Version: 4.0 | Last Updated: March 26, 2026

OpenControls, a d/b/a of MoxyWolf LLC ("OpenControls" or "MoxyWolf," "we," or "us"), a Nevada limited liability company with its principal place of business at 10001 Park Run Drive, Las Vegas, NV 89145, operates and administers the Platform (defined below).

This MoxyWolf Partner Agreement ("Agreement") constitutes a contract between OpenControls and the entity completing Stripe onboarding and accepting this Agreement ("Partner," "You," or "Your"). OpenControls and Partner are each a "Party" and collectively the "Parties."

By clicking "I Accept," by completing OpenControls' Stripe onboarding flow, or by accessing Partner-designated features of the Platform, You agree to this Agreement, including the mandatory arbitration provision in Section 11 and all Exhibits incorporated herein. If You do not agree to this Agreement, do not complete Stripe onboarding or use the Platform as a Partner. The Effective Date of this Agreement is the date You first accept this Agreement through any of the foregoing means.

Recitals

OpenControls operates SAMS (the "Platform"), a subscription-based software platform built on MoxyWolf's STIGViewer® and RegGenome® infrastructure, providing cybersecurity compliance, GRC, SecOps, AI governance, and related data services.

Partner desires to resell access to the Platform to its customers and, where applicable, to embed and distribute Federated Linked Data within Partner's own software platform or service. OpenControls desires to authorize Partner to do so, subject to the terms of this Agreement and the Exhibits attached hereto.

This Agreement consists of the following components: this Master Agreement; Exhibit A (VAR Schedule), which is incorporated upon Your acceptance of this Agreement; and Exhibit B (Data Integration Schedule), which is incorporated upon Your acceptance of this Agreement if You select Data Integration access during Stripe onboarding. Your obligations and rights under each Exhibit are activated upon incorporation of the applicable Exhibit. The terms of this Agreement and all Exhibits are standardized and non-negotiable. By accepting this Agreement, You accept all applicable terms as written.

1. Definitions

Terms not otherwise defined herein have the meanings set forth in the MoxyWolf Federated Platform Participation Agreement ("FPPA"), available at FPPA, which is incorporated by reference.

"Application Fee" means the portion of each Customer payment that is automatically transferred to OpenControls by Stripe at the time of each transaction, as set by OpenControls programmatically on each Charge. The Application Fee is calculated as the total Customer payment less the Partner Commission.
"Attribution Tag" means the machine-readable metadata embedded in each item of FLD identifying the Original Author, Contributor, and applicable license terms, as defined by https://grcschema.org/contributor and https://grcschema.org/thing/License.
"Charge" means a payment transaction initiated on Partner's Stripe Connected Account when a Customer purchases a Platform subscription.
"Consumer Account" has the meaning set forth in the FPPA: an authenticated, active account held by a Customer with OpenControls that confers the right to access FLD through the Platform or through the Partner Platform, and which is subject to an active, paid subscription in good standing.
"Customer" means any end customer that holds an active Consumer Account and that purchases or receives access to the Platform through Partner pursuant to this Agreement.
"Customer Agreement" means the then-current FPPA, which governs each Customer's use of the Platform and FLD.
"Data Integration Schedule" means Exhibit B to this Agreement, governing Partner's rights to embed and distribute FLD within the Partner Platform.
"FLD" or "Federated Linked Data" has the meaning set forth in the FPPA.
"Federation Layer" means OpenControls' proprietary structuring, interlinking, parsing, indexing, attribution tagging, and value-added organization applied to FLD, which constitutes original intellectual property of OpenControls regardless of the underlying FLD's public domain status.
"Marks" means the trademarks, service marks, trade names, and logos of a Party, including OpenControls' registered marks: MoxyWolf®, STIGViewer®, and RegGenome®.
"NFR License" means a complimentary Platform subscription provided to Partner for internal evaluation, demonstration, and training purposes only — not for resale.
"Partner Commission" means the portion of each Customer payment that remains in Partner's Stripe Connected Account after the Application Fee is transferred to OpenControls, equal to thirty percent (30%) of the gross Charge amount, as set by OpenControls via Stripe on each transaction.
"Partner Platform" means the software platform, application, or service operated by Partner, as described in Exhibit B, through which Partner distributes FLD to Customers where Exhibit B is active.
"Platform" means OpenControls' SAMS subscription platform, operating on MoxyWolf's STIGViewer® and RegGenome® infrastructure and associated APIs, FLD, and services, as updated from time to time.
"Provisioning Signal" means the API-delivered verification issued by OpenControls to Partner confirming that a specific Customer holds an active Consumer Account and is authorized to receive FLD through the Partner Platform.
"Relationship Owner" means the Party responsible for the commercial, support, and renewal relationship with a given Customer, as determined under Section 3.
"Stripe" means Stripe, Inc., the third-party payment processing platform used by OpenControls to process all Customer payments under this Agreement.
"Stripe Connected Account" means the Standard Stripe account created by Partner through OpenControls' onboarding flow, through which all Customer payments are processed and Partner Commissions are deposited.
"VAR Schedule" means Exhibit A to this Agreement, governing Partner's rights to resell access to the Platform.

