Supplemental Underwriting Questionnaire

GlassPearl LLC | Technology E&O / Cyber (The Hartford) and Crime / Social Engineering (Chubb). Martin, your carrier applications are already about two thirds complete using the information you have provided. The questions below are the only remaining items the underwriters require. Answer what you can, mark anything uncertain as such. Nothing here binds coverage.

Your Name *

Email *

A. Company and Financial

A1. Projected total operating expenses for the next 12 months ($)

A2. Will any revenue in the next 12 months come from operations or customers outside the United States?

If yes, approximate percentage of revenue (%). Your intake said US only, but we have discussed occasional Europe. Please confirm.

A3. Will any current or prospective customers use your compute capacity for cryptocurrency or blockchain workloads (including mining)?

A4. Typical annual revenue size of the customers you serve

B. Customer Environment Access and Software

B1. Will GlassPearl personnel have administrative or remote access to customer environments, including out-of-band or baseboard management (BMC / IPMI / remote KVM)?

If yes, which controls are in place:

B2. Does GlassPearl develop, license, or maintain any software code for customers?

C. Contracts and Subcontractors

C1. Does a qualified attorney review all customer contract wording before execution?

C2a. Do your standard customer contracts (MSA) include limitation of liability for consequential damages?

If yes: percentage of contracts containing it (%)

Is the cap equal to or less than contract value?

C2b. Liquidated damages payable by GlassPearl?

C2c. Disclaimer of warranties?

C2d. Hold harmless in GlassPearl's favor?

C3. Formal customer acceptance and sign-off procedure for delivered work or contract changes?

C4. Written procedures to resolve customer disputes over fees or charges?

C5. Approximate percentage of revenue delivered through subcontractors (%)

C6. Do you require subcontractors to carry at least $1,000,000 of professional or technology liability and collect proof?

C7. Do subcontractor agreements include hold harmless language in GlassPearl's favor?

D. Cybersecurity Controls

D1. Who is responsible for information security (name, title, and firm if outsourced)?

D2. Is there a dedicated cybersecurity team or vendor monitoring your network?

D3. Is multi-factor authentication (MFA) required for ALL remote access to your network and systems?

D4. Is MFA required for email access?

D5. Is antivirus / endpoint protection running on all computers and servers?

D6. Is an EDR or MDR product in place?

EDR/MDR product name

D7. Email security in place:

If secure email gateway, product name

D8. Critical data backups:

Stored offline / isolated?

D9. How often do you test restoring from backup?

D10. Cyber incident response / business continuity plan in place?

Tested:

D11. Roughly how many individuals' or organizations' nonpublic records will you store or process?

D12. Is that data encrypted at rest?

Encrypted in transit?

Encrypted on mobile devices?

D13. Security awareness / antiphishing training frequency:

D14. Has GlassPearl acquired or filed any trademarks? If yes, were they screened for infringement?

E. Banking and Funds Transfer Controls (Chubb crime / social engineering)

E1. Who performs due diligence on vendors and suppliers (name and title)?

E2. Number of active vendors and suppliers to date

Do you maintain a master vendor file?

E3. ACH payments: number (or write None)

ACH payments: total $

Wires: number

Wires: total $

Largest single payment $

E4. Do you use a service to validate vendor bank account ownership (for example GIACT, Plaid, PaymentWorks)?

E5. Before any wire or vendor bank account change, is the request verified by a phone call to a known number (never by replying to the email)?

E6. Does your online banking enforce segregation of duties, so no single person can both initiate and release a payment?

E7. Do you hold, transfer, or take custody of any client funds?

E8. Do you have a WRITTEN wire transfer procedure and a wire transfer authority matrix? Chubb requires both documents to quote the $1,000,000 social engineering limit. If you do not have them, check No and Safeshield will provide templates for you to adopt.

E9. Are employees who process payment or bank change requests trained on these procedures?

F. Confirmations and Elections

F1. Confirm that no founder, officer, or member has ever been subject to professional disciplinary or criminal action by any authority.

F2. Confirm that no one at GlassPearl is aware of any error, incident, or circumstance that could reasonably give rise to a claim.

F3. Confirm GlassPearl LLC is not a subsidiary of any parent company. We will disclose Globalscale Holdings CY LTD's 50% membership interest to the underwriters; is that ownership description accurate?

F4. Preferred retention (deductible) for the Tech E&O / Cyber policy:

F5. Anything else the underwriters should know?

Completed by

Title

Your information is secure and will only be used to provide an insurance quote.