Sample_Contract.pdf

City of Beaverton - SaaS Agreement (Long form) Page 1 Last rev. 04/2026

City of Beaverton Software as a Service (SaaS) Agreement

Agreement No. #XX-XXXX-XX

Provider: INSERT NAME

INSERT ADDRESS

City: City of Beaverton 12725 SW Millikan Way Beaverton, OR 97005

Background

A. City would like to ensure that Provider adheres to best practices with regard to software security and uptime requirements relating to its software.

B. Provider and City may be referred to collectively as the “Parties” or individually as a “Party.”

Therefore, the Parties agree as follows:

1. Definitions.

a. “Actual Uptime” means the total minutes in the Service Period that the Services are

Available.

b. “Agreement” means this Software as a Service Agreement, including all incorporated attachments and documents.

c. “Authorized Employees” means Service Provider’s employees who have a need to know or otherwise access Personal Information to enable Service Provider to perform its obligations under this Agreement.

d. “Authorized User” means all persons authorized by City to access and use the Services through the City’s account under this Agreement, whether at the Server location or by remote access, and includes individual users that are employees, authorized contractors, and agents of the City.

e. “Available” and “Availability” means the Services are available and operable for access and use by the City and its Authorized Users over the internet in full conformity with the Specifications.

f. “Availability Requirement” has the meaning set forth in Section 6(a).

g. "Business Day" means a day other than a Saturday, Sunday, or an official holiday that the City of Beaverton is closed for business.

h. “Change Order” means a modification or change to the Services under any executed Work Order that is memorialized in a mutually agreed written order and signed by both parties.

City of Beaverton - SaaS Agreement (Long form) Page 2

i. “Corrective Action Plan” has the meaning set forth in Section 6(e)(v).

j. “Critical Service Error” means an event that renders the System and/or interfaces inoperable or allows unauthorized access (See also the chart in Exhibit C).

k. “City” means the City of Beaverton, its employees, agents, customers, and suppliers of services.

l. “City Data” means any and all information, data, materials, works, expressions, or other content, including any that are (a) uploaded, submitted, posted, transferred, transmitted, or otherwise provided or made available by or on behalf of City or any Authorized User for Processing by or through the Services, or (b) collected, downloaded, or otherwise received by Provider or the Services for City or pursuant to this Agreement or any Work Order or at the written request or instruction of City.

All output, copies, reproductions, improvements, modifications, adaptations, translations, designs and methods and other derivative works of, based on, derived from, obtained from City in connection with the Services, or otherwise using any City Data are themselves also City Data. City Data includes all User Data and Personal Information but does not include any Provider Materials.

m. “City Systems” means information technology infrastructure, including the computers, software, databases, electronic systems (including database management systems), and networks, of the City or any of its designees.

n. “Documentation” means all generally available documentation relating to the

Services, including all user manuals, operating manuals, and other instructions, specifications, documents, and materials, in any form or media, that describe any component, feature, requirement, or other aspect of the Services, including any functionality, testing, operation, or use thereof.

o. “Effective Date” is the date last signed by a party of this Agreement and approved as to form by the City Attorney’s Office.

p. “Exceptions” has the meaning set forth in Section 6(b).

q. “Fees” has the meaning set forth in Section 7.

r. "Force Majeure Event" means an event, such as a hurricane, earthquake, or other casualty caused by nature; labor strike; war; a law, order, proclamation, regulation, or ordinance of any governmental agency that prevents a party from performing its obligations under this Agreement.

s. “Highly Sensitive Personal Information” means an (i) individual's government-issued identification number (including Social Security number, driver's license number, or state-issued identification number); (ii) financial account number, credit card number, debit card number, or credit report information, with or without any required security code, access code, personal identification number, or password that would permit access to an individual’s financial account; or (iii) biometric, genetic, health, medical, or medical insurance data.

t. “Initial Term” has the meaning set forth in Section 3.

City of Beaverton - SaaS Agreement (Long form) Page 3

u. “Intellectual Property Rights” means any and all registered and unregistered rights granted, applied for, or otherwise now or hereafter in existence under or related to any patent, copyright, trademark, trade secret, database protection, or other intellectual property rights laws, and all similar or equivalent rights or forms of protection, in any part of the world.

v. “Key Personnel” means any Provider Personnel identified as key personnel in this Agreement or any Work Order.

w. “Law” means any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree, or other requirement of any federal, state, local, or foreign government, political subdivision, or any arbitrator, court, or tribunal of competent jurisdiction.

x. “Licensed Technology” means Provider’s proprietary software or other third-party software or other intellectual property, including the Documentation, provided to allow City to access and utilize the System in conformance with the Work Order or to make the System available to City, its Authorized Users, and any applicable third-party users over the internet as a service.

y. “Minor Service Error” means an event that has minor impact to the City's business and that does not impact normal operation of the System, including when a Service is operating with minor issues that can be addressed with a work around.

