What Should a Vendor Agreement Include for a Small Business?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

A vendor agreement is the written deal with a business that sells you products or services. It should state what they deliver, the price, how and when you pay, delivery or service standards, who is responsible for what, who owns the work and accounts, and how either side can end the deal. Read the vendor’s terms before you sign, and get changes in writing.

What this means

Vendors include suppliers (materials, inventory, equipment), service providers (marketing, IT, cleaning, bookkeeping), and software (scheduling, payments, customer records). Many use their own standard terms. Your job is to read them and get the key points in writing.

A good vendor agreement covers:

What’s delivered: products, quantities, services, and standards
Price and changes: how and when the price can go up
Payment: due dates, deposits, and late fees
Delivery or service levels: timing, response times, and what happens when they miss
Responsibilities: what they do, what you do
Ownership: who owns the work product, data, accounts, and logins (see 6.2.7 Intellectual-Property Ownership)
Insurance: what coverage they carry (see 11.2.6 Insurance Certificates from Vendors)
Data handling if they touch customer information (see 11.2.7 Data-Processing Terms)
Term, renewal, and ending the deal (see 11.2.8 Termination Terms)

Made-up example: Pinecrest Plumbing hires a marketing agency. Before signing, the owner adds three lines: Pinecrest owns its domain, website content, and GBP; Pinecrest stays the primary owner of the GBP, with the agency added as a manager; and on termination, the agency hands over all logins and files within 10 days.

Why it matters

Auto-renewals add up. Many vendor terms renew for a year unless you cancel in a short window.
Account ownership is the big trap. If an agency creates your GBP, domain, or ad account under its own login, you may not control it when you leave (see 14.3.8 Profile Ownership and 13.1.2 Registrar Ownership).
Missed deliveries cost you jobs. Without service levels in writing, you have little to point to.
Vendors with your customer data are your responsibility. The Federal Trade Commission (FTC) tells businesses to check how service providers will protect data before handing it over and to put security expectations in the contract.

Who this applies to

Every business that depends on outside suppliers or providers. For small, one-time purchases, a receipt is enough. For anything ongoing, anything that touches customer data, or anything that controls your online accounts, get written terms.

How to do it

List your vendors in a vendor log: what they provide, cost, contract dates, renewal dates, and who owns the account.
Read the vendor’s standard terms before you sign. Look for auto-renewal, price increases, ownership, and cancellation.
Ask for changes in writing when terms don’t fit. Many vendors will agree to reasonable edits, especially on ownership and cancellation.
Keep accounts in your business’s name. For GBP, keep yourself as the primary owner and add vendors as managers. Google’s help pages explain that owners can add and remove users, while managers can’t.
Get an insurance certificate from vendors who work on site or handle risky tasks.
Add data terms if the vendor stores or sees customer information.
Set a calendar reminder before each renewal date.
Review the vendor once a year: price, service, and whether you still need them.

What proof to keep

The signed agreement or accepted terms, with the date and version
Written changes and emails confirming them
The vendor log with renewal dates
Insurance certificates
A list of accounts the vendor can access, and who owns each one (see 11.7.5 Access Inventory)

Common mistakes

Clicking “I agree” without reading.
Letting a vendor set up your accounts under its own email. Use a business-owned email and stay the owner.
Missing the cancellation window on an auto-renewal.
No written service levels, so late or poor work has no consequence.
Assuming you own the website or content a vendor built. Check the agreement.
One vendor, no backup. If a key supplier fails, you have nowhere to go.

When to get help from a pro

Attorney: for large, long-term, or high-risk vendor deals, and anything involving ownership of your work or accounts. Questions to ask:

Who owns the work product and accounts under this agreement?
What happens if the vendor misses deadlines or goes out of business?
Can I get out early, and what does it cost?

Bill’s note

[Bill: add a short note. For example, a business owner who lost access to their Google Business Profile or domain when they left an agency, and what the contract should have said.]

If you’d rather have this done for you, SiteSmarty handles Google Business Profile management with you kept as the owner.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: building the SiteSmarty vendor log and checking ownership terms]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the vendor log with renewal dates]
[Result so far:]

Questions people ask

Do I need a written contract with every supplier? For ongoing suppliers and anyone who touches your accounts or customer data, yes. For small one-time purchases, a receipt is usually enough.

Who owns my website if an agency builds it? Whoever the agreement says. Get it in writing that your business owns the domain, content, and accounts.

Should my agency be the owner of my Google Business Profile? No. Keep your business as the primary owner and add the agency as a manager.

How do I avoid surprise renewals? Track every renewal date and cancellation window in a vendor log with calendar reminders.

Audit check

Question: Does every ongoing vendor have written terms covering delivery, price, payment, ownership, insurance, data, and termination?
Pass looks like: Signed or saved terms for each vendor, a vendor log with renewal dates, and all key accounts owned by the business.
Fail looks like: No written terms, surprise renewals, or a vendor that owns your GBP, domain, or website.
Evidence to collect: Vendor agreements, the vendor log, GBP user list showing the business as primary owner, and domain registrar account details.

Where this fits

Do this first: 10.6.3 Vendor Approval and Bank-Change Verification

Do this next: 11.2.2 Independent-Contractor Agreement

Sources

Federal Trade Commission, "Stick with Security: Make sure your service providers implement reasonable security measures" (checked October 17, 2026)
Google Business Profile Help, "Manage your Business Profile owners and managers" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.