VoIP Service Agreement

Business hosted voice and SIP trunking services.

Version 1.1 | Effective date: As identified in the accepted Service Order.

This VoIP Service Agreement is between CBIT, Inc., a Washington corporation doing business as Columbia Basin IT, with its principal place of business in Richland, Washington (CBIT or Provider), and the business customer identified in the accepted Service Order (Customer). Together they are the Parties.

This Agreement governs the Services identified in each Service Order. Customer accepts this Agreement by electronically signing a Service Order that identifies and provides access to this version of the Agreement, or by signing this Agreement. An authorized signer must separately affirmatively acknowledge Exhibit A before interconnected VoIP activation. Use of Services alone does not replace that acknowledgment or the initial signature process.

IMPORTANT EMERGENCY CALLING NOTICE: VoIP emergency calling depends on electrical power, network connectivity, and the supported emergency-location configuration. It may operate differently from traditional telephone service. Read Section 6 and Exhibit A. Customer must supply accurate location information, inform End Users of limitations, and maintain an alternative means of reaching emergency services.

1. Definitions

"Services" means the hosted voice, unified communications, SIP trunking, fax, SMS/MMS, portals, applications, and related features expressly identified in a Service Order. This definition does not determine any service's legal regulatory classification.

"Service Order" means a quote, order form, proposal, or online order accepted by Customer in writing or through CBIT's electronic signature application, identifying Services, quantities, prices, and applicable commitments. "Equipment" means phones, ATAs, headsets, gateways, switches, routers, power supplies, and other hardware used with Services. "Device" means any Equipment, softphone, mobile application, desktop application, or other calling endpoint.

"Service Activation Date" means the date CBIT notifies Customer that a particular Service is provisioned and available for use, after applicable activation prerequisites are satisfied. Different Services may have different activation dates. An Order may expressly provide a different billing commencement rule for Customer-caused delays.

"Registered Location" means the location provided and maintained for a Device or emergency calling identity under the applicable emergency-location method. "Dispatchable Location" has the meaning in 47 C.F.R. Section 9.3, including the street address and additional information necessary to adequately identify the caller's location. "PSAP" means Public Safety Answering Point. "ECRC" means a national emergency call center used where permitted to obtain or confirm location and relay emergency calls.

"Emergency Service Profile" means the location and configuration record completed during onboarding, including supported fixed and non-fixed endpoints, location methods, emergency calling identities, notification contacts, and allocation of configuration responsibilities. It may be an attachment to a Service Order or an authenticated onboarding record supplied to Customer.

"End User" means an employee, contractor, guest, or other person Customer permits to use Services. "MRC" means monthly recurring service charges. "NRC" means nonrecurring charges. "Business Day" means Monday through Friday, excluding US federal holidays, in the Pacific time zone.

2. Services and Service Orders

2.1 Scope and incorporation

CBIT provides only the Services stated in accepted Service Orders. CBIT will supply or make available a downloadable copy of this Agreement and referenced schedules before signature, and retain the accepted version and electronic signature audit record. An Order overrides a provision only if it identifies that provision and expressly states the override, subject to Section 21.5.

2.2 Business use

Services are offered to commercial, governmental, and nonprofit organizations for business use, not residential subscriptions. Customer represents that its signer is authorized to bind the identified legal entity. This classification does not waive rights or duties that law makes nonwaivable.

2.3 Changes

CBIT may change features, suppliers, platforms, or software while maintaining substantially equivalent core functionality. A planned material reduction to core functionality requires at least thirty days' direct notice. Customer may cancel affected Services before the change without early termination charges; independent equipment purchase balances and accrued charges remain due. Urgent changes necessary for security or legal compliance may occur sooner, with notice as soon as practicable and an appropriate cancellation opportunity if a material reduction remains.

2.4 Service dependencies

Services depend on underlying carriers, emergency service providers, numbering administrators, and networks outside CBIT's control. CBIT does not guarantee their uninterrupted performance. Sections 12, 16, and 17 govern contractual remedies and liability, subject to nonwaivable law. Customer obligations are limited to this Agreement and the documents expressly identified in it.

2.5 Administrators and authentication

Customer will designate authorized administrators and keep their permissions and contact information current. CBIT may rely on instructions submitted through approved authentication procedures. Disclosure of CPNI, credential recovery, administrator replacement, porting, and sensitive routing changes require applicable verification. CBIT may refuse or defer an instruction pending reasonable verification, consistently with applicable porting rules. Customer must promptly revoke departed personnel's access.

3. Term and Cancellation

3.1 Month-to-month Services

Unless an Order specifies a fixed term, each Service begins on its Service Activation Date and renews monthly until cancelled.

3.2 Customer cancellation and reductions

Customer may cancel or reduce month-to-month Services on thirty days' written notice under Section 21.2. Charges continue through the effective date and are prorated for a partial final month. Fixed-term reductions remain subject to the minimum quantities, minimum charges, and express termination provisions in the applicable Order. Routine administrator changes do not alter these commitments.

3.3 Provider cancellation

CBIT may discontinue Services for convenience on sixty days' written notice, or suspend or terminate for cause under Section 14. Provider convenience termination does not trigger Customer early termination charges. CBIT will refund prepaid unused service fees, subject to valid outstanding charges.

3.4 Fixed terms

A fixed-term Order must expressly state its term, start rule, minimum quantities or charges, renewal treatment, equipment obligations, and any early termination charge and calculation. No early termination charge is implied if none is stated. Unless the Order expressly provides otherwise, added Services are coterminous with the existing Order and do not extend its term. Fixed-term recurring prices remain fixed except for lawful taxes and charges, expressly permitted adjustments, and Customer-authorized changes. Unless otherwise stated, a fixed term converts to month-to-month at expiration.

3.5 Offboarding

Customer must arrange timely porting of numbers it wishes to retain, return CBIT-owned Equipment, and pay accrued charges and applicable commitments. Porting and cancellation are separate processes. CBIT will identify the scheduled disconnection date in its cancellation acknowledgment and reasonably cooperate with valid ports. Customer should not disconnect numbers before porting. Numbers disconnected without a pending valid port may be released under applicable rules and may not be recoverable. Requested extensions are subject to availability and disclosed charges, and will not be used to unreasonably delay a valid port.

