@monoes/monomindcli 2.15.2 → 2.15.4

package/org-skills/general-counsel-advisor/SKILL.md

@@ -0,0 +1,157 @@
+---
+name: general-counsel-advisor
+description: "General Counsel advisory for startups: contract review (MSA, SaaS, NDA, DPA, employment), IP strategy, term sheet decoding, and regulatory landscape mapping. Use when reviewing any contract or term sheet, deciding when to engage outside counsel, defining IP strategy, evaluating regulatory exposure (HIPAA, GDPR, FDA, fintech), or when user mentions general counsel, GC, legal review, contract..."
+tags: ["legal","leadership"]
+tools: []
+license: MIT
+source: https://github.com/alirezarezvani/claude-skills
+source_path: "c-level-advisor/skills/general-counsel-advisor"
+source_commit: 19392f7a08264ed00486a251f5b2098321771f94
+---
+# General Counsel Advisor
+
+Strategic legal frameworks for startup General Counsels and founders without one. Contract risk, IP strategy, term sheet decoding, regulatory landscape.
+
+This is **not legal advice**. It surfaces the right questions to bring to qualified outside counsel and catches the obvious traps before they reach a signature. Treat every output as a starting point for a conversation with a licensed attorney, not as a substitute for one.
+
+## Keywords
+
+general counsel, GC, legal review, contract review, MSA, SaaS agreement, NDA, DPA, employment agreement, contractor agreement, IP assignment, invention assignment, open source license, OSS compliance, term sheet, liquidation preference, anti-dilution, option pool, vesting, acceleration, drag-along, pro-rata, board composition, regulatory, HIPAA, GDPR, CCPA, FDA, MDR, fintech, BSA/AML, money transmitter, AI Act, indemnity, liability cap, force majeure, auto-renewal, choice of law, venue, non-compete, non-solicit
+
+## Quick Start
+
+```bash
+# Scan a contract for risky clauses (uses bundled sample if no path given)
+python scripts/contract_risk_scanner.py
+python scripts/contract_risk_scanner.py path/to/contract.txt
+
+# Analyze a term sheet for founder-friendliness
+python scripts/term_sheet_analyzer.py
+python scripts/term_sheet_analyzer.py path/to/term_sheet.json
+```
+
+## Key Questions (ask these first)
+
+- **Who owns the IP being created or shared?** (Founders forget that contractors don't auto-assign IP without a written clause.)
+- **What's the liability cap, and what's carved out?** (Standard: 12 months of fees, with carve-outs for IP infringement, data breach, willful misconduct.)
+- **Is there a DPA in place if any personal data flows?** (GDPR, CCPA, state laws — non-negotiable if EU/CA data is touched.)
+- **What's the termination right, notice period, and auto-renewal trap?** (5-year auto-renew with 60-day notice is a common founder mistake.)
+- **Does this contract or product launch trigger a new regulatory regime?** (Healthcare → HIPAA. Fintech → BSA/AML. Medical device → FDA/MDR.)
+- **For term sheets: liquidation preference, pre-money option pool, anti-dilution flavor?** (Three places where 5% of founder economics can quietly disappear.)
+
+## Core Responsibilities
+
+### 1. Contract Review
+
+Standard contracts a startup signs in its first 5 years:
+
+- **Vendor MSA** — Master Service Agreement (cloud, tooling, services)
+- **Customer SaaS Agreement** — your standard customer paper + customer redlines
+- **NDA** — mutual + one-way, with carve-outs for residuals + independent development
+- **DPA** — Data Processing Agreement (required when personal data flows)
+- **Employment Agreement** — offer letter, IP assignment, non-compete (where enforceable), arbitration
+- **Contractor / 1099 Agreement** — IP assignment is critical; misclassification risk
+- **Equity Agreements** — option grants, RSU agreements, advisor grants (FAST template, YC SAFE for advisors)
+
+**Run** `contract_risk_scanner.py` on the text. It flags the 12 most common founder-killer clauses.
+
+### 2. IP Strategy
+
+- **Invention assignment** — every employee and contractor signs one. No exceptions.
