Statement of Work: Platform Audit and Feasibility Assessment

This Statement of Work (this "SOW") is between Dovito® Business Solutions, Ltd. ("Dovito") and the customer who purchases the Platform Audit ("Customer"). It is governed by and incorporates Dovito's Master Services Agreement, version v2026.10, published at dovito.com/legal/msa (the "MSA"). Capitalized terms not defined here have the meanings in the MSA.

1. Service

Dovito will review an application concept, prototype, or existing codebase that Customer identifies (the "Subject System") and assess its technical feasibility, likely development cost, and realistic timeline.

2. Scope

2.1 Materials Review. Dovito will review the materials Customer provides, which may include source code and repositories, design files, technical documentation, user stories, requirements, and project notes (the "Audit Materials").

2.2 Technical Assessment. Dovito will assess, to the extent the Audit Materials allow: architecture; code quality; dependencies and technical debt; scalability and performance considerations; security observations; and technical risks.

2.3 Functional Analysis. Dovito will document intended functionality, map principal user flows, identify gaps between requirements and implementation, and group features by estimated complexity.

3. Deliverables

Each Deliverable is licensed under MSA Section 8.3 and is not an Assigned Deliverable.

4. Out of Scope

This SOW does not include: development or code changes; penetration testing, vulnerability scanning of live systems, or any security certification; deployment or hosting; ongoing maintenance or support; project management beyond the audit; training; third-party service configuration; or legal review of licenses, contracts, or regulatory obligations. These may be offered under a separate SOW.

5. Customer Responsibilities

Customer will provide, within 5 business days after payment:

1. Read access to the complete source code (repository access or file transfer).
2. Design files (for example, Figma).
3. Available documentation, requirements, and a description of business objectives and target launch timeline.
4. A description of third-party integrations. Customer will share any credentials only through the secure method Dovito designates, and never by plain email.

Customer represents and warrants that it owns or has the right to share the Audit Materials with Dovito for this purpose, and that doing so does not breach any agreement with a third party, including any developer, contractor, or former vendor. MSA Sections 5.3 and 16.2 apply.

6. Schedule

Dovito will deliver D1 through D3 within 5 to 8 business days after the later of payment and Dovito's receipt of complete Audit Materials. This is an estimate under MSA Section 3.3. Dovito will provide email updates and one follow-up call of up to 60 minutes to discuss the findings, which must be scheduled within 30 days after delivery.

7. Fees and Payment

1. Fee: As stated on Dovito's invoice or checkout page.
2. Payment: Due in full on invoice and before work begins.
3. Refunds: Customer may cancel for a full refund before Dovito begins reviewing the Audit Materials. Once review begins, the fee is non-refundable, except as provided in MSA Section 14.3.
4. Acceptance: Deliverables are subject to MSA Section 7.

8. Nature and Reliance

8.1 Point-in-Time Estimate. The Deliverables reflect the Audit Materials and information available to Dovito at the time of the audit. Budgets and timelines are professional estimates based on stated assumptions, not fixed quotes or guarantees. Actual cost and duration depend on scope decisions, team composition, third-party changes, and other factors outside Dovito's control. Findings are current for 90 days, after which material changes may require reassessment.

8.2 Not Exhaustive. The audit is a review of the Audit Materials, not a guarantee that the Subject System is free of defects, vulnerabilities, license issues, or other problems. Dovito may not identify every issue. Security observations are not a penetration test or security certification.

8.3 Internal Use Only. The Deliverables are for Customer's internal decision-making. Customer will not provide them to, and no third party (including investors, lenders, acquirers, insurers, or other developers) may rely on them, without Dovito's prior written consent. Notwithstanding MSA Section 16.2, which this sentence expands for this SOW only as permitted by MSA Section 2.4, Customer will also defend and indemnify Dovito against claims by any third party to whom Customer provides the Deliverables without that consent.

8.4 No Professional Advice. MSA Section 14.6 applies. The audit does not include legal advice about software licenses, contracts, intellectual property ownership, or regulatory compliance.

9. Confidentiality and Data

Dovito will treat the Audit Materials as Customer's Confidential Information under MSA Section 11 and will use them only to perform this SOW. Customer will not include protected health information, payment card data, or production personal data in the Audit Materials unless Dovito agrees in writing beforehand. Within 30 days after delivery, Dovito will delete or return copies of the Audit Materials and revoke any access it holds, except as permitted by MSA Section 11.6.

10. Next Steps

Customer has no obligation to engage Dovito for development. If Customer does, the Parties will sign a separate SOW.

11. Acceptance of this SOW

Customer accepts this SOW and MSA version v2026.10 by signing a copy of it, by checking the acceptance box at checkout, or by paying the invoice for the Platform Audit, whichever happens first.