Master Services Agreement

Platform means the shared Limestone infrastructure used for identity, tenancy, hosting, monitoring, backup, security operations, and support. Module means a discrete Limestone application identified in a Service Order. Products are the Platform and ordered Modules. Products, documentation, implementation, and support are the Service. Authorized Users are Customer personnel and contractors approved to use the Service. Service Order means an ordering document that references this Agreement and states the purchased Products, scope, users, fees, and term, including an Invoice and Service Authorization, Quote, or Statement of Work. A Service Order is executed when Customer either (a) signs it, including by electronic signature, or (b) approves it in writing by email from an authorized representative of Customer that identifies the Service Order by number or date. Provider’s issuance of the Service Order constitutes Provider’s execution.

A Licensed User is a named Authorized User authorized to access a Module under a paid seat in a Service Order. Licensed Users typically perform work within a Module, including resolving, administering, configuring, approving, or reporting. Licensed User seats are counted per Module and are the licensed unit. A Participant is an Authorized User who submits requests, supplies information, takes part in a process, and views the status and records of the Participant's own submissions. Participant access is unlimited and carries no seat charge unless a Service Order states otherwise.

Provider will configure, host, support, and make the ordered Products available as stated in each Service Order. Customer will provide timely access to personnel, information, sample records, workflows, and decisions needed for implementation. Material scope changes require a written change order, which Customer may sign or approve by email in the same manner as a Service Order under Section 1. Customer may permit only Authorized Users to access the Service, is responsible for their compliance, and will not allow named accounts to be shared. Provider may improve security, reliability, or functionality so long as it does not materially reduce the core purchased functionality during the current term.

Customer will use the Service lawfully and for its internal operations; maintain accurate user and contact information; promptly disable departed users; safeguard credentials; not reverse engineer, resell, sublicense, interfere with, or attempt unauthorized access; ensure Customer Data is accurate, lawfully collected, and appropriate for processing; maintain its own internet access, endpoint security, identity controls, and business-continuity procedures; and not enable access to an unlicensed Module. Customer will also identify its contracting authority, procurement contact, and any legally required purchase-order or appropriation reference on the applicable Service Order.

Customer will pay the fees in each Service Order and later billing invoice. Unless an invoice states another due date, payment is due thirty (30) calendar days after Customer receives the invoice. Customer must provide written notice of any good-faith dispute within ten (10) business days after receipt, identifying the disputed amount and the basis for the dispute. Undisputed amounts remain due as stated. Undisputed overdue amounts may accrue interest at the lesser of 1.0% per month or the maximum rate permitted by applicable law. Provider will give at least ten (10) days' written notice before suspension for nonpayment. Customer will reimburse Provider's reasonable costs of collection, including attorneys' fees, for undisputed amounts more than thirty (30) days overdue. Fees exclude sales, use, and similar transaction taxes. Customer is responsible for taxes properly imposed on the transaction, excluding taxes on Provider's net income, and will provide any valid exemption or direct-pay certificate before payment is due. Invoices issued after the applicable executed Service Order are for billing purposes only. They do not require signature, do not modify the terms stated in the Service Order, and are subordinate to that Service Order and this Agreement. If a later invoice conflicts with the Service Order, the Service Order controls.

Each Service Order states an included Licensed User count and a per-seat rate for each Module. Customer may add Licensed User seats at any time on written request from a contact identified in the applicable Service Order; no new Service Order is required for seat additions alone. Added seats are billed at the per-seat rate stated in that Service Order, prorated from the first day of the calendar month in which the seat is activated through the end of the then-current service term, and co-terminate with that term. Provider will invoice seat additions on the next regular invoice for the affected Module, except that Provider may invoice separately where the prorated amount exceeds two hundred fifty dollars ($250). At renewal, the active Licensed User count for each Module becomes the baseline for the renewal term. Participant counts are not metered.

Licensed User seats may not be reduced during a service term, and no credit or refund is issued for a seat deactivated mid-term. Customer may reduce its Licensed User count effective at renewal by written notice given at least sixty (60) days before the end of the then-current service term.

