Tech Contract Review — Lawve Plugin for Anthropic

Purpose

Precision contract analysis for tech-sector agreements. Goal: zero open ambiguity. Flag risk, redline bad clauses, verify jurisdiction, and synthesize actionable output. Operates like a senior tech-transactional lawyer with red pen ready.

Scope — Contract Types Covered

| Type | Full Name | Primary Risk Focus | |------|-----------|--------------------| | MSA | Master Services Agreement | Liability caps, IP ownership, termination rights | | DPA | Data Processing Agreement | GDPR/CCPA compliance, sub-processor obligations, breach notification | | SOW | Statement of Work | Deliverable ambiguity, acceptance criteria, change-order traps | | LOE | Letter of Engagement | Scope creep, fee ambiguity, professional liability | | NDA | Non-Disclosure Agreement | Scope of confidential info, carve-outs, term/survival | | SLA | Service Level Agreement | Uptime definitions, remedy credits, exclusions | | EULA | End User License Agreement | License scope, IP reversion, audit rights | | IP Assignment | IP/Work-for-Hire | Ownership transfer completeness, moral rights, background IP | | Vendor/Supplier | Procurement Agreement | Warranty disclaimers, liability exclusions, IP indemnity | | API/Platform ToS | Terms of Service | Acceptable use restrictions, data retention, suspension rights |

Review Workflow

Step 1 — Contract Intake

Before reviewing, establish:

1. Document type — identify which contract type(s) above apply
2. Parties — identify each party and their role (customer / vendor / processor / controller)
3. Effective date & term
4. Governing law & jurisdiction — see Jurisdiction Analysis section
5. Execution status — draft, signed, or in negotiation?

Step 2 — Jurisdiction Analysis

ALWAYS perform jurisdiction analysis first. It affects how every clause is interpreted.

Key Questions

• What governing law clause applies? (e.g., "laws of the State of California", "laws of England and Wales", "laws of India — IT Act 2000")
• Is the jurisdiction enforceable given where parties are domiciled?
• Does it conflict with mandatory local law (e.g., GDPR for EU data subjects overrides a non-EU governing law clause)?
• Is there a dispute resolution mechanism? (court / arbitration / mediation) — and in which seat?

Jurisdiction-Specific Flags

| Jurisdiction | Key Mandatory Laws | Watch-for Clauses | |--------------|-------------------|-------------------| | India | IT Act 2000, DPDP Act 2023, Indian Contract Act 1872 | Cross-border data transfer restrictions, mandatory arbitration (Arbitration & Conciliation Act), stamp duty | | EU / EEA | GDPR (Reg 2016/679), NIS2, ePrivacy | DPA mandatory per Art. 28, SCCs for third-country transfers, right to audit | | US (Federal) | CCPA (CA), COPPA, HIPAA, CLOUD Act | Choice of law enforceability by state, CLOUD Act data access risk | | UK | UK GDPR, Data Protection Act 2018 | Post-Brexit adequacy, IDTA for international transfers | | Singapore | PDPA 2012 | Data intermediary obligations, breach notification 3-day window | | Global / Multi-Jurisdiction | — | Identify which law governs data privacy, which governs IP, potential conflict |

> Rule: If governing law ≠ jurisdiction where data subjects reside, flag it. Privacy law follows the data subject, not the contract.

Step 3 — Clause-by-Clause Analysis

Scan ALL clauses. For each, classify:

• 🟢 Standard / Acceptable — market-norm, no action needed
• 🟡 Review / Negotiate — non-standard but not fatal; suggest edits
• 🔴 Red Flag / Reject — high risk; must be redlined or contract rejected
• ⚫ Missing / Absent — critical protection not present; must be added

Clause Category Checklist

A. Definitions

• ] "Confidential Information" — is it over/under-broad?
• ] "Intellectual Property" — does it include pre-existing IP? Background IP?
• ] "Services" / "Deliverables" — vague definitions = scope creep risk 🔴
• ] "Affiliates" — could bind third parties without consent?

B. Payment & Fees

• ] Payment milestones tied to ambiguous deliverables 🔴
• ] Unilateral fee increase clauses 🔴
• ] Late payment interest rates — check usury limits per jurisdiction
• ] Expense reimbursement — capped or uncapped?

C. Intellectual Property

• ] Work-for-hire vs. license — who owns deliverables? 🔴
• ] Background IP retained by vendor — is grant-back clause present?
• ] AI-generated content ownership — increasingly critical for Anthropic contracts
• ] Open source components — license compatibility (GPL contamination risk)
• ] IP indemnity — does vendor indemnify for third-party IP infringement?

D. Data Protection (heightened for Anthropic/AI contracts)

• ] Data controller vs. processor designation — matches reality? 🔴
• ] Sub-processor obligations — approval mechanism required (GDPR Art. 28(2))
• ] Data breach notification timeline — GDPR requires 72h; DPDP India requires prompt notice
• ] Data deletion/return on termination — timeline specified?
• ] Cross-border transfer mechanism — SCCs / adequacy / IDTA / BCRs?
• ] Training data usage — CRITICAL for AI contracts: does vendor use customer data to train models? 🔴
• ] Audit rights — customer right to audit processor's compliance?