4. Fees, Billing and Taxes

4.1 Disclosed charges

Customer will pay charges stated in an Order and applicable usage and professional-service schedules identified by URL or attachment and effective date before acceptance. CBIT will make those schedules available for download. Charges not included in a plan may include international calling, toll-free inbound calling, directory assistance, messaging, and approved professional services. CBIT will disclose applicable rates before enabling chargeable options or obtaining approval for billable work.

4.2 Billing

MRC is billed monthly in advance. Usage, overages, and NRC may be billed in arrears. Charges begin on the applicable activation or expressly agreed delayed-activation billing date. Partial months are prorated by calendar day unless an Order expressly provides otherwise. Invoices are sent electronically to the billing contact. Delayed carrier usage records may appear on a later invoice with identifying detail.

4.3 Payment

Invoices are due fifteen days after issuance unless the Order states otherwise. CBIT may require disclosed automatic-payment arrangements, a reasonable deposit, or prepayment. Late charges are the lesser of 1.5 percent per month, without compounding, or the lawful maximum. Customer is responsible for reasonable, lawful collection costs and disclosed returned-payment or chargeback costs. No fee is imposed to the extent prohibited by law.

4.4 Taxes and recovery fees

Prices exclude applicable government taxes and assessments. These will be calculated using legally applicable rates, bases, exemptions, and sourcing rules, including Washington 911 and 988 taxes where applicable. Federal USF recovery, if assessed, will comply with applicable recovery limitations and will not be represented as a tax imposed directly on Customer. CBIT-imposed regulatory recovery or administrative fees are Provider charges, not government taxes or government-mandated customer charges. Their amount or calculation must be separately disclosed in an Order or incorporated schedule. Customer must supply valid exemption documentation; an exemption applies only to charges covered by law. Taxes measured on CBIT's net income are not passed through under this clause.

4.5 Price changes

CBIT may change month-to-month recurring, usage, and discretionary Provider fee rates on at least thirty days' direct written notice. Customer may cancel affected Services before the increase becomes effective without early termination charges. Changes in government-imposed taxes or legally applicable assessments may take effect when required by law, with notice on the invoice or earlier when practicable. Urgent restrictions on destinations or usage needed to prevent fraud or comply with law are governed by Sections 10 and 14 and do not authorize undisclosed retroactive rates.

4.6 Disputes

Customer must identify disputed charges and the reason in writing within sixty days after the invoice date. Undisputed charges remain due. CBIT will investigate reasonably and provide its determination. Customer must pay amounts determined payable within fifteen days after resolution. CBIT will not suspend solely for a timely, specific, good-faith billing dispute while Customer pays undisputed amounts and cooperates. The review period does not waive rights that cannot lawfully be waived or prevent correction of established billing errors.

4.7 Business calling plans

Plans must state included destinations, inbound and outbound treatment, whether minutes are pooled, included minutes, and overage rates in the Order or incorporated plan schedule. Unless expressly stated otherwise, an included-minute allowance is per seat, not pooled, and does not include international or toll-free inbound calling. A plan with a numerical allowance will be described by that allowance rather than as unqualified unlimited calling. Abnormal automated, resale, continuous forwarding, or call-center usage requires an expressly approved plan. Any conversion to a different rate plan is prospective after notice under Section 4.5, except lawful protective restrictions.

5. Customer Network, Internet and Power

5.1 Connectivity

Customer maintains adequate broadband unless CBIT provides it under an Order. Typical voice planning guidelines are at least 100 kbps symmetric bandwidth per concurrent call, low latency and jitter, and minimal packet loss. These are planning guidelines, not a guarantee of quality for every codec or network path. CBIT may specify reasonable technical requirements for the selected configuration.

5.2 Local environment

Customer maintains its cabling, LAN, Wi-Fi, switches, firewall, router, VLANs, and QoS unless CBIT has agreed to manage them. Customer will follow approved SIP, RTP, firewall, and provisioning requirements and avoid incompatible SIP ALG or configuration. Responsibility and remedies for CBIT-provided Internet or CBIT-managed network components are governed by the applicable Order or managed services agreement; they are not excluded merely because installed at Customer premises.

5.3 Power

Devices and supporting switches, routers, firewalls, modems, and ONTs require power. An outage can interrupt Services and emergency calling. Customer should provide suitable backup power for the required path and maintain an alternative way to reach emergency services.

5.4 Special devices

Services may be unsuitable for alarm panels, elevators, fire communicators, medical monitoring, fax, modems, payment terminals, or other specialized systems. Customer must disclose intended use and maintain legally compliant alternative connectivity for life-safety systems. Such use is not approved merely because ordinary calls work; any supported configuration requires an express Order and appropriate technical review.

5.5 Troubleshooting

Customer-caused environmental problems are outside the hosted platform commitment. CBIT may charge disclosed troubleshooting rates after notice and Customer approval. Work on CBIT-managed components remains subject to the applicable support agreement.

6. Emergency Calling and Location

6.1 Provider duties

CBIT will provide emergency calling and location functionality required by applicable law for the supported service configuration, including 47 C.F.R. Section 9.11 where applicable. CBIT will route emergency calls and provide callback and location information as required. Customer obligations and disclosures do not waive CBIT's directly applicable legal duties.

6.2 Activation profile

Before activation, the Parties will complete the Emergency Service Profile for each location and supported endpoint category. It will identify emergency calling identities, fixed and non-fixed services, the actual location method, necessary dispatchable detail, emergency notification configuration, and responsibility for Customer-operated components. Customer must provide accurate information, and CBIT must complete applicable validation and provisioning before activation.

6.3 Moves

Customer must update required location information before using a relocated Device for ordinary calls, and immediately upon discovering an inaccurate location. There is no grace period for knowingly leaving an incorrect location in place. Customer must follow location prompts and confirmation instructions and ensure End Users do likewise. An address update request alone does not establish that emergency routing has changed. Nothing instructs an End User to refrain from attempting 911 in an emergency.

