Pindrop Subscription Agreement for Verizon Resale Customers

1. Definitions.

Capitalized terms used in this Exhibit C have the meanings given below or, if not defined below, the meanings given in the main body of this
Agreement.

“In-Scope Subcontractor” means each of Pindrop’s subcontractors who are engaged by Pindrop to deliver component(s) of the Products or Services to you and will have access to, process, or store Your Call Data.

“Information System” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing,
dissemination or disposition of electronic information, as well as any specialized system such as industrial/process controls systems, telephone
switching and private branch exchange systems, and environmental control systems.

“Pindrop-Controlled Systems” means: (i) Information Systems that are within Pindrop’s possession or control; and (ii) Amazon Web Services
(“AWS”) Information Systems or Google Cloud Platform (“GCP”) that meet the following criteria: (a) under Pindrop’s enterprise account with
AWS or GCP, as applicable; (b) used by Pindrop to deliver the Products or Services or used by Pindrop for Pindrop’s internal, corporate-level
systems; and (c) are AWS Information Systems or GCP Information Systems for which Pindrop solely configures and manages the security controls
used by Pindrop to protect the data stored within such AWS Information Systems or GCP Information Systems. The defined term Pindrop-Controlled
Systems excludes all of Your Controlled Systems.

“Regulator” means any industry regulatory agency with supervisory authority over your company under applicable Laws.

“Security Breach” means a reasonably suspected or confirmed unauthorized disclosure of your Confidential Information within Pindrop’s
possession or control; or a reasonably suspected or confirmed unauthorized access by a third party to any Pindrop-Controlled Systems that process, hold, or provide access to your Confidential Information.

“Your Controlled System” means Information Systems that are within your possession or control.

2. Governance and Oversight.

(a) Pindrop will have in place a cybersecurity program designed to protect the confidentiality, integrity, and availability of the Pindrop-Controlled
Systems, as detailed in this Exhibit C. Such cybersecurity program includes tracking data asset locations and maintaining risk based written security
policy or policies that satisfy the requirements set forth in this Exhibit C (the “Security Policy”). Pindrop will not make any change to its Security
Policy that will materially degrade the overall level of security described in this Exhibit C.

(b) Pindrop’s Security Policy will be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security,
confidentiality, and integrity of your Confidential Information within Pindrop’s possession or control that could result in the unauthorized disclosure,
misuse, alteration, destruction or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks. The risk assessment will be written and include: (i) criteria for the evaluation and categorization of identified security risks or threats to your
Confidential Information within Pindrop’s possession or control; (ii) criteria for the assessment of the confidentiality, integrity, and availability of
your Confidential Information within Pindrop’s possession or control, including the adequacy of the existing controls in the context of the identified
risks or threats; and (iii) requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the Security Policy will address the risks.

(c) Pindrop will periodically perform additional risk assessments that reexamine the reasonably foreseeable internal and external risks to the
security, confidentiality, and integrity of your Confidential Information within Pindrop’s possession or control that could result in the unauthorized
disclosure, misuse, alteration, destruction or other compromise of such information, and reassess the sufficiency of any safeguards in place to control these risks.

(d) Pindrop will (i) design and implement safeguards to control the risks identified through the risk assessments it performs; and (ii) evaluate and
adjust its information security program in light of the results of the testing and monitoring described in this Exhibit C, any material changes to
Pindrop’s operations or business arrangements, and any other circumstances that Pindrop knows or has reason to know may have a material impact
on Pindrop’s information security program.

(e) Pindrop will assign an appropriate individual within Pindrop’s Information Security team to maintain responsibility and executive oversight for
the Security Policy, including, without limitation, formal governance and revision management, employee education, and compliance enforcement.
The individual assigned by Pindrop to maintain responsibility and executive oversight for the Security Policy will report in writing, regularly and at
least annually, to Pindrop’s executive team or board of directors or equivalent governing body. Any such reports will include the following
information: (i) the overall status of Pindrop’s information security program; and (ii) material matters related to Pindrop’s information security
program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management’s responses thereto, compliance obligations and recommendations for changes in the information security program.

