Which agreement actually binds you

Most vendor questions have a findable answer. This page is about the ones where the answer you find is wrong — where the document a search returns is not the document that governs your company, and nothing on the page tells you that.

Every case below is quoted from the vendor’s own published documents, with the source. We are not telling you these vendors did anything improper. Publishing several agreements for several kinds of customer is normal and correct. The problem is on the reader’s side: if you cite the wrong one in a data-processing agreement or a security questionnaire, you have put a wrong statement into a compliance document, and you carry that.

1. Anthropic — two different questions, two different right answers

This case is on the page because it is the one most likely to be got half right, and because getting it half right feels like getting it right.

The contracting entity for a Claude Pro subscription is not the Irish one. Anthropic’s Commercial Terms say:

“Anthropic” means Anthropic Ireland, Limited if Customer resides in the European Economic Area (“EEA”), Switzerland or UK, and Anthropic, PBC if Customer resides anywhere else.

But the Consumer Terms of Service — which is what governs a Claude Pro seat bought on a card — name one entity only:

These Terms are a contract between you and Anthropic, PBC (“Anthropic”) (and not our Providers)

… under “the laws of the State of California”, with disputes “exclusively in the state or federal courts located in San Francisco, California”. The word “Ireland” does not appear anywhere in that document.

And yet “Anthropic Ireland, Limited” is also a correct answer — to a different question. Anthropic’s Privacy Policy states:

If you live in the European Economic Area (EEA), UK or Switzerland (the “European Region”), the data controller responsible for your personal data is Anthropic Ireland, Limited.

Why it matters, precisely. These are two fields, not one, and they disagree on purpose:

• Data controller — what GDPR Article 30 records ask for. For EEA/UK/Swiss users that is Anthropic Ireland, Limited, consumer plans included. A record naming the Irish entity here is right.
• Contracting entity and governing law — what a DPA negotiation, a liability cap, a venue clause and a contractual remedy turn on. For a card-bought Claude Pro seat that is Anthropic, PBC, California law, San Francisco courts.

So the failure mode here is not a wrong entity. It is carrying one field’s answer into the other field’s box — telling a customer your contractual counterparty is Irish because your controller is, or telling a regulator your controller is Californian because your contract is. Both are wrong, both look reasonable, and neither is visible from a single document.

Sources: Commercial Terms of Service · Consumer Terms of Service · Privacy Policy, section 9. All checked 9 August 2026.

2. Microsoft 365 Copilot — we publish no entity, on purpose

What a search returns. Asked which legal entity a business contracts with for Microsoft 365 Copilot, a web search and a general AI assistant both return this, confidently:

For all other Services, you’re contracting with Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, U.S.A.

Correction, 30 August 2026. This blockquote previously read “For all Services other than Skype-branded services…” — a paraphrase inside quotation marks. The sentence above is the one the Microsoft Services Agreement actually carries, re-checked against the live document on 30 August 2026. The error did not change the finding, and it is recorded here rather than quietly amended because a page arguing that the wrong document gets quoted has no standing to misquote one.

That sentence is from the consumer Microsoft Services Agreement, which is not the instrument that governs the business product. The agreement naming the contracting entity for a business customer depends on how the product was bought — a Microsoft Customer Agreement, an Online Subscription Agreement, or a volume licensing agreement — and that text sits behind a geography-selection form or a negotiated contract.

Why it matters. The failure here is not that the answer is hard to find. It is that an answer arrives, sounds authoritative, cites a real Microsoft document, and is the wrong instrument. Vannus therefore publishes no contracting entity for Microsoft 365 Copilot at all, and says why on the tool page. It is the only vendor in the top of our catalog we deliberately leave blank.

Source: Microsoft Services Agreement. Checked 8 August 2026.

3. OpenAI — the UK gets Irish law and a US counterparty

OpenAI’s business agreement splits by region twice, and the two splits are not the same split. The entity clause reads:

“OpenAI Contracting Party” means: (a) OpenAI OpCo, LLC, for Customers located outside the EEA or Switzerland; (b) OpenAI Ireland Ltd. for Customers located in the EEA or Switzerland…

The governing-law clause reads:

“Governing Laws” means: (a) for Customers in the EEA, Switzerland, or UK, the Laws of Ireland; and (b) for all other Customers, the laws of the State of California…

Why it matters. The UK is in the second list and not the first. A UK business therefore contracts with OpenAI OpCo, LLC, a US company, while being bound to Irish law and Dublin courts. Compare Anthropic, which puts UK customers with the Irish entity and under Irish law. Two of the most common vendors in any stack, splitting differently — and you only see it by reading the entity clause and the governing-law clause against each other.

Source: OpenAI Services Agreement, effective 1 January 2026. Checked 8 August 2026.

4. Zoom — the public terms say they may not be your terms

This is the clearest case on the page, because Zoom tells you itself. The opening paragraph of the public Terms of Service reads:

… unless you and Zoom have entered into a written Master Subscription Agreement (MSA), in which case such MSA will govern your access to and use of the Services and Software and not these Terms of Service.

Zoom does not publish the MSA. So for any customer whose Zoom was bought through a sales conversation rather than a card, the document you can read is expressly not the document that governs, and the one that does govern is not available to read.

Even inside the public terms the answer moves. Section 33.2 provides that a billing address in India makes the contracting entity “Zoom’s affiliate, ZVC India Pvt. Ltd.”, while section 33.3 applies “the laws of the State of California, U.S.A.” And if the purchase went through a reseller, the counterparty is the reseller — not Zoom at all.

Why it matters. A DPA answer that names Zoom and California law is correct for a self-serve card purchase and wrong for a reseller purchase, wrong for an India-billed entity, and unverifiable for anyone on a negotiated MSA. Nothing you can look up tells you which of those you are. The answer is in your own order paperwork — which is exactly what we will tell you to go and pull.

Source: Zoom Terms of Service, sections 33.2 and 33.3 and the introductory paragraph. Checked 8 August 2026.

The honest limit of this

For a negotiated purchase, the document that finally binds you is your own Order Form or MSA — and we will never have a copy of that. No catalog can. So this page does not claim to tell you your answer. It tells you when the answer you were about to give is void, and which clause of your own paperwork to go and read instead.

That is a smaller claim than “we know who controls your vendors”, and it is the one that survives contact with a real contract.

What this page is not

Not legal advice, and not a claim that any vendor has done anything wrong. It is a reading of public documents, dated, with the source next to each quote so you can check it rather than trust us. If we have read one of these wrongly, tell us and we will publish the correction.

This list grows as we work through the catalog. Where we cannot establish which agreement binds a given buyer, we record that rather than guess — an honest blank is worth more to you than a confident answer from the wrong document.