6.4 Updates and confirmation

CBIT will provide the location-update methods required for its applicable service configuration, including an end-user method using only the CPE needed to access the non-fixed VoIP service where required. The Profile will identify the actual supported method, support channels, and applicable processing expectations. CBIT will acknowledge administrative update requests and confirm when validated changes take effect. Pending updates can cause incorrect routing or location delivery; Customer must use its alternative emergency-calling arrangements where available. No stated processing estimate excuses a legal requirement for timely updates or required functionality.

6.5 Fixed and non-fixed methods

Fixed interconnected VoIP must deliver automated dispatchable location where required. Non-fixed interconnected VoIP will use automated dispatchable location when technically feasible and otherwise a legally permitted alternative identified in the Profile, which may include compliant Registered Location procedures, Alternative Location Information, or national emergency call center routing under the applicable rule. The Profile must separately account for applicable MLTS requirements. CBIT will not represent an optional or unavailable platform feature as implemented. Customer-entered initial data may be part of an approved configuration; automated delivery does not itself mean a Device independently detects every move.

6.6 End-user notice

CBIT will supply prominent disclosures and required warning labels or other permitted warnings. Customer will inform all persons reasonably expected to use Devices before use and when material limitations change, affix supplied labels on or near applicable Devices, and request additional warnings as needed. Customer will not remove warnings or disable required location prompts.

6.7 Limitations

Depending on the verified configuration, emergency calls may fail, be delayed, or convey inaccurate location during power or network failures, provisioning or location-update delays, unreported moves, Device misconfiguration, congestion, legally permitted suspension or disconnection, or use outside supported areas. Non-native numbers and shared outbound identities require correct emergency mapping. Where permitted, an ECRC may obtain location and relay a call. Its use can delay response and is not a substitute for any independently required MLTS configuration. The Profile and Exhibit A must accurately describe the deployed method.

6.8 Alternatives

Customer must maintain an alternative means of reaching emergency services at each location, such as an available mobile phone, and inform End Users where it is. Remote and mobile users must understand the difference between the CBIT application and their mobile phone's native emergency dialer. Services outside the approved US coverage area must not be relied upon for local emergency calling.

6.9 During an emergency

The caller should state the exact location and callback number and redial immediately if disconnected. A callback may not succeed. Customer must not conduct live 911 testing without advance coordination through the appropriate emergency-service testing procedure.

6.10 Emergency disclosures

Customer authorizes disclosure of names, callback numbers, and location information to emergency-service providers and database administrators for emergency purposes as permitted or required by law. This authorization does not enlarge unrelated data-use permissions.

6.11 Shared numbers and PBXs

Customer must disclose shared numbers, SIP trunks, gateways, and multiple stations or locations using one calling identity. The Parties will document emergency identity and station-level mapping in the Profile. Customer must maintain assigned mappings within components it operates; CBIT must perform the configuration and routing duties applicable to components it provides, installs, manages, or operates. Ordinary outbound caller ID alone does not establish compliant emergency location.

6.12 Affirmative acknowledgment

CBIT will obtain and retain Customer's separate affirmative acknowledgment of Exhibit A before activating interconnected VoIP. The record may be electronic and will identify the signer, account, date, disclosure version, and associated Profile. Customer's ordinary Service Order signature is insufficient unless the workflow also captures the separate express acknowledgment. CBIT will obtain acknowledgment of revised disclosures when required by law.

6.13 Emergency indemnity and statutory protection

To the fullest lawful extent, Customer will defend, indemnify, and hold harmless CBIT and its applicable suppliers and emergency-service providers against third-party claims to the extent caused by Customer's breach of its location, configuration, warning, or end-user notification duties. This obligation excludes the extent caused by a protected party's gross negligence, willful misconduct, or breach of a nondelegable legal duty. Section 18.3 governs defense procedure. Nothing waives statutory immunity or limits liability that cannot lawfully be limited. Customer does not purport to release independent claims of persons it lacks authority to bind.

7. Multi-Line Telephone Systems

7.1 Direct dialing

Where applicable, CBIT will configure components it installs, manages, or operates for direct 911 dialing without a required additional digit, code, prefix, or postfix. Customer must not change configurations to interfere with that functionality. Applicability is determined under law, including 47 C.F.R. Sections 9.15 and 9.16.

7.2 Notification

Where legally required and the system can provide notification without the improvement described in the applicable rule, notification must be configured before activation. It must not delay the 911 call and must be directed where someone is likely to see or hear it, with contemporaneous initiation where technically feasible. Customer must designate and maintain recipients; refusal does not waive required configuration. CBIT may defer activation of an unsupported or incomplete configuration.

7.3 Dispatchable location

The Profile will identify on-premises fixed, on-premises non-fixed, and off-premises endpoints and applicable location delivery methods. Customer must provide sufficient building, floor, suite, room, or equivalent detail for its premises and maintain station information. CBIT will perform applicable duties for components within its role. Required fixed and non-fixed location functionality must comply with applicable law, including Section 9.16; an approved interconnected VoIP fallback does not automatically satisfy every MLTS requirement.

7.4 Customer-operated systems

For a Customer-operated PBX, SBC, or gateway, Customer is responsible for its assigned internal mapping, dial plans, notification, and configuration. CBIT is responsible for its own applicable routing and service duties. The Profile will identify the interface, emergency calling identities, and configuration boundaries. Neither Party's legal duties are displaced by labeling the other Party the operator.

7.5 Verification

Before activation and after material configuration changes, the Parties will verify their assigned configuration tasks through approved testing methods and retain the resulting configuration record. Customer must promptly report changes in layout, station placement, or system administration that affect emergency functionality.

8. Equipment

8.1 Purchased equipment

Title passes on full payment; risk of loss passes on delivery. Manufacturer warranties are passed through to the extent available and transferable, subject to nonwaivable law. CBIT provides no additional equipment warranty unless expressly stated. CBIT will release purchased Equipment from its provisioning control on authenticated request after applicable equipment purchase balances are paid, subject to technical capability and reasonable disclosed assistance charges. Unrelated disputed service charges do not alone prevent release.

