Scope of Services
Define specific modules, features, installation tasks, and integration points; list deliverables, milestones, and acceptance tests so both parties share the same expectations.
A well-drafted agreement reduces disputes, clarifies responsibilities for uptime and data handling, allocates IP ownership, and aligns expectations on support and costs; it also documents consent for electronic signature and records under U.S. e-signature law such as the ESIGN Act and state UETA or ESRA frameworks.
Signatures are usually required from an authorized officer for the vendor and from the spa owner or an authorized representative; witness or notarization requirements depend on the governing law and document type.
Define specific modules, features, installation tasks, and integration points; list deliverables, milestones, and acceptance tests so both parties share the same expectations.
State one-time charges, recurring subscription amounts, payment schedule, late fees, and any variable fees such as per-transaction or per-seat billing with examples to avoid ambiguity.
Specify uptime targets, maintenance windows, response and resolution times for incidents, credits or remedies for missed SLAs, and escalation procedures for critical outages.
Describe data ownership, permitted uses, encryption standards, breach notification timelines, and whether a HIPAA business associate agreement (BAA) is required for protected health information.
Allocate ownership of custom code, third-party components, and deliverables; include license scope for the spa and restrictions on reverse engineering and resale.
Include termination rights, notice periods, early-termination fees, and post-termination transition assistance to export data and restore service continuity.
| Field | Configuration |
|---|---|
| Signing Order | Sequential or parallel signer routing |
| Authentication | Email only, SMS code, or two-factor |
| Reminders | Auto reminders at configurable intervals |
| Certificate | Attach completion certificate with audit trail |
Verify platform compliance for required frameworks (ESIGN/UETA, HIPAA if applicable, and SOC 2/ISO certifications) and retain signed records with an attached audit trail.
Define weeks or months from Effective Date
Set a fixed review period, commonly 14–30 days
Provide written notice 30–90 days before renewal
Establish notice period, typically 30–60 days
Specify initial response time, e.g., 4 hours for critical