[ ] Breach-notification window — in hours, not "promptly"
[ ] Security commitments — MFA, encryption at rest / in transit
[ ] Sub-processor disclosure + flow-down terms
[ ] Data location
[ ] Return / deletion on exit
[ ] Audit / attestation rights — SOC 2 report on request?
[ ] Liability cap vs. data-breach carve-out
⚖️ You're not lawyering — you're locating and summarizing. Write each finding as one register line ("72h — MSA §9.2"). Anything missing or alarming goes to actual counsel.