Incorporation by Reference

What is incorporation by reference?

Incorporation by reference means a contract makes another document part of itself by pointing to it, instead of copying its text. The pointer is often a web address.

In SaaS this is everywhere. You sign a master service agreement, but it may pull in a data processing agreement, an acceptable use policy, a service level agreement, security pages and product terms. Each one lives at its own URL. Together they can be far longer than the document you signed.

The key question is which version counts. Some contracts pull in the linked page as it was on the day you signed. Others pull it in "as updated from time to time," which means the vendor can change your contract by editing a web page.

What it looks like in a vendor's terms

A typical clause reads like this:

The Agreement includes the Acceptable Use Policy, Security Measures and Service Level Agreement available at the URLs below, each of which is incorporated by reference. We may update these documents from time to time, and the updated version will apply from its effective date.

• "Includes" and "incorporated by reference": the linked documents are part of your contract, even though you never signed them separately.
• "Available at the URLs below": the text lives on the vendor's website, not in your files.
• "May update": the vendor can change these documents on its own. This works like a unilateral amendment clause.
• "From its effective date": the new version can apply without your signature.

Two real examples show the difference. Salesforce's MSA incorporates its DPA as "posted as of the Effective Date," a fixed version (section 2.2). Atlassian's agreement includes its policies, product-specific terms and DPA, and says Atlassian may modify all of them from time to time (sections 20.9 and 21).

A real change we caught

Venpo flagged a change in which Hotjar's DPA can now change without your signature. A DPA you once treated as a fixed, signed document became one more page that can move.

Why it matters to you

• Your signed contract can change. If a linked document applies "as updated," a change on the vendor's website can change your rights. This can affect data use, security promises or pricing rules.
• You may not get a direct email. Notice terms vary. GitHub promises at least 30 days' notice of material changes by posting on its site or emailing you (GitHub Terms of Service, section R). Atlassian promises commercially reasonable efforts to post changes 30 days ahead (section 20.9). A post on a website is easy to miss.
• Your promises to your customers. If you promised your customers certain security or privacy terms, and your vendor changes a linked DPA or security page, your promise may no longer be backed up.
• Unclear wording. A 2020 version of Salesforce's agreement said its data processing addendum was "hereby incorporated by reference," but said only that use of Beta Services "is subject to" terms posted at a web address (Salesforce MSA, June 2020). Whether a linked change binds you can depend on the exact wording and the law that applies.

What to check

• List every URL your contract points to. Save a dated copy of each page on the day you sign.
• For each one, check whether it applies as of the signing date or "as updated." Ask for the fixed version, at least for the DPA and security terms.
• Ask for written notice by email of any change to linked documents, with a set number of days before it takes effect.
• Ask for a right to reject a change, or to leave with a refund of prepaid fees. Atlassian's agreement gives paid customers 30 days to terminate after certain mid-term changes (section 20.9(c)).
• Check the order of precedence clause to see whether a linked document can override what you negotiated.

How Venpo helps

Incorporation by reference turns a vendor's web pages into part of your contract. Venpo monitors those public pages, such as terms, DPAs, policies and subprocessor lists, and emails you a plain-English alert that says what changed and why it matters. Every vendor gets a change history, so you can prove what a linked document said on the day you signed.