Document Automation
Product features
By practice area
By company size
Contract Review
PRODUCT FEATURES
Resources
LearN
Case Studies
Pricing
Gavel Exec reviews and redlines contracts inside Microsoft Word, checked against your own playbook. Start with 25 free queries, no credit card required.
Use this master services agreement (MSA) playbook to redline a vendor's MSA from the customer side: for each clause it gives the preferred term, the fallback you can concede, and the point where a lawyer must approve. Vendor positions are noted, and it covers caps, indemnities, intellectual property, exit and statements of work.
Last reviewed November 13, 2026. This playbook is general information for lawyers, not legal advice for a specific matter. Gavel publishes it and makes Gavel Exec.
This playbook assumes you are the customer buying services or software under a long-term MSA.
To flip the playbook to the vendor side, start from these positions:
Vendor-side walk-away points: uncapped data breach liability, indemnities for the customer's own content, and convenience termination on short notice for a front-loaded fixed-fee project.
The MSA holds the legal terms. Each SOW describes a project: scope, deliverables, milestones, acceptance criteria and fees. An order form does the same for subscriptions. Business teams often sign SOWs and order forms after the MSA without legal review, so the precedence clause decides how much of your MSA work survives.
Published standard forms take different approaches. The Common Paper Cloud Service Agreement provides that the order form controls over the framework terms, and the Common Paper Professional Services Agreement provides that the SOW controls over the agreement. Writing for the American Bar Association's Law Practice magazine, Wade K. Sims III recommends a "Conflict Between Documents" clause that ranks each document. For a customer, the safer default is that the MSA controls unless a SOW names the MSA section it changes.
When the MSA covers goods, purchase orders add risk. Under Uniform Commercial Code (UCC) section 2-207, additional terms in an acceptance between merchants become part of the contract unless the offer limits acceptance to its own terms, the terms "materially alter it," or the other party objects within a reasonable time. The MSA should exclude preprinted terms on purchase orders, invoices, click-through screens and vendor web pages.
Use the preferred position in your first redline, concede to the fallback without escalation, and send anything in the escalation column to the responsible lawyer.
| Issue | Preferred position | Acceptable fallback | Escalate or walk away if | Why it matters |
|---|---|---|---|---|
| Order of precedence | MSA controls over every SOW and order form. A SOW may change an MSA term only by citing the section number and stating the change. Data processing agreement (DPA) and security exhibit control on data issues. | SOW controls on scope, fees, milestones and acceptance criteria only. MSA always controls on liability, indemnity, ownership, data and termination. | Vendor terms are incorporated by web address (URL) and can change without notice, or the SOW controls "in all respects." | Unreviewed SOWs are where negotiated caps and data terms get overwritten. |
| General liability cap | Greater of (a) all fees paid and payable under the MSA and all SOWs in the 12 months before the claim and (b) a fixed floor, such as $1 million. | 12 months of fees under the SOW giving rise to the claim, with a floor equal to the annual contract value. | Cap is fees paid in the prior 3 or 6 months, or a per-SOW cap with no floor on a small SOW touching critical systems. | Common Paper's 2026 benchmark reports 96% of software as a service (SaaS) agreements cap at 1 times fees. A cap tied to one small SOW can be worth almost nothing. |
| Super-cap | Separate cap of 3 times 12-month fees, with a floor of $2 million (or $5 million for regulated data), for data security breaches, confidentiality breaches and vendor indemnities other than IP infringement. | 2 times 12-month fees with a fixed floor, as a separate pool that does not draw down the general cap. | Super-cap is below a realistic breach cost estimate for the data involved, or counts against the general cap. | Common Paper's default increased cap is 5 times 12-month fees. Its benchmark shows 2 times and 5 times supercaps in use. |
| Uncapped claims | Fraud, gross negligence, willful misconduct, bodily injury and death, and third-party intellectual property (IP) indemnity sit outside all caps. | IP indemnity moves under the super-cap. Fraud, willful misconduct and bodily injury stay uncapped. | Vendor caps its own fraud or willful misconduct. | Under California Civil Code section 1668, contracts exempting a party from its own fraud or willful injury are against public policy. The California Supreme Court applied it to damages limitations for willful injury in New England Country Foods, LLC v. VanLaw Food Products, Inc. (2025) 17 Cal.5th 703, holding that "a limitation on damages for willful injury to the person or property of another is invalid under section 1668." |
| Consequential damages waiver | Mutual waiver, with carve-outs for super-cap and uncapped claims. Breach notification, credit monitoring, regulatory fines, data restoration and replacement services are treated as direct damages. | Those breach costs are recoverable up to the super-cap amount. | Waiver applies to amounts payable under an indemnity. | Without the list, breach costs get argued away as consequential. |
