Free checklist
Vendor contract review
checklist
20 things to check before you sign or renew a vendor contract. Covers commercial terms, renewal and exit rights, liability, data protection, and operational obligations.
How to use this checklist
Work through each section before signing or renewing any vendor contract. Items marked with a red flag deserve particular attention — these are the clauses most commonly exploited to vendor advantage. If you cannot satisfy a checklist item, consider negotiating that clause before signing, or document the accepted risk.
Contract value and payment schedule are clearly stated
Look for any ambiguity around payment milestones, currency, and whether prices include VAT.
Price increase mechanism is defined and capped
Many vendor contracts allow annual price increases of up to 10–15% with minimal notice. Check for a cap or a CPI-linked formula.
Scope of services is unambiguous
Vague scope leads to disputes. Every deliverable, SLA, and exclusion should be explicit.
Invoicing terms and late payment penalties are acceptable
Standard is 30 days net. Watch for 14-day terms or daily interest clauses.
Auto-renewal clause identified and notice period noted
The most common contract trap. If auto-renews, mark the notice deadline in your calendar today.
Notice period for cancellation is reasonable (30–90 days is normal)
Notice periods longer than 90 days for SaaS tools are a red flag. Vendor contracts with 6-month notice deserve hard negotiation.
Early termination clause and any exit fees understood
Some contracts penalise early exit with 3–6 months of remaining fees. Know this before you sign.
Renewal price protections (if any) are in writing
If the vendor promises a renewal rate, get it in the contract. Verbal commitments don't hold.
Governing law and jurisdiction are acceptable
Contracts governed by a foreign jurisdiction can be expensive to enforce. Try to negotiate your own country's law.
Liability cap is present and proportionate
The liability cap should be at least equal to 12 months of fees. Caps below this significantly limit your recourse.
Indemnification provisions are mutual (or acceptable one-way)
Broad indemnification clauses that are one-sided in the vendor's favour are common. Get them mutual.
Force majeure clause doesn't exclude routine service failures
Some vendors use broadly drafted force majeure to excuse poor performance. Check what it covers.
Data processing agreement (DPA) in place if vendor processes personal data
Required under GDPR for any vendor that touches your customer or employee data. This is a legal obligation, not optional.
Data residency and transfer mechanisms confirmed
If data leaves the EU, you need a valid transfer mechanism (SCCs, adequacy decision). Ask explicitly where data is stored.
Security obligations (encryption, access controls, incident notification) are defined
The vendor should commit to specific security standards and notify you within 72 hours of any breach.
Data deletion / return on termination is specified
What happens to your data when the contract ends? Ensure you can export it and that it is deleted within a defined period.
SLA commitments (uptime, response times) are measurable and enforceable
99.9% uptime sounds good — that's 8.7 hours of downtime per year. Know what the SLA actually means for your operations.
Vendor's right to change or discontinue the product/service is limited
Some SaaS contracts let vendors deprecate features or change pricing with 30 days notice. Push for longer or require material change protections.
Sub-processors and third-party dependencies are disclosed
If the vendor uses third-party infrastructure that could affect your service, you need to know. Relevant for SLAs and data protection.
Change management process is agreed (for professional services contracts)
Without a formal change process, scope creep is inevitable. All changes to scope should require a written change order.
Take the checklist with you
Free, no email address, no account. Copy it or download it and it is yours.
Useful in a contract review meeting, or as a step in vendor onboarding. Copy it, print it, change it — it is a plain checklist, not a lead form.
The six clauses that actually cost money
The checklist above is what to look at. This is why each of these six is worth spending negotiating capital on, and what to ask for instead — because knowing a clause is bad is only useful if you know what good looks like.
1 of 6
Auto-renewal
- What it says
- The agreement renews for a further term — often matching the original — unless one side gives notice by a stated deadline.
- What it costs
- Silence is acceptance. Doing nothing is a decision to continue on whatever the renewal terms say, including any uplift, and the decision gets made without anyone at your company being in the room.
- Ask for
- A shorter renewal term than the initial one, or a renewal that requires positive confirmation rather than silence. Failing both, get the notice deadline into a calendar the day you sign.
