Master Services Agreement

This Master Services Agreement (this "Agreement") is entered into as of the Effective Date stated on the applicable Order Form by and between FohBoh.ai, Inc., a Delaware corporation with its principal place of business at 3812 Walden Way, Dallas, Texas 75287 ("FohBoh"), and the entity identified as Client on the applicable Order Form ("Client") that is governed by this Agreement through reference. FohBoh and Client are each a "Party" and together the "Parties." Client accepts this Agreement electronically as described in Section 19.

Recitals

• FohBoh operates the Metrics Governance Engine (MGE), a deterministic rules engine that certifies operational data, metric definitions, and business calculations, and provides the Sentry, Cortex, and Countersign products on the MGE platform.
• Sentry examines Client records and issues sealed Certified Analysis and Audit Reports (CAARs) identifying variances between what Client was contractually owed and what Client actually received or was charged.
• Cortex certifies Client operating data through the MGE and may provide operational answers based on certified data when included in an applicable Order Form.
• Countersign is a governance service for Client's AI agents. Before an agent performs an action, Countersign evaluates the proposed action against registered authority, policy, and certified records and returns an APPROVE or DENY decision; an APPROVE may include a signed, single-use Execution Certificate for that action.
• FohBoh does not collect, hold, move, or settle funds; act as Client's agent or representative; contact a Vendor on Client's behalf; perform, execute, initiate, transmit, or cancel an action; or provide legal, accounting, or tax advice. Client wishes to receive the services from FohBoh on the terms below. The Parties agree as follows.

1. Definitions

Capitalized terms have the meanings given below or where first defined in this Agreement. Terms defined in the applicable Order Form control for that engagement.

Advisor

An AI Feature that explains a certified result, its root causes, and next steps a Client could take, generated only from results the MGE has already certified. The Advisor cannot change a Sealed Record, CAAR, or Trust Score, and does not participate in the Certification Pipeline. FohBoh’s Ask Help feature, which answers questions about using the Service from FohBoh’s help content and never reads certification data, is not the Advisor.

AI Feature

Any feature of the Service that incorporates, uses, or depends on a generative or probabilistic model to generate a suggestion, recommendation, narrative, or other output. An AI Feature is not part of the MGE, never participates in the Certification Pipeline, cannot change a Sealed Record, and is not itself deterministic. The Advisor operates only on results the MGE has already certified; Ask Help answers questions about using the Service from FohBoh’s help content. Output of an AI Feature is not a Certified Finding and is addressed in Section 2.6. As of the Effective Date, the AI Features are the Advisor (which explains a certified result, its root causes and next steps) and Ask Help. AI Features use third-party model providers as FohBoh’s Subprocessors.

Authorized Users

Any employee, contractor, or other individual authorized by Client to access or use the Service on Client’s behalf, including any user Client designates under Section 2.3. Client is responsible for the acts and omissions of its Authorized Users as stated in Section 2.3.

CAAR

Certified Analysis and Audit Report. The sealed report issued by Sentry for a single Module, Location group, and Review Period, stating the Certified Findings derived from the Sealed Source Records, together with the Trust Score achieved, the rule registry version, and the ExportPack Manifest hash. A CAAR is issued for every completed analysis, at whatever Trust Score and outcome (CERTIFIED, VERIFIED, REVIEWED or FAILED) that analysis achieves.

Certification Pipeline

The eight deterministic stages (the Trust Loop) through which the MGE certifies an Intake Set: Resolve, Govern, Calculate, Reconcile, Test, Score, Determine, and Seal & Vault. No stage uses AI.

Certified Finding

An individual variance, overcharge, misapplied rate, unremitted amount, duplicated charge, or other discrepancy that (a) derives solely from Sealed Source Records, (b) is produced by deterministic execution of the rule registry, and (c) is stated in a CAAR together with its supporting certified calculation record.

Certified Recoverable Amount (CRA)

The arithmetic sum of the dollar values of the Certified Findings stated in a single CAAR whose outcome is CERTIFIED, computed as described in Section 7.4. The CRA is a certified statement of what the Sealed Source Records show; it is not a prediction, promise, or estimate of what Client will collect.

Client Data

Any and all information, data, or materials that is (a) uploaded, input, or entered into any Module or the MGE by or on behalf of Client, including for processing, (b) provided, transferred, or made available to FohBoh or its subcontractors or representatives by or on behalf of Client, including for processing by or through the MGE or any Module, (c) collected, downloaded, or otherwise received by FohBoh for or on behalf of the Client as part of FohBoh’s provision of Services. Client Data includes all Source Records supplied by Client (as received, fingerprinted on arrival) and the following data derived from them: normalized records, Sealed Records (the MGE’s certified, append-only records of a certification), CAARs and ExportPacks. Client Data also includes any Inputs and Output of an AI Feature generated using Client Data, even though the AI Feature itself is FohBoh’s property under Section 11.1. Client Data does not include (i) FohBoh Materials (including rules, formulas, scoring methods and weights, templates, narrative text and software), even where they are embedded in or used to produce a CAAR, ExportPack or Sealed Record, which Client may use under the license in Section 8.1; or (ii) FohBoh Operational Data.

Client Materials

Client Data, together with Client Marks (as defined in Section 11.2). Client Materials do not include any FohBoh Materials.

Console

The FohBoh | Sentry client console made available to Client under this Agreement, including its evidence intake, document delivery, claim status, and account functions. The Console is the access layer through which Client reaches the Vault.

Cortex

FohBoh | Cortex, a FohBoh product offered on its own or with Sentry as the Sentry + Cortex bundle, which certifies Client’s operating data (for example sales, labor and inventory figures) through the MGE and answers operating questions from certified data. Cortex has its own Advisor, which is an AI Feature. Cortex is provided only where the applicable Order Form includes it.

Documentation

Any user guide, onboarding runbook, security or data-handling description, API or connector guide, or other reference material FohBoh makes available to Client describing the use, configuration, or security of the Service, as updated by FohBoh from time to time. Documentation is provided for reference; this Agreement, and not the Documentation, governs in the event of a conflict.

Custodian Declaration

A written declaration signed by a natural person at FohBoh with knowledge of the Certification Pipeline, describing the chain of custody for the Sealed Source Records and the generation of the accompanying CAAR.

ExportPack

The sealed evidence archive accompanying a CAAR, comprising the Source Records exactly as received, the evidence records with their inclusion proofs, the client-safe form of the Sealed Record, the sealed DCLS narrative, the published signing keys, and a Manifest. Each component is individually SHA-256 hashed and the Manifest is hashed last as the trust anchor. The ExportPack does not include FohBoh’s internal rule evaluation log or per-gate scoring, which remain FohBoh Materials.

Fee Qualification Threshold

A CERTIFIED outcome (a Trust Score of 85 or greater on the 0–100 Trust Score scale) with Certification Eligibility (Trust Gate TG11) passing, meaning no hard-gate condition capped the outcome. The Threshold, together with a positive Certified Recoverable Amount, governs whether a CAAR Transaction Fee is payable. It does not govern whether a CAAR is issued — every completed analysis produces a CAAR.

FohBoh Materials

The MGE, each Module, Cortex, Countersign, any AI Feature, the Console, the rule registry, the rule sets and rule versions, formulas, the Trust Gate methodology, gate ledger, factors and weights, the execution manifest, the Deterministic Certified Language System (DCLS) narrative template library and sealing method, the ExportPack structure, all FohBoh software, and all related documentation, together with all improvements to any of the foregoing. FohBoh Materials do not include Client Data, but remain FohBoh’s proprietary templates, processes, and documentation, including the CAAR, ExportPack or Sealed Record, remain FohBoh Materials, excluding any Client Data incorporated therein.

FohBoh Operational Data

Records FohBoh creates to operate, meter, bill and secure the Service, even where derived from Client Data, provided it does not identify Client: (a) the IUM (Intelligence Under Management) log, FohBoh’s dollar-free record of certifications and rule outcomes, keyed by a pseudonymous Client reference; (b) usage, metering and billing records, including advisor allowances and invoices; (c) audit, security and system logs; (d) aggregated or de-identified statistics under Section 8.3; and (e) FohBoh’s own synthetic test data. FohBoh Operational Data is not Client Data and is governed by Section 8.5.

