Master Subscription Agreement

Applies to: The LightLeapAI ^® Platform and all modules licensed by an institution ("Licensee") from N2N Services, Inc. ("Licensor").

How to use this page. This is the standard Master Subscription Agreement ("Agreement") that governs every LightLeapAI ^® subscription. Rather than circulating a bespoke contract for each engagement, Licensor incorporates these standard terms by reference into a short Order Form (also called a Work Order). The Order Form identifies the subscribing institution, the licensed modules, the subscription fees, the term, and any engagement-specific parameters; this Agreement supplies all other terms. By executing an Order Form that references this Agreement at https://www.lightleapai.com/subscription-agreement/, the institution agrees to the terms below. In the event of a conflict between an Order Form and this Agreement, this Agreement controls unless the Order Form expressly states otherwise.

Not a substitute for the Data Sharing Agreement. Where student personally identifiable information or education records are processed, a separate Data Sharing Agreement ("DSA") is executed between the parties. On data-related matters, the DSA controls over this Agreement.

This Master Subscription Agreement is made and entered into by and between N2N Services, Inc. ("Licensor"), a Georgia corporation with its principal place of business located at 3063 Peachtree Industrial Blvd., Duluth, GA 30097, and the institution identified as "Licensee" in the applicable Order Form (each a "Party" and collectively the "Parties"). This Agreement is effective as of the date of the last signature on the applicable Order Form (the "Effective Date").

The Parties hereby agree as follows:

1. Definitions

The following terms used in this Agreement shall have the following meanings, unless the context otherwise requires:

• "Agreement" means this Master Subscription Agreement, together with all exhibits and Order Forms incorporated herein.
• "Software" means the LightLeapAI ^® Platform and all modules subscribed to by Licensee as identified in the applicable Order Form, including but not limited to Orion (Fraud Intelligence), Meridian (the Application Platform, including its Prism Document Intelligence and Polaris Student Services Automation modules), Helios (Integration & Agent Platform), and Omnia (Executive Intelligence Hub), together with any updates, enhancements, or new modules made available by Licensor during the Term, as updated from time to time with Licensee's consent.
• "Order Form" means a mutually executed document (also referred to as a Work Order) identifying the specific Software modules, subscription fees, user parameters, and configuration details for a given subscription term, which is incorporated into and governed by this Agreement. In the event of a conflict between an Order Form and this Agreement, this Agreement shall control unless the Order Form expressly states otherwise.
• "Licensee Data" means: (a) personally identifiable information and education records provided by Licensee to Licensor in connection with the Services, as further described in the Data Sharing Agreement executed between the parties; (b) institutional configuration data, usage logs, and system-generated data attributable to Licensee's instance of the Software; and (c) any other data submitted by or on behalf of Licensee through the Software. For the avoidance of doubt, Licensee Data does not include aggregated, de-identified data that cannot reasonably be used to identify Licensee or any individual student, which Licensor may use for platform improvement purposes subject to the limitations in Section 5.3 and the Data Sharing Agreement.
• "Confidential Information" means non-public information disclosed by one Party to the other in connection with this Agreement, including proprietary algorithms, business plans, pricing, technical specifications, and software code. Student personally identifiable information and education records are governed by the Data Sharing Agreement between the parties and are subject to the indemnification, limitation of liability, and confidentiality provisions of this Agreement only as expressly cross-referenced therein.
• "Data Sharing Agreement" or "DSA" means the N2N Services Data Sharing Agreement executed between the parties governing the use, protection, and handling of student personally identifiable information and education records in connection with the Software.
• "Documentation" means the then-current product documentation, technical specifications, and user guides made available by Licensor to Licensee in writing or via Licensor's customer portal.

2. License

2.1 License Grant

Licensor grants Licensee a non-exclusive, non-transferable annual subscription to access and use the Software and associated modules as identified in the applicable Order Form, for Licensee's internal operations during the Term of the Agreement.

2.2 User Parameters

User counts, seat limits, and daily usage parameters applicable to each Software module are set forth in the applicable Order Form. Where an Order Form specifies different parameters, the Order Form controls. Licensor will notify Licensee in writing if usage materially and persistently exceeds agreed parameters, and the parties will negotiate in good faith an appropriate adjustment.

2.3 Restrictions

Licensee shall not reverse engineer, decompile, disassemble, or otherwise tamper with the Software. The Software may not be sublicensed, resold, or used by third parties without Licensor's written consent. Licensee shall not use the Software to process data categories not authorized under the applicable Data Sharing Agreement.

2.4 Proprietary Rights

Licensor retains all rights, title, and interest in the Software, including all modules, algorithms, models, Documentation, and related intellectual property. No rights in Licensor's intellectual property are transferred to Licensee by this Agreement. Section 5 governs intellectual property and data ownership in detail.

