🚨 Legal Contract Red-Flag Scanner

Contract Red-Flag Report

Executive Summary

This contract leans aggressively in the Provider's favor across every section — liability, termination, data, renewals. The single top concern is Section 5.3 (liability cap at 3 months of fees, even for gross negligence, which is non-enforceable in Delaware anyway but shows bad faith). My recommendation: negotiate hard on 5 points before signing — this contract as drafted is not acceptable for a $48k/year commitment.

🚨 Critical Red Flags

Clause 3.2: 120-day non-renewal notice with auto-renewal

Verbatim quote: "...this Agreement shall automatically renew for successive twelve (12) month terms unless either party provides written notice of non-renewal at least one hundred twenty (120) days prior to the end of the then-current term."

What this means: You must notify them 4 months BEFORE your 3-year term ends, or you're locked into another 12 months at the escalated rate. Miss the window by a day — on your calendar from 2029 — and you've just signed up for $58,000 in obligations.

Why it matters: Auto-renew + long notice period is the #1 SaaS gotcha. I've seen this trap seven-figure contracts.

What a fair version looks like: 30-60 day notice, or a calendar alert provision requiring Provider to notify Customer 150 days before renewal. Ideally: month-to-month renewal after the initial term.

Clause 5.3: Liability cap at 3 months of fees, including gross negligence

Verbatim quote: "...Provider's aggregate liability exceed the fees paid by Customer in the three (3) months preceding the event giving rise to liability. This limitation shall apply to all causes of action, including those arising from Provider's gross negligence."

What this means: If their system corrupts your financial data causing you $2M in losses, the maximum they owe you is $12,000 (3 months of $48k/year). The gross-negligence carve-in is particularly aggressive — most fair contracts exclude gross negligence and willful misconduct from liability caps.

Why it matters: For a fintech-adjacent product, this is underprotective. Industry standard is liability cap at 12 months of fees minimum, with gross negligence excluded.

What a fair version looks like: "Provider's aggregate liability shall not exceed the greater of (a) twelve (12) months of fees or (b) $500,000. This limitation shall not apply to gross negligence, willful misconduct, or breaches of confidentiality/data-protection obligations."

Clause 9.4: Provider can terminate for convenience with 90-day notice; you cannot

Verbatim quote: "Provider may terminate this Agreement at any time for any reason upon ninety (90) days written notice."

What this means: They can leave you with 90 days to migrate off their service for no reason. You have no equivalent right — you're locked in for 3 years.

Why it matters: This is asymmetric in the worst way. If their roadmap changes or they get acquired, you're scrambling to migrate critical infrastructure in 3 months. For a multi-year deal, this needs to be mutual.

What a fair version looks like: Mutual termination for convenience with 180 days notice on THEIR side, OR remove their right to terminate for convenience entirely.

⚠️ Important Concerns

Clause 4.1: 5% annual escalation, no termination right on increase

Verbatim quote: "Customer shall have no right to terminate or reduce usage as a result of such increase."

What this means: Over 3 years, your real cost compounds: $48k → $50.4k → $52.9k. Plus, you can't leave even if they jack up the rate to something unconscionable later.

What a fair version looks like: 3% cap (below inflation for most years) OR a right to terminate if escalation exceeds a benchmark (CPI + 2%).

Clause 7.1: They can use your data, de-identified, "for any purpose"

Verbatim quote: "Provider may use de-identified and aggregated data derived from Customer Data for any purpose, including improving the Services and for benchmarking."

What this means: They can train AI on your data, sell aggregated benchmarks to your competitors, and use your usage patterns to improve their own products. "De-identified" is often reversible and not legally rigorous.

What a fair version looks like: Permitted uses limited to "improving the Services provided to Customer" only. No third-party benchmarking without opt-in. No AI training rights without separate agreement.

ℹ️ Notable Items

Clause 10.1: 15-day audit notice — they can audit you

Verbatim quote: "Provider reserves the right to audit Customer's usage of the Services upon fifteen (15) days notice."

What this means: They can inspect your records to check if you're using more seats/features than you paid for. Standard in enterprise SaaS but the 15-day window is short.

What a fair version looks like: 30-day notice, audits limited to once per year, conducted during business hours, at Provider's expense unless material under-payment found.

What's MISSING (that should be there)

1. SLA with service credits. No uptime commitment at all. At this contract value, minimum 99.5% with 10% service credit per hour of outage.

2. Data export rights at termination. Not specified. You should have 60-90 days after termination to export your data in standard formats. Without this, they can hold your data hostage.

3. Security/breach notification obligations. No mention of incident response or notification timelines. For fintech-adjacent, you need 24-72 hour breach notification language — especially if ANY CCPA/GDPR data flows through.

4. Confidentiality mutual obligations. No mutual NDA-style protection for your data and strategies.

5. Price-lock during term. The 5% escalation clause overrides any other pricing discussion — there's no "price protection" language for the base year.

6. Indemnification for IP infringement. If their software gets sued for patent infringement, you're potentially on the hook. Standard to have Provider indemnify Customer.

Leverage Analysis

You have more power on:

1. Termination for convenience (Section 9.4) — asymmetric in the extreme, easy pushback.

2. Data rights (Section 7.1) — vendors are used to being pushed back on this, especially by fintech customers.

3. Liability cap gross-negligence carve-out (Section 5.3) — this is non-standard and aggressive; rarely worth fighting them.

They have more power on:

1. Overall pricing — you've already accepted $48k/year + 5%, can't renegotiate baseline.

2. Audit rights — standard, hard to remove entirely.

3. Core SLA levels — may be plan-tier-locked.

The quiet leverage you might not see: Your 3-year commit IS the leverage. They're booking revenue for 3 years with no opt-out from you. Remind them of this when asking for the mutual termination and data rights changes.

5 Negotiation Priorities, Ranked

1. Liability cap: 12 months of fees, gross negligence excluded. (Section 5.3) — non-negotiable for fintech. Walk if they refuse.

2. Mutual termination for convenience OR remove theirs. (Section 9.4) — your ability to operate depends on not being migrated off mid-contract.

3. Auto-renewal notice to 30-60 days, with Provider-notification requirement. (Section 3.2) — saves you from the calendar trap.

4. Data export rights at termination — add the clause. (Missing) — guarantees you're not locked in after termination.

5. Remove "any purpose" data usage language. (Section 7.1) — for fintech-adjacent, you probably have regulatory exposure here.

Don't fight the audit rights or the escalation. Concede those in exchange for the above.

Questions to Ask Your Lawyer

1. "Is the gross-negligence carve-in from the liability cap enforceable in Delaware? If not, should we still push to remove it for signaling purposes?"

2. "What's the minimum breach-notification language we need for our business to stay compliant with our own customer agreements?"

3. "What's our exposure if their service is used to process customer financial data and they experience an incident? Do we need higher indemnification caps?"

4. "If we're unable to renegotiate auto-renew to 30 days, what's the operational process we need to set up to prevent missing the 120-day window?"

5. "What are our SLA requirements that would need to flow through from our customer contracts to this vendor?"

Sign / Negotiate / Reject

NEGOTIATE. Do not sign as-is. This contract reflects vendor-favorable defaults with no customer pushback yet applied. Expect Provider to accept 3 of your 5 priorities; hold firm on #1 and #2 as deal-breakers. If they refuse both, consider alternative vendors — the terms as drafted are below market norm for this price point in 2026.