Brass Acre Master Subscription Agreement

This Master Subscription Agreement (the "Agreement") is between Ignis Public Safety Group, LLC, a California limited liability company doing business as Brass Acre ("Brass Acre"), with its principal place of business in Temecula, California, and the public agency or other organization named on a signed Order Form ("Customer" or "Agency"). Every Order Form that refers to this Agreement is governed by it. By signing an Order Form, Customer agrees to this Agreement. The person signing for a public agency represents that he or she has authority to bind the Agency, including by a purchase order issued under the Agency's procurement rules.

1. Definitions

"Service" means the Brass Acre software products named on an Order Form, delivered as a hosted subscription over the internet, together with the shared platform included with every product: one sign in for every member (Brass Acre ID), the shared records for people, addresses, calls and equipment, the capture bar, exports, the audit trail, mobile and offline use, and support.

"Order Form" means the ordering document signed by both parties, on paper or electronically, that names the products, the Station count, the annual fee, the term and any special terms. The form of Order Form is Exhibit A.

"Station" means a fire station or equivalent fixed facility from which Customer's apparatus respond, whether staffed by career, paid call or volunteer members. The Station count on the Order Form sets the fee. Customer's number of members, users or logins never affects the fee.

"Customer Data" means all records, files, images, audio, video and other content submitted to the Service by or for Customer, including incident, patient care, investigation, inspection, training, health and personnel records, and any data imported for Customer.

"Authorized Users" means Customer's employees, volunteers, contractors and mutual aid partners whom Customer allows to use the Service for Customer's benefit.

"Subscription Year" means each twelve month period beginning on the Subscription Start Date stated on the Order Form.

"Price List" means Brass Acre's published annual price list at brassacre.com/pricing, as summarized in Schedule 1.

2. Subscription, Orders and Term

2.1 Provision of the Service. Brass Acre will make the Service available to Customer during each Subscription Year under this Agreement, the service levels and support in Exhibit B, and the security terms in Exhibit C.

2.2 Annual subscriptions only. Every subscription is sold by the year. There are no monthly plans. Unless the Order Form states a longer term, the initial term is one Subscription Year. Subscriptions renew for one year at a time unless either party gives written notice of non-renewal at least sixty (60) days before the end of the current term.

2.3 Renewal price protection. The annual fee for a renewal term will not increase by more than four percent (4%) over the fee for the term just ending, for the same products and Station count. Brass Acre will send the renewal fee in writing at least ninety (90) days before renewal so Customer can budget for it. A multi-year Order Form locks its stated fee for the full committed term.

2.4 Full Acre package and products not yet released. When Customer orders the Full Acre package, Customer pays the Core Four price, plus the step price stated in Schedule 1 for each additional product from the first day of the month after that product becomes generally available to Customer, and never more than the Full Acre price stated on the Order Form. An Order Form may also reserve any single product that Brass Acre has announced but not yet released. No fee is charged for a reserved product until the first day of the month after it becomes available to Customer, and its price is locked at the price on the Order Form.

2.5 Adding Stations or products. Customer may add Stations or products at any time. Additions are billed from the first day of the next month, prorated to the end of the current Subscription Year, at the prices on the Price List in effect on the Order Form date for the rest of the term. Customer may reduce Stations or products only at renewal.

2.6 Included use. Each Station includes up to four thousand (4,000) incident records per year and two hundred fifty (250) gigabytes of stored media, pooled across all of Customer's Stations. Brass Acre will not charge for use above these amounts during a term. If Customer's use exceeds them for two consecutive Subscription Years, Brass Acre may propose a reasonable adjustment at the next renewal, subject to Section 2.3.

2.7 Pilots. Any free pilot, trial or evaluation is provided "as is" and the warranties in Section 9 do not apply to it. Customer Data entered during a pilot carries into a paid subscription, or is returned and deleted under Section 6 if Customer does not continue.

3. Use of the Service

3.1 Authorized Users. There are no per user or per seat fees. Customer may enroll every member of the Agency. Customer is responsible for its Authorized Users' compliance with this Agreement and for keeping its user roster current.

