vendor-contract-review

name	vendor-contract-review
description	Vendor contract review: identify risky clauses in SaaS, services, and procurement contracts — liability caps, indemnification, data processing, termination rights, and auto-renewal traps

Vendor Contract Review Skill

When to activate

• Reviewing a contract before signing with a new vendor or supplier
• Identifying unfavourable clauses in SaaS or software agreements
• Reviewing a services agreement, MSA, or SOW for your company
• Checking a renewal before auto-renewing a large spend
• Flagging data processing and liability risks in vendor contracts

When NOT to use

• Negotiating your own customer contracts (different risk priorities)
• Employment contracts — different legal framework
• Real estate or physical asset agreements — out of scope
• Contracts requiring regulatory compliance analysis (FDA, banking) — needs qualified legal counsel
• Replacing a lawyer for high-stakes contracts (> $500K or with significant liability exposure)

Instructions

Standard vendor contract review

Review this vendor contract and flag risky clauses.

Contract type: [SaaS subscription / Professional services / MSA + SOW / Procurement / NDA]
Vendor: [name]
Annual value: $[X]
Duration: [X months / annual]
Renewal: [auto-renew / manual]
Your role: [buyer receiving the service]

Review these clauses in priority order:

1. LIABILITY CAP (highest priority):
   - What is the vendor's maximum liability to you?
   - Red flag: cap equal to or less than 1× monthly fees
   - Standard: 12× monthly fees (1 year of contract value)
   - Best: uncapped for willful misconduct, fraud, death/injury, IP infringement, data breach

2. INDEMNIFICATION:
   - Who indemnifies whom for what?
   - Red flag: you indemnify vendor for your "misuse" (overly broad)
   - Standard: mutual indemnification for IP infringement, negligence
   - Watch: indemnification carve-outs that gut your protection

3. DATA AND PRIVACY:
   - Who owns the data you input or generate?
   - Is there a DPA (Data Processing Agreement) attached or referenced?
   - Red flag: vendor can use your data for product improvement without consent
   - GDPR / CCPA: if you process EU/CA personal data, DPA is legally required
   - Watch: data return/deletion rights on termination

4. TERMINATION RIGHTS:
   - Can you terminate for convenience (without cause)?
   - Notice period required to terminate: [X days]
   - Red flag: no termination for convenience / termination requires 90+ days notice
   - Right to terminate for cause (material breach): how long to cure?

5. AUTO-RENEWAL:
   - Does the contract auto-renew?
   - How far in advance must you give notice to cancel? [X days]
   - Red flag: auto-renew with > 60 days notice window (easy to miss)
   - Best practice: calendar reminder at 90 days before renewal date

6. PRICING AND PRICE INCREASES:
   - Can vendor increase price at renewal?
   - Cap on annual price increases? [X%]
   - Red flag: uncapped price increases at renewal

7. SLA AND SERVICE CREDITS:
   - What uptime is guaranteed? [X%]
   - What are the remedies if SLA is breached?
   - Red flag: SLA credits are your only remedy (caps your recovery)
   - Watch: credits only, no right to terminate for repeated SLA failures

8. INTELLECTUAL PROPERTY:
   - Who owns work product or customisations?
   - Red flag: vendor retains IP for work you paid for
   - Standard: you own custom work; vendor retains their pre-existing IP

Flag each clause as: GREEN (favourable) / YELLOW (negotiate) / RED (reject or escalate to legal)

SaaS-specific clause review

Review this SaaS agreement for common software-specific risks.

Vendor SaaS product: [describe]
Users: [X seats / unlimited]
Data stored in the product: [describe sensitivity — PII / financial / proprietary]

SaaS-specific clauses to check:

ACCEPTABLE USE POLICY (AUP):
- What uses are prohibited?
- Red flag: broad "at vendor's discretion" suspension rights
- Watch: vague AUP that could affect your legitimate use case

DATA PORTABILITY AND EXPORT:
- Can you export your data at any time?
- In what format? (machine-readable CSV/JSON is standard)
- What happens to data after termination? 30-day window to export is standard.
- Red flag: no data export / proprietary format / data deleted on termination with no grace period

UPTIME AND MAINTENANCE:
- Scheduled maintenance: does it count against uptime SLA?
- How much notice for planned downtime?
- Emergency maintenance: what's the process?