| Vendor indemnity | Defend and indemnify against third-party claims for IP infringement, breach of data security obligations, violation of law, bodily injury or property damage, and claims by vendor personnel. On infringement: procure a license, modify, replace, or refund. | Standard exclusions for customer modifications, unauthorized combinations and customer specifications. | IP indemnity limited to patents issued in one country, or vendor may settle by admitting fault on the customer's behalf. | It protects against claims the customer cannot see or control. |
| Customer indemnity | Limited to third-party claims that customer-supplied data or materials infringe or were collected in violation of law. | Add claims arising from customer use in breach of the acceptable use policy. | Customer indemnifies "any claim arising from use of the services," or customer's indemnity is uncapped while the vendor's is capped. | Broad versions shift the vendor's product risk to the buyer. |
| Ownership of deliverables | Customer owns custom deliverables as created, through a present assignment ("hereby assigns"). Vendor personnel and subcontractors are bound by written assignments. | Ownership passes on payment of the related fees, with a license to use the deliverables before then. | Vendor owns custom work the customer paid to develop and grants a license that ends with the MSA. | 17 U.S.C. 204(a) requires a signed writing to transfer copyright. Common Paper's services form offers both timing options. |
| Vendor tools and residuals | Vendor keeps pre-existing materials. Customer gets a perpetual, irrevocable, royalty-free license to embedded vendor materials, transferable with the business. No residuals clause. No artificial intelligence (AI) training on customer data or deliverables. | Residuals limited to general skills retained in unaided memory, excluding customer confidential information and data. | Deliverables cannot run without a vendor tool licensed only for the term. | Common Paper reports AI training prohibitions in 14% of cloud agreements in 2026. |
| Warranties | Services performed in a professional and workmanlike manner. Deliverables conform to the SOW for 90 days after acceptance. No malicious code. Compliance with law. Remedy: reperform free, then refund and terminate the SOW. | 60-day warranty period with the same remedy sequence. | Warranty remedy is stated as the sole remedy for all breaches, including data breach. | UCC section 2-316 requires a merchantability disclaimer to mention merchantability and, in a writing, be conspicuous when the MSA covers a sale of goods. |
| Payment and disputes | Net 45 from receipt of a correct invoice. Good-faith disputes raised within 30 days; undisputed amounts paid on time. No suspension over disputed amounts. | Net 30. Late interest of 1% per month on undisputed amounts after written notice. | Vendor may suspend critical services on short notice for any unpaid amount, disputed or not. | Common Paper reports 30-day payment periods as the norm for invoiced agreements. |
| Price increases and renewal | Fees fixed for the initial term. Renewal increases capped at the lesser of 3% or the change in the Consumer Price Index (CPI), with 90 days' written notice. | Cap of 5% per renewal with 60 days' notice. | Renewal at "then-current list price," or multi-year automatic renewals. | Common Paper reports auto-renewal in 87% of cloud agreements and automatic fee increases in 13%. |
| Termination and transition | Customer may end any SOW for convenience on 30 days' notice, paying for work done. 30-day cure for breach; immediate termination for a material data breach. Up to 6 months of transition help at existing rates. Export, then deletion with written certification. | 90 days of transition help. A fixed early termination fee for fixed-price SOWs. | No data export right, or ending the MSA ends every active SOW. | The 2023 interagency guidance on third-party relationships calls for "reasonable time frames to allow for the orderly transition of the activity." |
| Insurance | Commercial general liability (CGL) of $1 million per occurrence and $2 million aggregate; errors and omissions (E&O) and cyber of $5 million per claim where the vendor holds personal data or system access; customer as additional insured on CGL; 30 days' notice of cancellation. | Cyber of $2 million for vendors without sensitive data, or a combined E&O and cyber policy. | No cyber coverage for a vendor hosting customer personal data, or insurance limits stated as limits on liability. | The interagency guidance says coverage "should be commensurate with the risk of possible losses." Common Paper reports cyber insurance requirements in 12% of cloud agreements in 2026. |
| Data security | Written security program, current System and Organization Controls (SOC) 2 Type II report or International Organization for Standardization (ISO) 27001 certificate, incident notice within 48 hours, annual audit right, DPA attached. | 72-hour notice. Third-party audit reports in place of on-site audits. | Notice only "without undue delay," or security terms published at a URL the vendor can change. | California Civil Code section 1798.81.5(c) requires a business disclosing certain personal information of California residents to a nonaffiliated third party to require reasonable security by contract. |
| Subcontracting and assignment | No subcontracting of material services without consent. Vendor liable for subcontractors as for itself. Neither party assigns without consent, except customer to an affiliate or successor. Customer may terminate on a vendor change of control. | Published subcontractor list with 30 days' notice and an objection right. Mutual assignment on a merger with notice. | Vendor may assign to a customer competitor, or may move regulated data offshore without consent. | Common Paper's services form allows subcontractors only with customer permission. |
To test a single clause against these positions, paste it into the contract clause checker.
