Legal & IP Fortress
The startup legal protection operating system. Actionable legal frameworks — not legal advice (always consult qualified counsel) — organized as decision trees, checklists, and compliance matrices so founders know what to ask, when to act, and what to protect.
Keywords
legal, lawyer, attorney, law firm, IP, intellectual property, patent, trademark, copyright, trade secret, NDA, non-disclosure, non-compete, contract, agreement, terms of service, privacy policy, employment agreement, offer letter, ESOP agreement, shareholder agreement, SHA, SSA, articles of incorporation, bylaws, operating agreement, entity formation, Delaware, Singapore, India, incorporation, regulatory, compliance, GDPR, CCPA, DPDP, data privacy, open source, license, MIT, Apache, GPL, litigation, lawsuit, cease and desist, C&D, injunction, arbitration, mediation, IP valuation, patent troll, freedom to operate, prior art, provisional patent, utility patent, design patent, 409A, fair market value, cap table legal, vesting, acceleration, ROFR, drag along, tag along, information rights, protective provisions, anti-dilution, liquidation preference, Companies Act, FEMA, RBI, SEBI, MCA, ROC, DPIIT, IT Act, Patent Act, Trademark Act, Copyright Act, Labour Code, Shop Establishment, GST, transfer pricing
How to Use This Skill
This skill operates in 6 modes based on legal need:
| Mode |
Trigger |
What It Does |
| Foundation |
"setting up my company", "incorporation" |
Entity structure, co-founder agreements, initial IP |
| Protect |
"patent this", "protect our IP" |
IP strategy, filing decisions, trade secret protocols |
| Contract |
"review this agreement", "NDA template" |
Contract analysis, negotiation points, templates |
| Comply |
"GDPR compliance", "regulatory requirements" |
Compliance checklists, gap analysis, remediation |
| Defend |
"cease and desist", "we're being sued" |
Litigation readiness, response protocols, insurance |
| Transact |
"acquisition legal", "due diligence legal" |
M&A legal prep, IP valuation, DD checklists |
Chain with existing skills:
fundraising-command-center for term sheet legal terms
crisis-war-room for legal crises and litigation
governance-compliance-shield for ongoing regulatory compliance
talent-os for employment law and equity legal
india-business-law for detailed India regulatory guidance
IMPORTANT: This skill provides frameworks and checklists for legal planning. It is NOT legal advice. Always engage qualified legal counsel for specific legal matters.
1. Entity Formation Decision Matrix
Jurisdiction Selection
Where should you incorporate?
├── Raising US VC money? → Delaware C-Corp (standard, 85%+ of VC-backed startups)
├── Raising only from Indian investors? → India Private Limited (Section 2(68))
├── Want both? → Delaware parent + India subsidiary (flip structure)
├── Hardware/manufacturing in India? → India Pvt Ltd (easier to operate)
├── IP licensing model? → Consider Singapore + India subsidiary
├── Crypto/Web3? → Cayman/BVI + operating entity (consult counsel)
└── Bootstrapped, India-only? → India LLP or Pvt Ltd
Entity Type Comparison
| Factor |
Delaware C-Corp |
India Pvt Ltd |
Singapore Pte Ltd |
LLP (India) |
| VC Fundraise |
Standard |
Acceptable |
Good for SEA |
Not suitable |
| ESOP Flexibility |
Excellent |
Good (post-2020) |
Excellent |
Limited |
| Tax Efficiency |
Higher corp tax |
Lower initially |
Low (17%) |
Pass-through |
| Flip Structure |
N/A |
Needs RBI approval |
Easier |
N/A |
| Compliance Burden |
Low-Medium |
High |
Medium |
Medium |
| Cost to Set Up |
$1,500-3,000 |
INR 10,000-25,000 |
SGD 3,000-5,000 |
INR 5,000-15,000 |
Day-1 Legal Checklist (Pre-Revenue)
2. IP Strategy Matrix
IP Protection Decision Tree
What type of IP do you have?
│
├── Technical invention (novel, non-obvious, useful)?
│ ├── Yes → Consider patent
│ │ ├── Software/algorithm → Provisional patent (buy time) + trade secret for implementation
│ │ ├── Hardware/device → Utility patent (strong protection)
│ │ ├── Design/UI → Design patent (cheaper, narrower)
│ │ └── Pharma/biotech → Utility patent (essential, long timeline)
│ └── No → Trade secret + copyright
│
├── Brand name, logo, slogan?
