Application Service Provider Agreement Between Verizon Sourcing LLC And SYNCHRONOSS TECHNOLOGIES, INC. GDSVF&H\3541367.2Application Service Provider Agreement Synchronoss and Verizon Proprietary and Confidential

Application Service Provider Agreement Between Verizon Sourcing LLC And SYNCHRONOSS TECHNOLOGIES, INC. GDSVF&H\3541367.2Application Service Provider Agreement Synchronoss and Verizon Proprietary and Confidential

TABLE OF CONTENTS APPLICATION SERVICE PROVIDER AGREEMENT ...................................................... 1 1. PARTIES ............................................................................................................. 1 2. TERM .................................................................................................................. 1 3. DEFINITIONS ...................................................................................................... 1 4. SCOPE/AUTHORIZATION LETTERS .................................................................. 7 5. LICENSES........................................................................................................... 9 6. OVERALL PERFORMANCE REQUIREMENT .................................................. 14 7. HOSTING .......................................................................................................... 15 8. DEVELOPMENT SERVICES............................................................................. 16 9. SECURITY ........................................................................................................ 17 10. ADDITIONAL REQUIREMENTS ....................................................................... 17 11. FEES/PAYMENT ............................................................................................... 18 12. RECORDS AND REPORTS .............................................................................. 20 13. DELIVERY......................................................................................................... 21 14. TESTING, EVALUATION AND APPROVAL ..................................................... 21 15. REPRESENTATIONS AND WARRANTIES ...................................................... 23 16. ESCROW .......................................................................................................... 27 17. TERMINATION .................................................................................................. 30 18. INFRINGEMENT ............................................................................................... 32 19. CONFIDENTIAL INFORMATION ...................................................................... 33 20. OWNERSHIP .................................................................................................... 34 21. SUBSCRIBER DATA AND CONTENT ............................................................. 36 22. USE OF TRADEMARKS ................................................................................... 38 23. PUBLICITY AND DISCLOSURE ........................................................................ 39 24. COMPLIANCE WITH LAWS .............................................................................. 40 GDSVF&H\3541367.2Application Service Provider Agreement Synchronoss and Verizon Proprietary and Confidential

25. FORCE MAJEURE ............................................................................................ 42 26. ASSIGNMENT ................................................................................................... 42 27. SUBCONTRACTING ......................................................................................... 43 28. TAXES ............................................................................................................... 44 29. PERMITS ........................................................................................................... 45 30. WORK RULES AND ACCESS REQUIREMENTS .............................................. 45 31. INDEMNIFICATION ........................................................................................... 49 32. INSURANCE ..................................................................................................... 50 33. RELATIONSHIP OF PARTIES .......................................................................... 51 34. NOTICES .......................................................................................................... 51 35. NONWAIVER .................................................................................................... 52 36. SEVERABILITY ................................................................................................ 52 37. LIMITATION OF LIABILITY .............................................................................. 53 38. DISPUTE RESOLUTION ................................................................................... 53 39. ORDER OF PRECEDENCE .............................................................................. 54 40. SECTION HEADINGS ....................................................................................... 54 41. SURVIVAL OF OBLIGATIONS ......................................................................... 54 42. CHOICE OF LAW AND JURISDICTION ........................................................... 55 43. GIFTS AND GRATUITIES AND CONFLICTS OF INTEREST ........................... 55 44. ENTIRE AGREEMENT ...................................................................................... 56 45. SIGNATURES ................................................................................................... 56 EXHIBIT A – FORM OF AUTHORIZATION LETTER ................................................... 57 EXHIBIT B – CHANGE REQUEST FORM .................................................................... 59 EXHIBIT C-1 - BASELINE INFORMATION SECURITY REQUIREMENTS .................. 61 EXHIBIT C-2 - VERIZON WIRELESS NETWORK SECURITY REQUIREMENTS…….80 EXHIBIT C-3 - CLOUD SECURITY REQUIREMENTS……………………………………87 GDSVF&H\3541367.2Application Service Provider Agreement Synchronoss and Verizon Proprietary and Confidential

EXHIBIT D - DISASTER RECOVERY PLAN ................................................................ 88 EXHIBIT E – COMPLIANCE WITH MINORITY, WOMAN-OWNED, AND SERVICE- DISABLED VETERAN BUSINESS ENTERPRISES (MWDVBE) UTILIZATION ........... 89 EXHIBIT F- NONDISCLOSURE AGREEMENT ............................................................ 94 EXHIBIT G .................................................................................................................... 97 SUMMARY OF VERIZON’S GUIDELINES ................................................................... 97 FOR EVALUATING CRIMINAL RECORD REPORTS .................................................. 97 GDSVF&H\3541367.2Application Service Provider Agreement Synchronoss and Verizon Proprietary and Confidential

APPLICATION SERVICE PROVIDER AGREEMENT 1. PARTIES This Application Service Provider Agreement is made between Synchronoss Technologies Inc. a Delaware corporation, with offices at 000 Xxxxxxxx Xxxx, Xxxxxxxxxxx, XX 00000, on behalf of itself and for the benefits of its Affiliates (“Supplier"), and Verizon Sourcing LLC, a Delaware limited liability company, having an office and principal place of business at Xxx Xxxxxxx Xxx, Xxxxxxx Xxxxx, Xxx Xxxxxx 00000, on behalf of itself and for the benefit of its Affiliates (individually or collectively “Verizon”), each a Party and together the Parties hereto. NOW THEREFORE, in consideration of the mutual promises and conditions set forth herein, receipt of which is hereby acknowledged, and intending to be legally bound, the Parties hereto agree as follows: 2. TERM This Agreement shall become effective when fully executed by both Parties hereto (the “Effective Date”), and the term of the Agreement shall retroactively commence on April 1, 2013 and shall continue in effect until five years from the Effective Date (the “Initial Term”). This Agreement shall be automatically renewed for subsequent one-year periods (each, a “Renewal Term” and together with the Initial Term, the “Term”) at the end of the Initial Term or any Renewal Term unless written notice of intent not to renew is given by one Party to the other **** prior to the end of the Initial Term or any Renewal Term. Notwithstanding anything herein to the contrary, the Term shall continue in effect so long as any Authorization Letters are outstanding. 3. DEFINITIONS The terms defined in this Section shall have the meanings set forth below whenever they appear in this Agreement, unless the context in which they are used clearly requires a different meaning or a different definition is described for a particular Section or provision: 3.1 “Acceptance” or “Accepted” means delivery to Supplier by Verizon of its written notice of acceptance or deemed acceptance as provided in Section 14 or any Authorization Letter. 3.2 “Affiliate” means, at any time, and with respect to any corporation, partnership, person or other entity, any other corporation, partnership, person or entity that at such time, directly or indirectly through one or more intermediaries, controls, or is controlled by, or is under common control with, such first corporation, partnership, person, or other entity. As used in this definition, “control” means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of a corporation, partnership, person or other entity, whether through the ownership of voting securities, or by contract or otherwise. 1 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

3.3 “Agreement” means this Application Service Provider Agreement, including all Orders, Statements of Work, Exhibits, attachments and all mutually agreed to Authorization Letters attached to and made a part of this Agreement. 3.4 “App(s)” means the software applications, including Catalog Apps, developed by Supplier for distribution to Subscribers for download, installation and use on such Subscriber’s Wireless Devices. 3.5 “App Store Catalog” means the third party online repository of applications to which Verizon or Supplier submits for publication an App subject to this Agreement. Examples of this include the online Qualcomm Brew Catalog, the Apple iTunes App Store, the Google Play Store, and the Amazon Kindle Fire Marketplace. 3.6 “App Store Owner” means the third party that owns or controls a given App Store Catalog. 3.7 “App Store Developer Agreement” means the agreement (typically a standard- form agreement) governing the submission, review and publication of applications, including any App, to an App Store Catalog, entered into between the developer of such application and the App Store Owner (or its designee), in addition to any policies incorporated into such App Store Developer Agreement. 3.8 “Application Service Provider” or “ASP” means a Person who manages and delivers content or application capabilities to enable Verizon to make such content or application capabilities available to its Subscribers. 3.9 “Authorization Letter” means a service agreement, order, statement of work or authorization letter, substantially in the form of Exhibit A, mutually agreed to between Verizon and Supplier and duly executed by an authorized representative of each party. 3.10 “Background Materials” means Supplier’s tangible and intangible materials and intellectual property that was developed independently from this Agreement or existed before Supplier commenced work on any Software, or Services provided under this Agreement or any Authorization Letter, including without limitation reports, documentation, drawings, computer programs (source code, object code and listings), inventions, know-how, creations, works, devices, masks, models and work-in-process, and any enhancements, corrections, Updates or modifications to such tangible and intangible materials and intellectual property provided it does not include Verizon Confidential Information and expressly excludes any Custom Software or Paid Work Product. 3.11 “Call Detail Information” shall be any information that pertains to the transmission of specific telephone calls, including: (a) for outbound calls, the number called and the time, location or duration of any call, and (b) for inbound calls, the number from which the call was placed and the time, location, or duration of any call. 2 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

3.12 “Catalog App(s)” means any software applications developed by Supplier using a third party software development kit and tools developed by an App Store Owner and posted on the online App Store Catalog. 3.13 “Change Request” means a request to modify a previously agreed upon Authorization Letter, in the form attached to this Agreement as Exhibit B, sent in writing or via electronic transmission pursuant to the Change Request Process set forth in Section 4.3 of this Agreement and mutually agreed to by Verizon and Supplier. 3.14 “Commercial Service Date” means the first date that Verizon makes a Data Service commercially available to Subscribers under an Authorization Letter. 3.15 “Content” means digital media objects that Subscribers may preview, download, display, store or otherwise use via the Verizon Service. For greater certainty, Content may include audio, pictures, images, text, graphics, video or other media objects in formats described in the Specifications or as mutually agreed by the Parties, but shall not include any text or digital media objects originated by Subscribers. 3.16 “Content Provider” means any third party who has licensed Content to either Verizon or Supplier. 3.17 “CPNI” or “Customer Proprietary Network Information” shall be as defined in 47 U.S.C. Section 222(h)(1). 3.18 “Custom Software” means the system software, application software and other computer programs resulting from the Development Services provided by Supplier under this Agreement or an Authorization Letter that are not part of the Platform or Supplier Background Materials. Custom Software includes both object code and source code. 3.19 “Data Service” means a service made available by Verizon to Subscribers based upon the Platform, Services, and/or Software described in an applicable Authorization Letter including all exhibits attached thereto, as amended by any Change Request. 3.20 “Deliverables” means all Documentation and other materials, and all Upgrades thereto (i) are delivered to Verizon as described in an Authorization Letter or (ii) that Supplier agrees to provide to Verizon in providing Software or in performing the Services described in an Authorization Letter. For the avoidance of doubt, the Platform shall not be considered a Deliverable. 3.21 ”Development Services” means the design, creation, development, modification or enhancement of computer programs by Supplier pursuant to this Agreement or an Authorization Letter. 3.22 “Documentation” means all documentation containing requirements, technical and functional specifications, relating to the design, testing, training, operation and support of a Platform or Software whether in print or in electronic form, including without limitation, (i) Supplier’s then current specifications relating to 3 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

Platform, Service or Software, (ii) user, maintenance and system administration documentation including without limitation user guidelines, operating manuals, training manuals and technical materials relating to Platform or Services; and (iii) any and all revisions to the above that Supplier provides or agrees to provide to Verizon in an Authorization Letter. 3.23 “Error” means failure of the Platform, Software or Services to perform in accordance with its Specifications. 3.24 “Hardware” means the hardware, equipment or facilities furnished by Supplier or used by Supplier to provide Hosted Services (including the Firmware licensed to Verizon when such Firmware is in the Hardware) and all additions, extensions, components, supplies, test equipment, apparatus and parts, as specified or identified in this Agreement or in an Authorization Letter, including, without limitation, those set forth or otherwise identified in any Authorization Letter, and all other Exhibits to this Agreement. 3.25 “Hosting Service” or “Hosted Service” shall mean the implementation and ongoing operation of a Platform connected to the Verizon Network by any means, including, without limitation, wide area data communications network connections to enable a Data Service to be provided to and used by Subscribers. 3.26 “Indirect Channel Entity” means any third party whom Verizon has authorized in writing to offer, promote, market and resell Verizon Services indirectly or through one or more tiers of indirect distribution, under the Trademarks of Verizon or the Trademarks of such Indirect Channel Entity. For greater certainty, the term “Indirect Channel Entity” expressly does not include overseas Affiliates of Verizon or its parent companies. 3.27 “Intellectual Property Rights” means any patent, copyright, rights in trademarks, trade secret rights and other intellectual property or proprietary rights arising under the laws of any jurisdiction. 3.28 “Milestones” means the schedule of development and delivery milestones specified in an Authorization Letter. 3.29 “Person” means any natural person, corporation, partnership, limited liability company or other entity. 3.30 “Platform” means the system comprised of computer equipment, Software and network interconnections and services, owned, implemented and operated by Supplier (and any corrections, Updates, enhancements or modifications thereto which enables Verizon to provide or support a Data Service to Subscribers as provided in an Authorization Letter. 3.31 “Products” means all Platform, Software and Services, and all hardware, equipment, supplies, materials, parts, components and assemblies used to provide the Services described in an Authorization Letter. 3.32 “Self-Help Code” means (i) any back door, “time bomb”, drop-dead device, or other software routine designed to disable a computer program automatically 4 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