These five issues need drafted language in the redline. Adjust defined terms to match your MSA.
Preferred: "If this Agreement conflicts with a Statement of Work or Order Form, this Agreement controls. A Statement of Work or Order Form changes this Agreement only for that Statement of Work or Order Form, and only if it identifies by section number the provision of this Agreement being changed and states that the change is intended. The Data Processing Agreement and Security Exhibit control on Customer Data. No terms on a purchase order, invoice, website, or click-through screen form part of this Agreement."
Fallback: "A Statement of Work controls over this Agreement only as to scope, fees, schedule, and acceptance criteria. Sections [Liability], [Indemnities], [Ownership], [Data Security], and [Termination] of this Agreement control in every case."
Expect the vendor to say that legal review of every SOW slows sales. The fallback answers that: SOWs set commercial terms freely, and the five legal sections stay fixed.
Preferred: "Each party's total liability arising out of this Agreement and all Statements of Work will not exceed the greater of (a) the fees paid and payable under this Agreement in the twelve months before the event giving rise to the claim and (b) [$1,000,000] (the General Cap). For Data Claims, each party's total liability will not exceed the greater of three times those fees and [$2,000,000] (the Data Cap). The Data Cap is in addition to the General Cap and amounts paid under it do not reduce the General Cap. Neither cap applies to liability for fraud, gross negligence, willful misconduct, bodily injury or death, or Provider's intellectual property indemnity."
Fallback: "...two times the fees paid and payable in the twelve months before the event giving rise to the claim, and not less than [$1,000,000]."
Expect the vendor to argue that its insurance cannot support a super-cap. Ask what cyber coverage it carries and set the super-cap at that limit. Raise the bracketed Data Cap floor to $5,000,000 where the vendor holds regulated data. Define "Data Claims" by reference to the security and confidentiality sections, so the cap does not turn on how a plaintiff pleads the claim.
Copyright law makes a commissioned work a "work made for hire" only in listed categories and only with a signed written agreement, and custom software usually falls outside those categories. Under 17 U.S.C. 201(b), the hiring party owns a work made for hire. Everything else needs an assignment that meets 17 U.S.C. 204(a).
Preferred: "Provider hereby assigns to Customer all right, title, and interest in the Deliverables, including all intellectual property rights, effective as each Deliverable is created. Provider will obtain written assignments from its personnel and subcontractors sufficient to give effect to this section. Deliverables do not include Provider's pre-existing materials, which Section [License to Provider Materials] covers."
Fallback: "Provider hereby assigns to Customer all rights in each Deliverable, effective when Customer pays the fees for it. Until then, Provider grants Customer a non-exclusive license to use the Deliverable for Customer's internal business."
The usual pushback is that the vendor reuses components across clients. Accept that, and require a perpetual license to anything embedded in the deliverables so the customer can run and modify them after the relationship ends.
Preferred: "On expiry or termination of any Statement of Work, Provider will, at Customer's request, continue to provide the Services and reasonable transition assistance for up to six months at the rates then in effect. Within 30 days after Customer's request, Provider will return all Customer Data in [comma-separated values (CSV) files or the format named in the Statement of Work], and only after Customer confirms receipt will Provider delete it, within 30 days after that confirmation, and certify deletion in writing."
Fallback: "...for up to 90 days... Provider will make Customer Data available for export for 30 days after termination."
Vendors resist open-ended transition duties, so offer a time limit and payment at existing rates. A fixed deletion schedule, such as the 60-day deletion on request in the Common Paper cloud form, should still follow export.
Preferred: "Fees are fixed for the Initial Term. Provider may increase fees for a Renewal Term by giving written notice at least 90 days before the Renewal Term begins, and the increase may not exceed the lesser of 3% and the percentage change in the CPI for the preceding twelve months."
Fallback: "...may not exceed 5% for any Renewal Term..."
