OEM Object Code License Agreement - RSA Data Security Inc. and Tumbleweek Software Inc.


           Confidential treatment has been requested with respect to certain
     information contained in this document.  Confidential portions have been
     omitted from the public filing and have been filed separately with the
     Securities and Exchange Commission.


                              RSA DATA SECURITY, INC.
                           100 MARINE PARKWAY, SUITE 500
                               REDWOOD CITY, CA 94065

                         OEM OBJECT CODE LICENSE AGREEMENT


       This OEM OBJECT CODE LICENSE AGREEMENT ("Agreement"), effective as of 
the later date of execution ("Effective Date"), is entered into by and 
between RSA Data Security, Inc., a Delaware corporation ("RSA"), having a 
principal address at 100 Marine Parkway, Suite 500, Redwood City, California 
94065, and the entity named below ("OEM"), having a principal address as set 
forth below.

OEM:

Tumbleweed Software, a California corporation
-----------------------------------------------------------------------
(Name and jurisdiction of incorporation)

2010 Broadway, Redwood City, CA 94063
-----------------------------------------------------------------------
(Address)

Notices to Contact:  Bill Bradford,
                     ---------------------------------------------------
                     Vice President Strategic Relationships
                     ---------------------------------------------------
                     (650) 569-3687
                     ---------------------------------------------------
                     (Name, Title and Telephone)

RSA SOFTWARE:

BSAFE-Registered Trademark- 3.0, consisting of the following algorithms: RSA, 
DES, DESX., 3DES, RC2, RC4, RC5, MD, MD2, MD5, SHA, DSA, Diffie-Hellman; 
TIPEM-Registered Trademark- 2.0, consisting of the following algorithms: RSA, 
DES, 3DES, RC2, RC5, MD5, SHA, JSAFE-Registered Trademark- 1.0, consisting of 
the following algorithms: RSA, DES, 3DES, RC2, RC4, RC5, MD5, SHA, 
Diffie-Hellman.  (The RSA Software provided by RSA on the Windows 95/NT 
platform.)

OEM may obtain copies of the RSA Software on other platforms as may be 
generally available at RSA's then current published price list, each 
additional platform version of which will be covered RSA Software under this 
Agreement.

           Confidential treatment has been requested with respect to certain
     information contained in this document.  Confidential portions have been
     omitted from the public filing and have been filed separately with the
     Securities and Exchange Commission.




DELIVERY OF RSA SOFTWARE TO OEM:

One (1) copy of each of the Object Code and the User Manual for the RSA 
Software identified above:

       [X]    has been received by OEM, or

       [ ]    will be delivered by RSA as soon as practicable, but not later
              than ten (10) business days after the date of execution of this
              Agreement.

BUNDLED PRODUCT:

OEM's software products currently known as 1) "Posta Server" ("Server Bundled 
Product") which holds and forwards Posta-generated documents to Posta 
Recipient Client, 2) "Posta Desktop Client," which encrypts and signs 
documents being sent to Server Bundled Product, 3) "Posta Recipient Client," 
which decrypts documents and validates signatures.  The Posta Desktop Client 
and the Posta Recipient Client are referred to collectively as the "Client 
Bundled Products."

FIELD OF USE:

Solely for privacy and authentication of communications between the Server 
Bundled Product and the Client Bundled Products within a closed system, 
JSAFE-Registered Trademark- v.1.0 shall perform decryption and authentication 
functions only.

INITIAL MAINTENANCE AND SUPPORT:

       [X]    Yes           [  ]    No


1.     DEFINITIONS
       -----------

       The following terms when used in this Agreement shall have the 
following meanings:

       1.1    "Bundled Product(s)" means one or more of the products or 
product groups described above which has been or will be developed by OEM and 
which incorporates in the OEM Product in any manner any portio of the RSA 
Software.  A Bundled Product must represent a significant functional and 
value enhancement to the RSA Software such that the primary reason for an End 
User Customer to license such Bundled Product is other than the right to 
receive a license to the functionality of the RSA Software included in the 
Bundled Product.

       1.2    "Distributor" means a dealer or distributor in the business of 
reselling Bundled Products to End User Customers, directly or through one or 
more Distributors, by virtue of 


                                       2


authority of OEM.  Bundled Products resold by a Distributor shall bear OEM's 
trademarks and service marks and shall not be privately labeled by such 
Distributor or other parties.  A Distributor shall have no right to modify 
any part of the Bundled Products.  Notwithstanding the foregoing, OEM may 
authorize a Distributor to co-brand or private label the Bundled Products for 
redistribution to End User Customers by such Distributor; provided that OEM 
indicates in it licensing reports delivered pursuant to Section 3.7 the 
identity of any Distributor so authorized and the name of the co-branded or 
private-labeled Bundled Products.  It is understood and agreed that a 
Distributor authorized to co-brand or private label a Bundled Product may not 
otherwise modify the Bundled Product or incorporate it into another product 
for redistribution.

       1.3    "End User Customer" mans a person or entity licensing RSA 
Software as part of a Bundled Product from OEM, OEM Sublicensee, Corporate 
Sublicensee or a Distributor solely for personal or internet use and whose 
primary purpose in licensing the Bundled Product is other than to license, 
assign or otherwise transfer such Bundled Product to any other person or 
entity.

       1.4    "Field of Use" means a use, method of incorporation or product 
purpose limitation with respect to the RSA Software for a Bundled Product 
specified above for such Bundled Product.

       1.5    "RSA Software" means RSA's proprietary software identified 
above (and including only those algorithms listed therewith), as further 
described in the User Manual(s) associated therewith.

       1.6    "OEM Product" means any product developed by OEM into which the 
RSA Software is to be incorporated to create a Bundled Product.

       1.7    "Object Code" means the RSA Software in machine-readable, 
compiled object code or in the case RSA Software includes JSAFE, in Java byte 
code form.

       1.8    "Source Code" means the mnemonic, high level statement versions 
of the RSA Software written in the source language used by programmers.

       1.9    "Territory" means worldwide, subject to Section 10.7.

       1.10   "User Manual" means the most current version of the user manual 
and/or reference manual customarily supplied by RSA to OEMs who license the 
Object Code.

2.     LICENSES.
       --------

       2.1    LICENSE GRANT.  During the term of this Agreement and within 
the Field of Use limitation (if any), RSA hereby grants OEM a non-exclusive, 
non-transferable license to:


                                       3


              2.1.1  (i) incorporate the Object Code into an OEM Product to 
create a Bundled Product; and (ii) reproduce, have reproduced, and license or 
otherwise distribute the Object Code as incorporated in a Bundled Product in 
the Territory.

              2.1.2  sublicense its rights granted in Section 2.1.1 with 
respect to the RSA Object Code as part of the Bundled Products to OEM's 
licensees in the Territory (each, an "OEM Sublicensee") for the use only in 
their own products in which substantial functionality or value is added to 
the Bundled Products so that such products are not a substitute for the RSA 
Software (collectively, "Sublicensee Products").

              2.1.3  sublicense its rights granted in Section 1.1 to 
distribute the RSA Object Code as part of the Client Bundled Products to 
OEM's End User Customers of the Bundled Products in the Territory who are 
either (i) Posta Service Providers (as defined below), or (ii) corporate End 
User Customers operating a service for internal business purposes using the 
Bundled Products (collectively, "Corporate Sublicensees") and who in each 
case may make minor changes to the user interfaces in the Bundled Products 
but no substantial changes in functionality (collectively, "Corporate 
Sublicensee Products"), provided that only the client components of such 
Corporate Sublicensee Products are licensed or otherwise distributed and only 
for use in obtaining the Posta Service or supporting the Corporate 
Sublicensee's's service for internal business purposes, and not as commercial 
products.