+- **Open source license compliance** — track every OSS dependency's license; AGPL and GPL trigger copyleft obligations.
+- **Trade secrets** — define what's protected and how (clean room dev, access controls, NDAs).
+- **Patents** — file provisional within 12 months of disclosure; PCT for international.
+- **Trademarks** — register the word mark first, design mark second; clear before launch.
+- **Copyright** — automatic on creation, but register for statutory damages eligibility.
+
+See `references/ip_and_regulatory.md`.
+
+### 3. Term Sheet Decoding
+
+When a term sheet arrives, the difference between a founder-friendly and founder-hostile sheet often hides in three clauses:
+
+- **Liquidation preference** — 1x non-participating is standard; 1x participating or 2x is hostile
+- **Pre-money vs post-money option pool** — pre-money pool dilutes founders; post-money dilutes everyone proportionally
+- **Anti-dilution** — broad-based weighted average is standard; full ratchet is hostile
+
+**Run** `term_sheet_analyzer.py` to get a 0-100 founder-friendliness score with flags.
+
+### 4. Regulatory Landscape
+
+When to engage outside counsel **before** committing:
+
+| Trigger | Regime | First Step |
+|---|---|---|
+| Healthcare data | HIPAA, HITECH, state breach laws | Specialist health-tech counsel |
+| Cardholder data | PCI DSS (industry standard, not law, but contractually required) | QSA + counsel |
+| Money movement | BSA/AML, state money-transmitter (50-state patchwork) | Fintech specialist |
+| Medical device claims | FDA 510(k) / De Novo / PMA, MDR (EU), ISO 13485 | Medical-device specialist |
+| EU residents' personal data | GDPR + EU AI Act if AI is deployed | EU privacy counsel |
+| California residents | CCPA / CPRA | Privacy generalist |
+| Securities (tokens, equity crowdfunding) | SEC rules (Reg D, Reg A+, Reg CF) | Securities counsel |
+| Defense / aerospace customers | ITAR, EAR, DFARS, CMMC | Export-control counsel |
+| AI in EU | EU AI Act (risk-tiered) | EU privacy + product counsel |
+| AI for hiring (NYC, CO, IL) | Local bias-audit laws | Employment counsel |
+
+See `references/ip_and_regulatory.md` for sequencing.
+
+## Workflows
+
+### Workflow 1: Contract Review
+1. Save the contract as plain text
+2. Run `contract_risk_scanner.py path/to/contract.txt`
+3. For each HIGH risk finding, draft a counter-proposal
+4. Bring the redline + counter-proposals to outside counsel
+5. Log the decision via `/cs:decide`
+
+### Workflow 2: Term Sheet Response
+1. Save the term sheet as a JSON file matching the schema in `term_sheet_analyzer.py --help`
+2. Run `python scripts/term_sheet_analyzer.py path/to/term_sheet.json`
+3. Review the founder-friendliness score and per-clause flags
+4. Negotiate the worst 3 clauses (don't try to win all 20)
+5. Always have a securities/venture attorney review before signing
+6. Log via `/cs:decide` with `/cs:freeze 30` to prevent regret-driven re-opening
+
+### Workflow 3: IP Hygiene Audit
+1. Confirm every employee and contractor (past 12 months) signed invention assignment
+2. Run an OSS license inventory (`pip-licenses`, `license-checker` for npm)
+3. Map AGPL/GPL dependencies and confirm compliance (or remove)
+4. File provisional patents on novel inventions (12-month deadline from disclosure)
+5. Register word-mark trademarks for the product name
+
+### Workflow 4: Regulatory Trigger Assessment
+1. List planned product features for the next 12 months
+2. Map each feature to the trigger table in this document
+3. For any HIPAA / FDA / fintech trigger, engage a specialist counsel **before** building
+4. Document the regulatory roadmap and budget alongside the product roadmap
+5. Pair with `cs-ciso-advisor` for ISO 27001 / SOC 2 sequencing
+
+## Output Standard (when invoked via `/cs:gc-review`)
