 Page 11

6.2 Term of Services. Services purchased under this Service Attachment commence on the start date specified in the applicable Order and continue for the term specified therein, subject to relevant provisions in the Contract, such as the Contract’s termination and non-appropriation provisions. Should a Subscriber elect to renew a Services subscription, provided this Contract and Service Attachment remain in effect, the renewal will be at the Subscriber’s option and will be for the same or greater discount from list as the Services subscription being renewed and under the same terms and conditions.

6.3 Modification. If a change in law, rules, or regulations requires a modification of the renewal price or any terms and conditions in this Service Attachment, the Parties will in good faith negotiate the modifications necessitated by such a change, and any modifications will only be effective upon a written agreement signed by the Parties.

7. Miscellaneous

7.1 Affirmation and Disclosure Form. Contractor must complete an Affirmation and Disclosure Form for this Service Attachment (the form of which is attached as Exhibit I) affirming the Contractor understands and will meet the requirements of Section 9.13 of the Contract. During the performance of the Services under this Service Attachment, if the Contractor changes the location(s) disclosed on an Affirmation and Disclosure Form, Contractor must complete and submit a revised Affirmation and Disclosure Form reflecting such changes.

IN WITNESS WHEREOF, the Parties have executed this Service Attachment as of the dates written below.

RPOST US INC. STATE OF OHIO, DEPARTMENT OF

ADMINISTRATIVE SERVICES

Signature Signature

Zafar Khan

Kathleen C. Madden Printed Name Printed Name

CEO

Director

Title Title

Date Effective Date

RPost US Inc. MCSA0133 Service Attachment 1 Page 12

PRICING ADDENDUM 1

Service Attachment 1 Pricing November 2023

Part Number

(SKU)

Service/Product Name and Description

Term Price

RMail- Standard-

USD

RMail Standard per user plan with Basic Support, includes Registered Email certified proof of delivery, secure and certified file share up to 1GB, Register Reply, RMail eSign with options to install into Microsoft Outlook for one user and up to 200 Units per month.

12 months $180

RMail- Standard- Plus-Ent- Support-USD

USD

RMail Standard per user plan with Enterprise Support, includes Registered Email certified proof of delivery, secure and certified file share up to 1GB, Register Reply, RMail eSign with options to install into Microsoft Outlook for one user and up to 200 Units per month.

12 months $216

RMail- Business-

USD

RMail Business per user plan with Basic Support, includes Registered Email certified proof of delivery, secure and certified file share up to 1GB, Register Reply, Active Tracker, RMail eSign, and Lookalike Domain, Reply Hijack, and Email Eavesdropping Alerts with options to install into Microsoft Outlook and Windows for one user, and up to 500 Units per month.

12 months $300

RMail- Business- Plus-Ent- Support-USD

RMail Business per user plan with Enterprise Support, includes Registered Email certified proof of delivery, secure and certified file share up to 1GB, Register Reply, Active Tracker, RMail eSign, and Lookalike Domain, Reply Hijack, and Email Eavesdropping Alerts with options to install into Microsoft Outlook and Windows for one user, and up to 500 Units per month.

12 months $360

RMail- Enterprise-

USD

RMail Enterprise per user plan with Basic Support, includes Registered Email certified proof of delivery, Registered Encryption, Redact+, secure and certified file share up to 1GB, Register Reply, Digital Seal sender authentication, Active Tracker, RMail eSign, and

12 months $420

RPost US Inc. MCSA0133 Service Attachment 1 Page 13

Lookalike Domain, Reply Hijack, and Email Eavesdropping Alerts, with options to install into Microsoft Outlook and Windows for one user, and up to 1000 Units per user per month.

RSign- Business- Plus-Ent- Support-USD

RMail Add-on: RSign Business per user plan with Enterprise Support, includes advanced eSignature services including templates, workflow automation, and web forms, runs inside the RMail for Outlook installation and RMail for Windows installation, and up to 100 Units per month.