              2.1.4  (i) use the User Manual to support End User Customers; 
(ii) modify and incorporate portions of the User Manual in Bundled Product 
documentation; and (iii) reproduce, have reproduced and distribute in the 
Territory such portions of the User Manual as incorporated in Bundled Product 
documentation.

       2.2    LIMITATIONS ON LICENSES.  The licenses granted in Section 2.1 
are further limited as follows:

              2.2.1  LIMITATION ON DISTRIBUTEES.  The RSA Software shall bel 
licensed or otherwise distributed only to (i) Distributors, (ii) End User 
Customers, (iii) OEM Sublicensees, and (iv) Corporate Sublicensees.

              2.2.2  NO EXPOSURE OF RSA SOFTWARE.  The RSA Software may only 
be accessed by the functionality of the Bundled Product in which it is 
included and a Bundled Product shall not make the RSA Object Code directly 
accessible to End User Customers or to products other than the Bundled 
Product or otherwise expose a cryptographic API.

              2.2.3  NO STANDALONE PRODUCT.  OEM may not in any way sell, 
lease, rent, license, sublicense or otherwise distribute the RSA Software or 
any part thereof or the right to use the RSA Software or any part thereof to 
any person or entity except as part of a Bundled Product.


                                       4


              2.2.4  PROHIBITED ACTIVITIES; NO SOURCE CODE.  OEM shall not 
modify, translate, reverse engineer, decompile, or disassemble the RSA 
Software or any part thereof or otherwise attempt to derive Source Code 
therefrom, and shall not authorize any third party to do any of the 
foregoing.  Nothing in this Agreement grants OEM any rights, license or 
interest with respect to Source Code.

              2.2.5  RSA ROOT KEYS.  OEM may include the RSA/VeriSign, Inc. 
root keys (the "RSA Root Keys") in any Bundled Product in which a hierarchy 
root key is utilized or incorporated, provided that any such incorporation 
must make the RSA Root Keys functional within the Bundled Products and as 
accessible as any other hierarchy root key within the Bundled Product.

              2.2.6  CONDITION OF SUBLICENSE GRANT.  All sublicenses 
permitted under Sections 2.1.2 and 2.1.3 shall be subject to all of the 
following conditions:  (i) all such sublicenses will be granted in a signed 
writing containing at a minimum substantially all of the restrictions set 
forth in Exhibit "A" attached hereto, and RSA shall be an express third party 
beneficiary of the such sublicense agreements; (ii) OEM shall use its best 
efforts to enforce the provisions of such sublicense as they relate to RSA 
and the RSA Software; (iii) the Sublicensee Products shall include 
substantial added function and value on top of the Bundled Products; (iv) the 
OEM Sublicensees and Corporate Sublicensees to whom such rights are 
sublicensed pursuant to Sections 2.1.2 and 2.1.3 shall have no further right 
to sublicense such rights; (v) any rights of any OEM Sublicenses or Corporate 
Sublicensee sublicensed by OEM shall survive only so long as both this 
Agreement and the sublicense between OEM and such OEM Sublicensee or 
Corporate Sublicensee remain in effect; and (vi) OEM shall identify all OEM 
Sublicensees and Corporate Sublicensees in its licensing reports delivered 
pursuant to Section 3.7.

       2.3    TITLE.  Except for the limited licenses expressly granted in 
Section 2.1 and as further limited by Section 2.2, RSA does not by this 
Agreement grant to OEM any right, title or ownership interest in and to the 
RSA Software or in any related patents, trademarks, copyrights or proprietary 
or trade secret rights.  RSA receives no right, title or ownership interest 
in the OEM product by way of this Agreement.

3.     LICENSE FEES; DELIVERY.
       ----------------------

       3.1    LICENSE FEES.  In consideration of RSA's grant to OEM of the 
limited license rights hereunder, OEM shall pay to RSA license fees in the 
amounts set forth below (the "License Fees"):


                                       5


              3.1.1  ANNUAL LICENSE FEE.  OEM shall pay RSA an annual License 
Fee during the term of this Agreement in the amount of 
[                 *                 ], for unlimited distribution of Client 
Bundled Products and Server Bundled Product.  Such amount shall be due and 
payable for the first year upon execution of this Agreement, and for each 
subsequent year on the anniversary of the Effective Date of this Agreement.

              3.1.2  PERCENTAGE OF PRODUCT REVENUE LICENSE FEE.  In addition 
to the License Fees set forth above, OEM shall pay to RSA as License Fees an 
amount equal to [    *    ] of all Product Revenue.

              3.1.3  PERCENTAGE OF SERVICE REVENUE LICENSE FEE.  The parties 
acknowledge and agree that OEM's licensees of the Bundled Products may use 
the Bundled Products, Sublicensee Products or Corporation Sublicensee 
Products to provide an electronic document distribution service to third 
parties (the "Posta Service").  Under OEM's current business model, such 
licensees ("Posta Service Providers') will pay OEM a percentage of the 
transaction and/or subscription revenue from the Posta Service and may pay 
OEM an initial license fee for the right to offer the Posta Service.  Based 
upon the foregoing, and in addition to the License Fees set forth above, OEM 
shall pay to RSA as License Fees an amount equal to [          *           ] 
of all Service Revenue.  "Service Revenue" means the gross amount of all 
cash, in-kind or other consideration receivable by OEM from Posta Service 
Providers at any time in connection with their providing the Posta Service, 
whether as a percentage of transaction and/or subscription revenue, as an 
initial license fee, or otherwise.

              3.1.4  CHANGE IN BUSINESS MODEL.  The License Fees set forth in 
Section 3.1.3 are based upon OEM's business model described above.  In the 
event OEM changes its business model, OEM agrees to negotiate in good faith 
for alternative License Fees that result in substantially the same payments 
to RSA for substantially the same value to OEM as those provided for in 
Section 3.1.3.

              3.1.5  [              *                ]

       3.2    TAXES.  All taxes, duties, fees and other governmental charges 
of any kind (including sales and use taxes, but excluding taxes based on the 
gross revenues or net income of RSA) which are imposed by or under the 
authority of any government or any political subdivision thereof on the 
License Fees or any aspect of this Agreement shall be borne by OEM and shall 
not be considered a part of, a deduction from, or an offset against License 
Fees.

---------------------

       *      Confidential treatment has been requested with respect to 
certain information contained in this document.  Confidential portions have 
been ommited from the public filing and have been filed separately with the 
Securities and Exchange Commission.


                                       6


       3.3    PREPAYMENT OF LICENSE FEES.  OEM shall prepay License Fees in 
the amount  [                     *               ] upon execution of this 
Agreement.  In no event shall such prepayment be refundable.  All of such 
prepaid amounts may be offset against License Fees accrued under Section 
3.1.2 at a rate of [                  *                 ] of License Fees 
accrued under Sections 3.1.2 and 3.1.3 until the prepayments are exhausted.  
OEM shall show the application of prepaid License Fees in the licensing 
reports provided to RSA pursuant to Section 3.7.

       3.4    USE OF PRODUCT REVENUE.  "Product Revenue" means the gross 
amount of all cash, in-kind or other consideration receivable by OEM at any 
time in consideration of the licensing or other distribution of the Bundled 
Products, whether as a sale, license, use, transaction, or service fee based 
on or involving the Bundled Product, but excluding any amounts receivable by 
OEM for standard maintenance and support fees which are not intended to avoid 
any payment of royalties under this Agreement, sales and use taxes, shipping, 
insurance and duties, and reduced by all discounts or refunds granted in the 
ordinary course of business, and excluding Service Revenue.  For the purposes 
of determining Product Revenue, the amount of in-kind or other non-cash 
consideration receivable by OEM shall be deemed to have a dollar value equal 
to the standard price (as listed in OEM's published price schedule on the 
date of the grant of the license or the sale in question) for such Bundled 
Product, less all cash paid.  For purposes of this Section 3.4 and Section 
3.1.3, in-kind or non-cash consideration does not include the standard 
marketing consideration that OEM requires in its standard license agreement 
for the Bundled Products under OEM's standard pricing.

