Mutual Non-Disclosure and Org Access Agreement

Parties

This Revecast Assess Mutual Non-Disclosure and Org Access Agreement (the “Agreement”) is entered into as of the Effective Date (defined in Section 1) by and between:

Revecast, Inc., a corporation with its principal place of business at 707 W Main Avenue, Suite B1, Spokane, WA 99201 (“Revecast”); and

the organization identified as the customer in the Revecast Assess request form or in the signature block below (“Customer”).

Revecast and Customer are each a “Party” and together the “Parties.” With respect to any Confidential Information, the Party disclosing it is the “Disclosing Party” and the Party receiving it is the “Receiving Party.”

1. Acceptance and Effective Date

1.1 How this Agreement is accepted. Customer accepts this Agreement either (a) by submitting the Revecast Assess request form with the option “I accept the Revecast NDA” selected, or (b) by signing it. The “Effective Date” is the date of that submission or of the last signature, whichever occurs first.

1.2 Authority. The individual who accepts or signs this Agreement on Customer’s behalf represents that they are authorized to bind Customer to it and to grant the access described in Section 5, or that they have the approval of someone who is.

1.3 Customer’s own NDA. If Customer asks to use its own non-disclosure agreement instead, Revecast will not sign in to Customer’s Salesforce org until that agreement is signed by both Parties. Unless the Parties agree otherwise in writing, Sections 4 through 8 of this Agreement apply as an addendum to Customer’s agreement, and Customer’s agreement controls if the two conflict on confidentiality.

2. Purpose

Revecast will perform a no-cost assessment of Customer’s Salesforce org using Revecast Orchestrate, review the results with Customer on a call, and deliver the resulting assessment documents (together, the “Assessment”). In connection with the Assessment, and with discussing any follow-on work, each Party may disclose Confidential Information to the other (together, the “Purpose”). This Agreement protects that information and sets the terms of Revecast’s access to Customer’s org.

3. Confidential Information

3.1 Definition. “Confidential Information” means any non-public information that a Disclosing Party discloses to a Receiving Party, whether orally, in writing, electronically or by any other means, that is designated as confidential or that reasonably should be understood to be confidential given its nature and the circumstances of disclosure. Confidential Information includes, without limitation:

1. business plans, strategies, forecasts and financial information;

2. technical data, trade secrets, know-how, software, system architecture, product plans and services;

3. customer, constituent, student, patient, donor, vendor and personnel information;

4. pricing, proposals, bids and cost structures;

5. the configuration and metadata of Customer’s Salesforce org, including its objects, fields, automation, code, security settings, installed packages and integrations;

6. credentials, usernames, passwords, security tokens and other access details;

7. any Customer Data (defined in Section 4) that Revecast encounters;

8. Revecast Orchestrate, and Revecast’s assessment methods, tools, templates and frameworks; and

9. any other information marked “Confidential” or that would reasonably be understood to be confidential.

3.2 Exclusions. Confidential Information does not include information that (i) is or becomes publicly known through no breach of this Agreement; (ii) was rightfully known by the Receiving Party before disclosure, as shown by written records; (iii) is rightfully obtained from a third party without a restriction on disclosure; or (iv) is independently developed by the Receiving Party without use of or reference to the Disclosing Party’s Confidential Information. Exclusions (ii) through (iv) do not apply to Customer Data.

3.3 Obligations. Each Party, as Receiving Party, will:

1. hold the Disclosing Party’s Confidential Information in strict confidence, using at least the degree of care it uses to protect its own confidential information of a similar nature, and never less than reasonable care;

2. not disclose it to any third party without the Disclosing Party’s prior written consent, except as this Agreement allows;

3. use it solely for the Purpose;

4. limit access to its employees, contractors and agents who need it for the Purpose and who are bound by confidentiality obligations at least as protective as these, and remain responsible for their compliance; and

5. promptly notify the Disclosing Party on discovering any unauthorized use or disclosure.

4. Customer Data

4.1 Definition and ownership. “Customer Data” means the contents of the records stored in Customer’s Salesforce org, such as contact, account, case, opportunity, student, patient, donor and financial records, and the values stored in their fields, together with any attachments and files. As between the Parties, Customer owns all Customer Data.