8.2 Rented equipment

Equipment expressly identified as rented, leased, or Provider-owned remains CBIT's property. Customer must protect it, avoid liens or unauthorized changes, and use it with the approved configuration. Relocation requires the emergency-location process. Customer bears loss or damage other than ordinary wear and must pay reasonable replacement charges stated in the Order or schedule, without duplicate recovery.

8.3 Returns

Customer must return Provider-owned Equipment in good condition within fifteen days after the associated Service ends, at its expense, using CBIT's instructions, or arrange approved pickup. If not received within thirty days, CBIT may invoice the disclosed replacement charge. Equipment accepted within sixty days after termination will receive a credit of the replacement charge less disclosed shipping, missing-part, damage, and reasonable restocking costs. CBIT need not accept later returns unless agreed. Payment of a replacement charge does not transfer provisioning credentials or licenses unavailable for transfer.

8.4 Customer equipment

Customer-provided Devices must be supported models. Compatibility and feature parity are not guaranteed. Configuration and troubleshooting may be billable at disclosed rates with approval.

8.5 Updates

CBIT may apply reasonable firmware and configuration updates. Customer must not tamper with CBIT-owned Equipment or active managed provisioning. Purchased Equipment may be reprovisioned after service termination and release under Section 8.1. Customer must not interfere with emergency calling configuration while Services remain active.

8.6 Installation

Unless ordered, physical installation is Customer's responsibility. Ordered site work is performed at disclosed rates and scheduled hours. Extra visits due to site unreadiness require notice of applicable charges.

9. Numbers and Porting

9.1 Number rights

Customer receives use of assigned numbers, not a property right, subject to applicable portability rights. CBIT will not use this clause to defeat a valid port.

9.2 Porting in

Customer must supply an authorized LOA, accurate account information, and reasonably required records. Customer must keep existing service active until the port completes. CBIT will comply with applicable porting duties; estimates are not guarantees of another provider's performance. CBIT is not responsible for delays caused by inaccurate Customer information or a losing provider except to the extent law or this Agreement imposes responsibility on CBIT.

9.3 Cutover

The Parties will coordinate cutover and validate required emergency information before the port. Temporary numbers, interruptions, and emergency-calling limitations must be identified in the deployment plan. Disclosures do not authorize activation without required emergency functionality.

9.4 Porting out

CBIT will facilitate valid requests without unreasonable delay or procedures and will not condition porting on payment. Porting does not discharge debts, minimum commitments, or lawful termination charges and does not by itself cancel remaining Services. Customer must separately submit cancellation notice. CBIT may use reasonable authentication consistent with applicable porting rules and will reasonably coordinate pending valid ports before scheduled disconnection.

9.5 Unauthorized transfers

Customer must protect credentials and porting information. CBIT will use applicable authentication and safeguards and investigate reported unauthorized transfers. Responsibility is allocated under Sections 10 and 17; possession of Customer information alone does not excuse CBIT's own required safeguards. CBIT will reasonably cooperate in recovery without guaranteeing another provider's actions.

9.6 Listings

Directory and CNAM submissions are subject to external database processes and accuracy. CBIT will submit authorized information reasonably but does not guarantee universal display or removal of spam labels.

10. Acceptable Use, Fraud and Security

10.1 Lawful use

Customer and End Users must comply with applicable communications, privacy, anti-spam, recording, telemarketing, caller ID, and Do-Not-Call laws and applicable restrictions stated in this Agreement. Automated and high-volume calling require express approval and do not become lawful merely through that approval.

10.2 Prohibited uses

Customer must not originate unlawful calls or messages, spoof caller ID unlawfully, engage in traffic pumping, harass or defraud others, interfere with networks, obtain unauthorized access, or resell Services unless an express reseller Order permits it. Customer must not misrepresent identity, number authorization, consent, or calling purposes. Approved use remains subject to lawful mitigation and network protection.

10.3 Unauthorized usage

Customer must immediately report suspected compromise through the emergency support channel identified in its Order or onboarding record, then provide written confirmation. Customer remains responsible for usage attributable to its accounts, credentials, Devices, or systems, including unauthorized usage, except to the extent caused by CBIT's breach of its express security obligations or liability that cannot lawfully be shifted. CBIT will take commercially reasonable steps to restrict identified fraudulent traffic after an authenticated report. Notice alone does not automatically eliminate usage charges. Alerts and thresholds are not guaranteed billing caps unless expressly agreed.

10.4 Security controls

Customer must use strong unique credentials and MFA where available, protect SIP credentials, follow network guidance, maintain supported updates, promptly revoke obsolete access, and report incidents. Before enabling international or high-risk destinations, the Order or onboarding record will identify restrictions and available spending controls. CBIT will document the enabled settings; Customer must not assume all destinations are blocked unless confirmed.

10.5 Protective action

CBIT may restrict affected functionality promptly when reasonably necessary to prevent unlawful traffic, fraud, security harm, or comply with lawful requirements. It will give notice when practicable and restore functionality when the basis is reasonably resolved. Emergency-calling treatment is subject to Section 14.1 and applicable law.

10.6 Verification and traceback

Customer must provide accurate business identity, ownership or control information reasonably requested for verification, intended calling purposes, number-use authorization, and reasonably necessary compliance evidence. Customer must promptly cooperate with lawful investigations and traceback requests within CBIT's reasonable stated deadline, including urgent requests needed to meet applicable response obligations. CBIT may restrict affected traffic if material requested verification is withheld.

11. Recording, Messaging and Regulated Uses

11.1 Recording

Customer must configure recording lawfully, obtain required consent, provide required notices, and retain appropriate evidence. Washington law generally requires all-participant consent for private communications subject to statutory exceptions; other jurisdictions may differ. Where an announcement is used to establish consent, Customer must ensure the required announcement is itself recorded where applicable. CBIT may disable features reasonably believed to be used unlawfully. Storage follows the disclosed retention configuration.

