Solanasis — Client Legal Documents

Document Set

#	Document	Purpose	When to Use
01	Mutual NDA	Protect confidential information before substantive discussions	Before first real conversation about client infrastructure
02	ORB Engagement Agreement	Full engagement terms — scope, fees, liability, IP, everything	Before starting the Resilience Checkup
03	Change Order Template	Modify scope, fees, or timeline of an active engagement	During engagement if complexity uplifts or scope changes arise
04	Friendly Services Hold Harmless	Indemnification for informal, goodwill tech work (friends, favors)	Before doing any informal IT/tech work — e.g., setting up OpenCLAW, configuring systems

NDA first — Share and sign before discussing any client infrastructure details
Engagement Agreement — Sign when the client is ready to proceed. Collect 50% upfront payment.
Change Orders — Only if needed during the engagement (e.g., Day 2 complexity discovery)

Fill in all [bracketed] fields before sending to a client
Replace [ADDRESS PLACEHOLDER] with Solanasis’s registered business address once available
These documents are designed for e-signature platforms (DocuSign, PandaDoc, HelloSign, etc.)
Get attorney review before first use — these are well-researched templates but have not been reviewed by licensed counsel
Colorado law governs all documents
Reference the ORB Pack (playbooks/solanasis_orb_pack_v2/) for the Access Checklist and Intake Form mentioned as exhibits
The Engagement Agreement (02) supersedes the older SOW template in the ORB Pack (14_SOW_Template.md). Use the Engagement Agreement for all new client engagements — it includes the SOW scope plus full legal protections (liability cap, IP, dispute resolution, insurance, etc.) that the older template lacked

Combined engagement agreement (not separate MSA + SOW) for speed and SMB-friendliness
Dual-layer plain language — each section has a “In plain terms” summary + precise legal terms
Colorado-specific: no non-compete clauses, Colorado Privacy Act awareness, Boulder County venue
Cybersecurity-specific: active breach discovery protocol, no-guarantee disclaimer, access controls
Liability cap: 1x fees paid, with carve-outs for confidentiality breach, gross negligence, and willful misconduct

Document	When Needed
Business Associate Agreement (BAA)	HIPAA-covered clients (healing centers, healthcare)
Data Processing Addendum (DPA)	When processing personal data under Colorado Privacy Act
Rules of Engagement (ROE)	If adding active penetration testing to scope
Retainer Agreement / MSA	Converting ORB clients to ongoing fractional Resilience Partner

oneNDA — Gold standard mutual NDA (CC BY 4.0)
Cure53 Contracts — Open-source security assessment contracts
Basecamp Policies — Model for plain-language legal writing
Colorado Revised Statutes: C.R.S. §8-2-113 (non-compete), C.R.S. §6-1-716 (breach notification)
Colorado Privacy Act (C.R.S. §6-1-1301 et seq.)