2 of 6
Notice period and how notice must be given
- What it says
- How far ahead you must tell the vendor you are leaving, and the exact channel — a named address, a legal contact, sometimes registered post.
- What it costs
- Two separate failures cost the same amount: sending notice too late, and sending valid-looking notice the wrong way. An email to your account manager may not satisfy a clause that names a legal address, and vendors do enforce this.
- Ask for
- A notice period no longer than 30 days for software, and notice by email to a named address. If the contract demands post, ask for email to be added as an accepted channel.
3 of 6
Price escalation at renewal
- What it says
- How much the price may rise when the term rolls over: a fixed percentage, an inflation-linked formula, or a move to current list pricing.
- What it costs
- Uncapped escalation compounds. A clause agreed in a low-inflation year behaves very differently in a high one, and 'current list pricing' is not a number you can budget against at all.
- Ask for
- A cap in writing — a stated maximum percentage, or inflation with a ceiling. If a vendor promises a renewal rate verbally, it belongs in the contract or it does not exist.
4 of 6
Termination for convenience
- What it says
- Whether you may exit before the natural end of the term without the vendor being at fault, and what that costs.
- What it costs
- Without it, a tool your team abandons in month three is still paid for in month twelve. With a punitive version of it, exiting costs the remaining fees anyway, which is the same outcome dressed differently.
- Ask for
- A right to exit on 30 to 60 days' notice after an initial period, with any fee limited to a stated number of months rather than the whole remaining term.
5 of 6
Data ownership and export on exit
- What it says
- Who owns the data you put in, how you get it out, in what format, and how long the vendor keeps it after termination.
- What it costs
- Export terms decide whether leaving is actually possible. A vendor that returns your data as a per-record manual download, or deletes it days after termination, has made switching expensive without ever raising the price.
- Ask for
- Explicit customer ownership, self-service export in a structured format, and a stated retention window after termination — long enough to migrate, short enough to be a real deletion commitment.
6 of 6
Liability cap and its carve-outs
- What it says
- The ceiling on what the vendor owes you if something goes badly wrong, usually a multiple of fees paid, plus the exceptions that sit outside it.
- What it costs
- A cap set at a few months of fees is your entire remedy for an outage or a breach. The carve-outs matter as much as the number: a cap with no exception for data breaches leaves you carrying that risk.
- Ask for
- A cap of at least twelve months of fees, with carve-outs for breach of confidentiality, data protection failures, and IP indemnities. This is the clause most worth spending negotiating capital on.
Frequently asked questions
What should you check before signing a vendor contract?
Six clauses carry most of the cost: auto-renewal, the notice period and how notice must be delivered, price escalation at renewal, termination for convenience, data ownership and export on exit, and the liability cap. Everything else on a review checklist matters less than getting those six right.
Who should review vendor contracts in a small business?
Whoever will live with the consequences, usually operations or finance rather than a lawyer. A structured checklist gets a non-specialist most of the way; bring in legal advice for the liability cap, indemnities, and anything with regulatory exposure, which are the clauses where judgment is worth paying for.
How long should a vendor contract review take?
Around an hour for a routine software agreement if you have the contract in front of you and a checklist to work through. Longer contracts are not proportionally slower, because the clauses that cost money are the same ones in a five-page agreement and a forty-page one.
Is the checklist free to use and share?
Yes. No email address, no account, nothing to sign up for. Copy it, print it, edit it, or drop it into your vendor onboarding process. It is a plain checklist rather than a lead form, which is the point of publishing it.
Related resources
Contract Renewal Tracking Template
CSV spreadsheet for Excel and Google Sheets — 11 columns covering everything from counterparty to auto-renews flag.
Get the template →
SaaS Cancellation Notice Templates
Copy-paste email templates for cancelling SaaS subscriptions and vendor contracts. Three scenarios covered.
Get the templates →
Stop reviewing contracts manually
Lumipact AI extracts renewal dates, notice periods, and key clauses from your contracts automatically. Get tiered alerts before deadlines and a live spend dashboard — without the spreadsheet.