Document structure
Ancillary agreements: NDA, DPA, SLA
Non-disclosure agreements, data processing agreements, service level agreements, and similar documents carry obligations but no commercial commitment. They belong on the vendor record because they describe what you and the vendor owe each other, and they must be excluded from spend totals because they commit nothing.
The Vendor Squeezer team. Last reviewed 2026-08-08. General guidance on contract structures, not legal advice, and not a statement about any particular vendor's terms.
What each one is for
These documents answer questions that the commercial paperwork does not, and they are frequently the ones someone needs urgently and cannot find.
| Document | What it governs | When it is needed |
|---|---|---|
| Non-disclosure agreement | What each side may do with the other's information | Often before any purchase |
| Data processing agreement | How the vendor handles personal data on your behalf | Any vendor touching personal data |
| Service level agreement | Availability, response times, and any credits | When service quality is disputed |
| Security addendum | Security controls the vendor commits to | Reviews, audits, incidents |
| Business associate agreement | Handling of protected health information | Regulated healthcare contexts |
Why they belong on the record anyway
An NDA signed early in a relationship often has its own term and can outlive the commercial arrangement. A data processing agreement is the document someone will ask for during a security review or an incident. A service level agreement is what you cite when a service has been unavailable and you want to know whether that entitles you to anything.
None of those are findable when they are treated as paperwork rather than as part of the vendor record, which is usually the moment they are needed most.
Keeping them out of the money
The rule is simple and worth stating explicitly: a document with no commercial terms contributes nothing to a spend total. Including it inflates the count of contracts and, where a value has been guessed to make a field non-empty, inflates the money too.
Questions to ask about your own agreement
- 1.Do we hold a data processing agreement for every vendor that handles personal data?
- 2.Does the NDA have its own term, and does it survive the commercial agreement?
- 3.Does the service level agreement provide credits, and has anyone ever claimed them?
- 4.Are these documents attached to the vendor record or filed separately?
- 5.Is any ancillary document being counted in a spend total?
Common questions
Should an NDA be recorded as a contract?
As a document on the vendor record, yes. As a line of spend, no. The distinction is between what obliges you and what costs you, and a register should carry both without mixing them.
Does a service level agreement guarantee uptime?
It states a target and usually a remedy, which is typically a service credit rather than compensation. What it actually provides is specific to the document, so the useful step is reading what remedy your own agreement offers.
Put this against your own vendors
Record the term, the notice deadline, and the exit cost against the vendor once, and the next renewal review starts from an answer instead of a search. Free while in early access.