To assist employers in these obligations, Hyland has developed the Guardian Electronic I-9 and E-Verify software which enables employers to electronically complete the Form I-9 and E-Verify process, manage I-9 and related E-Verify deadlines, detect and remediate prior I-9 compliance mistakes, create compliance reports, and integrate with other human resources information systems.

“Affiliate” of Customer means a corporation, partnership, limited liability company or other business entity of which shares, securities or other interests having both a majority of the economic ownership rights and a majority of the voting power in the election of directors or other governing body are beneficially owned by Customer directly (and not indirectly or through one or more intermediaries). A reference to “Customer” shall mean Customer and/or Customer’s Affiliates except where Affiliate is expressly added or excluded for the avoidance of doubt. Hyland and Customer agree that Customer shall act for and on behalf of all such Affiliates with respect to all matters relating to this Agreement, including the issuance of any purchase orders for Software or Services, entering into any and all SOWs, granting any approval, acceptance or consent, providing or receiving any notice, entering into any modification, exercising any right of termination and any other action required or permitted by this Agreement by Customer. Customer agrees that it shall be responsible for the performance of all obligations of such Affiliates under this Agreement and for causing each such Affiliate to comply with all applicable provisions of this Agreement.

“Customer Data” means any and all data and information of Customer stored within the Software which is located in Hyland’s data centers.

“End Users” means employees and agents of Customer that Customer allows to use the Software.

“E-Verify” means the Internet-based employment eligibility verification system, operated by the U.S. Department of Homeland Security (DHS) in partnership with the Social Security Administration (SSA), which compares the information on an employee’s Form I-9 with SSA and DHS records to verify the identity and employment eligibility of each newly hired employee and/or employee assigned to a covered federal contract.

Form I-9 or “I-9(s)” means the Form I-9 Employment Eligibility Verification Form or Section 3 of the Form I-9, which must be completed by employers for newly hired employees, re-hired employees, and reverifications pursuant to IRCA.

“Go-Live Date” means the date on which Hyland first makes the Software available for Customer’s use in a final production environment.

“Order Form” means the ordering document for Customer’s purchase of Software or Services from Hyland that is executed by the parties from time to time, which shall be governed by the terms of this Agreement.

“Services” means the implementation, integration, data migration, and/or similar services described in an Order Form or Statement of Work and provided by Hyland employees and subcontractors in support of Customer’s use of the Software.

“Software” means the Guardian Electronic I-9 and E-Verify software system as more specifically described in Schedule A attached hereto, as well as any updates made available by Hyland during the term of this Agreement.

“Statement of Work” or “SOW” means the document describing the scope and schedule of Services, if any, to be performed by Hyland for Customer. An SOW may be a stand-alone document or incorporated into an Order Form and shall be governed by the terms of this Agreement.

“Subscription Term” means the subscription period set forth on an applicable Order Form.

3.1
Scope of Agreement This Agreement sets forth the terms and conditions applicable to the Software and Services to be provided by Hyland to Customer. From time to time, the parties may add new Order Forms and/or SOWs, which will be subject to the terms and conditions of this Agreement.

3.2
Agreement and Schedules This Agreement consists of the terms and conditions set forth below and Schedules A, B, C, D, and E which are incorporated and made part this Agreement by this reference and are included in any reference to this Agreement. Hyland shall use commercially reasonable efforts to (a) provide Customer with the Software described more specifically in Schedule A (“Description of Software”); (b) make the Software available for use in accordance with the terms and conditions specified in Schedule B (“Service Level Agreement”); (c) provide Customer with the levels of support and response times indicated in Schedule C (“Customer Support Policies”); (d) notify Customer of Hyland’s acceptable use policy for the Software, a current copy of which is attached as Schedule D (“Acceptable Use Policy”); and (e) adhere to the levels of security in accordance with Schedule E (“Data Security Requirements).

3.3
Order of Precedence To the extent of any conflict or inconsistency between the provisions in this Agreement and any Order Form or SOW, the terms of this Agreement will prevail unless expressly stated otherwise in such Order Form or SOW. Customer and Hyland specifically acknowledge and agree that this Agreement and all Order Forms and SOWs take precedence over any purchase order or other electronic, written or oral communication issued by Customer, which may be accepted by Hyland for administrative convenience only.

4.1
License to Use the Software Subject to compliance by Customer with the terms, conditions and restrictions of this Agreement and payment of all applicable fees hereunder, for the duration of the Subscription Term, Customer will have the non-exclusive, non-assignable (except as provided herein), royalty free, worldwide limited right to use the Software solely for its internal business operations and subject to the terms of this Agreement. End Users may use the Software only for this purpose and Customer is responsible for its End Users’ compliance with this Agreement. The Software is provided as described in, and subject to, the provisions in this Agreement.

4.2
No Software Delivery Obligation Hyland has no software delivery obligation and will not ship copies of any of the Hyland Software used to provide the Services to Customer. Upon the end of the Service Order, Customer’s right to access or use the Hyland Software specified in the Service Order will terminate.

4.3
Restricted Use Customer shall not (and shall not allow any third party to): (a) decompile, disassemble, or otherwise reverse engineer the Software or attempt to reconstruct or discover any source code, underlying ideas, algorithms, file formats or programming interfaces of the Software by any means whatsoever (except and only to the extent that applicable law prohibits or restricts reverse engineering restrictions); (b) distribute, sell, sublicense, rent, lease, or use the Software (or any portion thereof) for time sharing, hosting, service provider, or like purposes; (c) remove any product identification, proprietary, copyright, or other notices contained in the Software; (d) modify any part of the Software, create a derivative work of any part of the Software, or incorporate the Software into or with other software, except to the extent expressly authorized in writing by Hyland; (e) attempt to circumvent or disable the security key mechanism that protects the Software against unauthorized use (except and only to the extent that applicable law prohibits or restricts such restrictions); or (f) publicly disseminate performance information or analysis (including, without limitation, benchmarks) from any source relating to the Software to any non-Customer employees, excluding Customer’s attorneys or authorized representatives.

4.4
Services Hyland shall provide Customer with the Services set forth, and as described, in an applicable Order Form or Statement of Work, which shall be subject to the terms of this Agreement. Customer hereby acknowledges and agrees that, unless otherwise specified in an Order Form or Statement of Work, Hyland will not perform any custom software development for Customer hereunder.

5.1
Fees and Expenses Customer agrees to pay Hyland for all Software and Services ordered on an applicable Order Form or SOW and reimburse Hyland for any expenses incurred, but only to the extent the expenses are specifically itemized or authorized in advance by Customer in writing. Unless otherwise specified in an Order Form or SOW, all fees and expenses due to Hyland are non-cancelable and the sums paid nonrefundable.

5.2
Invoice Terms Unless otherwise specified in an Order Form or SOW, Hyland shall issue invoices to Customer for Software and Services ordered. Customer agrees that amounts on all invoices shall be due and payable within thirty (30) days of Customer’s receipt of such invoice. Hyland reserves the right to charge a late fee of $35 plus a finance charge of one and one half percent (1-1/2%) per month, or the maximum rate permitted by applicable law, whichever is less, if payment in full is not received within thirty (30) days of the date due.