Forward-Looking Projection

Any annualized, extrapolated, run-rate, or scenario figure presented in or alongside a CAAR. A Forward-Looking Projection is an estimate, is expressly not a Certified Finding, is segregated and labeled as such, and is never included in the CRA or in any fee calculation.

Input

Any Client Data or other information or materials submitted by or on behalf of Client or an Authorized User to the Service, including through the Console, for processing by the MGE, any Module, or any AI Feature.

Intake Ledger

The append-only record maintained by the Console for each uploaded file, capturing at minimum: the SHA-256 hash of the file as received, the receipt timestamp in UTC, the authenticated identity of the uploading user, the requirement to which the file was assigned, the original filename and byte size, and the seal sequence number.

Intake Manifest

The machine-readable specification issued into the Console stating every document Client must supply for its engagement, by Module, Location, format, and period.

Intake Set

The complete set of Source Records uploaded by Client through the Console or received through a FohBoh data connection for a given Module and Review Period, together with the Intake Ledger for those files.

MGE

The Metrics Governance Engine. MGE is deterministic. Identical inputs under identical rule, formula and narrative versions produce a byte-identical Sealed Record with the same SHA-256 fingerprint. No generative or probabilistic model participates in normalization, reconciliation, rule execution, scoring, narrative sealing, or output generation. MGE is FohBoh’s proprietary software and constitutes the core, deterministic engine underlying the Service. Each Module, and any AI Feature, operates on top of, and depends upon, MGE’s processing, as further described in Sections 2.5 and 2.6.

Location

A restaurant or other business location of Client identified on the applicable Order Form, including by legal entity, DBA, address, POS store code, and Vendor account identifiers, as further detailed in the Location schedule to that Order Form.

Module

A discrete Sentry certification scope. As of the Effective Date the generally available Modules are M01 (Merchant Services Certification), M02 (Delivery Service Provider Certification) and M04 (Supplier Invoice Certification). M01 and M02 are included in the Sentry subscription; M04 and each later Module carry their own fee stated on the Order Form. Additional Modules are made available only by a separate Order Form executed between the Parties or a written amendment to the existing Order Form.

Trust Gates

The eleven deterministic Trust Gates (TG01–TG11) evaluated by the MGE. TG01–TG10 are scored and produce the Trust Score; TG11 (Certification Eligibility) is derived after scoring and passes only at a CERTIFIED outcome with no hard-gate override. Gate factors and weights are FohBoh Materials.

Order Form

Client identity, locations, modules, review periods, packages, CAAR Transaction Fee percentage, caps and floors, term. The only document a client signs per engagement subject to this Agreement.

Outcome

The result the MGE determines for each analysis from its Trust Score and any hard-gate conditions: CERTIFIED (Trust Score 85–100), VERIFIED (70–84), REVIEWED (60–69) or FAILED (0–59). A hard-gate condition caps the outcome at REVIEWED whatever the score; it never deducts points.

Output

Any CAAR, ExportPack, Custodian Declaration, or other content generated by the Service based on an Input, including any output of an AI Feature.

Qualifying CAAR

A CAAR that meets the Fee Qualification Threshold and states a positive Certified Recoverable Amount (a “fee-bearing” CAAR). Only a Qualifying CAAR gives rise to a CAAR Transaction Fee.

Review Period

The date range of Vendor activity covered by a given analysis, as stated in the applicable Order Form or in the applicable Intake Manifest.

Fingerprinted Source Record

A Source Record that has been received through the Console or a FohBoh data connection and fingerprinted (SHA-256) and timestamped on receipt, and that is thereafter treated as read-only by FohBoh.

Sealed Record

The MGE’s certified, append-only record of a certification, fingerprinted with SHA-256 and digitally signed, stating the outcome, Trust Score, findings and sealed DCLS narrative. A Sealed Record is never edited or deleted; a correction is made only by a superseding Sealed Record, and the superseded record remains retrievable and verifiable.

Service

The FohBoh products and services stated in the applicable Order Form, including the MGE, Sentry, Cortex, Countersign, the Console, any included AI Feature, and the related evidence intake, certification, governance, API, connector, and delivery services.

Source Records

The records Client supplies, including Vendor statements, settlement and payout files, merchant processing statements, Vendor agreements and fee schedules, point-of-sale exports, bank deposit records, and identifier mappings.

Subprocessor

A third party that FohBoh uses to process Client Data or support the Service, including infrastructure, hosting, storage, email, authentication, and AI model providers. A Subprocessor’s products and services are separate from, and not part of, the Service.

Sub-Threshold CAAR

A CAAR that is not a Qualifying CAAR, including every CAAR whose outcome is VERIFIED, REVIEWED or FAILED. It is delivered to Client with its ExportPack and Custodian Declaration on the same terms as any other CAAR, states on its face the Trust Score achieved and the Trust Gates not satisfied and gives rise to no fee of any kind.

TEST RUN

A certification run in a sandbox or test environment, labeled TEST RUN. TEST RUNs are never billed, never give rise to a fee, are never written to write-once storage, and may be deleted.

Trust Score

The 0–100 score produced by MGE upon evaluation of the Trust Gates for a given analysis. It measures evidence coverage, not the amount found; findings never lower it.

Vendor

A merchant acquirer, payment processor, payment gateway, delivery service provider, franchisor, supplier, or other third party whose charges, fees, remittances, or settlements are the subject of a Module.

Vault

The governed data store, accessed through the Console, in which (a) Client’s rate schedules, Vendor agreements, franchise and FDD Item 6 definitions, KPI definitions, and other governance rules are loaded for use by the MGE, and (b) Source Records, the Intake Ledger, CAARs, and ExportPacks are retained on an append-only basis following certification.

WGS

White Glove Service. The delivery model in which FohBoh personnel perform onboarding, intake review, operation of certification through the MGE, and delivery on Client’s behalf.

Action

A discrete operation proposed by an Agent for a Destination and submitted to Countersign for a Decision.

Agent

A software agent, including an agent that uses artificial intelligence, operated by Client or an End Customer. An Agent is not operated or controlled by FohBoh.

Authority Grant

A Registry record defining the scope of authority assigned to an Agent or Principal for an Action.

Countersign

FohBoh's governance service for Client's agents, powered by FohBoh MGE Certified Execution, as described in Section 2.7.

Countersign Record

The append-only record of a Countersign Decision, including the outcome, findings, applicable Certified Records, Narrative, pinned control version, and, when issued, Execution Certificate.

Decision

Countersign's deterministic APPROVE or DENY evaluation of an Execution Package against the applicable Execution Controls, Registry, and Certified Records.

Destination

A third-party system, account, application, or service to which Client or an End Customer may dispatch an Action.

End Customer

A customer of Client for whose Agents or Actions Client uses Countersign, as permitted by the applicable Order Form.

Enforcing Adapter

Software or an integration component that verifies and redeems an Execution Certificate immediately before dispatching an Action to a Destination.

Execution Certificate

A signed, single-use certificate issued by Countersign for an APPROVE Decision and valid only for the exact Action and period it identifies.

Execution Controls

FohBoh's deterministic controls used by Countersign to evaluate an Execution Package against the applicable Registry and Certified Records.

Execution Package

The structured proposal for an Action submitted to Countersign, including the information required by the applicable API documentation.

Registry

The controlled set of Client or End Customer records used by Countersign, including Agents, Authority Grants, Policies, Schema Profiles, Principals, and related Certified Records.

2. The FohBoh Services

2.1 The Service

FohBoh will provide the products and services identified in the applicable Order Form (collectively, the "Service"). The Service may include Sentry, Cortex, Countersign, the MGE, the Console, related APIs and connectors, permitted AI Features, and related onboarding, evidence intake, certification, governance, and delivery services. Client receives only the Service components expressly included in its Order Form.

