Review Vendor and Supplier Contracts with AI

# Vendor Contract Risk Review
**Contract:** Cloud Infrastructure Services Agreement
**Value:** $480K/year × 3 years = $1.44M total contract value (TCV)
**Buyer:** 200-person SaaS company
**Reviewer Note:** Analysis based on the summary terms provided. A full clause-by-clause review should be performed against the executed document before signature.

---

## 1. Key Commercial Terms Summary

| Term | Current Position | Commentary |
|---|---|---|
| Term Length | 3 years | Long commitment; reduces buyer leverage mid-term |
| Annual Value | $480,000 | Material spend — justifies enterprise-level protections |
| Renewal | Auto-renewal | Unfavorable default; needs notice window scrutiny |
| Indemnification | Mutual | Directionally fair, but scope/carve-outs matter |
| Limitation of Liability (LoL) | 6 months of fees (~$240K) | Below market for infrastructure vendors; low relative to TCV |
| SLA Modification | Vendor may modify w/ 30 days' notice | One-sided; vendor can unilaterally reduce service commitments |

---

## 2. Risk Issues

| Clause | Risk Level | Issue | Suggested Redline |
|---|---|---|---|
| Auto-Renewal | **HIGH** | Likely rolls into another multi-year term; notice window probably short (30–60 days). Exposes buyer to unwanted lock-in and price hikes. | Convert to month-to-month post-initial-term, OR 1-year renewals with 90-day non-renewal notice and a cap on renewal price increases (e.g., CPI or 5%, whichever is lower). |
| Unilateral SLA Modification (30 days) | **HIGH** | Vendor can water down uptime, support response, or credits without buyer consent — a rare and aggressive term for infrastructure. | SLA changes require mutual written agreement. Alternatively, if vendor modifies SLA to buyer's material detriment, buyer gets termination right without penalty + pro-rata refund. |
| Limitation of Liability (6 months) | **HIGH** | ~$240K cap on a $1.44M contract is thin, especially for infrastructure where downtime or data loss can cause large losses. | Increase cap to 12–24 months of fees. Carve out from the cap: (i) breach of confidentiality, (ii) data security/privacy breaches, (iii) IP indemnity, (iv) gross negligence/willful misconduct, (v) payment obligations. |
| Mutual Indemnification (scope unclear) | **MEDIUM** | "Mutual" sounds fair, but vendors often limit their indemnity to narrow IP infringement while making buyer indemnify broadly for data/use. | Vendor indemnity must cover: IP infringement, data breach caused by vendor, and violation of law. Buyer indemnity should be limited to unauthorized/illegal use of the service. |
| Data Security / Privacy (not mentioned) | **HIGH** | No reference to security standards, breach notification, data location, or subprocessors. Critical gap for a SaaS buyer handling customer data. | Add DPA with: SOC 2 Type II / ISO 27001 compliance, 48–72 hour breach notification, encryption in transit/at rest, subprocessor approval, annual audit/pen-test rights. |
| Termination Rights (not mentioned) | **HIGH** | No visible termination-for-convenience or termination-for-cause framework described. | Add: (i) termination for material breach with 30-day cure, (ii) termination for repeated SLA failures, (iii) termination for convenience with pro-rata refund of prepaid fees, (iv) termination on change of control. |
| Service Level Agreement (substantive SLA absent) | **MEDIUM** | Risk mod provision is discussed, but no reference to uptime %, credits, or escalation path. | Require ≥ 99.95% monthly uptime, tiered service credits (e.g., 10%/25%/50%), and a chronic-failure termination right (3 months of missed SLAs in any rolling 6-month period). |
| IP Ownership (not mentioned) | **MEDIUM** | Ensure buyer retains all rights to its data and any configurations; vendor should not claim ownership over derivative or "usage" data. | Buyer owns all Customer Data. Vendor may use aggregated, de-identified data for service improvement only. No training of AI/ML models on Customer Data without consent. |
| Warranties (not mentioned) | **MEDIUM** | Infrastructure vendors often disclaim nearly all warranties. | Add affirmative warranties: service will perform materially per documentation; no malicious code; compliance with applicable laws; sufficient rights to deliver the service. |
| Price Protection / Fee Escalation | **MEDIUM** | Not addressed — vendors typically increase on renewal or mid-term. | Lock pricing for the initial term. Cap renewal increases at lesser of CPI or 5%. |
| Data Return & Transition | **MEDIUM** | Migration risk at end of term if no export obligation exists. | Vendor must provide data export in standard format for 90 days post-termination and reasonable transition assistance at then-current rates. |
| Assignment | **LOW** | Vendor may assign to competitor or acquirer. | Mutual consent required, except for internal reorganization; buyer has termination right if vendor assigns to a buyer competitor. |