Additional Modules purchased during a service term require a new executed Service Order. Fees for an added Module are prorated from the first day of the calendar month in which the Module is activated through the end of the then-current service term, and the added Module co-terminates with that term. Implementation fees for an added Module are not prorated and are invoiced in full.

This Agreement continues until all Service Orders expire or are terminated. Each Service Order states its initial term. A Service Order renews only through a written renewal or extension that Customer signs or approves by email from an authorized representative, in the same manner as a Service Order under Section 1, unless that Service Order expressly permits another legally valid method. If Customer's governing body does not appropriate funds for a future fiscal period, Customer may terminate the affected future period on prompt written notice with reasonable evidence of non-appropriation. Fees earned or incurred through the termination date remain due, and completed or committed implementation fees are not refundable. Seat additions are governed by Section 4 and do not require a new Service Order. Additional Modules are governed by Section 4.3.

Provider and its licensors retain all rights in the Platform and Modules, source and object code, architecture, models, prompts, templates, workflows, documentation, know-how, generic configurations, and improvements (collectively, Provider Technology). During an active paid term, Provider grants Customer a limited, nonexclusive, nontransferable right for Authorized Users to access the ordered Modules for Customer's internal operations. No source-code rights or ownership transfer. Provider may use voluntary feedback without restriction if it does not identify Customer or disclose Customer Confidential Information.

Customer retains all rights in data, text, records, attachments, instructions, and other content submitted by or for Customer (Customer Data). Customer authorizes Provider and its subprocessors to process Customer Data only as reasonably necessary to provide, secure, support, and improve the Service, comply with law, and enforce this Agreement. Provider may use aggregated and deidentified statistics that do not identify Customer, an individual, or Customer Confidential Information.

AI features may classify, summarize, retrieve, draft, recommend, or otherwise assist with operations. AI output can be incomplete or incorrect and does not replace qualified human judgment. Customer is responsible for human review before relying on AI output for material operational, safety, legal, employment, financial, or regulated decisions. Provider will not knowingly use Customer Data to train a generally available model without Customer's prior written consent. An AI Usage Allowance is a commercial allowance, not a fixed number of tokens, calls, or outputs. When technically practicable, Provider will notify Customer near 75% and 90% usage. Provider will not impose overage charges without written authorization. If the allowance is exhausted and more usage is not authorized, Provider may notify Customer and rate-limit or temporarily suspend AI-enabled features without incurring additional third-party AI charges; Provider will use reasonable efforts to keep non-AI core functions available and will restore AI features after usage is authorized or a new allowance begins. Unused allowance expires at term-end and is not refundable or transferable.

Customer may apply an approved deployment name, logo, colors, or domain when stated in a Service Order and grants Provider a limited license to display those materials only to deliver and support the Service. Customer owns its supplied marks; Provider owns Limestone names and marks. Any in-product attribution will be stated in the Service Order. Provider may not use Customer's name or logo for external marketing without Customer's prior written consent.

Each Party will protect nonpublic information that is marked confidential or reasonably understood to be confidential, use it only for this Agreement, and disclose it only to personnel and contractors who need it and have confidentiality duties. Exclusions apply to information independently developed, rightfully received without restriction, publicly available without breach, or previously known without restriction. Customer's duties are subject to applicable public-records and open-meetings laws. When lawful, Customer will give Provider prompt notice of a request for Provider Confidential Information and reasonable opportunity to seek protection. Confidentiality duties last five (5) years after disclosure; trade-secret duties last while the information remains a trade secret.

Provider will maintain the safeguards in Schedule C. Each Party will comply with privacy and security laws applicable to its own activities. Customer will not submit regulated or specially protected data, including protected health information, payment-card data, criminal-justice information, tax information subject to special safeguards, or government-classified information, unless the Parties first complete a written assessment, sign any required addendum, and confirm the Service is configured for that data. Provider may suspend the affected workflow immediately on written notice when needed to prevent material security or legal harm.

