# Main Service Agreement

Yama Industrials, Inc. - Customer services guidelines, processes & procedures

##

This Main Service Agreement (this "Agreement") is entered into by and between Yama Industrials, Inc., a Wyoming corporation ("Yama"), and the customer identified in the applicable Order Form ("Customer").

By signing an Order Form, Statement of Work, quote, proposal, invoice, credit application, renewal, or other ordering document referencing this Agreement, by providing verbal authorization for Yama to begin work, or by using, receiving, or paying for any Services or Products, Customer agrees to be bound by this Agreement.

> **Terminology Note — Solutions Provider and Service Provider.** Throughout this Agreement, the terms "solutions provider," "service provider," and "technology solutions provider" are used interchangeably and refer solely to Yama in its capacity as a solutions provider that designs, implements, configures, and integrates multi-vendor technology solutions for its customers. The use of any such term in this Agreement does not characterize Yama as a managed service provider (MSP), managed security service provider (MSSP), or any other provider category carrying implied ongoing monitoring, remediation, or duty-of-care obligations beyond those expressly stated in a signed Order Form.

> **Third-Party and Brokered Services Notice:** Where Yama resells, brokers, procures, or arranges any third-party product, service, subscription, license, or platform on Customer's behalf, Yama acts solely as a reseller or intermediary and not as the primary provider or obligor. All such brokered and resold offerings are subject to the applicable third-party vendor's own terms, warranties, and support commitments. Yama makes no warranty and assumes no liability with respect to any third-party or brokered offering except as expressly stated herein. **See Article 21 (Brokered and Resold Third-Party Services)** for the full terms governing such arrangements.

***

### 1. Overview and Agreement Structure

#### 1.1 Master Framework

This Agreement establishes the master terms governing all Services, Products, Deliverables, subscriptions, support, consulting, implementation, advisory work, equipment, software, and other offerings provided by Yama to Customer.

#### 1.2 Incorporated Documents

The following documents are incorporated into and form part of this Agreement, to the extent applicable:

* Any Order Form.
* Any Statement of Work.
* Any Service Level Agreement expressly signed by Yama.
* Any Yama policy published at resources.yamaindustrials.com and expressly incorporated by reference.
* Any written implementation plan, renewal, invoice, or Written Confirmation accepted under this Agreement.
* The Post-Agreement & Ad-Hoc Support Policy, where applicable.

#### 1.3 Broad Definition of Order Form; Acceptance

For purposes of this Agreement, an "Order Form" includes any statement of work, quote, proposal, estimate, invoice, renewal, email authorization, ticket, checkout flow, text message, messaging-platform communication, or other written or electronic authorization requesting, approving, or confirming the provision of Services or Products.

If Customer gives verbal authorization for Yama to begin work, Yama's subsequent commencement of work constitutes conclusive evidence of Customer's authorization for the requested work and strong evidence of Customer's acceptance of this Agreement. A reference to, or link to, this Agreement included on any invoice, estimate, proposal, ticket, or other documentation delivered to Customer in connection with the Services constitutes sufficient notice of this Agreement's terms.

All Services performed are subject to the fees, payment terms, and incorporated policies of this Agreement, regardless of whether every applicable fee is itemized in the initial Order Form.

#### 1.4 Order of Precedence

In the event of any conflict among the documents comprising this Agreement, the following order of precedence applies unless a later document expressly overrides a specific provision of an earlier document in a writing signed by an authorized officer of Yama:

1. Article 8 (Fees, Billing, and Payment).
2. Article 15 (Limitation of Liability).
3. Article 18 (Dispute Resolution).
4. This Agreement.
5. Incorporated Yama policies.
6. The applicable Order Form.
7. The applicable Statement of Work.
8. Any Customer purchase order, procurement portal term, click-through term, vendor onboarding term, or other Customer paper.

Any Customer term that is additional to, inconsistent with, or different from this Agreement is rejected and shall have no force or effect unless expressly accepted in a signed writing by an authorized officer of Yama.

#### 1.5 No Reliance on Customer Internal Processes

Customer's internal purchasing, vendor onboarding, invoice-routing, budgeting, approval, accounting, compliance, payment, or purchase-order procedures do not modify or defer Customer's obligations under this Agreement unless expressly agreed in a signed writing by an authorized officer of Yama.

#### 1.6 Service Changes

Yama reserves the right to modify, suspend, or discontinue any Service or Product at any time, with or without notice, in its discretion, subject only to any non-waivable commitment expressly stated in a signed Order Form.

***

### 2. Definitions

For purposes of this Agreement:

**"Ad-Hoc Services"** means ad hoc, emergency, reactive, supplemental, out-of-scope, break-fix, time-and-materials, or similar services requested by Customer outside the fixed scope of an active subscription, SOW, or managed service commitment.

**"Affiliate"** means any entity that directly or indirectly controls, is controlled by, or is under common control with a party.

**"Confidential Information"** means non-public technical, business, financial, legal, operational, security, customer, personnel, or commercial information disclosed by one party to the other in any form that is designated as confidential or that reasonably should be understood to be confidential.

**"Customer Data"** means all data, files, content, records, credentials, configurations, information, and materials submitted, uploaded, transmitted, stored, processed, or otherwise made available by or on behalf of Customer in connection with the Services.

**"Customer Equipment"** means all hardware, software, systems, accounts, facilities, platforms, networks, licenses, and third-party environments owned, leased, licensed, or controlled by Customer.

**"Deliverables"** means specific work product expressly identified in an applicable Order Form or Statement of Work as deliverable by Yama to Customer.

**"Documentation"** means Yama's standard user manuals, setup guides, technical instructions, onboarding materials, and related written materials, if any, provided by Yama in connection with the Services or Products.

**"Micro-SOW"** means a binding mini statement of work formed pursuant to a Written Confirmation under Section 4.2.

**"Order Form"** has the meaning set forth in Section 1.3.

**"Products"** means any hardware, software, appliances, subscriptions, licenses, platforms, tools, or other items sold, licensed, leased, rented, provisioned, or supplied by Yama.

**"Services"** means all services provided by Yama, including support, managed services, implementation, consulting, advisory, installation, monitoring, remediation, training, cybersecurity, hosted services, and related professional services.

**"Statement of Work"** or **"SOW"** means a written scope document, project schedule, or similar document describing specific Services, Deliverables, assumptions, pricing, milestones, or responsibilities.

**"Written Confirmation"** means a written confirmation by Yama of Ad-Hoc Services or scope modifications, including via email, SMS, ticketing system, messaging platform, direct message, or other written communication channel.

**"Yama Equipment"** means any hardware, devices, appliances, software agents, access methods, credentials, subscriptions, or other items provided, deployed, leased, rented, licensed, or controlled by Yama in connection with the Services, excluding Customer Equipment.

**"Yama Materials"** means the Services, Deliverables, Documentation, reports, templates, software, scripts, workflows, methods, tools, know-how, and other materials provided or made available by Yama.

***

### 3. Orders, Scope, Renewals, and Ad-Hoc Status

#### 3.1 Orders and SOWs

Yama will provide Services and Products as described in one or more Order Forms or SOWs. Each Order Form or SOW is incorporated into this Agreement upon execution, electronic acceptance, email confirmation, payment, or other authorization accepted by Yama.

#### 3.2 Service Terms

Services may be provided on a term basis, subscription basis, ad-hoc basis, project basis, prepaid basis, or time-and-materials basis, as specified in the applicable Order Form or invoice.

#### 3.3 Renewals

If an Order Form provides for an initial term, renewal term, or automatic renewal, such terms govern unless otherwise stated in that Order Form.

If Customer renews or continues Services after expiration of a prior term, the renewal may be documented through a new Order Form, amendment, email confirmation, invoice payment, or other authorization accepted by Yama. Any renewal incorporates the then-current version of this Agreement and incorporated policies published at resources.yamaindustrials.com at the time of renewal.

#### 3.4 Courtesy Expiration Notice

Yama may provide Customer with advance notice of an upcoming service expiration as a courtesy. Failure to provide any reminder does not extend any service term, does not create liability for Yama, and does not prevent expiration, non-renewal, or transition to Ad-Hoc Support Status. Customer is solely responsible for monitoring its service expiration dates and timely communicating renewal decisions.

#### 3.5 Transition to Ad-Hoc Support Status

At the end of an applicable service term, or upon termination of subscription-based Services, Services may automatically transition to Ad-Hoc Support Status under Yama's then-current Post-Agreement & Ad-Hoc Support Policy unless Customer renews under a new service commitment.

Upon transition to Ad-Hoc Support Status, all proactive monitoring, patching, optimization, included support, warranty coordination, and similar subscription-based services cease immediately, and any further work is reactive, discretionary, and billable at Yama's then-current rates.

#### 3.6 No Obligation to Continue Ad-Hoc Support

Yama may discontinue, decline, terminate, or disengage Ad-Hoc Support Status at any time, in its discretion, including for nonpayment, inactivity, operational reasons, risk reduction, unsupported environments, or legacy-system concerns. Retention of credentials or prior administrative access does not create any implied service agreement or ongoing duty to provide support.

***

### 4. Ad-Hoc Services, Change Orders, and Acceptance

#### 4.1 Deemed Acceptance of Deliverables

Customer shall review each Deliverable promptly upon delivery. If Customer does not reject a Deliverable in writing within ten (10) business days after delivery, with reasonable detail describing the specific nonconformity, the Deliverable shall be deemed accepted.

Any use of a Deliverable in production, operational reliance on a Deliverable, payment of an invoice covering the Deliverable, failure to timely identify a material nonconformity, or direction to proceed to the next phase of work constitutes final and irrevocable acceptance of that Deliverable.

#### 4.2 Ad-Hoc Services and Micro-SOWs

Customer may request Ad-Hoc Services. Yama may confirm such Ad-Hoc Services through a Written Confirmation, including by email, SMS, ticket, or other written electronic communication. A Written Confirmation becomes a binding Micro-SOW upon the earliest of: (a) Customer's written approval; (b) Customer's direction that Yama proceed; (c) Customer's provision of access, scheduling, credentials, or other cooperation reasonably necessary for Yama to begin the requested work; or (d) Customer's knowing acceptance of the benefit of the Ad-Hoc Services.

Each Written Confirmation shall state the applicable rate, fixed fee, estimate, pricing basis, or an express incorporation of Yama's then-current rate card or price sheet. If a Written Confirmation does not state a specific rate or fixed fee, the applicable pricing basis shall be Yama's then-current rate card or price sheet for the requested work, which shall constitute the agreed rate for purposes of this Agreement, including Section 8.9. All Ad-Hoc Services are billable at the pricing stated in, or incorporated by, the applicable Written Confirmation unless otherwise expressly stated in a signed writing by Yama.

#### 4.3 Change Orders

Any request by Customer to modify the scope, timing, assumptions, site conditions, service levels, Deliverables, integrations, equipment, dependencies, or work sequence of existing Services may be treated by Yama as a change order and may result in revised pricing, revised milestones, additional fees, or a revised Order Form, SOW, or Micro-SOW.

Yama has no obligation to perform out-of-scope work unless and until it elects to do so.

#### 4.4 On-Site and Apparent Authority

Customer represents and warrants that any of its owners, officers, employees, agents, representatives, project managers, IT personnel, facilities personnel, dispatchers, or on-site contacts who request, approve, authorize, direct, or permit Ad-Hoc Services, emergency work, on-site work, or scope changes have full authority to bind Customer with respect to such request, authorization, or direction.

Customer assumes all risk of internal miscommunication, lack of internal approval, or alleged lack of authority of its personnel, and Customer waives any defense based on a claim that Yama relied on instructions from the wrong Customer representative. Nothing in this Section limits any defense based on Yama's actual knowledge of fraud or forgery by a purported Customer representative.

#### 4.5 No Implied Free Work

Yama's performance of Ad-Hoc Services, diagnostics, emergency response, field dispatch, temporary remediation, courtesy review, or service restoration does not imply that such work is included within any subscription fee, fixed fee, recurring fee, or prior scope commitment unless expressly stated in a signed writing by Yama.

***

### 5. Services and Service Levels

#### 5.1 Service Standard

Yama will perform the Services in a professional and workmanlike manner using commercially reasonable efforts consistent with ordinary industry practice for similar services.

#### 5.2 Estimates Only

Any implementation schedule, completion date, milestone, delivery estimate, response estimate, or project timeline is an estimate only unless expressly stated to be binding in a signed Order Form.

#### 5.3 Implementation and Configuration

Yama will supply, configure, implement, or deploy the Products and Services in accordance with the applicable Order Form, subject to Customer cooperation, site readiness, external dependencies, third-party availability, and commercially reasonable implementation assumptions.

#### 5.4 No Service Level Guarantee Absent SLA

Service level commitments, if any, are defined only in a separate signed Service Level Agreement or signed Order Form. In the absence of a specific signed service level commitment, no uptime guarantee, response commitment, restoration commitment, service credit obligation, or other service-level remedy applies.

#### 5.5 Service Changes

Yama may modify, suspend, replace, discontinue, or otherwise change any Service, Product, feature, functionality, method, tool, platform, integration, support model, or technical requirement at any time, in whole or in part, with or without notice, in its discretion. Without limiting the foregoing, Yama may make immediate changes where reasonably necessary for security, legal, regulatory, vendor, technical, operational, supportability, or business reasons.

If Yama determines that a change materially affects the scope, technical requirements, support model, or economics of continuing Services for Customer, Yama may revise the applicable service model, requirements, delivery assumptions, implementation approach, or technical dependencies by notice to Customer. Any pricing change arising from any such Service change shall be governed exclusively by Section 8.13, and Customer's continued use of the affected Services after the effective date of a Service change constitutes acceptance of the Service change, but not of any pricing change except as expressly provided in Section 8.13, subject in all cases to any non-waivable commitment expressly stated in a signed Order Form.

#### 5.6 Geographic Limitations; Relocation

Yama's onsite obligations, dispatch commitments, response estimates, and location-dependent Services apply only within Yama's then-current service areas and only for the sites, assets, and environments identified in the applicable Order Form, SOW, invoice, or service records.

If Customer relocates any covered site, system, equipment, or environment, or if Customer's actual site details, configuration details, access constraints, or geographic location differ from Yama's service records, Yama may requalify the affected Services, revise response times, revise pricing, impose travel or recertification charges, require inspection, limit service methods to remote or depot-style support, or decline to provide onsite Services until Yama confirms continued supportability.

Yama is not liable for any delay, unavailability, degraded performance, or failure to meet any estimate or service level resulting from Customer relocation, inaccurate site information, or conditions outside Yama's applicable service area.

***

### 6. Customer Responsibilities

Customer shall:

* Provide accurate, complete, current, and timely information reasonably required for Yama to perform.
* Provide timely access to facilities, systems, networks, platforms, accounts, environments, credentials, and personnel.
* Obtain and maintain all rights, licenses, approvals, and permissions necessary for Yama to access Customer systems and Customer Data.
* Cooperate in good faith and timely make decisions, approvals, elections, and designations.
* Use the Services and Products only for lawful business purposes and in accordance with this Agreement.
* Notify Yama promptly of issues, changes, incidents, risks, or conditions that may affect the Services.
* Monitor expiration dates, licensing requirements, renewal windows, and service transitions.
* Maintain backups, business continuity procedures, disaster recovery measures, cybersecurity controls, and regulatory compliance unless expressly assumed by Yama in a signed Order Form.
* Validate outputs, reports, configurations, and Deliverables before relying on them operationally.
* Provide safe, sufficient, and timely access to Customer facilities, workspaces, power, connectivity, environmental conditions, accurate addresses, loading access, site escorts, and authorized contact personnel reasonably necessary for Yama to perform onsite or location-dependent Services.
* Ensure that work areas are reasonably safe, compliant, and ready for service, and that any required permits, landlord approvals, shutdown windows, and site prerequisites are timely obtained at Customer's expense unless expressly assumed by Yama in a signed writing.

If Yama personnel are unable to perform Services, are materially delayed, or incur additional time or expense due to Customer's act or omission, inaccurate site information, denied or delayed access, unsafe conditions, lack of site readiness, unavailable Customer personnel, missing approvals, incorrect shipping information, "no fault found" determinations, or issues caused by Customer Equipment or third-party environments, then all resulting time and expense are billable and Yama may charge abortive-visit, rescheduling, waiting-time, diagnostics, and no-fault-found fees at Yama's then-current rates.

Customer is responsible for all use of the Services through Customer-controlled accounts, systems, or credentials by Customer or its employees, contractors, agents, and representatives, and for unauthorized use resulting from Customer's failure to maintain reasonable security or administrative control over such access.

***

### 7. Equipment, Access, and Third-Party Dependencies

#### 7.1 Customer Equipment

Customer is solely responsible for all Customer Equipment, including maintenance, support, configuration, compatibility, licensing, lawful use, security, and backups.

Yama disclaims any warranty, maintenance, repair, support, or compatibility obligation for Customer Equipment unless expressly stated in a signed Order Form.

Yama is not responsible for delay, outage, degradation, incompatibility, re-work, or failure caused by Customer Equipment malfunction, configuration errors, incompatibility, end-of-life status, unsupported status, or third-party environment issues. Any delays, additional labor, or re-work caused by Customer Equipment issues are billable.

#### 7.2 Yama Equipment

All Yama Equipment remains the sole and exclusive property of Yama or its licensors unless expressly sold in a signed Order Form.

Customer receives only a limited, revocable, non-exclusive, non-transferable right to use Yama Equipment during the applicable service term solely as necessary to receive the Services.

#### 7.3 Return of Yama Equipment

Upon expiration, termination, replacement, or Yama's written demand, Customer shall, at Customer's sole cost and expense, deinstall if requested by Yama, package, protect, and return all Yama Equipment in good working condition, ordinary wear and tear excepted, to the location designated by Yama, within fifteen (15) business days of the date of expiration, termination, or replacement, or within fifteen (15) calendar days of Yama's written demand, whichever is earlier.

If Customer fails to timely return Yama Equipment as required under this Section, Yama may invoice Customer for the full replacement value of the equipment, together with all shipping, handling, deinstallation, recovery, testing, refurbishment, disposition, and related expenses.

#### 7.4 Recovery Rights; Continued Charges

**Access and Recovery.** Customer shall provide Yama and its designees reasonable access during normal business hours, or at such other times as reasonably necessary, to inspect, deinstall, recover, replace, service, or repossess Yama Equipment. If Customer fails to return Yama Equipment when required, fails to provide access for recovery, relocates Yama Equipment without Yama's prior written consent, or otherwise interferes with Yama's rights in Yama Equipment, Yama may exercise any lawful remedy available to recover such equipment or its value, including self-help where permitted by applicable law, replevin, injunctive relief, or other judicial or administrative process.

**Late Return Fee.** Without limiting Yama's right to invoice for full replacement value under Section 7.3, if Customer fails to return Yama Equipment by the applicable deadline under Section 7.3 and subsequently returns such equipment after that deadline, Customer shall pay Yama a late return fee equal to one and one-half times (1.5x) the pro-rated daily rental, subscription, or management fee applicable to such equipment as set forth in the applicable Order Form, or if no such rate is specified, as reasonably determined by Yama based on the then-current fair market daily rental value of comparable equipment (the "Late Return Fee"), for each calendar day from the first day following the missed deadline through and including the date Yama physically receives the equipment in the condition required by Section 7.3. The Late Return Fee accrues automatically and without further notice. The parties acknowledge that the Late Return Fee represents a reasonable estimate of Yama's damages arising from the unauthorized continued possession of its equipment, including lost redeployment opportunity and carrying costs, and constitutes liquidated damages and not a penalty. Payment of the Late Return Fee does not preclude Yama from invoking the replacement-value remedy under Section 7.3 if the returned equipment fails to meet the condition standard set forth therein.

**Continued Charges.** Any recurring charges, rental charges, subscription charges, management charges, monitoring charges, or other equipment-related fees associated with Yama Equipment continue to accrue until the earliest of: (a) Yama's actual receipt of the returned equipment; (b) Yama's written confirmation that the equipment is no longer recoverable and replacement-value charges under Section 7.3 have been paid in full; or (c) Yama's written release of such charges; provided, however, that to the extent the Late Return Fee accrues for any calendar day, any recurring rental, subscription, or management charges for the same equipment and same calendar day that form the basis of the Late Return Fee are included within, and not in addition to, the Late Return Fee, and any such overlapping charges invoiced separately shall be credited against the Late Return Fee.

**No Double Recovery.** Yama's remedies under Section 7.3 and this Section 7.4 are cumulative and in addition to any other remedies available at law or in equity; provided, however, that (i) any Late Return Fees paid by Customer shall be credited against any replacement-value invoice subsequently elected by Yama under Section 7.3, and (ii) Yama shall not recover duplicative compensation for the same calendar day of non-return under the Late Return Fee, overlapping Continued Charges, and the replacement-value remedy.

#### 7.5 Administrative Access

Where technically necessary, Yama may retain administrative credentials or access methods for devices or systems under its management. Following expiration, termination, or transition to Ad-Hoc Support Status, such access may be retained solely for client-initiated billable support, security disengagement, or administrative transition, and shall not be construed as proactive monitoring, ongoing support, or an implied service obligation.

#### 7.6 Third-Party Products and Services

Yama may resell, recommend, configure, or integrate third-party products or services. All such third-party items are subject to the third party's own terms, policies, warranties, and support commitments.

Yama makes no warranty regarding third-party products or services and is not liable for defects, outages, vulnerabilities, delays, incompatibilities, or failures attributable to third parties.

***

### 8. Fees, Billing, and Payment

#### 8.1 Fees

Customer shall pay all fees, charges, expenses, taxes, and other amounts stated in the applicable Order Form, invoice, billing communication, Micro-SOW, or other authorization accepted by Yama.

#### 8.2 Payment Terms

Unless otherwise stated in the applicable Order Form, all invoices are due within seven (7) days after the invoice date. Invoices may be delivered electronically to the email address designated by Customer.

#### 8.3 No Setoff or Withholding

All amounts owed to Yama are payable without setoff, recoupment, deduction, counterclaim, withholding, or reduction of any kind except to the extent required by non-waivable law.

#### 8.4 Late Charges

All unpaid amounts accrue simple interest at the rate of one and one-half percent (1.5%) per month, or the maximum lawful rate permitted by applicable law for the applicable Customer entity type, whichever is less.

Notwithstanding the foregoing, if Customer is a natural person, sole proprietorship, general partnership, or other entity type as to which a lower rate is required by applicable law, the applicable interest rate shall not exceed the maximum lawful rate permitted for such Customer entity type.

#### 8.5 Collection Costs and Legal Fees

Customer shall reimburse Yama for all costs of collection and recovery, including court costs, filing fees, reasonable attorneys' fees, expert fees, skip-tracing costs, administrative charges, and related recovery expenses, to the fullest extent permitted by applicable law.

#### 8.6 Dishonored Payments; Chargebacks; Collection Costs

If any check, ACH, wire, credit card payment, debit card payment, or other payment instrument tendered by Customer is returned, reversed, rejected, declined, charged back, or dishonored for any reason, Customer shall pay Yama, in addition to the underlying amount due, a returned-payment fee of thirty dollars ($30.00) per item or the maximum amount permitted by applicable law, whichever is less.

If any delinquent amount is referred to a collection agency or other collections provider, Customer shall reimburse Yama for all resulting collection costs, including any contingent or fixed collection-agency compensation, in an amount not to exceed thirty percent (30%) of the delinquent amount, to the fullest extent permitted by applicable law.

If the same delinquent amount is thereafter, or simultaneously, referred to legal counsel, pursued in arbitration, litigation, or other formal recovery proceedings, or collected through a collection agency that retains or works with legal counsel, Customer shall also reimburse Yama for all additional court costs, filing fees, and reasonable attorneys' fees and expenses actually incurred in collecting the delinquent amount, to the fullest extent permitted by applicable law.

For the avoidance of doubt, collection-agency compensation and attorneys' fees, court costs, filing fees, and other legal recovery expenses are cumulative and separately recoverable to the extent actually incurred by Yama; provided, however, that the thirty percent (30%) cap applies only to collection-agency compensation and does not limit separately recoverable attorneys' fees, court costs, filing fees, or other legal expenses. Yama shall not recover both collection-agency compensation and attorneys' fees to the extent they compensate Yama for the same services performed by the same provider.

Customer acknowledges and agrees that this Agreement is a commercial contract entered into solely for business purposes and not for personal, family, or household purposes.

#### 8.7 Suspension for Nonpayment

Yama may suspend, restrict, or disable some or all Services immediately if Customer fails to pay any amount when due. Suspension does not relieve Customer of payment obligations and does not waive Yama's right to terminate, accelerate charges, assess an early termination charge where permitted, or pursue collections.

If Customer fails to pay invoices or does not renew at the end of a service term, Yama may automatically transition the account to Ad-Hoc Support Status or may instead fully disengage the account, in either case without waiving any payment or collection rights.

#### 8.8 No Refunds

All fees paid are non-refundable except as expressly stated in a signed Service Level Agreement, signed Order Form, or to the extent required by non-waivable law.

#### 8.9 Billing Disputes; Dispute Window; Form Requirements

**Dispute Window.** Customer must notify Yama in writing of any billing dispute within the later of: (a) thirty (30) days after the invoice date; or (b) fifteen (15) days after the date on which the Services, work, or Deliverables to which the invoice relates were completed, delivered, or accepted under Section 4.1 (the "Dispute Window"). Failure to submit a conforming billing dispute notice within the Dispute Window constitutes a waiver of any right to dispute the invoice or any portion thereof as a billing dispute, except to the extent prohibited by non-waivable law.

**Form of Dispute Notice.** A billing dispute is validly initiated only if submitted in one of the following two forms, and no other form shall be recognized or given legal effect for purposes of invoking this Section 8.9: (a) a written email sent directly to Yama's designated billing contact email address as stated on the applicable invoice, transmitted from an email address belonging to an authorized representative of Customer as identified in Yama's account records; or (b) a written letter sent by certified mail, return receipt requested, to Yama's designated notice address as stated on the applicable invoice or pursuant to Section 20.4.

**Excluded Channels.** The following shall not constitute a valid billing dispute notice and shall not toll any deadline, extend any payment obligation, or preserve any billing-dispute right, regardless of content or timing: verbal communications of any kind, including in-person, by telephone, or by voicemail; SMS, text message, instant message, chat, or messaging platform communications of any kind; communications submitted through any ticketing system, support portal, or helpdesk channel; communications made in passing, incidentally, or as part of a broader service or support conversation; communications made by any person not expressly authorized in Yama's account records to bind Customer on billing matters; and any communication that does not expressly state (i) the specific invoice number being disputed, (ii) the specific line item or dollar amount disputed, (iii) the precise arithmetic, clerical, or rate/quantity discrepancy alleged, and (iv) the amount Customer contends is correctly owed.

**Scope of Valid Disputes.** Billing disputes are limited solely to demonstrable arithmetic or clerical errors in the amount invoiced, or demonstrable discrepancies between the invoiced rate or quantity and the rate or quantity expressly stated in, or expressly incorporated by rate card or price sheet into, the applicable Order Form, SOW, Micro-SOW, Written Confirmation, renewal, or other written pricing communication issued by Yama. Billing disputes do not include the quality, sufficiency, outcome, or performance of any Services or Deliverables; whether work was necessary, appropriate, or effective; invoice format, invoice detail, billing presentation, or billing methodology; internal approval workflows, vendor onboarding status, or missing purchase-order numbers; demands for hourly, time-entry, or task-level breakdowns not expressly required by the applicable Order Form; or any other administrative, procedural, or subjective matter. For the avoidance of doubt, this Section 8.9 limits only what constitutes a billing dispute and does not eliminate a separate warranty claim properly asserted under Article 14 or any other non-billing claim otherwise permitted under this Agreement.

**Work Acceptance Precludes Re-Opening.** Customer's acceptance of any Deliverable or Services under Section 4.1 — whether express or deemed — constitutes final acceptance of the work performed and the obligation to pay the corresponding fees as invoiced, subject only to a valid billing dispute under this Section 8.9 or a separate claim expressly permitted elsewhere in this Agreement. A billing dispute submitted after deemed acceptance under Section 4.1 is limited exclusively to arithmetic, clerical, or rate/quantity discrepancies as described above and may not be used to re-open, relitigate, recharacterize, or otherwise challenge any aspect of the accepted work, scope, methodology, outcome, or pricing basis other than the specific discrepancy asserted.

**Payment Obligation Unaffected.** Customer must pay the full invoice amount by the due date, including any disputed amount. Submission of a purported billing dispute does not suspend, delay, reduce, or otherwise affect Customer's obligation to pay. If Yama determines that Customer is entitled to an adjustment, Yama may issue a credit memo, service credit, or refund at Yama's sole election.

#### 8.10 Determination of Invalid Billing Disputes; Referral to Collections

Yama may determine, acting reasonably and in good faith, whether any Customer communication constitutes a valid billing dispute under Section 8.9 for purposes of internal billing administration and collections handling. Any such determination by Yama is not conclusive in any court, arbitration, or other formal proceeding, and a good-faith Dispute Notice asserting a non-billing claim shall not fail solely because the same communication also references an amount that Yama contends is not a valid billing dispute under Section 8.9.

If Customer fails to pay any amount when due and Yama determines that the asserted dispute is not a valid billing dispute under this Agreement, Yama may, without further obligation to continue internal billing review, declare the amount immediately delinquent, suspend or terminate Services, revoke any conditional license or access rights, accelerate any available remedies, and refer the account to a collection agency, collections provider, or legal counsel.

For the avoidance of doubt, any amount subject only to an invalid billing dispute shall be treated as unpaid and overdue for all purposes under this Agreement, including interest accrual, suspension, termination, collections activity, recovery of collection costs, and recovery of attorneys' fees and expenses.

#### 8.11 Bankruptcy Preference Intent; Contemporaneous Exchange for New Value

To the extent any payment by Customer corresponds to Services, Products, Deliverables, equipment, software, access, support, labor, provisioning, goods, or other value provided contemporaneously or substantially contemporaneously by Yama, the parties intend such payment to constitute a contemporaneous exchange for new value within the meaning of 11 U.S.C. § 547(c)(1).

The parties further acknowledge and agree that Yama provides new value through, among other things, services, labor, access, provisioning, support, Deliverables, goods, software, equipment, and other value furnished to Customer in connection with this Agreement.

Nothing in this Section limits Yama's right to apply payments to outstanding amounts owed by Customer, invoice in arrears, require advance payment, require deposits, suspend Services for nonpayment, or rely on any other defense, offset, or protection available under applicable law, including ordinary-course-of-business and subsequent-new-value defenses, to the fullest extent permitted by law.

#### 8.12 Conditional Suspension and Revocation of Licensed Rights for Nonpayment

Any license, access right, or use right granted by Yama under this Agreement or any Order Form with respect to Deliverables, Documentation, reports, software, scripts, templates, portals, dashboards, hosted environments, subscriptions, or other Yama Materials is expressly conditioned on Customer's timely payment of all amounts due under this Agreement.

If Customer fails to pay any invoice or other amount when due, Yama may, in addition to any other rights or remedies, immediately suspend, restrict, or revoke some or all such license, access, or use rights, in whole or in part, until all delinquent amounts, applicable interest, and recovery costs are paid in full or until Yama otherwise elects in writing to reinstate such rights.

Upon any such suspension or revocation, Customer shall immediately cease the affected use, access, copying, distribution, deployment, display, and exploitation of the affected Yama Materials and shall, upon Yama's request, certify in writing compliance with this Section.

#### 8.13 Price Adjustments; Price Sheets; Pass-Throughs; Market and Regulatory Changes

Unless expressly stated otherwise in a signed Order Form, quoted pricing, recurring service pricing, and standard rate-sheet pricing for a committed service term shall remain fixed during that committed term. Standard annual price increases for recurring Services, including without limitation managed services, firewall services, support plans, monitoring, licensing renewals, and similar recurring offerings, may be implemented only upon renewal or the start of a new service term through a renewal quote, renewal invoice, written price sheet, or other written pricing communication issued by Yama. Customer acknowledges that Yama may maintain and update standard price sheets, rate cards, and pricing guides from time to time, and that such updated pricing shall apply to renewals, new Orders, Ad-Hoc Services, out-of-scope work, and any Services not subject to a then-current fixed committed term.

Notwithstanding the foregoing, Yama may adjust pricing during a current term upon written notice to Customer to reflect: (a) Customer-requested scope changes; (b) inaccurate assumptions, site-condition differences, customer-caused delays, denied access, unavailable personnel, incorrect information, unsafe conditions, or other Customer-caused cost increases; (c) documented increases imposed on Yama by third-party vendors, licensors, carriers, utilities, distributors, manufacturers, or cloud providers; (d) sudden, material, or extraordinary increases in hardware, component, freight, fuel, cloud, power, cooling, labor, insurance, tariff, duty, sanction, compliance, cybersecurity, or regulatory costs that materially affect Yama's cost of service delivery; or (e) governmental prohibitions, import restrictions, export controls, equipment bans, authorization withdrawals, sanctions measures, or other regulatory events affecting the procurement, deployment, replacement, or continued use of technology used in the Services.

If an increase described in clause (c), (d), or (e) is imposed on Yama without advance notice, Yama may implement the corresponding adjustment effective upon the date such increase takes effect for Yama or as soon thereafter as commercially practicable, and any otherwise applicable advance notice period shall not apply. Upon written request, Yama shall provide reasonable supporting documentation for any such mid-term adjustment.

Customer's continued use of the affected Services after the effective date of any permitted adjustment under this Section constitutes acceptance of the adjusted pricing. Verbal discussions regarding renewal or pricing are non-binding and for business convenience only; only pricing stated in a written quote, invoice, price sheet, Order Form, Written Confirmation, or other written pricing communication issued by Yama shall have contractual effect.

For the avoidance of doubt, nothing in this Section limits Yama's right to charge then-current rates for Ad-Hoc Services, out-of-scope work, emergency work, or any Services performed after expiration, termination, non-renewal, or transition to Ad-Hoc Support Status.

***

### 9. Intellectual Property and Use Rights

All Yama Materials, including without limitation any software, scripts, templates, tools, methods, processes, documentation, reports, dashboards, and other deliverables created, developed, or provided by Yama, are and shall remain the sole and exclusive property of Yama or its licensors.

No title to or ownership of any Yama Materials is transferred to Customer under this Agreement or any Order Form. Customer receives only the limited use right expressly granted in the applicable Order Form or this Agreement, which is non-exclusive, non-transferable, non-sublicensable, revocable, and limited to Customer's internal business use during the applicable service term.

Customer shall not reverse engineer, decompile, disassemble, copy, reproduce, distribute, modify, create derivative works of, sublicense, sell, resell, assign, or transfer any Yama Materials except as expressly permitted in a signed writing by Yama.

Customer retains all rights to Customer Data. Customer grants Yama a limited, non-exclusive, royalty-free license to access, use, process, and store Customer Data solely as necessary to perform the Services and fulfill Yama's obligations under this Agreement.

