Confidential treatment has been requested with respect to certain information contained in this document. Confidential portions have been omitted from the public filing and have been filed separately with the Securities and Exchange Commission. RSA DATA SECURITY, INC. 100 MARINE PARKWAY, SUITE 500 REDWOOD CITY, CA 94065 OEM OBJECT CODE LICENSE AGREEMENT This OEM OBJECT CODE LICENSE AGREEMENT ("Agreement"), effective as of the later date of execution ("Effective Date"), is entered into by and between RSA Data Security, Inc., a Delaware corporation ("RSA"), having a principal address at 100 Marine Parkway, Suite 500, Redwood City, California 94065, and the entity named below ("OEM"), having a principal address as set forth below. OEM: Tumbleweed Software, a California corporation ----------------------------------------------------------------------- (Name and jurisdiction of incorporation) 2010 Broadway, Redwood City, CA 94063 ----------------------------------------------------------------------- (Address) Notices to Contact: Bill Bradford, --------------------------------------------------- Vice President Strategic Relationships --------------------------------------------------- (650) 569-3687 --------------------------------------------------- (Name, Title and Telephone) RSA SOFTWARE: BSAFE-Registered Trademark- 3.0, consisting of the following algorithms: RSA, DES, DESX., 3DES, RC2, RC4, RC5, MD, MD2, MD5, SHA, DSA, Diffie-Hellman; TIPEM-Registered Trademark- 2.0, consisting of the following algorithms: RSA, DES, 3DES, RC2, RC5, MD5, SHA, JSAFE-Registered Trademark- 1.0, consisting of the following algorithms: RSA, DES, 3DES, RC2, RC4, RC5, MD5, SHA, Diffie-Hellman. (The RSA Software provided by RSA on the Windows 95/NT platform.) OEM may obtain copies of the RSA Software on other platforms as may be generally available at RSA's then current published price list, each additional platform version of which will be covered RSA Software under this Agreement. Confidential treatment has been requested with respect to certain information contained in this document. Confidential portions have been omitted from the public filing and have been filed separately with the Securities and Exchange Commission. DELIVERY OF RSA SOFTWARE TO OEM: One (1) copy of each of the Object Code and the User Manual for the RSA Software identified above: [X] has been received by OEM, or [ ] will be delivered by RSA as soon as practicable, but not later than ten (10) business days after the date of execution of this Agreement. BUNDLED PRODUCT: OEM's software products currently known as 1) "Posta Server" ("Server Bundled Product") which holds and forwards Posta-generated documents to Posta Recipient Client, 2) "Posta Desktop Client," which encrypts and signs documents being sent to Server Bundled Product, 3) "Posta Recipient Client," which decrypts documents and validates signatures. The Posta Desktop Client and the Posta Recipient Client are referred to collectively as the "Client Bundled Products." FIELD OF USE: Solely for privacy and authentication of communications between the Server Bundled Product and the Client Bundled Products within a closed system, JSAFE-Registered Trademark- v.1.0 shall perform decryption and authentication functions only. INITIAL MAINTENANCE AND SUPPORT: [X] Yes [ ] No 1. DEFINITIONS ----------- The following terms when used in this Agreement shall have the following meanings: 1.1 "Bundled Product(s)" means one or more of the products or product groups described above which has been or will be developed by OEM and which incorporates in the OEM Product in any manner any portio of the RSA Software. A Bundled Product must represent a significant functional and value enhancement to the RSA Software such that the primary reason for an End User Customer to license such Bundled Product is other than the right to receive a license to the functionality of the RSA Software included in the Bundled Product. 1.2 "Distributor" means a dealer or distributor in the business of reselling Bundled Products to End User Customers, directly or through one or more Distributors, by virtue of 2 authority of OEM. Bundled Products resold by a Distributor shall bear OEM's trademarks and service marks and shall not be privately labeled by such Distributor or other parties. A Distributor shall have no right to modify any part of the Bundled Products. Notwithstanding the foregoing, OEM may authorize a Distributor to co-brand or private label the Bundled Products for redistribution to End User Customers by such Distributor; provided that OEM indicates in it licensing reports delivered pursuant to Section 3.7 the identity of any Distributor so authorized and the name of the co-branded or private-labeled Bundled Products. It is understood and agreed that a Distributor authorized to co-brand or private label a Bundled Product may not otherwise modify the Bundled Product or incorporate it into another product for redistribution. 1.3 "End User Customer" mans a person or entity licensing RSA Software as part of a Bundled Product from OEM, OEM Sublicensee, Corporate Sublicensee or a Distributor solely for personal or internet use and whose primary purpose in licensing the Bundled Product is other than to license, assign or otherwise transfer such Bundled Product to any other person or entity. 1.4 "Field of Use" means a use, method of incorporation or product purpose limitation with respect to the RSA Software for a Bundled Product specified above for such Bundled Product. 1.5 "RSA Software" means RSA's proprietary software identified above (and including only those algorithms listed therewith), as further described in the User Manual(s) associated therewith. 1.6 "OEM Product" means any product developed by OEM into which the RSA Software is to be incorporated to create a Bundled Product. 1.7 "Object Code" means the RSA Software in machine-readable, compiled object code or in the case RSA Software includes JSAFE, in Java byte code form. 1.8 "Source Code" means the mnemonic, high level statement versions of the RSA Software written in the source language used by programmers. 1.9 "Territory" means worldwide, subject to Section 10.7. 1.10 "User Manual" means the most current version of the user manual and/or reference manual customarily supplied by RSA to OEMs who license the Object Code. 2. LICENSES. -------- 2.1 LICENSE GRANT. During the term of this Agreement and within the Field of Use limitation (if any), RSA hereby grants OEM a non-exclusive, non-transferable license to: 3 2.1.1 (i) incorporate the Object Code into an OEM Product to create a Bundled Product; and (ii) reproduce, have reproduced, and license or otherwise distribute the Object Code as incorporated in a Bundled Product in the Territory. 2.1.2 sublicense its rights granted in Section 2.1.1 with respect to the RSA Object Code as part of the Bundled Products to OEM's licensees in the Territory (each, an "OEM Sublicensee") for the use only in their own products in which substantial functionality or value is added to the Bundled Products so that such products are not a substitute for the RSA Software (collectively, "Sublicensee Products"). 2.1.3 sublicense its rights granted in Section 1.1 to distribute the RSA Object Code as part of the Client Bundled Products to OEM's End User Customers of the Bundled Products in the Territory who are either (i) Posta Service Providers (as defined below), or (ii) corporate End User Customers operating a service for internal business purposes using the Bundled Products (collectively, "Corporate Sublicensees") and who in each case may make minor changes to the user interfaces in the Bundled Products but no substantial changes in functionality (collectively, "Corporate Sublicensee Products"), provided that only the client components of such Corporate Sublicensee Products are licensed or otherwise distributed and only for use in obtaining the Posta Service or supporting the Corporate Sublicensee's's service for internal business purposes, and not as commercial products. 