z. “Minimal Service Error” means an event that has minimal impact or no impact on the City's business, such as when a Service is operating with minor issues that can be addressed with a work around.

aa. “Permitted Uses” means any and all lawful use of the Services by the City for the benefit of the City for the City’s business operations.

bb. “Person” means an individual, corporation, partnership, joint venture, limited liability company, governmental authority, unincorporated organization, trust, association, or other entity.

cc. “Personal Information” means information provided to Provider by or at the direction of the City, information which is created or obtained by Provider on behalf of the City, or information to which access was provided to Provider by or at the direction of the City, in the course of Provider's performance under this Agreement that: (i) identifies or can be used to identify an individual (including, without limitation, names, signatures, addresses, telephone numbers, email addresses, and other unique identifiers); or (ii) can be used to authenticate an individual (including, without limitation, employee identification numbers, government-issued identification numbers, passwords or PINs, user identification and account access credentials or passwords, financial account numbers, credit report information, student information, biometric, health, genetic, medical, or medical insurance data, answers to security questions, and other personal identifiers), in case of both subclauses (i) and (ii), including, without limitation, all Highly Sensitive Personal Information. the City’s business contact information is not by itself deemed to be Personal Information.

City of Beaverton - SaaS Agreement (Long form) Page 4

dd. “Plan” means a Business Continuity and Disaster Recovery Plan that can be implement in the event of any unplanned interruption of the Services to restore Services.

ee. “Process” means to perform any operation or set of operations on any data, information, material, work, expression, or other content, including to (a) collect, receive, input, upload, download, record, reproduce, store, organize, combine, log, catalog, cross-reference, manage, maintain, copy, adapt, alter, translate, or make other improvements or derivative works, (b) process, retrieve, output, consult, use, disseminate, transmit, submit, post, transfer, disclose, or otherwise provide or make available, or (c) block, erase, or destroy. "Processing" and "Processed" have correlative meanings.

ff. “Provider” has the meaning set forth at the beginning of this Agreement.

gg. "Provider Materials" means the Services, Specifications, Documentation, and Provider Systems and any and all other information, data, documents, all devices, documents, data, know-how, methods, processes, hardware, software, and other technologies and inventions, including any deliverables, technical or functional descriptions, requirements, plans, or reports, that are provided or used by Provider or any Subcontractor in connection with the Services or otherwise comprise or relate to the Services or Provider Systems.

hh. "Provider Personnel" means all employees and agents of Provider, and all Subcontractors and all employees and agents of any Subcontractor, involved in the performance of Services.

ii. "Provider Systems" means the information technology infrastructure, including all computers, software, databases, electronic systems (including database management systems), and networks used by or for Provider to access the City Systems or provided the Services.

jj. "Reimbursable Expenses" means direct, documented, out-of-pocket travel and lodging expenses incurred by Provider in performing the Services.

kk. “Renewal Term” has the meaning set forth in Section 3.

ll. “Resolve” has the meaning set forth in Section 6(e)(iv)(2).

mm. “Scheduled Uptime” means the total minutes in the Service Period.

nn. “Security Incident” means an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of the Services or the data the System possesses, stores, transmits; or an occurrence that constitutes a violation or imminent threat of violation of security policies described in Section 6(f).

oo. “Security Breach” means (i) any act or omission that compromises either the security, confidentiality, or integrity of Personal Information or the physical, technical, administrative, or organizational safeguards put in place by Provider, or by the City should Provider have access to the City’s systems, that relate to the protection of the security, confidentiality, or integrity of Personal Information, (ii) receipt of a complaint

City of Beaverton - SaaS Agreement (Long form) Page 5 in relation to the privacy and data security practices of Provider, or (iii) a breach or alleged breach of this Agreement relating to such privacy and data security practices.

Without limiting the foregoing, a compromise shall include any unauthorized access to or disclosure or acquisition of Personal Information.

pp. “Service Availability Credits” has the meaning set forth in Section 6(d)(i).

qq. “Service Error” means any failure of any Subscription Service to be Available or otherwise perform in accordance with this Agreement and the Specifications.

rr. “Service Level Credits” means credits issued to the City due to Provider’s failure to achieve the Support Service Level Requirements (See also Exhibit C).

ss. “Service Level Failure” means a failure to perform the Support Services fully in compliance with the Support Service Level Requirements.

tt. “Service Period” means each calendar month Provider is required to perform any Services.

uu. “Services” means all services required of Provider to ensure the software as a Service is available to the City and third-party users over the Internet consistent with the terms of this Agreement. These services include: hosting; making the System available to the City and third party users over the Internet as a service; ensuring the System operates with other software, hardware, systems, networks, and services;

using embedded third party software for the Permitted Uses, including for Processing City Data; programming, modifying, or configuring the System to meet the City’s ongoing needs; integrating, customizing, enhancing, or modifying the System;

consulting activities; and training or project management.

