Glossary of vendor contract and privacy terms

Browse all terms

A 26 terms

• Abuse Monitoring Retention When an AI provider keeps prompts and answers for a set time, such as up to 30 days, to look for misuse; it is the main exception to zero data retention.
• Acceptable Use Policy (AUP) An acceptable use policy (AUP) is a vendor's list of things you and your team may not do with its product, such as attacking the service, scraping data or misusing AI. Breaking it can get your account suspended.
• Adequacy Decision An adequacy decision is a European Commission finding that a country outside the EU protects personal data to an EU-level standard, so personal data can flow there without standard contractual clauses or other extra safeguards.
• Affiliate Definition An affiliate is a company linked to another by ownership or control. The contract's definition decides which group companies can use the service and whose data is covered.
• Aggregated Data Aggregated data is data a vendor combines from many customers and strips of identity. Contracts often let the vendor own and use it freely, even after you leave.
• AI Connector (MCP Integration) An AI connector, such as one built on the Model Context Protocol (MCP), is a link that lets an AI assistant read data from or take actions in one of your business apps, using a user's permissions.
• AI Copyright Indemnity An AI copyright indemnity is a vendor's promise to defend you, and cover certain costs, if someone claims the AI's output infringes their copyright, as long as you meet its conditions.
• AI Features Enabled by Default AI features enabled by default are new AI tools a vendor switches on in your account without asking first, so your data can start flowing to them before anyone has reviewed the terms.
• AI Output Ownership AI output ownership is who holds the rights to what an AI tool produces for you. A vendor's contract decides this between you and the vendor, while copyright law decides whether the output is protected at all.
• AI Subprocessor An AI subprocessor is an outside AI company, such as OpenAI, Anthropic or Google, that one of your vendors uses to process your data when you use the vendor's AI features.
• AI Terms (AI Addendum) AI terms, or an AI addendum, are the part of a vendor's contract that governs its AI features: what happens to your inputs and outputs, which model providers are involved, and whether your data can train AI models.
• AI Training on Customer Data AI training on customer data is when a vendor uses the information you put into its product, such as files, prompts and AI answers, to teach or improve its AI models.
• AI Training Opt-Out An AI training opt-out is a setting, request or contract clause that tells a vendor not to use your data to train its AI models when training would otherwise be on by default.
• AI Usage Policy An AI usage policy is a vendor's set of rules for what you may and may not do with its AI features or models. It is different from your own internal policy for staff use of AI.
• AI Vendor Risk Assessment An AI vendor risk assessment adds questions for vendors that use AI on your data: whether they train on it, how long they keep prompts and outputs, which AI providers they use and who owns the output.
• Amendment vs Addendum An amendment changes the wording of an existing contract, such as a new price or a revised clause. An addendum adds new terms on a topic the contract did not cover, such as data protection or AI use. Both become part of the same agreement.
• Annual Vendor Review An annual vendor review is a yearly check of your important vendors to confirm they are still needed, still correctly rated for risk and still meet your requirements, using their latest security reports and legal documents.
• Anonymized Data Anonymized data is data changed so that no one can reasonably identify the person it was about. Under the GDPR it is no longer personal data, but pseudonymized data still is.
• Answering Security Questionnaires Answering security questionnaires means responding to the security and privacy questions a customer sends before it buys or renews, and many of those answers depend on what your own vendors do and promise.
• API Terms API terms are the rules for connecting software to a vendor's platform through its API. They set request limits, restrict how you use the data, and let the vendor change the API or cut off your access.
• Arbitration Clause An arbitration clause says disputes go to a private arbitrator instead of a court. It often comes with a ban on class actions and a waiver of jury trials.
• Arbitration Opt-Out Window An arbitration opt-out window is a short period, such as 30 days, in which you can refuse a vendor's arbitration clause and keep your right to go to court.
• Assignment Clause An assignment clause says whether either side can hand the contract over to another company. In vendor terms, it often lets the vendor transfer your contract, and your data, to a buyer without asking you.
• Audit Rights Audit rights are your contract right to check that a vendor keeps its data protection promises. In practice, many vendors offer a SOC 2 report or similar document first and allow on-site audits only under conditions.
• Auto-Renewal Clause An auto-renewal clause makes a subscription start a new term on its own when the current one ends, unless you cancel before a set deadline. The new term often comes at the vendor's current price, not the price you paid.
• Automated Decision-Making Automated decision-making is when software, often AI, makes a decision about a person, such as a hiring, lending or pricing decision, with little or no human involvement.

B 11 terms

• Back-to-Back Terms Back-to-back terms means the promises you make to your customers are backed by matching promises from your vendors, so you never commit to more (faster notice, higher uptime, wider liability) than your own vendors commit to you.
• Backup Retention Backup retention is how long copies of your data stay in a vendor's backups after the live version is deleted.
• Beta Terms Beta terms are the rules for a vendor's unreleased features, such as beta, preview or early access. They often remove warranties, cut liability to a small amount and let the vendor change or end the feature at any time.
• Billing Dispute Window A billing dispute window is the time you have to challenge a charge before the vendor treats the invoice as accepted. Some contracts set it in days; others set no window, and then payment deadlines and general claim limits decide how long you have.
• Billing Terms Billing terms are the rules for how a vendor charges you: when you pay, how prices can rise, refunds, late payment and how to dispute a charge. They may sit in the main terms or in a separate billing document.
• Binding Corporate Rules (BCRs) Binding corporate rules (BCRs) are a company group's internal data protection rules, approved by a data protection authority, that let the group move personal data from the EU to its own companies in other countries.
• Breach Notification Clause A breach notification clause says when and how a vendor must tell you about a security problem affecting your data. Under the GDPR the vendor must tell you without undue delay, and you then generally have 72 hours to tell the regulator.
• Bridge Letter A bridge letter is a short letter from a vendor's management covering the gap between the end of its last SOC report period and today. It says no material control changes are known, but no auditor has checked it.
• Browsewrap Agreement A browsewrap agreement is a set of website terms, usually linked at the bottom of the page, that says you agree just by using the site. Courts are skeptical of them.
• Business Associate Agreement (BAA) A business associate agreement (BAA) is a contract HIPAA requires when a vendor handles protected health information for a health care provider, health plan or another business associate. It limits how the vendor uses the data and requires it to protect and report on it.
• Business Continuity and Disaster Recovery Business continuity and disaster recovery (BCDR) is a vendor's plan for keeping its service running during a major outage and restoring systems and data afterward. Two numbers sum it up: how much data could be lost (RPO) and how long recovery takes (RTO).

