MANAGED SERVICES ADDENDUM

Effective Date: August 16, 2026

This Managed Services Addendum (the “Addendum”) supplements the Master Terms and Conditions (the “Master Terms”) between Short Arms Technologies, LLC d/b/a SA Applied (“SA Applied”) and the customer identified in an applicable Order (“Customer”).

This Addendum applies when an Order includes Managed Services. Capitalized terms not defined in this Addendum have the meanings given to them in the Master Terms.

1. Managed Services

1.1 Managed Services

“Managed Services” means ongoing administration, maintenance, support, monitoring, deployment, configuration, management, or other technology services performed by SA Applied for Customer as identified in an applicable Order or other written service description incorporated into the Agreement.

Managed Services may relate to cloud infrastructure, software, applications, websites, servers, networks, accounts, repositories, domains, identity systems, databases, third-party services, appliances, or other technology used by Customer.

1.2 Scope

SA Applied will perform only the Managed Services identified in the applicable Order or other applicable written service description.

The scope of Managed Services may be identified through line items, descriptions, schedules, proposals, SOWs, service specifications, portal records, or other written records incorporated into or associated with the applicable Order. No particular format or separate line item is required so long as the applicable scope can reasonably be determined.

A function is not included merely because it is technically related to, useful for, or commonly associated with a Managed Service.

Unless expressly included in the applicable service scope, Managed Services do not include any particular level of:

(a) continuous or 24-hour monitoring;

(b) cybersecurity monitoring or incident response;

(c) vulnerability scanning or penetration testing;

(d) patch management;

(e) backup or disaster recovery;

(f) business continuity;

(g) regulatory or industry compliance;

(h) help-desk or end-user support;

(i) guaranteed response or resolution times;

(j) uptime or availability commitments; or

(k) any other service level, recovery objective, or security function.

Different components of the Managed Services may be separately priced, bundled, included without a separate charge, or otherwise commercially structured as stated in the applicable Order or service description.

1.3 No Implied Service Level

SA Applied does not provide a service-level agreement, guaranteed response time, guaranteed resolution time, recovery-time objective, recovery-point objective, uptime commitment, or other performance guarantee unless expressly stated in the applicable Order or SOW.

Service targets, estimates, anticipated response times, operational practices, or similar objectives do not constitute guarantees unless expressly identified as contractual service levels.

2. Customer Environment

2.1 Customer Environment

A “Customer Environment” means technology accounts, infrastructure, systems, applications, repositories, cloud environments, subscriptions, servers, databases, domains, DNS zones, configurations, networks, storage, appliances, or other technology resources that are established, acquired, maintained, or designated specifically for Customer and that Customer owns, controls, or is entitled to control, subject to applicable third-party rights and payment obligations.

A Customer Environment may be created by Customer, by SA Applied on Customer’s behalf, or by a third party.

A Customer Environment may be hosted within a Customer-controlled account, an account administered by SA Applied, dedicated infrastructure, or other technical arrangement appropriate to the applicable Managed Services.

2.2 Customer Interest in Dedicated Resources

The fact that SA Applied creates, provisions, configures, administers, pays for, hosts, or technically controls a Customer Environment does not by itself give SA Applied beneficial ownership of Customer’s dedicated resources.

Where SA Applied establishes or acquires a dedicated account or resource specifically on Customer’s behalf, Customer will have the beneficial interest in that account or resource, subject to:

(a) payment of amounts properly attributable to its acquisition, registration, subscription, or use;

(b) applicable Provider Terms;

(c) rights in SA Applied Technology;

(d) third-party intellectual property rights; and

(e) any different ownership arrangement expressly stated in an Order or SOW.

2.3 Organizational and Administrative Structures

SA Applied may, where reasonably appropriate for providing the Managed Services, place or maintain Customer Environments within administrative, organizational, reseller, billing, management, deployment, hosting, or similar structures controlled or administered by SA Applied.

Such an arrangement does not, by itself, change Customer’s beneficial interest in its Customer Environment.