---

## 3. Missing or Weak Protections

- **Data Security / DPA** — Absent; must be added given SaaS business model.
- **Termination Framework** — No visible convenience or cause-based termination rights.
- **Substantive SLA** — Only modification rights mentioned; no uptime or credit commitment described.
- **IP / Data Ownership** — Not addressed; critical for protecting Customer Data.
- **Warranties** — Not mentioned; likely disclaimed in full in boilerplate.
- **LoL Carve-out

# Commercial Vendor Contract Risk Review
## Cloud Infrastructure SaaS Agreement – $480K Annual Value

---

## (1) KEY COMMERCIAL TERMS SUMMARY

| Term | Details | Assessment |
|------|---------|-----------|
| **Contract Duration** | 3 years | Standard; auto-renewal creates perpetual obligation |
| **Annual Fee** | $480,000 | $1.44M total commitment over 3 years |
| **Auto-Renewal** | Yes (implied from description) | ⚠️ Default renewal unless actively terminated |
| **Termination for Convenience** | Not mentioned | 🚩 **CRITICAL GAP** – likely not permitted mid-term |
| **Price Escalation** | Not specified | 🚩 **CRITICAL GAP** – unlimited increases possible |
| **Indemnification** | Mutual | Balanced but requires detailed review of scope |
| **Limitation of Liability (LOL)** | 6 months of fees (~$240K cap) | ⚠️ Below industry norm for infrastructure vendor |
| **SLA Modification Rights** | Vendor can modify with 30 days notice | 🚩 **HIGH RISK** – one-sided, unilateral control |
| **Payment Terms** | Not specified | 🚩 **CRITICAL GAP** |

**Overall Risk Rating: HIGH** – Multiple one-sided terms favor the vendor; critical gaps in buyer protections.

---

## (2) RISK-BASED CLAUSE ANALYSIS

### HIGH-RISK CLAUSES

| Clause | Risk Level | Issue | Explanation |
|--------|-----------|-------|-------------|
| **SLA Modification Right** | 🔴 HIGH | Unilateral modification with 30 days notice | Vendor can degrade service levels (uptime, response times, support hours) with minimal notice. Example: reduce uptime SLA from 99.9% to 99.5% or extend support response times. Buyer has no contractual recourse and cannot terminate without cause. This undermines the entire value proposition of the agreement. |
| **Limitation of Liability Cap** | 🔴 HIGH | Capped at 6 months of fees ($240K) | For a $480K/year infrastructure vendor, a $240K cap is insufficient. If infrastructure failure causes operational outage affecting revenue-generating systems, damages could easily exceed this. Industry standard for critical infrastructure: 12 months of fees or higher. Also unclear if cap applies to data loss, security breaches, or only service downtime. |
| **Auto-Renewal Clause** | 🔴 HIGH | Automatic renewal to next 3-year term unless terminated | Requires buyer to affirmatively opt-out, typically 90+ days before expiration. High risk of missing deadline → locked into next 3 years with no ability to renegotiate or exit. Creates perpetual obligation without fresh negotiation. |
| **No Termination for Convenience** | 🔴 HIGH | Not explicitly addressed (implied lockup) | Buyer cannot exit even if service deteriorates, vendor is acquired, pricing becomes uncompetitive, or business needs change. Vendor has no performance incentive beyond initial contract term. No buyout or early termination clause identified. |