Where the applicable Order Form includes Sentry, FohBoh will provide Client with the Sentry certification service for the Modules, Locations, and Review Periods stated on that Order Form, which consists of: (a) the MGE; (b) each Module stated on the applicable Order Form; (c) any AI Feature , including the Advisor, that FohBoh makes available as part of the Service; (d) access to the Console; (e) evidence intake with chain-of-custody sealing through the Console or a FohBoh data connection; (f) execution of the Certification Pipeline against Client’s Intake Sets; and (g) delivery of CAARs, ExportPacks, and Custodian Declarations for every completed analysis, whatever Trust Score and outcome that analysis achieves.

2.2 White Glove delivery

During the WGS period, FohBoh personnel perform registry setup, Vendor profile configuration, transcription of Client’s Vendor agreements into the contract vault (which Client confirms), intake completeness review, certification, and quality review. Client’s operational obligation is limited to supplying accurate Source Records, identifier mappings, and any other information or materials reasonably requested by FohBoh in order to deliver a CAAR, and to reviewing and acting on delivered CAARs. FohBoh approves each new Location, assists its general manager with onboarding and training, and approves its go-live; go-live does not delay billing (Section 7.13). FohBoh may transition Client to a self-directed configuration on sixty (60) days’ written notice without change to fees.

2.3 Console access

FohBoh will provision a client tenant in the Console and issue credentials to the Authorized Users Client designates. Client is responsible for the acts and omissions of its Authorized Users, for maintaining the confidentiality of credentials, and for promptly removing Authorized Users who leave Client’s organization. Client represents it will not permit any person outside Client’s organization to access the Console without FohBoh’s prior written consent, except Client’s professional advisors under obligations of confidentiality. Client’s Owner (the account role that manages Authorized Users) invites, changes and removes Authorized Users in the Console; sign-in uses FohBoh’s authentication Subprocessor.

2.4 Changes to the Service

FohBoh may modify the Console, the rule registry, the Trust Gate configuration, and the Certification Pipeline from time to time. Each change takes effect as a new pinned version recorded in later Sealed Records; it never alters an existing Sealed Record. FohBoh will not make a change that materially reduces the certification standard applied to Client’s analyses during the then-current Term. Changes to the rule registry that would materially change the CRA of a CAAR already delivered are handled under Section 5.6 (Supersession).

2.5 License to the Service

Subject to Client’s payment of all Fees when due and Client’s continued compliance with this Agreement, FohBoh grants Client and its Authorized Users a limited, non-exclusive, non-transferable, non-sublicensable license during the Term to access and use the Service — including the MGE, each Module identified on an Order Form, and any AI Feature made available as part of the Service — solely for Client’s own internal business purposes. Client is responsible for each Authorized User’s compliance with this Agreement. All access to the MGE and to every Module, including any AI Feature, is provided solely under this license. No ownership interest in the MGE, any Module, any AI Feature, the Console, or any other FohBoh Materials is granted to Client under this Agreement, whether by implication, estoppel, or otherwise.

2.6 AI Features

FohBoh may make available one or more AI Features as part of the Service. The MGE is the deterministic core engine underlying the Service; each Module is built on top of the MGE; the Advisor operates only on results the MGE has already certified, and no AI Feature participates in, or can change, a certification. An AI Feature, however, may use a generative or probabilistic model and, unlike the MGE and the Certification Pipeline, is not deterministic. Output of an AI Feature (a) is not a Certified Finding and is not included in the CRA of any CAAR; (b) may be inaccurate or incomplete and should not be relied upon without independent verification appropriate to its intended use; and (c) does not constitute legal, accounting, or tax advice. AI Features are provided through a third-party LLM model provider acting as FohBoh’s Subprocessor; FohBoh sends it only the certified results, the question and the context to provide an Output answer. AI Feature use is metered: each Location includes the monthly allowance stated on the Order Form, and Client’s Owner may buy top-ups (Section 7.15). A Subprocessor’s product is separate from, and not part of, the Service. FohBoh makes no representation or warranty regarding any Subprocessor’s product, and is not liable for any defect, unavailability, or other issue arising from or related to a Subprocessor’s product, except to the extent caused by FohBoh’s failure to configure or use that product as expressly set forth in this Agreement, an Order Form, or any Documentation. A Subprocessor’s product may be subject to the Subprocessor’s own terms, which FohBoh will identify to Client on request. FohBoh may add, modify, or withdraw any AI Feature at any time without liability, provided that doing so does not affect FohBoh’s obligations with respect to any CAAR already issued.

2.7 Countersign

When Countersign is included in an applicable Order Form, FohBoh will provide the Countersign API, evaluation of each Execution Package against the applicable Execution Controls, Registry, and Certified Records, a Decision for each submission, a signed Execution Certificate for each APPROVE when applicable, Countersign Records and Audit Chain access, and any Enforcing Adapter or Console functionality identified in the Order Form.

2.8 Countersign Keys and Production Access

FohBoh may issue sandbox keys after Client accepts this Agreement. FohBoh issues production keys only after both Parties have signed the applicable production Order Form and FohBoh has approved Client's production integration. Client must protect all keys, use them only as authorized, promptly request revocation of a key it believes exposed, and remain responsible for all requests made using its keys.

2.9 Deterministic Decisions

Each Countersign Decision, Narrative, Countersign Record, and Execution Certificate is produced deterministically. A Countersign Decision evaluates only the proposed action against the registered authority, policy, and cited Certified Records at the time of evaluation. It is not a determination that the action is lawful, prudent, correctly priced, or in any person's interest.

3. Onboarding and Client Responsibilities

3.1 The WGS Runbook

Onboarding follows the FohBoh | Sentry WGS Onboarding Runbook, which will be provided to Client following its agreement to the terms of the Agreement and execution of an Order Form, and states each step, its owner, and its acceptance criteria. The Onboarding Runbook terms are incorporated by reference and may be updated by FohBoh from time to time; the version in effect on the Effective Date governs unless the Parties agree in writing otherwise.

3.2 Custodian

Client will designate in writing at least one individual (the “Custodian”) with authority to upload Source Records, to attest to their completeness and authenticity, and to close an Intake Set. Client will designate a backup. Client will notify FohBoh within five (5) business days of any change of the designated Custodian.

3.3 Client deliverables

Client will supply, through the Console or a FohBoh-approved data connection, and through no other channel, every document identified as required in the applicable Intake Manifest, in a readable and machine-processable form, covering the full Review Period. Client will supply identifier mappings sufficient to associate each Vendor account identifier (merchant identification number, delivery service provider store identifier, and the like) with a specific Location.

3.4 Client attestation

Upon closing an Intake Set, Client’s Custodian will attest, through the Console, by typing their full legal name on the attestation’s signature line, that to the best of Client’s knowledge the Source Records in that set are (a) true, accurate, and complete copies of records Client received from or exchanged with the applicable Vendor or generated in the ordinary course of Client’s business; (b) unaltered; and (c) complete for the Review Period. FohBoh relies on this attestation, and Client acknowledges the results of any processed Intake Set are reliant on the above representations.

3.5 Right to provide

Client represents that it has the right to provide each Source Record and all Client Data and Client Materials to FohBoh for the purposes of this Agreement, and that doing so does not breach any agreement between Client and a Vendor, including any confidentiality provision in a Vendor agreement or fee schedule. Client will notify FohBoh before uploading any record subject to a Vendor confidentiality restriction that Client believes may limit FohBoh’s use.

3.6 Effect of delay or incompleteness

Certification timelines run from Intake Closure, not from Order Form execution. If Client does not close an Intake Set within thirty (30) days of the Intake Manifest being issued, FohBoh may place the engagement in a paused state. A paused engagement does not extend the Term and does not suspend or delay billing. Without limiting the foregoing, at FohBoh’s request, Client will provide, at Client’s own cost, FohBoh with all input and cooperation required in order to complete the Services, including but not limited to providing any information, materials, or access, to FohBoh, or participating in correspondence with FohBoh, in order to complete the Services. Client acknowledges that the start date and the end date of the work described in an Order Form depends on the timely receipt of such input from Client and the performance of Client’s cooperation obligations. In case of any delay therein, FohBoh’s obligations under the relevant Order Form, may, in FohBoh’s discretion, be suspended for the period of the delay.