2. Partner Authorization

(a) Authorization. Subject to the terms of this Agreement and the applicable Exhibits, OpenControls authorizes Partner to: (i) resell access to the Platform to Customers pursuant to Exhibit A; and (ii) where Exhibit B is incorporated, embed and distribute FLD within the Partner Platform pursuant to Exhibit B.

(b) Non-Exclusive. All authorizations granted under this Agreement are non-exclusive. OpenControls may sell the Platform directly, appoint additional partners, and engage with any customer or prospect without restriction.

(c) No Agency. Partner is an independent contractor. Nothing in this Agreement creates an agency, partnership, joint venture, or employment relationship. Partner has no authority to bind OpenControls to any obligation.

(d) Exhibit Activation. Exhibit A is incorporated upon Your acceptance of this Agreement. Exhibit B is incorporated upon Your acceptance of this Agreement if You select Data Integration access during Stripe onboarding. Once incorporated, each Exhibit remains in effect for the Term unless terminated in accordance with its own terms.

3. Customer Relationship Ownership

(a) Partner-Sourced Customers. For any Customer that Partner introduces to the Platform through Partner's own sales efforts, Partner is the Relationship Owner for that Customer. As Relationship Owner, Partner is responsible for: (i) all commercial terms, pricing, and subscription management between Partner and that Customer; (ii) first-level customer support, account management, and renewal engagement; (iii) ensuring the Customer accepts the Customer Agreement (FPPA) prior to accessing the Platform; (iv) notifying OpenControls promptly, and in any event within five (5) business days, of any Customer cancellation, non-renewal, or material breach of the Customer Agreement; and (v) where Exhibit B is active, cooperating with OpenControls to ensure timely deprovisioning of FLD access for any Customer whose Consumer Account has lapsed, been cancelled, or been terminated.

(b) OpenControls Direct Customers. For any Customer that engages OpenControls directly, OpenControls is the Relationship Owner. OpenControls has no obligation to involve Partner in the management of direct customer relationships.

(c) Disputes. If the Parties dispute Relationship Ownership for a particular Customer, the Parties will resolve the dispute through the deal registration process in Exhibit A. In the absence of a registered deal, OpenControls' determination is final.

(d) FPPA Primacy. Regardless of Relationship Ownership, each Customer's use of the Platform and FLD is governed by the Customer Agreement (FPPA). Partner may not grant Customers any rights that exceed or conflict with the Customer Agreement.

4. Customer Agreement Compliance and Account-Scoped Access

(a) Customer Agreement Requirement. Partner must ensure that each Customer accepts the then-current Customer Agreement (FPPA) before accessing the Platform or receiving FLD through the Partner Platform. OpenControls will provide Partner with the current version of the Customer Agreement and will notify Partner of material updates with reasonable advance notice.

(b) Partner Responsibility. Partner is responsible for: (i) maintaining accurate records of Customer Agreement acceptance; (ii) providing accurate Customer information to OpenControls at subscription registration; and (iii) notifying OpenControls promptly, and in any event within five (5) business days, if Partner becomes aware of any Customer breach of the Customer Agreement.

(c) Provisioning Condition. Partner may not provision FLD access for any Customer unless and until OpenControls has issued a Provisioning Signal for that Customer's Consumer Account. Partner shall implement and maintain the technical mechanisms necessary to receive and act on Provisioning Signals from the OpenControls API.

(d) Ongoing Account Condition. Partner's right to deliver FLD to any Customer is at all times conditional on that Customer's Consumer Account remaining active and in good standing with OpenControls. If OpenControls revokes or suspends a Consumer Account, OpenControls will issue a revocation signal to Partner via the API, and Partner's right to deliver FLD to that Customer terminates immediately upon receipt.

(e) Deprovisioning Obligation. When a Customer's Consumer Account lapses, is cancelled, or is terminated, OpenControls will notify Partner via the API. Partner must deprovision FLD access for that Customer no later than the end of that Customer's then-current billing cycle as recorded by OpenControls. Partner must not restore FLD access for a deprovisioned Customer unless and until a new valid Provisioning Signal has been received from OpenControls.

(f) Partner Liability for Unauthorized Delivery. If Partner delivers FLD to any Customer who does not hold an active Consumer Account, such delivery constitutes a material breach of this Agreement.

