Enterprise Master Services Agreement

Provider: To be confirmed: legal entity name, a To be confirmed: legal entity type organized under the laws of To be confirmed: incorporation jurisdiction, with its registered office at To be confirmed: registered address ("SiteAxis"). Customer: To be confirmed: customer legal name, a To be confirmed: customer entity type having its principal address at To be confirmed: customer address ("Customer"). Effective Date: To be confirmed: agreement effective date.

This Master Services Agreement ("MSA") governs the Customer's enterprise subscription to SiteAxis's hosted project-management and project-controls software and any ordered professional services. It consists of this MSA, executed Order Forms and the incorporated schedules listed below. An individual user's website or application acceptance does not, by itself, prove authority to execute this MSA for a company.

1. Defined terms

1. Affiliate means an entity controlling, controlled by or under common control with a Party. An Affiliate is not an authorized Customer unless an Order Form expressly includes it or the MSA permits its participation.
2. Authorized User means an individual invited or provisioned into a permitted Company, Project or Module under the applicable permissions and contractual authority. Users may be employees, consultants, client representatives, general contractors, contractors, subcontractors, inspectors, supervisors or other approved project participants.
3. Company or Tenant means a customer-associated organizational scope in SiteAxis. It does not, without more, establish title to an entire construction project's records.
4. Project means a configured workspace and associated operational records, people, documents, permissions, workflow history and reporting. A real-world project can involve multiple legally distinct organizations.
5. Project Sponsor means the organization identified in the applicable Order Form or Project Collaboration Schedule as authorized to administer a shared Project and issue instructions to SiteAxis concerning that workspace within its legal authority.
6. Participating Organization means an independent organization granted access to a Project by an authorized sponsor or through an approved collaboration arrangement. A construction subcontractor is not automatically a privacy Subprocessor of SiteAxis.
7. Customer Data means records, information, attachments, images, schedules, forms, submissions and content uploaded to or generated within the Services by or for authorized organizations, excluding SiteAxis software, third-party licensed components and properly deidentified service telemetry. Personal data within Customer Data is subject to the DPA where applicable.
8. Customer Project Records include inspections, incidents, injury-related observations, safety and environmental reports, corrective actions, daily reports, permits, schedules (including P6/XER-derived records), risks, commercial records, equipment/asset entries, document versions, audit histories, exported reports and linked attachments.
9. Services means the hosted SiteAxis product features, modules, interfaces, authorized integrations and professional services expressly described in an Order Form, subject to applicable availability and role restrictions.
10. Order Form means an executed ordering instrument that identifies authorized Customer entities, Project scope, modules, subscriptions, prices, seats, term, and applicable schedules.
11. DPA means the separately executed or validly incorporated SiteAxis Data Processing Addendum and its activated annexes.
12. Confidential Information and Security Incident have the meanings in Sections 10 and the DPA respectively.
13. Documentation means generally supplied user and administrator instructions for the licensed Services, as updated without materially removing agreed capabilities during the paid Term.
14. Beta Features means capabilities expressly identified as trial, experimental, gated, preview or not generally available.

2. Contract documents and precedence

2.1 The following are incorporated only to the extent identified in an applicable Order Form or expressly stated to apply: (a) DPA and processing annexes; (b) Project Collaboration & Data Governance Schedule; (c) Security Measures Exhibit; (d) Customer Exit/Retention Schedule; (e) Support/SLA Schedule; (f) Acceptable Use Policy (AUP); (g) AI Feature Addendum; (h) Professional Services Statements of Work; and (i) Pilot Addendum.

2.2 For a conflict, legally mandatory terms and completed statutory data-transfer clauses control within their scope; the DPA controls Customer Personal Data processing; a specifically negotiated, signed Order Form controls its stated commercial deviation; the Project Collaboration Schedule controls authority over jointly accessed project records; this MSA then controls the remaining Services matters. Schedules govern their subject only. An online policy update cannot silently amend a countersigned pricing, liability or data-protection term.

2.3 If Customer purchasing terms, purchase-order boilerplate or procurement portal terms are submitted, they do not amend this MSA unless both parties expressly execute a written amendment referring to the provisions changed.