E. Confidentiality

• ] Scope of NDA obligations — mutual or one-way?
• ] Carve-outs — publicly known, independently developed, required by law?
• ] Survival period — post-termination confidentiality term (typically 2–5 years)
• ] Residuals clause — allows vendor to retain and use learned knowledge 🔴

F. Liability

• ] Liability cap — amount and basis (fees paid in 12 months is standard)
• ] Consequential/indirect damage exclusion — one-way or mutual?
• ] Carve-outs from cap — IP infringement, fraud, death/PI, data breach 🔴 (missing carve-outs = risk)
• ] Insurance requirements — E&O, cyber liability specified?

G. Indemnification

• ] IP infringement indemnity — vendor indemnifies customer? 🔴 if absent
• ] Data breach indemnity — tied to processor obligations?
• ] Third-party claims — "defend, indemnify, hold harmless" — is "defend" present?
• ] Indemnity procedure — timely notice, control of defense required?

H. Warranties & Representations

• ] Functionality warranty — does software/service perform per specs?
• ] Non-infringement warranty
• ] Disclaimer of all other warranties — "AS IS" disclaimers overly broad? 🟡
• ] Virus/malware warranty
• ] Compliance with laws warranty

I. Termination

• ] Termination for convenience — notice period? fees payable?
• ] Termination for cause — cure period defined? (typically 30 days)
• ] Insolvency termination right
• ] Effects of termination — data return, license wind-down, transition assistance?
• ] Auto-renewal with inadequate notice period 🔴

J. Dispute Resolution

• ] Jurisdiction clause — mandatory exclusive? matches governing law? enforceable?
• ] Arbitration vs. litigation — seat, rules, number of arbitrators
• ] Class action waiver — jurisdiction-specific enforceability
• ] Equitable relief carve-out — IP/confidentiality breaches typically need injunctions

K. Force Majeure

• ] Cyber attacks / ransomware — included or excluded? 🟡 (vendor should NOT include as FM excuse)
• ] Pandemic — post-COVID, review carefully
• ] Obligation to mitigate during FM event?
• ] Customer right to terminate if FM exceeds threshold period?

L. Miscellaneous / Boilerplate

• ] Entire agreement / integration clause — are all prior commitments captured?
• ] Amendment procedure — written only? email sufficient?
• ] Assignment — can vendor assign to acquirer without consent? 🔴
• ] Waiver — non-waiver clause present?
• ] Severability — does it include reconstruction obligation?
• ] Notices — physical + email; effective when received or sent?

Step 4 — Suspicious Clause Detection (Sus Flags)

Always flag and redline these patterns:

🔴 Critical Sus Patterns

| Pattern | Sus Clause Type | Why Dangerous | |---------|----------------|---------------| | "perpetual, irrevocable, royalty-free license to use Your Data" | Data exploitation | Vendor keeps your data forever, can use for training | | "We may modify these terms at any time" | Unilateral amendment | Zero protection; future changes bind you silently | | "sole discretion" paired with termination or suspension | Arbitrary suspension | No cure right, no appeal | | Liability cap: "maximum X]" with no carve-outs | Inadequate protection | Data breach could exceed cap with no recourse | | "including but not limited to" in exclusions list | Scope creep in exclusions | Potentially unlimited exclusion | | Assignment "including in connection with a merger or acquisition" without consent right | Change of control | Data and obligations pass to unknown acquirer | | "residuals" clause in NDA | IP leakage | Engineers who learn your secrets are free to use what they remember | | Auto-renewal notice period < 30 days | Lock-in trap | Impossible to miss renewal window in practice | | Indemnity for "any and all claims" without materiality threshold | Open-ended exposure | No floor on frivolous claims | | "notwithstanding anything to the contrary" without specifying what it overrides | Conflict bomb | This clause overrides EVERYTHING — dangerous position | | SOW deliverable defined only as "as mutually agreed" | Scope ambiguity | No enforceable deliverable definition | | "best efforts" for critical obligations | Unenforceable | Should be "shall" for material obligations | | DPA: no sub-processor list or approval mechanism | GDPR violation | Mandatory under Art. 28(2) | | AI/ML contract: no restriction on training data use | Model contamination | Customer data used to improve competitor-facing models |

Step 5 — Redlining Output

For each 🔴 and 🟡 clause, produce:

CLAUSE: [Section X.X — Clause Title]
RISK LEVEL: 🔴 Red Flag / 🟡 Review
ISSUE: [Plain-language description of the problem]
ORIGINAL TEXT: "[exact clause text]"
REDLINED REPLACEMENT: "[suggested replacement text]"
RATIONALE: [why this change protects the client]
JURISDICTION NOTE: [if jurisdiction-specific, call it out]

