Loading...
HomeMy WebLinkAbout2014-528-E Library - CERVIS Technologies for Volunteer Management $2,250 DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB [Departmental Use Only] TITLE Volunteer Program FY 14-15 ORANGE COUNTY CONTRACT UNDER$15,000.00 NORTH CAROLINA THIS AGREEMENT, made and entered into this 11th day of September, 2014, ("Effective Date") by and between Orange County,North Carolina, a body politic and corporate organized under the laws of the State of North Carolina, (the "County"), party of the first part; and CERVIS Technologies (the "Provider"), party of the second part; WITNESSETH: For the purpose and subject to the terms and conditions hereinafter set forth, the County hereby contracts for the services of the Provider, and the Provider agrees to provide the following services to the County in accordance with the terms of this Agreement,time being of the essence: The services and/or materials (hereinafter referred to collectively as "Services") to be furnished under this Agreement are as follows: Community Event Registration and Volunteer Information System software and Technical Support, which is attached as Exhibit A and incorporated into this document by reference. The term of this agreement rendered shall be from October 1, 2014 to September 30, 2015. Provider represents and agrees that Provider is qualified to perform and fully capable of performing and providing the services required or necessary under this Agreement in a fully competent, professional and timely manner to the satisfaction of the County. Provider shall be responsible for all errors or omissions, in the performance of the Agreement. Provider shall correct any and all errors, omissions, discrepancies, ambiguities, mistakes or conflicts at no additional cost to the County. Provider agrees that Provider shall not sub-contract any of the services to be provided in this Agreement, nor shall Provider assign any right or responsibility granted or required by this Agreement,without the prior written approval of the County. SPECIFIC TERMS 1. Payment: The County agrees to pay at the rates specified for Services satisfactorily performed in accord with this Agreement. The amount to be paid by the County shall not exceed Two- thousand Two Hundred and Fifty Dollars&00/100, ($2250). Payment shall be made within thirty (30)days of an invoice properly submitted to County. Should Provider fail to perform its duties under the terms of this Agreement, County may, without fault or penalty, withhold any payment associated with the work to be performed until such time as said work is completed. 2. Non—waiver: Failure by County at any time to require the performance by Provider of any of the provisions hereof shall in no way waive or affect the County's right hereunder to enforce the same, nor shall any waiver by the County of any breach be held to be a waiver of any succeeding breach or a waiver of this Non-Waiver Clause. 3. Independent Contractor: The Provider shall operate as an independent contractor and the County shall not be responsible for any of the Provider's acts or omissions. The Provider shall not be treated as an employee with respect to the Services performed hereunder for federal or state tax, unemployment or workers' compensation purposes. The Provider understands that neither federal, nor state, nor payroll tax of any kind shall be withheld or paid by the County on behalf of the Provider or the employees of the Provider. 4. Insurance: Provider shall obtain, at its sole expense, Commercial General Liability Insurance, Automobile Insurance, Workers' Compensation Insurance, and any additional insurance as may Revised 7/14 1 DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB be required by Owner's Risk Manager as such insurance requirements are described in the Orange County Risk Transfer Policy and Orange County Minimum Insurance Coverage Requirements (each document is incorporated herein by reference and may be viewed at http:Horan eg c�tync. og_v/purchasing/conkacts.asp). If Owner's Risk Manager determines additional insurance coverage is required such additional insurance shall consist of N/A (if no additional insurance required mark N/A as being not applicable). Provider shall not commence work until such insurance is in effect and certification thereof has been received by the Owner's Risk Manager. 5. Indemnity: The Provider agrees to defend, indemnify, and hold harmless Orange County from all losses, liabilities, claims, demands, suits, costs, damages or expenses (including reasonable attorney's fees) arising from bodily injury, including death, to any person or persons or damage to or destruction of any property caused in whole or in part by any negligent or intentional act or omission on the part of the Provider. 6. Termination: This Agreement may be terminated at any time by mutual written agreement of the parties or by the County upon written notice to the Provider. 