+
+```
+**Bottom Line:** [sign / negotiate / do not sign]
+**The Risks:** [3 highest-severity issues]
+**Counter-Proposals:** [specific language]
+**Outside Counsel Action Items:** [what to bring to the attorney]
+**Your Decision:** [the call only the founder can make]
+```
+
+## Adjacent Skills
+
+- `c-level-advisor/skills/ciso-advisor/` — Compliance overlap (SOC 2, ISO 27001, HIPAA technical safeguards)
+- `c-level-advisor/skills/cfo-advisor/` — Term sheet → dilution math
+- `c-level-advisor/skills/ma-playbook/` — Acquisition agreements, integration playbooks
+- `ra-qm-team/` — ISO 13485, MDR, FDA 510(k), GDPR execution
+- `c-level-agents/skills/gc-review/SKILL.md` — `/cs:gc-review` slash command
+
+## References
+
+- [contracts_playbook.md](references/contracts_playbook.md) — Standard contracts, clause checklist, common founder traps
+- [ip_and_regulatory.md](references/ip_and_regulatory.md) — IP protection + regulatory landscape mapping
+- [term_sheet_decoder.md](references/term_sheet_decoder.md) — Term sheet glossary + founder-friendly defaults + pushback strategies
+
+---
+
+**Version:** 1.0.0
+**Status:** Production Ready
+**Disclaimer:** Not legal advice. Always engage qualified counsel for binding decisions.

package/org-skills/general-counsel-advisor/references/contracts_playbook.md

@@ -0,0 +1,148 @@
+# Contracts Playbook — Standard Startup Agreements
+
+Reference for the 7 contracts every startup signs in its first 5 years and the clause traps to avoid in each. **Not legal advice.** Bring redlines to qualified counsel.
+
+## 1. Master Service Agreement (MSA) — Vendor Side (you signing theirs)
+
+**What it is:** The umbrella contract for an ongoing relationship with a vendor (cloud, tooling, services, agencies). Usually paired with one or more SOWs / Order Forms.
+
+**Top 5 redlines to push:**
+
+1. **Auto-renewal:** Cut notice period to 30 days max. Reject 60/90/180 day notice.
+2. **Liability cap:** Insist on 12 months of fees. Reject "fees in the preceding 3 months" (too narrow).
+3. **Mutual indemnification:** Reject one-sided. Mirror the scope on both sides.
+4. **IP ownership of deliverables:** All work product belongs to you. Vendor retains rights to pre-existing tools / methodologies, granted back to you for use.
+5. **Data: DPA + return-or-destroy on termination.** Specifically: vendor cannot use your data to train AI models.
+
+**Bonus catch:** Watch for "Vendor may modify these terms upon notice" — this means the contract you signed isn't the contract you have.
+
+## 2. Customer SaaS Agreement (your paper)
+
+**Standard structure:**
+
+1. License grant (subscription, scope, term)
+2. Acceptable use policy (what customer can/can't do)
+3. Fees & payment (annual prepay vs. monthly, late fee, currency)
+4. Service Level Agreement (uptime %, credits, exclusions)
+5. Confidentiality (mutual, residuals carve-out)
+6. Data Protection (DPA exhibit, subprocessor list, security commitments)
+7. Warranties (limited, disclaim implied)
+8. Indemnification (mutual, IP-infringement focused)
+9. Limitation of liability (12 months fees, carve-outs for IP/data breach/willful)
+10. Term & termination (term, termination for cause, termination for convenience)
+
+**Founder traps when accepting customer redlines:**
+
+- "Most-favored-nation" pricing (means you can never give anyone else a better deal).
+- Uncapped liability for data breach with no minimum threshold.
+- Customer right to perpetual license-back of "improvements" to your product.
+- Customer "ownership" of any custom configuration (often hiding IP creep).
+- Source-code escrow with auto-release triggers tied to customer convenience.
+
+## 3. Non-Disclosure Agreement (NDA)
+
+**One-way (you receiving):** Acceptable to sign without redlines for short evaluations.