2.1.4 (i) use the User Manual to support End User Customers; (ii) modify and incorporate portions of the User Manual in Bundled Product documentation; and (iii) reproduce, have reproduced and distribute in the Territory such portions of the User Manual as incorporated in Bundled Product documentation. 2.2 LIMITATIONS ON LICENSES. The licenses granted in Section 2.1 are further limited as follows: 2.2.1 LIMITATION ON DISTRIBUTEES. The RSA Software shall bel licensed or otherwise distributed only to (i) Distributors, (ii) End User Customers, (iii) OEM Sublicensees, and (iv) Corporate Sublicensees. 2.2.2 NO EXPOSURE OF RSA SOFTWARE. The RSA Software may only be accessed by the functionality of the Bundled Product in which it is included and a Bundled Product shall not make the RSA Object Code directly accessible to End User Customers or to products other than the Bundled Product or otherwise expose a cryptographic API. 2.2.3 NO STANDALONE PRODUCT. OEM may not in any way sell, lease, rent, license, sublicense or otherwise distribute the RSA Software or any part thereof or the right to use the RSA Software or any part thereof to any person or entity except as part of a Bundled Product. 4 2.2.4 PROHIBITED ACTIVITIES; NO SOURCE CODE. OEM shall not modify, translate, reverse engineer, decompile, or disassemble the RSA Software or any part thereof or otherwise attempt to derive Source Code therefrom, and shall not authorize any third party to do any of the foregoing. Nothing in this Agreement grants OEM any rights, license or interest with respect to Source Code. 2.2.5 RSA ROOT KEYS. OEM may include the RSA/VeriSign, Inc. root keys (the "RSA Root Keys") in any Bundled Product in which a hierarchy root key is utilized or incorporated, provided that any such incorporation must make the RSA Root Keys functional within the Bundled Products and as accessible as any other hierarchy root key within the Bundled Product. 2.2.6 CONDITION OF SUBLICENSE GRANT. All sublicenses permitted under Sections 2.1.2 and 2.1.3 shall be subject to all of the following conditions: (i) all such sublicenses will be granted in a signed writing containing at a minimum substantially all of the restrictions set forth in Exhibit "A" attached hereto, and RSA shall be an express third party beneficiary of the such sublicense agreements; (ii) OEM shall use its best efforts to enforce the provisions of such sublicense as they relate to RSA and the RSA Software; (iii) the Sublicensee Products shall include substantial added function and value on top of the Bundled Products; (iv) the OEM Sublicensees and Corporate Sublicensees to whom such rights are sublicensed pursuant to Sections 2.1.2 and 2.1.3 shall have no further right to sublicense such rights; (v) any rights of any OEM Sublicenses or Corporate Sublicensee sublicensed by OEM shall survive only so long as both this Agreement and the sublicense between OEM and such OEM Sublicensee or Corporate Sublicensee remain in effect; and (vi) OEM shall identify all OEM Sublicensees and Corporate Sublicensees in its licensing reports delivered pursuant to Section 3.7. 2.3 TITLE. Except for the limited licenses expressly granted in Section 2.1 and as further limited by Section 2.2, RSA does not by this Agreement grant to OEM any right, title or ownership interest in and to the RSA Software or in any related patents, trademarks, copyrights or proprietary or trade secret rights. RSA receives no right, title or ownership interest in the OEM product by way of this Agreement. 3. LICENSE FEES; DELIVERY. ---------------------- 3.1 LICENSE FEES. In consideration of RSA's grant to OEM of the limited license rights hereunder, OEM shall pay to RSA license fees in the amounts set forth below (the "License Fees"): 5 3.1.1 ANNUAL LICENSE FEE. OEM shall pay RSA an annual License Fee during the term of this Agreement in the amount of [ * ], for unlimited distribution of Client Bundled Products and Server Bundled Product. Such amount shall be due and payable for the first year upon execution of this Agreement, and for each subsequent year on the anniversary of the Effective Date of this Agreement. 3.1.2 PERCENTAGE OF PRODUCT REVENUE LICENSE FEE. In addition to the License Fees set forth above, OEM shall pay to RSA as License Fees an amount equal to [ * ] of all Product Revenue. 3.1.3 PERCENTAGE OF SERVICE REVENUE LICENSE FEE. The parties acknowledge and agree that OEM's licensees of the Bundled Products may use the Bundled Products, Sublicensee Products or Corporation Sublicensee Products to provide an electronic document distribution service to third parties (the "Posta Service"). Under OEM's current business model, such licensees ("Posta Service Providers') will pay OEM a percentage of the transaction and/or subscription revenue from the Posta Service and may pay OEM an initial license fee for the right to offer the Posta Service. Based upon the foregoing, and in addition to the License Fees set forth above, OEM shall pay to RSA as License Fees an amount equal to [ * ] of all Service Revenue. "Service Revenue" means the gross amount of all cash, in-kind or other consideration receivable by OEM from Posta Service Providers at any time in connection with their providing the Posta Service, whether as a percentage of transaction and/or subscription revenue, as an initial license fee, or otherwise. 3.1.4 CHANGE IN BUSINESS MODEL. The License Fees set forth in Section 3.1.3 are based upon OEM's business model described above. In the event OEM changes its business model, OEM agrees to negotiate in good faith for alternative License Fees that result in substantially the same payments to RSA for substantially the same value to OEM as those provided for in Section 3.1.3. 3.1.5 [ * ] 3.2 TAXES. All taxes, duties, fees and other governmental charges of any kind (including sales and use taxes, but excluding taxes based on the gross revenues or net income of RSA) which are imposed by or under the authority of any government or any political subdivision thereof on the License Fees or any aspect of this Agreement shall be borne by OEM and shall not be considered a part of, a deduction from, or an offset against License Fees. --------------------- * Confidential treatment has been requested with respect to certain information contained in this document. Confidential portions have been ommited from the public filing and have been filed separately with the Securities and Exchange Commission. 6 3.3 PREPAYMENT OF LICENSE FEES. OEM shall prepay License Fees in the amount [ * ] upon execution of this Agreement. In no event shall such prepayment be refundable. All of such prepaid amounts may be offset against License Fees accrued under Section 3.1.2 at a rate of [ * ] of License Fees accrued under Sections 3.1.2 and 3.1.3 until the prepayments are exhausted. OEM shall show the application of prepaid License Fees in the licensing reports provided to RSA pursuant to Section 3.7. 3.4 USE OF PRODUCT REVENUE. "Product Revenue" means the gross amount of all cash, in-kind or other consideration receivable by OEM at any time in consideration of the licensing or other distribution of the Bundled Products, whether as a sale, license, use, transaction, or service fee based on or involving the Bundled Product, but excluding any amounts receivable by OEM for standard maintenance and support fees which are not intended to avoid any payment of royalties under this Agreement, sales and use taxes, shipping, insurance and duties, and reduced by all discounts or refunds granted in the ordinary course of business, and excluding Service Revenue. For the purposes of determining Product Revenue, the amount of in-kind or other non-cash consideration receivable by OEM shall be deemed to have a dollar value equal to the standard price (as listed in OEM's published price schedule on the date of the grant of the license or the sale in question) for such Bundled Product, less all cash paid. For purposes of this Section 3.4 and Section 3.1.3, in-kind or non-cash consideration does not include the standard marketing consideration that OEM requires in its standard license agreement for the Bundled Products under OEM's standard pricing. 