5. Intellectual Property

(a) OpenControls Ownership. OpenControls owns all right, title, and interest in: (i) the Platform and all technology, software, systems, and infrastructure therefor; (ii) the Federation Layer; and (iii) all OpenControls Marks. Nothing in this Agreement transfers any ownership interest to Partner.

(b) Contributor Ownership. Proprietary Contributions remain the property of the applicable Contributor. FLD rights flow to Partner solely through the license grants in the FPPA and, where applicable, Exhibit B.

(c) Partner Ownership. Partner retains ownership of the Partner Platform and all Partner intellectual property, excluding any FLD or Federation Layer components incorporated therein.

(d) Marks License. OpenControls grants Partner a limited, non-exclusive, non-transferable, revocable license to use OpenControls' Marks solely to market and promote the Platform during the Term, in accordance with OpenControls' then-current brand guidelines. All goodwill generated through Partner's use of OpenControls' Marks inures solely to OpenControls.

(e) Feedback. If Partner provides OpenControls with feedback or suggestions regarding the Platform, OpenControls may use such feedback for any purpose without obligation to Partner.

6. Representations and Warranties

(a) Mutual. Each Party represents and warrants that: (i) it is duly organized, validly existing, and in good standing; (ii) it has full authority to enter into and perform this Agreement; and (iii) this Agreement constitutes a valid, binding, and enforceable obligation.

(b) Partner. Partner further represents and warrants that: (i) it will comply with all applicable laws, including export control laws and Stripe's then-current terms of service; (ii) it will not make representations about the Platform inconsistent with OpenControls' official documentation; and (iii) it has obtained and will maintain all licenses and authorizations required to conduct its business.

(c) OpenControls Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, OPENCONTROLS MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, OR NON-INFRINGEMENT. THE PLATFORM AND FLD ARE PROVIDED "AS IS" AND "AS AVAILABLE."

7. Confidentiality

(a) Confidential Information. Each Party may disclose to the other certain confidential or proprietary information ("Confidential Information"), including pricing, business plans, customer data, technical information, and the terms of this Agreement.

(b) Obligations. Each receiving Party agrees to: (i) hold the disclosing Party's Confidential Information in strict confidence; (ii) not disclose it to any third party without prior written consent, except to employees or representatives with a need to know who are bound by obligations at least as protective as those herein; and (iii) use it only to perform obligations or exercise rights under this Agreement.

(c) Exceptions. Obligations do not apply to information that: (i) is or becomes publicly available through no fault of the receiving Party; (ii) was known to the receiving Party prior to disclosure; (iii) is independently developed without use of Confidential Information; or (iv) must be disclosed by law or court order, with prompt advance notice where permitted.

(d) Duration. Confidentiality obligations survive termination for three (3) years.

8. Indemnification

(a) Partner Indemnification. Partner will indemnify, defend, and hold harmless OpenControls and its officers, directors, agents, partners, and employees (the "OpenControls Parties") from and against any losses, liabilities, claims, demands, damages, expenses, or costs ("Claims") arising out of or related to: (i) Partner's breach of this Agreement or any Exhibit; (ii) Partner's representations about the Platform inconsistent with OpenControls' official documentation; (iii) Partner's failure to ensure Customer acceptance of the Customer Agreement; (iv) any Customer claim arising from Partner's conduct as Relationship Owner; or (v) Partner's violation of applicable law or Stripe's terms of service.

(b) OpenControls Indemnification. OpenControls will indemnify, defend, and hold harmless Partner and its officers, directors, agents, partners, and employees from and against Claims arising out of any allegation that the Platform or FLD, as provided by OpenControls and used by Partner in strict accordance with this Agreement: (i) infringes any third-party intellectual property right; or (ii) contains a material defect that causes demonstrable harm to Partner or its Customers. For the avoidance of doubt, the indemnification obligation under clause (ii) applies only to material defects in the Platform or FLD as delivered by OpenControls and does not extend to fitness for a particular purpose, merchantability, or any other warranty, all of which are disclaimed under Section 6(c). OpenControls' obligations under this Section do not apply to Claims arising from: (A) Partner's modification of FLD or the Platform; (B) use in combination with third-party products not approved by OpenControls; or (C) Partner's breach of this Agreement.

(c) Procedure. The indemnified Party will: (i) provide prompt written notice of any Claim; (ii) grant the indemnifying Party sole control of defense and settlement; and (iii) provide reasonable cooperation.

9. Limitation of Liability

(a) Exclusion. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, PUNITIVE, OR SPECIAL DAMAGES OR LOST PROFITS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

(b) Cap. EACH PARTY'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, REGARDLESS OF FORM OF ACTION, WILL NOT EXCEED THE TOTAL FEES PAID BY OR THROUGH PARTNER TO OPENCONTROLS IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE CLAIM.

