SKILL 76: Vendor & Contractor Agreements
Purpose
Legal protection for every external relationship that touches your product — developers, vendors, SaaS providers, subcontractors. The right agreements prevent IP disputes, tax disasters, and security breaches.
Independent Contractor Agreement — Required Elements
Scope of Work
- Specific deliverables (not "help with development" — list exact outputs)
- Timeline and milestones
- Acceptance criteria for each milestone
- Revision rounds included vs. charged separately
Payment
- Fixed fee per milestone preferred over hourly (clearer budget, aligned incentives)
- Payment terms: net 30 after milestone acceptance
- Late payment: 1.5%/month interest on overdue amounts
- Expenses: reimbursed only with pre-approval and receipts
IP Assignment (CRITICAL)
"All work product, including but not limited to source code, designs, documentation, inventions, and improvements, created by Contractor in connection with this Agreement shall be the sole and exclusive property of the Company. Contractor hereby assigns all right, title, and interest in such work product to the Company, including all intellectual property rights."
- Includes: everything made using company resources, time, or information
- Work made for hire doctrine: where applicable, work is "work made for hire" under 17 U.S.C. § 101
- Prior IP: list any pre-existing IP the contractor retains (they must carve it out explicitly)
Confidentiality
- NDA embedded in the agreement (no separate NDA needed)
- Covers: all company information, user data, technical systems, business plans
- Survives termination for [2–5 years] or until information is publicly known
Non-Solicitation
- Contractor won't solicit your employees for [12–24 months] after engagement
- Note: not a non-compete — just a non-solicitation (more enforceable, less restrictive)
Independent Contractor Status
"Contractor is an independent contractor, not an employee. Nothing in this Agreement creates an employment relationship, partnership, or joint venture."
- Why critical: misclassification as employee → back payroll taxes, benefits, workers comp liability
- Tax: collect W-9 (US) before first payment; W-8BEN for non-US contractors
- Issue 1099-NEC if US contractor is paid >$600/year
Termination
- Either party: [14/30] days written notice
- For cause: immediate termination if contractor violates IP assignment, confidentiality, or prohibited conduct provisions
- On termination: contractor delivers all work product, deletes company data
Indemnification
- Contractor indemnifies company for: IP infringement in their work product, their own tax obligations, their compliance with applicable law
- Company indemnifies contractor for: company's use of the work product as directed
Software Development Agreement (External Dev Shops)
Everything in the contractor agreement PLUS:
- Source code ownership: company owns ALL source code. No license-back to the developer.
- Escrow: if dev shop goes bankrupt, source code held in escrow is accessible to company
- Warranty: code is free from known material defects, substantially conforms to specifications, does not infringe third-party IP
- Acceptance testing: define acceptance criteria for each milestone. Payment contingent on acceptance.
- Security requirements: follow OWASP guidelines, no hardcoded credentials, no known vulnerabilities, no GPL/AGPL without prior approval
- Bug fix support: [90-day] post-delivery support for defects, included in contract price
- Source control: all code committed to company-controlled repository (GitHub org, not contractor's account)
SaaS Vendor Agreement Review Checklist
Before signing any vendor TOS, verify:
| Issue |
What to Verify |
Red Flag |
| Data ownership |
You own YOUR data |
"Vendor owns all data" |
| Data portability |
You can export all data |
No export capability |
| SLA |
99.9%+ uptime guarantee |
No uptime commitment |
| Data security |
Encryption at rest and transit, access controls |
No security specifications |
| Breach notification |
72-hour notice |
No breach notification obligation |
| Termination and data return |
Data returned within 30 days after termination |
Data deleted immediately |
| Sub-processors |
List of sub-processors provided |
No sub-processor transparency |
| DPA availability |
Standard DPA available (for GDPR compliance) |
No DPA |
Key Vendors to Negotiate Enterprise Terms With
- Supabase: database hosting, data processing agreement
- Vercel: frontend hosting, DPA
- Anthropic: AI API, enterprise agreement covering your use case (CRITICAL — see SKILL 45)
- OpenAI: backup AI API, enterprise agreement
Subprocessor Agreements (GDPR)
If serving EU users:
- Vendors that process EU user data are "subprocessors"
- Data Processing Agreement (DPA) required with each subprocessor
- Maintain a subprocessor list: vendors, data processed, purpose, location, safeguards
- Most major vendors have standard DPAs: Supabase (dpa.supabase.com), Vercel (vercel.com/legal/dpa), Anthropic
This is legal research and intelligence, not legal advice. Consult qualified legal counsel before taking action.