with the passage of time or under the positive control of a person other than a licensee of the program and (ii) any digital rights management or copy protection code for the Software other than as noted in the applicable Documentation. Self- Help Code does not include software routines in a computer program designed to permit the licensor of the computer program (or other person acting by authority of the licensor) to obtain access to a licensee’s computer system(s) (e.g., remote access via modem) for purposes of maintenance or technical support. 3.33 “Services” means all installation, implementation, technical support, maintenance, modification, training, repair, Development Services, Hosting Services, and other services related to a Data Service or Software that Supplier will provide to Verizon, as described in an applicable Authorization Letter including all exhibits attached thereto, as amended by any Change Request. 3.34 “Service Description” means the document attached to the applicable Authorization Letter and made a part thereof, that describes the Service or Software (as applicable) that Supplier will provide to Verizon, as may be modified by Change Requests agreed to by Supplier and Verizon pursuant to the Change Request Process. 3.35 “Verizon Service Requirements” means, collectively, all of the Specifications and all of the requirements for a Data Service or Software set forth or referenced in the applicable Authorization Letter, including but not limited to the Service Description, Service Level Agreement; Security Requirements (as set forth in Exhibit C and as supplemented or as modified in an applicable Authorization Letter); Training Plan and Disaster Recovery Requirements documents, as applicable and as amended from time to time by any mutually agreed upon Change Request, or otherwise upon mutual written agreement of the Parties. 3.36 “Service Level Agreement” or “SLA” means the document attached to the applicable Authorization Letter, which defines and sets forth the service level commitments to be performed by Supplier. 3.37 “Service Web Site” means the location on the Internet or other public data network accessed via a computing device at a URL specified by Verizon which will serve as a location and mechanism through which (i) information about a Data Service or Software may be provided by Verizon, (ii) a Person may elect to become a Subscriber or modify elections made for such Data Service or Software, or (iii) Content may be accessed by, transmitted to the Data Service by, or delivered to Subscribers. With respect to any Web Site maintained on the World Wide Web, such Web Site includes all HTML Pages (or similar unit of information presented in any relevant data protocol) that either are identified by the same second-level domain (such as xxx.xxxxxxxxxxxxxxx.xxx) or by an equivalent level identifier in any relevant address scheme. 3.38 “Software” means on whatever media provided, a program, or programs, including data files, system software and application software and firmware consisting of machine readable logical instructions and tables of information, which guide the functioning of a processor or which provide functional and operational performance capabilities and capacities, including all updates, 5 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

upgrades and enhancements thereto. The term Software as used in this Agreement shall include Apps. 3.39 “Source Code” means the human-readable version of particular Software, as well as associated documentation required or necessary to enable an independent third party programmer with reasonable programming skills to compile, create, operate, maintain, modify and improve such Software and associated documentation without the help of any other Person. 3.40 “Specifications” means the written functional and technical specifications and requirements for a Platform or Software attached to or referenced in this Agreement or the applicable Authorization Letter and all Documentation, as amended from time to time by any mutually agreed upon Change Request or otherwise by mutual written agreement of the Parties. 3.41 “Subscriber” means a Person who (i) subscribes, in a manner prescribed by Verizon, to access and use a Data Service or Software from a Wireless Device and/or (ii) registers in a manner prescribed by Verizon, to access and use a Data Service or Software from a personal computer. For greater certainty, a Person may become a Subscriber either directly through Verizon or indirectly through an Indirect Channel Entity. 3.42 “Subscriber Data” means information or data that (i) is provided by Verizon or a Subscriber, or compiled, generated or collected by either Party in connection with a Data Service or Software, and (ii) identifies the Subscriber individually, or that when compared to or otherwise combined or processed with other information enables an individual Subscriber to be identified. For greater certainty, “Subscriber Data” includes, without limitation, user name or ID, account number, individual usage data, user profile or preferences, credit card or other payment information, mailing address, email address, IP address, landline or cellular telephone numbers, Social Security number and date of birth. 3.43 “Trademarks” means, with respect to each Party, their trademarks, service marks, trade names, logos, brands and other proprietary indicia. 3.44 “Unauthorized Code” means any virus, Trojan horse, worm, rootkit, or other software routine or hardware component designed to enable unauthorized access to, to disable, to erase, or otherwise to harm software, hardware, or data or to perform any other such actions. The term Unauthorized Code does not include Self-Help Code. 3.45 “Updates” means all future releases, patches, fixes, corrections, enhancements program code changes, improvements, upgrades, updates and new releases relating to Software, as well as refinements, solutions, changes and corrections to the Software as are required to keep the Software in conformance with the applicable Service Requirements and that are created by Supplier as corrections for defects in the Software, including without limitation error corrections, installation programs, and data conversion programs applicable to the Software. 3.46 “Usage Data” means information or data other than Subscriber Data (as defined above) that describes the operation of a Data Service for or use of a Data 6 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

worked at $**** (no hours prior to the execution of such Change Request shall be included) for any work in progress, capped at **** of the payment due for such work in the applicable Change Request (or the underlying Authorization Letter) for such Milestone or Deliverable, unless other termination fees or charges are specified under such Authorization Letter (in which case such stated termination fees or charges shall be in lieu of any other partial payments). 4.4 Affiliates An Affiliate that issues an Authorization Letter may enforce the terms and conditions of this Agreement with respect to any Software or Services purchased by such Affiliate as though it were a direct signatory to the Agreement. Default by one Affiliate shall not affect any other Affiliate party to this Agreement. 5. LICENSES 5.1.1 Supplier grants to Verizon and its Affiliates and to its and their employees, agents and contractors, a non-exclusive, irrevocable (other than for Verizon’s uncured material breach), worldwide, license and right to Use and access the Platform, Services and, to the extent Software is provided to Verizon, an unlimited number of copies of any Software and any Documentation related thereto required for Use and access to the Platform as specified in an Authorization Letter during the Term, at the prices set forth in the applicable Authorization Letter. Where expressly permitted by an Authorization Letter, Software may be sublicensed by Verizon to its original equipment manufacturers (“OEMs”), customers and Indirect Channel Entities in accordance with the foregoing sentence. 5.1.2 Verizon shall also have the right, at no additional charge, to Use the Software by means of remote electronic access at locations other than the locations at which the Software is stored. Supplier also grants to Verizon the right to authorize Use of such license to its subcontractors, agents, contractors, outsourcing entities and others for use when performing services for Verizon; provided that Verizon shall remain responsible to any violation of the Agreement or any Authorization Letter by such parties. In addition, if Verizon transfers or assigns the Software to an Affiliate or a third party in connection with the provision or support of network services, then the license granted hereunder shall extend to such transferee or assignee. No such authorization, transfer or sublicense shall release Verizon from its obligations hereunder. 5.2 License Term Except as otherwise set forth herein, the term of each license of Software granted under this Agreement or any Authorization Letter shall commence on the applicable delivery date, or such other date as set forth in an Authorization Letter, and shall remain in effect perpetually, or for such shorter term as set forth in an Authorization Letter, or until the Use of the Software, as it may have been updated or enhanced is permanently discontinued by Verizon, unless such license for Software is terminated in accordance with Section 17. 9 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

5.3 Shrink-Wrap Licenses Under no circumstances shall any Supplier shrink-wrap or click-wrap license be given any force or effect in connection with any Software and Verizon specifically rejects all such licenses. The Parties agree to replace the terms of such licenses with the terms of this Agreement or an Authorization Letter, if applicable. 5.4 Content Licenses 5.4.1 Verizon grants to Supplier a limited, nonexclusive, non-transferable, royalty-free license to Verizon Content to copy, store, display, transmit, distribute and sell Content solely for the purpose of providing Verizon Content via its Platform for Verizon’s Data Service to Subscribers in accordance with the applicable Authorization Letter, expressly without the right of further sublicense of any of the foregoing. Nothing in this Section shall be interpreted as granting Supplier any greater rights or authorizations than are granted to Verizon pursuant to its licensing agreements with Content Providers. Supplier shall have no right to reproduce or sub-license, re-sell or otherwise distribute all or any portion of Verizon Content to any person in any form or any manner other than as necessary or appropriate in providing a Service or Software in accordance with the applicable Service Requirements. Except as otherwise agreed in writing, Supplier shall not receive, transmit, alter, copy, access, store, or otherwise use Verizon Content except for purposes of performing its obligations under an applicable Authorization Letter. Supplier shall protect all Verizon Content from unauthorized alteration, copying, access, storage, transmittal or use as required in this Agreement and as provided in the Service Requirements. 5.4.2 Supplier grants to Verizon a limited, nonexclusive, non-transferable license to Supplier Content to copy, store, display, transmit, distribute and sell Supplier Content solely for the purpose of providing Supplier Content through the Platform via a Data Service to Subscribers in accordance with an applicable Authorization Letter, expressly without the right of further sublicense of any of the foregoing. Nothing in this Section shall be interpreted as granting Verizon any greater rights or authorizations than are granted to Supplier pursuant to its licensing agreements with Content Providers. Verizon shall have no right to reproduce or sub-license, re-sell or otherwise distribute all or any portion of Supplier Content to any person in any form or any manner other than as necessary or appropriate in providing a Data Service in accordance with the applicable Service Requirements. 5.5 All rights and licenses granted under or pursuant to this Agreement or any Authorization Letter by Supplier to Verizon are, and shall otherwise be deemed to be, for the purposes of Section 365(n) of the United States Bankruptcy Code (“Code”), licenses to rights to “intellectual property” as defined in the Code. The Parties agree that Verizon, as licensee of such rights under this Agreement, shall retain and may fully exercise all of its rights and elections under the Code. The Parties further agree that, in the event of a bankruptcy proceeding by or against Supplier under the Code, Verizon shall be entitled to retain all of its rights 10 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

(b) In addition, upon termination of this Agreement or the applicable Authorization Letter (other than for cause by Supplier), provided that such termination is not due to Verizon’s breach of this Agreement, and Verizon has paid all fees due, including termination charges due, such license to the Solution API shall be extended to grant to Verizon the right to use and sublicense the Solution API to Device Application Developers solely to incorporate the Solution API into an interface of the Device Applications and support and maintain such interface with any service offering similar functionality to the associated Supplier Platform (and not solely to interface with the associated Supplier Platform) solely for the benefit of Verizon’s Subscribers (including those Subscribers using the service offering similar functionality to the associated Supplier Platform referenced in this sentence). In all cases, Verizon shall inform Supplier in writing of any Device Application Developer to which Verizon Wireless has provided the Solution API. Verizon shall be liable for any breach by a Device Application Developer of any of the covenants and obligations of Verizon hereunder. 5.7.2 During the Term or Renewal Term, Verizon may provide written notice to Supplier that it wishes to use and sublicense the Solution API set forth in subsection 5.7.1 to Device Application Developers to incorporate the Solution API into an interface of the Device Applications and support and maintain such interface with any service offering similar functionality to the associated Supplier Platform (and not solely to interface with the Supplier Platform) solely for the benefit of Verizon Subscribers because (A) Supplier has been subject to credits for failure to meet any one service level set forth in an applicable Service Level Agreement for three (3) consecutive months where each such failure is subjected to a credit of at least $**** or (B) Supplier’s Platform (or non-Platform Software supporting a Data Service) is not within Industry-Standards (solely from a technology basis including without limitation features and functionality) in some or all material respects and there is another service offering which Verizon wishes to use and that Verizon in good faith determines such service offering to address the “Industry Standards” issues identified in the affected Platform (or non-Platform Software supporting a Data Service). If such notice is pursuant to subsection (B) and Supplier fails to meet such “Industry Standards” in all material respects within a reasonable period after the receipt of such notice but no later than the production release date of the next feature release of the Platform (or non-Platform Software supporting a Data Service) that will reasonably accommodate any industry standard issues that may arise or which the content of such feature release has not yet been finalized, then such license shall be so extended as set forth herein. For the avoidance of doubt, in the event of the extension of the license to the Solution API as described above, this shall not release Verizon of any of its other obligations under this Agreement, including but not limited any payment obligations and Supplier has the right to immediately rescind such license in the event of any uncured material breach by Verizon under this Agreement. In the event that Verizon does not give notice of its exercise of the right hereunder to Supplier within **** of the trigger of such 13 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

10.2.2 Supplier shall update the Disaster Recovery Plan as reasonably necessary during the Term to include a list of all hardware, software and communications facilities and services used by Supplier to provide the Hosting Service. Verizon shall have the right to reasonably audit Supplier’s compliance at reasonable times as Verizon deems necessary provided such audit does not adversely impact Supplier or any services provided by Supplier to any other customer. Verizon’s review of any changes to the Disaster Recovery Plan shall not in any way alter or waive any of Suppliers duties, obligations, representations or warranties under this Agreement. 10.3 Training Upon request from Verizon, Supplier shall provide training outlined in the applicable Authorization Letter upon the terms set forth in such applicable Authorization Letter. Verizon shall have the right to duplicate or reproduce (including any markings as to confidentiality and copyrights), for internal usage only, any of the training materials at no additional cost. 10.4 Branding Unless otherwise stated in the applicable Authorization Letter, nothing in this Agreement shall be construed to limit or restrict Verizon’s rights to market and have marketed a Data Service or Software as Verizon determines, using Verizon own Trademarks or the Trademarks of one or more Indirect Channel Entities; provided Verizon does not remove any applicable copyrights. 10.5 International Roaming Access All Software and Services are intended to be used to enable Verizon to provide the Data Service to Subscribers who are customers purchasing Verizon Services in the United States. However, Supplier acknowledges and agrees that Verizon may, in its sole discretion, enable Subscribers to access and use a Data Service using Wireless Devices while roaming outside the United States pursuant to international data roaming agreements that Verizon may enter into with other wireless carriers. 11. FEES/PAYMENT 11.1 Pricing During the Term of this Agreement, Verizon shall pay Supplier for Service and/or Software in accordance with each applicable Authorization Letter. All payments are due in U.S. Dollars. All charges to Verizon for Services or Software are as set forth in each applicable Authorization Letter or, for modifications to a Service or Software, in a Change Request. 11.2 Improvements Supplier and Verizon shall continue to identify areas for Supplier’s continuous improvement in cost, quality and service over the term of the Agreement. 18 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

