PART 1: B2B TERMS OF SERVICE

Effective Date: November 12, 2026 Provider: ProvaSapien LLC (Tennessee), doing business as ProvaTrace ("ProvaTrace," "Provider," "we," or "us")

IMPORTANT — READ CAREFULLY: THESE B2B TERMS OF SERVICE ("AGREEMENT") GOVERN ALL ACCESS TO AND USE OF THE PROVATRACE SOFTWARE-AS-A-SERVICE PLATFORM, PUBLIC COMPLIANCE CALCULATORS, SANDBOX TOOLS, EMAIL INGESTION ENDPOINTS, AND DOCUMENTATION (COLLECTIVELY, THE "SERVICE"). BY CLICKING "I AGREE," EXECUTING A PILOT LETTER OF INTENT OR ORDER FORM, OR UPLOADING ANY DOCUMENT TO THE SERVICE, THE BUSINESS ENTITY YOU REPRESENT ("CUSTOMER" OR "YOU") AGREES TO BE BOUND BY THIS AGREEMENT.

1. Strictly Commercial B2B Scope & Authority

1.1 B2B Commercial Use Only. The Service is designed, offered, and licensed exclusively for commercial, industrial, and business-to-business ("B2B") use by machine shops, metal fabricators, manufacturers, distributors, and quality assurance professionals. The Service is not intended for personal, family, or household consumer use, and consumer protection statutes applicable solely to retail consumer transactions do not apply. 1.2 Authority to Bind. The individual accepting this Agreement represents and warrants that they are at least eighteen (18) years of age and have full legal authority to bind Customer to this Agreement. If you do not have such authority, or do not agree to these terms, you must not access or use the Service.

2. Clerical Decision-Support Scope & Mandatory Human-in-the-Loop QA Verification

2.1 Clerical Extraction & Arithmetic Comparison Only. Customer acknowledges and agrees that ProvaTrace is strictly an administrative document-indexing, optical character recognition ("OCR"), coordinate-highlighting, and deterministic arithmetic comparison utility. 2.2 No Metallurgy, Professional Engineering (PE), or Autonomous Material Release. ProvaTrace does NOT:

• (a) engage in the practice of licensed Professional Engineering ("PE"), metallurgical engineering, materials science consulting, or legal/regulatory advice;
• (b) perform physical, chemical, mechanical, or non-destructive laboratory testing, or independently verify the authenticity or truthfulness of any mill, foundry, or supplier test report; or
• (c) autonomously approve, certify, quarantine, or release raw materials for manufacturing, aerospace flight hardware, defense contracts, pressure vessels, medical devices, or AS9100 / ISO 9001 / ASME / API / ISO 13485 quality management compliance.

2.3 Inherent OCR & Document Parsing Limitations. Automated PDF text extraction and Vision OCR—especially on multi-generation faxed, stamped, skewed, low-DPI, or handwritten Mill Test Reports ("MTRs" or "CMTRs")—can misread characters, decimal places, units of measure, element headers, or country names, and may produce false positives or false negatives. Every uploaded document enters the Service in a PENDING_HUMAN_VERIFICATION state. 2.4 Mandatory Human-in-the-Loop ("HITL") Inspector Verification. PRIOR TO RELEASING ANY RAW MATERIAL TO PRODUCTION, CUTTING METAL, GENERATING AN AS9102 FIRST ARTICLE INSPECTION ("FAI") REPORT, COMPILING A CUSTOMER CERTIFICATION PACK, OR SHIPPING ANY PART, CUSTOMER'S QUALIFIED QUALITY INSPECTOR OR ENGINEER MUST VISUALLY VERIFY ALL EXTRACTED VALUES, UNITS, HEAT/LOT NUMBERS, SPECIFICATION LIMITS, AND MELT-COUNTRY ORIGINS DIRECTLY AGAINST THE ORIGINAL SOURCE MILL TEST REPORT. Clicking "Confirm Match Against Original Document & Log Lot" (or exporting records from the Service) constitutes Customer's sole, independent quality release decision under Customer's Quality Management System ("QMS"). 2.5 Statutory Lookup Disclaimer. The Service's DFARS 252.225-7009 (10 U.S.C. § 4863) and DFARS 225.872-1 Qualifying Country indicator checks supplier-stated melt/smelt country strings against published federal statutory lists as an administrative convenience. It does not evaluate prime-contract flow-down waivers, domestic non-availability determinations ("DNADs"), COTS exceptions, electronic-component carve-outs, or changes in federal acquisition regulations enacted prior to software updates. Customer remains 100% responsible for verifying prime-contract flow-down compliance.