vv. “Severe Service Error” means an event that results in a significant impairment of performance of the System, impairs essential operations or allows unauthorized access (See also the chart in Exhibit C).

ww. “Software as a Service (SaaS)” or “System” means the turnkey system provided by Provider pursuant to this Agreement as part of its Services, including any Licensed Technology that Provider makes accessible to City or its Authorized Users as part of its Services under this Agreement.

xx. “Specifications” means the specifications for the Services set forth in any applicable Work Order to the extent consistent with the Documentation.

yy. “Statement of Work” means the scope of work and system requirements detailed in the City’s Request for Proposals together with Provider’s Response to the Request for Proposals.

zz. “Subcontractor” means a person Provider contracts with to provide some of the Services Provider is obligated to perform under the Agreement.

aaa. “Support Request” means a request from the City for Service Error corrections.

City of Beaverton - SaaS Agreement (Long form) Page 6 bbb. “Support Service Level Requirements" means required times and other terms and conditions for evaluating Support Services as set forth in Exhibit C.

ccc. “Support Services” mean maintenance and support services.

ddd. “Term” means the Initial Term and any subsequent Renewal Term or Terms.

eee. “User Data” means any and all information reflecting the access or use of the Services by or on behalf of City or any Authorized User, including any end user profile, visit-, session-, impression-, click through-, or click-stream-data, and any statistical or other analysis, information, or data based on or derived from any of the foregoing.

fff. “Work Order” means a request for services by City that is in writing and signed by the Parties.

2. Agreement Documents. The Agreement is comprised of the following documents:

a. Sections 1-15 of this Agreement.

b. Exhibit A. Work Orders

c. Exhibit B. Payment Schedule

d. Exhibit C. Service Levels

e. Exhibit D. Request for Proposals

f. Exhibit E. Provider’s Proposal

g. Any subsequent work orders.

h. Any applicable documentation.

In the event of a conflict between the terms of the documents listed above, the order of precedence shall be the order in which they appear above.

3. Term.

a. Initial Term. The initial term of the Agreement commences on the Effective Date and, unless terminated earlier pursuant to this Agreement, will continue in effect for five years. (“Initial Term”).

b. Renewal Term. Following expiration of the Initial Term, the Agreement will automatically renew each year on the anniversary of the Effective Date for an additional one-year term (each a “Renewal Term”) unless terminated pursuant to this Agreement or City gives Provider written notice of non-renewal at least 30 days prior to the expiration of the current term (collectively, the Renewal Term and the Initial Term constitute the “Term”).

4. Scope of Services and License.

a. Scope of Services. Provider shall perform all work specified in this Agreement inclusive of the Exhibits. Unless stated otherwise in this Agreement, the work required of Provider includes all labor, materials and tasks, whether or not enumerated in the Agreement, that are such an inseparable part of the work expressly stated in the Agreement that exclusion of the work would render Provider’s performance impractical, illogical, or unconscionable.

City of Beaverton - SaaS Agreement (Long form) Page 7

b. Licensed Technology. Provider grants to the City and its Authorized Users, a non-exclusive, non-transferable (except as permitted in the Assignment section) right to access and use the Licensed Technology and the Services for Permitted Uses with no geographical limitations within the United States, for the number of users stated in the City’s Specifications (if none stated, then for an unlimited number of users), including the right to use any embedded third party software within the System or required to operate or allow access to the Licensed Technology or System. This right to use and access the System is for unlimited concurrent use for City governmental and business purposes, including on- and off-site access and use of the System by authorized third party users.

c. SaaS Services. Provider shall provide the City and its Authorized Users with all

Services described in this Agreement and set forth in all Specifications and Work Orders. The Services will comply with all Support Service Level Requirements as set forth in Exhibit C. All maintenance and Support Services for the Licensed Technology and the System shall also be provided to the City.

i. Updates, Upgrades, and Releases. For the full term of this Agreement, Provider shall promptly provide to the City, with advance notice and at no additional cost, any and all updates (including error corrections, bug fixes, security updates, and patches), upgrades, or new releases to the System including updates, upgrades, or new releases Provider made available to other subscribers or licensees of all or part of the System. All such updates, upgrades, and new releases shall remain the sole property of Provider and shall be deemed to be included within the scope of the rights granted under this Agreement.

ii. Business Function. For the full term of this Agreement, Provider will ensure the Licensed Technology and System will not inhibit the ability of the City to continue its business functions.

d. Documentation License. Provider grants to the City a non-exclusive, non-sublicensable, non-transferable (except in compliance with the Assignment section) license to prepare, reproduce, print, download, and use as many copies of the Documentation during the Term as necessary for any Permitted Uses under this Agreement.

e. Work Orders. Work Orders and Change Orders will be effective only when signed by the City and Provider. However, for any Services provided on a limited basis (for example, on a per user, server, CPU, or named-user basis), the City may, at any time, increase or decrease the number of its licenses subject to a corresponding adjustment of the Fees in accordance with the pricing set forth in this Agreement.

f. Use Restrictions. The City shall not reproduce, publish, or license the System to others. The City shall not modify, reverse engineer, disassemble, or decompile the System or any portion of the System, except to the extent: (a) expressly authorized in this Agreement; or (b) permitted under any applicable open-source license.