2.5 Acceptable Use

Licensee's Obligations. Licensee shall use the Software only for lawful purposes consistent with this Agreement and applicable law. Licensee shall not: (i) use automated fraud detection outputs as the sole basis for adverse decisions affecting individual students without human review; (ii) use the Software in a manner that discriminates against students based on characteristics protected under applicable federal or state law, including but not limited to Title VI, Title IX, Section 504, the ADA, or applicable state equivalents; (iii) attempt to reverse-engineer, circumvent, or manipulate the Software's fraud detection algorithms or scoring outputs; or (iv) use the Software to process data categories not authorized under the applicable Data Sharing Agreement.

Licensor's Obligations. Licensor shall not use Licensee Data to train, fine-tune, benchmark, or otherwise improve AI or machine learning models used for any other customer or institution. Licensor may improve model performance within Licensee's specific instance using Licensee Data to improve outcomes for Licensee, subject to Section 5.3, without sharing that data with any third party or other institution.

3. Term and Termination

3.1 Term

The initial term of this Agreement shall be one (1) year commencing on the Effective Date, unless a different initial term is specified in the applicable Order Form. Thereafter, this Agreement shall automatically renew for successive one (1) year terms unless either Party provides written notice of its intent not to renew at least sixty (60) days prior to the expiration of the then-current term.

The Term may include an initial thirty (30) day Early Onboarding Period commencing on the Effective Date where so provided in the Order Form. During the Early Onboarding Period, Licensee may access and use the Software at no cost while completing procurement and administrative requirements. All provisions of this Agreement, including confidentiality, data security, and limitation of liability, shall apply during the Early Onboarding Period. Unless Licensee provides written notice of termination at least fifteen (15) days prior to the expiration of the Early Onboarding Period, this Agreement will automatically continue in effect for an initial one (1) year paid subscription term commencing immediately upon conclusion of the Early Onboarding Period. For the avoidance of doubt, no Licensee Data, including student personally identifiable information, shall be transmitted to or processed by Licensor during the Early Onboarding Period until the Data Sharing Agreement between the parties has been fully executed. Licensor shall provide access to the Software environment during the Onboarding Period using synthetic or non-production data only until the Data Sharing Agreement is in effect.

3.2 Termination

This Agreement may be terminated upon the following terms and conditions:

• The License will terminate automatically upon any material non-compliance with the restrictions identified in Section 2.3 above that is not cured within thirty (30) days of written notice.
• Either party may terminate the Agreement at any time should the other party default on any of its material obligations under this Agreement if, within thirty (30) days after written notice specifying the default, such other party has failed to begin good faith efforts to cure the default or, if the default is not curable within thirty (30) days, has failed to commence and diligently pursue cure to completion within a maximum of sixty (60) days from the date of written notice.
• Either party may terminate this Agreement immediately upon written notice if: (i) the other party is declared insolvent or bankrupt; (ii) a petition is filed in any court and not dismissed within ninety (90) days to declare one of the parties bankrupt or for a reorganization under the bankruptcy laws or similar statutes; or (iii) a trustee in bankruptcy, receiver, or other similar entity is appointed for one of the parties.

3.3 Effect of Termination

Upon expiration or termination of this Agreement for any reason: (i) all licenses granted hereunder shall immediately terminate and Licensee shall cease all use of the Software; (ii) Licensor shall return or destroy all Licensee Data in accordance with the terms of the Data Sharing Agreement and Exhibit C; (iii) Licensor shall, for a period of thirty (30) days following the effective date of termination, make all Licensee Data available for export in a commonly used machine-readable format to facilitate Licensee's transition to an alternative service; and (iv) each party shall return or certify destruction of the other party's Confidential Information upon request. Sections 1, 5, 6, 7 (disclaimers), 8, 9, and 12 through 15 shall survive termination of this Agreement.

4. Fees and Payment Terms

4.1 Fees

As full consideration for the License and other rights granted in this Agreement, Fees are payable as set forth in the applicable Order Form in accordance with the payment terms set forth therein. Licensor will invoice annually based on the fees described in the applicable Order Form.

Fee Adjustments at Renewal. Licensor may adjust fees for any renewal term by providing written notice to Licensee no later than ninety (90) days prior to the start of the renewal term. Fee increases shall not exceed the greater of five percent (5%) or the change in the Consumer Price Index for All Urban Consumers (CPI-U) for the preceding twelve-month period. Licensee may provide a non-renewal notice within thirty (30) days of receiving a fee adjustment notice, notwithstanding the otherwise applicable sixty (60) day notice period. Where an Order Form establishes fixed fees for a committed multi-year term, this renewal fee adjustment provision shall not apply during that committed term.

4.2 Payment Terms

Fees and expenses are due and payable by Licensee within thirty (30) days of the date of the invoice. Failure to submit an invoice shall not waive such fees and expenses.

4.3 Payment Methods

Licensor's current payment instructions, including ACH/wire transfer details and check remittance address, are set forth on each invoice. Payment instructions are subject to change upon thirty (30) days' written notice to Licensee. Licensor will provide updated payment instructions on each invoice and upon request.