3. Export Control, No-ITAR & No-CUI Prohibition

3.1 Commercial Non-GovCloud Infrastructure. Customer acknowledges that ProvaTrace operates on standard commercial US cloud infrastructure and is not a FedRAMP High, DoD IL4/IL5, or ITAR-registered sovereign defense enclave. 3.2 Strict Raw-Material Certificate Boundary (Prohibited Data). Customer represents, warrants, and covenants that all files uploaded, emailed, or transmitted to the Service consist solely of commercial raw-material test reports, chemical/mechanical certificates of conformance, and non-restricted receiving records, and contain ZERO:

• (a) ITAR Technical Data controlled under the International Traffic in Arms Regulations (22 CFR Parts 120–130) or the U.S. Munitions List ("USML");
• (b) EAR-Restricted Defense/Space Technical Data controlled under Export Control Classification Numbers ("ECCNs") outside EAR99 (including any 600-series or 9x515 items);
• (c) Controlled Unclassified Information ("CUI") subject to 32 CFR Part 2002 or DFARS 252.204-7012 safeguarding mandates, Defense Critical Infrastructure Security Information, or Naval Nuclear Propulsion Information ("NNPI");
• (d) Classified National Security Information, NOFORN materials, or DoD Distribution Statement D, E, or F documents; or
• (e) Customer or Prime-Contractor Part Blueprints, 2D Engineering Drawings, or 3D CAD Models. (If a supplier bundles a controlled part drawing into the same PDF as an MTR, Customer must strip the drawing pages prior to uploading the raw-material MTR pages.)

3.3 Automated Pre-Ingestion Firewall & Purge Authorization. Customer expressly authorizes ProvaTrace to execute automated deterministic text and metadata screening on inbound uploads prior to persistent storage. Any file exhibiting export-control or restricted markings (including ITAR, 22 CFR, EXPORT CONTROLLED, CUI //, NOFORN, or DISTRIBUTION STATEMENT D/E/F) may be immediately rejected, zero-filled in memory, and purged without storage, logging only non-content security metadata. Automated screening is a defense-in-depth safeguard for Provider and does not relieve Customer of its strict compliance warranty under Section 3.2. 3.4 U.S. Entity & Sanctions Representation. Customer represents that neither Customer nor any of its authorized users is located in an embargoed jurisdiction or listed on any U.S. Government denied-party list (including OFAC SDN or BIS Entity List).

4. Customer-Owned Tolerance Profiles & Copyright-Clean Architecture

4.1 No Embedded Third-Party Copyrighted Standards. ProvaTrace does not sell, license, embed, or redistribute copyrighted specification tables from standards development organizations (including ASTM International, SAE International / AMS, ASME, ISO, AIA/NAS, API, or UL). 4.2 Customer-Supplied Material Master & PO Specifications. The Service performs mathematical range checks exclusively against:

• (a) minimum/maximum specification rows printed directly on the uploaded Mill Test Report by the issuing mill or supplier;
• (b) Customer-Owned Tolerance Profiles (Material Master or Purchase Order limits) manually entered or imported by Customer into Customer's isolated workspace; and
• (c) public-domain U.S. federal law (10 U.S.C. § 4863 / DFARS 252.225-7009).

4.3 Customer Ownership & Responsibility for Material Master Data. Customer retains exclusive ownership of its Material Master configurations and warrants that it possesses valid internal business rights (such as lawfully purchased standards copies or customer PO flow-downs) to reference and enter any acceptance limits into its private workspace. Customer is solely responsible for verifying that its Material Master tolerances match the applicable revision level required by its customer Purchase Order.

5. Subscriptions, Fair-Use Quotas & Stripe Billing

5.1 Subscription Tiers & Document Quotas. Paid subscriptions are billed monthly or annually in advance in accordance with the plan selected at checkout or in a signed Pilot Agreement (e.g., Shop Starter up to 150 MTRs/mo; AS9100 Pro up to 500 MTRs/mo; Multi-Site / Enterprise up to 2,000 MTRs/mo; Free Compliance Utility limited to 3 sandbox MTR checks/mo with zero vault archival). 5.2 Technical Guardrails. To protect platform reliability and prevent denial-of-wallet abuse, uploads are subject to deterministic file guardrails (15 MB and 25 pages maximum per MTR PDF unless otherwise specified in Customer's plan). 5.3 PCI-DSS Compliant Third-Party Billing. All credit card and ACH payments are processed directly by Stripe, Inc. via Stripe Checkout and the Stripe Customer Billing Portal (PCI-DSS SAQ-A). ProvaTrace never receives, stores, or processes raw payment card numbers or CVV codes. Subscriptions renew automatically for successive billing periods of equal length unless canceled by Customer via 1-click self-serve cancellation in the Billing Portal (or written notice to legal@provatrace.com) prior to the renewal date. 5.4 Taxes. Fees are exclusive of applicable state or local sales, use, or value-added taxes, which will be itemized at checkout where required by law.