11.2 Caller identity

Customer may present only numbers it is authorized to use. Authentication may be performed by CBIT or through an authorized signing arrangement consistent with applicable law. Attestation depends on verified identity and number authorization; no attestation level, delivery, reputation score, or freedom from blocking is guaranteed. CBIT retains its own applicable signing and mitigation duties.

11.3 Messaging

SMS/MMS is subject to applicable law and number-specific carrier registration, verification, consent, opt-out, content, and throughput requirements. A2P 10DLC, toll-free, and short-code processes may differ. Customer must provide accurate registration data, maintain consent evidence, honor opt-outs, and supply evidence reasonably requested. Registration does not guarantee approval or delivery. Applicable registration, campaign, usage, and reasonably documented third-party violation charges attributable to Customer's breach must be disclosed in an Order or schedule; disputed charges follow Section 4.6. No undisclosed third-party terms impose obligations on Customer.

11.4 Regulated information and HIPAA

Customer must disclose intended regulated use before enabling features that maintain or process regulated information. Unless the applicable service description or Order expressly approves the use, Services must not be used to create, receive, maintain, store, process, or transmit PHI. Where CBIT will act as a business associate, the Parties must execute a BAA and identify approved Services and configuration before the use begins. A BAA does not make every feature suitable. A signed BAA controls its subject matter; nothing disclaims independently applicable HIPAA duties or converts stored-information processing into a transmission-only conduit. Customer remains responsible for its own industry obligations, including GLBA or PCI DSS as applicable. No general compliance certification is implied.

11.5 International use

Services are intended for approved locations within the United States. International use requires approval and may be restricted by local law and emergency-calling limitations. Customer must not rely on the Services for local emergency calling outside the supported area.

12. Availability and Credits

12.1 Commitment

CBIT will use commercially reasonable efforts to make the core calling platform available 99.9 percent of each calendar month. Availability equals total calendar minutes less qualifying outage minutes, divided by total calendar minutes, expressed as a percentage. Overlapping outage minutes count once.

12.2 Covered outage

A qualifying outage is complete failure of inbound calling or complete failure of outbound calling for the covered hosted-voice or SIP-trunk Service at an affected location, caused by CBIT's platform or controlled network. An isolated Device failure is not a location outage. Measurement begins at CBIT's monitoring detection or Customer's trouble ticket, whichever occurs first, and ends on restoration. Eligible MRC is the affected recurring voice-seat and SIP-trunk service MRC, excluding taxes, equipment, usage, and unrelated Services.

12.3 Exclusions

Excluded events are scheduled maintenance announced at least forty-eight hours ahead, reasonably necessary emergency maintenance, Customer-caused network or power failures, Customer configuration or misuse, third-party carrier or public Internet failures outside CBIT's control, force majeure, lawful suspension, and malicious attacks CBIT has taken commercially reasonable measures to mitigate. CBIT-managed LAN and Internet obligations remain governed by their applicable agreement. These exclusions do not waive mandatory emergency-calling or regulatory duties.

12.4 Credit bands

Monthly availability of at least 99.9 percent earns no credit. Availability of at least 99.0 percent but below 99.9 percent earns 10 percent of eligible MRC. Availability of at least 98.0 percent but below 99.0 percent earns 25 percent. Availability below 98.0 percent earns 50 percent. Calculation uses unrounded availability, avoiding gaps between bands.

12.5 Requests

Customer must request a credit within thirty days after month-end, identifying the outage or ticket. Credits cannot exceed 50 percent of eligible MRC for the month and cannot be stacked for the same outage under overlapping commitments. Credits offset an invoice; a credit remaining when an account closes offsets the final invoice and any remaining balance is refunded. CBIT may defer applying credits against genuinely delinquent undisputed balances but will not forfeit a valid credit solely because of a pending good-faith dispute.

12.6 Remedies

Credits and the termination right in this subsection are the exclusive contractual remedies for failure to meet this availability commitment, subject to nonwaivable law and obligations expressly preserved elsewhere. If qualifying availability is below 98.0 percent in any three months in a rolling six-month period, Customer may terminate affected Services by notice within thirty days after the third qualifying month's end, without the ordinary notice period or early termination charges. Independent equipment purchase balances and accrued charges remain payable.

13. Support and Changes

13.1 Channels

Standard remote support is available on Business Days, with after-hours emergency support for a location-wide calling outage, suspected active toll fraud, or reported emergency-calling malfunction. Current contact channels, emergency escalation instructions, standard hours, and any agreed response targets must be supplied in the Order or onboarding record. CBIT will directly notify Customer of changes. Response estimates are not guaranteed restoration times unless expressly agreed.

13.2 Included support

Support covers the platform, supported CBIT-provisioned Devices, ordinary feature administration, emergency-location updates, and reasonable Service troubleshooting. Customer must provide authenticated contacts, access, and cooperation.

13.3 Billable work

Site visits, Customer-environment work, additional training, and complex redesign may be charged at disclosed rates after approval unless already included in another applicable agreement. CBIT will not bill ordinary correction of its own configuration error as Customer-environment work.

13.4 Adds, removals and moves

Authorized administrators may request changes through approved channels. Adds begin billing on activation. Reductions and removals follow Section 3 and applicable minimum commitments; portal removal alone does not waive them. Moves require the emergency-location process. Billable changes require authentication and disclosure of applicable charges.

14. Suspension and Termination

14.1 Suspension

CBIT may restrict or suspend Services, after notice when practicable, for undisputed nonpayment continuing fifteen days after due date, material prohibited use, reasonable evidence of compromise or fraud, legally required action, or threats to network security. CBIT will tailor restrictions where reasonably practicable. Emergency-calling treatment must comply with applicable law and verified capabilities; a suspension is not presumed to disable or preserve 911 in every configuration. CBIT will disclose the actual effect when practicable, and Customer must maintain alternatives. Any reconnection fee must be disclosed.

14.2 Cause

Either Party may terminate affected Services for a material breach not cured within thirty days after written notice, or ten days for undisputed nonpayment. CBIT may act immediately for unlawful use, fraud, or urgent security threats where lawful and reasonably necessary. All rights, including those concerning insolvency, financial condition, collection, or termination, are subject to applicable bankruptcy law and court orders. No right is asserted solely on an insolvency trigger to the extent prohibited by law.