5.3
Purchase Orders In the event that Customer’s business practices require a purchase order number be issued prior to payment of any Hyland invoice, then such purchase order number must be provided to Hyland prior to the effective date of the applicable Order Form or SOW. Customer’s execution and return of an Order Form or SOW to Hyland without designating a purchase order number shall be deemed an acknowledgement that no purchase order number is required for payment of invoices hereunder. Additionally, terms, provisions or conditions on any purchase order, acknowledgement, or other business form or writing that Customer may provide to Hyland or use in connection with the procurement of Services from Hyland are rejected and will have no force or effect on the rights, duties or obligations of the parties hereunder, regardless of any failure of Hyland to object to such terms, provisions or conditions.

5.4
Taxes The fees invoiced by Hyland do not include charges for taxes imposed by any government authority upon the provision of the Software and the Services to Customer, and Customer shall pay any such taxes, excluding taxes based upon or assessed against the income of Hyland. Hyland shall not assess against or charge Customer for any taxes for which Customer provides a valid resale, direct payment or tax exemption certificate.

6.1
Term of Agreement This Agreement commences on the date of the first Order Form and/or SOW between Hyland and Customer (the “Effective Date”) and continues until the termination or expiration of all Subscription Terms specified in all Order Forms and/or of the terms specified in all SOWs or until terminated by either party as set forth herein (the “Term”).

6.2
Term of Subscription Subscriptions to the Software commence on the first day of the month of the Go-Live Date and continue for the Subscription Term specified in the applicable Order Form. Unless otherwise set forth in an Order Form, subscriptions shall automatically renew for additional periods of one year for the fees set forth in the applicable Order Form unless either party gives the other notice of non-renewal at least ninety (90) days prior to the end of the then-current Subscription Term. Hyland reserves the right to increase Subscription fees in a reasonable manner by notifying Customer at least thirty (30) days prior to the expiration of a Subscription Term that is then in effect. Increases, if any, shall be no greater than the cumulative increases in the Consumer Price Index (CPI) since the beginning of the initial Subscription Term or the latest price increase effective date, whichever is later.

6.3
Termination for Cause In the event of a breach of this Agreement, the non-defaulting party may terminate this Agreement upon not less than thirty (30) days written notice to the other party, provided such default is not cured within thirty (30) days after receipt of written notice of such default by the defaulting party.

6.4
Violation of Laws Notwithstanding anything to the contrary, if, in the reasonable opinion of Customer or Hyland, the compliance by either party with the terms of this Agreement will be in violation of any law or regulation implemented or modified after the Effective Date of this Agreement, Customer or Hyland, as the case may be, may terminate this Agreement and the applicable Order Form and/or SOW upon thirty (30) days written notice to the other party.

6.5
Effect of Termination Upon termination of this Agreement, all rights granted under the Agreement terminate immediately and Customer will make no further use of the Software or Services. Customer shall remain liable for all fees and charges incurred prior to the date of termination.

6.6
Termination Assistance Notwithstanding any dispute between the parties and subject to Customer’s payment of all applicable fees and charges, Hyland will provide to Customer termination assistance as reasonably requested in order to provide an orderly transition. In connection with this transition assistance, Hyland will: (a) transfer all Customer Data stored in the Software to Customer as specified in Section 8.4 herein; (b) cooperate with Customer in the transition from Hyland to a third party or Customer software product, including assistance in the event of an audit; (c) maintain the same service levels during the transition period; and (d) once the transition is complete, destroy all Customer records and files, unless retention is required by law or regulation. If this transition has not been completed by the estimated termination date, Hyland will, at the request of Customer, continue to provide the Software on a month-to-month basis for up to twelve (12) months from the estimated date of termination, and will continue to be compensated at the rates set forth in an applicable Order Form.

6.7
Survival The provisions contained in this Agreement that would, by their nature, survive termination or expiration shall so survive the expiration or termination of this Agreement for any reason.

7.1
Proprietary Rights Subject to the limited rights expressly granted hereunder, Hyland and its suppliers reserve all rights, title and interest in and to the Software, including all related intellectual property rights, including without limitation, any and all worldwide copyrights, patents, trade secrets, trademarks and proprietary and confidential information rights. No rights are granted to Customer hereunder other than as expressly set forth herein. Code modifications to the Software, if any, whether under a Order Form, SOW, or other agreement shall always remain the exclusive property of Hyland and may at the option of Hyland be made available as part of the Software or any other Hyland software product or code.

7.2
Documentation Notwithstanding the foregoing, Hyland grants to Customer a non-exclusive, non-transferable, worldwide license to use, during the term of an applicable Order Form or SOW, any technical documentation, sample code, user guides and support information (collectively, “Software Documentation”) provided by Hyland to Customer, solely for the purpose of accessing and using the Software and/or receiving the Services.

7.3
Prohibitions Customer agrees that the Service and Software contains trade secrets and other proprietary information owned by Hyland and its suppliers. No part of the Software may be copied, reproduced, distributed, republished, downloaded, displayed, posted or transmitted in any form or by any means, except as expressly provided in this Agreement or an applicable Order Form and/or SOW. Customer agrees to make every reasonable effort to prevent unauthorized third parties from accessing the Software or Software Documentation.

8.1
Confidential Information Defined “Confidential Information” means any information and data, including intangible, electronic or other form, of Hyland or Customer that is identified as confidential or proprietary at the time of disclosure or which should be understood to be confidential by the nature of the information or the circumstances of the disclosure. Confidential Information shall include without limitation Services, products, Customer data, business plans, strategies, technology, software, documentation, methodologies, know-how, technical information, financial information, information regarding each party’s operations, business relationships and the terms of this Agreement. Confidential Information shall not include any information which: (i) is demonstrated by receiving party to be known to the receiving party prior to receipt hereunder from a source other than one having an obligation of confidentiality to the disclosing party; (ii) becomes lawfully known (independently of disclosure by the disclosing party) to the receiving party from a source other than one having an obligation of confidentiality to the disclosing party; (iii) becomes publicly known or otherwise ceases to be secret or confidential, except through a breach of this Agreement by receiving party; or (iv) is demonstrated by receiving party to have been independently developed by the receiving party without use of the Confidential Information.

8.2
Protection of Confidential Information The receiving party agrees that it will use the same degree of care that such party uses to protect its own confidential information, but in any event not less than reasonable care; and shall not use the Confidential Information of the disclosing party in any way, for its own account or the account of any third party, except for the purpose of performing this Agreement, nor will the receiving party disclose the Confidential Information of the disclosing party to any third party except as required by law. In the event that either party is required by law to make any disclosure of any Confidential Information, by subpoena, judicial or administrative order or otherwise, such party must first give written notice of such requirement to the other party, and must permit such party to intervene in any relevant proceedings to protect its interests in the Confidential Information, and provide full cooperation and assistance in seeking to obtain such protection, provided such notice is not otherwise prohibited by such subpoena, judicial or administrative order or otherwise. The obligation of confidentiality will continue for a period of three (3) years from the date of disclosure of the information, provided, however, that for any trade secret the obligation of confidentiality will continue and survive until such information is no longer a trade secret under applicable law. Each party shall be liable and responsible for any breach of this paragraph (b) committed by any of such party’s employees, agents, consultants, contractors or representatives.