3.2 Restrictions. Customer will not: (a) sell, resell, sublicense or share the Service with anyone outside its Authorized Users; (b) reverse engineer or copy any part of the Service except as the law allows; (c) use the Service to build a competing product; (d) upload malicious code; or (e) use the Service in violation of law.

3.3 Customer responsibilities. Customer is responsible for the accuracy and lawful collection of Customer Data, for any consents its own law requires, for protecting its members' sign in credentials, and for its own internet access and devices.

3.4 Professional judgment. The Service supports and never replaces the judgment of Customer's firefighters, officers, investigators, inspectors and medical providers. Drafting help in the Service produces suggestions that stay marked as suggested until a member confirms them, and nothing unconfirmed is included in an export.

4. Fees, Invoices and Taxes

4.1 Fees. Fees are stated on the Order Form and follow the Price List in effect on the Order Form date. A one time onboarding fee, if any, is charged once per agency, not per product and not per year.

4.2 Invoices and payment. Brass Acre invoices the annual fee once a year, in advance. Invoices are due thirty (30) days after receipt. Brass Acre accepts ACH, check and purchase orders. Card payment is available only where the Order Form says so. Customer may prepay a multi-year term. Brass Acre will meet Customer's reasonable invoicing requirements (purchase order numbers, vendor registration, W-9, certificates of insurance) at no charge.

4.3 No suspension over a good faith dispute. If Customer disputes an invoice in good faith and pays the undisputed part, Brass Acre will not suspend the Service or limit Customer's access to Customer Data while the parties resolve the dispute. Brass Acre will never withhold Customer Data over a fee dispute.

4.4 Taxes. Fees do not include taxes. Where a tax applies to the Service, including California sales tax on software subscriptions beginning January 1, 2027, Brass Acre will show it as a separate line on the invoice and pay it to the taxing authority. Brass Acre will not charge tax to a Customer that provides a valid exemption certificate.

4.5 Non-appropriation. If Customer is a public agency and its governing body does not appropriate funds for a renewal term, Customer may end this Agreement at the end of the paid term by written notice that funds were not appropriated. This is not a breach and no termination charge applies.

5. Term and Termination

5.1 Term. This Agreement continues while any Order Form is in effect.

5.2 Termination for cause. Either party may terminate an Order Form if the other party materially breaches it and does not cure the breach within thirty (30) days after written notice, or at once if the other party becomes insolvent.

5.3 Effect of termination. When an Order Form ends: (a) the subscription ends; (b) Section 6.3 applies to Customer Data; (c) if Brass Acre ended it for Customer's uncured breach, unpaid fees for the rest of the committed term become due; and (d) if Customer ended it for Brass Acre's uncured breach, Brass Acre will refund prepaid fees for the unused part of the term. Sections 4.3, 6, 9.3, 10, 11, 13, 14 and 18 survive.

6. Customer Data

6.1 Ownership. Customer owns Customer Data. Brass Acre receives only the limited right to host, process, send and display Customer Data to provide the Service, to prevent or fix technical problems, and to comply with law. Brass Acre does not sell Customer Data and does not use it for advertising.

6.2 No training of general purpose models. Brass Acre will not use Customer Data to train, fine tune or improve any general purpose artificial intelligence model, its own or anyone else's. Drafting help in the Service works on Customer's own records for Customer's own use.

6.3 Export and deletion. Customer may export Customer Data at any time during the term, at no charge, using the Service's export tools, in open formats (PDF, Word, CSV, and NERIS and NEMSIS formats where a product supports them). For sixty (60) days after an Order Form ends, Brass Acre will keep export available at no charge and give reasonable help moving the data. After that, Brass Acre will delete Customer Data from production systems within thirty (30) days and from backups as they rotate, within ninety (90) days, and will provide a written certificate of deletion on request. Records under a hold in Section 14 are kept until the hold is released.