6. Intellectual Property, Customer Data Ownership & Portability

6.1 Customer Data Ownership. As between the parties, Customer retains 100% ownership, title, and intellectual property rights in and to all uploaded MTR PDFs, supplier records, PO/Work Order metadata, Material Master tolerances, QA verification logs, and exported compliance packages ("Customer Data"). ProvaTrace claims zero ownership over Customer Data. 6.2 Limited License to Host & Process. Customer grants ProvaTrace a limited, non-exclusive, non-transferable license during the Subscription Term solely to host, parse, encrypt, index, back up, and display Customer Data to Customer's authorized workspace users as required to provide the Service. ProvaTrace never sells Customer Data and never uses Customer Data to train public or multi-tenant foundation AI models. 6.3 1-Click Zero-Ransom Data Portability. At any time during an active subscription—and for thirty (30) days following cancellation or expiration—Customer may execute a self-serve 1-Click Full Archive Export (ZIP + CSV) downloading all stored original MTR PDFs, structured Heat-Lot CSV indexes, AS9102 Form 2 schedules, and SHA-256 verification logs at $0 additional fee. 6.4 Provider IP. ProvaTrace retains all right, title, and interest in and to the Service software, user interface, deterministic validation code, public-statute rule engines, trademarks, and documentation.

7. Disclaimer of Warranties

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICE, ALL OCR OUTPUTS, ARITHMETIC COMPARISONS, DFARS ORIGIN FLAGS, AND EXPORT TEMPLATES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITH ALL FAULTS. PROVATRACE EXPRESSLY DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ERROR-FREE OR UNINTERRUPTED OPERATION, OR 100% OCR OR REGULATORY ACCURACY. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY PROVATRACE SHALL CREATE ANY WARRANTY OR EXPAND THE SCOPE OF THIS AGREEMENT.

8. Limitation of Liability

8.1 EXCLUSION OF CONSEQUENTIAL & MANUFACTURING DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL PROVATRACE, ITS OWNER, MEMBERS, OFFICERS, CONTRACTORS, OR LICENSORS BE LIABLE UNDER ANY CONTRACT, NEGLIGENCE, STRICT LIABILITY, TORT, OR OTHER LEGAL OR EQUITABLE THEORY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING WITHOUT LIMITATION:

• (a) MATERIAL SCRAP, MACHINING REWORK, TOOLING DAMAGE, OR PRODUCTION LINE DOWNTIME;
• (b) PRODUCT RECALL, FIELD FAILURE, AVIATION/DEFENSE/MEDICAL INCIDENT, OR DOWNSTREAM CUSTOMER CHARGEBACKS OR LIQUIDATED DAMAGES;
• (c) AS9100 / ISO 9001 / NADCAP REGISTRAR AUDIT FINDINGS, CORRECTIVE ACTION REQUESTS ("CARs/SCARs"), SUSPENSION OF CERTIFICATION, OR DEBARMENT; OR
• (d) LOSS OF PROFITS, REVENUE, CONTRACTS, GOODWILL, OR DATA,

EVEN IF PROVATRACE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND REGARDLESS OF WHETHER ANY REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

8.2 HARD AGGREGATE LIABILITY CAP. TO THE MAXIMUM EXTENT PERMITTED BY LAW, PROVATRACE'S TOTAL CUMULATIVE AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE SERVICE—WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR OTHERWISE—SHALL STRICTLY NOT EXCEED:

• (a) FOR PAID SUBSCRIPTION OR PAID PILOT CUSTOMERS: THE TOTAL SUBSCRIPTION FEES ACTUALLY PAID BY CUSTOMER TO PROVATRACE DURING THE THREE (3) MONTHS IMMEDIATELY PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY; OR
• (b) FOR USERS OF THE FREE COMPLIANCE UTILITY, UNAUTHENTICATED CALCULATORS, OR FREE SANDBOX: ONE HUNDRED U.S. DOLLARS ($100.00 USD) IN THE AGGREGATE.