8.3
Ownership of Customer Data All Customer Data shall be the exclusive and unambiguous property of Customer and shall be considered Confidential Information owned by Customer. Hyland may access Customer Data solely for the purpose of delivering and/or supporting the Services, and such access shall be limited to authorized Hyland personnel. Notwithstanding any other term of this Agreement, Hyland may access and use, and shall retain all right, title and interest in transactional and performance data related to Customer’s use of the Software, which may include aggregated and anonymized Client data, so long as such data does not reveal the identity or traits of any particular individual person or of Customer.

8.4
Export of Customer Data At termination and upon written request of Customer, Hyland shall perform a data export and provide Customer with a copy of Customer Data in an industry standard XML format at no cost to Customer. For the avoidance of doubt, Customer’s Data as referenced in this subsection shall include all available I-9/E-Verify data points in the Software, including (i) all of the information recorded in Sections 1, 2, and 3 of the Form I-9; (ii) electronic signature data, as applicable; (iii) audit trail information which shows the user name, date, and particular action taken when any new electronic I-9 form generated by the Software was created and completed, as well as any time an electronic or migrated I-9 was updated, modified, altered, or corrected; (iv) I-9 supporting documents, as applicable; and (v) E-Verify transaction data and related documents, as applicable.

8.5
Data Security Protection Hyland shall comply with the provisions of the Data Security Requirements attached hereto, and further acknowledges and agrees that the provisions therein shall supplement this Agreement, and shall control over any provisions of this Agreement that are less protective of Customer or less restrictive of Hyland.

9.1
Due Organization Each party represents that it is a business entity duly organized, validly existing, and in good standing in the jurisdiction in which it is incorporated, and that it has the full power and authority to execute and deliver this Agreement and to carry out the transactions contemplated by this Agreement.

9.2
Conflicting Agreements Each party represents and warrants that it has no outstanding agreement or obligation that is in conflict with any of the provisions of this Agreement, or that would preclude it from complying with the provisions hereof.

9.3
Services All Services shall be performed and/or delivered in a professional and workmanlike manner in accordance with generally accepted industry practices. All Hyland personnel shall have the necessary training and expertise and be qualified to provide the Services under this Agreement. Customer must notify Hyland of any breach of this warranty no later than sixty (60) days after Hyland’s completion of the Services detailed in this SOW.

9.4
No Malicious Code Hyland represents and warrants that it has and shall: (a) develop and maintain the Software using secure coding practices, without intentionally, knowingly, or negligently introducing or enabling third parties to introduce any Malicious Code (as herein defined below); (b) scan the Software for Malicious Code using no less than industry standard detection and removal tools and best practices; and (c) notify Customer promptly upon discovering any Malicious Code. Upon discovery by Hyland of such Malicious Code or upon prompt notice by Customer to Hyland of such Malicious Code and Hyland’s confirmation of such Malicious Code, Hyland’s sole obligation and Customer’s sole remedy will be for Hyland to use its commercially reasonable efforts to promptly repair or replace the Software containing the malicious code free-of-charge to Customer. “Malicious Code” means routine, codes or instructions that are designed to permit unauthorized access to or intrusion upon, disabling or disruption of, erasure of or interference with the Software.

9.5
Compliance with Applicable Laws Each party covenants that: (a) subject to Section 6.3, it can and shall comply in all material respects with all applicable laws in exercising its rights and performing its obligations under this Agreement; (b) no notice or charge of non-compliance with any applicable law has been asserted or filed against it that may impair its ability to perform hereunder; and (c) it shall not perform or fail to perform any act that it knows or reasonably should know would place the other party in violation of any applicable law.

9.6
Hyland Compliance with Electronic I-9 Regulations Hyland further represents and warrants that the Software, and each component thereof, has been and shall be designed and maintained to comply with, incorporate, and operate in accordance with the Department of Homeland Security recordkeeping standards for the generation and storage of electronic Forms I-9 at 8 CFR 274a.2(e) and all related sections as amended by 75 FR 42575-42579 (“Electronic I-9 Regulations”), which require the following:

1. Reasonable controls to ensure the integrity, accuracy and reliability of the electronic generation or storage system;
2. Reasonable controls designed to prevent and detect the unauthorized or accidental creation of, addition to, alteration of, deletion of, or deterioration of an electronically completed or stored Form I-9, including the electronic signature if used;
3. An inspection and quality assurance program evidenced by regular evaluations of the electronic generation or storage system, including periodic checks of the electronically stored Form I-9, including the electronic signature if used;
4. A retrieval system that includes an indexing system that permits searches, identification and retrieval for viewing or reproducing of relevant documents and records maintained in the Software;
5. The ability to reproduce legible and readable hardcopies of the Form I-9s;
6. The ability to retrieve and reproduce (including printing copies on paper, if requested) only the Forms I-9 electronically retained in the Software and supporting documentation specifically requested by an agency of the United States, along with associated audit trails;
7. The ability to provide a requesting agency of the United States with the resources (e.g., appropriate hardware and software, personnel and documentation) necessary to locate, retrieve, read, and reproduce (including paper copies) any electronically stored Forms I-9, any supporting documents, and their associated audit trails, reports, and other data used to maintain the authenticity, integrity, and reliability of the records;
8. The ability to provide, if requested, any reasonably available or obtainable electronic summary file(s), such as a spreadsheet, containing all of the information fields on all of the electronically stored Forms I-9 requested by a requesting agency of the United States;
9. Reasonable controls to ensure that (i) only authorized personnel have access to electronic records; (ii) backup and recovery of records is available to protect against information loss, such as power interruptions; (iii) Customer employees are trained to minimize the risk of unauthorized or accidental alteration or erasure of electronic records; and (iv) whenever the electronic record is created, completed, updated, modified, altered, or corrected, a secure and permanent record is created that establishes the date of access, the identity of the individual who accessed the electronic record, and the particular action taken; and
10. Processes to ensure that all electronic signatures conform to the requirements of 8 CFR 274a.2(h) which require the system to (i) affix the electronic signature at the time of the transaction; (ii) create and preserve a record verifying the identity of the person producing the signature; and (iii) upon request of the employee, provide a printed confirmation of the transaction to the person providing the signature.

9.7
Changes in I-9 and E-Verify Requirements Hyland shall update the Software free-of-charge, as reasonably necessary to make the Software comply and remain current with all applicable I-9 and E-Verify requirements.

