Legal Document Analysis Expert

Legal Review: Master Subscription and Services Agreement (Nimbus Cloud Solutions, LLC and Brightleaf Analytics, Inc.)

This is general information, not legal advice. Have an attorney licensed in Delaware review it before you sign or negotiate.

Executive Summary

Overall risk rating: HIGH. Almost every major term favors the Provider. As written, I wouldn't recommend signing this without significant changes.

• You would own nothing you build, and your data has no protection. §4.2 hands every dashboard, report and configuration your team creates to Nimbus "upon creation." The agreement never says who owns your data, and it has no security, privacy or data-export obligations at all.
• Your risk has no limit, and Nimbus's is close to zero. You would cover Nimbus for any claim tied to your use of the platform "regardless of the degree of fault attributable to Provider," with no cap (§6, §7.3). Nimbus's total liability is limited to one month of fees paid (§7.1). Because you pay once a year, that could be $0 most of the year. Lost data is also excluded (§7.2), which is the main risk with a data analytics platform.
• There's no promise the service will work. §8 offers only "commercially reasonable efforts." The uptime and support terms are left to a future document that doesn't exist yet and may not be binding.
• You're committed to at least $372,000 with no way out. There are 24 months at $186,000 a year, all non-refundable "for any reason" (§3.3), and you can't terminate for convenience. Renewals can go up 15% a year at Nimbus's "sole discretion" (§2.2). The late-payment interest term (§3.2) sets a minimum rate but no maximum.
• Exhibit A (the Order Form) was not provided. I can't check the scope of services, user limits, usage fees or whether it adds or overrides any of these terms.

1. Document Overview

2. Key Provisions

Rights and obligations

• Provider: Provides the platform and support (§1). Makes "commercially reasonable efforts" to keep it available (§8). Keeps all platform IP and takes ownership of what you create (§4). Must protect your confidential information with "reasonable care" for 3 years (§5).
• Customer: Pays fees (§3). Indemnifies Nimbus broadly (§6). Stops all use as soon as the agreement ends (§9.3). Assigns its work product to Nimbus (§4.2).

Financial terms

Term, renewal and termination

• 24-month initial term, then automatic 12-month renewals unless either side gives notice at least 90 days before the term ends. For the initial term, that deadline falls around July 2, 2028 (confirm the exact date).
• Nimbus can terminate immediately if an undisputed amount goes unpaid for 15 days after a "payment reminder" (§9.1).
• You can terminate only for an uncured material breach, and only after a 60-day notice and cure period (§9.2).
• After termination, Nimbus "may" delete your data after 30 days (§9.3).

Performance standards and acceptance: None. There's no uptime percentage, response times, service credits, warranty or acceptance testing.

3. Risk Assessment (Customer's Perspective)

CRITICAL

C1. Nimbus takes ownership of your work product (§4.2)

"Any custom reports, dashboards, or configurations created by Customer within the Platform shall be deemed 'Work Product' and are hereby assigned to Provider upon creation."

• This is an assignment in the present tense ("are hereby assigned"), so ownership moves the moment the work is created.
• Your dashboards often contain your business logic, analytical methods and possibly client-confidential material. Nimbus could reuse them, sell them as templates, or refuse to let you export them.
• §4.1 adds to the problem. Nimbus owns any improvements "developed based on Customer feedback, data, or specifications," with no carve-out for your underlying data or confidential information.
• Nothing in the agreement says you own your data. Given how broad §4 is, that silence is dangerous.

C2. Unlimited indemnity that covers Nimbus's own fault (§6 + §7.3)

"...arising out of or related to Customer's use of the Services, Customer's data, or Customer's breach... regardless of the degree of fault attributable to Provider."