│ └── Trademark registration (file early, enforce always)
│
├── Creative work (code, content, design)?
│ └── Copyright (automatic, but register for enforcement)
│
├── Customer data, algorithms, processes?
│ └── Trade secret (strongest when patent not viable)
│
└── Open source contributions?
└── License compliance + CLA (Contributor License Agreement)
Patent vs Trade Secret Decision
| Factor |
Patent |
Trade Secret |
| Duration |
20 years (utility), 15 years (design) |
Indefinite (as long as secret) |
| Disclosure |
Full public disclosure required |
Must remain secret |
| Cost |
$15K-50K+ per patent (US) |
Low (internal controls) |
| Enforcement |
Can stop independent invention |
Only protects against misappropriation |
| Speed |
2-5 years to grant |
Immediate |
| Best for |
Hardware, pharma, defensible tech |
Algorithms, processes, data, recipes |
| Startup budget |
Provisional first ($3-5K), full later |
NDA + access controls + documentation |
Patent Filing Strategy for Startups
Phase 1: Provisional Patent ($3-5K)
- File as early as possible for priority date
- 12-month window to file full application
- "Patent Pending" status for investor conversations
- Can be broad — refine in full application
Phase 2: PCT Application (Month 12, $5-10K)
- International treaty — buys 30 months to choose countries
- Single application covers 150+ countries
- Essential if you plan international expansion
Phase 3: National Phase (Month 30, $10-30K per country)
- File in jurisdictions where you'll do business or face competition
- Priority countries: US, EU (EPO), China, India, Japan
- Cost-benefit: only file where enforcement is realistic
Trademark Protection Protocol
| Action |
Timeline |
Cost |
Priority |
| Trademark search (TESS/TMR) |
Before naming |
Free-$500 |
Critical |
| File trademark application |
Day 1 |
$250-350/class (USPTO) |
High |
| Domain name registration |
Day 1 |
$10-50/year |
Critical |
| Social media handles |
Day 1 |
Free |
High |
| International trademark (Madrid Protocol) |
When expanding |
$600-1,500/country |
Medium |
| Monitor for infringement |
Ongoing |
$100-500/month |
Medium |
India IP Filing
| IP Type |
Filing Office |
Typical Cost |
Timeline |
| Patent (Provisional) |
Indian Patent Office |
INR 8,000-15,000 |
Immediate |
| Patent (Complete) |
Indian Patent Office |
INR 50,000-2,00,000 |
3-7 years |
| Trademark |
TMR, Controller General |
INR 4,500-9,000/class |
12-24 months |
| Copyright |
Copyright Office |
INR 500-2,000 |
6-12 months |
| Design |
Design Wing, Patent Office |
INR 4,000-8,000 |
6-12 months |
| GI (Geographical Indication) |
GI Registry |
INR 5,000-10,000 |
12-24 months |
3. Contract Essentials Matrix
Critical Contracts by Stage
| Stage |
Must-Have Contracts |
Nice-to-Have |
| Pre-Seed |
Co-founder agreement, IP assignment, NDA, CIIA |
Advisory agreements |
| Seed |
+ Employment agreements, customer ToS, privacy policy |
Vendor agreements, partnership MOUs |
| Series A |
+ SHA/SSA, board consent forms, ESOP plan, data processing agreements |
Channel partner agreements, licensing deals |
| Series B+ |
+ International contracts, joint ventures, M&A documentation |
Franchise agreements, complex licensing |
Key Contract Negotiation Points
Employment Agreements:
- IP assignment (work-for-hire + assignment of inventions)
- Non-compete: enforceable varies by jurisdiction (void in California, limited in India)
- Non-solicitation: 12-24 months is standard
- At-will vs fixed term (India requires notice period)
- ESOP grant as part of offer (vest schedule, exercise price, cliff)
Customer Agreements (SaaS):
- Limitation of liability (cap at 12 months of fees paid)
- Indemnification (mutual, with carve-outs for IP infringement)
- Data processing terms (GDPR Art 28 if EU customers)
- SLA with remedies (credits, not termination)
- Auto-renewal with notice period for cancellation
Vendor/Contractor Agreements:
- IP ownership (ensure company owns all work product)
- Confidentiality (survives termination)
- Indemnification for IP infringement
- Termination for convenience (30-day notice)
- Data security requirements (especially for PII handlers)
4. Data Privacy Compliance Matrix
Regulation Applicability
| Regulation |