C 32 terms

• CAIQ The CAIQ (Consensus Assessments Initiative Questionnaire) is the Cloud Security Alliance's set of yes-or-no questions that a cloud provider answers to show how it meets each control in CSA's Cloud Controls Matrix (CCM).
• Cancellation Policy A cancellation policy sets out how and when you can stop a SaaS subscription, how much notice you must give, through which channel, and what you still owe or lose afterward, such as unused fees and your data.
• Carve-Out Method (Subservice Organizations) The carve-out method is how a SOC report leaves out the controls of a vendor's own providers, such as its cloud host. The report names those providers, but the auditor does not test their controls, so you need other evidence for them.
• CCPA and CPRA The CCPA is California's consumer privacy law, and the CPRA is the 2020 ballot measure that expanded it. It gives California residents, including business contacts, rights over their personal information and limits how businesses and their vendors can sell or share it.
• CCPA Service Provider Under the CCPA, a service provider is a vendor that processes personal information on your behalf under a written contract that bars it from selling, sharing or reusing that data. With that contract in place, handing data to the vendor is not a sale.
• Certificate of Deletion A certificate of deletion is a written statement from a vendor confirming that it has deleted your data, usually naming the data, the systems and the date.
• Change of Control Clause A change of control clause says what happens to a contract when one side is bought, merged or sold, such as whether the other side can end the contract or must accept the new owner.
• Change Severity Change severity is a judgment of how much a change to a vendor's legal document matters to you: whether it is positive, negative or neutral for you, and what it touches, such as data use, billing or liability.
• Changes Effective at Renewal Changes effective at renewal is a contract protection that makes a vendor's new terms apply to you only from your next renewal or order, not in the middle of your current term.
• CIPA Pixel Lawsuits CIPA pixel lawsuits are claims under the California Invasion of Privacy Act and similar wiretap laws that say tracking pixels and other website tools let third parties collect visitor activity without consent. In 2026 California ended private suits for one type of claim, but wiretapping claims remain.
• Class Action Waiver A class action waiver is a clause where you give up the right to join a group lawsuit against a vendor and agree to bring claims only on your own, usually in arbitration.
• Clickwrap Agreement A clickwrap agreement is an online contract you accept by clicking "I agree" or ticking a box next to the terms. Courts typically enforce it when the terms were clearly shown.
• Co-Terming Co-terming lines up the end dates of several subscriptions or add-ons so they all renew on the same day, often with prorated charges for anything added mid-term.
• Colorado AI Act The Colorado AI Act (SB 24-205) is Colorado's 2024 law on high-risk AI. SB 26-189, passed in May 2026 before its duties began, repeals and replaces it on January 1, 2027 with a narrower automated decision-making law. A federal court order currently bars enforcement of both.
• Complementary User Entity Controls (CUECs) Complementary user entity controls (CUECs) are the security steps a vendor's SOC report assumes you, the customer, will take. The vendor's controls only work as described if you do your part, such as managing your own users' access.
• Concentration Risk Concentration risk is the danger that many of your vendors rely on the same cloud provider, AI model or other supplier underneath. If that one supplier fails, changes its terms or has a breach, several of your tools are hit at once.
• Confidentiality Clause A confidentiality clause makes both sides keep each other's private business information secret and use it only for the contract. Whether it also covers the data you put into the product depends on how the clause defines confidential information.
• Consequential Damages Exclusion A consequential damages exclusion is a contract clause that stops you from recovering the knock-on losses a vendor failure causes, such as lost profits, lost sales or lost data, leaving you only the direct cost of the failure.
• Continued Use as Acceptance Continued use as acceptance is a contract clause saying that if you keep using a service after its terms change, you have agreed to the new terms, even though you never clicked or signed anything.
• Continuous Vendor Monitoring Continuous vendor monitoring means watching your vendors between formal reviews, so you learn about changed terms, new subprocessors, security problems or business trouble when they happen instead of at the next annual review.
• Contract Amendment A contract amendment is a formal change to a contract that both sides agree to, usually in a short signed document that lists the sections it changes.
• Contract Lifecycle Management (CLM) Contract lifecycle management (CLM) is the process, and the software, for handling the contracts you sign: drafting, approval, signature, storage, renewal dates and obligations. It tracks your copy of each agreement, not the vendor's public online terms after they change.
• Controller vs Processor Under GDPR, a controller decides why and how personal data is used, while a processor handles that data on the controller's behalf and follows its instructions. When you use a SaaS tool for your customers' data, you are usually the controller and the vendor is the processor.
• Cookie Policy A cookie policy is a page that explains which cookies, pixels and similar trackers a company uses on its sites and apps, why it uses them and how you can turn them off. A change often means new tracking.
• Cosmetic Change A cosmetic change is an edit to a legal document, such as a new date, fixed typo or updated link, that does not change anyone's rights or duties.
• CPI Price Increase A CPI price increase raises your fee in line with inflation, measured by the Consumer Price Index. Some contracts add extra points on top, such as CPI plus 3%.
• Critical Vendor A critical vendor is one you cannot operate without, or whose failure would seriously hurt your customers, such as your cloud host, payment processor or main customer database.
• Cross-Context Behavioral Advertising Cross-context behavioral advertising is California's term for targeting ads to a person based on their activity across other companies' websites, apps or services.
• Cure Period A cure period is the time a party gets to fix a breach after receiving notice of it, often 30 days in SaaS agreements, before the other side can terminate. Unpaid invoices often follow a separate, faster suspension track.
• Customer Data Customer data is the contract term for the data you put into a vendor's service. Most vendor promises about use, deletion and AI training apply only to data inside this definition.
• Customer DPA Request A customer DPA request is when a customer asks you to sign a data processing agreement, the contract that sets out how you, as their vendor, handle the personal data they share with you and which subprocessors you use.
• Customer Indemnity A customer indemnity is your promise to defend the vendor and pay for third-party claims that come from your data, your users or your breach of the terms.