14.3 Transition and data

Accrued charges and expressly applicable commitments become due under their terms. Ordinary account access ends at termination unless the export window below applies. Customer must export data before termination. Unless prohibited by law or prevented by a security threat, CBIT will, on an authenticated request made within thirty days after termination, provide a reasonable supported export of retained Customer content or limited read-only access, subject to disclosed reasonable assistance charges. CBIT may delete operational content after that window, but does not promise that previously expired content still exists. Legal holds, required records, and protected backups follow Section 15.5. Porting follows Section 9. Sections intended by their nature to survive, including payment, returns, porting, confidentiality, data protection, limitations, and indemnity, survive.

15. Data Privacy and CPNI

15.1 Privacy policy

CBIT's Privacy Policy at gocbit.com/legal/privacy-policy applies to its handling of personal information. CBIT will make the applicable version available before signature and retain that version with the transaction record. The policy supplements this Agreement; it does not expand permitted CPNI use or override a signed BAA, mandatory law, or the specific service obligations and liability allocation here. Privacy-policy updates that materially change contractual duties for Services follow Section 21.6; website posting alone does not impose new fees, indemnities, or liability exclusions under this Agreement.

15.2 CPNI and access

CBIT will protect CPNI as required by applicable law, including 47 U.S.C. Section 222 and applicable FCC rules. Disclosure and use are limited to lawful service purposes, other legally permitted purposes, and valid approval where required. Customer designates administrators, but CBIT must apply required authentication and safeguards. Any alternative business-customer authentication regime requires satisfaction of its legal conditions and specific written agreement; business status alone is insufficient.

15.3 Service data and content

Customer retains its rights in communications, voicemail, recordings, faxes, and messages. Customer grants CBIT the limited rights necessary to provide, bill, secure, troubleshoot, and support Services and comply with law. Quality improvement may use aggregated or properly de-identified information where permitted by law and the Privacy Policy. CBIT will not use identifiable CPNI for unrelated marketing or use communication content to train general-purpose AI models merely under this clause. Additional uses require a lawful basis and required approval.

15.4 Security and legal process

CBIT will maintain reasonable administrative, technical, and physical safeguards appropriate to the Services and information processed and require appropriate protections from service providers with access. CBIT will investigate confirmed unauthorized access affecting Customer information and provide notices required by law, subject to required reporting sequences and lawful restrictions. CBIT will comply with valid legal process and applicable lawful-intercept duties and notify Customer of requests for content where legally permitted. Customer reimburses only reasonable, legally recoverable and documented account-specific response costs, not costs attributable to CBIT's violation.

15.5 Retention and export

Before activation of storage features, CBIT will disclose actual default retention periods, capacity limits, supported export formats, and optional storage charges in the Order or onboarding record. Customer may select supported settings and is responsible for its archival copies. No indefinite retention or recoverable backup is promised. CBIT may retain billing, security, regulatory, and legal-hold records as law permits or requires; backup copies are subject to ordinary secure retention and access restrictions. Section 14.3 governs post-termination requests and does not override legal preservation or data protection duties.

16. Warranties and Disclaimers

EXCEPT FOR EXPRESS OBLIGATIONS IN THIS AGREEMENT, SERVICES AND EQUIPMENT ARE PROVIDED AS IS AND AS AVAILABLE. TO THE FULLEST LAWFUL EXTENT, CBIT AND ITS SUPPLIERS DISCLAIM IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. THIS DISCLAIMER DOES NOT ELIMINATE AN EXPRESS INDEMNITY, TRANSFERRED MANUFACTURER WARRANTY, OR NONWAIVABLE DUTY. CBIT DOES NOT GUARANTEE UNINTERRUPTED OR ERROR-FREE SERVICE, ABSOLUTE SECURITY, OR EMERGENCY-CALL COMPLETION IN EVERY CIRCUMSTANCE. CONTRACTUAL AVAILABILITY REMEDIES ARE THOSE IN SECTION 12, INCLUDING ITS TERMINATION RIGHT.

17. Liability Allocation

17.1 Excluded damages

TO THE FULLEST LAWFUL EXTENT, CBIT AND ITS APPLICABLE SUPPLIERS ARE NOT LIABLE TO CUSTOMER FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR LOST PROFITS, REVENUE, BUSINESS, DATA, OR BUSINESS INTERRUPTION ARISING FROM THIS AGREEMENT. THIS ALLOCATION DOES NOT PURPORT TO BIND A PERSON CUSTOMER HAS NO AUTHORITY TO BIND.

17.2 Aggregate cap

EXCEPT TO THE EXTENT LAW PROHIBITS LIMITATION, CBIT'S TOTAL AGGREGATE LIABILITY ARISING FROM THIS AGREEMENT WILL NOT EXCEED CHARGES PAID FOR THE SERVICE ORDER OR ORDERS DIRECTLY AFFECTED DURING THE TWELVE MONTHS BEFORE THE FIRST EVENT GIVING RISE TO THE CLAIM. RELATED EVENTS ARE TREATED AS ONE CLAIM; MULTIPLE CLAIMS DO NOT MULTIPLY THE CAP. CBIT'S DEFENSE COSTS, SETTLEMENTS, AND AWARDS UNDER SECTION 18.2 COUNT TOWARD THIS CAP. SERVICE CREDITS ARE APPLIED AGAINST RECOVERY FOR THE SAME LOSS TO AVOID DUPLICATION. A SIGNED BAA MAY EXPRESSLY PROVIDE A DIFFERENT ALLOCATION FOR ITS SUBJECT MATTER.

17.3 Emergency services and exceptions

CBIT retains all available statutory immunities and protections for emergency communications. No disclaimer, cap, release, or indemnity limits liability for fraud, gross negligence, willful misconduct, or other liability to the extent limitation is prohibited by applicable law. The Agreement does not waive regulatory enforcement powers or CBIT's nondelegable duties. Emergency-calling claims are otherwise subject to lawful limitations in this Section and the specific indemnity in Section 6.13.