Applies If |
Key Requirements |
Penalty |
| GDPR |
Any EU user data |
Consent, DPO, DPIA, 72hr breach notice |
Up to 4% global revenue or EUR 20M |
| CCPA/CPRA |
CA residents, >$25M rev or >100K consumers |
Opt-out, data deletion, no discrimination |
$2,500-7,500 per violation |
| DPDP Act (India) |
Indian data principals |
Consent, purpose limitation, breach notice |
Up to INR 250 crore |
| PIPEDA (Canada) |
Canadian user data |
Consent, accountability, access rights |
Up to CAD 100,000 |
| POPIA (South Africa) |
SA user data |
Consent, purpose specification |
Up to ZAR 10M |
| LGPD (Brazil) |
Brazilian user data |
Consent, DPO, legitimate interest |
Up to 2% revenue or BRL 50M |
Privacy Compliance Checklist (Minimum Viable)
5. Open Source License Compliance
License Compatibility Matrix
| License |
Can Use In Proprietary Product? |
Must Disclose Source? |
Patent Grant? |
| MIT |
Yes |
No (include copyright notice) |
No |
| Apache 2.0 |
Yes |
No (include NOTICE file) |
Yes |
| BSD 2/3 |
Yes |
No (include copyright) |
No |
| LGPL |
Yes (with dynamic linking) |
Only modifications to LGPL code |
No |
| MPL 2.0 |
Yes |
Only modified MPL files |
Yes |
| GPL v2/v3 |
NO (copyleft) |
Entire derivative work |
v3 only |
| AGPL v3 |
NO (network copyleft) |
Including SaaS use |
Yes |
| SSPL |
NO |
Entire service stack |
No |
| BSL |
Varies (time-delayed) |
After change date |
Varies |
Safe Practices
- Maintain SBOM (Software Bill of Materials)
- Automated license scanning (FOSSA, Snyk, WhiteSource)
- GPL/AGPL: never import into proprietary codebase without legal review
- Copyleft code in microservice? Isolate behind API boundary
- Contribute back: safer than forking for long-term maintenance
6. Litigation Prevention Playbook
Top 10 Lawsuit Triggers for Startups
| # |
Trigger |
Prevention |
| 1 |
Co-founder dispute (no written agreement) |
SHA/founder agreement on Day 1 |
| 2 |
IP ownership unclear (contractor/former employer) |
CIIA, IP assignment, clean room |
| 3 |
Employee misclassification (contractor vs employee) |
Follow IRS 20-factor test, state tests |
| 4 |
Non-compete violation (from previous employer) |
Legal review before hiring, clean room |
| 5 |
Customer data breach |
Security program, incident response plan |
| 6 |
Trademark infringement |
Search before naming, register early |
| 7 |
Patent infringement |
Freedom-to-operate search for core tech |
| 8 |
Securities violation (fundraising) |
Use standard docs, Reg D compliance |
| 9 |
Employment discrimination |
Document everything, consistent policies |
| 10 |
Vendor payment dispute |
Clear contracts, documented deliverables |
Insurance Requirements by Stage
| Insurance |
When to Get |
Typical Cost |
Coverage |
| D&O |
At first funding |
$2,000-10,000/yr |
Director/officer liability |
| E&O/Professional Liability |
At first customer |
$1,000-5,000/yr |
Service errors, negligence |
| Cyber Liability |
At first user data |
$1,000-7,500/yr |
Data breach costs |
| General Liability |
At incorporation |
$500-3,000/yr |
Physical injury, property damage |
| Workers' Comp |
At first hire |
State-mandated |
Employee injuries |
| Key Person |
At Series A |
Varies |
CEO/CTO incapacity |
| IP Insurance |
If patent-heavy |
$5,000-25,000/yr |
Patent defense/enforcement |
7. M&A / Exit Legal Readiness
Legal Due Diligence Checklist (What Acquirers Examine)
India M&A Legal Considerations
- CCI Approval: Competition Commission of India approval if turnover/asset thresholds met
- FEMA Compliance: RBI approval for cross-border M&A
- Stamp Duty: Varies by state on share transfer
- Capital Gains: Short-term vs long-term based on holding period
- Section 56(2)(x): Consideration below fair value triggers tax
- NCLT Scheme: Court-approved merger scheme for complex structures
Reference Files
For detailed templates and India-specific legal guides, load:
reference/contract-templates-index.md — Key clauses and negotiation points for all startup contracts
reference/india-legal-compliance.md — India Companies Act, FEMA, labor law, and tax compliance matrices
Forensic Intelligence & Regulatory Arbitrage Layer
Benford's Law for Due Diligence
In legitimate data, digit "1" leads ~30%. Fabricated → uniform distribution.
