When you sign up for Evolve, you sign Evolution Global's Master Service Agreement (MSA), which incorporates a Data Processing Agreement (DPA) and references the published Acceptable Use Policy and Privacy Policy. The full set is published on the website — there is no separate enterprise MSA you have to negotiate to find out what you're agreeing to. Key terms in plain English: monthly or annual SaaS subscription at the published tier you select; auto-renewal at 12 months; 90-day cancellation notice; two-bill structure (subscription up front, usage in arrears); add-ons activated separately at published rates; standard limits of liability and warranty; customer owns the data they put in; Evolution Global is data processor for that data; Zero Data Retention agreements active across the AI providers.

What's in the standard MSA

The Master Service Agreement covers the commercial relationship:

Subscription terms — the tier you signed up for, the billing cadence (monthly or annual), the renewal mechanics. Auto-renews at the 12-month anniversary.
Cancellation — 90-day notice, no multi-year lock-in. The notice can be given on day one of your subscription if you want to use it as your evaluation window.
Pricing — the published tier rates, the integration setup and per-claim fees, the active-user fee, the document storage overage, the additional Evolve system fee, the customization rates by support tier. All match what's on the published Pricing page.
Two-bill structure — subscription bill on the 1st of each month for the current month, paid in advance. Usage bill issued separately for the prior month's actual activity.
Payment — Stripe. Credit card, ACH, and other Stripe-supported electronic payment methods. Recurring billing.
Data ownership — the customer owns the claim data, fee schedules, contacts, configurations, and user records they put into Evolve. Evolution Global has license to process it for the purpose of providing the service.
Warranties and limitations — standard SaaS commercial warranties; limitations of liability scoped to fees paid in the preceding 12 months for most claim types.
Confidentiality — mutual NDA-equivalent terms covering customer data and business information.

What's in the Data Processing Agreement (DPA)

The DPA governs how Evolution Global handles personal information under data-protection law:

Roles — defines Evolution Global as data processor for customer data and data controller for limited categories (account information, billing).
Subprocessors — names every subprocessor by category (AI providers Anthropic, OpenAI, Google; cloud and identity AWS and AWS Cognito; payments Stripe; community Mighty Networks; continuous monitoring Drata; service work Xogito).
Data subject rights — how Evolution Global handles GDPR / CCPA / CPRA / VCDPA / TDPSA requests routed through the customer.
Cross-border transfers — Standard Contractual Clauses where required.
Data retention — claim data retained per the contractual period; billing records 7 years; ELIAS AI conversation data subscription term + 3 years (and not retained by AI providers under Zero Data Retention).
Breach notification — incident-response timeline and notification obligations.
Audit — customer's audit rights under enumerated conditions.

What the Acceptable Use Policy adds

The AUP is the do-not-misuse policy — no fraudulent claims data, no security violations, no prohibited content. It's the standard set you'd see in any SaaS AUP, and it's published on the website.

What 10% revenue pledge means in the contract

Evolution Global's structural commitment to fund the Ark Alliance Foundation with 10% of revenue in perpetuity is referenced in the MSA as a corporate disclosure, not a customer-facing fee. It does not increase what the customer pays. It documents the pre-existing commitment so customers understand the Foundation is structurally funded — relevant context for the AI governance and Certified Integrity Standard provisions.

What you do not have to negotiate

A few things are baked into the published terms and are the same for every customer:

The published tier rates.
The 90-day cancellation notice.
The two-bill structure.
The Zero Data Retention commitment with AI providers.
The audit logging and CIS validation provisions.

Custom MSA terms for enterprise customers (BAAs for HIPAA-covered scenarios, custom DPA addenda, specific compliance commitments beyond the published baseline) are handled with the compliance team during the demo conversation.

Where to read the actual document

The MSA, DPA, AUP, and Privacy Policy are public on the website. The brand commitment is the same posture as on pricing — every term a prospect needs to make an informed decision is published, no separate enterprise version, no information asymmetry to navigate around.

What does the contract actually say — what am I agreeing to?