4.4 Late Payments

A late payment charge not to exceed one and one-half percent (1½%) per month, or the maximum rate permitted by applicable law, whichever is less, will be added to any amounts more than thirty (30) days past due. If it becomes necessary to turn this account over for collection, Licensee is responsible for all reasonable collection costs, including reasonable attorneys' fees.

4.5 Service Suspension for Non-Payment

If any payment by Licensee remains unpaid for a period of forty-five (45) days following the due date, Licensor may, at its own discretion, suspend access to the Software upon fifteen (15) days' prior written notice to Licensee. During any suspension period, Licensor shall preserve all Licensee Data in accordance with the Data Sharing Agreement and shall not delete or destroy any Licensee Data solely as a result of a payment dispute. Services shall be restored within two (2) business days of Licensor's receipt of all overdue amounts. Service suspension does not waive any other remedy available to Licensor under this Agreement.

5. Intellectual Property and Data

5.1 Licensor Intellectual Property

Licensor retains all rights, title, and interest in the Software, including all modules, algorithms, models, Documentation, and related intellectual property, and all improvements, enhancements, and derivative works thereof, whether or not created using Licensee Data. No rights in Licensor's intellectual property are transferred to Licensee by this Agreement. Licensee's use of the Software is limited to the license granted in Section 2.

5.2 Licensee Intellectual Property and Data Ownership

Licensee retains all rights, title, and interest in Licensee Data and in Licensee's institutional configurations, workflows, and integrations developed using Licensor's APIs. Licensor acquires no proprietary interest in Licensee Data by virtue of processing it through the Software. Licensee's rights with respect to student education records and personally identifiable information are further governed by the Data Sharing Agreement.

5.3 Model Improvement

Licensor may use Licensee Data to retrain and improve Software models within Licensee's specific instance only, for the purpose of improving outcomes for Licensee. Licensor shall not: (i) use Licensee Data to train, improve, or benchmark models used for any other customer or institution; (ii) share Licensee Data with any third party for model training purposes; or (iii) use Licensee Data to develop new product lines or capabilities outside the scope of services provided to Licensee. All improvements derived from Licensee's instance remain the intellectual property of Licensor and do not confer any proprietary interest on Licensee. Where Licensor's improvements to a module are informed by work performed in Licensee's instance, Licensor may apply those improvements to its broader platform, provided no Licensee Data is shared or disclosed in that process. This Section supplements and does not replace the AI model training prohibition in the applicable Data Sharing Agreement.

5.4 Data Security Standards

Licensor shall implement and maintain a comprehensive information security program consistent with industry standards, including the NIST Cybersecurity Framework and NIST SP 800-171, and compliant with all applicable law including the GLBA Safeguards Rule (16 C.F.R. Part 314, as amended). Licensor's specific obligations with respect to Licensee Data, including breach notification, subprocessor management, and data return, are set forth in the Data Sharing Agreement and in Exhibit C. In the event of a conflict between Exhibit C and the Data Sharing Agreement on data security matters, the Data Sharing Agreement shall control.

6. Confidentiality

Confidential Information is that which relates to either party's research, development, trade secrets, or business affairs; it does not include information that is generally known or easily ascertainable by third parties or that is required to be disclosed by law.

The receiving party shall not duplicate, use, or disclose Confidential Information for any purpose other than the performance of this Agreement, without explicit written permission from the disclosing party. Each party shall implement reasonable and appropriate administrative, physical, and technical safeguards consistent with industry standards, including the NIST Cybersecurity Framework and NIST SP 800-171, to protect the other party's Confidential Information from unauthorized disclosure. This standard applies in lieu of any "same care" or "similar efforts" standard.

Licensor acknowledges that it may have access to Personally Identifiable Information (PII) and student education records governed by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, and its implementing regulations at 34 C.F.R. Part 99. The LightLeapAI ^® Platform is not to be used to process Protected Health Information (PHI) as defined in HIPAA without the parties having executed a Business Associate Addendum as contemplated by the applicable Data Sharing Agreement. Similarly, the LightLeapAI ^® Platform is not to be used to process data subject to the Payment Card Industry Data Security Standard (PCI DSS) without the parties executing a separate agreement addressing scope, auditability, and accountability.

Licensor shall return, transfer, or certify the destruction of all Licensee Confidential Information upon termination of this Agreement in accordance with Section 3.3 and the applicable Data Sharing Agreement. Confidentiality obligations survive termination of this Agreement for a period of five (5) years, except with respect to trade secrets, which shall remain confidential for as long as they qualify as trade secrets under applicable law.

7. Warranties

7.1 Performance Warranty

Licensor warrants that the Software will perform substantially in accordance with the then-current Documentation during the Term. In the event of a material failure of the Software to conform to this warranty, Licensee's exclusive remedy shall be: (i) Licensor's reasonable efforts to correct the non-conformity within thirty (30) days of written notice specifying the failure in reasonable detail; or (ii) if correction is not achievable within that period, a pro-rata refund of fees paid for the non-conforming period. This warranty does not apply to non-conformities caused by Licensee's misuse, unauthorized modification, or use of the Software in a manner inconsistent with this Agreement or the Documentation.