Protocol: Extract financials → first-digit analysis → chi-squared test
p < 0.05 → Flag for investigation. 30% more likely adverse SOX opinions.
Use as screening tool, not definitive proof.
OSINT for Competitive Intel
1. Job postings → strategic direction (new ML hires = AI pivot)
2. BuiltWith → competitor tech stack (costs, capabilities)
3. Patent/trademark filings → future product direction
4. Glassdoor/Blind → culture intelligence, litigation risk
5. Google dorking: site:competitor.com filetype:pdf
6. Court records → ongoing litigation exposure
Regulatory Sandbox Strategies
| Jurisdiction |
Regulator |
Timeline |
Key Benefit |
| UK |
FCA |
6-12mo |
Regulatory cover |
| Singapore |
MAS |
6mo |
Clear path to full license |
| India |
RBI |
12-18mo |
Test without full compliance |
| India |
IFSCA (GIFT City) |
Varies |
No FEMA, tax holiday |
| UAE |
DFSA |
12mo |
Tax-free + regulatory cover |
R&D Tax Credit Optimization
| Jurisdiction |
Benefit |
Key Detail |
| US Section 174 |
Full deduction |
Immediate expensing restored (2025) |
| UK RDEC |
20% credit |
Enhanced for R&D-intensive SMEs |
| India Section 35 |
100% deduction |
DSIR approval required |
| Singapore |
250% deduction |
First S$400K qualifying R&D |
Forward/Reverse Flip (2025-2026)
Forward flip: India → Delaware/Singapore. Pre-Series A with US VC interest.
Reverse flip: Overseas → India. Major trend (Razorpay, Zepto, Meesho completed 2025).
September 2024 fast-track process: 90-120 days vs previous 8-12 months.
1---2name: legal-ip-fortress3description: Startup legal and IP protection operating system covering entity formation, co-founder agreements, IP strategy (patents, trademarks, trade secrets, copyright), employment law, contract management, regulatory compliance by industry, data privacy (GDPR/CCPA/DPDP), open-source license compliance, litigation prevention, IP valuation, M&A legal readiness, and investor-side legal requirements. Includes comprehensive India legal stack covering Companies Act 2013, FEMA, RBI regulations, SEBI compliance, Patent Act 1970, Trademark Act 1999, IT Act 2000, DPDP Act 2023, Labour Codes 2020, Shop & Establishment Acts, GST compliance, transfer pricing, and regulatory sandbox frameworks. Use when user mentions legal, lawyer, attorney, IP, patent, trademark, copyright, trade secret, contract, NDA, employment agreement, ESOP agreement, shareholder agreement, term sheet legal, regulatory, compliance, GDPR, CCPA, data privacy, open source license, litigation, lawsuit, cease and desist, incorporation, entity structure, or any leg4license: MIT5---6
7# Legal & IP Fortress
8
9The startup legal protection operating system. Actionable legal frameworks — not legal advice (always consult qualified counsel) — organized as decision trees, checklists, and compliance matrices so founders know what to ask, when to act, and what to protect.
