Third Party Tos Reviewer

third-party-tos-reviewer

Agent: Corporate Counsel

L2 corporate counsel (1x) responsible for compliance scanning, legal risk register, third-party TOS review, entity formation, corporate governance, and founder equity.

Department ethos: ideal-legal.md

Skill Description

Reviews third-party terms of service, vendor contracts, and partner agreements to identify legal risks, unfavorable clauses, and compliance implications before the company commits.

When to Use

• When the company is evaluating a new vendor, SaaS tool, or service provider and needs to understand the legal implications of their terms.
• When a third-party contract includes data processing, IP licensing, or indemnification clauses that require legal analysis.
• When renewing an existing vendor agreement and terms have changed since the last review.

Workflow

1. Document Collection: Obtain the complete terms of service, privacy policy, data processing agreement, and any supplemental terms. Identify the governing law and dispute resolution mechanism. Deliverable: complete document set with key metadata.
2. Risk Clause Analysis: Score the agreement using the scoring rubric at references/scoring-rubric.md across five criteria: liability and indemnification, data privacy and security, IP and data ownership, term and exit provisions, and modification and governance. Review for high-risk clauses per signal tables: unlimited liability, broad IP assignment, unilateral modification rights, data ownership ambiguity, non-compete restrictions, and auto-renewal with penalty. Deliverable: annotated risk summary with clause references and criterion scores.
3. Data and Compliance Review: Assess data handling provisions against the company's privacy obligations. Check GDPR Article 28 processor requirements (DPA, sub-processor disclosure, breach notification within 72 hours, data deletion on termination) and CCPA service provider provisions (no selling/sharing). Deliverable: data compliance assessment checklist.
4. Recommendation: Calculate composite score per rubric and determine grade band (Accept / Accept with Notes / Negotiate Minor / Negotiate Required / Reject Unless Negotiated / Reject). Produce the review report using template at assets/tos-review-report-template.md with specific redline requests and fallback positions for each unfavorable clause. Deliverable: TOS review report with scored recommendation and redlines.
5. Risk Register Update: Log any accepted risks (clauses that could not be negotiated) in the legal risk register with mitigation notes. Deliverable: updated risk register entry.

Anti-Patterns

• Reviewing TOS after signing: Conducting legal review after the team has already committed to the service. Why: post-signing review has no leverage; unfavorable terms are already binding and can only be mitigated, not negotiated.
• Ignoring privacy policy and DPA: Reviewing only the main TOS without examining the privacy policy and data processing agreement. Why: data handling obligations often live in separate documents, and missing them creates compliance gaps that regulators will find.
• Binary accept/reject without alternatives: Rejecting a vendor without suggesting alternatives or negotiation strategies. Why: the requesting team needs a path forward, not just a veto; legal should enable the business while managing risk.

Output

On success: Produces an annotated risk summary, data compliance assessment, and recommendation memo with redlines. Delivered to the requesting team and filed in the legal review archive.

On failure: Report which documents were unavailable for review (e.g., vendor refused to share DPA), what partial assessment is possible, and whether proceeding without full review is acceptable. Escalate to General Counsel.

Related Skills

• risk-register-legal -- Accepted risks from TOS reviews are logged in the legal risk register.
• compliance-scanner -- Compliance requirements inform which TOS clauses require scrutiny.