(f) Subject to the terms and conditions in Section 12 (Audits) of the main body of the Agreement, the rights in this Section 2(f) shall apply. If a
Regulator exercising its supervisory authority makes a request to you to access the Products or Services, you will use commercially reasonable efforts to resolve that request directly with the Regulator using alternative methods, including by reviewing the security certifications for the Pindrop-Controlled Systems with the Regulator. If the Regulator determines that the information available through these mechanisms is insufficient to verify compliance with applicable Laws then, upon the Regulator’s request and your written confirmation that the Regulator has the requisite supervisory authority over your company to make such a request, Pindrop will provide the Regulator with: (i) information about the Products and Services and the opportunity to discuss the Products and Services operations and controls with Pindrop subject matter experts; and (ii) if required, a direct right to examine the Products and Services used by you, including by conducting an examination on premises. Pindrop may charge you a fee (based on Pindrop’s reasonable costs) for any such discussion, communication, and examination. Any discussion, communication, or examination requested by the Regulator under this subsection will, except in an emergency or crisis situation, be conducted consistent with the terms of Section 12 (Audits) of the main body of the Agreement.

3. Policies and Procedures.

(a) The policies that comprise the Security Policy are commercially reasonable, communicated to relevant Pindrop employees, and designed to: (i)
be protective of your Confidential Information within the Pindrop-Controlled Systems; and (ii) support Pindrop’s compliance with its obligations
under the Agreement. If requested by you in writing, Pindrop agrees to provide you with (1) the title page and table of contents related to the
Security Policy or other related policies or procedures applicable to Pindrop’s business operations set forth in this Exhibit C; (2) an opportunity to
discuss Pindrop’s security measures; (3) confirmation that penetration testing and vulnerability scanning has been performed; and (4) independent
audit reports applicable to the Products (such as SOC2 Type 2) that Pindrop makes generally available to its customers under confidentiality terms.

(b) Pindrop will review its Security Policy at least annually and amend such Security Policy (or subparts thereof) as Pindrop deems commercially
reasonable (e.g., in light of relevant risk assessment findings, relevant changes in applicable laws or standards, technology advances, changes to
Pindrop’s systems or Pindrop’s own changing business operations).

(c) As part of the Security Policy, Pindrop will have security-minded development practices for applications that form any part of the Products or
that are used to deliver the Products, and procedures for evaluating and assessing the security of externally developed applications that form any part of the Products or that are used in the delivery of the Products.

(d) Pindrop will maintain and follow employment verification requirements for all new Pindrop employee hires, with such verifications occurring
prior to the date of hire. These requirements will include criminal background checks, proof of identity validation, and additional checks as deemed
reasonably necessary by Pindrop and as permitted by applicable Law. Such employment verification measures shall be in line with requirements
under Industry Standards (as defined in Section 4 (Compliance) below). Each Pindrop local entity is responsible for implementing the foregoing
requirements in its hiring process as applicable and permitted under local law. Pindrop will provide verification of the completion of background
checks in a satisfactory manner for employees upon your reasonable request; however, Pindrop is not required to provide an actual copy of the
background check results.

(e) Pindrop will have a training program that includes conducting security education for its employees annually. The training program will: (i)
provide security awareness training that is updated to reflect risks identified by Pindrop’s risk assessments; and (ii) promote the maintenance of
current knowledge of changing information security threats and countermeasures.

4. Compliance. Pindrop-Controlled Systems will be subject to annual certification of compliance with the Payment Card Industry Data Security
Standards (PCI-DSS) (with respect to relevant cardholder data environments only), ISO 27001, and SSAE SOC 2 or any substantially equivalent or
alternative successor standard (the “Industry Standards”). Upon written request from you, Pindrop will provide evidence of the compliance and
accreditation with the Industry Standards as reasonably determined by Pindrop, such as certificates, attestations, or reports resulting from accredited independent third-party audits (accredited independent third-party audits will occur at the frequency required by the relevant standard). Additionally, Pindrop will use commercially reasonable efforts to verify that its In-Scope Subcontractors comply with all Laws applicable to the operation of the In-Scope Subcontractors’ business and all Laws generally applicable to providers of information technology services, in each case, to the extent relevant to the specific products and services being provided by such In-Scope Subcontractor to Pindrop in connection with the Products and Services covered under the Agreement and a Reseller Order. The verification may be accomplished through Pindrop’s vendor due diligence process. In the event that Pindrop’s vendor due diligence process identifies a non-compliance with the aforementioned Laws, Pindrop will work with the In-Scope Subcontractor to cure such deficiency.