***

### 10. Confidentiality and Data Handling

Each party shall hold the other party's Confidential Information in strict confidence using at least the same degree of care it uses to protect its own confidential information of a similar nature, but in no event less than reasonable care.

Neither party shall disclose the other party's Confidential Information to any third party without the disclosing party's prior written consent, except to its employees, contractors, advisors, or agents who have a need to know and are bound by confidentiality obligations at least as protective as those set forth herein.

Confidentiality obligations do not apply to information that: (a) is or becomes publicly known through no breach of this Agreement; (b) was rightfully known to the receiving party before disclosure without restriction; (c) is rightfully received from a third party without restriction; or (d) is required to be disclosed by applicable law, regulation, or court order, provided the receiving party gives the disclosing party prompt prior written notice to the extent permitted by law and cooperates reasonably in seeking a protective order.

Yama shall handle Customer Data in accordance with its published Privacy Policy at resources.yamaindustrials.com and any applicable data processing addendum signed by the parties. Customer is solely responsible for ensuring that its use of the Services and its instructions to Yama comply with applicable data protection and privacy laws.

***

### 11. Security, Compliance, and Customer Environment

Yama will implement and maintain reasonable administrative, technical, and physical safeguards consistent with industry-standard practices for comparable technology solutions providers to protect Yama's own systems and infrastructure. Such safeguards do not extend to Customer's environment, network, systems, devices, or data except as expressly stated in a signed Order Form.

Customer is solely responsible for the security, configuration, patching, updating, backup, and compliance of Customer's own environment, network, systems, devices, accounts, and data. Customer shall implement and maintain appropriate security controls, access restrictions, backup procedures, and compliance measures applicable to Customer's business, industry, and regulatory obligations. Yama's provision of any Services does not transfer to Yama any obligation to maintain, monitor, or enforce Customer's security posture or regulatory compliance unless expressly assumed in a signed Order Form.

Yama is not responsible for security incidents, data breaches, data loss, unauthorized access, ransomware, malware, or other security events affecting Customer's environment that arise from Customer's failure to maintain adequate security controls, from Customer Equipment vulnerabilities, from third-party platform failures, or from conditions outside the scope of Yama's then-current Services.

**Client Waiver of Reports; SKU-Based Scope Elections; Effect on Notice.** Where Customer selects, purchases, or authorizes any Service, engagement type, or SKU that, by its description in Yama's then-current pricing sheet, rate card, Order Form, or service catalog, excludes the preparation or delivery of any firewall log, traffic report, security event report, system diagnostic, or similar technical documentation, Customer's selection of such SKU or service tier constitutes Customer's express, informed waiver of: (a) any right to receive such report or the information it would have contained; (b) any right to receive written notice of any security condition, anomaly, indicator of compromise, or network event that would have been visible in such report; and (c) any claim against Yama arising from Yama's non-disclosure of any condition that would have been documented in the excluded report. Yama shall have no liability for any security condition or threat vector observable in any report that Customer's SKU selection excluded, regardless of whether Yama's personnel were aware of such condition during the engagement.

**No Duty to Monitor, Warn, or Act; Incidental Security Observations.** Yama does not provide security monitoring, threat detection, Security Operations Center (SOC) services, or continuous network surveillance as part of any engagement unless such services are expressly identified and separately scoped in a signed Order Form. The performance of any Services — including without limitation firewall configuration, deployment, implementation, and support, VOIP implementation, network configuration, equipment installation, or Ad-Hoc support — does not impose on Yama any duty to monitor, scan, assess, analyze, detect, identify, or report security threats, anomalies, compromises, or indicators of malicious activity present in Customer's environment, whether or not such conditions would be visible or apparent during the performance of the authorized Services. Yama has no obligation — contractual, tortious, or otherwise — to notify Customer of any security condition, anomaly, indicator of compromise, suspicious traffic pattern, or potential threat that Yama's personnel may incidentally observe while performing any Services, regardless of the apparent severity of the observed condition. Any informal, verbal, or incidental communication by Yama personnel regarding an observed condition: (a) does not constitute a professional security assessment, threat analysis, or forensic determination; (b) does not represent a complete or authoritative characterization of Customer's security posture; (c) does not create any duty on Yama's part to investigate further, take protective action, or provide follow-up notice; and (d) shall not be construed as an assumption of any security monitoring, advisory, or remediation obligation. Yama shall have no liability to Customer for failing to observe, identify, report, escalate, or act upon any security condition, threat, anomaly, or indicator of compromise — including without limitation malware, ransomware, command-and-control traffic, data exfiltration, lateral movement, or unauthorized access — that was or may have been present in Customer's environment at any time, regardless of whether Yama personnel were performing Services in Customer's environment at the time such condition existed. Customer is solely responsible for the ongoing security of its own network, systems, devices, and data, and acknowledges that Yama's engagement as a solutions provider for specific implementation, configuration, or support tasks does not substitute for, and is entirely distinct from, dedicated security monitoring, SOC services, or managed threat detection, which are separately priced third-party professional service categories. Nothing in this paragraph prohibits Yama from voluntarily providing Customer with informal notice of an observed security condition as a courtesy; however, where Yama elects to provide such voluntary notice, whether verbally or in writing, such notice: (a) does not obligate Yama to provide any further notice, investigation, or follow-up; (b) does not create any ongoing duty to monitor for the same or similar conditions; and (c) does not expand the scope of any then-current engagement.

***

### 12. Term, Termination, and Effects of Termination

#### 12.1 Agreement Term

This Agreement commences on the date of first execution, acceptance, or use of Services and continues until all active Order Forms and SOWs have expired or been terminated, unless earlier terminated as provided herein.

#### 12.2 Termination for Cause

Either party may terminate this Agreement or any Order Form immediately upon written notice if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days after receiving written notice of the breach, except that breaches involving non-payment, intellectual property infringement, confidentiality violations, or unauthorized use may be terminated immediately without a cure period.

#### 12.3 Termination for Convenience

Yama may terminate this Agreement or any Order Form for convenience upon thirty (30) days' prior written notice to Customer. Customer may terminate for convenience only if and to the extent expressly permitted in the applicable signed Order Form.

#### 12.4 Effects of Termination

Upon expiration or termination of this Agreement or any Order Form: (a) all licenses and use rights granted to Customer terminate immediately; (b) Customer shall immediately cease all use of Yama Materials and return or destroy all Yama Confidential Information in its possession; (c) Customer shall return all Yama Equipment as required by Section 7.3; (d) all accrued and unpaid payment obligations survive and become immediately due; and (e) Sections that by their nature should survive termination shall survive, including without limitation Articles 8, 9, 10, 14, 15, 16, 18, and 20.

***

### 13. Acceptance, Disclaimers, and Reliance Limits

Customer acknowledges that it has independently evaluated the Services and Products, has not relied on any oral or written representation, promise, guarantee, or warranty not expressly set forth in this Agreement or a signed Order Form, and has made its own determination that the Services and Products are suitable for its needs.

No employee, agent, or representative of Yama has authority to make representations, warranties, or commitments beyond those expressly set forth in this Agreement or a signed Order Form, and any such representations, if made, are not binding on Yama.

***

### 14. Limited Warranty and Disclaimer

#### 14.1 Limited Warranty

Yama warrants that it will perform the Services in a professional and workmanlike manner using commercially reasonable efforts consistent with ordinary industry practice for similar services.

#### 14.2 Warranty Limitations

The warranty in Section 14.1 does not apply to: (a) issues caused by Customer Equipment, Customer configurations, or Customer-controlled environments; (b) issues caused by Customer's failure to follow Yama's recommendations, instructions, or documented requirements; (c) issues caused by third-party products, services, or platforms not under Yama's direct control; (d) issues resulting from unauthorized modifications to Yama's work; (e) issues caused by Force Majeure events; or (f) Ad-Hoc Services or time-and-materials work performed at Customer's specific direction.

#### 14.3 Exclusive and Sole Remedy

Customer's sole and exclusive remedy, and Yama's sole and exclusive obligation, for any alleged breach of Section 14.1 is, at Yama's option, to re-perform the affected Services or terminate the affected Services and issue a prorated credit or refund for the unused portion of the fees actually paid for the materially nonconforming Services.

Customer must notify Yama in reasonable detail of the alleged nonconformity within thirty (30) days after Customer discovers it and, except for latent nonconformities not reasonably discoverable earlier, no later than ninety (90) days after delivery of the affected Services or Deliverables. Any latent nonconformity claim must be asserted within fifteen (15) days after discovery and in all events no later than one hundred eighty (180) days after such delivery.

For the avoidance of doubt, nothing in Section 4.1 or Section 8.9 eliminates Customer's ability to assert a timely warranty claim under this Section 14.3, although acceptance under Section 4.1 and payment obligations under Article 8 remain effective except to the limited extent of the remedy expressly provided in this Section.

Customer waives all other remedies arising from or relating to any alleged breach of warranty, to the fullest extent permitted by applicable law.

#### 14.4 General Disclaimer

EXCEPT AS EXPRESSLY SET FORTH IN SECTION 14.1, YAMA PROVIDES ALL SERVICES, PRODUCTS, AND YAMA MATERIALS "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, COMPLETENESS, OR SECURITY. YAMA DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, FREE OF VULNERABILITIES, OR THAT ANY PARTICULAR RESULT WILL BE ACHIEVED.

***

### 15. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL YAMA, ITS AFFILIATES, OR THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, OR CONTRACTORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, PUNITIVE, OR ENHANCED DAMAGES, INCLUDING WITHOUT LIMITATION LOSS OF REVENUE, LOSS OF PROFITS, LOSS OF BUSINESS, LOSS OF DATA, LOSS OF GOODWILL, BUSINESS INTERRUPTION, COST OF SUBSTITUTE SERVICES, OR ANY OTHER ECONOMIC LOSS, ARISING OUT OF OR RELATED TO THIS AGREEMENT, REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF YAMA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, YAMA'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, ANY ORDER FORM, OR ANY SERVICES OR PRODUCTS PROVIDED HEREUNDER SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY CUSTOMER TO YAMA IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

THE LIMITATIONS IN THIS ARTICLE 15 APPLY TO ALL CLAIMS, WHETHER BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, WARRANTY, OR ANY OTHER LEGAL OR EQUITABLE THEORY, AND SHALL APPLY EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES; IN SUCH JURISDICTIONS, YAMA'S LIABILITY SHALL BE LIMITED TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW.

***

### 16. Indemnity

Customer shall defend, indemnify, and hold harmless Yama and its affiliates, officers, directors, employees, agents, successors, and assigns from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) Customer's breach of this Agreement; (b) Customer's use of the Services or Products in violation of applicable law or third-party rights; (c) Customer Equipment or Customer-controlled environments; (d) Customer Data, including any claim that Customer Data infringes or misappropriates any third-party right or violates applicable law; (e) Customer's acts or omissions, including unauthorized use of Yama's credentials, access methods, or systems; or (f) any claim by a third party arising from Customer's business operations or Customer's use of the Services.

***

### 17. Force Majeure and External Dependencies

Yama shall not be liable for any delay or failure in performance caused by circumstances beyond Yama's reasonable control, including without limitation acts of God, natural disasters, pandemic, epidemic, government action, regulatory change, war, terrorism, civil unrest, labor disputes, internet or telecommunications outages, power failures, third-party vendor failures, supply chain disruptions, cyberattacks on infrastructure outside Yama's reasonable control, or any other event beyond Yama's reasonable control (each, a "Force Majeure Event").

If a Force Majeure Event occurs, Yama shall notify Customer as soon as reasonably practicable and shall use commercially reasonable efforts to resume performance. Fees continue to accrue during any Force Majeure Event for Services that remain partially or fully available.

***

### 18. Dispute Resolution

#### 18.1 Informal Escalation Requirement

Before initiating any formal legal proceeding, the party asserting a dispute shall provide the other party with a written Dispute Notice identifying in reasonable detail the nature of the dispute and the relief sought. The parties shall attempt in good faith to resolve the dispute through senior management escalation within fifteen (15) business days after delivery of the Dispute Notice (or such longer period as the parties may mutually agree in writing).

#### 18.2 Venue, Forum, and Election of Remedies

If the parties are unable to resolve a dispute through informal escalation, either party may pursue resolution through binding arbitration or litigation as permitted under this Agreement. The parties irrevocably submit to the exclusive jurisdiction of the state and federal courts located in Wyoming for any dispute not submitted to arbitration, and each party waives any objection to the laying of venue in such courts.

This Agreement shall be governed by and construed in accordance with the laws of the State of Wyoming, without regard to its conflict-of-laws provisions.

#### 18.3 Provisional and Equitable Relief

Notwithstanding any other provision of this Agreement, either party may seek provisional, injunctive, or other equitable relief in any court of competent jurisdiction to prevent irreparable harm pending resolution of a dispute, without waiving the right to pursue any other remedy.

#### 18.4 Time to Bring Claims

Any claim, action, or proceeding arising out of or related to this Agreement must be brought within one (1) year after the date the claiming party knew or reasonably should have known of the facts giving rise to the claim, except to the extent a shorter period is provided elsewhere in this Agreement. Any claim not brought within this period is permanently barred.

#### 18.5 Pre-Filing Dispute Notice

Compliance with the informal escalation requirement in Section 18.1 is a condition precedent to filing any formal legal proceeding. A Dispute Notice that asserts only an invoice objection that does not constitute a valid billing dispute under Section 8.9 shall not toll any payment deadline or preserve any billing-dispute right under Article 8; however, a good-faith Dispute Notice asserting an otherwise permitted non-billing claim shall not fail solely because the same notice also references an amount that Yama contends is not a valid billing dispute under Section 8.9.

#### 18.6 Tolling and Non-Tolling Matters

Delivery of a Dispute Notice under Section 18.1 tolls the limitations period in Section 18.4 solely with respect to the specific claim identified in that Dispute Notice for the duration of the informal escalation period. Delivery of a Dispute Notice does not toll, suspend, or extend: (a) any billing-dispute Dispute Window under Section 8.9; (b) any payment deadline under Article 8; (c) any deemed-acceptance period under Section 4.1; or (d) any warranty-notice period under Section 14.3.

***

### 19. Notices

All notices, demands, consents, approvals, and other communications required or permitted under this Agreement shall be in writing and delivered by: (a) certified mail, return receipt requested, postage prepaid; (b) nationally recognized overnight courier; or (c) email with confirmed delivery to the designated notice email address of the receiving party, as set forth in the applicable Order Form or updated by written notice.

Notices are effective upon receipt. Either party may update its notice address by providing written notice to the other party in accordance with this Article 19.

***

### 20. Miscellaneous

#### 20.1 Entire Agreement

This Agreement, together with all incorporated documents, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior and contemporaneous negotiations, representations, proposals, understandings, and agreements, whether oral or written, relating to such subject matter.

#### 20.2 Amendments

Yama may amend this Agreement by posting a revised version at the designated Yama terms URL or by otherwise providing written notice to Customer.

Unless otherwise expressly stated, any amendment becomes effective upon posting or notice for new Orders, renewals, and Services provided after expiration, termination, or transition to Ad-Hoc Support Status.

For a Customer then in an active committed service term, any material amendment to Article 8, Article 14, Article 15, Article 18, or this Article 20 shall apply prospectively only upon renewal or upon at least thirty (30) days' prior written notice, and shall not alter committed-term pricing or any non-waivable commitment expressly stated in a signed Order Form during the then-current committed term, except as expressly permitted by Section 8.13 or another express provision of this Agreement already in effect on the applicable Order Form effective date. No amendment adopted after the effective date of a committed Order Form shall expand the circumstances under which Yama may implement a mid-term price increase for that committed Order Form beyond those expressly set forth in Section 8.13 as in effect on that effective date; provided, however, that nothing in this Section limits Yama's right to implement any price adjustment, surcharge, pass-through, substitution, or service-model change expressly permitted by Section 8.13 or by the applicable signed Order Form as in effect on that effective date.

Customer has a continuing obligation to review the then-current Agreement before entering into new Orders, renewals, or requests for additional Services. Customer's continued use of Services after the effective date of an applicable amendment constitutes acceptance of that amendment.

#### 20.3 Assignment

Customer may not assign, transfer, delegate, or sublicense this Agreement, any Order Form, or any rights or obligations hereunder, whether by operation of law, merger, acquisition, change of control, asset sale, or otherwise, without Yama's prior written consent. Any purported assignment without such consent is void.

Yama may assign, transfer, or delegate this Agreement, any Order Form, or any rights or obligations hereunder at any time without Customer's consent, including in connection with a merger, acquisition, reorganization, or sale of all or substantially all of Yama's assets or the business unit to which this Agreement relates.

#### 20.4 Notice Address and Notice Mechanics

Yama's current designated notice address and billing contact email address are published at resources.yamaindustrials.com or as stated on the applicable invoice or Order Form. Customer is responsible for ensuring its notice information in Yama's account records remains current.

#### 20.5 Waiver

No waiver of any provision of this Agreement shall be effective unless in writing and signed by an authorized officer of the waiving party. No waiver of any breach or default constitutes a waiver of any subsequent breach or default, and no course of dealing or trade usage shall constitute a waiver of any right.

#### 20.6 Severability and Reformation

If any provision of this Agreement is held invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be reformed to the minimum extent necessary to make it enforceable, and the remaining provisions shall continue in full force and effect.

#### 20.7 Survival

The following provisions survive expiration or termination of this Agreement for any reason: Article 2 (Definitions), Article 8 (Fees, Billing, and Payment), Article 9 (Intellectual Property and Use Rights), Article 10 (Confidentiality and Data Handling), Section 12.4 (Effects of Termination), Article 13 (Acceptance, Disclaimers, and Reliance Limits), Article 14 (Limited Warranty and Disclaimer), Article 15 (Limitation of Liability), Article 16 (Indemnity), ...Article 18 (Dispute Resolution), Article 20 (Miscellaneous), and Article 21 (Brokered and Resold Third-Party Services), and Article 22\
(Customer-Introduced Devices; Internal Network Security; Scope Limitations), Article 23 (Subcontractors; Third-Party Personnel; Unauthorized and Rogue Acts), Article 24 (Administrative Accounts; Credentials; Migration and Transition Options; Yama Configuration IP; Post-Transition Assessments), and Article 25 (Supply Chain Security; Vendor-Introduced Compromise; Zero-Day Vulnerabilities; Nation-State and Advanced Persistent Threat Events)

#### 20.8 Independent Contractors

The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, franchise, employment, or fiduciary relationship between the parties. Neither party has authority to bind the other party to any obligation.

#### 20.9 No Third-Party Beneficiaries

This Agreement is for the sole benefit of the parties and their respective permitted successors and assigns. Nothing in this Agreement creates or is intended to create any rights, claims, or remedies in any third party.

#### 20.10 Counterparts; Electronic Acceptance; Signatures

This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one agreement. Electronic signatures, digital signatures, and click-through or other electronic acceptances shall be deemed legally binding to the same extent as original signatures.

#### 20.11 Interpretation

This Agreement shall be construed without regard to any presumption or rule requiring construction against the party causing this Agreement to be drafted. Section headings are for convenience only and shall not affect the interpretation of this Agreement. The words "include," "includes," and "including" are deemed to be followed by the words "without limitation." Unless the context otherwise requires, references to a statute or regulation include all amendments thereto and successor provisions.

#### 20.12 Publicity and Reference Rights

Yama may reference Customer's name and general description of the nature of Services provided as a customer reference for marketing, promotional, and business development purposes, unless Customer provides written objection to Yama's designated notice address within thirty (30) days after the effective date of Customer's first Order Form.

#### 20.13 Priority of Business Records

In the event of any ambiguity or dispute regarding the scope, pricing, or terms of Services performed, Yama's internal service records, ticketing records, billing records, account records, and business records shall constitute presumptive evidence of the services performed, amounts invoiced, and terms applicable.

### 21. Brokered and Resold Third-Party Services

#### 21.1 Reseller and Intermediary Status

Where Yama resells, brokers, procures, arranges, or passes through any third-party product, service, subscription, license, platform, or other offering on Customer's behalf (each, a "Brokered Service"), Yama acts solely as a reseller, intermediary, or procuring agent and not as the primary provider, manufacturer, developer, or obligor with respect to such Brokered Service. Customer acknowledges that the underlying third-party vendor, licensor, carrier, or platform provider (the "Upstream Vendor") is the primary obligor for all performance, availability, security, functionality, support, and warranty obligations relating to the Brokered Service.

#### 21.2 No Yama Warranty on Brokered Services

Yama makes no representation or warranty, express or implied, regarding any Brokered Service, including without limitation any warranty of merchantability, fitness for a particular purpose, accuracy, uptime, security, non-infringement, or suitability for Customer's requirements. Any warranty claim with respect to a Brokered Service must be asserted directly against the applicable Upstream Vendor under that vendor's then-current terms and warranty policy. The warranty in Section 14.1 does not apply to Brokered Services.

#### 21.3 Vendor EULA Compliance; Flow-Down

All Brokered Services are subject to the applicable Upstream Vendor's end-user license agreement, terms of service, acceptable use policy, privacy policy, and support terms (collectively, "Vendor Terms"), which are binding on Customer as a condition of receiving the Brokered Service. Customer is solely responsible for reviewing, accepting, and complying with all applicable Vendor Terms. Yama shall have no obligation or liability arising from Customer's failure to comply with any Vendor Terms, and any suspension, termination, restriction, or modification of a Brokered Service resulting from Customer's violation of Vendor Terms shall not constitute a breach of this Agreement by Yama. To the extent a Brokered Service requires Customer's direct acceptance of Vendor Terms, Customer shall execute such acceptance upon Yama's request and in any event before using the Brokered Service.

#### 21.4 Vendor-Initiated Changes, Suspension, or Discontinuation

Yama shall have no liability to Customer for any modification, suspension, restriction, price change, feature removal, discontinuation, or termination of any Brokered Service initiated by the Upstream Vendor, including without limitation changes to the vendor's pricing, support model, geographic availability, technical requirements, platform architecture, security posture, or business operations. If an Upstream Vendor modifies or discontinues a Brokered Service, Yama may, in its discretion: (a) pass through the Upstream Vendor's modified terms and pricing upon notice to Customer; (b) substitute a comparable third-party offering; or (c) terminate the affected portion of the applicable Order Form without penalty upon notice to Customer. Any pricing adjustment arising from an Upstream Vendor change is separately governed by Section 8.13.

#### 21.5 Refund and Credit Limitation

Yama's obligation to issue any refund, credit, service credit, or other monetary remedy with respect to any Brokered Service is strictly limited to amounts Yama actually receives from the applicable Upstream Vendor attributable to the Customer account. Yama shall use commercially reasonable efforts to request and pass through any refund or credit to which Customer may be entitled under the Upstream Vendor's then-current refund or credit policy, but Yama shall have no obligation to fund, advance, or guarantee any refund or credit that the Upstream Vendor does not provide.

#### 21.6 Limitation of Liability for Brokered Services

Without limiting Article 15, Yama's total aggregate liability to Customer arising out of or relating to any Brokered Service — including any Upstream Vendor outage, security incident, data breach, feature loss, performance failure, availability failure, or support failure — shall not exceed the amounts actually paid by Customer to Yama for the specific Brokered Service during the three (3) months immediately preceding the event giving rise to the claim. For the avoidance of doubt, this liability limitation applies in addition to, and not instead of, the general liability cap set forth in Section 15.2; the lower of the two caps governs.

#### 21.7 No Agency Relationship with Upstream Vendor

Nothing in this Agreement, any Order Form, or any Brokered Service arrangement creates an agency, partnership, joint venture, or employment relationship between Yama and any Upstream Vendor. Yama does not have authority to bind any Upstream Vendor, to modify any Upstream Vendor's terms, or to make representations on any Upstream Vendor's behalf. Yama shall not be liable for any act, omission, misrepresentation, or failure of any Upstream Vendor.

#### **21.8 Physical Property Damage; On-Site Vendor Activity**

Where Yama procures, brokers, or arranges access for any Upstream Vendor or its personnel to perform physical installation, construction, cabling, wiring, or other on-site work at Customer's premises or in proximity to Customer Equipment, Yama acts solely as a coordinating intermediary and not as a general contractor, employer, principal, or supervisor of the Upstream Vendor's personnel. Customer acknowledges that Yama exercises no direction or control over the Upstream Vendor's on-site work methods, personnel, equipment handling, or field execution. In the event of any physical property damage, loss, destruction, personal injury, or other tort arising from the Upstream Vendor's on-site activities, Customer's sole remedy is against the applicable Upstream Vendor directly, and Yama shall have no liability therefor. Yama shall use commercially reasonable efforts, upon request, to assist Customer in asserting a claim against the applicable Upstream Vendor or its insurer, but such assistance does not create any guaranty, co-liability, or assumption of the Upstream Vendor's obligations. Yama makes no representation that any Upstream Vendor maintains any particular level of insurance coverage. Customer is responsible for maintaining its own property and casualty insurance covering Customer Equipment at all times.

### 22. Customer-Introduced Devices; Internal Network Security; Scope Limitations

#### **22.1 Customer-Introduced Devices**

Customer is solely responsible for any device, system, platform, application, or endpoint that Customer, or any third party engaged directly by Customer, installs, connects, activates, provisions, or otherwise introduces to Customer's internal network, whether permanently or temporarily, and whether or not Customer notifies Yama of such introduction. This includes without limitation:

* VoIP systems, telephony platforms, and unified communications equipment;
* IP-based cameras, video surveillance systems, and physical access control systems;
* IoT devices, building automation systems, environmental controls, and smart-facility equipment;
* Networked copiers, printers, multifunction devices, and externally managed print services;
* Point-of-sale systems, payment terminals, and kiosks;
* Personally owned devices, guest devices, and contractor devices connected to any Customer network segment; and
* Any other device, appliance, or platform not expressly identified in the applicable Order Form as within Yama's support scope.

Customer assumes all risk, liability, and responsibility for the security posture, configuration hygiene, patch status, network behavior, and operational impact of all Customer-introduced devices. Yama has no duty to audit, assess, monitor, detect, remediate, or advise with respect to any Customer-introduced device absent a separate written engagement expressly scoped to that device.

#### **22.2 No Pre-Installation Review Obligation**

Yama has no obligation to review, assess, approve, or advise on the security implications of any planned third-party installation, device addition, or network change by Customer or Customer's vendors unless Customer submits a written request to Yama prior to such installation and Yama expressly agrees in a signed writing to perform such review as a separately scoped and billable engagement. The absence of a Yama pre-installation review does not create any Yama liability for the security or operational impact of the installation.

#### **22.3 Scope of Yama Firewall and Security Support Services**

Where Yama provides subscription support, management, monitoring, or configuration services for a firewall, security appliance, or perimeter security solution, the scope of such services is expressly limited to:

* The WAN-side perimeter and the configured rulesets, interfaces, and zones expressly identified in the applicable Order Form; and
* The supported appliance in its last known stable configuration as of Yama's most recent documented configuration event.

Yama's firewall and security support services expressly exclude and do not extend to:

(a) internal LAN-side security, lateral movement, or east-west traffic between internal network segments; (b) network segmentation, VLAN architecture, or isolation of any device not expressly within scope; (c) detection, containment, or remediation of any threat or breach originating from or propagating through any Customer-introduced device; or (d) any condition, vulnerability, misconfiguration, or threat vector introduced to the network after Yama's last documented configuration, whether by Customer, a third-party vendor, or a Customer-introduced device.

#### **22.4 No Implied Network Security Engagement**

Yama's support of any individual appliance, device, or platform under a subscription support plan does not constitute a general network security engagement, a network security assessment, a penetration test, a vulnerability management service, or a managed security service of any kind. No implied duty of broader network security care arises from the existence of any Yama firewall support subscription, security appliance subscription, or related service engagement.

#### **22.5 Breach and Incident Causation; No Liability**

In the event of any security breach, incident, intrusion, unauthorized access, ransomware event, data exfiltration, or other security event affecting Customer's systems, networks, or data, Yama shall have no liability for any resulting losses, damages, costs, regulatory penalties, notification obligations, remediation expenses, or third-party claims arising from or attributable to:

(a) any Customer-introduced device as described in Section 22.1; (b) Customer's failure to segregate, isolate, or properly secure any device on its internal network; (c) any threat, attack vector, or unauthorized access originating from within Customer's internal LAN, internal wireless network, or any network segment not expressly within Yama's documented support scope; (d) any third-party vendor's act, omission, negligence, or reckless installation practice; or (e) any condition or vulnerability existing prior to Yama's engagement or introduced after Yama's last documented configuration of the applicable supported system.

The foregoing exclusions apply regardless of whether the affected system or appliance is otherwise covered under an active Yama subscription support plan, and regardless of whether the breach could theoretically have been detected or mitigated by a broader security engagement not expressly authorized under this Agreement.

Nothing in this Article limits Yama's liability for damages caused solely and directly by Yama's own gross negligence or willful misconduct in performing the expressly scoped support services.

#### **22.6 Third-Party Diagnostic Requests; Temporary Security Modifications; Customer Consent Requirements**

**No Obligation to Comply.** Yama shall have no obligation to open any firewall port, create any access rule, disable any security policy, bypass any security inspection, suspend any threat-prevention feature, or otherwise modify the security posture of any Yama-supported device or system at the request of any third-party vendor, installer, contractor, or platform provider, regardless of the stated diagnostic, troubleshooting, or operational purpose. Yama may decline any such request in its sole discretion without liability to Customer or to the requesting third party.

**Customer Authorization Required.** If Customer wishes Yama to accommodate a third-party vendor's diagnostic or troubleshooting request that requires a temporary security modification, Customer must provide express prior written authorization before Yama will take any such action. Such authorization must:

(a) identify the specific third-party vendor and the stated diagnostic purpose; (b) identify the specific modification requested, including the port, rule, policy, or feature to be temporarily altered; (c) specify the requested duration of the temporary modification; (d) be transmitted in one of the following authorized forms: (i) a written email sent from an email address belonging to an owner, officer, or expressly authorized representative of Customer as identified in Yama's account records, or (ii) if email access is unavailable or impractical at the time of the request, a written text message or messaging platform communication sent directly from the personal device of an owner or officer of Customer, with such individual expressly identifying themselves by name and title in the communication; and (e) include an express acknowledgment by the authorizing individual that they understand the request involves a temporary reduction in network security protections and that Customer accepts all risk of unauthorized access, intrusion, breach, data loss, or other security incident arising during or after the temporary modification period.

**No Verbal Authorization.** Verbal authorization of any kind — including in-person, by telephone, or by voicemail — shall not constitute valid authorization for any temporary security modification under this Section, regardless of the identity of the requesting individual or the urgency of the diagnostic need.

**Yama's Right to Decline Notwithstanding Consent.** Even where Customer provides valid authorization under this Section, Yama retains the right, in its sole professional judgment, to decline to make the requested security modification if Yama reasonably determines that the modification presents an unacceptable security risk, is inconsistent with applicable vendor requirements, or conflicts with Yama's professional obligations. Yama shall notify Customer promptly of any such declination.

**Release of Liability; Assumption of Risk.** Customer's authorization of any temporary security modification under this Section constitutes Customer's express assumption of all risk arising from or related to the modification, including without limitation any unauthorized access, intrusion, malware infection, ransomware event, data breach, data exfiltration, lateral movement, denial-of-service event, or other security incident occurring during the modification window or arising from any vulnerability introduced or exposed as a result of the modification. Yama shall have no liability for any such incident or its consequences, regardless of whether the incident was foreseeable, regardless of whether the third-party vendor's request was the proximate cause, and regardless of whether the incident persists or recurs after the modification is reversed. This release applies in addition to, and not instead of, the liability exclusions set forth in Article 15 and Sections 22.3 through 22.5.

**Restoration; Billability.** Upon completion of the authorized diagnostic window, or upon Customer's written request, Yama will use commercially reasonable efforts to restore the affected security configuration to its prior state. All time spent by Yama implementing, monitoring, documenting, and reversing any temporary security modification — including any associated testing, change-window coordination, or post-restoration verification — constitutes billable Ad-Hoc Services under Section 4.2, regardless of whether the diagnostic effort resolves the third-party vendor's issue.

**Documentation.** Yama will retain a record of the authorization received, the modification made, and the restoration performed as part of its internal service records, which shall constitute presumptive evidence of the scope and terms of the authorization under Section 20.13.

#### **22.7 Third-Party and Internal IT Providers; Remote Access** **Bypass; Parallel IT Environments**

**No Control Over Parallel IT Providers.** Where Customer engages, retains, or permits any third-party IT provider, internal IT department, contractor, consultant, or other technology personnel ("Parallel IT Provider") to perform any work on Customer's systems, networks, devices, or environments concurrently with or at any time during Yama's engagement, Yama has no visibility into, control over, or responsibility for the security practices, access methods, equipment, credentials, or technical protocols of any such Parallel IT Provider.

**Remote Access Tool Bypass.** Customer acknowledges that remote access tools and software — including without limitation TeamViewer, AnyDesk, LogMeIn, ConnectWise Control, Splashtop, and similar remote desktop, screen sharing, or remote management applications (collectively, "Remote Access Tools") — when installed or authorized on Customer's internal devices, create inbound and outbound connection pathways that operate independently of and outside the protection of any firewall, perimeter security device, geo-blocking rule, or network security control that Yama has deployed or manages on Customer's behalf. Connections established through Remote Access Tools originate from or are received by the endpoint device directly and are not inspected, filtered, blocked, or logged by Yama's perimeter security architecture in the same manner as standard network traffic.

**Express Exclusion from Firewall and Security Scope.** Yama's firewall management, perimeter security, and network security services — including any geo-blocking, DNS filtering, traffic inspection, or access control services provided under any Order Form — expressly exclude and do not extend to:

(a) any connection, session, transfer, or activity conducted through any Remote Access Tool installed or authorized on any Customer device, regardless of whether such Remote Access Tool was installed by Yama, by a Parallel IT Provider, by Customer, or by any other party;

(b) any malware, ransomware, credential theft, data exfiltration, lateral movement, or other compromise introduced to Customer's internal network through any Remote Access Tool session, regardless of whether such session was authorized by Customer;

(c) any security incident originating from, facilitated by, or introduced through the equipment, devices, credentials, or network connections of any Parallel IT Provider, regardless of whether such Parallel IT Provider was engaged by Customer with or without Yama's knowledge; and

(d) any condition, vulnerability, misconfiguration, or unauthorized access introduced to Customer's environment by any Parallel IT Provider, whether through Remote Access Tools, direct physical access, VPN connections, cloud platform access, or any other access method.