7. Entire Agreement and Signatures: The parties have read this Agreement and agree to be bound by all of its terms, and further agree that it constitutes the complete and exclusive statement of the Agreement between the parties unless and until modified in writing and signed by the parties. This Agreement together with any amendments or modifications may be executed electronically. All electronic signatures affixed hereto evidence the intent of the Parties to comply with Article I IA and Article 40 of North Carolina General Statute Chapter 66. 8. Priori : In determining the basic services to be provided, should any documents be referenced in this Agreement, the terms herein shall have priority in any conflict between the terms of referenced documents and the terms of this Agreement. 9. Governing Law: Both parties agree that this Agreement shall be governed by the laws of the State of North Carolina. Should either party initiate litigation to settle any dispute involving the terms of this Agreement such litigation shall be initiated in the General Court of Justice of North Carolina seated in Orange County, North Carolina. Provider shall at all times remain in compliance with all applicable local, state, and federal laws, rules, and regulations including but not limited to all anti-discrimination laws. Pursuant to the terms of North Carolina General Statute 153A-449(b) no county may enter into a contract with a contractor unless the contractor and the contractor's subcontractors comply with the requirements of Article 2 of Chapter 64 of the North Carolina General Statutes. Where applicable, failure to maintain compliance with the requirements of Article 2 of Chapter 64 of the General Statutes constitutes Provider's breach of this Agreement. By executing this Agreement Provider affirms Provider is in compliance with Article 2 of Chapter 64 of the North Carolina General Statutes. 10. Non Appropriation: Provider acknowledges that County is a governmental entity, and the validity of this Agreement is based upon the availability of public funding under the authority of its statutory mandate. In the event that public funds are unavailable and not appropriated for the performance of County's obligations under this Agreement, then this Agreement shall automatically expire without penalty to County immediately upon written notice to Provider of the unavailability and non-appropriation of public funds. [SIGNATURE PAGE TO FOLLOW] Revised 7/14 2 DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB IN WITNESS WHEREOF,Orange County and the Provider have signed this Agreement, effective as of the day first written above. ORANGE Tgy.d by: PROVIDER DocuSigned by: &6LA,Vu[(, ( MM V'S� A{1uSi � W''tiwr By y 06i7994B755F477 B F 1 vA a�M1 V County Manager 286B8EFA396643B... 200 S. Cameron St. CERVIS Technologies P.O.Box 8181 PO BOX 64181 Hillsborough,NC 27278 Colorado Springs, CO 80962 Revised 7/14 3 DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB CERVIS EXHIBIT A SERVICE AGREEMENT STANDARD TERMS & CONDITIONS This SERVICE AGREEMENT, made as of the 11th day of September 2014 ("Effective Date"), is by and between Orange County, North Carolina, P.O. Box 8181, Hillsborough, NC 27278 (hereinafter referred to as the "Customer") and CERVIS Technologies (hereinafter referred to as "CERVIS"). Now, therefore, in consideration of the premises and of the mutual covenants and agreements herein contained, the parties hereto for themselves, their lawful successors and assigns, hereby covenant and agree as follows: WARRANTIES, EXCLUSIONS, REMEDIES AND LIMITATION OF LIABILITY 1.1 Warranty. CERVIS warrants that the online volunteer and event management service ("Service")functions in accordance with the specifications described on the CERVIS web site (the "Site"). 1.2 Disclaimer. CERVIS does not warrant that the Service will be error free nor that Customer will be able to utilize the Service without experiencing periodic problems or interruptions. Except for the express limited warranties set forth herein and to the extent allowed by applicable law, CERVIS hereby disclaims all other warranties, whether expressed, implied, statutory or otherwise, regarding the Service, including the warranties of merchantability and fitness for a particular purpose. 1.3 Limitation on Liability. Regardless of the form of any claim(s) Customer may have under this Service Agreement or otherwise, CERVIS's aggregate liability for any damages to Customer, including negligence, shall not exceed the total amount of fees paid by the Customer to CERVIS for the Service during the prior twelve (12) months. CERVIS shall not be responsible for and will bear no liability for damages, including but not limited to consequential damages, arising from any use of the Service. OWNERSHIP 2.1 Ownership. CERVIS has sole ownership of the Service described in this Service Agreement. CERVIS warrants that, to the best of the knowledge of CERVIS, the Service does not infringe any patent or copyright. 