(c) Exceptions. The limitations in this Section do not apply to: (i) either Party's indemnification obligations; (ii) either Party's liability for gross negligence, fraud, or willful misconduct; or (iii) liability that cannot be excluded or limited under applicable law.

10. Term and Termination

(a) Term. This Agreement commences on the Effective Date and continues for one (1) year (the "Initial Term"). It automatically renews for successive one-year terms unless either Party provides written notice of non-renewal at least sixty (60) days prior to the end of the then-current term. The Effective Date is the date Partner first accepts this Agreement by clicking "I Accept," completing Stripe onboarding, or accessing Partner-designated features of the Platform.

(b) Termination for Cause. Either Party may terminate this Agreement immediately upon written notice if the other Party: (i) materially breaches this Agreement and fails to cure within thirty (30) days of written notice; (ii) becomes insolvent or subject to bankruptcy proceedings; or (iii) ceases to conduct business in the ordinary course.

(c) Termination for Convenience. Either Party may terminate this Agreement for any reason upon sixty (60) days' prior written notice.

(d) Effect of Termination. Upon termination or expiration: (i) all Partner authorizations immediately cease; (ii) Partner's Stripe Connected Account continues to exist but OpenControls will cease routing new Customer transactions through it; (iii) NFR Licenses terminate immediately; (iv) Partner shall cease use of OpenControls' Marks and return or destroy OpenControls' Confidential Information upon request; (v) all outstanding amounts owed to OpenControls become immediately due and payable; and (vi) in-term Customer subscriptions in Partner's book continue under the Customer Agreement, with OpenControls assuming direct responsibility for those Customers.

(e) Survival. Sections 1, 5(a)–5(c), 6(c), 7, 8, 9, 10(d), 10(e), 11, and 12 survive termination or expiration.

11. Dispute Resolution; Binding Arbitration

(a) Informal Resolution. The Parties will first attempt to resolve disputes informally by escalating to senior representatives and negotiating in good faith for thirty (30) days following written notice of a dispute before initiating arbitration.

(b) Binding Arbitration. If informal resolution fails, either Party may submit the dispute to binding arbitration administered by JAMS under the JAMS Streamlined Arbitration Rules and Procedures, as then in effect. All proceedings will be held in Clark County, Nevada, conducted on an individual basis before a single arbitrator. There are no class proceedings.

(c) Governing Law. This Agreement is governed by the laws of the State of Nevada, without regard to conflict of law principles. Disputes not subject to arbitration will be resolved exclusively in the state or federal courts sitting in Clark County, Nevada, to which each Party irrevocably consents.

12. General Provisions

(a) Entire Agreement. This Agreement and its Exhibits constitute the entire agreement between the Parties regarding their subject matter and supersede all prior agreements. In the event of conflict between this Master Agreement and any Exhibit, this Master Agreement controls unless the Exhibit expressly states otherwise.

(b) Amendments. OpenControls may make changes to this Agreement from time to time. If we make changes, we will provide You with notice of such changes, such as by sending an email to the address associated with Your Stripe Connected Account, providing a notice through the Platform, or updating the date at the top of this Agreement. Unless we say otherwise in our notice, the amended Agreement will be effective immediately, and Your continued use of the Platform after we provide such notice will confirm Your acceptance of the changes. If You do not agree to the amended Agreement, You must stop using the Platform, subject to any payment obligations and Customer transition requirements under Sections 8 and 10(d). OpenControls' updates to the FPPA do not require Partner's consent but will be communicated with reasonable advance notice.

(c) Assignment. Partner may not assign or transfer this Agreement without OpenControls' prior written consent. OpenControls may assign in connection with a merger, acquisition, or asset sale. Attempted assignments in violation of this Section are void.

(d) Notices. All notices must be in writing, delivered by email with confirmation of receipt, overnight courier, or certified mail, return receipt requested, to the addresses in Section 13.

(e) Waiver; Severability. Failure to enforce any provision is not a waiver of future enforcement. If any provision is held invalid or unenforceable, the remaining provisions continue in full force.

(f) Force Majeure. Neither Party shall be liable to the other for any failure or delay in performing its obligations under this Agreement (other than payment obligations) to the extent that such failure or delay results from circumstances beyond the affected Party's reasonable control, including but not limited to acts of God, natural disasters, pandemics, epidemics, war, terrorism, riots, embargoes, acts of civil or military authorities, fire, floods, earthquakes, power outages, internet or telecommunications failures, cyberattacks, Stripe platform outages, sanctions, or government actions (each, a "Force Majeure Event"). The affected Party shall provide prompt written notice to the other Party of the Force Majeure Event and shall use commercially reasonable efforts to mitigate the effects of such event. If a Force Majeure Event continues for more than sixty (60) consecutive days, either Party may terminate this Agreement upon written notice to the other Party.