+
+**Mutual NDA (both directions):** The default for ongoing discussions.
+
+**Critical carve-outs (always include):**
+
+- **Residuals:** Information retained in unaided memory after end of engagement is not confidential.
+- **Independent development:** If you build something similar without using their info, it's yours.
+- **Public domain:** Information already public is not confidential.
+- **Rightfully received:** Information received from a third party without confidentiality obligation.
+- **Required by law:** Information disclosed under subpoena (with notice).
+
+**Founder trap:** NDAs that prevent you from "engaging in similar business" — that's a non-compete in disguise. Strip it out.
+
+## 4. Data Processing Agreement (DPA)
+
+**Required when:** Personal data of EU residents flows (GDPR Article 28), or California residents (CCPA / CPRA), or HIPAA-covered data, or biometrics in IL/TX/WA (BIPA).
+
+**Standard structure (GDPR-aligned):**
+
+- Scope of processing (what data, what purpose)
+- Controller / Processor designation
+- Subprocessor list + flow-down obligations
+- Data subject rights (access, deletion, portability)
+- Security measures (encryption, access controls, training)
+- Breach notification timelines (within 72 hours for GDPR)
+- Audit rights (annual, reasonable)
+- International transfer mechanism (SCCs, adequacy decision, BCRs)
+- Return-or-destroy on termination
+
+**Templates:** Use IAPP, EU Commission SCCs, or vendor-friendly DPA (e.g., Vanta's, Stripe's).
+
+**Founder trap:** Missing DPA when EU/CA data flows = contract may be unenforceable AND regulatory fine exposure.
+
+## 5. Employment Agreement / Offer Letter
+
+**Must-have provisions:**
+
+- **At-will employment** (US most states; not enforceable in MT for example)
+- **Compensation:** salary, bonus structure, equity (option grant separately documented)
+- **Invention assignment:** all IP created during employment using company resources belongs to company
+- **Confidentiality:** ongoing duty, surviving termination
+- **Non-solicit:** 12 months post-termination, employees + customers (carve out general advertising)
+- **Non-compete:** state-dependent (CA, ND, OK, DC: void; many other states: enforceable if reasonable)
+- **Arbitration:** mutual, AAA or JAMS rules, employer pays fees
+
+**Founder traps:**
+
+- Forgetting to require employees to sign **before** starting work (otherwise IP assignment is weak).
+- Not including a "previously created inventions" exhibit (lets founders document pre-existing IP brought into the company).
+- Skipping background checks for senior hires.
+
+## 6. Contractor / 1099 Agreement
+
+**Critical differences from employment:**
+
+- **IP assignment is NOT automatic.** Without a written clause, the contractor owns what they create (under US law, "work for hire" applies only to specific categories of work).
+- **Misclassification risk:** If a contractor functions like an employee (controlled hours, exclusive engagement, supplied equipment), tax authorities can reclassify, triggering back taxes + penalties.
+- **No benefits, no withholding, contractor handles their own taxes.**
+
+**Must-have provisions:**
+
+- **Explicit work-for-hire OR written IP assignment** ("Contractor hereby assigns all right, title, and interest...").
+- **Independent contractor status:** contractor controls means and methods.
+- **Termination:** 30-day notice, immediate for cause.
+- **Indemnification:** contractor indemnifies you for misclassification claims if they misrepresent status.
+
+**Tooling:** Use Deel, Remote, or Velocity Global for international contractors to handle classification correctly.
+
+## 7. Equity Agreements (Option Grants, Advisor Grants)
+
+**Employee option grant:**
+
+- **Strike price:** must be ≥ fair market value (FMV) at grant date (409A valuation, refreshed annually).
+- **Vesting:** standard 4 years, 1 year cliff, monthly thereafter.
+- **Exercise window post-termination:** 90 days standard; 7-10 years is founder-friendly.
+- **ISO vs NSO:** ISOs have tax advantages (long-term capital gains if held) but limits ($100K vest/year) and US-citizen-only.
