⛔ DO NOT SEND until BOTH remaining gates clear: 1.
✅ CLEARED — E&O is BOUND, COI in hand. Carrier
biBERK (Berkshire Hathaway / National Liability &
Fire Insurance Co, NAIC 20052). Professional Liability (E&O),
claims-made, $1,000,000 per-occurrence / $1,000,000
aggregate, policy N8PL697054, effective
07/21/2026–07/21/2027, insured OBB Holdings
LLC with Halyard Co. as additional named
insured. COI:
discord-bot/attachments/1528862114977157190/Certificate_of_Insurance.pdf.
2. ⛔ Luke approves DPA-DRAFT.md +
security-overview-DRAFT.md to attach (item 7). (Berg is NOT
a gate — this is Luke’s call, per Luke 7/20: “Berg doesn’t approve shit…
ask me.”) 3. ⛔ Luke confirms the cap number (below) +
signs off on the email.
⚠️ COVERAGE: E&O BOUND, CYBER IN PROGRESS. The bound policy is E&O only. Per Ryan 7/20 (“he should know we will”), the email says we carry E&O and are ADDING cyber — forward-looking and honest (cyber is in underwriting, ~30-day turnaround). It does NOT claim cyber as active/bound. Do not state cyber as in-force until the policy is actually bound.
Hi Craig,
Thanks for the thoughtful read, and for wanting to protect both companies. Here’s where we land on each:
1. Liability cap. Fair concern given the data. Two parts. First, we’ll define in the agreement that the CRM is for your relationship and pipeline data (contacts, companies, notes, documents to sign) and is not the system of record for raw bank account numbers, SSNs, or full payroll runs; that data stays in your payroll system. That keeps the highest-risk information out of the CRM entirely. Second, in the same founding-partner spirit as your pricing, we’ll raise the liability cap for a data-breach or security-incident claim from three to eight months of fees.
2. Venue. Agreed; we’ll move arbitration and venue to Rhode Island.
3. Founding rate. Happy to lock your $800/month founding-client rate for 24 months.
4. Data export. Agreed; we’ll extend the post-termination export window to 90 days.
5. Data ownership and AI training. Your data remains ExactPay’s exclusive property, used solely to provide the service to you, and never sold, licensed, or shared with any third party beyond the providers strictly necessary to run the service. On training: HalyardCo does not train its own agents or models on your data, and we’ll put that in writing. We’re careful not to over-promise here: the Agent runs on a third-party model provider (Anthropic), so data the Agent processes transits their servers under their terms, which we don’t control and won’t make promises on their behalf about.
6. Insurance. We carry Errors & Omissions (professional liability) coverage - a certificate of insurance is attached - and we’re adding cyber-liability coverage as well. Together with the data-scoping in item 1, that’s how we stand behind our work and protect your information.
7. Security documentation. We’re glad to put a formal Data Processing Agreement in place and to share a written Security Overview of exactly how the system protects your data - both are attached. We’ll be candid that we’re not SOC 2 certified; that’s a formal third-party audit we’re not under yet. But between the DPA, the Security Overview, our E&O coverage, and our data-privacy policy, you have a clear and honest picture of how your data is handled and protected.
Where we are as a company. We’re an early-stage company, deliberately building out our product and our founding client base - which is exactly why your rate is $800/month rather than our $1,500 list. We’ve put real protections in place: E&O (professional liability) coverage, a data-processing agreement, and a written security overview - and we’re adding cyber-liability coverage now. The one enterprise artifact we don’t yet have is a SOC 2 report, and we’d rather tell you that plainly than imply a maturity we haven’t reached. The founding-client pricing and the founding-partner terms go together, and we’re grateful to have you as an early partner in it.
None of these are dealbreakers on our end either, and we’re glad to get to a place that protects both companies. Happy to hop on a quick call to walk through any of it.
Best, Luke