All posts

PlaybookApril 22, 2026·7 min read

Five clauses we always flag in vendor MSAs

Vendor MSAs all start to look the same after a few thousand of them. The language varies; the patterns don't. These are the five we reliably surface on every review, and the rationale we suggest your counsel use to push back.

1. Liability caps below 12 months of fees

The default vendor template caps liability at "the greater of $10,000 or three months of fees." For most SaaS vendors that's structurally under-indemnified — a single data breach has remediation costs an order of magnitude higher.

What we suggest: cap at 12 months of fees, with explicit carve-outs for breach of confidentiality, data-protection violations, and IP indemnification. The vendor will push back; the carve-outs are usually where they concede.

2. IP feedback licenses

Look for: "Customer hereby grants Vendor a perpetual, worldwide, royalty-free license to use any feedback, suggestions, or recommendations provided to improve the Services."

The problem isn't the perpetual license per se — it's the scope. "Feedback" in practice ends up covering bug reports, usage patterns, integration requests, even prompt content sent to AI vendors. That's a lot more than "feedback."

What we suggest: narrow to anonymized, aggregated metrics only. If the vendor wants verbatim feedback rights, they should ask explicitly with attribution.

3. Indemnity asymmetry

The vendor indemnifies you for IP infringement claims; you indemnify the vendor for "any third-party claim arising from Customer's use of the Services." That second one is a backdoor — if a regulator comes after the vendor for processing your data, the language sweeps that in.

What we suggest: mutual indemnity for third-party IP and data-protection claims, with each party's indemnity scoped to claims actually arising from that party's actions. If the vendor breached your DPA, that's not your indemnification problem.

4. Force-majeure scope creep

Modern force-majeure clauses have crept from "acts of God, war, natural disaster" into 200-word lists that include "labor disputes, supply chain interruptions, internet outages, and any cause beyond Vendor's reasonable control." That last clause swallows the first.

What we suggest: enumerated list only, no general catch-all. Internet outages aren't force-majeure for an internet company; they're an SLA matter.

5. The auto-renew (covered separately)

We wrote a whole post on auto-renew traps. Short version: 30-day notice, renewal terms equal to the shortest billing period, CPI-capped at 5%, affirmative acceptance not silent acquiescence.

How to use this

Run your next vendor MSA through CheckMyDoc and you'll see these five findings (plus the dozen others that are typical) flagged with severity, with the cited section and a one-line "push back to." Walk into the counsel conversation with the redlines already drafted. Your lawyer's two hours go toward the deal-specific issues, not these standard ones.