Adapt
What pro-client paper looks like.
Every tactic on the Observe page has an opposite, and every opposite can be written into a contract. None of what follows is theoretical: each of these terms exists today in a published agreement anyone can read. This page states them as another option, provider-neutral, so you know what is possible before anyone tells you what is normal.
A useful habit while reading: for each term, imagine asking a provider to put it in writing. A fair provider can. A reluctant one is telling you something.
Outside the standard
Ten marks of a fair agreement
Month-to-month, both directions
The term
Either side may end the agreement on 30 days' written notice. No
multi-year minimum, no auto-renewal trap, no cancellation window
to miss. The provider earns your business every month or loses it.
Leaving costs nothing extra
Termination
No early termination fee. Your only obligation at exit is the
current billing month. If a provider needs a penalty to keep you,
ask why the service alone will not.
No forced arbitration
Disputes
Disagreements go to negotiation, then mediation, then court if it
comes to that. You keep your right to a judge, a jury, and an
appeal. Many service contracts quietly waive all three.
A liability cap that rises for breaches
Liability
A stated general cap, and a higher cap, twice the general one or
available insurance proceeds, for data breaches and data-protection
failures. The cap goes up exactly where your exposure does, and the
provider's insurance is disclosed in the agreement.
A breach clock in writing
Notification
Notice of any known or suspected breach without undue delay, and in
any event within 72 hours of discovery. A hard number, not "prompt"
or "reasonable," because your own regulatory deadlines start
running whether or not your provider hurries.
Rates that hold
Billing
The per-user rate does not increase for the life of the agreement.
No annual escalators, no cost-of-living creep. If loyalty is worth
something, it shows up as a credit, not a raise.
Service levels with automatic teeth
The SLA
Response targets measured from the provider's own ticketing system,
and service credits applied automatically to the next invoice when
targets are missed. You should never have to catch the miss and
file a claim to be made whole.
No resale, no markup
Hardware & licenses
You buy hardware and licensing directly, at your discretion, and
you own what you buy. The provider advises; the provider does not
take a margin on the advice. Nothing on your network can become a
buyout at exit.
A written exit, with a date
Offboarding
At termination: your environment documentation, your administrator
credentials, and your data, in machine-readable formats, on a
committed timeline measured in days. Written into the agreement on
day one, when nobody is angry yet.
You own your data and deliverables
Ownership
Everything produced for you is assigned to you on payment, and
your data is yours throughout, stated plainly. The provider keeps
its own pre-existing tools, and nothing of yours.
If you are regulated
Four more marks for practices and firms
A medical practice or an accounting firm carries obligations a generic agreement never mentions. These belong in yours.
A BAA from day one
Healthcare
If a provider will touch systems holding patient information, a
HIPAA Business Associate Agreement is signed before the work
starts, not after you ask. A provider who hesitates on the BAA is
not ready for healthcare.
A real risk assessment at onboarding
Compliance
The security risk analysis your rules require, HIPAA for
practices, the FTC Safeguards Rule and a written information
security plan for firms handling tax data, performed at the start
and included in the engagement, not sold later as a surprise
project.
Backups that answer the hard question
Data
Encrypted, offsite, immutable backups with tested restores, and an
agreement that honestly addresses what happens to retained backup
copies at termination instead of promising a deletion that
immutability makes impossible. Careful drafting here is a sign the
provider actually understands regulated data.
Compliance evidence as a deliverable
Audits & insurance
The documentation your auditor, regulator, or cyber-insurer will
ask for, organized and current, as part of the service. And a
provider honest enough to say they are not your auditor and cannot
certify you compliant. Be wary of anyone who claims otherwise.