The Startup Contract Playbook: Founders, ESOPs, Investors, Customers and Vendors, and What Shows Up in the Data Room
The documents an Indian startup signs in its first three years, the law behind each, and the ones that cause trouble at the Series A data room. A playbook from founders' agreement to vendor contracts, with the post-signature obligations a small team can actually track.
Startups sign a lot of paper with no one owning it. By the time an investor's counsel asks for the signed founders' agreement, the ESOP grant letters, every customer contract with a termination-for-convenience clause and every vendor that processes user data, the answers are in six inboxes. This playbook lists the document stack in order, the Indian law behind each, and how to keep the record investor-ready. Position as of October 2026.
Stage 1: Formation
Founders' agreement. Equity split, vesting (typically four years with a one-year cliff), roles, IP assignment to the company, decision-making, exit and deadlock. Two Indian points: a post-exit non-compete on a founder is at risk under section 27 of the Indian Contract Act, 1872 unless it fits the sale-of-goodwill exception; and IP created before incorporation must be assigned in writing to the company (an "all IP belongs to the company" sentence without an assignment is not enough).
Shareholders' agreement and articles. Rights in the SHA bind the parties; to bind the company and later shareholders they should be reflected in the articles of association under the Companies Act, 2013.
Stage 2: Team
Employment contracts (see the employment-contract guide in this series): notice, confidentiality, IP assignment, no post-term non-compete, employee-data clause for DPDP.
ESOP scheme and grant letters. Under section 62(1)(b) of the Companies Act, 2013 and rule 12 of the Companies (Share Capital and Debentures) Rules, 2014, an employee stock option scheme requires a special resolution and compliance with the rule's conditions (minimum one-year vesting, disclosures, register of options). Each grant letter is a contract: grant date, number, exercise price, vesting schedule, exercise period after exit, and treatment on termination. Track vesting dates and exercise windows as obligations; missed exercise windows are a recurring source of disputes.
Contractor agreements for genuinely independent providers, with GST and TDS terms and the 45-day payment cap where the contractor is a micro or small enterprise (section 15, MSMED Act, 2006).
Stage 3: Capital
Investment documents. Term sheet, share subscription agreement, SHA, and the instruments (equity, compulsorily convertible preference shares or debentures). Since the Finance (No. 2) Act, 2024, section 56(2)(viib) of the Income-tax Act, 1961 (the "angel tax" on share premium above fair value) does not apply to shares issued on or after 1 April 2025, for all classes of investors. Valuation reports remain relevant for other purposes (FEMA pricing for foreign investors, section 56(2)(x) for the investor).
Obligations that follow: investor information rights (monthly or quarterly reporting dates), board composition, reserved matters requiring investor consent, anti-dilution and pre-emption mechanics on the next round, and ESOP pool top-ups. These are dated or triggered duties that belong in a register, not in the SHA PDF.
Stage 4: Revenue
Customer agreements. SaaS terms (clickwrap for self-serve, signed MSA for enterprise), with separate data consent under section 6(1) of the DPDP Act, 2023 and processor terms where you process customers' user data (section 8(2)). Tag termination-for-convenience, liability caps, exclusivity and auto-renewal at signature; these are the first things a Series A data room asks about.
Marketplace and partner agreements. If you sell through a marketplace, the Consumer Protection (E-Commerce) Rules, 2020 require a prior written contract between seller and platform and the display of seller information.
Stage 5: Vendors and infrastructure
Cloud, payments, analytics, HR and support vendors that process personal data are Data Processors; a "valid contract" with security provisions is required (section 8(2); rule 6 of the DPDP Rules, 2025) by 13 May 2027. Hosting location, breach-notification window and erasure on exit are the three clauses to check in every vendor's standard terms.
The data-room test
Before a funding round, the company should be able to produce, from one system, within a day:
| Request | What you need |
|---|---|
| Signed founders' agreement and IP assignments | Executed, stamped, with audit trail |
| ESOP scheme, resolutions, every grant letter, vesting schedule | Grant register reconciled to the cap table |
| All customer contracts with change-of-control, termination-for-convenience, exclusivity or liability deviations | Clause tags on every contract |
| All vendors processing personal data, with DPA status | Processor flag and DPA on file |
| All contracts expiring in the next 12 months | Renewal register |
| Any contract with a post-term non-compete | Should be none |
Keeping it investor-ready with a two-person team
- One template per document type, approved once.
- Every contract through one intake and e-signature flow, stamped where chargeable.
- Five clause tags at signature: change of control, termination for convenience, exclusivity, liability deviation, personal-data processing.
- A register with renewal, vesting, reporting and payment dates.
- A quarterly 30-minute review of the register.
Where Legatio fits. Legatio gives a startup the templates, the signature flow, the clause tags and the register from day one, so the data-room test is a report rather than a scramble. The legal structure of the documents is for your counsel.
Position stated as of October 2026. General information; investment documents should be prepared with counsel.