5. Incident Response and Security Breaches.

(a) Pindrop will maintain and follow documented incident response policies consistent with National Institute of Standards and Technology, United
States Department of Commerce (NIST) guidelines or equivalent industry standards for computer security incident handling. Pindrop’s written
incident response plan will be designed to promptly respond to, and recover from, any event materially affecting the confidentiality, integrity, or
availability of your Confidential Information within Pindrop’s possession or control. Such incident response plan shall address the following areas:
(i) the goals of the incident response plan; (ii) the internal processes for responding; (iii) the definition of clear roles, responsibilities and levels of
decision-making authority; (iv) external and internal communications and information sharing; (v) identification of requirements for the remediation
of any identified weaknesses in information systems and associated controls; (vi) documentation and reporting; and (vii) the evaluation and revision
as necessary of the incident response plan.

(b) Pindrop will investigate Security Breaches (and security incidents that are not yet Security Breaches but that are reasonably likely to result in
Security Breaches) of which Pindrop becomes aware, perform a root-cause analysis of the same and take prompt action designed to contain the
Security Breach. You must notify Pindrop of any suspected vulnerability or security incident by immediately submitting a technical support request
to Pindrop.

(c) Pindrop will notify you within no more than 24 hours after Pindrop becomes aware of a Security Breach that has impacted your Confidential
Information. Pindrop will provide you with reasonably requested information about such Security Breach and the status of any Pindrop containment
and service restoration activities.

6. Physical Security and Entry Control.

(a) Pindrop will maintain reasonable physical entry controls, such as barriers, card-controlled entry points, surveillance cameras, and manned
reception desks, designed to protect against unauthorized entry into Pindrop-managed facilities (i.e., its headquarter facility) used to provide the
Pindrop-Controlled Systems. Auxiliary entry points into such facilities, such as delivery areas and loading docks, will be controlled and isolated from
computing resources.

(b) Access to Pindrop-managed facilities and controlled areas within those facilities will be limited by job role and subject to authorized approval.
Such access will be logged, and such logs will be retained for not less than one year. Pindrop will revoke access to Pindrop-managed facilities upon
separation of an authorized employee. Pindrop will follow formal documented separation procedures that include prompt removal from access
control lists and surrender of physical access badges.

(c) Any person granted temporary permission to enter an Pindrop-managed facility or a controlled area within such facility will be registered upon
entering the premises and will be escorted by authorized personnel.

(d) Pindrop will take precautions designed to protect the physical infrastructure of Pindrop-managed facilities against environmental threats, both
naturally occurring and man-made, such as excessive ambient temperature, fire, flood, humidity, theft, and vandalism.

7. Access, Intervention, Transfer and Separation Control.

(a) Pindrop will maintain measures for Pindrop-Controlled Systems that are designed to logically separate and prevent your Confidential
Information stored within Pindrop-Controlled Systems from being exposed to or accessed by unauthorized persons. Pindrop will maintain isolation
of its production and non-production environments, and, if your Confidential Information is transferred to a non-production environment, for
example to reproduce an error at your request, security and privacy protections in the non-production environment will be equivalent to those in
production.

(b) Pindrop will encrypt your Confidential Information that is subject to long-term storage within Pindrop-Controlled Systems and when your
Confidential Information is transmitted by Pindrop over public networks. Pindrop will maintain documented procedures for encryption key
generation, issuance, distribution, storage, rotation, revocation, recovery, backup, destruction, access, and use. To the extent that encryption is
impractical, Pindrop will use compensating controls designed to protect your Confidential Information.

(c) If Pindrop requires access to your Confidential Information that is stored within Pindrop-Controlled Systems, and if such access is managed by
Pindrop, Pindrop will deploy measures designed to restrict access to the minimum level required. Such access, including, without limitation,
administrative access, will be individual, role-based, and subject to approval and regular validation by authorized Pindrop personnel following the
principles of segregation of duties. Pindrop will maintain measures to identify and remove redundant and dormant accounts with privileged access
and will promptly revoke such access upon the account owner's separation or upon the request of authorized Pindrop personnel, such as the account owner’s manager.

