Every customer sends back our contract with their own security schedule, and we agree to things nobody has checked we can do.
Technology businesses sign obligations faster than they can service them: uptime commitments, security schedules, data processing terms and liability caps negotiated by whoever was closest to the deal. We own the contract layer so what you promise is what you can actually deliver. In practice that means one person holds every customer contract, knows which clauses differ from your standard position and why, and is in the room while the next one is negotiated rather than reading it afterwards.
Dinmore Bell acts as the outsourced General Counsel for technology companies: customer and reseller agreements, SaaS terms, data processing and security schedules, IP assignment, and the commercial disputes that follow. It is a retained function on a fixed monthly fee rather than a law firm billing by the hour.
How we own it
Contracts your engineering team can honour
Service levels, uptime and support commitments checked against what the platform actually does before they are agreed, not after the first breach. Where a customer asks for something you cannot deliver, we say so during the negotiation. The gap is nearly always in the definitions rather than the headline number. Two companies can both promise the same availability and mean entirely different things by it, depending on how downtime is measured, what counts as excluded maintenance, whether degraded performance counts at all, and over what period the figure is averaged. A monthly measurement window is a materially harder promise than a quarterly one, and almost nobody notices which they signed. Then there is what happens when you miss it. Service credits are the normal remedy and they are usually survivable. What is not survivable is a service level that is drafted as a condition rather than a warranty, so a sustained miss gives the customer a termination right, or one that links to a broader indemnity. On a contract that represents a meaningful share of revenue, that distinction is the difference between an awkward quarter and a hole in the forecast. Support commitments have the same problem in a different place. Response times expressed in hours mean one thing if the clock runs in business hours in your own timezone and another if it runs around the clock for a customer eight hours away. A support obligation your team cannot meet without hiring is a hiring decision that was made in a contract negotiation by somebody who did not know they were making it.
Data processing that survives a security review
Processing terms, sub-processor lists, transfer mechanisms and security schedules kept current and consistent across every customer, so an enterprise review is a document you already have rather than a fortnight of work. The cost of getting this wrong is almost never a regulatory one at this stage of a company's life. It is sales cycle. An enterprise buyer's security review asks for the same fifteen things every time: the data processing agreement, the sub-processor list, the transfer mechanism for anything leaving the region, the retention and deletion position, the breach notification timetable, the penetration test summary, the access control policy, the business continuity plan. A company that has those in a folder closes weeks earlier than one that assembles them per deal, and it closes them without making commitments in the heat of a deadline. Consistency is the part that decays. Each negotiation ends with a small concession, and eighteen months later the company has agreed four different breach notification periods, three different audit rights and two incompatible sub-processor consent regimes. Nobody is tracking which customer got which. The first time it matters is the first incident, when somebody has to work out who must be told, in what order, within how many hours, across a customer base nobody has mapped. We hold that map. One register of which customer has which variation from the standard position, so the answer to a question during an incident takes minutes rather than a day, and so the next negotiation starts from a known position rather than from whatever the customer sent.
The liability cap, and the things that sit outside it
The cap is the single most commercially significant number in a technology contract, and it is routinely agreed by people who are looking at the price instead. A cap set at twelve months' fees is the market position for most software; a cap set at the contract value, or an uncapped liability for data breach, is a different risk entirely and one your insurance may not follow. What matters as much as the number is what is carved out of it. Indemnities for intellectual property infringement, liability for a data breach, breach of confidentiality, and anything drafted as a wilful default are commonly placed outside the cap, and each carve-out is negotiable. An uncapped data breach indemnity in a contract with an enterprise customer, on a platform holding their customers' personal data, is an exposure that can exceed the company's value, and it is agreed in ordinary course because it appears in a schedule rather than on the commercial summary. We read these against the insurance the business actually holds, and against the other contracts in the estate, so that the answer to how much aggregate uncapped exposure the company carries is a number somebody knows.
