REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
September 10, 2024
FROM
LYNN FYHRLUND, Chief Information Officer, Innovation and Technology Department
SUBJECT
Title
End User License Agreement with Xecurify Inc. DBA miniOrange Security Software Pvt Ltd. for Enhanced Website Performance Software
End
RECOMMENDATION(S)
Recommendation
1. Approve End User License Agreement with Xecurify Inc., DBA miniOrange Security Software Pvt Ltd., including non-standard terms, simultaneously terminating Contract No. 21-922, for the use of enhanced website performance software known as miniOrange WordPress plugin retroactively effective January 5, 2024, and continuing until terminated by either party.
2. Authorize the Chief Information Officer or Assistant Chief Information Officer to electronically accept the End User License Agreement with Xecurify Inc., DBA miniOrange Security Software Pvt Ltd., and any non-substantive amendments, as they pertain to changes in the use of the WordPress plugin, subject to review by County Counsel.
3. Direct the Chief Information Officer or Assistant Chief Information Officer to transmit printed copies of any non-substantive amendments to the End User License Agreement related to the use of the WordPress plugin that are electronically accepted to the Clerk of the Board of Supervisors within 30 days of acceptance.
(Presenter: Lynn Fyhrlund, Chief Information Officer, 388-5501)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Improve County Government Operations.
Operate in a Fiscally-Responsible and Business-Like Manner.
FINANCIAL IMPACT
Approval of the item will not result in the use of Discretionary General Funding (Net County Cost). The End User License Agreement (EULA) is non-financial in nature and does not commit the County to make any purchases. If future purchases are made under the EULA, the Innovation and Technology Department (ITD) will adhere to County purchasing policies and return to the Board of Supervisors (Board) for approval, if necessary.
BACKGROUND INFORMATION
ITD continues to modernize its existing platform for web content creation to provide enhanced functionality by using the open-source content management system, WordPress, for its templates and plugin architecture. A plugin is a third-party software component that enables customization by adding a specific feature to a website or application. By utilizing plugins, ITD can extend and expand the functionality of web content and application management platforms. The miniOrange software WordPress plugin (miniOrange) offered through Xecurify Inc., DBA miniOrange Security Software Pvt Ltd. (Xecurify) enhances site performance and response time for County websites developed and supported by WordPress template and plugin architecture.
On December 7, 2021 (Item No. 26), the Board approved non-financial End User License Agreement No. 21-922 and non-financial Service Level Agreement No. 21-923 (including non-standard terms), allowing ITD to utilize the miniOrange plugin for the period of December 7, 2021 through December 6, 2026.
The terms of the EULA are accepted upon downloading, installing or using the Xecurify software. Upon ITD’s annual review of these terms in July 2024, it was determined that Xecurify had issued a new EULA on January 5, 2024, which County Counsel advised supersedes the previously approved Contract No. 21-922.
The EULA is Xecurify’s standard commercial contract, which includes terms that differ from the standard County contract and omits certain County standard contract terms. The EULA is a non-negotiable clickwrap agreement accepted by downloading, installing or using the Xecurify software. The non-standard and missing terms include the following:
1. Governing law is the State of Wyoming.
• The County standard contract requires California governing law.
• Potential Impact: The EULA will be interpreted under Wyoming law. Any questions, issues or claims arising under the EULA will require the County to hire outside counsel competent to advise on Wyoming law, which may result in fees that exceed the total EULA amount.
2. Xecurify may assign the EULA to any party through merger, stock or asset sale, or other acquisition, without notice to the County and without the County’s approval.
• The County standard contract requires that the County must approve any assignment of the contract.
• Potential Impact: Xecurify could assign the EULA to a third party or business with which the County is legally prohibited from doing business due to issues of Federal debarment or suspension and conflict of interest, without the County’s knowledge. Should this occur, the County could be out of compliance with the law until it becomes aware of the assignment and terminates the EULA.
