1. Is there a real cap on liability — and do the carve-outs swallow it?
The limitation of liability clause decides the worst case. A typical cap limits each side to the fees paid in the last 12 months, so if a project goes badly wrong, that number is what you can recover — or what you owe. The cap only means something once you read the exceptions: carve-outs for indemnity, confidentiality, or IP claims often sit outside the cap, and if they are broad enough they can quietly reintroduce unlimited exposure.
Watch for: A cap that protects only the vendor, a low or "fees paid in the prior month" cap on your recovery, a total exclusion of consequential damages that guts your real losses, and carve-outs so broad (indemnity, confidentiality, "gross negligence") that little is actually capped.
Ask for: A mutual cap tied to a meaningful figure (often 12 months of fees, or a multiple for data or security failures), consequential-damages exclusions that are reciprocal, and carve-outs limited to genuine exceptions like willful misconduct rather than everything that matters.
2. Indemnification — who defends whom, and how broad is it?
An indemnity is a promise to cover the other side's legal costs and losses if a third party sues over something you were responsible for. The fair version is narrow and mutual: the vendor covers IP-infringement and its own negligence, you cover your own misuse of the service. The dangerous version makes one party defend the other against "any and all claims arising from the agreement," which can pull in losses that had nothing to do with them.
Watch for: A one-way indemnity where only you defend the vendor, vague triggers like "any claim relating to this agreement," a duty to indemnify with no cap and no carve-out from the liability cap, and no vendor obligation to cover third-party IP claims over its own product.
Ask for: A mutual indemnity scoped to each party's actual fault, an explicit vendor indemnity for IP infringement by its deliverables, control-of-defense and settlement-consent language, and a clear statement of whether indemnity sits inside or outside the liability cap.
3. Term, auto-renewal, price increases, and how each side gets out
The term and termination clauses control how long you are locked in and on what terms. Many MSAs auto-renew for another full year unless you cancel weeks in advance, and bury a clause letting the vendor raise prices at renewal. The exit rights are often lopsided: the vendor can terminate "for convenience" on short notice while you can only leave "for cause," or you owe the rest of the contract if you walk.
Watch for: Automatic renewal with a long notice window (60–90 days) and no reminder, uncapped price increases at renewal, a vendor right to terminate for convenience with no matching right for you, and early-termination fees or "all remaining fees become due" on your exit.
Ask for: A renewal you must opt into, or at least a short cancellation window and a cap on renewal price increases; mutual termination-for-convenience with equal notice; a clear cure period for termination-for-cause; and a pro-rated refund of prepaid, unused fees.
4. IP and ownership — do you actually own what you paid to have built?
When the vendor builds something for you, this clause decides who owns it. You generally want to own the deliverables you paid for, with the vendor keeping its pre-existing tools and giving you a license to use them inside the deliverable. Problems appear when the vendor keeps ownership of the work product and only licenses it back to you, or when a broad "license-back" lets the vendor reuse your data or custom work for other clients.
Watch for: Deliverables that remain the vendor's property with only a license to you, no assignment on final payment, an over-broad license-back that lets the vendor reuse your custom work or data, and background IP defined so broadly it absorbs the thing you commissioned.
Ask for: Assignment of the custom deliverables to you on payment, a clear line between the vendor's background IP and your work product, a license to any background IP embedded in the deliverable, and a narrow, defined license-back if the vendor needs one at all.
5. Payment terms, warranties/SLAs, and data protection
The back half of an MSA is where cash flow, quality, and data risk live. Payment terms set when money is due and whether you can dispute an invoice; net-60 or net-90 can strain a small business, and auto-charge or auto-escalation clauses remove your control. Warranties and SLAs define what "working" means and what you get when it does not — and many contracts disclaim almost every warranty. Data-protection terms decide who is responsible if the vendor loses your customer data, and whether subprocessors and security standards are actually committed to.
Watch for: Net-60/90 terms with steep late fees, "all warranties disclaimed, service provided as-is," SLAs with no real remedy (credits you have to chase, or none at all), no breach-notification timeline, and subprocessors the vendor can add or change with no notice or security commitments.
Ask for: Payment terms you can actually meet (net-15/30) with a right to withhold disputed amounts, a baseline warranty that the service performs materially as described, SLAs with automatic credits, a defined breach-notification window, and a data-protection addendum listing subprocessors and security standards.
Before you sign that vendor MSA...
Upload it, tell Initialed which side you are on, and it flags the clauses that shift risk onto you — liability, indemnity, renewal, IP, payment and data — ranked by how much they can cost, in about two minutes. Your first credit is free.
Review your MSA freeFrequently asked
What should a small business check in an MSA?
Start with the five clauses that decide who pays when a deal goes wrong: the limitation of liability and its cap (plus the carve-outs), the indemnification obligations and whether they are mutual, the term and auto-renewal and how each side can terminate, ownership of any deliverables you pay for, and the payment terms, warranties/SLAs, and data-protection commitments. Those are where a routine-looking vendor contract most often shifts risk and cost onto you.
What is the difference between an MSA and an SOW?
A Master Services Agreement sets the long-term legal terms — liability, indemnity, IP, payment, termination, data protection — that govern the whole relationship. A Statement of Work sits under the MSA and describes a specific engagement: the deliverables, timeline, and price. The MSA is signed once; you can add new SOWs over time without renegotiating the legal terms. Read them together, because an SOW can quietly change pricing or scope that the MSA assumed.
Do I need a lawyer to review an MSA?
For a high-value, long-term, or unusual commercial agreement, a qualified attorney is worth it — the liability, indemnity, and IP terms can bind your business for years. For routine vendor MSAs, a fast, side-aware review can surface the risky terms in a couple of minutes so you know exactly what to push back on before you bring in counsel or sign.
Keep reading
All guides →Repairs, auto-renewal, uncapped rent, personal guaranties, and early-termination traps — what to watch for before you sign a lease.
The five clauses that decide whether a freelancer gets paid — scope, payment, IP, termination, and liability.
Comp and clawbacks, equity and vesting, IP assignment, non-competes, and arbitration — what to check before you accept a job offer.
Duration, geography, scope, and enforceability — how to read a non-compete before you sign (and why it varies so much by state).
Property, support, custody, and retirement — the terms in a divorce settlement that most often come back to bite.
The clauses that quietly decide what happens to a home, a business, or a career years from now — in plain English.
This guide is general information, not legal advice, and Initialed AI is not a law firm. Contract law varies by jurisdiction. For a high-value or unusual commercial agreement, consult a qualified attorney.