       3.5    TERMS OF PAYMENT.  License Fees payable under Section 3.1.2 
shall accrue with respect to Bundled Products licensed or otherwise 
distributed by OEM, OEM Sublicensees, Corporate Sublicensees or Distributors, 
as applicable, upon the date of invoice of the Bundled Product, Sublicensee 
Product or Corporate Sublicensee Product, as applicable, to an End User 
Customer or Distributor.  License Fees payable under Section 3.1.3 shall 
accrue upon the date the applicable Service Revenue is due and payable from 
Posta Service Providers to OEM.  Such License Fees shall be paid by OEM to 
the attention of the Software Licensing Department at RSA's address set forth 
above on or before the thirtieth (30th) day after the close of the calendar 
quarter during which the License Fees accrued.  A late payment penalty on any 
License Fees not paid when due shall be assessed at the rate of one percent 
(1%) per thirty (30) days, beginning on the day after the delayed License 
Fees were due.

       3.6    U.S. CURRENCY.  All payments hereunder shall be made in lawful 
United States currency and shall in no case be refundable.  If OEM receives 
payment in foreign currencies, the amount of its License Fees to RSA shall be 
calculated using the closing exchange rate published 

---------------------
       *      Confidential treatment has been requested with respect to 
certain information contained in this document.  Confidential portions have 
been ommited from the public filing and have been filed separately with the 
Securities and Exchange Commission.


                                       7


in THE WALL STREET JOURNAL, Western Edition, on the last business day such 
journal is published in the calendar quarter immediately preceding the date 
of payment.

       3.7    LICENSING REPORT.  A report in reasonably detailed form setting 
forth the calculation of License Fees due from OEM and signed by a reasonable 
officer of OEM shall be delivered to RSA on or before the thirtieth (30th) 
day after the close of each calendar quarter during the term of this 
Agreement, regardless of whether License Fee payments are required to be made 
pursuant to Section 3.5.  The report shall include, at a minimum, the 
following information with respect to the relevant quarter:  (I) the total 
Product Revenue invoiced to OEM Sublicensees, Corporate Sublicensees, 
Distributors and End User Customers; (iii) the total Service Revenue due and 
payable from Posta Service Providers' and (iii) total License Fees accrued.

       3.8    AUDIT RIGHTS.  RSA shall have the right, at its sole cost and 
expense, to have an independent certified public accountant conduct during 
normal business hours and not more frequently than annually, an audit of the 
appropriate records of OEM to verify the amount of Product Revenue and 
Service Revenue and OEM's calculation of License Fees.  If the License Fees 
accrued are different than those reported, OEM will be invoiced or credited 
for the difference, as applicable.  Any additional License Fees, along with 
the late payment penalty assessed in accordance with Section 3.5, shall be 
payable within thirty (30) days of such invoice.  If the deficiency in 
License Fees paid by OEM is greater than ten percent (10%) of the License 
Fees reported by OEM for any quarter, OEM will pay the reasonable expenses 
associated with such audit, in addition to the deficiency.

       3.9    EVALUATION COPIES.  [INTENTIONALLY OMITTED.]
              -----------------

4.     LIMITED WARRANTY.
       ----------------

       4.1    LIMITED WARRANTY.  During the initial ninety (90)-day term of 
this Agreement, RSA warrants that the RSA Software will operate in material 
conformance to RSA's published specifications for the RSA Software.  RSA does 
not warrant that the RSA Software or any portion thereof is error-free.  
OEM's exclusive remedy, and RSA's entire liability in tort, contract or 
otherwise, shall be correction of any warranted nonconformity as provided in 
Section 4.2. This limited warranty and any obligations of RSA hereunder shall 
not apply to any nonconformities caused by, and shall terminate immediately 
if OEM makes, any unauthorized modification to the RSA Software.

       4.2    ERROR CORRECTION.  In the event OEM discovers an error in the 
RSA Software which causes the RSA Software not to operate in material 
conformance to RSA's published specifications therefor, OEM shall submit to 
RSA a written report describing such error in sufficient detail to permit RSA 
to reproduce such error.  Upon receipt of any such written report, RSA will 
use its reasonable business judgment to classify a reported error as either:  
(i) a "Level 1 Severity" error, meanding an error that causes the RSA 
Software to fail to operate in a material 


                                       8


manner or to produce materially incorrect results and for which there is no 
workaround or only a difficult woraround; or (ii) a "Level 2 Severity" error, 
meaning an error that produces a situation in which the RSA Software is 
usable but does not function in the most convenient or expeditious manner, 
and the use or value of the RSA Software suffers no material impact. RSA will 
acknowledge receipt of a conforming error report within two (2) business days 
and (A) will use its continuing best efforts to provide a correction for any 
Level 1 Severity error to OEM as early as practicable; and (B) will use its 
reasonable efforts to include a correction for any Level 2 Severity error in 
the next release of the RSA Software.

       4.3    DISCLAIMER.  EXCEPT FOR THE EXPRESS LIMITED WARRANTY PROVIDED 
IN THIS SECTION 4, THE RSA SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY WARRANTY 
WHATSOEVER.   RSA DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS 
TO ANY MATTER WHATSOEVER, INCLUDING ALL IMPLIED WARRANTIES OF 
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF 
THIRD PARTY RIGHTS. RSA DISCLAIMS ANY WARRANTY OR REPRESENTATION TO ANY 
PERSON OTHER THAN OEM WITH RESPECT TO THE RSA SOFTWARE.  OEM SHALL NOT, AND 
SHALL TAKE ALL MEASURES NECESSARY TO INSURE THAT ITS AGENTS AND EMPLOYEES DO 
NOT, MAKE OR PASS THROUGH ANY SUCH WARRANTY ON BEHALF OF RSA TO ANY 
DISTRIBUTOR, END USER CUSTOMER OR OTHER THIRD PARTY.

5.     ADDITIONAL OBLIGATIONS OF OEM.
       -----------------------------

       5.1    USE OF RSA "LICENSE SEAL".  OEM agrees to insert and maintain 
within Bundled Products and marketing materials therefor the RSA "Licensee 
Seal" from the "Logo Usage Guide," which shall be delivered to OEM within ten 
(10) days of execution of this Agreement and is Incorporated herein by 
reference, as follows:

              5.1.1  IN BUNDLED PRODUCTS.  OEM shall ensure display of the 
Licensee Seal within any Bundled Product such that users thereof are exposed 
to the Licensee Seal during normal operation of such Bundled Product.  In a 
software Bundled Product, the Licensee Seal shall be featured in such Bundled 
Product's startup splash screen (if any) and within security-related dialog 
windows visible in the normal operation of the product (i.e., password dialog 
window).  In a hardware Bundled Product, the Licensee Seal shall be visible 
on the panel of such Bundled Product most normally viewed by the user.

              5.1.2  IN MARKETING MATERIALS.  OEM agrees to provide the 
Licensee Seal within related marketing materials that reference any security 
features of the Bundled Products, including but not limited to printed and 
electronic data sheets, direct mail, user documentation, product packaging 
and advertisements for the Bundled Product.


                                       9


       5.2    BUNDLED PRODUCT MARKETING.  OEM is authorized to represent to 
Distributors and End User Customers only such facts about the RSA Software as 
RSA states in its published product descriptions, advertising and promotional 
materials or as may be stated in other non-confidential written material 
furnished by RSA.

       5.3    CUSTOMER SUPPORT.  OEM shall, at its expense, provide all 
support for the Bundled Products to Distributors and End User Customers.

       5.4    LICENSE AGREEMENTS.  OEM shall cause to be delivered to each 
Distributor and End User Customer a license agreement which shall contain, at 
a minimum, substantially all of the limitations of rights and the protections 
for RSA which are contained in Sections 2.2, 5.5, 7, 10.7 and 10.8 of this 
Agreement.  OEM shall use commercially reasonable efforts to enforce the 
terms of such agreements.