**No Liability for Parallel IT Provider Acts or Omissions.** Yama shall have no liability to Customer for any security incident, data breach, system compromise, data loss, service disruption, or other loss or damage arising from or related to: (a) the security practices or lack thereof of any Parallel IT Provider; (b) the use of any Remote Access Tool by any Parallel IT Provider or internal IT personnel; (c) any connection to Customer's environment made through unsecured, unpatched, compromised, or otherwise inadequately protected hardware or software operated by any Parallel IT Provider; or (d) the removal, disabling, circumvention, or bypass of any security control deployed by Yama, whether deliberate or inadvertent, by any Parallel IT Provider or internal IT personnel.

**Geo-Blocking and Perimeter Controls Are Not Comprehensive Security.** Customer acknowledges that geo-blocking, DNS filtering, and perimeter firewall controls deployed by Yama represent one layer of a multi-layered security architecture and do not constitute comprehensive protection against all threat vectors, including without limitation threats introduced through Remote Access Tools, insider threats, physically connected devices, encrypted tunnels, cloud-based access, or supply chain compromise. The presence of active geo-blocking or other perimeter controls does not indicate that Customer's environment is free from compromise or that all threats are being contained.

### 23. Subcontractors; Third-Party Personnel; Unauthorized and Rogue Acts

#### **23.1 Yama's Right to Use Subcontractors**

Yama may engage subcontractors, independent contractors, third-party technicians, field service providers, staffing resources, or other personnel to perform or assist in performing any Services under this Agreement (each, a "Yama Subcontractor"). Yama's engagement of a Yama Subcontractor does not alter Yama's obligations to Customer under this Agreement with respect to the authorized scope of Services, except as otherwise expressly stated herein.

#### **23.2 Scope of Yama's Responsibility for Subcontractor Acts**

Yama's responsibility for the acts and omissions of any Yama Subcontractor is limited to acts and omissions occurring within the express scope of the work authorized by Yama for that engagement. Yama shall use commercially reasonable efforts consistent with ordinary industry practice to engage subcontractors that are reasonably qualified for the authorized scope of work.

Yama is not responsible for, and expressly disclaims liability arising from, any act, omission, conduct, or event that:

(a) is outside the authorized scope of the Yama Subcontractor's engagement with Yama; (b) constitutes intentional misconduct, willful wrongdoing, criminal conduct, fraud, theft, sabotage, unauthorized access, unauthorized data exfiltration, or other act committed for personal motives unrelated to the performance of the authorized Services (each, a "Rogue Act"), regardless of whether such person had authorized physical or logical access to Customer's premises, systems, or equipment at the time of the Rogue Act; (c) results from Customer's own grant of access, credentials, permissions, or physical entry to any individual beyond what Yama requested or authorized; or (d) results from Customer's failure to maintain reasonable independent security controls, credential hygiene, access logging, physical security measures, or monitoring for its own premises and systems.

#### **23.3 Upstream Vendor Personnel; Rogue Acts**

Where Yama brokers, arranges, or coordinates access for any Upstream Vendor or its personnel under Article 21, or where Customer permits any Upstream Vendor personnel (including without limitation ISP technicians, carrier field technicians, or vendor-dispatched field engineers) to access Customer's premises, systems, networks, or equipment in connection with any Yama-brokered or Customer-arranged engagement:

(a) Yama shall have no liability for any Rogue Act committed by any Upstream Vendor employee, agent, contractor, or technician, including without limitation any unauthorized access to Customer systems or data, physical damage to equipment committed outside the scope of authorized work, data theft, credential compromise, installation of unauthorized software or hardware, network reconfiguration performed without authorization, or any other intentional or criminal act; (b) Yama does not supervise, direct, control, or oversee the conduct, methods, background, or qualifications of Upstream Vendor personnel, and makes no representation regarding any Upstream Vendor's personnel vetting, background check, certification, bonding, or insurance practices; and (c) Customer's sole remedy for any Rogue Act by Upstream Vendor personnel is against the Upstream Vendor directly and, where applicable, against the individual personally. Yama shall use commercially reasonable efforts to assist Customer in identifying the responsible party and relevant insurance or bonding information upon request, but such assistance does not create any Yama liability or co-obligation.

#### **23.4 Customer's Independent Security Obligations**

Regardless of whether any Yama Subcontractor or Upstream Vendor personnel has authorized access to Customer's premises or systems, Customer remains solely responsible for:

(a) maintaining independent access logging, credential monitoring, and audit trails for all systems accessible to any third-party personnel; (b) revoking credentials, access keys, VPN profiles, physical access badges, or other access methods issued to or used by any third-party personnel promptly upon completion of the authorized work; (c) maintaining physical security measures, surveillance, and visitor escort policies for its premises; and (d) maintaining its own property, casualty, and cyber insurance coverage adequate to address losses arising from unauthorized acts of third-party personnel, regardless of who engaged such personnel.

Yama's performance of any Services does not relieve Customer of any of the foregoing obligations, and Customer's failure to maintain such controls is an intervening cause that limits or eliminates Yama's liability for any resulting loss.

#### **23.5 Limitation of Liability; No Waiver of Article 15**

Nothing in this Article 23 expands Yama's liability beyond the caps and exclusions set forth in Article 15. To the extent any claim arising from a Yama Subcontractor's authorized negligent act (as distinct from a Rogue Act) is cognizable under this Agreement, such claim remains subject to the liability cap in Section 15.2, the consequential damages waiver in Section 15.1, and all other limitations in Article 15.

Yama retains liability solely for damages caused directly and solely by Yama's own gross negligence or willful misconduct in the direct performance of expressly authorized Services, and not for the independent, unauthorized, or criminal conduct of any Yama Subcontractor or Upstream Vendor personnel.

#### **23.6 Incident Reporting; Cooperation**

If Customer becomes aware of any suspected or confirmed Rogue Act by any Yama Subcontractor or Upstream Vendor personnel, Customer shall notify Yama in writing within twenty-four (24) hours of discovery. Timely notice allows Yama to preserve evidence, engage its subcontractor's insurer or bonding company, and cooperate with law enforcement or regulatory authorities. Failure to provide timely notice may impair Yama's ability to pursue recovery on Customer's behalf and shall not be used to expand Yama's liability for the underlying incident.

### 24. Migration and Transition Options; Yama Configuration IP; Post-Transition Assessments

#### **24.1 Yama Administrative Accounts; No Transfer of Yama Credentials**

Where Yama creates, maintains, or uses administrative accounts, credentials, API keys, management consoles, or other privileged access methods on any Customer system, platform, network, or device in connection with the Services ("Yama Admin Accounts"), such accounts are the sole and exclusive property of Yama and constitute Yama's internal operational tools for delivering the Services. Yama Admin Accounts are not Customer Equipment, are not subject to Customer's control or direction, and are not transferable to Customer, any incoming vendor, any successor IT provider, or any other third party under any circumstances.

Customer shall have no right to demand, request, require, or receive the credentials, passwords, API tokens, recovery keys, MFA codes, or any other access component of any Yama Admin Account, regardless of the reason for the request, regardless of the stage of any service transition, and regardless of any claim that such access is necessary for Customer's operations, compliance obligations, or business continuity. Any Customer demand for Yama Admin Account credentials is deemed rejected as a matter of contract and does not constitute a valid basis for a dispute, claim of non-performance, or allegation of breach.

#### **24.2 View-Only and Compliance Secondary Accounts**; Eligibility and Default Posture

**(a) Default Posture.** Secondary Accounts are unavailable by default. Yama has no obligation to create, provision, or maintain any Secondary Account under this Agreement, any Order Form, or any service plan. A Secondary Account is a narrow, discretionary exception available solely under the conditions set forth in this Section 24.2 and is not available as of right under any circumstance.

**(b) Eligibility Prerequisites.** Yama will not consider any request for a Secondary Account unless all of the following conditions are satisfied at the time of the request and throughout the account's existence:

* **Active Subscription in Good Standing.** Customer must hold an active subscription in good standing at the time of the request. A Secondary Account is not available during Ad-Hoc Support Status, upon or following service termination or expiration, or as a transition, handover, or incoming party familiarization tool of any kind.
* **Documented External Compliance Mandate.** Customer must submit to Yama prior to any account creation: (i) a written copy of the specific regulatory, contractual, or audit requirement that expressly mandates the access being requested, identifying the applicable regulatory framework, audit standard, or contractual obligation by name and section; (ii) the identity and role of the specific individual requiring access; (iii) the specific data, logs, or parameters that individual is required to review; and (iv) the minimum access scope required to satisfy the mandate and no more. A generalized, vague, or self-certified compliance need, Customer's internal preference, operational convenience, or incoming party onboarding need does not constitute a qualifying Compliance Mandate for any purpose under this Section.
* **Yama Approval.** Receipt of a Compliance Mandate documentation package does not create any obligation on Yama to create a Secondary Account. Yama may in its sole discretion approve, deny, condition, or defer any request, including where Yama determines the stated mandate is insufficiently specific, unverifiable, or inconsistent with Yama's operational, security, or legal obligations. Yama's denial of a request does not constitute a breach of this Agreement.

**(c) Scope Limitation.** If approved, any Secondary Account is strictly limited to the access level, permissions, and scope expressly defined by Yama at the time of provisioning. Where the Compliance Mandate requires only review of firewall traffic logs or audit trail records, the Secondary Account shall be scoped to logs and audit records only and shall not provide visibility into the underlying configuration, rule sets, or policy architecture generating those logs. A Secondary Account does not expand the scope of Services Yama is obligated to perform under any Order Form or this Agreement; does not create any monitoring, alerting, remediation, incident response, or reporting obligation beyond those expressly stated in a signed Order Form or Service Level Agreement; does not constitute access to or control over any Yama Admin Account; and does not create any implied duty of Yama to act on any information accessible through the Secondary Account unless Yama has expressly assumed that duty in a signed Order Form.

**(d) Prohibited Use.** A Secondary Account shall not be used to copy, document, transcribe, export, screen-capture, photograph, or otherwise reproduce any Yama Configuration IP, Yama Materials, security policies, or configuration logic visible through the account. Use of a Secondary Account for any purpose other than satisfying the specific documented Compliance Mandate — including for transition planning, incoming party familiarization, configuration review, or internal IT evaluation — constitutes a material breach of this Agreement.

**(e) Automatic Termination.** Any Secondary Account terminates automatically and without further notice upon the earliest of: (i) expiration or termination of Customer's active subscription; (ii) Customer's transition to Ad-Hoc Support Status; (iii) satisfaction, expiration, or withdrawal of the documented Compliance Mandate; (iv) conclusion of the specific audit, examination, or review for which the account was created; or (v) Yama's written notice of termination for any reason in its sole discretion.

**(f) No Transition Right; No Implied Obligations.** A Secondary Account does not constitute a Handover Admin Account, does not provide any incoming party or successor IT provider with any right to access or use such account, and does not create any obligation on Yama to maintain the account beyond the active subscription term. The existence of a Secondary Account creates no implied duty of continued access, no service level commitment, no obligation to provide any particular data or scope of visibility, and no right to demand any extension, modification, or continuation of access beyond the active subscription term and documented Compliance Mandate period.

**(g) Billability.** All time spent by Yama creating, configuring, maintaining, modifying, or removing any Secondary Account constitutes billable Ad-Hoc Services under Section 4.2.

#### **24.3 Migration Services; Exclusive Transition Options**

Where Yama performs migration services — whether migrating Customer to an in-house IT function, to a successor service provider, to a different platform or environment, or to any other configuration ("Migration") — the following terms govern:

**(a) Scope and Billing.** Migration Services constitute Ad-Hoc Services under Section 4.2 and are billable at Yama's then-current rates unless a fixed Migration fee is expressly stated in a signed Order Form or Micro-SOW. Migration Services are out of scope under any existing subscription or service commitment unless expressly included in writing. Migration Services are offered solely at Yama's discretion and are not available as of right for Customer Equipment on Ad-Hoc Support Status or following service termination, absent Yama's express written agreement.

**(b) Exclusive Transition Methods.** Yama's transition and handover obligations in connection with any Migration are limited exclusively to the two options set forth in this Section 24.3(b). No other form of access, credential sharing, account creation, live device access, or transition assistance is available under this Agreement except as expressly agreed in a signed Order Form. The applicable option shall be identified in the Order Form or Micro-SOW prior to commencement of Migration Services.

* **Option 1 — Factory Reset.** Customer may request, or Yama may elect pursuant to its Administrative Disengagement right under Section 2(b) of the Post-Agreement & Ad-Hoc Support Policy, a factory reset or equivalent restoration to manufacturer default settings on any Yama-supported or Yama-configured device, appliance, firewall, or network platform (a "Factory Reset"). A Factory Reset requested by Customer requires Customer's express written authorization identifying the specific devices to be reset and acknowledging the consequences set forth herein. Where Yama elects a Factory Reset pursuant to its Administrative Disengagement right under the Post-Agreement & Ad-Hoc Support Policy, Customer authorization is not required. Upon completion of a Factory Reset: (i) all Yama Configuration IP is removed from the applicable device, which reverts to its manufacturer default state — including no firewall rules, no geo-blocking, no DNS filtering, no access control policies, and fully open or permissive default settings as determined by the applicable manufacturer's factory configuration; (ii) Customer assumes sole and complete responsibility for implementing replacement security controls prior to or concurrent with redeployment of the device, and Yama has no obligation to verify, confirm, or ensure that any replacement controls have been implemented, are adequate, or are operational prior to or following the Factory Reset; (iii) Yama shall issue a written Factory Reset Confirmation identifying the devices reset and the date of reset within three (3) business days of completion, which shall constitute presumptive evidence under Section 20.13 of the removal of all Yama Configuration IP from the identified devices as of the confirmed date; and (iv) Customer waives any claim against Yama arising from or related to any security incident, data breach, unauthorized access, network compromise, or other adverse condition occurring on the reset devices after the Factory Reset date, except to the extent arising solely from Yama's gross negligence or willful misconduct in performing the Factory Reset itself.
* **Option 2 — Documentation Export.** Customer may request a limited written export of configuration documentation sufficient to allow an incoming party to understand the general network environment (a "Documentation Export"), subject to the terms of Section 24.4. A Documentation Export is a separately scoped, billable Deliverable under Section 4.1. It does not include direct device access, live system access, or any Yama Configuration IP as defined in Section 24.7. Delivery of a Documentation Export constitutes Yama's complete satisfaction of any configuration documentation or transition assistance obligation under this Agreement and any applicable Order Form.

**(c) Customer and Incoming Party Responsibility.** Customer assumes sole and exclusive responsibility for the security, operation, and continuity of its network and systems from the moment of completion of any Factory Reset or delivery of any Documentation Export, as applicable. Customer is solely responsible for onboarding and transitioning its environment to any incoming party. Yama has no responsibility for any act, omission, breach, compromise, or failure of any incoming party following completion of the applicable transition option. Customer shall communicate the restrictions set forth in Section 24.7 to any incoming party that receives a Documentation Export or gains access to any device bearing Yama Configuration IP.

**(d) Deletion of Yama Admin Account.** Following completion of the agreed Migration scope and Yama's reasonable confirmation that the applicable transition option is complete, Yama will delete or deactivate all Yama Admin Accounts associated with the migrated systems, platforms, or environments. Where Yama has elected a Factory Reset, deletion of Yama Admin Accounts is incorporated within the Factory Reset process. Deletion or deactivation of all applicable Yama Admin Accounts constitutes Yama's completion of the access transition component of the Migration.

**(e) Post-Deletion Liability Cutoff.** Upon deletion or deactivation of all applicable Yama Admin Accounts, Yama's obligations with respect to the migrated systems, platforms, and environments terminate. Yama has no liability for any condition, configuration, vulnerability, breach, incident, outage, data loss, or failure arising from or relating to the migrated environment after the deletion date, regardless of whether such condition pre-existed the Migration or was introduced during or after the Migration by Customer, the incoming party, or any third party.

**(f) No Obligation to Retain Access.** Yama has no obligation to maintain any access, credentials, or administrative capability with respect to any migrated system or environment following completion of the Migration. Customer may not require Yama to retain or escrow any access method, credential, recovery key, or administrative capability for any migrated system or environment for any purpose.

**(g) No Device Access Outside These Options; Right to Decline.** The options set forth in Section 24.3(b) constitute the exclusive methods by which Customer may obtain any form of configuration access, documentation, or transition assistance in connection with any service transition or change of IT provider. Yama has no obligation to provide any incoming IT provider, successor service provider, Customer personnel, or other third party with direct live access to any Customer Equipment bearing Yama Configuration IP for any transition, onboarding, familiarization, or evaluation purpose. Yama may decline to offer or perform any option under this Section 24.3 where Customer has any outstanding unpaid invoice, is in breach of any provision of this Agreement, or where Yama determines in its reasonable discretion that performance would create unacceptable operational, legal, or security risk. Such declination does not constitute a breach of this Agreement.

#### **24.4** Documentation Export; Scope and IP Restrictions

**(a) Scope of Documentation Export.** Where the parties agree on a Documentation Export under Section 24.3(b), such Documentation Export constitutes a Deliverable under this Agreement, is subject to the acceptance provisions of Section 4.1 and the limited warranty provisions of Section 14.1, and is governed by the intellectual property restrictions of Article 9 and Section 24.7. A Documentation Export includes, to the extent applicable and in Yama's standard format, the following Customer-owned or environment-specific information:

* Network topology overview (generalized)
* IP address assignments and VLAN structure
* Interface assignments and physical port mappings
* Hostname, device model, and firmware version information
* ISP and WAN connection parameters belonging to Customer
* Customer-owned vendor account identifiers and license keys required for device registration

**(b) Exclusion of Yama Configuration IP.** A Documentation Export expressly excludes all Yama Configuration IP as defined in Section 24.7, including without limitation: firewall security policies, rules, and rule sets; geo-blocking configurations, country block lists, and geographic access control parameters; DNS filtering policies and category configurations; application control, intrusion prevention, SSL inspection, and threat protection profiles; NAT, PAT, and routing policy configurations derived from Yama's methodology; and any other configuration element constituting Yama's proprietary security methodology, hardening procedure, or operational framework.

**(c) No Compatibility Warranty.** Yama makes no warranty that any Documentation Export will be fully compatible with, sufficient for import into, or adequate for use by any platform, tool, or environment operated by Customer or any incoming party. Yama's obligation is limited to providing a commercially reasonable Documentation Export in Yama's standard format or in a mutually agreed format expressly stated in the applicable Order Form or Micro-SOW.

**(d) Billability.** All time spent preparing, formatting, validating, or transmitting any Documentation Export, including time spent responding to incoming party questions regarding the export, constitutes billable Ad-Hoc Services under Section 4.2.

**(e) IP Restrictions on Recipient.** Customer and any incoming party receiving a Documentation Export are bound by the restrictions of Article 9 and Section 24.7 with respect to such Documentation Export and its contents. Delivery of a Documentation Export does not constitute a Migration, a transfer of any Yama Admin Account, a transfer of or license to any Yama Configuration IP, or a conveyance of any right, title, or interest in or to any Yama Materials beyond the limited right to use the Customer-owned information expressly included therein.

**(f) Complete Satisfaction.** Delivery of a Documentation Export in Yama's standard format as provided herein constitutes Yama's complete satisfaction of any configuration documentation or transition assistance obligation under this Agreement and any applicable Order Form. No further documentation, supplementation, clarification, or technical assistance is required of Yama following delivery of the Documentation Export absent a separately scoped and signed Micro-SOW.

#### **24.5 Timing; Customer Cooperation**

Customer shall cooperate fully and timely with all Migration activities, including by providing access, scheduling windows, approvals, device availability, and designated points of contact. Yama's Migration obligations are conditioned on Customer's timely cooperation and, where applicable, on the incoming party's timely readiness to receive any Documentation Export and assume management of Customer's support environment.

Any delay caused by Customer's lack of cooperation, the incoming vendor's unavailability or unreadiness, scheduling conflicts, system incompatibilities, or third-party dependencies shall not constitute a breach by Yama, and all resulting additional time and expense are billable as Ad-Hoc Services under Section 4.2.

#### **24.6 No Implied Post-Migration Support**

Yama's completion of a Migration does not create any obligation to provide post-migration support, monitoring, troubleshooting, validation, or assistance unless expressly agreed in a signed Order Form or Micro-SOW. Any post-migration support requested by Customer or the incoming vendor is reactive, discretionary, and billable as Ad-Hoc Services under Section 4.2.

### 25. Supply Chain Security; Vendor-Introduced Compromise; Zero-Day Vulnerabilities; Nation-State and Advanced  Persistent Threat Events

#### **25.1 Scope and Purpose**

This Article addresses Yama's liability — and the allocation of risk between the parties — with respect to security incidents, data breaches, system compromises, and related losses arising from: (a) supply chain attacks targeting software or hardware manufacturers, developers, distributors, or vendors whose products or services Yama deploys, supports, recommends, or procures on Customer's behalf; (b) zero-day and undisclosed vulnerabilities in third-party products; (c) compromised firmware, hardware implants, or hardware-level backdoors introduced by a manufacturer or distributor prior to Yama's possession, deployment, or recommendation; and (d) nation-state, state-sponsored, advanced persistent threat, or other sophisticated cyberattack campaigns targeting shared infrastructure, vendor ecosystems, or industry-wide platforms (collectively, "Supply Chain and Advanced Threat Events").

#### **25.2 No Warranty Against Supply Chain Compromise**

Yama makes no representation, warranty, or guarantee that any software, firmware, hardware, appliance, platform, subscription service, monitoring tool, management console, security product, or other technology that Yama deploys, installs, configures, recommends, procures, or manages on Customer's behalf is free from supply chain compromise, manufacturer-introduced vulnerabilities, developer-level backdoors, firmware-level implants, compromised update mechanisms, or any other condition introduced into the product or service prior to, during, or after Yama's engagement with such product or service.

This disclaimer applies regardless of:

(a) the reputation, market standing, or certification status of the vendor, developer, or manufacturer; (b) whether Yama recommended, specified, procured, or installed the affected product or service; (c) whether the affected product or service was under an active Yama-support subscription at the time of compromise; or (d) whether the supply chain compromise was publicly known, privately disclosed, or undisclosed at the time of Yama's deployment or management of the affected product.

#### **25.3 Vendor-Introduced Compromise; Deployed Tools**

Where Yama deploys, installs, configures, or manages any third-party software tool, agent, platform, or application on Customer's systems, networks, or devices — including without limitation remote monitoring and management (RMM) agents, network management platforms, unified communications software, security information and event management (SIEM) tools, endpoint detection agents, firewall management consoles, cloud management platforms, or any similar tool — and such tool is subsequently determined to have been compromised at the vendor, developer, distributor, or update-delivery level prior to or during its authorized use ("Vendor-Introduced Compromise"), the following applies:

(a) Yama's deployment, installation, configuration, or support of the compromised tool does not constitute negligence, breach of contract, breach of warranty, or violation of any duty of care owed to Customer, provided that Yama's deployment of the tool was consistent with ordinary industry practice at the time of deployment;

(b) Yama has no liability for any loss, damage, data breach, regulatory penalty, notification obligation, business interruption, or other consequence arising from or relating to a Vendor-Introduced Compromise, regardless of whether such compromise was exploited before or after Yama became aware of the compromise;

(c) Yama's sole obligation upon becoming aware of a confirmed or credible Vendor-Introduced Compromise affecting tools deployed in Customer's environment is to notify Customer within a commercially reasonable time and to use commercially reasonable efforts to assist in remediating or replacing the affected tool, which remediation and replacement constitute billable Ad-Hoc Services under Section 4.2; and

(d) Customer acknowledges that Yama, as a service provider, may deploy the same or similar tools across multiple customer environments, and that a Vendor-Introduced Compromise may simultaneously affect multiple Yama customers; Yama's prioritization of remediation efforts across its customer base in such circumstances shall not constitute a breach of any obligation owed to Customer.

#### **25.4 Hardware Supply Chain; Firmware and Implants**

Yama makes no representation or warranty regarding the integrity, authenticity, or security of the hardware, firmware, embedded software, microcode, or manufacturing provenance of any device, appliance, component, or equipment that Yama procures, recommends, deploys, or supports, including without limitation network appliances, firewalls, routers, switches, access points, servers, storage devices, telephony equipment, cameras, IoT devices, or endpoint devices.

Yama has no obligation to perform hardware supply chain audits, firmware integrity verification, component authenticity testing, or manufacturer provenance investigation with respect to any device, unless such obligation is expressly stated in a signed Order Form. Yama is not liable for any loss, compromise, breach, or failure arising from hardware-level supply chain compromise, counterfeit components, backdoored firmware, or implanted hardware introduced by any manufacturer, distributor, reseller, or logistics participant, regardless of whether Yama procured, recommended, or installed the affected hardware.

#### **25.5 Zero-Day and Undisclosed Vulnerabilities**

Yama has no obligation to detect, prevent, or remediate any security vulnerability that was not publicly disclosed or otherwise known to the information security community as of the date on which Yama last performed the relevant configuration, support, patching, or security-related service for the affected system ("Zero-Day Vulnerability").

Yama is not liable for any loss, damage, breach, or failure arising from exploitation of a Zero-Day Vulnerability, regardless of whether:

(a) the Zero-Day Vulnerability existed in a product or system under an active Yama support subscription; (b) the Zero-Day Vulnerability was subsequently disclosed and Yama was not immediately aware of such disclosure; (c) a patch, workaround, or mitigation for the Zero-Day Vulnerability was available from the vendor but had not yet been applied by Yama; or (d) exploitation of the Zero-Day Vulnerability occurred during a period when Yama held administrative access to the affected system.

Notwithstanding the foregoing, where Yama has assumed an express patching obligation for a specific system under a signed Order Form or Service Level Agreement, Yama's liability for failure to apply a publicly released patch within the timeframe specified in such Order Form or Service Level Agreement remains governed by Article 14 and Article 15 and is not expanded by this Section.

#### **25.6 Nation-State, State-Sponsored, and Advanced Persistent Threat Events**

Yama has no liability for any loss, damage, breach, compromise, data exfiltration, system destruction, or service disruption arising from any cyberattack, intrusion, or campaign attributable to, sponsored by, directed by, or carried out by or on behalf of any national government, government agency, state-sponsored group, military or intelligence organization, or advanced persistent threat ("APT") actor, regardless of:

(a) whether such attack targeted Customer specifically, Yama specifically, or a broader vendor ecosystem of which Customer or Yama is a part; (b) whether Yama held administrative access to the affected systems at the time of the attack; (c) whether the attack exploited a known or unknown vulnerability in a system under Yama's management; (d) whether the attack originated through a supply chain vector, a Vendor-Introduced Compromise, or a direct intrusion; or (e) whether any governmental authority subsequently attributes the attack to a nation-state or APT actor after the fact.

Nation-state and APT attacks constitute Force Majeure Events within the meaning of Article 17 and independently constitute events excluded from Yama's liability under this Article 25, such that both Article 17 and this Article 25 apply concurrently to the same event.

#### **25.7 Customer's Independent Cyber Insurance Obligation**

Customer acknowledges that Supply Chain and Advanced Threat Events of the type described in this Article 25 represent a category of risk that is:

(a) beyond the reasonable control of any service provider; (b) industry-wide in scope and not specific to Yama's performance; and (c) appropriately addressed through Customer's own cyber liability insurance, property insurance, and business interruption insurance coverage.

Customer is solely responsible for maintaining cyber liability insurance coverage adequate to address losses arising from Supply Chain and Advanced Threat Events, and Customer's failure to maintain such coverage does not expand Yama's liability under this Agreement.

#### **25.8 Remediation Services; Incident Response**

Where Customer requests Yama's assistance in responding to, investigating, containing, or remediating any Supply Chain or Advanced Threat Event, all such assistance constitutes Ad-Hoc Services under Section 4.2 and is billable at Yama's then-current rates unless a specific incident response engagement is separately scoped and signed. Yama has no obligation to provide incident response, forensic investigation, regulatory notification assistance, or remediation services absent a separate written engagement.

#### **25.9 Transitive and Indirect Dependencies**

The protections set forth in Section 25.3 apply equally to any compromise, vulnerability, or malicious payload introduced through any dependency, sub-dependency, transitive dependency, or indirect dependency of any software, tool, agent, platform, or application that Yama deploys, installs, configures, or supports, regardless of whether Yama had direct knowledge of the existence, identity, or version of such transitive or indirect dependency at the time of deployment or management.

Customer acknowledges that modern software tools, management platforms, monitoring agents, and development frameworks routinely incorporate complex dependency chains comprising hundreds or thousands of individual packages, libraries, and modules, many of which are maintained by independent third parties outside of any software vendor's direct control. Yama has no obligation to audit, inventory, verify, or monitor the security integrity of any transitive or indirect dependency of any software it deploys or supports, and the compromise of any such transitive or indirect dependency — including without limitation through maintainer account hijacking, malicious package publication, dependency confusion attacks, or poisoned update delivery — constitutes a Vendor-Introduced Compromise within the meaning of Section 25.3, subject to all exclusions and protections set forth therein.


# MAIN SERVICE AGREEMENT

Customer services guidelines, processes & procedures

## YAMA INDUSTRIALS, INC. - MAIN SERVICE AGREEMENT <a href="#yama-industrials-inc---main-service-agreement" id="yama-industrials-inc---main-service-agreement"></a>

This Main Service Agreement ("MSA") is entered into as of the Effective Date of the first Order Form by and between **Yama Industrials, Inc.**, a Wyoming corporation (hereinafter referred to as "Yama," "Yama Industrials," or the "Company"), and the customer entity identified in the Order Form ("Client").

### RECITALS <a href="#recitals" id="recitals"></a>

**WHEREAS**, Company provides specialized technology products and related advisory services ("Services"); and

**WHEREAS**, Client desires to procure such Services.

**NOW, THEREFORE**, the parties agree as follows:

### 1. SERVICES, ORDER FORMS, AND SCOPE OF WORK

1.1. **Services and Order Forms**. Yama Industrials, Inc. ("Yama Industrials") agrees to provide the services and products ("Services" and "Products") as described in one or more order forms or statements of work ("Order Form") executed by both parties.\
1.2. **Definition of Order Form**. For the purposes of this Agreement, an "Order Form" shall be defined as any statement of work, proposal, quote, email, other written communication, or verbal authorization that requests or authorizes the provision of Services.\
1.3. **Verbal Authorization**. In the event of a Client's verbal authorization, the subsequent commencement of work by Yama Industrials shall serve as conclusive proof of the Client's request and its acceptance of this Agreement. All Services performed are subject to the fees and payment terms of this Agreement and all policies incorporated herein by reference, regardless of whether such fees are specified in the initial Order Form.\
1.4. **Incorporation and Precedence**. Each Order Form is incorporated into this Main Service Agreement ("Agreement") and is subject to the terms and conditions of this Agreement and all policies published at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/) and incorporated herein by reference. In the event of any conflict between an Order Form and this Agreement or any incorporated policy, the terms of this Agreement and the incorporated policies shall control.\
1.5. **Modification of Services**. Yama Industrials reserves the right to modify, suspend, or discontinue any Service or Product at any time, with or without notice, in its sole discretion.\
1.6. **Client Responsibility for Policy Review**. This Agreement may incorporate by reference one or more online policies. The Company reserves the right to amend such policies at its sole discretion by posting the amended versions to the applicable URL. The Company is not obligated to provide individual notice of such amendments. The Client is solely responsible for periodically reviewing all referenced policies in accordance with its own review standards. The Client's continued use of the Services following the posting of any amendments constitutes its binding acceptance thereof.

### 2. SERVICE TERMS AND RENEWALS

Services may be provided on a term basis (as specified in the Order Form or invoice) or on an ad-hoc, project, or time-and-materials basis (as specified in the Order Form or invoice). For term-based Services, the Initial Service Term shall be as specified in the Order Form. At the end of the Initial Service Term, Services will automatically transition to Ad-Hoc Support Status as governed by the Post-Agreement & Ad-Hoc Support Policy, available at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/), unless Client renews for an additional term. Yama Industrials will provide Client with notice of the upcoming expiration at least sixty (60) days prior to the end of the Service Term, as a courtesy. Such notice may be provided via email, telephone, or other means of communication. This notice is provided as a courtesy to allow Client the opportunity to renew services. Failure to provide such notice does not extend the Service Term, does not impose any liability on Yama Industrials, and does not prevent the automatic transition to Ad-Hoc Support Status. Client is responsible for monitoring the expiration date and initiating renewal requests. If Client elects to renew, the renewal may be documented through a new Order Form, an amendment to the existing Order Form, or verbal agreement with Yama Industrials prior to the end of the Service Term. Any renewal will incorporate the current version of this Main Service Agreement and all related policies as published at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/)at the time of renewal. Services may include, but are not limited to: technical support, implementation, configuration, installation, training, and related professional services.

### 3. AD-HOC SERVICES, CHANGE ORDERS, AND ACCEPTANCE

3.1. **Deemed Acceptance**. If Client fails to review or respond to any Deliverable within ten (10) business days of delivery, the Deliverable shall be deemed accepted.\
3.2. **Micro-SOWs**. Client may request ad-hoc services ("Ad-Hoc Services"). Company may confirm via a Written Confirmation (email, SMS, or DM). Client acknowledges and agrees that failure to dispute a Written Confirmation within one (1) business day constitutes affirmative acceptance of the "Micro-SOW."\
3.3. **On-Site Authority**. Client represents that any on-site personnel requesting Ad-Hoc Services have authority to bind Client.

### 4. IMPLEMENTATION AND CONFIGURATION

4.1. **Process and Timelines**. Yama Industrials will supply and configure the Products and Services in accordance with the specifications set forth in the Order Form. Implementation timelines are estimates only and are subject to change based on factors including Customer cooperation, site readiness, and third-party dependencies.

### 5. CLIENT OBLIGATIONS

Client has an obligation to meet certain requirements when engaging Yama Industrials' Services. Client agrees to:\
(a) provide accurate and complete information necessary to perform the Services;\
(b) provide timely access to systems, networks, facilities, and personnel as reasonably required by Yama Industrials to perform the Services;\
(c) comply with all applicable laws and regulations in connection with its use of the Services and Products;\
(d) notify Yama Industrials promptly of any issues, problems, or changes that may affect the Services;\
(e) comply with the Acceptable Use Policy set forth in Section 19 of this Agreement;\
(f) monitor the expiration date of the Service Term and proactively communicate renewal decisions to Yama Industrials.

### 6. SERVICE LEVEL AGREEMENT

Service level commitments, if any, are defined in a separate Service Level Agreement document or in the applicable Order Form. In the absence of a specific Service Level Agreement, no uptime guarantees or service level commitments are provided.