### MEDIUM-RISK CLAUSES

| Clause | Risk Level | Issue | Explanation |
|--------|-----------|-------|-------------|
| **Mutual Indemnification** | 🟡 MEDIUM | Scope and procedures unclear without full contract review | "Mutual" sounds balanced but: (a) likely disproportionate—vendor indemnifies for their negligence; buyer indemnifies for any third-party claims; (b) no carveout for vendor's gross negligence or willful misconduct; (c) no defined defense procedures, cost controls, or exclusive remedy language. Requires detailed review of indemnification section. |
| **Price Escalation (Unspecified)** | 🟡 MEDIUM | No cap on annual price increases mentioned | Vendor could increase fees 10-20% annually. Over 3 years without caps, total cost could reach $1.8M+ vs. budgeted $1.44M. Standard protection: CPI + 3% cap or fixed percentage (e.g., max 5% annual increase). |
| **Data Security & Privacy** | 🟡 MEDIUM | No mention of data protection, encryption, compliance (GDPR, HIPAA, SOC 2) | Critical gap for cloud infrastructure vendor. Buyer needs explicit commitments on: data encryption (in-transit, at-rest), audit rights, breach notification (24-48 hours), compliance certifications (SOC 2 Type II, ISO 27001), and DPA addendum. Current exposure: regulatory fines + reputational harm. |
| **Warranty & Support SLA Vagueness** | 🟡 MEDIUM | "SLA" mentioned but no specific SLA terms, penalties, or credits defined | Without detail: what is the uptime percentage? What are response/resolution times? What are service credits if SLA breached? Typical: 99.9% uptime, 1-hour response, 4-hour fix time for Severity 1, with 10% monthly credit per 0.1% below target. Missing specifics = no accountability. |

### LOW-RISK CLAUSES

| Clause | Risk Level | Issue | Explanation |
|--------|-----------|-------|-------------|
| **3-Year Initial Term** | 🟢 LOW | Standard for enterprise SaaS/infrastructure | Acceptable if paired with termination for convenience and price caps. Problematic only in isolation given auto-renewal + no exit. |
| **Mutual Indemnification Framework** | 🟢 LOW | Mutual structure is balanced (if properly scoped) | Acceptable principle, but medium-risk due to execution (see above). Recommend detailed review of carveouts and procedures. |

---

## (3) MISSING OR WEAK PROTECTIONS

### Indemnification Gaps

**Current State:** Mutual indemnification mentioned but scope unknown.

**Critical Gaps:**
- ❌ No carveout excluding vendor's gross negligence, willful misconduct, or IP infringement from mutual obligations
- ❌ No definition of "claim" procedures, defense rights, or caps on indemnifying party's control
- ❌ No limitation on indemnification to third-party claims (vs. direct claims)
- ❌ No exclusive remedy language (buyer may be forced to indemnify vendor while also suing for breach)

**Recommended Addition:**
> "Vendor shall indemnify Buyer for any third-party claims that Vendor's services infringe any IP rights or violate applicable law, except to the extent caused by Buyer's breach or misuse. Vendor shall have no obligation to indemnify Buyer for claims arising solely from Buyer's negligence or IP infringement by Buyer. Indemnification obligations shall not apply to Vendor's gross negligence, willful misconduct, or breach of this Agreement."