SA Applied may establish technical or administrative relationships reasonably necessary to manage the Customer Environment and may remove, relinquish, or transfer those relationships in connection with transition or termination.

2.4 Identification of Customer Environments

Material Customer Environments may be identified through Orders, schedules, onboarding records, account records, portal records, technical documentation, correspondence, or other written records maintained in connection with the Managed Services.

Identification of a Customer Environment is not required to appear on each invoice, and changes to technical identifiers, resource names, architecture, or individual components do not necessarily require amendment of the applicable Order.

3. Administrative Authority

3.1 Authorization

Customer authorizes SA Applied to access, administer, configure, deploy to, modify, monitor, maintain, and otherwise interact with the Customer Environment to the extent reasonably necessary to perform the Managed Services.

This authorization includes authority to use administrative accounts, service accounts, credentials, APIs, automation, remote-management tools, deployment systems, repositories, and other technical mechanisms reasonably necessary to perform the applicable Managed Services.

3.2 Customer Access

Unless an Order expressly provides otherwise, Customer retains the right to request reasonable administrative access to its Customer Environment.

SA Applied may use reasonable security procedures when providing privileged access, including identity verification, multifactor authentication, credential rotation, access logging, or other safeguards.

SA Applied is not required to provide Customer with credentials belonging solely to SA Applied, credentials that would expose another customer’s environment, or credentials for systems that constitute SA Applied Technology.

3.3 Customer Changes

Customer may make or authorize changes to its Customer Environment.

Customer is responsible for the consequences of changes made by Customer, its personnel, its contractors, other service providers, or other persons acting under Customer’s authority.

If such a change interferes with the Managed Services, creates a security or operational issue, or requires remediation, SA Applied may charge for additional work reasonably necessary to investigate, remediate, restore, or accommodate the change unless such work is otherwise included in the applicable service scope.

3.4 Protective Action

Where SA Applied reasonably believes immediate action is necessary to protect the Customer Environment, Customer Data, SA Applied’s systems, another customer, a Provider, or other persons or systems from an actual or reasonably suspected security threat, abuse, compromise, material operational failure, or unlawful activity, SA Applied may take reasonable protective action without prior Customer approval.

Protective action may include restricting access, disabling or rotating credentials, isolating systems, blocking traffic, stopping workloads, disabling integrations, suspending affected resources, or taking other reasonably necessary technical measures.

Where reasonably practicable, SA Applied will notify Customer of material protective action and cooperate with Customer regarding restoration.

Protective action does not expand the security services SA Applied has agreed to provide or make SA Applied responsible for preventing all security incidents.

4. Management, Maintenance, and Monitoring

4.1 Management

SA Applied will manage the portions of the Customer Environment identified in the applicable service scope.

SA Applied may use automation, scripts, deployment tools, monitoring systems, management platforms, third-party tools, and other reasonable methods to perform Managed Services.

4.2 Maintenance

Maintenance obligations apply only to the systems and activities included in the applicable service scope.

Unless otherwise agreed, SA Applied may determine reasonable technical methods, sequencing, tooling, and maintenance procedures used to perform the Managed Services.

4.3 Monitoring

Monitoring is provided only to the extent included in the applicable service scope.

Monitoring does not guarantee detection of every outage, vulnerability, attack, compromise, performance issue, unauthorized activity, configuration problem, or other event.

Alerts and monitoring systems may fail, be delayed, generate false positives or false negatives, or depend upon third-party systems outside SA Applied’s control.

4.4 Updates and Changes

SA Applied may make routine configuration, deployment, maintenance, or administrative changes reasonably necessary to perform the Managed Services.

Material architectural changes, significant migrations, substantial new functionality, or work materially outside the applicable Managed Services may require Customer approval and may constitute Professional Services or additional Managed Services.

5. Security Responsibilities

5.1 Shared Responsibility

Security of a Customer Environment is a shared responsibility among Customer, SA Applied, applicable Providers, and other parties with access to or responsibility for the Customer Environment.

The allocation of particular security functions depends upon the Managed Services purchased by Customer.

SA Applied does not assume responsibility for a security function merely because SA Applied has administrative access to a system capable of supporting that function.