13. Notices

Party	Contact
OpenControls / MoxyWolf LLC	10001 Park Run Drive, Las Vegas, NV 89145 · Attn: Legal Department · Email: info@moxywolf.com · Legal Counsel: Marquis Aurbach
Partner	The legal name, address, and email address associated with Partner's Stripe Connected Account, as updated by Partner from time to time

EXHIBIT A — VAR SCHEDULE

Applicable to: All Partners. Exhibit A is incorporated upon Your acceptance of this Agreement.

A-1. Resale Authorization

(a) Subject to the Master Agreement and this Exhibit, OpenControls authorizes Partner to resell Platform subscriptions to Customers within the Territory specified in Section A-9 (Commercial Terms).

(b) Partner may bundle the Platform with Partner's own value-added services, provided Partner clearly identifies OpenControls' Platform as a distinct component. Partner may not represent the Platform as Partner's own product.

(c) Partner may set its own resale pricing to Customers. OpenControls does not control Partner's resale margin. OpenControls is not a party to the commercial arrangement between Partner and Customer with respect to resale pricing.

A-2. Stripe Onboarding and Connected Account

(a) Required Onboarding. To receive Partner Commissions, Partner must complete OpenControls' Stripe onboarding flow and establish a Stripe Connected Account (Standard account). Partner will be directed to Stripe's hosted onboarding interface, where Stripe will conduct KYC verification, identity verification, and all applicable compliance and risk checks directly with Partner. OpenControls has no responsibility for and bears no liability in connection with Stripe's onboarding, verification, or approval process.

(b) Partner's Stripe Relationship. Partner's Stripe Connected Account is governed by Stripe's then-current Connected Account Agreement and Stripe's terms of service, to which Partner agrees directly with Stripe as a condition of onboarding. Partner is solely responsible for maintaining its Stripe Connected Account in good standing, including compliance with Stripe's terms, accurate account information, and all applicable regulatory requirements.

(c) OpenControls' Stripe Controls. OpenControls sets the Application Fee programmatically on each Charge processed through Partner's Stripe Connected Account. OpenControls controls the product catalog, subscription plans, and pricing available through the Platform. Partner acknowledges that OpenControls' ability to set the Application Fee is a material condition of this Agreement and that Partner may not circumvent, modify, or interfere with OpenControls' Application Fee configuration.

(d) Partner Dashboard. Partner will have full access to its own Stripe dashboard, through which Partner can view its transaction history, manage its payout schedule to its bank account, and handle refunds for Partner-sourced Customers. OpenControls does not have access to Partner's bank account or payout settings.

A-3. Payment Mechanics and Revenue Split

(a) Direct Charge Model. All Customer payments for Platform subscriptions sold through Partner are processed as direct charges on Partner's Stripe Connected Account. When a Customer pays for a subscription, the full payment amount lands on Partner's Stripe Connected Account. Stripe's processing fees are deducted from Partner's portion of each Charge.

(b) Application Fee. On each Charge, OpenControls automatically transfers the Application Fee to OpenControls' Stripe account. The Application Fee is calculated as the gross Charge amount less the Partner Commission (30%). OpenControls sets the Application Fee programmatically on each transaction; no manual transfer or reconciliation by either Party is required for this step.

(c) Partner Commission. Partner's Commission on each Charge is thirty percent (30%) of the gross Charge amount, net of Stripe processing fees, which are deducted from Partner's side. By way of illustration only (not indicative of actual pricing):

Example Charge	Stripe Processing Fee (est.)	Application Fee to OpenControls	Partner Net
$100.00	~$3.20 (from Partner's portion)	$70.00	~$26.80
$200.00	~$6.10 (from Partner's portion)	$140.00	~$53.90

The actual Stripe processing fee will vary based on Stripe's then-current fee schedule and transaction characteristics. OpenControls makes no representation as to the exact Stripe processing fee applicable to any Charge.

(d) No Invoice-Based Payments. There are no wholesale invoices issued by OpenControls to Partner for Customer subscriptions sold under this Exhibit A. Partner's compensation is derived entirely from the Partner Commission retained on each Charge through the Stripe direct-charge mechanism. Partner is not required to remit any amounts to OpenControls; the Application Fee is transferred automatically by Stripe on each transaction.

(e) Quarterly Billing Only (V1). The initial version of the Platform under this Agreement supports quarterly billing cycles only. Monthly and annual billing options may be made available in future versions at OpenControls' discretion, upon written notice to Partner.

A-4. Customer Onboarding

(a) Partner must ensure each Customer accepts the Customer Agreement (FPPA) before accessing the Platform. Partner shall provide accurate Customer registration information to OpenControls at the time of each new subscription, including Customer legal name, primary contact, billing address, and subscription tier.

