TL;DR: The master services agreement decides who absorbs cost when something goes wrong. Twelve clauses do the shifting: IP assignment, replacement, termination, conversion, liability, indemnities, confidentiality, security notification, audit rights, data residency, currency and governing law. For each, this page gives the fair buyer position and the opening offer you will usually see instead. Negotiate the continuity clauses first and the rate last.
Most buyers focus on the rate card and treat the MSA as boilerplate. That is backwards. The rate decides what a good engagement costs; the MSA decides what a bad one costs, and the gap between those two numbers is where this document earns its attention.
What follows are negotiating positions rather than benchmarks. They are what we would argue for as a buyer, not a survey of what the market does.
The twelve clauses, in four groups
Grouping them tells you who needs to read what.
Ownership: IP assignment and confidentiality. Engineering and legal both need these.
Continuity: replacement, termination for convenience, conversion to employment. Procurement should own these, and they carry the most commercial value.
Exposure: limitation of liability, indemnities, security incident notification. Legal owns these, and engineering should read the notification window.
Mechanics: audit rights, data residency, currency and FX, governing law and dispute resolution. These look administrative and determine whether everything above is enforceable.
Fair position against the usual opening offer
Provider first drafts are not dishonest. They are drafted by the provider, and these are the places that shows.
1. IP assignment
Fair: all foreground IP assigned to you on creation, with the governing law for assignment named inside the clause, and a warranty that the chain runs from the individual engineer through the provider entity to you.
Weak: assignment on final payment, no jurisdiction named, silent on the engineer’s own assignment. Assignment triggered by payment is a leverage mechanism dressed as an accounting term, because you cannot use the work until every invoice clears.
2. Replacement guarantee
Fair: a defined window from start, named triggers including the engineer resigning, a service level on how fast the replacement arrives, and credit for gap days when the seat is empty.
Weak: a short window, gross misconduct as the only trigger, no timeline on the replacement, and no gap credit. That structure leaves you paying while the seat sits empty.
3. Termination for convenience
Fair: notice-based termination after an initial commitment period, with no early termination fee beyond days worked.
Weak: long notice plus a fee tied to remaining contract value, or termination for cause only. That converts a flexible arrangement into a fixed-term lease. The legitimate provider concern is sunk vetting cost, and the right place to address it is the initial commitment period rather than a fee.
4. Conversion to employment
Fair: a named fee that reduces with service and reaches zero at an agreed point.
Weak: a fee payable whenever you hire, with no expiry. Agree this before the engagement starts, because negotiating once you have decided you want someone is the weakest position available.
Why the IP clause needs separate attention
It is the clause most often drafted to the wrong law, and the one where that failure surfaces latest.
First ownership of a work differs by country under the Berne Convention framework, so an assignment written only under your own governing law may not transfer what you expect where the engineer sits and creates the work. Name the assignment law inside the IP clause rather than inheriting it from the general provision.
Warrant the whole chain: engineer to provider entity, provider entity to you. A break anywhere leaves you holding a contract against a party who never owned the thing.
And check what the clause enumerates. Older templates list code and documentation and quietly omit prompts, evals, fine-tuned weights and agent configurations, which for some engagements are the valuable part. Our deeper treatment sits in IP assignment in IT staffing contracts.
Argue liability carve-outs, not the cap. Buyers spend most of their liability negotiation on the multiple and accept a cap that also limits confidentiality breach and IP infringement. Those are the two exposures that can exceed the value of the whole engagement. A lower cap with the right carve-outs beats a higher one without them.
5 to 8: exposure and disclosure
Limitation of liability. A cap tied to fees over a defined period is normal. What matters is the carve-outs: confidentiality breach, IP infringement and wilful misconduct belong outside it.
Indemnification. The provider should indemnify for employment law failures in the engineer’s country, since that is their obligation. You indemnify for instructions and materials you supply.
Confidentiality. Mutual, with a survival period that outlasts the engagement and a return-or-destroy obligation with a deadline attached.
Security incident notification. A fixed number of hours, triggered by discovery rather than by confirmation. “Prompt notice” is undefined and effectively means at the provider’s convenience. Where the work touches personal data, GDPR Article 28 also sets processor obligations including the conditions for engaging any sub-processor, and the NIST Cybersecurity Framework gives you third-party vocabulary both sides will recognise.
9 to 12: the mechanics that make it enforceable
Audit rights. The right to verify compliance, with reasonable notice and a defined scope. Regulated buyers cannot treat this as optional.
Data residency. Which countries data moves through, listed rather than described. Vague geography is the finding auditors return to.