Supplier from its testing, inspection and quality control obligations. Unless an alternative Acceptance mechanism or deemed Acceptance procedure is specified in an Authorization Letter and except as provided under Section 14.1.5, Statement of Work or elsewhere in this Agreement, Software and Services shall not be deemed Accepted unless such Acceptance is in writing. 14.1.2 Except as set forth in an Authorization Letter, Verizon shall have a period of **** following delivery of the Software and/or Service within which to test the Software and/or Service for conformity with this Agreement, the applicable Authorization Letter and Verizon Service Requirements, as applicable, and any applicable criteria for Acceptance. If the Software and/or Service fails to so conform, Verizon may, provide written notice (email shall be acceptable for this purpose) to Supplier rejecting such Software and/or Service. Following such notification, Supplier shall use commercial reasonable efforts, within ****, at Supplier's risk and expense, to correct all deficiencies by repairing or replacing any non-conforming Software. If, after the cure period, the Software and/or Service still fails to perform in accordance with the applicable criteria for Acceptance and Supplier is not able to correct such deficiency, it shall require that Verizon return the impacted Software and/or Service to Supplier at Supplier’s expense. 14.1.3 If such Software and/or Service is rejected above, any one-time amounts paid to Supplier by Verizon specifically for the impacted Software release and/or Service milestone shall be refunded to Verizon within **** after return of the impacted Software and/or Service; provided, however, in no event shall this provision apply to a refund of any transaction fees related to the Platform. The purchase price for such Software and/or Service also shall be credited against any future volume commitments or applied for evaluation of attainment of volume discounts under this Agreement applicable to such Software and/or Service. 14.1.4 Verizon has the right to subject the initial release of the Software and/or Service, and each subsequent Software release containing new functionality or enhancements intended for commercial production, to an operational soak period as part of the Acceptance testing. Soak period means using the Software and/or Service in a productive operation mode for ****. If the Software and/or Service does not perform according to the Service Requirements during the soak period, Supplier, at no additional charge, shall provide technical support personnel, to perform tuning services in order to meet the Service Requirements. If such tuning efforts are unsuccessful (i.e., the Software or Service will not perform to Service Requirements) after a reasonable period of time, in addition to its other remedies at law, equity or under this Agreement, (i) Verizon may return the Software release which was subjected to the soak period, and Supplier shall refund all monies paid for the applicable Software or Service release that was subjected to the soak period (provided, however, in no event shall this provision apply to a refund of any transaction fees related to the Platform) or (ii) Verizon, retaining all rights and remedies including those under (i), may extend the soak period 22 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

Agreement to obtain the Escrow Materials from the Trustee, the escrowee or any other person or entity having possession thereof, and shall, if requested under the conditions specified in the Escrow Agreement for release of the Escrow Materials, cause a copy of such Escrow Materials to be made available to Verizon. Notwithstanding anything in this Agreement to the contrary, Verizon reserves all rights available to it under Section 365(n) of the Federal Bankruptcy Code, 11 U.S.C. § 365(n) or any equivalent or successor provision thereto and such rights as may be available under other applicable laws. 16.6 Dispute Resolution. Supplier may dispute in good faith the existence of the release conditions described in Section 16.3 and such disputes will be subject to final and binding arbitration by a three-arbitrator panel wherein each party shall select an arbitrator, and those two arbitrators shall jointly select a third, and the panel’s written decision must be provided within **** of the date such arbitration claim is submitted. The panel will be required to furnish, promptly upon conclusion of the arbitration, a written decision, setting out the reasons for the decision. The arbitration decision will be final and binding on the Parties, and the decision may be enforced by either Party in any court of competent jurisdiction. The arbitration will be conducted in New York, NY under the then current Commercial Dispute Resolution procedures of the American Arbitration Association ("AAA"). Each Party will bear its own expenses and an equal share of the expenses of the third arbitrator and the fees, if any, of the AAA, unless the arbitrator rules otherwise as detailed above. The effectiveness of the license described in Section 16.4 (and any release of the Escrow Materials) shall be delayed until such disputes are resolved in Verizon’s favor by the arbitrator/panel. 16.7 Survival. The obligations set forth in this Section shall survive and remain in effect until the later of (i) all obligations of Supplier to provide maintenance and support for the Software to Verizon, including to provide Maintenance Services, whether pursuant to this Agreement or after the expiration or termination of this Agreement, or (ii) termination or expiration of any separate agreement between the Parties with respect to maintenance and support for the Software. 16.8 Definitions. For purposes of this Section 16: 17.6.1 “Escrow Agreement” means an agreement executed by Supplier and Verizon which is separate from, but supplemental to, this Agreement and which sets forth the terms and conditions governing release of the Escrow Materials to Verizon. 16.8.2 “Escrow Materials” means the then-current Source Code for the Software,, all tools and other software required to translate or convert the deposited Source Code to executable code (e.g. software compilers, linkers, assemblers, translators and interpreters) that are not readily 29 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

available to Verizon commercially off- the-shelf, and any Custom Software obtained through this Agreement. 17. TERMINATION 17.1 Supplier shall be in default if Supplier fails to perform any of its material obligations under this Agreement , and such failure to perform shall continue for a period of **** after Supplier's receipt of Verizon's written notice thereof, then, in addition to all other rights and remedies under this Agreement at law or in equity or otherwise, Verizon shall have the right, upon written notice, to immediately cancel any or all affected Orders or, at Verizon’s option, to terminate this Agreement, without any obligation or liability to Supplier for said termination or cancellation. 17.2 This Agreement may additionally be terminated, by written notice only, as follows: 17.2.1 Unless otherwise expressly provided in such Authorization Letter, Verizon may terminate any or all Authorization Letters issued hereunder without cause, effective upon **** notice, upon written notice to Supplier and, in such event, Supplier shall receive payment only in accordance with Section 17.4 hereof. 17.2.2 Supplier may terminate any affected Authorization Letter if Verizon fails to make timely payments of those portions of invoices that are not disputed in good faith as required hereunder, and any such failure is not remedied within **** after receipt of written notice by Supplier stating its intention to terminate such Authorization Letter. 17.2.3 By either party, effective immediately, upon written notice to the other party, if any of the following events occurs: 17.2.3.1 The other party files a voluntary petition in bankruptcy. 17.2.3.2 The other party is adjudged bankrupt. 17.2.3.3 A court assumes jurisdiction of the assets of the other party under a federal reorganization act. 17.2.3.4 A trustee or receiver is appointed by a court for all or a substantial portion of the assets of the other party. 17.2.3.5 The other party becomes insolvent or suspends its business. 17.2.3.6 The other party makes an assignment of its assets for the benefit of its creditors except as required in the ordinary course of business. 17.3 Upon termination of this Agreement, Supplier shall deliver to Verizon, and Verizon shall own, all Custom Software and Paid Work Product created by 30 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

Services and Software to enable Verizon to utilize its Data Service (subject to the continued payment of undisputed payments by Verizon pursuant to the terms of this Agreement or as otherwise agreed by the parties) and (b) use reasonable efforts to assist Verizon to ensure a seamless migration without interruption to Subscribers (collectively, the “Transition Services”) on mutually agreed pricing and other terms but in no event shall Supplier be required under this subsection (b) to license its Platform to Verizon or such third party as part of the Transition Services. Without limiting the foregoing obligations, to the extent that any services are required, in addition to and beyond the scope of the Transition Services, to effect such transition to Verizon or another application service provider, the parties will mutually agree upon further terms (including fees) regarding the scope and schedule of such additional services. If Verizon does not request Transition Services, Supplier will cease providing the Service(s) at the time termination becomes effective. 17.7 The foregoing rights are in addition to, and not in limitation of, any other remedy a party may have at law or equity. 18. INFRINGEMENT 18.1 Supplier shall indemnify, defend and hold harmless Verizon, its parents, subsidiaries and Affiliates, its OEMs (subject to the limitations in Section 18.5) and its and their respective directors, officers, employees, agents, successors and assigns ("IP Indemnified Parties") from and against any claims, demands, lawsuits, liabilities, loss, cost or expenses (including, but not limited to, reasonable fees and disbursements of counsel and court costs), judgments, settlements and penalties of every kind ("IP Claims") arising from or relating to any actual or alleged infringement or misappropriation of any patent, trademark, copyright, trade secret or any actual or alleged violation of any other intellectual property or proprietary rights arising from or in connection with the Services (including related products furnished hereunder by Supplier) or Software provided under this Agreement. Notwithstanding anything to the contrary contained in this Agreement (including, but not limited to, Section 1), the provisions of this Section 8, shall govern the rights of Indemnified Parties with respect to indemnification for IP Claims. 18.2 The procedures, limitations and restrictions set forth in Section 31 (Indemnification) shall apply in the case of IP Claims hereunder. 18.3 Without limitation of Sections 18.1 and 18.2, if sale, use or if applicable, distribution, of the products or Services becomes subject to an IP Claim, Supplier shall, at Supplier’s option and Supplier’s expense: 18.3.1 Procure for Verizon the right to use the Services or Software (including related products furnished hereunder); 18.3.2 If 18.3.1 is not possible modify the Services or Software (including related products furnished hereunder) so they become non-infringing; 32 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

works that VZ specifically pays for and is identified in an Authorization Letter as a Paid Work Product (“Paid Work Product”), are works made for hire exclusively for Verizon under the patent or copyright laws of the United States and shall become and remain the exclusive property of Verizon, and Verizon shall have the rights to use such for any purpose without any additional compensation to Supplier. In the event any Custom Software or Paid Work Product produced under this Agreement shall not be deemed to be a work made for hire exclusively for Verizon under the patent or copyright laws of the United States, Supplier hereby grants and assigns to Verizon all right, title and interest in and to (including the right to reproduce, modify, display, produce derivative works of, translate, publish, sell, use, dispose of, and to authorize others so to do, and the right to patent or copyright and to register such patent or copyright in Verizon’s or its nominee's name) all Custom Software or Paid Work Product, subject to Section 20.2.1. Supplier further agrees to assist Verizon in every proper way to protect Custom Software or Paid Work Product, including, but not limited to, signing patent and copyright applications, oaths or declarations, and assignments in favor of Verizon relating to the Custom Software or Paid Work Product, as well as such ancillary and confirmatory documents as may be required or appropriate to insure that such title is clearly and exclusively vested in Verizon, within the United States and in any and all foreign countries. Supplier further agrees to assist and cooperate with all efforts to enforce the rights of Verizon in such property against any third parties. 20.2.3.2 (a) Ownership of all Work Product that is not Custom Software or Paid Work Product shall be retained by Supplier (“Supplier-retained Work Product”). With respect to such Supplier-retained Work Product, Supplier grants to Verizon a nonexclusive, perpetual, fully paid up, royalty free, worldwide, irrevocable license under such Supplier-retained Work Product to make/have made, use, sell, have sold and otherwise provide Verizon products (through one or more intermediaries) to Verizon’s end-user customers. For the avoidance of doubt, the foregoing license rights to Supplier-retained Work Product shall not apply or extend to Verizon a license to Background Materials or to the Platform. (b) With respect to Custom Software or Paid Work Product consisting of/including improvements or enhancements to Supplier’s Background Materials (“Verizon-Owned Improvements to Background Materials”), such Verizon-Owned Improvements to Background Materials must be expressly identified as such in the applicable Authorization Letter in accordance with Section 20.2.6. 20.2.4 Supplier grants to Verizon a royalty-free, nonexclusive, transferable, sublicensable, and irrevocable license during the Term to any and all Background Materials which are incorporated in any Custom Software, 35 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