       5.5    PROPRIETARY RIGHTS.
              ------------------

              5.5.1  RSA COPYRIGHT NOTICES.  OEM agrees not to remove or 
destroy and proprietary, trademark or copyright markings or notices placed 
upon or contained within the RSA Software, User Manuals or any related 
materials or documentation.  OEM further agrees to insert and maintain within 
every Bundled Product and any related materials or documentation a copyright 
notice in the name of OEM.

              5.5.2  TRADEMARKS.  By reason of this Agreement or the 
performance hereof, OEM shall acquire no rights of any kind in any RSA 
trademark, trade name, logo or product designation under which the RSA 
Software was or is marketed and OEM shall not make any use of the same for 
any reason except as expressly authorized by this Agreement or otherwise 
authorized in writing by RSA.  OEM shall cease to use the markings, or any 
similar markings, in any manner on the expiration or other termination of 
this Agreement.

6.     CONFIDENTIALITY.  Each party acknowledges that in its performance of 
its duties hereunder, the other party may communicate to it (or its 
designees) certain confidential and proprietary information of such party, 
provided that such Confidential Information is clearly identified in writing 
at the time of disclosure (the "Confidential Information"), all of which is 
confidential and proprietary to, and a trade secret of the disclosing party.  
The receiving party agrees to hold the Confidential Information disclosed to 
it within its own organization and shall not, without the specific written 
consent of the disclosing party or as expressly authorized herein, utilize in 
any manner, publish, communicate, or disclose any part of the disclosing 
party's Confidential Information or the RSA Software (in the case of OEM) to 
third parties.  This Section 6 shall impose no obligations on either party 
with respect to any Confidential Information which:  (i) is in the public 
domain at the time disclosed by the disclosing party; (ii) enters the public 
domain after disclosure other than by a breach of the receiving party's 
obligations hereunder or by a breach of another party's confidentiality 
obligation; (iii) is shown by documentary evidence to have been known by the 
receiving party prior to its receipt from the 


                                      10


disclosing party or developed independently without reference to Confidential 
Information; or (iv) is required to be disclosed by law.  Each party will 
take such steps as are consistent with its protection of its own confidential 
and proprietary information (but will in no event exercise less then 
reasonable care) to insure that provisions of this Section 6 are not violated 
by its employees, agents or any other person.  The terms of this Agreement 
are deemed Confidential Information and may not be disclosed without the 
prior written consent of the other party, except (i) either party may 
disclose such terms to the extent required by law; (ii) either party may 
disclose the existence of this Agreement; (iii) either party may disclose 
such terms to the extent necessary in connection with the due diligence 
review of such party by potential business partners, investors or acquirors, 
to such persons and to their employees, agents, attorneys and auditors, if 
such persons are bound by written confidentiality agreements covering 
third-party information; and (iv) both parties shall have the right to 
disclose that OEM is an OEM of the RSA Software and that any 
publicity-announced Bundled Product incorporates the RSA Software.

7.     LIMITATION OF LIABILITY.  IN NO EVENT WILL EITHER PARTY BE LIABLE TO 
THE OTHER PARTY FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY 
DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT, INCLUDING BUT NOT 
LIMITED TO LOST PROFITS, BUSINESS INTERRUPTION, OR LOSS OF BUSINESS 
INFORMATION, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH 
DAMAGES, REGARDLESS OF THE CAUSE OF ACTION OR THE FORM OF ACTION, RSA'S 
AGGREGATE LIABILITY TO OEM FOR ACTUAL DAMAGES ARISING OUT OF OR RELATED TO 
THIS AGREEMENT SHALL BE LIMITED TO THE TOTAL AMOUNT PAID BY OEM HEREUNDER, 
EXCEPT FOR RSA'S LIABILITY ARISING UNDER SECTIONS 6 AND 8.  DURING THE TERM 
OF THIS AGREEMENT OEM'S AGGREGATE LIABILITY TO RSA FOR ACTUAL DAMAGES ARISING 
OUT OF OR RELATED TO THIS AGREEMENT SHALL BE LIMITED TO THE TOTAL AMOUNT 
PAYABLE BY OEM TO RSA HEREUNDER, EXCEPT FOR OEM'S LIABILITY RESULTING FROM 
BREACH OF SECTIONS 2 AND 6.

8.     INTELLECTUAL PROPERTY INDEMNITY.
       -------------------------------

       8.1    DUTY TO DEFEND.  RSA agrees that it shall, at its own expense, 
defend, or at its option settle, any action instituted against OEM, and pay 
any award or damages assessed against OEM or agreed to be paid by OEM in 
settlement resulting from such action, insofar as the same is based upon a 
claim that any RSA Software used in accordance with the terms of this 
Agreement infringes any United States patent, copyright or trade secret or a 
claim that RSA has no right to license the RSA Software hereunder, provided 
that OEM gives RSA; (i) prompt notice in writing of such action, (ii) the 
right to control and direct the investigation, preparation, defense and 
settlement of the action; and (iii) reasonable assistance and information.

       8.2    RSA OPTIONS.  If, as a result of any binding settlement among 
the parties or a final determination by a court of competent jurisdiction, 
any of the RSA Software is held to infringe and its use is enjoined, or if 
RSA reasonable determines in its sole discretion that the 


                                      11


RSA Software may become subject to an inunction, RSA shall have the option to 
obtain the right to continue use of the RSA Software or replace or modify the 
RSA Software so that it is no longer infringing.  In the event that neither 
of the foregoing options is reasonably available, then RSA may refund the 
License Fees paid by OEM hereunder less depreciation for use assuming 
straight line depreciation over a five (5)-year useful life and terminate the 
Agreement.

       8.3    EXCLUSIONS.  Notwithstanding the foregoing, RSA shall have no 
liability under this Section 8 if the alleged infringement arises from (i) 
the use of other than current unaltered release of the RSA Software provided 
by RSA or other than in the manner specified in the relevant User Manual, or 
(ii) combination of the RSA Software with other equipment or software not 
provided by RSA, if such action would have been avoided but for such use or 
combination.

       8.4    EXCLUSIVE REMEDY.  NOTWITHSTANDING ANYTHING TO THE CONTRARY IN 
THIS AGREEMENT, THE FOREGOING STATES RSA'S ENTIRE LIABILITY AND OEM'S 
EXCLUSIVE REMEDY FOR PROPRIETARY RIGHTS INFRINGEMENT.

9.     TERM AND TERMINATION.
       --------------------

       9.1    TERM.  This Agreement shall be effective as of the date hereof 
and shall continue in full force and effect unless and until sooner 
terminated pursuant to the terms of this Agreement.

       9.2    TERMINATION FOR DEFAULT.  Either party shall be entitled to 
terminate this Agreement at any time on written notice to the other in the 
event of a material default (i.e., breach of a provision designated as 
"material" herein) by the other party and a failure to cure such default 
within a period of thirty (30) days following receipt of written notice 
specifying that a default has occurred.  For purposes of this section, 
"material" provisions include Sections 1, 2, 3, 5.2, 5.4, 5.5, 6, 8, 10.2, 
10.7 and 10.8.

       9.3    INSOLVENCY.  Upon (i) the institution of any proceedings by or 
against either party seeking relief, reorganization or arrangement under any 
laws relating to insolvency, which proceedings are not dismissed within sixty 
(60) days; (ii) the assignment for the benefit of creditors, or the 
appointment of a receiver, liquidator or trustee, of any of either party's 
property or assets; or (iii) the liquidation, dissolution or winding up of 
either party's business; then and in any such events this Agreement may 
immediately be terminated by the other party upon written notice.