(d) For Pindrop-Controlled Systems, Pindrop will:

(i) monitor and periodically test the Pindrop-Controlled Systems to assess the effectiveness of the Security Policy;

(ii) maintain technical measures enforcing timeout of inactive sessions, lockout of accounts after multiple sequential failed login attempts,
strong password or passphrase authentication, and password change frequency;

(iii) monitor use of privileged access and maintain security information and event management measures designed to: (1) identify unauthorized
access and activity; (2) facilitate a timely and appropriate response, and (3) enable internal and independent third-party audits of compliance with the Security Policy;

(iv) where practicable for a given Pindrop-Controlled System, use multi-factor authentication designed to protect against unauthorized access to
such Pindrop-Controlled System;

(v) maintain logs in which privileged access and activity are recorded will be retained in compliance with Pindrop's worldwide records
management plan and Security Policy;

(vi) maintain measures designed to protect against unauthorized access, modification, and accidental or deliberate destruction of the logs
described in the prior (v);

(vii) maintain signature-based malware detection and removal software for the Pindrop-Controlled Systems; and

(viii) where practical with respect to the Pindrop-Controlled Systems, use multifactor authentication designed to protect against unauthorized
access to Pindrop-Controlled Systems.

(e) Pindrop will securely sanitize physical media intended for reuse prior to such reuse, and will destroy physical media not intended for reuse,
consistent with NIST guidelines for media sanitization. Upon your reasonable request, Pindrop will provide a certificate of destruction certifying the
destruction of any of Your Confidential Information within Pindrop’s possession or control.

8. Service Integrity and Availability Control. With respect to Pindrop-Controlled Systems, Pindrop will:

(a) Perform security risk assessments at least annually;

(b) Perform security testing and vulnerability assessments on a periodic basis;

(c) Enlist a qualified testing service to perform penetration testing at least annually;

(d) Perform automated vulnerability scanning against configuration industry standards reasonably designed to identify publicly-known security
vulnerabilities in Pindrop-Controlled Systems based on Pindrop’s risk assessment: (i) at least every six months; (ii) whenever there are material
changes to Pindrop’s technical operations of the nature that reasonably justify the performance of a scan; and (iii) whenever there are circumstances that Pindrop knows or has reason to know may have a material impact on Pindrop’s information security program of the nature that reasonably justify the performance of a scan;

(e) Follow Pindrop’s policies with respect to the remediation of identified vulnerabilities, based on associated risk, exploitability, and impact;

(f) Take reasonable steps to avoid disruption of the Products and Services when performing its tests, assessments, scans, and execution of
remediation activities;

(g) Maintain measures designed to assess, test, and apply security advisory patches. Upon determining that a security advisory patch is applicable
and appropriate, Pindrop will implement the patch pursuant to Pindrop’s policies, taking into account associated risk, exploitability, and impact;

(h) Maintain policies and procedures designed to manage risks associated with the application of changes; and

(i) Maintain an inventory of information technology assets.

9. Malicious Code.

Pindrop will not intentionally or knowingly either introduce or allow the introduction of any code, files, scripts, agents or
programs intended to do harm, including for example, viruses, worms or Trojan horses (“Malicious Code”) into the Product delivery environment. If
Malicious Code is found to have been introduced into a Product by Pindrop, Pindrop will be responsible for removing the Malicious Code from such
Product. If the Malicious Code that was found to have been introduced by Pindrop is also found to have been introduced into Your Controlled
Systems, Pindrop will reasonably cooperate with you by providing relevant information necessary for the you to mitigate the effects of such
Malicious Code.

10. Vendor Management Program.

(a) Pindrop agrees to maintain a formal vendor management program. As part of such program, Pindrop is responsible for conducting due diligence
on each of its In-Scope Subcontractors on a periodic basis to assess the extent to which each In-Scope Subcontractor has reasonable security
measures designed to protect the Your Call Data in that In-Scope Subcontractor’s possession or control. In conducting In-Scope Subcontractor due
diligence, Pindrop may rely upon the information available in an In-Scope Subcontractor’s SOC2 or comparable report or certification (each an
“Independent Audit Report”) to make such assessment, even if the Independent Audit Report does not contain the level of detail specified in this
Exhibit C. Upon your request, Pindrop shall direct you to the location at which you can obtain copies of an In-Scope Subcontractor’s Independent
Audit Report. In the event that you are unable to obtain such Independent Audit Report, Pindrop shall use reasonable efforts to secure the relevant
Independent Audit Report from such In-Scope Subcontractor and provide a copy to you. Pindrop agrees to provide you with a minimum of 30 days’ prior notice if there is a material change in the identity of the In-Scope Subcontractors applicable to the Products or Services covered under an
existing Reseller Order. If an In-Scope Subcontractor is Processing Your Personal Information, then within 30 days of receiving notice of a new In-
Scope Subcontractor, you may object (in good faith) to such engagement. In the event you make an objection within such time period, the parties will work in good faith to resolve the objection. If the parties are not able to come to a mutually agreed to solution, your sole and exclusive remedy will be to terminate the Reseller Order pursuant to the terms in Your Agreement and such Reseller Order(s) with the Authorized Reseller.