City of Beaverton - SaaS Agreement (Long form) Page 8

g. Excess Use. If the City’s use of the Services exceeds the volume of use permitted for the number of Authorized Users and any applicable Work Order, the City shall pay Provider the Fees attributable to the excess use as permitted under the Fees section. These Fees will be Provider's sole and exclusive remedy for such excess use.

h. Compliance with Laws. Provider shall comply with all applicable Laws as related to this Agreement, including by securing and maintaining all required and appropriate visas, work permits, business licenses, and other documentation and clearances necessary for performance of the Services.

i. Subcontracting. Provider shall not itself, and shall not permit any other Person to, subcontract any Services, in whole or in part, without the City’s prior written consent.

Without limiting the foregoing:

i. Provider shall ensure each Subcontractor agrees in writing to be bound by all relevant terms of this Agreement, including all provisions relating to City Data, Personal Information, or other Confidential Information of the City.

ii. The City's consent to any such Subcontractor shall not relieve Provider of its representations, warranties, or obligations under this Agreement.

iii. Provider shall remain responsible and liable for any and all: (A) performance required under this Agreement, including the proper supervision, coordination, and performance of the Services; and (B) acts and omissions of each Subcontractor (including, such Subcontractor's employees and agents, who, to the extent they are involved in providing any Services, are deemed Provider Personnel) to the same extent as if such acts or omissions were by Provider.

iv. Any noncompliance by any Subcontractor or its employees or agents with the provisions of this Agreement or any Work Order will constitute a breach by Provider.

j. Key Personnel. Provider shall ensure that the persons responsible for Provider's performance of the Services under this Agreement and, to the extent applicable, identified below as Key Personnel are appropriately trained and experienced and have adequate time and resources to perform in accordance with the terms of this Agreement. The City shall not be responsible for any additional costs associated with a change in Key Personnel. Provider will provide thirty (30) days' advance notice, or as much advance notice as is possible, when there is a change to the City’s Account Representative.

i. Name of Account Representative and Title: ______________________

k. Management and Payment of Provider Personnel. Provider is solely responsible for the payment of Provider Personnel, including all fees, expenses, and compensation to, by, or on behalf of any Provider Personnel and, if applicable, the withholding of income taxes and payment and withholding of social security and other payroll taxes, unemployment insurance, workers' compensation insurance payments, and disability benefits.

City of Beaverton - SaaS Agreement (Long form) Page 9

l. Time of the Essence. Provider acknowledges and agrees that time is of the essence with respect to its obligations under this Agreement and that prompt and timely performance of all such obligations, including all timetables and other requirements of this Agreement and each Work Order, is strictly required.

m. City Contract Manager. The City shall appoint a City employee to serve as the City’s primary contact with respect to the Services, who will have the authority to act on behalf of the City to manage and enforce this Agreement.

5. Delivery; Testing and Acceptance.

a. System and Service Preparation. Promptly upon the Parties' execution of a Work Order, Provider shall take all steps necessary to make the Services procured ready and available for the City’s use in accordance with the Work Order and this Agreement, including any applicable milestone date or dates set forth in the Work Order. All the City license keys, usernames, and passwords shall be authenticated by Provider. The System shall meet or exceed the standards and requirements set forth in this Agreement, including specifically Exhibit C.

b. Documentation. Provider shall deliver copies of the Documentation to the City within seven (7) days of the Effective Date and shall promptly provide any updated Documentation as it becomes available during the term of this Agreement. Provider represents and warrants that the Documentation is sufficiently comprehensive and of sufficient quality to enable a competent user to operate the System efficiently and in accordance with the Specifications. The City has the right to copy and modify the Documentation as it deems necessary for its Permitted Uses.

c. Final Acceptance Testing. When Provider notifies the City in writing that the setup of the System is complete and the Services are ready for use in a production environment, the City shall have sixty (60) days, or the length of time expressly set forth in the applicable Work Order, from receipt of the notice to test the Services to determine whether the Services comply in all material respects with the requirements of this Agreement and the Specifications. The City shall test the System to determine whether the System: (A) properly functions with any applicable operating software;

(B) provides the capabilities stated in this Agreement and the Documentation; and