9.8
Customer Data Customer represents and warrants to Hyland that: (a) Customer is the legal custodian of the Customer Data and it has the right and authority to use the Software and Services in connection with all Customer Data and other materials hereunder; (b) Customer will use reasonable efforts to ensure that any Customer Data submitted to Hyland via electronic media will be free of viruses; and (c) anyone submitting Customer Data to Hyland for use in connection with the Software or Services has the legal authority to do so, either through ownership of the Customer Data or by obtaining appropriate authorizations therefor, and that submission of Customer Data does not violate any contracts, agreements, or any applicable law. Customer is responsible for all Customer Data that is submitted to Hyland for use in connection with the Software and Services.

9.9
Warranty Limitations Hyland’s sole obligation, and Customer’s sole and exclusive remedy, for any non-conformities to the warranties listed under paragraphs 9.3 to 9.7 shall be for Hyland to use commercially reasonable efforts to correct the non-conformity(ies), which may include the delivery of a commercially reasonable workaround for the non-conformity or if Hyland determines that correction of the non-conformity is not commercially practicable, then Customer’s sole and exclusive remedy shall be to terminate the Agreement, in which event Hyland will refund to Customer any prepaid fees for the non-conforming Software and/or Services covering the remainder of the Subscription Term or SOW term. This warranty specifically excludes non-performance issues caused as a result of incorrect data or incorrect procedures used or provided by Customer or a third party or failure of Customer to perform and fulfill its obligations under this Agreement or any non-conformities arising from or related to problems within Customer’s computing environment, including Customer third party software applications, hardware, network or internet connectivity.

9.10
Disclaimer of Other Warranties HYLAND EXPRESSLY DISCLAIMS ALL WARRANTIES OF ANY KIND, NOT EXPRESSLY SET FORTH IN THIS AGREEMENT, WHETHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WARRANTIES OF TITLE, WARRANTIES AGAINST INFRINGEMENT AND THOSE ARISING BY STATUTE OR OTHERWISE IN LAW OR FROM A COURSE OF DEALING OR USAGE OF TRADE. CUSTOMER EXPRESSLY AGREES THAT NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED BY CUSTOMER FROM HYLAND OR THROUGH OR FROM THE SOFTWARE SHALL CREATE ANY WARRANTY NOT EXPRESSLY STATED IN THE SERVICE ORDER AND THAT NO ACCOUNTING, FINANCIAL OR LEGAL ADVICE OR COUNSEL IS GIVEN OR SHALL BE DEEMED TO HAVE BEEN GIVEN BY THE SOFTWARE.

10.1
Software Features Customer acknowledges that its use of the Software is neither contingent upon the delivery of any future functionality or features nor dependent upon any oral or written public comments made by Hyland with respect to future functionality or features. Hyland may change Software features and functionality at any time and from time to time, in conformity with the Agreement. Customer agrees that Hyland shall not be liable to Customer for any reasonable modification or enhancement of the Software that does not materially degrade the Software.

10.2
User Accounts In order to access the Software, User accounts are created and protected by user identifications and passwords. Customer is solely responsible for maintaining confidentiality of user identifications and passwords. Each user identification and password may be used by one person only and may not be shared or used concurrently. If Customer suspects any user identification or password has been stolen or intercepted, Customer agrees to take immediate action to protect the user identification and password, including changing user identifications and passwords and notifying Hyland of such breach of user identification and password security.

10.3
Acceptable Use Policy Customer and its End Users shall at all times adhere to the Hyland Acceptable Use Policy (“AUP”), which each authorized user is required to read and accept upon first use of the Software. The current form of AUP is attached hereto as Schedule D.

10.4
E-Verify Customer acknowledges that in order for Hyland to provide E-Verify access through the Software, Customer must necessarily agree to a Memorandum of Understanding (“MOU”) prescribed by E-Verify, setting forth the terms by which the Department of Homeland Security (“DHS”) will confirm the employment eligibility of newly hired employees following completion and submission of the I-9 through the Software. Customer further agrees that Hyland may operate as the E-Verify Employer Agent of Customer for purposes of providing E-Verify access contemplated herein. Customer is responsible for compliance with provisions of the MOU that are applicable solely to Customer.

10.5
Customer Systems To access and use the Software, authorized users must have a functioning Internet connection and the hardware and software necessary for accessing the Software, including the following supported web browsers: (i) Mozilla Firefox (latest public release plus immediate previous version); (ii) Google Chrome (latest public release plus immediate previous version); (iii) Internet Explorer version 9 or greater not in compatibility mode; or (iv) Apple Safari version 6.1.6 or greater. Hyland acknowledges that Customer may obtain a license for, or use and access of, utilities, databases, software and services offered by thirty party vendors that access or integrate with the Software, including by way of example, new hire employment portals, background check services, drug screening services, payroll services, HRIS systems, and other verification and processing services (“Third Party Offerings”). Customer acknowledges that use of or access to Third Party Offerings will be subject to and in accordance with the terms and conditions established by the vendor(s) of such Third Party Offerings and that Hyland shall have no liability of any kind or nature with respect to Customer’s use of and access to Third Party Offerings.

10.6
Export Regardless of any disclosure made by Customer to Hyland of an ultimate destination of any components of the Software or Services, or related documentation, Customer agrees not to export either directly or indirectly any of the foregoing without first obtaining a license from the United States Government to export or re-export such components or related documentation, as may be required, and to comply with United States Government export regulations, as applicable. Customer agrees that it will not export or re-export any components of the Software or Services or related documentation to a country that is subject to a U.S. embargo (such embargoed countries include, but are not limited to, Cuba, Iran, Iraq, North Korea, Burma (Myanmar), Sudan and Syria) under the U.S. Department of Commerce Export Administration Regulations and U.S. Department of State International Traffic in Arms Regulations. Customer will not export or re-export any components of the Software or Services (or any related documentation) to any prohibited person or entity in violation of U.S. export laws as described above (for more information visit: https://www.bis.doc.gov/complianceandenforcement/liststocheck.htm). Customer shall not use the Software or Services (or any related documentation) for any prohibited end uses under applicable United States laws and regulations, including but not limited to, any application related to, or purposes associated with, nuclear, chemical or biological warfare, missile technology (including unmanned air vehicles), military application or any other use prohibited or restricted under the U.S. Export Administration Regulations (EAR) or any other relevant laws, rules or regulations of the United States of America.

