October 26, 2026
Decide which few terms really matter before the first redline, hold firm on those, and be flexible on everything else. For most startups selling to larger customers, the terms worth fighting for are the liability cap, IP ownership, termination, payment terms and exclusivity. Startups lose deals by over-lawyering small points, and they put the company at risk by giving in on the big ones.
Key takeaways
Every deal is different, but for a startup selling software or services to a larger company, these five come up again and again.
| Term | What to ask for | Reasonable fallback |
|---|---|---|
| Limitation of liability | A mutual cap equal to the fees paid in the prior 12 months | A higher cap (a "super-cap") for confidentiality, data breach and IP indemnity, instead of unlimited liability |
| IP ownership | The customer owns its data. You keep your platform, know-how and improvements | The customer owns deliverables built only for it, and you get a license to reuse general know-how |
| Termination | No termination for convenience during the committed term | Termination for convenience on 90 days' notice, with fees paid through the notice period |
| Payment terms | Net 30, interest on late payments, no right to withhold unrelated amounts | Net 45 or net 60 for a large enterprise customer |
| Exclusivity and non-solicitation | Delete them | A narrow, short non-solicit of each other's employees |
The liability cap and IP ownership are the two where a bad term can sink the company. An uncapped indemnity can exceed the value of the whole business. Giving a customer ownership of your core platform, even by accident through a broad "work product" clause, can make it impossible to sell to anyone else.
Not every point is a deal-breaker. Notice periods, reporting requirements, insurance certificates, audit rights within reason, and the customer's preferred form of the boilerplate are usually worth conceding. Giving ground on terms that don't matter builds goodwill, keeps the deal moving, and makes the other side more willing to move on the terms that do.
Flexibility doesn't mean signing anything. The opposite mistake is just as common: a founder who wants a big logo signs an uncapped indemnity or gives away IP to close the deal. If a customer won't move on one of your must-have terms, it's worth asking whether the deal is worth the risk.
There's one more limit on what you can give: don't promise a customer more than what your own vendors promise you. If your SLA promises 99.9% uptime and your cloud host commits to less, or you agree to report a breach within 24 hours when your data vendors only have to tell you "promptly," you are covering the gap yourself. Before you accept a stricter uptime, support, security, data location or indemnity term, check it against the contracts of the vendors your product depends on, and exclude outages of third-party providers outside your control from your SLA. See Service Level Agreement (SLA).
Acknowledge the redline within a day, even if you need longer to review it. Then sort each change into one of four groups: accept, accept with a tweak, push back with a reason, or walk away. Send back a single marked-up draft with short comments, rather than a long email thread.
Explain your pushback in business terms, not legal ones. "We can't get insurance for uncapped liability, and our cap is 12 months of fees for every customer" persuades a procurement team far more than a citation to case law. Large customers negotiate hundreds of these contracts a year. Clear, consistent positions get approved faster.
Say a startup is closing a $60,000-a-year contract with a large retailer. The retailer's paper asks for uncapped liability, ownership of "all work product," and termination for convenience on 30 days' notice.
A reasonable counter is a mutual liability cap of 12 months of fees ($60,000), with a super-cap of two or three times that for data breach and confidentiality. On IP, the retailer owns its data and any custom reports built only for it, and the startup keeps the platform and everything it learns building the product. On termination, the startup offers 90 days' notice after an initial committed term. Everything else in the retailer's paper, such as its insurance requirements and invoicing process, the startup accepts.
A large customer's "standard" agreement is only part of its paper. The terms that cost the most often sit in the security or privacy rider, the data processing agreement, the exhibits and the order form, and a clause in any of them can override the main agreement. Read the whole stack before you agree to the headline terms. These are the red flags we see most, with a fallback for each.
Short breach-notice windows. Security riders often require notice within 24 hours of a suspected incident. Offer notice within 72 hours of confirming a breach that affects the customer's data, with updates as you learn more. See Data Breach Response for Startups.