       9.4    TERMINATION FOR CONVENIENCE.  The parties acknowledge and agree 
that OEM may at any time delay, interrupt or cease use of the RSA Software, 
but this Agreement shall continue in full force, including any obligations to 
make quarterly reports.  OEM may elect to terminate this Agreement upon ninety
(90) days written notice and it is expressly understood that such termination 
shall not discharge payment obligations accrued as of the date of such


                                      12


termination, even if such obligation is payable after the termination date, 
or entitle OEM to a refund of any amounts previously paid to RSA.

       9.5    EFFECT OF TERMINATION.  Upon the termination of this Agreement, 
OEM shall cease making copies of, using or licensing the RSA Software, User 
Manual and Bundled Products, excepting only such copies of Bundled Products 
necessary to fill orders placed with OEM prior to such expiration or 
termination.  OEM shall destroy all copies of the RSA Software, User Manual 
and Bundled Products not subject to any then-effective license agreement with 
an End User Customer and all information and documentation provided by RSA to 
OEM, other than such copies of the RSA Object Code, the User Manual and the 
Bundled Products as are necessary to enable OEM to perform its continuing 
support obligations in accordance with Section 5.3, if any.

       9.6    SURVIVAL OF CERTAIN TERMS.  The following provision shall 
survive any expiration or termination:  Sections 2.2, 2.3, 3.8, 4.3, 6, 7, 9 
and 10.

10.    MISCELLANEOUS PROVISIONS.
       ------------------------

       10.1   GOVERNING LAW AND JURISDICTION.  This Agreement will be 
governed by and construed in accordance with the laws of the State of 
California, irrespective of its choice of law principles.  All disputes 
arising out of this Agreement shall exclusively be brought in the California 
state courts or the United States District Court for the Northern District of 
California.  The parties agree that the United Nations Convention on 
Contracts for the international Sale of Goods shall not apply to this 
Agreement.

       10.2   BINDING UPON SUCCESSORS AND ASSIGNS.  Except as otherwise 
provided herein, this Agreement shall be binding upon, and inure to the 
benefit of, the successors, representatives, administrators and assigns of 
the parties hereto. Notwithstanding the generality of the foregoing, this 
Agreement shall not be assignable by OEM, by operation of law or otherwise, 
without the prior written consent of RSA, which shall not be unreasonably 
withheld.  If RSA fails to respond to a written request for consent to assign 
OEM's rights with identifies the proposed assignee and which is given in 
accordance with Section 10.6 and directed to RSA's Legal Department within 
fourteen (14) days after is receipt, RSA shall be deemed to have consented to 
such request.  Any such purported assignment or delegation without RSA's 
written consent shall be void and of no effect.  RSA may withhold its consent 
to the assignment of this Agreement, at its sole discretion, if the Agreement 
provides for paid-up License Fees. RSA acknowledges that this unamended 
Agreement as of the Effective Date does not provide for paid-up License Fees.

       10.3    SEVERABILITY.  If any provision of this Agreement is found to 
be invalid or unenforceable, such provision shall be severed from the 
Agreement and the remainder of this Agreement shall be interpreted so as best 
to reasonably effect the intent of the parties hereto.


                                      13


       10.4   ENTIRE AGREEMENT.  This Agreement any exhibits or attachments 
hereto constitute the entire understanding and agreement of the parties 
hereto with respect to the subject matter hereof and supersede all prior and 
contemporaneous agreements, representations and understandings between the 
parties regarding the subject matter hereof.

       10.5   AMENDMENT AND WAIVERS.  Any term or provision of this Agreement 
may be amended, and the observance of any term of this Agreement may be 
waived, only by a writing signed by the party to the bound.

       10.6   NOTICES.  Any notice, demand, or request with respect to this 
Agreement shall be in writing and shall be effective only if it is delivered 
by hand or mailed, certified or registered mail, postage prepaid, return 
receipt requested, addressed to the appropriate party at its address set 
forth on page 1.  Notice to RSA shall be addressed to "RSA Legal Department." 
 Such communication shall be effective when they are received by the 
addressee; but if sent by certified or registered mail in the manner set 
forth above, they shall be effective not later than ten (10) days after being 
deposited in the mail. Any party may change its address for such 
communications by giving notice to the other party in conformity with this 
Section.

       10.7   EXPORT COMPLIANCE AND FOREIGN RESHIPMENT LIABILITY.  THIS 
AGREEMENT IS EXPRESSLY MADE SUBJECT TO ANY LAWS, REGULATIONS, ORDERS OR OTHER 
RESTRICTIONS ON THE EXPORT FROM THE UNITED STATES  OF AMERICA OF THE RSA 
SOFTWARE OR BUNDLED PRODUCTS OR OF INFORMATION ABOUT THE RSA SOFTWARE OR 
BUNDLED PRODUCTS WHICH MAY BE IMPOSED FROM TIME TO TIME BY THE GOVERNMENT OF 
THE UNITED STATES OF AMERICA.  NOTWITHSTANDING ANYTHING CONTAINED IN THIS 
AGREEMENT TO THE CONTRARY, OEM SHALL NOT EXPORT OR REEXPORT, DIRECTLY OR 
INDIRECTLY, ANY RSA SOFTWARE OR BUNDLED PRODUCTS OR INFORMATION PERTAINING 
THERETO ANY COUNTRY TO WHICH SUCH EXPORT OR REEXPORT IS RESTRICTED OR 
PROHIBITED, OR AS TO WHICH SUCH GOVERNMENT OR ANY AGENCY THEREOF REQUIRES AN 
EXPORT LICENSE OR OTHER GOVERNMENTAL APPROVAL AT THE TIME OF EXPORT OR 
REEXPORT WITHOUT FIRST OBTAINING SUCH LICENSE OR APPROVAL.

       10.8   FEDERAL GOVERNMENT LICENSE.  OEM and each of OEM's Distributors 
shall in all proposals and agreements with the United States government or 
any contractor of the United States government identify and license the 
Bundled Product, including the RSA Software incorporated therein, as follows: 
(i) for acquisition by or on behalf of civilian agencies, as necessary to 
obtain protection as "commercial computer software" and related documentation 
in accordance with the terms of OEM's or such Distributor's customary 
license, as specified in 48 C.F.R. 12.212 of the Federal Acquisition 
Regulations and its successor regulations; or (ii) for acquisition by or on 
behalf of units of the Department of Defense, as necessary to obtain 
protection as "commercial computer software" as defined in 48 C.F.R. 
252.227-7014(a)(1) of the Department of Defense Federal Acquisition 
Regulation Supplement (DFARS) and related


                                      14


documentation in accordance with the terms of OEM's or such Distributor's 
customary license, as specified in 48 C.F.R. 227.7202-1 of DFARS and its 
successor regulations.

       10.9   REMEDIES NON-EXCLUSIVE.  Except as otherwise expressly 
provided, any remedy provided for in this Agreement is deemed cumulative 
with, and not exclusive of, any other remedy provided for in this Agreement 
or otherwise available at law or in equity.  The exercise by a party of any 
remedy shall not preclude the exercise by such party of any other remedy.

       10.10  ATTORNEYS' FEES.  Should suit be brought to enforce or 
interpret any part of this Agreement, the prevailing party shall be entitled 
to recover, as an element of the costs of suit and not as damages, reasonable 
attorneys' fees to be fixed by the court (including without limitation, 
costs, expenses and fees on any appeal).

              IN WITNESS WHEREOF, the parties have executed this Agreement as of
the date of the last signature below.


                                       OEM:

                                       TUMBLEWEED SOFTWARE, INC.


                                       By: /s/ Joseph C. Consul
                                           -----------------------------------

                                       Printed Name:  Joseph C. Consul
                                                     -------------------------

                                       Title: VP Finance, CFO
                                              --------------------------------

                                       Date:  3/29/98
                                             ---------------------------------


                                       RSA DATA SECURITY, INC.


