Hosting Agreement (Data Commitment)

Schedule D - Hosting Agreement / Data Center Commitment 

Last Updated: July 16, 2026

Uptime Commitments

DOCUMOTO commits that the Web Application shall be generally available 99.9% or more of the time per month.

The Web Application will be “available” when the Web Application is accessible from one or more locations on the public Internet in accordance with the Specifications.

The foregoing will not apply in the case of: (i) planned maintenance downtime (for which the COMPANY will have at least 24 hours notification) and will be planned for COMPANY’s non-core business hours as much as practicable; (ii) downtime caused by circumstances beyond DOCUMOTO’s control, including acts of nature, acts of government; flood, fire; earthquakes; acts of terror, war; strikes and other labor issues, computer and telecommunications failures and delays not within DOCUMOTO’s control, network intrusions or denial of service attacks, but only to the extent the unavailability was the result of DOCUMOTO’s failure to take reasonable and commercial care to mitigate or prevent such an attack or intrusion; or (iii) use of or access to the Web Application other than as expressly permitted under this Agreement.

Information Security Incident Notification

Information Security Incident means any actual or suspected event that threatens or compromises the confidentiality, integrity, or availability of COMPANY's information assets, customer data, systems, or services, or that results in a violation of the organization’s information security policies, security controls, or legal, regulatory, or contractual obligations.

In the event of an Information Security Incident, DOCUMOTO shall:

1. Within twenty-four (24) hours of discovering the Information Security Incident, notify COMPANY in writing by sending an email to the COMPANY’s designated IT, Primary, and Secondary contacts, or by telephone if COMPANY has provided a designated cybersecurity contact number.
2. If COMPANY is impacted, within seventy-two (72) hours of discovery, provide available details regarding the Information Security Incident, including the nature of the information compromised and the steps being taken to investigate, contain, and mitigate the Information Security Incident. To the extent available, the report shall include:
   1. Affected systems or facilities, including location where applicable.
   2. Description of the threat, the earliest known date of occurrence, notifications issued, actions taken, and any information available regarding the source of the incident.
   3. Description of the actual or potential impact on COMPANY’s systems, services, or data.
   4. Description of DOCUMOTO’s incident response activities and remediation plan.
   5. If complete information is not available at the time of reporting, DOCUMOTO shall provide follow-up updates as additional information becomes available.