10
11## Keywords
12
13legal, lawyer, attorney, law firm, IP, intellectual property, patent, trademark, copyright, trade secret, NDA, non-disclosure, non-compete, contract, agreement, terms of service, privacy policy, employment agreement, offer letter, ESOP agreement, shareholder agreement, SHA, SSA, articles of incorporation, bylaws, operating agreement, entity formation, Delaware, Singapore, India, incorporation, regulatory, compliance, GDPR, CCPA, DPDP, data privacy, open source, license, MIT, Apache, GPL, litigation, lawsuit, cease and desist, C&D, injunction, arbitration, mediation, IP valuation, patent troll, freedom to operate, prior art, provisional patent, utility patent, design patent, 409A, fair market value, cap table legal, vesting, acceleration, ROFR, drag along, tag along, information rights, protective provisions, anti-dilution, liquidation preference, Companies Act, FEMA, RBI, SEBI, MCA, ROC, DPIIT, IT Act, Patent Act, Trademark Act, Copyright Act, Labour Code, Shop Establishment, GST, transfer pricing
14
15---
16
17## How to Use This Skill
18
19This skill operates in **6 modes** based on legal need:
20
21| Mode | Trigger | What It Does |
22|------|---------|--------------|
23| **Foundation** | "setting up my company", "incorporation" | Entity structure, co-founder agreements, initial IP |
24| **Protect** | "patent this", "protect our IP" | IP strategy, filing decisions, trade secret protocols |
25| **Contract** | "review this agreement", "NDA template" | Contract analysis, negotiation points, templates |
26| **Comply** | "GDPR compliance", "regulatory requirements" | Compliance checklists, gap analysis, remediation |
27| **Defend** | "cease and desist", "we're being sued" | Litigation readiness, response protocols, insurance |
28| **Transact** | "acquisition legal", "due diligence legal" | M&A legal prep, IP valuation, DD checklists |
29
30**Chain with existing skills:**
31- `fundraising-command-center` for term sheet legal terms
32- `crisis-war-room` for legal crises and litigation
33- `governance-compliance-shield` for ongoing regulatory compliance
34- `talent-os` for employment law and equity legal
35- `india-business-law` for detailed India regulatory guidance
36
37**IMPORTANT**: This skill provides frameworks and checklists for legal planning. It is NOT legal advice. Always engage qualified legal counsel for specific legal matters.
38
39---
40
41## 1. Entity Formation Decision Matrix
42
43### Jurisdiction Selection
44
45```
46Where should you incorporate?
47├── Raising US VC money? → Delaware C-Corp (standard, 85%+ of VC-backed startups)
48├── Raising only from Indian investors? → India Private Limited (Section 2(68))
49├── Want both? → Delaware parent + India subsidiary (flip structure)
50├── Hardware/manufacturing in India? → India Pvt Ltd (easier to operate)
51├── IP licensing model? → Consider Singapore + India subsidiary
52├── Crypto/Web3? → Cayman/BVI + operating entity (consult counsel)
53└── Bootstrapped, India-only? → India LLP or Pvt Ltd
54```
55
56### Entity Type Comparison
57
58| Factor | Delaware C-Corp | India Pvt Ltd | Singapore Pte Ltd | LLP (India) |
59|--------|----------------|---------------|-------------------|-------------|
60| VC Fundraise | Standard | Acceptable | Good for SEA | Not suitable |
61| ESOP Flexibility | Excellent | Good (post-2020) | Excellent | Limited |
62| Tax Efficiency | Higher corp tax | Lower initially | Low (17%) | Pass-through |
63| Flip Structure | N/A | Needs RBI approval | Easier | N/A |
64| Compliance Burden | Low-Medium | High | Medium | Medium |
65| Cost to Set Up | $1,500-3,000 | INR 10,000-25,000 | SGD 3,000-5,000 | INR 5,000-15,000 |
66
67### Day-1 Legal Checklist (Pre-Revenue)
68
69- [ ] Entity incorporated with clean structure
70- [ ] Co-founder agreement / SHA signed
71- [ ] IP assignment agreements (all founders assign IP to company)
72- [ ] CIIA (Confidential Information & Invention Assignment) for all team members
73- [ ] Vesting schedule established (4yr/1yr cliff standard)
74- [ ] Board resolutions for initial actions
75- [ ] EIN/PAN/TAN obtained
76- [ ] Basic employment agreements drafted
77- [ ] NDA template ready
78- [ ] Domain names secured
79- [ ] Trademark search conducted for company name
80- [ ] Privacy policy and ToS drafted (if customer-facing)
81
82---
83
84## 2. IP Strategy Matrix
85
86### IP Protection Decision Tree
87
88```
89What type of IP do you have?
90│
91├── Technical invention (novel, non-obvious, useful)?
92│ ├── Yes → Consider patent
93│ │ ├── Software/algorithm → Provisional patent (buy time) + trade secret for implementation
94│ │ ├── Hardware/device → Utility patent (strong protection)
95│ │ ├── Design/UI → Design patent (cheaper, narrower)
96│ │ └── Pharma/biotech → Utility patent (essential, long timeline)
97│ └── No → Trade secret + copyright
98│
99├── Brand name, logo, slogan?