                                       By: /s/ Albert Sisto
                                           -----------------------------------

                                       Printed Name: Albert Sisto
                                                     -------------------------

                                       Title: Chief Operating Officer
                                              --------------------------------

                                       Date: March 30, 1998
                                             ---------------------------------


                                      15


                                  EXHIBIT "A"
                          MANDATORY SUBLICENSE TERMS


       All sublicense agreements for the license of the RSA Object Code in 
the Bundled Products by OEM to OEM Sublicensees and Corporate Sublicensees 
will substantially include all of the following restrictions:

       I.     The OEM Sublicensee or Corporate Sublicensee will receive no 
greater rights with respect to the Bundled Products than those permitted in 
Sections 2.1.1 of the Agreement as limited by Section 2.2 of the Agreement.

       II.    The OEM Sublicensee or Corporate Sublicensee will agree not to 
remove or destroy any proprietary, trademark or copyright markings or 
confidentiality legends placed upon or contained within the Bundled Products 
or any related materials or documentation.

       III.   If applicable, the OEM Sublicensee or Corporate Sublicensee 
will agree that any sublicensee of the Bundled Products to the United States 
Government or any agency thereof will state that such software and related 
documentation are "commercial computer software" as that term is defined for 
purposes of the Federal Acquisition Regulations (FARs) or the Department of 
Defense Federal Acquisition Regulations Supplement (DFARS), as applicable, 
then in effect.

       IV.    The OEM Sublicensee or Corporate Sublicensee will agree not to 
export or reexport any Bundled Products or any part thereof or information 
pertaining thereto to any country for which a U.S. government agency requires 
an export license or other governmental approval without first obtaining such 
license or approval.

       V.     The OEM Sublicensee or Corporate Sublicensee will agree that, 
except for the limited licenses granted under the license agreement, OEM and 
its licensors will retain full and exclusive right, title and ownership 
interest in and to the Bundled Products and in any and all related patents, 
trademarks, copyrights or proprietary or trade secret rights.

       VI.    OEM will have the right to terminate the license for the OEM 
Sublicensee's or Corporate Sublicensee's breach of a material term.  The OEM 
Sublicensee or Corporate Sublicensee will agree that, upon termination of the 
license, the OEM Sublicensee or Corporate Sublicensee will return to OEM all 
copies of the object code and documentation for the Bundled Products or 
certify to OEM that the OEM Sublicensee or Corporate Sublicensee has 
destroyed all such copies, except that the OEM Sublicensee or Corporate 
Sublicensee may retain one (1) copy of the object code for the Bundled 
Products solely for the purpose of supporting the OEM Sublicensee's or 
Corporale Sublicensee's existing licensees.


                                      16


       VII.   The OEM Sublicensee or Corporate Sublicensee will agree, to the 
extent permitted by applicable law, not to reverse compile, disassemble or 
modify the Bundled Products.

       VIII.  The OEM Sublicensee or Corporate Sublicensee will agree not to 
distribute the Bundled Products or any part thereof except pursuant to a 
license agreement meeting the requirements in Section 5.4 of the Agreement.

       IX.    The sublicense agreement will state that in no event will OEM 
or its licensors be liable for indirect, incidental, special, consequential 
or exemplary damages arising out of or related to the Bundled Products, 
including but not limited to lost profits, business interruption or loss of 
business information, even if such party has been advised of the possibility 
of such damages.












                                      17


                           RSA DATA SECURITY, INC.
                        100 Marine Parkway, Suite 500
                           Redwood City, CA 94065

                      MAINTENANCE AND SUPPORT AGREEMENT


       THIS MAINTENANCE AND SUPPORT AGREEMENT ("Support Agreement"), 
effective as of the later date of execution ("Effective Date"), is entered 
into by and between RSA Data Security, Inc., a Delaware corporation ("RSA"), 
having a principal address at 100 Marine Parkway, Suite 500, Redwood City, 
California 94065, and the entity named below ("OEM"), having a principal 
address as set forth below:

OEM:

Tumbleweed Software, a California corporation
-----------------------------------------------------------------------
(Name and jurisdiction of incorporation)

2010 Broadway, Redwood City, CA 94063
-----------------------------------------------------------------------
(Address)

Notices to Contact:  Bill Bradford,
                     ---------------------------------------------------
                     Vice President Strategic Relationships
                     ---------------------------------------------------
                     (650) 569-3687
                     ---------------------------------------------------
                     (Name, Title and Telephone)


Initial Annual Maintenance Fee:  [         *           ]


10.    DEFINITIONS.  All capitalized terms used and not defined herein shall 
have the meanings set forth in the OEM Agreement or the following meanings:

       10.1   "News Release" means a version of the RSA Software which shall 
generally be designated by a new version number which has changed from the 
prior number only to the right of the decimal point (E.G., Version 2.2 to 
Version 2.3).

---------------------

       *      Confidential treatment has been requested with respect to 
certain information contained in this document.  Confidential portions have 
been ommited from the public filing and have been filed separately with the 
Securities and Exchange Commission.


                                      18


       10.2   "New Version" means a version of the RSA Software which shall 
generally be designated by  a new version number which has changed from the 
prior number to the left of the decimal point (E.G., Version 2.3 to Version 
3.0).

       10.3   "OEM Agreement" means that certain OEM Object Code License 
Agreement between RSA and OEM dated March 30).

       10.4   "RSA Software" means proprietary software identified as RSA 
Software on page 1 of the OEM Agreement.

11.    MAINTENANCE AND SUPPORT SERVICES.
       --------------------------------

       11.1   GENERAL.  This Support Agreement sets forth the terms under 
which RSA will provide maintenance and support to OEM for the RSA Software 
licensed to OEM for the Bundled Product, as set forth under the unamended OEM 
Agreement. The use of and license to any software provided to OEM hereunder 
shall be governed by the terms of the OEM Agreement.

       11.2   SUPPORT AND MAINTENANCE.  RSA agrees to provide the maintenance 
and support specified in this Support Agreement and OEM agrees to pay RSA's 
then-current annual support and maintenance fee ("Maintenance Fee").

       11.3   MAINTENANCE PROVIDED BY RSA.  For the annual period commencing 
on the Effective Date hereof, and for future annual periods for which OEM has 
paid the Maintenance Fee, RSA will provide OEM with the following services:

              11.3.1 TELEPHONE SUPPORT.  RSA will provide telephone support 
to OEM during RSA's normal business hours.  RSA may provide on-site support 
reasonably determined to be necessary by RSA at OEM's location specified on 
page 1 hereof.  RSA shall provide the support specified in this Section 2.3.1 
to OEM's employees responsible for developing and maintaining the Bundled 
Products licensed under the OEM Agreement and providing support to End User 
Customers. No more than two (2) OEM employees may obtain such support from 
RSA at any one time.  On RSA's request, OEM will provide a list with the 
names of the employees designated to receive support from RSA.  OEM may 
change the names on the list at any time by providing written notice to RSA.

              11.3.2 ERROR CORRECTION.  In the event OEM discovers an error 
in the RSA Software which causes the RSA Software not to operate in material 
conformance to RSA's published specifications therefor, OEM shall submit to 
RSA a written report describing such error in sufficient detail to permit RSA 
to reproduce such error.  Upon receipt of any such written report, RSA will 
use its reasonable business judgment to classify a reported error as either:  
(i) a "Level 1 Severity" error, meaning an error that causes the RSA Software 
to fail to operate in a material manner or to produce materially incorrect 
results and or which there is no workaround 


                                      19


or only a difficult workaround; or (ii) a "Level 2 Severity" error, meaning 
an error that produces a situation in which the RSA Software is usable but 
does not function in the most convenient or expeditious manner, and the use 
or value of the RSA Software suffers no material impact. RSA will acknowledge 
receipt of a confirming error report within two (2) business days and (A) 
will use its continuing best efforts to provide a correction of any Level 1 
Severity error to OEM as early as practicable; and (B) will use its 
reasonable efforts to include a correction for any Level 2 Severity error in 
the next release of the RSA Software.

