The framework contract for enterprise customers.

Who's bound and how.

This Agreement is between:

• Customer — the legal entity identified on the first executed order form, including its affiliates that are listed on an order form.
• Cascade Asia — Cascade Asia Pte. Ltd., a Singapore-registered private limited company with its registered address in Singapore (referred to as "Cascade").

The Agreement is binding upon execution of the first order form by both parties. Subsequent order forms reference and incorporate this MSA by default.

What Cascade provides.

Onsight is Cascade’s source-graded intelligence service, providing monitoring, field briefs, and per-engagement field work for compliance, ESG, investment, and investigative use. Onsight is currently in private build, and access is arranged on a per-engagement basis. The public methodology at cascadeasia.com/methodology.html and the security posture at cascadeasia.com/cascade-security.html are part of the Service description and incorporated by reference; specific functionality and scope for a given Customer are set out in the applicable order form.

Cascade may modify the Service from time to time, provided no modification materially diminishes the functionality the Customer is paying for under an active order form. Material changes are communicated at least 60 days in advance.

How specific commitments get into writing.

Each order form sets out the specific services Customer is purchasing, including:

• Subscription tier, included seats, included monitor subjects, included engagements per year
• Term length and renewal terms
• Fees and payment terms
• Customer-specific commitments (data residency, named-analyst assignment, custom methodology, escalation contacts)
• Any deviations from this MSA (which control to the extent they conflict)

Statements of Work (SOWs) may be issued for non-recurring services (custom field briefs, special engagements, integration work). Each SOW is governed by this MSA unless explicitly stated otherwise. SOWs reference the parent order form and are signed by both parties.

Order forms may be amended by mutual written agreement. Any party-issued purchase order's terms (other than commercial information matching the order form) are deemed null and void.

How long, and when either party can exit.

Initial term

Each order form has its own initial term as specified in that order form. Typical initial terms are 12 or 36 months.

Renewal

Order forms auto-renew for successive 12-month periods unless either party gives written notice of non-renewal at least 60 days before the end of the then-current term. Cascade may increase fees on renewal by up to the greater of (a) 5% annually or (b) the change in the U.S. CPI for that period, whichever is higher; larger increases require Customer's written agreement.

Termination for cause

Either party may terminate this Agreement or any order form for material breach if the breach is not cured within 30 days of written notice. Material breach by Customer includes non-payment past 60 days; material breach by Cascade includes prolonged service unavailability beyond the SLA's outer bounds (see section 06).

Termination for convenience

Customer may terminate any order form for convenience on 90 days written notice. Fees paid for the unused portion of the prepaid term are non-refundable except as a credit against future Cascade services.

Termination for insolvency

Either party may terminate immediately on written notice if the other party becomes insolvent, files for bankruptcy, makes an assignment for the benefit of creditors, or has a receiver appointed.

Effect of termination

On termination: Customer's access to the Service ends at the end of the then-current paid period (or earlier for cause). Customer has 90 days to export Customer Data using the platform's export tools. Cascade deletes Customer Data per the retention schedule. Sections that by nature survive termination (Confidentiality, IP, Liability, Indemnity, Governing Law) survive.

How and when Customer pays.

Fees

Fees are stated in each order form. Subscription fees are billed in advance (monthly, quarterly, or annually as specified). Per-engagement fees are billed as scheduled in the relevant order form or SOW.

Invoicing & payment terms

Cascade invoices in accordance with the order form. Default payment terms are net 30 from invoice date; enterprise customers may negotiate net 45 or net 60 in the order form. Payment is in U.S. dollars unless otherwise specified. Acceptable payment methods: Stripe (credit card, ACH), wire transfer, or other methods specified in the order form.

Late payment

Past-due amounts accrue interest at 1.5% per month or the maximum permitted by law, whichever is lower. After 60 days past due, Cascade may suspend the Service in addition to other remedies. After 120 days past due, Cascade may terminate the Agreement.

Taxes

Fees are exclusive of taxes. Customer is responsible for all sales, use, GST, VAT, withholding, and similar taxes, except for taxes based on Cascade's net income. Where Cascade is required by law to collect such taxes, they are added to invoices.

Disputed amounts

Customer must dispute an invoice in writing within 30 days of receipt, or the invoice is deemed accepted. Undisputed portions of an invoice must be paid on time even when other portions are under dispute.

Records audit

Customer may, on 30 days' notice and no more than once per 12-month period, audit Cascade's records of the fees billed under this Agreement to verify accuracy. Audit cost is borne by Customer unless the audit reveals overcharges of more than 5%, in which case Cascade bears the audit cost and refunds the overcharge.

Uptime, response time, and credits.

Availability commitment

Where an order form specifies an uptime service level, Cascade commits to the stated Monthly Uptime Percentage (by default, 99.5%) for the Onsight customer-facing surfaces identified in that order form. While Onsight is in private build, service-level commitments apply only where expressly stated in an order form. "Monthly Uptime Percentage" = (total minutes in month − Downtime) ÷ total minutes in month, where Downtime excludes Scheduled Maintenance and Force Majeure events.