Open-ended audit rights. A right to audit your systems and records whenever the customer likes is expensive to honor. Offer your SOC 2 report or a completed security questionnaire first, and any on-site audit no more than once a year, on 30 days' notice, during business hours and at the customer's cost, unless the customer is investigating a confirmed breach.
Subprocessor approval. A right to approve every new subprocessor can freeze your product. Offer advance notice of new subprocessors and a right to object, with termination of the affected service and a refund of prepaid fees as the customer's remedy.
Transition duties. Some agreements let the customer terminate and then require you to keep serving it for months while it moves to a replacement. Agree to a set period, often 30 to 90 days, paid at your then-current rates, and only while the customer is current on its invoices.
Most-favored-customer pricing. A promise that no other customer will get a better price constrains every future deal. Avoid it. If you must agree, limit it to the same product, volume and term, for a fixed period.
Unlimited liability carve-outs. A reasonable cap can be undone by its exceptions. Keep data breach, confidentiality and indemnity claims under a super-cap, as in the table above. If the customer insists on some uncapped claims, limit them to fraud, gross negligence and willful misconduct.
Once a master agreement is signed, every later order form and statement of work can quietly change it. A statement of work drafted by a sales or implementation lead might add custom support hours, a promise to build a feature by a date, acceptance tests the customer controls, or a line saying the customer owns "all deliverables." If the master agreement doesn't say which document wins a conflict, courts often give more weight to specific, separately negotiated terms than to general standard ones, which usually favors the statement of work.
Control this in two places. First, the master agreement should include an order-of-precedence clause saying it controls over any order form or statement of work unless the later document expressly names the section it changes. That keeps your liability cap, IP ownership and data terms in charge and makes every exception deliberate. Second, have someone who knows your playbook review every statement of work and order form before it's signed, not just the first contract.
For implementation work, define acceptance by objective criteria tied to the specification. Give the customer a fixed period, often 10 business days, to test and report material problems in writing, and treat the work as accepted if it doesn't, or once the customer uses it in production. Otherwise a customer can hold up payment indefinitely by never signing off. See How Do I Draft a Strong Contract for My Startup?
Yes, once you are negotiating the same kind of contract more than a few times. A playbook is a short document, often one page, that lists your preferred position on each key term, the fallbacks you can accept, and the points that must go to a lawyer. It keeps your positions consistent across deals and lets different people on your team negotiate without reinventing the wheel each time.
A playbook also answers a common question: should non-lawyers redline customer contracts? Yes, for commercial terms and any position the playbook already approves. Indemnity, liability, IP and data clauses should go to counsel.
Pilots are a good way to get into a large customer, but keep them simple. A pilot agreement should cover the scope and how success will be measured, a short term (often 60 to 90 days), whether it is paid, how the customer's data is handled and deleted at the end, and how it converts into a full contract if it works. It shouldn't transfer any IP or grant exclusivity.
Pick one and keep it consistent. For a Delaware corporation, Delaware or the law of the state where you are based (often New York or California) are common choices. If a large customer insists on its home state, that is usually fine as long as the state's law isn't unusual for the issues in the contract. Be cautious about agreeing to disputes being heard in a foreign country without advice from local counsel.
AI tools are good at summarizing a redline, spotting where a draft departs from your playbook, and helping you prepare questions. Many enterprise procurement teams already use them. They are much weaker at knowing what is market for a startup selling to a large company, or which concessions you can live with. Use AI to prepare, not to decide.
Over-lawyering is when counsel fights every clause, slowing the deal, running up fees and sometimes killing it over points that don't matter. It often comes from training at large firms that represent large companies, where removing every last bit of risk makes sense. For a startup, the bigger risk is usually not closing deals. Work with counsel who understands that tradeoff, focuses on your must-have terms and moves fast on the rest.
When you are ready to move from startup-style contracts to an enterprise-ready set, you will usually want a master services agreement with order forms, a data processing agreement, a service level agreement and a one-page playbook. See What Should Startup Founders Know About Drafting Strong Contracts?, Service Level Agreement (SLA), NDA: What It Means for Startups and What Are the 10 Contracts Every Startup Should Have on Hand? For help with a specific deal, see our contract review service, or contact us.