4.2 Configuration, not records. The Assessment analyzes how Customer’s org is configured. It does not require Customer Data. Revecast will not export, copy, download or retain Customer Data, and will not use it for any purpose other than the Purpose.

4.3 Incidental exposure. Because the temporary user described in Section 5 can see what its profile allows, Customer Data may be visible to Revecast while it works in the org, or may appear inside configuration the Assessment reads (for example, a default value or a record name in a report filter). Any Customer Data Revecast encounters is Customer’s Confidential Information, and Revecast will not keep any of it in the Assessment documents beyond what is needed to describe a configuration finding. Customer may instead give Revecast access to a sandbox that does not contain production data.

4.4 AI processing. Revecast Orchestrate uses artificial-intelligence functionality, which may include a third-party AI provider, to process the org configuration it reads. Revecast will use such providers only under confidentiality and data-protection obligations at least as protective as those in this Agreement.

5. Org Access and Installation of Revecast Orchestrate

5.1 Temporary user. Customer authorizes Revecast to sign in to the Salesforce org Customer chooses (a production org or a sandbox) using a temporary user that Customer creates with the email address assess@revecast.io. Customer chooses the user’s license, profile and permissions. Installing the Revecast Orchestrate connector requires a System Administrator profile, or equivalent permissions to install packages and authorize connected apps.

5.2 Installation and authorization. Customer authorizes Revecast, using that user, to (a) install the Revecast Orchestrate connector package, including its connected app, in the org; and (b) authorize the connector so that Revecast Orchestrate can read the org’s configuration for the Assessment.

5.3 What Revecast may do. Using the temporary user and the connector, Revecast may only (a) read the org’s configuration and metadata; (b) read usage and license information shown in Setup; and (c) generate the Assessment.

5.4 What Revecast will not do. Apart from Section 5.2, Revecast will not, without Customer’s further written approval (email is enough): (a) create, change or delete any configuration, code, user, permission or record in the org; (b) export, copy or download Customer Data; (c) create other users, change the temporary user’s permissions, or grant anyone else access; (d) install any other package or connect any other application; or (e) use the access for any purpose other than the Purpose.

5.5 Credential security. Revecast will keep the temporary user’s credentials confidential and limit them to the personnel performing the Assessment. Revecast will use multi-factor authentication whenever the org requires or supports it, and will not share the credentials with anyone, including any AI provider.

5.6 Ending access. Customer may deactivate the temporary user, uninstall the connector or revoke its authorization at any time, and Revecast’s access ends at once. Within five (5) business days after the results call, or sooner if Customer asks, Revecast will tell Customer in writing that it has finished. Customer should then deactivate the temporary user and may uninstall the connector. Revecast will stop using the access when it notifies Customer and, within thirty (30) days, will delete or destroy any connection tokens it holds for the org.

5.7 Customer responsibilities. Customer remains responsible for the security of its own org, including creating and deactivating the temporary user, choosing its permissions, and complying with its own policies and any licensing terms that apply to adding a user.

6. Security Incidents

Each Party will notify the other without undue delay, and in any case within seventy-two (72) hours, after confirming any unauthorized access to or use or disclosure of the other Party’s Confidential Information in its possession or control, including any misuse of the temporary user’s credentials. The notifying Party will share the information reasonably available to it about the incident and the steps it is taking to remediate it.

7. Revecast Personnel and Salesforce Account Team

7.1 Revecast personnel. Revecast may share Customer’s Confidential Information only with its employees and contractors who need it to perform the Assessment and the results call, as allowed by Section 3.3(d). Each of them is bound by confidentiality obligations at least as protective as these, and Revecast is responsible for their compliance with this Agreement.

7.2 Salesforce account team. If Customer was referred by its Salesforce account executive, Customer agrees that Revecast may tell that account executive that the Assessment is under way, and may invite them to the results call. Revecast will share the Assessment documents or other Customer Confidential Information with Salesforce only with Customer’s consent, which Customer may give or withhold by email or on the results call.

8. The Assessment and Its Results

8.1 No cost, no obligation. The Assessment is provided at no cost. Neither Party is obligated to enter into any further agreement, engagement or transaction, and either Party may end discussions at any time without liability.