8.3 Essential Basis of the Bargain. Customer acknowledges that ProvaTrace's subscription fees ($199–$599/mo) reflect a clerical software tool pricing model—not metallurgical insurance or quality-release underwriting—and that ProvaTrace would not provide the Service without the liability caps and HITL verification covenants in Sections 2, 7, 8, and 9.

9. Customer Indemnification

Customer agrees to defend, indemnify, and hold harmless ProvaTrace and its Owner, members, officers, and affiliates from and against any and all third-party claims, government investigations, fines, damages, losses, liabilities, costs, and reasonable attorneys' fees arising out of or relating to:

1. Customer's release, machining, fabrication, sale, or certification of any material or component without performing independent human inspection against the source MTR as required by Section 2.4;
2. Any breach by Customer of Section 3 (Export Control, No-ITAR & No-CUI Prohibition), including uploading ITAR, EAR-controlled, or CUI technical data; or
3. Any inaccuracy or third-party intellectual property claim arising from Customer Data or Customer-supplied Material Master tolerances under Section 4.

10. Term, Termination, Emergency Suspension & General Terms

10.1 Termination. Customer may cancel its subscription at any time effective at the end of the current billing cycle (or during a Pilot opt-out window per Part 3). ProvaTrace may suspend or terminate access immediately upon written notice if Customer violates Section 3 (ITAR/CUI upload), initiates abusive denial-of-wallet traffic, or fails to cure non-payment within ten (10) days. 10.2 Governing Law & Venue. This Agreement is governed by the laws of the State of Tennessee, without regard to conflict-of-laws principles. Any dispute arising under this Agreement shall be resolved exclusively in the state or federal courts located in Knox County, Tennessee, and each party waives any objection to jurisdiction or venue therein. EACH PARTY KNOWINGLY WAIVES ANY RIGHT TO A TRIAL BY JURY OR TO PARTICIPATE IN A CLASS ACTION. 10.3 Entire Agreement & Severability. This Agreement (together with the Privacy Policy in Part 2 and any executed Pilot LOI in Part 3) constitutes the entire agreement between the parties and supersedes any conflicting boilerplate terms on a Customer Purchase Order or vendor portal clickwrap. If any provision is held unenforceable, it shall be modified to the minimum extent necessary to make it enforceable while preserving the remaining Agreement in full force.

PART 2: PRIVACY, SECURITY & DATA HANDLING POLICY

Effective Date: November 12, 2026 Data Controller / Service Provider: ProvaSapien LLC d/b/a ProvaTrace

ProvaTrace is built for precision machine shops and fabricators whose supplier chains, heat-lot histories, and customer PO numbers are commercially sensitive trade secrets. Our data handling commitments are simple, verifiable, and strictly enforced.

1. Core Privacy Commitments at a Glance

1. Zero Sale of Customer Data: We never sell, rent, broker, or trade Customer MTRs, supplier names, heat numbers, pricing, PO numbers, or user email lists to third parties, metal brokers, or data aggregators.
2. Zero AI Model Training on Customer MTRs: We never use Customer MTRs, uploaded PDFs, Material Master tolerances, or workspace metadata to train, fine-tune, or improve public, third-party, or multi-tenant foundation AI/ML models.
3. 100% US-Pinned Processing & Zero-Data-Retention ("ZDR") OCR: Native digital PDFs are parsed deterministically without external AI calls. When scanned/rasterized image MTRs require Vision OCR, requests are routed exclusively to US-region endpoints configured with contractual 0-day Zero-Data-Retention and zero training rights.
4. Zero Lock-In (ZIP + CSV Portability): Your quality archive belongs to your shop—export every PDF, CSV index, and SHA-256 verification log in 1 click at any time.

2. Categories of Data Collected

• B2B Account & Workspace Information: Work email address, user name, job title, company name, role permissions, and login session identifiers.
• Uploaded Compliance Records ("Customer Data"): Raw-material Mill Test Reports (PDFs), Material Master tolerance rules, PO / Work Order tags, Heat/Lot numbers, and inspector verification audit trails (verified_by_user_id, verified_at_utc, source_pdf_sha256).
• Billing Metadata (PCI-DSS SAQ-A): Stripe customer ID, subscription tier, invoice status, and last-4 card digits. Raw credit card numbers and CVV codes are collected and stored exclusively by Stripe, Inc. and never touch ProvaTrace servers.
• Operational & Security Telemetry: Upload file sizes, page counts, error logs, IP addresses for rate-limiting/authentication, and non-content export-control firewall rejection timestamps.