3. Service model and access rights

3.1 Subject to timely payment and compliance with this MSA, SiteAxis grants Customer a limited, non-exclusive, non-transferable (except as expressly permitted under Section 16) right during each Order Term to access and use subscribed Services for its authorized business and construction project operations. This is cloud-hosted SaaS, not a licence to install SiteAxis on Customer infrastructure; no source code or on-premise deployment is delivered by default.

3.2 Customer may authorize employees and relevant independent participants to access only those Projects and Modules for which Customer has power to grant access. SiteAxis may enforce company/project assignments, module entitlements, lifecycle states, individual role and MFA requirements. A user or organization's participation in a shared Project does not grant cross-project or cross-company rights.

3.3 Customer must appoint one or more administrators with documented authority to manage invitations, settings, project membership, contractors and subcontractors, data visibility and departures. Customer remains responsible for instructions and invitations it issues; it does not automatically assume responsibility for actions of users sponsored by a separate contracting customer.

3.4 Each Authorized User must use unique credentials; credential sharing, bypassing MFA, scraping or attempting to access another organization is prohibited. Customer will promptly revoke access of departing users and notify SiteAxis of suspected unauthorized activity using To be confirmed: security email.

3.5 SiteAxis may offer APIs, exports, integrations, AI-assisted functions, localization or other gated features subject to Order Form entitlements and technical release state. Documentation, marketing demonstrations and product roadmaps do not constitute a warranty that every described feature is currently live.

3.6 A Project Sponsor may authorize Participating Organizations to collaborate through a Project. Their underlying construction contracts, confidentiality duties, records ownership, professional obligations and statutory retention obligations remain separate. The Project Collaboration Schedule identifies the authorized instruction hierarchy; where disputed or incomplete, SiteAxis may preserve records and restrict irreversible actions pending reliable authority evidence or a lawful order.

4. Customer obligations and restrictions

4.1 Customer will provide accurate company/billing details, designate lawful administrators, obtain necessary permissions and notices for Project Records, use the Services only within approved scope, and require its invited users to observe the AUP. Customer controls the necessity and lawfulness of the information it submits, including injury and witness information entered in safety workflows.

4.2 Customer will not reverse engineer or redistribute the software except where law prevents that restriction; interfere with service security; circumvent role, tenant, entitlement or rate-limit controls; transmit malware; unlawfully surveil people; misrepresent the authority to share or delete joint project evidence; or use the service to violate applicable laws, orders or third-party rights.

4.3 Customer must independently review and approve all safety determinations, corrective actions, permit decisions, engineering/quality judgments, contractual notices, schedule analyses, P6/XER imports, commercial calculations, AI-assisted summaries and exports. SiteAxis is a workflow and evidence-management tool and does not act as the engineer of record, licensed safety practitioner, scheduler of record, legal adviser or contracting authority.

4.4 Customer will notify SiteAxis if regulatory, project owner or employer requirements impose exceptional retention, restricted disclosure, trade-secret, incident-reporting or data-localization obligations not expressly included in an Order Form. Additional services/controls require a separate assessment and written agreement.

5. Customer Data and collaborative evidence

5.1 Each submitting organization retains its underlying legal rights in Customer Data. Customer grants SiteAxis and its authorized processors a limited licence to host, transmit, process, display, back up and otherwise use Customer Data only to supply, secure, maintain and support the Services and as provided in the DPA and Privacy Policy. This licence ends as the data is disposed of under the applicable exit schedule, subject to permitted retention.

5.2 SiteAxis owns its platform software, interfaces, templates created by SiteAxis, general know-how and improvements, not project-specific Customer Data. SiteAxis does not acquire title to a user's construction photograph, uploaded record, schedule, drawing or other submitted project evidence merely because it is stored or converted to PDF.

5.3 Data shared within a Project may be visible to authorized users across organizations according to approved scopes. The contributing organization retains its rights in the original submission; other participants may need continued access for evidentiary, safety, contract or statutory purposes. No party may direct SiteAxis to destroy another party's legitimately retained records solely because it withdraws from a Project. The agreed Project Collaboration Schedule and lawful instructions govern conflicts.