### 7. EQUIPMENT AND SOFTWARE

7.1. **Client's Pre-Existing Equipment**. Client is solely responsible for all hardware, software, and equipment that Client owned, leased, or otherwise controlled prior to engaging Yama Industrials' Services ("Client Equipment"). This includes, but is not limited to, routers, switches, firewalls, servers, workstations, and related infrastructure that existed before the commencement of Services. Client retains all ownership rights to Client Equipment and is solely responsible for the maintenance, security, licensing, and support of all Client Equipment. Yama Industrials disclaims any and all warranty or maintenance responsibility for Client Equipment. Yama Industrials is not responsible or liable for any delay or failure in the Services caused by Client Equipment malfunction, configuration errors, incompatibility, end-of-life status, or any other issues related to Client Equipment. Any delays or re-work caused by Client Equipment issues shall be treated as billable time.\
7.2. **Yama-Provided Equipment (Leased, Rented, or Subscribed)**. All hardware, software, or other equipment provided, leased, rented, or subscribed to by Yama Industrials as part of the Services ("Yama Equipment") remains the sole and exclusive property of Yama Industrials, Inc., regardless of where such equipment is physically located. Client is granted a limited, non-exclusive, non-transferable right to use Yama Equipment during the Service Term solely for the purposes of receiving the Services. Upon termination of this Agreement for any reason, Client must return all Yama Equipment to Yama Industrials in good working condition, subject to normal wear and tear, within fifteen (15) days. Client is responsible for all shipping costs associated with the return of Yama Equipment. Failure to do so will result in Client being invoiced for the full replacement value of such equipment.

### 8. THIRD-PARTY PRODUCTS AND SERVICES

8.1. **Third-Party Offerings**. Yama Industrials may resell, recommend, or implement third-party hardware, software, or services. All third-party products and services are subject to the terms, conditions, warranties, and support provided by the respective third-party vendor.\
8.2. **No Warranty and Limitation of Liability**. Yama Industrials makes no warranties or representations regarding third-party products or services. Customer is solely responsible for reviewing and accepting third-party terms and conditions. Yama Industrials is not liable for any issues, failures, defects, or security vulnerabilities in third-party products or services.

### 9. PAYMENT TERMS, TAXES, AND BILLING DISPUTES

9.1. **Invoicing and Fees**. Client shall pay all fees by the due date specified on the applicable invoice. If no due date is specified, payment is due within thirty (30) days of the invoice date. Late payments will accrue interest at a rate of 1.5% per month, or the maximum rate allowed by law, whichever is lower.\
9.2. **Suspension for Non-Payment**. Company may suspend all Services if any invoiced amount remains unpaid for more than forty-five (45) days from the due date. An amount disputed by the Client not in good faith shall be considered unpaid for purposes of this section.\
9.3. **Taxes**. Client is responsible for all sales, use, excise, value-added, and other taxes or duties associated with the Services and Products, excluding taxes based solely on Yama Industrials' net income. If Yama Industrials is required to collect or pay such taxes, Client will reimburse Yama Industrials for such amounts.\
9.4. **Billing Disputes**. Client must notify Yama Industrials in writing of any good-faith billing dispute within thirty (30) days of the invoice date. Failure to dispute an invoice within this period shall be deemed an acceptance of the invoice and a waiver of Client's right to dispute such invoice. Disputes must be sent to:

Yama Industrials, Inc.\
Attn: Billing Department\
800 Third Avenue #1292\
New York, NY 10022\
Email: <info@yamaindustrials.com>

Unless otherwise required by law, Client shall remit full payment of all invoiced charges by the due date, including any amounts subject to a good-faith dispute. Any adjustments or credits agreed upon by the parties will be applied to a subsequent invoice. For the avoidance of doubt, any amount not reasonably disputed in good faith shall be treated as unpaid for purposes of Sections 9.2 and 9.9 if not received when due. For the avoidance of doubt, Section 3.1 governs Client's time period to review and dispute any Deliverables, and nothing in this Section 9.4 extends or modifies the acceptance period for Deliverables.

9.5. **Scope of Billing Disputes**. Billing disputes are limited to claims that Services or Products were not provided as agreed or that charges contain a billing error. Disputes regarding invoice format, level of detail, billing methodology, or presentation are not valid grounds for non-payment. Yama Industrials reserves the right to invoice using the format and level of detail it determines appropriate based on the services provided, including flat fees, hourly rates, or other pricing structures as specified in the Order Form.\
9.6. **Payment as Acceptance**. Client's payment of any portion of an invoice constitutes final, irrevocable acceptance of the work performed as detailed in that specific invoice up to the date of payment.\
9.7. **Revocation of License for Non-Payment**. The license to use the Deliverables granted in Section 10.1 is expressly conditioned on the Client's timely and full payment of all invoices. In the event that a Client fails to pay any invoice in full within the time period specified in Section 9.1, the license to use the Deliverables is immediately and automatically revoked. The Client must immediately cease all use of the Deliverables and, at the Company's request, provide written certification that it has done so.\
9.8. **Contemporaneous Exchange for New Value**. The parties acknowledge and agree that all payments made by the Client to the Company under this Agreement are intended to be a contemporaneous exchange for new value. Each payment is for new services rendered and is not intended to be a payment on account of a pre-existing debt.\
9.9. **Overdue Accounts and Collections**. In addition to any other remedies available to Company, if any invoiced amount remains past due for more than sixty (60) days, Company may, without further notice, refer the account to a third-party collection agency or other collections provider, and may share Client information with such provider to the extent permitted by applicable law and Company's Privacy Policy. Client agrees to be responsible for and reimburse Company for all reasonable costs incurred in collecting past due amounts, including but not limited to collection agency fees, reasonable attorneys' fees, and court costs, to the extent permitted by applicable law.\
9.10. **Annual Price Adjustment**. Yama Industrials reserves the right to increase fees for Services and Products once every twelve (12) months. Such increase shall be the greater of: (a) five percent (5%); or (b) the percentage increase in the Consumer Price Index (CPI-U) for the preceding year.\
9.11. **No Set-Off**. Client shall pay all amounts due under this Agreement without set-off, counterclaim, deduction, or withholding of any kind.

### 10. INTELLECTUAL PROPERTY

10.1. **License**. Upon full payment, and provided that the Client is not in material breach of any of its obligations under this MSA, Company grants Client a non-exclusive, perpetual license to use the final work product ("Deliverables"). Company retains all rights to its underlying methodologies and tools. Client shall not reverse engineer, decompile, or otherwise attempt to derive the source code or trade secrets from any Deliverable.\
10.2. **Feedback**. If Client provides Company with any suggestions, comments, improvements, ideas, or other feedback regarding the Services ("Feedback"), Client hereby grants Company a worldwide, perpetual, irrevocable, royalty-free, fully paid-up, transferable, and sublicensable license to use, copy, modify, distribute, display, perform, and otherwise exploit such Feedback, in any form and for any purpose, including to improve or develop products and services, without any obligation or compensation to Client. For clarity, Feedback shall not be considered Client's Confidential Information.\
10.3. **Aggregated Statistics**. Notwithstanding anything to the contrary in this Agreement, Yama Industrials may monitor Client's use of the Services and collect and compile Aggregated Statistics. As between Yama Industrials and Client, all right, title, and interest in Aggregated Statistics, and all intellectual property rights therein, belong to and are retained solely by Yama Industrials. Client acknowledges that Yama Industrials may compile Aggregated Statistics based on Client Data input into the Services. Client agrees that Yama Industrials may (i) make Aggregated Statistics publicly available in compliance with applicable law, and (ii) use Aggregated Statistics to the extent and in the manner permitted under applicable law. "Aggregated Statistics" means data and information related to Client's use of the Services that is used by Yama Industrials in an aggregate and anonymized manner.

### 11. CONFIDENTIALITY

11.1. **Obligations**. The receiving party shall protect the disclosing party's Confidential Information with at least reasonable care.\
11.2. **Exclusions**. Confidential Information does not include information that: (a) is or becomes publicly available without breach of this Agreement; (b) was known to the receiving party without restriction before receipt; (c) is independently developed without use of the disclosing party's Confidential Information; or (d) is rightfully received from a third party without restriction. For the avoidance of doubt, Client-side data that the Company cannot access shall not be deemed Confidential Information in the Company's possession, and any Deliverables that have not yet been paid for shall be considered the Confidential Information of Yama.

### 12. DATA PROTECTION AND PRIVACY

12.1. **Data Handling**. Yama Industrials will handle Customer data in accordance with its Privacy Policy, Zero-Knowledge Policy, and applicable data protection laws. For healthcare clients, HIPAA compliance terms are governed by a separate Business Associate Agreement.\
12.2. **Customer Warranty**. Customer represents and warrants that it has obtained all necessary consents and permissions to provide any personal data or protected information to Yama Industrials in connection with the Services.

### 13. TERM AND TERMINATION

13.1. **Term**. This Agreement begins on the Effective Date and continues for the Initial Service Term specified in the Order Form, unless earlier terminated as provided herein.\
13.2. **Termination for Cause by Yama Industrials**. Yama Industrials may terminate this Agreement with immediate effect if the Customer is in material breach of this Agreement. A material breach is defined as, but not limited to, the non-payment of fees as detailed in the Post-Agreement & Ad-Hoc Support Policy. Upon termination under this section, all fees for the remainder of the then-current Service Term shall be accelerated and become immediately due and payable as liquidated damages and not as a penalty. The parties acknowledge and agree that Yama Industrials' actual damages in the event of such termination would be difficult to ascertain, and that this amount represents a reasonable estimate of the damages Yama Industrials would suffer, including but not limited to lost profits, committed resources, and unrecouped onboarding costs.\
13.3. **Termination for Convenience**. Yama Industrials may terminate this Agreement without cause upon sixty (60) days' written notice. Client may not terminate this Agreement for convenience.\
13.4. **Effect of Termination**. Upon expiration or termination of this Agreement for any reason, Customer's account will transition to Ad-Hoc Support Status as governed by the Post-Agreement & Ad-Hoc Support Policy, available at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/). Customer must immediately cease using all Services and Products for which subscriptions have expired or been terminated. Customer remains obligated to pay all fees and charges incurred through the termination date, plus any applicable termination fees.\
13.5. **Survival**. The following sections shall survive termination: 9, 10, 11, 12, 13, 14, 15, 16, 17, and 18.

### 14. INDEMNIFICATION

14.1. **By Company**. Company will defend and indemnify Client from third-party claims alleging the Deliverables infringe a third-party IP right. This obligation shall not apply to claims arising from: (a) Client's modifications; (b) use with third-party systems not provided by Company; (c) Client's data; or (d) Company's compliance with Client's instructions.\
14.2. **By Client**. Client will defend and indemnify Company from claims arising from Client's misuse of Services, Client's data, or breach of this MSA.\
14.3. **Procedure**. The Indemnifying Party controls the defense but may not settle any claim without the Indemnified Party's prior written consent, which shall not be unreasonably withheld, conditioned, or delayed, and provided such settlement does not impose any admission of liability or obligation on the Indemnified Party.

### 15. WARRANTIES AND COOPERATION

15.1. **Company Warranty**. Company warrants Services will be performed in a professional manner.\
15.2. **Client Cooperation**. Client agrees to cooperate in good faith.\
15.3. **DISCLAIMER OF WARRANTIES**. Yama Industrials does not warrant or guarantee that the Services and Products will be uninterrupted, error-free, or completely secure. The Services and Products are provided on an "as is" and "as available" basis. To the maximum extent permitted by applicable law, Yama Industrials disclaims all warranties, whether express, implied, or statutory, including but not limited to warranties of merchantability, fitness for a particular purpose, title, and non-infringement. Yama Industrials does not warrant that the Services will meet Customer's specific requirements or that any defects will be corrected. Customer acknowledges that the use of the Services and Products is at Customer's sole risk. This disclaimer does not affect any warranties that cannot be excluded or limited under applicable law.

### 16. LIMITATION OF LIABILITY

16.1. **EXCLUSION OF INDIRECT DAMAGES**. IN NO EVENT WILL COMPANY BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, OR SPECIAL DAMAGES.\
16.2. **MONETARY CAP**. COMPANY'S TOTAL LIABILITY SHALL NOT EXCEED THE FEES PAID BY CLIENT UNDER THE APPLICABLE SOW IN THE 12 MONTHS PRECEDING THE CLAIM.\
16.3. **Exclusions from Cap**. The Monetary Cap shall not apply to: (a) indemnification obligations; or (b) Client's payment obligations. Notwithstanding anything to the contrary in this Agreement, Yama Industrials' indemnification obligations under Section 14.1 are expressly subject to the Monetary Cap set forth in Section 16.2. Data breaches and breaches of confidentiality shall remain subject to the Monetary Cap.

### 17. DISPUTE RESOLUTION

17.1. **Good Faith Negotiation**. Parties agree to first negotiate any dispute in good faith.\
17.2. **Executive Escalation**. If unresolved, the dispute will be escalated to a senior executive from each party.\
17.3. **Mandatory Mediation**. If still unresolved, the dispute will be submitted to mandatory, non-binding mediation in a location to be mutually agreed upon by the parties. If no agreement can be reached, the mediation shall take place in New York, NY.\
17.4. **BINDING ARBITRATION**. IF A DISPUTE REMAINS UNRESOLVED, IT SHALL BE FINALLY RESOLVED BY BINDING ARBITRATION ADMINISTERED BY JAMS IN A LOCATION TO BE MUTUALLY AGREED UPON BY THE PARTIES. IF NO AGREEMENT CAN BE REACHED, THE ARBITRATION SHALL TAKE PLACE IN NEW YORK, NEW YORK. NOTWITHSTANDING THE FOREGOING, EITHER PARTY MAY SEEK TEMPORARY OR INJUNCTIVE RELIEF IN ANY COURT OF COMPETENT JURISDICTION TO PREVENT IRREPARABLE HARM PENDING ARBITRATION.

### 18. GENERAL PROVISIONS

18.1. **Entire Agreement**. This Agreement, together with all Order Forms and incorporated policies and documents, constitutes the entire agreement between the parties and supersedes all prior agreements, understandings, and communications, whether written or oral, relating to the subject matter hereof.\
18.2. **Amendments**. Yama Industrials may amend this Agreement at any time by posting the revised terms at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/). It is Customer's responsibility to review the Agreement periodically for changes. Continued use of the Services after any amendment constitutes acceptance of the amended terms.\
18.3. **Assignment**. Customer may not assign or transfer this Agreement without Yama Industrials' prior written consent. Yama Industrials may assign this Agreement to any affiliate or in connection with a merger, acquisition, or sale of assets. Any attempted assignment in violation of this section is void.\
18.4. **Waiver**. No waiver of any provision of this Agreement will be effective unless in writing and signed by the party against whom the waiver is sought. No waiver of any breach will constitute a waiver of any subsequent breach.\
18.5. **Severability**. If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions will remain in full force and effect, and the invalid provision will be modified to the minimum extent necessary to make it valid and enforceable.\
18.6. **Independent Contractors**. The parties are independent contractors. This Agreement does not create a partnership, joint venture, agency, or employment relationship between the parties.\
18.7. **Notices**. All notices under this Agreement must be in writing and delivered to the addresses specified in the Order Form or in this Agreement. Notices may be delivered by email, certified mail, or nationally recognized courier service. Notices are deemed received upon delivery.\
18.8. **No Third-Party Beneficiaries**. This Agreement is for the sole benefit of the parties and does not confer any rights upon any third party.\
18.9. **Counterparts**. This Agreement and any Order Forms may be executed in counterparts, each of which will be deemed an original and all of which together will constitute one agreement. Electronic signatures are valid and binding.\
18.10. **Force Majeure**. Neither party will be liable for any delay or failure to perform its obligations under this Agreement due to causes beyond its reasonable control, including but not limited to, acts of God, war, terrorism, civil unrest, strikes or other labor disputes, natural disasters, government actions, pandemics, epidemics, or other public health emergencies; internet, telecommunications, or power failures; supply chain or third-party service provider failures; cosmic events (including, but not limited to, solar flares, geomagnetic storms, and meteorite impacts); malicious software (including, but not limited to, ransomware and AI-driven cyberattacks); and any other unforeseen events or circumstances.\
18.11. **Limitation on Actions**. No legal action may be brought more than one (1) year after the cause of action arises, to the extent permitted by applicable law.\
18.12. **Zero-Knowledge and Data Handling**. The Company's services are provided on a "zero-knowledge" basis. All Client data is processed on the client-side, and the Company has no ability to access, view, or decrypt such information. As such, Client is solely and exclusively responsible for the security and backup of its data. Any personally identifiable information collected by the Company for the purposes of account management and billing shall be governed by the Company's public-facing Privacy Policy, which is incorporated herein by reference. The Company shall not be liable for any loss or breach of data that is not in its direct possession and control.\
18.13. **Non-Solicitation**. During the Term and for twelve (12) months thereafter, Client shall not knowingly solicit for employment or hire any employee or contractor of Yama Industrials with whom Client had contact during the performance of the Services. In the event Client hires an employee in violation of this Section, Client agrees to pay Yama Industrials a "Placement Fee" equal to thirty percent (30%) of said employee's first-year total guaranteed compensation. The parties agree that this fee represents a reasonable estimate of the standard market costs associated with recruiting, hiring, and training a replacement.\
18.14. **Governing Law & Jurisdiction**. This Agreement is governed by New York law. Courts of competent jurisdiction in the State of New York, County of New York, shall have authority solely to compel arbitration, enforce arbitration awards, and issue provisional or injunctive relief in aid of arbitration.\
18.15. **Publicity**. Neither party may use the other's name or logo in marketing materials without prior written consent. Notwithstanding the foregoing, Yama Industrials may use Client's name, logo, and general description of the Services provided in marketing materials, case studies, and on its website. Client may revoke this right by submitting a written request to <legal@yamaindustrials.com>.\
18.16. **Attorney's Fees**. The prevailing party in any dispute is entitled to recover its reasonable attorney's fees and court costs.

### 19. ACCEPTABLE USE

This Section applies solely to Client's use of any Subscription Services or access to Company-operated systems. Client shall not use the Subscription Services to: (a) transmit unlawful material; (b) transmit malicious code; (c) attempt to gain unauthorized access to any systems; or (d) violate any applicable laws. A breach of this Section is a material breach of this Agreement.


# Terms of Service Disclaimer

Additional Policies/Terms-of-Service/Privacy Terms

### Third-Party Service Providers <a href="#third-party-service-providers" id="third-party-service-providers"></a>

Yama Industrials, Inc. utilizes third-party service providers to deliver certain products and services. When you use these third-party services, your use is governed by the applicable third-party provider's terms and conditions.


# Independent Contractor Relationship

Document ID: YI-POL-001

Effective Date: October 27, 2025\
Version: 1.0

### Nature of Service Relationship

Yama Industrials, Inc., including all divisions, subsidiaries, employees, contractors, and agents (collectively "Yama Industrials") provides technology services as an independent contractor. This document defines the boundaries of our service relationship with all clients.

### What Yama Industrials IS:

✓ An independent contractor providing specific, defined technical services\
✓ A technology solutions provider focused on implementation and advisory services\
✓ A provider of cybersecurity guidance, advisory, and technical implementation\
✓ A vendor of specific technical products and services as explicitly contracted\
✓ A professional services firm with limited, clearly defined scope of work

### What Yama Industrials IS NOT:

✗ Not an Employee – We are not your staff, employee, or agent\
✗ Not Your IT Department – We do not assume responsibility for your overall IT strategy or operations\
✗ Not Your CISO – We are not your Chief Information Security Officer\
✗ Not Your CIO – We are not your Chief Information Officer\
✗ Not Your IT Director/Manager – We do not serve in any executive, management, or administrative IT capacity\
✗ Not Your Systems Administrator – We do not assume day-to-day IT operational responsibility

✗ Not Your Managed Service Provider (MSP) or Managed Security Service Provider (MSSP)

### Client Retains Ultimate Responsibility For:

The client retains sole and exclusive responsibility for:

* IT Strategy & Planning – Overall technology direction and roadmap
* Infrastructure Design – Network architecture, topology, and design decisions
* Vendor Selection & Management – Choosing and overseeing technology vendors
* Budget & Purchasing Decisions – IT spending and procurement
* Regulatory Compliance – Meeting industry, legal, and regulatory requirements
* Cybersecurity Posture – Overall security strategy and risk management
* Day-to-Day IT Operations – Ongoing management and operational oversight
* Business Continuity – Disaster recovery and business resilience planning
* Acceptance or Rejection of Recommendations – Implementation of any advice provided

### Scope of Yama Industrials Services

Yama Industrials provides only those specific services explicitly defined in each service agreement, statement of work, or contract. Our services are:

* Limited in Scope – Restricted to the specific technical deliverables contracted for
* Advisory in Nature – Recommendations are guidance only; implementation is at client's discretion
* Not Comprehensive – We do not assume responsibility for aspects of your IT infrastructure outside our specific contracted services

### Legal Effect

By engaging Yama Industrials for any services:

1. The client acknowledges and agrees to this Independent Contractor Relationship
2. The client agrees that Yama Industrials has not assumed any role, title, or responsibility beyond the specific services contracted for
3. The client accepts sole responsibility for all IT and cybersecurity decisions outside the explicit scope of contracted services
4. The client agrees to indemnify Yama Industrials for any claims arising from the client's own IT decisions, infrastructure design, or vendor management

### Incorporation by Reference

This policy is incorporated by reference into all Yama Industrials service agreements, terms of service, and related documents. It is accessible at resources.yamaindustrials.com, as noted on all client invoices.

For additional context on Yama Industrials' business model, see our Solutions Provider Disclaimer at resources.yamaindustrials.com/disclaimer-solutions-provider

**Questions? Contact: <info@yamaindustrials.com>**


# Disclaimer: Solutions Provider

Yama Industrials as a whole is a Technology Advisory  Solutions Provider

Understanding Our Role as a Solutions Provider

We want to clarify that we operate primarily as a solutions provider rather than a managed service provider (MSP) or managed security service provider (MSSP).

<mark style="color:yellow;">**Key Differences:**</mark>&#x20;

<mark style="color:blue;">**Solutions Provider:**</mark> We offer multi-vendor solutions, crafting custom technology strategies that integrate various products and services tailored to meet your specific business challenges. Our goal is to ensure that the technology we implement aligns seamlessly with your overall business objectives.&#x20;

<mark style="color:blue;">**MSP/MSSP:**</mark> These providers typically offer menu-based services with predefined packages and preferred vendor products. Their focus is often on standardizing solutions, which may not fully address the unique needs of your organization.&#x20;

<mark style="color:yellow;">**Advantages of Being a Solutions Provider:**</mark>

<mark style="color:blue;">**Customized Multi-Vendor Solutions:**</mark> We leverage a diverse range of technologies and partnerships, allowing us to choose the best tools for your specific needs rather than being limited to a single vendor’s offerings.&#x20;

<mark style="color:blue;">**Business-Centric Focus:**</mark> Our primary aim is to create solutions that fit your business requirements. We prioritize understanding your operational goals and challenges, ensuring the technology serves as an enabler rather than a constraint.&#x20;

<mark style="color:blue;">**Flexibility and Adaptability:**</mark> We have the agility to adjust our approach as your business evolves, ensuring that our solutions remain effective in a dynamic market.&#x20;

<mark style="color:blue;">**Expertise in Implementation:**</mark> Our team specializes in designing and implementing solutions that not only meet technical requirements but also enhance overall business performance.&#x20;

<mark style="color:blue;">**Focus on Innovation:**</mark> We emphasize innovative strategies and technologies, helping you stay competitive while aligning IT investments with your long-term business vision.&#x20;

By partnering with us as your solutions provider, you gain a dedicated ally focused on delivering bespoke technology solutions that truly fit your business needs.


# Yama Universal Terms

## Yama Universal Terms and Conditions

#### 1. Acceptance of Terms

1.1. These Yama Universal Terms and Conditions ("Universal Terms") govern all services, products, and deliverables provided by Yama Industrials, Inc. ("Yama") to any client, customer, or end-user ("Client").

1.2. Payment of any invoice referencing [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com) constitutes explicit acceptance of these Universal Terms and all policies incorporated herein. These Universal Terms apply to all service agreements, statements of work, and purchase orders unless explicitly superseded by a signed, written agreement.

#### 2. Service Scope and Limitations

2.1. All services provided by Yama are strictly limited to the scope explicitly defined in a written service agreement, statement of work, or other mutually executed contract.

2.2. Yama shall have no liability or obligation for any systems, hardware, software, services, or security controls outside the explicitly defined scope of a written service agreement.

#### 3. No Implied Duty or Retained Responsibility

3.1. Yama shall have no obligation to identify, document, notify, or remediate Client cybersecurity deficiencies, vulnerabilities, or misconfigurations *unless explicitly contracted in writing for such services*. Yama is not the Client's IT department, retained IT personnel, or ongoing technology advisor. Yama's role is limited to the specific services explicitly defined in written service agreements.

3.2. If Yama personnel voluntarily provide informal observations or recommendations regarding issues outside the scope of a written agreement, such communications are provided as a courtesy only. They do not constitute an expansion of the service scope, do not create any new obligations, and do not constitute acceptance of responsibility for identifying, documenting, or resolving such issues.

#### 4. Third-Party Products and Services

4.1. Yama is a solutions provider that implements, configures, supports, or recommends third-party products and services. Yama does not provide any warranty, express or implied, for any third-party hardware, software, or services.

4.2. All third-party products and services are subject to the terms, conditions, and warranties of the respective third-party provider. Client is solely responsible for reviewing and complying with all third-party license agreements, terms of service, and privacy policies.

4.3. No liability shall attach to Yama for the failure, malfunction, or security vulnerability of any third-party product or service, even if recommended or implemented by Yama.

#### 5. Client Responsibility for Cybersecurity

5.1. The Client is solely and exclusively responsible for its own cybersecurity posture, including but not limited to implementing and maintaining appropriate administrative, physical, and technical safeguards.

5.2. Knowledge of a Client's security deficiencies, whether discovered incidentally or otherwise, does not create an obligation for Yama to act. No liability shall attach to Yama for failing to identify or notify the Client of security deficiencies that are not within the explicit scope of a written service agreement.

#### 6. Limitation of Liability

6.1. In no event shall Yama's total liability under any service agreement exceed the total fees paid by the Client to Yama during the twelve (12) month period immediately preceding the event giving rise to the claim, as further defined in the Master Service Agreement.

6.2. In no event shall Yama be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, or business interruption, regardless of the theory of liability.

#### 7. Burden of Proof for Claims

7.1. For any claim against Yama to be considered valid, the Client must prove all of the following by clear and convincing evidence: a. A written service agreement was in effect that explicitly covered the specific system, service, or deliverable at issue. b. Yama breached a specific, explicitly defined contractual obligation. c. The breach was the direct and proximate cause of the damages claimed. d. The Client was in full compliance with all of its contractual obligations. e. The Client maintained an adequate cybersecurity posture independent of the services provided by Yama.

7.2. The failure to prove any single element above shall result in the complete dismissal of the claim.

#### 8. Timely Written Notice

8.1. Client must provide detailed written notice of any claim to Yama within thirty (30) days from the date the Client first discovers the event giving rise to the claim.

8.2. Failure to provide timely written notice as required by this section shall result in the claim being irrevocably waived and time-barred.

#### 9. Integration with Other Policies

9.1. These Universal Terms incorporate by reference all current versions of policies and documentation published at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com), which collectively form the complete agreement between Yama and the Client.

9.2. In the event of a conflict between these Universal Terms and a specific service agreement, the terms of the specific service agreement shall control only for the services defined therein.

#### 10. Policy Updates

10.1. Yama reserves the right to update these Universal Terms and any other referenced policies from time to time by posting the revised versions at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com).

10.2. The Client is solely responsible for monitoring the website for changes. Continued engagement of Yama's services or payment of any invoice following an update constitutes acceptance of the revised terms.

#### 11. No Separate Signature Required

11.1. These Universal Terms, as published and updated, are binding upon the Client through acceptance of a service agreement, statement of work, or payment of an invoice, and do not require a separate signature from the Client to be enforceable.


# SERVICE LEVEL AGREEMENT

Customer services guidelines, processes & procedures

## **SERVICE LEVEL AGREEMENT**

### YAMA INDUSTRIALS, INC. - 2022

The provision of Services and/or Products by Yama Industrials, Inc., a Wyoming corporation, are subject to the terms and conditions set forth in the following Service Level Agreements (“SLAs”). The Yama Industrials “Order Form” for the Services shall be expressly incorporated herein and the delivery, installation and provision of Services shall be subject to Yama Industrials Main Service Agreement (“MSA”), which can be found at: <https://resources.yamaindustrials.com/> Customer agrees to abide by and be subject to the Service Level Agreements (“SLAs”) set forth herein as well as the Order Form and MSA. Based on the terms hereof, Customer may be eligible for specific reductions in future monthly recurring charges (“MRC”) owed by Customer (“Service Credits”). Any terms not defined herein shall be ascribed the definition set forth in the MSA or the Order Form.

1\. **Definitions**.

a. “Chronic Service Issue” means one (1) identical issue that results in the issuance of Service Credits to Customer under this SLA.

b. “Network Latency” means the average network transit delay, measured via roundtrip pings on an ongoing basis to determine a consistent average monthly performance level for Latency at all the points of presence (“POPs”).

c. “Network Outage” exists when a Customer’s SDWAN or Network as-a-Service is unable to transmit data. A Network Outage is measured from the time a Trouble Ticket is opened due to the Network Outage to the time Customer’s SDWAN or Network-as-a-Service is again able to transmit and receive data.

d. “Network Packet Delivery” refers to the successful delivery of units of data carried over a network.

e. “Voice Outage” exists when a Customer’s Voice Services are unable to accept or make phone calls because the Yama Industrials voice network core is unavailable.

2\. **Network Outage**. For each cumulative one (1) hour period where SDWAN or Network-as-a-Service experiences a Network Outage, Customer shall be eligible to receive a Service Credit equal to 1/720th of the affected Service’s MRC. No Service Credit shall be available for any Network Outage lasting less than one (1) cumulative hour or any partial hour. To be eligible for a Service Credit due to a Network Outage lasting longer than one (1) cumulative hour for SDWAN Services:

a. Customer must purchase SDWAN with at least one dedicated Broadband Link or MPLS Link connection from Yama Industrials;

b. Customer must have at least a second network connection, which can be Customer or Yama Industrials provided network connection, subject to Yama Industrials sole and absolute discretion that there is true diversity between the primary network connection and the secondary network connection; and

c. CPE failure is not the cause of the Network Outage.

3\. **Network Latency**. For locations in the United States: (a) Network Latency for Service Credit purposes is calculated on a monthly basis; and (b) if monthly average Network Latency exceeds fifty (50) milliseconds (ms) for any calendar month (the “Network Latency Goals”), Customer shall receive a future Service Credit equal to ten percent (10%) of the MRC for the affected service that exceeded the Network Latency Goals; provided, however, Yama Industrials broadband services do not qualify for a Network Latency Service Credit, unless the underlying internet service provider specifically allows for such in their service level agreements, which Yama Industrials will pass on to the Customer, if applicable, on a case by case basis. Notwithstanding the foregoing, Network Latency calculations for locations outside of the United States are subject to a separate technical review and shall be separately agreed to by Yama Industrials and the Customer based on that review.

4\. **Network Packet Delivery**. Packet Delivery is measured on an ongoing basis to determine a consistent average monthly performance level for data actually delivered between POPs. If average monthly Network Packet Delivery is below 99.99% (“Packet Goal”) for any calendar month, Customer shall be eligible to receive a Service Credit equal to ten percent (10%) of the MRC for the affected Service that did not meet the Packet Goal.

5\. **Chronic Service Issue**. If a Chronic Service Issue occurs at least three (3) times or more during any calendar month for any single Location, and the third Chronic Service Issue has not been resolved to the reasonable satisfaction of Customer within five (5) business days of Customer notifying Yama Industrials of such Chronic Service Issue, Yama Industrials shall provide Customer with a remediation plan as to how it will correct the Chronic Service Issue within thirty (30) business days following such notice by Customer that the third attempt to address the Chronic Service Issue was inadequate (the “Remediation Period”). If Yama Industrials is unable to correct the Chronic Service Issue to the reasonable satisfaction of Customer by the expiration of the Remediation Period, Customer shall have the option of terminating Services to the Location experiencing the Chronic Service Issue without penalty, including, without limitation, the payment of any early Termination Fee.

6\. **Voice Outage**. For each cumulative one (1) hour period where a Customer experiences a Voice Outage, Customer will be qualified to receive a Service Credit equal to 1/720th of the affected Service’s MRC. No Service Credit shall be available for any Voice Outage lasting less than one (1) cumulative hour or any partial hour.

7\. **Simple Configuration Changes**. Non-urgent, simple configuration requests for security or routing changes will be reviewed by Yama Industrials upon Customer submitting a Trouble Ticket to Yama Industrials (a “Configuration Change Notice”). Yama Industrials will endeavor to complete the configuration change within one (1) business day or as noted by the SLA of receiving a Configuration Change Notice (the “Configuration Goal”). Provided, however, many configuration changes require a design review process or update of diagrams, modification of customer’s approved technical documents, and/or discussions around how it could impact other applications/services and such changes shall not be subject to the Configuration Goal. Whether a configuration is simple or more detailed shall be determined in Yama Industrials sole and absolute discretion.

8\. **Hardware and Equipment Replacement**. Yama Industrials endeavors to replace hardware, equipment and CPE (collectively, “Replaced Equipment”) by the end of the next business day or as noted by the SLA for locations within the United States (“Replaced Equipment Goal”) after a Replaced Equipment Notice (defined below) is received. For locations outside of the United States, the Replaced Equipment Goal may be longer based on shipping and fulfillment times or other matters related to the local jurisdiction. Customer shall notify Yama Industrials of the need for Replaced Equipment by submitting a Trouble Ticket to Yama Industrials (a “Replaced Equipment Notice”). If CPE must be replaced, Yama Industrials shall first identify, diagnose, and determine a replacement for the applicable CPE. Once determined, Yama Industrials shall endeavor to replace the affected CPE by the Replaced Equipment Goal. If replacement by the Replaced Equipment Goal is not possible, Yama Industrials will replace the Replaced Equipment within a commercially reasonable time.

9\. **High Availability Configuration**. Yama Industrials highly recommends a high availability (HA) configuration, especially for any Location where Customer’s business would be especially impacted by a Network Outage, Voice Outage or equipment failure.

10\. **Installation.** Installation of Products and Services varies based on the applicable technology employed and a host of other variables. Should Yama Industrials determine that construction, carpentry, electrical wiring, etc. (collectively, a “Build Out” is required to install a Product or provide a Service, Customer may elect to move forward with the installation any pay applicable construction costs for the Build Out, or the Customer can cancel the affected Product or Service without penalty or obligation to Yama Industrials. Should the installation of a Product or Service exceed the date set forth below as the “Installation Goal,” Customer will be eligible to receive a Service Credit equal to five percent (5%) of the affected Service’s monthly recurring charge (MRC).