D 26 terms

• Data Breach A data breach (in GDPR terms, a personal data breach) is a security failure that leads to personal data being destroyed, lost, changed, disclosed or accessed without permission, whether by accident or by attack.
• Data Controller A data controller is the company that decides why and how personal data is used. For your own users and customers, that is usually you, not your vendors.
• Data Deletion After Termination Data deletion after termination is what a vendor does with your data when your contract ends: usually a short window to export it, then deletion from live systems, with backups removed later.
• Data Export and Portability Data export and portability is your ability to download your data from a vendor in a usable format, such as CSV or JSON, so you can keep it or move it to another tool.
• Data Localization Data localization is a legal requirement that certain data be stored, and sometimes processed, inside a specific country.
• Data Minimization Data minimization means collecting and keeping only the personal data you need for a purpose. With vendors, it means sending each tool only the data its job requires and turning off collection you do not use.
• Data Ownership Data ownership is the part of a SaaS contract that says who holds the rights to your data. The license you give the vendor matters more, because it decides what the vendor can actually do with it.
• Data Processing Addendum A data processing addendum is the same thing as a data processing agreement under another name. It is an add-on to the main contract that sets how the vendor handles personal data for you.
• Data Processing Agreement (DPA) A data processing agreement (DPA) is a contract that sets the rules for how a vendor handles personal data on your behalf, including security, subprocessors, breach notice and deletion. The GDPR requires one whenever it applies.
• Data Processor A data processor is a company that handles personal data on behalf of another business, following that business's instructions. Most SaaS vendors are processors for the data you put into their products.
• Data Protection Impact Assessment (DPIA) A data protection impact assessment (DPIA) is a written review, required by the GDPR for high-risk uses of personal data, that describes the plan, its risks to people and how you will reduce them, before you start.
• Data Protection Officer (DPO) A data protection officer (DPO) is the person who advises a company on the GDPR, monitors how it handles personal data and is the contact point for regulators and individuals. The GDPR requires one only in specific cases, such as large-scale monitoring of people.
• Data Residency Data residency is where your data is physically stored, such as in EU or US data centers. It is often a choice offered by vendors, not a legal requirement, and it may cover only some of your data.
• Data Residency vs Data Sovereignty Data residency is where your data is physically stored, such as servers in the EU or the US. Data sovereignty is which country's laws apply to that data and who can demand access to it. Storing data in one country does not by itself decide which laws reach it.
• Data Retention Data retention is how long a vendor keeps your data, including your content, account details, logs and backups, both while you use the service and after you leave.
• Data Sharing with Affiliates Data sharing with affiliates is a vendor's right to pass your data to other companies in its corporate group, such as its parent company or subsidiaries, including ones it acquires later.
• Data Subject A data subject is the living person that personal data is about, such as your users, your customers' employees or your own staff. The GDPR gives data subjects rights over their data, and those rights reach the vendors that hold it.
• Data Subject Access Request (DSAR) A data subject access request (DSAR) is a person's request to see the personal data you hold about them, and often to delete or correct it, which you must answer within a legal deadline, including data held by your vendors.
• De-Identified Data De-identified data is information changed so it can no longer reasonably be linked to a person. Under the CCPA, data that meets the legal test falls outside most of the law's protections.
• Description of Processing (Annex I) The description of processing is the part of a DPA, often Annex I, that lists what data the vendor handles, about whom, for what purpose and for how long.
• "Do Not Sell or Share" Link The "Do Not Sell or Share My Personal Information" link is the homepage opt-out link the CCPA requires from businesses that sell or share personal information.
• Do Not Track Do Not Track is an older browser setting that asked websites not to track you; websites were never required to obey it, and the standard was abandoned in 2019.
• Documented Instructions Documented instructions are your written directions to a vendor about what it may do with your data. Under GDPR Article 28(3)(a), a processor may only process your data on those instructions.
• Downgrade Restrictions A downgrade restriction says you cannot move to a cheaper plan or reduce seats until your current term ends, so you keep paying for the full amount you bought until renewal.
• DPA vs Privacy Policy A DPA is a contract that sets how a vendor handles personal data on your behalf. A privacy policy is a public notice telling people how a company uses their data. As a business customer, the DPA is what binds the vendor to you.
• Due Diligence Questionnaire (DDQ) A due diligence questionnaire is a broad vendor review that covers security plus finances, ownership, legal, privacy and continuity.

E 11 terms

• Effective Date An effective date is the day a contract, or a new version of a vendor's terms or policy, starts to apply to you. It can be later than the date the new version was posted.
• Encryption at Rest and in Transit Encryption in transit protects data while it moves between systems, usually with TLS. Encryption at rest protects data while it is stored on disks or in databases, often with AES-256. Vendors describe both in their security terms.
• End of Life Notice An end of life notice is a vendor's announcement that it will stop selling, supporting or running a product, plan or feature on a set date. It starts the clock on your move to a replacement and on getting your data out.
• End User License Agreement (EULA) An end user license agreement (EULA) gives you permission to install and use a copy of software while the vendor keeps ownership. SaaS vendors still use one for desktop apps, agents and self-managed editions.
• Enterprise vs Consumer AI Terms Many AI products have consumer plans for individuals and business plans for companies, each with its own terms. The same model can sit behind both, but the rules on training, retention and data ownership can differ by plan.
• Entire Agreement Clause An entire agreement clause says the signed contract is the whole deal. Anything a salesperson promised in a call, email or demo does not count unless it is written into the contract.
• ePrivacy Directive The ePrivacy Directive (2002/58/EC) is the EU law behind cookie banners. It requires consent before a website or app stores or reads information on a user's device, unless that is strictly necessary, and it sets the consent rules for marketing emails.
• EU AI Act The EU AI Act is the European Union law that sorts AI systems by risk and sets duties for the companies that build them (providers) and use them (deployers). Its obligations apply in stages, and the 2026 AI Omnibus pushed the high-risk deadlines to December 2027 and August 2028.
• EU-US Data Privacy Framework (DPF) The EU-US Data Privacy Framework (DPF) lets EU companies send personal data to US companies that certify they follow its privacy principles. As of October 2026 it is valid, with an appeal pending at the EU Court of Justice.
• Evergreen Clause An evergreen clause keeps a contract running with no fixed end date, renewing period after period until one side gives notice to stop. It is often used loosely to mean any contract that renews on its own.
• Export Control Clause An export control clause is your promise to follow export and sanctions laws when using a vendor's product, including not sending it to embargoed countries or listed people.