5.4 Customer authorizes SiteAxis to generate export files, dashboards, reports, PDFs, calculated fields or derived workflow content as necessary to supply enabled features. Customer is responsible for checking recipients, document versions, project scopes and accuracy prior to external distribution. Generated output does not establish regulatory compliance or constitute an authoritative contract record unless the relevant parties separately agree.

5.5 SiteAxis may use truly aggregated, properly deidentified operational statistics to secure, operate and improve the service only where allowed by law, the Privacy Policy and the DPA; this clause does not authorize reuse or model training of identifiable Customer Project Records. Any optional AI processing requires the applicable AI Addendum and verified providers.

6. Data protection and security

6.1 The Parties will comply with data-protection law applicable to their respective activities. For Customer Personal Data processed by SiteAxis on Customer's behalf, the DPA governs roles, instructions, subprocessors, assistance, international transfers, security incidents and data return/deletion. For SiteAxis's direct account, billing, security, marketing and website processing, its Privacy Policy and applicable law govern as appropriate.

6.2 SiteAxis will maintain reasonable technical and organizational safeguards appropriate to the service, described in the approved Security Measures Exhibit. Only safeguards validated in that exhibit are commitments; SiteAxis does not represent possession of a SOC 2 certificate, ISO certification, independent penetration test, fixed hosting region or particular recovery objective unless specifically identified and supported in a signed schedule.

6.3 Each Party must protect credentials and Confidential Information and promptly report suspected security events through designated channels. Specific incident notice service levels are governed by the DPA and the executed incident-response schedule, not inferred from a technical design document.

7. Fees, invoicing, taxes and renewal

7.1 Customer will pay the fees, currency, payment method, billing intervals, project/user limits and permitted overages listed on the Order Form. Unless otherwise agreed, service usage outside the stated allowances requires Customer authorization or a stated overage schedule; SiteAxis will not invent unstated fees.

7.2 Invoices are payable within To be confirmed: payment terms days calendar days from invoice date in To be confirmed: payment currency, subject to the applicable Order. Fees exclude applicable taxes unless an Order expressly states otherwise. Tax responsibility, billing addresses, withholding requirements and exempt-customer documentation are described in To be confirmed: invoice tax handling.

7.3 Orders run for their stated initial Term. Renewal is To be confirmed: auto renewal mode; where automatic renewal is agreed, either party may give notice at least To be confirmed: renewal notice days days before expiration. Any price change for renewal requires at least To be confirmed: price increase notice days days notice, subject to non-waivable law and signed Order commitments. No automatic renewal is effective where these election terms remain blank.

7.4 Customer must notify SiteAxis promptly of a good-faith invoice dispute, identifying the disputed amount and reasons. Undisputed amounts remain payable. Late fees, if any, and cure periods are To be confirmed: late payment terms. No unilateral payment grace period is promised where the operating policy remains unapproved.

7.5 SiteAxis may suspend use for material non-payment, misuse or threat to security only as permitted by law and the applicable notice/cure and emergency provisions. Suspension does not itself authorize deletion of Customer Data, which remains governed by the exit schedule and applicable law.

8. Availability, maintenance and support

8.1 SiteAxis will provide the subscribed Services with commercially reasonable care and skill and use reasonable efforts to remedy material failures. Any measurable uptime percentage, support coverage, response target, maintenance exclusion or service credit applies only if populated and incorporated in an executed Support/SLA Schedule.

8.2 SiteAxis may perform planned maintenance, security patches and necessary emergency changes. Where practical, SiteAxis will give notice of a materially disruptive planned change through the designated Customer administrator. Beta Features may change or be withdrawn as governed by the Pilot Addendum or applicable product notice.

8.3 Third-party outages and Customer connectivity can affect Services. This does not excuse SiteAxis from obligations it expressly undertakes in the DPA, security exhibit or an executed SLA.

