Practice · Enterprise contracts and procurement
Enterprise procurement contract review for SaaS and AI vendors
Answers to an enterprise customer's security questionnaire often become representations in the contract the vendor signs. Penwell Law reviews the questionnaire answers before they go back, and negotiates the master services agreement, the data processing agreement and the AI terms that arrive in the same procurement package. The practice represents companies from pre-seed startups to established enterprises on either side of the deal, including buyers reviewing a vendor's security, data and AI terms.
Who reviews the deal on the customer's side
In most large companies, procurement runs the commercial process and vendor onboarding. Legal reviews the master services agreement (MSA) with its liability cap and indemnities, and a privacy team reviews the data processing agreement (DPA). Security handles the questionnaire and security addendum along with the SOC 2 request. A risk or insurance group owns the certificate requirements, and some customers now route AI features through a separate review.
Customer paper and the issues list
Large customers usually require their own paper. Their MSA, DPA and security addendum can contradict one another on data return, breach notice and audit rights, and an unnoticed contradiction can become a commitment the company has made.
Penwell Law sends the company a short issues list, ranked by what could cost it real money or hold up the deal, before the full redline goes out. The practice also drafts the company's own MSA, DPA and security addendum.
Terms to hold and trade when procurement asks for changes
The points to hold firm on are the customer's asks that could exceed what the company can pay or perform. They include the structure of the liability cap and any super-cap for data claims, indemnity scope, uncapped exposure the insurance does not cover, and security or uptime commitments the company does not meet in practice. On customer templates, the list also includes clauses that assign "deliverables" to the customer, which can reach the product itself, and clauses that bind the company to customer policies "as updated from time to time," which let the customer change the company's obligations on its own. Terms to trade include invoicing mechanics, notice periods, reporting, and audit procedures with notice and frequency limits.
Security and AI terms
A company still working toward a SOC 2 Type II report can offer a Type I report, a readiness assessment or the auditor's signed engagement letter in the meantime. It can also send a completed standard questionnaire, such as the SIG Lite or the CAIQ, along with its written security policies. An AI company that promises a customer more than its own model provider promises it, for example on training use of customer data, retention and subprocessors, carries the gap itself.
What the first enterprise review exposes
A customer's procurement and security review can ask an early company for documents it has not written yet, such as an incident response plan, a subprocessor list and AI governance documents. Penwell Law writes the incident response plan and the AI governance documents with the company's team.
Common questions
Frequently asked questions
What kind of lawyer should a startup hire to negotiate its first enterprise contract?
A startup should look for a lawyer who has negotiated against enterprise customers' paper and will say which requested changes to accept, counter or refuse. Before the first call, the company should gather the customer's MSA, DPA and security addendum as procurement sent them, the security questionnaire with any answers already given, and the date the customer wants to sign.
Can a customer's DPA override the liability cap in our MSA?
The order-of-precedence clause and the DPA's own liability terms decide it together. If the clause gives the DPA priority and the DPA has its own liability terms, those terms can govern data claims in place of the negotiated cap. Many DPAs claim priority on personal-data matters, which can override terms negotiated in the MSA, so that clause is worth reading and negotiating.
How long does it take to get through a customer's procurement, legal and security review?
A first enterprise deal on the customer's paper commonly takes several weeks to a few months. Legal, privacy, security and insurance each run their own queue, so the slowest team sets the calendar, and teams that review in sequence add their waits together. Asking for the full list of reviewers at the start and answering them in parallel shortens the review.
Writing
Liam writes on the legal questions behind building and shipping technology: AI governance, privacy, and content rights. Read the blog →
Start the conversation
Based in Burlingame, California, working with clients and teams across Silicon Valley, the Bay Area, and nationally.
Inquiries