100│ └── Trademark registration (file early, enforce always)
101│
102├── Creative work (code, content, design)?
103│ └── Copyright (automatic, but register for enforcement)
104│
105├── Customer data, algorithms, processes?
106│ └── Trade secret (strongest when patent not viable)
107│
108└── Open source contributions?
109 └── License compliance + CLA (Contributor License Agreement)
110```
111
112### Patent vs Trade Secret Decision
113
114| Factor | Patent | Trade Secret |
115|--------|--------|-------------|
116| **Duration** | 20 years (utility), 15 years (design) | Indefinite (as long as secret) |
117| **Disclosure** | Full public disclosure required | Must remain secret |
118| **Cost** | $15K-50K+ per patent (US) | Low (internal controls) |
119| **Enforcement** | Can stop independent invention | Only protects against misappropriation |
120| **Speed** | 2-5 years to grant | Immediate |
121| **Best for** | Hardware, pharma, defensible tech | Algorithms, processes, data, recipes |
122| **Startup budget** | Provisional first ($3-5K), full later | NDA + access controls + documentation |
123
124### Patent Filing Strategy for Startups
125
126**Phase 1: Provisional Patent ($3-5K)**
127- File as early as possible for priority date
128- 12-month window to file full application
129- "Patent Pending" status for investor conversations
130- Can be broad — refine in full application
131
132**Phase 2: PCT Application (Month 12, $5-10K)**
133- International treaty — buys 30 months to choose countries
134- Single application covers 150+ countries
135- Essential if you plan international expansion
136
137**Phase 3: National Phase (Month 30, $10-30K per country)**
138- File in jurisdictions where you'll do business or face competition
139- Priority countries: US, EU (EPO), China, India, Japan
140- Cost-benefit: only file where enforcement is realistic
141
142### Trademark Protection Protocol
143
144| Action | Timeline | Cost | Priority |
145|--------|----------|------|----------|
146| Trademark search (TESS/TMR) | Before naming | Free-$500 | Critical |
147| File trademark application | Day 1 | $250-350/class (USPTO) | High |
148| Domain name registration | Day 1 | $10-50/year | Critical |
149| Social media handles | Day 1 | Free | High |
150| International trademark (Madrid Protocol) | When expanding | $600-1,500/country | Medium |
151| Monitor for infringement | Ongoing | $100-500/month | Medium |
152
153### India IP Filing
154
155| IP Type | Filing Office | Typical Cost | Timeline |
156|---------|-------------|-------------|----------|
157| Patent (Provisional) | Indian Patent Office | INR 8,000-15,000 | Immediate |
158| Patent (Complete) | Indian Patent Office | INR 50,000-2,00,000 | 3-7 years |
159| Trademark | TMR, Controller General | INR 4,500-9,000/class | 12-24 months |
160| Copyright | Copyright Office | INR 500-2,000 | 6-12 months |
161| Design | Design Wing, Patent Office | INR 4,000-8,000 | 6-12 months |
162| GI (Geographical Indication) | GI Registry | INR 5,000-10,000 | 12-24 months |
163
164---
165
166## 3. Contract Essentials Matrix
167
168### Critical Contracts by Stage
169
170| Stage | Must-Have Contracts | Nice-to-Have |
171|-------|-------------------|-------------|
172| **Pre-Seed** | Co-founder agreement, IP assignment, NDA, CIIA | Advisory agreements |
173| **Seed** | + Employment agreements, customer ToS, privacy policy | Vendor agreements, partnership MOUs |
174| **Series A** | + SHA/SSA, board consent forms, ESOP plan, data processing agreements | Channel partner agreements, licensing deals |
175| **Series B+** | + International contracts, joint ventures, M&A documentation | Franchise agreements, complex licensing |
176
177### Key Contract Negotiation Points
178
179**Employment Agreements:**
180- IP assignment (work-for-hire + assignment of inventions)
181- Non-compete: enforceable varies by jurisdiction (void in California, limited in India)
182- Non-solicitation: 12-24 months is standard
183- At-will vs fixed term (India requires notice period)
184- ESOP grant as part of offer (vest schedule, exercise price, cliff)
185
186**Customer Agreements (SaaS):**
187- Limitation of liability (cap at 12 months of fees paid)
188- Indemnification (mutual, with carve-outs for IP infringement)