11.1
Intellectual Property Indemnification Hyland shall defend and indemnify Customer, its subsidiaries and affiliates and their respective officers, directors, employees and agents against all liability and expense, including reasonable attorneys’ fees, arising from any third-party action, suit or proceeding (“Claim”) against Customer based upon an allegation that Software either infringes, violates, or misappropriates a patent, copyright, trademark, trade secret or other proprietary right of a reasonably anticipated third party; provided that: (A) Hyland is notified promptly after Customer receives notice of such Claim, (B) Hyland is solely in charge of the defense of and any settlement negotiations with respect to such claim, provided, that Hyland will not settle any claim without the prior written consent of Customer if such settlement contains a stipulation to or admission or acknowledgement of any liability or wrongdoing on the part of or otherwise requires payment by Customer, (C) the Customer does not prejudice Hyland’s defense of such Claim, (D) the Customer gives Hyland all reasonable assistance with and reasonable cooperation in the defense or settlement of such Claim, (E) and has the right, upon either the occurrence of or the likelihood (in the opinion of Hyland) of the occurrence of a finding of infringement or misappropriation, either to procure for Customer the right to continue use of the Software, or to replace the relevant portions of the Software with other equivalent, non-infringing portions. If Hyland is unable to accomplish either of the options set forth in the preceding sentence, Hyland shall terminate this Agreement upon thirty (30) days advance written notice to Customer and refund to Customer any prepaid fees for the Services covering the remainder of the term of the Service Order after the effective date of termination. Notwithstanding the above, Hyland has no obligation to indemnify Customer if the infringement, violation, or misappropriation arises from any of the following: (i) modifications to the Software made by Customer; (ii) Customer’s non-compliance with applicable Software Documentation; (iii) use of the Software for purposes not contemplated by this Agreement or applicable Software Documentation (including distribution to third parties); (iv) Customer’s use or combination of the Software with products, software, or services that are not provided by Hyland; or (v) Customer Data. The foregoing states the entire liability of Hyland to Customer for the infringement of the intellectual property rights of any third party.

11.2
Form I-9 and E-Verify Compliance Indemnification Hyland shall defend, indemnify and hold harmless Customer, its subsidiaries and affiliates and their respective officers, directors, employees and agents from and against all costs, damages, claims and liabilities (including reasonable attorney’s fees) arising out of or related to any Form I-9 fines or penalties imposed by the U.S. Immigration and Customs Enforcement (or successor agency) and paid, even if pursuant to a settlement agreement, by Customer as a direct and sole result of Hyland’s failure to comply with the Electronic I-9 Regulations. Hyland’s obligations under this section shall be limited to no more one million dollars (USD $1,000,000).

11.3
Indemnification of Hyland by Customer Customer shall defend, indemnify and hold harmless Hyland, its licensors and each such party’s parent organizations, subsidiaries, affiliates, officers, directors, employees, successors, attorneys and agents from and against all costs, damages, claims and liabilities (including reasonable attorney’s fees) arising out of or related to any unauthorized, untrained, or improper use of the Services by Customer’s employees or agents, any breach of this Agreement by Customer, or violation of local, state, or federal laws or regulations by Customer’s employees or agents, including those claims, losses, or damages that are a direct or indirect result of Customer’s failure to obtain the advice of legal counsel.

12.1
LIMITATION ON TYPES OF RECOVERABLE DAMAGES IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR ANYONE ELSE FOR ANY CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE OR INDIRECT DAMAGES (INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, GOODWILL, USE, DATA LOSS OR OTHER INTANGIBLE ITEMS SUCH AS BUSINESS INTERUPPTION OR THE COST OF RECOVERING SUCH DATA) EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR LOSSES.

12.2
CAP ON DIRECT DAMAGES EXCEPT FOR A PARTY’S INDEMNIFICATION OBLIGATIONS SPECIFIED ABOVE, OR CUSTOMER’S BREACH OF SECTION 5.3 (“Restricted Use”), OR ANY OTHER LIABILITY WHICH MAY NOT BE EXCLUDED BY LAW, EACH PARTY’S AGGREGATE LIABILITY TO THE OTHER PARTY ARISING UNDER OR IN RELATION TO THIS AGREEMENT, (OTHER THAN CUSTOMER’S OBLIGATION TO PAY FEES) WILL BE LIMITED TO THE AMOUNT CUSTOMER PAID TO HYLAND IN THE TWELVE (12) MONTHS PRECEDING THE DATE THE CLAIM GIVING RISE TO SUCH LIABILITY ARISES.

13.1
Governing Law; Jurisdiction This Agreement and any claim, action, suit, proceeding or dispute arising out of this Agreement shall in all respects be governed by, and interpreted in accordance with, the substantive laws of the State of Ohio (and not by the 1980 United Nations Convention on Contracts for the International Sale of Goods, as amended), without regard to the conflicts of laws provisions thereof. Venue and jurisdiction for any action, suit or proceeding arising out of this Agreement shall vest exclusively in the federal or state courts of general jurisdiction located in Cuyahoga County, Ohio.

13.2
Resolution of Invoice Disputes If Customer believes that an invoice contains an error, then Customer shall, prior to the due date for payment of such invoice, notify Hyland in writing that it disputes all or any portion of an amount invoiced. Any amounts not timely disputed in accordance with the preceding sentence shall be deemed to be undisputed and shall be payable in accordance with Section 6. With respect to any amounts that are timely disputed, both parties will use commercially reasonable efforts to resolve the dispute within thirty (30) calendar days of Hyland’s receipt of the notice. If any amount remains disputed in good faith after such 30-day period, either party may escalate the disputed items to the parties’ respective executive management to attempt to resolve the dispute. The parties agree that at least one of each of their respective executives will meet (which may be by telephone or other similarly effective means of remote communication) within ten (10) calendar days of any such escalation to attempt to resolve the dispute. If the parties are unable to resolve the dispute in accordance herewith, either party thereafter may file litigation in a court of competent jurisdiction under Section 14.1 of this Agreement to seek resolution of the dispute.

14.1
Assignment This Agreement shall be binding upon and shall inure to the benefit of the parties and their respective successors and permitted assigns. Hyland may assign this Agreement or its rights or obligations under this Agreement, in whole or in part, to any other person or entity. Customer may not assign this Agreement or its rights or obligations under this Agreement, in whole or in part, to any other person or entity without the prior written consent of Hyland. Any change in control of Customer resulting from an acquisition, merger or otherwise shall constitute an assignment under the terms of this provision. Any assignment made without compliance with the provisions of this paragraph (a) shall be null and void and of no force or effect.

14.2
Use of Subcontractors Hyland may, in its discretion, engage subcontractors to perform Services under this Agreement, provided that Hyland and such subcontractors are required to comply with the confidentiality and other obligations described herein. Engagement of a subcontractor will not excuse Hyland from any of its obligations under this Agreement, and Hyland will be liable for any breach of this Agreement by its subcontractors.

14.3
Relationship of the parties The parties are independent contractors. Nothing in this Agreement or in the activities contemplated by the parties under this Agreement will be deemed to create an agency, partnership, employment or joint venture relationship between the Parties. Each party will be deemed to be acting solely on its own behalf and has no authority to bind the other to any third party. Hyland will use its sole discretion to determine the manner or method for completing the Services. Nothing herein expressed or implied is intended or shall be construed to confer upon or give to any person or entity, other than the parties hereto, any rights or remedies by reason of this Agreement; provided, however, that third party suppliers of software products bundled with the Software are third party beneficiaries to this Agreement as it applies to their respective software products.