17.4 Allocation

The Parties intend these provisions to allocate commercial risk and reflect the service price. They apply to the fullest lawful extent under applicable theories of liability and even if a limited remedy fails of its essential purpose, subject to the express exceptions above.

17.5 Claims period

To the extent permitted by law, Customer must bring contractual claims within one year after accrual. The period is tolled during the mandatory informal-resolution process in Section 20.2. This clause does not shorten a nonwaivable statutory period or bar a claim law does not permit the Parties to shorten.

18. Indemnification

18.1 Customer indemnity

Subject to Section 6.13 for emergency claims, Customer will defend and indemnify CBIT and its applicable suppliers, personnel, and agents against third-party claims to the extent caused by Customer's unlawful use, unauthorized content or recording, breach of number-use authorization, material breach of this Agreement, or Customer-controlled Equipment, network, or credential compromise. It does not cover the extent caused by a protected party's gross negligence, willful misconduct, or breach of its own nondelegable legal duty. Fines and penalties are recoverable only where lawful, attributable to Customer's conduct, and reasonably documented. Toll-fraud usage charges are governed by Section 10.3 and are not duplicated here.

18.2 Intellectual property

CBIT will make available applicable transferable supplier infringement protection for third-party products to the extent CBIT is authorized to do so, without making a separate defense promise for those products. CBIT's direct defense and indemnity obligation applies only to CBIT-developed technology expressly identified as covered in an accepted Order. For such technology, CBIT will defend third-party US patent, copyright, or trademark claims and pay covered final awards or approved settlements, subject to Sections 17 and 18.3. Exclusions are Customer content, unauthorized modifications, combinations causing the claim, and continued use after a reasonable non-infringing alternative is offered. CBIT may obtain rights, modify or replace the affected technology, or terminate affected Services and refund prepaid unused fees without early termination charges.

18.3 Procedure

The protected Party must give prompt notice; delay excuses duties only to the extent materially prejudiced. The indemnifying Party controls the defense with qualified counsel and pays reasonable cooperation costs. No settlement may admit fault, impose nonmonetary duties, or fail to release the protected Party without its consent, not unreasonably withheld. If the indemnifying Party fails to assume a covered defense after reasonable notice, the protected Party may reasonably defend and seek covered costs, subject to applicable limits. CBIT may participate at its expense where interests conflict.

19. Confidentiality

Each Party will protect the other's nonpublic business, technical, security, pricing, and customer information with reasonable care and use it only for the Agreement or other lawful authorized purposes. Disclosure is limited to personnel, suppliers, and advisers with a need to know and appropriate confidentiality duties. Exclusions are information public without breach, already lawfully known, independently developed, or lawfully obtained without restriction. Compelled disclosure is permitted, with advance notice when legally permitted and practicable. Duties last three years after termination, and longer for trade secrets, CPNI, personal information, or content to the extent required by law or a signed BAA. Government public-records duties are addressed in an applicable public-sector addendum and mandatory law.

20. Governing Law and Disputes

20.1 Law

Washington law and applicable federal law govern, subject to mandatory laws applicable to a Party or Service. The UN Convention on Contracts for the International Sale of Goods does not apply.

20.2 Informal resolution

Before filing suit, a Party must give a specific dispute notice and participate in good-faith discussions for thirty days, unless resolved earlier or the Parties agree otherwise. Either Party may seek urgent injunctive relief, make a timely filing necessary to preserve a right, or pursue regulatory remedies. CBIT may collect undisputed past-due amounts without this waiting period. Contractual claim deadlines are tolled from dispute notice through the required discussion period.

20.3 Venue and fees

Subject to mandatory law and any authorized public-sector addendum, disputes will be brought in state courts in Benton County, Washington, or the federal court having jurisdiction over that county. The Parties consent to jurisdiction. EACH PARTY WAIVES TRIAL BY JURY TO THE EXTENT LAWFULLY ENFORCEABLE. The prevailing Party in an enforcement action may recover reasonable attorneys' fees and costs as permitted by law.

20.4 Agencies

Nothing prevents a complaint to the FCC, Washington UTC, or another agency with jurisdiction. The Agreement does not determine or expand an agency's jurisdiction.

21. General Provisions

21.1 Force majeure

Neither Party is liable for delay caused by events beyond reasonable control, including disasters, war, government action, utility failure, widespread network outages, and carrier failures, except that accrued payment duties remain due. The affected Party will use reasonable mitigation and restoration efforts. This clause does not excuse nonwaivable duties or duplicate recovery. If an event prevents substantially all affected Service for thirty consecutive days, either Party may terminate affected Services without early termination charges; accrued charges and independent equipment balances remain due.

21.2 Notices

Orders must identify billing, administrative, emergency-support, and legal notice contacts. Legal, breach, cancellation, amendment, and pricing notices must be sent directly to the designated email or by tracked courier, certified mail, or hand delivery. Email is effective the next Business Day after sending if no delivery failure is received; a sender receiving failure must use another designated method. Tracked delivery is effective on recorded delivery. Portal posting alone is insufficient for those notices. Maintenance and routine operational notices may also be posted in the portal, with direct notice where practicable. Customer must keep contacts current; CBIT will retain notice records. Fraud and emergency reports require the immediate escalation channel in addition to any written notice.

21.3 Assignment

Customer may assign with CBIT's consent, not unreasonably withheld; a change of control is an assignment. CBIT may assign to an affiliate or business successor on notice, provided service obligations are assumed. Neither assignment overrides mandatory privacy, regulatory, or public-sector requirements.

21.4 Relationship

The Parties are independent contractors. No partnership, agency, fiduciary relationship, or authority to bind the other is created. CBIT may use subcontractors but remains responsible for its own contractual and legal duties.