+
+**Advisor grant (FAST template by Founder Institute):**
+
+- 0.1% - 1% equity vested over 1-2 years, depending on level and stage.
+- 2-year vesting, no cliff (advisors are tested through engagement, not retention).
+- Single trigger acceleration on change of control (rare; double trigger more common).
+
+**Founder trap:**
+
+- Issuing options before completing the 409A valuation — strike price might be challenged by IRS.
+- Verbal promises about acceleration — must be in writing.
+- Forgetting to issue option grants to early employees within 90 days of hire (loses ISO eligibility).
+
+## Quick Triage Heuristics
+
+When you have 5 minutes to look at a contract:
+
+1. **Find the liability cap.** No cap or > 24 months of fees = red flag.
+2. **Find the indemnity clauses.** One-sided = red flag.
+3. **Find the IP clause.** Vague or "as agreed" = red flag.
+4. **Find the term + termination.** Auto-renewal with > 30 day notice = red flag.
+5. **Find the choice of law/venue.** Exclusive in counterparty home jurisdiction = red flag.
+
+Run `scripts/contract_risk_scanner.py` for the automated version.
+
+---
+
+**Final reminder:** This is a triage playbook. Every contract over $100K or longer than 1 year deserves outside counsel review. Every contract that touches personal data deserves a privacy attorney. Every term sheet deserves a securities / venture attorney. Period.

package/org-skills/general-counsel-advisor/references/ip_and_regulatory.md

@@ -0,0 +1,191 @@
+# IP Strategy & Regulatory Landscape
+
+The two areas where startups most often discover legal exposure after it's too late to fix cheaply: IP ownership and regulatory triggers. **Not legal advice.**
+
+## Part 1: IP Strategy
+
+### IP Inventory — The Four Categories
+
+| Type | What it protects | How you get it | How you lose it |
+|---|---|---|---|
+| **Patents** | Inventions (novel, non-obvious, useful) | File application | Public disclosure > 12 months before filing |
+| **Copyright** | Original works of authorship (code, content, designs) | Automatic on fixation | Almost never; can be assigned away |
+| **Trademark** | Brand identifiers (names, logos, slogans) | Use in commerce + registration | Not policing infringement; becoming generic |
+| **Trade secret** | Confidential business information | Reasonable measures to keep secret | Public disclosure; failure to maintain confidentiality |
+
+### Invention Assignment — The Single Most Important IP Practice
+
+**Rule:** Every person who touches the company's product or systems must sign an invention assignment agreement **before** they start work.
+
+This includes:
+- Co-founders (often forgotten — usually fixed via founder restricted-stock purchase agreements)
+- Employees (in employment agreement)
+- Contractors (in contractor agreement; NOT automatic in US law)
+- Interns (often forgotten — use a short standalone IP agreement)
+- Advisors (in advisor agreement, scope limited to inventions related to company)
+
+**Why it matters:** Without written assignment, the creator retains ownership. A contractor who built a critical service for 6 months and never signed an assignment can come back years later and demand a license — or assert that competitors can also use what they built.
+
+**The "previously created inventions" exhibit:** Every IP assignment should include an exhibit where the signer lists pre-existing inventions they want to exclude. This protects everyone — the signer's prior work isn't accidentally assigned, and the company has documentation of what came in.
+
+### Open Source License Compliance
+
+**Permissive licenses** (MIT, Apache 2.0, BSD 2/3): Use freely, attribute, no copyleft.
+
+**Weak copyleft** (LGPL, MPL): Can use in proprietary product; modifications to the OSS itself must be released. Distribution model matters.
+
+**Strong copyleft** (GPL v2, GPL v3, AGPL): Distribution / SaaS use of a strong-copyleft component can require releasing your derivative work under the same license. **AGPL is the most aggressive** — it applies even when you only run the software on a server (SaaS / network use).
+
+**Practice:**
+
+1. Maintain an OSS inventory: `pip-licenses`, `license-checker` (npm), `cargo-license`, `go-licenses`.
+2. Identify any GPL / AGPL / SSPL dependencies.