7.2 Title and Authority

Licensor warrants that it has full title and ownership of the Software and full power and authority to grant the license provided by this Agreement to Licensee.

7.3 Disclaimer of Implied Warranties

EXCEPT FOR THE WARRANTIES SET FORTH IN SECTIONS 7.1 AND 7.2, THE SOFTWARE IS PROVIDED "AS IS." LICENSOR MAKES NO OTHER WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. NEITHER PARTY MAKES ANY WARRANTY TO THE OTHER PARTY HEREUNDER BEYOND THOSE EXPRESSLY STATED IN THIS AGREEMENT, AND EACH PARTY HEREBY DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, TO THE GREATEST EXTENT PERMITTED BY APPLICABLE LAW.

7.4 Regulatory Compliance Design

Licensor warrants that the Software, as delivered and maintained by Licensor, is designed to enable Licensee's compliant use in accordance with FERPA, the GLBA Safeguards Rule, and applicable federal student aid regulations, and that Licensor maintains a security program consistent with those requirements. This warranty does not extend to Licensee's configuration, data inputs, or use of the Software in a manner not authorized by this Agreement or the applicable Data Sharing Agreement. Licensee remains responsible for its own compliance obligations as a FERPA-covered institution.

7.5 AI Output Disclaimer

LICENSOR DOES NOT WARRANT THAT THE SOFTWARE'S AI-GENERATED OUTPUTS, INCLUDING FRAUD RISK SCORES, IDENTITY VERIFICATION RESULTS, AND BEHAVIORAL ANALYTICS, ARE FREE FROM ERROR OR WILL IDENTIFY ALL INSTANCES OF FRAUD OR ANOMALOUS ACTIVITY. ALL OUTPUTS ARE PROBABILISTIC INDICATORS AND ARE NOT INTENDED TO SERVE AS THE SOLE BASIS FOR ADVERSE DECISIONS AFFECTING INDIVIDUAL STUDENTS. LICENSEE ASSUMES SOLE RESPONSIBILITY FOR DECISIONS MADE IN RELIANCE ON SOFTWARE OUTPUTS AND SHALL MAINTAIN HUMAN REVIEW PROCESSES CONSISTENT WITH APPLICABLE LAW, INCLUDING FERPA AND ANY APPLICABLE STATE OR FEDERAL AI GOVERNANCE REQUIREMENTS.

8. Limitation of Liability

8.1 General Cap

Licensor's total cumulative liability to Licensee arising out of or related to this Agreement, whether in contract, tort, or otherwise, shall not exceed the greater of: (a) the total license fees paid by Licensee to Licensor during the twelve (12) months preceding the claim; or (b) fifty thousand dollars ($50,000).

8.2 Data Breach Supercap

In the event of a confirmed unauthorized disclosure or breach of Licensee Data caused by Licensor's gross negligence, willful misconduct, or failure to implement required security controls, Licensor's liability shall not exceed the greater of: (a) two times the total fees paid by Licensee during the twelve (12) months preceding the claim; or (b) one hundred thousand dollars ($100,000).

8.3 Exclusions From Cap

The limitations in Sections 8.1 and 8.2 shall not apply to: (i) either party's indemnification obligations under Section 9; (ii) Licensor's violation of Section 5.3 (model improvement limitations and prohibition on cross-institution data use); (iii) either party's liability for fraud or intentional misrepresentation; or (iv) either party's liability for gross negligence or willful misconduct.

8.4 Exclusion of Indirect Damages

IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING LOSS OF REVENUE, LOSS OF PROFITS, OR LOSS OF DATA, ARISING OUT OF OR RELATED TO THIS AGREEMENT, REGARDLESS OF WHETHER SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS EXCLUSION SHALL NOT APPLY TO THE CARVE-OUTS IN SECTION 8.3.

9. Indemnification

9.1 Licensor Indemnification

Licensor shall defend, indemnify, and hold harmless Licensee and its officers, agents, employees, and servants ("Licensee Indemnitees") from and against any third-party claims, losses, expenses, and damages, including reasonable attorneys' fees ("Claims"), arising from: (i) Licensor's material breach of this Agreement; (ii) Licensor's gross negligence or willful misconduct; (iii) any claim that the Software, as delivered by Licensor without modification, infringes a third party's intellectual property rights; or (iv) a breach of Licensee Data security caused by Licensor's failure to implement required security controls. Licensor's indemnification obligations shall not apply to Claims arising from Licensee's misuse of the Software, Licensee's data inputs, Licensee's modification of the Software, or Licensee's breach of this Agreement.