• Nearly any claim "related to" your use of the platform triggers it. If Nimbus's own security failure causes a breach, you could end up paying for it.
• Delaware courts read indemnity clauses strictly and enforce indemnity for the indemnitee's own negligence only when the language is "clear and unequivocal" and shows the parties specifically considered it (Watt Tieder 50-State Survey – Delaware; Egan, Express Negligence Doctrine). The phrase "regardless of the degree of fault attributable to Provider" is very likely drafted to meet that test. Assume it would be enforced.
• Delaware's anti-indemnity statute (6 Del. C. § 2704) applies only to construction contracts, so it doesn't help here.
• §7.3 takes this indemnity out of any cap, so your exposure has no limit.
• Missing: Nimbus gives no indemnity back to you, not even the standard one for third-party claims that the platform infringes someone's IP.

C3. Nimbus's liability cap is close to zero and excludes lost data (§7.1, §7.2)

"...SHALL NOT EXCEED THE FEES PAID BY CUSTOMER IN THE ONE (1) MONTH PRECEDING THE CLAIM."

• Ambiguity: you pay once a year. In the 11 months when you made no payment, the cap is arguably $0. In the month you paid, it's arguably $186,000. Even the most generous reading (1/12 of the annual fee) is about $15,500.
• §7.2 excludes "LOST DATA" entirely, even though protecting data is the core of what a data platform does.
• There are no carve-outs for confidentiality breaches, data breaches or security failures, gross negligence, or willful misconduct.
• The cap and exclusions protect only Nimbus. Nothing limits your liability to Nimbus.
• Delaware generally enforces liability limits between sophisticated businesses. As a general rule, Delaware public policy doesn't let a party contract away liability for its own intentional fraud, but you shouldn't rely on that as protection.

C4. No service levels or warranties (§8)

"Specific uptime commitments, response times, and support escalation procedures will be addressed in a separate service level document to be mutually agreed upon."

• This is an "agreement to agree." Courts generally won't enforce one where essential terms are left open. In practice, you'd have no enforceable uptime commitment.
• The entire-agreement clause (§11.1) covers only "this Agreement, together with Exhibit A." A later SLA might be treated as outside the contract unless it's signed as a formal amendment.
• "Commercially reasonable efforts" isn't defined.
• Missing: any warranty that the platform will perform as described, and any warranty against malware.

C5. No data protection, security or exit rights (§9.3; missing terms)

"Provider may delete Customer's data thirty (30) days after termination."

• Nimbus has no duty to return or export your data, and you're barred from using the platform "immediately," so you may not be able to get your own data back.
• "May delete" also means Nimbus doesn't have to delete it. It could keep your data indefinitely.
• Missing entirely: security standards (e.g., SOC 2 or ISO 27001), breach notification, a data processing agreement, rules on subprocessors, data location, and a promise not to use your data for training, benchmarking or resale. If Brightleaf handles personal data (including Texas residents' data under the Texas Data Privacy and Security Act, or clients' regulated data), you'd have no contractual way to meet your own compliance obligations.

IMPORTANT

I1. Late interest has a floor but no ceiling (§3.2)

"2.0% per month or the maximum rate permitted by law, whichever is greater."

• The logic is backwards. "Whichever is greater" makes the legal maximum a minimum. It should say "whichever is less."
• Delaware law bars corporations from raising usury as a defense in any action (6 Del. C. § 2306, Justia; LegalClarity overview). As a Delaware corporation, Brightleaf probably couldn't use usury law to reduce this rate.

I2. All fees are non-refundable, even when Nimbus is at fault (§3.3)

"All fees are non-refundable, including in the event of early termination by Customer for any reason."

• "For any reason" arguably includes you terminating because Nimbus breached the contract under §9.2. You'd pay for service you never got.

I3. Renewal price increase at Nimbus's "sole discretion" (§2.2)

• Nothing requires Nimbus to tell you about an increase before your 90-day non-renewal deadline. It could announce 15% more after you've lost the chance to leave.
• Delaware's implied covenant of good faith might limit truly arbitrary use of that discretion, but it's a weak and uncertain protection.
• Delaware's automatic-renewal rules are aimed mainly at consumer contracts and are unlikely to protect a business-to-business deal like this one (have Delaware counsel confirm).