Provider warrants that implementation and support will be performed in a professional and workmanlike manner and that the Service will materially conform to the functionality stated in the applicable Service Order under normal authorized use. Customer must report a claimed breach with reasonable detail within thirty (30) days after the affected service. Provider's obligation and Customer's exclusive remedy are to reperform or correct the affected service; if Provider cannot do so after reasonable efforts, Customer may terminate the affected Module and receive a prorated refund of prepaid, unused recurring fees for that Module. Except for those express commitments, the Service and AI output are provided "as is" and "as available." To the maximum extent permitted by law, Provider disclaims implied warranties of merchantability, fitness for a particular purpose, title, noninfringement, and warranties arising from course of dealing or usage. Provider does not promise uninterrupted or error-free operation or accurate AI output. This disclaimer does not reduce Schedule B.

Provider will defend Customer against a third-party claim that Customer's authorized use of the unmodified Service infringes a United States patent, copyright, or trademark, and will pay damages finally awarded or agreed in settlement. Provider may modify or replace the affected Module, obtain continued-use rights, or terminate the affected Module and refund prepaid unused recurring fees. This does not apply to claims arising from Customer Data, a Customer-supplied mark, unauthorized use, third-party combinations not supplied by Provider, or Customer specifications.

To the extent permitted by applicable law and without waiving any immunity, Customer will defend Provider against a third-party claim arising from Customer Data, a Customer-supplied mark, Customer's violation of law, or Customer's material breach of this Agreement, and will pay damages finally awarded or agreed in settlement.

The indemnified Party must promptly notify the indemnifying Party, provide reasonable cooperation at the indemnifying Party's expense, and allow control of the defense and settlement. No settlement may admit fault by or impose a nonmonetary obligation on the indemnified Party without written consent.

Customer will defend and indemnify Provider against any third-party claim arising from Customer's reliance on, publication of, or action taken on AI-assisted output without the human review required by Section 8 and Schedule C5, and will pay damages finally awarded or agreed in settlement. This obligation is not subject to the caps in Section 14. All provisions apply only to the extent enforceable against a governmental entity, and nothing waives a statutory or common-law immunity.

To the maximum extent permitted by law, neither Party is liable for indirect, incidental, special, exemplary, punitive, or consequential damages, or for lost profits, revenues, goodwill, or data, even if advised of the possibility. Except as stated in Section 14.2, each Party's aggregate liability arising from this Agreement will not exceed the recurring fees actually paid by Customer for the twelve (12)-month service term in which the event giving rise to the claim occurred. The implementation fee and any AI Usage Allowance are excluded from this cap. All provisions apply only to the extent enforceable against a governmental entity, and nothing waives a statutory or common-law immunity.

Provider's aggregate liability under Section 13.1 will not exceed three (3) times the recurring fees paid for the service term in which the event occurred. Customer's obligations under Sections 13.2 and 13.4, and liability arising from unauthorized user access, security or privacy violations, prohibited data, AI-safeguard violations, or unauthorized use or misappropriation of Provider Technology, are not subject to a cap. The caps do not limit Customer's payment obligations or either Party's liability for gross negligence, willful misconduct, fraud, or liability that cannot legally be limited. All provisions apply only to the extent enforceable against a governmental entity, and nothing waives a statutory or common-law immunity.

No claim under this Agreement may be brought more than twelve (12) months after the claiming Party knew or reasonably should have known of the facts giving rise to it, except a claim for nonpayment or where applicable law prohibits that limitation.

Either Party may terminate for a material breach not cured within thirty (30) days after written notice. Provider may suspend sooner when reasonably necessary to prevent material security harm, unlawful use, prohibited data processing, or after the nonpayment notice in Section 4. Provider will limit and promptly lift a suspension when the cause is resolved. At expiration or termination, access ends. At Customer's written request at any time before deletion, Provider will make one commercially reasonable export of Customer Data available in a commonly used format. Provider will not delete Customer Data earlier than sixty (60) days after expiration or termination unless Customer requests earlier deletion or law requires otherwise. Backup copies may remain until overwritten in ordinary retention cycles. Accrued payment obligations remain due. Sections 3, 4, 5, 6, 8, 11, 12, 13, 14, 21, 22, and 23 survive, together with provisions that by nature should survive.