3.7 Prohibited records

Client will not upload cardholder data, full payment card numbers, personally identifiable information about individual consumers, protected health information, or employee records, except where a Module’s Intake Manifest expressly requires a specific field. Where a required document contains such data incidentally, Client will redact it before upload where practicable.

3.8 Countersign Integration and Client Responsibilities

For Countersign, Client is responsible for maintaining accurate, current authority grants, policies, schema profiles, principals, agents, and Certified Records in the Registry; for verifying the identity and authority of each Principal; and for the acts and omissions of its Authorized Users, Agents, and End Customers. Client must deploy an Enforcing Adapter in front of each destination where it relies on an Execution Certificate, retain all destination credentials itself, and configure the destination so that an agent cannot bypass the Enforcing Adapter. Client will not submit cardholder data, full payment card numbers, bank credentials, passwords, destination credentials, protected health information, or government identifiers to Countersign.

4. Intake and Chain of Custody

4.1 Seal on receipt

Each file received through the Console or a FohBoh data connection is hashed using SHA-256 and timestamped in UTC at the moment of receipt, before any inspection, conversion, parsing, renaming, or movement. The hash, timestamp, authenticated uploader identity, assigned requirement, original filename, byte size, and seal sequence number are written to the Intake Ledger. The Intake Ledger is append-only.

4.2 Read-only treatment

FohBoh will not alter a Fingerprinted Source Record. Normalization, conversion, and enrichment operate on derived copies; the sealed original is retained unmodified and is the copy carried into the ExportPack.

4.3 Intake Closure

An Intake Set is closed when (a) every requirement in the Intake Manifest has at least one accepted file, (b) FohBoh’s completeness review has passed, and (c) Client’s Custodian has executed the attestation under Section 3.4. Intake Closure is itself hashed and recorded. Documents uploaded after Intake Closure are handled as a supplemental set and may require a superseding CAAR under Section 5.6.

4.4 Relationship to the ExportPack

The Fingerprinted Source Records in a closed Intake Set become the source-document components of the ExportPack issued with the resulting CAAR. The hash recorded at intake is the hash carried in the ExportPack Manifest, and the two must match. A mismatch is a certification failure and blocks issuance.

4.5 Records requests

Client may download its Fingerprinted Source Records, Intake Ledger, CAARs, and ExportPacks from the Console at any time during the Term and for ninety (90) days after expiration or termination, except that the ExportPack for a Qualifying CAAR is released as stated in Section 7.14.

5. Certification and Deliverables

5.1 Certification Pipeline

FohBoh will process each closed Intake Set through the Certification Pipeline. Rule execution, reconciliation, scoring, and narrative generation are deterministic and never use AI or any language model. Identical inputs and an identical rule registry version produce a byte-identical Sealed Record with the same SHA-256 fingerprint, and the rule registry version is recorded in the ExportPack audit trail.

5.2 Trust Score, and what it does and does not decide

MGE evaluates the Trust Gates and produces a Trust Score for each analysis and determines its outcome: CERTIFIED (85–100), VERIFIED (70–84), REVIEWED (60–69) or FAILED (0–59). FohBoh issues a CAAR for every completed analysis, together with its ExportPack and Custodian Declaration, whatever Trust Score and outcome that analysis achieves. The Trust Score is stated on the face of the CAAR.

The Trust Score and outcome never decide whether Client receives a CAAR; they decide whether a CAAR Transaction Fee is payable. A CAAR that meets the Fee Qualification Threshold and states a positive Certified Recoverable Amount is a Qualifying CAAR and is chargeable under Section 7. Every other CAAR is a Sub-Threshold CAAR, is delivered on the same terms with its ExportPack released at once, and is free. A Sub-Threshold CAAR states on its face the Trust Score achieved, the Trust Gates not satisfied, the reason each was not satisfied, and the additional or corrected Source Records that would allow the analysis to reach the Threshold. Client may supply those records, and FohBoh will re-run the analysis and issue a superseding CAAR at no charge (the superseding CAAR is chargeable only as stated in Section 7.3).

The four Outcome values break down as follows:

A CAAR’s Outcome does not change its evidentiary character: a CAAR in any band is the certified, deterministic output of the Certification Pipeline described in Section 5.1, not a human or AI-generated opinion. See also Section 6.8.

5.3 What a CAAR contains

A CAAR states, for each Certified Finding: the Location and Vendor account to which it relates, the period, the contractual or statutory basis relied upon, the source record and page or row reference, the certified calculation, and the dollar value. The CAAR states the outcome, the Trust Score, the rule registry version, and the ExportPack Manifest hash. Anyone holding a CAAR can confirm its seal and signature on FohBoh’s public verification page, which discloses no Client Data content (Section 8.6).

5.4 Summary character

A CAAR is a summary of voluminous underlying records, prepared for the convenience of the reader, and is designed to be presented alongside those records rather than in place of them. The Fingerprinted Source Records themselves are produced with every CAAR in the ExportPack. Nothing in this Agreement, and no marking on a CAAR, is a representation by FohBoh as to the admissibility of any document in any proceeding, legal or otherwise.

5.5 Forward-Looking Projections

Where a CAAR presents an annualized or extrapolated figure, that figure is segregated from the Certified Findings, is labeled as a Forward-Looking Projection, and is excluded from the CRA. FohBoh makes no representation that a Forward-Looking Projection will be realized.

5.6 Supersession and correction

If FohBoh determines that a delivered CAAR contains a material error, or if Client supplies Source Records that materially change the analysis, FohBoh will issue a superseding Sealed Record and CAAR bearing the same engagement reference and a new version number. Sealed Records are append-only: the superseded record and CAAR are never edited or deleted, are marked superseded in the Console, and remain retrievable and verifiable. Fee treatment on supersession is stated in Section 7.7.

5.7 Retention

FohBoh will retain Fingerprinted Source Records, Intake Ledgers, CAARs, ExportPacks, and audit trails in the Vault for the longer of (a) seven (7) years from issuance or (b) the period stated in separate data handling requirements agreed upon between the parties in writing. In production, Sealed Records and their evidence are held in write-once storage for seven (7) years from sealing and cannot be altered or deleted by anyone, including FohBoh, before that period ends (Section 8.4). TEST RUN records are not held in write-once storage and may be deleted.

5.8 Countersign Records and Execution Certificates

Each Countersign submission receives one sealed Decision. On an APPROVE, FohBoh may issue one signed Execution Certificate, valid only for the short period and exact action specified by the applicable API documentation. An Execution Certificate is single-use. Countersign Records and the Audit Chain are append-only; a Decision is never changed, and a new submission receives a new Decision. FohBoh will retain Countersign Records, Execution Certificates, and the Audit Chain for the production environment for seven (7) years from the Decision, subject to applicable law. Test-run records may be deleted.

6. Nature and Limits of the Service

6.1 FohBoh is not a recovery agent or debt collector

FohBoh does not recover funds on Client’s behalf. FohBoh analyzes Client’s records, certifies what those records show, and delivers a sealed report that Client may use. Whether to present a CAAR to a Vendor, when to present it, what to demand, whether to negotiate, settle, escalate, arbitrate, or litigate, and whether to accept any Vendor response, are decisions reserved entirely to, and are the entire responsibility of, Client.

6.2 Relationship of the Parties

FohBoh is an independent contractor. Nothing in this Agreement creates an agency, partnership, joint venture, legal representation, or fiduciary relationship. FohBoh will not communicate with any Vendor on Client’s behalf, will not sign correspondence as Client or for Client, and will not appear in any proceeding as Client’s representative. FohBoh’s participation in any proceeding, if any, is limited to authenticating its own records as a custodian and is subject to Section 6.7.

6.3 Not a debt collector

FohBoh does not take assignment of any claim, does not acquire any interest in any amount identified in a CAAR, does not receive or hold any recovered funds, and is not a collection agency and will not contact any third party to collect any amount. The subject matter of a CAAR displays financial records and flag inconsistencies related thereto between Client and its Vendor arising from Client’s own business records.

