Master Services Agreement

This MSA establishes the overarching legal framework between Credosis and Client for the provision of technology services. All Statements of Work executed under this MSA are governed by its terms. In case of conflict between this MSA and a SOW, the SOW prevails to the extent of the inconsistency. This MSA is effective upon execution by both parties or upon Client's acceptance through our digital engagement process.

"Acceptance Period" — 10 business days from delivery of Deliverables for testing "Background IP" — pre-existing code, libraries, AI models, prompt templates, tools owned by Credosis prior to or independent of the engagement "Change Order" — written amendment to a SOW modifying scope, timeline, or fees "Client" — the entity engaging Credosis for Services "Confidential Information" — non-public information disclosed by either party "Deliverables" — work product produced under a SOW "Foreground IP" — new IP created specifically for Client under a SOW "Force Majeure Event" — events beyond reasonable control "Personnel" — individuals assigned by Credosis to perform Services "Services" — technology services described in applicable SOW(s) "Statement of Work" or "SOW" — document describing specific scope, deliverables, timeline, and fees

All Services provided under individually executed SOWs referencing this MSA. Each SOW shall specify: description of Services, Deliverables with acceptance criteria, project timeline and milestones, fees and payment schedule, key Personnel (if applicable). No work commences until a SOW is executed by both parties. Changes to scope, timeline, or fees require a formal Change Order that includes: description of proposed change, impact analysis on timeline and budget, revised deliverables and milestones. No informal communication constitutes a Change Order.

Credosis assigns qualified Personnel with relevant expertise. Client may request approval of key Personnel. Credosis may substitute Personnel of equivalent qualification with reasonable notice. Personnel remain Credosis's employees or contractors at all times; no employment relationship is created between Personnel and Client.

Unless otherwise specified in the SOW, the default milestone billing structure applies: 20% advance before project initiation 20% upon approximately 30% completion 20% upon approximately 50% completion 30% upon approximately 90% completion Remaining balance upon final delivery and acceptance All invoices payable within 15 days of receipt (Net 15). Late payments accrue interest at 1.5% per month on the outstanding balance. All fees are exclusive of applicable taxes including VAT. International engagements invoiced in USD. Domestic engagements invoiced in BDT. International payments exceeding USD 10,000 per individual transaction must be remitted via wire transfer through standard banking channels, in accordance with Bangladesh Bank regulations. The Client shall be responsible for any withholding taxes imposed by their local jurisdiction.

(a) Conditional Assignment: Credosis retains all right, title, and interest in the Deliverables until full payment has been received for the applicable SOW. Upon receipt of full and final payment, all Foreground IP irrevocably assigns to Client. Prior to full payment, Client is granted a limited, revocable, non-exclusive license solely to evaluate and test the work. (b) Background IP: Credosis retains absolute ownership of all Background IP. Client receives a perpetual, irrevocable, non-exclusive, worldwide, royalty-free license to use Background IP solely as it is incorporated into the Deliverables. Client shall not extract, reverse-engineer, or distribute Background IP independently. (c) Moral Rights: To the extent permitted by the Copyright Act, 2023, Credosis waives any moral rights in the Deliverables that would prevent Client's full use after IP transfer. (d) Portfolio Rights: Unless expressly prohibited in the applicable SOW, Credosis may reference the engagement and showcase non-confidential aspects of completed work in portfolios, case studies, and marketing materials. (e) Open Source: Any open-source components incorporated into Deliverables will be disclosed in the applicable SOW or technical documentation and remain subject to their respective open-source licenses.

(a) AI technologies are probabilistic. Outputs may be inaccurate, incomplete, biased, or fabricated. Credosis does not warrant the factual accuracy of AI-generated output. (b) Client proprietary data is NOT used to train third-party foundational AI models. Third-party AI APIs are engaged via enterprise-tier, zero-retention agreements. (c) AI outputs may not be unique. Similar inputs from different clients may produce similar outputs. (d) AI outputs do not constitute professional advice (medical, legal, financial, or otherwise). (e) Client assumes sole responsibility for implementing human-in-the-loop review before deploying AI outputs in production or relying on them for business-critical, medical, or regulated decisions. (f) Client shall not deploy AI-powered Deliverables for High-Risk Applications (medical diagnosis, autonomous legal interpretation, automated employment decisions, critical infrastructure control) without appropriate human oversight and documented validation procedures.

Upon delivery of each Deliverable or milestone, Client has 10 business days (the "Acceptance Period") to conduct User Acceptance Testing (UAT) against the acceptance criteria defined in the SOW. Client must notify Credosis in writing of any material defects within the Acceptance Period. If no written objection is received within the Acceptance Period, the Deliverable is deemed accepted. Credosis will use commercially reasonable efforts to correct reported material defects and resubmit for acceptance. Acceptance may not be unreasonably withheld.

Both parties shall protect Confidential Information with at least the same degree of care applied to their own proprietary information, and in no event less than reasonable care. Access restricted to Personnel and advisors with a demonstrated need-to-know, who are bound by confidentiality obligations no less protective than those herein. Standard carve-outs: information that (a) is or becomes publicly available through no fault of the receiving party, (b) was known prior to disclosure, (c) was independently developed without reference to Confidential Information, or (d) is required to be disclosed by valid legal order (with prompt notice to the disclosing party). Upon termination, each party shall return or destroy all Confidential Information and certify such destruction in writing. Confidentiality obligations survive termination for 3 years.