21.5 Entire agreement and precedence

The Agreement includes accepted Orders, Exhibit A, identified plan and rate schedules, and the Privacy Policy as limited by Section 15.1. No undisclosed third-party terms are incorporated. A signed BAA controls its subject matter; an authorized public-sector addendum controls its expressly addressed subjects; then an Order provision expressly overriding a specified clause controls; then this Agreement, Exhibit A, other Order terms, and identified schedules, in that order. Emergency configuration records must accurately implement required functionality and do not waive mandatory duties. No commercial override may waive a nonwaivable legal requirement. Purchase-order boilerplate is rejected unless expressly accepted in a signed amendment. This Agreement governs VoIP Services without replacing separate managed IT or Internet agreements except as expressly stated.

21.6 Amendments

For month-to-month Services, CBIT may amend terms on at least thirty days' direct notice with the revised version supplied or linked for download. Customer may cancel materially adversely affected Services before effectiveness without early termination charges. Fixed-term amendments require agreement except changes expressly permitted here or necessary to comply with mandatory law. Changes to emergency disclosures will be supplied promptly, with renewed affirmative acknowledgment where required. Privacy-policy posting alone does not amend commercial obligations; material contractual changes follow this Section. No amendment applies retroactively to accrued disputes.

21.7 Severability and waiver

Invalid provisions are enforced only to the lawful extent and severed if necessary. No waiver exists without an authorized writing, and waiver of one breach does not waive another. Nothing authorizes a court to expand a Party's obligations beyond a lawful interpretation.

21.8 Electronic execution

Electronic signatures, counterparts, and accepted electronic Orders are effective as originals. Each signer represents authority. CBIT will retain the signed Order, this Agreement's version, incorporated schedules, Exhibit A acknowledgment, and available audit trail and provide the executed transaction documents to Customer. An Order may serve as the Agreement signature record; it must not omit the separate express 911 acknowledgment.

21.9 Interpretation and public-sector customers

Headings aid navigation. Including means including without limitation. Government customers require an approved public-sector addendum before activation where their authority, public-records duties, indemnity restrictions, appropriations, or dispute rules differ. No official is required to assume obligations beyond lawful authority.

Execution

This Agreement may be executed through a Service Order identifying version 1.1. If executed separately, complete the following. Exhibit A requires its own express acknowledgment in either workflow.

• Customer legal entity
• Customer authorized signature and date
• Printed name and title
• Customer legal notice email and address
• CBIT authorized signature and date
• Printed name and title
• CBIT legal notice email and address

Exhibit A — Emergency Calling Acknowledgment

Separate affirmative acknowledgment required before activation.

A1. How emergency calling works

CBIT will provide the emergency functionality required for the supported configuration identified in the Emergency Service Profile. Depending on the service and applicable law, emergency location may be delivered automatically from provisioned information, obtained through supported location functionality, updated by the user through required procedures, or confirmed by a national emergency call center where that alternative is permitted. CBIT does not promise every Device independently detects its physical location. A location stored for one shared calling number may not identify every station unless appropriate mapping is configured.

A2. Important limitations

Power and connectivity: Devices, network equipment, and the access connection need power and functioning connectivity. Outages, congestion, and equipment failures can prevent or delay calls and location delivery, including callbacks.

Moves and location accuracy: A phone or application may continue ordinary calling after it moves while its emergency location remains incorrect. Customer and End Users must update information before ordinary use at the new location and follow prompts and confirmation instructions. There is no ten-day grace period. During updates, emergency calls may still use prior information. An update request alone does not confirm activation of a new location.

Provisioning and ports: New and ported Services require completed provisioning and applicable location validation. The deployment plan must explain temporary numbers and any interruption. Customer should maintain existing service and alternatives until cutover is confirmed.

Remote and mobile endpoints: These must use the method identified in the Profile. ECRC routing, where permitted and used, may require the caller to state location and callback information and can delay response. The mobile phone's native emergency dialer may behave differently from the CBIT application. Use of an ECRC does not waive separate MLTS requirements.

Suspension and termination: Restrictions or disconnection may affect emergency calling depending on the actual configuration and applicable law. Customer must read any suspension notice and maintain alternatives; neither continued access nor universal loss of 911 is promised for every restricted account.

Other limitations: Shared numbers, non-native numbers, Customer-operated PBXs, unapproved configurations, use outside supported US areas, and unavailable PSAP capabilities may affect routing or information delivery. A caller should always state exact location and callback number and redial if disconnected. Life-safety devices require separately reviewed and approved connectivity.

A3. Customer responsibilities

Customer will provide accurate dispatchable location detail; maintain assigned station and emergency-identity mappings; update moves promptly; designate required notification recipients; and preserve direct dialing, notification, and location configuration within Customer-controlled components. Customer will inform all persons reasonably expected to use Devices, supply warnings to remote users, place supplied labels or permitted warnings, and maintain an alternative emergency-calling method. Customer must report a known emergency-calling malfunction through the immediate support channel and use approved testing procedures.

A4. Allocation of risk

The limitations and responsibilities in Sections 6, 7, 17, and 18 apply. Emergency indemnity is limited as stated in Section 6.13 and excludes the specified protected-party misconduct and nondelegable duties. No acknowledgment waives mandatory legal requirements, statutory protections, or liability that cannot lawfully be limited. Customer does not release independent claims of persons it lacks authority to bind.

A5. Separate affirmative acknowledgment

The authorized representative must affirmatively acknowledge each statement below, by initials or separate express selections in CBIT's electronic signature workflow. This acknowledgment must not be inferred solely from service use or a general Order signature.

• I received and understand the emergency-calling limitations in Section 6 and this Exhibit.
• Customer has supplied accurate initial location information and will complete the Emergency Service Profile before activation.
• Customer understands that an unreported move or incorrect mapping may route responders to the wrong place and will require updates before ordinary use at a new location.
• Customer will inform End Users, provide supplied warnings, maintain required notification recipients, and preserve required configuration.
• Customer understands power, network, provisioning, location-update, and service restrictions may affect emergency calling and will maintain alternatives.
• I am authorized to make this acknowledgment for the identified Customer.

The initial locations may be supplied on an attached schedule. CBIT retains the signed acknowledgment and applicable disclosure version with the account record. The final Profile, update instructions, support escalation channels, and actual configuration must be supplied before activation.