3.5 TERMS OF PAYMENT. License Fees payable under Section 3.1.2 shall accrue with respect to Bundled Products licensed or otherwise distributed by OEM, OEM Sublicensees, Corporate Sublicensees or Distributors, as applicable, upon the date of invoice of the Bundled Product, Sublicensee Product or Corporate Sublicensee Product, as applicable, to an End User Customer or Distributor. License Fees payable under Section 3.1.3 shall accrue upon the date the applicable Service Revenue is due and payable from Posta Service Providers to OEM. Such License Fees shall be paid by OEM to the attention of the Software Licensing Department at RSA's address set forth above on or before the thirtieth (30th) day after the close of the calendar quarter during which the License Fees accrued. A late payment penalty on any License Fees not paid when due shall be assessed at the rate of one percent (1%) per thirty (30) days, beginning on the day after the delayed License Fees were due. 3.6 U.S. CURRENCY. All payments hereunder shall be made in lawful United States currency and shall in no case be refundable. If OEM receives payment in foreign currencies, the amount of its License Fees to RSA shall be calculated using the closing exchange rate published --------------------- * Confidential treatment has been requested with respect to certain information contained in this document. Confidential portions have been ommited from the public filing and have been filed separately with the Securities and Exchange Commission. 7 in THE WALL STREET JOURNAL, Western Edition, on the last business day such journal is published in the calendar quarter immediately preceding the date of payment. 3.7 LICENSING REPORT. A report in reasonably detailed form setting forth the calculation of License Fees due from OEM and signed by a reasonable officer of OEM shall be delivered to RSA on or before the thirtieth (30th) day after the close of each calendar quarter during the term of this Agreement, regardless of whether License Fee payments are required to be made pursuant to Section 3.5. The report shall include, at a minimum, the following information with respect to the relevant quarter: (I) the total Product Revenue invoiced to OEM Sublicensees, Corporate Sublicensees, Distributors and End User Customers; (iii) the total Service Revenue due and payable from Posta Service Providers' and (iii) total License Fees accrued. 3.8 AUDIT RIGHTS. RSA shall have the right, at its sole cost and expense, to have an independent certified public accountant conduct during normal business hours and not more frequently than annually, an audit of the appropriate records of OEM to verify the amount of Product Revenue and Service Revenue and OEM's calculation of License Fees. If the License Fees accrued are different than those reported, OEM will be invoiced or credited for the difference, as applicable. Any additional License Fees, along with the late payment penalty assessed in accordance with Section 3.5, shall be payable within thirty (30) days of such invoice. If the deficiency in License Fees paid by OEM is greater than ten percent (10%) of the License Fees reported by OEM for any quarter, OEM will pay the reasonable expenses associated with such audit, in addition to the deficiency. 3.9 EVALUATION COPIES. [INTENTIONALLY OMITTED.] ----------------- 4. LIMITED WARRANTY. ---------------- 4.1 LIMITED WARRANTY. During the initial ninety (90)-day term of this Agreement, RSA warrants that the RSA Software will operate in material conformance to RSA's published specifications for the RSA Software. RSA does not warrant that the RSA Software or any portion thereof is error-free. OEM's exclusive remedy, and RSA's entire liability in tort, contract or otherwise, shall be correction of any warranted nonconformity as provided in Section 4.2. This limited warranty and any obligations of RSA hereunder shall not apply to any nonconformities caused by, and shall terminate immediately if OEM makes, any unauthorized modification to the RSA Software. 4.2 ERROR CORRECTION. In the event OEM discovers an error in the RSA Software which causes the RSA Software not to operate in material conformance to RSA's published specifications therefor, OEM shall submit to RSA a written report describing such error in sufficient detail to permit RSA to reproduce such error. Upon receipt of any such written report, RSA will use its reasonable business judgment to classify a reported error as either: (i) a "Level 1 Severity" error, meanding an error that causes the RSA Software to fail to operate in a material 8 manner or to produce materially incorrect results and for which there is no workaround or only a difficult woraround; or (ii) a "Level 2 Severity" error, meaning an error that produces a situation in which the RSA Software is usable but does not function in the most convenient or expeditious manner, and the use or value of the RSA Software suffers no material impact. RSA will acknowledge receipt of a conforming error report within two (2) business days and (A) will use its continuing best efforts to provide a correction for any Level 1 Severity error to OEM as early as practicable; and (B) will use its reasonable efforts to include a correction for any Level 2 Severity error in the next release of the RSA Software. 4.3 DISCLAIMER. EXCEPT FOR THE EXPRESS LIMITED WARRANTY PROVIDED IN THIS SECTION 4, THE RSA SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY WARRANTY WHATSOEVER. RSA DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO ANY MATTER WHATSOEVER, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS. RSA DISCLAIMS ANY WARRANTY OR REPRESENTATION TO ANY PERSON OTHER THAN OEM WITH RESPECT TO THE RSA SOFTWARE. OEM SHALL NOT, AND SHALL TAKE ALL MEASURES NECESSARY TO INSURE THAT ITS AGENTS AND EMPLOYEES DO NOT, MAKE OR PASS THROUGH ANY SUCH WARRANTY ON BEHALF OF RSA TO ANY DISTRIBUTOR, END USER CUSTOMER OR OTHER THIRD PARTY. 5. ADDITIONAL OBLIGATIONS OF OEM. ----------------------------- 5.1 USE OF RSA "LICENSE SEAL". OEM agrees to insert and maintain within Bundled Products and marketing materials therefor the RSA "Licensee Seal" from the "Logo Usage Guide," which shall be delivered to OEM within ten (10) days of execution of this Agreement and is Incorporated herein by reference, as follows: 5.1.1 IN BUNDLED PRODUCTS. OEM shall ensure display of the Licensee Seal within any Bundled Product such that users thereof are exposed to the Licensee Seal during normal operation of such Bundled Product. In a software Bundled Product, the Licensee Seal shall be featured in such Bundled Product's startup splash screen (if any) and within security-related dialog windows visible in the normal operation of the product (i.e., password dialog window). In a hardware Bundled Product, the Licensee Seal shall be visible on the panel of such Bundled Product most normally viewed by the user. 5.1.2 IN MARKETING MATERIALS. OEM agrees to provide the Licensee Seal within related marketing materials that reference any security features of the Bundled Products, including but not limited to printed and electronic data sheets, direct mail, user documentation, product packaging and advertisements for the Bundled Product. 9 5.2 BUNDLED PRODUCT MARKETING. OEM is authorized to represent to Distributors and End User Customers only such facts about the RSA Software as RSA states in its published product descriptions, advertising and promotional materials or as may be stated in other non-confidential written material furnished by RSA. 5.3 CUSTOMER SUPPORT. OEM shall, at its expense, provide all support for the Bundled Products to Distributors and End User Customers. 