5.2 Customer Security Responsibilities

Unless expressly included in the applicable service scope, Customer is responsible for:

(a) determining its security requirements and risk tolerance;

(b) determining whether the Managed Services are sufficient for Customer’s business and regulatory requirements;

(c) establishing appropriate policies governing its users, devices, data, credentials, and business processes;

(d) controlling access by Customer personnel and other Customer-authorized persons;

(e) promptly notifying SA Applied of known or suspected compromise relevant to the Managed Services;

(f) maintaining security controls for systems, devices, applications, or accounts outside SA Applied’s agreed scope; and

(g) identifying any legal, regulatory, contractual, industry-specific, retention, security, or compliance requirement that Customer expects SA Applied to satisfy.

5.3 SA Applied Responsibilities

SA Applied is responsible for performing security functions expressly included in the applicable service scope and for exercising reasonable care in its own performance of the Managed Services.

SA Applied will use reasonable measures appropriate to the nature and scope of its administrative access but does not warrant that a Customer Environment will be invulnerable, continuously secure, free from unauthorized access, or compliant with a particular security framework or regulatory regime unless expressly agreed in writing.

5.4 No Assumption of Comprehensive Security Responsibility

Administrative access, infrastructure management, monitoring, deployment, maintenance, or support does not by itself make SA Applied Customer’s exclusive cybersecurity provider or transfer comprehensive responsibility for Customer’s security program to SA Applied.

Any enhanced security services or assumption of specifically identified security responsibilities must be stated in the applicable service scope.

5.5 Security Incidents

The occurrence of a security incident does not by itself establish that either party breached the Agreement.

Each party will reasonably cooperate regarding security incidents affecting portions of the Customer Environment within that party’s control or responsibility.

Personal-data incidents subject to the Data Processing Addendum are also governed by that Addendum.

6. Backups, Recovery, and Business Continuity

6.1 Backup Services

SA Applied provides backup, replication, archival, restoration, or disaster-recovery services only to the extent identified in the applicable service scope.

Unless expressly stated otherwise, the existence of storage, snapshots, replication, version history, Provider recovery functionality, or other technical capabilities does not mean SA Applied has undertaken a contractual backup obligation.

6.2 Backup Requirements

Customer is responsible for identifying its required backup frequency, retention period, recovery objectives, geographic requirements, archival requirements, and other business-continuity needs.

SA Applied may assist Customer in designing or implementing such measures when included in the Managed Services or otherwise requested as additional services.

6.3 Recovery

SA Applied does not guarantee that Customer Data or systems can be recovered from every failure, corruption, deletion, attack, Provider failure, or other event.

Recovery depends upon the backup and recovery services purchased by Customer, the condition and availability of applicable backups, Provider capabilities, and other technical circumstances.

6.4 Testing

Backup restoration testing, disaster-recovery exercises, failover testing, and business-continuity testing are not included unless expressly identified in the applicable service scope.

Any contractual RPO, RTO, recovery guarantee, or similar recovery commitment must be expressly stated in writing.

7. Third-Party Infrastructure and Services

7.1 Third-Party Dependencies

Customer Environments may depend upon infrastructure, software, platforms, networks, APIs, telecommunications, registrars, cloud providers, or other services provided by third parties.

SA Applied does not control those third parties and is not responsible for their independent acts, omissions, outages, discontinuations, security incidents, or service changes except to the extent responsibility cannot lawfully be excluded or SA Applied has expressly undertaken a separate obligation.

7.2 Customer-Purchased Services

Where Customer purchases a third-party product or service directly and SA Applied administers it as part of the Managed Services, Customer remains responsible for its agreement with and payment obligations to the applicable provider.

SA Applied’s administration of a Customer-purchased third-party service does not make that service a Third-Party Service resold by SA Applied.

The parties may identify material Customer-purchased services administered by SA Applied through an Order, schedule, onboarding record, portal record, technical record, correspondence, or other written record. Such identification need not appear as a separate invoice line item.