---

### Limitation of Liability Weaknesses

**Current Cap:** 6 months of fees ($240K) for all damages.

**Gaps:**
- ❌ Cap likely applies to ALL damages including data loss, security breach, compliance violations, business interruption
- ❌ $240K cap insufficient for critical infrastructure vendor (industry norm: 12 months for infra vendors)
- ❌ No carveout for gross negligence, willful misconduct, IP infringement, or data breaches
- ❌ Unclear if cap applies per-incident or aggregate; likely not tiered by severity
- ❌ No separate cap for indemnification (may be subject to LOL cap)

**Risk Example:** Infrastructure outage lasts 4 hours, causing $2M in lost revenue. Buyer's recovery capped at $240K (53% shortfall).

**Recommended Revision:**
> "LIMITATION OF LIABILITY: Except for (a) either party's indemnification obligations, (b) Gross Negligence or Willful Misconduct, (c) Data Breaches or Security Incidents, (d) IP Infringement, (e) Confidentiality breaches, and (f) Breach of Section [Data Processing], each party's total cumulative liability arising from this Agreement shall not exceed the annual fees paid in the 12 months preceding the claim. Vendor shall maintain cyber liability insurance of not less than $2M."

---

### Data Security & Privacy – CRITICAL GAPS

**Current State:** No mention of data security, compliance, or privacy protections.

**Missing Elements:**

| Protection | Why Critical | Industry Standard |
|-----------|-------------|-------------------|
| **Data Encryption** | Customer data in transit/at rest vulnerable to interception or theft | AES-256 encryption

# Vendor Contract Risk Review

**Important note:** I don’t see the actual attached contract text, so I can’t cite exact section numbers or quote precise language yet. Based on the terms you summarized, this is a **preliminary buyer-side issue list** for a **3-year, $480K/year cloud infrastructure agreement**. If you paste the agreement, I can convert this into a clause-by-clause review with exact references and markups.

---

## 1) Key Commercial Terms Summary

| Term | Summary | Buyer Comment |
|---|---|---|
| Vendor type | Cloud infrastructure vendor | Critical service; operational dependency is likely high |
| Customer | 200-person SaaS company | Likely reselling/embedding services into own platform, so uptime and security matter materially |
| Term | 3 years | Long commitment; should be paired with strong termination, SLA, and price protections |
| Annual contract value | $480K annually | Material spend; leverage exists for negotiated protections |
| Renewal | Auto-renewal | Needs notice timing, pricing controls, and renewal opt-out clarity |
| Indemnity | Mutual indemnification | “Mutual” sounds balanced, but scope often is not; needs close review |
| Limitation of liability | Cap = 6 months of fees | Likely too low for buyer in a cloud infrastructure deal |
| SLA changes | Vendor may modify SLA on 30 days’ notice | One-sided and high risk if uptime/support obligations can degrade during term |

---

## 2) Risk Issues Table

Because the contract text is not included, the “Clause” column below uses the **described topic** rather than exact numbering.

