In plain English
You review an MSA without a lawyer by running a structured pass on the clauses that actually move risk (liability, indemnity, IP, data, payment, term/termination) then accepting, countering, or escalating each flag with a clear owner. You are not "practicing law"; you are doing founder/ops diligence so surprises show up before signature, not after invoice #3.
This is not legal advice. It is an operating playbook. Escalate novel, high-dollar, regulated, or personally guaranteed deals to counsel.
By version90 staff Published How this was made
When is it reasonable to review without counsel?
It is reasonable when the deal size is modest relative to your runway, the paper looks like a normal services/SaaS MSA, your checklist covers the known landmines, and you have a written escalation path for anything weird. It is not reasonable when you're signing enterprise paper with uncapped exposure, assigning core IP, processing sensitive personal data without a DPA, or personally guaranteeing obligations.
If you don't yet know what an MSA is supposed to do, start with What Is an MSA? and MSA vs SOW vs Order Form.
What should you do before you read a single clause?
Set the table first. Skipping this step is how people "review" the wrong file.
- Confirm the file: Latest
.docx, not a PDF of a Word doc, not last month's template. - Confirm the commercial deal: Price, term, seats/scope, start date. Write them down.
- Confirm related exhibits: SOW, order form, DPA, SLA, security exhibit. Missing exhibits are findings.
- Name an owner: One human accountable for the redline round.
- Open your checklist: Use the Startup MSA Redline Checklist so reviews stay comparable across deals.
How do you run the actual review pass?
Work top to bottom, but budget attention by risk. A useful sequence for non-lawyers:
1. Parties, scope pointers, and precedence
Check legal names, effective date mechanics, and whether the MSA correctly points at SOWs/order forms. Confirm order of precedence. Ambiguity here means you may enforce the wrong deal.
2. Term, renewal, and exit
Map initial term, auto-renew, notice window, termination for convenience, termination for cause, and cure periods against your real planning cycle. A 30-day auto-renew notice is a classic trap for quarterly-budget teams.
3. Fees and payment (even if "details are in the SOW")
The MSA often sets late fees, price-increase rights, expense rules, and audit rights. Diff these against the commercial handshake. Net 30 quietly becoming Net 60 is not a vibe; it's a cash-flow event.
4. Intellectual property
Preexisting IP should stay put. Work product ownership and license grants should match who is paying for what. Watch "vendor owns all improvements" language that eats custom work, and unbounded feedback assignments.
5. Confidentiality and data
Prefer mutual confidentiality. If personal data or customer data is in play, require a DPA (or equivalent) rather than a one-liner in the MSA. Breach notice timing should be defined.
6. Warranties, disclaimers, indemnity, liability
Read these as a set. A broad indemnity plus a tiny liability cap plus a sweeping disclaimer is a risk sandwich. Note carve-outs (IP infringement, confidentiality breach, gross negligence) and whether caps are mutual.
7. Boilerplate that isn't boring
Assignment, governing law/venue, injunctions, publicity rights, and "entire agreement" clauses decide where fights happen and whether marketing can use your logo tomorrow. Skim with intent.
For each flag, choose one of three outcomes: accept, counter with standard language, or escalate. "We'll remember to be careful" is not an outcome.
What does a clean redline look like?
A clean redline is a Word document with real tracked changes, short comments that state the business reason, and one canonical file moving between parties. Avoid parallel PDFs, comment-only markups on frozen files, and email threads that re-attach last Tuesday's draft.
Keep version discipline ruthless, see Contract Version Control: End Final v7. If AI assists the first pass, demand citations to exact clauses and verify them: AI Contract Review With Citations.
What should non-lawyers escalate?
Escalate (to outside counsel, a fractional GC, or a board-connected advisor) when you see:
- Unlimited liability or one-sided caps that dwarf deal value
- Broad IP assignment of your core product or customer data
- Unusual indemnities (especially for your customers' end use)
- Non-standard data/security commitments you can't operationally meet
- Most-favored-nation, exclusivity, or non-compete lite terms
- Personal guaranties, unusual security interests, or odd governing law/venue for your footprint
- Anything you don't understand after a careful read (confusion is a signal)
Escalate early. Paying for one hour of counsel before signature is cheaper than discovering the clause in discovery.
Review checklist (founder/ops edition)
- Correct parties and effective-date mechanics
- Exhibits listed and attached (SOW/order form/DPA/SLA)
- Precedence clause present and sensible
- Term, auto-renew, notice window workable
- Termination paths and cure periods defined
- Payment / price-change / late-fee rules match the deal
- IP ownership and licenses match intent
- Confidentiality mutual (or knowingly one-way)
- Data terms + DPA if needed
- Indemnity + liability read as a package
- Assignment, publicity, governing law scanned
- Every flag marked accept / counter / escalate
- One canonical
.docxwith tracked changes ready to send
About this page
Who. Written by version90 staff at Latent Ape LLC, the company that builds version90, working with AI tools. We build contract software and run our own contracts through it; we are not a law firm, and nothing here is legal advice.
How. Each piece starts from the review workflow version90 is built around. AI drafts and structures the text; staff edit, fact-check, and rewrite it before it is published, and we update the date shown above whenever the substance changes.
Why. The library exists to give founders and ops teams a shared standard for reviewing contracts without a legal department. If you spot an error, email [email protected] and we will fix the page.