5.4 LICENSE AGREEMENTS. OEM shall cause to be delivered to each Distributor and End User Customer a license agreement which shall contain, at a minimum, substantially all of the limitations of rights and the protections for RSA which are contained in Sections 2.2, 5.5, 7, 10.7 and 10.8 of this Agreement. OEM shall use commercially reasonable efforts to enforce the terms of such agreements. 5.5 PROPRIETARY RIGHTS. ------------------ 5.5.1 RSA COPYRIGHT NOTICES. OEM agrees not to remove or destroy and proprietary, trademark or copyright markings or notices placed upon or contained within the RSA Software, User Manuals or any related materials or documentation. OEM further agrees to insert and maintain within every Bundled Product and any related materials or documentation a copyright notice in the name of OEM. 5.5.2 TRADEMARKS. By reason of this Agreement or the performance hereof, OEM shall acquire no rights of any kind in any RSA trademark, trade name, logo or product designation under which the RSA Software was or is marketed and OEM shall not make any use of the same for any reason except as expressly authorized by this Agreement or otherwise authorized in writing by RSA. OEM shall cease to use the markings, or any similar markings, in any manner on the expiration or other termination of this Agreement. 6. CONFIDENTIALITY. Each party acknowledges that in its performance of its duties hereunder, the other party may communicate to it (or its designees) certain confidential and proprietary information of such party, provided that such Confidential Information is clearly identified in writing at the time of disclosure (the "Confidential Information"), all of which is confidential and proprietary to, and a trade secret of the disclosing party. The receiving party agrees to hold the Confidential Information disclosed to it within its own organization and shall not, without the specific written consent of the disclosing party or as expressly authorized herein, utilize in any manner, publish, communicate, or disclose any part of the disclosing party's Confidential Information or the RSA Software (in the case of OEM) to third parties. This Section 6 shall impose no obligations on either party with respect to any Confidential Information which: (i) is in the public domain at the time disclosed by the disclosing party; (ii) enters the public domain after disclosure other than by a breach of the receiving party's obligations hereunder or by a breach of another party's confidentiality obligation; (iii) is shown by documentary evidence to have been known by the receiving party prior to its receipt from the 10 disclosing party or developed independently without reference to Confidential Information; or (iv) is required to be disclosed by law. Each party will take such steps as are consistent with its protection of its own confidential and proprietary information (but will in no event exercise less then reasonable care) to insure that provisions of this Section 6 are not violated by its employees, agents or any other person. The terms of this Agreement are deemed Confidential Information and may not be disclosed without the prior written consent of the other party, except (i) either party may disclose such terms to the extent required by law; (ii) either party may disclose the existence of this Agreement; (iii) either party may disclose such terms to the extent necessary in connection with the due diligence review of such party by potential business partners, investors or acquirors, to such persons and to their employees, agents, attorneys and auditors, if such persons are bound by written confidentiality agreements covering third-party information; and (iv) both parties shall have the right to disclose that OEM is an OEM of the RSA Software and that any publicity-announced Bundled Product incorporates the RSA Software. 7. LIMITATION OF LIABILITY. IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER PARTY FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO LOST PROFITS, BUSINESS INTERRUPTION, OR LOSS OF BUSINESS INFORMATION, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, REGARDLESS OF THE CAUSE OF ACTION OR THE FORM OF ACTION, RSA'S AGGREGATE LIABILITY TO OEM FOR ACTUAL DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL BE LIMITED TO THE TOTAL AMOUNT PAID BY OEM HEREUNDER, EXCEPT FOR RSA'S LIABILITY ARISING UNDER SECTIONS 6 AND 8. DURING THE TERM OF THIS AGREEMENT OEM'S AGGREGATE LIABILITY TO RSA FOR ACTUAL DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL BE LIMITED TO THE TOTAL AMOUNT PAYABLE BY OEM TO RSA HEREUNDER, EXCEPT FOR OEM'S LIABILITY RESULTING FROM BREACH OF SECTIONS 2 AND 6. 8. INTELLECTUAL PROPERTY INDEMNITY. ------------------------------- 8.1 DUTY TO DEFEND. RSA agrees that it shall, at its own expense, defend, or at its option settle, any action instituted against OEM, and pay any award or damages assessed against OEM or agreed to be paid by OEM in settlement resulting from such action, insofar as the same is based upon a claim that any RSA Software used in accordance with the terms of this Agreement infringes any United States patent, copyright or trade secret or a claim that RSA has no right to license the RSA Software hereunder, provided that OEM gives RSA; (i) prompt notice in writing of such action, (ii) the right to control and direct the investigation, preparation, defense and settlement of the action; and (iii) reasonable assistance and information. 8.2 RSA OPTIONS. If, as a result of any binding settlement among the parties or a final determination by a court of competent jurisdiction, any of the RSA Software is held to infringe and its use is enjoined, or if RSA reasonable determines in its sole discretion that the 11 RSA Software may become subject to an inunction, RSA shall have the option to obtain the right to continue use of the RSA Software or replace or modify the RSA Software so that it is no longer infringing. In the event that neither of the foregoing options is reasonably available, then RSA may refund the License Fees paid by OEM hereunder less depreciation for use assuming straight line depreciation over a five (5)-year useful life and terminate the Agreement. 8.3 EXCLUSIONS. Notwithstanding the foregoing, RSA shall have no liability under this Section 8 if the alleged infringement arises from (i) the use of other than current unaltered release of the RSA Software provided by RSA or other than in the manner specified in the relevant User Manual, or (ii) combination of the RSA Software with other equipment or software not provided by RSA, if such action would have been avoided but for such use or combination. 8.4 EXCLUSIVE REMEDY. NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT, THE FOREGOING STATES RSA'S ENTIRE LIABILITY AND OEM'S EXCLUSIVE REMEDY FOR PROPRIETARY RIGHTS INFRINGEMENT. 9. TERM AND TERMINATION. -------------------- 9.1 TERM. This Agreement shall be effective as of the date hereof and shall continue in full force and effect unless and until sooner terminated pursuant to the terms of this Agreement. 9.2 TERMINATION FOR DEFAULT. Either party shall be entitled to terminate this Agreement at any time on written notice to the other in the event of a material default (i.e., breach of a provision designated as "material" herein) by the other party and a failure to cure such default within a period of thirty (30) days following receipt of written notice specifying that a default has occurred. For purposes of this section, "material" provisions include Sections 1, 2, 3, 5.2, 5.4, 5.5, 6, 8, 10.2, 10.7 and 10.8. 9.3 INSOLVENCY. Upon (i) the institution of any proceedings by or against either party seeking relief, reorganization or arrangement under any laws relating to insolvency, which proceedings are not dismissed within sixty (60) days; (ii) the assignment for the benefit of creditors, or the appointment of a receiver, liquidator or trustee, of any of either party's property or assets; or (iii) the liquidation, dissolution or winding up of either party's business; then and in any such events this Agreement may immediately be terminated by the other party upon written notice. 