9. Product assurances and disclaimers

9.1 Each Party represents that it is duly authorized to enter into and perform this MSA. SiteAxis warrants that paid, generally available Services will materially conform to the Documentation during the applicable Order Term when used as authorized. Customer's initial remedy for a verifiable material nonconformity is reasonable correction or workaround; if SiteAxis cannot substantially correct it after To be confirmed: service remedy period days days following written notice, Customer may terminate the affected Order and receive a prorated refund of prepaid unused fees for that affected service, subject to counsel-approved allocation.

9.2 Except for the express warranties and non-waivable legal rights, Services are provided without additional implied warranties to the extent permissible. Beta Features are provided on a controlled-trial basis as described in the Pilot Addendum. No platform output, incident record, AI summary or uploaded schedule is a professional certification or proof that the underlying construction project satisfies contractual or regulatory requirements.

10. Confidentiality

10.1 Confidential Information means non-public technical, security, financial, pricing, strategic or business information designated confidential or reasonably understood to be confidential, including Customer Project Records and non-public SiteAxis platform information; personal data is additionally protected under the DPA and law.

10.2 The receiving Party will use Confidential Information only to perform or exercise rights under this MSA, exercise at least reasonable care, restrict access to personnel/advisers with a need to know and appropriate confidentiality duties, and not disclose it except as authorized or required by law. It will remain liable for its authorized recipients' misuse within the recipient's scope of responsibility.

10.3 Information is not confidential to the extent the recipient can demonstrate it became public without breach, was lawfully known without restriction, was lawfully received from a third party without duty, or was independently developed without use of protected information.

10.4 If compelled by law, the receiving Party may disclose only as required and, where lawful, give prompt notice and reasonable cooperation in seeking protective treatment. Confidentiality survives To be confirmed: confidentiality survival years years following expiration; trade secrets remain protected while legally qualifying as trade secrets, and privacy obligations last as required by law or the DPA.

11. Intellectual property, feedback and infringement

11.1 No intellectual property passes between the Parties except expressly licensed. Customer retains its own records, processes, trademarks and proprietary methods. SiteAxis retains its software, trademarks, product documentation, UI and pre-existing technology.

11.2 If Customer supplies suggestions, SiteAxis may use general non-confidential feedback to improve the platform without identifying Customer publicly, disclosing Customer Data or violating confidentiality/data rights. This does not grant rights to train third-party AI models on Customer Data.

11.3 Subject to Section 13 and the exclusions below, SiteAxis will defend a third-party claim alleging generally available SiteAxis software (as supplied and unmodified) infringes Canadian or applicable agreed intellectual-property rights and pay final court-awarded damages or SiteAxis-approved settlements. It may procure continued use, modify/replace the affected service materially equivalently or terminate it with a prorated refund. Exclusions: Customer Data, third-party systems, unauthorized modifications, non-approved combinations or use beyond the Order. To be confirmed: ip indemnity scope requires counsel approval for coverage geography and exclusions.

12. Indemnification process and Customer claims

12.1 Subject to the agreed liability allocation, Customer will defend claims by third parties to the extent resulting from Customer-provided unlawful content or Customer's violation of third-party intellectual-property or privacy rights in Customer Data, except to the extent caused by SiteAxis's breach or unauthorized processing. Allocation for independently sponsored participating organizations follows their signed agreements and factual control, not merely Project membership.

12.2 An indemnified Party must provide reasonably prompt written notice, reasonable cooperation at the indemnifying Party's expense, and control of defence to the indemnifying Party, subject to counsel approval for conflicts of interest and any settlement affecting admissions, injunctive obligations or protected data. Delay relieves the indemnifier only to the extent materially prejudiced.

13. Liability allocation

13.1 To the maximum extent permitted by law, neither Party is liable under this MSA for unforeseeable indirect, special, punitive or consequential damages, except for To be confirmed: exclusion of damages exceptions. Because schedule delay, site safety and commercial claims can have substantial and unusual consequences, counsel must review this allocation and applicable jurisdictional enforceability.

13.2 Each Party's aggregate liability is limited to To be confirmed: msa liability cap basis. Specific caps or uncapped categories (if any) for security incidents, privacy breaches, confidentiality, indemnities, unpaid charges, deliberate misconduct and personal injury are To be confirmed: msa supercap and carveouts. This section is not ready for signature while those terms are unresolved.