(b) In addition to In-Scope Subcontractors, you understand and agree that Pindrop may use other vendor systems and solutions to support its day to day back office business operations where your Confidential Information (other than data that’s been input into a Product) may be collected,
processed or stored, including by way of example, contract management, billing or other financial transaction-related tools and solutions (each a
“Back Office Business System”). Back Office Business Systems are not Pindrop-Controlled Systems, but are subject to the requirements in
Sections 10(c) and 10(d) of this Exhibit C.

(c) Pindrop will have a written agreement in place with each In-Scope Subcontractor and each vendor providing a Back Office Business System
that contains commercially reasonable confidentiality obligations designed to protect the confidentiality of Your Call Data in the possession or
control of the In-Scope Subcontractor or the confidentiality of your Confidential Information in the possession or control of each vendor providing
the Back Office Business System, as applicable.

(d) Pindrop is responsible for any unauthorized disclosure of Your Call Data by an In-Scope Subcontractor and your Confidential Information by
each vendor providing a Back Office Business System to the same extent as Pindrop itself would be by the terms of this Agreement.

11. BCP Program.

(a) Pindrop’s BCP will include (i) a business impact analysis that includes a risk assessment that documents prioritization of business functions and
process, systems, subcontractors, resource requirements and interdependencies that may affect recovery timelines and alternative resource plans; (ii) specifically defined or targeted RTOs (recovery time objective); and (iii) specifically defined or targeted RPOs (recovery point objective). Pindrop’s RTO and RPO policy for a single availability zone failure for a Product will not exceed 24 hours.

(b) Pindrop will conduct periodic exercises with respect to its BCP (such as tabletop exercises), but on no less than an annual basis. If an event
triggers Pindrop’s BCP (each a “BCP Event Trigger”), Pindrop is responsible for implementing the BCP in accordance with Pindrop’s policies and
procedures. You understand and agree that if a BCP Event Trigger occurs, depending on the nature and scope of the event and whether you procure “high availability” Appliances for any Products deployed at your managed facilities, the availability and/or ability to recover Your Confidential
Information, including without limitation, the Your Call Data, in Pindrop’s possession or control may be impacted.

(c) The Products are not designed for and should not be used by you as an official record or similar, whether for regulatory purposes or otherwise.

(d) Should the Product(s) in use by you experience an outage, Pindrop will notify you of such outage and provide periodic status updates until such
impact is resolved.

(e) Pindrop will provide reasonable prior notice to you if Pindrop’s BCP is changed in a way that would have a material adverse impact in
Pindrop’s ability to deliver the Products or the Services to you as set forth in the Agreement and each Reseller Order.

12. Your Responsibilities.

You agree to take commercially reasonable measures designed to detect and prevent the introduction of Malicious Code
into Pindrop-Controlled Systems used in the delivery of Products or Services to you. You further understand and agree that you are responsible for
determining whether the Products and Services are suitable for your use and implementing and managing security measures for all components of the Products and Services that Pindrop does not manage or for which Pindrop does not have security obligations under this Exhibit C, with Pindrop’s
only security obligations being as set forth in this Exhibit C. Examples of your responsibilities include, without limitation: (a) securing all of Your
Controlled Systems; and (b) accepting and implementing all security patches provided by Pindrop with respect to any On-Premises Appliances (and
all other software distributed by Pindrop to you in order to enable such security patches), without delay. You further agree that it is your
responsibility, and not Pindrop’s responsibility, to ensure adequate backups of any of Your Call Data on Your Controlled Systems that are physically
and logically separated from the Products and Services being provided by Pindrop under this Agreement. You agree that Pindrop shall not be in
breach of its obligations under this Exhibit C if and to the extent that Pindrop’s non-compliance is directly caused by your failure to comply with
your own security responsibilities in this Agreement.