Back-to-Back Terms

What are back-to-back terms?

Back-to-back terms means the promises you make to your customers are matched by the promises your vendors make to you. If you promise a customer something that depends on a vendor, the vendor's contract should promise you at least the same.

The gap appears when you promise more than you receive. Say you tell customers you will report a security incident within 24 hours. Your hosting provider only promises to tell you "without undue delay". You now carry a promise you may not be able to keep.

Data protection law builds in one version of this idea. Under GDPR Article 28(4), a processor must pass the same data protection duties down to each subprocessor it uses, and it stays fully liable to its customer if that subprocessor fails. These passed-down duties are called flow-down obligations.

Why it matters to you

Your customers hold you to your contract, not to your vendor's. If a vendor misses a deadline, cuts a benefit or changes its terms, you still owe your customer what you promised.

Common gaps show up in a few places:

• Breach notice. Atlassian's DPA promises notice "without undue delay" and, where feasible, within 72 hours (Atlassian DPA, section 3.2). A 24 hour promise to your customer would be tighter than that.
• Subprocessor notice. If you promise customers 30 days' notice, but a vendor you rely on gives less, you may learn of a change too late to pass it on.
• Uptime and service credits. Your SLA to customers cannot be safely higher than the SLAs of the services you run on.
• Liability. If you accept unlimited liability for data loss, but your vendor caps its own at a few months of fees, the difference is yours to pay. See limitation of liability.

Vendor changes can open a gap after you signed. For example, Venpo flagged that Meta dropped the 30-day notice from its WhatsApp Business terms: Meta can now end the agreement at any time on notice, instead of giving 30 days' written notice. If you promise customers support over WhatsApp, that promise now rests on a shorter one from Meta.

What to check

• List the promises in your own customer contract and DPA: breach notice hours, uptime, subprocessor notice, data deletion timing, data location.
• For each one, find the matching promise in your key vendors' DPA, SLA or terms. Write down any gap.
• Where you find a gap, either soften your own promise or ask the vendor for a stronger one.
• Check the liability cap in each key vendor contract against the liability you accept from customers.
• Recheck after any vendor terms change, since a vendor can shorten a notice period or remove a promise at renewal.

How Venpo helps

Venpo emails you a plain-English alert when a vendor's terms, DPA, SLA or subprocessor list changes, including when a notice period or a promise is cut. That shows you when a promise you made to your own customers has lost its backing.