(b) OpenControls will activate each Customer's Consumer Account and issue a Provisioning Signal to Partner upon receipt of required registration information and confirmation of payment. Partner may not grant a Customer access to FLD through the Partner Platform until a valid Provisioning Signal for that Customer has been received. Partner is solely responsible for implementing the technical mechanisms to receive and act on Provisioning Signals.

A-5. Refunds

(a) Partner Refund Authority. Partner may process refunds for Partner-sourced Customers directly through Partner's Stripe dashboard without prior approval from OpenControls, subject to the limitations set forth in this Section A-5.

(b) Application Fee Handling on Refund. When a refund is processed on a Charge, Stripe does not automatically return the Application Fee to Partner. OpenControls retains discretion to return, absorb, or otherwise handle the Application Fee portion of any refunded Charge on a case-by-case basis. OpenControls will exercise this discretion reasonably and communicate its determination to Partner within ten (10) business days of the refund.

(c) No Claw-Back from OpenControls. Partner will not be required to remit any amount to OpenControls in connection with a Customer refund. Refund adjustments to OpenControls' downstream obligations (including any data contributor royalties) are handled internally by OpenControls and are not Partner's responsibility.

(d) Direct SAMS Customers. For Customers who purchased directly through the Platform without a VAR, OpenControls handles all refunds under its standard refund process. This Section A-5 applies only to Partner-sourced Customers.

A-6. Deal Registration

(a) Partner may register prospective Customer opportunities with OpenControls to establish Relationship Ownership. Registration requires: (i) prospective Customer legal name and primary contact; (ii) anticipated subscription tier and volume; (iii) anticipated close date; and (iv) a brief description of Partner's engagement.

(b) OpenControls will respond within five (5) business days. Approved registrations establish Relationship Ownership for the registered prospect for ninety (90) days, renewable upon request with demonstrated active engagement.

(c) Deal registration does not create exclusivity. OpenControls may engage registered prospects directly with notice to Partner.

A-7. Renewals and Cancellations

(a) Partner is responsible for managing renewals for Customers in Partner's book. OpenControls will provide Partner with renewal reminders no less than sixty (60) days prior to each Customer's renewal date.

(b) Partner shall notify OpenControls of any Customer cancellation within five (5) business days. Cancellation does not relieve the Customer of payment obligations for the remainder of the then-current Subscription Cycle, and any Charges already processed in that cycle are final.

(c) If a Customer subscription in Partner's book lapses without renewal within thirty (30) days of expiration, OpenControls reserves the right to assume direct Relationship Ownership for that Customer.

A-8. Not-for-Resale Licenses

(a) OpenControls will provide Partner with the number of NFR Licenses specified in Section A-9. NFR Licenses are for Partner's internal evaluation, demonstration, and personnel training only. They may not be used for production, resale, or any commercial purpose other than pre-sales activities.

(b) NFR Licenses terminate automatically upon termination or expiration of this Agreement and may be revoked by OpenControls at any time upon written notice.

A-9. VAR Commercial Terms

Term	Detail
Territory	Worldwide, non-exclusive
Partner Commission	30% of gross Charge amount (retained via Stripe; Stripe processing fees deducted from Partner's portion)
Application Fee	70% of gross Charge amount (transferred automatically to OpenControls via Stripe on each transaction)
Billing Cycle (V1)	Quarterly only
NFR Licenses	Two (2) licenses
Price Change Notice to Partner	60 days' written notice
Renewal Reminder to Partner	60 days prior to Customer renewal date
Deal Registration Window	90 days, renewable with active engagement
Non-Renewal Notice (Partner)	60 days prior to end of then-current term

EXHIBIT B — DATA INTEGRATION SCHEDULE

For Partners Embedding FLD in Their Own Platform

Applicable to: Partners that, in addition to reselling the Platform under Exhibit A, also embed and distribute FLD within the Partner Platform. Exhibit B is incorporated upon Partner's acceptance of this Agreement if Partner selects Data Integration access during Stripe onboarding.

Fee Structure: The Data Integration License Fee set forth in Section B-9 (Commercial Terms) is the sole fee payable to OpenControls for all rights under this Agreement — data integration rights under this Exhibit B and resale rights under Exhibit A. Where Exhibit B is active, no separate Stripe-based Application Fee / Partner Commission mechanics under Exhibit A apply to transactions originating through the Partner Platform under this Exhibit, unless otherwise specified in writing. OpenControls and Partner will agree separately in writing on how Customer payments are processed for Exhibit B transactions.

B-1. Data Integration License

(a) Nature of License. The license granted under this Exhibit B is a passthrough delivery mechanism, not a grant of independent data rights. Partner's right to access, cache, display, or otherwise deliver FLD to any Customer is entirely conditional on that Customer holding an active Consumer Account in good standing with OpenControls, as verified by a valid Provisioning Signal. Partner acquires no right to hold, use, display, or exploit any FLD independent of an active Consumer Account.