7.3 SA Applied-Provided Third-Party Services

Where SA Applied procures or resells the applicable third-party product or service to Customer, the Third-Party Services Addendum also applies.

8. Consumption and Infrastructure Costs

8.1 Customer Responsibility for Consumption

Customer is responsible for charges associated with the operation and consumption of its Customer Environment, including compute, storage, bandwidth, databases, backups, logging, monitoring, APIs, software licenses, network services, third-party services, and similar usage-based or resource-based charges, except to the extent an applicable Order expressly includes such charges within a fixed or bundled fee.

8.2 Customer Pricing and Billing Basis

SA Applied may invoice Customer for infrastructure, consumption, or other charges incurred or provided in connection with Customer’s Environment.

Customer charges may be fixed, bundled, metered, usage-based, calculated according to a customer-facing rate, or structured using another pricing method stated or reasonably ascertainable from the applicable Order or billing arrangement.

SA Applied’s customer-facing price may include a markup, management component, administrative charge, bundled amount, discount allocation, or other pricing component and need not equal SA Applied’s underlying cost.

Unless expressly agreed otherwise, SA Applied is not required to disclose its wholesale rates, acquisition costs, distributor pricing, discounts, rebates, incentives, credits, margins, or other confidential commercial arrangements with Providers or suppliers.

8.3 Usage Information

Upon reasonable request, SA Applied may provide available information reasonably sufficient to substantiate Customer’s applicable usage or consumption charges.

SA Applied may redact or withhold Provider rates, wholesale pricing, discounts, rebates, credits, information concerning other customers, confidential supplier information, or other information not reasonably necessary to substantiate Customer’s actual usage or the basis of Customer’s charges.

8.4 Budgets and Alerts

Budgets, forecasts, alerts, thresholds, monitoring tools, estimates, or similar cost-management mechanisms are informational unless an Order expressly states that SA Applied has undertaken to enforce a hard spending limit.

Such mechanisms may not prevent additional consumption or charges.

8.5 Unexpected Consumption

Customer remains responsible for actual consumption associated with the Customer Environment, including unexpected or unusually high consumption.

A claim that SA Applied caused or contributed to such consumption through a breach of its obligations is subject to the remedies and limitations contained in the Agreement and does not, by itself, eliminate Customer’s obligation to pay third-party charges actually incurred for Customer’s Environment.

8.6 Deposits and Prepayment

Where SA Applied reasonably determines that Customer’s anticipated or actual infrastructure, consumption, third-party, or other pass-through charges create material financial exposure for SA Applied, SA Applied may require a reasonable deposit, advance payment, increased billing frequency, payment method, spending authorization, or other reasonable credit arrangement as a condition of continuing to advance such costs.

9. Credentials and Access

9.1 Credential Management

SA Applied may create, hold, manage, rotate, or use credentials reasonably necessary to perform the Managed Services.

The parties will use reasonable efforts to avoid unnecessary sharing of individual credentials and may use role-based access, service accounts, delegated administration, credential-management systems, or similar mechanisms where appropriate.

9.2 Customer Credentials

Customer is responsible for credentials issued to Customer and persons acting under Customer’s authority.

Customer will use reasonable measures to protect privileged credentials and will promptly notify SA Applied of known or suspected compromise relevant to the Customer Environment.

9.3 SA Applied Credentials

SA Applied is responsible for exercising reasonable care with credentials under SA Applied’s control.

Customer is not responsible merely because a security incident results from SA Applied’s failure to exercise reasonable care in protecting credentials under SA Applied’s exclusive control.

9.4 Credential Transition

Upon termination or transition, SA Applied will reasonably cooperate in transferring or relinquishing Customer-dedicated credentials and administrative authority in accordance with Section 13.

SA Applied is not required to disclose internal SA Applied credentials or credentials that provide access to systems or resources belonging to SA Applied or other customers.

10. Customer Data

10.1 Customer Data

As between Customer and SA Applied, Customer retains its rights in data, content, records, databases, files, configurations, and other information supplied by or maintained specifically for Customer (“Customer Data”), subject to third-party rights and the Agreement.