Scheduled Maintenance

Cascade reserves up to 4 hours per month for Scheduled Maintenance, performed during low-traffic windows (Asian business-hours nighttime). Customer is notified at least 72 hours in advance via email and in-app notice.

Service Credits

To claim Service Credits, Customer notifies Cascade in writing within 30 days of the end of the affected month with relevant details. Service Credits are applied as a credit against future fees and are Customer's sole and exclusive remedy for service-availability failures.

Support Response Time SLA

"Business hours" = Monday-Friday 9:00am-6:00pm Singapore Standard Time, excluding Singapore public holidays. Enterprise order forms may specify 24/7 critical-incident support with named escalation contacts.

What each party owns.

Cascade IP

The Onsight platform, the methodology, brand elements, and all associated software, designs, and documentation are the intellectual property of Cascade. The order form grants Customer a non-exclusive, non-transferable, non-sublicensable, worldwide license to use the Service during the order form's term, for Customer's internal business use and for the use cases described in the order form.

Customer Data

"Customer Data" means data Customer or Customer's seats load into the Service (watch lists, scoping notes, internal annotations, uploaded files). Customer Data is owned by Customer. Cascade processes Customer Data as a data processor per the Data Processing Agreement.

Cascade-published intelligence

Field briefs, findings, and the corroboration graph published by Cascade analysts ("Cascade Intelligence") are Cascade IP. Customer's order form grants a license to use Cascade Intelligence within Customer's organization, with redistribution rights as tagged on each piece of evidence (see Terms section 04).

Aggregated data

Cascade may use Customer's usage data in aggregated, de-identified form to operate, secure, and improve the Service. Aggregated data does not identify Customer or any of Customer's seats. Cascade does not use Customer-loaded subject data to train models for use by other Customers.

Feedback

If Customer provides feedback or suggestions, Cascade may use them without obligation, including in future versions of the Service. Feedback is not Confidential Information unless Customer marks it as such and Cascade agrees in writing.

What stays between us.

"Confidential Information" means information disclosed by one party (the "Disclosing Party") to the other ("Receiving Party") that is marked or reasonably understood to be confidential, including: order form pricing, Customer Data, Cascade Intelligence not yet published, Cascade roadmap, security architecture, sub-processor list (in detailed form beyond the public list), and any sensitive personal data of either party's personnel.

The Receiving Party will:

• Use Confidential Information only to perform under this Agreement.
• Protect it with at least the same care it uses for its own confidential information of similar sensitivity, but no less than reasonable care.
• Not disclose it to third parties except (a) to its employees and contractors under similar confidentiality obligations, on a need-to-know basis, or (b) as required by law, on prompt written notice to the Disclosing Party where lawful.

Confidentiality obligations survive termination for 5 years, except for trade secrets, which remain protected as long as they qualify as trade secrets under applicable law.

Confidential Information does not include information that: (a) was lawfully in the Receiving Party's possession before disclosure; (b) is or becomes public through no fault of the Receiving Party; (c) was independently developed without use of the Disclosing Party's Confidential Information; or (d) was lawfully obtained from a third party not under a confidentiality obligation.

What Cascade promises about the Service.

Cascade warrants that:

• It will perform the Service in a workmanlike manner consistent with industry standards.
• It has the right to grant Customer the licenses set out in this Agreement.
• The Service does not knowingly contain malicious code (viruses, worms, trojans, ransomware) at the time of delivery.
• It complies with applicable laws regulating Cascade's provision of the Service.
• It maintains the technical and organizational security measures described in the DPA Annex I and the Security page.

Customer warrants that:

• It has the right to load Customer Data into the Service and to grant Cascade the rights to process it.
• Its use of the Service complies with applicable laws, including data-protection law, sanctions, export controls, and anti-discrimination law.
• The seats it provisions are bound by appropriate confidentiality and acceptable-use obligations.

Mutual cover for third-party claims.

Cascade indemnifies Customer for IP infringement

Cascade will defend, indemnify, and hold Customer harmless from any third-party claim alleging that Customer's authorized use of the Service infringes a third party's intellectual property rights, and pay damages and costs awarded in such claim or in a settlement Cascade approves. If the Service is held to infringe (or Cascade reasonably anticipates a claim), Cascade may at its option: (a) modify the Service to be non-infringing; (b) obtain a license; or (c) terminate the affected order form and refund prepaid unused fees.

Cascade has no obligation under this section for claims arising from: (i) Customer Data; (ii) modifications made by Customer; (iii) combinations with software not provided by Cascade; or (iv) Customer's use beyond what's licensed.

Customer indemnifies Cascade

Customer will defend, indemnify, and hold Cascade harmless from any third-party claim arising from: (a) Customer Data infringing or violating a third party's rights; (b) Customer's breach of the Acceptable Use provisions; (c) Customer's use of the Service in violation of applicable law; or (d) any claim by a subject of an engagement that the engagement was unlawful, where Customer provided false or incomplete scoping information.