2.2 Effect of License. CERVIS shall retain title to and ownership of Service hereunder, including any modifications and enhancements thereto. Customer's license to use the Service pursuant to this Agreement does not create any ownership rights in the Service for Customer. 2.3 Data. Data stored within the Service by the Customer is the sole property of the Customer. Title and ownership of the volunteer data entered by the Customer remains with the Customer. Page 1 of 6 DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB CERVIS LICENSE 3.1 Use. The Customer (including all Customer-authorized users) is granted a non-exclusive license to use the Service according to the terms of this Service Agreement. 3.2 Restrictions. Customer shall not, and shall not allow any third party to, (i) decompile, disassemble, or otherwise reverse engineer or attempt to reconstruct or discover, in any way, any source code, programming, algorithms, design structure, interoperability interfaces, concepts, construction methods, underlying ideas, of file formats of the Service or any files contained in the Service, for any purpose, (ii) remove any identification markings, including but not limited to copyright notices and Trademarks, from the Service, or (iii) make any modification or enhancement to the Software, or incorporate the Service, or any portions thereof, into or with any other software. 3.3 Stored Information. The Customer is solely responsible for the content or data stored in the Service ("Stored Data"). The Customer warrants the Stored Data will not contain content that is libelous, obscene, scandalous or defamatory, and that the Stored Data will not contain content that violates the personal, proprietary, or intellectual property rights of any third party. AVAILABILITY 4.1 Availability. CERVIS uses commercially reasonable efforts to maintain availability of the Service twenty-four (24) hours per day, seven (7) days per week. However, scheduled and unscheduled interruptions may occur, and CERVIS does not warrant or guarantee totally uninterrupted availability of the Service. Scheduled maintenance is normally conducted during non-peak hours so as to cause minimum inconvenience to the Customer. Scheduled interruptions will be posted in advance. In the event that an unscheduled interruption occurs, CERVIS will apply reasonable resources to resolve the problem and return the Service to availability as soon as possible. During these scheduled and unscheduled interruptions, the Customer may be unable to use the Service. 4.2 Reliability. CERVIS uses commercially reasonable practices including redundancy and backup practices to minimize unscheduled interruptions of service and loss of Customer data. However, CERVIS does not warrant or guarantee that such events will not occur. CERVIS' sole and exclusive obligation for any loss or damage to the Stored Data is to use reasonable efforts to provide Customer with the most recent backup of the Stored Data. TERM AND TERMINATION 5.1 Term of Service. Service will commence on the Effective Date for both the Monthly and Annual Plan. Service shall continue unless cancelled or terminated as provided in the Service Agreement. 5.2 Involuntary Service Termination or Suspension. CERVIS may, at its option, terminate or temporarily suspend a Customer's service if a Customer fails to make timely payments of service fees set forth in Schedule A. If payment has not been received within thirty (30) days after the due date, CERVIS will suspend Service until payment, including any late fees, have been received. CERVIS may terminate this Service Agreement, for any reason or for no reason, with thirty (30) Page 2 of 6 DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB 10"__- CERVIS days notice to Customer. If this Service Agreement is terminated for reasons other than Customer breach, Customer will receive a refund of any unused portion of their fees and Stored Data will be made available by CERVIS for Customer downloading for up to ninety (90) days after termination. After ninety (90) days CERVIS shall destroy remaining data in Customer's account. 5.3 Voluntary Service Cancellation. A Customer may cancel this Service Agreement and use of the Service at anytime. To cancel CERVIS, Customer must complete and sign a Service Cancellation Form and must also pay any outstanding account balance immediately upon cancellation. The voluntary cancellation is not effective until CERVIS receives the signed and completed Service Cancellation Form via fax, e-mail, or in-person and all required payments have been made. All set-up fees and service fees are billed in advance and no paid set-up fees, service fees or credit balances from credits previously issued will be refunded, unless cancellation is within thirty (30) days of the Effective Date as described below in paragraph 5.4. If Customer wishes to obtain its Stored Data, the Customer is responsible for retrieving their Stored Data from the System prior to their cancellation. Customer grants CERVIS the right to destroy all Stored Data and information left in cancelled accounts. CERVIS will remove Customer's Stored Data from the System upon Customer cancellation. 