I4. Termination rights are lopsided (§9.1, §9.2)

• Nimbus has 15 days and can terminate immediately. You have to wait 60 days.
• A "payment reminder" isn't defined (email? a portal notice?), and there's no process for disputing an invoice, so the "undisputed" protection is hollow.
• There's no right to suspend service with advance notice, no termination for convenience, and no right to terminate if Nimbus becomes insolvent, suffers a data breach, or has chronic outages.

I5. Nimbus can assign the contract without your consent (§11.2)

• Nimbus could transfer the contract, and your data, to a buyer that competes with you or has weaker security, and you'd have no exit.
• The agreement says nothing about whether you can assign it, which could cause friction if Brightleaf itself is acquired.

I6. Confidentiality is too thin (§5)

"Each party agrees to protect the other's Confidential Information using reasonable care, for a period of three (3) years following disclosure."

• "Confidential Information" isn't defined, and there are no standard exclusions, no limits on use, no return-or-destroy obligation, and no longer protection for trade secrets.
• Three years is short for trade secrets and for data stored on the platform over time.

MINOR

• M1. Force majeure (§11.3): Covered events aren't listed, there's no duty to mitigate, and there's no right to terminate if an event drags on. Nimbus could label an outage "force majeure," and you'd still owe fees under §3.3.
• M2. Exclusive venue in New Castle County, Delaware (§10): Reasonable for two Delaware entities, but it means litigating away from your Austin office. Consider asking for a jury-trial waiver or an escalation step before litigation.
• M3. Missing standard boilerplate: There's no notices clause (which matters for the 90-day non-renewal deadline), amendment clause, order of precedence between the agreement and Exhibit A, severability, waiver, survival, insurance, or signature blocks.
• M4. "Services" depends on Exhibit A (§1): It wasn't provided, so I can't assess the scope of services, user or usage limits, overage fees, or whether any additional terms are incorporated.

4. Recommendations

Negotiation priorities (ranked by importance and likelihood of success)

Proposed contract changes

§4.2: replace with:

"As between the parties, Customer owns all right, title, and interest in and to (a) all data, content, and materials submitted by or on behalf of Customer to the Platform ('Customer Data'), and (b) all reports, dashboards, configurations, and outputs created by or for Customer using the Platform ('Customer Work Product'). Provider shall not use Customer Data or Customer Work Product except as necessary to provide the Services to Customer, and shall not use Customer Data to train, benchmark, or improve any product or service offered to third parties without Customer's prior written consent."

§4.1: add at the end:

"...provided that nothing in this Section 4.1 grants Provider any right in Customer Data, Customer Work Product, or Customer Confidential Information."

§6: replace with mutual indemnity:

"6.1 Provider shall defend, indemnify, and hold harmless Customer from third-party claims (a) alleging that the Platform or Services infringe or misappropriate any intellectual property right, (b) arising from Provider's breach of Sections 5 (Confidentiality) or [Data Security], or (c) arising from Provider's gross negligence or willful misconduct. 6.2 Customer shall defend, indemnify, and hold harmless Provider from third-party claims arising from Customer Data that infringes a third party's rights or Customer's use of the Services in violation of this Agreement, except to the extent caused by Provider's negligence, willful misconduct, or breach of this Agreement."

§7.1 / §7.3: replace with:

"7.1 EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL LIABILITY SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. 7.2 [Keep the mutual exclusion of indirect damages, but delete 'LOST DATA' and make it apply to both parties.] 7.3 'Excluded Claims' means (a) a party's indemnification obligations; (b) breach of Section 5 or [Data Security], which shall be subject to a separate cap of [three (3) times] the annual fees; (c) gross negligence, fraud, or willful misconduct; and (d) Customer's obligation to pay undisputed fees."

§8: replace:

"Provider shall make the Platform available at least 99.9% of the time each calendar month, measured and remedied as set forth in the Service Level Agreement attached as Exhibit B and incorporated herein. If Provider fails to meet the availability commitment in any three (3) months within a rolling twelve (12) month period, Customer may terminate this Agreement upon written notice and receive a pro-rata refund of prepaid fees."