3. There is no provision in the EULA addressing each party’s responsibility for paying attorneys’ fees.
• The County standard contract requires each party to bear its own costs and attorney fees, regardless of who is the prevailing party.
• Potential Impact: County Counsel cannot advise on, whether and to what extent, Wyoming law may affect a party’s requirement to pay the prevailing party’s attorneys’ fees and costs in a legal action where no specific provision is provided in the EULA.
4. The County agrees to indemnify Xecurify for expenses incurred for any infringement claim attributable to the County’s (a) use of software not supplied by Xecurify; (b) modifications after delivery; (c) use in combination with other products, services, processes or materials where the alleged infringement relates to such combination which were unauthorized by Xecurify; (d) use for purposes outside the scope of the license; (e) continued use of allegedly infringing software after Xecurify provides a replacement; (f) breach of the EULA; (g) modification not made or authorized in writing by Xecurify; or (e) activity after Xecurify has provided a work around or modification that would have avoided such claim.
• The County standard contract does not include any indemnification or defense by the County of a contractor.
• Potential Impact: By agreeing to indemnify Xecurify, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time limited, or expense limited could be brought against Xecurify without such limitations and the County could be responsible to defend and reimburse Xecurify for costs, expenses, and damages, which could exceed the total EULA amount. County Counsel cannot advise on, whether and to what extent, Wyoming law may limit or expand this EULA term.
5. The EULA does not require Xecurify to meet the County’s insurance standards as required pursuant to County Policies, 11-05, 11-07 and 11-07SP.
• County policy requires contractors to carry appropriate insurance at limits and under conditions determined by the County’s Risk Management Department and as set forth in County policy and in the County standard contract.
• Potential Impact: The County has no assurance that Xecurify will be financially responsible for claims that may arise under the EULA, which could result in expenses to the County that exceed the total EULA amount.
6. Payment terms are Net 30 in advance with late payment penalties of suspension of service and interest equal to the amount of the used service. In addition, all fees are non-cancelable and non-refundable.
• County standard payment terms are Net 60 days with no interest or late payment penalties.
• Potential Impact: County standard processing time is 60 days or more. Failing to pay within 30 days may result in a material breach of the EULA, which could allow Xecurify to terminate the EULA and seek other legal remedies, including interest, which could exceed the EULA amount.
7. Venue for disputes arising under the EULA is in the courts of Wyoming.
• County Policy 11-05 requires venue for disputes in Superior Court of California, County of San Bernardino, San Bernardino District.
• Potential Impact: Having a venue in Wyoming may result in additional expenses that exceed the amount of the EULA.
ITD recommends approval of the EULA with Xecurify, including non-standard terms, to allow ITD to continue utilizing this plugin to enhance site performance and response time for WordPress sites.
PROCUREMENT
The EULA, including non-standard terms, will be used to accompany future purchases to be approved, as necessary, per County Policy 11-04 Procurement of Goods, Supplies, Equipment and Services, provided that Xecurify does not substantively modify its EULA.
MiniOrange was initially acquired in 2021andd was selected due to a need for a plugin that would enhance website performance and response times; only miniOrange could accommodate this need. Initially a part of the modernization of County websites, miniOrange is still currently being utilized in the Countywide Plan website. Due to the level of integration within public facing County websites, it would be difficult to remove and implement other plugins without causing downtime and technical difficulties. The Purchasing Department concurs with the non-competitive justification.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455) on August 8, 2024; Purchasing (Jessica Barajas, Supervising Buyer, 387-2065) on August 9, 2024; Risk Management (Gregory Ustaszewski, Staff Analyst II, 386-9008) on August 8, 2024; Finance (Iliana Rodriguez, Administrative Analyst, 387-4205) on August 21, 2024; and County Finance and Administration (Paloma Hernandez-Barker, Deputy Executive Officer, 387-5423) on August 23, 2024.