14.4
Counterparts The parties may execute this Agreement in multiple counterparts, each of which constitutes an original, and all of which, collectively, constitute only one agreement. This Agreement may be executed by facsimile or PDF. Said facsimile or PDF shall be deemed an original and fully enforceable and admissible in any legal proceeding. Delivery of an executed counterpart signature page by facsimile or PDF is as effective as executing and delivering this Agreement in the presence of the other parties to this Agreement. This Agreement is effective upon delivery of one executed counterpart from each party to the other party(ies). In proving this Agreement, a party must produce or account only for the executed counterpart of the party to be charged.

14.5
Entire Agreement This Agreement, together with all Schedules, Order Forms, SOWs, and any other documents incorporated herein by reference, constitutes the sole and entire agreement of the parties to this Agreement with respect to the subject matter contained herein, and supersedes all prior and contemporaneous understandings and agreements, both written and oral, with respect to such subject matter. Neither of the parties shall be bound by any conditions, definitions, warranties, understandings or representations with respect to the subject matter other than as expressly provided in this Agreement. This Agreement may only be modified by a written document signed by duly authorized representatives of the parties. This Agreement shall not be supplemented or modified by any course of performance, course of dealing or trade usage. The parties specifically acknowledge and agree that any other terms varying from or adding to the terms of this Agreement, whether contained in any purchase order or other electronic, written or oral communication made from Customer to Hyland are rejected and shall be null and void and of no force or effect, unless expressly agreed to in writing by both parties. Variance from or addition to the terms and conditions of this Agreement in any written notification or documentation, from Customer or otherwise, will be of no effect unless expressly agreed to in writing by both parties.

14.6
Force Majeure No failure, delay or default in performance of any obligation of a party to this Agreement (except the payment of money) shall constitute a default or breach to the extent that such failure to perform, delay or default arises out of a cause, existing or future, beyond the control (including, but not limited to: action or inaction of governmental, civil or military authority; fire; strike, lockout or other labor dispute; flood; war; riot; theft; earthquake; natural disaster or acts of God; national emergencies; unavailability of materials or utilities; sabotage; viruses; or the act, negligence or default of the other party) and without negligence or willful misconduct of the party otherwise chargeable with failure, delay or default. Either party desiring to rely upon any of the foregoing as an excuse for failure, default or delay in performance shall, when the cause arises, give to the other party prompt notice in writing of the facts which constitute such cause; and, when the cause ceases to exist, give prompt notice of that fact to the other party. This paragraph (f) shall in no way limit the right of either party to make any claim against third parties for any damages suffered due to said causes. If any performance date by a party under this Agreement is postponed or extended pursuant to this paragraph (f) for longer than ninety (90) calendar days, the other party, by written notice given during the postponement or extension, and at least thirty (30) days prior to the effective date of termination, may terminate this Agreement.

14.7
Headings and Captions The headings used in this Agreement are for reference and convenience purposes only and shall not in any way limit or affect the meaning or interpretation of any of the terms hereof. All defined terms in this Agreement shall be deemed to refer to the masculine, feminine, neuter, singular or plural, in each instance as the context or particular facts may require. Use of the terms “hereunder,” “herein,” “hereby” and similar terms refer to this Agreement.

14.8
Interpretations The parties agree that the terms and conditions of this Agreement are a result of mutual negotiations. Therefore, the rule of construction that any ambiguity shall apply against the drafter is not applicable and will not apply to this Agreement. Any ambiguities shall be reasonably construed as to its fair meaning and not strictly for or against one party regardless of who authored the ambiguous language. All pronouns and any variations of same shall be deemed to refer to the masculine, feminine, neuter, singular, or plural, as the identity of the person or persons may require

14.9
No Waiver The parties may not waive any provision of this Agreement in whole or in part, except pursuant to a writing executed by both parties. The failure of either party to enforce at any time any of the provisions of this Agreement will not be construed to be a continuing waiver of any provisions hereunder, nor will the failure by either party to strictly enforce any provision of this Agreement prejudice the right of that party to take any action in the future to enforce any provisions hereunder.

14.10
Severability In the event that any term or provision of this Agreement is deemed by a court of competent jurisdiction to be overly broad in scope, duration or area of applicability, the court considering the same will have the power and is hereby authorized and directed to limit such scope, duration or area of applicability, or all of them, so that such term or provision is no longer overly broad and to enforce the same as so limited. Subject to the foregoing sentence, in the event any provision of this Agreement is held to be invalid or unenforceable for any reason, such invalidity or unenforceability will attach only to such provision and will not affect or render invalid or unenforceable any other provision of this Agreement.

14.11
Notices Unless otherwise agreed to by the parties in a writing signed by both parties, all notices required under this Agreement shall be deemed effective when sent and made in writing by either: (a) registered mail, certified mail, return receipt requested, or reputable, national or international overnight courier, in any such case addressed and sent to the address set forth on the latest Order Form or SOW executed by the parties and to the attention of the person executing the Order Form and/or SOW on behalf of that party, or that person’s successor, or to such other address or such other person as the party entitled to receive such notice shall have provided, in writing, to the other party in accordance herewith, or (b) via electronic transmission to hylandcontracts@onbase.com (in the case of Hyland) or to such other address as the party entitled to receive such notice shall have provided, in writing, to the other party in accordance herewith.

14.12
Publicity No press release or public announcement related to the Agreement shall be issued or made without the prior written approval of both parties; provided however, that Customer agrees to serve as reference in Hyland’s proposals to prospective clients for the Software and/or Services after a reasonable period of use of the Services (generally presumed to be 2 to 3 months). Neither party shall acquire a right to use, and may not use without the other party’s prior written consent, the names, characters, artwork, designs, trade names, trademarks or service marks of the other party in any advertising, public announcement, marketing, or press release.

• Web-based electronic interface enables employees and employer representative to electronically complete and store the Form I-9
• Real-time error checking prevents I-9 compliance mistakes or omissions based on the I-9 regulations and current government handbooks (e.g., the “M-274 Handbook for Employers”)
• Prevents duplicate or inaccurate social security numbers (based on SSA’s numbering rules)
• Customizable help-text enables organization to write specific instructions for each field on the Form I-9
• Bilingual English/Spanish view of section 1 of the I-9
• Newly created electronic I-9s will always use the latest version available on the USCIS website
• I-9s cannot be marked “completed” until all errors have been resolved
• Special I-9 rules guide employees who are under the age of 18 (“minors”) and are unable to present an identity document
• Ensures the use of the latest (correct) version of the Form I-9
• Prevents the most common example of over-documentation in section 2 (recording documents in List A, B, and C) while ensuring the document presented corresponds with the employee’s attestation in section 1
• Ability to scan copies of documents used in verification and attach them to the individual employee’s record

Reverifications

• Reverify expiring work authorization documents for certain foreign national employees by completing section 3 or a new I-9
• A Section 3 entry is always completed on the latest version of the Form I-9
• Ability to perform multiple reverifications on each employee when permissible

Electronic Signature

• Section 1 features a proprietary identity-verification based electronic signature methodology which is designed to unequivocally capture the employee’s intent to sign
• Sections 2 and 3 of the I-9 can be signed by the employer representative using a secure password or SSO credentials
• All electronic signatures are captured in the audit trail

E-Verify and FAR Functionality

• Enable E-Verify by location or FEIN
• Data from completed and approved I-9s is electronically submitted to E-Verify and responses are instantly viewable in the Software
• Ability to process an E-Verify mismatch as required under the E-Verify Memorandum of Understanding (MOU), including electronic signature and retention of the TNC notices and letters
• Integrated photo matching tool enables comparison of E-Verify photo with the employee’s ID uploaded to the Software
• Proprietary E-Verify FAR functionality enables covered federal contractor to manage federal contracts in the Software, attach contracts to affected employees, check historical I-9s for E-Verify compatibility, and batch submit through the Software FAR queue.