F 11 terms

• Fair Use Policy A fair use policy is a set of rules that limits how much of a service you can use, even on a plan sold as unlimited. It lets the vendor slow you down, charge more or suspend you if it decides your use is excessive.
• Feature Deprecation Feature deprecation is when a vendor removes or retires one feature while the product keeps running, often with less notice than a full product shutdown.
• Feedback Clause A feedback clause gives the vendor rights to the ideas, suggestions and bug reports you send, often with no payment or credit to you.
• Fine-Tuning on Customer Data Extra training of an existing AI model on a smaller set of your examples, either to build a model only you use or to improve a model shared with other customers.
• Flow-Down Obligations Flow-down obligations are the duties your vendor must pass on to the companies it hires to handle your data. Under the GDPR, those subprocessors must take on the same data protection duties, and your vendor stays liable for them.
• Force Majeure Force majeure is a contract clause that excuses a party from performing while an event outside its control, such as a disaster, war or major outage, stops it, without that party being in breach.
• Forced Plan Migration A forced plan migration is when a vendor moves existing customers off their current plan onto a new one. The new plan can cost more, include less or count usage differently, so it can work as a price increase without a new list price.
• Fourth-Party Risk Fourth-party risk is the risk from your vendors' own vendors, such as the cloud host or AI provider a tool uses to process your data. For software, these are mostly the subprocessors on a vendor's subprocessor list.
• Free Trial Auto-Conversion Free trial auto-conversion is when a free trial turns into a paid subscription on its own at the end of the trial, unless you cancel first. The card or billing details you gave at signup are charged automatically.
• FTC Click-to-Cancel Rule (Vacated) The FTC Click-to-Cancel Rule was a 2024 federal rule that would have made subscriptions, including business ones, as easy to cancel as to start. A federal appeals court vacated it in July 2025, and as of October 2026 the FTC is gathering comments on a possible new rule.
• Future Functionality Disclaimer A future functionality disclaimer says your purchase does not depend on features the vendor has not yet delivered.

G 8 terms

• GDPR Article 28 GDPR Article 28 is the EU privacy law rule that says what must be in the contract between a business and a vendor that handles personal data for it. That contract is usually called a data processing agreement, or DPA.
• GDPR for US SaaS Companies The GDPR is the EU law on personal data. It can apply to a US SaaS company with no EU office if it offers services to people in the EU or tracks their behavior there, and it sets rules for every vendor that handles that data for you.
• GDPR vs CCPA GDPR is the EU privacy law, and it requires a legal reason for every use of personal data of people in the EU. The CCPA is California's privacy law for larger businesses, and it centers on rights such as opting out of the sale or sharing of data.
• General vs Specific Subprocessor Authorization Under GDPR Article 28(2), specific authorization means you approve each subprocessor by name, while general authorization means you approve in advance and the vendor must tell you about changes so you can object.
• Global Privacy Control (GPC) Global Privacy Control (GPC) is a browser setting that tells websites not to sell or share your personal information, and businesses covered by California's privacy law must honor it.
• Governing Law Clause A governing law clause names the state or country whose law decides what the contract means if you and the vendor disagree. It is often the vendor's home state, not yours.
• Government Data Requests Government data requests are legal demands from police, courts or other authorities for data a vendor holds about its customers, such as subpoenas, court orders and search warrants.
• Grandfathered Terms and Pricing Grandfathered terms and pricing let existing customers keep their old price, plan or terms after a vendor changes them for new customers, usually for a limited time.

H 6 terms

• HIPAA and SaaS Vendors HIPAA is the US federal law that protects health information held by health plans, health care providers and their vendors. A SaaS vendor that handles that information for them is a business associate and must sign a business associate agreement (BAA).
• Hold Harmless Hold harmless is a contract promise that one side will not have to bear certain losses or claims, usually written as "defend, indemnify and hold harmless." Courts differ on whether it adds anything to indemnify.
• How to Notify Customers of a New Subprocessor Notifying customers of a new subprocessor means telling them, before the change takes effect, that a new outside company will handle their personal data for you, so they can review it and object if your contract allows.
• How to Publish Your Own Subprocessor List Publishing your own subprocessor list means posting a public page that names every outside company that handles your customers' personal data, what each one does and where, and keeping it current as your vendors change.
• How to See Old Versions of Terms You can see old versions of a vendor's terms in the vendor's own archive, in the Internet Archive's Wayback Machine, or in your own saved copies, each with gaps.
• Human Review of AI Data Human review of AI data means people at an AI vendor, or its contractors, can read your prompts and the AI's answers, for example to check flagged misuse, fix problems or answer legal demands.