22.2.2.1 Supplier agrees that the nature and quality of all use by Supplier of the Verizon Marks shall conform to such reasonable guidelines and standards as are provided in writing from time to time by Verizon. 22.2.2.2 Supplier shall submit to Verizon for review and approval, at least **** prior to proposed use, all materials, in which the Verizon Marks are used. Subsequent changes to previously submitted materials still in the approval process will be approved within ****. Supplier hall not publish, distribute or use any such materials, in which the Verizon Marks are used without the prior written approval of the following representative of Verizon: ****, email ****. 22.2.2.3 Notwithstanding the foregoing, Supplier may designate at the time of submission that the requested approval is for multiple/repetitive, identical uses on the same medium. Supplier may request approval for such multiple/repetitive, identical use for a period not to exceed the end of the term of this Agreement. 22.2.2.4 Verizon reserves the right, in its sole discretion and without cause, to refuse to approve any proposed Supplier use of the Verizon Marks. 22.2.2.5 Ownership and Goodwill. Supplier acknowledges that, as between Verizon and Supplier, Verizon’s affiliate Verizon Trademark Services LLC (“VTS”) is the sole and exclusive owner of rights in the Verizon Marks, and Supplier undertakes not to challenge the validity of the Verizon Marks or VTS’s registration and ownership of the Verizon Marks, and agrees that it will do nothing inconsistent with such ownership. Supplier further acknowledges and agrees that all use of the Verizon Marks by Supplier and all goodwill generated by and developed therefrom shall inure to the benefit of and be on behalf of VTS. Supplier agrees that nothing in this Agreement shall give Supplier any right, title or interest in or to the Verizon Marks other than the right to use the Verizon Marks in connection with the Licensed Use in the manner contemplated by this Agreement and only for so long as this Agreement is in force. 23. PUBLICITY AND DISCLOSURE Each party agrees not to provide copies of this Agreement, or otherwise disclose the terms of this Agreement, to any third party without the prior written consent of the other party, except as required by law. Except as required by law, each party further agrees to submit to the contacts below, for written approval, all advertising, sales promotion, press releases and other publicity matters relating to the product furnished and/or the Service performed pursuant to this Agreement, when a name or xxxx or the name or xxxx of the other party or any of its partners or Affiliates is mentioned or language from which the connection of 39 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

applicant for employment because of race, color, religion, disability, sex, national origin, age, physical or mental disability, veteran status or other unlawful criterion, and it shall comply with all applicable laws against discrimination. (If applicable, the Equal Opportunity Clauses set forth in 41 C.F.R. §§60-1.4(a), 60-250.5(a), and 60-741.5(a) are incorporated by reference herein.); 24.1.2 to the safeguarding, protection, privacy, security, encryption, unauthorized disclosure, breach notification and disposal of personal or similar information used, maintained, and/or accessed on Verizon’s behalf including, without limitation, the Standards for Protection of Personal information of the Residents of the Commonwealth of Massachusetts 201 CMR17:00; California Civil Code §1798.82 and the Fair and Accurate Credit Transactions Act of 2003, Public Law 108-159; 24.1.3 to directly or indirectly, making, offering, causing to be made, accepting, requesting, suggesting, directing or otherwise inducing any bribe, payment, loan, commission, hospitality, gift of money, kick-back, inducement or anything of value or other advantage (individually or collectively “Bribery”) to any official, employee, agent or instrumentality of any government, including legislative, administrative or judicial positions, or any public international organization or any other person, company or legal entity to gain any advantage for Verizon or Supplier, or which is in violation of any economic or trade sanctions, in connection with any transaction relating to this Agreement that could result in a violation of any laws relating to Bribery, including without limitation the Foreign Corrupt Practices Act and the U.K. Xxxxxxx Xxx 0000 (“U.K. Bribery”). Notwithstanding any other provisions in this Agreement, Verizon may suspend performance or terminate this Agreement immediately upon written notice, if Supplier breaches any of the terms set forth in sections above. Following notice of termination, Verizon shall not be responsible for any payments due under the Agreement, and shall not be required to complete any order or take any other action pursuant to this Agreement, if it has reasonable basis to believe that such payment, completion of order, or other action would violate any applicable law, including but not limited to the Foreign Corrupt Practices Act, or the UK Bribery. In the event of an unauthorized disclosure of personal or similar information or any other violation of the foregoing pertaining to Verizon, Supplier shall provide notice of same by e-mail to xxxxxxxx.xxxxxx@xxxxxxx.xxx within forty-eight (48) hours, and to the notice addressee set forth in the Notices section of this Agreement by the means set forth therein. Supplier shall also procure any required permits or certificates necessary to perform its obligations under this Agreement. 24.2 Software furnished shall comply, to the extent applicable, with the requirements of the Federal Communications Commission’s Rules and Regulations, as may be amended, including those sections concerning the labeling of such Software and the suppression of radiation to specified levels to the extent applicable. If the Software generates interference harmful to radio communications, and such Software was installed in accordance with such Rules and Regulations, then 41 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

Supplier shall provide to Verizon methods for suppressing the interference. If the interference cannot be reasonably suppressed, Supplier shall accept return of the Software, refund to Verizon the price paid for the Software and bear all expenses for removal and shipment of such Software. Nothing herein shall be deemed to diminish or otherwise limit Supplier’s obligations under Section 31, Indemnification or any other rights or remedies available to Verizon, whether at law or in equity. 24.3 Supplier represents and warrants to Verizon that at the time of delivery, the Platform delivered, or Software delivered, hereunder shall be “CALEA Compliant”, meaning that they will comply with the provisions of the Communications Assistance for Law Enforcement Act (Pub L. 103-414, Title 1, October 25, 1994, 108 Stat 4279, as amended), as well as any regulations implementing the provisions of the law. . 24.4 Notwithstanding Section 24.1, it shall not be considered a material breach of this Agreement if a Party is not in compliance with an Applicable Law if such non- compliance is not material to a Party’s performance under this Agreement. 25. FORCE MAJEURE Neither Party shall be responsible for any delay or failure in performance of any part of this Agreement to the extent that such delay is caused by reason of acts of God, wars, revolution, civil commotion, acts of public enemy, embargo, acts of government in its sovereign capacity, or any other circumstances beyond the reasonable control and to the extent not involving any fault or negligence of the Delayed Party ("Condition"). If any such Condition occurs, the Party delayed or unable to perform ("Delayed Party"), upon giving prompt notice to the other Party, shall be excused from such performance on a day-to-day basis during the continuance of the impacts of such Condition (and the other Party shall likewise be excused from performance of its obligations on a day-to-day basis during the same period); provided, however, that the Party so affected shall use its best reasonable efforts to avoid or remove such Condition, and both Parties shall proceed immediately with the performance of their obligations under this Agreement whenever such causes are removed or cease. Labor difficulties, including without limitation, strikes, slowdowns, work stoppage, picketing or boycotts, shall not constitute a Condition that excuses a party from performance of its obligations under this Agreement. In the event of such labor difficulties affecting a party, the other party shall use all lawful means to perform Services or meet obligations agreed to under this Agreement. If the Condition continues for more than ****, then the Party affected may terminate this Agreement or any Authorization Letter. 26. ASSIGNMENT The rights, obligations, and other interests of Supplier shall not be assigned by Supplier, in whole or in part, without the prior written consent of Verizon and any purported assignment of same shall be void and ineffective; provided, however, no consent shall be required in the event of the sale of all of the capital stock or 42 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

substantially all of the assets to another party. provided, that such acquiring third party: (a) agrees to be bound by all of the terms and conditions of this Agreement, and (b) meets none of the following criteria: i. Such acquiring third party is a competitor of Verizon or is owned by a competitor of Verizon; ii. Such acquiring third party does not have substantially equal or greater financial wherewithal as compared to Supplier; or iii. Verizon has been in litigation with such entity in the past over one or more of the following topics: Intellectual Property Rights, confidential information, data protection, or a material breach of a services agreement. 26.1 If Verizon sells, exchanges or otherwise disposes of all or a portion of the assets of, or Verizon’s interest in, any business unit in which Services are used, then Verizon shall have the right to assign to such third party all applicable licenses, warranties, maintenance schedules and rights granted under this Agreement with respect to such Service; provided that the third party agrees to be bound by all obligations of Verizon to Supplier that pertain to the Service. Notwithstanding the foregoing, Verizon shall have the right to assign this Agreement to any Affiliate.]] 27. SUBCONTRACTING Supplier shall not use subcontractors to perform the Services under this Agreement except by prior written consent of Verizon. Requests by Supplier to Verizon to use subcontractors shall be in writing and shall specify the Services to be subcontracted and the identity of the proposed subcontractors. It shall be Supplier’s responsibility to update Verizon as it adds or deletes subcontractors and to ensure that the subcontractors it uses are in all cases approved by Verizon. Supplier accepts full responsibility for the acts and omissions of subcontractors and of persons either directly or indirectly employed by them in connection with performing Services hereunder to the same extent as Supplier is responsible for the acts and omissions of persons directly employed by Supplier. In the event Verizon approves the use of a Subcontractor, for all subcontractors, including, without limitation, any application provider or Content provider, that directly or indirectly furnish hardware, facilities, software, data files, or services that are elements of, or support, the Hosted Services (“Third Party Providers”), Supplier shall contract with such Third Party Providers (other than Terremark or any other affiliate of Verizon) on terms and conditions that are the same as, or no less stringent and beneficial to Verizon than the terms and conditions of Sections 5, 19, 20, 21, 24.1.2 (if the Subcontractor will have access to Massachusetts customer information described in such Section) and 26 and the applicable SLA; and further as and for an inducement to Verizon to enter into this Agreement, Supplier shall make Verizon a third party beneficiary in all respects under such contracts between or among Supplier and such Third Party Providers in order to 43 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

pass through to Verizon all rights and remedies against such Third Party Providers as may be beneficial to Verizon. Verizon’s rights and remedies under all such Third Party Provider contracts shall be supplemental to its rights and remedies against Supplier. 28. TAXES 28.1 Verizon shall, as required by law, pay all state and local sales and use tax or other similar tax (each, a "Tax"), which is directly and solely attributable to purchases by Verizon from Supplier for consideration under this Agreement. Supplier shall xxxx such Tax to Verizon in the amount required by law, separately stating the amount and type of the billed Tax on the applicable invoice; Verizon shall pay such billed amount of Tax to Supplier; and Supplier shall remit such billed amount of Tax to the appropriate tax authorities as required by law; provided, however, that Supplier shall not xxxx to or otherwise attempt to collect from Verizon any Tax with respect to which Verizon provides Supplier with (i) an exemption certificate prepared in accordance with applicable law, (ii) a direct pay number, or (iii) other evidence, reasonably acceptable to Supplier, that such Tax does not apply. Except as provided in this Section 28.1, Supplier shall bear the costs of all import and export duties and other governmental fees of whatever nature (other than taxes) with respect to all Software and Services supplied under this Agreement. For the avoidance of doubt, Supplier shall be solely responsible for any taxes, tax-like charges or tax-related or other surcharges determined by Supplier's income, net worth, franchise or property. Supplier will bear any and all financial responsibility for interest, and penalties resulting from its failure to comply with applicable law. 28.2 Supplier shall be responsible for any sales, use, excise, value added, service, consumption, property, franchise, income, or other taxes and duties based upon or measured by Supplier’s cost in acquiring goods or services furnished or used by Supplier in the Software and services supplied under this Agreement. 28.3 Supplier shall reasonably cooperate with Verizon so as to minimize the tax liability of Verizon, including, without limiting the generality of the foregoing, liability for Tax to be billed and collected under Section 28.1. Such cooperation shall include, without limiting the generality of the foregoing: (i) the delivery of Software and Documentation from Supplier to Verizon via electronic transmission; (ii) the separate statement of Tax charges on all invoices (including, without limiting the generality of the foregoing, charges for installation, assembly, configuration, freight, insurance and shipping); (iii) the maintenance and invoicing of separate prices for Software and Services; (iv) providing Verizon, upon request, with a written opinion as to (a) the percentage of the value of the Software or Services supplied under this Agreement, (b) the percentage breakdown of value among such categories of Software as Verizon may identify in its request, and (c) such supporting documentation and information with respect to such opinion as Verizon may request; and (v) upon request from Verizon, certifying in writing whether and, if applicable, to what extent, any particular Software is custom or pre-written. 28.4 Supplier shall cooperate with all reasonable requests of Verizon in connection with any contest or refund claim with respect to taxes. If applicable law places 44 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

the responsibility on Supplier to collect a Tax from Verizon and Supplier fails to do so, Verizon will not be responsible for any interest or penalties associated with Supplier’s failure to invoice such Tax solely due to its error. If Supplier incorrectly (in the reasonable opinion of Verizon) bills and collects Tax from Verizon and the taxing authority requires that any refund from the taxing authority be sought by the billing party, then, upon request from Verizon (together with reasonable supporting documentation), Supplier shall seek the refund and remit to Verizon the amount of the refund actually obtained, together with interest, if any, actually received, promptly upon receiving such refund and interest, if any, from the taxing authority. If the Supplier agrees with a tax authority to waive the Supplier’s statute of limitations as to its audit period, Verizon will not be responsible for any portion of tax audit assessments on Supplier beyond Supplier’s original applicable statute of limitations, nor, will Verizon be responsible for any portion of tax audit assessments on Supplier for any period for which Verizon’s statute of limitations is closed due to expiration or audit settlement. 28.5 If any payment to be made in respect of any invoice is subject, under the law of any foreign tax jurisdiction, to any withholding tax, notwithstanding any provision of this Agreement to the contrary, Verizon shall make payment to Supplier of the amount owing on the invoice, less a deduction for the withholding tax, and shall account to the relevant tax authority for the withheld tax. Payments of the net sum to Supplier and the withholding tax to the relevant tax authority shall constitute, for purposes of this Agreement, full settlement of the amount owing under the invoice. Verizon will, upon written request from Supplier and at Supplier’s expense, furnish any necessary evidence that may reasonably be required to establish the payment of the withholding tax to the relevant tax authority. 29. PERMITS Unless otherwise specifically provided for in this Agreement, Supplier (including any employees, agents and contractors) shall obtain and keep in full force and effect, at its expense, any permits, licenses, consents, approvals and authorizations (“Permits”) necessary for the performance of Services. Upon request, Supplier must submit to Verizon evidence of any Permits required for Supplier to perform Services in a given location. 30. WORK RULES AND ACCESS REQUIREMENTS 30.1 Supplier shall comply with Verizon security rules to the extent provided to Supplier or with respect to which Supplier has actual or reasonable constructive notice as well as all governmental security regulations including, but not limited to U.S. governmental regulations governing security clearances. 30.2 Supplier shall permit reasonable access to employees or subcontractors (for purposes of this Section, Verizon shall be responsible for such Verizon subcontractors as if they were Verizon employees) of Verizon during normal working hours to its facilities to the extent reasonably required in connection with the Service. 45 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