(b) License Grant. Subject to the Master Agreement, this Exhibit, the account-scoped delivery requirements of Section B-5, and payment of all License Fees and applicable Contributor Royalties, OpenControls grants Partner a worldwide, non-exclusive, non-transferable, non-sublicensable license during the Term to:

Access FLD within the Data Scope through the API, solely on behalf of and to deliver to Customers holding active Consumer Accounts;
Reproduce and cache FLD within the Data Scope solely as necessary for efficient delivery to such Customers through the Partner Platform;
Display and present FLD to Customers holding active Consumer Accounts through the Partner Platform;
Create and distribute Adaptations of FLD within the Data Scope to Customers holding active Consumer Accounts, subject to the attribution requirements of Section B-3; and
Incorporate FLD within the Data Scope into Collections distributed to Customers holding active Consumer Accounts through the Partner Platform.

(c) AI and Machine Learning Rights. Partner may: (i) use FLD within the Data Scope to develop or improve Partner's Models; (ii) use FLD as training data to create Trained Models; (iii) make Models and Output available to Customers or third parties, including commercially; and (iv) create Tokenized Data from FLD for these purposes without attribution for Tokenized Data or Trained Models. Any generative AI content containing identifiable FLD must include attribution consistent with Section B-3. AI and machine learning rights under this subsection are not account-scoped and survive deprovisioning of individual Customer Accounts; they apply at the level of FLD that Partner has lawfully accessed under this Agreement during the Term.

(d) No Other Rights. All rights not expressly granted are reserved to OpenControls and applicable Contributors.

B-2. Restrictions

Partner shall not, and shall not permit Customers or any third party to:

Deliver, display, or make FLD accessible to any Customer who does not hold an active Consumer Account verified by an OpenControls Provisioning Signal;
Sublicense, resell, or transfer FLD or API access to any third party except as expressly permitted under Section B-1;
Grant Customers any right to further distribute, sublicense, or redistribute FLD beyond their use within the Partner Platform;
Circumvent, disable, remove, alter, or interfere with any Attribution Tag, access control, or component of OpenControls' Federation Layer;
Represent FLD as Partner's original data or obscure the identity of the Original Author or Contributor;
Aggregate or combine FLD with third-party data in a manner that obscures or eliminates attribution to Original Authors or Contributors;
Distribute FLD together with non-FLD data unless such non-FLD data is in the public domain or available under a Compatible License as defined in the FPPA;
Retain cached FLD for any deprovisioned Customer Account beyond the purposes described in Section B-5(d); or
Access or attempt to access FLD by means other than the API in accordance with the Technical Specifications.

B-3. Attribution

(a) Tag-Based Attribution. Attribution obligations under this Exhibit B are satisfied by preserving Attribution Tags in metadata. Partner is not required to display contributor attribution in the Partner Platform's UI, provided that Attribution Tags remain intact and accessible in the underlying data layer.

(b) Tag Integrity. Partner shall implement and maintain technical measures sufficient to preserve Attribution Tags through all stages of FLD ingestion, transformation, caching, and distribution. Partner shall notify OpenControls within forty-eight (48) hours of any technical failure resulting in loss or corruption of Attribution Tag data.

(c) No Implied Endorsement. Partner shall not use any attribution to imply sponsorship by or endorsement of OpenControls, any Contributor, any Original Author, or any Attribution Party, without prior written permission.

B-4. Customer Terms

(a) Before granting Customers access to FLD through the Partner Platform, Partner shall: (i) confirm receipt of a valid Provisioning Signal from OpenControls for that Customer's Consumer Account; and (ii) ensure each Customer accepts end user terms that, at minimum: (1) prohibit sublicensing or redistribution of FLD beyond the Partner Platform; (2) prohibit tampering with Attribution Tags; (3) bind Customers to restrictions consistent with Consumer-level rights under the FPPA; and (4) notify Customers that their access to FLD is contingent on maintaining an active Consumer Account with OpenControls.

(b) Partner is responsible and liable for Customer compliance with these end user terms and with Consumer-level rights under the FPPA.

B-5. API, Technical Requirements, and Account-Scoped Delivery

(a) OpenControls will provide Partner with API credentials and access to the Technical Specifications upon execution of this Exhibit and payment of the initial License Fee. Partner shall access FLD only through the API in accordance with the Technical Specifications.

(b) Partner shall implement and maintain commercially reasonable security measures to protect FLD from unauthorized access. Partner shall notify OpenControls within forty-eight (48) hours of any actual or suspected unauthorized access to FLD.