Dashboard

• Dashboard provides comprehensive view of important I-9 and E-Verify deadlines, based on the user’s permissions
• Available dashboards include pending I-9s, pending reverifications, I-9s needing further action, pending E-Verify actions, I-9s needing approval, and employee counts (among others).
• Pending I-9s feature color-coded compliance visuals based on I-9 compliance deadlines
• Ability to directly access employee, I-9, and E-Verify records (as applicable)

Ability to correct I-9s

• Ability to makes corrections and exemptions to I-9s according to current DHS/ICE standards.
• Option to require all section 1 changes to be made by the employee
• Amended I-9s display corrected data in a different color font, along with user user’s initials and date of correction

Remote Hiring

• Secure login enables new hires to complete Section 1 of the I-9 remotely
• Remote third-party can complete Section 2 of the I-9 through a one-time system access
• Employer can easily review and approve remotely completed I-9s to ensure accuracy

Reports

• Comprehensive list of “canned” reports can be generated by employer representatives
• Reports display records based on user’s permission
• Interactive report features drag/drop functionality, enabling employer to query/view any field on the I-9, employee, or E-Verify record.
• Reports can be saved, re-used, and made public/private
• Ability to graphically report and track the timeliness of all I-9 and E-Verify transactions

Audit Trail
The Software creates a secure and permanent record of every I-9 and E-Verify event which occurs in the system. Specifically, the Software records every time an I-9 is created, completed, updated, modified, altered or corrected with the following corresponding details:

• Ability to graphically report and track the timeliness of all I-9 and E-Verify transactions
• Name of employee/record for which the data was change
• Type of event (i.e. addition, update, etc.)
• Date and time stamp (down to the second)
• Name of the user who made the change
• The button clicked (or action taken to make this record an event)
• The field that was altered
• The old data (if there was any)
• The new data (if any was added)

I-9 Retention

• Detailed and reportable history of I-9 creation
• Calculation of the “purge date” based on 3- and 1-year rule and ability for administrators to purge multiple I-9s
• When deleting purge-eligible records, each I-9’s entire associated history is purged with it.

Product and Industry Updates

• Upcoming I-9 and E-Verify regulatory changes are communicated via a LawLogix blog and email notification to the users
• Links to software-embedded tutorials are included with uploaded system changes

1. UPTIME GUARANTEE
Hyland shall provide the Software to Customer during the term of the Agreement on a twenty-four (24) hours a day, seven (7) days a week basis at an availability of 99% per calendar month (“Monthly Uptime Percentage”), excluding planned maintenance and circumstances beyond the reasonable control of Hyland (as set forth in Section 2.2 below). The Software will be deemed unavailable during such time when the Software, at either the web server, application server, or database server level is not available to Customer as measured by monitoring software running on Hyland’s servers (“Downtime”). For example, Downtime would include instances when Customer is unable to login to the Software or access Customer data stored in the Software.

2. MAINTENANCE AND OTHER EXCEPTIONS TO DOWNTIME

2.1
Planned Maintenance Downtime does not include unavailability of the Software during the planned maintenance window of 10:00pm to 4:00am Arizona Time (“Planned Maintenance”) on a nightly basis. This maintenance may prevent the Software from being accessed or used by Customer during this time period. During each period of Planned Maintenance, any user attempting to access the Software will be notified via an automated status screen in the Software that the Software is unavailable due to maintenance.

2.2
Circumstances Beyond Reasonable Control of Hyland Customer acknowledges and agrees that Hyland will not be responsible for Software unavailability which occurs due to (a) problems associated with Customer’s hardware, software and Customer’s network access or Internet Service Provider; (b) Customer’s use of an operating system, web browser, or third party application which is not supported by Hyland for the Software as specified in Hyland documentation; (c) issues solely associated with third party hosting solutions or services such as the E-Verify system; (d) the flow of data to or from Hyland’s servers and other portions of the Internet which depend on the performance of Internet services provided or controlled by third parties; (e) Force Majeure as defined in the Agreement; and (f) down periods resulting from misuse of the Software by Customer.

3. CALCULATING THE MONTHLY UPTIME PERCENTAGE.
The Monthly Uptime Percentage for the Software will be calculated by the following formula:

4. CREDITS.
Should Hyland fail to meet the 99% Uptime Guarantee, Hyland will credit, upon Customer’s request within thirty (30) days of the end of a calendar month measurement period, Customer’s account an amount equal to a percentage of the total monthly fee paid by Customer as set forth in the table below. Hyland will calculate any service level Downtime using Hyland’s system logs and other records. The credits set forth in this Section 4 are Customer’s exclusive remedy related to Hyland’s guaranteed uptime.

2.1
Support Offered Hyland shall provide phone, on-line, and e-mail customer service support (“Support”) to Premium Users at no charge during the designated customer service hours of 6:30am to 6:00pm (Mountain Standard Time), Monday through Friday excluding federal holidays. At Customer’s request, Hyland shall provide Support to Standard Users or Basic Users for an additional hourly fee as specified in an applicable Service Order.

2.2
Support Requests For any Support requests, Customer should be prepared to provide to Hyland all pertinent information about the request, including but not limited to area of Software involved, specific actions taken by Customer, and a detailed description of the problem or issue. Customer must use reasonable efforts to communicate with Hyland in order to verify the existence of the problem and provide information about the conditions under which the problem could be duplicated.

2.3
Request Tracking Hyland will log every Support request received from Customer, along with actions taken by Hyland to provide a solution, if applicable and available. Hyland will furnish written notice to Customer of bug fixes or enhancements that are sufficiently detailed to permit Customer to determine the impact as soon as the update first becomes available.