3. Encryption, Multi-Tenant Isolation & Security Controls

• Encryption in Transit & at Rest: All network traffic is encrypted using TLS 1.3 (HTTPS). All database records, object-storage MTR PDFs, and automated daily backups are encrypted at rest using AES-256.
• Strict Multi-Tenant Isolation: Every database table and object-storage prefix enforces strict Row-Level Security (RLS) keyed on tenant_id. Document viewing uses cryptographically signed, short-lived URLs (<= 15 minutes TTL).
• Immutable Audit Integrity: Every verified MTR generates a cryptographic SHA-256 digest of the source PDF tied to the approving inspector's user ID and UTC timestamp to support AS9100 Rev D Clause 7.5 documented-information integrity.

4. Restricted Data & Pre-Storage ITAR/CUI Firewall

• ProvaTrace is designed strictly for raw-material certificates and non-classified commercial quality records.
• Inbound uploads pass through a deterministic pre-storage text/metadata scanner (ITAR, 22 CFR, EXPORT CONTROLLED, CUI //, NOFORN, DISTRIBUTION STATEMENT D/E/F). Flagged files are aborted in volatile memory prior to disk persistence or external OCR dispatch, recording only a metadata rejection event (doc_rejected_export_control_flag) for Customer's Quality Manager.

5. Subprocessors & Third-Party Infrastructure

ProvaTrace utilizes a minimal set of vetted Tier-1 US commercial infrastructure subprocessors solely to deliver the Service:

1. Cloud Application, PostgreSQL Database & Encrypted Object Storage (US Regions) — Hosting, RLS database storage, and encrypted PDF vaulting.
2. Stripe, Inc. (US) — PCI-DSS Level 1 subscription checkout, invoicing, and self-serve billing portal.
3. US-Pinned Zero-Data-Retention Vision/OCR Provider (US Region, 0-day retention, training disabled) — Invoked strictly as fallback on non-searchable scanned image PDFs.
4. Transactional Email Relay (US) — Passwordless/auth magic links, optional certs@<shop> inbound routing, and system receipts.

6. Data Retention, 1-Click ZIP + CSV Portability & Deletion Rights

• Active Vault Retention: Because AS9100 and ISO 9001 shops rely on ProvaTrace for multi-year registrar traceability, Customer Data is retained continuously throughout an active subscription unless deleted earlier by Customer's Workspace Administrator.
• Self-Serve 1-Click Portability (ZIP + CSV): Workspace Administrators can download a complete, structured archive containing (1) all original MTR PDF files organized by Year / Heat_Number / PO_Number, (2) master heat_lots.csv and as9102_form2.csv indexes, and (3) audit_verification_log.csv with SHA-256 hashes at any time in 1 click.
• Self-Serve Workspace Deletion & Post-Cancellation Purge:
  • Immediate Purge on Demand: Workspace Administrators may delete individual MTRs or trigger a complete "Delete Workspace & Purge All Data" action from Settings (removing live database rows and object-storage PDFs immediately, with encrypted disaster-recovery snapshots aging out automatically within 30 days).
  • Standard Post-Cancellation Window: Upon subscription cancellation without an immediate purge request, Customer retains read-only export access for thirty (30) days to download its ZIP + CSV archive, after which all Customer Data is permanently purged.
• Unauthenticated Sandbox Uploads: Any sample PDF tested in the free unauthenticated Sandbox is processed transiently and automatically purged within 24 hours (zero long-term vaulting).

7. B2B Corporate Privacy Rights & CAN-SPAM Compliance

• Access, Correction & Deletion Requests: Any individual or Customer administrator may request access to, correction of, or deletion of their account data (including rights under the California Consumer Privacy Act / CPRA where applicable to B2B contacts) by emailing legal@provatrace.com. We respond within 10 business days and never discriminate for exercising privacy rights.
• Commercial Email & Instant Opt-Out: Any outbound informational or promotional B2B email sent by ProvaTrace includes our valid business mailing address (ProvaSapien LLC, Legal & Compliance Dept., Knoxville, TN (physical notice address furnished on executed commercial Order Forms)) and a deterministic 1-click Unsubscribe link honored automatically in < 1 hour. Transactional security and billing receipts remain active for subscribed workspaces.

