Service Agreement / Master Services Agreement Template

"Service agreement" is the generic label for any contract under which one party provides services to another. A Master Services Agreement (MSA) is a long-form services agreement that handles the commercial framework — IP, liability, confidentiality, payment terms, indemnities — and is signed once. A Statement of Work (SOW) sits underneath the MSA and defines a specific engagement's scope, deliverables, schedule, and fees. Best practice for any ongoing or repeatable service relationship: sign the MSA once, then add SOWs as needed. This removes procurement friction on the second sale and creates consistent legal terms across all engagements.

Service credits are the client's sole and exclusive remedy for SLA breach in well-drafted agreements, structured as tiered percentages of monthly fees: typically 10% for first-tier breach, 25% for second tier, 50% for catastrophic breach. They should be capped at monthly fees, excluded from the aggregate liability cap, and accompanied by a chronic-failure termination right (e.g., three consecutive credit-triggering months or two consecutive months below 95% availability). Without service credits as the exclusive remedy, the client has only a damages claim — which is rarely cost-effective to pursue for downtime — and the provider faces an open-ended exposure.

For ongoing service relationships, yes — but with proper notice mechanics. Market structure is an initial 12-month term with successive 12-month renewals unless either party gives 60–90 days' written notice of non-renewal. California (Bus. & Prof. Code §17600), New York (Gen. Bus. Law §763), and several other states require clear and conspicuous disclosure of auto-renewal terms for consumer-facing services. The FTC Negative Option Rule (16 C.F.R. §425, effective 2024) imposes additional disclosure and "click-to-cancel" requirements. B2B auto-renewals are generally enforceable but should still meet contract-formation standards and may be subject to state UDAP statutes.

For most professional services: (i) Commercial General Liability of $1M per occurrence / $2M aggregate; (ii) Professional Liability / Errors & Omissions of $1M-$5M per claim depending on engagement size; (iii) Cyber Liability of $1M-$10M for any data-touching engagement; (iv) Workers' Compensation per applicable state law; and (v) Automobile Liability if any travel. Enterprise clients increasingly require named additional insured status on the CGL policy, a waiver of subrogation, and at-least-30-days notice of cancellation endorsement. Make certificate of insurance delivery a condition precedent to engagement kickoff — not an afterthought when the first claim arrives.

Only if the contract grants the right expressly. Without a termination-for-convenience clause, the client can only terminate for cause (material breach) or under specific contract triggers (insolvency, change of control). Most well-drafted MSAs grant the client a termination-for-convenience right on 30–60 days' written notice, with the service provider paid for (i) work completed through the termination date, (ii) any non-cancelable third-party commitments, and (iii) a wind-down fee or kill fee proportional to remaining commitments. The service provider's exit right is typically more constrained — usually only for the client's uncured material breach or non-payment beyond the cure period.

If the service provider will access, store, or process personal data on the client's behalf — yes, and it is legally required. GDPR Article 28 mandates a written processor contract. The CCPA service-provider definition (Cal. Civ. Code §1798.140(ag)) and the Colorado, Connecticut, Virginia, and Utah privacy acts impose substantially similar requirements. The DPA covers processing purpose limitations, sub-processor authorization, security measures, breach-notification timeline (72 hours under GDPR), audit rights, and data return or deletion at termination. For protected health information, layer a HIPAA Business Associate Agreement (45 C.F.R. §164.504(e)); for payment-card data, layer PCI-DSS allocation of responsibilities.

Yes — this is the single most common 2024-2026-vintage gap in legacy services agreements. Pre-2022 templates are silent on whether the provider can use client confidential information to train, fine-tune, or prompt machine-learning models or input client information into third-party AI services. The clause is two sentences: (i) the provider shall not use client Confidential Information to train, fine-tune, prompt, or evaluate any ML model; and (ii) the provider shall not input client Confidential Information into any third-party AI service that does not contractually prohibit use of inputs for model training. Without it, enterprise procurement audits routinely flag the agreement as non-compliant.