SA Applied may access and process Customer Data as reasonably necessary to provide the Managed Services and as otherwise permitted by the Agreement.

10.2 Customer Responsibility for Data

Customer is responsible for the legality of Customer Data and for obtaining any rights, notices, consents, or authorizations necessary for Customer’s collection and use of Customer Data and SA Applied’s processing of it on Customer’s behalf.

10.3 Personal Data

Where SA Applied processes personal data on Customer’s behalf and the Data Processing Addendum applies, such processing is also governed by the Data Processing Addendum.

SA Applied’s general website or business Privacy Policy does not govern Customer’s independent collection or use of Customer Data merely because SA Applied provides Managed Services relating to the system in which that data is stored or processed.

11. Customer Responsibilities and Cooperation

Customer will reasonably cooperate with SA Applied in providing the Managed Services, including by:

(a) providing timely access to systems, accounts, personnel, information, credentials, approvals, and resources reasonably required for the Managed Services;

(b) providing accurate information concerning Customer’s requirements and environment;

(c) identifying material legal, regulatory, security, operational, retention, or compliance requirements applicable to Customer;

(d) making qualified personnel reasonably available when Customer decisions or actions are required;

(e) maintaining licenses, subscriptions, permissions, and third-party relationships for Customer-purchased services;

(f) using reasonable measures to protect Customer-controlled systems and credentials; and

(g) promptly communicating material changes to Customer’s systems or requirements that may affect the Managed Services.

SA Applied is not responsible for delay, failure, increased cost, or other consequences to the extent caused by Customer’s failure to satisfy a dependency or responsibility reasonably necessary for SA Applied’s performance.

Additional work caused by such failure may be separately chargeable.

12. Suspension

12.1 General Suspension

SA Applied may suspend Managed Services as permitted by the Master Terms, including for nonpayment, security threats, unlawful activity, material breach, or circumstances creating unreasonable risk to SA Applied, Customer, Providers, other customers, or affected systems.

12.2 Suspension of Active Resources

Where Customer fails to pay amounts required to maintain or operate a Customer Environment, SA Applied may, after any applicable notice or cure period, stop, suspend, scale down, disable, or otherwise limit active resources to reduce or halt continuing charges.

This may result in websites, applications, servers, APIs, databases, integrations, or other services becoming unavailable.

Suspension of active resources does not by itself terminate Customer’s rights in its Customer Environment or Customer Data.

12.3 Data During Suspension

Where reasonably practicable, SA Applied will use commercially reasonable measures to preserve available Customer Data during an applicable suspension, retention, or transition period, subject to:

(a) backup and retention services actually purchased by Customer;

(b) the condition and availability of Customer Data and backups;

(c) Provider capabilities and restrictions;

(d) technical limitations;

(e) continuing storage or retention costs; and

(f) Customer’s cooperation.

Nothing in this Section constitutes a guarantee that Customer Data will always be recoverable or preserved.

12.4 Continuing Charges

Suspension does not eliminate charges for resources, storage, backups, licenses, reservations, commitments, or other services that continue to incur costs.

Customer remains responsible for such charges until the applicable resources are transferred, terminated, released, deleted, or otherwise cease generating charges.

12.5 Relinquishment of Responsibility

SA Applied is not required to continue operating, funding, or administering a Customer Environment indefinitely following suspension or termination.

Following the applicable notice, cure, retention, and transition periods, SA Applied may cease management of the Customer Environment and relinquish its administrative responsibilities in accordance with Section 13 and the Master Terms.

13. Termination, Transition, and Offboarding

13.1 Transition Period

Unless an Order provides otherwise or the parties agree to another period, Customer will have 30 days following the effective termination of the applicable Managed Services to reasonably cooperate with SA Applied in transitioning the affected Customer Environment (the “Transition Period”).

The parties may extend the Transition Period by agreement.

Continued Managed Services, infrastructure, consumption, storage, Provider services, and other resources used during the Transition Period remain chargeable as applicable.