11\. **SLA Claim Process**. Customer must request a Service Credit within fifteen (15) days of the incident allegedly giving rise to a Service Credit or within 15 days of a Product or Service being installed (for purposes of Installation Goals only) by emailing accounts\@y[amaindustrials.com](https://mail.google.com/mail/?view=cm\&fs=1\&tf=1\&to=billing@commandlink.com) (a “Service Credit Request”). A Service Credit Request must include the Customer’s name, Location address, contact information, dates of incident, and background on the incident. Yama Industrials will review the Customer’s claim and provide feedback or a response within fifteen (15) days of its receipt of the Service Credit Request. If Customer fails to provide a response to any Yama Industrials request for additional information regarding a claim for Service Credits within fifteen (15) days from Customer’s receipt thereof, the claim will be denied. Yama Industrials will not accept late Service Credit Requests under any circumstance and any applicable Service Credits shall be null and void. A separate Service Credit Request must be submitted for each incident and each Location, unless the request is for the same Service and Location. Customer must also be current in all of its invoices to be eligible for service credits, and may not withhold payments based on pending or disputed Service Credit Requests.

12\. **Service Credit Terms**. The maximum Service Credit to be issued to Customer for any given calendar month shall not exceed fifty percent (50%) of the MRC for the affected Service. Service Credits must also be equal to or greater than twenty dollars ($25.00) to be processed.

13\. **Service Credit Ineligibility**. Customer will not be entitled to Service Credits if an event was caused by any of the following:

a. Scheduled and/or emergency maintenance, service alteration, or implementation.

b. Failure of CPE.

c. Acts or omissions caused by Customer, its employed staff, contracted representatives, or end users.

d. Events involving force majeure.

e. Termination, suspension, or modification of services for cause, including but not limited to material breach of payment obligations, violation of acceptable use policies, or failure to maintain account in current status as required by the Main Service Agreement Section 11.

f. Yama Industrials lack of reasonable access to Customer’s Location.

g. Interruptions to a Service due to power failure at a Customer Location.

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

YAMA INDUSTRIALS, INC. - 2021


# Post-Agreement & Ad-Hoc Support Policy

Document ID: YI-POL-004 Effective Date: July 1, 2025 Version: 1.0

### 1. Purpose and Scope

This policy governs the service relationship for clients whose subscription-based Service Agreement ("Agreement") with Yama Industrials, Inc. has expired due to non-renewal or has been terminated for cause, such as non-payment. It establishes the terms under which a client is transitioned from a proactive, subscription-based service to a reactive, on-demand support model.

This policy is a component of the master Terms of Service available at `resources.yamaindustrials.com`, as referenced on all client invoices.

### 2. Policy Statement: Transition to Ad-Hoc Support Status

Upon the expiration or termination of a client's subscription Agreement, the client's account will automatically transition to **"Ad-Hoc Support Status."** This transition involves the following fundamental changes:

* **Cessation of All Proactive Services:** All proactive "Operate" and "Optimize" services included in the subscription are terminated immediately. This includes, but is not limited to:
  * All monitoring for hardware anomalies, network uptime, and performance.
  * All application of software updates, firmware upgrades, and security patches.
  * All warranty hardware replacement coordination.
  * Access to all-inclusive Business Hours Support as defined in the subscription.
* **Change in Purpose of Administrative Access:** The client acknowledges that due to the technical requirements of the unified hardware management system, Yama Industrials, Inc. may retain its administrative credentials on the device. However, the purpose and legal standing of this access are fundamentally altered:

  * Administrative access is retained for the sole purpose of enabling client-initiated, billable, ad-hoc support requests.
  * All proactive monitoring, management, and alerting functions associated with this access are disabled.
  *

  ```
  _Yama Industrials, Inc. will not access the device for any reason except as follows:_
  ```

  ```
  > _**(a) Client-Initiated Service:**_ _Upon explicit request by an authorized client contact for a billable service engagement._
  >
  > _**(b) Administrative Disengagement:**_ _To perform administrative actions necessary to remove subscription-based services, proprietary configurations, and other Yama Industrials intellectual property, and to execute final service disconnection as authorized under Section 5 of this policy._
  ```

### 3. Client Acknowledgment and Full Assumption of Risk

By failing to renew the Service Agreement or by defaulting on payment, the client acknowledges and explicitly agrees to the following:

* **Sole Responsibility:** The client assumes sole and exclusive responsibility for the ongoing security, operation, maintenance, and compliance of their network and firewall. The client affirms that Yama Industrials, Inc. does not serve as, and has not assumed the role of, the client's Chief Information Security Officer (CISO), Chief Information Officer (CIO), IT Director, IT Manager, or any similar executive, management, or staff position. Yama Industrials provides specific contracted technical services only. The client retains sole and ultimate responsibility for all IT infrastructure decisions, network architecture design, vendor selection and management, cybersecurity strategy, regulatory compliance, and day-to-day IT operations.
* **Increased Risk Profile:** The client understands that without the proactive patching, monitoring, and management provided under the subscription service, their hardware and network will become increasingly vulnerable to newly discovered security threats, software bugs, and performance degradation over time.
* **Indemnification:** The client agrees to indemnify, defend, and hold harmless Yama Industrials, Inc., its officers, directors, employees, contractors, and agents from any and all claims, liabilities, damages, losses, costs, or expenses (including reasonable attorneys' fees) arising from or related to security incidents, data breaches, system failures, regulatory non-compliance, network disruptions, or operational failures that occur while the account is in Ad-Hoc Support Status or following service termination or modification. This indemnification is absolute and applies regardless of cause or theory of liability.

### 4. Terms of Ad-Hoc (Break-Fix) Support

All support requests from a client in Ad-Hoc Support Status are governed by the following terms:

* **Reactive and Billable:** Service is initiated only by a formal request from an authorized client contact. All work performed is billable at the standard Time & Materials (T\&M) rates then in effect, as specified for non-covered services in our standard agreements.
* **No Service Level Agreement (SLA):** Requests are handled on a best-effort basis and are not subject to the response time guarantees of any previous subscription plan.
* **Acceptance of Terms:** By initiating a service request, the client explicitly agrees to the terms outlined in this policy and the associated T\&M charges.

### **5. Right to Terminate Ad-Hoc Support Status and Disengage Services**

Yama Industrials, Inc., at its sole discretion, reserves the absolute and unilateral right to terminate a client's Ad-Hoc Support Status and fully disengage all services at any time and for any reason, including but not limited to:

**(a)** A prolonged period of client inactivity, where no billable ad-hoc support has been requested or engaged;

**(b)** The client's failure to remit payment for any ad-hoc services rendered in a timely manner;

**(c)** Business or operational reasons as determined by Yama Industrials, Inc., including the need to decommission legacy infrastructure or reduce liability exposure from unmanaged accounts.

The client acknowledges that the URL for the master Terms of Service (resources.yamaindustrials.com) is provided on every invoice and that they have a continuing and non-delegable obligation to review these terms. Publication of this policy at the referenced URL constitutes full and sufficient notice of Yama Industrials, Inc.'s right to disengage services without further warning.

Retention of administrative access for the purpose of providing potential ad-hoc support shall not, under any circumstances, be construed as an implied service agreement, a waiver of any contractual rights, or an obligation to provide notice prior to full disengagement.

Upon Yama Industrials, Inc.'s internal decision to terminate Ad-Hoc Support Status, all service modifications may be implemented immediately, including permanent device disconnection from management consoles and credential revocation. The client assumes all risks associated with such immediate disengagement.<br>

<br>


# Cybersecurity Guidance, Advisory, and Consulting Services Policy

Note: No single, multiple processes or combination of technology will make you 100% secure.

## <mark style="color:blue;">**Policy Overview**</mark>

Yama Industrials, Inc. including any associated divisions and/or subsidiaries (hereinafter referred to as "Yama Industrials") is committed to delivering industry best practices for cybersecurity guidance, advisory, and consulting services to our clients. This policy delineates the exact scope of our services and explicitly states that Yama Industrials does not act as, nor imply in any way the role of, the Chief Information Security Officer (CISO) or any related positions and/or titles for our clients. Our responsibilities are strictly limited to:

* Providing standard(s)-based guidance, advice, and consulting services on cybersecurity matters.
* Conducting standard(s) evaluations of the client's cybersecurity requirements and current posture.
* Recommending appropriate and tailored cybersecurity solutions based on the client's specific needs.
* Offering industry-accepted best practices and strategies for the implementation of cybersecurity solutions.
* Yama Industrials may assist in the implementation of cybersecurity solutions as needed.
* Our team can engage in hands-on activities to ensure the deployment and configuration of recommended cybersecurity measures.

## <mark style="color:blue;">**Implementation Assistance Clause**</mark>

Yama Industrials may assist in the implementation of cybersecurity solutions as needed. However, such assistance is ultimately provided under the client's approval, direction and authorized supervision. The client retains ultimate responsibility for the implementation and effectiveness of all cybersecurity measures.

## <mark style="color:blue;">**Hands-on Engagement Clause**</mark>

Our team can engage in hands-on activities to ensure the logistics, deployment, and configuration of recommended cybersecurity measures. These activities are performed based on industry-standard practices (as viable) but ultimately based on the client's specified needs and requirements. Yama Industrials shall not be liable for any damages arising from the deployment and configuration of cybersecurity measures unless such damages result from gross negligence, reckless disregard, or willful misconduct on the part of Yama Industrials.

\ <mark style="color:blue;">**Definitions of Misconduct**</mark>
----------------------------------------------------------------

**Willful Misconduct:** For purposes of this agreement, "willful misconduct" shall mean a conscious, voluntary act or omission in reckless disregard of a legal duty and of the consequences to another party, but shall not include ordinary negligence, inadvertent errors, or mistakes in judgment. "Reckless disregard" shall mean conduct that is substantially more than negligent but less than intentional harm, characterized by a substantial deviation from acceptable standards of care, where the risk of harm is either known or so obvious that it should have been known, excluding actions taken in good faith or errors made in complex or ambiguous situations. "So obvious" shall mean a risk that is clear and evident to a reasonable person with similar expertise and/or experience and under similar circumstances, but shall not include risks that are not apparent due to the complexity, ambiguity, and/or technical nature of the situation.

**Purposeful Misconduct:** "Purposeful misconduct" shall mean any action or omission undertaken with the specific intent to cause harm or achieve a wrongful objective, characterized by a deliberate and conscious effort to disregard the safety, rights, or interests of others. This includes actions taken with a clear and wrongful purpose that goes beyond negligence or recklessness.

**Recklessness:** "Recklessness" shall mean conduct whereby a person disregards a substantial and unjustifiable risk that their action or omission will result in harm. This risk must be of such a nature and degree that considering the circumstances known to the person, its disregard involves a gross deviation from the standard of conduct that a reasonable person would observe in the situation. For purposes of this policy, "substantial" means significant in terms of the probability and magnitude of potential harm. "Potential harm" refers to an adverse effect that could reasonably be expected to result from an action or omission.

**Unjustifiable Risk:** An "unjustifiable risk" is a risk that a reasonable person in the same situation would not take because the potential harm involved is significantly greater than any potential benefit to be gained. This type of risk is not reasonable under the circumstances and represents a gross deviation from the standard of care expected in similar situations.

**Justifiable Risk:** A "justifiable risk" is a risk that a reasonable person in the same situation would take because the potential benefits outweigh the potential harm, considering the circumstances and the information available at the time. This type of risk is reasonable under the circumstances and aligns with the standard of care expected in similar situations.

**Gross Negligence:** "Gross negligence" shall mean a severe degree of negligence taken as a reckless disregard for the safety or lives of others. It is more than simple inadvertence, but it is just shy of being intentional harm. Gross negligence is characterized by a substantial deviation from the standard of care that a reasonable person would observe in the situation, constituting a flagrant indifference to the safety and rights of others.

**Willful Negligence:** "Willful negligence" shall mean a deliberate act or omission, knowing that such conduct is likely to cause harm to another party. It involves a conscious and intentional disregard or indifference to the safety, rights, or interests of others, characterized by an awareness of the risk and a willful decision to ignore it.

**Simple Inadvertence:** "Simple inadvertence" shall mean an unintentional act or omission resulting from carelessness or lack of attention, but which does not rise to the level of gross negligence, willful negligence, or recklessness. It typically involves minor errors or lapses in judgment that a reasonable person might make under similar circumstances.

**Reasonable Person:** A "reasonable person" refers to a hypothetical individual in society who exercises average care, skill, and judgment in conduct. This standard is used as a comparative measure to determine if a person's actions were negligent by evaluating whether a similarly situated person with ordinary prudence would have acted in the same manner under the same circumstances.

\ <mark style="color:blue;">Limitation of Liability</mark>
----------------------------------------------------------

Yama Industrials, Inc. (including any divisions and/or subsidiaries) shall not be liable for any damages, whether direct, indirect, incidental, consequential, or punitive, arising from the performance or non-performance of services provided by the client, their designated third party service providers and/or subcontractors. This limitation applies regardless of the nature of the claim, whether based on contract, tort, or any other legal theory.

Any claims, disputes, or legal actions related to the management, monitoring, operation or implementations of cybersecurity and associated systems shall be directed solely to the client and/or their, third party or subcontracted service providers. Yama Industrials' liability is strictly limited to instances of gross negligence, reckless disregard or willful “misconduct”

\ <mark style="color:blue;">Indemnification</mark>
--------------------------------------------------

The client agrees to indemnify, defend, and hold harmless Yama Industrials, its officers, directors, employees, and agents from and against any and all claims, liabilities, damages, losses, or expenses (including reasonable attorneys' fees and costs) arising out of or in any way connected with the client’s, their service providers', third parties and/or subcontractors performance or non-performance of general cybersecurity and/or management and monitoring services. This indemnification obligation begins from the initial point of contact, including during the solicitation and inquiry phase, and continues throughout the duration of the engagement. This includes, but is not limited to, claims arising from data breaches, security incidents, regulatory non-compliance and legal non-compliance.

\ <mark style="color:blue;">Client Responsibilities</mark>
----------------------------------------------------------

*The client is bound and agrees to:*

**Maintain Compliance:** Ensure compliance with all applicable federal, state, and local laws, regulations, and industry standards related to cybersecurity and data protections.

**Implement Recommendations:** Implement (where appropriate and as needed) the cybersecurity solutions and strategies recommended by industry best practices regardless of origin.

**Monitor Systems:** Monitor and manage their cybersecurity systems, and promptly address any vulnerabilities or threats identified as applicable.

**Report Incidents:** Report any data breaches, security incidents, or regulatory issues to appropriate agencies as dictated by law and cooperate fully with any investigations or remediation efforts.

**Maintain Documentation:** Keep accurate and up-to-date records (as dictated by industry compliance and laws) of all cybersecurity measures, incidents, and compliance efforts.

## <mark style="color:blue;">Dispute Resolution</mark>

Any disputes or claims arising out of or relating to this policy shall be resolved through binding arbitration, conducted in accordance with the rules of the American Arbitration Association. The arbitration shall take place in a mutually agreed location, and the arbitrator's decision shall be final and binding on all parties. The costs of arbitration, including reasonable attorneys' fees, shall be borne by the losing party unless otherwise determined by the arbitrator.

## <mark style="color:blue;">Governing Law</mark>

This policy shall be governed by and construed in accordance with the laws of the jurisdiction in which Yama Industrials is headquartered, without regard to its conflict of laws principles.


# On-Site Service/Support Resource Commitment Policy

Billing and Invoice Information

This policy outlines the binding financial commitments associated with the mobilization of technical resources for on-site service calls. It is designed to ensure resource availability and to transparently define the cost structures for both scheduled and unscheduled service events.

### **5.1. Defining Resource Mobilization**

For invoicing purposes, the point at which a service request becomes a firm, billable commitment is defined by the mobilization status of the assigned technical resource.

* **A. Standard Mobilization (During Contractual Service Hours):**\
  A resource is considered **"mobilized"** at the moment they begin billable work in response to a dispatch request. This includes, but is not limited to:
  * **Preparation Time:** Time spent gathering necessary tools, inventory, or parts required for the service call.
  * **Diagnostic & Research Time:** Preliminary work to diagnose the issue or research a solution prior to departure.
  * **Travel Time:** The physical act of traveling to the client site.
* **B. Full Commitment (Outside Contractual Service Hours):**\
  For service requests that fall on **Holidays, Weekends, or outside of contractual service hours**, the billable event is defined as the **"Full Commitment Point."** This point is reached at the moment **Yama Industrials formally accepts and acknowledges the dispatch request.** This action immediately allocates the premium resource and triggers the associated minimum invoice period.

### **5.2. Cancellation Fee & Service Commitment Schedule**

The application of fees is determined by the timing of the cancellation request relative to the resource's mobilization status.

* **A. Cancellation Following Full Commitment: Full Minimum Invoiced**
  * If a service call dispatched outside of contractual service hours is canceled at any time **after the Full Commitment Point has been reached** (per section 5.1.B), the **full 4-hour minimum fee** at the "Holiday / Urgent After-Hours" rate of **4.0x** will be invoiced.
  * Due to the immediate allocation of premium resources, no grace period is applicable in this scenario.
* **B. Cancellation During Standard Mobilization (Contractual Hours):**
  * **Standard Cancellation Fee ($49.99):** This fee applies if a service call is canceled *prior* to Standard Mobilization (per section 5.1.A).
  * **Late Cancellation / Turn-Away Fee (2-Hour Charge):** This fee, equivalent to a **2-hour charge** at the appropriate service rate, applies if the client cancels the request *after* the technician has been mobilized but *before* their arrival on-site.
  * **Full Minimum Invoiced (Arrival On-Site):** If the technician arrives on-site and is then turned away, the full 2/**4-hour minimum** on-site fee for that service period applies and will be invoiced.


# Support Policy & SLA's

CLIENT SUPPORT INFORMATION

## A. Support Hours

YAMA and/or its partners generally monitor(s) incident submissions from 9 AM EST to 5 PM EST Monday through Friday, excluding nationally recognized holidays in the United States and other country locations. Extended support hours are available for select industries/clients. Incident response service upgrades are available.

## B. Incident Submission and Customer Cooperation

Customer may report errors or abnormal behavior of the service(s) by contacting YAMA via given support **phone number, ticket system or email at <support@yamaindustrials.com>** (or as given by it's vendor partner(s)) Customer will provide information and cooperation to YAMA as reasonably required for YAMA to provide Support. This includes, without limitation, providing the following information to YAMA regarding the Incident:

* Aspects of the Service that are unavailable or not functioning properly
* Incident's impact on users
* Start time of Incident
* List of steps to reproduce Incident
* Relevant log files or data
* Wording of any error message

## C. Standard Tier - Incident Response

YAMA Support personnel will assign a **Priority Level** to each Incident and seek to provide responses in accordance with the table below.

| Priority Level | Description                                                                                                                                                     | Target Response Times |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
| Priority 1     | Operation of the Service is critically affected (not responding to requests or serving content) for a large number of users; no workaround available.           | 4 Hours               |
| Priority 2     | Service is responding and functional but performance is degraded, and/or Incident has potentially severe impact on operation of the Service for multiple users. | 8 Hours               |
| Priority 3     | Non-critical issue; no significant impact on performance of the Service but user experience may be affected.                                                    | 1 Day                 |

## D. Plus Tier - Incident Response

YAMA Support personnel will assign a **Priority Level** to each Incident and seek to provide responses in accordance with the table below.

| Priority Level | Description                                                                                                                                                     | Target Response Times |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
| Priority 1     | Operation of the Service is critically affected (not responding to requests or serving content) for a large number of users; no workaround available.           | 2 Hours               |
| Priority 2     | Service is responding and functional but performance is degraded, and/or Incident has potentially severe impact on operation of the Service for multiple users. | 4 Hours               |
| Priority 3     | Non-critical issue; no significant impact on performance of the Service but user experience may be affected.                                                    | 1 Day                 |

## E. Premier Tier - Incident Response

YAMA Support personnel will assign a **Priority Level** to each Incident and seek to provide responses in accordance with the table below.

| Priority Level | Description                                                                                                                                                     | Target Response Times |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
| Priority 1     | Operation of the Service is critically affected (not responding to requests or serving content) for a large number of users; no workaround available.           | 1 Hour                |
| Priority 2     | Service is responding and functional but performance is degraded, and/or Incident has potentially severe impact on operation of the Service for multiple users. | 2 Hours               |
| Priority 3     | Non-critical issue; no significant impact on performance of the Service but user experience may be affected.                                                    | 1 Day                 |

## F. Elite Tier - Incident Response

YAMA Support personnel will assign a **Priority Level** to each Incident and seek to provide responses in accordance with the table below.

| Priority Level | Description                                                                                                                                                     | Target Response Times |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
| Priority 1     | Operation of the Service is critically affected (not responding to requests or serving content) for a large number of users; no workaround available.           | 30 min                |
| Priority 2     | Service is responding and functional but performance is degraded, and/or Incident has potentially severe impact on operation of the Service for multiple users. | 1 Hour                |
| Priority 3     | Non-critical issue; no significant impact on performance of the Service but user experience may be affected.                                                    | Same Day              |

## G. Platinum Tier - Incident Response

YAMA Support personnel will assign a **Priority Level** to each Incident and seek to provide responses in accordance with the table below.

| Priority Level | Description                                                                                                                                                     | Target Response Times |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
| Priority 1     | Operation of the Service is critically affected (not responding to requests or serving content) for a large number of users; no workaround available.           | 15 min                |
| Priority 2     | Service is responding and functional but performance is degraded, and/or Incident has potentially severe impact on operation of the Service for multiple users. | 30 min                |
| Priority 3     | Non-critical issue; no significant impact on performance of the Service but user experience may be affected.                                                    | 1 Hour                |

## H. Exclusions

YAMA will have no obligation to provide Support to the extent an Incident arises from: (a) use of the Service by Customer in a manner not authorized in the Agreement or the applicable Documentation; (b) general Internet problems, force majeure events or other factors outside of YAMA's reasonable control; (c) Customer's equipment, software, network connections or other infrastructure; or (d) third party systems, acts or omissions.

If the Customer purchased services through a reseller, YAMA may have no obligation to provide Support depending on the Customer's agreement with the reseller and YAMA.


# Third-Party Product Warranty and Support

Hardware and Software Support

Yama provides a *<mark style="background-color:yellow;">**14-day warranty**</mark>* on third-party products unless otherwise specified. After this period, the manufacturer’s warranty will be in effect. Clients should direct any warranty claims, service, or support inquiries to the manufacturer.

<mark style="color:blue;">**Key Points:**</mark>

* <mark style="color:blue;">**14-Day Warranty**</mark><mark style="color:blue;">:</mark> Yama offers a 14-day warranty on third-party products, starting from the date of purchase, unless otherwise noted.
* <mark style="color:blue;">**Manufacturer's Warranty:**</mark> Following the initial 14 days, any warranty claims must be handled directly with the manufacturer, as their warranty terms will apply.
* <mark style="color:blue;">**Service and Support:**</mark> While Yama can provide service and support, it will be available at the rates stated at that time. Clients are encouraged to contact Yama for any additional assistance.

By purchasing third-party products through Yama, you acknowledge and accept these terms regarding warranty and support.


# Policy on Service Modification for Terminated Accounts

Document ID: YI-POL-006 Effective Date: July 1, 2025 Version: 1.0

### 1. Purpose and Scope

This policy defines the actions Yama Industrials, Inc. reserves the right to take regarding the configuration of client-owned hardware following the termination of a Service Agreement ("Agreement") due to non-renewal or material breach, including non-payment of service invoices. This policy is incorporated by reference into the Main Service Agreement and the master Terms of Service available at `resources.yamaindustrials.com` .

### 2. Policy Statement on Removal of Proprietary Services

Yama Industrials, Inc. invests in and develops proprietary services and configurations, such as Yama DNS Protection, to provide enhanced security and performance to clients under an active, paid Service Agreement. These features are components of the subscription service and are not granted to the client in perpetuity.

In the event of the termination of a Service Agreement due to client non-payment, Yama Industrials, Inc. reserves the right to modify the configuration of the managed hardware to remove any and all proprietary, subscription-based services and features.

### 3. Specific Action Regarding DNS Services

To provide a specific example that falls under the policy stated in Section 2:

> Due to the termination of the service agreement for non-payment, all proprietary and subscription-based security features will be removed from your firewall configuration. This includes the Yama DNS Protection service, which will be replaced with standard public DNS resolvers (e.g., 1.1.1.1, 8.8.8.8) to maintain basic internet connectivity.

This action is not punitive but is the logical and necessary cessation of a premium service for which payment is no longer being rendered.

### 4. Client Acknowledgment and Assumption of Risk

**4(a)** By failing to maintain a Service Agreement in good standing, the client acknowledges and accepts that the removal of these security features may increase their network's exposure to threats. The client assumes sole responsibility for any and all risks associated with the operation of their network without the proprietary security services previously provided by Yama Industrials, Inc.&#x20;

**4(b) Absolute Release of Liability**

The client releases, waives, and forever discharges Yama Industrials, Inc., its officers, directors, employees, contractors, and agents from any and all claims, liabilities, damages, losses, costs, or expenses (including attorneys' fees) arising from or related to:

* The removal of proprietary security features or subscription-based services
* Network security incidents, data breaches, or cyberattacks occurring after service modification
* System downtime, performance degradation, or connectivity issues
* Business interruption, lost profits, or consequential damages

This release is absolute and applies regardless of the cause or theory of liability.


# Information Security at Yama Industrials, Inc.

Internal guidelines, processes & procedures

This document covers the guidelines, processes, procedures and standards of our information security handling. Any questions or issues, you can reach us at <info@yamaindustrials.com>. Yama Industrials, Inc. employs industry standards & guidelines for information security compliance, ensuring clients have the highest degree of (TCC) trust, confidence, and consistency in our protection of their data and operations. Our security practices are aligned to the following information and data security compliance guidelines, standards, and best practices, Forrester Zero Trust Model of information security, GDPR (General Data Protection Regulation), NIST (National Institute of Standards and Technology, HIPAA (Health Insurance Portability and Accountability Act), PCI-DSS (Payment Card Industry Data Security Standard), SANS (SysAdmin, Audit, Network, and Security) Institute and ISO/IEC Information Security Management standards.

**Personnel Security, Privacy & Security Training**

Yama Industrials, Inc.’s guidelines, policies, procedures, and compliance standards apply to all employees/personnel/associates, team members, contractors, sub-contractors, and 3rd parties who make up the Yama Industrials, Inc. workforce. Prior to access to Yama Industrials, Inc. systems & infrastructure, workers and 3rd parties agree to NDA’s and consent to background checks/investigations as needed. Security awareness training is ongoing, including general security awareness, device security, web security, data privacy, physical security, incident reporting, insider threat awareness, reporting requirements, data protection, compliance, and workplace ethics. Upon termination, all access to Yama Industrials, Inc. systems and infrastructure are revoked.

**Systems Security**

Access to Yama Industrials, Inc. office systems are secured by digital video surveillance, electronic key locks, keyed access, and UTM (Unified Threat Management) systems as needed for the sensitivity of the material handled at the relevant facility. All systems used by team members are configured to compliance standards & guidelines for information security. These standards & guidelines require all systems to be securely configured, scheduled system updates, and security monitoring software. Systems are configured to encrypt relevant data, password authentication, restricted remote access, and lock when idle as needed for the sensitivity of the material handled.

**Audits**

Yama Industrials, Inc. continuously checks and updates, using independent 3rd party tools, guidelines & systems to assess our policies and procedures. Our processes & guidelines are certified and compliant with both HIPAA, NIST 800-171 and ISO27001. We actively work with our commercial client's security, management, and insurance teams to make sure we address all questions prior to services and product deployment(s).

**Network security**

Yama Industrials, Inc. incorporates a hybrid-cloud infrastructure that is decentralized, incorporates network-segmentation, micro-segmentation, nano- segmentation and granular perimeter enforcement based on users, their locations, and other data to determine whether to trust a user, machine, or application seeking access to a particular part of the enterprise, in order to protect all internal and external company data and relevant systems. System(s)-only and diagnostics logs are generated, used, and stored in accordance with our zero-knowledge framework, zero-trust architecture, and privacy-by-design security model.

**Authorizing access**

Yama Industrials, Inc. employs a zero-trust architecture security model when granting systems access in order to minimize the risks of a data breach and insider threat. Yama Industrials, Inc. grants 2FA/MFA secured access to code repositories, billing systems, customer relationship management tools, email servers, and cloud environments as needed.

**Authentication**

Yama Industrials, Inc. uses multi-factor authentication along with password management authentication on systems where applicable.

**System monitoring & logging**

Yama Industrials, Inc. logs systems access and activities on both production and development environments per compliance standards & guidelines.

**Responding to security incidents**

All security incidents are processed and logged by (UTM) Unified Threat Management systems and cloud based security automation tools. Our processes & guidelines are certified and compliant with both HIPAA, NIST 800-171 and ISO27001.


# Information Security Plan

YAMA Security/Cyber Policy

## **Yama Industrials, Inc.**

"Yama Industrials, Inc."

will be referred to as “Company” or “Company’s,” for the purposes of this security document,

**Intro**

The following security policies constitute the Company’s official information security plan. The purpose of this document is to educate, instruct, and confirm the compliance of every employee, and any associated contractors and vendors, to the Company’s security policies.

To be in compliance with Company security, every employee, contractor, and vendor working closely with the Company's network or internal data, shall read and adhere to the following security policies. All parties shall sign and date the final page of the security policy document to confirm said Company’s policies and procedures.

**Summary Policy Notes:**

**#1** There is no expectation of privacy; all "Company" systems/networks are logged & audited.

**#2** Shut down your computer at the end of your day, unless instructed otherwise (to allow over night updates or other maintenance).

**#3** Report a lost security key and/or company equipment immediately.

**#4** Do Not load/connect personal/unauthorized hardware, software or make unauthorized configuration changes to any systems or web portals. Use only approved and procured software and hardware to keep your system(s) up to date and secure. Request and obtain approval for any non-standard software or hardware.

**#5** Only "Company" Furnished/Vetted Equipment is allowed to connect to "Company" internal wired

and wireless business networks.

**#6** Only "Company" Furnished/Vetted Equipment is allowed to connect to any "Company"-owned

peripheral equipment (e.g. projectors, video teleconference units, printers, etc.).

**#7** Visitors and vendors presenting files or briefs on the internal network should email all files to their

"Company" sponsor/handler and present on "Company" owned/vetted equipment. These files will be scanned for vulnerabilities by "Company" approved security tools, policies and procedures.

### Compliance Measurements:

The “Company” will verify compliance to this policy through various audit and logging methods.

### Exceptions:

Any exception to the policy must be approved by the “COMPANY.

### Non-Compliance:

An employee or 3rd party found to have violated this policy may be subject to disciplinary action, up to and including termination of employment/contract.

&#x20;**Policies Included in This Information Security Plan:**

#### Acceptable Use Policy

**Access Control Policy**

**Account Management Policy**

**Secure Password Policy**

**Wireless Network Security Policy**

**Electronic Mail Policy**

**Clean Desk Policy**

**Data Handling and Disposal Policy**

**Physical Security Policy**

**Malware Protection Policy**

**Removable** **Media Policy**

**Remote Access Policy**

## Acceptable Use Policy

### Purpose:

The purpose of this policy is to outline the acceptable use of information technology at “Company”. These rules are in place to protect the employee(s) and “Company”. Inappropriate use exposes “Company” to risks including malware attacks, compromise of network systems and services, data loss, and associated legal issues.

### Scope:

This policy applies to the use of information, electronic and computing devices, and network resources used to conduct company business or interact with internal networks and business systems, whether owned or leased by “Company”, the employee(s), or a third party. All employees, contractors, consultants, temporary employees, and other workers at “Company” and its subsidiaries are responsible for familiarizing themselves with and following these policies, in accordance with “Company” policies and procedures.

### Policy

**General Use and Ownership:**

* “Company” data stored on electronic and computing devices whether owned or leased by “Company”, the employee or a third party, remains the sole property of “Company”.
* You are to promptly report the theft, loss or unauthorized disclosure of “Company” data. 

* You may access, use or share “Company” data only to the extent it is authorized and necessary to fulfill your assigned job roles and duties. 
 

* The company reserves the right to monitor or block any website it deems as questionable or unsafe.

**Security and Company Data:**

* System-level and user-level passwords should comply with the company Password Policy. Providing access to another individual, either deliberately or through failure to secure its access, is prohibited. 

* All computing devices will be secured with a password-protected screensaver with the automatic activation feature set after a certain amount of time deemed by compliance standard(s). You will lock the screen or log off when the device is unattended. 

* Postings by employees from a company email address to newsgroups should contain a disclaimer stating that the opinions expressed are strictly their own and not necessarily those of “Company”, unless the posting is in the course of business duties. 


### Unacceptable Use:

The following activities are, in general, prohibited. Employees may be exempted from these restrictions during the course of their legitimate job responsibilities.

The lists below are by no means exhaustive, but attempt to provide a framework for activities which fall into the category of unacceptable use.

### System and Network Activities:


*The following activities are strictly prohibited, with no exceptions:*

* Violations of the rights of any person or company protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of "pirated" or other software products that are not appropriately licensed for use by “Company”. 

* Accessing data, a server or an account for any purpose other than conducting “Company” business, even if you have authorized access, is prohibited. 

* Exporting software, technical information, encryption software or technology, in violation of international or regional export control laws, is illegal. The appropriate management, policies and/or procedures should be consulted prior to export of any material that is in question. 

* Introduction of malicious programs into the network or server (e.g., viruses, worms, Trojan horses, email bombs, etc.). 

* Revealing your account password to others or allowing use of your account by others. This includes family and other household members when work is being done at home. 

* Using a “Company” computing asset to actively engage in procuring or transmitting material that is in violation of sexual harassment or hostile workplace laws. 

* Making fraudulent offers of products, items, or services originating from any “Company” account. 

* Affecting security breaches or disruptions of network communication, unless these duties are within the scope of regular duties. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access. For purposes of this section, "disruption" may include, network sniffing, packet spoofing, denial of service, and forged routing information for malicious purposes. 

* Executing any form of network monitoring, which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty. 

* Circumventing user authentication or security of any host, network or account. 



* Providing information about, or lists of, “Company” employees to parties outside “Company”.
* Connection of unauthorized devices to the “Company” network(s).

&#x20;**Blogging and Social Media:**

***The following guidelines apply restrictions relating to blogging:***

* Blogging by employees, whether using “Company” property and systems or 
personal computer systems, is also subject to the terms and restrictions set forth in this policy.
* If an employee is expressing his or her beliefs or opinions in blogs, the employee may not, expressly or implicitly, represent themselves as an employee or representative of “Company”.

***In regards to the use of social media sites, the following apply:***

* Do not post any confidential, sensitive or proprietary information about “Company” or any of our clients and candidates.
* Speak respectfully about our current, former and potential customers, partners, employees and competitors. Do not engage in name-calling or behavior that will reflect negatively on your or “Company” reputation.
* Beware of comments that could reflect poorly on you and the “Company”.
* Use privacy settings when appropriate. Remember, the internet is immediate and nothing posted is ever truly private and does not expire.
* Be aware that you are not anonymous when you make online comments. Information on your networking profiles is published in public.