189- Data processing terms (GDPR Art 28 if EU customers)
190- SLA with remedies (credits, not termination)
191- Auto-renewal with notice period for cancellation
192
193**Vendor/Contractor Agreements:**
194- IP ownership (ensure company owns all work product)
195- Confidentiality (survives termination)
196- Indemnification for IP infringement
197- Termination for convenience (30-day notice)
198- Data security requirements (especially for PII handlers)
199
200---
201
202## 4. Data Privacy Compliance Matrix
203
204### Regulation Applicability
205
206| Regulation | Applies If | Key Requirements | Penalty |
207|-----------|-----------|-----------------|---------|
208| **GDPR** | Any EU user data | Consent, DPO, DPIA, 72hr breach notice | Up to 4% global revenue or EUR 20M |
209| **CCPA/CPRA** | CA residents, >$25M rev or >100K consumers | Opt-out, data deletion, no discrimination | $2,500-7,500 per violation |
210| **DPDP Act (India)** | Indian data principals | Consent, purpose limitation, breach notice | Up to INR 250 crore |
211| **PIPEDA (Canada)** | Canadian user data | Consent, accountability, access rights | Up to CAD 100,000 |
212| **POPIA (South Africa)** | SA user data | Consent, purpose specification | Up to ZAR 10M |
213| **LGPD (Brazil)** | Brazilian user data | Consent, DPO, legitimate interest | Up to 2% revenue or BRL 50M |
214
215### Privacy Compliance Checklist (Minimum Viable)
216
217- [ ] Privacy policy published and accessible
218- [ ] Cookie consent mechanism (if serving EU)
219- [ ] Data processing agreements with all vendors handling PII
220- [ ] Data inventory: what data, where stored, who accesses, retention period
221- [ ] User rights mechanism: access, deletion, portability requests
222- [ ] Breach notification process documented
223- [ ] Employee training on data handling
224- [ ] Encryption at rest and in transit for PII
225- [ ] Access controls and logging for PII systems
226
227---
228
229## 5. Open Source License Compliance
230
231### License Compatibility Matrix
232
233| License | Can Use In Proprietary Product? | Must Disclose Source? | Patent Grant? |
234|---------|-------------------------------|----------------------|--------------|
235| **MIT** | Yes | No (include copyright notice) | No |
236| **Apache 2.0** | Yes | No (include NOTICE file) | Yes |
237| **BSD 2/3** | Yes | No (include copyright) | No |
238| **LGPL** | Yes (with dynamic linking) | Only modifications to LGPL code | No |
239| **MPL 2.0** | Yes | Only modified MPL files | Yes |
240| **GPL v2/v3** | NO (copyleft) | Entire derivative work | v3 only |
241| **AGPL v3** | NO (network copyleft) | Including SaaS use | Yes |
242| **SSPL** | NO | Entire service stack | No |
243| **BSL** | Varies (time-delayed) | After change date | Varies |
244
245### Safe Practices
246- Maintain SBOM (Software Bill of Materials)
247- Automated license scanning (FOSSA, Snyk, WhiteSource)
248- GPL/AGPL: never import into proprietary codebase without legal review
249- Copyleft code in microservice? Isolate behind API boundary
250- Contribute back: safer than forking for long-term maintenance
251
252---
253
254## 6. Litigation Prevention Playbook
255
256### Top 10 Lawsuit Triggers for Startups
257
258| # | Trigger | Prevention |
259|---|---------|-----------|
260| 1 | Co-founder dispute (no written agreement) | SHA/founder agreement on Day 1 |
261| 2 | IP ownership unclear (contractor/former employer) | CIIA, IP assignment, clean room |
262| 3 | Employee misclassification (contractor vs employee) | Follow IRS 20-factor test, state tests |
263| 4 | Non-compete violation (from previous employer) | Legal review before hiring, clean room |
264| 5 | Customer data breach | Security program, incident response plan |
265| 6 | Trademark infringement | Search before naming, register early |
266| 7 | Patent infringement | Freedom-to-operate search for core tech |
267| 8 | Securities violation (fundraising) | Use standard docs, Reg D compliance |
268| 9 | Employment discrimination | Document everything, consistent policies |
269| 10 | Vendor payment dispute | Clear contracts, documented deliverables |
270
271### Insurance Requirements by Stage
272
273| Insurance | When to Get | Typical Cost | Coverage |
