The biggest contract red flags in vendor and customer agreements are usually in a few “standard” clauses: automatic renewals, uncapped indemnities, one-sided limitations of liability, IP ownership, payment and termination terms, governing law and venue, unilateral amendment rights, and data security obligations. If you check those clauses before signing, you’ll catch most of the terms that create real financial exposure for a small business.
Below is a practical walkthrough of each red flag, what it looks like on the page, and what a more balanced version usually says.
Why contract red flags matter more for $1M–$5M businesses
A large company can absorb one bad contract. A business doing $3 million a year often can’t. One uncapped indemnity or a three-year auto-renewal on software you no longer use can wipe out a quarter’s profit.
The problem is that risky terms rarely look risky. They sit in the “General Provisions” section, in a linked online terms page, or on the back of a purchase order. Most owners read the price, scope and dates, then sign.
The clauses below are where problems most often hide. If you want a starting point for which agreements your business should have in the first place, see our guide to essential contracts for growing businesses.
1. Automatic renewal clauses with short notice windows
What it looks like: “This Agreement will automatically renew for successive one-year terms unless either party gives written notice of non-renewal at least 90 days before the end of the then-current term.”
Why it’s a red flag: The renewal itself isn’t the problem. The narrow window is. Miss a 90-day deadline by a week and you may owe another full year. Some clauses also allow price increases at renewal with no cap.
What to look for instead:
- Renewal terms no longer than the original term (or month-to-month after the first term)
- A cap on renewal price increases
- A requirement that the vendor send a reminder before the notice deadline
Between businesses, auto-renewals are generally enforceable if they’re clear. A few states add protections for certain contract types. For example, New York General Obligations Law § 5-903 makes some auto-renewals in service, maintenance and repair contracts unenforceable unless the provider gives written notice 15 to 30 days before the cancellation deadline. Don’t rely on rules like that, though. Calendar every renewal deadline when you sign.
2. Uncapped or one-way indemnities
What it looks like: “Customer shall indemnify, defend and hold harmless Vendor from any and all claims, losses and expenses arising out of or relating to this Agreement.”
Why it’s a red flag: “Arising out of or relating to this Agreement” can cover almost anything, including losses caused by the other side. If only you give an indemnity, and it has no cap, your exposure may exceed the contract’s value many times over.
What to look for instead:
- Indemnities tied to specific risks (for example, your own negligence, your breach, or IP infringement by your product)
- Mutual indemnities where risks run both ways
- Clear limits: who controls the defense, notice requirements, and whether the indemnity is subject to the liability cap
3. One-sided limitation of liability clauses
What it looks like: “In no event shall Vendor’s liability exceed the fees paid in the three months preceding the claim. In no event shall Vendor be liable for any indirect, incidental, special or consequential damages.”
Why it’s a red flag: Liability caps are normal and often reasonable. The red flags are:
- The cap protects only one party
- The cap is tiny compared with the harm a failure could cause (three months of a $500/month subscription is $1,500)
- Indemnities and confidentiality breaches are carved out of their cap but not yours
- “Consequential damages” are excluded in a way that wipes out your most likely losses, like lost revenue from a system outage
What to look for instead: A mutual cap, sized to the real risk, with sensible carve-outs (for example, for confidentiality breaches, data incidents, or gross negligence) that apply equally to both sides.
4. Intellectual property ownership terms
What it looks like: “Vendor retains all right, title and interest in all deliverables, work product, and materials created under this Agreement.”
Why it’s a red flag: If you pay a developer, agency or designer to build something for you, you probably assume you own it. Under the Copyright Act’s definition of “work made for hire”, that isn’t automatic for most work by independent contractors. Without a written assignment, the contractor may own it and you may hold only a license.
What to look for instead:
- A clear assignment of custom deliverables to you on payment
- A license to any pre-existing vendor tools built into the deliverables
- On customer contracts you write: make sure you aren’t accidentally giving customers ownership of your platform, templates or know-how
IP gaps often surface later, during a sale. Buyers check this closely, which we cover in preparing your business for sale.
5. Payment terms that squeeze cash flow
What it looks like: Net-90 payment terms from a large customer, “pay-when-paid” clauses, or a right for the customer to withhold payment for any “dispute.”
Why it’s a red flag: For a business with tight working capital, payment terms are a financial risk, not a formality. Watch for:
- Long payment windows with no late fee or interest
- Broad set-off rights (the customer can deduct claimed amounts from any invoice)
- Acceptance criteria that let the customer delay payment indefinitely
- On vendor contracts: large prepayments with no refund if the vendor fails to deliver
6. Termination rights that only run one way
What it looks like: The customer can terminate “for convenience” on 30 days’ notice, but you can terminate only for uncured material breach.
Why it’s a red flag: One-sided termination leaves you carrying staffing, inventory or software costs for a customer who can walk away. On vendor contracts, the reverse problem appears: you’re locked in even when the vendor underperforms.