| Clause | Risk Level | Issue | Suggested Redline |
|---|---|---|---|
| Term / 3-year commitment | Medium | Long fixed commitment can trap buyer if service quality drops, business needs change, or pricing becomes uncompetitive | Add termination for convenience after year 1 or annual termination right with reasonable notice; include performance-based termination rights |
| Auto-renewal | High | Auto-renewal can lock buyer into additional terms if notice window is missed | Require written renewal by mutual agreement or at minimum extend notice window and require vendor reminder notice 60–90 days before renewal |
| Limitation of Liability / 6 months of fees | High | For a mission-critical cloud vendor, 6 months of fees is often too low relative to outage, security, migration, and customer liability exposure | Increase cap to at least 12–24 months of fees; add uncapped or super-capped carveouts for confidentiality, data security, IP infringement, gross negligence, willful misconduct, and indemnity |
| SLA modification right / 30 days’ notice | High | Allows vendor to unilaterally reduce uptime, support, or remedies during the contract term | Freeze SLA during the committed term, or allow changes only if not materially adverse; buyer termination right if SLA is materially reduced |
| Mutual indemnification | Medium-High | “Mutual” may still be imbalanced if vendor’s indemnity is narrow and buyer’s is broad; cloud deals should include robust vendor IP and security indemnities | Expand vendor indemnity to cover IP infringement, breach of confidentiality, data/security incidents caused by vendor, and bodily injury/property damage where relevant |
| SLA credits | Medium-High | Many cloud SLAs provide only minimal service credits and make them the sole remedy | Ensure credits are meaningful and not sole remedy for chronic failure, security issues, or material breach |
| Termination rights | High if limited | If there is no termination for chronic SLA failure, repeated security failures, insolvency, or convenience, buyer bears heavy lock-in risk over 3 years | Add termination for cause, chronic SLA failure, security breach, regulatory risk, change in control concerns, and prolonged force majeure |
| Data security / privacy | High if weak or missing | Cloud infrastructure vendors should commit to defined security controls, breach notice, audit artifacts, subprocessors, and cooperation obligations | Add detailed security addendum with standards, incident notice timing, remediation, DPA, and subprocessor controls |
| Data return / deletion | High if weak or missing | Buyer may face operational disruption or holdover costs at exit if data export, assistance, and deletion terms are not clear | Add data export rights, transition assistance, format requirements, deletion certification, and continued access for transition period |
| Price increases at renewal | Medium | Auto-renewal plus uncapped renewal increases is commercially risky | Cap renewal increases, e.g., CPI or 3–5% annually |
| Warranties | Medium-High if minimal | Vendors often disclaim all warranties except bare compliance language; inadequate for infrastructure services | Add performance, security, legal compliance, malware, and professional services warranties |
| IP ownership / usage rights | Medium | Need to ensure buyer retains ownership of its data, configs, outputs, and custom deliverables | Clarify buyer ownership of customer data and derived outputs; vendor gets limited license only to provide services |
| Audit / compliance rights | Medium | Buyer may need audit reports, SOC 2, ISO 27001, penetration summaries, and compliance commitments | Add right to receive current reports/certifications and security questionnaires |
| Suspension rights | Medium-High | Vendors often reserve broad rights to suspend service, which is dangerous for critical infrastructure | Limit suspension to urgent/security/legal necessity, with prior notice where feasible and narrow scope |
| Assignment / subcontracting | Medium | Broad vendor assignment or subcontracting may create service or compliance risk | Restrict assignment to successor in bona fide transaction; require vendor responsibility for subprocessors/subcontractors |
| Force majeure | Medium | If too broad, vendor may avoid accountability for preventable outages | Exclude payment obligations and events within vendor’s reasonable control; allow termination after extended event |
| Governing law / venue | Low-Medium | Usually manageable, but can affect leverage and enforcement | Prefer favorable forum and practical dispute resolution mechanics |

---

## 3) Missing or Weak Protections

## A. Indemnification
**Likely issue:** “Mutual indemnification” is often presented as balanced but may not actually protect the buyer enough.

**What buyer should have:**
- **Vendor IP infringement indemnity** covering claims that the services infringe or misappropriate third-party IP.
- **Vendor security/confidentiality indemnity** for losses arising from vendor breach of confidentiality, security incident, or violation of data protection obligations.
- **Vendor indemnity for law violations** related to vendor’s provision of the service.
- Duty to **defend**, not just indemnify.
- Clear remedies if infringement occurs: **procure rights, replace/modify, or refund plus transition assistance**.

**Push back if:**
- Vendor indemnity excludes open-source, combinations, or customer use too broadly.
- Buyer indemnity covers broad use cases, content, or downstream claims beyond buyer’s control.

