Financial Services Addendum

Effective 15 September 2026. This Addendum applies only where an order form says it does. It is an optional annex to the Terms of Service between ALIEN SOFTWARE LLC, a Wyoming limited liability company ("Clobber") and the Customer, for customers that are financial entities subject to an outsourcing or third party risk regime. Capitalised terms not defined here have the meaning given in the Terms.

This Addendum does not state that Clobber complies with any regulation. Whether a regime applies to you, and whether this Addendum is enough to satisfy it, is your assessment to make (section 3 of the Terms) and your competent authority's to judge.

#1. What the Service is

Clobber provides hosted order book infrastructure: a matching engine, an internal double entry ledger, a durable command journal, a market data feed and an API. The function is described in the Terms and documented at docs.clobberhq.com.

Whether this is a critical or important function is your determination, not ours. You decide, document and maintain that classification, and you tell us in writing when you have made it, so that we know which of the rights below you intend to exercise. We will not dispute a classification you make.

What we are not. We do not hold funds, do not resolve markets and do not participate in your markets (sections 1.1 to 1.3 of the Terms). We provide no investment service, and we make no decision that binds your customers.

#2. Where the Service runs

Processing and storage happen in the region each environment is pinned to, chosen by you at creation. An environment never spans regions, and the journal for an environment is archived in the same region. The providers involved, and the location of each, are listed at clobberhq.com/legal/subprocessors/.

Administration of production systems is performed remotely by our personnel, from the countries named in section 7 of the Privacy Policy and section 11.5 of the Data Processing Addendum. We will tell you before personnel in an additional country are given production access, and before a change of processing region or of storage location affecting your environments.

#3. Access, audit and inspection

3.1 Who has these rights. You have them. So do your statutory auditor and your competent authority, exercising them either themselves or through a third party they appoint, and we will not require any of them to be an accredited firm.

3.2 What they cover. Full access to the documentation, records, systems and premises relevant to the Service we provide you, including the right to inspect on site at our facilities and at the facilities of a subcontractor that processes your Customer Data.

3.3 How they are exercised. On 30 days' written notice, during business hours, in a way that does not compromise another customer's data or the security of the Service, and no more than once in any twelve month period, except where an audit follows an incident affecting you, is required by your competent authority, or repeats findings we agreed to remediate and did not, in which case there is no frequency limit and the notice period is 5 business days.

3.4 Unrestricted inspection rights are not narrowed by this section. Where your competent authority has a statutory right of access, it applies whatever this Addendum says, and we will not obstruct it.

3.5 What it costs. One audit per year is at our cost. Additional audits, and audits requiring work beyond producing existing documentation, are at your cost at our published rates, except where the audit follows our failure.

3.6 Pooled and third party assurance. We may satisfy an audit request in whole or in part with an independent assessment, a questionnaire response or a pooled audit with other customers, where it answers the question asked. You may still exercise section 3.2 if it does not.

#4. Subcontracting

4.1 The list. Every subcontractor that processes Customer Data is listed at clobberhq.com/legal/subprocessors/, with what it does and where.

4.2 Notice of change. We give at least 30 days' written notice before adding or replacing a subcontractor that processes Customer Data, and the notice says what it will do and where.

4.3 Objection. If you reasonably object on risk or regulatory grounds within the notice period, we will work with you to find an alternative. If we cannot, you may terminate the affected environments without penalty and receive a refund of prepaid unused fees.

4.4 Our responsibility. We remain responsible to you for the performance of every subcontractor, and we impose on each one obligations no less protective than these.

4.5 What we will not subcontract. The matching engine, the ledger and the journal run on infrastructure we operate. They are not delegated to a third party operator.

#5. Incidents

5.1 Security incidents. We notify you without undue delay and in any event within 72 hours of becoming aware of a security incident affecting your Customer Data, with what we know, what we have done and what you should do (section 9 of the Terms), and we update you as the picture changes.

5.2 Operational incidents. For an incident that materially degrades or interrupts the Service for your production environments, we notify your administrative contacts within 4 hours of becoming aware, post to status.clobberhq.com, and give you a written summary within 5 business days of resolution, with the cause and the remediation.

5.3 What you need for your own reporting. On request, we give you the information we hold that you need to meet your own incident reporting obligations, in the time your deadline requires, to the extent we hold it.

#6. Exit and transition

6.1 Your data comes out whole. At any time, and on termination, you may export your journal, your ledger state and your market configuration through the API. The journal format is documented, and an export is complete: it is the same record the engine replays.

6.2 Transition assistance. On termination for any reason other than your material breach, we provide reasonable transition assistance for 90 days, at our published rates beyond export and documentation, so that you can move to another provider or in house without an interruption you did not plan.

6.3 Wind down. If we discontinue the Service generally, section 12.6 of the Terms applies: at least 90 days' notice, environments kept running during it, and 90 days of export afterwards. Escrow of the engine source, the journal format specification and the deployment artifacts is available under section 12.7.

6.4 Your exit plan is yours. We will support it, including with a documented test of an export and a restore into your own environment, once per year, at your cost. We do not write it for you, and nothing here is an assurance that your exit plan is adequate.

#7. Cooperation with your authority

We will cooperate with your competent authority in relation to the Service we provide you, including by providing information it requests from us through you, and by permitting the access in section 3. Where the authority addresses us directly, we will tell you unless we are prohibited from doing so.

#8. Records and reporting

We maintain the records of the Service that these documents describe: the journal for the period in section 4.5 of the Terms (extendable by order form), access logs, incident records and change records. On request, once per quarter, we provide a written summary of availability, incidents and material changes affecting your environments.

#9. Changes to this Addendum

We may change this Addendum on the notice terms in section 15 of the Terms. We will not reduce a right in sections 3, 4, 5 or 6 during a committed term.

Questions about this Addendum: [email protected]