9.2 Licensee Indemnification

Licensee shall defend, indemnify, and hold harmless Licensor and its officers, employees, and agents ("Licensor Indemnitees") from and against any Claims arising from: (i) Licensee's material breach of this Agreement; (ii) Licensee's use of the Software in a manner not authorized by this Agreement or applicable law; (iii) Licensee's data inputs to the Software, including any claim that such data was obtained or shared in violation of applicable law; or (iv) Licensee's decisions made in reliance on Software outputs without maintaining required human review processes consistent with Section 2.5. Where Licensee is a public institution or governmental entity, this indemnification obligation applies only to the extent permitted by applicable law.

9.3 Indemnification Procedure

The indemnified party shall: (i) promptly notify the indemnifying party in writing of any Claim; (ii) grant the indemnifying party sole control of the defense and settlement of the Claim, provided that no settlement imposing material obligations on or requiring an admission of fault by the indemnified party shall be made without the indemnified party's prior written consent; and (iii) provide reasonable cooperation to the indemnifying party in the defense of the Claim at the indemnifying party's expense.

9.4 IP Infringement Remedy

If the Software is found to infringe a third party's intellectual property rights, Licensor may, at its option: (i) modify the Software to be non-infringing while maintaining substantially equivalent functionality; (ii) obtain a license permitting Licensee's continued use of the Software; or (iii) if neither (i) nor (ii) is commercially practicable, terminate the affected subscription and refund to Licensee any prepaid, unused fees for the terminated subscription period.

9.5 Survival

This Section 9 shall survive the termination of this Agreement.

10. Insurance

Licensor shall maintain insurance coverage as described in Exhibit B throughout the Term of this Agreement and for two (2) years following termination, and shall provide current certificates of insurance to Licensee upon request within ten (10) business days.

11. Support and Service Levels

11.1 Support

Licensor will provide support to Licensee via electronic mail to designated Licensee professional staff. Business hours support covers non-emergency issues during 9:00 AM to 5:00 PM Eastern time, Monday through Friday (excluding federal holidays). After-hours support is available for Emergency issues. An "Emergency" means a condition in which the Software is completely unavailable or a critical function — including fraud detection alerting, identity verification, or financial aid monitoring — is non-operational, directly impacting Licensee's time-sensitive operations. Non-emergency issues include degraded non-critical performance, non-critical feature failures, and configuration questions. Target response times: Emergency — four (4) hours from notification; Non-emergency — next business day.

11.2 Service Level Agreement

"Availability" means the Software is accessible and functional for its intended purpose, excluding: (i) scheduled maintenance windows communicated to Licensee at least forty-eight (48) hours in advance; (ii) downtime caused by Licensee's systems, third-party integrations under Licensee's control, or Licensee's data inputs; (iii) force majeure events; and (iv) outages in third-party infrastructure outside Licensor's reasonable control, including cloud infrastructure provider outages.

Licensor shall operate the Software with a target Availability of 99.95%, corresponding to no more than approximately twenty-two (22) minutes of unscheduled downtime per month, measured on a calendar-month basis.

If Availability falls below 99.95% in a given calendar month due to causes within Licensor's reasonable control, Licensee shall be entitled to a service credit equal to ten percent (10%) of that month's subscription fee (calculated as 1/12 of the applicable annual subscription fee), subject to the following: (i) Licensee must submit a written credit request within thirty (30) days of the end of the affected month; (ii) credits shall be applied to the next renewal invoice and shall not be converted to cash; and (iii) total credits shall not exceed twenty percent (20%) of any single month's subscription fee. Service credits are Licensee's sole and exclusive remedy for Availability failures and do not affect Licensee's right to terminate under Section 3.2 for persistent material breach.

12. Entire Agreement and Amendment

This Agreement, together with all exhibits and any executed Order Forms, sets forth the entire agreement and understanding between the parties with respect to its subject matter and supersedes all prior oral and written understandings, representations, and discussions between them. This Agreement may be amended only by a written instrument executed by both Licensor and Licensee that expressly states it is intended to amend this Agreement. An Order Form may vary commercial terms (such as fees, volumes, term length, and module scope) for the engagement it governs without constituting an amendment to this Agreement.

Where Licensor and Licensee have executed a Data Sharing Agreement, the terms of the Data Sharing Agreement shall govern with respect to the use, handling, and protection of student personally identifiable information and education records. In the event of a conflict between this Agreement and the Data Sharing Agreement on data-related matters, the Data Sharing Agreement shall control. On all other matters, this Agreement shall govern.

13. Notices

All notices required or permitted to be given under this Agreement shall be in writing and delivered by: (a) personal service; (b) nationally recognized overnight courier with tracking confirmation; (c) U.S. certified or registered mail, return receipt requested, postage prepaid; or (d) email with confirmed delivery receipt. Notice by email shall be deemed given upon sender's receipt of confirmation of delivery. Notice by overnight courier shall be deemed given one (1) business day after deposit. Notice by certified mail shall be deemed given three (3) business days after deposit.