## Access Control Policy

### Purpose

The purpose of this policy is to address the considerations that will help to ensure that “Company” IT resources and information assets are properly protected against unauthorized access, while meeting the access requirements for all authorized users.

### User Access Management:

The objective of implementing user access management is to ensure that authorized users are able to access information and resources, while preventing access for unauthorized users.

### User Registration:

Human Resources/Management and IT will implement a formal user registration and removal procedure for granting and revoking access to all information resources and services.

### Privilege Management:

Access control rules will take into account existing policies for information dissemination and authorization, while incorporating the principle of least privilege, which grants the lowest level of access, rights, privileges, and security permissions needed for the performance of authorized tasks to any “Company” data, resource or information.

Access control rules will differentiate between different roles that may be applicable for an individual commensurate with the classification of the resources. *For example, a general user who accesses information from a website, the individual responsible for updating the content on a website, the administrator of the application, and the network hosting administrator each have different roles that necessitate different privileges.*

Acceptable implementation of this principle will include allocation of user privileges on a need-to-use basis, per system, per application, based on resource and data classification, business requirements, and job function.

**User Password Management:**

All users will abide by the “Company” Secure Password Management Policy.

### Review of User Access Rights:

IT, in cooperation with Human Resources and management, will review user access, authorization, and privileges on an ongoing basis.

### User Responsibilities:

The objective of implementing user responsibility controls is to foster an informed and cooperative approach between users and the organization’s management for protecting “Company” resources and data from unauthorized user access.

### Password Use:

Users are responsible for handling, using, and storing passwords in a manner that complies with all password management requirements noted under User Access Management.

**Unattended User Equipment:**

Users are responsible for ensuring that unattended equipment have appropriate protection.

### Network Access Control:

The objective of Network Access Control is to provide access to internal and external network systems in a controlled manner that is consistent with security policies.

Access to the Company network will be protected through a combination of security controls to prevent and detect unauthorized access, while providing secure access to authorized users and systems.

### Policy on use of Network Services:

Access to any given network service will only be granted to users who are specifically authorized to use that particular service.

### User Authentication for External Connections:

Approved remote access methods will be used for and by employees, contractors, and business partners.

### Operating System Access Control:

The objective of implementing operating system access controls is to enable the ability to restrict access to operating systems to only authorized users.

The “Company” IT department will restrict unauthorized access to operating systems by employing controls that will properly authenticate users, provide appropriate access by role (e.g. Administrator), log activities, and generate notifications in the event of a breach.

## Account Management Policy

### Purpose

The scope of this policy includes all personnel who have or are responsible for an account or any form of access that supports or requires a password on any “Company” system.

### Policy

**User Accounts**

**New Accounts:**

* Users will be given individual (non-shared) accounts for applications.

**Account Changes:**

* The addition, deletion, and modification of user IDs, credentials, changes to user privileges, and other account changes will be controlled and documented.

**Inactive Accounts:**

* An inactive account, which may occur when a user is on extended leave, will be removed or disabled within 90 days. Inactive accounts resulting from termination or resignation will be removed or disabled immediately.

**Third-Party Accounts:**

* Third-party accounts will be enabled only during the time period needed, and disabled when not in use.
* Accounts will be logged and audited when in use.

## Secure Password Policy

### Purpose

The purpose of this policy is to establish a standard for creation of strong passwords, the protection and use of those passwords, and the frequency of change.

The scope of this policy includes all personnel who have or are responsible for an account or any form of access that supports or requires a password on any “Company” system.

### Policy

General password construction guidelines are used for various purposes at “Company” (i.e. user-level accounts, web accounts, email accounts, and local router logins).

**All passwords should not:**

* Be found in a dictionary, including foreign language, or exist in a language slang, dialect, or jargon.
* Contain personal information such as birthdates, addresses, phone numbers, or names of family members, pets, and friends.
* Contain work-related information such as building names, system commands, sites, companies, hardware, or software.
* Contain number patterns such as aaabbb, qwerty, zyxwvuts, or 123321.
* Contain common words spelled backward, or preceded or followed by a number (for example, terces, secret1 or 1secret).
* Be some version of “Welcome123” “Password123” “Changeme123”

Make use of a secured company authorized password manager to store “Company” password(s).

### Password Protection Standards

**Password Creation:**

All user-level and system-level passwords will conform to the password construction guidelines found in this policy.

Users will not use the same password for “Company” accounts as for other non-Company personal access.

Where deemed possible, users will not use the same password for various “Company” access needs.

**Password Protection:**

Passwords will not be shared with anyone. All passwords are to be treated as sensitive, confidential information.

Passwords will not be inserted into email messages or other forms of electronic communication.

**The following guidelines must also be followed:**

* Passwords will not be revealed over the phone to anyone (unless previously approved).
* Do not reveal a password on questionnaires or security forms.
* Do not hint at the format of a password (e.g. "my family name").
* Do not share Company passwords with anyone, including administrative assistants, secretaries, managers, co-workers while on vacation, or family members.
* Do not write passwords down and store them anywhere in your office.
* Do not store passwords in a file on a computer system or mobile devices (phone, tablet) **without** encryption.

**Any user suspecting that there password may have been compromised must report the incident immediately per company policy and procedure’s**

## Wireless Network Security Policy

### Purpose

This policy pertains to all devices - whether owned by “Company”, employees, guests, etc, - inclusive of smartphones, tablet computers, laptops, or any other device seeking access to the “Company” wireless network.

### Policy

* All users of “Company” wireless local area networks, APs, and wireless clients will comply with all applicable company policies, standards, and guidelines.
* Any unauthorized use of the “Company” wireless network is prohibited. Unauthorized uses include: attempts to sniff or capture wireless data, attempts to disrupt or jam the wireless network, altering a wireless client media access control (MAC) address to attempt to evade security, attempts to break into or gain unauthorized access to any computer(s) or system(s) from a wireless or wired connection, installing a personal AP on the network, or any type of denial of service attack using the wireless network.
* Only managed “Company” devices are allowed to connect to the “Company” corporate wireless network. All other devices, including authorized employee devices and guest devices, must connect to the guest network.
* “Company” reserves the right to take whatever reasonable steps are necessary, including denial of network access, to protect the integrity and security of the company network and systems to protect the company from liability or otherwise.

## Electronic Mail Policy

### Purpose

When using “Company” resources to access and use the internet, employees and others represent the “Company”.

### Policy

“Company” email accounts are to be used for official business only. Whenever employees state an affiliation to the “Company”, they will also clearly indicate that "the opinions expressed are my own and not necessarily those of the company.” Questions should be addressed to a supervisor, manager and/or policies and procedures.

**In addition, the following are strictly prohibited:**

* Sending unsolicited email messages, including the sending of "junk mail" or other advertising material to individuals who did not specifically request such material (i.e. email spam). 

* Any form of harassment whether through language, frequency, or size of messages. 

* Unauthorized use, or forging, of email header information. 

* Solicitation of email for any other email address, other than that of the poster's account, with the intent to harass or to collect replies. 

* Creating or forwarding "chain letters", "Ponzi" or other "pyramid" schemes of any type. 


* Posting the same, or similar, non-business-related messages to large numbers of Usenet newsgroups (i.e. newsgroup spam). 


## Clean Desk Policy

### Purpose

The purpose for this policy is to establish a culture of security for employees at “Company”. An effective clean desk effort involving the participation and support of “Company” employees can greatly protect paper documents that contain sensitive data about the “Company”, clients, customers and vendors.

### Policy

* If you are unsure of whether a duplicate piece of sensitive documentation should be kept, ask your supervisor and/or follow policies and procedures.
* Use secured storage for sensitive documents when they are no longer needed.
* Employees are required to ensure that all sensitive/confidential information in hard-copy or electronic form is secure in their work area at the end of the day, and when they are expected to be gone for an extended period. 

* File cabinets containing restricted or sensitive documents will be kept closed and 
locked when not in use or when not attended. 

* Keys used for access to restricted or sensitive information will not be left at an 
unattended desk. 

* Printouts containing restricted or sensitive information should be immediately removed from the printer. 

* Whiteboards containing restricted or sensitive information should be erased.
* Protect mass storage devices such as CD ROM, DVD, or USB drives with sensitive data and secure them appropriately.

## Data Handling and Disposal Policy

### Purpose

“Company” is bound by various obligations with regard to the data that is collected, retained, or that is in our custody or under our control. The obligations may arise from local laws or regulations, or from contracts and SLA’s that have been made to our employees, customers, service providers, and/or partners.

Broadly, when a Data Retention Period is over, and “Company” no longer needs the data, equipment, or documents, it should be destroyed according to followed compliance standard(s) and/or “Company” policies and procedures.

### Policy

**Data:**

* Data includes all data created by, and collected by, “Company”, including proprietary data, as well as client and partner data.
* Data will only be created, collected, accessed, used, and stored for the purposes for which it was either created or collected.
* Data will only be accessed by those with an authorized role/duty.
* All partners, vendors, and employees will adhere to “Company” privacy standards of all data created or stored by “Company”.
* All data, shall be removed from equipment using appropriate media sanitizing methods.

**Computer Equipment:**

* Computer equipment refers to desktop, laptop, tablet, printers, copiers, monitors, servers, handheld devices, telephones, cell phones, disc drives or any storage device, network switches, routers, wireless access points, etc.
* When computer equipment has reached the end of life, it should be sent to IT for proper disposal.
* All drives will be removed and rendered unreadable per followed industry standards.

## Physical Security Policy

### Purpose

Access to “Company” computers and devices will be controlled using secure methods and procedures in order to prevent damage to “Company” assets and reputation.

### Visitor Access:

* Badge access restrictions are active in areas where critical infrastructure is located, restricting access to authorized staff only. These controls are periodically reviewed to ensure it is operating as intended.
* All visitors will sign in upon arrival. Visitors include vendors, job candidates, family and friends, contractors, business partners, etc. Visitors are issued an authorized visitor's badge when signing in, and upon leaving, any badges issued should be collected to prevent access at a later date.
* Appropriate recording mechanisms are in place to record the names, dates, times, and signatures for the signing in and out of visitors at “Company”. Visitors at “Company” may be required to sign a Non-Disclosure Agreement (NDA) prior to obtaining a visitor’s badge and entering the offices.
* At all times, staff and visitors will wear their employee and visitor ID badges (as deemed necessary), which have been issued to them.

### Information Technology Security:

* Observance and maintenance of the physical security of rooms and offices where computers or critical information processing equipment is located is a paramount consideration. For example, servers and business critical equipment should be located in locations with adequate environmental controls.
* All interfaces used for managing system administration and enabling access to information processing should be appropriately secured.
* Maintenance of “Company” equipment and infrastructure will be carried out by authorized personnel.
* Access to, and knowledge of, key fobs, door lock codes, or access to keys for locks, are restricted to authorized personnel only, and will not be shared with any unauthorized person.
* “Company” equipment should be taken off-site only once the device has been encrypted approved methods. Extreme care regarding loss, damage, or theft will be employed whilst the equipment is off-site. Staff will adhere to any relevant procedures and guidance regarding the use of and security of “Company” equipment being used off-site.

### Physical Access Control:

* ID cards, keys, or electronic door locks/key fobs or cards are issued to authorized staff on an as needed basis. They are fully registered to that individual, and only used by that individual. The key fob will be returned immediately when no longer required, and registration details updated accordingly. Any keys or fobs that are not being used should be securely stored, and a log maintained of these fobs.
* Direct access to secure locations, or access to adjoining offices which could provide access, will be locked and secured using appropriate locking mechanisms.
* Doors which provide access to “Company” network infrastructure equipment will not to be left open, unless for the purpose of taking delivery of equipment, to accommodate the movement of existing equipment, or the transportation of maintenance or cleaning equipment. In these cases, an authorized member of staff will be present at all times to supervise access when doors are left open.
* All Company contracted cleaners will have and display appropriate identification and be made aware of the requirements within this procedure.

## Malware Protection Policy

### Purpose

The purpose of this policy is to outline which systems are required to have anti-malware applications. This policy applies to all “Company” information system(s)

### Policy

Company operations staff will adhere to this policy to determine which systems will have anti-malware applications installed on them and to deploy such applications as appropriate.

### **Malware**:

Laptop and Desktop Computers

Managed malware protection will be installed on all laptop and desktop computers. The malware application installed will be configured to be tamper resistant by employees other than system administrators. Updates to the malware application should be set to update automatically as needed.

### Servers:

Servers will be assessed for their malware protection needs. The decision to install malware protection will be based on associated risk and the existence of any other mitigating controls.

### **Malware** Scans:

The malware protection application will monitor for signs of threat, as well as periodically scanning the systems it protects.

## Removable Media Policy

### Purpose

The purpose of this policy is to minimize the risk of malware, data loss or exposure of sensitive data maintained by “COMPANY”.

### Policy

This policy covers all information systems in “COMPANY”.

“COMPANY” staff may only use “COMPANY” approved or furnished removable media in their workplace systems. “COMPANY” removable media may not be connected to or used in systems that are not owned, leased or approved by the “COMPANY” without explicit permission of the “COMPANY”. Sensitive and/or propriety data should be stored on removable media only as required in the performance of your assigned roles/duties. When sensitive information is stored on removable media, it should encrypted in accordance with “COMPANY” polices, procedures and/or compliance standards.

### **Media**:

Covers any and all used external physical media, both legacy (e.g. tape) and modern (e.g. usb drives)

## Remote Access Policy

### Purpose

The purpose of this policy is to define rules and requirements for connecting to “COMPANY”' network. These rules and requirements are designed to minimize the potential exposure to “unauthorized use of “COMPANY” resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical “COMPANY” internal systems, and other liabilities incurred as a result of those losses.

### Policy

This policy applies to all “COMPANY” employees, contractors, vendors and agents with a “COMPANY” owned, provided or other systems used to connect to the “COMPANY” network. This policy applies to remote access connections used to do work on behalf of “COMPANY”, including viewing or sending email and viewing intranet web resources. This policy covers any and all technical implementations of remote access used to connect to “COMPANY” networks. Authorized Users will not use “COMPANY” networks to access the Internet for outside business use.

**General:**

* Authorized users must not share their login credentials.
* All inbound connections to "COMPANY" internal networks must pass through an access control point before the user can reach a login banner.
* Remote users must be required to authenticate before being granted access to company information.
* Remote access must be logged and audited.

**Hosts:**

* All hosts connected to “COMPANY” internal networks must be equipped with up-to-date anti-malware software. Third-party hosts must comply with this requirement before connecting to the network.
* All hosts connected to “COMPANY” internal networks via remote access must be company-issued or approved third-party devices.

**VPN:**

* Restricted company information must only be accessible via the "COMPANY" internal network or VPN. Access to the VPN must require multi-factor authentication.
* Authorized users shall not connect to the "COMPANY" VPN while the host is connected to a network that is not a trusted third-party network. Users shall not connect to the "COMPANY" VPN while also using another VPN (split-tunneling).
* Users must exercise caution when connecting to networks in public venues like airports, coffee shops, etc., and must not connect to the Company’s internal network (even via VPN) if on an unsecured, public network.

**Third-parties:**

* Access accounts used by remote vendors must only be enabled during the required time period and must be disabled immediately thereafter. Vendor accounts must be closely monitored and approved by "COMPANY".
* Authorized third-party users must be required to authenticate before being allowed to access restricted information.

### Usage:

Used only as needed in job/role/assignment(s). Terminate network connections as needed at the end of the sessions or after a defined period.

### **VPN/Proxy/Other**:

Covers any and all remote connection standards (e.g. website, VPN software/hardware, SOCKS proxy, SSH, etc.

### Policy Acceptance

*By signing below, I acknowledge that I have read, understand and will be held accountable to the above policies, procedures and agree to abide by them during the course of my employment and/or access with Company and/or resources.*

Signature: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Date:\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

*Please sign and return this page to requester.*


# Remote Support

Client On-Demand Remote Support Security - powered by ZOHO Assist/SpiceWorks

## Security and Privacy

Zoho Assist provides you a web-based solution with an uncluttered user interface. Security is not a concern with the two-factor authentication, SSL certification, and compatibility with all major anti-virus software.

### Multi-factor Authentication

Protect your account with an extra layer of security with an additional verification process. We use time-based OTP as a secondary factor of authentication to protect your account from internet fraud.

### Monitor Your Organization With Action Log Viewer.

The Action Log Viewer helps you track the activities carried out in your organization for auditing and administrative purposes.&#x20;

### Firewall Friendly

You can establish remote connections in a flash. You don't have to worry about exceptions or ports in your proxy or firewall configuration compromising your internet security.

### Secure With SSL and 256-bit AES Encryption.

The exchange of data in Zoho Assist during a session takes place through industry-standard, SSL and 256-bit AES protocols. Your sessions are safe and secure from any intrusion or tampering with the shared data.

### Antivirus Compatible.

Remote support and[ Remote Access ](http://www.zoho.com/assist/)[software](http://www.zoho.com/assist/) needs to be compatible with anti-virus software for hassle-free troubleshooting. Zoho Assist works well with all major anti-virus software.

### Secure Sessions With Inactive Session Timeout.

You and your clients shouldn't worry about idle sessions remaining open. With inactive session timeout, sessions will be terminated automatically if they are left idle beyond a pre-defined time period.

### Data Anonymization. Privacy Shield.

Internet Privacy is all about the protection of sensitive and private information. With data anonymization, we protect Personally Identifiable Information (PII) like technicians' IP addresses, clients' email addresses, and clients' IP addresses by allowing you to make the information anonymous at any time.

### Consent-Based Access. Session Confirmation Prompt.

With session confirmation, allows your client to give consent to the technician trying to initiate an [unattended](http://www.zoho.com/assist/unattended-remote-access.html)[ access](http://www.zoho.com/assist/unattended-remote-access.html) session.


# Immutable Infrastructure

Development and Production Workstation & Servers

Immutable infrastructure is an approach to managing services and software deployments on IT resources wherein components are replaced rather than changed. An application or services is effectively redeployed each time any change occurs.

## Security Features:

Immutable Linux Operating System(s)

Read-Only systems. Tamper-resistant and hardened against corruption.

Atomic upgrades.

Live Migration & Snapshots.

Critical Application(s) Sandboxing.

In a traditional software deployment, an application or service update requires that a component is changed in production, while the complete service or application remains operational. Immutable infrastructure instead relies on instancing, where components are assembled on computing resources to form the service or application. Once the service or application is iterated, its components are set -- thus, the service or application is immutable, unable to change. When a change is made to one or more components of a service or application, a new iteration is assembled, tested, validated and made available for use. Then the old iteration is discontinued to free the computing resources within the environment for other tasks.

Immutability restricts the potential for configuration drift, reducing the IT infrastructure's vulnerability to attack. Uptime is improved in unexpected events, because instances are redeployed instead of restored from multiple unique configurations and versions.

A deployment iteration typically results in the build of a common image that can be tested and proven. Cloud computing environments provide the automation required to construct and deploy images for immutable operations.

Immutable infrastructure benefits include lower IT complexity and failures, improved security and easier troubleshooting than on mutable infrastructure. It eliminates server patching and configuration changes, because each update to the service or application workload initiates a new, tested and up-to-date instance. There is no need to track changes. If the new instance does not meet expectations, it is simple to roll back to the prior known-good instance. Since you’re not working with individual components within the environment, there are far fewer chances for unpredictable behaviors or unintended consequences of code changes.


# Terms of Use

### Overview <a href="#overview" id="overview"></a>

**TERMS OF USE**

**Effective Date:** November 10, 2025

These Terms of Use ("Terms") govern your access to and use of the Yama Industrials, Inc. website located at yamaindustrials.com and all subdomains (the "Website"), including any content, materials, services, and information made available through the Website.

**These Terms apply only to Website visitors and users.** If you are engaging Yama Industrials to provide professional services, support services, advisory services, or any other services, your use is governed by the Main Service Agreement and related policies available at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/).

***

### 1. Acceptance of Terms <a href="#id-1-acceptance-of-terms" id="id-1-acceptance-of-terms"></a>

By accessing or using the Website, you agree to be bound by these Terms and all policies incorporated herein by reference. If you do not agree to these Terms, do not use the Website. Yama Industrials may modify these Terms at any time by posting the revised version on the Website. Your continued use of the Website following any modifications constitutes your acceptance of the modified Terms.

***

### 2. Use License <a href="#id-2-use-license" id="id-2-use-license"></a>

Subject to your compliance with these Terms, Yama Industrials grants you a limited, non-exclusive, non-transferable, non-sublicensable license to access and use the Website for lawful purposes only.

***

### 3. Nature of Service <a href="#id-3-nature-of-service" id="id-3-nature-of-service"></a>

Yama Industrials is a business-to-business (B2B) service provider. The Website provides information about professional services, support services, and advisory services offered to commercial entities and businesses. The Website is not intended to serve retail or direct-to-consumer functions. Yama Industrials operates as a cloud-based service provider and does not maintain physical retail locations or consumer-facing public facilities.

***

### 4. Prohibited Uses <a href="#id-4-prohibited-uses" id="id-4-prohibited-uses"></a>

You shall not, and shall not permit any third party to:

* **(a)** Use the Website for any illegal purpose or in violation of any applicable law or regulation
* **(b)** Violate the Acceptable Use Policy available at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/)
* **(c)** Interfere with, disrupt, or circumvent the operation of the Website or its servers and networks
* **(d)** Transmit viruses, malware, ransomware, or any other harmful or invasive code
* **(e)** Attempt to gain unauthorized access to any part of the Website, user accounts, or backend systems
* **(f)** Perform port scanning, vulnerability scanning, or network reconnaissance without authorization
* **(g)** Transmit spam, phishing communications, or unsolicited materials
* **(h)** Engage in harassment, threats, abuse, or defamation of any person
* **(i)** Infringe on any third-party intellectual property, privacy, publicity, or other proprietary rights
* **(j)** Systematically download, scrape, index, or harvest content from the Website
* **(k)** Mirror, frame, or incorporate any part of the Website into another product or service
* **(l)** Reverse engineer, decompile, or disassemble any part of the Website
* **(m)** License, sublicense, sell, resell, or distribute the Website or any content for commercial purposes
* **(n)** Engage in any activity that Yama Industrials reasonably determines to violate the spirit or intent of these Terms

***

### 5. Intellectual Property <a href="#id-5-intellectual-property" id="id-5-intellectual-property"></a>

All content on the Website, including text, graphics, images, videos, code, and other materials ("Content"), is protected by copyright, trademark, patent, trade secret, and other intellectual property laws. Yama Industrials and its licensors retain all right, title, and interest in and to the Website and all Content. You have no rights other than the limited license granted in Section 2.

***

### 6. User Submissions <a href="#id-6-user-submissions" id="id-6-user-submissions"></a>

Any information, feedback, comments, or materials you provide to Yama Industrials through the Website ("Submissions") are non-confidential and may be used by Yama Industrials for any purpose without compensation or attribution to you. You represent and warrant that you have all rights necessary to provide such Submissions and that they do not violate any third-party rights or applicable law.

***

### 7. Disclaimer <a href="#id-7-disclaimer" id="id-7-disclaimer"></a>

THE WEBSITE AND ALL CONTENT ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT ANY WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. YAMA INDUSTRIALS DISCLAIMS ALL WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, UNINTERRUPTED ACCESS, OR ERROR-FREE OPERATION.

YAMA INDUSTRIALS MAKES NO REPRESENTATION OR WARRANTY REGARDING THE ACCURACY, COMPLETENESS, TIMELINESS, RELIABILITY, QUALITY, USEFULNESS, LEGALITY, OR SAFETY OF ANY CONTENT OR INFORMATION ON THE WEBSITE.

YOUR USE OF THE WEBSITE IS AT YOUR SOLE RISK. YAMA INDUSTRIALS HAS NO OBLIGATION TO MONITOR THE WEBSITE OR REMOVE ANY CONTENT.

***

### 8. Limitation of Liability <a href="#id-8-limitation-of-liability" id="id-8-limitation-of-liability"></a>

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, YAMA INDUSTRIALS AND ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS (COLLECTIVELY, "YAMA PARTIES") SHALL NOT BE LIABLE FOR ANY DAMAGES ARISING FROM OR RELATING TO YOUR USE OF THE WEBSITE, INCLUDING BUT NOT LIMITED TO:

* Loss of profits, revenue, or business opportunities
* Business interruption or loss of use
* Loss of data or data corruption
* Inability to access the Website or any portion thereof due to technical issues, browser compatibility, network connectivity, system limitations, or any other reason
* Cost of substitute services or products
* Any indirect, incidental, special, consequential, or punitive damages
* Any claims arising from third-party services, integrations, or dependencies

THIS LIMITATION APPLIES REGARDLESS OF WHETHER YAMA INDUSTRIALS WAS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND REGARDLESS OF THE LEGAL THEORY (WHETHER IN CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE).

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES OR STATUTORY RIGHTS. IN SUCH JURISDICTIONS, YAMA PARTIES' LIABILITY SHALL BE LIMITED TO THE MAXIMUM EXTENT PERMITTED BY LAW.

***

### 9. Third-Party Content and Links <a href="#id-9-third-party-content-and-links" id="id-9-third-party-content-and-links"></a>

The Website may contain links to or access to third-party websites, content, materials, and services. Yama Industrials does not endorse, control, or assume responsibility for any third-party content, services, or resources. Your use of third-party content or services is governed by the terms and conditions of the third-party provider. Yama Industrials is not liable for any issues, defects, or security vulnerabilities in third-party content or services.

***

### 10. Privacy and Data Protection <a href="#id-10-privacy-and-data-protection" id="id-10-privacy-and-data-protection"></a>

Information collected through the Website is handled in accordance with Yama Industrials' Privacy Policy, available at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/).

***

### 11. Governing Law and Dispute Resolution <a href="#id-11-governing-law-and-dispute-resolution" id="id-11-governing-law-and-dispute-resolution"></a>

These Terms are governed by the laws of the State of Wyoming, without regard to conflict of law principles. All disputes arising from or relating to these Terms shall be resolved in the state or federal courts located in Wyoming, and you irrevocably consent to personal jurisdiction and venue in such courts.

You waive any right to trial by jury and agree to resolve disputes on an individual basis (not as a class action).

***

### 12. Suspension and Termination <a href="#id-12-suspension-and-termination" id="id-12-suspension-and-termination"></a>

Yama Industrials may, in its sole discretion and without prior notice, suspend or terminate your access to the Website if you violate these Terms, the Acceptable Use Policy, or if your use poses a security risk or legal liability to Yama Industrials.

***

### 13. Indemnification <a href="#id-13-indemnification" id="id-13-indemnification"></a>

You agree to indemnify, defend, and hold harmless Yama Industrials and all Yama Parties from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable attorney fees) arising from:

* **(a)** Your use of the Website
* **(b)** Your violation of these Terms or the Acceptable Use Policy
* **(c)** Your violation of any applicable law or regulation
* **(d)** Your violation of any third-party rights
* **(e)** Any Submission you provide

***

### 14. Service Engagement <a href="#id-14-service-engagement" id="id-14-service-engagement"></a>

If you choose to engage Yama Industrials for professional services, support services, advisory services, or any other services, your engagement is governed by the Main Service Agreement and all policies published at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/), not by these Terms of Use.

***

### 15. General Provisions <a href="#id-15-general-provisions" id="id-15-general-provisions"></a>

### 15.1. Entire Agreement

These Terms constitute the entire agreement between you and Yama Industrials concerning your use of the Website and supersede all prior agreements and understandings.

### 15.2. Severability

If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

### 15.3. No Waiver

No waiver of any provision of these Terms shall be effective unless in writing and signed by Yama Industrials. No waiver of any breach shall constitute a waiver of any subsequent breach.

### 15.4. Assignment

You may not assign or transfer these Terms without Yama Industrials' prior written consent. Yama Industrials may assign these Terms to any affiliate or successor without restriction.

### 15.5. Notices

All notices under these Terms must be in writing and delivered to 800 Third Avenue #1292, New York, NY 10022, or to the email address provided by Yama Industrials.

### 15.6. Force Majeure

Neither party shall be liable for delays or failures to perform due to causes beyond its reasonable control, including acts of God, war, terrorism, natural disasters, pandemics, or third-party service failures.

### 15.7. Independent Relationship

These Terms do not create a partnership, joint venture, agency, or employment relationship between you and Yama Industrials.

***

### 16. Compliance with Laws <a href="#id-16-compliance-with-laws" id="id-16-compliance-with-laws"></a>

You represent and warrant that you comply with all applicable laws and regulations in connection with your use of the Website. You shall not use the Website to violate U.S. export control laws or to engage with any country, individual, or entity subject to U.S. government restrictions or embargoes.

***

### 17. Contact Information <a href="#id-17-contact-information" id="id-17-contact-information"></a>

For questions about these Terms of Use, please contact:

**Yama Industrials, Inc.**\
800 Third Avenue #1292\
New York, NY 10022\
Email: <info@yamaindustrials.com>


# Acceptable Use Policy

This Acceptable Use Policy sets out a list of acceptable and unacceptable conduct for our Services. If we believe a violation of the policy is deliberate, repeated or presents a credible risk of harm to other users, our customers, the Services or any third parties, we may suspend or terminate your access.

## Do:

* comply with all User Terms of Service, including the terms of this Acceptable Use Policy;
* comply with all applicable laws and governmental regulations, including, but not limited to, all intellectual property, data, privacy, and export control laws, and regulations promulgated by any government agencies, including, but not limited to, the U.S. Securities and Exchange Commission, and any rules of any national and other securities exchanges;
* upload and disseminate only Customer Data to which Customer owns all required rights under law and under contractual and fiduciary relationships (such as proprietary and confidential information learned or disclosed as part of employment relationships or under nondisclosure agreements) and do so only consistent with applicable law;
* use commercially reasonable efforts to prevent unauthorized access to or use of the Services;
* keep passwords and all other login information confidential;
* monitor and control all activity conducted through your account in connection with the Services;
* promptly notify us if you become aware of or reasonably suspect any illegal or unauthorized activity or a security breach involving your accounts or teams, including any loss, theft, or unauthorized disclosure or use of a username, password, or account; and
* comply in all respects with all applicable terms of the third party applications, including any that Customer elects to integrate with the Services that you access or subscribe to in connection with the Services.

## Do not:&#x20;

* interfere with or disrupt the operation of the servers or networks used to make the Services available, or violate any requirements, procedures, policies, or regulations of such servers or networks or their providers;&#x20;
* post, transmit, or otherwise make available through, or in connection with, the Services any virus, worm, Trojan horse, Easter egg, time bomb, spyware, or other computer code, file, or program that is, or is potentially, harmful or invasive or intended to damage or hijack the operation of, or to monitor the use of, any hardware, software, or equipment;
* license, sublicense, transfer, assign, reproduce, duplicate, copy, sell, resell, distribute, or exploit for any commercial or production purposes the Services;
* reproduce, modify, rent, lease, loan, timeshare, sell, distribute, or otherwise exploit all or any part of the Services, except as expressly authorized in this Agreement;
* frame or mirror all or any part of the Services, or incorporate all or any part of the Services into any product or service.
* systematically download or store all, or any part of, Services, or use any robot, spider, site search/retrieval application, or other manual or automatic device to retrieve, index, “scrape,” “data mine”, reproduce, or circumvent the navigational structure or presentation of the Services;
* remove any copyright, trademark, or other proprietary rights notice of YAMA in connection with the Services;
* in connection with the Services (a) defame, threaten, abuse, or harass any person, or otherwise violate the legal rights of any person or entity, including any copyright, trademark, trade secret, right of publicity or privacy, or any other proprietary right; (b) harvest or collect personally identifiable information from or about any person other than in the ordinary course of Customer’s business or otherwise in violation of any applicable law; (c) impersonate any person or entity, or falsely state or otherwise misrepresent Customer’s affiliation with any person or entity; or (d) engage in any fraudulent or otherwise tortious or unlawful conduct.
* engage in any other activity prohibited by the User and Customer Terms.

Without affecting any other remedies available to us, YAMA may permanently or temporarily terminate or suspend an Authorized User's or Customer's account or access to the Services without notice or liability if YAMA (in its sole discretion) determines that an Authorized User or Customer has violated this Acceptable Use Policy.


# Software and SaaS Subscription Agreement

### Overview <a href="#overview" id="overview"></a>

**SOFTWARE AND SAAS SUBSCRIPTION AGREEMENT**

**Effective Date:** November 10, 2025

This Software and SaaS Subscription Agreement ("Software Agreement") governs the **licensing and use of software products**, software-as-a-service (SaaS) platforms, and cloud-based applications provided by Yama Industrials, Inc. ("Yama Industrials"), including but not limited to Yama DNS and any future software offerings (collectively, "Software Products").

The **delivery, support, payment, and termination of all services** (including those related to Software Products) are governed by the Main Service Agreement and related policies available at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/).

***

### 1. General Provisions <a href="#id-1-general-provisions" id="id-1-general-provisions"></a>

### 1.1. Agreement to Terms

By accessing, using, registering for, or subscribing to any Software Product, Customer agrees to be bound by this Software Agreement, the Main Service Agreement, and all policies published at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/) and incorporated herein by reference.

### 1.2. Supremacy of Main Service Agreement

This Software Agreement addresses only software-specific licensing matters. All other terms, conditions, obligations, and provisions are governed by the Main Service Agreement, which shall apply and control.

### 1.3. Authorization and Ordering

Software Products are provided when authorized by an Order Form as defined in the Main Service Agreement. The authorization, acceptance, and ordering process for Software Products is governed by the Main Service Agreement.

***

### 2. Software License <a href="#id-2-software-license" id="id-2-software-license"></a>

### 2.1. Limited License

Subject to Customer's compliance with this Software Agreement and payment of all applicable fees, Yama Industrials grants Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Software Products during the Subscription Term solely for Customer's internal business purposes.

### 2.2. License Restrictions

Customer shall not, and shall not permit any third party to:

* **(a)** Copy, modify, create derivative works of, reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code or underlying algorithms of any Software Product
* **(b)** Rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer, or otherwise make available any Software Product to any third party
* **(c)** Use any Software Product for any purpose other than as expressly permitted in this Software Agreement
* **(d)** Remove, alter, or obscure any proprietary notices on any Software Product
* **(e)** Use any Software Product to develop, operate, or distribute any competing product or service
* **(f)** Access any Software Product for purposes of monitoring availability, performance, or functionality for benchmarking or competitive purposes
* **(g)** Use any Software Product in any manner that violates applicable laws, regulations, or third-party rights
* **(h)** Transmit, store, or process any viruses, malware, or malicious code through any Software Product
* **(i)** Attempt to gain unauthorized access to any Software Product, related systems, or networks
* **(j)** Use any Software Product in violation of the Acceptable Use Policy

### 2.3. Proprietary Rights

Yama Industrials and its licensors retain all right, title, and interest in and to the Software Products, including all intellectual property rights. No rights are granted to Customer other than the limited license expressly set forth in Section 2.1.