Currency and FX. Which currency you pay in and who carries movement between invoice and payment. Small until a currency moves ten percent, then not small.
Governing law and dispute resolution. A seat both parties actually operate in, with a defined escalation path before arbitration. A law neither side works under adds cost to any dispute and tends to favour whoever drafted the template.
Negotiate in this order
Take the continuity clauses first. Replacement, termination and conversion carry the highest value to you and the lowest cost to a confident provider, and they get expensive once the provider knows you have chosen them.
Then ownership, then exposure, then mechanics. Leave rates until last, because that is the term both sides expect to move, and opening with it spends goodwill on an outcome you would have reached anyway.
Capturing most of this at the RFP stage is cheaper than negotiating it mid-cycle. Our IT staffing RFP template covers doing that, and the agreement template gives you a starting draft.
Where to hold and where to trade
A negotiation with no concessions does not close. Decide in advance which side of the line each item sits on.
Hold firm on IP assigned on creation with the law named, liability carve-outs for confidentiality and IP infringement, a conversion fee that expires, subcontracting disclosure across the chain, and a security notification window measured in hours.
Reasonable to trade: an initial commitment period before termination for convenience, the headline liability cap once carve-outs are agreed, notice length if the replacement service level is strong, audit frequency provided the rights themselves survive, and the rate.
What a regulated buyer has to add
In supervised sectors, several of these stop being negotiating positions and become obligations.
Audit and access rights, named data locations, a documented exit plan and explicit subcontracting conditions are required terms where the service supports a critical or important function rather than preferences you might trade away.
Decide the criticality classification before drafting rather than after. It determines which clauses you are obliged to include, and discovering it late means reopening an agreement you have already signed. Our guide to fintech staff augmentation covers what that looks like in practice.
The clause that is not in most templates
One obligation is worth adding even though standard drafts rarely include it: a warranty about who employs the engineer, and disclosure of anyone else in the chain.
Augmentation is control, and control is what classification tests examine. The IRS common-law test weighs behavioural control, financial control and the type of relationship, and the HMRC CEST tool asks the same question in UK terms. You will assign the work, set the hours and review the output, so the contract needs the provider standing behind lawful employment in the engineer’s country.
Ask for three things in writing: the named legal entity, the country of employment, and whether any part of the service is subcontracted. A provider who cannot answer those in a sentence has not thought about the arrangement you are buying.
Our guide to worker classification in cross-border IT staffing covers where the structure breaks and what the exposure looks like.
Reviewing an MSA you already signed
Most readers arrive here mid-relationship rather than pre-signature, and an existing agreement is worth a read against this list.
You cannot unilaterally reopen a signed contract, but renewal is a negotiation and most MSAs renew. Read the twelve clauses now, mark which fall short, and put those on the renewal agenda while you still have time to prepare rather than raising them in the final week.
Two clauses are worth attempting to amend mid-term because the cost of leaving them is high. A conversion fee with no expiry, since it will bite the moment you want to keep someone. And a liability cap with no carve-outs, since that exposure is uncapped in effect for the risks that matter.
Keep a one-page summary of the terms actually agreed: rates, notice, replacement window, conversion fee, governing law, IP assignment law, liability carve-outs, data terms and the employing entity. Most disputes start with somebody not knowing one of those.
MSA FAQs
Should the MSA name individual engineers?
No. The master agreement covers the relationship and the statement of work covers the engagement. What the MSA should say is that reassignment requires your consent, which is the protection people think naming engineers gives them.
How long should an MSA take to agree?
Days rather than weeks if you work in the order above and the provider has seen a regulated buyer before. Delays come from an engagement model that was never settled and from subcontracting questions the provider cannot answer without checking.
Can we use the provider’s template?
Yes, as a starting point, provided you redline the twelve clauses above. A provider template is a reasonable draft and a poor final position, and treating it as boilerplate is exactly the instinct this page argues against.
What if the provider will not move on a red line?
Ask why, and listen to the answer. Some refusals are structural, such as a provider who genuinely cannot warrant an assignment chain because they do not employ the engineer. That answer tells you more about the arrangement than the clause does.
Takeaways
- The rate decides what a good engagement costs. The MSA decides what a bad one costs.
- IP assigned on creation, with the governing law named inside the clause.
- Argue the liability carve-outs rather than the cap multiple.
- Negotiate continuity clauses first and rates last.
- A refusal you cannot explain is information about the arrangement, not just the clause.
Start from a draft that already covers these
Second Talent operates through licensed local entities across Asia, so the classification, payroll and assignment chain questions above have a straightforward answer.
Start the conversation, or read the 15 questions to ask before you sign.