PART 3: FOUNDING SHOP 30-DAY PAID PILOT LETTER OF INTENT (LOI) & AGREEMENT

Clean 1-Page Plain-English B2B Pilot Agreement for Founding AS9100 & ISO 9001 Machine Shops

PROVATRACE — 30-DAY FOUNDING SHOP PILOT AGREEMENT

Date: ____________________ Provider: ProvaSapien LLC d/b/a ProvaTrace (ProvaSapien LLC, Legal & Compliance Dept., Knoxville, TN (physical notice address furnished on executed commercial Order Forms) | legal@provatrace.com) Founding Customer ("Shop"): ________________________________________ Primary QA Contact & Title: ________________________________________ (Email: ______________________)

1. Purpose

This 1-page Founding Shop Pilot Agreement sets up a 30- calendar-day production pilot of ProvaTrace so Shop's Quality and Receiving team can verify incoming Mill Test Reports (MTRs), check DFARS 252.225-7009 melt origin, and export AS9102 raw-material documentation on real shop-floor certificates with zero long-term lock-in and zero setup fees.

2. Selected Founding Shop Tier ($0 Setup — Select One)

• Shop Starter — $199 / month (Up to 150 MTRs/mo, up to 3 user seats, OCR bounding-box chemistry/mechanical check, DFARS 252.225-7009 melt-country verifier, 10-year searchable Heat-Lot Vault, 1-click ZIP + CSV export).
• AS9100 Pro — $349 / month (Up to 500 MTRs/mo, unlimited shop seats, dedicated certs@ receiving email ingestion, 1-click AS9102 Form 2 FAI export, 1-click merged PDF Customer Cert Pack compiler, Non-Conformance CAR log, 10-year Heat-Lot Vault).

(Founding Shop Rate Guarantee: As a Founding Pilot Shop, your selected monthly rate above is locked against price increases for 24 months following pilot completion.)

3. Objective 30-Day Pilot Success Criteria

During the 30-day Pilot Period (starting on workspace activation), ProvaTrace will be evaluated against three concrete operational benchmarks on Shop's commercial raw-material certificates:

1. < 30-Second MTR Verification Workflow: Side-by-side extraction and clickable PDF bounding-box highlight of Heat/Lot #, alloy chemistry, mechanical properties, and spec min/max comparisons enabling human QA Inspector verification in under 30 seconds per standard MTR.
2. 100% DFARS Melt-Country Rule Accuracy: 100% deterministic statutory accuracy checking extracted/selected Melt & Smelt countries against the federal DFARS 252.225-7009 (10 U.S.C. § 4863) & DFARS 225.872-1 Qualifying Countries schedule.
3. 1-Click AS9102 Form 2 & Full Archive Export: Instant 1-click export of verified raw-material rows formatted for AS9102 Rev C Form 2 (CSV/Excel) plus anytime 1-click ZIP + CSV full vault export of all PDFs and SHA-256 verification logs.

4. Seamless Continuation OR 1-Click Zero-Obligation Opt-Out

• Automatic Month-to-Month Continuation if Satisfied: If Shop is satisfied at the end of Day 30, no extra paperwork is required—Shop's workspace continues seamlessly on a month-to-month basis at the Founding Shop rate selected in Section 2 (cancelable anytime in 1 click prior to any future monthly billing date).
• 1-Click Zero-Obligation Opt-Out (& Performance Refund Guarantee): At any point on or before Day 30, Shop may opt out with 1 click inside Workspace Billing Settings or by sending a 1-line email ("OPT OUT") to legal@provatrace.com with zero ongoing obligation, zero cancellation fee, and full 1-click ZIP + CSV download of all pilot records. Furthermore, if ProvaTrace fails to meet any of the three Success Criteria in Section 3 during the 30-day Pilot and Shop opts out by Day 30, ProvaTrace will refund 100% of the initial 30-day Pilot fee within 5 business days.

5. Clean Compliance Guardrails (Incorporation of B2B Terms)

This Pilot incorporates the ProvaTrace B2B Terms of Service and Privacy Policy (Parts 1 and 2 above), including: (a) Shop's QA Inspector performs final visual verification against the original MTR before releasing material to production (HITL clerical tool scope; 3-month fee liability cap); (b) Shop uploads raw-material certs only (zero ITAR 22 CFR 120–130 technical data, CUI, or part CAD blueprints); (c) Shop supplies its own internal Material Master/PO limits if used; and (d) ProvaTrace never sells Shop data and never trains AI models on Shop MTRs.

ACCEPTED AND AGREED BY: