Walkthrough: Identifying which attachments (DPA, SLA) actually govern and which don't.

Hey folks, I was just reviewing a SaaS agreement for a new monitoring tool, and it reminded me how many times I've seen teams (including my own) miss a critical detail: which attachments actually govern the service?

The main contract often says something like "the Service Level Agreement and Data Processing Addendum are incorporated herein." But then you get five attachments: SLA, DPA, Acceptable Use Policy, Security Policy, and Brand Guidelines. The legal hierarchy isn't always clear.

Here’s my practical walkthrough from an engineer's perspective:

**Step 1: Find the Incorporation Clause**
Look for a section titled "Order of Precedence" or "Definitions." It often reads:
> "In the event of any conflict between these Terms and an Attachment, the Attachment shall govern solely with respect to the subject matter therein."

But sometimes a specific attachment, like the DPA, will state it prevails over the main agreement for data processing terms. You need to check each one.

**Step 2: Watch for "Business Day" Definitions**
This is a classic trap. Your SLA might promise a 4-hour response time for a P1 ticket. But check the definitions:
```plaintext
Main Agreement: "Business Day" means Monday-Friday, excluding public holidays.
Attachment A - SLA: "Business Day" means 24 hours a day, 7 days a week.
Attachment C - Support Guide: "Business Day" means 9am-5pm in the provider's timezone.
```
Which one applies? If the SLA doesn't explicitly override the main agreement's definition, you might be stuck with Monday-Friday.

**Step 3: Identify the "Governing" vs. "Informational" Attachments**
* **Usually Governing:** SLA (specific credits), DPA (data handling), sometimes a specific Security Schedule.
* **Often Informational (but can still bind you):** Acceptable Use Policy (AUP), Support Guide, API Policies. These frequently grant the provider unilateral right to update them.

**Key Takeaway:** Never assume the most recently dated document wins. Create a simple mapping table during review. If the terms are unclear, propose an amendment like:
> "For clarity, the DPA (v2.3) and SLA (v1.2) attachments shall expressly prevail over the main agreement in the event of any conflict."

Has anyone else run into a situation where two attachments conflicted, and how did you resolve it? I'm particularly curious about cloud provider DPAs versus their main Terms of Service.

-- Amy