(c) Caching. Partner may cache FLD locally for performance, provided that: (i) Partner has received a valid Provisioning Signal for each Customer Account to which the cached FLD corresponds; (ii) cached FLD is refreshed no less frequently than specified in the Technical Specifications; (iii) Attribution Tags are preserved in all cached copies; and (iv) caching is implemented solely to improve performance for active Consumer Accounts and not to circumvent API access controls or deprovisioning obligations.

(d) Account-Scoped Delivery and Deprovisioning.

(i) Provisioning Gate. Partner may not deliver or make accessible any FLD to a Customer through the Partner Platform unless and until a valid Provisioning Signal has been received from OpenControls for that Customer's Consumer Account.
(ii) Deprovisioning Obligation. When OpenControls issues a revocation or lapse signal for a Customer's Consumer Account, Partner must deprovision FLD access for that Customer no later than the end of that Customer's then-current billing cycle as recorded by OpenControls.
(iii) Retained Cached FLD. Following deprovisioning of a Customer Account, Partner may retain cached copies of FLD solely for Partner's own internal audit, compliance, or legal hold purposes. Such retained FLD may not be delivered, displayed, made accessible, or otherwise used for any operational purpose.
(iv) Material Breach. Delivery of FLD to a Customer who does not hold an active Consumer Account constitutes a material breach of this Agreement triggering immediate termination rights under Section B-8(a)(ii).

B-6. Usage Reporting and Audit

(a) Partner shall provide OpenControls with monthly usage reports within ten (10) business days of month-end, detailing: (i) active Customers accessing FLD; (ii) datasets and FLD categories accessed; (iii) API call volume; and (iv) any other metrics reasonably requested by OpenControls.

(b) OpenControls may audit Partner's usage records upon thirty (30) days' written notice, not more than once per calendar year. If an audit reveals underpayment exceeding five percent (5%), Partner shall bear the reasonable cost of the audit.

B-7. License Fees and Contributor Royalties

(a) Partner shall pay OpenControls the License Fee set forth in Section B-9. License Fees are non-refundable.

(b) Where Partner distributes Proprietary Contributions, applicable Contributor Royalties are specified in Section B-9 or communicated separately by OpenControls on behalf of the applicable Contributor. OpenControls administers Contributor Royalty remittance.

(c) Invoices are due within thirty (30) days of invoice date. Late amounts bear interest at 1.5% per month or the maximum lawful rate. OpenControls may adjust License Fees upon ninety (90) days' written notice; adjustments do not apply retroactively.

B-8. Termination of Exhibit B

(a) Exhibit B may be terminated independently of the Master Agreement and Exhibit A: (i) by either Party upon ninety (90) days' written notice; or (ii) immediately by OpenControls if Partner: (1) circumvents any Attribution Tag or Federation Layer protection measure; (2) distributes FLD outside the Data Scope; (3) grants Customers rights exceeding Consumer-level rights under the FPPA; (4) delivers FLD to any Customer who does not hold an active Consumer Account after the applicable deprovisioning deadline; or (5) fails to pay License Fees within ten (10) days of written notice of non-payment.

(b) Upon termination of Exhibit B, Partner shall: (i) immediately cease all delivery and display of FLD through the Partner Platform; (ii) deprovision FLD access for all active Customer Accounts within forty-eight (48) hours; (iii) delete all cached FLD except any copies retained solely for audit, compliance, or legal hold purposes under Section B-5(d)(iii); and (iv) certify in writing to OpenControls within thirty (30) days that all operational FLD has been deleted and all Customer Accounts deprovisioned. Termination of Exhibit B does not terminate the Master Agreement or Exhibit A.

B-9. Data Integration Commercial Terms

Term	Detail
Data Scope	All FLD available through the Platform API at Partner's subscription tier, as configured in Partner's account
Partner Platform	As registered by Partner during Stripe onboarding and described in Partner's account profile
Data Integration License Fee	As set forth in the subscription tier selected by Partner during Stripe onboarding; billed quarterly via Stripe
Contributor Royalties	As communicated by OpenControls on behalf of applicable Contributors; administered by OpenControls
Payment Schedule	Quarterly, via Stripe
Payment Terms	Charged automatically via Partner's Stripe Connected Account
Late Interest	1.5% per month
Price Change Notice to Partner	90 days' written notice
Usage Report Frequency	Monthly, within 10 business days of month-end
Cache Refresh Frequency	As specified in the Technical Specifications provided to Partner
API Rate Limits	Per Technical Specifications
Audit Rights	Once per calendar year, 30 days' notice
Non-Renewal Notice (Partner)	90 days prior to end of then-current term
Exhibit B Termination for Convenience	90 days' written notice

[End of MoxyWolf LLC / OpenControls Partner Agreement, Exhibit A, and Exhibit B]