Back to the prompt
Step by step

Review a vendor MSA top-to-bottom

This page lists three turns, the messages you send to the AI one after another in the same chat, and then a check of the answer. Keep it open next to your chat. Each turn shows the next thing to paste, with the values you entered already filled in. Nothing is sent from this page, and your conversation stays in the AI tool you are using.

Paste the full agreement plus any exhibits, order form, or incorporated policies you want reviewed.

Annual value, term, what the vendor actually does, and how badly it hurts if they stop.

Reverses every position below, and changes what counts as a win.

Decides whether a DPA is mandatory and how hard the security obligations have to bite.

What the agreement says governs, where disputes go, and which regulators reach this data.

Your playbook: standard cap, required carve-outs, approved fallbacks, and anything that is a hard no.

Watch for these throughout

  • The model reads only what you paste. Order forms, SLAs, security exhibits, and incorporated policies carry the real obligations, and the teeth are usually in the exhibit.
  • Liability carve-outs interact with your insurance. Confirm that cyber and E&O coverage actually reaches the exposure you are agreeing to accept.
  • If the vendor processes EU, UK, or California personal data, a DPA is not optional and transfer mechanisms may be required. Treat any DPA analysis here as a starting point, not a compliance conclusion.
  • Auto-renewal and price-escalator clauses become someone else's problem in eighteen months. Calendar the notice window before you sign, not after.
  • State-specific regimes (Illinois BIPA, Washington My Health My Data, New York SHIELD) will not surface unless you name them. Add them to the inputs yourself.