8.2 Use of the results. Revecast delivers the Assessment documents to Customer after the results call. Customer may use them for its own business purposes, including sharing them with its other service providers, with Revecast or without it.

8.3 Ownership. Revecast keeps all rights in Revecast Orchestrate and in its methods, tools, templates and frameworks, including those used to produce the Assessment. Nothing in the Assessment documents transfers any of those rights to Customer.

8.4 AI-assisted analysis. The Assessment includes analysis generated with artificial intelligence, which a Revecast architect reviews before it is delivered. The Assessment is provided “AS IS” for planning purposes, is not a guarantee of any outcome, and Customer is responsible for reviewing and validating it before relying on it.

9. Term and Survival

This Agreement starts on the Effective Date and lasts two (2) years, unless either Party ends it earlier with thirty (30) days’ prior written notice. If it ends, Section 5.6 still applies until Revecast’s access has ended and its connection tokens are deleted. The obligations of confidentiality for Confidential Information disclosed during the term survive the end of this Agreement in perpetuity.

10. Compelled Disclosure

If the law, a regulation or a court order compels a Receiving Party to disclose any Confidential Information, it will, to the extent legally permitted, give the Disclosing Party prompt written notice so that the Disclosing Party may seek a protective order or other remedy. If no such remedy is obtained, the Receiving Party will disclose only the portion that is legally required and will use reasonable efforts to obtain confidential treatment for it.

11. Return or Destruction

On the Disclosing Party’s written request, or when this Agreement ends, the Receiving Party will promptly return or destroy all materials containing the Disclosing Party’s Confidential Information, including copies, summaries and extracts, and will confirm that in writing on request. The Receiving Party may keep (a) copies the law requires it to keep, and (b) copies in routine electronic backup or archival systems, as long as they stay subject to this Agreement for as long as they are kept. Customer may keep the Assessment documents.

12. No License; No Publicity

Nothing in this Agreement grants either Party any license, right, title or interest in the other Party’s Confidential Information, intellectual property or other proprietary rights. Neither Party may use the other’s name, trademarks or logos, or announce that the Assessment took place, without the other Party’s prior written consent.

13. No Warranty

Except as expressly stated in this Agreement, all Confidential Information is provided “AS IS,” and neither Party makes any warranty about its accuracy or completeness.

14. Remedies

Each Party acknowledges that a breach of this Agreement may cause irreparable harm for which money damages would not be an adequate remedy. In addition to any other remedy available at law or in equity, the Disclosing Party may seek equitable relief, including an injunction and specific performance, without posting a bond or proving actual damages.

15. General Provisions

1. Governing law and venue. This Agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-law principles. The state and federal courts located in Delaware have exclusive jurisdiction over any action arising out of this Agreement, except that either Party may seek injunctive relief in any court of competent jurisdiction to protect its Confidential Information.

2. Entire agreement. This Agreement is the entire agreement between the Parties about its subject matter and supersedes all prior discussions about it. If the Parties later sign a master services agreement or similar agreement, that agreement controls for the work it covers.

3. Amendment and waiver. This Agreement may be amended only in a writing signed by authorized representatives of both Parties. A waiver is effective only in writing, and failing to enforce a provision is not a waiver of the right to enforce it later.

4. Severability. If any provision is found invalid or unenforceable, the rest of this Agreement stays in full force and effect.

5. Assignment. Neither Party may assign this Agreement without the other’s prior written consent, except to a successor in a merger, acquisition or sale of substantially all of its assets.

6. Notices. Notices under this Agreement must be in writing. Email is sufficient. Notices to Revecast go to assess@revecast.io, and notices to Customer go to the email address in the request form or signature block.

7. Independent contractors. The Parties are independent contractors. This Agreement does not create a partnership, joint venture, agency or employment relationship.

8. Electronic acceptance and counterparts. Acceptance through the Revecast Assess request form, electronic signatures and signatures in counterparts are each valid and binding, and each counterpart is an original.

16. Signatures

Customers who prefer a signed copy may sign below and email it to assess@revecast.io. Signing is optional for Customers who accept this Agreement through the Revecast Assess request form.

IN WITNESS WHEREOF, the Parties have executed this Agreement as of the Effective Date.