2.4
Response Protocol Hyland will use commercially reasonable efforts to respond to Software support requests from Premium Users based on the severity level of the issue (as determined in good faith by Hyland). Hyland does not guarantee resolution times, and a resolution may consist of a fix, workaround, service availability, or other solution to restore functionality. Customer acknowledges and agrees that the response protocol described herein does not apply to general usage questions, documentation errors, issues related to a non-production environment, or feature requests reported by Customer:

2.5
Hyland Response to a Government Audit In the event that Customer reports to Hyland the receipt of a Notice of Inspection (“NOI”) from the U.S. Immigration and Customs Enforcement (or successor agency), Hyland shall make initial contact with Customer within 4 business hours of such report to discuss the NOI and plan for a response. Within 24 hours of receiving all of the necessary information and NOI details from Customer, Hyland shall provide Customer with a customized export of the relevant I-9 records and supporting documents separated by a cover sheet as well as any additional documentation requested by the inspecting government agency (together, “the Audit Files”). Hyland shall deliver the Audit Files to Customer via secure electronic delivery or optional courier service at Customer’s expense. Notwithstanding the above, Customer acknowledges and agrees that the employment eligibility verification obligations of Section 274A(b) of the Immigration and Nationality Act rest exclusively with Customer, and nothing in this Agreement is intended to outsource this responsibility to Hyland.

Hyland shall store and encrypt transaction information encompassing all Personally Identifiable Information on secure computers located in a physically secure data center. Hyland shall employ technology that is consistent with industry standards for firewalls and other security technology to help prevent Hyland’s computers from being accessed by unauthorized persons. In order to protect data integrity during transfers, Hyland shall enforce the use of the HTTPS protocol. In addition, Hyland shall provide the following security measures: SSL 128-bit AES encryption of all data transmitted through the Service; the ability to transfer files via secure FTP, encrypted email, or HTTPS; and magnetic media destruction reformats information or purges information from media according to DOD standards. The software and all Hyland’s equipment shall be continuously monitored (24 hours per day; 7 days per week) by Hyland for health and performance.

2. INFORMATION SECURITY PROGRAM

Hyland shall have a documented comprehensive information security program that complies with applicable privacy and security regulations. Such information security program shall include, without limitation: (i) adequate physical security of all premises in which Personally Identifiable Information will be processed and/or stored; (ii) reasonable precautions taken with respect to the employment of and access given to Hyland personnel, including background checks and security clearances that assign specific access privileges to such personnel; and (iii) an appropriate network security program. Such network security program shall include, without limitation: (a) appropriate access controls and data integrity controls; (b) testing and auditing of all controls; and (c) appropriate corrective action and incident response plans. Hyland shall provide Customer with information regarding the safeguards and related measures upon reasonable request and promptly provide Customer with information, such as SAS70, SSAE16 or other audit reports, regarding any failure of such security measures or any security breach related to Personally Identifiable Information.

3. RISK ASSESSMENT

Hyland will perform ongoing risk assessments to identify, assess, and mitigate reasonably foreseeable internal and external risks to the security, confidentiality and/or integrity of Personally Identifiable Information.

4.1
Hyland shall limit access to Personally Identifiable Information to its personnel and any subcontractors who have a need to access the Personally Identifiable Information as a condition to Hyland’s performance of services under the Agreement.

4.2
Hyland shall utilize the principle of “least privilege” and concept of “minimum necessary” when determining the level of access for all users to Personally Identifiable Information.

4.3
Hyland shall implement policies, procedures and access control mechanisms to protect all Personally Identifiable Information from being accessed by non-authorized users.

4.4
Hyland will require end-user passwords of at least eight (8) characters in length and meet appropriate complexity requirements in accordance with industry standards additionally, accounts will lock out after a maximum of 5 unsuccessful login attempts.

4.5
Hyland will enable Customer to force users to change their passwords after a pre-determined numbers of days.

4.6
Customer may opt to use SureID Secondary Security which enforces a two stage login process for all direct users of the Service

5.1
Hyland will log transactions that affect the security of applications (including but not limited to administrative actions and failed logins.)

5.2
Audit logs shall be maintained for one year and will be reviewed by Hyland on a regular basis.

5.3
The audit logs shall have mechanisms in place to prevent deletion, tampering or substitution.

All of Hyland’s network connections to include wireless connections shall be hardened against intrusion and include firewall protection and intrusion detection in accordance with industry best practices. Hyland shall have monitoring capabilities to ensure that: (i) system weaknesses are detected, (ii) anomalous user activity is recognized, and (iii) Hyland is informed of newly discovered vulnerabilities. Hyland shall perform regular vulnerability scanning, and third party penetration testing.

Hyland agrees that no Personally Identifiable Information will be processed on or transferred to any unencrypted removable or portable media, including but not limited to laptops, PDAs, mobile phones, back-up tapes, or other portable computing device by Hyland. To be considered encrypted a storage medium must have a minimum of one hundred twenty-eight (128) bit encryption.

Hyland agrees that any and all transmission or exchange of Personally Identifiable Information by Hyland will take place using appropriate secure measures. Examples of appropriate secured transmission methods include: VPN, SSL, TLS, and SFTP.

9.1
Hyland will maintain and apply physical security measures and safeguards for the ongoing protection of Personally Identifiable Information whether stored electronically on servers or in hard copy. Hyland has written procedures that set forth the manner in which physical access to Personally Identifiable Information is restricted as well as the manner and location in which such information shall be locked and stored. Secured physical access to all servers and computer production control areas shall be restricted to personnel responsible for the operation and maintenance of the hardware located in those areas.

9.2
Hyland will maintain a documented facility security plan and will conduct periodic reviews of who has access to the facility and secure zones.

Hyland will have a Business Continuity Plan (BCP) in place to resume business operations in the event that an interruption occurs to the business. The BCP should be updated, tested, and reviewed by executive management annually.

Hyland will maintain and follow a disaster recovery plan designed to maintain Customer’s access requirements to the Service and to prevent the unintended destruction of Customer information and data. Such disaster recovery plan, shall provide for daily back-up(s) of Customer information and data and archival of such Customer information and data at a secure facility.

Customer shall have the right to monitor Hyland’s compliance with the terms of this Schedule by inspecting and/or auditing Hyland’s facilities, equipment, and records, provided that Customer provides reasonable notification to Hyland. Any such review shall be conducted at Customer’s sole expense during normal business hours and will not unreasonably interfere with Hyland’s normal conduct of business.

13.1
In the event that Hyland needs to destroy Personally Identifiable Information, Hyland shall do so by means of a technology standard that renders Personally Identifiable Information unusable, unreadable, indecipherable and unrecoverable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute (“ANSI”) and is consistent with guidance issued by the Department of Defense (“DOD”).

13.2
Hyland agrees that upon termination of this Agreement, Hyland will promptly return all Personally Identifiable Information to Customer or destroy all Personally Identifiable Information according to the standards that renders Personally Identifiable Information unusable, unreadable, indecipherable and unrecoverable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by ANSI and is consistent with guidance issued by the DOD. Hyland shall certify in writing to Customer that these actions have been completed within sixty (60) days of the termination of the Agreement. In the event that return or destruction is not feasible, Hyland will continue to extend the requirements of this Schedule to the Personally Identifiable Information and Hyland shall obligate any and all successors and assigns to the obligations of this Schedule.