***

### 3. Subscription Basis <a href="#id-3-subscription-basis" id="id-3-subscription-basis"></a>

### 3.1. Subscription Only

Software Products are provided on a subscription basis only; there are no perpetual licenses. The subscription term, renewal process, and transition to Ad-Hoc Support Status upon expiration or termination are governed by the Main Service Agreement and the Post-Agreement & Ad-Hoc Support Policy.

### 3.2. License Termination

Upon termination or expiration of a Software Product subscription for any reason, Customer's license to the affected Software Product immediately terminates and Customer must cease all use.

***

### 4. Customer Data <a href="#id-4-customer-data" id="id-4-customer-data"></a>

### 4.1. Ownership

Customer retains all right, title, and interest in and to all data, content, and materials that Customer submits, uploads, or otherwise makes available through the Software Products ("Customer Data").

### 4.2. Data Handling

All data handling, privacy, security, retention, export, and deletion obligations are governed by the Privacy Policy, Zero-Knowledge Policy, Data Protection and Privacy provisions of the Main Service Agreement, and applicable data protection laws.

***

### 5. Software-Specific Terms <a href="#id-5-software-specific-terms" id="id-5-software-specific-terms"></a>

### 5.1. Software Updates and Changes

Yama Industrials may, in its sole discretion, update, modify, enhance, or otherwise change the Software Products at any time, including adding, modifying, or removing features. Updates may be deployed automatically without prior notice. Yama Industrials has no obligation to maintain any particular features or functionality.

### 5.2. Third-Party Services

Software Products may rely on or integrate with third-party services, APIs, platforms, or infrastructure. Yama Industrials is not responsible for the availability, performance, security, or functionality of any third-party services. Yama Industrials may modify, suspend, or discontinue third-party integrations at any time without liability.

### 5.3. Service Availability

Service level commitments, if any, are governed by the Support Policy and Service Level Agreements and as specified in the Order Form. Unless a specific service level commitment is set forth in a signed Order Form, Software Products are provided on a best-effort basis. Yama Industrials may perform scheduled or emergency maintenance at any time.

***

### 6. Suspension <a href="#id-6-suspension" id="id-6-suspension"></a>

Yama Industrials may immediately suspend Customer's access to any Software Product if Customer violates this Software Agreement, the Acceptable Use Policy, or if Customer's use poses a security risk or legal liability to Yama Industrials or its customers. Suspension does not relieve Customer of payment obligations.

***

### 7. Governing Terms <a href="#id-7-governing-terms" id="id-7-governing-terms"></a>

All terms, conditions, and obligations not specifically addressed in this Software Agreement are governed by the Main Service Agreement and related policies published at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/).


# Privacy Policy

Notice

**Safeguarding our users' information is a top priority.**

This Privacy Policy explains how Yama Industrials, Inc. ("Yama Industrials, Inc.," "we," "us," or "our") collects, uses, and discloses your information. This Privacy Policy applies to all services and products, except those products that have a separate privacy policy.

By using our website, products, and services, you consent to the use of your information as described in this Privacy Policy. Please read this document in full. If you have any questions, please contact us.

Privacy is core to our business. We take the protection of your information seriously and are committed to transparent data practices.

### What We Do NOT Collect or Retain <a href="#what-we-do-not-collect-or-retain" id="what-we-do-not-collect-or-retain"></a>

Yama Industrials, Inc. operates under zero-knowledge principles regarding permanent client data retention. We **do not**:

* Permanently collect, store, or retain client passwords, login credentials, or authentication information
* Maintain permanent copies of client proprietary data, Personally Identifiable Information (PII), or Protected Health Information (PHI) on our servers or off-site infrastructure
* Maintain permanent remote support connections, persistent remote access tools, or monitoring systems on client systems
* Collect or retain usage logs, activity logs, or behavioral telemetry from client systems
* Sell any personal information about our users, other than in connection with a disposition of our company or our assets, as described below
* Turn over any personal information about our users to third-party marketing or advertising firms without your consent

### What Information We Collect <a href="#what-information-we-collect" id="what-information-we-collect"></a>

We collect only the information necessary to provide our services and maintain our business operations.

### Information You Directly Provide Us

When you sign up for a Yama Industrials, Inc. account or use our services, we may collect:

* Your email address (for billing, account status, system status updates, and customer support)
* IP address (for account setup and billing purposes)
* Company name or organization information
* Payment contact information (for billing purposes)
* Any information you voluntarily provide through communications with us

### Payment Information

Payment processing is handled entirely by our third-party payment processor, Wave Financial (waveapps.com). When you receive an invoice from us, you will be directed to Wave Financial's secure payment portal to complete your payment.

**Yama Industrials, Inc. does not collect, process, or store credit card numbers, CVV codes, bank account numbers, or any payment card information.** The only exception is for payments made by company check, which are processed through standard banking channels.

All electronic payment information, including credit card and ACH transfer details, is collected and processed directly by Wave Financial and is subject to Wave Financial's privacy policy and security practices, not ours.

### Information From Your Browser

Your browser automatically sends us certain information, including your IP address, browser type, operating system, and referral URL. We use this information for website optimization and security purposes.

### A Note on Cookies <a href="#a-note-on-cookies" id="a-note-on-cookies"></a>

We do not deploy cookies or tracking technologies. However, some of our service providers may use cookies and similar technologies to help you interact with our website and services, and for analytics and support purposes. These service providers are subject to their own privacy policies.

### Client Data Access During Service Delivery <a href="#client-data-access-during-service-delivery" id="client-data-access-during-service-delivery"></a>

When providing IT services, cybersecurity consulting, device migrations, system maintenance, and technical support, our technicians may access client systems and data, including:

* Business files and documents
* Personally Identifiable Information (PII) of client employees or customers
* Proprietary business information and intellectual property
* For healthcare clients: Protected Health Information (PHI) under HIPAA Business Associate Agreements

All such access is:

* Governed by our contractual agreements (Master Service Agreement, Non-Disclosure Agreements, Business Associate Agreements)
* Limited to what is necessary to perform the contracted services
* Subject to strict confidentiality obligations
* Not permanently retained on our systems after service completion

We do not collect, copy, or retain permanent copies of client data accessed during service delivery on our servers or off-site infrastructure. For healthcare clients, all PHI access is governed by Business Associate Agreements and subject to HIPAA safeguards. See our HIPAA Business Associate Notice for details.

### How We Use Your Information <a href="#how-we-use-your-information" id="how-we-use-your-information"></a>

We use collected information for the following purposes:

* To respond to your questions and fulfill your requests
* To complete and fulfill your purchases and provide customer service
* To send you marketing communications (which you can opt out of—see "Choices and Access" below)
* To personalize your experience on our website and with our products and services
* To allow you to participate in our promotions, which may have their own rules
* For legitimate business purposes, such as fraud detection and prevention, developing new products, enhancing and improving our products and services, identifying usage trends, and operating our business activities
* As required by applicable law or legal process
* To enforce our Terms of Use and EULA
* To protect the rights, privacy, safety, and property of Yama Industrials, Inc., our affiliates, and our users

**We do not use your information for data analysis or profiling related to your business operations, client systems, or usage patterns.**

### How We Share Your Information <a href="#how-we-share-your-information" id="how-we-share-your-information"></a>

We share collected information in the following limited circumstances:

* **With third-party service providers** who provide services such as website hosting, payment processing, IT infrastructure, email delivery, and similar services necessary to operate our business. These service providers are contractually obligated to protect your information and are prohibited from using it for other purposes. Our primary payment processor is Wave Financial (waveapps.com).
* **In legal proceedings**, as we believe necessary or appropriate: (a) under applicable law; (b) to comply with legal process or requests from the U.S. Government; (c) to enforce our Terms of Use or EULA; (d) to protect our operations or those of our affiliates; (e) to protect the rights, privacy, safety, or property of Yama Industrials, Inc., our affiliates, you, or others; and (f) to pursue available remedies or limit damages.
* **In connection with business transfers**, in the event of an acquisition, merger, reorganization, sale, or other disposition of all or any portion of our business, assets, or stock (including in connection with bankruptcy or similar proceedings).
* **If you violate our policies**, we reserve the right to use or disclose relevant information and records if you violate our Terms of Use or EULA, or if you engage in or are reasonably suspected of engaging in illegal activity, to protect our operations and legal interests.

### Third-Party Services <a href="#third-party-services" id="third-party-services"></a>

This Privacy Policy does not apply to third-party websites, services, or practices. Any links to third-party sites do not imply endorsement by Yama Industrials, Inc. or our affiliates.

When you are directed to Wave Financial's payment portal to complete a transaction, you will be subject to Wave Financial's privacy policy and terms of service.

### Security <a href="#security" id="security"></a>

Yama Industrials, Inc. takes the security of your data seriously and uses reasonable security measures to protect personal information. However, no data transmission or storage system can be guaranteed to be 100% secure. If you believe your interaction with us is no longer secure, please immediately contact us at <info@yamaindustrials.com>

### Choices and Access <a href="#choices-and-access" id="choices-and-access"></a>

### Marketing Communications

If you no longer want to receive marketing-related emails from us, you may opt-out by following the instructions in each email or by contacting us at <info@yamaindustrials.com> We will comply with your request as soon as reasonably practicable. Please note that you cannot opt-out of administrative or transactional emails necessary for account management and service delivery.

### Access and Correction

If you would like to review, correct, update, suppress, or delete the personal information you have provided to us, you may contact us at <info@yamaindustrials.com>

In your request, please clearly specify what personal information you would like changed and whether you want it deleted or suppressed from our database. For your protection, we will only implement requests with respect to the personal information associated with the email address you use to send your request, and we may verify your identity before making changes.

We will comply with your request as soon as reasonably practicable. We may need to retain certain information for record-keeping purposes, legal compliance, or to complete transactions you initiated prior to your request. Some residual information may remain in our databases and backup systems.

### Use of Services by Minors <a href="#use-of-services-by-minors" id="use-of-services-by-minors"></a>

We do not direct our products or services to anyone under 18 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information.

### Cross-Border Transfer <a href="#cross-border-transfer" id="cross-border-transfer"></a>

Yama Industrials, Inc. operates out of the United States. Our services and products are not intended to subject us to the laws or jurisdiction of any state, country, or territory other than the United States. By using our website, products, and services, you consent to the transfer of information to and from the United States.

### Sensitive Information <a href="#sensitive-information" id="sensitive-information"></a>

We request that you do not send us or disclose sensitive personal information such as social security numbers, health information, genetic characteristics, or criminal background information through our website or otherwise.

### Changes to This Privacy Policy <a href="#changes-to-this-privacy-policy" id="changes-to-this-privacy-policy"></a>

We may update this Privacy Policy from time to time. Your continued use of our website, products, and services means you have accepted the updated Privacy Policy. We encourage you to review this Privacy Policy periodically for any updates.

### Contacting Us <a href="#contacting-us" id="contacting-us"></a>

If you have any questions about this Privacy Policy, please contact us:

Yama Industrials, Inc.\
800 Third Avenue #1292\
New York, NY 10022

Or email: <info@yamaindustrials.com>

Because email communications are not always secure, please do not include credit card information or other sensitive information in your emails to us.


# Zero-Knowledge Policy

Privacy by Design

### Overview <a href="#overview" id="overview"></a>

Yama Industrials, Inc. was founded in 2014 on the principles of privacy-by-design and zero-knowledge frameworks. We do not retain copies of client data, do not collect or store client passwords and login credentials, and do not maintain permanent remote support connections on client systems.

### What We Do NOT Retain or Maintain <a href="#what-we-do-not-retain-or-maintain" id="what-we-do-not-retain-or-maintain"></a>

**Client Passwords and Login Credentials**

We do not retain, store, or keep client passwords, usernames, authentication credentials, or access tokens. We do not maintain permanent credentials that would allow ongoing access to client systems.

**Client Data Storage**

We do not store, host, or retain copies of client data on our servers or off-site infrastructure. Client data remains the responsibility and property of the client.

**Permanent Remote Support Connections**

We do not maintain standing remote support access, persistent remote tools, or permanent connections to client systems. Remote support is provided on an as-needed, temporary basis during active service engagements only.

### Data Access During Service Delivery <a href="#data-access-during-service-delivery" id="data-access-during-service-delivery"></a>

During the course of providing IT services, cybersecurity consulting, device migrations, system support, and technical work, our technicians may temporarily access:

* Client systems and devices
* Files and data stored on client equipment
* Personally Identifiable Information (PII) of client employees or customers
* For healthcare clients: Protected Health Information (PHI) under HIPAA Business Associate Agreements

All such access is:

* Limited to the duration of the active service engagement
* Governed by our contractual agreements and security obligations
* Subject to strict confidentiality and data protection requirements

For healthcare clients, all PHI access is governed by Business Associate Agreements and subject to the terms specified in those agreements. See our HIPAA Business Associate Notice for information about our role as a Business Associate.

### Third-Party Service Providers <a href="#third-party-service-providers" id="third-party-service-providers"></a>

Yama Industrials, Inc. utilizes third-party service providers for operational infrastructure and business functions. These services support our operations and are not used to store, retain, or monitor client data or credentials.

Please refer to our Privacy Policy and other compliance documentation for information regarding third-party data handling and processing.

### Changes to Our Service Providers <a href="#changes-to-our-service-providers" id="changes-to-our-service-providers"></a>

As our business infrastructure needs evolve, we may add or discontinue service providers. We will update this page periodically to reflect changes.

### Questions About This Policy <a href="#questions-about-this-policy" id="questions-about-this-policy"></a>

For questions or clarifications regarding our Zero-Knowledge Policy, please contact Yama Industrials, Inc. directly at <info@yamaindustrials.com>


# Privacy by Design

(PbD) framework

Privacy by Design advances the view that the future of privacy cannot be assured solely by compliance with regulatory frameworks; rather, privacy assurance must ideally become an organization’s default mode of operation.

Privacy by Design extends to a trilogy of encompassing applications:<br>

1. **IT systems.**<br>
2. **Accountable business practices.**<br>
3. **Networked infrastructure.**

Principles of Privacy by Design may be applied to all types of personal information, but should be applied with special vigour to sensitive data such as medical information and financial data. The strength of the privacy measures implemented tends to be commensurate with the sensitivity of the data.

The Privacy by Design (PbD) framework is characterized by the taking of proactive rather than reactive measures. It anticipates the risks and prevents privacy invasive events before they occur. (PbD) does not wait for privacy risks to materialize, nor does it offer remedies for resolving privacy infractions once they have occurred —it aims to identify the risks and prevent the harms from arising. In short, Privacy by Design comes before-the-fact, not after.

Privacy by Design seeks to deliver the maximum degree of privacy by ensuring that personal data are automatically protected in any given IT system or business practice, as the default. If an individual does nothing, their privacy still remains intact. No action is required on the part of the individual in order to protect their privacy —it is already built into the system, by default.

Privacy measures are embedded into the design and architecture of IT systems and business practices. These are not bolted on as add-ons, after the fact. The result is that privacy becomes an essential component of the core functionality being delivered. Privacy is thus integral to the system, without diminishing functionality.

Privacy by Design seeks to accommodate all legitimate interests and objectives in a positive-sum “win-win” manner, not through the dated, zero-sum (either/or) approach, where unnecessary trade-offs are made. Privacy by Design avoids the pretense of false dichotomies, such as privacy vs. security, demonstrating that it is indeed possible to have both.

Privacy by Design, having been embedded into the system prior to the first element of information being collected, extends securely throughout the entire lifecycle of the data involved —strong security measures are essential to privacy, from start to finish.

Privacy by Design seeks to assure all stakeholders that whatever the business practice or technology involved, it is in fact, operating according to the stated promises and objectives, subject to independent verification. The data subject is made fully aware of the personal data being collected, and for what purpose(s). All the component parts and operations remain visible and transparent, to users and providers alike.

Privacy by Design requires architects and operators to keep the interests of the individual uppermost by offering such measures as strong privacy defaults, and appropriate notice.


# CCPA

California Consumer Privacy Act

## California Consumer Privacy Act (CCPA) Notice <a href="#california-consumer-privacy-act-ccpa-notice" id="california-consumer-privacy-act-ccpa-notice"></a>

This California Consumer Privacy Act (CCPA) Notice supplements our Privacy Policy and applies to consumers who are residents of California. This notice describes Yama Industrials, Inc.'s practices regarding the collection, use, and disclosure of personal information from California residents, as required by the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.).

### Categories of Personal Information We Collect <a href="#categories-of-personal-information-we-collect" id="categories-of-personal-information-we-collect"></a>

Over the past 12 months, Yama Industrials, Inc. has collected the following categories of personal information:

| Category                   | Examples                                                                                                                                                                                                                                        | Source                                                                                                                                       |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| **Identifiers**            | Name, email address, mailing address, phone number, company name                                                                                                                                                                                | Directly from you when creating an account or contacting us                                                                                  |
| **Commercial Information** | Account type, subscription plan, billing history, transaction records                                                                                                                                                                           | Directly from you during account setup and service usage                                                                                     |
| **Payment Information**    | Payment contact information for invoicing purposes only. Credit card numbers, CVV codes, bank account numbers, and ACH transfer details are collected and processed exclusively by Wave Financial (waveapps.com), not by Yama Industrials, Inc. | Payment contact info directly from you; all payment card and banking details collected by Wave Financial through their secure payment portal |
| **Internet Activity**      | IP address, browser type, operating system, pages visited, referral URL                                                                                                                                                                         | Automatically collected through your browser when accessing our website                                                                      |
| **Geolocation Data**       | General location inferred from IP address                                                                                                                                                                                                       | Automatically collected                                                                                                                      |

### What We Do NOT Collect <a href="#what-we-do-not-collect" id="what-we-do-not-collect"></a>

In accordance with our zero-knowledge principles, Yama Industrials, Inc. does **not** collect, store, or retain:

* Client passwords, login credentials, or authentication information
* Client proprietary data or intellectual property
* Permanent remote access credentials or connection information
* Usage logs, activity logs, or behavioral telemetry from client systems
* Credit card numbers, CVV codes, bank account numbers, or payment card information (these are processed exclusively by Wave Financial)

### Sources of Personal Information <a href="#sources-of-personal-information" id="sources-of-personal-information"></a>

We collect personal information from the following sources:

* **Directly from you**: When you create an account, use our services, contact customer support, or subscribe to our products
* **Automatically**: Through your browser and devices when you access our website and services
* **Payment processors**: Wave Financial collects payment information directly from you when you complete payment through their secure portal
* **Customer service interactions**: When you contact us with questions or support requests

### Business and Commercial Purposes for Collection <a href="#business-and-commercial-purposes-for-collection" id="business-and-commercial-purposes-for-collection"></a>

We collect and use personal information for the following purposes:

* To provide, maintain, and improve our services and products
* To process invoicing (payment processing is handled by Wave Financial)
* To respond to your inquiries and provide customer support
* To send you account notifications and service updates
* To send you marketing communications (with opt-out available)
* To comply with legal obligations and regulatory requirements
* To prevent fraud, secure our systems, and protect the rights and property of Yama Industrials, Inc.
* To analyze usage trends and improve our website and services (not including analysis of client business operations or systems)
* To establish and maintain customer accounts

### Categories of Third Parties We Share With <a href="#categories-of-third-parties-we-share-with" id="categories-of-third-parties-we-share-with"></a>

We may share your personal information with the following categories of third parties:

* **Service providers**: Third-party companies that provide services on our behalf, including website hosting, payment processing (Wave Financial), customer service, and email delivery
* **Legal requirements**: Government agencies or courts when required by law
* **Business transfers**: In connection with a merger, acquisition, or sale of assets
* **Fraud prevention**: When necessary to detect, investigate, or prevent fraud or security incidents

### Data Sales and Sharing <a href="#data-sales-and-sharing" id="data-sales-and-sharing"></a>

**Yama Industrials, Inc. does NOT sell personal information about California residents.**

We do not sell personal information as defined by the CCPA. However, we do share personal information with third-party service providers as described above, which may constitute a "sharing" under the CCPA.

### Your California Consumer Rights <a href="#your-california-consumer-rights" id="your-california-consumer-rights"></a>

As a California resident, you have the following rights under the CCPA:

### Right to Know

You have the right to request what personal information we have collected about you and how we use it. This includes the categories of personal information, the sources of that information, and the business or commercial purposes for collection.

### Right to Delete

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (such as when information is needed to complete a transaction or comply with legal obligations).

### Right to Opt-Out

You have the right to opt-out of the sale or sharing of your personal information. As noted above, we do not sell personal information, but you may opt-out of any sharing of personal information by contacting us (see below).

### Right to Correct

You have the right to request correction of inaccurate personal information.

### Right to Limit Use and Disclosure

You have the right to limit our use and disclosure of your sensitive personal information to purposes necessary to provide you with the services you requested.

### Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights. We will not deny services, charge different rates, or provide different quality of service based on your exercise of CCPA rights.

### How to Submit a Request <a href="#how-to-submit-a-request" id="how-to-submit-a-request"></a>

To exercise any of the rights described above, please submit a verifiable consumer request to us by:

**Email**: <info@yamaindustrials.com>

**Mail**: Yama Industrials, Inc.\
800 Third Avenue #1292\
New York, NY 10022

**Subject Line**: "CCPA Rights Request"

### Verifying Your Identity

To protect your privacy and security, we will verify your identity before processing your request. We may require you to provide:

* The email address associated with your account
* Your name and mailing address
* Any other information we reasonably request to verify your identity

You may authorize another person (an "authorized agent") to make a request on your behalf by providing them with power of attorney or similar authorization. We may require the authorized agent to verify their authority and your identity.

### Response Timeline <a href="#response-timeline" id="response-timeline"></a>

We will respond to verifiable consumer requests within 45 calendar days, or as otherwise required by California law. If we need additional time, we will provide written notice of the extension.

### Personal Information of Minors <a href="#personal-information-of-minors" id="personal-information-of-minors"></a>

We do not intentionally collect personal information from minors under 18 years of age. If we become aware that we have collected personal information from a minor under 18, we will take appropriate steps to delete such information.

For minors between 13 and 18 years of age, they may request deletion of information they have posted. To submit such a request, please contact us at the address or email provided above.

### Changes to This Notice <a href="#changes-to-this-notice" id="changes-to-this-notice"></a>

Yama Industrials, Inc. may update this CCPA Notice from time to time. Your continued use of our services constitutes acceptance of the updated notice. We encourage you to review this CCPA Notice periodically for any updates.

### Contact Us <a href="#contact-us" id="contact-us"></a>

If you have questions about this CCPA Notice or your California consumer rights, please contact us:

Yama Industrials, Inc.\
800 Third Avenue #1292\
New York, NY 10022

Email: <info@yamaindustrials.com>

Because email communications are not always secure, please do not include personal financial information or other sensitive information in your emails to us.


# Data Subject Notice

Notice

I am hereby consenting that YAMA can process my personal data for the following purposes:‌

To respond to my questions and fulfill my requests.

To send helpful information to me, such as notifying me of changes to YAMA's terms of use, end user license agreement or privacy policy.

To complete and fulfill my purchases and provide me with customer service.

To send me marketing communications.

To personalize my experience on YAMA's website and use of YAMA's products and services.

To allow me to participate in YAMA's promotions, which may have their own rules.

For YAMA's other internal business purposes, such as data analysis, audits, fraud monitoring and prevention, developing new products, enhancing, improving or modifying YAMA's products and services, identifying usage trends, determining the effectiveness of YAMA's promotional campaigns, and operating and expanding YAMA's business activities.

As YAMA believes to be necessary or appropriate: (a) under applicable law; (b) to comply with legal process, litigation and/or requests from the U.S. or a state Government; (c) to enforce YAMA's Terms and EULA; (d) to protect YAMA's operations or those of any of YAMA's affiliates; (e) to protect YAMA's rights, privacy, safety or property, and/or that of YAMA's affiliates, me or others; and (f) to allow us to pursue available remedies or limit the damages that we may sustain.

To comply with YAMA's internal policies or legal proceedings in connection with investigations of any violations or suspected violations of YAMA's Terms and/or EULA; we reserve the right to use, release or otherwise share any usage logs or other records concerning me if me violate the Terms or EULA, or intentionally or unintentionally partake (or are reasonably suspected of partaking) in any illegal activity.

I am aware and I was informed that I have a right to ask YAMA to stop using or limit their use of me personal data in certain circumstances—for example, if YAMA has no lawful basis to keep using my data, or if I think my personal data is inaccurate. I may withdraw my consent by contacting YAMA at <legal@yamaindustrials.com> to do so. I agree that the withdrawal of consent does not affect the lawfulness of the processing activities up to the point it is confirmed by YAMA to have been withdrawn.

## Google Cloud Security and Compliance

#### Data processing amendment <a href="#data-processing-amendment" id="data-processing-amendment"></a>

Google takes a global approach to our commitments on data processing. Google and many of our customers operate in a global environment. G Suite offers a [Data Processing Amendment](https://gsuite.google.com/terms/dpa_terms.html) and EU Model Contract Clauses to facilitate compliance with jurisdictional-specific laws or regulations.&#x20;


# Forrester Zero Trust Model

Information/Systems/Network Security

Zero Trust, Zero Trust Network, or Zero Trust Architecture refer to security concepts and threat model that no longer assumes that actors, systems or services operating from within the security perimeter should be automatically trusted, and instead must verify anything and everything trying to connect to its systems before granting access. The term was coined by a security analyst at Forrester Research.

Zero Trust is a strategic initiative that helps prevent successful data breaches by eliminating the concept of trust from an organization’s network architecture. Rooted in the principle of “never trust, always verify,” Zero Trust is designed to protect modern digital environments by leveraging network segmentation, preventing lateral movement, providing Layer 7 threat prevention, and granular user-access control.


# GDPR

General Data Protection Regulation

**GDPR**

**Updated: 5/23/2018**

Passed in 2016, the new General Data Protection Regulation (GDPR) is the most significant legislative change in European data protection laws since the EU Data Protection Directive (Directive 95/46/EC), introduced in 1995. The GDPR, which becomes enforceable on May 25, 2018, seeks to strengthen the security and protection of personal data in the EU and serve as a single piece of legislation for all of the EU. It will replace the EU Data Protection Directive and all the local laws relating to it.

The data regulation law centers on two main principles. The first is that companies need your consent to collect your data. The second is that you should be required to share only data that is necessary to make their services work.

We support the GDPR and will ensure all Yama Industrials, Inc. services comply with its provisions by May 25, 2018. Not only is the GDPR an important step in protecting the fundamental right of privacy for European citizens, it also raises the bar for data protection, security, and compliance in the industry.

If you're visiting us from the EU, we are compliant with the General Data Protection Regulation (GDPR). We provide the same standard of security privacy protection to all our users around the world, regardless of their country of origin or location.

**Global privacy practices**

We store and process the information that we collect in the United States in accordance with this Privacy Statement (our subprocessors may store and process data outside the United States). However, we understand that we have users from different countries and regions with different privacy expectations, and we try to meet those needs even when the United States does not have the same privacy framework as other countries.

We provide the same standard of privacy protection — as described in this Privacy Statement — to all our users around the world, regardless of their country of origin or location, and provide the same levels of notice, choice, accountability, security, data integrity, access, and recourse.

## ZOHO COMPLIANCE

**GDPR** is a pan-European regulation that requires businesses to protect the personal data and privacy of EU citizens for processing of their personal data.

Zoho has always demonstrated its commitment to its user's data privacy by consistently exceeding industry standards. Zoho welcomes GDPR as a strengthening force of the privacy-consciousness that already exists in it.&#x20;

Zoho's offerings have privacy features that comply to GDPR, and Zoho's processing of its customer's data adheres to the data protection principles of the GDPR.&#x20;

**Applicable to:**\
Zoho Campaigns,Zoho CRM,Zoho Forms,Zoho Mail,Zoho SalesIQ,

Zoho Cliq,Zoho PageSense,Zoho Social,Zoho Motivator,

Zoho Projects,Zoho Writer,Zoho Desk,Zoho Assist,Zoho Recruit,

Zoho People,Zoho Creator,Zoho Analytics,Zoho Flow,

Zoho Vault,Zoho Finance Plus,Zoho Connect,

Zoho Survey,Zoho Sign

**TRUSTe Review** Zoho’s privacy policy, platform, website, and support portal have been reviewed by TRUSTe for compliance with their program requirements.&#x20;

Zoho Corporation is certified to be compliant with the EU-U.S. PRIVACY SHIELD FRAMEWORK and SWISS-U.S. PRIVACY SHIELD FRAMEWORK

## Google Cloud Security and Compliance

#### EU Data Protection Directive <a href="#eu-data-protection" id="eu-data-protection"></a>

The Article 29 Working Party is an independent European advisory body focused on data protection and privacy. They have provided guidance on how to meet European data privacy requirements when engaging with cloud computing providers. Google provides capabilities and contractual commitments created to meet data protection recommendations provided by the Article 29 Working Party.

#### EU model contract clauses <a href="#contract-clauses" id="contract-clauses"></a>

In 2010, the European Commission approved model contract clauses as a means of compliance with the requirements of the Directive. The effect of this decision is that by incorporating certain provisions into a contract, personal data can flow from those subject to the Directive to providers outside the EU or the European Economic Area. Google has a broad customer base in Europe. By adopting [EU model contract clauses](https://gsuite.google.com/terms/mcc_terms.html), we’re offering customers an additional option for compliance with the Directive.


# NIST 800-88 Rev. 1

Media Sanitization Procedures

NIST 800-88, published by the National Institute for Standards and Technology, is known for its media sanitization categories of Clear, Purge and Destroy. Its principles can apply to magnetic, flash-based, and other storage technologies. And, it can cover everything from mobile devices and USB drives to servers.

The latest update, NIST 800-88 Rev. 1, is one of the most widely used data sanitization standards requested or required by the U.S. Federal government, and its adoption has spread to countless private businesses and organizations with principles incorporated into international standard ISO/IEC 27040:2015

The goal is to effectively sanitize media so that any and all data is irretrievable once the data or data storage device reaches end-of-life. It's principles come into play whether a media asset is moving from a high level of confidential protection in one department to another, less secure department within the same organization, or whether that device is destined to leave the organization entirely.

![](https://1136562835-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LvaqXkK_uzANivJm2Lx%2F-Lyuf7Ehz4aiJC87WJ4R%2F-Lyuf_BFsJMS7EQJbQxj%2Fimage.png?alt=media\&token=234aa1d6-f30a-4fdf-b704-c9dee7f4d5d4)


# HIPAA

Health Insurance Portability and Accountability Act

### &#x20;HIPAA Business Associate Notice

### Our Role as Business Associate <a href="#our-role-as-business-associate" id="our-role-as-business-associate"></a>

Yama Industrials, Inc. acts as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) when providing services to covered entities and their business associates in the healthcare industry. We execute Business Associate Agreements (BAAs) with healthcare organizations that establish our contractual obligations to maintain HIPAA compliance standards.

Healthcare clients include but are not limited to: hospitals, medical clinics, mental health providers, developmental disability services organizations, insurance providers, healthcare clearinghouses, and other entities regulated under HIPAA.

### Protected Health Information Access <a href="#protected-health-information-access" id="protected-health-information-access"></a>

Yama Industrials, Inc. may access Protected Health Information (PHI) during the course of providing services to healthcare clients. Our technicians may encounter PHI during:

* IT infrastructure support and system administration
* Device and data migrations
* Cybersecurity related services
* System troubleshooting and technical support
* Compliance advisory services
* Cloud infrastructure support
* Network and communication system support

Such access is incidental to the performance of our contracted services and is limited to what is necessary to complete the work.

### Data Retention <a href="#data-retention" id="data-retention"></a>

Yama Industrials, Inc. does not store, host, or retain copies of client PHI on our servers or off-site infrastructure. Client PHI remains the responsibility and property of the client.

### Business Associate Agreements <a href="#business-associate-agreements" id="business-associate-agreements"></a>

Healthcare clients may execute a Business Associate Agreement (BAA) with Yama Industrials, Inc. to establish the specific terms, conditions, safeguards, and obligations applicable to the Business Associate relationship. The BAA addresses all HIPAA compliance requirements, permitted uses and disclosures, safeguard specifications, breach notification procedures, and other detailed terms.

Clients are responsible for determining whether a Business Associate Agreement is required for their engagement with Yama Industrials, Inc. based on the nature of services provided and applicable regulatory requirements.

### Contact for HIPAA Matters <a href="#contact-for-hipaa-matters" id="contact-for-hipaa-matters"></a>

For questions about our HIPAA Business Associate obligations, Business Associate Agreements, or other HIPAA-related matters, please contact:

Yama Industrials, Inc.\
800 Third Avenue #1292\
New York, NY 10022

Email: <info@yamaindustrials.com>


# PCI-DSS

Payment Card Industry Data Security Standard

The Payment Card Industry Data Security Standard is an information security standard for organizations that handle branded credit cards from the major card schemes. The PCI Standard is mandated by the card brands but administered by the Payment Card Industry Security Standards Council.

## SQUARE/ZOHO Payment Processor

## Privacy and Security

Square’s approach to security is designed to protect both merchants and their customers. Read about how we keep you and your information safe.

### Security at Square <a href="#security-at-square" id="security-at-square"></a>

To protect Square account holders and their customers, all information our customers submit is encrypted to our servers, regardless of whether you’re using a public or private WiFi connection or a data service on your phone (such as 3G, 4G or EDGE). Square complies with all required [PCI standards](https://www.pcisecuritystandards.org/). As per our [Terms](https://squareup.com/legal/ua), [Security Policy](https://squareup.com/security) and [Privacy Policy](https://squareup.com/legal/privacy), we will never sell information to third party vendors.

Square protects its systems with industry-leading technology and security controls, including:

* Square performs data encryption within the card reader at the moment of swipe.
* Square’s software is developed using industry-standard security best practices.
* Square’s servers are monitored around the clock by dedicated security staff.
* Square’s employees act in accordance with security policies designed to keep your data safe.

## ZOHO Payment Processor

### Compliance at Zoho

#### Certifications

**ISO/IEC 27001** is one of the most widely recognized independent international security standards. This certificate is awarded to organizations that comply with ISO's high global standards. Zoho has earned ISO/IEC 27001:2013 certification for Applications, Systems, People, Technology, and Processes

**Applicable to-** All cloud services and on-premise products of Zoho, ManageEngine,  Site24x7, WebNMS and GSP Solution

**ISO/IEC 27017** gives guidelines for information security controls applicable to the provision and use of cloud services by providing additional implementation guidance for relevant controls specified in ISO/IEC 27002 and additional controls with implementation guidance that specifically relate to cloud services.

Zoho is certified with ISO/IEC 27017:2015 - Information technology - Security techniques - Code of practice for information security controls based on ISO/IEC 27002 for cloud services.

**Applicable to-** All Cloud services of Zoho, Manage Engine and Site24x7 .

**ISO/IEC 27018** establishes commonly accepted control objectives, controls and guidelines for implementing measures on safeguarding the PII that is processed in a public cloud. These controls are an extension of ISO/IEC 27001 and ISO/IEC 27002, ISO/IEC 27018 which provide guidance to organizations concerned about how their cloud providers are handing personally identifiable information (PII).