9.4 TERMINATION FOR CONVENIENCE. The parties acknowledge and agree that OEM may at any time delay, interrupt or cease use of the RSA Software, but this Agreement shall continue in full force, including any obligations to make quarterly reports. OEM may elect to terminate this Agreement upon ninety (90) days written notice and it is expressly understood that such termination shall not discharge payment obligations accrued as of the date of such 12 termination, even if such obligation is payable after the termination date, or entitle OEM to a refund of any amounts previously paid to RSA. 9.5 EFFECT OF TERMINATION. Upon the termination of this Agreement, OEM shall cease making copies of, using or licensing the RSA Software, User Manual and Bundled Products, excepting only such copies of Bundled Products necessary to fill orders placed with OEM prior to such expiration or termination. OEM shall destroy all copies of the RSA Software, User Manual and Bundled Products not subject to any then-effective license agreement with an End User Customer and all information and documentation provided by RSA to OEM, other than such copies of the RSA Object Code, the User Manual and the Bundled Products as are necessary to enable OEM to perform its continuing support obligations in accordance with Section 5.3, if any. 9.6 SURVIVAL OF CERTAIN TERMS. The following provision shall survive any expiration or termination: Sections 2.2, 2.3, 3.8, 4.3, 6, 7, 9 and 10. 10. MISCELLANEOUS PROVISIONS. ------------------------ 10.1 GOVERNING LAW AND JURISDICTION. This Agreement will be governed by and construed in accordance with the laws of the State of California, irrespective of its choice of law principles. All disputes arising out of this Agreement shall exclusively be brought in the California state courts or the United States District Court for the Northern District of California. The parties agree that the United Nations Convention on Contracts for the international Sale of Goods shall not apply to this Agreement. 10.2 BINDING UPON SUCCESSORS AND ASSIGNS. Except as otherwise provided herein, this Agreement shall be binding upon, and inure to the benefit of, the successors, representatives, administrators and assigns of the parties hereto. Notwithstanding the generality of the foregoing, this Agreement shall not be assignable by OEM, by operation of law or otherwise, without the prior written consent of RSA, which shall not be unreasonably withheld. If RSA fails to respond to a written request for consent to assign OEM's rights with identifies the proposed assignee and which is given in accordance with Section 10.6 and directed to RSA's Legal Department within fourteen (14) days after is receipt, RSA shall be deemed to have consented to such request. Any such purported assignment or delegation without RSA's written consent shall be void and of no effect. RSA may withhold its consent to the assignment of this Agreement, at its sole discretion, if the Agreement provides for paid-up License Fees. RSA acknowledges that this unamended Agreement as of the Effective Date does not provide for paid-up License Fees. 10.3 SEVERABILITY. If any provision of this Agreement is found to be invalid or unenforceable, such provision shall be severed from the Agreement and the remainder of this Agreement shall be interpreted so as best to reasonably effect the intent of the parties hereto. 13 10.4 ENTIRE AGREEMENT. This Agreement any exhibits or attachments hereto constitute the entire understanding and agreement of the parties hereto with respect to the subject matter hereof and supersede all prior and contemporaneous agreements, representations and understandings between the parties regarding the subject matter hereof. 10.5 AMENDMENT AND WAIVERS. Any term or provision of this Agreement may be amended, and the observance of any term of this Agreement may be waived, only by a writing signed by the party to the bound. 10.6 NOTICES. Any notice, demand, or request with respect to this Agreement shall be in writing and shall be effective only if it is delivered by hand or mailed, certified or registered mail, postage prepaid, return receipt requested, addressed to the appropriate party at its address set forth on page 1. Notice to RSA shall be addressed to "RSA Legal Department." Such communication shall be effective when they are received by the addressee; but if sent by certified or registered mail in the manner set forth above, they shall be effective not later than ten (10) days after being deposited in the mail. Any party may change its address for such communications by giving notice to the other party in conformity with this Section. 10.7 EXPORT COMPLIANCE AND FOREIGN RESHIPMENT LIABILITY. THIS AGREEMENT IS EXPRESSLY MADE SUBJECT TO ANY LAWS, REGULATIONS, ORDERS OR OTHER RESTRICTIONS ON THE EXPORT FROM THE UNITED STATES OF AMERICA OF THE RSA SOFTWARE OR BUNDLED PRODUCTS OR OF INFORMATION ABOUT THE RSA SOFTWARE OR BUNDLED PRODUCTS WHICH MAY BE IMPOSED FROM TIME TO TIME BY THE GOVERNMENT OF THE UNITED STATES OF AMERICA. NOTWITHSTANDING ANYTHING CONTAINED IN THIS AGREEMENT TO THE CONTRARY, OEM SHALL NOT EXPORT OR REEXPORT, DIRECTLY OR INDIRECTLY, ANY RSA SOFTWARE OR BUNDLED PRODUCTS OR INFORMATION PERTAINING THERETO ANY COUNTRY TO WHICH SUCH EXPORT OR REEXPORT IS RESTRICTED OR PROHIBITED, OR AS TO WHICH SUCH GOVERNMENT OR ANY AGENCY THEREOF REQUIRES AN EXPORT LICENSE OR OTHER GOVERNMENTAL APPROVAL AT THE TIME OF EXPORT OR REEXPORT WITHOUT FIRST OBTAINING SUCH LICENSE OR APPROVAL. 10.8 FEDERAL GOVERNMENT LICENSE. OEM and each of OEM's Distributors shall in all proposals and agreements with the United States government or any contractor of the United States government identify and license the Bundled Product, including the RSA Software incorporated therein, as follows: (i) for acquisition by or on behalf of civilian agencies, as necessary to obtain protection as "commercial computer software" and related documentation in accordance with the terms of OEM's or such Distributor's customary license, as specified in 48 C.F.R. 12.212 of the Federal Acquisition Regulations and its successor regulations; or (ii) for acquisition by or on behalf of units of the Department of Defense, as necessary to obtain protection as "commercial computer software" as defined in 48 C.F.R. 252.227-7014(a)(1) of the Department of Defense Federal Acquisition Regulation Supplement (DFARS) and related 14 documentation in accordance with the terms of OEM's or such Distributor's customary license, as specified in 48 C.F.R. 227.7202-1 of DFARS and its successor regulations. 10.9 REMEDIES NON-EXCLUSIVE. Except as otherwise expressly provided, any remedy provided for in this Agreement is deemed cumulative with, and not exclusive of, any other remedy provided for in this Agreement or otherwise available at law or in equity. The exercise by a party of any remedy shall not preclude the exercise by such party of any other remedy. 