---

## B. Limitation of Liability
**Current issue:** Cap at **6 months of fees**.

For a $480K/year deal, that is approximately **$240K**, which is likely **too low** for:
- Major outage losses
- Security incident response
- Data migration/replacement costs
- Third-party claims passed through to buyer
- Customer credits and business interruption

**What buyer should seek:**
- General cap of **12 months of fees at minimum**, preferably **18–24 months** for infrastructure.
- Separate **higher cap** for data/security/confidentiality breaches.
- **Uncapped** or excluded claims for:
  - IP infringement indemnity
  - Confidentiality breaches
  - Data protection/security breaches
  - Gross negligence/willful misconduct
  - Fraud
  - Payment obligations
  - Possibly indemnified claims generally

---

## C. Data Security
**Likely issue:** No security commitments were mentioned.

**Must-have protections:**
- Specific security standards: e.g., industry-standard administrative, technical, and physical safeguards.
- Current **SOC 2 Type II** and/or **ISO 27001** commitments.
- **Breach notification timing**: e.g., without undue delay, no later than 24–48 hours after confirmation.
- Incident response cooperation.
- Encryption in transit and at rest.
- Access controls, MFA, logging, vulnerability management.
- Subprocessor disclosure and notice.
- Data residency/location commitments if relevant.
- DPA/privacy addendum if personal data is involved.

---

## D. Termination
**Likely issue:** Long-term commitment with auto-renewal, but no mention of meaningful buyer exit rights.

**Buyer should add:**
- Termination for **material breach** with reasonable cure period.
- Termination for **chronic SLA failures**.
- Termination for **security incident** or repeated security non-compliance.
- Termination if vendor **materially degrades service or SLA**.
- Termination for **insolvency/bankruptcy**.
- Optional termination for convenience:
  - after year 1, or
  - on each anniversary with notice, or
  - with declining termination fee.

---

## E. SLAs
**Current issue:** Vendor can modify the SLA with 30 days’ notice.

That is a major problem in a 3-year infrastructure contract.

**Buyer should require:**
- SLA fixed for the term, or changes only if **not materially adverse**.
- Clear uptime commitment.
- Defined service levels for support response/resolution.
- Meaningful service credits.
- Credits not sole remedy for **chronic** failures.
- Right to terminate for repeated misses.

---

## F. IP Ownership
**Likely issue:** Not enough information, but cloud vendors often try to broadly use customer data.

**Buyer should ensure:**
- Buyer retains all rights in:
  - customer data
  - usage data that identifies buyer
  - configurations
  - outputs and deliverables created for buyer
- Vendor gets only a limited license to process data to provide and improve

# Vendor Contract Risk Review

## 1. Key Commercial Terms Summary
- **Term**: 3-year initial term with auto-renewal (details unspecified).
- **Pricing**: $480K annually (total ~$1.44M over 3 years).
- **Indemnification**: Mutual (assumed standard third-party IP/IPC claims).
- **Liability Cap**: Limited to 6 months' fees (~$240K).
- **SLAs**: Vendor right to modify with 30 days' notice (uptime/credits unspecified).
- **Context**: Cloud infrastructure for 200-person SaaS buyer; high stakes for uptime, data security, and business continuity.

## 2. Risk Assessment
| Clause                  | Risk Level | Issue                                                                 | Suggested Redline |
|-------------------------|------------|-----------------------------------------------------------------------|-------------------|
| Auto-Renewal Provision | **Medium** | Likely auto-renews for another 3 years unless buyer gives notice (period unspecified). Risks lock-in without easy exit. Favors vendor by defaulting to continuation. | "This Agreement will automatically renew for successive 12-month terms unless either party provides written notice of non-renewal at least 90 days prior to the end of the then-current term." |
| Limitation of Liability (6 months' fees cap) | **High** | Caps vendor liability at ~$240K, excluding indirect/consequential damages. Too low for cloud outages causing SaaS downtime/revenue loss. One-sided as buyer faces uncapped exposure. | "Neither party's aggregate liability shall exceed 12 months' fees paid/pre-paid. Exclusions do not apply to breaches of confidentiality, IP infringement, gross negligence, willful misconduct, or data breach obligations." |
| SLA Modification Right (30 days' notice) | **High** | Vendor can unilaterally weaken SLAs (e.g., reduce uptime from 99.9% to 99%). Erodes buyer's service guarantees; highly unusual and vendor-favoring for mission-critical cloud services. | "Vendor may not modify SLAs without Buyer's prior written consent. Any proposed changes require mutual agreement and do not apply retroactively." |
| Mutual Indemnification | **Low**   | Assumed standard, but lacks detail on scope (e.g., data breaches, privacy). Weak if no coverage for vendor's negligence. | "Each party will indemnify the other for third-party claims arising from its own IP infringement, gross negligence, or (for Vendor only) data breaches violating law. Vendor covers all defense costs; no settlement without indemnitee's consent." |