              11.3.3 NEW RELEASES AND NEW VERSIONS.  RSA will provide OEM 
information relating to New Releases and New Versions of the RSA Software 
during the term of this Support Agreement.  New Releases and New Versions 
will be provided by RSA at no additional charge. Nevertheless, license rights 
to any New Versions provided hereunder shall not extend to any new algorithms 
contained in such New Versions which algorithms are not listed as licensed 
under the terms of the OEM Agreement.  License rights to such new algorithms 
shall be available at RSA's standard upgrade charges in effect at the time.  
Any New Releases or New Versions acquired by OEM shall be governed by all of 
the terms and provisions of the OEM Agreement.

       11.4   LEGEND MAINTENANCE.  If this Support Agreement has lapsed, OEM 
may obtain a license of New Releases or New Versions of the applicable RSA 
Software (consistent with Section 2.3.3 above) or any service which is 
provided as a part of maintenance and support by becoming current on 
Maintenance Fees as provided in Section 3.1 to te date such New Release or 
New Version is licensed or such service is provided.

12.    MAINTENANCE AND SUPPORT FEES.
       ----------------------------

       12.1   MAINTENANCE AND SUPPORT FEES.  In consideration of RSA's 
providing the maintenance and support services described herein, OEM agrees 
to pay RSA the initial Maintenance Fee set forth on the first page hereof.  
Such amount shall be payable for the first year upon the execution of this 
Support Agreement, and for each subsequent year in advance of the 
commencement of such year.  The Maintenance Fee may be modified by RSA for 
each renewal term by written notice to OEM at least ninety (90) days prior to 
the end of the then-current term.  If OEM elects not to renew this Support 
Agreement for successive terms (as provided in Section 6.1 below) OEM may 
re-enroll only upon payment of the annual Maintenance Fee for the coming year 
and for all Maintenance Fees that would have been paid had OEM not ceased 
maintenance and support.

       12.2   ADDITIONAL CHARGES.  In the event RSA is required to take 
actions to correct a difficulty or defect which is traced to OEM errors, 
modifications, enhancements, software or hardware, then OEM shall pay to RSA 
its time and materials charges at RSA's rates then in effect, in the event 
RSA's personnel must travel to perform maintenance or on-site support, OEM 
shall reimburse RSA for any reasonable out-of-pocket expenses incurred, 
including travel to and from OEM's sites, lodging, meals and shipping, as may 
be necessary in connection with duties performed under this Section 3.2 by 
RSA.


                                      20


       12.3   TAXES.  All taxes, duties, fees and other governmental charges 
of any kind (including sales and use taxes, but excluding taxes based on the 
gross revenues or net income of RSA) which are imposed by or under the 
authority of any government or any political subdivision thereof on the 
Maintenance Fees or any aspect of this Support Agreement shall be borne by 
OEM  and shall not be considered a part of, a deduction from or an offset 
against Maintenance Fees.

       12.4   TERMS OF PAYMENT.  Maintenance Fees due RSA hereunder shall be 
paid by OEM to the attention of the Software Licensing Department at RSA's 
address set forth above upon execution and, in the case of renewal terms, 
prior to each anniversary thereof. A late payment penalty on any Maintenance 
Fees not paid when due shall be assessed at the rate of one percent (1%) per 
thirty (30) days.  In no event shall Maintenance Fees paid be refundable.

       12.5   U.S. CURRENCY.  All payments hereunder shall be made in lawful 
United States currency.

13.    CONFIDENTIALITY.  The parties agree that all obligations and 
conditions respecting confidentiality, use of the Source Code (if licensed to 
OEM) and publicity in Section 6 of the OEM Agreement shall apply to the 
parties' performance of this Support Agreement.

14.    USE LIMITATIONS; TITLE; INTELLECTUAL PROPERTY INDEMNITY; LIMITATION OF 
LIABILITY.  Any and all RSA Software provided to OEM pursuant to this Support 
Agreement shall constitute RSA Software under the OEM Agreement.  As such, 
the parties' respective interests and obligations relating to the RSA 
Software, including but not limited to license and ownership rights thereto, 
use limitations (if any), intellectual property indemnity and limitation of 
liability, shall be governed by the terms of the OEM Agreement.

15.    TERM AND TERMINATION
       --------------------

       15.1   TERM.  This Support Agreement shall commence on the Effective 
Date hereof and shall remain in full force and effect for an initial period 
of one (1) year, unless sooner terminated in accordance with this Support 
Agreement. Upon expiration of the initial period and each successive period, 
this Support Agreement shall automatically renew for an additional (1) year 
period, unless either party has notified the other of its intent to terminate 
as set forth in Section 6.2.3 herein.

       15.2   TERMINATION.
              -----------

              15.2.1 Either party shall be entitled to terminate this Support 
Agreement at any time on written notice to the other in the event of a 
material default by the other party of this Support Agreement and a failure 
to cure such default within a period of thirty (30) days following receipt of 
written notice specifying that a default has occurred.


                                      21


              15.2.2 This Support Agreement shall automatically terminate in 
the event that the OEM Agreement is terminated in accordance with its terms.

              15.2.3 This Support Agreement may also be terminated by OEM for 
any or no reason by providing written notice of such intent at least (90) 
days prior to the end of the then-current term.  RSA may cease to offer 
support and maintenance for future maintenance terms by notice delivered to 
OEM ninety (90) days or more before the end of the then-current maintenance 
term.

              15.2.4 Upon (i) the institution of any proceeding by or against 
either party seeking relief, reorganization or arrangement under any laws 
relating to insolvency, which proceedings are not dismissed within sixty (60) 
days; (ii) the assignment for the benefit of creditors, or upon the 
appointment of a receiver, liquidator or trustee, of any of either party's 
property or assets; or (iii) the liquidation, dissolution or winding up of 
either party's business, then and in any such events this Support Agreement 
may immediately be terminated by the other party upon written notice.

       15.3   SURVIVAL OF CERTAIN TERMS.  The following provisions shall 
survive any expiration or termination:  Sections 2.4, 5, 6 and 7.

16.    MISCELLANEOUS PROVISIONS.  This Support Agreement is not an amendment 
to the OEM Agreement, but instead is a separate binding agreement which 
incorporates certain terms of the OEM Agreement for the purposes of brevity 
and assured consistency.  This Agreement incorporates by this reference 
Section 10 of the OEM Agreement in its entirety.

       IN WITNESS WHEREOF, the parties have executed this Agreement as of the
date of the later signature below.

OEM:

TUMBLEWOOD SOFTWARE, INC.


BY:
    -----------------------------------

PRINTED NAME:
              -------------------------

TITLE:
       --------------------------------

DATE:
      ---------------------------------


                                      22



RSA DATA SECURITY, INC.


BY: /s/ Albert Sisto
    -----------------------------------

PRINTED NAME: Albert Sisto
              -------------------------

TITLE: Chief Operating Officer
       --------------------------------

DATE: March 30, 1998
      ---------------------------------







                                      23


                                  EXHIBIT "A"
                                      TO
                     MAINTENANCE AND SUPPORT AGREEMENT



Licensee:  Tumbleweed Software, Inc.
         ----------------------------------------------------------------------

Maintenance and Support Agreement Date:   March 30, 1998
                                        ---------------------------------------


       THE MAINTENANCE AND SUPPORT AGREEMENT between RSA Data Security, Inc. 
and the Licensee set forth above dated as of the date set forth above 
("Agreement") is amended as set forth below.

       1.     DEFINITIONS.  Capitalized terms used and not otherwise defined 
in this Exhibit "A" shall have the meanings designated for such terms in the 
Agreement.