(C) if applicable, meets the acceptance criteria stated in the Statement of Work (the criteria in (A), (B), and (C) are collectively referred to as the “Final Acceptance Criteria”). In the event of a conflict between the Documentation and the acceptance criteria stated in the Statement of Work, the Statement of Work shall prevail. Final payment shall not be made to Provider prior to the written confirmation by the Information Services Manager or his or her designee that the Software successfully passed the Final Acceptance Criteria, and such written confirmation shall constitute “Final Acceptance.”

i. The testing period shall commence on the first business day after Provider informs the City in writing that it completed the setup of the System and that

City of Beaverton - SaaS Agreement (Long form) Page 10 the System is ready for testing. The testing period shall continue for a period of up to sixty (60) days.

ii. During the testing period, the City may notify Provider in writing of any error or defect in the System so that Provider may make any needed modifications or repairs. If Provider notifies the City that it elects to make modifications, testing will cease until Provider resubmits for Final Acceptance testing, at which time the 60 day testing period shall restart.

iii. The City shall notify Provider in writing of its Final Acceptance or rejection of the System, in whole or in part, within fifteen (15) days after the end of the testing period, including any extensions or restarts. If the City rejects the System, or any part of it, the City shall provide notice identifying the Final Acceptance Criteria the System failed to meet and a written list of items that must be corrected. Following such notice, Provider shall have thirty (30) days to: (a) promptly commence, at no additional cost or charge to the City, necessary corrections, repairs, and modifications to the System or a portion of it, to bring it into full compliance with the Specifications and Statement of Work, or (b) otherwise respond to the City's notice. If Provider modifies, repairs, or replaces the System or a portion of it, the testing period shall re-commence consistent with the procedures set forth above in this Section.

iv. If any corrective measures are required, upon its completion of all such measures, Provider shall notify the City in writing and the process set forth in above shall be repeated; provided that if the City determines that the Services, as revised, still do not comply in all material respects with the Specifications and Statement of Work, the City may, in its sole discretion:

1. require the Provider to repeat the correction, repair, and modification process set forth in this section at no additional cost or charge to the City; or

2. terminate any relevant Work Order and this Agreement with no liability, obligation, or penalty to the City.

v. The Parties shall repeat the foregoing procedure until the City Accepts the Services or elects to terminate the Agreement, the relevant Work Order, or any other Work Order as provided in this Section. If City elects to exercise its rights under this Section and elects to terminate:

1. solely the relevant Work Order, Provider shall refund to the City all sums previously paid to Provider under such Work Order;

2. this Agreement (including the relevant Work Order), Provider shall refund to the City all sums previously paid to Provider under the relevant Work Order and any prepaid Fees for Services that have not been provided under this Agreement, including any other Work Order;

or

3. any other Work Order(s) (but not the entirety of this Agreement), Provider shall refund to the City any prepaid Fees for Services that have

City of Beaverton - SaaS Agreement (Long form) Page 11 not been provided under such other Work Order(s) and, if the City also terminates the relevant Work Order, all sums previously paid to Provider under such Work Order.

All refunds payable under this Section shall be paid within 15 business days of the City’s written notice of termination under this Section.

6. Service Levels and Credits.

a. Availability Requirement. Provider shall make the Services Available, each Service Period during the Term for at least 99.99% of the time (the "Availability Requirement"). The Services will not be considered unavailable solely as a result of one or more of the Exceptions listed in this Section 6. The Services are not Available in the event of any performance degradation or inoperability of the Services, in whole or in part.

b. Exceptions. No period of Service degradation or inoperability will be included in calculating Availability to the extent that such downtime or degradation is due to any of the following (collectively "Exceptions"):

i. the City’s or any of its Authorized Users' misuse of the Services;

ii. failures of the City’s or its Authorized Users' internet connectivity;

iii. internet or other network traffic problems other than problems arising in or from networks required to be provided or controlled by Provider;

iv. the City’s or any of its Authorized Users' failure to meet any minimum hardware or software requirements set forth in the Specifications

c. Service Availability Reports. Within thirty (30) days after the end of each Service Period, Provider shall provide to the City a report describing the Availability and other performance of the Services during that calendar month and the calendar year-to-date. The report shall be in electronic or such other form as the City may approve in writing and shall include, at a minimum: (a) the actual performance of the Services relative to the Availability Requirement and Specifications; and (b) if Service performance failed in any respect to meet or exceed the Availability Requirement or Specifications during the reporting period, a description in sufficient detail to inform the City of the cause of such failure and the corrective actions the Provider has taken and will take to ensure that the Availability Requirement and Specifications are fully met.

d. Remedies for Service Availability Failures.

i. If the actual Availability of the Services is less than the Availability Requirement for any Service Period, such failure shall constitute a Service Error for which Provider shall issue to the City the corresponding service credits as set forth in Exhibit C ("Service Availability Credits") in accordance with the Fees section.

ii. If the actual Availability of the Services is less than the Availability Requirement in any two of four consecutive Service Periods, then, in addition to all other