5.4 Termination Within First Thirty(30) Days. Customer may opt to cancel their Service within thirty (30) days of the Effective Date and receive a full refund of the monthly or annual fees that they have previously paid. Customer will not receive a refund of their set-up fee. To cancel Service pursuant to this Section 5.4, CERVIS must receive the signed and completed Service Cancellation Form from Customer via fax, e-mail, or in-person no later than thirty (30) days from the Effective Date. FEES AND PAYMENTS 6.1 Fees. Customer agrees to pay the Set-Up and Service Fees that they have selected on Schedule A. 6.2 Fee Changes. CERVIS will not, at any time, increase the monthly and annual fees to Customer. CERVIS reserves the right to change fees or increase fees for new Customers only. 6.3 Taxes. CERVIS shall charge Customer all federal, state and local taxes, if any, which are applicable by law to all fees and services. If Customer is exempt from paying federal, state or local taxes, the proper paperwork must be submitted to CERVIS within ninety (90) days of the Effective Date. GENERAL PROVISIONS 7.1 Attachments. This Service Agreement is accompanied by the following attachments: Schedule A - Fees and Payment Terms Each attachment to this Service Agreement is incorporated herein by reference in its entirety, the same as though fully set forth at length herein. Page 3 of 6 DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB 10"__- CERVIS 7.2 Customer Reference. You agree that CERVIS may identify Customer as a recipient of services and use Customer logo in sales presentations, marketing materials, press releases, and for promotional purposes on www.cervistech.com. 7.3 Entire Service Agreement. This Service Agreement shall become effective only upon acceptance by an authorized representative of CERVIS. The Service Agreement supersedes all prior Service Agreements and understandings, constitutes the entire Service Agreement, and may not be modified or terminated orally. 7.4 Force Majeure. Except for the obligation to make payments, neither party shall be deemed in default of this Service Agreement and shall be excused from liability for any failure to perform or delay in performance to the extent that performance is rendered impossible by strike, fire, explosion, flood, act of God, governmental acts or orders or restrictions, failure of suppliers (including telecommunications vendors), or any other reason where failure to perform is beyond the control and not caused by the negligence of the non-performing party. 7.5 Severability. In the event any provision of this Service Agreement or portion thereof is adjudged by any court of competent jurisdiction to be illegal, unenforceable, or invalid, that provision shall be stricken or modified to the minimum extent necessary so that this Service Agreement shall remain enforceable, and the remaining provisions of this Service Agreement shall remain in full force and effect. In addition, the illegal, unenforceable, or invalid provision shall be automatically amended so as to best accomplish the objectives of the illegal, unenforceable, or invalid provision within the limits of applicable law. All titles, headings and captions are placed in this Service Agreement merely as a matter of convenience and shall not affect the construction or interpretation of any of its provisions. 7.6 Notices. Any notices, requests or other communications required or permitted to be given hereunder shall be in writing and shall be delivered by a widely recognized national overnight courier service or mailed by United States registered or certified mail, return receipt requested, postage prepaid, or by email or facsimile transmission, and addressed to each party at its address set forth below: CERVIS: P.O. Box 64181 Colorado Springs, CO 80962 Fax: 1-888-549-3601 Email: support @cervistech.com Customer: Orange County Government P.O. Box 8181 Hillsborough, NC 27278 Either party may change their notice address by notice to the other. Notices will be effective on the date delivered or on which delivery is attempted unsuccessfully if by national courier service or United States mail. Page 4 of 6 DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB CERVIS ARBITRATION 8.1 If there is any dispute or claim between a customer and CERVIS, the Customer agrees to submit the dispute for resolution to binding arbitration. Arbitration means that neither the Customer nor CERVIS can sue each other in court over a dispute and that an arbitrator will decide the dispute, not a judge or jury. The arbitrator shall be selected by CERVIS and unless mandated by applicable law, each customer shall bear their own attorney's fees and costs. IN WITNESS WHEREOF, and intending to be legally bound, the parties hereto, having been duly authorized, execute this Service Agreement on the date indicated: CERVIS Technologies