Add a warranty: "Provider warrants that the Services will perform materially in accordance with the Documentation and that Provider will not introduce malicious code."

§3.2: replace:

"...interest at the lesser of 1.0% per month or the maximum rate permitted by law, only on undisputed amounts that remain unpaid thirty (30) days after written notice of non-payment."

§3.3: replace:

"Fees are non-refundable except that, upon termination by Customer under Section 9.2 or [SLA termination right], Provider shall refund all prepaid fees attributable to the period following the effective date of termination."

§2.2: replace the last sentence with:

"Provider may increase fees for any Renewal Term by no more than the lesser of five percent (5%) or the percentage increase in CPI-U over the prior twelve months, provided Provider gives Customer written notice of such increase at least one hundred twenty (120) days before the end of the then-current term."

§9.1: replace:

"...if Customer fails to pay any undisputed amount within thirty (30) days after receiving written notice of non-payment sent in accordance with Section [Notices]."

§9.2: change "sixty (60) days" to "thirty (30) days." Also add a right to terminate immediately if Nimbus becomes insolvent or has a security breach affecting Customer Data.

§9.3: replace:

"For sixty (60) days following termination, Provider shall make Customer Data and Customer Work Product available for export in a standard, machine-readable format at no additional charge. Thereafter, Provider shall delete all Customer Data and certify such deletion in writing within fifteen (15) days of Customer's request."

§11.2: replace:

"Neither party may assign this Agreement without the other's prior written consent, except to a successor in a merger, acquisition, or sale of substantially all assets, provided the assignee assumes all obligations in writing. If Provider assigns to a competitor of Customer, Customer may terminate upon written notice and receive a pro-rata refund of prepaid fees."

§5: Add a definition of "Confidential Information" with standard exclusions, limits on use, return or destruction at the end of the agreement, a 5-year protection period, and protection for as long as the information remains a trade secret (including Customer Data).

New sections to add: Data Security (with a named standard such as SOC 2 Type II, breach notice within 48–72 hours, and a DPA as an exhibit), Notices, Order of Precedence, Insurance (cyber and E&O coverage, with limits), Survival, Severability, and Amendment (signed writing only).

Practical steps to reduce your exposure

1. Don't let the October 1 date force a signature. If Nimbus won't move, push the Effective Date back, or sign only a short pilot on better terms.
2. Get Exhibit A and the SLA now and review them before signing. Confirm there are no extra terms, links to online policies, or usage fees.
3. Put the non-renewal deadline on the calendar (about 90 days before September 30, 2028), with reminders at 150 and 120 days.
4. Limit what you put on the platform until data terms are fixed. Avoid uploading client-confidential or personal data, and keep your analytics logic documented outside the platform.
5. Export your data regularly during the term so you don't depend on the 30-day window after termination.
6. Check your insurance. Confirm whether your cyber and general liability policies would cover the §6 indemnity. Many policies exclude liability you take on by contract.
7. Ask for Nimbus's security documentation (a SOC 2 report or penetration test summary) and its certificate of insurance.
8. Use the two-year commitment as leverage. Offer to keep the multi-year term, or pay annually in advance, in exchange for the changes on ownership, liability and the SLA.

Limitations: I only reviewed the text you provided. Exhibit A, any SLA, and any online terms incorporated by reference weren't available. This is general information, not legal advice. Before you negotiate or sign, have an attorney licensed in Delaware review it, ideally one with SaaS and data-privacy experience, and have them check whether Texas or other privacy laws apply to your data.

Sources

• 6 Del. C. § 2306 – Defense of usury as available to certain entities (Justia)
• Delaware Usury Laws: Interest Caps, Exemptions & Penalties (LegalClarity)
• Watt Tieder 50-State Survey – Delaware (indemnity and 6 Del. C. § 2704)
• Byron Egan, Indemnification in M&A Transactions for Strict Liability or Indemnitee's Own Negligence (Jackson Walker)