Notice to Licensor:

• Entity: N2N Services, Inc.
• General Notices: Operations Manager — accounting@n2nservices.com
• Security / Breach: CISO — security@n2nservices.com
• Legal / Compliance: Legal — legal@n2nservices.com
• Address: 3063 Peachtree Industrial Blvd., Duluth, GA 30097

Notice to Licensee: The entity, contact, address, and email set forth in the applicable Order Form.

14. Assignment

Licensee may not assign or otherwise transfer its rights or obligations under this Agreement without the prior written consent of Licensor, which consent shall not be unreasonably withheld. Licensor may assign this Agreement without Licensee's consent to: (i) an affiliate of Licensor; or (ii) any entity that acquires all or substantially all of the assets or equity of Licensor, whether by merger, acquisition, or otherwise, provided that: (a) the assignee assumes all of Licensor's obligations under this Agreement in writing; (b) the assignee's data protection capabilities are no less protective than Licensor's; and (c) Licensor provides Licensee with written notice of the assignment within thirty (30) days. Licensee may terminate this Agreement within sixty (60) days of receiving such notice if the assignee is a direct competitor of Licensee or if the assignment materially impairs Licensee's rights under this Agreement. Any purported assignment in violation of this Section shall be void ab initio.

15. Miscellaneous

15.1 Counterparts

This Agreement and any Order Form may be executed in any number of counterparts, each of which shall be an original and all of which shall constitute one agreement. Any counterpart containing an electronic, digital, or facsimile signature shall be deemed an original. Execution signifies the parties' mutual consent to conduct transactions electronically.

15.2 Severability

Every provision of this Agreement is intended to be severable. If any term or provision is held invalid, illegal, or unenforceable for any reason, the validity, legality, and enforceability of the remaining provisions shall not be affected or impaired thereby, and any invalidity in any jurisdiction shall not affect the validity of any term in any other jurisdiction.

15.3 Governing Law

This Agreement shall be governed by the laws of the State of Georgia, without regard to conflicts of law, and venue for any dispute arising under this Agreement shall be in Gwinnett County, Georgia — except where the applicable Order Form specifies a different governing law and venue (for example, to accommodate a public institution required by law to contract under the law of its home state), in which case the Order Form controls on governing law and venue.

15.4 Independent Contractors

Nothing in this Agreement shall be deemed to create a partnership, agency, joint venture, or any formal business organization between the parties. Each party is an independent contractor.

15.5 Waiver

No waiver by either party of any breach or default of any provision of this Agreement shall be deemed a waiver of any subsequent breach or default, and shall not affect the other terms of this Agreement.

15.6 Force Majeure

Neither party shall be liable for delays or failures in performance resulting from causes beyond that party's reasonable control, including acts of God, natural disasters, pandemics, governmental actions, or failures of third-party infrastructure providers, provided that the affected party provides prompt written notice and uses reasonable efforts to resume performance. If a force majeure event continues for more than sixty (60) days, either party may terminate this Agreement upon written notice without liability, except for payment of fees accrued prior to the force majeure event.

Exhibit A: Service Descriptions — LightLeapAI ^® Platform

LightLeapAI ^® Platform Overview. LightLeapAI ^® by N2N Services Inc. is an AI-powered platform purpose-built for higher education. It delivers a suite of intelligent modules designed to support institutional efficiency, student success, and regulatory compliance. Each module is independently licensable and may be deployed separately or in combination. The modules subscribed to by Licensee in a given engagement are identified in the applicable Order Form.

Orion — Fraud Intelligence. Orion is the fraud detection and prevention module of the LightLeapAI ^® Platform. It safeguards institutions against financial aid fraud, identity theft, ghost student enrollment, and refund misdirection schemes. Key capabilities include AI-driven application and identity verification, financial aid disbursement monitoring, behavioral analytics for suspicious enrollment and registration patterns, integration with student information systems and payment processors, audit-ready compliance reporting, and continuous model refinement. Orion outputs are probabilistic fraud risk indicators and are not intended to serve as the sole basis for adverse decisions. Institutions must maintain human review processes consistent with FERPA and applicable law.

Prism — Document Intelligence (a Meridian Module). Prism is LightLeapAI ^®'s document-intelligence module, built on the Meridian platform. It applies OCR and AI document analysis, including AWS Textract and Bedrock-based extraction with human-in-the-loop review, to support transcript verification, credential authentication, and eTranscript processing workflows. Prism integrates with institutional SIS and relevant clearinghouse services to provide a unified document intelligence layer.

Polaris — Student Services Automation (a Meridian Module). Polaris is LightLeapAI ^®'s student-services module, built on the Meridian platform. It provides a multi-channel inbox in which email, chat, web-form, and phone requests are AI-classified, routed by institutional rules, and tracked to resolution against service-level agreements. Autonomous agents draft and propose responses, but a human reviewer or the student's own confirmation of resolution closes every request. Where deployed in a student health services context, Polaris may involve Protected Health Information and requires activation of the Business Associate Addendum in accordance with the applicable Data Sharing Agreement.