6.4 Not legal, accounting, or tax advice

Nothing FohBoh provides is legal, accounting, auditing, or tax advice, and no CAAR is an audit opinion, an attestation engagement, legal evidence, a legally authenticated document, or an examination under any professional standard. Client should consult its own counsel and accountants before acting on a CAAR.

6.5 No outcome guarantee

FohBoh does not represent, warrant, or predict that Client will recover any amount, that any Vendor will accept a CAAR, or that any Certified Finding will result in a refund, credit, offset, or payment. Vendor agreements may contain claim windows, dispute procedures, limitation provisions, and waiver terms that are outside FohBoh’s control and that may bar or reduce recovery of an amount that is nonetheless correct.

6.6 Dependence on Client records

Certification establishes that the analysis of the records supplied is correct, complete against the applicable rules that rely upon the Client Materials provided thereunder, reproducible, and unaltered. It does not and cannot establish that the records Client supplied are themselves complete or authentic. Client’s attestation under Section 3.4 is the basis on which FohBoh proceeds. If Client supplies incomplete or inauthentic records, the resulting CAAR may be certified and still be wrong about the world, and Section 7.6 governs the fee consequences. Client is solely responsible and liable for any direct or indirect results of any CAAR which is certified and still inaccurate as a result of the Client Materials Client provides to generate any CAAR.

6.7 Testimony and third-party requests

If Client requires a witness, an affidavit beyond the standard Custodian Declaration, deposition testimony, document production in response to a subpoena directed to FohBoh, or expert testimony, FohBoh will cooperate to the extent legally required and will otherwise, at FohBoh’s sole discretion, do so as requested by Client through a separately quoted professional service at the rates stated on the applicable Order Form or, absent a stated rate, at FohBoh’s then-current rates, plus reasonable expenses.

6.8 Automated software certification; no human or professional review

(a) Nature of output. Every CAAR, Certified Finding, and other output the Service generates — including each MGE calculation — is the result of fully automated, deterministic software execution against rules configured in advance, applied to the Source Records Client or its Vendors supply. No FohBoh employee or contractor reviews, interprets, or exercises discretion over Client Data in generating a CAAR.

(b) No human review; not an audit opinion. The Certification Pipeline runs without human involvement or subjective evaluation (“Zero HITL”). FohBoh is not an accounting firm, auditor, law firm, or third-party certifying agency, and no CAAR, Certified Finding, or Outcome is, or may be construed as, a financial audit opinion, attestation under any auditing or assurance standard, or legal conclusion, consistent with Section 6.4.

(c) What “certified” means here; Client’s responsibility. “Certified,” “verified,” “reviewed,” and the other Outcome values in Section 5.2 describe a deterministic software state: that the data processed did, or did not, satisfy FohBoh’s defined Trust Gates. They do not mean that an independent third party reviewed or attested to the result. Client remains solely responsible for reviewing the underlying Source Records, assessing its own regulatory or accounting compliance, and deciding whether and how to pursue a recovery claim or vendor dispute. FohBoh disclaims any liability for a third party’s reliance on a CAAR, a Certified Finding, or an Outcome in a legal or financial proceeding to which FohBoh is not a party.

6.9 Countersign Does Not Execute Actions

Countersign authorizes or denies a proposed action; it does not perform, dispatch, execute, transmit, or cancel one. Whether an agent proposes an action, whether Client dispatches an approved action, and what a destination does with it are decisions and responsibilities of Client, its End Customers, and their destinations. An APPROVE permits an action under the applicable Execution Controls; it never instructs one.

7. Fees and Payment

7.1 Fee elements

Client shall pay (a) a subscription fee for access to the Service, stated per Location per month on the applicable Order Form, billed from that Order Form’s Effective Date (the date it is signed), whether or not a Location has gone live, and for a restaurant added later from its order confirmation (Section 7.13); (b) for each separately priced Module stated on the applicable Order Form, its Module fee per Location per month, billed in the same way from the date that Module is ordered; (c) a CAAR Transaction Fee for each Qualifying CAAR issued, computed under this Section 7 at the same Fee Percentage for every Module; and (d) any Advisor top-ups Client’s Owner buys (Section 7.15). Any offer or credit stated on the Order Form (such as a sign-up credit of Module fees) applies only as the Order Form states it and never to the CAAR Transaction Fee.

7.2 The CAAR Transaction Fee

For each Qualifying CAAR issued to Client, Client will pay a certification transaction fee (the “CAAR Transaction Fee”) equal to the percentage stated on the applicable Order Form multiplied by the new certified dollars of that CAAR: for each Certified Finding, its certified amount less any amount of the same finding (same Location, Module and period) already made fee-bearing by an earlier CAAR, so that each certified dollar bears the fee only once. The fee is computed in whole cents, rounded half up to the cent. No CAAR Transaction Fee is payable in respect of a Sub-Threshold CAAR. (See “Fee Formula”)

7.3 No fee below the Fee Qualification Threshold

A Sub-Threshold CAAR is delivered at no charge. FohBoh bears the cost of the work performed and of the report. Re-running the analysis after Client supplies corrected or additional Source Records for the same Module and Review Period is likewise at no charge, and the superseding CAAR is chargeable only if it reaches the Fee Qualification Threshold. Client owes nothing for work FohBoh could not certify to standard, and Client keeps the report either way.

7.4 Computing the Certified Recoverable Amount

The CRA of a CAAR is the sum of the dollar values of its Certified Findings. The following are excluded from the CRA and from any fee calculation:

• Forward-Looking Projections, including annualized, extrapolated, and run-rate figures.
• Any item presented as advisory, informational, unverified, or observational rather than as a Certified Finding.
• Any amount that Client disclosed during intake as already refunded, credited, or otherwise recovered before the Review Period closed (the “Prior Recovery Exclusion”). Client bears the burden of disclosing prior recoveries at intake; an amount not disclosed at intake is not excluded on that basis after issuance.
• Any amount arising from the same underlying transaction as a Certified Finding in a prior CAAR for the same Client, so that no transaction is fee-bearing more than once.
• Sales, use, and other transaction taxes; interest; and any penalty, fee-shifting, or multiplier a Vendor agreement or statute might allow.
• Any amount excluded by an express provision of the applicable Order Form.

7.5 The fee is not contingent on collection

The CAAR Transaction Fee is consideration for the certification transaction — the deterministic examination, reconciliation, rule execution, scoring, sealing, and issuance of the CAAR together with its ExportPack and Custodian Declaration. It is not a contingency fee, a success fee, a bounty, a finder’s fee, or a commission on recovered funds. It is neither increased nor reduced by whether, when, from whom, or in what amount Client actually recovers any sum. FohBoh’s obligation in respect of a CAAR is discharged on issuance. Client acknowledges that it has read Section 6 and Section 7, understands that it may owe a CAAR Transaction Fee on a CAAR from which it ultimately recovers nothing, and has priced that risk in agreeing to the Fee Percentage.

7.6 Review window and adjustment

Client has ten (10) business days from issuance of a CAAR to notify FohBoh in writing of a claimed error in the identification or computation of a Certified Finding, or of a Prior Recovery that Client can evidence was disclosed at intake. FohBoh will review and, where the claim is well founded, in FohBoh’s sole discretion, will issue a superseding CAAR under Section 5.6 with a corrected CRA, and the fee will be computed on the reissued CAAR. Absent timely notice, the CRA as issued is final for fee purposes.

7.7 Supersession — no double charging

Where a CAAR is superseded, the CAAR Transaction Fee is computed on the superseding CAAR only. Any amount already invoiced on the superseded CAAR is credited in full against the superseding invoice, and any excess is refunded within thirty (30) days from the date the superseding CAAR is issued.

7.8 Floor and cap

No CAAR Transaction Fee is chargeable on a CAAR whose CRA is below the Minimum CRA stated on the applicable Order Form. Where the applicable Order Form states a Per-CAAR Fee Cap or a Monthly Fee Cap, the CAAR Transaction Fee is limited accordingly. Where the applicable Order Form states no cap, none applies.