274|-----------|------------|-------------|---------|
275| **D&O** | At first funding | $2,000-10,000/yr | Director/officer liability |
276| **E&O/Professional Liability** | At first customer | $1,000-5,000/yr | Service errors, negligence |
277| **Cyber Liability** | At first user data | $1,000-7,500/yr | Data breach costs |
278| **General Liability** | At incorporation | $500-3,000/yr | Physical injury, property damage |
279| **Workers' Comp** | At first hire | State-mandated | Employee injuries |
280| **Key Person** | At Series A | Varies | CEO/CTO incapacity |
281| **IP Insurance** | If patent-heavy | $5,000-25,000/yr | Patent defense/enforcement |
282
283---
284
285## 7. M&A / Exit Legal Readiness
286
287### Legal Due Diligence Checklist (What Acquirers Examine)
288
289- [ ] Clean cap table with no disputes
290- [ ] All IP properly assigned to company (no gaps)
291- [ ] No pending or threatened litigation
292- [ ] All employment agreements current and enforceable
293- [ ] Regulatory compliance documented
294- [ ] Customer contracts transferable (no change-of-control issues)
295- [ ] No material undisclosed liabilities
296- [ ] Tax filings current and accurate
297- [ ] Insurance policies adequate
298- [ ] All corporate governance documents in order
299- [ ] Data privacy compliance documented
300- [ ] Open source compliance verified
301- [ ] No outstanding government investigations
302- [ ] Material contracts have assignment provisions
303
304### India M&A Legal Considerations
305- **CCI Approval**: Competition Commission of India approval if turnover/asset thresholds met
306- **FEMA Compliance**: RBI approval for cross-border M&A
307- **Stamp Duty**: Varies by state on share transfer
308- **Capital Gains**: Short-term vs long-term based on holding period
309- **Section 56(2)(x)**: Consideration below fair value triggers tax
310- **NCLT Scheme**: Court-approved merger scheme for complex structures
311
312---
313
314## Reference Files
315
316For detailed templates and India-specific legal guides, load:
317- [`reference/contract-templates-index.md`](reference/contract-templates-index.md) — Key clauses and negotiation points for all startup contracts
318- [`reference/india-legal-compliance.md`](reference/india-legal-compliance.md) — India Companies Act, FEMA, labor law, and tax compliance matrices
319
320## Forensic Intelligence & Regulatory Arbitrage Layer
321
322### Benford's Law for Due Diligence
323
324```
325In legitimate data, digit "1" leads ~30%. Fabricated → uniform distribution.
326Protocol: Extract financials → first-digit analysis → chi-squared test
327p < 0.05 → Flag for investigation. 30% more likely adverse SOX opinions.
328Use as screening tool, not definitive proof.
329```
330
331### OSINT for Competitive Intel
332
333```
3341. Job postings → strategic direction (new ML hires = AI pivot)
3352. BuiltWith → competitor tech stack (costs, capabilities)
3363. Patent/trademark filings → future product direction
3374. Glassdoor/Blind → culture intelligence, litigation risk
3385. Google dorking: site:competitor.com filetype:pdf
3396. Court records → ongoing litigation exposure
340```
341
342### Regulatory Sandbox Strategies
343
344| Jurisdiction | Regulator | Timeline | Key Benefit |
345|-------------|-----------|----------|-------------|
346| UK | FCA | 6-12mo | Regulatory cover |
347| Singapore | MAS | 6mo | Clear path to full license |
348| India | RBI | 12-18mo | Test without full compliance |
349| India | IFSCA (GIFT City) | Varies | No FEMA, tax holiday |
350| UAE | DFSA | 12mo | Tax-free + regulatory cover |
351
352### R&D Tax Credit Optimization
353
354| Jurisdiction | Benefit | Key Detail |
355|-------------|---------|------------|
356| US Section 174 | Full deduction | Immediate expensing restored (2025) |
357| UK RDEC | 20% credit | Enhanced for R&D-intensive SMEs |
358| India Section 35 | 100% deduction | DSIR approval required |
359| Singapore | 250% deduction | First S$400K qualifying R&D |
360
361### Forward/Reverse Flip (2025-2026)
362
363Forward flip: India → Delaware/Singapore. Pre-Series A with US VC interest.
364Reverse flip: Overseas → India. Major trend (Razorpay, Zepto, Meesho completed 2025).
365September 2024 fast-track process: 90-120 days vs previous 8-12 months.