+3. For each: either (a) comply with the license, (b) replace with a permissively-licensed alternative, or (c) document the carve-out (some companies build internally with GPL but only ship the binary externally — verify with counsel).
+4. Run the inventory before any due diligence (acquisition, financing).
+
+### Patents — When to File
+
+**File when:**
+
+- You have a genuinely novel technical invention (algorithm, hardware design, materials, biotech process).
+- You face well-funded competitors who could copy without consequence.
+- You're in a patent-dense industry (semiconductors, pharma, networking, medical devices).
+- Filing strengthens fundraising / acquisition optics (limited weight for software-only startups).
+
+**Don't bother when:**
+
+- Your "invention" is a UX flow or business method (these are extremely hard to patent post-Alice Corp).
+- You're in early stage with limited capital and no competitors close enough to copy.
+- Defensive only and joining a patent pool (LOT Network, OIN) might be cheaper.
+
+**Process:**
+
+1. **Provisional patent** ($300-500 USPTO fee + $3K-5K attorney). 12 months to file non-provisional.
+2. **Non-provisional / utility patent** ($1K USPTO fee + $10K-15K attorney + prosecution costs).
+3. **PCT application** for international filings ($5K-10K).
+4. **National phase entries** in each country you care about ($5K-15K per country).
+
+Budget $25K-50K total for one well-prosecuted patent family with international coverage.
+
+### Trade Secrets
+
+**Reasonable measures required for legal protection:**
+
+- NDA / confidentiality clauses with everyone who has access.
+- Access controls (need-to-know basis, not company-wide).
+- Marking documents "Confidential."
+- Departure procedures (return of materials, exit interview, deactivation).
+- Training employees on what's a trade secret.
+
+**Without these measures, the information may not qualify for trade secret protection if disclosed — even by a thief.**
+
+**Common trade secrets:**
+
+- Customer lists with usage / pricing data
+- Algorithms not disclosed in published patents
+- Manufacturing processes
+- Sales playbooks and pricing models
+- Internal financial projections
+- Source code (unless OSS)
+
+### Trademark Strategy
+
+**Search before launch:**
+
+- USPTO TESS search (free, but limited; doesn't catch common-law marks).
+- Professional search via attorney ($500-2K) catches common-law marks and similar-mark conflicts.
+- International searches via WIPO Global Brand Database.
+
+**Register early:**
+
+- US: Intent-to-use application (1B) lets you reserve a mark before launch.
+- International: Madrid Protocol filing extends to 100+ countries.
+- Word marks first (the brand name itself), design marks second (logos).
+
+**Policing:**
+
+- Set up Google Alerts and USPTO TMNG for your mark.
+- Send cease-and-desist letters promptly; failure to police can weaken the mark.
+
+---
+
+## Part 2: Regulatory Landscape — When to Engage Counsel
+
+The startups that survive their first regulatory encounter engage specialist counsel **before** building, not after. The ones that don't usually pivot, retreat, or pay heavy fines.