7.9 Invoicing and payment

FohBoh invoices the subscription fee and any Module fees monthly (one line per Location), each CAAR Transaction Fee when its Qualifying CAAR is issued, each Advisor top-up when it is bought, and any other fees for Services stated on the applicable Order Form or at checkout through any ordering process under this Agreement. A Sub-Threshold CAAR produces no invoice. Invoices are due net thirty (30) days from the invoice date. All amounts due are in United States dollars. Client will pay by credit card or ACH or another method FohBoh designates.

7.10 Taxes

Fees are exclusive of taxes. Client is responsible for all sales, use, value-added, and similar taxes, excluding taxes on FohBoh’s net income.

7.11 Late payment and suspension

Undisputed amounts not paid when due accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum permitted by law. If an undisputed invoice remains unpaid thirty (30) days passed the initial due date, FohBoh may suspend the Service and Console access without liability. FohBoh will not withhold or delete Client Data during suspension, except that an ExportPack held under Section 7.14 stays held until its invoice is paid and will restore access on payment in full. Client’s right to download its Fingerprinted Source Records and issued CAARs under Section 4.5 survives suspension.

7.12 Disputed amounts

Client may withhold a specific invoiced amount it disputes in good faith, provided Client pays the undisputed balance when due and states the basis for the dispute in writing before the due date. The Parties will escalate an unresolved dispute under Section 17.1.

7.13 Billing start and restaurants added later

Billing for each Order Form starts on its Effective Date, the date it is signed, for every Location it lists, and not at go-live. FohBoh approves each Location, assists its general manager with onboarding and training, and approves its go-live, in accordance with any relevant Documentation. Client may add a restaurant through the Add-a-restaurant step in the Console: the confirmation by Client’s Owner, with the price shown before confirming, is an order under this Agreement and the applicable Order Form on the terms shown, without amendment, and billing for that restaurant starts on the confirmation date. If FohBoh declines a restaurant Client added, FohBoh credits in full all amounts billed for it and tells Client the reason.

7.14 ExportPack release (payment assurance)

The CAAR is always available to Client in the Console during the Term. Unless FohBoh has set Client’s account to release on issue, the ExportPack for a Qualifying CAAR is released once the invoice for its CAAR Transaction Fee is paid; the ExportPack for any other CAAR is released at once. FohBoh alone sets this release setting and may release a held ExportPack early. Payment status never changes a Sealed Record, a CAAR or its fingerprint.

7.15 Advisor allowance and top-ups

Each Location’s subscription includes the monthly Advisor allowance stated on the Order Form, subject to a fair-use limit that may pause the Advisor before the allowance is used up in a month of unusually long answers. The allowance resets on the first day of each month and does not carry over. Client’s Owner may buy top-ups for the current month at the prices shown on the Order Form or in the Console.

7.16 TEST RUNs

Certifications run in a sandbox or test environment are TEST RUNs. TEST RUNs are never billed and never give rise to a CAAR Transaction Fee.

7.17 Countersign Fees

For Countersign, Client will pay the platform fees, included usage allowances, decision fees, and any professional-services fees stated in the applicable Order Form. Unless the Order Form states otherwise, platform fees are billed monthly in advance and usage-based decision fees are billed monthly in arrears. A decision fee may apply whether a Decision is APPROVE or DENY, as stated in the Order Form.

8. Client Data

8.1 Ownership

As between the Parties, Client owns all Client Data and Client Materials, including the Source Records, the Sealed Records, and the CAARs and ExportPacks issued to Client. FohBoh Materials embedded in or used to produce a CAAR, ExportPack or Sealed Record (including rules, formulas, scoring methods and weights, templates and narrative text) remain FohBoh’s. FohBoh grants Client a non-exclusive, royalty-free license, which survives termination, to use those FohBoh Materials as embedded in the CAARs and ExportPacks issued to Client, for Client’s internal business purposes, including the uses permitted by Section 11.2.

8.2 License to FohBoh

Client grants FohBoh a non-exclusive license to host, copy, hash, process, and transmit Client Materials solely to provide the Service, to maintain the chain of custody, to meet FohBoh’s retention obligations, and to respond to a lawful request, and to publish verification metadata under Section 8.6. FohBoh will not use Client Materials for any other purpose except as stated in Sections 8.3, 8.5 and 8.6.

8.3 Aggregated and de-identified data

FohBoh may create and use aggregated, de-identified statistics derived from Client Data to operate, secure, benchmark, and improve MGE and Sentry, and to publish industry-level findings, provided that such statistics (a) do not identify Client, any Location, or any Vendor account, (b) are not derived from fewer than twenty (20) contributing organizations for any published figure, and (c) do not reproduce any Vendor agreement term. FohBoh will not disclose Client’s Vendor identities, rates, or contract terms to any third party.

8.4 Deletion

On written request after expiration or termination, and subject to Section 5.7, Section 9, and any legal hold, FohBoh will delete Client Data (other than Sealed Records and their evidence, which are retained as stated below) within sixty (60) days and confirm deletion upon Client’s written request. Client acknowledges that Sealed Records and their evidence are retained in write-once storage for seven (7) years from sealing to preserve the chain of custody, and cannot be deleted by anyone, including FohBoh, during that period; FohBoh will keep them confidential, restrict access to them, and delete them when that period ends. TEST RUN records may be deleted at any time. Where deletion of a Sealed Record would break the integrity of an ExportPack Client has retained, FohBoh will so advise and will delete only on Client’s written confirmation.

8.5 FohBoh Operational Data

FohBoh owns FohBoh Operational Data and may use it to operate, meter, bill, secure, support and improve the Service, and may publish aggregate counts of certifications that do not identify Client. FohBoh Operational Data will never identify Client, any Location or any Vendor account, and the IUM log never contains Client’s dollar amounts or restaurant data.

8.6 Public verification

Client authorizes FohBoh to publish verification metadata (seal fingerprints and signature status) through FohBoh’s public verification page, so that anyone holding a CAAR or record identifier can confirm its seal and signature. Verification metadata discloses no Client Data content.

8.7 Countersign Data and Records

Client may read and export Countersign Records and its Audit Chain during the Term. Upon expiration or termination, FohBoh will provide Client a full export of Client Data, including the applicable Registry, Countersign Records, and Audit Chain, subject to payment of undisputed amounts due and applicable law. Production Countersign Records, Execution Certificates, and the Audit Chain will remain confidential during their retention period.

9. Confidentiality

From time to time during the Term of this Agreement, either Party (as the "Disclosing Party") may disclose or make available to the other Party (as the "Receiving Party"), non-public, proprietary, and confidential information of Disclosing Party that, whether disclosed orally or disclosed or accessed in written, electronic or other form or media, and whether or not marked, designated or otherwise identified as “confidential,” in connection with this Agreement (the “Confidential Information"); provided, however, that Confidential Information does not include any information that: (a) is or becomes generally available to the public other than as a result of Receiving Party's breach of this Section 9; (b) is or becomes available to the Receiving Party on a non-confidential basis from a third-party source, provided that such third party is not and was not prohibited from disclosing such Confidential Information; (c) was in Receiving Party's possession prior to Disclosing Party's disclosure hereunder; or (d) was or is independently developed by Receiving Party without using any Confidential Information. The Receiving Party shall: (x) protect and safeguard the confidentiality of the Disclosing Party's Confidential Information with at least the same degree of care as the Receiving Party would protect its own Confidential Information, but in no event with less than a reasonable degree of care; (y) not use the Disclosing Party's Confidential Information, or permit it to be accessed or used, for any purpose other than to exercise its rights or perform its obligations under this Agreement; and (z) not disclose any such Confidential Information to any person or entity, except to the Receiving Party's Group who need to know the Confidential Information to assist the Receiving Party, or act on its behalf, to exercise its rights or perform its obligations under this Agreement.