30.3 Supplier shall provide its employees, subcontractors, and agents and work vehicles with identification in accordance with current generally applicable Verizon supplier requirements 30.4 If Supplier is given access, whether on-site or through remote facilities, to any Verizon computer or electronic data storage system in order for Supplier to accomplish the Services called for in this Agreement, Supplier shall limit such access and use solely to perform Services within the scope of this Agreement, shall not without the prior written authorization of Verizon export or transmit any computer system, electronic file, software or other electronic services, or data therein contained, to entities or locations other than those specified in this Agreement and shall not access or attempt to access any computer system, electronic file, software or other electronic services other than those specifically required to accomplish the work required under this Agreement and only as permitted in this Agreement. Supplier shall limit such access to those of its employees who are qualified and required, subject to Verizon requiring written authorization, to have such access in connection with this Agreement, and shall strictly follow all Verizon’s security rules for use of Verizon’s electronic resources. All user identification numbers and passwords disclosed to Supplier and any information obtained by Supplier as a result of Supplier’s access to and use of Verizon’s computer and electronic data storage systems shall be deemed to be, and shall be treated as, Verizon Confidential Information under applicable provisions of this Agreement. Verizon reserves the right to monitor such actions by Supplier and Supplier agrees to cooperate with Verizon in the investigation of any apparent unauthorized access by Supplier to Verizon’s computer or electronic data storage systems or unauthorized release of Confidential Information by Supplier. 30.5 If Supplier is given such access to any Verizon computer or electronic storage system, or if Supplier otherwise exchanges electronic messages or communications with Verizon (including but not limited to Verizon accessing any of Supplier’s data bases or systems on-site or remotely), or if Supplier furnishes software or other electronic transmissions to Verizon, (i) Supplier shall not transmit or introduce any virus, worm or other malicious code to Verizon or into its network, computers, electronic storage systems or other systems (the foregoing shall not apply where Subscriber Data as transmitted by Verizon to Supplier contains such a virus, worm or other malicious code) and (ii) any Software provided to Verizon by Supplier for use by Supplier or Verizon shall (a) contain no hidden files; (b) not replicate, transmit, or activate itself without control of a person operating computing equipment on which it resides; (c) not alter, damage, or erase any data or computer programs without control of a person operating the computing equipment on which it resides unless such practice is consistent with Specifications or Service Requirements; (d) contain no encrypted imbedded key unknown to Verizon, node lock, time-out or other function, whether implemented by electronic, mechanical or other means, which restricts or may restrict use or access to any programs or data developed under this Agreement, based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria (“Illicit Code”) unless such practice is consistent with Specifications or Service Requirements. 46 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

30.6 Verizon reserves the right to reasonably request at any time and for any reason that specific employees, subcontractors, and agents of Supplier be removed from and not assigned by Supplier to perform Services for Verizon, and Supplier acknowledges, agrees and understands that Supplier will immediately comply with such request by Verizon. 30.7 Background Checks. 30.7.1 For each of the employees that Supplier wishes to assign to perform Services for Verizon, Supplier shall certify to Verizon that it has conducted (or caused to be conducted) a background check as described herein (collectively referred to as “background checking”) to the extent permitted by applicable law. For purposes of this Section, “employee” shall include Supplier’s employees and any of Supplier’s contract personnel; and “assign” shall include training for Services to be provided to Verizon, unless otherwise agreed to by Verizon. 30.7.1.1 Where permitted by law, the criminal history check shall consist of a federal and state check for felony criminal convictions (or the equivalent thereof under relevant law) in all locations where the assigned employee has resided, has been employed, or has attended school in the immediately preceding seven (7) years, and a check of U.S. Government Specially Designated National (OFAC) and export denial lists. This criminal history check shall include, to the extent available and permitted by law, a check for outstanding warrants and a check for pending felony charges in all such locations. Statewide county searches shall be performed in all states where such search mechanism is available without requiring specialized data (such as fingerprints or DNA), and the National Criminal File database shall also be searched. 30.7.1.2 The employee will be checked against the National/State Sex Offender Registry (xxxx://xxx.xxxxxxxxxxxxxx.xx/ with no state selected) or the equivalent, to yield a national and all-states search. 30.7.1.3 The name to which employee’s Social Security Number is attributed shall be verified. 30.7.1.4 The employee’s citizenship, most recent country of permanent residence, and legal right to work in the jurisdiction in which the employee will be performing Services for Verizon shall be verified. 30.7.2 For any period of time encompassed in the foregoing background check requirement when the employee was resident outside of the United States, such background checking shall be conducted by a reputable investigative agency that conducts background checking in the relevant country(ies) for transnational technology firms comparable to Verizon, utilizing database checking, field checking and interviews as needed to 47 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

the extent permitted by applicable law. The criminal convictions check shall include the equivalent, under relevant non-US law, of those convictions described in 30.7.1 to the extent permitted by applicable law 30.7.3 Supplier shall comply with all applicable laws in conducting the background check specified in this Section 30.7 including but not limited to, where required, securing from each employee who provides Services to Verizon such employee’s written consent to perform the background checking specified in this Section 30.7 and to disclose the results thereof to Verizon upon Verizon’s request to the extent permitted by applicable law. Without limitation of the foregoing, Supplier will make all written disclosures to and obtain written consent from each employee to obtain consumer reports as defined in and required by the Fair Credit Reporting Act to the extent permitted by applicable law. Supplier shall provide such results and written consent to Verizon upon request from Verizon. Supplier may be required to recertify on an annual basis that such Background Checks were performed for any employee who has performed Services and was not included in the prior certification. 30.7.4 Without prior review with and consent of Verizon, Supplier shall not assign any employee to provide Services to Verizon if such employee: 30.7.4.1 has been convicted of a felony (or the equivalent thereof under relevant law) within the last seven (7) years which, following a review under applicable law and applying the guidelines set forth in Exhibit G, Supplier concludes the circumstances of which are directly job-related to the assignment at Verizon and therefore makes the employee unsuitable for that assignment at Verizon, or for whom a warrant is outstanding, or for whom a felony charge is currently pending, or is on a U.S. Government Specially Designated National or export denial list. The foregoing shall not apply to a minor traffic violation (a moving traffic violation other than reckless driving, hit and run, driving to endanger, vehicular homicide, driving while intoxicated or other criminal offense involving gross negligence, recklessness, intentional or willful misconduct while operating a motor vehicle), to a conviction that has been legally expunged, or to a conviction for a misdemeanor that occurred while the employee was under the age of twenty-one years; or 30.7.4.2 is on the national or any state Sex Offender Registry which, following a review under applicable law and applying the guidelines set forth in Exhibit G, Supplier concludes the circumstances of which are directly job-related to the assignment at Verizon and therefore makes the employee unsuitable for that assignment at Verizon 30.7.4.3 does not have the legal right to work in the jurisdiction in which the employee will be performing Services for Verizon. 48 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

30.7.5 Supplier shall certify to Verizon that Supplier has caused the foregoing background checking to be performed for each employee assigned to provide Service for Verizon within **** of the Effective Date; further, upon request, Supplier shall annually certify no later than the anniversary of the Effective Date that it has met the foregoing background checking requirements for all employees then assigned to provide Service for Verizon. Such certifications shall be sent via electronic mail to Verizon’s in accordance with the Notice provision in the Agreement. 31.8 Supplier agrees to comply with Verizon's Supplier Code of Conduct located at xxxx://xxx00.xxxxxxx.xxx/xxxxxx, which may be updated from time to time to the extent Verizon notifies Supplier in writing of such update. 31. INDEMNIFICATION 31.1 Supplier shall defend, indemnify and hold harmless Verizon, its parents, subsidiaries and Affiliates, and its and their respective directors, officers, partners, members, employees, agents, successors and assigns (“Indemnified Parties”) from and against any claims, demands, lawsuits, damages, liabilities, loss, costs or expenses (including, but not limited to, reasonable fees and disbursements of counsel and court costs), judgments, settlements and penalties of every kind (“Claims”), that may be made: (a) by anyone for injuries (including death) to persons or damage to tangible property, including theft, resulting in whole or in part from the acts or omissions of Supplier or those persons furnished by Supplier, including its subcontractors (if any); (b) by persons furnished by Supplier and its subcontractors (if any) under Worker's Compensation or similar acts; (c) by anyone in connection with or based upon Services or Software (including products furnished hereunder) provided by Supplier and its subcontractors, if any, or contemplated by this Agreement, including Claims regarding the adequacy of any disclosures, instructions or warnings related to any such Services; (d) under any federal securities laws or under any other statute, at common law or otherwise arising out of or in connection with the performance by Supplier contemplated by this Agreement or any information obtained in connection with such performance and (e) for any breach by Supplier of Section 15.9.1. The foregoing indemnification shall apply whether Supplier or an Indemnified Party defends such Claim and whether the Claim arises or is alleged to arise out of the sole acts or omissions of the Supplier (and/or any subcontractor of Supplier) or out of the concurrent acts or omissions of Supplier (and/or any subcontractor of Supplier) and any Indemnified Parties. Supplier further agrees to bind its subcontractors, if any, to similarly indemnify, hold harmless, and defend the Indemnified Parties. 31.2 Verizon will provide Supplier with prompt, written notice of any written Claim covered by this indemnification and will cooperate appropriately with Supplier in connection with Supplier’s evaluation of such Claim. Promptly after receipt of such request, Supplier shall assume the sole control and defense of such Claim. Supplier shall not settle or compromise any such Claim or consent to the entry of any judgment without the prior written consent of each Indemnified Party and without an unconditional release of all claims by each claimant or plaintiff in favor of each Indemnified Party. 49 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

32. INSURANCE 32.1 Supplier shall secure and maintain at its expense during the term of this Agreement: 32.1.1 Commercial General Liability insurance (including, but not limited to, premises-operations, products/completed operations, contractual liability, independent contractors, personal and advertising injury) with limits of at least $****, combined single limit for each occurrence and $**** general aggregate. 32.1.2 Commercial Automobile Liability insurance with limits of at least $**** combined single limit for each accident covering all owned, non-owned hired and leased vehicles. 32.1.3 Workers' Compensation insurance, in compliance with the statutory requirements of the state(s) of operation and Employer's Liability insurance with limits of not less than $**** each accident/disease/policy limit. 32.1.4 A combination of primary and excess/umbrella liability policies will be acceptable as a means to meet the limits specifically required hereunder. THE REQUIRED MINIMUM LIMITS OF COVERAGE SHOWN ABOVE, HOWEVER, WILL NOT IN ANY WAY RESTRICT OR DIMINISH SUPPLIER’S LIABILITY UNDER THIS AGREEMENT. 32.1.5 Professional Liability/Errors and Omissions insurance, with limits of not less than $**** each claim. 32.2 Supplier represents and warrants that it will obtain upon or prior to the effective date of the agreement a policy or policies of insurance from an insurer(s) that (i) is licensed, authorized or permitted to do business in the state(s) where service is to be provided, and (ii) has a Best’s Rating “A- VII” or better. Supplier shall deliver a Certificate of Insurance on which Verizon Communications Inc., its subsidiaries and Affiliates are named as additional insureds and listed as a Certificate Holder to the following address: **** Verizon Sourcing LLC One Verizon Way Mailcode **** Basking Ridge, NJ USA 07920 or via Verizon’s vSource supplier portal. Supplier’s insurer or its authorized representative shall provide no less than **** prior written notice of intent to non- renew, cancellation or material adverse change, except **** notice for nonpayment of premium shall apply. 32.3 Supplier shall waive its rights of subrogation against Verizon for all claims, as permitted by law. 50 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

overnight delivery service, or hand delivery, proper postage or other charges paid and addressed or directed to the respective Parties as follows. A notice that is sent by facsimile shall also be sent by one of the other means set out by this Section: To Supplier: Synchronoss Technologies, Inc. 000 Xxxxxxxx Xxxx. Xxxxxxxxxxx, XX 00000 Attention: President Fax: **** With a copy to: Synchronoss Technologies, Inc. 000 Xxxxxxxx Xxxx. Xxxxxxxxxxx, XX 00000 Attention: General Counsel Fax: **** To Verizon: Verizon Xxx Xxxxxxx Xxx Xxxxxxx Xxxxx, XX XXX 00000 Attention: **** With a copy to: Verizon Sourcing LLC Xxx Xxxxxxx Xxx Xxxxxxx Xxxxx, Xxx Xxxxxx 00000 Attention: Vice President and Deputy General Counsel - Sourcing Fax: **** Notices for change in ownership, change in name of firm, or change in mailing address must be given by each party by mailing to the other party within **** of such change. Notices for change in ownership must include the names of all new owners or officers, registered agent for service of process and state of incorporation or organization. 35. NONWAIVER Either party’s failure to enforce any of the provisions of this Agreement or any Authorization Letter, or to exercise any option, shall not be construed as a waiver of such provisions, rights, or options, or affect the validity of this Agreement. 36. SEVERABILITY If any provision of this Agreement shall be invalid or unenforceable, then such invalidity or unenforceability shall not invalidate or render unenforceable the entire Agreement. The entire Agreement shall be construed as if not containing the particular invalid or unenforceable provision or provisions, and the rights and obligations of the Parties shall be construed and enforced accordingly. 52 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

37. LIMITATION OF LIABILITY EXCEPT FOR CLAIMS UNDER SECTION 19 (CONFIDENTIAL INFORMATION), IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY, ITS EMPLOYEES, SUBCONTRACTORS, AND/OR AGENTS, OR ANY THIRD PARTY, FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE DAMAGES, OR LOST PROFITS FOR ANY CLAIM OR DEMAND OF ANY NATURE OR KIND, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE PERFORMANCE OR BREACH THEREOF. THE AGGREGATE LIABILITY OF EITHER PARTY FOR ALL CLAIMS MADE IN ANY CALENDAR YEAR UNDER OR IN CONNECTION WITH THIS AGREEMENT, IRRESPECTIVE OF THE BASIS OF CLAIM (WHETHER WARRANTY, TORT (INCLUDING NEGLIGENCE) OR OTHERWISE) SHALL BE LIMTED TO ****. ****. The Parties acknowledge that the fees paid hereunder reflect the foregoing allocation of risk. 38. DISPUTE RESOLUTION 38.1 The Parties desire to resolve certain disputes, controversies and claims arising out of this Agreement without litigation. Accordingly, except in the case of a suit, action or proceeding to compel either Party to comply with the dispute resolution procedures set forth in this Section the Parties agree to use the following alternative procedure with respect to any dispute, controversy or claim arising out of or relating to this Agreement or its breach. The term "Dispute" means any dispute, controversy or claim to be resolved in accordance with the dispute resolution procedure specified in this Section. 38.2 At the written request of a Party, each Party shall appoint a knowledgeable, responsible representative to meet and negotiate in good faith to resolve any Dispute arising under this Agreement. The Parties intend that these negotiations 53 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

