SLA, data terms, liability caps, and exit ramps — the terms that protect your business when something downstream breaks.
Free. No registration. No card. No catch.
What's happening here
Every business relies on vendors — for software, inventory, logistics, or specialized services. What happens when the vendor goes down, ships the wrong product, exposes your customers' data, or simply stops performing? The answer depends entirely on what's in writing.
You're onboarding a vendor whose product or service will be integrated into your operations. It might be a SaaS tool your team depends on, a supplier whose inventory goes into your product, a fulfillment center shipping your orders, or a data processing partner handling your customers' information.
Vendors often present their own standard terms — written to protect the vendor. Without negotiating your own vendor agreement or counter-terms, you're accepting liability caps that favor them, SLAs without teeth, data terms that may conflict with your privacy obligations, and exit restrictions that lock you in.
A vendor outage with no compensation mechanism. A supplier who delivers defective goods with no return or replacement obligation. A data breach at the vendor level with no contractual indemnification flowing to you. Auto-renewing contracts with no exit ramp. All common in vendor relationships with no tailored agreement.
The right agreement for this situation
The right document depends on what the vendor is providing and what risks are most relevant to your business relationship with them.
Software and services
For technology vendors, SaaS providers, and professional service providers. Covers SLA with uptime guarantees and credit mechanisms, data handling obligations, liability cap, acceptable use, IP ownership of customizations, audit rights, and exit provisions including data portability on termination.
Physical goods
For inventory, raw materials, components, or manufactured goods. Covers purchase order terms, delivery timelines, quality standards and inspection rights, defective goods procedures, pricing adjustments, minimum order quantities, exclusivity (if applicable), and termination for persistent delivery failures.
Data and privacy
Required when the vendor processes personal data on your behalf. Defines data controller/processor roles, permitted processing purposes, security standards, breach notification obligations, sub-processor restrictions, and data deletion on termination. Required for GDPR compliance and increasingly for CCPA.
What BizDraft asks you
Software access, physical goods, data services, logistics. The type of product or service determines which clauses are relevant — SLA for software, quality standards for goods, DPA for data.
For software: uptime percentage, response time SLA, maintenance windows. For goods: quality specs, lead times, defect rates. For services: deliverable standards, turnaround times. These become the SLA or performance clause.
If the vendor has access to your customer data, employee data, or financial data, the agreement needs data handling provisions. BizDraft includes a data protection clause and flags whether a separate DPA may be required.
Mutual liability cap (typically one year of fees), carve-outs for gross negligence and willful misconduct, indemnification for IP infringement. BizDraft defaults to a balanced cap and flags vendor-favorable provisions you should negotiate.
Initial term, auto-renewal, notice period to cancel, and what happens to your data or inventory on exit. Exit ramps with adequate notice protect you from being locked in when a vendor underperforms.
Does the vendor want exclusivity? Are you committing to a minimum purchase volume? These terms have major commercial implications and should be approached carefully — BizDraft flags the downstream consequences.
What to watch out for
Many vendor contracts auto-renew for a full year if you don't cancel within a 30-day window — often in month 10 or 11. If you miss the window, you're locked in for another full term. Always check the auto-renewal trigger date and the notice deadline.
An SLA that defines uptime requirements but provides no credit or remedy when they're breached is decorative. A real SLA specifies what credit you receive per hour or percentage of downtime beyond the threshold — making it financially meaningful for the vendor to meet it.
When you leave a vendor, what happens to your data? Vendor agreements that don't specify a data export window and format can leave you without access to years of business data when the relationship ends. Require a minimum 30-day export window and a specified file format.
Some vendor agreements allow the vendor to change pricing with 30 days' notice — at any time, for any reason. If your pricing can change unilaterally, your budget is unreliable. Negotiate price stability for the initial term, or at minimum a cap on annual increases.
If you've customized a vendor's platform for your business — built integrations, created custom workflows, added data structures — who owns those customizations? Some vendor agreements claim ownership of anything built on their platform. Negotiate ownership of your own customizations from the start.
Example
What you tell BizDraft
"I'm signing with a SaaS analytics vendor. Annual contract, $24,000/year. 99.5% uptime SLA with credit for breaches. They'll process our customer usage data. I need a DPA. I want a 60-day cancellation window and a 30-day data export period on exit. Liability cap at one year of fees. New York."
What BizDraft generates
A vendor agreement with 99.5% uptime SLA and service credit schedule, $24,000 annual fee, data processing provisions, DPA addendum, 60-day cancellation notice, 30-day data export period, $24,000 annual liability cap, IP ownership of client customizations retained by client, New York governing law.
Download options
A vendor agreement with DPA addendum. Word and PDF. All SLA percentages, credit schedules, and data terms editable before download. Use as your counter-proposal to the vendor's standard terms.
Frequently asked questions
Yes. BizDraft's vendor agreement is drafted from your perspective as the customer. Most vendors present their own terms first — having your own draft in hand shows you've done your homework and makes it easier to identify which provisions to prioritize in negotiation.
If the vendor processes personal data about your customers or employees on your behalf, a DPA is required under GDPR (if any EU individuals are involved) and recommended under CCPA. Even without regulatory requirements, a DPA defines what the vendor can and cannot do with your data.
99.9% uptime ("three nines") allows ~8.7 hours of downtime per year. 99.5% allows ~43.8 hours. 99% allows ~87.6 hours. For business-critical systems, 99.9% is the minimum; for mission-critical applications, 99.99% is more appropriate. The SLA is only meaningful if there's a credit for breaches.
Standard practice is to cap mutual liability at 12 months of fees paid under the agreement. Carve this out for: (1) breaches of confidentiality, (2) indemnification obligations for IP infringement, (3) gross negligence or willful misconduct, and (4) data breaches involving personal information. These should be uncapped or separately capped at a higher amount.
Draft a vendor agreement from your perspective. Free.
Draft your vendor agreement