Meridian — The Application Platform. Meridian is LightLeapAI ^®'s platform for building enterprise applications from a prompt, comprising a dynamic application builder, a configurable object designer, a versioned API explorer, seamless tenant administration, and a Data Studio that supports natural-language and SQL queries natively in the browser. Prism and Polaris are delivered as modules of Meridian. Meridian may also be licensed as a standalone platform for institution-specific application development, including as the basis for a full Student Information System deployment, as identified in the applicable Order Form.

Helios — Integration & Agent Platform. Helios is LightLeapAI ^®'s integration and agent platform, providing flexible, configurable data connectors and agentic workflows between LightLeapAI ^® modules and institutional SIS, LMS, ERP, and third-party data systems. Helios configurations, including specific data sets and integration mappings, are negotiated per engagement and documented in the applicable Order Form. Helios does not constitute a defined data processing commitment independent of the Order Form.

Omnia — Executive Intelligence Hub. Omnia is LightLeapAI ^®'s conversational AI interface, providing natural-language access to institutional data, analytics, and platform configuration across LightLeapAI ^® modules for administrators, faculty, and staff. Conversation data generated through Omnia interactions that is directly related to a student and maintained on behalf of the institution may constitute an education record under FERPA; institutions are responsible for classifying and managing such data in accordance with their FERPA obligations.

Exhibit B: Insurance Requirements

Licensor shall not commence work under this Agreement until a required insurance certificate has been submitted to Licensee's designated Project Manager. Certificates of insurance shall be issued by an insurer with an AM Best rating of A-VII or better. Such certificates shall evidence all coverages and limits required by this Agreement and shall specify that insurers will give Licensee at least thirty (30) days' prior written notice of non-renewal or material change.

Minimum Scope and Limits of Insurance. Licensor shall maintain in force throughout the Term of this Agreement and for two (2) years following termination:

• Workers' Compensation (statutory limits) and Employers' Liability insurance with limits not less than $1,000,000 each accident, $1,000,000 per employee, and $1,000,000 each disease;
• Commercial General Liability insurance with limits not less than $1,000,000 each occurrence for Bodily Injury and Property Damage / $2,000,000 general aggregate, including coverages for contractual liability, personal injury, broadform property damage, independent contractors, and products and completed operations;
• Commercial Automobile Liability insurance with limits not less than $1,000,000 each occurrence for Bodily Injury and Property Damage, including coverages for owned, non-owned, and hired vehicles, as applicable;
• Professional Liability (Errors and Omissions) insurance with limits not less than $2,000,000 each claim / annual aggregate, covering errors and omissions arising from professional services and AI-generated outputs, with any deductible not to exceed $50,000 each claim;
• Cyber Liability insurance with limits not less than $2,000,000 each claim / annual aggregate, covering data breaches, privacy liability, network security failures, and regulatory defense costs, with any deductible not to exceed $50,000 each claim.

Other Insurance Provisions.

• If any required insurance is written on a claims-made form, such insurance shall be maintained for a period of three (3) years following termination of this Agreement.
• Commercial General Liability and Automobile Liability policies shall name Licensee, its officers, agents, employees, and servants as Additional Insureds. Such coverage shall be primary to any other insurance or self-insurance available to the Additional Insureds and shall apply separately to each.
• Maintenance of required insurance is a material condition of this Agreement. Failure to maintain required insurance may, at Licensee's option, result in a declaration of material breach and suspension of Licensor's further work under this Agreement.

Exhibit C: Data Security Standards

Relationship to Data Sharing Agreement. This Exhibit C sets forth Licensor's general data security standards and obligations. Where Licensor and Licensee have executed a Data Sharing Agreement, the terms of that Data Sharing Agreement shall govern with respect to student personally identifiable information and education records. In the event of any conflict between this Exhibit C and the Data Sharing Agreement, the Data Sharing Agreement shall control.

Security. Licensor shall implement and maintain a comprehensive information security program that includes: (a) physical and logical security of hosting locations and infrastructure; (b) role-based access controls limiting access to Licensee Data to Licensor personnel with a documented need in connection with providing the Services; (c) encryption of Licensee Data in transit and at rest using industry-standard encryption protocols; (d) multi-factor authentication for all systems that access Licensee Data; (e) regular security assessments including penetration testing and vulnerability scanning; (f) written incident response and disaster recovery plans; and (g) employee security awareness training. Licensor's security program shall be consistent with the NIST Cybersecurity Framework and NIST SP 800-171.

Licensee Data Export and Return. Upon expiration or termination of this Agreement for any reason, Licensor shall: (i) within thirty (30) days, make all Licensee Data available for export in a commonly used, machine-readable format to facilitate Licensee's transition; (ii) cooperate with Licensee's reasonable data migration requests during the transition period; and (iii) certify destruction of all Licensee Data within forty-five (45) days of Licensee's written confirmation of successful data export, using destruction methods consistent with NIST SP 800-88 (current revision), at minimum the Purge standard. Licensor shall provide a written certificate of destruction within ten (10) business days of completion, including the date, description of data destroyed, and destruction method used.