42. CHOICE OF LAW AND JURISDICTION The construction, interpretation and performance of this Agreement shall be governed by and construed in accordance with the laws of the State of New York without regard to any conflicts of law principles that would require the application of the laws of any other jurisdiction and subject to the exclusive jurisdiction of the federal or state courts in New York. The Parties hereby consent to the exclusive jurisdiction of the courts in the State of New York and agree to accept the service of process of such courts such that any suit brought by either Party against the other Party for claims arising out of this Agreement shall be brought in the Supreme Court of the State of New York, New York County, and/or, if applicable, the United States District Court for the Southern District of New York. The application of the United Nations Convention on Contracts for the International Sale of Goods is specifically excluded from this Agreement. 43. GIFTS AND GRATUITIES AND CONFLICTS OF INTEREST 43.1 Supplier certifies that, to the best of Supplier’s knowledge and belief, no economic, beneficial, employment or managerial relationship exists between Supplier and any employee of Verizon, or between Supplier and any relative of an employee of Verizon, that would tend in any way to influence such employee in the performance of his or her duties on behalf of Verizon in connection with the awarding, making, amending or making determinations concerning the performance of this or any other agreement. 43.2 The exchange or offering of any money, gift item, personal service, entertainment or unusual hospitality by Supplier to Verizon is expressly prohibited. This prohibition is equally applicable to both Parties’ officers, employees, agents or immediate family members. Any violation of this provision constitutes a material breach of this Agreement. 55 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

EXHIBIT A – FORM OF AUTHORIZATION LETTER Date Contact Name Supplier Name Address City, State Re: This Application Service Provider Agreement between Verizon and _____________________ (“Supplier”) Verizon Contract No. Authorization Letter Number: Dear __________________: This authorization is pursuant to the terms and conditions of the above-referenced agreement (the “Agreement”). The services to be performed are described in the attached “Statement of Work” (Schedule 1) (“Project”). The schedule of pricing is set forth in the attached Statement of Work. The Verizon Project Leader will be: __________________________________ Invoices shall be billed on a monthly basis and addressed to: Verizon [INSERT APPROPRIATE ADDRESS] ______________________ _______________________ Attn: _________________________ The payment terms shall be as defined in the Agreement. Supplier shall not issue its invoice for the Project until the earlier of Verizon’s written acceptance of the Project or the expiration of the acceptance period set forth in the Statement of Work. The Services will be performed at the Verizon facilities located at ____________. Travel time to and from this location will not be billable. Out-of-pocket expenses, authorized in advance by Verizon, will be billed to Verizon in accordance with the Agreement. The maximum amount authorized under this letter is $___________ (“Amount Authorized”). Services authorized by this letter will commence on _______________ and will continue until _____________, subject to the earlier of 1) completion of the Project; or 2) termination of Services under the Agreement. The Verizon Project Leader will specify standards and/or other constraints to be applied to work being performed. 57 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

Supplier will provide the Verizon Project Leader with a weekly status report indicating hours worked by day and status of assigned tasks. Please indicate your acceptance of this Authorization Letter by having it signed by an authorized representative of Supplier and return a fully executed original and a copy of your insurance certificate to ________________________ at the address stated above with copies to ______________. Sincerely, (Name) Verizon (Title) Agreed to and accepted by Supplier: BY: ____________________________ NAME: ____________________________ TITLE: ____________________________ DATE: ____________________________ 58 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

EXHIBIT B – CHANGE REQUEST FORM CHANGE REQUEST FORM CUSTOMER PROVIDED INFORMATION Originator’s Name: Date: Telephone: Email: Customer Name: Application Name: Description of Problem or Desired Changes (Attach Additional sheets as Necessary): Recommended Action/Solution (Attach Additional sheets as Necessary): TO BE COMPLETED BY SUPPLIER Functional Areas Affected: Application Development Production Operations Project Management Office Network Engineering QA Legal Data Base Management Other Content Management Marketing Written description of the work Supplier anticipates performing in order to effectuate such change(s) requested: Schedule for commencing and completing such work: 59 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

The number of person hours expected to be expended and the costs to Customer associated with such change(s): Analysis/Evaluation/Comments: Reviewed/Verified By: Project Manager _________________________ Date: ________________ Business Unit Manager _________________________ Date: ________________ Other _________________________ Date: ________________ Change Management Team Target Release Date: Recommendation: Work Defer Close Agreed to and accepted by Supplier: Agreed to and accepted by Verizon: BY: ____________________________ BY: ____________________________ NAME: ____________________________ NAME: ____________________________ TITLE: ____________________________ TITLE: ____________________________ DATE: ____________________________ DATE: ____________________________ 60 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

(6) Federal Tax ID (Social Security Number) in many cases) (7) Driver’s license number (8)) State identification card number (9) An account number or credit or debit card number (10) Alien registration number (11) Health insurance identification number “Personally Identifiable Information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. Sensitive Information Any SPI, PII or CPNI-PI, collectively or individually. Sensitive Personal One or more of the following personal data elements that may Information (SPI) be combined with a person’s identifying information (name, telephone number, email address, driver’s license number, internet address, etc.): (1) Social Security number, (2) driver’s license number or state-issued identification card number, (3) financial account number, or credit or debit card number, with our without any required security code, access code, personal identification number (PIN) or password that would permit access to that person’s financial account, (4) medical information (including, but not limited to, any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional), (5) health insurance information (i.e., an individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records). “Sensitive Personal Information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. b) General Definitions Industry Standard “Industry Standard” means: ) actually used or adopted by a substantial number of comparable companies working with comparable information of a comparable nature; ) prescribed for use by an a governing industry standards body or group; or ) assessed by recognized experts in the field as acceptable and reasonable. Media Destruction A process that destroys media on which information is located 62 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

and thereby makes recovery of such information impossible, and means “destroyed” as specified in Guidelines for Media Sanitization, National Institute of Standards and Technology, NIST Special Publication 800-88 (NIST 800-88). Incineration, shredding and pulverizing are all permissible physical destruction methods in accordance with minimum standards specified in NIST 800-88. Media that have been subject to such Destruction are “Destroyed” under these Baseline Security Requirements. Storage Encryption Data encryption using at least using a non-proprietary industry standard algorithm that has not been broken (AES and 3Des are acceptable encryption methods). Verizon Sensitive Information stored by Supplier shall be protected using the following minimum encryption standards: **** Sanitization “Sanitized” or “sanitization” is a process that removes information from media or that renders such information irretrievable, such that data recovery is not possible, and means “sanitized” no less effectively than as specified in Guidelines for Media Sanitization, National Institute of Standards and Technology, NIST Special Publication 800-88 (NIST 800-88). 63 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

Secure Transportation Transport utilizing a licensed, bonded, secure carrier that implements and adheres to a "chain of custody program", approved by Verizon, for tracking the movement and disposition of storage media or other equipment from receipt to final disposition, including tracking the following specific items: ) Ownership of the media ) Serial number of the media ) Verification at collection/pick-up location (owner/end user) ) Driver name, date and time Stamp ) Receipt at Supplier's location (date and time Stamp); Security Breach The unauthorized acquisition or unauthorized use of unencrypted data, or the unauthorized acquisition or unauthorized use of encrypted data along with the confidential process or key that is capable of compromising the security, confidentiality, or integrity of such encrypted data. Strong Authentication Authentication is a process for verifying an individual and/or the individual’s electronic identity. An individual or the individual’s electronic identity can be certified by positively identifying any one of the following: Something they know (an authentication code), such as a password; Something they have (an authentication device), such as a proximity door card or a SecurID1 card; or Something they are (physical characteristics), such as facial features, retina pattern, or a fingerprint Strong Authentication occurs when a user is required to submit or use at least two of these identification indicators for verification. Supplier Devices Servers, computers, mobile devices (other than mobile workstations), and communications equipment provided by Supplier in connection with work under the Agreement. Supplier Staff Supplier staff includes employees, contract employees, temporary staff, authorized subcontractors, and employees, contract employees and temporary staff of the foregoing subcontractors. Transport Encryption Transport encryption shall be no less secure than encryption consisting of SSL v3 or TLS protected by a minimum of 128 bit encryption with a 1024 bit keys using Verizon approved digital certificates. Public certificates must be used for all web-based servers. If other transport encryption methods are utilized, they must conform to these minimum standards. 2) Information Security Program Requirements: 1 SecurID is a registered trademark of RSA Security, Inc. 64 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

Supplier is required to maintain an information security program that at minimum includes the following: a) One or more designated qualified employees must be responsible to maintain the Supplier information security program. b) Supplier must maintain written information security policies and standards that address all information security requirements contained in the Agreement(s); that are at minimum consistent in all material respects with the requirements of this Exhibit and with applicable Industry Standards; and that support the confidentiality, integrity and availability of Supplier systems, information and business operations and the confidentiality, integrity and availability of Verizon Sensitive Information and Confidential Information. In addition, such policies and standards must conform to all applicable data protection laws and regulations. c) Supplier executive management must endorse information security polices and standards; d) Supplier Staff must receive periodic training (at least annually) to understand Supplier’s security policies, and must acknowledge their adherence to Supplier’s security policies. Written certification of the periodic training and of the acknowledgement of information security policies by Supplier employees and permitted contractors must be maintained by supplier for inspection by Verizon upon reasonable request. e) Non-compliance with Supplier’s information security policies must result in meaningful discipline. f) Supplier Information Security program must include periodic education and awareness messages to Supplier Staff that consist of relevant and timely information to sensitize such staff to the importance of security for Sensitive Information and Confidential Information, complying with applicable use requirements and limitations, the proper use of Supplier’s security systems, and the requirements of Supplier’s information security program. g) Supplier must review its security measures on an ongoing basis, at least annually and whenever there is a material change in business practices that may implicate the security or integrity of records containing Sensitive Information. Such review will identify and assess reasonably foreseeable internal and external risks to the security, confidentiality and/or integrity of any electronic, paper or other records containing Sensitive Information. h) Supplier must regularly monitor its security measures to identify and assess reasonably foreseeable risks to the security, confidentiality and/or integrity of Sensitive Information and to ensure that its information security program is operating in a manner reasonably calculated to prevent unauthorized access to or unauthorized use of Sensitive Information, and to ensure that the security program continues to comply with applicable laws. Supplier will promptly notify Verizon of any findings of deficiencies in its security program and of its plans mitigating such deficiencies, and Supplier will upgrade its information security safeguards as necessary to minimize the risks associated with those deficiencies. 65 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

v) Visitors accessing the facility must be managed in accordance with the following practices: (1) Visitors to Supplier facilities must be registered in a visitor log. The log should document the visitor’s name, the firm represented, and the employee authorizing physical access on the log. The log should be retained for inspection by Verizon for a minimum of three months, unless otherwise restricted by law. (2) Visitors should be issued temporary identification badges specific to the length of the expected visit in the facility. Visitor identification badges must be returned upon the visitor’s departure. (3) Temporary visitor identification should be noticeably different from Supplier’s normal employee and contractor identification. (4) Supplier must inform employees of the approved formal policies for granting access to visitors at Supplier facilities. (5) Any visitor to a Supplier facility that accesses areas where Verizon Sensitive Information and/or Confidential Information is stored, processed or transmitted must be accompanied and supervised at all times by a Supplier employee who is specifically authorized to access confidential Verizon data. (6) Prior to granting a visitor to a Supplier facility access to any computer, server or system containing Verizon Sensitive Information and/or Confidential Information, access by each such visitor must be approved in writing by the designated Verizon contact, and the visitor must be positively identified as the person for whom Verizon has given such approval. (7) Under no circumstances may visitors be left unattended in an area where they have physical access to equipment that handles Verizon Sensitive Information and/or Confidential Information. c) Facilities Access Monitoring: i) The Supplier should utilize appropriate levels of monitoring equipment in public areas of their facilities to ensure the auditing of Supplier facility entry and exit activity can be performed. ii) For all Supplier access control and monitoring installations, appropriate safeguards and retention of records should be implemented to ensure the integrity of the systems and the availability of the records if the need arises. d) Separate Information Processing Environments At a minimum, the following physical security and access controls must be implemented and maintained throughout the terms of the engagement: i) Verizon Sensitive Information and/or Confidential Information must not be processed on servers that are accessible in general business areas of Supplier’s facility and must be isolated in dedicated information processing areas with independent physical, monitoring, environmental and health and human safety systems (referred to as a “Computer Room”). 67 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

