# Cloud service agreement review
> Source: https://legalcode.md/skills/legalcode-cloud-service-agreement-review | [HTML version](https://legalcode.md/skills/legalcode-cloud-service-agreement-review)

Review cloud and hosted-service agreements (CSA, cloud MSA, SaaS agreement, cloud subscription agreement, cloud order form) — flag deviations, generate confidence-scored redlines, and produce an auditable analysis.

Review cloud and hosted-service agreements (CSA, cloud MSA, SaaS agreement, cloud subscription agreement, cloud order form) — flag deviations, generate confidence-scored redlines, and produce an auditable analysis. Covers service description and scope, SLAs and uptime credits, security commitments, data processing (GDPR Art. 28 / DPA overlay), sub-processors, audit rights, customer data ownership, provider AI training rights, limitation of liability (including data breach super-caps), indemnification, business continuity and DR, exit assistance and data portability (EU Data Act 2023), regulatory compliance allocation (DORA, HIPAA BAA, PCI DSS, FedRAMP), unilateral modification rights, and term and termination. Jurisdiction-agnostic with [JURISDICTION-SPECIFIC] markers. Native Legalcode replacement for imported cloud-service agreement packs. Use when reviewing cloud provider terms, AWS/Azure/GCP order forms, SaaS enterprise agreements, managed-hosting contracts, IaaS/PaaS/SaaS agreements, or any contract where a customer is consuming computing, storage, or software as a service.

This skill reviews cloud service agreements (CSAs), SaaS enterprise agreements, cloud MSAs, and related hosted-service contracts against an organization's negotiation playbook or general market standards. It identifies deviations, classifies their severity, generates actionable redline suggestions, and produces a confidence-scored, auditable analysis calibrated to the specific risks of cloud and hosted-service procurement. **Covers:** - Clause-by-clause analysis across 16 CSA-specific categories plus 6 standard categories - Deviation classification (GREEN / YELLOW / RED) adapted to cloud procurement risk - SLA uptime credit mechanics and carveout analysis - GDPR Art. 28 / DPA overlay and sub-processor flow-down assessment - Data breach liability structure and super-cap negotiation - EU Data Act Chapter VI (Arts. 23–26) exit and switching compliance (applicable from 12 September 2025) - DORA (Reg. 2022/2554) mandatory contract term compliance for financial sector customers - Provider AI training use of customer data — rights, restrictions, and safeguards - Business continuity, DR, and resilience commitment analysis - Redline generation with fallback positions - Multi-stakeholder mapping including data subjects, regulators, and sub-processors - Glass Box audit trail **Does not:** - Draft new cloud agreements (see legalcode-technology-license-agreement for drafting) - Replace qualified legal counsel or provide legal advice - Apply exclusively to one jurisdiction — ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*