Orange County F DocuSigned by: [—�6,vuwt-t,cuSigned by: L�{✓tw L (riWV Rmmt,V'S 286MEFA396643B... 0637994B755E477... Signature Signature Matt Mayberry Bonnie Hammersly Printed Name Printed Name Director of Sales County Manager Title Title 9/12/2014 10/7/2014 Date Date Page 5 of 6 DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB 10"__- CERVIS SCHEDULE A FEES AND PAYMENT TERMS Orange County, North Carolina, P.O. Box 8181, Hillsborough, NC 27278 ("Customer") hereby orders and CERVIS Technologies ("CERVIS") agrees to provide the Service described in the Service Agreement to which this Schedule is attached pursuant to the terms and conditions in the Service Agreement agreed to by Customer and CERVIS on the 11th day of September 2014. Set-Up Fees Premier Edition Choose your set-up from the options below. Choose your plan from the options below. ® Basic Set-Up: $100 ❑ Monthly Plan: $175/month ❑ Advanced Set-Up: $300 ® Annual Plan: $1,800/year Set-Up Fees. The Set-Up fee is due upon execution of this Agreement. Monthly Service Fees. For customers choosing the Monthly Plan, payment is due on the first (1 st) day of each month for Service that month, for so long as the Service Agreement is in effect. Annual Service Fees. For customers choosing the Annual Plan, payment of the annual fee is due upon execution of the Service Agreement and on every annual anniversary thereof, for so long as the Service Agreement is in effect. Late Fees. If any fees are not paid when due, a late fee of 10% of the late payment shall immediately be due and payable in addition to the amount due. Page 6 of 6 DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB o�••"' ' to Cloud Service Questionnaire This questionnaire is to be used to assess security and legal issues surrounding cloud services under consideration for Orange County. For this questionnaire, cloud services are any services requiring storage of County `o } data outside the County network or provision of computing resources outside Cato, of the County network. Vendor under consideration: Volstar, Inc. dba CERVIS Technologies Solution under consideration: CERVIS Volunteer and Event Management Software Department(s) served: Click here to enter text. 1. Who owns the data created by County personnel using this service? Data ownership remains with the County 2. Does the Cloud contractually allow the County to access and retrieve its data at the County's discretion? Yes If No, Explain: Click here to enter text. 3. Is the Cloud provider contractually obligated to dispose, return or retrieve data in the event of contract termination? Yes If No, Explain: Click here to enter text. 4. Upon such provision of data, is the Cloud provider obligated to specify data format and all information necessary for data extraction? Yes If No, Explain: Click here to enter text. 5. Is the Cloud provider obligated to destroy all copies of County data, at the County's request? Yes If No, Explain: Click here to enter text. 6. What are the Cloud provider's obligation to the County in the event of confirmed or suspected data breaches? CERVIS will notify County of suspected or confirmed data breach within 48hrs of being made aware of such a breach 7. Is the Cloud provider obligated to inform the County of all locations in which the data is stored (including backups) and to continually keep the County informed of any changes DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB to those locations? No If No, Explain: Standard service agreement does not include such a provision but we would be more than happy to include this if requested prior to execution. 8. What are the Cloud provider's contractual obligations with respect to litigation holds on County data? Click here to enter text. 9. What are the Cloud provider's contractual prohibitions on disclosing data to individuals, groups or organizations making record requests, unless so directed by an authorized County official? CERVIS will not provide data to any third party unless directed by an authorized County official except as required by law. 10. Does the contract obligate the Cloud provider to allow third-party audits and/or certifications related to infrastructure and security, including penetration testing and vulnerability assessment, as requested by the County? No If No, Explain: Standard service agreement does not include such a provision but we would be more than happy to include this if requested prior to execution as long as all costs associated with such activity are fully covered by the County 11. Does the contract obligate the Cloud provider to allow third party onsite inspections of the Cloud provider's infrastructure and security practices on a specified basis? No If No, Explain: Onsite inspections of infrastructure and security will not be authorized. 12. Does the contract obligate the Cloud provider to provide security documentation upon request by the County? No If No, Explain: Security documentation will not be provided upon request. 