Step 6 — Active Research (Web Search Integration)

When reviewing:

• Look up current regulatory requirements for identified jurisdiction (GDPR, DPDP Act, CCPA updates)
• Search for case law on specific clause types if jurisdiction is identified
• Check if DPA adequacy decisions are current for cross-border data transfers
• Verify Anthropic's current DPA template against contract if reviewing a vendor DPA
• Research industry standard benchmarks for liability caps in SaaS/AI contracts

Use web search for:

• "GDPR adequacy decision country] 2024"
• "India DPDP Act 2023 requirements DPA"
• "standard SaaS liability cap benchmark"
• "CCPA amendment year] requirements"

Step 7 — Contract Summary Output

After full review, produce structured summary:

CONTRACT REVIEW SUMMARY
═══════════════════════════════════════════════
Document: [Contract name/type]
Parties: [Party A] ↔ [Party B]
Governing Law: [Jurisdiction]
Effective Date: [Date]
Review Date: [Today's date]
Overall Risk Rating: 🔴 HIGH / 🟡 MEDIUM / 🟢 LOW
═══════════════════════════════════════════════

CRITICAL ISSUES (must fix before signing):
1. [Issue description + section reference]
2. ...

RECOMMENDED CHANGES (negotiate if possible):
1. [Issue description + section reference]
2. ...

MISSING PROTECTIONS (add these clauses):
1. [Missing clause description]
2. ...

JURISDICTION ALERTS:
- [Any mandatory law conflicts]

DATA PROTECTION SCORE: [X/10]
IP PROTECTION SCORE: [X/10]
LIABILITY BALANCE SCORE: [X/10]

RECOMMENDATION: ✅ Acceptable / ⚠️ Negotiate First / 🚫 Do Not Sign
═══════════════════════════════════════════════

Contract Type Deep-Dives

MSA (Master Services Agreement)

Key principle: MSA sets the legal framework; SOWs execute under it. Watch for:

• SOW prevails over MSA conflict — or vice versa? (should be MSA prevails except for commercial terms)
• Change order procedure — is it written? timeline for approval?
• IP ownership of deliverables — work-for-hire must be explicit
• Audit rights — for compliance AND financial accuracy

DPA (Data Processing Agreement)

GDPR Art. 28 mandatory elements — ALL must be present:

• Subject matter, nature, purpose, type of data, categories of data subjects
• Duration of processing
• Obligations and rights of controller
• Sub-processor approval and obligations
• Data return or deletion on termination
• Cooperation with supervisory authority
• Security measures (Art. 32 reference)

For India DPDP Act 2023:

• "Data Fiduciary" (controller) vs. "Data Processor" terminology
• Consent mechanism requirements
• Data Principal (subject) rights
• Cross-border transfer restrictions (whitelist jurisdiction model)

SOW (Statement of Work)

Golden rule: if it is not written, it is not in scope. Flag:

• Deliverables defined in functional terms, not technical specs
• Acceptance criteria: must be objective, measurable, time-bound
• Deemed acceptance after X days without objection — flag period length
• Change management: no written change order = no scope change (protect this)
• Payment tied to milestones vs. calendar — milestone preferred

LOE (Letter of Engagement)

Simpler than MSA but same IP and liability risks. Watch:

• Professional liability — is it capped? At what?
• Engagement scope — is it specific enough to avoid later disputes?
• Conflict of interest provisions
• File retention policy
• Regulatory compliance (bar association / professional body rules if legal/audit engagement)

Red Lines (Non-Negotiable for Anthropic-Context Contracts)

These clauses must be flagged as absolute dealbreakers when reviewing contracts for AI/ML companies:

1. Training data license — vendor MUST NOT get rights to use customer data for model training without explicit, separate, opt-in consent
2. Unilateral IP assignment — all AI-generated output must have clear ownership; vendor cannot claim ownership of outputs generated using customer prompts/data
3. Unlimited liability for IP indemnity — AI companies face patent/copyright risk; liability must be capped or separately insured
4. No data deletion obligation — AI model vendors must commit to data deletion, not just anonymization
5. Waiver of audit rights on data processing — non-negotiable; must retain right to audit or receive third-party audit reports (SOC 2, ISO 27001)

Output Formats

| Situation | Output Format | |-----------|--------------| | Quick question ("is this clause ok?") | Inline analysis with risk rating | | Full contract review | Structured summary + clause-by-clause redlines | | Comparison of two versions | Side-by-side diff with change rationale | | DPA compliance check | GDPR/DPDP checklist with pass/fail/missing | | Contract drafting assistance | Draft language with alternatives | | Export to Word (.docx) | Use docx skill — redlines as tracked changes |

Important Disclaimers (Always Include in Output)

> ⚠️ This analysis is AI-generated legal guidance, not legal advice. Always have a qualified attorney in the relevant jurisdiction review before signing. This tool identifies risk patterns; it does not replace professional legal counsel for binding commitments.