6.4 Service information. Brass Acre may use de-identified, combined information about how the Service is used (for example, counts of features used and system performance) to run and improve the Service, if it cannot reasonably identify Customer, any person or any incident.

7. Security, Privacy and Regulated Records

7.1 Security program. Brass Acre maintains the administrative, physical and technical safeguards in Exhibit C, including encryption of Customer Data in transit and at rest, two step sign in, role based access, audit logging and daily backups stored in the United States.

7.2 Notice of a breach. Brass Acre will notify Customer without undue delay, and no later than seventy-two (72) hours after confirming a security breach affecting Customer Data, and will cooperate with Customer's own notice duties.

7.3 Patient records. Where the Service handles protected health information, including EMS patient care records, the Business Associate Agreement in Exhibit D applies.

7.4 Criminal justice information. Where the Service handles criminal justice information, including investigation records connected to law enforcement data, the CJIS Security Addendum in Exhibit E applies.

7.5 Subprocessors. Brass Acre's current list of subprocessors is posted at brassacre.com/legal/subprocessors. Brass Acre will give at least thirty (30) days' notice before adding a subprocessor that can access Customer Data, and Customer may object on reasonable data protection grounds.

7.6 Public records. Nothing in this Agreement stops Customer from disclosing this Agreement or its prices when the law requires. Brass Acre's prices are published and are not confidential.

8. Support and Service Levels

Brass Acre will provide the support and meet the service levels in Exhibit B for every subscription at no extra charge. Support is not sold in tiers.

9. Warranties

9.1 Authority. Each party warrants that it has authority to enter into this Agreement.

9.2 Performance. Brass Acre warrants that during each Subscription Year the Service will perform materially as described in its published documentation, and that Brass Acre will not materially reduce the function of a product Customer has paid for during a paid term. If the Service does not, Brass Acre will correct it. If Brass Acre cannot correct it within thirty (30) days, Customer may end the affected Order Form and receive a refund of prepaid fees for the unused term.

9.3 Disclaimer. Except as stated in this Section 9, the Service is provided without other warranties, express or implied, including warranties of merchantability, fitness for a particular purpose and non-infringement. Brass Acre does not warrant that the Service will be uninterrupted or error free. The remedy for availability problems is the service credit process in Exhibit B.

10. Indemnification

10.1 By Brass Acre. Brass Acre will defend Customer against any third party claim that the Service, used as this Agreement permits, infringes a United States patent, copyright or trademark or misappropriates a trade secret, and will pay damages finally awarded and reasonable attorneys' fees. If such a claim is made or seems likely, Brass Acre may get Customer the right to keep using the Service, change the Service so it does not infringe without a material loss of function, or, if neither is reasonably possible, end the affected Order Form and refund prepaid fees for the unused term. This Section is Customer's only remedy for infringement claims.

10.2 By Customer. To the extent its law allows, and without waiving any immunity or defense available to a public agency, Customer is responsible for third party claims arising from Customer Data that Customer had no right to submit, or from Customer's use of the Service in violation of law. Nothing in this Agreement requires a public agency to give an indemnity its charter or state law prohibits.

11. Limitation of Liability

11.1 Cap. Except for the Excluded Claims, each party's total liability arising out of this Agreement is limited to the fees paid or payable by Customer in the twelve (12) months before the event that gave rise to the liability.

11.2 Excluded Claims. The cap does not apply to: (a) Brass Acre's obligations under Section 10.1; (b) a breach of Section 13; (c) a security breach caused by Brass Acre's gross negligence or willful misconduct; or (d) Customer's obligation to pay fees owed. For any other security breach involving Customer Data, Brass Acre's liability is limited to two times (2x) the cap.

11.3 Indirect damages. Neither party is liable for indirect, incidental, special or consequential damages or lost profits, even if told they were possible. This Section does not limit liability for personal injury or death caused by negligence, or any liability that cannot be limited by law.

