Exhibit 2 - Service Description Event Hub, Version 2023-10

Introduction

Event Hub Overview

The event hub is an Add-On service for CoreMedia on Cloud Service Subscribers. It receives events from a CoreMedia Content Cloud instance, processes them, and distributes them to registered webhooks (following “Event Hub Service” or “Event Hub”)).

The service offers multiple subscription to three different types of events:

· Content events

· Create, update and delete

· check-in/out

· publication/de-publication and approval events

· Workflow events

· Editorial notifications that are available in Studio including custom notifications

Events for content and workflows are analogous to the events in the CoreMedia unified API.

Documentation

Documentation is provided for:

· The Event Hub API, with detailed description of all receivable events

· The webhook subscription API

Event Hub overview, which contains all links to the API descriptions: https://documentation.coremedia.com/services/event-hub-service/introduction-to-event-hub/

Limitations

The Event Hub Service is currently only available to CoreMedia Content Cloud Service Subscribers.

Non-Durable Events Streams

Notification and workflow events are not stored persistently in the CoreMedia Content Cloud and therefore do not support:

· Replay of an initial state

· Recover events in the case of data loss in used message queues

· Recover events in case the event producer running in the CoreMedia Content Cloud instance fails

Durable Event Streams

Content event streams can be replayed from a specific timestamp after a 'synthetic' initialization phase has been completed.[footnoteRef:1] [1: For details on synthetic replay refer to chapter “5.11 Listeners” in Unified API Developer Manual.]

Thus, it is possible to build a 'replicated' view of a content repository on the Subscriber`s side:

· During the initialization phase the delivered events are emitted in a sequential order which does not represent a logically consistent view on the repository.

· Short event sequences may be received multiple times on the subscriber side. This can happen on failure or restarts of the event producer running in the CoreMedia Content Cloud Service or in case of a disaster recovery. The Subscriber side must be able to detect and handle those situations.

Backup and Recovery

Storage

Event Hub uses managed message queues, SQL and No-SQL databases to persistently store event data and configuration:

· Message queues: Event stream data

· SQL-databases: Event stream state (timestamps) and metadata

· No-SQL databases: Event subscription configuration data

Backup and Restore

Backup

All Event Hub databases are subject to backup and restore procedures provided by CoreMedia.

Message queues do not provide backups but are highly available and fault-tolerant.

· SQL databases: Data Snapshots are taken once a day with a retention period of 7 days.

· No-SQL databases: Data is replicated to a second geographically distant location.

Disaster-Recovery

In the event of data loss in one of the used services, CoreMedia takes the following measures for recovery:

Message queues:

· Timestamps of the durable event streams (content) are reset to a time before the outage. Event starting from this time are replayed again.

· Events from non-durable stream cannot be replayed and are lost.

SQL databases:

· Timestamps and metadata are restored from the latest snapshot.

· Events of durable event streams are replayed from the timestamp stored in the snapshot.

· Non-durable streams are not affected.

· In case data loss also includes backup snapshots durable event streams will replay the whole repository state.

No-SQL databases:

· Configuration data is restored from the backup location.

· Event stream data is not affected, however event delivery will be paused until recovery is completed.

Provisioning

Prerequisites

Event Hub provisioning

Once licensed, the Event Hub can be activated by contacting the CoreMedia support via  support@coremediaoncloud.com.

On activation

· The repository listener (that send events from a CoreMedia environment to the Event Hub) is installed in the Content Management and the Master Live Server. There will be no downtime of the CoreMedia application components.

· The Subscriber is provided with all required information needed to register webhooks.

Delivery

The Event Hub is intended for use in developing and operating applications that comply with our terms of service. The Event Hub subscription covers a reasonable usage of 20,000,000 events per month.

Every content action, such as create, change, publish, and delete, counts as one event. Additionally, every editorial user notification, such as assignment to workflows, comments, and Project or To-Do assignment, counts as one event.

If required, additional events per month can be booked according to the price list. When exceeding the respective usage limits for events, the service will continue to work normally, unless in the case of vast exceeding the limit. In case of vast limit exceeding, we reserve the right to take corrective action, including, but not limited to, the throttling of our APIs, or ultimately stopping access to the Event Hub service. However, additional charges will apply, according to the price list (“Overage Events”). CoreMedia will try to contact you and discuss options before taking service-restricting measures.

For security reasons the number of webhook subscriptions per Content Management and Master Live Server instance is by default limited to

· 4 subscriptions per event type

· 10 subscriptions in total

This limit can be increased upon request.

Support and Maintenance Services

Support and Maintenance Services are rendered as set out in the Exhibit 2 and 3.

The Support Service offers additional capabilities, which can be requested via CoreMedia support:

· Reset timestamp to replay events from a certain timestamp.

· Activate / deactivate live or preview event streams:

· Preview, which includes management content, workflow and notification events.

· Live, which includes only content live events.

Service Level

Notwithstanding Exhibit 3 the Service Level Objective for Event Hub Delivery is 99.9% per month. Availability is determined by monitoring.

The following times are excluded from Availability:

· Failures caused by Subscriber adaptations or inappropriate use.

· Failures caused by third-party systems provided by the Subscriber

· Failures caused by exceeding the Usage Limits.

· Planned and communicated maintenance times as stated in section 8

The Service Restoration Objective (RTO) is 1 business day.

Access and Security

Access to Event Hub Resources

Only permanent and specially trained members of the CoreMedia Content Cloud Service operations team are given access to a subscriber’s resources (event streams and webhook configuration). Access is always secured by two-factor-authentication.

Network

Data transfer between the Subscriber and Event Hub API services is secured by transport encryption methods and authentication.

Self Service APIs

Event Hub "Self Service" APIs for Subscribers are protected against unauthorized access using industry standard JSON Web Tokens. Subscribers can obtain these tokens from CoreMedia provided authentication endpoints. Credentials required for authentication are communicated in a secure way.

Webhook Endpoints

Event Hub supports the following methods for securing webhook endpoints:

· HTTP basic authentication

· Application secrets provided by HTTP headers

It is the Subscriber‘s responsibility to protect their webhook endpoints against possible attack scenarios.

Application Security

See Service Description for CoreMedia Content Cloud - Service section “Application Security”.

Penetration Testing

See Service Description for CoreMedia Content Cloud - Service section “Penetration Testing”.

Roles and Responsibilities

The following roles and responsibilities shall apply for the Services provided by CoreMedia to the Subscriber. Only Services where CoreMedia is marked with “R” (for responsible) are part of CoreMedia’s Event Hub obligations to the Subscriber. All other responsibilities are the Subscriber’s obligation.

· R – Responsible

· A – Accountable

· C – Consulted

· I – Informed