Vendor Documents

Acceptable Use Policy (AUP) An acceptable use policy (AUP) is a vendor's list of things you and your team may not do with its product, such as attacking the service, scraping data or misusing AI. Breaking it can get your account suspended. AI Terms (AI Addendum) AI terms, or an AI addendum, are the part of a vendor's contract that governs its AI features: what happens to your inputs and outputs, which model providers are involved, and whether your data can train AI models. API Terms API terms are the rules for connecting software to a vendor's platform through its API. They set request limits, restrict how you use the data, and let the vendor change the API or cut off your access. Beta Terms Beta terms are the rules for a vendor's unreleased features, such as beta, preview or early access. They often remove warranties, cut liability to a small amount and let the vendor change or end the feature at any time. Billing Terms Billing terms are the rules for how a vendor charges you: when you pay, how prices can rise, refunds, late payment and how to dispute a charge. They may sit in the main terms or in a separate billing document. Business Associate Agreement (BAA) A business associate agreement (BAA) is a contract HIPAA requires when a vendor handles protected health information for a health care provider, health plan or another business associate. It limits how the vendor uses the data and requires it to protect and report on it. Cookie Policy A cookie policy is a page that explains which cookies, pixels and similar trackers a company uses on its sites and apps, why it uses them and how you can turn them off. A change often means new tracking. Data Processing Addendum A data processing addendum is the same thing as a data processing agreement under another name. It is an add-on to the main contract that sets how the vendor handles personal data for you. Data Processing Agreement (DPA) A data processing agreement (DPA) is a contract that sets the rules for how a vendor handles personal data on your behalf, including security, subprocessors, breach notice and deletion. The GDPR requires one whenever it applies. End User License Agreement (EULA) An end user license agreement (EULA) gives you permission to install and use a copy of software while the vendor keeps ownership. SaaS vendors still use one for desktop apps, agents and self-managed editions. Incorporation by Reference Incorporation by reference means a contract makes another document part of itself by pointing to it, often by a web link. If the linked page applies as updated, the vendor can change your contract by editing that page. Master Service Agreement (MSA) A master service agreement (MSA) is the main contract between you and a vendor. It sets the general rules on payment, liability, data and termination, while separate order forms cover each purchase. Order Form An order form is the document that records one purchase from a vendor: what you buy, how many seats, the price, the term and the renewal date. It sits on top of the main agreement and often overrides it. Order of Precedence Clause An order of precedence clause says which document wins when parts of a contract disagree, such as the order form, main agreement, DPA and online policies. It decides whether the terms you negotiated hold up. Privacy Notice A privacy notice is often just another name for a privacy policy. It can also be a separate, shorter notice, such as California's notice at collection or a US state privacy notice. Privacy Policy A privacy policy is a public page that explains how a company collects, uses, shares and keeps personal data. For a software vendor, it shows what happens to information about you and your team, including AI use, ads and retention. Refund Policy A refund policy sets out when a vendor gives money back and when it does not. In SaaS, fees are often non-refundable by default, with exceptions such as a short return window or ending the contract for the vendor's breach. SaaS Agreement (Subscription Agreement) A SaaS agreement, or subscription agreement, is the contract for using cloud software for a set period. It is often a bundle: a main agreement, an order form, a DPA and online policies, some of which the vendor can change. Security Addendum A security addendum is the part of a contract that lists the security controls a vendor promises to keep, such as encryption, access control and incident response. Unlike a security marketing page, it is a binding promise. Service Level Agreement (SLA) A service level agreement (SLA) is a vendor's written promise about how well its service will run, usually a monthly uptime percentage. If the vendor misses it, you typically get only small service credits. Service-Specific Terms Service-specific terms are extra contract rules for particular products or features of a vendor, kept on a separate page from the main agreement. They often cover usage limits, AI, beta features and service levels, and they can override the main terms. Subprocessor List A subprocessor list is a public page where a vendor names the other companies that handle your data for it, with what each one does, where it is, and what data it touches. It changes whenever the vendor adds or drops a provider. Support Policy A support policy sets how a vendor handles your help requests: what it covers, when support is open, and target response times for each priority level. Terms and Conditions Terms and conditions is another name for a terms of service. No law sets the title, so courts look at what the document says and how you agreed to it, not at its name. Terms of Service (ToS) A terms of service (ToS) is the contract a software vendor publishes to set the rules for using its product, including fees, data rights, liability and how disputes are handled. Vendors can usually change it on their own. Terms of Use Terms of use is another name for a terms of service. Some vendors use it for the rules of their website, docs and forums, and keep a separate agreement for the paid product. Transparency Report A transparency report is a vendor's public count of the government and legal requests it received for customer data, and how it responded to them. Trust Center A trust center is a vendor's page or portal for security, privacy and compliance information, such as SOC 2 reports, certificates, subprocessor lists and security policies. Some documents are public, and others need sign-up or an NDA.