What to look for instead:
- Mutual termination rights, or termination fees that cover your sunk costs
- A clear cure period for breaches
- Defined obligations at exit: data return, transition help, and final invoices
7. Governing law, venue and dispute resolution
What it looks like: “This Agreement is governed by the laws of [the other party’s home state]. Any dispute shall be brought exclusively in the courts of [a city 1,000 miles away].”
Why it’s a red flag: Venue clauses can make a modest dispute too expensive to pursue. If you’re owed $40,000, flying counsel and witnesses across the country may cost more than you’d recover.
Some states limit these clauses. North Carolina’s G.S. 22B-3, for example, generally voids clauses in contracts entered into in North Carolina that require disputes to be litigated or arbitrated in another state, with limited exceptions. How those statutes apply, especially in federal court or to arbitration clauses, can be complicated. Don’t assume your state’s rule will rescue you.
Also check for jury waivers, mandatory arbitration, shortened deadlines to bring claims, and “prevailing party” attorney fee clauses.
8. Unilateral amendment rights and incorporated online terms
What it looks like: “Vendor may modify these Terms at any time by posting updated Terms on its website. Continued use constitutes acceptance.”
Why it’s a red flag: You negotiate a deal, then the vendor changes it without asking. A related trap: the signed order form “incorporates” online terms by URL, and those terms override what you negotiated.
What to look for instead:
- Changes require a signed writing from both parties, or at least advance notice and a right to terminate without penalty
- An “order of precedence” clause stating your negotiated terms control over online terms
A related issue is the “battle of the forms.” When businesses exchange purchase orders and invoices with conflicting fine print, UCC § 2-207 governs which terms apply to sales of goods. The result can surprise both sides. A signed master agreement avoids most of that uncertainty.
9. Data, privacy and security obligations
What it looks like: Your customer’s contract requires you to meet a security standard you don’t currently follow, notify them of any incident within 24 hours, and pay all costs of any breach. Or your vendor’s contract disclaims all responsibility for the data you upload.
Why it’s a red flag: Data terms are now standard in both directions. Every state has a data breach notification law, and breach response is expensive. Check:
- Whether security requirements match what you actually do
- Who pays for notification, forensics and credit monitoring after an incident
- Whether data liability sits inside or outside the liability cap
- Whether the vendor can use your data for its own purposes, including training products
- Whether your cyber insurance covers the obligations you’re accepting
10. Other clauses worth a second look
- Assignment and change of control: Can the other side assign the contract to a competitor? Can you assign it if you sell your business? Missing assignment rights can complicate a later sale.
- Exclusivity: Does the contract bar you from working with competitors or other vendors?
- Non-solicitation: Are you barred from hiring their people, and for how long?
- Personal guaranties: Is an owner signing personally, not just on behalf of the company?
- Insurance requirements: Can you actually meet the required coverage types and limits?
- Survival: Which obligations continue after the contract ends, and for how long?
How to review contracts without slowing down every deal
You don’t need a lawyer to read every purchase order. A practical system for a growing business looks like this:
- Standard templates. Have counsel prepare your customer agreement and key vendor templates, so you start from your own paper.
- A one-page checklist. Use the ten red flags above as a screening tool for incoming contracts.
- Thresholds for legal review. Send contracts above a dollar amount, longer than a year, or with unusual risk to counsel.
- A renewal calendar. Track every notice deadline the day the contract is signed.
That’s the kind of recurring work a legal subscription is built for. Flex Business Lawyer subscribers get up to 5 attorney hours each month to use on contract reviews, templates and negotiations. You can see how the subscription is priced, compare it with other models in our post on subscription vs. hourly vs. in-house counsel, or start your subscription when you’re ready.
If you’re unsure whether a particular contract needs a lawyer’s eyes, our guide on when to call a business lawyer covers the common triggers.
Frequently asked questions
What are the most common red flags in a vendor contract?
The most common are automatic renewals with short cancellation windows, liability caps that protect only the vendor, broad indemnities you give with no cap, and terms that let the vendor change the agreement unilaterally. Data and security terms that put breach costs on you are increasingly common too.
Can I negotiate a vendor's standard terms?
Often, yes, especially on renewal mechanics, liability caps, payment terms and termination rights. Larger vendors may refuse to change their paper, but many will accept targeted changes on a few material points. Knowing which two or three points matter most to your business is what makes the negotiation productive.
Are automatic renewal clauses enforceable in business contracts?
Generally yes, between businesses, if the terms are clear. A few states add notice requirements for certain contract types. New York, for example, requires service providers to give written notice before enforcing some auto-renewals of service, maintenance or repair contracts. Consumer auto-renewal laws are broader but usually don’t apply to business-to-business deals.
What is the difference between a limitation of liability and an indemnity?
A limitation of liability caps or excludes what one party can recover from the other. An indemnity is a promise to cover certain losses, often including third-party claims and legal fees. They interact: if indemnities are carved out of the liability cap, your exposure under the indemnity may have no ceiling.
Should a lawyer review every contract my business signs?
Not necessarily. Many businesses have counsel build templates and a short review checklist, then send only high-value, long-term or unusual contracts for full review. That approach catches the riskiest terms without slowing every deal.