I 9 terms

• "Improve Our Services" Clause A contract line that lets a vendor use your data to make its product better; unless AI training is excluded, it can cover training models on your data.
• Incorporation by Reference Incorporation by reference means a contract makes another document part of itself by pointing to it, often by a web link. If the linked page applies as updated, the vendor can change your contract by editing that page.
• Indemnification Clause An indemnification clause decides who pays when a third party sues: one side promises to defend the other and cover legal fees, settlements and judgments for claims the contract assigns to it.
• Inherent vs Residual Risk Inherent risk is how risky a vendor is before any safeguards. Residual risk is what remains after your controls and the vendor's controls are counted.
• Insurance Requirements An insurance requirements clause lists the insurance a vendor promises to carry, such as cyber or errors and omissions coverage, and the minimum amount for each.
• IP Indemnity An IP indemnity is a vendor's promise to defend you and pay the costs if someone sues claiming the vendor's product infringes their patent, copyright or trademark.
• ISO 27001 ISO 27001 is an international standard for running an information security management system: the policies, people and processes a company uses to manage security risk. A vendor certified to it has passed an audit by an independent certification body.
• ISO 27701 ISO 27701 is an international standard for managing privacy: how a company handles personal data as a controller or processor. It began as a privacy extension to ISO 27001, and its 2025 edition became a standalone standard.
• ISO 42001 ISO 42001 is an international standard for managing how a company builds and uses AI. A certificate shows an outside auditor checked the company's AI governance process, not that any AI product is safe.

J 2 terms

• Joint Controller Joint controllers are two or more companies that decide together why and how personal data is used. Under GDPR Article 26 they must agree who handles which privacy duties, and each stays answerable to the people concerned.
• Jury Trial Waiver A jury trial waiver is a clause where both sides give up the right to have a jury decide a dispute, so a judge decides it alone.

L 6 terms

• Last Updated Date A last updated date shows when a vendor last edited a page. It is not the date the rules start to apply, and it does not always move when the text changes.
• Lawful Basis and Legitimate Interest A lawful basis is the legal reason the GDPR requires for each use of personal data. Legitimate interest is one of the six bases: it allows a use that serves a real interest, unless the person's interests or rights override it.
• Liability Cap A liability cap is the maximum amount one side can recover from the other under a contract, often calculated from the fees paid over a set period.
• License to Customer Data The license to customer data is the permission you give a vendor to use your data. Its purpose, length and scope decide what the vendor can do beyond running your account.
• Limitation of Liability A limitation of liability clause caps how much a vendor must pay you if something goes wrong, often at the fees you paid over a set period, and excludes certain losses such as lost profits or data.
• Limitation of Liability vs Indemnification A limitation of liability clause caps how much one side can owe the other if something goes wrong. An indemnification clause makes one side cover the other's costs when a third party sues. The two work together, since the cap can decide how much an indemnity is really worth.

M 6 terms

• Master Service Agreement (MSA) A master service agreement (MSA) is the main contract between you and a vendor. It sets the general rules on payment, liability, data and termination, while separate order forms cover each purchase.
• Material Breach A material breach is a serious failure that goes to the heart of a contract, such as a vendor that stops delivering the service. It can let the other side stop performing and, after any cure period, terminate. A minor breach only allows damages.
• Material Change A material change is a change to a contract or policy significant enough to affect your rights, costs or data, and it is often the kind of change that requires the vendor to warn you in advance.
• Minimum Commitment A minimum commitment is a promise to spend or use at least a set amount over a period, which you owe even if your real use is lower.
• Model Provider (LLM Provider) The company that builds and runs the large language model behind a vendor's AI feature, such as OpenAI, Anthropic or Google.
• MSA vs Terms of Service A master service agreement (MSA) is a contract you negotiate and sign with a vendor. Terms of service are standard online terms the vendor writes and you accept by clicking or using the product. When both exist, the documents themselves decide which one wins.

N 5 terms

• Non-Refundable Fees Non-refundable fees are payments a vendor will not give back, even if you stop using the service early. When paired with "non-cancelable," the clause also means you owe the full commitment for the term, whether you use it or not.
• Notice of Changes to Terms A notice of changes is the email or posted message a vendor uses to tell you its terms, privacy policy or other legal documents are changing, and when the new version starts to apply.
• Notice of Non-Renewal A notice of non-renewal is the message you send a vendor to say you will not renew when your current term ends. Contracts often require it a set number of days before the end date, and missing that deadline can lock you into another term.
• Notices Clause A notices clause says how each side must send formal messages under a contract, such as by email, posting or mail, and when each message counts as delivered.
• Nth-Party Risk Nth-party risk is the risk from providers further down your vendor chain, such as your vendor's AI provider's cloud host. You manage it mainly by checking how your vendors oversee their own providers.

O 3 terms

• Order Form An order form is the document that records one purchase from a vendor: what you buy, how many seats, the price, the term and the renewal date. It sits on top of the main agreement and often overrides it.
• Order of Precedence Clause An order of precedence clause says which document wins when parts of a contract disagree, such as the order form, main agreement, DPA and online policies. It decides whether the terms you negotiated hold up.
• Overage Charges Overage charges are extra fees you pay when you use more than your plan includes, such as more seats, contacts, API calls or storage. They are often billed at a higher rate than your plan price.

P 13 terms

• Penetration Test Report A penetration test report sets out what authorized security testers found when they attacked a system the way a real attacker would, how serious each weakness is and how to fix it.
• Personal Data Personal data is any information about a person who can be identified, directly or by combining details. Under the GDPR it can include names, work emails, IP addresses and cookie IDs.
• Personal Information Personal information is the CCPA term for information that can reasonably be linked to a California resident or household. It excludes public, deidentified and aggregate information.
• Personally Identifiable Information (PII) Personally identifiable information (PII) is a US term for data that can identify a person, such as a name, email address, ID number or IP address. Its exact meaning depends on the law or contract that uses it.
• Price Change Notice A price change notice is the warning a vendor gives before it charges you a new price. On monthly and self-serve plans, it is often the only protection you get, since the plan can renew at the new price within weeks.
• Price Escalation Clause A price escalation clause builds a set yearly increase into the contract, as a fixed percentage or tied to an index like CPI.
• Privacy Notice A privacy notice is often just another name for a privacy policy. It can also be a separate, shorter notice, such as California's notice at collection or a US state privacy notice.
• Privacy Policy A privacy policy is a public page that explains how a company collects, uses, shares and keeps personal data. For a software vendor, it shows what happens to information about you and your team, including AI use, ads and retention.
• Privacy Policy Monitoring Privacy policy monitoring means keeping watch on your vendors' privacy policies so you learn when they change and whether the change affects how your data, your staff's data or your customers' data is used, shared or kept.
• Privacy Shield Privacy Shield was a program for sending personal data from the EU to certified US companies. The EU Court of Justice struck it down in July 2020, and the Data Privacy Framework replaced it in 2023.
• Processor vs Subprocessor A processor works directly for you under its own contract with you, while a subprocessor works for your processor under a contract with it. Your processor stays fully liable to you for its subprocessors.
• Publicity (Logo Use) Clause A publicity clause lets a vendor name you as a customer and show your logo in its marketing, often unless you opt out.
• Purpose Limitation Purpose limitation is the rule that personal data collected for one purpose should not be reused for an unrelated one. It is the privacy principle most directly tied to vendors training AI on your data.

