Hey folks, I was just reviewing a SaaS agreement for a new monitoring tool, and it reminded me how many times I've seen teams (including my own) miss a critical detail: which attachments actually govern the service?
The main contract often says something like "the Service Level Agreement and Data Processing Addendum are incorporated herein." But then you get five attachments: SLA, DPA, Acceptable Use Policy, Security Policy, and Brand Guidelines. The legal hierarchy isn't always clear.
Here’s my practical walkthrough from an engineer's perspective:
**Step 1: Find the Incorporation Clause**
Look for a section titled "Order of Precedence" or "Definitions." It often reads:
> "In the event of any conflict between these Terms and an Attachment, the Attachment shall govern solely with respect to the subject matter therein."
But sometimes a specific attachment, like the DPA, will state it prevails over the main agreement for data processing terms. You need to check each one.
**Step 2: Watch for "Business Day" Definitions**
This is a classic trap. Your SLA might promise a 4-hour response time for a P1 ticket. But check the definitions:
```plaintext
Main Agreement: "Business Day" means Monday-Friday, excluding public holidays.
Attachment A - SLA: "Business Day" means 24 hours a day, 7 days a week.
Attachment C - Support Guide: "Business Day" means 9am-5pm in the provider's timezone.
```
Which one applies? If the SLA doesn't explicitly override the main agreement's definition, you might be stuck with Monday-Friday.
**Step 3: Identify the "Governing" vs. "Informational" Attachments**
* **Usually Governing:** SLA (specific credits), DPA (data handling), sometimes a specific Security Schedule.
* **Often Informational (but can still bind you):** Acceptable Use Policy (AUP), Support Guide, API Policies. These frequently grant the provider unilateral right to update them.
**Key Takeaway:** Never assume the most recently dated document wins. Create a simple mapping table during review. If the terms are unclear, propose an amendment like:
> "For clarity, the DPA (v2.3) and SLA (v1.2) attachments shall expressly prevail over the main agreement in the event of any conflict."
Has anyone else run into a situation where two attachments conflicted, and how did you resolve it? I'm particularly curious about cloud provider DPAs versus their main Terms of Service.
-- Amy
Cloud cost nerd. No, I don't use Reserved Instances.
Your step one is good, but you're being too kind. Most of the time that "Order of Precedence" clause is a complete fiction. It says attachments govern, but then you get a Security Policy attachment that says "this document is for informational purposes only and does not form part of the agreement." So which is it? The clause is meaningless if you don't then audit every single referenced document for its own governing language.
And the "Business Day" trap is real, but it's just a symptom. The disease is definitions not being consolidated into a single, governed terms section. I've seen SLA, DPA, and main contract all define "Business Day" differently. Good luck enforcing your 4-hour response when their clock stops at 5pm Friday and yours doesn't.
— geo
Exactly, and the real headache starts when those attachments aren't even static documents. You get a clause saying the SLA is incorporated, but then the SLA itself is a webpage they can update unilaterally. I've had vendors argue that the "current version" online applies, which completely undermines any fixed terms you negotiated.
You have to treat any reference to a policy or external document as a live link. If it doesn't have a version date and an explicit change control mechanism in the main agreement, it's not governed, it's just a pointer to whatever they feel like later. I make a point to append a specific, dated PDF of every referenced policy as an exhibit now.
Automate everything. Twice.