ii) Access to any information processing area where Verizon Confidential and/or Sensitive information is processed must be restricted to authorized Supplier personnel only. iii) Supplier must implement physical access policies and procedures to ensure that physical access is revoked when it is no longer needed or appropriate (for example, immediately removing access for separated employees or removing access for employees who are no longer authorized to access Verizon Confidential and/or Sensitive Information). Removal of Physical Access should occur in a timely manner not to exceed 24 hours. iv) Supplier must employ technical and organizational mechanisms to prevent unauthorized copying of Sensitive Information within Information Processing Environments. These mechanisms shall include disabling/restricting local ports so as to prevent downloading of data onto removable USB drives, MP3 players or similar devices, restrictions on uploading or file transfer from the facility to unauthorized recipients, and a prohibition on the use of cameras (excluding CCTV security unit) and other screen capture devices. e) Computer Room Physical Security Requirements Computer room facilities where Verizon Sensitive Information and/or Confidential Information is stored, processed or transmitted must implement the following information security controls: i) All computer room doors must be secured to prevent unauthorized access into the room. ii) Each computer room door must have signs on both sides indicating it is to be closed and locked with a contact to notify if it is found unsecured. iii) Supplier Staff must be instructed to immediately report unsecured doors. iv) Supplier must implement a reliable process of designating staff access to Computer Rooms. v) Supplier Staff should only be authorized to enter a Computer Room for a legitimate business need and a record of the individual’s identity, justification and duration of access should be maintained. vi) A separate electronic access control system utilizing strong authentication should be installed on Computer Room doors that will only allow authorized personnel access to the room, unless access to the room is controlled 24 hours a day, 7 days a week, by a guard. (1) The access control system must be secured against tampering. (2) The access control system must log the entry and exit of staff for each time the door is opened. Entry and exit logs should contain a reliable time stamp, room location and identification of the person who gained access or exited the room. (3) The access control system should alert security staff in the event that a secured door has been open beyond a reasonable amount of time (for example, by being propped open and unattended). 68 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

ii) Electronic Media containing Sensitive Information: If electronic media containing Sensitive Information are shipped, the Sensitive Information must be encrypted using Storage Encryption unless shipped in accordance with the Secure Transportation requirements herein. 4) Logical Security Requirements (Suppliers conducting information processing of Verizon Information) a) Logical Access Control Supplier must develop logical access controls for all computing systems handling Verizon Confidential and/or Sensitive Information. Logical Access controls must include: i) The assured enforcement of authentication controls to limit access to information systems to only those individuals who are currently active and who are authorized to access a given information system. ii) A secure and reliable method of enforcing authorization controls which limit access to Verizon Sensitive Information and Verizon Confidential Information to only previously-authorized Supplier Staff. iii) Use of the “principle of least privilege” model for access, enabling Supplier personnel to access only such information and resources as are necessary when they perform under the Agreement for the role assigned to the authorized user, iv) A process of controlling User IDs and other identifiers to ensure they are unique among users and are not shared. Note: Sensitive Personal Information must not be used as an authentication or an authorization mechanism to obtain a password, or for log in rights or for access to any application, system, website or database owned or operated by Verizon or on Verizon’s behalf. The last four digits of a Social Security number, passwords, PINs, challenge responses and/or access codes are permitted to be used for such purposes in conjunction with other data. v) A process which will immediately terminate access by an employee or contractor who no longer requires access to perform under the Agreement (e.g., a terminated or reassigned employee/contractor). vi) Periodic review of access, authorization and other applicable monitoring logs on all systems to ensure the access control and authentication systems are performing as expected. vii) Processes that utilize industry standard password selection and aging procedures to limit opportunities for compromise of password security. Such password procedures should include but not be limited to the following: (1) A process to ensure that no user or information system may utilize Supplier-supplied default account passwords. (2) A secure method of assigning and selecting passwords or other unique identity validation values, such as biometric registration values or the issuance of one-time-password token devices. 71 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

(3) Limit repeated access attempts by locking out the user ID after not more than six (6) attempts with a thirty (30) minute minimum lockout duration (4) Verification of user identity before password resets; (5) All passwords must be have first-time passwords set to a unique value for each user and change immediately after the first use; (6) Inactive accounts must be disabled after 90 days; (7) Password must be changed at least every ninety (90) days; (8) Passwords must be at least eight (8) characters and must include letters and numbers; (9) Supplier must require users to submit passwords that are different than any of the last four (4) passwords the individual has used; (10) If a session has been idle for more than fifteen (15) minutes, require the user to re-enter the password to reactivate the terminal. (11) Control and encrypt with a 1-way hash, data security passwords to ensure that such passwords are kept in a location and/or format that does not compromise the security of the data they protect. b) Access Logging and Monitoring i) Supplier must maintain electronic logs of persons accessing Verizon Confidential and/or Sensitive Information depicting the details of the access and transactional changes made. ii) Logs must be maintained for inspection by Verizon for a minimum of ninety (90) days. iii) Logs shall be stored centrally on Supplier owned or controlled systems that cannot be altered by users or privileged users. iv) At a minimum logs shall capture the following information for all access to Verizon Confidential and/or Sensitive Information: (1) Unique user ID; (2) Login/Logout time; (3) System/data set accessed; (4) Failed login attempts; (5) Activity (for privileged users such as data base administers, system administrators, etc.) including changes to permissions, changes to data, etc.) v) Access logs shall be reviewed by Supplier at least daily and provided to Verizon for inspection upon reasonable request. Alternatively, log parsing tools which automatically generate alerts based on information security rules 72 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

may be utilized provided that alerts are reviewed and appropriate action is taken, at least daily. c) Network and Communications Security The Supplier must develop and implement network and communications security policies, procedures and technology to control and detect potential network and communications information security system issues and failures. At a minimum, Supplier must have: i) Firewall controls at appropriate points in the Supplier network to control the ingress and egress of communications and data to environments containing Verizon Sensitive Information and/or Confidential Information. At a minimum, Network Firewalls must protect all connections to open, public networks. System Security Patches and updates for Firewalls must be implemented in a timely manner not to exceed 30 days following release. ii) Supplier must employ industry standard intrusion detection systems (IDS) for any environment into which Sensitive Information will be placed. (1) Network IDS must be placed on network connection points between the Supplier environment containing the Verizon Confidential and/or Sensitive Information and other network environments. Alternatively, Host- Based IDS may be placed on all computing assets storing, processing or transmitting Verizon Confidential and/or Sensitive Information. (2) IDS must be configured with business rules appropriate to the environment and must be configured to generate alerts immediately. (3) Signatures and software for IDS must be kept current and up to date. (4) IDS alerts must be reviewed at least daily by trained security personnel. iii) System Segmentation (1) Information systems storing, processing or transmitting Sensitive Information must be logically isolated from systems that handle other companies’ information. For example, Supplier must use separate database server instances for the processing of Verizon data or must use separate virtual operating system images than those used or accessed by other companies who the Supplier may also service. (2) At no time may Verizon Sensitive Information and/or Confidential Information be housed on a server shared by companies other than the contracting Supplier. For example, a shared web server that is used by several companies and maintained by an Internet Service Provider must not be used to house Verizon data. This requirement also applies to “cloud-based” services. (3) Internet-facing web servers must be dedicated to this task, and must not host internal (intranet) applications for the Supplier. 73 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

(2) All assets controlled by Supplier used to perform work for Verizon must be tracked using an inventory management system including the following information. a. Name, location, retention schedule, and Verizon-assigned data classification level (as described in the Verizon Data Classification in Section 6 of CPI-810) of the information asset such as a database or file system. b. A knowledgeable individual owner of each information asset (the default owner of an information asset is its creator) c. Computer systems (i.e. Servers – Host Name/IP Address) that house Verizon data d. Storage encryption status for any Sensitive Information (both at rest and on any back up media). (3) All Supplier Devices used to perform work for Verizon should be centrally managed by the Supplier. (4) All Supplier Devices used to perform work for Verizon must be managed for the application of operating system and applicable software patches. Critical operating system and software security patches must be installed in a timely manner not to exceed one (1) month following release for public availability. (5) All Critical Security Patches for workstations shall be installed within 7 days of publication from the software or hardware vendor. (6) All Supplier Devices shall have current antivirus software installed (if technically feasible) and configured to check for updates on a daily basis at a minimum. (7) All Supplier Devices that connect to the Internet shall have a personal firewall or its equivalent enabled and configured to only allow connections to authorized business applications. By default, the personal firewall must use a default deny rule that blocks inbound traffic that is not specifically allowed in the course of a specific communication (8) All Supplier mobile computing devices (notebook computers, PDAs, etc.) and portable storage devices (portable drives, flash drives, thumb drives, optical disc media, etc.) used to store or process Verizon Sensitive Information and/or Confidential Information must have “whole disc” or other device Storage Encryption enabled for internal as well as peripheral and removable media. Encryption keys for mobile computing devices and portable storage devices must be kept in escrow and sufficiently protected by the Supplier to enable forensic recovery of data on any protected device. Whole disk Encryption should be implemented with a Pre-Boot authorization configuration. (9) Supplier personnel must not communicate, store or process any Verizon confidential data on any email, storage or processing 75 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

repository that is outside of the direct ownership and control of Supplier. For example, the use of personal web email accounts, web-based backup services, Internet-based document editing or public cloud-based computing services are prohibited without express written permission from the Verizon Sponsor. (10) Sensitive Information data should not be stored or used in testing or other non-production environments. If this use is required, an authorized exception permitting such use must granted in writing by Verizon, and such data must either be (a) masked so that it no longer meets the definition of Sensitive Information, or (b) protected using controls against unauthorized access, copying or viewing that are comparable to those required for the protection of Sensitive Information in production environments. ii) Data Storage Requirements (1) Data Obfuscation a. All Sensitive Personal Information and Personally Identifiable Information at rest must be encrypted using Storage Encryption. CPNI-PI should also be encrypted using Storage Encryption. Storage Encryption of the device on which such information is stored will satisfy these requirements. b. Data Replacement (e.g. SAFE) or field level masking may be acceptable methods of obfuscation. Such methods must be approved in writing by Verizon prior to implementation. (2) Encryption Key Management a. Supplier shall implement key and seed management procedures that enable Verizon Confidential or Sensitive Information to be retrieved if the person who encrypted such data is unable or unwilling to decrypt the data. b. Keys and seeds shall be properly protected, using either physical procedures including very limited access control, separation of duties and logging/monitoring key access or encryption no less robust than is required for Supplier’s own most highly confidential or Sensitive Personal Information and not accessible by unauthorized personnel. c. Additionally, Supplier shall require split keys for all key encryption such that one person does not have the full key for any data encrypted at rest. Generally, Encryption Keys should also be encrypted. d. Supplier shall maintain a written and tested process for key rotation on a periodic basis (at least annually) or in event of compromise (does not apply to keys for data stored in offsite backup). iii) Data Backup Requirements 76 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

review and recommend reasonable changes, and Supplier must amend the policies or respond with mitigating controls and responses within a reasonable time period for mutually agreed to changes. 79 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

EXHIBIT C- 2 – VERIZON WIRELESS NETWORK SECURITY REQUIREMENTS 1. DEFINITIONS The terms defined in this Section shall have the meanings set forth below whenever they appear in this Exhibit, unless the context in which they are used clearly requires a different meaning or a different definition is described for a particular Section or provision: 1.1. “Confidential Information” shall mean: Verizon customer data and proprietary network information, data pertaining to Verizon systems, networks, services, and the security controls implemented on those systems and networks, data pertaining to Verizon employees, Verizon proprietary and/or trade secret information, and any other information or data labeled as confidential or proprietary under the terms of the Agreement. 1.2. “Industry-standard” shall mean: an accepted set of best practices that are (1) used or adopted by a substantial number of companies that are engaged in a similar type of business (“comparable companies”) to manage information of a similar type; (2) prescribed for use by a governing industry standards body or group; or (3) established by recognized experts in the field as being acceptable and reasonable. 1.3. “Penetration Test” shall mean: part of the Risk Assessment Process whereby highly skilled, experienced and trained person(s), known as “white-hat hackers”, engage in a coordinated and planned attack on computer systems and networks to discover potential vulnerabilities and ensure the logical controls can withstand deliberate attempts to be circumvented. 1.4. “Program” shall mean: the documented and exercised processes and procedures for accomplishing common objectives and monitoring such accomplishment, which may be updated from time to time. 1.5. “Risk Assessment Process” and “Risk Assessment” shall mean: a documented and exercised process used to identify the risks to system security and determine the probability of occurrence, the resulting impact, and identify additional safeguards or modifications that would eliminate and/or adequately mitigate this impact. 1.6. “Risk Management Program” shall mean: the documented and exercised process for identifying, controlling, and mitigating information system related risks. It includes Industry-standard qualitative and/or quantitative Risk Assessment Process; cost-benefit analysis; and the selection, implementation, testing, and evaluation of safeguards, including a determination of steps required to meet the four security goals of Security Assurance. 1.7. “Security Assurance” shall mean: grounds for confidence that the four security goals (i.e., integrity, availability, confidentiality, and accountability) have been adequately met by a specific computer system. “Adequately met” includes (1) functionality that performs correctly, (2) sufficient protection against unintentional errors (by users or software), and (3) sufficient resistance to intentional penetration or bypass. 80 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

1.8. “Threat-source” shall mean: either (1) intent and method targeted at the intentional exploitation of a Vulnerability or (2) a situation and method that may accidentally trigger a Vulnerability. 1.9. “Threat Analysis” shall mean: the examination and documentation of threat-sources against system Vulnerabilities to determine the potential threats applicable to a specific computer system in a particular operational environment. 1.10. “Vulnerability” (or “Vulnerabilities” in the plural) shall mean: a flaw or weakness in computer system functionality, design, implementation, internal controls, or security procedures that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy. 2. GENERAL REQUIREMENTS 2.1. This Security Requirements Exhibit (“Exhibit”) is applicable to all relevant aspects of Supplier’s performance under the Agreement , including without limitation the development, offering, use and/or maintenance of any service, software or other product there under, and any future releases, versions, updates, enhancements and modifications thereto (“Software” or “Hardware”, as the case may be). 2.2. Supplier will at all times implement and maintain Industry-Standard administrative, physical and technical security controls, which will be followed in all relevant aspects of Supplier’s performance under the Agreement. Such controls will be sufficient in nature and scope to protect (1) the confidentiality, integrity and availability of Verizon’s Confidential Information as well as (2) the availability and integrity of Verizon’s service, network and operations. 2.3. Supplier shall comply with the administrative, physical and technical security controls as described in this Exhibit and in Verizon’s Security Standards & Policies (“Verizon Policies”). Supplier shall request from Verizon all revised and additional Verizon Policies applicable to Supplier’s Software and Hardware before execution of each new work order. 2.4. Notwithstanding anything to the contrary, for such changes or additions to Verizon Policies applicable to Supplier’s Software and Hardware, the parties shall review such documentation for change and exceptions that impact the Software or Hardware. A Change Request may be required for implementation by Supplier of any such changes to the Verizon Policies. 2.5. For each given Authorization Letter, Verizon Policies applicable to the Software and Hardware supporting the Platform under such Authorization Letter shall be set forth in an exhibit to the Authorization Letter as well as any exceptions to this Exhibit or other terms and conditions agreed upon by the Parties pertaining to Verizon Policies or the Information Security Policy. 3. CONFIDENTIAL INFORMATION 3.1. Supplier warrants that Verizon’s Confidential Information shall only be used for the purposes specified under the Agreement. Supplier’s obligation to 81 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