Q 1 term

• Quebec Law 25 Quebec Law 25 is the 2021 law that overhauled private-sector privacy rules in the Canadian province of Quebec, adding GDPR-like duties such as privacy impact assessments, breach reporting and a privacy officer, phased in from 2022 to 2024.

R 10 terms

• Records of Processing Activities (RoPA) Records of processing activities (RoPA) is the internal list the GDPR requires of how you use personal data: why, whose data, which vendors receive it, where it goes and how long you keep it.
• Redline (Document Comparison) A redline is a version of a document that marks exactly what changed, with additions highlighted and deletions struck through, used both to negotiate contracts and to compare an old and new version of a vendor's terms.
• Refund Policy A refund policy sets out when a vendor gives money back and when it does not. In SaaS, fees are often non-refundable by default, with exceptions such as a short return window or ending the contract for the vendor's breach.
• Renewal Price Cap A renewal price cap limits how much a vendor can raise your price at each renewal, ideally written into your signed order form.
• Renewal Price Increase (Uplift) A renewal price increase, or uplift, is the higher price a vendor charges when your subscription renews. It can be a fixed percentage, an inflation-based increase, or a jump to the vendor's current list price.
• Representations and Warranties Representations are statements of fact a party makes when signing, and warranties are promises about how things will be, such as a vendor promising its service will perform as documented.
• Responsible AI Policy A responsible AI policy is a vendor's public statement of how it intends to build and use AI. It often has no contract force, so do not treat it as a promise about your data.
• Retroactive Terms Changes A retroactive terms change applies new contract or privacy rules to the past: to disputes that already began, or to data a vendor collected under older, stricter promises.
• Right to Object to a New Subprocessor The right to object lets you push back when a vendor plans to add a new company that handles your data. In many contracts, if the vendor goes ahead anyway, your only remedy is to stop using the affected service.
• Right to Reject Changes A right to reject changes lets you refuse a vendor's new terms, usually by ending the contract early with a refund of prepaid fees, instead of being bound by them.