Data Ownership. Licensee, and/or its suppliers and affiliates, retains all right, title, and interest (including all proprietary rights) to Licensee Data. Licensor acquires no ownership interest in Licensee Data through this Agreement. Except as otherwise provided herein or in the Data Sharing Agreement, upon termination or cancellation of this Agreement, Licensor shall make available for export or certify destruction of all Licensee Data in accordance with this Exhibit C and the Data Sharing Agreement.

Nondisclosure of Licensee Data. Licensor shall hold all Licensee Data in strict confidence consistent with the NIST CSF/800-171 standard and shall not use Licensee Data for any purpose other than to provide the Services or as expressly authorized in writing by Licensee. Licensor shall not disclose Licensee Data to any other party except: (a) to Licensor employees, agents, subcontractors, and service providers to whom Licensee Data needs to be disclosed for the purpose of providing the Services, subject to confidentiality obligations no less protective than those in this Agreement; (b) as required by applicable law, subject to the legal process notification procedure below; or (c) as authorized by Licensee in writing. Licensor shall take reasonable steps to ensure that all Licensor personnel with access to Licensee Data are aware of Licensor's obligations and are bound by appropriate confidentiality obligations.

Legal Process Notification. In the event Licensor receives a subpoena, court order, governmental demand, search warrant, or other legal process requiring the disclosure of Licensee Data, Licensor shall, to the extent permitted by law: (i) promptly notify Licensee in writing prior to making any disclosure; (ii) take direction from Licensee regarding how to respond; and (iii) cooperate with Licensee's reasonable efforts to seek a protective order or other appropriate remedy. Licensee shall be responsible for notifying affected students of any required disclosure in accordance with FERPA and applicable law. Licensor shall not voluntarily disclose Licensee Data to law enforcement without a valid legal order and without following this notification procedure.

Security Breach Notification. Licensor will notify Licensee of a Security Breach within seventy-two (72) hours of Licensor's reasonable determination that a Security Breach has occurred or is reasonably suspected to have occurred. Licensor shall not delay notification pending full verification of the scope of the breach. The notification shall include, to the extent then known: (a) a description of the nature of the Security Breach; (b) the categories and approximate number of individuals and records affected; (c) the date of and date of discovery of the Security Breach; (d) a description of Licensor's efforts to investigate, contain, and mitigate the breach; and (e) Licensor's recommended steps for Licensee to take to protect affected individuals. Licensor shall provide updated information as it becomes available. All information shared regarding a Security Breach shall be treated as Confidential Information.

Breach Notification Responsibilities. Licensee shall be responsible for determining whether a Security Breach requires notification to affected individuals, regulators, or law enforcement under applicable state and federal breach notification laws, and for making any required notifications. Licensor agrees to cooperate reasonably with Licensee's breach notification obligations, including providing forensic documentation and supporting evidence as reasonably requested.

Subprocessors. Licensor shall maintain a current list of subprocessors and third-party service providers that have access to Licensee Data in connection with the Services ("Subprocessor List"). Licensor shall provide the Subprocessor List to Licensee upon request and shall provide at least thirty (30) days' advance written notice before engaging any new subprocessor that will have access to Licensee Data. Licensee may object to a new subprocessor within fifteen (15) days of receiving notice, and the parties will work in good faith to resolve any legitimate objection. All subprocessors shall be bound by data protection obligations no less protective than those in this Agreement and the applicable Data Sharing Agreement.

Identity Verification and NIST IAL2 Certification. Where Licensee Data includes requests for identity verification services (including but not limited to facial photograph analysis, government-issued ID verification, biometric matching, or behavioral identity verification), Licensor shall engage only subprocessors that maintain current certification to NIST IAL2 (Identity Assurance Level 2) or higher, as evidenced by: (a) certification through the Kantara Initiative Trust Mark program or an equivalent third-party assessment framework validating compliance with NIST SP 800-63-3 (Digital Identity Guidelines) or its successor standards; (b) annual audit or attestation of ongoing compliance with NIST SP 800-63-3 or successor standards; and (c) a written commitment to notify Licensor within fifteen (15) days of any material change in certification status or loss of certification, which Licensor shall in turn promptly relay to Licensee.

Licensor shall provide a current certificate of NIST IAL2 compliance (or equivalent Kantara Initiative certification) for any identity verification subprocessor upon Licensee's request, and shall refresh such certificate annually or upon Licensee's written request. Licensor shall maintain a Subprocessor Compliance Matrix identifying each identity verification subprocessor and its current NIST IAL2 certification status as part of the Subprocessor List, updated not less than quarterly. This requirement does not obligate Licensor to name a specific identity verification subprocessor in this Agreement; the identity of such subprocessors remains subject to the notice and objection procedures set forth in the Subprocessors section above.

Revision History

LightLeapAI ^® is a product of N2N Services, Inc. | 3063 Peachtree Industrial Blvd., Duluth, GA 30097 | legal@n2nservices.com