13.3 Nothing excludes liability which cannot lawfully be excluded. No provision limits obligations under mandatory data protection law or binding transfer clauses to the extent such limitation is prohibited.

14. Suspension and termination

14.1 Either Party may terminate an affected Order for the other's material breach if not cured within To be confirmed: material breach cure days days after written notice reasonably describing the breach. Either Party may terminate immediately where continued performance would be unlawful, or in other circumstances expressly agreed in writing.

14.2 SiteAxis may temporarily restrict affected users, endpoints or Projects to prevent imminent compromise or material abuse, applying measures proportionate to the threat and informing the authorized administrator where feasible and lawful. Safety/security suspension shall not imply that the underlying project evidence has been deleted.

14.3 On expiration or termination, subscription access ends or enters a restricted transition state as stated in the Customer Exit Schedule. Customer Data export, legal holds, shared-project evidence, deletion, backup expiry and associated fees follow the executed schedule; no fixed automatic deletion, unrestricted self-service export or data-residency guarantee is implied.

14.4 Each Party will return or destroy the other's Confidential Information as practicable, except lawfully retained records, backup copies governed by documented controls and continuing rights/obligations. Accrued undisputed fees, confidentiality, data protection, IP rights, liability allocation, dispute resolution and provisions designed to survive remain effective.

15. Compliance and project-sector matters

15.1 The Parties will comply with applicable anti-bribery, export controls, sanctions and privacy laws in performing this MSA. Neither Party is required to comply with laws that do not apply to it merely because a template refers to them. Customer is responsible for its occupational health and safety reporting, site permit authorizations, labour/union duties, construction lien/holdback processes, records retention, inspections and professional review unless expressly assumed in a separate SOW.

15.2 SiteAxis can preserve event histories and output records for authorized users but is not a legal escrow, official permit issuer, digital signature certifying authority or statutory notice service without an expressly contracted capability.

15.3 Customer will not rely solely on SiteAxis to dispatch time-critical emergency, regulatory or contractual notices. Human confirmation of recipients, deadlines and delivery remains required unless a separately validated and ordered notification service explicitly covers that obligation.

16. General terms

16.1 Independent contractors. The Parties are independent contractors, not agents, partners or joint employers; access by contractor/subcontractor users does not change their employer or contractual status.

16.2 Assignment. Neither Party may assign this MSA without written consent, not unreasonably withheld, except to a successor in a bona fide business transfer that assumes the obligations and does not materially diminish security, subject to law and applicable notice. A transfer of a construction Project is not necessarily assignment of a SiteAxis subscription.

16.3 Force majeure. A Party is excused for failure caused by events beyond reasonable control if it mitigates impacts, notifies the other and resumes promptly; this does not automatically excuse payment obligations already due, confidentiality breaches caused by avoidable failures or mandatory statutory duties.

16.4 Notices. Contractual notices must be in writing by the contact method recorded in the Order Form and to SiteAxis at To be confirmed: legal notices email and To be confirmed: registered address. Material security notices use To be confirmed: security email. Routine product notices may use authorized account contacts, subject to applicable law.

16.5 Governing law and venue. This MSA is governed by To be confirmed: governing law, excluding conflicts rules, and disputes not resolved after good-faith escalation within To be confirmed: dispute escalation days days are submitted to To be confirmed: courts venue, except either party may seek urgent protective relief or exercise mandatory statutory rights.

16.6 Entire agreement and changes. This MSA, signed Orders and incorporated schedules constitute the entire agreement on their subject. Amendments require authorized written agreement, except operational policy changes expressly permitted that do not diminish signed protections. Invalid portions may be severed without defeating the remainder. No waiver is effective unless in writing. Electronic counterpart signatures are permitted subject to applicable law.

16.7 Order of signatures. Signatories warrant legal authority to bind the named Party; a SiteAxis platform-role assignment alone does not establish corporate signature authority.

Signatures

Incorporated documents: Order Form no. To be confirmed: order number and the schedules expressly listed and completed therein.