Expect the vendor to cite rising costs; offer a longer initial term in exchange for the lower cap. For service, maintenance or repair contracts on property, New York General Obligations Law section 5-903 makes an automatic renewal unenforceable against the customer unless the provider gives written notice, personally or by certified mail, 15 to 30 days before the cancellation deadline.
| Segment | What shifts in the MSA | Why |
|---|---|---|
| Early-stage software startup (as vendor) | Pushes for 1 times fees with no floor, ownership on payment, and a mutual change-of-control assignment right. Can rarely offer a super-cap above its cyber policy limit. | Assignment limits can block an acquisition, and thin insurance limits what it can cover. |
| Enterprise software vendor | Expect negotiation to happen on the order form and a short addendum, so precedence between the addendum and the vendor's online terms becomes the main issue. | The vendor's standard terms apply across its customer base and change on its own schedule. |
| Biotech and life sciences | MSAs with contract research organizations (CROs) need a written description of the regulatory obligations transferred, listing each one unless all are transferred. Ownership must cover data, inventions and samples, with publication review rights. | Under 21 C.F.R. 312.52(a), any obligation not covered by the written description "shall be deemed not to have been transferred." |
| Healthcare provider or health tech | A business associate agreement (BAA) is required where the vendor handles protected health information (PHI). The BAA should control over the MSA on PHI, with flow-down to subcontractors and a termination right. | The Health Insurance Portability and Accountability Act (HIPAA) rule at 45 C.F.R. 164.504(e) requires these terms, including return or destruction of PHI at termination. |
| Financial services | Contractual safeguards for customer information, audit rights reaching subcontractors, business continuity and transition rights. Caps are tested against potential loss. | The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule at 16 C.F.R. 314.4(f)(2) requires non-bank financial institutions to bind service providers "by contract." For banks, the 2023 interagency guidance covers audit, subcontracting, termination and whether liability limits "are in proportion to the amount of loss." |
| Manufacturing or supply chain | Goods sold under the MSA bring in the UCC. Warranty disclaimers must meet section 2-316, and purchase order boilerplate must be excluded expressly. | UCC section 2-207 can add purchase order and acknowledgment terms to the contract between merchants. |
| Startup (as customer) | Accept the vendor's form for most tools and focus on three terms: data security, export on exit and renewal price caps. | Little leverage, and the main risks are lock-in and price changes. |
| Mid-market | Negotiate the cap floor, super-cap and transition help for critical vendors only. | Limited legal capacity goes to vendors that hold data or run operations. |
| Enterprise (as customer) | Use your own MSA, with insurance certificates, audit rights and named subcontractors, and give your security exhibit precedence over vendor terms. | Auditors, and examiners in regulated industries, review its vendor contracts, and procurement volume gives leverage. |
Gavel Exec is AI contract review and drafting software that works in Microsoft Word. It generates playbook rules from a checklist, a spreadsheet playbook or signed agreements in .docx, PDF or .csv format, so the table above, saved as a spreadsheet, can become a working playbook. See how playbooks work in Gavel Exec.
When you open a vendor's MSA in Word, Gavel Exec applies those rules as priority-ranked tracked changes, with the reasoning for each change. In the web app, benchmarking labels each provision on-market, off-market or missing. Pricing is $160 per user per month or $1,740 per user per year, and each user gets 25 free queries with no credit card required.
What is an MSA playbook?
An MSA playbook is a written set of positions for each clause of a master services agreement, listing the preferred term, the acceptable fallback, and when to escalate. It lets reviewers redline consistently and tells them which concessions need a lawyer's approval.
Does the SOW or the MSA control if they conflict?
The order of precedence clause decides. Some standard forms let the SOW or order form control, so a customer-side playbook asks for the MSA to control unless the SOW names the MSA section it changes.
What is a super-cap in a master services agreement?
A super-cap is a higher liability cap for specific claims, usually data security breaches, confidentiality breaches and indemnities. Common Paper's default increased cap is 5 times the fees paid or payable in the prior 12 months.
What is a typical limitation of liability in an MSA?
The most common cap is 1 times fees. Common Paper's 2026 benchmark reports that 96% of software as a service agreements cap at 1 times, and Common Paper's default cap measures the fees paid or payable in the 12 months before the claim.
Who owns intellectual property created under an MSA?
Copyright in what the vendor's people create generally stays with the vendor unless the MSA assigns it in a signed writing, as 17 U.S.C. 204(a) requires. Custom software built by a contractor usually does not qualify as a work made for hire.
What belongs on an MSA review checklist?
Check the order of precedence, the cap in dollars, the super-cap, the deliverables assignment, the data security terms, renewal pricing and the exit terms. Then read every SOW and order form signed with the MSA for overrides.
Related reading: contract playbook best practices for legal teams, reviewing data protection agreements with AI, and AI review for commercial contracts.
AI contract review and redlining in Microsoft Word, checked against your own playbook, with the reasoning behind each change.