SUBPROCESSORS AND THIRD-PARTY SERVICES:
- Does vendor use subprocessors who will touch your data?
- Are they listed? Can you object to new ones?
- GDPR requirement: must notify customers of subprocessor changes

SECURITY OBLIGATIONS:
- What security standards does vendor commit to? (SOC 2, ISO 27001)
- Incident notification: how quickly must they notify you of a breach?
- Standard: 72 hours (GDPR requirement); watch for > 72 hours or no commitment

CHANGES TO SERVICE:
- Can vendor change features or remove functionality?
- Notice required for material changes? (30-90 days is standard)
- Red flag: vendor can change service unilaterally without notice

Output: flagged clause list + recommended negotiation asks for each RED/YELLOW clause.

Contract negotiation playbook

Build a negotiation strategy for [contract].

Contract value: $[X/year]
Vendor's leverage: [high / medium / low — are there alternatives?]
Your leverage: [high / medium / low — size of your spend relative to vendor]
Must-win clauses: [list the 2-3 most important to fix]
Nice-to-have: [list secondary asks]

Negotiation playbook:

Prioritise: pick your 3 fights, let the rest go.
Vendors expect negotiation — they won't walk from a material deal over reasonable asks.

For each RED clause:

Clause: [name]
Problem: [what the current language says, why it's unfavourable]
Your ask: [the specific language change you want]
Your fallback: [minimum acceptable language if they push back]
Justification: [why this is a reasonable business ask]

Leverage tactics:
- Multi-year commitment: "We'll sign 3 years if you fix the liability cap"
- Volume commitment: "We'll expand to 500 seats if you fix data portability"
- Timeline urgency: "We need this resolved by [date] to proceed"
- Competition: "Your competitor's contract already includes this protection"

Escalation path:
- Level 1: standard redlines from their AE
- Level 2: legal-to-legal negotiation
- Level 3: executive escalation (only for strategic deals)

Generate the negotiation playbook for my specific redlines.

Contract checklist

Generate a vendor contract review checklist for [company/team].

Use case: [all new vendors / vendors above $X spend / SaaS tools only]
Risk tolerance: [conservative / moderate / standard startup]

Quick review checklist (for contracts < $50K/year):
□ Liability cap ≥ 12 months of fees?
□ Auto-renewal notice period ≤ 60 days?
□ Data export rights included?
□ Termination for convenience available with ≤ 30 days notice?
□ No unusual IP assignment clauses?
→ If all green: sign. If any red: escalate.

Full review checklist (contracts > $50K/year or involving sensitive data):
□ Liability cap and carve-outs reviewed
□ Indemnification scope understood
□ DPA attached (if processing personal data)
□ SLA reviewed and remedies are adequate
□ Termination rights (for cause and convenience)
□ Auto-renewal terms calendared
□ Pricing escalation clause reviewed
□ Data portability and deletion rights confirmed
□ Security certification requirements met
□ Governing law and jurisdiction is acceptable
→ Internal legal review required for RED items

Generate the specific checklist for my company's contract review process.

Example

User: A new SaaS vendor sent us a contract. Annual spend: $84K. Their liability cap is "one month of fees paid." Auto-renews with 90-day notice required. No DPA attached though we'll be storing customer email addresses. What should I push back on?

Claude's priority redlines:

Three must-fix issues before signing:

1. Liability cap (RED — reject as written): Current: 1 month of fees = $7,000 max liability (you're paying $84K/year) Your ask: "Minimum 12 months of fees paid in the prior 12 months ($84,000)" Fallback: "6 months of fees ($42,000) with uncapped carve-outs for data breach and fraud" Why they'll agree: This is a reasonable industry standard ask. Any reputable vendor will move from 1 month.

2. Auto-renewal notice (YELLOW — negotiate): Current: 90-day notice window — easy to miss, especially if the person who signed leaves Your ask: "60 days or less" Fallback: "90 days is acceptable if contract includes written reminder from vendor at 120 days" Practical fix: Set a recurring calendar reminder immediately for [renewal date - 100 days] regardless of what's in the contract.

3. DPA / data privacy (RED — required, not optional): Current: No DPA attached, yet you'll process customer email addresses (personal data) Your ask: "Execute vendor's standard DPA before go-live, as an addendum to this agreement" Why non-negotiable: If you're subject to GDPR or CCPA, you're legally required to have a DPA with any processor handling personal data. Most vendors have a standard DPA — just ask for it. If they don't have one, that's a red flag about their data practices.

What to let go: SLA credits, IP clauses (assuming no custom development), and governing law are lower priority at this spend level.

---