Vendoro Master Terms of Service

1. Agreement & Platform Services Description

These Master Terms of Service ("Agreement") govern the access and use of the Vendoro procurement management platform, mobile applications, API endpoints, and associated services (collectively, the "Platform") operated by Vendoro, Inc. ("Vendoro", "we", "us", or "our").

By accessing, registering for, or using the Platform on behalf of an entity, business, healthcare provider, or organization ("Customer" or "Subscriber"), you warrant that you are authorized to bind such entity to this Agreement. Access is granted exclusively to authorized users under the license provisioning of your Organization Administrator.

2. SOC 2 Type II Compliance & Technical Security Controls

Vendoro maintains an enterprise-grade Information Security Management System (ISMS) engineered to comply with the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (**SOC 2 Type II**).

• Data Encryption Standards: All Customer Data in transit is protected using TLS 1.3 cryptographic protocols. All database stores, transaction backups, and storage blobs are encrypted at rest using FIPS 140-2 validated AES-256 bit hardware keys.
• Logical Multi-Tenant Segregation: Customer Data is segregated logically utilizing mandatory TenantId row-level isolation policies in SQL Server and isolated application contexts, ensuring no cross-tenant data leakage or unauthorized aggregation.
• Access Control & Multi-Factor Authentication: Role-Based Access Controls (RBAC) enforce strict least-privilege principles. Multi-Factor Authentication (MFA) or SAML 2.0 / OAuth Enterprise Single Sign-On (SSO) is required for all administrative sessions.
• Security Telemetry & Audit Logs: Immutable append-only audit logging tracks all credential authorizations, requisition approvals, line item pricing updates, and administrative overrides. Logs are maintained for a minimum of 365 days.
• Incident Response Commitment: In the event of a confirmed Security Incident involving unauthorized access to Customer Data, Vendoro will notify affected Customer Administrators within 72 hours of verification.

3. HIPAA Compliance & Business Associate Addendum (BAA)

Where Customer operates as a Covered Entity or Business Associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health ("HITECH") Act, Vendoro supports full HIPAA compliance:

• Business Associate Agreement (BAA): Vendoro agrees to execute a standard Business Associate Addendum (BAA) governing the processing, transmission, and protection of Protected Health Information (PHI) or Electronic PHI (ePHI) as required by 45 CFR § 164.502(e) and § 164.504(e).
• Administrative, Physical & Technical Safeguards: Vendoro implements safeguards meeting or exceeding the HIPAA Security Rule (45 CFR Part 164, Subpart C), including strict audit controls, automatic session timeouts, encrypted transmissions, and vulnerability scanning.
• Minimum Necessary Standard: Procurement line items and requisition data must adhere to the Minimum Necessary rule. Users are prohibited from inputting unencrypted patient medical charts or clinical records into free-form notes fields unless protected under executed BAA terms.
• Breach Notification under HIPAA: Any discovery of a Breach of Unsecured PHI (as defined in 45 CFR § 164.402) will be reported to the Covered Entity without unreasonable delay and in no case later than 60 calendar days following discovery.

4. PCI-DSS v4.0 Payment Card Data Security

Vendoro strictly adheres to the Payment Card Industry Data Security Standard (**PCI-DSS v4.0 Level 1**) to protect financial and payment card data processed through the Platform:

All payment submissions, automated invoice payments, and supplier card transactions are tokenized directly through PCI-DSS Level 1 certified payment gateways (e.g., Stripe, Authorize.net) via client-side iframe tokenization or direct API handshakes using TLS 1.3 encryption.

5. Customer Data Ownership & Multi-Tenant Data Rights

Customer retains sole and exclusive ownership of all right, title, and interest in and to all data, procurement catalogs, requisition histories, vendor pricing tiers, and organizational files uploaded to the Platform ("Customer Data").

Vendoro is granted a limited, non-exclusive, non-transferable license to host, store, copy, and transmit Customer Data solely to the extent necessary to provide, maintain, and support the Platform. Vendoro will never sell, monetize, or disclose proprietary Customer pricing data or vendor lists to third parties.

6. Service Level Agreement (SLA), Availability & Maintenance

• Uptime Commitment: Vendoro targets a monthly Service Uptime of 99.9%, excluding planned scheduled maintenance.
• Maintenance Windows: Scheduled maintenance requiring temporary service interruption is performed during off-peak hours (Sundays between 1:00 AM – 4:00 AM EST) with at least 48 hours advance notice posted in the Platform dashboard.
• Disaster Recovery & Backups: Automated full database backups are performed weekly with daily differential backups and point-in-time recovery (PITR) replicated geographically across Microsoft Azure East US and Central US availability zones.

7. SMS Communications & Mobile Disclosures

By providing your phone number in your user profile, you consent to receive operational SMS messages (such as 2FA codes and requisition alerts). Message frequency varies based on your organization's activity. Standard message and data rates may apply. You can opt-out at any time by replying STOP. For help, reply HELP or contact your administrator.

• Opt-In Consent: Mobile notifications are enabled exclusively upon explicit opt-in within the user profile or administrator provisioning workflow.
• Message & Data Rates: Standard carrier message and data rates may apply. Reply STOP at any time to cancel notifications, or reply HELP for support.

8. User Conduct & Security Responsibilities

Customer and its Authorized Users agree not to:

• Share user account credentials or bypass Multi-Factor Authentication.
• Reverse engineer, decompile, or attempt to extract source code from the Platform.
• Introduce malicious software, automated scraping bots, or perform denial-of-service tests without written consent.
• Use the Platform for fraudulent purchasing or unauthorized vendor impersonation.

9. Intellectual Property & Proprietary Rights

The Platform, including software architecture, UI design, database schemas, algorithms, microservices, and logos, is the exclusive intellectual property of Vendoro, Inc. Protected under international copyright, patent, and trademark laws.

10. Limitation of Liability & Mutual Indemnification

Limitation of Direct Damages: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL EITHER PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT EXCEED THE TOTAL AMOUNT PAID BY CUSTOMER HEREUNDER IN THE TWELVE (12) MONTHS PRECEDING THE INCIDENT.

Exclusion of Consequential Damages: IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES (INCLUDING LOSS OF PROFITS, REVENUE, OR DATA), REGARDLESS OF WHETHER ADVANCE NOTICE WAS GIVEN.

11. Term, Termination & Post-Termination Data Purge

Upon subscription termination or expiration:

• Customer will have thirty (30) days to request a full export of Customer Data in standard CSV/JSON/SQL format.
• Following the 30-day retrieval window, Vendoro will cryptographically erase and overwrite all Customer Data across production databases and storage blobs in compliance with DoD 5220.22-M wipe standards.

12. Governing Law, Dispute Resolution & Contact

This Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of law principles. Any dispute arising hereunder shall be resolved through binding arbitration administered by the American Arbitration Association (AAA) in Wilmington, Delaware.