City of Beaverton - SaaS Agreement (Long form) Page 12 remedies available to the City, the City may terminate this Agreement and/or any applicable Work Order on written notice to Provider with no liability, obligation, or penalty to the City by reason of such termination.

iii. Any Service Availability Credits due under this Section will be applied as set forth in Exhibit C.

e. Support and Maintenance. Provider shall provide Support Services for the Services in accordance with the provisions of this Section. The Support Services are included in the Services, and Provider shall not assess any additional Fees, costs, or charges for such Support Services.

i. Support Service Responsibilities. Provider shall:

1. correct all Service Errors in accordance with the Support Service Level

Requirements, including by providing defect repair, programming corrections, and remedial programming;

2. provide unlimited telephone support twenty-four (24) hours a day, for three hundred sixty-five days a year;

3. Provide online access to technical support bulletins and other user support information, to the full extent Provider makes such resources available to its other customers for services substantially similar to the Services; and

4. Respond to and Resolve Support Requests as specified in this Section.

ii. Service Monitoring and Management. Provider shall continuously monitor and manage the Services to optimize Availability that meets or exceeds the Availability Requirement. Such monitoring and management shall include:

1. Proactively monitoring on a 24 hour by seven-day basis all Service functions, servers, firewall, and other components of Service security;

2. Taking all necessary and reasonable remedial measures to promptly eliminate threats to the Availability of the Services to ensure full Availability if Provider’s monitoring identifies, or Provider otherwise becomes aware of, any circumstance that is reasonably likely to threaten Availability of the Services; and

3. Acting on knowledge it receives that the Services or any Service function or component is not Available, including by written notice from the City, to confirm the outage and notify the City of all related problems, pertinent findings, and actions taken to restore Availability.

iii. Service Maintenance. Provider shall continuously maintain the Services to optimize Availability that meets or exceeds the Availability Requirement. Such maintenance services shall include providing to the City and its Authorized Users:

City of Beaverton - SaaS Agreement (Long form) Page 13

1. All updates, bug fixes, enhancements, new releases, new versions, and other improvements to the Services as they become available, after prior, written approval by the City, that it provides at no additional charge to its other similarly situated customers;

2. Ensuring that all changes to the Services referenced in subsection 1 of this Section will not adversely affect the System; and

3. All such services and repairs necessary to maintain access to or use of the Services.

iv. Support Service Level Requirements. Provider shall correct all Service Errors and respond to and Resolve all Support Requests in accordance with the required times and other terms and conditions set forth in Exhibit C ("Support Service Level Requirements"), this Agreement, and the applicable Work Order.

1. Support Requests. The City shall classify its requests for Service Error corrections in accordance with the descriptions set forth in the chart in Exhibit C. The City Service Manager shall notify Provider of Support Requests by email, telephone, or such other means the parties agree to in writing.

2. Support Response and Resolution Time Service Levels. Response and Resolution times will be measured from the time Provider receives a Support Request until the respective time Provider (i) responds to the Support Request, in the case of response time, and (ii) Resolves such Support Request, in the case of Resolution time. "Resolve" (including "Resolves," "Resolution," and correlative capitalized terms) means that, as to any Service Error, Provider provided the City the corresponding Service Error correction and the City confirmed and accepted the correction. Provider shall respond to and Resolve all Service Errors within the times provided in Exhibit C based on the severity of the Service Error.

3. Escalation. With respect to any Critical Service Error Support Request, until such Support Request is Resolved, Provider shall escalate that Support Request within sixty (60) minutes of receiving the Support Request to the appropriate Provider support personnel.

v. Corrective Action Plan.

If two or more Critical Service Errors occur in any thirty (30) day period during the Term, Provider shall promptly investigate the root causes of these Service Errors and prepare a “Corrective Action Plan” within five (5) business days of the second Critical Service Error. The Corrective Action Plan shall include, at a minimum: (a) analysis of the root causes of the Service Errors, (b) a strategy for developing any programming, software updates, fixes, patches, etc.

necessary to remedy and prevent any further occurrences of such Service Errors; (c) time frames for implementing the Corrective Action Plan; and (d) Provider's commitment to devote the appropriate time, skilled personnel, City of Beaverton - SaaS Agreement (Long form) Page 14 systems support, equipment, and other resources necessary to Resolve and prevent future Service Errors. There will be no additional charge for Provider's preparation or implementation of the Corrective Action Plan. After the City’s review, comment, and written approval of the Corrective Action Plan, it shall be incorporated into this Agreement by this reference.

f. Security.

i. Information Security. Throughout the Term and at all times in connection with performance of the Services, Provider shall make the Services available in accordance with the data security requirements set out in this Section.

1. Provider shall comply with all applicable federal and state privacy and data protection laws, as well as all other applicable regulations and directives in its creation, collection, receipt, access, use, storage, disposal, and disclosure of Personal Information.

