Penetration Testing Assessment Report

MUTUAL NON-DISCLOSURE AGREEMENT

This Mutual Non-Disclosure Agreement ("Agreement") is entered into as of the date of electronic acceptance by and between Sigma Shake, Inc., a California corporation ("Sigma Shake"), and the individual accepting this Agreement on behalf of themselves and their employer or principal (collectively, "Recipient").

1. DEFINITION OF CONFIDENTIAL INFORMATION

"Confidential Information" means any and all non-public, proprietary, or trade secret information disclosed by Sigma Shake to Recipient, whether orally, in writing, electronically, or by any other means, in connection with Recipient's evaluation of Sigma Shake's security controls documentation. This includes but is not limited to: security architectures, control implementations, vulnerability assessments, penetration test results, audit findings, internal processes, source code evidence, threat models, incident response procedures, infrastructure configurations, encryption methodologies, and any other technical, operational, or business information that is designated as confidential or that a reasonable person would understand to be confidential.

2. OBLIGATIONS OF RECIPIENT

Recipient agrees to: (a) hold all Confidential Information in strict confidence using at least the same degree of care Recipient uses to protect its own most sensitive confidential information, but in no event less than reasonable care; (b) not disclose Confidential Information to any third party without Sigma Shake's prior written consent; (c) restrict access to Confidential Information to only those employees, contractors, and advisors who have a legitimate need to know and are bound by confidentiality obligations no less protective than this Agreement ("Authorized Recipients"); (d) be responsible for any breach by its Authorized Recipients; and (e) not use Confidential Information for any purpose other than evaluating Sigma Shake's security posture.

3. EXCLUSIONS

These obligations do not apply to information that: (a) is or becomes publicly available through no fault of Recipient; (b) was rightfully known by Recipient prior to disclosure, as documented by written records; (c) is rightfully received from a third party without restriction; (d) is independently developed without reference to the Confidential Information; or (e) is required to be disclosed by law or court order, provided Recipient gives Sigma Shake prompt written notice and reasonable opportunity to seek a protective order.

4. NO LICENSE; NO WARRANTY

Nothing in this Agreement grants Recipient any license, right, title, or interest in any Confidential Information or Sigma Shake's intellectual property. All Confidential Information is provided "AS IS" without warranty of any kind.

5. RETURN OR DESTRUCTION

Upon request or termination, Recipient shall within ten (10) business days: (a) return all tangible materials containing Confidential Information; (b) permanently destroy all electronic copies, including backups and cloud storage; and (c) provide written certification signed by an authorized officer confirming complete return or destruction.

6. BREACH NOTIFICATION

Recipient shall notify Sigma Shake in writing within forty-eight (48) hours of discovering any unauthorized access, use, or disclosure of Confidential Information, including: nature of the incident, information affected, corrective actions taken, and a designated point of contact. Recipient shall cooperate fully with any investigation.

7. DATA HANDLING AND SECURITY

Recipient shall implement commercially reasonable safeguards including: (a) encryption at rest and in transit; (b) role-based access controls; (c) audit logs of access; and (d) no storage on personal devices, removable media, or unapproved cloud services without prior written consent.

8. INDEMNIFICATION

Recipient shall indemnify, defend, and hold harmless Sigma Shake from and against any claims, damages, losses, liabilities, costs, and expenses (including attorneys' fees) arising from any breach of this Agreement or unauthorized use or disclosure of Confidential Information.

9. INJUNCTIVE RELIEF

Recipient acknowledges that breach may cause irreparable harm for which monetary damages would be inadequate. Sigma Shake may seek injunctive relief without proving actual damages or posting bond, in addition to any other remedies available.

10. NON-CIRCUMVENTION

Recipient shall not use Confidential Information to: (a) develop competing products or technologies; (b) reverse engineer any described technology; or (c) solicit or recruit Sigma Shake employees or contractors whose identity became known through Confidential Information.

11. NON-ASSIGNMENT

Recipient shall not assign or transfer this Agreement without Sigma Shake's prior written consent. Any attempted unauthorized assignment is void. In the event of a merger, acquisition, or change of control, Sigma Shake may terminate this Agreement upon written notice.

12. TERM

This Agreement remains in effect for two (2) years. Either party may terminate with thirty (30) days' written notice. Confidentiality obligations survive for an additional five (5) years or for so long as the Confidential Information remains a trade secret, whichever is longer.

13. GOVERNING LAW AND DISPUTE RESOLUTION

Governed by the laws of California. Disputes shall first be submitted to JAMS mediation in San Francisco. If unsuccessful within 30 days, resolved by binding JAMS arbitration before a single arbitrator. Either party may seek injunctive relief in court without first submitting to mediation or arbitration.

14. SEVERABILITY

If any provision is held invalid, it shall be modified to the minimum extent necessary, and all remaining provisions continue in full force.

15. ENTIRE AGREEMENT

This Agreement constitutes the entire agreement between the parties regarding confidentiality and supersedes all prior agreements. May be amended only by written instrument signed by both parties.

16. ELECTRONIC ACCEPTANCE

Electronic acceptance constitutes a legally binding signature under the E-SIGN Act and the California Uniform Electronic Transactions Act.

Sigma Shake, Inc. • trust@sigmashake.com • NDA Version 2.0.0