12. Insurance

During each Subscription Year, Brass Acre will carry, with insurers rated A- VII or better: technology errors and omissions and cyber liability insurance of at least $2,000,000 per claim and in the aggregate; commercial general liability insurance of at least $1,000,000 per occurrence and $2,000,000 in the aggregate; and workers' compensation insurance as the law requires. Brass Acre will provide certificates of insurance on request and will name Customer as an additional insured on the general liability policy where Customer's procurement rules require it.

13. Confidentiality

Each party will protect the other's non-public information with at least the care it uses for its own similar information, and no less than reasonable care, and will use it only to perform this Agreement. Confidential information does not include information that is public through no breach, independently developed, rightfully received from someone else, or required to be disclosed by law, including under public records laws (Section 7.6). Customer Data is Customer's confidential information. The Service's non-public technology is Brass Acre's.

14. Records, Holds and Audit

The Service keeps an audit trail of sign ins, record creation, changes, views of restricted records, exports and access changes that cannot be edited or deleted. When Customer gives written notice of a litigation hold, public records request or investigation, Brass Acre will keep the identified Customer Data and pause routine deletion for those records until Customer releases the hold. Once a year, on thirty (30) days' notice, Customer may review Brass Acre's compliance with Exhibit C through Brass Acre's current security documentation, penetration test summary and any third party audit reports Brass Acre then holds.

15. Publicity

Neither party will use the other's name or logo publicly without written consent, except that after Customer has been live for ninety (90) days Brass Acre may list Customer's name in a plain text customer list unless Customer opts out in writing. Case studies, quotes and logos always need separate written consent.

16. Assignment

Neither party may assign this Agreement without the other's written consent, except that Brass Acre may assign it in a merger, reorganization, change of its legal name, or sale of substantially all its assets, if the successor takes on this Agreement in full and Customer receives written notice. Brass Acre remains responsible for its subprocessors and subcontractors.

17. Governing Law and Disputes

If Customer is a California public agency, California law governs this Agreement and the courts in Riverside County, California have jurisdiction. If Customer is a public agency in another state whose law requires its own law or courts, the Order Form will say so and that state's law and courts apply. Before filing suit, the parties will try in good faith for thirty (30) days to resolve the dispute through their senior leaders. Each party waives trial by jury to the extent the law allows.

18. General

18.1 Entire agreement and order of precedence. This Agreement, its Exhibits and Schedule, and each Order Form are the entire agreement between the parties on this subject. If they conflict, this order controls: the Order Form, then Exhibits D and E for regulated records, then Exhibit F for Founding Agencies, then Exhibits B and C, then this Agreement. Printed terms on a purchase order have no effect.

18.2 Changes to this Agreement. Brass Acre may post a new version of this Agreement for future Order Forms. The version in effect on an Order Form's date governs that Order Form for its whole term, including renewals, unless the parties agree otherwise in writing.

18.3 Notices. Legal notices must be in writing and take effect on delivery: to Brass Acre at the address on the Order Form with a copy to legal@brassacre.com, and to Customer at the address on the Order Form. Service notices may be given inside the Service.

18.4 Events beyond control. Neither party is liable for a delay caused by events beyond its reasonable control if it works diligently to resume. This does not excuse payment for services already delivered.

18.5 Severability, waiver and signatures. If a provision is unenforceable, it is limited only as much as needed. Not enforcing a provision is not a waiver. This Agreement and any Order Form may be signed electronically and in counterparts, and electronic signatures meet any signature requirement under the federal ESIGN Act and the Uniform Electronic Transactions Act.

18.6 Independent parties. The parties are independent contractors. Nothing here creates a partnership, joint venture or agency.

Schedule 1. Price List (January 2027)

All prices are per year, billed annually. Prices are per Station for the first four Stations. Stations five through ten are priced at seventy-five percent (75%) of the per Station price. Agencies with eleven or more Stations receive a written quote.

• Teams without Stations (task forces, regional teams, special operations teams) are priced as one Station for every fifty (50) members or part of fifty.
• Three year term: ten percent (10%) off the annual fee, locked for the three years. Customer may prepay.
• Renewals are capped at a four percent (4%) increase per year (Section 2.3).
• Data migration from Customer's current system, training and support are included in every subscription.

Exhibit A. Order Form

The Order Form is a separate two page document that refers to this Agreement by version. The current form is posted at brassacre.com/legal/order-form.

Exhibit B. Service Levels and Support

B-1. Availability

The Service will be available at least 99.5% of each calendar month, not counting maintenance announced at least seventy-two (72) hours ahead and performed between 10:00 p.m. and 5:00 a.m. Pacific time, events beyond Brass Acre's control, and problems with Customer's own connection. Brass Acre publishes current and past availability at status.brassacre.com.

B-2. Service credits

Credits are applied to the next invoice when Customer asks within sixty (60) days after the month. If availability falls below 98.0% in any two months within six months in a row, Customer may end the affected Order Form without penalty and receive a refund of prepaid fees for the unused term.

B-3. Response times

B-4. What support includes, on every subscription

• A named customer success manager, a person, not a queue, introduced on the kickoff call.
• Live phone and chat from 6:00 a.m. to 6:00 p.m. Pacific time, Monday through Friday, and a 24 hour emergency line for Severity 1.
• Standing review calls: every quarter for agencies with 1 or 2 Stations, every month for 3 to 6 Stations, and every month plus a weekly office hour for 7 or more Stations.
• Unlimited training for as long as the subscription lasts: rollout, refreshers and new member sessions.
• Data migration from Customer's current system as part of onboarding, at no charge.
• No charge for support requests, report template help or export help.

B-5. Onboarding

Onboarding (data migration, setup and go live training) will be complete within thirty (30) days of the Subscription Start Date for agencies with 1 to 4 Stations, and within sixty (60) days for 5 or more Stations, if Customer provides its source data and scheduling access. If Brass Acre misses the window for reasons within its control, the Subscription Start Date moves to the go live date at no charge.

Exhibit C. Security and Data Processing

• Hosting: production systems run in United States regions of Amazon Web Services. Customer Data stays in the United States.
• Encryption: TLS 1.2 or higher in transit. AES-256 at rest, including backups. Separate encryption keys for investigation and health records.
• Separation: every record belongs to one agency, and the database itself refuses requests from outside that agency.
• Access: role based permissions, least privilege administration, two step sign in required for all Brass Acre staff and for Customer administrators and anyone who can see investigation, health or patient records, unique named accounts, and sessions that end after 30 minutes without activity.
• People: background checks and security training at hire and every year for anyone with production access. CJIS fingerprint screening where Exhibit E applies. Production data is never copied to test systems or personal devices.
• Originals: uploaded photos, video and documents are fingerprinted on arrival and stored once, unchanged. Every copy points back to the original.
• Backups: encrypted daily backups. Recovery point 24 hours. Recovery time 24 hours. Restores tested at least twice a year.
• Logging: central security logging and alerting, and an application audit trail that Customer administrators can view and that cannot be edited or deleted.
• Testing: an outside penetration test at least once a year, with findings fixed on a set schedule.
• Third party reports: Brass Acre will provide its current security documentation and latest penetration test summary on request, and any independent audit report it holds, under a confidentiality agreement. Brass Acre does not claim any certification it does not hold.
• Incidents: a written response plan. Notice to Customer as stated in Section 7.2 with what is known about scope, records affected and next steps. Brass Acre pays for notices required because of a breach caused by Brass Acre.
• Roles: Customer owns and controls Customer Data. Brass Acre processes it only on Customer's instructions as set out in this Agreement.

Exhibit D. HIPAA Business Associate Agreement

This Exhibit applies where Customer is a covered entity, or acts for one, and the Service creates, receives, keeps or sends protected health information ("PHI"), including EMS patient care records. Terms not defined here have the meanings in the HIPAA rules at 45 C.F.R. Parts 160 and 164, as amended by the HITECH Act.

1. Use and disclosure. Brass Acre, as business associate, will use and disclose PHI only to provide the Service to Customer, as required by law, or for its own proper management and administration with the assurances the rules require. Brass Acre will not use PHI to train any general purpose artificial intelligence model.