2. Provider shall implement and maintain a written information security program including appropriate policies, procedures, and risk assessments that are reviewed at least annually. Provider shall periodically complete a SOC2 Type 2 audit to assess its security controls.

3. Provider shall ensure the SaaS is hosted in an ISO27001 Certified

Environment.

4. Without limiting Provider’s obligations under subsection (1) of this section, Service Provider shall implement administrative, physical, and technical safeguards to protect Personal Information from unauthorized access, acquisition, or disclosure, destruction, alteration, accidental loss, misuse, or damage, and shall ensure that all such safeguards, including the manner in which Personal Information is created, collected, accessed, received, used, stored, processed, disposed of, and disclosed, complies with applicable data protection and privacy laws, as well as the terms and conditions of this Agreement.

5. If Provider has access to or will collect, access, use, store, process, dispose of, or disclose credit, debit, or other payment cardholder information, Provider shall at all times remain in compliance with the Payment Card Industry Data Security Standard (”PCI DSS”) requirements, including remaining aware at all times of changes to the PCI DSS and promptly implementing all procedures and practices as may be necessary to remain in compliance with the PCI DSS, in each case, at Service Provider’s sole cost and expense.

6. At a minimum, Provider’s safeguards for the protection of Personal

Information shall include: (i) limiting access of Personal Information to

City of Beaverton - SaaS Agreement (Long form) Page 15

Authorized Employees; (ii) securing business facilities, data centers, paper files, servers, backup systems, and computing equipment, including, but not limited to, all mobile devices and other equipment with information storage capability; (iii) implementing network, application, database, and platform security; (iv) securing information transmission, storage, and disposal; (v) implementing authentication and access controls within media, applications, operating systems, and equipment;

(vi) encrypting Highly Sensitive Personal Information stored on any media; (vii) encrypting Highly Sensitive Personal Information transmitted over public or wireless networks; (viii) strictly segregating Personal Information from information of Provider or its other customers so that Personal Information is not commingled with any other types of information; (ix) conducting risk assessments, penetration testing, and vulnerability scans and promptly implementing, at Provider’s sole cost and expense, a corrective security plan to correct any issues that are reported as a result of the testing; (x) implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with applicable law; and (xi) providing appropriate privacy and information security training to Provider’s employees.

7. While each Authorized Employee is employed by Provider, Provider shall at all times cause such Authorized Employees to abide strictly by Provider’s obligations under this Agreement. Service Provider further agrees that it shall maintain a disciplinary process to address any unauthorized access, use, or disclosure of Personal Information by any of Provider’s officers, partners, principals, employees, agents, or contractors.

ii. Data Breach Procedures.

1. Provider shall:

a. provide the City with the name and contact information for the person that will serve as the City’s primary and secondary security contacts, one of which shall always be available to assist the City twenty-four (24) hours per day, seven (7) days per week as a contact in resolving obligations associated with a Security Incident or Security Breach.

b. notify the City of a Security Incident or Security Breach as soon as practicable, but no later than twenty-four (24) hours after Provider becomes aware of it.

c. notify the City of any Security Incident or Security Breach by phone with a copy by email to the City’s primary business contact for this Agreement.

City of Beaverton - SaaS Agreement (Long form) Page 16

2. Immediately following Provider’s notification to the City of a Security Incident or Security Breach, the parties shall coordinate with each other to investigate the Security Incident or Security Breach. Provider agrees to fully cooperate with the City in the City’s handling of the matter, including, without limitation: (i) assisting with any investigation; (ii) providing the City with physical access to the facilities and operations affected; (iii) facilitating interviews with Provider’s employees and others involved in the matter; and (iv) making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable Laws, regulations, industry standards, or as otherwise required by the City.

3. Provider shall at its own expense take reasonable steps to immediately contain and remedy any Security Incident or Security Breach and prevent any further Security Incidents, including, but not limited to taking any and all action necessary to comply with applicable privacy rights, laws, regulations, and standards. Service Provider shall reimburse the City for all actual reasonable costs incurred by the City in responding to, and mitigating damages caused by, any Security Breach, including all costs of notice and/or remediation.

4. Provider agrees that it shall not inform any third party of any Security

Breach without first obtaining the City’s prior written consent, other than to inform a complainant that the matter has been forwarded to the City Attorney. Further, Provider agrees that the City shall have the sole right to determine: (i) whether notice of the Security Breach should be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies, or others as required by law or regulation; (ii) the contents of such notice; and (iii) any remediation that may be offered to those affected by the Security Breach.

5. Provider agrees to maintain and preserve all documents, records, and other data related to any Security Breach.

6. Provider agrees to fully cooperate at its own expense with the City in any litigation, investigation, or other action deemed necessary by the City to protect its rights relating to the use, disclosure, protection, and maintenance of Personal Information.