10.10 ATTORNEYS' FEES. Should suit be brought to enforce or interpret any part of this Agreement, the prevailing party shall be entitled to recover, as an element of the costs of suit and not as damages, reasonable attorneys' fees to be fixed by the court (including without limitation, costs, expenses and fees on any appeal). IN WITNESS WHEREOF, the parties have executed this Agreement as of the date of the last signature below. OEM: TUMBLEWEED SOFTWARE, INC. By: /s/ Joseph C. Consul ----------------------------------- Printed Name: Joseph C. Consul ------------------------- Title: VP Finance, CFO -------------------------------- Date: 3/29/98 --------------------------------- RSA DATA SECURITY, INC. By: /s/ Albert Sisto ----------------------------------- Printed Name: Albert Sisto ------------------------- Title: Chief Operating Officer -------------------------------- Date: March 30, 1998 --------------------------------- 15 EXHIBIT "A" MANDATORY SUBLICENSE TERMS All sublicense agreements for the license of the RSA Object Code in the Bundled Products by OEM to OEM Sublicensees and Corporate Sublicensees will substantially include all of the following restrictions: I. The OEM Sublicensee or Corporate Sublicensee will receive no greater rights with respect to the Bundled Products than those permitted in Sections 2.1.1 of the Agreement as limited by Section 2.2 of the Agreement. II. The OEM Sublicensee or Corporate Sublicensee will agree not to remove or destroy any proprietary, trademark or copyright markings or confidentiality legends placed upon or contained within the Bundled Products or any related materials or documentation. III. If applicable, the OEM Sublicensee or Corporate Sublicensee will agree that any sublicensee of the Bundled Products to the United States Government or any agency thereof will state that such software and related documentation are "commercial computer software" as that term is defined for purposes of the Federal Acquisition Regulations (FARs) or the Department of Defense Federal Acquisition Regulations Supplement (DFARS), as applicable, then in effect. IV. The OEM Sublicensee or Corporate Sublicensee will agree not to export or reexport any Bundled Products or any part thereof or information pertaining thereto to any country for which a U.S. government agency requires an export license or other governmental approval without first obtaining such license or approval. V. The OEM Sublicensee or Corporate Sublicensee will agree that, except for the limited licenses granted under the license agreement, OEM and its licensors will retain full and exclusive right, title and ownership interest in and to the Bundled Products and in any and all related patents, trademarks, copyrights or proprietary or trade secret rights. VI. OEM will have the right to terminate the license for the OEM Sublicensee's or Corporate Sublicensee's breach of a material term. The OEM Sublicensee or Corporate Sublicensee will agree that, upon termination of the license, the OEM Sublicensee or Corporate Sublicensee will return to OEM all copies of the object code and documentation for the Bundled Products or certify to OEM that the OEM Sublicensee or Corporate Sublicensee has destroyed all such copies, except that the OEM Sublicensee or Corporate Sublicensee may retain one (1) copy of the object code for the Bundled Products solely for the purpose of supporting the OEM Sublicensee's or Corporale Sublicensee's existing licensees. 16 VII. The OEM Sublicensee or Corporate Sublicensee will agree, to the extent permitted by applicable law, not to reverse compile, disassemble or modify the Bundled Products. VIII. The OEM Sublicensee or Corporate Sublicensee will agree not to distribute the Bundled Products or any part thereof except pursuant to a license agreement meeting the requirements in Section 5.4 of the Agreement. IX. The sublicense agreement will state that in no event will OEM or its licensors be liable for indirect, incidental, special, consequential or exemplary damages arising out of or related to the Bundled Products, including but not limited to lost profits, business interruption or loss of business information, even if such party has been advised of the possibility of such damages. 17 RSA DATA SECURITY, INC. 100 Marine Parkway, Suite 500 Redwood City, CA 94065 MAINTENANCE AND SUPPORT AGREEMENT THIS MAINTENANCE AND SUPPORT AGREEMENT ("Support Agreement"), effective as of the later date of execution ("Effective Date"), is entered into by and between RSA Data Security, Inc., a Delaware corporation ("RSA"), having a principal address at 100 Marine Parkway, Suite 500, Redwood City, California 94065, and the entity named below ("OEM"), having a principal address as set forth below: OEM: Tumbleweed Software, a California corporation ----------------------------------------------------------------------- (Name and jurisdiction of incorporation) 2010 Broadway, Redwood City, CA 94063 ----------------------------------------------------------------------- (Address) Notices to Contact: Bill Bradford, --------------------------------------------------- Vice President Strategic Relationships --------------------------------------------------- (650) 569-3687 --------------------------------------------------- (Name, Title and Telephone) Initial Annual Maintenance Fee: [ * ] 10. DEFINITIONS. All capitalized terms used and not defined herein shall have the meanings set forth in the OEM Agreement or the following meanings: 10.1 "News Release" means a version of the RSA Software which shall generally be designated by a new version number which has changed from the prior number only to the right of the decimal point (E.G., Version 2.2 to Version 2.3). --------------------- * Confidential treatment has been requested with respect to certain information contained in this document. Confidential portions have been ommited from the public filing and have been filed separately with the Securities and Exchange Commission. 18 10.2 "New Version" means a version of the RSA Software which shall generally be designated by a new version number which has changed from the prior number to the left of the decimal point (E.G., Version 2.3 to Version 3.0). 10.3 "OEM Agreement" means that certain OEM Object Code License Agreement between RSA and OEM dated March 30). 10.4 "RSA Software" means proprietary software identified as RSA Software on page 1 of the OEM Agreement. 11. MAINTENANCE AND SUPPORT SERVICES. -------------------------------- 11.1 GENERAL. This Support Agreement sets forth the terms under which RSA will provide maintenance and support to OEM for the RSA Software licensed to OEM for the Bundled Product, as set forth under the unamended OEM Agreement. The use of and license to any software provided to OEM hereunder shall be governed by the terms of the OEM Agreement. 11.2 SUPPORT AND MAINTENANCE. RSA agrees to provide the maintenance and support specified in this Support Agreement and OEM agrees to pay RSA's then-current annual support and maintenance fee ("Maintenance Fee"). 11.3 MAINTENANCE PROVIDED BY RSA. For the annual period commencing on the Effective Date hereof, and for future annual periods for which OEM has paid the Maintenance Fee, RSA will provide OEM with the following services: 11.3.1 TELEPHONE SUPPORT. RSA will provide telephone support to OEM during RSA's normal business hours. RSA may provide on-site support reasonably determined to be necessary by RSA at OEM's location specified on page 1 hereof. RSA shall provide the support specified in this Section 2.3.1 to OEM's employees responsible for developing and maintaining the Bundled Products licensed under the OEM Agreement and providing support to End User Customers. No more than two (2) OEM employees may obtain such support from RSA at any one time. On RSA's request, OEM will provide a list with the names of the employees designated to receive support from RSA. OEM may change the names on the list at any time by providing written notice to RSA. 11.3.2 ERROR CORRECTION. In the event OEM discovers an error in the RSA Software which causes the RSA Software not to operate in material conformance to RSA's published specifications therefor, OEM shall submit to RSA a written report describing such error in sufficient detail to permit RSA to reproduce such error. Upon receipt of any such written report, RSA will use its reasonable business judgment to classify a reported error as either: (i) a "Level 1 Severity" error, meaning an error that causes the RSA Software to fail to operate in a material manner or to produce materially incorrect results and or which there is no workaround 19 or only a difficult workaround; or (ii) a "Level 2 Severity" error, meaning an error that produces a situation in which the RSA Software is usable but does not function in the most convenient or expeditious manner, and the use or value of the RSA Software suffers no material impact. RSA will acknowledge receipt of a confirming error report within two (2) business days and (A) will use its continuing best efforts to provide a correction of any Level 1 Severity error to OEM as early as practicable; and (B) will use its reasonable efforts to include a correction for any Level 2 Severity error in the next release of the RSA Software. 