S 46 terms

• SaaS Agreement (Subscription Agreement) A SaaS agreement, or subscription agreement, is the contract for using cloud software for a set period. It is often a bundle: a main agreement, an order form, a DPA and online policies, some of which the vendor can change.
• SaaS Management SaaS management is the practice, and the category of tools, for tracking which software subscriptions a company has, who uses them and what they cost. It covers licenses, spend and renewals, which is a different job from reading what each vendor's legal terms say.
• SaaS Renewal Calendar A SaaS renewal calendar is one shared list of every software subscription with its renewal date, the last day to cancel and the expected price. It gives you time to cancel, renegotiate or approve each renewal before it happens automatically.
• SaaS Sprawl SaaS sprawl is when a company ends up with more software subscriptions than it can track. Each tool brings its own terms, privacy policy, renewal date and access to your data, so cost and risk pile up unseen.
• Sale of Personal Information Under California's privacy law, a sale of personal information is any transfer of personal data to another company for money or anything else of value, such as ad targeting or analytics.
• SCCs vs Data Privacy Framework Standard contractual clauses (SCCs) and the EU-US Data Privacy Framework (DPF) are two legal ways to move personal data from the EU to the US. SCCs are contract terms signed between two companies; the DPF is a program a US company joins by self-certifying with the US Department of Commerce.
• Schrems II Schrems II is the 16 July 2020 ruling of the EU Court of Justice that struck down Privacy Shield and kept standard contractual clauses valid, but only if companies check that the destination country's laws let the importer keep its promises.
• Security Addendum A security addendum is the part of a contract that lists the security controls a vendor promises to keep, such as encryption, access control and incident response. Unlike a security marketing page, it is a binding promise.
• Security Incident A security incident is any event that threatens the security of systems or data. Every personal data breach is a security incident, but not every incident is a breach.
• Security Questionnaire A security questionnaire is a list of questions a buyer sends a vendor about how it protects systems and data: access, encryption, testing, incidents and subprocessors. The answers describe the vendor on the day they were written.
• Security Rating A security rating is a score an outside company gives a vendor based on what it can see from the internet. It can warn you early, but it cannot see contracts, data use or internal controls.
• Selling vs Sharing Data (CCPA) Under the CCPA, a "sale" is giving personal information to a third party for money or anything else of value. "Sharing" is giving it to a third party for ads based on what a person does on other sites and apps, paid or not.
• Sensitive Personal Information Sensitive personal information is personal data that can cause serious harm if misused, such as ID numbers, health data, precise location or message contents. Privacy laws give it stricter rules.
• Server-Side Tracking Server-side tracking is tracking that sends your data from a company's own servers to ad or analytics partners, so it does not show up in your browser.
• Service Credits Service credits are discounts on a future bill that a vendor gives when it misses its promised uptime, often a percentage of the monthly fee that you must request before a deadline.
• Service Level Agreement (SLA) A service level agreement (SLA) is a vendor's written promise about how well its service will run, usually a monthly uptime percentage. If the vendor misses it, you typically get only small service credits.
• Service-Specific Terms Service-specific terms are extra contract rules for particular products or features of a vendor, kept on a separate page from the main agreement. They often cover usage limits, AI, beta features and service levels, and they can override the main terms.
• Session Replay Session replay is a tool that records what a visitor does on a website or app, such as clicks, scrolling and typing, so the company can play the visit back like a video.
• Severability Clause A severability clause keeps the rest of a contract in force if a court or arbitrator strikes out one part of it. It tells the court what the parties wanted, but the court still decides whether the rest can stand.
• Shadow AI Shadow AI is any AI tool people use for work without the company knowing or approving it, such as personal chatbot accounts, browser extensions, note-takers or AI features turned on without review.
• Shadow IT Shadow IT is software or online services people use for work without the company knowing or approving it. Each one is a vendor nobody reviewed, with terms someone accepted for the company and nobody read.
• SIG Questionnaire The SIG (Standardized Information Gathering questionnaire) is Shared Assessments' licensed vendor risk questionnaire. It comes in a short SIG Lite for lower-risk vendors and a longer SIG Core for vendors that handle sensitive or regulated data.
• Sign-In Wrap A sign-in wrap is a signup or login screen that says creating an account or continuing means you accept the terms, without an "I agree" box. Courts treat it as a gray zone.
• SOC 1 vs SOC 2 A SOC 1 report covers a vendor's controls that can affect your financial reporting, such as payroll or billing processing. A SOC 2 report covers controls for security, availability, processing integrity, confidentiality and privacy. For most SaaS tools, SOC 2 is the one to ask for.
• SOC 2 SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe.
• SOC 2 Exceptions A SOC 2 exception is a test result in the report showing that a control did not work as described during the audit period.
• SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found.
• SOC 2 Scope SOC 2 scope is the boundary of what a SOC 2 report covers: which products, systems, locations, legal entities, trust services categories and time period. Anything outside it was not examined, even if it carries the same brand.
• SOC 2 Type 1 vs Type 2 A SOC 2 Type 1 report checks whether a vendor's security controls are well designed on a single date. A Type 2 report also tests whether those controls actually worked over a period of months, which makes it stronger evidence.
• SOC 2 vs ISO 27001 SOC 2 is a US audit report, written by a CPA firm, on how well a vendor's security controls are designed and run. ISO 27001 is an international certification that a vendor runs a managed security program. Both are useful, and SOC 2 gives you more detail to read.
• SOC 3 Report A SOC 3 report is a short, public summary of a vendor's SOC 2 audit. It shows the auditor's overall opinion but leaves out the controls tested and the detailed results, so it cannot replace the full SOC 2 report.
• Sole and Exclusive Remedy A sole and exclusive remedy clause says one specific fix, such as a service credit, is the only thing you can get for a specific problem, so you cannot sue for your wider losses.
• Sole Discretion Sole discretion means one side, usually the vendor, decides a matter alone using its own judgment, such as when to suspend you, change terms or treat your usage as excessive.
• SSO Tax The SSO tax is the extra price you pay when a vendor offers single sign-on (one company login for many apps) only on its more expensive plans. You pay for the higher tier to get a basic security control.
• Standard Contractual Clauses (SCCs) Standard contractual clauses (SCCs) are a ready-made contract approved by the European Commission. Companies sign them to legally send personal data from the EU to countries without EU-level protection, such as the US.
• State Automatic Renewal Laws State automatic renewal laws set rules for contracts and subscriptions that renew on their own, such as clear disclosure, consent and reminders. Many protect consumers only; a few reach business contracts, so do not assume one protects your company when a vendor renews.
• State Data Breach Notification Laws State data breach notification laws require businesses to tell people when their personal information is exposed in a security breach. If the breach happens at one of your vendors, the duty to notify your customers or employees can still land on you.
• Subprocessor A subprocessor is a company your vendor hires to handle your data for it, such as a cloud host or an AI model provider. You have no contract with it, so your vendor's data processing agreement sets the rules.
• Subprocessor Change Notification A subprocessor change notification is the advance notice a vendor gives before it adds or replaces a company that handles your data. Your DPA sets how many days you get, how notice is sent and whether you can object.
• Subprocessor List A subprocessor list is a public page where a vendor names the other companies that handle your data for it, with what each one does, where it is, and what data it touches. It changes whenever the vendor adds or drops a provider.
• Subprocessor Monitoring Subprocessor monitoring means tracking the outside companies your vendors use to handle your data, and noticing when a vendor adds or removes one, so you can review the change and object in time if you need to.
• Super Cap A super cap is a separate, higher limit on what a vendor will pay for named high-risk claims, most often data breaches, set above the general liability cap.
• Support Policy A support policy sets how a vendor handles your help requests: what it covers, when support is open, and target response times for each priority level.
• Survival Clause A survival clause lists the parts of a contract that keep applying after it ends, such as confidentiality, data protection, unpaid fees and liability limits.
• Suspension of Service Suspension of service is a vendor's right to switch off or limit your access for a while, without ending the contract, often for unpaid invoices, policy breaches or security risks.
• Swiss-US Data Privacy Framework The Swiss-US Data Privacy Framework lets Swiss companies send personal data to certified US companies without extra contracts. It took effect on September 15, 2024.