7. In the event of any Security Breach, Service Provider shall promptly use reasonable efforts to prevent a recurrence of the Security Breach.

iii. Provider Systems. Provider shall be solely responsible for Provider Systems and shall prevent unauthorized access to the City Systems through the Provider Systems.

City of Beaverton - SaaS Agreement (Long form) Page 17

iv. Material Breach of Security Provisions. Any failure of the Services to meet the requirements of this Agreement with respect to the security of any City Data or other Confidential Information of the City, including any related backup or disaster recovery, is a material breach of this Agreement. The City may terminate this Agreement immediately on written notice to Provider without any notice or cure period for violation of this Section. Provider shall promptly reimburse the City any Fees prepaid by the City. The reimbursement shall be prorated to the date of termination.

v. Redundancy, Data Backup, and Disaster Recovery. Provider shall maintain disaster avoidance procedures designed to safeguard City Data and the City’s other Confidential Information, Provider's Processing capability, and the availability of the Services. The Force Majeure provisions in the Agreement shall not limit Provider's obligations under this Section.

1. Data Backup. Provider shall conduct daily backups of City Data and store the backup City Data on at least a weekly basis at the Secondary Backup Facility at its sole cost and expense.

2. Disaster Recovery/Business Continuity. Throughout the Term and at all times in connection with its actual or required performance of the Services, Provider shall:

a. Maintain a Business Continuity and Disaster Recovery Plan for the Services (the "Plan") and implement such Plan in the event of any unplanned interruption of the Services. Provider shall make its current Plan, revision history, and any reports or summaries relating to testing of the Plan available at the request of the City. Provider shall actively test, review, and update the Plan on at least an annual basis using industry best practices;

b. Conduct disaster recovery tests of Provider’s System and Services under this Agreement on at least an annual basis.

Provider shall notify the City at least ten (10) days in advance of each test. In addition, Provider shall conduct a disaster recovery test specific to the City’s data and use of Provider’s System in coordination with the City at least once per year at a time agreed upon by the City; and

c. Reinstate the Services within the recovery time objective of a maximum of eight (8) hours (“RTO”) and a recovery point objective of four (4) hours from the incident (“RPO”). In its sole discretion, the City may, immediately terminate this Agreement as a non-curable default under Termination for Cause section if the RTO and RPO are not met.

7. Fees.

City of Beaverton - SaaS Agreement (Long form) Page 18

a. Fees.

i. City shall pay for all Fees associated with the System during the Term, as outlined in Provider’s proposal.

ii. Payment shall be made only for work actually performed and completed pursuant to the Contract.

b. Fees during Renewal Terms.

i. Provider's Fees are fixed during the Initial Term. Provider may increase Fees for subsequent Renewal Terms by providing written notice to the City at least ninety (90) calendar days before the Renewal Term that would be subject to the new fees begins. No increase in Fees for a Renewal Term shall exceed the lesser of:

1. Three percent (3%) of the Fees effective during the immediately preceding Renewal Term; or

2. The amount equal to the percentage of the most-recently published CONSUMER PRICE INDEX (CPI) for all Urban Consumers in the West Region (CPI-W). The Parties agree that if this CPI is no longer published Provider and the City will negotiate in good faith to select a new index that best reflects and accounts for cost changes relevant to the City’s geographic location and Provider's business.

No increase in Fees for a Renewal Term is effective unless made in compliance with the provisions of this Section.

c. Responsibility for Costs; Travel.

i. Except for any Reimbursable Expenses specified in a Work Order or otherwise pre-authorized by the City in writing, Provider shall be responsible for all costs and expenses incurred in or incidental to the performance of Services, including all costs of any materials supplied by Provider, all fees, fines, licenses, bonds, or taxes required of or imposed against Provider, and all other costs of Provider’s business.

ii. The City shall not pay for travel costs and travel-related expenses, except to the extent, if any, that Exhibit B expressly provides for payment of such costs.

The City shall not be liable for any travel expenses that have not been approved in advance, in writing, by the City. All travel arrangements shall conform to the City’s standard travel policy applicable to its employees. The City will provide the most current version to Provider upon request.

d. Invoices. Provider shall submit invoices to the City for all goods provided and services completed at least thirty (30) days prior to the due date of the payment.

Each separate invoice shall: (a) clearly identify the Work Order to which it relates, in such manner as is required by the City; (b) list each Fee item and Service Credit separately; (c) include sufficient detail for each line item to enable the City to verify the calculation; and (d) include any other information required by the City as set forth in the applicable Work Order.

City of Beaverton - SaaS Agreement (Long form) Page 19

e. Payments. The City shall pay all properly invoiced amounts payable and due within thirty (30) days after the City receives Provider's invoice. However, the City may withhold from any payment any charge or amount disputed in good faith by the City pending resolution of such dispute. Pending the resolution of such payment dispute, Provider shall continue performing its obligations in accordance with this Agreement.

No charge or amount shall be payable for any Fees for Services until at least fifteen

(15) days…