11.3.3 NEW RELEASES AND NEW VERSIONS. RSA will provide OEM information relating to New Releases and New Versions of the RSA Software during the term of this Support Agreement. New Releases and New Versions will be provided by RSA at no additional charge. Nevertheless, license rights to any New Versions provided hereunder shall not extend to any new algorithms contained in such New Versions which algorithms are not listed as licensed under the terms of the OEM Agreement. License rights to such new algorithms shall be available at RSA's standard upgrade charges in effect at the time. Any New Releases or New Versions acquired by OEM shall be governed by all of the terms and provisions of the OEM Agreement. 11.4 LEGEND MAINTENANCE. If this Support Agreement has lapsed, OEM may obtain a license of New Releases or New Versions of the applicable RSA Software (consistent with Section 2.3.3 above) or any service which is provided as a part of maintenance and support by becoming current on Maintenance Fees as provided in Section 3.1 to te date such New Release or New Version is licensed or such service is provided. 12. MAINTENANCE AND SUPPORT FEES. ---------------------------- 12.1 MAINTENANCE AND SUPPORT FEES. In consideration of RSA's providing the maintenance and support services described herein, OEM agrees to pay RSA the initial Maintenance Fee set forth on the first page hereof. Such amount shall be payable for the first year upon the execution of this Support Agreement, and for each subsequent year in advance of the commencement of such year. The Maintenance Fee may be modified by RSA for each renewal term by written notice to OEM at least ninety (90) days prior to the end of the then-current term. If OEM elects not to renew this Support Agreement for successive terms (as provided in Section 6.1 below) OEM may re-enroll only upon payment of the annual Maintenance Fee for the coming year and for all Maintenance Fees that would have been paid had OEM not ceased maintenance and support. 12.2 ADDITIONAL CHARGES. In the event RSA is required to take actions to correct a difficulty or defect which is traced to OEM errors, modifications, enhancements, software or hardware, then OEM shall pay to RSA its time and materials charges at RSA's rates then in effect, in the event RSA's personnel must travel to perform maintenance or on-site support, OEM shall reimburse RSA for any reasonable out-of-pocket expenses incurred, including travel to and from OEM's sites, lodging, meals and shipping, as may be necessary in connection with duties performed under this Section 3.2 by RSA. 20 12.3 TAXES. All taxes, duties, fees and other governmental charges of any kind (including sales and use taxes, but excluding taxes based on the gross revenues or net income of RSA) which are imposed by or under the authority of any government or any political subdivision thereof on the Maintenance Fees or any aspect of this Support Agreement shall be borne by OEM and shall not be considered a part of, a deduction from or an offset against Maintenance Fees. 12.4 TERMS OF PAYMENT. Maintenance Fees due RSA hereunder shall be paid by OEM to the attention of the Software Licensing Department at RSA's address set forth above upon execution and, in the case of renewal terms, prior to each anniversary thereof. A late payment penalty on any Maintenance Fees not paid when due shall be assessed at the rate of one percent (1%) per thirty (30) days. In no event shall Maintenance Fees paid be refundable. 12.5 U.S. CURRENCY. All payments hereunder shall be made in lawful United States currency. 13. CONFIDENTIALITY. The parties agree that all obligations and conditions respecting confidentiality, use of the Source Code (if licensed to OEM) and publicity in Section 6 of the OEM Agreement shall apply to the parties' performance of this Support Agreement. 14. USE LIMITATIONS; TITLE; INTELLECTUAL PROPERTY INDEMNITY; LIMITATION OF LIABILITY. Any and all RSA Software provided to OEM pursuant to this Support Agreement shall constitute RSA Software under the OEM Agreement. As such, the parties' respective interests and obligations relating to the RSA Software, including but not limited to license and ownership rights thereto, use limitations (if any), intellectual property indemnity and limitation of liability, shall be governed by the terms of the OEM Agreement. 15. TERM AND TERMINATION -------------------- 15.1 TERM. This Support Agreement shall commence on the Effective Date hereof and shall remain in full force and effect for an initial period of one (1) year, unless sooner terminated in accordance with this Support Agreement. Upon expiration of the initial period and each successive period, this Support Agreement shall automatically renew for an additional (1) year period, unless either party has notified the other of its intent to terminate as set forth in Section 6.2.3 herein. 15.2 TERMINATION. ----------- 15.2.1 Either party shall be entitled to terminate this Support Agreement at any time on written notice to the other in the event of a material default by the other party of this Support Agreement and a failure to cure such default within a period of thirty (30) days following receipt of written notice specifying that a default has occurred. 21 15.2.2 This Support Agreement shall automatically terminate in the event that the OEM Agreement is terminated in accordance with its terms. 15.2.3 This Support Agreement may also be terminated by OEM for any or no reason by providing written notice of such intent at least (90) days prior to the end of the then-current term. RSA may cease to offer support and maintenance for future maintenance terms by notice delivered to OEM ninety (90) days or more before the end of the then-current maintenance term. 15.2.4 Upon (i) the institution of any proceeding by or against either party seeking relief, reorganization or arrangement under any laws relating to insolvency, which proceedings are not dismissed within sixty (60) days; (ii) the assignment for the benefit of creditors, or upon the appointment of a receiver, liquidator or trustee, of any of either party's property or assets; or (iii) the liquidation, dissolution or winding up of either party's business, then and in any such events this Support Agreement may immediately be terminated by the other party upon written notice. 15.3 SURVIVAL OF CERTAIN TERMS. The following provisions shall survive any expiration or termination: Sections 2.4, 5, 6 and 7. 16. MISCELLANEOUS PROVISIONS. This Support Agreement is not an amendment to the OEM Agreement, but instead is a separate binding agreement which incorporates certain terms of the OEM Agreement for the purposes of brevity and assured consistency. This Agreement incorporates by this reference Section 10 of the OEM Agreement in its entirety. IN WITNESS WHEREOF, the parties have executed this Agreement as of the date of the later signature below. OEM: TUMBLEWOOD SOFTWARE, INC. BY: ----------------------------------- PRINTED NAME: ------------------------- TITLE: -------------------------------- DATE: --------------------------------- 22 RSA DATA SECURITY, INC. BY: /s/ Albert Sisto ----------------------------------- PRINTED NAME: Albert Sisto ------------------------- TITLE: Chief Operating Officer -------------------------------- DATE: March 30, 1998 --------------------------------- 23 EXHIBIT "A" TO MAINTENANCE AND SUPPORT AGREEMENT Licensee: Tumbleweed Software, Inc. ---------------------------------------------------------------------- Maintenance and Support Agreement Date: March 30, 1998 --------------------------------------- THE MAINTENANCE AND SUPPORT AGREEMENT between RSA Data Security, Inc. and the Licensee set forth above dated as of the date set forth above ("Agreement") is amended as set forth below. 