5.2. Develop, implement, and comply with Industry-standard secure coding best practices. 5.3. Establish processes, including as appropriate, using Vulnerability source code scanners, operating system security benchmarking tools, web application scanners or other tools or techniques, or information acquired through Industry-standards organizations, to assess the Software or Hardware for security Vulnerabilities prior to production release. 5.4. Follow Industry-standard practices to mitigate and protect against all known and reasonably predictable security Vulnerabilities, including but not limited to: (1) unauthorized access, (2) unauthorized changes to system configurations or data, (3) disruption, degradation, or denial of service, (4) unauthorized escalation of user privilege, (5) service theft, and (6) unauthorized disclosure of Confidential Information. 5.5. Supplier must ensure all security features and configurations survive any update, modification or upgrade to Software and Hardware or are replaced with features and configurations that meet the requirements of this Exhibit, unless prior written consent is obtained from Verizon. 6. SECURITY ASSURANCE Supplier shall maintain a Risk Assessment Process which demonstrates the Security Assurance of Supplier’s Software and Hardware. This Process shall include, but is not limited to: 6.1. Supplier must, at Verizon’s cost, coordinate and conduct a Risk Assessment of its Software and Hardware using a Certified Verizon third- party security testing vendor. This Risk Assessment must be completed **** prior to the initial delivery of Supplier Software and Hardware, respectively or as otherwise agreed upon by the Parties in writing. Supplier shall thereafter, at Verizon’s cost and discretion, repeat this Risk Assessment at the earlier of (1) every major version release or (2) annually for all Software and Hardware deployed in the Verizon network or hosted by Supplier. This Risk Assessment shall include the following: 6.1.1. A Threat Analysis of the Software and Hardware 6.1.2. A Penetration Test of the Software and Hardware 6.1.3. A Risk Assessment of the administrative, technical, logical and physical security controls of the pertinent operating environment, systems, networks, and facilities where Software and Hardware is hosted, if hosted by Supplier. 6.2. Supplier must resolve all high and medium risk Vulnerabilities identified in the Risk Assessment Process prior to production release except as otherwise specified by Verizon in writing. At Verizon request, Supplier shall provide to Verizon a documented resolution timeline **** before production release for all remaining Vulnerabilities to be remediated post production. This document shall include the date by which each Vulnerability will be remediated. 83 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential ****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

a third party security vendor may be used to conduct such Verizon Risk Assessment. 85 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

EXHIBIT C-3 CLOUD SECURITY REQUIREMENTS Production / Non-Production Segregation of Cloud Duties: Production and non- production cloud environments shall be kept separate to prevent unauthorized access or changes to information assets, particularly in the case of Cloud and virtualization administrators with privileged access. Wireless Security. Policies and procedures shall be established and mechanisms implemented to protect access to cloud architectures from unauthorized wireless access, including the following: 1) Firewalls implemented and configured to restrict unauthorized traffic 2) Essential security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, SNMP community strings, etc.). 3) Logical and physical user access to wireless access points restricted to authorized personnel 4) The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network Shared Networks and/or Applications. Access to systems with shared infrastructure shall be restricted to authorized personnel in accordance with security policies, procedures and standards. Networks and/or applications shared with external entities shall have a documented plan detailing the compensating controls used to separate network traffic and application access between organizations. Clock Synchronization. A standard NTP time source must be used to synchronize the system clocks of all cloud-based information processing systems within the organization or explicitly defined security domain to facilitate tracing and reconstitution of activity timelines. Mobile Code. Mobile code (i.e. code shared between cloud and client devices or software) shall be authorized before its installation and use, and the configuration shall ensure that the authorized mobile code operates according to a clearly defined security policy. All unauthorized mobile code shall be prevented from executing. GDSVF&H\3541367.2 87 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

EXHIBIT D - DISASTER RECOVERY PLAN GDSVF&H\3541367.2 88 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

MWDVBE Commitments within thirty (30) days of receiving such notice by achieving its requirements, the Primary Supplier shall be in default and no further cure shall be permitted. 5. Supplier Report Card. In addition, the Primary Supplier’s ability to achieve its MWDVBE Commitments shall reflect upon and shall contribute to the Primary Supplier’s overall grade on the Supplier Report Card or other performance measurement(s). 93 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

EXHIBIT F- NONDISCLOSURE AGREEMENT 1. To facilitate discussions, meetings and the conduct of business between the parties with respect to this Agreement, it may be necessary for one party to disclose confidential information to the other. All information of any type or character that is either disclosed to the other party or with which the other party comes into contact shall be considered as the confidential information of the disclosing party including without limitation technical, customer, personnel and/or business information in written, graphic, oral or other tangible or intangible form (“Confidential Information”). Such Confidential Information may include proprietary material as well as material subject to and protected by laws regarding secrecy of communications or trade secrets. 2. Each party acknowledges and agrees as follows: a. All Confidential Information acquired by either party from the other shall be and shall remain the exclusive property of the source; b. To inform the receiving party, in advance of any disclosure of Confidential Information, in non-confidential and non-proprietary terms, of the nature of the proposed disclosure, and to afford the receiving party the option of declining to receive the Confidential Information; c. Information which is disclosed orally shall not be considered Confidential Information unless it is reduced to writing or to a written summary which identifies the specific information to be considered as Confidential Information, and such writing is provided to the receiving party at the time of disclosure or within thirty (30) days; d. To receive in confidence any Confidential Information; to use such Confidential Information only for purposes of work, services or analysis related to the matter of mutual interest described above and for other purposes only upon such terms as may be agreed upon between the parties in writing; e. To limit access to such Confidential Information to a party’s employees, contractors, and agents who (i) have a need to know the Confidential Information in order for such party to participate in the matter of mutual interest described above; and (ii) have also entered into a written agreement with the receiving party which provides the same or greater protections to any Confidential Information provided hereunder. Upon request, Supplier shall provide a copy of such agreements to Verizon; and f. At the disclosing party's request, to return promptly to the disclosing party or to destroy any copies of such Confidential Information that is in written, graphic or other tangible form, and provide to the disclosing party a list of all such material destroyed. 94 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

3. These obligations do not apply to Confidential Information which, as shown by reasonably documented proof: a. Was in the other's possession prior to receipt from the disclosing party; or b. Was received by one party in good faith from a third party not subject to a confidential obligation to the other party; or c. Now is or later becomes publicly known through no breach of confidential obligation by the receiving party; or d. Is disclosed to a third party by the source without a similar nondisclosure restriction; or e. Was developed by the receiving party without the developing person(s) having access to any of the Confidential Information received from the other party; or f. Is authorized in writing by the disclosing party to be released or is designated in writing by that party as no longer being confidential or proprietary. 4. Supplier agrees that either party may disclose Confidential Information to an Affiliate, subject to the terms and conditions set forth herein. For purposes of this Agreement, an Affiliate shall be defined as an entity that controls, is controlled by, or is under common control with such party. 5. Other than as required by law or as set forth in 2(e) or under the Agreement, neither party shall, without the other party’s prior written consent, disclose to any person, or make a public announcement of, the existence of discussions or negotiations or any of the terms relating to the matter of mutual interest described above or any Confidential Information. 6. If a party (“Ordered Party”) receives a request to disclose any Confidential Information of the other party, whether pursuant to a valid subpoena or an order issued by a court or regulatory body (“Ordering Party”), and on advice of legal counsel that disclosure is required by law, then prior to disclosure, the Ordered Party shall (i) notify the other party of the terms of such request and advice, (ii) cooperate with the other party in taking lawful steps to resist, narrow, or eliminate the need for such disclosure, and (iii) if disclosure is nonetheless required, work with the other party to take into account the other party’s reasonable requirements as to its timing, content and manner of making or delivery and use best efforts to obtain a protective order or other binding assurance from the Ordering Party that confidential treatment shall be afforded to such portion of the Confidential Information as is required to be disclosed. The foregoing is without limitation of the other party’s ability to seek a protective order or other relief limiting such disclosure; in such a case, the Ordered Party shall cooperate in such efforts by the other party. 95 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

7. Supplier acknowledges that the proprietary data, know-how, software or other materials or information obtained from a party under this Agreement may be commodities and/or technical data that may be subject to the Export Administration Regulations (the “EAR”) of the United States Department of Commerce as well as trade and economic sanctions subject to the Trading With the Enemy Act (TWEA) and the International Emergency Economic Powers Act (IEEPA) of the Office of Foreign Asset Control within the Department of Commerce, and that any export or re-export thereof must be in compliance with the EAR, TWEA and IEEPA. Each party agrees that it shall not export or re- export, directly or indirectly, either during the term of this Agreement or after its expiration, any commodities and/or technical data (or direct products thereof) provided under this Agreement in any form to destinations in or nationals of Country Groups D:1 or E, as specified in Supplement No. 1 to Part 740 of the EAR, and as modified from time to time by the U.S. Department of Commerce, or to destinations that are otherwise controlled or embargoed under U.S. law in contravention of the EAR or any of the above statutes. 8. It is agreed that a violation of any of the provisions of this Agreement will cause irreparable harm and injury to the non-violating party and that party shall be entitled, in addition to any other rights and remedies it may have at law or in equity, to seek an injunction enjoining and restraining the violating party from doing or continuing to do any such act and any other violations or threatened violations of this Agreement. Absent a showing of willful violation of this Agreement, neither party shall be liable to the other, whether in contract or in tort or otherwise, for special, indirect, incidental or consequential damages including lost income or profits of any kind, even if such party has been advised of the possibility thereof. In no event shall either party be liable to the other for punitive or exemplary damages. 96 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

EXHIBIT G SUMMARY OF VERIZON’S GUIDELINES FOR EVALUATING CRIMINAL RECORD REPORTS 1. Information regarding criminal offenses that is provided by or received about candidates who are under consideration for assignment to provide services to Verizon (the “Candidate”) will not necessarily bar their assignment with Verizon. Each Candidate must be considered on a case-by-case basis. 2. If a Candidate has a criminal record, Supplier must determine whether the disclosed criminal conviction will impair the Candidate’s ability to successfully perform the services that he/she may be assigned. Thus, a conviction may only be used to disqualify a Candidate from assignment if the criminal conviction is related to the nature of the services that he/she may be assigned to perform for Verizon. When determining whether a Candidate should be disqualified from assignment to Verizon due to a criminal record, Supplier must consider the below Mitigating Factors. Although this is not an exhaustive list of factors, these factors must be evaluated along with any other associated extenuating circumstances. 3. These additional guidelines should be used in combination with the Mitigating Factors listed in Section 4 below: • Look at each case individually. • Consider each factor and decision point carefully. • Consider state law requirements - for example, certain states may not allow consideration of misdemeanor convictions. • If additional information is needed, actual court records may be pulled and reviewed prior to making a decision to hire. Additionally, consult Supplier’s background check supplier or counsel if a Candidate has: • Expunged or Sealed Records (Note: certain states do not permit inquiries into expunged or sealed records) • Parolee Status • Pending Charges/Arrests (Note: certain states do not permit inquiries into arrests that have not resulted in a conviction) • Juvenile Records 97 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

4. Mitigating Factors Factors to be Decision Points Considered For all criminal convictions, the nature of the job applied for must be considered. This factor considers the nature and gravity of the offense as it relates to the nature of the position sought. Is the nature of the conviction such that there is a concern for the safety of Verizon employees/customers, protection of company assets, or the confidentiality/sanctity of Verizon records including confidential consumer information? • For jobs involving direct personal contact with Job Relatedness - Nature customers, other employees, or the public, careful of job and crime consideration should be given to whether a Candidate convicted of a crime involving violence presents a significant risk to Verizon, its employees or its customers. • Criminal convictions involving integrity, fraud or theft of property could weigh against Candidates applying for positions with financial responsibility (e.g., cash, etc.) and responsibility for handling proprietary and confidential information (e.g., customer &/or employee information). Was the Candidate a teenager or close to one when s/he committed the crime? If the Candidate was a minor at the Age at time of crime time of the criminal offense, this could weigh in the Candidate’s favor Efforts at rehabilitation and If sentencing required probation, community service or successful completion of other, has the Candidate completed the service? sentencing Time elapsed since If significant time has elapsed since the crime was conviction or final committed, this could weigh in the Candidate’s favor. adjudication If the crime was committed under extenuating Candidate’s explanation of circumstances, which would not be present in the reason crime was workplace, this could weigh in the Candidate’s favor. committed Court records should be pulled and reviewed to validate Candidate’s explanation. 98 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

Successful employment Has the individual held steady employment since the following criminal conviction? Satisfactory employment history since the conviction crime was committed could weigh in the Candidate’s favor. Has the Candidate had additional convictions? Number of criminal If the Candidate is a repeat offender, this could weigh convictions against the Candidate. 99 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential

100 Application Service Provider Agreement - Synchronoss and Verizon Proprietary and Confidential