1---2name: vendor-contractor-agreements3description: SKILL 76: Vendor & Contractor Agreements4---5# SKILL 76: Vendor & Contractor Agreements67## Purpose8Legal protection for every external relationship that touches your product — developers, vendors, SaaS providers, subcontractors. The right agreements prevent IP disputes, tax disasters, and security breaches.910## Independent Contractor Agreement — Required Elements1112### Scope of Work13- Specific deliverables (not "help with development" — list exact outputs)14- Timeline and milestones15- Acceptance criteria for each milestone16- Revision rounds included vs. charged separately1718### Payment19- Fixed fee per milestone preferred over hourly (clearer budget, aligned incentives)20- Payment terms: net 30 after milestone acceptance21- Late payment: 1.5%/month interest on overdue amounts22- Expenses: reimbursed only with pre-approval and receipts2324### IP Assignment (CRITICAL)25> "All work product, including but not limited to source code, designs, documentation, inventions, and improvements, created by Contractor in connection with this Agreement shall be the sole and exclusive property of the Company. Contractor hereby assigns all right, title, and interest in such work product to the Company, including all intellectual property rights."2627- Includes: everything made using company resources, time, or information28- Work made for hire doctrine: where applicable, work is "work made for hire" under 17 U.S.C. § 10129- Prior IP: list any pre-existing IP the contractor retains (they must carve it out explicitly)3031### Confidentiality32- NDA embedded in the agreement (no separate NDA needed)33- Covers: all company information, user data, technical systems, business plans34- Survives termination for [2–5 years] or until information is publicly known3536### Non-Solicitation37- Contractor won't solicit your employees for [12–24 months] after engagement38- Note: not a non-compete — just a non-solicitation (more enforceable, less restrictive)3940### Independent Contractor Status41> "Contractor is an independent contractor, not an employee. Nothing in this Agreement creates an employment relationship, partnership, or joint venture."42- **Why critical**: misclassification as employee → back payroll taxes, benefits, workers comp liability43- Tax: collect W-9 (US) before first payment; W-8BEN for non-US contractors44- Issue 1099-NEC if US contractor is paid >$600/year4546### Termination47- Either party: [14/30] days written notice48- For cause: immediate termination if contractor violates IP assignment, confidentiality, or prohibited conduct provisions49- On termination: contractor delivers all work product, deletes company data5051### Indemnification52- Contractor indemnifies company for: IP infringement in their work product, their own tax obligations, their compliance with applicable law53- Company indemnifies contractor for: company's use of the work product as directed5455## Software Development Agreement (External Dev Shops)56Everything in the contractor agreement PLUS:5758- **Source code ownership**: company owns ALL source code. No license-back to the developer.59- **Escrow**: if dev shop goes bankrupt, source code held in escrow is accessible to company60- **Warranty**: code is free from known material defects, substantially conforms to specifications, does not infringe third-party IP61- **Acceptance testing**: define acceptance criteria for each milestone. Payment contingent on acceptance.62- **Security requirements**: follow OWASP guidelines, no hardcoded credentials, no known vulnerabilities, no GPL/AGPL without prior approval63- **Bug fix support**: [90-day] post-delivery support for defects, included in contract price64- **Source control**: all code committed to company-controlled repository (GitHub org, not contractor's account)6566## SaaS Vendor Agreement Review Checklist67Before signing any vendor TOS, verify:6869| Issue | What to Verify | Red Flag |70|-------|---------------|---------|71| Data ownership | You own YOUR data | "Vendor owns all data" |72| Data portability | You can export all data | No export capability |73| SLA | 99.9%+ uptime guarantee | No uptime commitment |74| Data security | Encryption at rest and transit, access controls | No security specifications |75| Breach notification | 72-hour notice | No breach notification obligation |76| Termination and data return | Data returned within 30 days after termination | Data deleted immediately |77| Sub-processors | List of sub-processors provided | No sub-processor transparency |78| DPA availability | Standard DPA available (for GDPR compliance) | No DPA |7980### Key Vendors to Negotiate Enterprise Terms With81- **Supabase**: database hosting, data processing agreement82- **Vercel**: frontend hosting, DPA83- **Anthropic**: AI API, enterprise agreement covering your use case (CRITICAL — see SKILL 45)84- **OpenAI**: backup AI API, enterprise agreement8586## Subprocessor Agreements (GDPR)87If serving EU users:88- Vendors that process EU user data are "subprocessors"89- Data Processing Agreement (DPA) required with each subprocessor90- Maintain a subprocessor list: vendors, data processed, purpose, location, safeguards91- Most major vendors have standard DPAs: Supabase (dpa.supabase.com), Vercel (vercel.com/legal/dpa), Anthropic9293---94*This is legal research and intelligence, not legal advice. Consult qualified legal counsel before taking action.*
nickgallick