If the Receiving Party is required by applicable law or legal process to disclose any Confidential Information, it shall, prior to making such disclosure, use commercially reasonable efforts to notify Disclosing Party of such requirements to afford Disclosing Party the opportunity to seek, at Disclosing Party's sole cost and expense, a protective order or other remedy. For purposes of this Section 9 only, Receiving Party's Group shall mean Receiving Party, the Receiving Party's affiliates and their respective employees, officers, directors, shareholders, partners, members, managers, agents, independent contractors, service providers, sublicensees, subcontractors, attorneys, accountants, and financial advisors. Obligations survive for five (5) years after termination, and indefinitely for trade secrets. Notwithstanding the foregoing, the Receiving Party and Receiving Party’s Group may retain copies of the Confidential Information to the extent that such retention is to comply with applicable law or professional standards, or to comply with a bona fide document retention policy (including, without limitation, any Confidential Information saved pursuant to standard archival or computer back-up systems).

10. Security

FohBoh will maintain an information security program with administrative, technical, and physical safeguards appropriate to the sensitivity of Client Data, including encryption in transit and at rest, role-based access control, authenticated and logged access, tenant isolation, and periodic review. FohBoh’s current Subprocessors are used for hosting, storage and email, AI Feature model providers, and Authorized User sign-in; FohBoh will maintain a current list and make it available to Client. FohBoh will notify Client without undue delay, and in any event within seventy-two (72) hours of confirmation, of any unauthorized access to or disclosure of Client Data and will provide the information Client reasonably requires meeting its own notification obligations.

11. Intellectual Property

11.1 FohBoh property

The MGE is FohBoh’s proprietary software and constitutes the core, deterministic engine underlying the Service. Each Module, Cortex, and any AI Feature operates on top of, and depends upon, the MGE’s processing, and is likewise FohBoh’s and its licensor’s (such as a Subprocessor) proprietary technology. FohBoh owns and retains all right, title, and interest in MGE, Sentry, the Console, the rule registry, the Trust Gate methodology, the DCLS narrative sealing method, the ExportPack structure, all FohBoh Materials, including all software, and all documentation, together with all improvements, including each Module and any AI Feature incorporated therein, excluding any proprietary product or service provided by any Subprocessor. No rights are granted except the license expressly granted in Section 2.5.

11.2 Client property

Client owns and retains all right, title, and interest in Client Data, all Client Materials, and in Client’s marks, logos, trademarks, and similar indicia of Client (“Client Marks”). Client’s use of a delivered CAAR and ExportPack for its own business purposes — including presenting it to a Vendor, an advisor, an insurer, a lender, an acquirer, or a tribunal — is permitted without further consent.

11.3 Restrictions

Client will not, and will not permit any Authorized User or other third party to: (a) reverse engineer, decompile, disassemble, or attempt to derive the rule registry, the Trust Gate methodology, or the scoring or certification methodology; (b) copy, modify, translate, or create derivative works of the MGE, any Module, any AI Feature, the Console, or any other FohBoh Materials; (c) use the Service to build or support a product or service competitive with the Service; (d) resell, sublicense, lease, rent, distribute, or otherwise provide the Service or any FohBoh Materials to any third party not authorized under this Agreement; (e) access or use the Service in violation of applicable Law or in a manner that introduces Harmful Code; (f) remove, obscure, or alter any proprietary notice on the Service or any FohBoh Materials; or (g) publish FohBoh’s methodology documentation or any benchmark or comparative analysis of the Service without FohBoh’s prior written consent. Client may share a CAAR and its ExportPack as contemplated by Section 11.2. “Harmful Code” means any virus, worm, trojan horse, malware, ransomware, or other code, device, or mechanism designed to disrupt, disable, harm, or gain unauthorized access to any software, hardware, network, or data. “Law” means any statute, law, ordinance, regulation, rule, code, order, or other binding directive or requirement of any federal, state, local, or foreign governmental authority.

11.4 Feedback

Client hereby irrevocably assigns to FohBoh, on its own behalf and on behalf of its Authorized Users, all right, title, and interest, including all intellectual property rights, in and to any suggestion, enhancement request, correction, or other feedback Client or any Authorized User provides regarding the Service (“Feedback”). FohBoh is free to use, disclose, reproduce, and otherwise exploit Feedback for any purpose, including to improve the MGE, any Module, or any AI Feature for FohBoh’s customers generally, without attribution, restriction, compensation, or obligation to Client, and without any obligation to use any Feedback. Nothing in this Section 11.4 affects Client’s ownership of Client Data.

12. Term and Termination

12.1 Term

This Agreement begins on the Effective Date and continues for the Initial Term stated on the applicable Order Form (“Initial Term”), renewing for successive twelve (12) month periods each unless either Party gives written notice of non-renewal at least sixty (60) days before the end of the then-current term (each a “Renewal Term” and collectively with the Initial Term, the “Term”).

12.2 Termination for cause

Either Party may terminate this Agreement and any Order Form on thirty (30) days’ written notice of a material breach that remains uncured at the end of that period, or immediately on the other Party’s insolvency, assignment for the benefit of creditors, or the appointment of a receiver.

12.3 Termination for convenience

Either Party may terminate this Agreement and any Order for convenience, effective at the end of the then-current Term, by providing sixty (60) days’ prior written notice prior to the expiration of the then-current Term. Termination for convenience does not entitle Client to a refund of any subscription fee paid, and does not extinguish a CAAR Transaction Fee for a CAAR issued before the effective date of termination.

12.4 Effect

On expiration or termination, Console access continues in read-only form for ninety (90) days for the purpose of Section 4.5. Accrued fees remain due and payable. Sections 1, 4.5, 5.7, 6, 7 (as to accrued amounts), 8, 9, 11, 13.3, 13.4, 14, 15, 17, 18 and 19 survive.

13. Representations, Warranties, and Disclaimers

13.1 Mutual

Each Party represents that it is duly organized, has authority to enter this Agreement, and that this Agreement is enforceable against it.

13.2 FohBoh warranty

FohBoh warrants that (a) it will perform the Service in a professional and workmanlike manner; (b) the Certification Pipeline is deterministic, and an identical Intake Set processed under a materially identical rule registry version will produce a materially identical CAAR; (c) each Certified Finding in a CAAR is derived solely from Fingerprinted Source Records and is supported by a certified calculation record reproducible from those records; and (d) the hash of each Fingerprinted Source Record recorded in the Intake Ledger matches the hash of the corresponding component in the ExportPack Manifest. Client’s sole and exclusive remedy for breach of this Section is re-performance and, if FohBoh cannot cure within thirty (30) days, refund of the CAAR Transaction Fee paid for the affected CAAR.

13.3 Disclaimers

EXCEPT AS EXPRESSLY STATED IN SECTION 13.2, THE SERVICE IS PROVIDED “AS IS.” FOHBOH DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, AND STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, FOHBOH MAKES NO WARRANTY THAT ANY AMOUNT WILL BE RECOVERED, THAT ANY VENDOR WILL ACCEPT ANY CAAR, THAT ANY CAAR OR EXPORTPACK WILL BE ADMITTED IN ANY PROCEEDING, OR THAT CLIENT’S SOURCE RECORDS ARE COMPLETE OR AUTHENTIC.

13.4 AI Feature Acknowledgments

Client additionally acknowledges the following regarding any AI Feature, including the Advisor, made available as part of the Service:

• Client will, and will ensure its Authorized Users will, use any AI Feature only for purposes consistent with this Agreement. It is Client’s responsibility, and not FohBoh’s, to determine whether output of an AI Feature is appropriate for Client’s intended use.
• Output of an AI Feature may be inaccurate, incomplete, or unavailable from time to time, should not be relied upon without independent verification appropriate to the use case, and does not constitute legal, accounting, financial, tax, or other professional advice.

• Output of an AI Feature is not a Certified Finding, is not included in the CRA of any CAAR, and carries none of the certifications, warranties, or chain-of-custody protections that apply to a CAAR under this Agreement.
• FohBoh may add, modify, or withdraw any AI Feature at any time as part of its ordinary maintenance of the Service, and nothing in this Agreement obligates FohBoh to provide, or Client to use, any particular AI Feature.
• Except as Client and FohBoh otherwise agree in writing, FohBoh does not use Client Data to train or fine-tune any large language model or other AI Technology for the benefit of any person other than Client.