1. DEFINITIONS. Capitalized terms used and not otherwise defined in this Exhibit "A" shall have the meanings designated for such terms in the Agreement. 2. AMENDMENTS TO AGREEMENT. The following provisions of the Agreement, referenced by the applicable Section numbers in the Agreement, are hereby amended as follows: 2.1 SECTION 3.1 The third sentence of Section 3.1 is amended by adding the following at the end thereof: ". . . ; PROVIDED, HOWEVER THAT THE MAINTENANCE FEE SHALL NOT BE INCREASED BY ANA MOUNT GREATER THAN TEN PERCENT (10%) PER ANNUM." 2.2 SECTION 6.2.3 The second sentence of Section 6.2.3 of the Agreement is amended by adding the following at the end thereof: ". . . ; PROVIDED, HOWEVER, THAT RSA MAY CEASE TO OFFER MAINTENANCE TO OEM WITH RESPECT TO THE MOST RECENT RELEASE OF A PARTICULAR RSA SOFTWARE PRODUCT ONLY IF IT IS GENERALLY CEASING TO OFFER MAINTENANCE FOR THE SAME PRODUCT TO IT OTHER SIMILARLY-SITUATED LICENSEES." 3. EFFECT OF AMENDMENT. This Exhibit "A" is an amendment to the Agreement. Except as expressly amended above, the Agreement shall remain in full force and effect. IN WITNESS WHEREOF, the parties have executed this Exhibit "A" as of the date set forth above. LICENSEE: TUMBLEWEED SOFTWARE, INC. RSA DATA SECURITY, INC. BY: /s/ Joseph C. Consul BY: /s/ Albert Sisto ----------------------------------- --------------------------------- PRINTED NAME: Joseph C. Consul PRINTED NAME: Albert Sisto ------------------------- ----------------------- TITLE: VP FInance, CFO TITLE: Chief Operating Officer -------------------------------- ------------------------------ 24 EXHIBIT I SERVER SOFTWARE SUBLICENSE TERMS Any agreement between UPS and any Server Sublicensee shall contain rights consistent with those enumerated in the Agreement, except that the agreement must also include terms at least as protective of Tumbleweed's interests in the Server Software and Custom Server Software (collectively, the "Server Software") and in the Client Software and Custom Client Software (collectively, the "Client Software" which, with the Server Software, is collectively referred to herein as the "Software") as the following: 1. RESTRICTIONS. The license grant to use the Server Software and reproduce and distribute the Client Software is not transferable, assignable or sublicenseable. Server Sublicensee shall not, nor shall it authorize a third party to, decompile, reverse engineer or disassemble the Software except where such conduct is explicitly permitted under local law. Server Sublicensee agrees to pay all required licensing fees and not to exceed the scope of the licenses granted under the Agreement. Server Sublicensee acknowledges and agrees that Tumbleweed may, at any time without notice, incorporate license management software into the Server Software to prevent Server Sublicensee from exceeding the scope of its license. Neither UPS nor Tumbleweed has provided any license of its trademarks to Server Sublicensee. 2. OTHER RESTRICTIONS. Server Sublicensee shall retain any End User license agreements included with the Client Software. Server Sublicensee shall not remove, modify or obscure any proprietary rights notices in the Software or logos or trademarks displayed in the Software or any documents automatically generated by it. Server Sublicensee shall not distribute, in connection with the Software or in the performance of reselling messaging services, any viruses, trojan horses, worms, time bombs, cancelbots or other programs containing computer programming defects which are intended to damage or detrimentally interfere with a user's system or data. 3. OWNERSHIP. Except as otherwise provided in this Agreement, UPS and its suppliers (including, without limitation, Tumbleweed) shall retain all rights, title and interest in and to all copyrights, trademarks, trade secrets, patents and all other industrial and intellectual property embodied in or appurtenant to the Software. There are no implied licenses under this Agreement, and any rights not expressly granted to Server Sublicensee hereunder are reserved by UPS or its suppliers. 4. AUDIT RIGHTS. Server Sublicensee will keep for 3 years proper records and books of account relating to Server Sublicensee's activities regarding the Software. Once every 12 months, UPS or its designee may inspect such records to verify Server Sublicensee's statements. Any such inspection will be conducted on Server Sublicensee's office in a manner that does not unreasonably interfere with Server Sublicensee's business activities. Server Sublicensee shall immediately make any overdue payments disclosed by the audit. Such inspection shall be at UPS's expense; PROVIDED, HOWEVER, if the audit reveals overdue payments in excess of 5% of the payments owed to date, Server Sublicensee shall immediately pay the cost of such audit, and UPS may conduct another audit during the same 12 month period. Server Sublicensee will make available to UPS all relevant records, including but not limited to all records relating to activities outside of the United States. 5. DISCLAIMER OF WARRANTY; NO PASS THROUGH. UPS shall be responsible for any warranties extended to Server Sublicensee regarding the Software, except that UPS shall have the right to pass through to Server Sublicensee the proprietary rights indemnification of Tumbleweed, as set forth in Section 14(a) of the Agreement. TUMBLEWEED AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. Server Sublicensee shall make no warranties to End Users on behalf of UPS or its suppliers. 25 6. SERVER SUBLICENSEE'S INDEMNITY. Server Sublicensee shall indemnify UPS and its suppliers against any and all claims, losses, costs and expenses, including reasonable attorneys' fees, which any of them may incur as a result of claims in any form by third parties, including End Users, based upon (i) any representations made by Server Sublicensee to such third parties which are not supported by the Documentation and/or any other information or materials supplied by UPS and/or its suppliers, or (ii) any acts committed by Server Sublicensee's End Users during the course of their use of the Software. 7. LIMITATIONS ON LIABILITY. EXCEPT FOR ANY BREACHES OF SECTIONS RELATING TO LICENSE GRANTS OR CONFIDENTIALITY, IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR LOST PROFITS OR SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT (WHETHER FROM BREACH OF CONTRACT OR WARRANTY OR FROM NEGLIGENCE OR STRICT LIABILITY), EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION OF LIABILITY SHALL APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY HEREIN. EXCEPT FOR TUMBLEWEED'S INDEMNIFICATION OBLIGATIONS, IN NO EVENT SHALL TUMBLEWEED'S LIABILITY TO SERVER SUBLICENSEE EXCEED THE AMOUNTS ACTUALLY RECEIVED BY TUMBLEWEED ATTRIBUTABLE TO SERVER SUBLICENSEE. 8. GENERALLY. At its own expense, Server Sublicensee shall comply with all applicable laws, regulations, rules, ordinances and orders regarding its activities related to this Agreement. Without limiting the foregoing: (a) Server Sublicensee shall fully comply with the relevant export administration and control laws and regulations, as same may be amended from time to time, to ensure that the Software is not exported (directly or indirectly) in violation of United States law. (b) Server Sublicensee shall comply with the U.S. Foreign Corrupt Practices Act and shall not make any payments to third parties which would cause UPS (or any of its suppliers) or Server Sublicensee to violate such laws. 9. GOVERNMENT END USERS. The Software is a "commercial item," consisting of "commercial computer software" and "commercial computer software documentation," and is provided to the U.S. Government only as a commercial end item. 26