Startup Legal Basics

Foundational legal checklists for early-stage startups. This is not legal advice; use it to prepare and to work efficiently with qualified counsel.

When to Use

• Choosing an entity setup and getting incorporation done

• Ensuring founders and contractors assign IP correctly

• Building a sane contracting process (MSA/SOW, DPA, basic procurement flow)

• Privacy basics: data mapping, roles (controller/processor), and policy scope

• Legal readiness for first customers and light fundraising prep

When NOT to Use

• Jurisdiction-specific legal advice or interpretation of laws

• Complex regulated domains (health, finance, children’s privacy) without counsel

• Deep security compliance programs (SOC 2/ISO) -> qa-observability (technical controls) + dedicated compliance work

Quick Start (Inputs)

• Primary jurisdiction(s): founder location, customer location(s)

• Entity goal: bootstrapped, VC-backed, or uncertain

• Product type: SaaS, marketplace, services, hybrid

• Data: what personal data is collected, and what third parties receive it

• Selling motion: self-serve terms vs negotiated B2B contracts

Workflow

• Entity and ownership setup

• Decide: LLC vs C-Corp (or local equivalent) based on funding expectations and tax/legal advice.

• Ensure founders have signed equity and IP documents early.

• IP assignment and contractor hygiene

• Founders: assign IP to the company; confirm prior employer/IP constraints.

• Contractors: use written agreements with IP assignment + confidentiality.

• Contracting basics for selling

• Decide your default contract stack: click-through terms vs MSA/SOW.

• Add a simple “contract intake” flow to avoid random obligations.

• Privacy fundamentals (minimum viable)

• Create a data map (what you collect, why, where it goes, retention).

• Decide your roles: controller/processor where relevant.

• Ensure your policies match reality (do not claim controls you do not have).

• Fundraising readiness (light)

• Keep a basic corporate record set (cap table, key agreements, IP assignments).

• Avoid “side agreements” that complicate diligence later.

Resources

Resource Purpose

entity-and-ownership-basics.md Entity decisions, founder docs checklist

contracting-basics.md Contract intake, common clauses, red flags

privacy-basics.md Data map, privacy roles, policy scope

ip-protection-guide.md IP types, assignment, open source licensing, trademark and patent strategy

employment-law-basics.md Worker classification, employment docs, non-competes, international hiring

terms-of-service-guide.md TOS drafting, SLA design, DPA requirements, cookie consent, enforceability

equity-agreements-guide.md Founder equity splits, vesting schedules, 83(b) elections, advisor agreements

Templates

Template Purpose

incorporation-checklist.md Incorporation and founder docs checklist

ip-assignment-checklist.md Founder/contractor IP assignment checklist

contract-intake-checklist.md Intake questions and review flow

data-map-template.md Data map starter

Data

File Purpose

sources.json Legal readiness references

Common Mistakes

Mistake Consequence Prevention

Verbal equity promises Legal disputes, cap table chaos Written agreements only

Missing 83(b) election 6-figure tax liability on illiquid stock File within 30 days, calendar immediately

No contractor IP assignment Company doesn't own code/content Agreement signed before work starts

Policy/practice mismatch Regulatory liability, failed audits Data map validates privacy policy claims

Side deals with advisors Due diligence failure, cap table mess Everything documented in cap table

Unlimited liability accepted Existential risk from customer contract Cap at 12-24mo fees paid

Cookie banner doesn't block GDPR violation Test that cookies actually wait for consent

No DPA with vendors GDPR violation when processing EU data DPA with every vendor handling PII

What Good Looks Like

• Every contributor who writes code/content has signed a valid IP assignment to the company.

• You have a repeatable contract intake process and a default position on key terms.

• You know what data you collect and can explain it consistently across product, contracts, and policies.

• Your cap table is clean and matches all signed agreements.

• You can respond to a GDPR rights request within 30 days.