13. Does the contract obligate the Cloud provider to supply the County with the provider's performance records, including access to daily and weekly service quality statistics? No If No, Explain: Click here to enter text. 14. Explain the contractually obligated service level parameters, minimum levels, specific remedies and penalties for non-compliance for: 1)Uptime CERVIS will use commercially accepted practices in efforts to maintain 100% DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB uptime but does not warrantee service level performance as such. 2) Performance and response time:CERVIS will use commercially accepted practices in efforts to ensure maximum performance but does not warrantee service level performance as such. 3) Error correction time:CERVIS will use commercially accepted practices in efforts to ensure swift error correction but does not warrantee service level performance as such. 4) infrastructure and security: CERVIS will use commercially accepted practices in efforts to ensure system and data security but does not warrantee service level performance as such. 15. Does the contractually defined Service Level Agreement define pertinent terms such as downtime, scheduled downtime, etc...? No If No, Explain: No SLAs will be executed as part of this agreement. 16. Does the contract specify minimum disaster recovery and business continuity requirements, including penalties for non-compliance, as discovered through onsite inspections, audits or actual disasters? No If No, Explain: CERVIS will use commercially accepted practices in efforts to recover from a disaster recovery event, but does not warrantee service level performance as such. 17. Does the contract require the cloud vendor to notify the County of any outsourced functionality and its provider? No If No, Explain: Click here to enter text. 18. What are the contractually required notification period for the County or the cloud vendor for termination of the cloud services? CERVIS would be happy to include whatever timeline is required by County 19. Describe how the County's data will be stored, managed and archived. Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. However, County data will be stored on redundant storage and securely synchronized in real-time across multiple geographic regions. 20. Will the County's data be stored and managed on a storage system with other data? Yes If Yes, Explain: Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. County data will be stored on computer storage with other CERVIS customers but in a DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB completely separate database and encrypted. 21. At what architectural point in the provider's cloud facility will the County's data be physically connected to networking equipment with non-County data? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. 22. What are the cloud provider's information security policies? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. 23. What are the cloud provider's incident management and reporting policies? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. 24. What is the process by which the cloud provider updates policies and informs customers? CERVIS does not make internal policies and procedures available to customers and as such does not have a process to provide updates to customers. 25. What is the basic architecture of the cloud provider's network security? (overall design, zones, filters, firewalls, VLANs,protocols, standards) Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. However, CERVIS is protected with commercially accepted security practices including, Anti- Virus software,Network firewalls, host-based firewalls, network intrusion prevention, host-based intrusion prevention, Database firewalls, SSL encryption of data in motion, AES encryption of data at rest, encrypted VLANs and regularly scheduled vulnerability and web application security assessments. 26. What security measures does the cloud provider use in data storage, transit and use? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. However, CERVIS is protected with commercially accepted security practices including, Anti- Virus software,Network firewalls, host-based firewalls, network intrusion prevention, host-based intrusion prevention, Database firewalls, SSL encryption of data in motion, AES encryption of data at rest, encrypted VLANs and regularly scheduled vulnerability and web application security assessments. 27. What encryption technologies does the cloud provider use in data management? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. However, CERVIS is protected with commercially accepted security practices including, SSL encryption of data in motion and AES encryption of data at rest. 28. How are access rights managed by the cloud provider for their employees, contractors and other persons? DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB Access is provided based on the principle of least required privilege and is immediately revoked when no longer required. 