1. Safeguards. Brass Acre will use the administrative, physical and technical safeguards the HIPAA Security Rule requires, including those in Exhibit C, and will comply with the Security Rule to the extent it applies to business associates.

1. Reporting. Brass Acre will report to Customer any use or disclosure not permitted by this Exhibit, any security incident (other than routine unsuccessful attempts such as pings and port scans), and any breach of unsecured PHI, without unreasonable delay and no later than ten (10) business days after discovery, including the individuals affected to the extent known, so Customer can meet its own notice duties.

1. Subcontractors. Brass Acre will require any subcontractor that handles PHI to agree to restrictions at least as protective as these.

1. Individual rights. Brass Acre will make PHI available for access, amendment and an accounting of disclosures as 45 C.F.R. sections 164.524 to 164.528 require, within fifteen (15) days of Customer's request, and will refer any individual who contacts Brass Acre directly to Customer.

1. Minimum necessary and government access. Brass Acre will follow the minimum necessary standard and will make its records about PHI available to the Secretary of Health and Human Services to determine compliance.

1. End of the relationship. When the subscription ends, PHI is returned through the export process in Section 6.3 and then destroyed. If return or destruction is not feasible, this Exhibit continues to protect the PHI kept, and its use is limited to the reasons return is not feasible. Customer may end the Order Form if Brass Acre materially breaches this Exhibit and does not cure the breach.

Exhibit E. CJIS Security Addendum

This Exhibit applies where the Service stores or processes criminal justice information ("CJI") as defined in the FBI CJIS Security Policy, such as fire investigation records that include law enforcement data, arson case files, or firesetter records shared with law enforcement.

1. Policy. Brass Acre will keep controls consistent with the current FBI CJIS Security Policy for systems that handle CJI, and will sign the FBI CJIS Security Addendum and any state addendum Customer's CJIS Systems Agency requires, at no charge.

1. Screening and training. Every Brass Acre employee or contractor with access to unencrypted CJI will complete fingerprint based background screening as Customer's CJIS Systems Agency directs, and security awareness training within thirty (30) days of assignment and as the Policy requires after that. Brass Acre will keep and share, on request, the list of screened personnel.

1. Handling. CJI is stored only in the United States, encrypted in transit and at rest using FIPS 140-2 or 140-3 validated cryptography, kept separate by agency, and protected by advanced authentication for remote administrative access.

1. Incidents. Brass Acre will report a suspected or confirmed incident affecting CJI to Customer's designated CJIS contact within twenty-four (24) hours of confirming it, in addition to the notice in Section 7.2.

1. Audit. Customer, its CJIS Systems Agency and the FBI may audit compliance with this Exhibit as the Policy provides, and Brass Acre will cooperate at its own cost.

Exhibit F. Founding Agency Terms

This Exhibit changes the Agreement for the first ten (10) agencies whose Order Forms are marked "Founding Agency." Where it conflicts with the Agreement, this Exhibit controls.

1. Locked price. The annual fee on the Founding Agency's first Order Form will not increase for the initial term and the first three (3) renewals, four Subscription Years in all. After that the four percent (4%) renewal cap applies to the locked fee.

1. No onboarding fees. All onboarding fees are waived, including for Stations and products added later.

1. Direct line to the founder. For twenty-four (24) months from the Subscription Start Date, the Agency has a direct line to Brass Acre's founder for escalations and product input, in addition to the support in Exhibit B.

1. Twelve month exit. During the first twelve (12) months the Agency may end the Order Form for any reason on thirty (30) days' written notice and receive a refund of prepaid fees for the unused term, with free help exporting its data.

1. What Brass Acre asks. The Agency agrees to a monthly feedback session in the first year, up to four (4) reference calls a year with other agencies, and good faith consideration of a written case study, which always needs the Agency's separate written consent under Section 15. Nothing here requires the Agency to endorse Brass Acre publicly.