13.2 Transition Method

The appropriate method of transitioning a Customer Environment depends upon the architecture, hosting arrangement, Providers, technology, licensing, Customer Resources, SA Applied Technology, and technical options existing at the time of transition.

Where ordinary transfer of Customer-dedicated accounts, credentials, or administrative authority is reasonably sufficient, SA Applied may use that method.

Where the Customer Environment is operated using SA Applied-controlled infrastructure, appliances, shared systems, internal deployment resources, or another arrangement that cannot reasonably be transferred in its existing form, the parties will identify in writing, at or before the effective termination of the applicable Managed Services, a commercially reasonable method for providing Customer with the Customer Resources to which Customer is entitled.

The transition method may include, as appropriate, account transfer, credential handoff, repository access or copies, database or data exports, backups, machine or virtual-machine images, container images, configuration information, deployment artifacts, or another technically reasonable form.

Unless expressly agreed otherwise, SA Applied is not required to transfer SA Applied-owned infrastructure, appliances, shared platforms, internal systems, or SA Applied Technology merely because they were used to provide the Managed Services.

13.3 Ordinary Offboarding Cooperation

As part of ordinary offboarding, SA Applied will provide reasonable cooperation necessary to relinquish its administrative role and make Customer-controlled resources reasonably available to Customer or Customer’s replacement provider.

Ordinary offboarding may include, as applicable:

(a) providing existing Customer-dedicated credentials;

(b) changing administrative contacts;

(c) removing SA Applied administrative access;

(d) releasing or transferring Customer-dedicated accounts from SA Applied-controlled organizational structures;

(e) providing access to Customer repositories or Customer Data already maintained for Customer; and

(f) reasonably cooperating with standard Provider account-transfer procedures.

13.4 Additional Transition Services

Migration, rearchitecture, conversion, reconstruction, substantial data export or transformation, deployment modification, documentation creation, code modification, environment redesign, compatibility work, custom transfer tooling, creation of replacement infrastructure, or other material work beyond ordinary offboarding may constitute additional Professional Services or Managed Services and may be separately chargeable.

The fact that additional work is necessary to place Customer Resources into a form usable by Customer or a replacement provider does not make such work part of ordinary offboarding unless otherwise agreed.

13.5 Payment and Transfer

SA Applied may require payment of undisputed past-due amounts directly attributable to the affected Customer Environment, applicable third-party or consumption charges, and agreed or reasonably anticipated transition charges before undertaking material transition work or advancing additional costs.

SA Applied will not withhold a Customer Environment solely as security for an unrelated disputed obligation where Customer has paid the amounts necessary to maintain and transition that Customer Environment, except to the extent otherwise permitted by law and the Master Terms.

Nothing in this Section waives SA Applied’s right to pursue unpaid amounts through other remedies available under the Agreement or law.

13.6 Customer Failure to Complete Transition

Customer is responsible for timely cooperating with transition and for identifying where or how Customer Resources should be provided or transferred when Customer input is reasonably necessary.

If Customer fails to complete transition during the Transition Period, SA Applied may cease active management and may take commercially reasonable steps to stop resources that continue generating costs.

SA Applied may continue preserving available Customer Data for an additional reasonable period where commercially and technically practicable, subject to applicable storage, backup, Provider, and other charges.

SA Applied is not obligated to maintain an abandoned Customer Environment indefinitely.

13.7 Disposition After Retention Period

Before deleting Customer Data or terminating a Customer-controlled resource following expiration of applicable transition and retention periods, SA Applied will use reasonable efforts to provide Customer with notice where practicable and legally permitted.

Deletion, termination, or release of resources remains subject to applicable Provider Terms, legal requirements, purchased retention services, technical feasibility, and the Master Terms.

14. Customer Resources and SA Applied Technology

14.1 Customer Resources

For purposes of transition, “Customer Resources” means Customer’s Customer Environment, Customer Data, Customer Materials, Customer-specific configurations, and other resources that Customer owns or is entitled to control under the Agreement.

Customer Resources do not include SA Applied Technology merely because SA Applied Technology is used within, deployed to, stored with, or technically accessible from a Customer Environment.