Conditions

Indemnification is conditioned on the indemnified party: (i) giving prompt written notice of the claim; (ii) granting the indemnifying party sole control of the defense and any settlement (provided settlement does not impose admissions or material non-monetary obligations on the indemnified party without its consent); (iii) providing reasonable cooperation. Each party's own counsel may participate at the indemnified party's cost.

The cap on damages.

For enterprise orders above $250,000 annually, Cascade considers (on case-by-case basis) raising the cap to 2× annual fees and adding a separate higher cap for the data-protection carve-out. These are negotiated in the order form.

Coverage Cascade maintains.

Cascade maintains during the term of this Agreement and for one year thereafter, with reputable insurers, the following minimum insurance coverage:

Certificates of insurance are available on request. Coverage limits will be increased on a per-customer basis where a Customer's order form expressly requires higher minimums; the cost differential may be passed through.

What each party commits to follow.

Each party will comply with all laws applicable to its performance under this Agreement, including data-protection law, anti-bribery law, export controls, sanctions, and anti-modern-slavery legislation.

Specifically:

• Sanctions. Neither party will use the Service or its outputs to violate U.S., EU, U.K., Singapore, or U.N. sanctions. Customer represents that it is not on any restricted-party list and will not provide the Service to any such party.
• Anti-bribery. Each party complies with the U.S. FCPA, U.K. Bribery Act, Singapore Prevention of Corruption Act, and equivalent laws.
• Data protection. Personal data processing is governed by the DPA incorporated by reference.
• Modern slavery. Each party warrants that its operations comply with the U.K. Modern Slavery Act and equivalent laws.

Singapore law. SIAC arbitration.

This Agreement is governed by the laws of Singapore, without regard to its conflict-of-laws rules. The U.N. Convention on Contracts for the International Sale of Goods does not apply.

Any dispute arising out of or in connection with this Agreement, including any question regarding its existence, validity, or termination, shall be referred to and finally resolved by arbitration administered by the Singapore International Arbitration Centre (SIAC) in accordance with the Arbitration Rules of SIAC in force at the time of submission. The seat of arbitration is Singapore. The tribunal will consist of one arbitrator for disputes under USD 5,000,000 in claimed value, and three arbitrators for disputes above. The language is English. The award is final and binding; judgment may be entered in any court of competent jurisdiction.

Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or confidential information without first arbitrating.

Class actions are waived to the maximum extent permitted by law.

Housekeeping clauses.

Order of precedence

If there is a conflict between documents in this Agreement, the order of precedence is: (1) executed Order Form / SOW; (2) Data Processing Agreement; (3) this MSA; (4) any incorporated public document (Privacy, Security, Methodology). Later-dated executed documents prevail over earlier ones for the items they cover.

Entire agreement

This MSA, together with executed order forms, the Data Processing Agreement, and any incorporated public documents, constitutes the entire agreement between the parties with respect to the Service. It supersedes all prior agreements, proposals, or representations on the same subject.

Amendments

Amendments must be in writing and signed by both parties. Email confirmation of an order-form addendum is sufficient where signed by an authorized representative of each party.

Assignment

Neither party may assign this Agreement without the other's prior written consent (not to be unreasonably withheld), except either party may assign to a successor in interest in connection with a merger, acquisition, or sale of substantially all of its assets, on written notice.

Notices

Formal legal notices to Cascade: inquiries@cascadeasia.com with subject "Legal Notice", with copy by registered post to the registered address in Singapore (available on request). Notices to Customer: the address and email designated on the order form. Notices are effective on receipt; email is deemed received the next business day.

Severability

If any provision is held unenforceable, the remaining provisions continue in full force. The unenforceable provision will be replaced with one that most closely reflects the parties' intent.

No waiver

Failure to enforce a provision is not a waiver of that provision or the right to enforce it later.

Force majeure

Neither party is liable for failure to perform due to events beyond reasonable control (natural disasters, war, government action, internet outages, pandemics) provided the affected party gives prompt notice and uses reasonable efforts to resume performance. Force majeure does not excuse Customer's payment obligations for Service already delivered.

Independent contractors

The parties are independent contractors. This Agreement creates no partnership, joint venture, agency, fiduciary, or employment relationship.

No third-party beneficiaries

This Agreement does not create rights for anyone except the parties.

Survival

The following provisions survive termination: Definitions; IP & data ownership; Confidentiality; Warranties (with respect to claims accrued before termination); Indemnification (with respect to claims accrued before termination); Limitation of liability; Insurance (for the one-year tail); Compliance with laws; Governing law; General provisions; and any provisions that by their nature should survive.

Counterparts & electronic signature

This Agreement and order forms may be executed in counterparts, including by electronic signature, each of which is an original and all of which together constitute one instrument.

Reference attachments.