The IP is actually yours
Assignments from every contractor and founder, open-source obligations understood rather than assumed, and customer contracts that license rather than transfer. These are the things diligence finds, and they are cheap to fix now. The contractor point is the one that recurs. Paying an invoice does not transfer copyright, and a development agreement without an express assignment leaves the developer owning what they wrote. In a company's first two years the code is often written by a mix of founders before incorporation, contractors on a day rate, and an agency, and the paperwork for all three is frequently a purchase order. Fixing it later means finding people who have moved on and asking them to sign something, and their willingness is not guaranteed. Open source is usually less dangerous than founders fear and more dangerous than they check. Permissive licences are fine. Copyleft licences in code you distribute, or in a component compiled into something you ship, create obligations that are inconvenient to discover during a funding round. The work is knowing what is in the dependency tree and on what terms, which is a one-off exercise and then a light process. Customer contracts that transfer rather than licence are the third. A bespoke development clause in an enterprise agreement, drafted by the customer, will often assign the output to them, and if the output is a feature that becomes part of the product you have given away part of the platform. This is nearly always negotiable to a licence back, and nearly always missed.
The AI terms now arriving with every enterprise deal
Enterprise buyers have added a set of questions that did not exist two years ago, and they now arrive as a schedule: whether customer data is used to train models, which sub-processors provide the models, whether outputs are reviewed by a human, what happens if an output is wrong, and whether the supplier can evidence any of it. Most of these are answerable and the answers are commercially harmless. The risk is in answering them differently to different customers, or promising a restriction the product does not currently honour. A commitment that customer data will never be used for training is straightforward if it is true and an incident if it is not, and the person negotiating the deal is usually not the person who knows. We hold the position once, in a schedule of our own, so the answer is the same in every deal and matches what the platform does.
Where specialists come in
Patent drafting and prosecution, trade mark filing and any contentious matter before a court or tribunal are handled by regulated specialists — patent and trade mark attorneys, and solicitors or counsel — whom we instruct and coordinate. Regulated advice on financial promotions or on the tax treatment of share schemes is taken from authorised advisers. We hold the budget and remain accountable for the commercial outcome.
Services we run here
- What is an outsourced General Counsel for a technology company?
- A retained function on a fixed monthly fee that owns the contract layer: your standard terms, the customer paper that comes back, data processing and security schedules, IP assignment, and the disputes that follow. It sits inside the business rather than being instructed per matter.
- How does this differ from using a law firm?
- Cost is fixed and known rather than billed by the hour, and the work is continuous rather than transactional. A retained function is in the negotiation while it happens, holds the register of what has been agreed across every customer, and does not need briefing each time.
- What uptime commitment should we be giving?
- Whatever your platform demonstrably achieves, measured the way the contract defines it. The definitions matter more than the headline figure: the measurement window, what counts as excluded maintenance, and whether a sustained miss gives service credits or a termination right.
- What does an enterprise security review usually ask for?
- The data processing agreement, sub-processor list, transfer mechanism, retention and deletion position, breach notification timetable, penetration test summary, access control policy and business continuity plan. Having them ready shortens the sales cycle materially.
- Do we own code written by a contractor?
- Not automatically. Paying the invoice does not assign copyright, and without an express written assignment the developer retains it. This is the most common gap found in diligence and it is much cheaper to fix while the contractor is still contactable.
- Is open-source code a problem?
- Permissive licences are not. Copyleft licences in code you distribute can create obligations you would rather know about before a funding round. The work is establishing what is in the dependency tree and on what terms, then keeping that current.
- What liability cap is normal in a SaaS contract?
- Twelve months' fees is the common market position, but the carve-outs matter as much as the number. Uncapped liability for data breach or an open-ended IP indemnity is a materially different risk, and both are negotiable.
- How are AI clauses in customer contracts handled?
- By holding one position across the estate rather than answering each buyer separately: whether customer data is used for training, which model providers are sub-processors, and what the contract says about incorrect outputs. The commitment has to match what the product actually does.