# Agreements

> Accept the master services agreement and the data processing agreement in LightHouse, or have a negotiated agreement recorded by reference.

Use of LightHouse™ is governed by the **master services agreement** (MSA) and the **data processing agreement** (DPA), accepted in LightHouse or executed outside it and recorded by Atlantic.

## Methods

| Method                                          | Used for                                                          | Recorded as                                  |
| ----------------------------------------------- | ----------------------------------------------------------------- | -------------------------------------------- |
| Click-through at sign-up                        | [Self-service sign-up](/enterprise/sign-up/)                      | Accepted                                     |
| Acceptance at **Billing → Terms**               | New versions of the standard text                                 | Accepted                                     |
| Order form                                      | [Sales-led onboarding](/enterprise/sign-up/#sales-led-onboarding) | Accepted, with the route `order_form`        |
| Negotiated MSA or DPA signed outside the portal | Sales-led onboarding with negotiated terms                        | [Executed agreement](#negotiated-agreements) |

## Versions

Each agreement’s version is the date its text took effect, such as `2026-10-31`. The text of each version is published on the company site under that date (see [Legal](/data-sovereignty/legal/)). A later version is published alongside earlier versions; published versions are not edited. When a new version takes effect, LightHouse lists it as awaiting acceptance on **Billing → Terms** and in the set-up mission’s **Settle how you pay** step.

## Procedure

The **Agreements** panel on **Billing → Terms** shows, for each agreement, the version in force and its status: **Accepted**, **Awaiting acceptance** or **Executed agreement**.

1. Open **Billing → Terms**, signed in as a person with the `client_admin` role.

2. Read the standard text from the link beside the version.

3. Choose **Accept the master services agreement** or **Accept the data processing agreement**.

   Result: the panel shows the agreement as **Accepted**, with the version.

Acceptance is made by a person. Atlantic staff, machine keys and delegated tokens cannot accept. If a new version took effect after the page was loaded, the acceptance is refused; reload the page, read the new text and accept again.

## Acceptance record

| Field                 | Content                                                                                                                              |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| Agreement and version | For example, `msa` `2026-10-31`                                                                                                      |
| Time                  | When the acceptance was made                                                                                                         |
| Person                | The verified sign-in email address                                                                                                   |
| Origin                | Keyed hashes of the network address and browser. These show whether steps came from the same party; the address itself is not stored |

The record is append-only and cannot be edited or deleted while the tenant exists. It is also entered in the tenant’s audit log as `agreement_accepted`.

## Negotiated agreements

An organisation that negotiates its MSA or DPA signs it outside the portal. Atlantic records the **executed agreement** against the tenant:

| Field              | Content                                                                                                                             |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
| Contract reference | The reference on the signed document                                                                                                |
| Effective date     | The date from which the agreement governs                                                                                           |
| Signatories        | Both parties’ signatories                                                                                                           |
| Document hash      | The SHA-256 hash of the signed document. LightHouse holds the hash, which identifies the signed file; it does not hold the document |

The record is append-only and appears in the tenant’s audit log as `agreement_executed_recorded`, an action by Atlantic.

From its effective date, an executed agreement governs in place of the standard text for that agreement. Later versions of the standard text are not offered for acceptance; a negotiated agreement changes by amendment, recorded as a further executed agreement. The panel shows the reference, effective date, signatories and hash. To compare the organisation’s copy with the record:

```sh
shasum -a 256 signed-agreement.pdf
```

## API

| Route                     | Role                     | Action                                                                                                                          |
| ------------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| `GET /api/v1/agreements`  | Any role                 | Returns the versions in force, when the tenant accepted each, any executed agreement that governs, and what is pending          |
| `POST /api/v1/agreements` | `client_admin`, a person | Accepts the versions in force, such as `{"msa": "2026-10-31", "dpa": "2026-10-31"}`; the response lists what was newly recorded |

A version already accepted is not recorded again. An agreement governed by an executed agreement cannot be accepted through this route (`409`).

Source: https://docs.atlanticagenticlabs.com/enterprise/agreements/