12 months $360

RMail-PS- Config

Professional Services: Outlook Custom Config File. Company admin customizes default user interface/experience from parameters

Non- Recurring

$1000

RMail-PS- Receipt- Routing

Professional Services: Receipt Routing. Company admin creates a centralized email account to have copies of all Registered Receipts routed.

Non- Recurring

$1000

RMail-PS-

API

Professional Services: Custom API Level 3 Integration. RPost supports integration into State platforms, mid-level complexity.

Non- Recurring

$12500

Support Plans

Plan pricing is a percent of the service order with minimums:

a) *Premium: 25/month or 250/year if pre-paid or 10% of total service order, whichever is higher

b) *Platinum: 50/month or 500/year if pre-paid or 15% of total service order, whichever is higher

c) *Enterprise: 250/month or 2500/year if pre-paid or 20% of total service order, whichever is higher

RPost US Inc. MCSA0133 Service Attachment 1 Page 14

EXHIBIT I

Affirmation and Disclosure Form

Contractor affirms that Contractor has read and understands the applicable Executive Orders regarding the prohibitions of performance of offshore services, locating State data offshore in any way, or purchasing from Russian institutions or companies.

The Contractor shall provide all the name(s) and location(s) where services under this Contract will be performed and where data is located in the spaces provided below or by attachment. Failure to provide this information may result in no award. If the Contractor will not be using subcontractors, indicate “Not Applicable” in the appropriate spaces.

1. Principal location of business of Contractor:

(Address) (City, State, Zip)

Name/Principal location of business of subcontractor(s):

(Name) (Address, City, State, Zip)

2. Location where services will be performed by Contractor:

Name/Location where services will be performed by subcontractor(s):

RPost US Inc. MCSA0133 Service Attachment 1 Page 15

3. Location where state data will be located, by Contractor:

Name/Location(s) where state data will be located by subcontractor(s):

Contractor also affirms, understands and agrees that Contractor and its subcontractors are under a duty to disclose to the State any change or shift in location of services performed by Contractor or its subcontractors before, during and after execution of any contract with the State. Contractor agrees it shall so notify the State immediately of any such change or shift in location of its services. The State has the right to immediately terminate the contract, unless a duly signed waiver from the State has been attained to perform the services outside the United States.

On behalf of the Contractor, I acknowledge that I am duly authorized to execute this Affirmation and Disclosure Form and have read and understand that this form is a part of any Contract that Contractor may enter into with the State and is incorporated therein.

By: __________________________________ Contractor

Print Name: ___________________________

Title: __________________________________

Date: __________________________________

RPost US Inc. MCSA0133 Service Attachment 1 Page 16

EXHIBIT II

Support Plans

All parties have accepted the use of electronic signature for this document and have signed as follows:

Signed By: Zafar Khan Date: 12/04/2023 11:10:20 PM (UTC) 12/04/2023 03:10:20 PM (Local) Original Recipient: zkhan@rpost.com

IP: 108.95.184.49

Message Id 2B350BA8D136B20464907C2159A085A0EE6F6226 Client Code

RPost® Technologies: General terms, conditions, service levels, legal, trademark, and patent notices are available on RPost company (www.rmail.com) and product websites (https://www.rmail.com/legal-notices-2/legal-patent-notice/) RPost’s services, including RMail®, RSign®, Registered Email™, SideNote®, RMail encryption, and others are RPost patented technologies protected with US and non-US patent applications and US patents 8209389, 8224913, 8468199, 8161104, 8468198, 8504628, 7966372, 6182219, 6571334, 8484706, 9100355, 7707624, and other US and non-US patents listed at RPost company (www.rmail.com) and product websites (https://www.rpost.com/about-rpost/intellectual-property/trademarks).

Signoff Date: 12/04/2023 11:10:20 PM (UTC) 12/04/2023 03:10:20 PM (Local) https://www.rmail.com https://www.rmail.com/legal-notices-2/legal-patent-notice/ https://www.rmail.com https://www.rpost.com/about-rpost/intellectual-property/trademarks