+
+### Trigger Matrix
+
+| Trigger | Regulatory Regime | Specialist Needed | Earliest Action |
+|---|---|---|---|
+| Healthcare data (patient records, claims, PHI) | HIPAA, HITECH, state breach laws | Health-tech attorney | Business Associate Agreement, OCR-aligned risk assessment |
+| Cardholder data | PCI DSS (industry standard; contractually required) | QSA + counsel | Scope reduction, tokenization, certified processor |
+| Money movement (transmitting funds, custody, crypto) | BSA/AML, state money-transmitter (50-state patchwork) | Fintech attorney | Stripe Treasury / Banking as a Service to avoid MT registration |
+| Lending | Truth in Lending Act, state usury laws, ECOA | Fintech / consumer-finance attorney | Bank partnership, state licensing analysis |
+| Medical device claims | FDA 510(k), De Novo, PMA; EU MDR; ISO 13485 | Medical-device regulatory specialist | Pre-submission meeting with FDA |
+| EU residents' personal data | GDPR + ePrivacy + EU AI Act if AI | EU privacy attorney | DPA, SCCs for international transfer, DPIA |
+| California residents | CCPA / CPRA | Privacy generalist | Privacy notice, opt-out mechanisms, vendor management |
+| Children's data (under 13 US, under 16 in some EU states) | COPPA, GDPR-K | Privacy attorney | Parental consent, no-track defaults |
+| Securities (tokens, equity crowdfunding, advisory boards) | SEC rules (Reg D, Reg A+, Reg CF, Howey test) | Securities attorney | Token sale legal opinion, Form D filing |
+| Defense / aerospace customers | ITAR, EAR, DFARS, CMMC | Export-control attorney | Export classification, registered with State Dept |
+| AI in EU | EU AI Act (risk-tiered: prohibited / high-risk / limited / minimal) | EU privacy + product attorney | Risk assessment, conformity assessment for high-risk |
+| AI for hiring | NYC Local Law 144, CO SB 21-169, IL HB 53 | Employment attorney | Bias audit, candidate notice |
+| Telehealth / online prescribing | State medical board rules, DEA registration for controlled substances | Telehealth specialist | State-by-state physician licensing strategy |
+| Insurance (sale, underwriting, brokerage) | State insurance commissioners | Insurance attorney | State licensing, agency agreement |
+
+### Sequencing: SOC 2 → ISO 27001 → Industry-Specific
+
+For most B2B SaaS, the security/compliance sequence is:
+
+1. **SOC 2 Type 1** (point-in-time audit) — ~$15K-25K, 3-6 months prep
+2. **SOC 2 Type 2** (continuous, ~6-12 month audit window) — ~$25K-50K
+3. **ISO 27001** if expanding internationally — ~$30K-60K, builds on SOC 2 controls
+4. **ISO 42001** if AI is core to product — first AI management system standard
+5. **Industry overlays:** HIPAA technical safeguards, FedRAMP (federal customers), PCI DSS (cardholder data)
+
+**Sequencing logic:** SOC 2 unlocks the majority of enterprise sales. ISO 27001 unlocks European and Asia-Pacific. Industry overlays are required for specific verticals.
+
+### When to Get a General Counsel Hire
+
+| Stage | GC need |
+|---|---|
+| Pre-seed / seed | None. Use outside counsel ad-hoc + Clerky/Stripe Atlas templates |
+| Series A | Fractional GC (~$10-20K/month) OR senior associate at firm |
+| Series B | Full-time GC if regulated industry, customer contracts are heavy, or fundraising is constant |
+| Series C+ | Full-time GC + Deputy/Associate GC if international |
+
+**Signs you need a GC hire:**
+
+- You're spending > $200K/year on outside counsel
+- You're signing > 1 enterprise contract per week with customer redlines
+- You're in a regulated industry (healthcare, fintech, defense)
+- You're preparing for IPO or going-public transaction
+- You're acquiring companies
+
+### Cross-Border Considerations
+
+**Hiring international employees:**
+
+- Use Deel / Remote / Velocity Global for first 1-5 contractors per country.
+- Establish an entity (subsidiary or EOR-to-entity transition) at 5-10+ employees.
+- Tax residency, permanent establishment risk, and equity grants vary significantly.
+
+**International data flows:**
+
+- EU → US: SCCs + Transfer Impact Assessment (TIA); DPF if certified.
+- China → outbound: PIPL approval + standard contract + security assessment.
+- UK → outside: UK SCCs (similar to EU).
+- Schrems / DPF status changes regularly — monitor with privacy counsel.
+
+**International IP:**
+
+- Patent: PCT application within 12 months of first national filing.
+- Trademark: Madrid Protocol for multi-country filings.
+- Copyright: Berne Convention covers most countries automatically.
+
+---
+
+## Closing: The General Counsel's Three Rules
+
+1. **Get it in writing.** Verbal agreements and "we'll figure it out later" produce 80% of post-engagement disputes.
+2. **Identify the regulatory trigger before you build.** It's 10x cheaper to design around a regulation than to retrofit.
+3. **Always have outside counsel review anything binding.** This document is triage; real legal review is mandatory.