13.5 Countersign Acknowledgments

Client acknowledges that Countersign's protection depends on accurate Registry entries and Certified Records, correct integration, and an Enforcing Adapter that verifies and redeems an Execution Certificate immediately before dispatch. FohBoh does not warrant that a destination will perform an action exactly once, that Client's Registry or Certified Records are accurate, or that an approved action will be correct, lawful, or in Client's interest.

14. Limitation of Liability

NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, OR LOST BUSINESS OPPORTUNITY, HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY.

EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT IS LIMITED TO THE TOTAL FEES PAID AND PAYABLE BY CLIENT TO FOHBOH UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

These limits do not apply to a Party’s indemnification obligations under Section 15, to Client’s payment obligations, to either Party’s breach of Section 9, or to either party’s gross negligence or willful misconduct.

15. Indemnification

15.1 By FohBoh

FohBoh will defend and indemnify Client against a third-party claim that the Service as provided infringes a United States patent, copyright, or trade secret, and will pay damages finally awarded or amounts in settlement FohBoh approves. The foregoing obligation does not apply to the extent the applicable claim, allegation, or proceeding arises from or relates to: (i) Client Data or Client Materials; (ii) modifications to the Services or related Outputs not made by FohBoh; (iii) use of the Services in combination with any product, service, data, or business process not provided or authorized in writing by FohBoh; (iv) Client’s or any Authorized User's use of the Services other than as authorized under this Agreement or the applicable Order Form; or (v) FohBoh’s compliance with specifications, data, or instructions provided by Client. The foregoing obligation likewise does not extend to any claim arising from or related to a Subprocessor’s product or technology, including any third-party AI model underlying an AI Feature.

15.2 By Client

Client will defend and indemnify FohBoh against a third-party claim arising from (a) Client’s breach of Section 3.5 (right to provide) or Section 3.7 (prohibited records); (b) Client’s use of a CAAR, including any demand, negotiation, arbitration, or proceeding Client initiates against a Vendor; or (c) Client’s supply of records that were not what Client attested them to be, Client Data or Client Materials.

15.3 Process

The indemnified Party will give prompt notice, tender sole control of the defense, and provide reasonable cooperation at the indemnifying Party’s expense. No settlement imposing an obligation on the indemnified Party may be made without its consent.

16. Publicity

Neither Party will use the other’s name or marks in any public statement without prior written consent, except that FohBoh may identify Client and use Client Marks to identify Client as a customer in a customer list. Client may withdraw consent prospectively on thirty (30) days’ notice; FohBoh will not be required to recall materials already distributed.

17. Dispute Resolution and Governing Law

17.1 Escalation

Before filing any action, the Parties will escalate any dispute to an executive of each Party and negotiate in good faith for thirty (30) days.

17.2 Governing law and venue

This Agreement is governed by the laws of the State of Texas, without regard to its conflict of laws rules. The Parties submit to the exclusive jurisdiction of the state and federal courts located in Dallas County, Texas, and waive any objection to venue there.

17.3 Jury waiver

EACH PARTY WAIVES ANY RIGHT TO TRIAL BY JURY IN ANY ACTION ARISING OUT OF OR RELATED TO THIS AGREEMENT.

18. General

18.1 Website Terms and Privacy Policy

The FohBoh Terms of Service at https://www.fohboh.ai/terms.html and the FohBoh Privacy Policy at https://www.fohboh.ai/privacy.html (together, the "Website Policies") are incorporated by reference. The Website Policies govern Client's access to and use of FohBoh's public website and Services to the extent not governed by this Agreement or an applicable Order Form. The Privacy Policy describes FohBoh's handling of personal information and is acknowledged to have been made available to Client. If a Website Policy conflicts with this Agreement or an applicable Order Form, this Agreement and then the applicable Order Form control; the Website Policies do not amend the negotiated security, confidentiality, or Client Data obligations in this Agreement.

Unless otherwise expressly set forth in the applicable documentation, stating it controls over other provisions and which provisions it controls over, the following order of precedence applies: this Agreement controls over any Order Form, except as to the commercial terms this Agreement leaves to the Order Form (packages, Locations, Modules, prices, Fee Percentage, any Minimum CRA or cap, and Initial Term), which the Order Form states; an Order Form controls over an Add-a-restaurant confirmation except as to the restaurant and price that confirmation adds; and this Agreement controls over any Documentation, exhibits, addenda, schedules, or supplemental materials to this Agreement or any Order Form. Assignment: neither Party may assign without the other’s consent, except to a successor in a merger or sale of substantially all assets. Notices: in writing, to the addresses on the applicable Order Form, effective on delivery; notices to FohBoh must also be sent to legal@fohboh.com. Force majeure: neither Party is liable for a delay caused by an event beyond its reasonable control, excluding payment obligations. Amendment: Amendments are only effective if in a writing and signed by both Parties, or, for an updated version of this Agreement, accepted under Section 19, except that FohBoh may update any of its Documentation, effective upon notice, provided no update reduces the certification standard or the security posture. Severability and waiver: If any term or provision of this Agreement is found by a court of competent jurisdiction to be invalid, illegal or unenforceable in any jurisdiction, such invalidity, illegality or unenforceability shall not affect any other term or provision of this Agreement or invalidate or render unenforceable such term or provision in any other jurisdiction. No waiver by any Party of any of the provisions of this Agreement shall be effective unless explicitly set forth in writing and signed by the Party so waiving. Except as otherwise set forth in this Agreement, no failure to exercise, or delay in exercising, any right, remedy, power or privilege arising from this Agreement shall operate or be construed as a waiver thereof, nor shall any single or partial exercise of any right, remedy, power or privilege hereunder preclude any other or further exercise thereof or the exercise of any other right, remedy, power or privilege. Counterparts and electronic signature: This Agreement is effective upon the Effective Date and this Agreement and any Order Form governed by and subject to this Agreement may be executed in counterparts, each of which is deemed an original, but all of which together are deemed to be one and the same agreement. Electronic acceptance under Section 19 and electronic signatures on an Order Form are valid and binding as originals. Entire agreement: this Agreement, the applicable Order Form, and any Add-a-restaurant confirmations are the entire agreement and supersede all prior discussions.

19. Electronic Acceptance and Versions

19.1 Acceptance by click. Client accepts this Agreement when an individual authorized to bind Client clicks “I accept” (or a similarly labeled control) for this Agreement in a FohBoh product, sign-up or order page. Client signs only its Order Form; no separate signature to this Agreement is required. Signing an Order Form that incorporates this Agreement by reference also confirms Client’s acceptance.

19.2 Authority. The individual who accepts represents that they are authorized to bind Client. Acceptance binds Client, not only that individual, whether or not that representation is later disputed, unless FohBoh had actual knowledge at the time of acceptance that the individual lacked such authority. An Authorized User who is not authorized to bind Client accepts only the user terms for their own use of the Service.

19.3 Record of acceptance. FohBoh records each acceptance with the version number and date of this Agreement, the date and time (UTC), the accepting individual's name, email address and authenticated account, and Client's name. That record is evidence of Client's acceptance. Client may request a copy of the version it accepted from FohBoh.

19.4 Versions. This Agreement is identified by the version number and date shown on it. The version Client accepted governs Client’s Order Forms and Add-a-restaurant confirmations until Client accepts a later version.

19.5 Updated versions. FohBoh may publish an updated version of this Agreement and will notify Client at least thirty (30) days before asking Client to accept it. Client accepts an updated version by clicking “I accept” when prompted or by signing an Order Form that references it. If Client does not accept an updated version, the version Client last accepted continues to govern until the end of the then-current Term.

19.6 Electronic records. The Parties consent to conduct this transaction electronically. Electronic acceptance and electronic signatures have the same effect as handwritten signatures, and FohBoh’s electronic record of acceptance may be used as an original.