T 19 terms

• Targeted Advertising Targeted advertising is showing ads to a person based on data about them, such as the sites they visit or what they click, often collected by a vendor's ad partners through cookies and pixels.
• Technical and Organizational Measures (TOMs) Technical and organizational measures (TOMs) are the security steps a vendor promises to take to protect your data, such as encryption, access controls and staff training. They are usually listed in an annex to the DPA.
• Termination for Cause Termination for cause is the right to end a contract early because the other side committed a serious breach and did not fix it within the cure period the contract allows.
• Termination for Convenience Termination for convenience is the right to end a contract without giving a reason, simply by giving notice. In SaaS terms it may belong to you, the vendor, both or neither.
• Terms and Conditions Terms and conditions is another name for a terms of service. No law sets the title, so courts look at what the document says and how you agreed to it, not at its name.
• Terms of Service (ToS) A terms of service (ToS) is the contract a software vendor publishes to set the rules for using its product, including fees, data rights, liability and how disputes are handled. Vendors can usually change it on their own.
• Terms of Service Monitoring Terms of service monitoring means keeping watch on your vendors' legal terms so you learn when they change, what changed, and whether it affects your costs, your data or your promises to your own customers.
• Terms of Service Version History A terms of service version history is a dated record of every past version of a vendor's terms, so you can see what applied on a given day and what changed between versions.
• Terms of Service vs Privacy Policy Terms of service are the rules for using a product: what you may do, what you pay, and who is liable when things go wrong. A privacy policy explains what personal data the company collects, why, and who it shares it with.
• Terms of Use Terms of use is another name for a terms of service. Some vendors use it for the rules of their website, docs and forums, and keep a separate agreement for the paid product.
• Third-Party Cookies A third-party cookie is set by a company other than the website you are visiting, such as an ad network. Unlike a first-party cookie, it can follow you across many sites.
• Third-Party Risk Management (TPRM) Third-party risk management is how you manage the risks from any outside company you work with, including vendors, contractors and partners. It covers checking them before you start, watching them while you work together and closing things out when you stop.
• Third-Party vs Fourth-Party Risk Third-party risk comes from the vendors you sign up with directly. Fourth-party risk comes from your vendors' own vendors, such as the cloud hosts and AI providers they use to run their service. You have a contract with the first group, but usually not with the second.
• Tracking Pixel A tracking pixel is a small, invisible piece of code on a web page or in an email that reports your visit, clicks or email opens to another company's server, often an ad network.
• Transfer Impact Assessment (TIA) A transfer impact assessment (TIA) is a documented check, made before personal data leaves the EU under SCCs or BCRs, of whether the destination country's laws and practices let the recipient keep its data protection promises.
• Transition Assistance (Exit Period) Transition assistance, or the exit period, is the time after a contract ends when the vendor still lets you retrieve your data, sometimes with help moving to a new provider.
• Transparency Report A transparency report is a vendor's public count of the government and legal requests it received for customer data, and how it responded to them.
• True-Up A true-up is a bill at the end of a period that settles the gap between what you paid for and what you actually used, such as extra seats you added during the year.
• Trust Center A trust center is a vendor's page or portal for security, privacy and compliance information, such as SOC 2 reports, certificates, subprocessor lists and security policies. Some documents are public, and others need sign-up or an NDA.

U 6 terms

• UK GDPR The UK GDPR is the United Kingdom's version of the GDPR, kept in UK law after Brexit and amended since, with its own regulator, its own fines and its own tools for sending personal data abroad.
• UK International Data Transfer Addendum The UK International Data Transfer Addendum adapts the EU standard contractual clauses so they also cover transfers of personal data out of the UK.
• Unilateral Amendment Clause A unilateral amendment clause lets a vendor change its contract terms on its own, without your signature, usually by posting a new version and sometimes by emailing you.
• US State Privacy Laws US state privacy laws are the comprehensive consumer privacy laws passed state by state, starting with California. As of October 2026, about 20 are in force and four more take effect in 2027 and 2028, each with its own thresholds, opt-outs and rules for vendors.
• Usage Data Usage data is information a vendor collects about how you and your team use its product, such as features used, logins, devices and IP addresses. Vendors often claim broad rights over it, including for AI training and marketing.
• Usage-Based Pricing Usage-based pricing means you pay for how much you use, such as API calls, requests, messages or compute time, instead of a flat fee per seat. Your bill moves with your usage, so it can be hard to predict.

V 12 terms

• Vendor Acquisition A vendor acquisition is when another company buys your vendor. Your contract often carries on with the new owner, while the terms, privacy policy and subprocessors around it may change.
• Vendor Due Diligence Vendor due diligence is the homework you do before signing with a vendor: collecting its security reports, DPA, subprocessor list and terms, and recording who reviewed them and what was decided.
• Vendor Inventory A vendor inventory is one list of every company you buy from, with an owner, the data it handles, its risk tier, links to its legal documents and its renewal date. It is the starting point for managing vendor risk and for a SOC 2 audit.
• Vendor Lock-In Vendor lock-in is when leaving a vendor would cost so much time, money or data that you stay even when you would rather go. It usually comes from data you cannot easily export, long commitments and workflows built around one tool.
• Vendor Management Policy A vendor management policy is your company's own written rules for choosing, checking, watching and leaving vendors. It tells your team what to do and shows auditors and customers what you committed to.
• Vendor Offboarding Vendor offboarding is what you do when you stop using a vendor: export your data, have the vendor delete what it holds, remove its access to your systems and update your records.
• Vendor Onboarding Vendor onboarding is the set of steps you take when you start using a new vendor: checking its risk, accepting its terms, setting it up safely and adding it to your vendor list with an owner.
• Vendor Risk Assessment A vendor risk assessment is a check of how much risk a vendor brings, based on the data it gets, how much you depend on it and what its documents promise. You do it before you sign and again when something important changes.
• Vendor Risk Management (VRM) Vendor risk management is how you find, judge and keep watching the risks that come from the companies you buy from, such as data leaks, outages, price increases and changed terms. It runs from picking a vendor to leaving it.
• Vendor Tiering Vendor tiering is sorting your vendors into groups by how much risk they bring, based on the data they hold and how much you depend on them, so you review the riskiest ones more deeply and more often.
• Venue and Jurisdiction The venue and jurisdiction clause says which court, and in which city or county, hears a dispute under the contract. It is often exclusive, so you cannot sue anywhere else.
• Vulnerability Disclosure Policy A vulnerability disclosure policy (VDP) tells outside security researchers how to report a security hole in a vendor's product, what testing is allowed and what to expect back, often with a promise not to take legal action over good-faith research.

W 3 terms

• Warranty Disclaimer ("As Is") A warranty disclaimer is the clause where a vendor says it makes no promises about its service beyond the few it writes down, often with the words "as is," so bugs and outages are not by themselves a breach.
• "We Do Not Sell Your Data" Statement A "we do not sell your data" statement is a vendor's promise not to sell personal data, whose real reach depends on how the vendor defines "sell."
• Website Change Detection Website change detection means automatically checking a web page on a schedule and alerting you when its content changes; it can watch vendor legal pages, but generic tools do not explain what a legal change means.

Z 1 term

• Zero Data Retention (ZDR) Zero data retention (ZDR) is an AI provider's promise not to store your prompts or its answers after a request is processed, with possible exceptions for misuse checks, saved features and legal holds.