Neither Party may use the other Party's name, logo, testimonial, or engagement details in external marketing, a case study, or a press release without prior written consent. Factual disclosures required by law or procurement rules are permitted.

Each Party will comply with laws applicable to its own performance. Customer is responsible for the legality of its instructions, Customer Data, access approvals, and use of outputs. Provider is not Customer's legal, tax, regulatory, employment, or safety advisor.

Legal notices must be in writing and delivered by personal delivery, nationally recognized overnight courier, certified mail, or email followed by one of those physical methods. Notices go to the addresses in the applicable Service Order unless updated by written notice. Operational support may use the designated support channel.

The governing law and venue stated in the applicable Service Order control. If the Service Order is silent and legally permissible, Tennessee law governs and state and federal courts in Blount County, Tennessee have jurisdiction. Before filing suit, executives will meet in good faith within ten (10) business days after written escalation, except for reasonably necessary immediate injunctive relief. Nothing waives Customer's immunity, statutory defenses, notice requirements, or limits imposed by law.

A Force Majeure Event is beyond a Party's reasonable control, including natural disaster, fire, flood, epidemic, war, terrorism, civil disorder, labor disruption not limited to the affected Party's workforce, widespread internet or utility failure, government action, or critical third-party platform failure despite reasonable contingency measures. The affected Party will promptly notify the other, mitigate, and resume performance. Payment obligations are not excused. If the event materially prevents an affected Service for more than thirty (30) consecutive days, either Party may terminate that Service on written notice. Fees invoiced or accrued before termination remain due, and implementation fees are not refundable.

During the term, Provider will maintain workers' compensation coverage as required by law and commercial general liability insurance. Provider will furnish a certificate of that coverage on reasonable written request. Insurance does not expand Provider's liability under Section 14.

Customer will identify in the applicable Service Order or signed addendum the Customer's adopted records-retention schedule and any mandatory audit, accessibility, security, procurement, or public-records requirements applicable to the Service. Provider will retain and dispose of Customer Data and responsive Service records in accordance with that identified schedule and applicable law, subject to the data-return framework in Section 15 and any technical limitation disclosed before the Service Order is executed. Provider will reasonably cooperate with lawful audit and records requests relating to the Service, subject to confidentiality, security, privilege, and reasonable cost protections. Each person who signs or approves a Service Order on behalf of a Party represents that the person has authority to bind that Party. Customer's obligations are limited by applicable law; no term creates a pledge of future appropriations or waives governmental immunity.

To the extent applicable to Provider and the Service under a Service Order, Provider certifies that it will comply with the Tennessee Lawful Employment Act, including E-Verify requirements when required; is not identified on the applicable Tennessee list of persons engaged in investment activities in Iran; and will not, for the duration of the applicable Service Order, engage in a boycott of Israel as defined by and subject to the exceptions in applicable Tennessee law. Customer may require separate signed statutory certification forms as part of its procurement process. Those forms do not modify this Agreement unless signed by both Parties as an amendment.

Neither Party may assign this Agreement without the other's consent, except to an affiliate or with a merger, reorganization, or sale of substantially all relevant assets, with notice and assumption of obligations. The Parties are independent contractors. There are no third-party beneficiaries. If a provision is unenforceable, it will be narrowed to the minimum extent necessary and the remainder continues. No failure or delay in exercising a right is a waiver.

This Agreement, its Schedules, signed addenda, and executed Service Orders are the entire agreement about the Service and supersede prior proposals and discussions on the same subject. Amendments and waivers must be signed by authorized representatives. A later master form does not change an executed Service Order unless the Parties sign an amendment adopting it. Counterparts and electronic signatures are permitted. Customer purchase orders, portals, vendor-onboarding forms, and unsigned billing documents do not modify this Agreement unless an authorized Provider representative expressly signs a document stating the modification. A Customer purchase order may be issued for Customer’s internal processing and may be referenced on a Service Order, but a purchase order does not by itself execute a Service Order, and any preprinted or additional terms in the purchase order do not apply.