Credosis processes personal data in accordance with the PDPA 2026 and, where applicable, the GDPR and CCPA. Where Credosis acts as Data Processor on behalf of Client: processing is strictly in accordance with Client's documented instructions and applicable data protection law. A Data Processing Addendum (DPA) is available and, for EU/EEA clients, incorporates Standard Contractual Clauses (SCCs) for cross-border data transfers. Sub-processors are engaged only with prior notice and contractually bound to equivalent data protection obligations. In the event of a data breach, Credosis will notify Client and, where required, the National Data Management Authority (NDMA) within 72 hours. For healthcare technology engagements: Credosis acts strictly as Data Processor. Client (hospital, clinic, healthcare provider) is responsible for securing end-patient consent. Health and medical records are treated as Sensitive Personal Data with elevated security and consent requirements per PDPA 2026 Section 7.

(a) Services Warranty: Credosis warrants that Services will be performed in a professional and workmanlike manner consistent with generally accepted industry standards. (b) Defect Correction: Material defects in Deliverables reported within 90 days of final acceptance will be corrected at no additional cost, provided the defect is reproducible and attributable to Credosis's work. (c) Compliance: Credosis warrants compliance with applicable laws in its provision of Services. (d) Non-Infringement: Credosis warrants that Deliverables (excluding Client-provided materials and AI-generated outputs) will not infringe valid third-party intellectual property rights. (e) EXCEPT AS EXPRESSLY STATED, ALL SERVICES AND DELIVERABLES ARE PROVIDED "AS IS." CREDOSIS DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT WITH RESPECT TO AI-GENERATED OUTPUTS.

(a) EXCLUSION: NEITHER PARTY SHALL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, LOSS OF DATA, BUSINESS INTERRUPTION, OR THIRD-PARTY FAILURES, consistent with Section 73 of the Contract Act, 1872. (b) AGGREGATE CAP: Each party's total aggregate liability under this MSA shall not exceed the total fees paid or payable by Client under the applicable SOW(s) in the 12 months preceding the event giving rise to the claim. (c) SUPER-CAP: The foregoing cap does not apply to breaches of Section 9 (Confidentiality), Section 10 (Data Protection), or Section 6 (IP Rights), for which each party's liability is capped at 2x the trailing 12-month fees. (d) CARVE-OUTS: The limitations in this section do not apply to Client's payment obligations, fraud, or willful misconduct.

(a) By Credosis: Credosis shall indemnify, defend, and hold Client harmless from third-party claims that Deliverables (excluding AI-generated outputs and Client-provided materials) infringe valid third-party intellectual property rights. This indemnity is void if Client (i) knew the output was infringing, (ii) failed to use provided safety or compliance features, or (iii) intentionally directed the generation of copyrighted material. (b) By Client: Client shall indemnify Credosis from claims arising from (i) Client's misuse of Deliverables, (ii) violation of the AUP, (iii) claims arising from Client-provided materials or specifications, (iv) Client's deployment of AI-powered Deliverables for High-Risk Applications without appropriate oversight.

(a) Term: This MSA commences on the effective date and continues until terminated by either party. (b) Termination for Breach: Either party may terminate upon 30 days' written notice if a material breach remains uncured. (c) Termination for Convenience: Either party may terminate with 60 days' written notice. (d) Termination for Insolvency: Either party may terminate immediately if the other party becomes insolvent or enters liquidation. (e) Effect of Termination: Client pays for all Services performed, expenses incurred, and non-cancellable commitments made prior to termination. Credosis delivers work completed to date subject to payment. (f) Survival: Sections 6 (IP), 9 (Confidentiality), 10 (Data Protection), 11 (Warranties), 12 (Limitation of Liability), 13 (Indemnification), and 16 (General Provisions) survive termination.

Neither party shall be liable for delays or failure in performance caused by events beyond reasonable control, including: natural disasters, acts of war or terrorism, government orders, epidemics or pandemics, widespread telecommunications outages, prolonged cloud infrastructure failures (e.g., AWS, Azure, GCP downtime exceeding 48 hours), state-sponsored or large-scale cyberattacks, and disruptions to international payment or banking systems. The affected party must notify the other in writing within 5 business days and use commercially reasonable efforts to mitigate. If a Force Majeure Event continues for more than 90 consecutive days, either party may terminate affected SOW(s) without penalty.

(a) Governing Law: This MSA is governed by the laws of the People's Republic of Bangladesh. (b) Dispute Resolution — International Clients: Any dispute arising from or relating to this MSA shall be resolved by binding arbitration administered by the Singapore International Arbitration Centre (SIAC) under its prevailing rules. The seat of arbitration shall be Singapore. The language of arbitration shall be English. The arbitral tribunal shall consist of a sole arbitrator for claims under USD 500,000 and three arbitrators for claims above. (c) Dispute Resolution — Bangladeshi Clients: Disputes shall be subject to the exclusive jurisdiction of the courts in Dhaka, Bangladesh. (d) Pre-Arbitration Mediation: Both parties agree to attempt good-faith mediation for 30 days before initiating formal proceedings. (e) Entire Agreement: This MSA, together with executed SOWs and any DPAs, constitutes the entire agreement and supersedes all prior negotiations, representations, and agreements. (f) Severability: If any provision is held unenforceable, the remaining provisions continue in full force. (g) Assignment: Neither party may assign this MSA without prior written consent, except in connection with a merger, acquisition, or sale of substantially all assets. (h) Notices: All notices must be in writing and delivered via email to the designated contact or by registered post. (i) Amendment: This MSA may only be amended by a written instrument signed by both parties. (j) Independent Contractor: Credosis is an independent contractor. Nothing herein creates an employment, partnership, or joint venture relationship. (k) Non-Waiver: Failure to enforce any provision does not waive the right to enforce it later.