## 3. Missing or Weak Protections
- **Indemnification**: Mutual but likely narrow (IP only); missing data privacy/security breaches, negligence, or regulatory fines (e.g., GDPR/CCPA).
- **Limitation of Liability**: No carve-outs for high-risk areas (e.g., confidentiality, data loss); buyer needs symmetry.
- **Data Security**: Absent entirely. Critical for SaaS buyer—needs SOC 2 compliance, breach notification (within 48 hours), data processing addendum (DPA), and buyer data deletion rights.
- **Termination**: No for-cause/without-cause rights specified. Buyer needs 30-60 days' notice post-cure for vendor breach; immediate termination for material SLA failures.
- **SLAs**: Vague/no specifics (e.g., 99.95% uptime, credits = 10-30% of monthly fees). Modification right kills value.
- **IP Ownership**: Unspecified. Buyer must own/customize its data/apps; vendor owns only its tools.
- **Warranties**: None mentioned. Needs vendor warranties for services as described, compliance with laws, and no viruses/malware.

## 4. Specific Redline Suggestions with Proposed Replacement Language
(See Risk Assessment table for clause-specific redlines above. Additional key additions:)
- **Add Data Security Section**: "Vendor will: (i) maintain SOC 2 Type II compliance, (ii) notify Buyer of breaches within 48 hours, (iii) process Buyer Data per attached DPA, (iv) return/delete data within 30 days post-termination. Buyer Data ownership remains with Buyer."
- **Add Termination Rights**: "Buyer may terminate immediately for Vendor's uncured material breach or SLA failure >5%. Either party may terminate without cause on 90 days' notice post-Year 1."
- **Add SLA Details**: "Vendor guarantees 99.95% monthly uptime. Credits: 10% (one day), 25% (three days), 100% (five days) of monthly fees, applicable against future invoices."
- **Add IP/Warranties**: "Vendor warrants: (i) services conform to specs, (ii) free of viruses, (iii) compliant with laws. Buyer owns all its data/IP; Vendor granted limited license for service delivery."
- **Price Escalation (Missing)**: "Annual increases capped at CPI (max 3%). No changes without 60 days' notice."

## 5. Prioritized Negotiation Checklist for the Buyer
1. **Eliminate/Revise SLA Modification Right** (High risk; negotiate fixed SLAs with credits).
2. **Increase Liability Cap + Carve-Outs** (To 12 months' fees; exclude data breach/confidentiality).
3. **Add Data Security & DPA** (Mandatory for SaaS; include breach notification/audits).
4. **Clarify Auto-Renewal & Termination** (90-day notice; buyer-friendly exits).
5. **Insert SLAs, Warranties, IP Ownership** (Define uptime/credits; buyer data rights).
6. **Expand Indemnification** (Cover data breaches/negligence).
7. **Cap Price Escalation** (CPI max).
8. **Review Pricing/Volume Discounts** (Push for flexibility given $1.44M commitment).

# Top 5 Must-Negotiate Items
1. **SLA Modification Right** – Block unilateral changes; define strong uptime/credits.
2. **Limitation of Liability** – Raise cap to 12x fees; add carve-outs for data/IP breaches.
3. **Data Security Protections** – Require DPA, SOC 2, 48-hour breach notice.
4. **Termination Rights** – Add for-cause and convenience options.
5. **Auto-Renewal Notice Period** – Extend to 90 days for buyer control.