**Applicable to-** All Cloud services of Zoho, Manage Engine and Site24x7.

Zoho is SOC 2 Type II compliant. SOC 2 is an evaluation of the design and operating effectiveness of controls that meet the AICPA's Trust Services Principles criteria.

**Applicable to-** All cloud services and on-premise products of Zoho, ManageEngine, Site24x7, WebNMS and GSP Solution

**Payment card industry (PCI)** compliance refers to the technical and operational standards that businesses must follow to ensure that credit card data provided by cardholders is protected. PCI compliance is enforced by the PCI Standards Council, to ensure that all businesses that store, process or transmit credit card data electronically do so in a secure manner that helps reduce the likelihood that cardholders would have sensitive financial data stolen.

Zoho, being PCI compliant, consistently adheres to a set of guidelines set forth by companies that issue credit cards.

**Applicable to-** All the Zoho finance Plus products (ie) Zoho Books,Zoho Invoice,Zoho Inventory, Zoho Subscription, Zoho Expense, Zoho Checkout and Zoho Commerce


# FIPS 140-2

Federal Information Processing Standard

The National Institute of Standards and Technology (NIST) issued the FIPS 140 Publication Series to coordinate the requirements and standards for cryptography modules that include both hardware and software components. Protection of a cryptographic module within a security system is necessary to maintain the confidentiality and integrity of the information protected by the module. This standard specifies the security requirements that will be satisfied by a cryptographic module. The standard provides four increasing qualitative levels of security intended to cover a wide range of potential applications and environments. The security requirements cover areas related to the secure design and implementation of a cryptographic module. These areas include cryptographic module specification; cryptographic module ports and interfaces; roles, services, and authentication; finite state model; physical security; operational environment; cryptographic key management; electromagnetic interference/electromagnetic compatibility (EMI/EMC); self-tests; design assurance; and mitigation of other attacks.\[3]

Federal agencies and departments can validate that the module in use is covered by an existing FIPS 140-1 or FIPS 140-2 certificate that specifies the exact module name, hardware, software, firmware, and/or applet version numbers. The cryptographic modules are produced by the private sector or open source communities for use by the U.S. government and other regulated industries (such as financial and health-care institutions) that collect, store, transfer, share and disseminate sensitive but unclassified (SBU) information. A commercial cryptographic module is also commonly referred to as a hardware security module (HSM).


# SANS

(SysAdmin, Audit, Network and Security)

## CIS Critical Security Controls: Guidelines

### Critical Controls for Effective Cyber Defense

To secure against cyber attacks, organizations must vigorously defend their networks and systems from a variety of internal and external threats. They must also be prepared to detect and thwart damaging follow-on attack activities inside a network that has already been compromised. Two guiding principles are: "Prevention is ideal but detection is a must" and "Offense informs defense."

### The Goal of the Critical Controls

The goal of the Critical Controls is to protect critical assets, infrastructure, and information by strengthening your organization's defensive posture through continuous, automated protection and monitoring of your sensitive information technology infrastructure to reduce compromises, minimize the need for recovery efforts, and lower associated costs.


# ISO 27001

(ISO/IEC 27001:2013)

ISO 27001 (ISO/IEC 27001:2013) is the international standard that provides the specification for an information security management system (ISMS). The Standard is designed to help organisations manage their information security processes in line with international best practices while optimising costs.

ISO/IEC 27001:2013 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of the organization. It also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization. The requirements set out in ISO/IEC 27001:2013 are generic and are intended to be applicable to all organizations, regardless of type, size or nature.

## ZOHO

### Compliance at Zoho

**ISO/IEC 27001** is one of the most widely recognized independent international security standards. This certificate is awarded to organizations that comply with ISO's high global standards. Zoho has earned ISO/IEC 27001:2013 certification for Applications, Systems, People, Technology, and Processes

**Applicable to-** All cloud services and on-premise products of Zoho, ManageEngine,  Site24x7, WebNMS and GSP Solution

Zoho is SOC 2 Type II compliant. SOC 2 is an evaluation of the design and operating effectiveness of controls that meet the AICPA's Trust Services Principles criteria.

**Applicable to-** All cloud services and on-premise products of Zoho, ManageEngine, Site24x7, WebNMS and GSP Solution

## Google Cloud Security and Compliance

&#x20;Google contractually commits to the following: Google will maintain adherence to ISO 27001, ISO 27018 and SOC 2/3 audits during the term of the agreement;

#### Google contractually commits to the following:

* Google will maintain adherence to ISO 27001 and SOC 2/3 audits during the term of the agreement.
* Defined Security Standards. Google will define how data is processed, stored, and protected through specific defined security standards.
* Access to our Data Privacy Officer. Customers may contact Google’s Data Privacy Officer for questions or comments.
* Data Portability. Administrators can export customer data in [standard formats](https://support.google.com/accounts/answer/3024190?rd=1) at any time during the term of the agreement. Google does not charge a fee for exporting data.


# Covid-19

Business Continuity

**On-Going Policy Updates**

This post provides an update on how YAMA Industrials, Inc is adapting to the outbreak of the coronavirus and how this might impact your interaction with us. We will continue to update this post, as the situation evolves.

Given the increasing global infection rates of the coronavirus (Covid-19), we have changed some of our work policies to first prioritize the safety of our employees, associates, their families, and all our customers and business associates.

**Working Remotely Policy**

As of March 10th, we have adopted Work Remotely as the default policy for our offices as a matter of precaution, although we have had no known cases of infection. We will retain this policy until the threat of the virus has passed, or has reduced substantially.

At this stage, we do not anticipate any change to YAMA services in any geographic region. Customers can expect to receive the same level of services as before. Should there be any changes due to unforeseen circumstances, please check back on this post for an update.

**Customer Support to Continue Uninterrupted**

Our (SDA/I) Software-Defined-Architecture, Infrastructure, Frameworks, and Automations were built with redundancy and resiliency in mind. All your usual channels to reach us — phone, web, and chat — will remain open.

We hope this virus will be contained soon and that life resumes normally for all of us. As always, we thank you all for your business with YAMA. Please stay safe and we wish you and your families the best.


# DEI

Diversity, Equity, and Inclusion

Commitment to diversity, equity, and inclusion

We value diversity of ideas and perspectives. We strive to include varied experiences and perspectives and encourage participation by all groups and individuals.

*We continue to strive to create an inclusive environment where diverse associates want to work and where they can flourish professionally. In furtherance of our culture, all qualified applicants will receive consideration for employment without regard to race, national origin, gender, age, religion, disability, sexual orientation, veteran status, marital status, or any other characteristics protected by law.*


# Worker Infrastructure Protection

Minimizing Attack Surface for Enhanced Security

We prioritize the security of our enterprise infrastructure and sensitive data. As part of our comprehensive security strategy and compliance with various industry standards, we have implemented measures to reduce our public infrastructure footprint, particularly concerning our staff's online presence.

Currently, we limit the publication of employee profiles to only our founding partners' or public-facing leadership profiles. This approach significantly reduces our attack surface, minimizing the risk of potential hacking attempts and data breaches.

By restricting the availability of personal information online, we effectively mitigate the threat of phishing attacks, which are a leading cause of corporate data breaches. Phishing attempts often target individual employees, exploiting their personal information to gain unauthorized access to company systems and data.

Our proactive stance on worker infrastructure protection demonstrates our commitment to maintaining the highest levels of security for our organization, our workers, and our clients. We continuously monitor and adapt our security practices to address emerging threats and ensure the confidentiality, integrity, and availability of our data and systems.

We appreciate your understanding and support as we work to create a secure and resilient environment for our operations.


# SVB

Silicon Valley Bank Statement

Dear Valued Clients,

Yama Industrials, Inc. and its divisions did NOT have any accounts with SVB and are subsequently not directly impacted. However, some of our vendor partners were impacted and we are watching carefully for any related fallout.

Yama Industrials, Inc. operates both its operations and infrastructure on a distributed risk management model to avoid this or any other black swan events to ensure continued operations for our clients.

We have in fact currently over 250+ vendors/partners to offer a wide berth of products & services with a  deep overlap to ensure continued smooth operations for both ourselves and our clients.

Thank You

Executive Management


# LLM's - Leadership on use of AI technology

Leveraging Digital Technology for Enhanced Productivity and Corporate Resilience

We recognize that the genesis of all groundbreaking ideas and concepts lies within our visionary corporate leadership. To further refine these ideas and optimize them for editorial use, we employ state-of-the-art digital technology processes, such as Large Language Models (LLMs) and other cutting-edge digital workspace tools. By harnessing the power of these technologies, we aim to maximize the productivity of all associates, team members, and partners through efficient time management and streamlined workflows.

This strategic approach is a testament to our unwavering commitment to staying at the forefront of today's rapidly evolving digital landscape. By continually leveraging our technology prowess, we ensure that our company remains both relevant and highly competitive in the face of ever-changing market dynamics.

As an organization, we are dedicated to the ongoing exploration and testing of the latest technologies and innovations. This proactive stance enables us to cement our position as industry leaders and empowers us to confidently navigate the challenges of the future while seizing emerging opportunities across all our associated companies and divisions.

Our leadership team is steadfast in its mission to instill corporate resilience throughout the organization, ensuring that we can effectively withstand market economic fluctuations. By fostering a culture of agility and adaptability, we are well-equipped to swiftly respond to future market evolutions, allowing us to maintain our competitive edge and drive sustainable growth.

Together, we will continue to embrace digital transformation, leverage cutting-edge technologies, and cultivate a resilient corporate spirit that will propel us to new heights of success in the years to come.


# The HUB

Yama's Infrastructure Tech Hub: Igniting Efficiency through Collaboration

Yama's Infrastructure Tech Hub is an internal collaborative ecosystem designed to streamline product spin-offs, startups, and concept development. By providing shared resources, such as pre-configured cloud infrastructure, Web 3 infrastructure, mentorship, and training, the Tech Hub enables teams to launch new ventures quickly and efficiently, reducing costs and time-to-market.

The Hub's collaborative environment encourages cross-pollination of ideas across departments, fostering innovation and the development of competitive solutions. With the Tech Hub, Yama Industrials can seamlessly integrate new acquisitions into its existing infrastructure, increasing the company's scale and diversifying its revenue and customer base through unified platform cost optimizations.

Key benefits of the Tech Hub include:

1. Faster time-to-market
2. Reduced costs
3. Enhanced innovation
4. Competitive advantage

By leveraging the Infrastructure Tech Hub, Yama Industrials is well-positioned to ignite efficiency, drive growth, and maintain its competitive edge in today's rapidly evolving market.


# Cybersecurity Advisory Services Policy

### Overview <a href="#overview" id="overview"></a>

**CYBERSECURITY ADVISORY SERVICES POLICY**

**Effective Date:** November 10, 2025

Yama Industrials, Inc. (including any associated divisions and/or subsidiaries) is committed to delivering professional cybersecurity guidance and advisory services informed by industry frameworks and best practices.

This policy delineates the exact scope of our services and explicitly states that **Yama Industrials does not act as, nor imply in any way the role of, the Chief Information Security Officer (CISO) or any related positions and/or titles** for our clients.

All engagements are governed by the Main Service Agreement and related policies available at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/).

***

### 1. Important Notice <a href="#id-1-important-notice" id="id-1-important-notice"></a>

There is no single process or technology that will make systems 100% secure. Ensuring robust cybersecurity requires ongoing multi-layered safeguards, keeping software/firmware up-to-date, employee training, security-conscious workflows, and risk management. Yama Industrials' advisory services are limited to professional guidance and recommendations; the client retains ultimate responsibility for implementing, maintaining, and monitoring all cybersecurity measures.

***

### 2. Scope of Yama Industrials' Services <a href="#id-2-scope-of-yama-industrials-services" id="id-2-scope-of-yama-industrials-services"></a>

Yama Industrials' responsibilities are strictly limited to the following:

* **Providing risk-based guidance and advisory services** on cybersecurity matters informed by industry frameworks and best practices
* **Conducting evaluations** of the client's cybersecurity requirements, risk tolerance, and current posture
* **Recommending appropriate and tailored cybersecurity solutions** based on the client's specific environment, risk profile, and operational constraints
* **Offering strategies** for the implementation of cybersecurity solutions that balance security objectives with business requirements
* **Assisting in implementation** of cybersecurity solutions as authorized and directed by the client

***

### 3. Implementation Assistance <a href="#id-3-implementation-assistance" id="id-3-implementation-assistance"></a>

Yama Industrials may assist in the implementation of cybersecurity solutions as requested. However, such assistance is provided under the client's approval, direction, and authorized supervision. **The client retains ultimate responsibility for the implementation, monitoring, and effectiveness of all cybersecurity measures.**

Yama Industrials shall not be liable for any damages arising from the deployment, configuration, or operation of cybersecurity measures except as provided in the Main Service Agreement Section 17 (Limitation of Liability).

***

### 4. Hands-On Engagement <a href="#id-4-hands-on-engagement" id="id-4-hands-on-engagement"></a>

When engaged to perform hands-on activities, Yama Industrials' team can engage in logistics, deployment, and configuration of cybersecurity measures based on the client's authorized specifications, risk tolerance, and operational requirements. **The client retains sole discretion to accept, modify, or reject any recommendations.** All such activities are subject to the Main Service Agreement.

### 4.1. Deviations from Standards and Frameworks

Yama Industrials provides recommendations informed by industry frameworks and best practices (such as NIST, CIS Controls, ISO 27001, etc.). However, the client retains ultimate authority to determine which controls, configurations, and practices are implemented.

Deviations from published standards and frameworks may be appropriate and acceptable based on the client's risk tolerance, operational requirements, budget constraints, business priorities, or specific environmental factors. Standards frameworks themselves include provisions for documented deviations that maintain equivalent or appropriate protection levels.

**Yama Industrials shall not be liable for the client's decisions to deviate from, modify, or reject any recommendations**, provided the client understands the risk implications of such decisions. The client is responsible for documenting its risk decisions and the business justification for any deviations from recommended practices.

***

### 5. What Yama Industrials Does NOT Provide <a href="#id-5-what-yama-industrials-does-not-provide" id="id-5-what-yama-industrials-does-not-provide"></a>

Yama Industrials does not:

* **Act as your CISO** or assume any CISO responsibilities or accountability
* **Guarantee or warrant** that recommended solutions will eliminate all security risks
* **Monitor or manage** your systems on an ongoing basis unless explicitly contracted for such support services
* **Assume liability** for the client's implementation decisions, risk acceptance decisions, or operational choices
* **Provide legal advice** regarding regulatory compliance (consult legal counsel for compliance matters)
* **Provide insurance** against data breaches or security incidents
* **Assume responsibility** for client decisions to deviate from recommended practices or industry standards
* **Monitor, verify, audit, or enforce** the client's compliance with laws, regulations, industry standards, or any recommendations

***

### 6. Client Acknowledgments <a href="#id-6-client-acknowledgments" id="id-6-client-acknowledgments"></a>

The client acknowledges and agrees that:

* Yama Industrials' services are **advisory in nature only**
* The client retains **sole and ultimate responsibility** for all cybersecurity decisions, implementations, operations, and compliance
* The client is independently responsible for compliance with all applicable laws, regulations, and industry requirements
* Yama Industrials has **no obligation to monitor, verify, audit, or enforce** the client's cybersecurity practices, compliance obligations, or implementation of any recommendations

All contractual obligations related to services are governed by the Main Service Agreement and related policies published at [www.resources.yamaindustrials.com](http://www.resources.yamaindustrials.com/).

***

### 7. Service Engagement and Deliverables <a href="#id-7-service-engagement-and-deliverables" id="id-7-service-engagement-and-deliverables"></a>

Specific service deliverables, scope, timelines, and terms of engagement are defined solely in the applicable Order Form or Statement of Work. This policy does not enumerate or guarantee any specific deliverables. All advisory services are subject to the Main Service Agreement and related policies.

***

### 8. Governing Terms <a href="#id-8-governing-terms" id="id-8-governing-terms"></a>

All terms, conditions, obligations, fees, payment, termination, limitation of liability, indemnification, dispute resolution, and governing law related to Cybersecurity Advisory Services engagements are governed by the **Main Service Agreement and related policies published at** [**www.resources.yamaindustrials.com**](http://www.resources.yamaindustrials.com/).

This policy addresses only the scope and nature of Yama Industrials' advisory services.

### Contact Information <a href="#contact-information" id="contact-information"></a>

For questions about this policy or Cybersecurity Advisory Services, please contact:

**Yama Industrials, Inc.**\
800 Third Avenue #1292\
New York, NY 10022\
Email: <info@yamaindustrials.com>

© 2025 Yama Industrials, Inc. All rights reserved.


# End-of-Life (EOL) Policy

Effective Date: July 29, 2026 Last Updated: July 29, 2026 Policy Owner: Yama Industrials, Inc. ("Yama")

This End-of-Life (EOL) Policy ("Policy") is published by Yama Industrials, Inc. ("Yama") at resources.yamaindustrials.com. This Policy is incorporated by reference into the Main Service Agreement ("MSA" or "Agreement") between Yama and Customer pursuant to MSA Section 1.2, and governs Yama's standards for supporting, recommending, configuring, and maintaining certain categories of network hardware in connection with the Services.

Customer is responsible for reviewing the then-current MSA and incorporated Yama policies as provided in the MSA. A reference to, or link to, Yama's designated terms or resources domain in an invoice, estimate, proposal, ticket, renewal, or other Customer-facing documentation provides notice in accordance with MSA Section 1.3 and may identify this Policy as an incorporated policy under MSA Section 1.2. This Policy applies to Customer accounts and hardware deployments only to the extent, and at the time, permitted by the MSA, including MSA Sections 1.4 and 20.2, and any applicable signed Order Form or SOW.

***

#### Defined Term

"EOL-Classified" means hardware that Yama has designated under this Policy as ineligible for one or more specified activities, including recommendation, sale, configuration, deployment, or managed-support offerings. An EOL classification is an internal Yama support determination only. It does not, by itself, represent, adopt, or correspond to any manufacturer's end-of-sale, end-of-support, end-of-life, security, warranty, or regulatory-compliance designation. A product may be EOL-Classified under this Policy while still receiving active support from its original manufacturer, and vice versa.

#### Overview

Yama maintains this Policy to identify hardware categories that Yama has determined, in its reasonable operational judgment, present a risk profile Yama has determined is incompatible with its then-current support standards for compliance-sensitive deployments, or that Yama has otherwise determined are no longer suitable for new sale, configuration, or managed-support commitment due to manufacturer end-of-life status or insufficient on-device storage or compute resources. This Policy is maintained on an ongoing basis, and Yama reserves the right to add, remove, or reclassify hardware categories in accordance with the Notice and Amendment provisions below.

This Policy currently addresses two hardware categories:

1. Ubiquiti UniFi Network Gateway Hardware
2. Arista Edge Threat Management (Untangle) Appliance Hardware

***

#### Part 1: Ubiquiti UniFi Network Gateway Hardware

**1.1 Scope**

This Part applies to all Customer Equipment and Yama Equipment consisting of Ubiquiti UniFi Cloud Gateway devices, Dream Machine devices, and related gateway hardware, whether procured through Yama, brokered by Yama under MSA Article 21 (Brokered and Resold Third-Party Services), or independently owned by Customer.

**1.2 Rationale**

Yama has determined that:

* The frequency and severity of cybersecurity threats affecting network perimeter devices has materially increased year over year, including ransomware, zero-day exploitation, and regulatory scrutiny under frameworks such as CJIS, HIPAA, and comparable state and municipal compliance regimes.
* Adequate on-device log retention (flow logs, IDS/IPS events, and audit trails) is a baseline requirement for Customer's ability to detect, investigate, and respond to security incidents, and to satisfy Customer's own regulatory or contractual compliance obligations.
* Certain Ubiquiti hardware tiers lack expandable on-device storage sufficient to support durable log retention, relying instead on fixed onboard flash memory and system RAM, which materially limits retention windows.
* This approach is consistent with prevailing industry practice, including manufacturer-driven end-of-support decisions for legacy consumer and prosumer hardware based on evolving security and technology standards.

**1.3 Hardware Classification**

| Tier          | Representative Models                                                               | Storage Configuration                        | Classification                                                                                                                        |
| ------------- | ----------------------------------------------------------------------------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| Below Ultra   | USG, UDR, legacy Dream Machine (non-Pro), UniFi Express                             | Fixed onboard flash (4–16 GB), no expansion  | EOL-Classified — Not Recommended for Compliance-Sensitive Deployments                                                                 |
| Ultra         | UniFi Cloud Gateway Ultra, Cloud Gateway Fiber (base)                               | 16 GB fixed eMMC, 3 GB RAM, no expansion bay | EOL-Classified — Not Recommended for Compliance-Sensitive Deployments                                                                 |
| Max and Above | Cloud Gateway Max, Cloud Gateway Fiber (SSD-equipped), UDM Pro, UDM SE, UDM Pro Max | Selectable NVMe SSD (0–2 TB) or HDD bay      | Eligible for Consideration for Yama's Compliance-Oriented Support Offerings, Subject to Storage Being Populated and Section 1.4 Below |

\ <br>

Max-tier and above devices configured with the "No Storage" option are functionally equivalent to Ultra-tier devices for log retention purposes and are EOL-Classified under this Policy until storage is installed.

**1.4 Effect of Classification**

* Yama will not recommend, sell, configure, or renew compliance-tier support commitments for EOL-Classified hardware identified in Section 1.3, effective as of the Effective Date of this Policy, applicable to all Customer accounts and hardware deployments to the extent and at the time permitted by MSA Sections 1.4 and 20.2, regardless of when the hardware was originally deployed or when the account was established.
* Yama may, in its sole discretion, continue to provide Ad-Hoc Services with respect to EOL-Classified hardware on a time-and-materials basis, subject to MSA Article 4 and MSA Section 3.6.
* A designation of hardware as "Eligible for Consideration" under Section 1.3 reflects Yama's then-current operational assessment only. It is not a warranty, certification, legal opinion, or representation that any hardware, configuration, Customer environment, or Service satisfies CJIS, HIPAA, or any other legal, regulatory, contractual, insurance, or cybersecurity requirement.
* Nothing in this Part limits or expands Yama's right to modify, suspend, or discontinue any Service or Product, in accordance with the MSA, including MSA Sections 1.6, 3.6, 5.5, and 8.12, and MSA Article 12.

***

#### Part 2: Arista Edge Threat Management (Untangle) Appliance Hardware

**2.1 Scope**

This Part applies to all Customer Equipment and Yama Equipment consisting of legacy Untangle-branded Q-Series appliances (Q4, Q8, Q8W, Q12, Q20) and successor Arista Edge Threat Management ("ETM") appliance hardware, whether procured through Yama, brokered by Yama under MSA Article 21, or independently owned by Customer.

**2.2 Rationale**

Yama has determined that:

* Arista Networks, Inc. ("Arista"), the current owner of the Untangle NG Firewall product line, publicly announced end-of-sale of the ETM NG Firewall Q4, Q8, Q8W, Q12, and Q20 appliances on March 10, 2026, with the last day to order the affected products being June 30, 2026 (subject to availability). Per Arista's published End-of-Life Milestones, the last date for hardware RMA requests and the manufacturer end-of-life date for these devices are both June 30, 2029.
* Arista's published migration guidance designates the following Arista VeloCloud Edge OS appliances as the corresponding replacement products: the 710 Series for the Q4, the 720 Series for the Q8 and Q8W, the 740 Series for the Q12, and the 4100 Series for the Q20.
* Arista's published migration guidance also identifies a software or virtual appliance edition of ETM NG Firewall as an alternative migration path for affected customers.
* Where Customer elects a software-only NG Firewall deployment, the underlying bare-metal or virtualization host may be sourced either (a) by Customer, from any reputable, commercially supported third-party hardware vendor, or (b) by Yama, under an active Yama support subscription, as further described in Section 2.4 below.
* Continued reliance on hardware beyond its manufacturer-supported RMA and end-of-life dates presents a risk profile Yama has determined is incompatible with its then-current support standards for compliance-sensitive deployments.

**2.3 Hardware Classification**

| Category                                                       | Hardware/Product                                                                                                       | Manufacturer Status                                                                                                          | Classification                                                                                                                                                                                                         |
| -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Legacy Untangle Q-Series                                       | Q4, Q8, Q8W, Q12, Q20                                                                                                  | End-of-sale announced March 10, 2026; last order June 30, 2026; hardware RMA and manufacturer end-of-life both June 30, 2029 | EOL-Classified — Migration Required for Continued Eligibility for Compliance-Tier Support                                                                                                                              |
| NG Firewall Software Edition (VM)                              | Software-only / virtual appliance deployment                                                                           | Actively sold by Arista                                                                                                      | Eligible for Consideration — Bare-Metal/Hypervisor Sourced per Section 2.4                                                                                                                                             |
| Arista VeloCloud Edge Hardware                                 | 710 (replaces Q4) / 720 (replaces Q8, Q8W) / 740 (replaces Q12) / 4100 (replaces Q20)                                  | Actively sold by Arista; manufacturer-designated replacement line for the Q-Series                                           | Eligible for Consideration for Yama's Offerings — Arista-Designated, Manufacturer-Recommended Migration Path, Subject to Customer Requirements, Licensing, Compatibility, and a Signed Order Form or Statement of Work |
| Third-Party General-Purpose Server Hardware (Customer-Sourced) | Dell (e.g., PowerEdge), HP/HPE (e.g., ProLiant), or equivalent enterprise-grade server hardware                        | Actively sold and supported by respective OEM                                                                                | Eligible for Consideration — Approved Customer-Sourced Bare-Metal/Hypervisor Host, Subject to Section 2.4                                                                                                              |
| Third-Party Dedicated Appliance Hardware (Customer-Sourced)    | LogicSupply, Protectli, or other comparable reputable network-appliance hardware manufacturer                          | Actively sold and supported by respective OEM                                                                                | Eligible for Consideration — Approved Customer-Sourced Bare-Metal Host, Subject to Section 2.4                                                                                                                         |
| Yama-Selected Hardware (Under Active Support Subscription)     | Any hardware selected, specified, procured, or supplied by Yama at its discretion for the specific Customer engagement | Determined by Yama on a per-engagement basis                                                                                 | Eligible for Consideration — Governed by Applicable Order Form/SOW, Subject to Section 2.4                                                                                                                             |

\ <br>

Approval of any third-party hardware vendor not expressly listed above (including future additions to this Policy) is subject to Yama's sole discretion and will be evaluated against the same minimum specification and support-availability criteria applied to the vendors listed herein.

**2.4 Effect of Classification and Hardware Sourcing**

* Yama will not recommend, sell, configure, or renew compliance-tier or managed support commitments for legacy Untangle Q-Series hardware identified in Section 2.3, effective as of the Effective Date of this Policy, applicable to all Customer accounts and hardware deployments to the extent and at the time permitted by MSA Sections 1.4 and 20.2, regardless of when the hardware was originally deployed or when the account was established.
* Yama may, in its sole discretion, continue to provide Ad-Hoc Services with respect to EOL-Classified Untangle hardware on a time-and-materials basis, subject to availability of manufacturer support, MSA Article 4, and MSA Section 3.6.
* Customer-Sourced Hardware. Where Customer elects a software-only/virtual NG Firewall deployment on Customer-selected third-party bare-metal hardware, Customer is solely responsible for procuring, sizing, securing, patching, and maintaining the underlying hardware and hypervisor infrastructure, including all manufacturer warranty and support arrangements with the applicable third-party vendor, except to the extent expressly and separately assumed by Yama in a signed Order Form or Statement of Work. This allocation is consistent with MSA Section 11 and MSA Article 21, as applicable.
* Yama-Selected Hardware. Where Customer maintains an active Yama support subscription, Yama may, in its sole discretion and as part of the scoped engagement, select, specify, procure, and/or supply the bare-metal or appliance hardware on Customer's behalf, documented in the applicable Order Form or Statement of Work. The scope of Yama's responsibility for sizing, configuration, warranty coordination, and ongoing maintenance of such hardware shall not exceed what is expressly set forth in that Order Form or SOW, and remains governed by MSA Article 14 and MSA Article 21.
* No Compliance Determination. A designation of hardware as "Eligible for Consideration," "Supported," or similar under Section 2.3, whether Customer-sourced, Yama-selected, or manufacturer-designated, reflects Yama's then-current operational assessment of general compatibility and industry reputation, or Yama's own procurement determination, only. It is not a warranty, certification, legal opinion, or representation that any hardware, configuration, Customer environment, or Service satisfies CJIS, HIPAA, or any other legal, regulatory, contractual, insurance, or cybersecurity requirement.
* Ownership and Equipment Status. Hardware selected, procured, furnished, deployed, leased, rented, or otherwise supplied by Yama shall constitute Yama Equipment unless expressly identified as sold to Customer in a signed Order Form. All Yama Equipment remains subject to MSA Article 7, including the applicable access, return, recovery, replacement-value, and continuing-charge provisions. No reference in this Policy to Yama-selected or Yama-supplied hardware conveys title, ownership, or rights beyond those expressly stated in the applicable signed Order Form.
* Nothing in this Part limits or expands Yama's right to modify, suspend, or discontinue any Service or Product, in accordance with the MSA, including MSA Sections 1.6, 3.6, 5.5, and 8.12, and MSA Article 12.

***

#### 3. General Provisions (Applicable to Both Parts)

**3.1 No Duty to Monitor Customer Hardware**

Nothing in this Policy expands Yama's obligations beyond those set forth in MSA Section 11. Yama has no duty to monitor, audit, or inventory Customer's deployed hardware for EOL-Classified status absent an express, separately scoped engagement to do so. Customer remains responsible for the security, configuration, and compliance of its own environment, except to the limited extent Yama expressly assumes a specific responsibility in a signed Order Form or Statement of Work.

**3.2 Effect on Ad-Hoc and Suspended Accounts**

This Policy applies equally to Customers under active subscription-based Services and Customers under Ad-Hoc Support Status or suspension pursuant to MSA Sections 3.5, 3.6, and 8.12, and to hardware deployed before, on, or after the Effective Date of this Policy, subject in all respects to MSA Section 20.2. Publication of this Policy at resources.yamaindustrials.com constitutes sufficient notice to all Customers regardless of account status. Yama may, as a courtesy and in its sole discretion, provide additional direct notice to Customers with active subscription-based Services; such courtesy notice does not create an ongoing obligation to provide further notice and does not expand the scope of any Services.

**3.3 Reinstatement of Suspended or Ad-Hoc Accounts**

Where a Customer account is suspended or held in Ad-Hoc Support Status and seeks reinstatement of subscription-based Services, Yama may, as a condition of reinstatement, require a hardware compliance review against this Policy and may condition continued or renewed support on either (a) Customer's migration away from EOL-Classified hardware, or (b) a written acknowledgment, in a form approved by Yama and executed by Customer's authorized representative, of the EOL-Classified status, the associated limitations and risks (known and unknown), and any resulting limitations on Yama's support obligations.

**3.4 No Warranty; Reliance Limits**

This Policy is a statement of Yama's internal support standards. Except as expressly stated in a signed Order Form or Statement of Work, Customer shall not construe this Policy, including any hardware classification, recommendation, or designation contained herein, as a representation, warranty, certification, or guarantee of regulatory compliance, security, fitness for a particular purpose, or uninterrupted availability.

**3.5 Errors, Omissions, and Corrections**

This Policy is intended to reflect Yama's good-faith operational standards and publicly available third-party manufacturer information as of the date of publication or most recent revision. Any factual error, omission, outdated citation, typographical error, or inaccurate third-party reference contained in this Policy (including any manufacturer date, model designation, or specification) shall be construed, to the maximum extent possible, in a manner consistent with the express text of this Policy, the defined terms set forth herein, and the order of precedence established by MSA Section 1.4, and shall not, by itself, render any classification, condition, or requirement of this Policy void, unenforceable, or a basis for a claim of detrimental reliance against Yama. Yama may correct any clerical, typographical, formatting, or objectively verifiable factual error by publishing a revised version of this Policy at any time. Any such non-substantive correction shall relate back solely to clarify the original text and shall not be construed as a substantive amendment. Any substantive change to a classification, condition, requirement, or Customer obligation shall be governed by Section 4 and MSA Section 20.2.

**3.6 No Waiver; Severability**

No failure or delay by Yama in enforcing any provision of this Policy shall constitute a waiver of that provision or of Yama's right to enforce it at a later time. If any provision of this Policy is held invalid, illegal, or unenforceable in any respect, such provision shall be enforced to the maximum extent permitted, and the remaining provisions shall remain in full force and effect, construed so as to give maximum effect to the express text of this Policy and the remaining provisions hereof.

**3.7 Order of Precedence**

This Policy is an incorporated Yama policy for purposes of MSA Section 1.2. In the event of any conflict among the documents comprising the Agreement, including this Policy, the order of precedence set forth in MSA Section 1.4 shall govern. For the avoidance of doubt, neither an Order Form nor a Statement of Work supersedes this Policy or the MSA unless such document is later in time and expressly overrides the specific conflicting provision in a writing signed by an authorized officer of Yama.

***

#### 4. Notice; Amendments

Publication of this Policy at resources.yamaindustrials.com, together with a reference to or link to Yama's designated terms or resources domain in Customer-facing documentation, provides notice in accordance with MSA Section 1.3 and identifies this Policy as an incorporated Yama policy under MSA Section 1.2. Yama may amend, expand, revise, add to, remove from, or reclassify hardware categories or approved third-party vendors under this Policy at any time by publishing a revised version at resources.yamaindustrials.com, with a revised "Last Updated" date and, where applicable, a distinct Effective Date. Any amendment to this Policy shall be effective and applied in accordance with MSA Section 20.2. Unless otherwise expressly permitted by the MSA or an applicable signed Order Form, a revised Policy applies prospectively to new Orders, renewals, reinstatements, Ad-Hoc Services, and Services commencing after expiration or termination of a prior committed term, and shall not alter a non-waivable commitment expressly stated in a signed Order Form during its then-current committed term. A changelog of material revisions, including the effective date and scope of each version, is maintained below.

**Changelog**

| Version Date  | Effective Date | Change                                                                         | Application                                                                                                                                               |
| ------------- | -------------- | ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| July 29, 2026 | July 29, 2026  | Initial publication of EOL Policy, Parts 1 (Ubiquiti) and 2 (Arista/Untangle). | Customer accounts and hardware deployments, existing and future, to the extent and at the time permitted by the MSA, including MSA Sections 1.4 and 20.2. |

\ <br>

***

*This Policy is a Yama-published policy incorporated by reference into the Main Service Agreement pursuant to MSA Section 1.2. In the event of any conflict between this Policy and the Main Service Agreement, the order of precedence set forth in MSA Section 1.4 controls.*

\ <br>

\ <br>