29. What methods does the cloud provider use to destroy information, when so authorized? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. However, CERVIS will use secure erasure technology to accomplish this activity. 30. What is the cloud provider's patch management policy/methods? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. However, CERVIS will patch vulnerabilities based on criticality as assessed by our security teams. 31. How does the cloud provider defend against malware, including but not limited to viruses, bots, spyware, spam,phishing and pharming? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. However, CERVIS is protected with commercially accepted security practices including, Anti- Virus software,Network firewalls, host-based firewalls, network intrusion prevention, host-based intrusion prevention, Database firewalls, SSL encryption of data in motion, AES encryption of data at rest, encrypted VLANs and regularly scheduled vulnerability and web application security assessments. 32. What system hardening strategies are employed by the cloud provider? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. 33. How does the cloud provider perform security testing, including logging, correlation, intrusion detection, intrusion prevention, file integrity monitoring, time synchronization, security assessments,penetration testing? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. 34. What technologies and methods does the cloud vendor provide for strong authentication? Due to security and intellectual property reasons, CERVIS policy does not allow disclosure of specific information related to infrastructure or security. 35. Provide any other comments and explanations: Click here to enter text. ^os J DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB PAYCHEX INSURANCE AGENCY INC PO BOX 33015 SAN ANTONIO TX 78265 ORANGE COUNTY PUBLIC LIBRARY 137 W MARGARET LN HILLSBOROUGH NC 27278 ACORD 25(2014/01) DocuSign Envelope ID: 1E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB LIDO DATE(MM/DD/YYYY) A` O�RO CERTIFICATE OF LIABILITY INSURANCE R054 9/12/2014 THIS CERTIFICATEIS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER.THIS CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND,EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S),AUTHORIZED REPRESENTATIVE OR PRODUCER,AND THE CERTIFICATE HOLDER. IMPORTANT:If the certificate holder is an ADDITIONAL INSURED,the policy(ies)must be endorsed. If SUBROGATIONIS WAIVED,subject to the terms and conditions of the policy,certain policies may require an endorsement. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s). PRODUCER CONTACT NAME: PAYCHEX INSURANCE AGENCY INC (AONN,Ext): (AC, No): (888) 443-6112 210705 P: F: (888) 443-6112 E-MAIL ADDRESS: PO BOX 33015 INSURER(S)AFFORDING COVERAGE NAIC# SAN ANTONIO TX 78265 INSURERA: Sentinel Ins Co LTD INSURED INSURERS INSURER C CERVIS TECHNOLOGIES INSURER D: PO BOX 64181 INSURER E: COLORADO SPRINGS CO 80962 INSURER F: COVERAGES CERTIFICATE NUMBER: REVISION NUMBER: THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED. NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS,EXCLUSIONS AND CONDITIONS OF SUCH POLICIES.LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. INSR TYPE OF INSURANCE ADDL SUBR POLICYNUMBER POLICYEFF POLICYE%P LIMITS LTR hV.SR I MM/DD/YYYY COMMERCIAL GENERAL LIABILITY EACH OCCURRENCE s2, 000, 0 0 0 CLAIMS-MADE OCCUR DAMAGE TO RENTED $1 000, 0 0 0 PREMISES(Ea occurrence) A X General Liab 76 SBU PD4239 01/17/2014 01/17/2015 MED EXP(Any one person) $10, 000 PERSONAL&ADV INJURY s2, 000, 0 0 0 GEN'L AGGREGATE LIMIT APPLIES PER GENERAL AGGREGATE s4, 000, 0 0 0 JECT POLICY 71 PRO LOC PRODUCTS-COMP/OP AGG s4, 000, 0 0 0 OTHER: $ AUTOMOBILE LIABILITY COMBINED SINGLE LIMIT s2, 000, 0 0 0 (Ea accident) ANY AUTO BODILY INJURY(Per person) $ A ALL OWNED SCHEDULED 76 SBU PD4239 01/17/2014 01/17/2015 BODILY INJURY(Per accident) $ AUTOS AUTOS X HIRED AUTOS X NON-OWNED PROPERTY DAMAGE $ AUTOS (Per accident) 6 UMBRELLA LIAB OCCUR EACH OCCURRENCE $ EXCESS LIAB CLAIMS-MADE AGGREGATE $ DED I RETENTION$ $ WORKERS COMPEN.SATION PER OTH- ANDEMPLOYERS'LIABILITY STATUTE T ER ANY PROPRIETOR/PARTNER/EXECUTIVE Y/N E.L.EACH ACCIDENT $ OFFICER/MEMBER EXCLUDED? N/A (Mandatory in NH) ❑ E.L.DISEASE-EA EMPLOYEE $ If yes,describe under E.L.DISEASE-POLICY LIMIT $ DESCRIPTION OF OPERATIONS below A Technology E&O 76 SBU PD4239 01/17/2014 01/17/2015 1,000,00012,000,000 DESCRIPTION OF OPERATIONS/LOCATIONS/VEHICLES(ACORD 101,Additional Remarks Schedule,may be attached if more space is required) Those usual to the Insured' s Operations . CERTIFICATE HOLDER CANCELLATION SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN ACCORDANCE WITH THE POLICY PROVISIONS. ORANGE COUNTY PUBLIC LIBRARY AUTHORIZED REPRESENTATIVE 137 W MARGARET LN HILLSBOROUGH, NC 27278 ©1988-2014 ACORD CORPORATION.All rights reserved. ACORD 25(2014/01) The ACORD name and logo are registered marks of ACORD