       2.     AMENDMENTS TO AGREEMENT.  The following provisions of the 
Agreement, referenced by the applicable Section numbers in the Agreement, are 
hereby amended as follows:

              2.1    SECTION 3.1  The third sentence of Section 3.1 is 
amended by adding the following at the end thereof: ". . . ; PROVIDED, 
HOWEVER THAT THE MAINTENANCE FEE SHALL NOT BE INCREASED BY ANA MOUNT GREATER 
THAN TEN PERCENT (10%) PER ANNUM."

              2.2    SECTION 6.2.3  The second sentence of Section 6.2.3 of 
the Agreement is amended by adding the following at the end thereof:  ". . . 
; PROVIDED, HOWEVER, THAT RSA MAY CEASE TO OFFER MAINTENANCE TO OEM WITH 
RESPECT TO THE MOST RECENT RELEASE OF A PARTICULAR RSA SOFTWARE PRODUCT ONLY 
IF IT IS GENERALLY CEASING TO OFFER MAINTENANCE FOR THE SAME PRODUCT TO IT 
OTHER SIMILARLY-SITUATED LICENSEES."

       3.     EFFECT OF AMENDMENT.  This Exhibit "A" is an amendment to the 
Agreement.  Except as expressly amended above, the Agreement shall remain in 
full force and effect.

       IN WITNESS WHEREOF, the parties have executed this Exhibit "A" as of 
the date set forth above.

LICENSEE:


 TUMBLEWEED SOFTWARE, INC.                RSA DATA SECURITY, INC.

BY:  /s/ Joseph C. Consul                 BY: /s/ Albert Sisto
    -----------------------------------       ---------------------------------

PRINTED NAME:  Joseph C. Consul           PRINTED NAME: Albert Sisto
              -------------------------                 -----------------------

TITLE:  VP FInance, CFO                   TITLE: Chief Operating Officer
       --------------------------------          ------------------------------



                                      24


                                   EXHIBIT I

                       SERVER SOFTWARE SUBLICENSE TERMS


Any agreement between UPS and any Server Sublicensee shall contain rights 
consistent with those enumerated in the Agreement, except that the agreement 
must also include terms at least as protective of Tumbleweed's interests in 
the Server Software and Custom Server Software (collectively, the "Server 
Software") and in the Client Software and Custom Client Software 
(collectively, the "Client Software" which, with the Server Software, is 
collectively referred to herein as the "Software") as the following:

       1.     RESTRICTIONS.  The license grant to use the Server Software and 
reproduce and distribute the Client Software is not transferable, assignable 
or sublicenseable.  Server Sublicensee shall not, nor shall it authorize a 
third party to, decompile, reverse engineer or disassemble the Software 
except where such conduct is explicitly permitted under local law.  Server 
Sublicensee agrees to pay all required licensing fees and not to exceed the 
scope of the licenses granted under the Agreement.  Server Sublicensee 
acknowledges and agrees that Tumbleweed may, at any time without notice, 
incorporate license management software into the Server Software to prevent 
Server Sublicensee from exceeding the scope of its license.  Neither UPS nor 
Tumbleweed has provided any license of its trademarks to Server Sublicensee.

       2.     OTHER RESTRICTIONS.  Server Sublicensee shall retain any End 
User license agreements included with the Client Software.  Server 
Sublicensee shall not remove, modify or obscure any proprietary rights 
notices in the Software or logos or trademarks displayed in the Software or 
any documents automatically generated by it.  Server Sublicensee shall not 
distribute, in connection with the Software or in the performance of 
reselling messaging services, any viruses, trojan horses, worms, time bombs, 
cancelbots or other programs containing computer programming defects which 
are intended to damage or detrimentally interfere with a user's system or 
data.

       3.     OWNERSHIP.  Except as otherwise provided in this Agreement, UPS 
and its suppliers (including, without limitation, Tumbleweed) shall retain 
all rights, title and interest in and to all copyrights, trademarks, trade 
secrets, patents and all other industrial and intellectual property embodied 
in or appurtenant to the Software.  There are no implied licenses under this 
Agreement, and any rights not expressly granted to Server Sublicensee 
hereunder are reserved by UPS or its suppliers.

       4.     AUDIT RIGHTS.  Server Sublicensee will keep for 3 years proper 
records and books of account relating to Server Sublicensee's activities 
regarding the Software.  Once every 12 months, UPS or its designee may 
inspect such records to verify Server Sublicensee's statements.  Any such 
inspection will be conducted on Server Sublicensee's office in a manner that 
does not unreasonably interfere with Server Sublicensee's business 
activities.  Server Sublicensee shall immediately make any overdue payments 
disclosed by the audit. Such inspection shall be at UPS's expense; PROVIDED, 
HOWEVER, if the audit reveals overdue payments in excess of 5% of the 
payments owed to date, Server Sublicensee shall immediately pay the cost of 
such audit, and UPS may conduct another audit during the same 12 month 
period.  Server Sublicensee will make available to UPS all relevant records, 
including but not limited to all records relating to activities outside of 
the United States.

       5.     DISCLAIMER OF WARRANTY; NO PASS THROUGH.  UPS shall be 
responsible for any warranties extended to Server Sublicensee regarding the 
Software, except that UPS shall have the right to pass through to Server 
Sublicensee the proprietary rights indemnification of Tumbleweed, as set 
forth in Section 14(a) of the Agreement.  TUMBLEWEED AND ITS SUPPLIERS 
DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, 
THE IMPLIED WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR 
PURPOSE AND NONINFRINGEMENT.  Server Sublicensee shall make no warranties to 
End Users on behalf of UPS or its suppliers.


                                      25


       6.     SERVER SUBLICENSEE'S INDEMNITY.  Server Sublicensee shall 
indemnify UPS and its suppliers against any and all claims, losses, costs and 
expenses, including reasonable attorneys' fees, which any of them may incur 
as a result of claims in any form by third parties, including End Users, 
based upon (i) any representations made by Server Sublicensee to such third 
parties which are not supported by the Documentation and/or any other 
information or materials supplied by UPS and/or its suppliers, or (ii) any 
acts committed by Server Sublicensee's End Users during the course of their 
use of the Software.

       7.     LIMITATIONS ON LIABILITY.  EXCEPT FOR ANY BREACHES OF SECTIONS 
RELATING TO LICENSE GRANTS OR CONFIDENTIALITY, IN NO EVENT SHALL EITHER PARTY 
BE LIABLE FOR LOST PROFITS OR SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES 
ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT (WHETHER FROM BREACH OF 
CONTRACT OR WARRANTY OR FROM NEGLIGENCE OR STRICT LIABILITY), EVEN IF SUCH 
PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.  THIS LIMITATION 
OF LIABILITY SHALL APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF 
ANY LIMITED REMEDY HEREIN.  EXCEPT FOR TUMBLEWEED'S INDEMNIFICATION 
OBLIGATIONS, IN NO EVENT SHALL TUMBLEWEED'S LIABILITY TO SERVER SUBLICENSEE 
EXCEED THE AMOUNTS ACTUALLY RECEIVED BY TUMBLEWEED ATTRIBUTABLE TO SERVER 
SUBLICENSEE.

       8.     GENERALLY.  At its own expense, Server Sublicensee shall comply 
with all applicable laws, regulations, rules, ordinances and orders regarding 
its activities related to this Agreement.  Without limiting the foregoing:

              (a)    Server Sublicensee shall fully comply with the relevant 
export administration and control laws and regulations, as same may be 
amended from time to time, to ensure that the Software is not exported 
(directly or indirectly) in violation of United States law.

              (b)    Server Sublicensee shall comply with the U.S. Foreign 
Corrupt Practices Act and shall not make any payments to third parties which 
would cause UPS (or any of its suppliers) or Server Sublicensee to violate 
such laws.

       9.     GOVERNMENT END USERS.  The Software is a "commercial item," 
consisting of "commercial computer software" and "commercial computer 
software documentation," and is provided to the U.S. Government only as a 
commercial end item.





                                      26