14.2 SA Applied Technology

“SA Applied Technology” includes technology owned, developed, acquired, or licensed by SA Applied independently of Customer-specific ownership rights, including reusable or general-purpose software, libraries, frameworks, modules, APIs, utilities, scripts, infrastructure templates, deployment systems, automation, management tools, methodologies, processes, know-how, techniques, generalized improvements, and other reusable technology.

SA Applied Technology may include technology developed or improved while providing services to Customer if the technology is reusable or of general applicability and is not designated as Customer-owned work product in an applicable SOW.

14.3 No Implied Transfer of SA Applied Technology

Transfer of a Customer Environment, repository, configuration, deployment, account, backup, image, artifact, or other Customer Resource does not assign ownership of SA Applied Technology contained in or used with that Customer Resource.

Where Customer receives a copy of SA Applied Technology embedded in or reasonably necessary to operate a Customer deliverable, Customer’s rights in that technology are governed by the Master Terms, the Professional Services Addendum, and any applicable SOW.

Possession of source code, object code, container images, compiled artifacts, infrastructure definitions, repositories, backups, or other copies does not by itself transfer intellectual-property ownership.

14.4 Internal SA Applied Systems

SA Applied is not required to transfer internal systems, multi-customer systems, SA Applied-owned appliances, internal repositories, deployment infrastructure, management platforms, credentials, documentation, tooling, or other resources used by SA Applied to serve multiple customers or operate its business.

Where such systems contain Customer Data or Customer-specific material that Customer is otherwise entitled to receive, SA Applied may provide the applicable Customer material separately rather than transferring the underlying SA Applied system.

15. Repositories, Code, and Deployment Resources

Where SA Applied maintains a repository or deployment resource specifically for Customer, Customer may receive access to or a copy of Customer-owned or Customer-licensed material in that resource as part of transition, subject to applicable intellectual-property rights.

A repository may contain:

(a) Customer Materials;

(b) Customer-specific work product;

(c) SA Applied Technology;

(d) open-source software; and

(e) third-party software.

Transfer or copying of a repository does not alter the ownership or licensing status of its contents.

SA Applied may remove credentials, secrets, material belonging to other customers, internal administrative information, or other content Customer is not entitled to receive before providing a repository or copy.

16. Relationship to Professional Services

Managed Services may involve routine implementation, configuration, deployment, or modification work incidental to ongoing management.

A substantial implementation, development project, migration, integration, customization, architecture project, or other project-based engagement may be governed by the Professional Services Addendum and an applicable SOW in addition to this Addendum.

The fact that Professional Services create or modify part of a Customer Environment does not change the ownership or administrative principles established by this Addendum except as expressly stated in the applicable SOW.

17. Relationship to Other Agreement Documents

This Addendum supplements and forms part of the Agreement.

The Master Terms govern matters of general applicability, including payment, taxes, confidentiality, general intellectual-property rights, warranties and disclaimers, limitations of liability, indemnification, electronic contracting, amendments, notices, dispute resolution, and general termination provisions except to the extent expressly addressed differently in this Addendum.

The applicable Order and related written service descriptions identify the Managed Services purchased and any included monitoring, maintenance, backup, recovery, security, support, service-level, compliance, or other functions.

The Data Processing Addendum governs SA Applied’s processing of covered personal data on Customer’s behalf to the extent applicable.

The Third-Party Services Addendum applies separately to Third-Party Services procured or resold to Customer by SA Applied.

The Professional Services Addendum applies separately to project-based Professional Services.

In the event of a conflict, the order-of-precedence provisions of the Master Terms apply.

18. No Expansion of Scope by Access or Capability

SA Applied’s possession of administrative credentials, technical access, tooling, knowledge, permissions, or the technical capability to perform an action does not, by itself, create an obligation to monitor, maintain, secure, back up, restore, modify, investigate, or otherwise manage a system or function outside the Managed Services identified in the applicable service scope.

Customer’s purchase of Managed Services does not make SA Applied responsible for all technology used by Customer or for all risks associated with Customer’s business, systems, data, users, or third-party providers.