The 18 Legal Documents Every Founder Needs (and When You Actually Need Them)

Most founders learn about legal documents the expensive way.

A co-founder leaves in month eight and takes 50% of the company with them, because nobody signed a vesting schedule. An acquirer walks during diligence because the code was written by a contractor who never assigned the IP. A term sheet stalls for six weeks because the cap table is a spreadsheet that three people have edited and nobody trusts.

None of that is bad luck. It is missing paperwork.

Every great startup runs on more than a compelling product. It runs on foundations: the documents that protect the business, align the team, and make the company legible to investors, banks, and buyers. Founders who obsess over growth and treat the paperwork as "later" pay for it later, with interest.

This guide is the full stack. Eighteen documents, grouped by the stage you actually need them. For each one: what it is, why it matters, when it kicks in, and what happens if you skip it. We wrote it for founders building across MENA and emerging markets, so the regional notes cover free zones, Arabic-language contracts, and the data-protection laws that now apply from Riyadh to Cairo.

You do not need all 18 on day one. You need the right five on day one, and a plan for the rest.

Stage 1: Formation and ownership (day zero to first hire)

This is the layer that decides who owns the company and how decisions get made. Get it wrong and every later document is built on sand.

1. Founder Agreement

What it is: The contract between co-founders that defines each person's equity split, role and responsibilities, decision-making authority, vesting terms, and how you resolve disputes.

Why it matters: The single most common way early startups die is not competition. It is a founder falling-out with no document to fall back on. The founder agreement is where you decide the hard things while you still like each other: What happens to equity if someone leaves in year one? Who has the final call when you disagree? What counts as a full-time commitment?

When you need it: Before you write a line of code together. The day you agree to build something as partners.

Skip it and: Equity is assumed, not agreed. A departing co-founder keeps their full stake with zero vesting, and you are left running the company they walked away from while they own a quarter of it. Investors see the gap in diligence and discount your round or pass.

Regional note: In DIFC and ADGM, founder arrangements sit cleanly on top of common-law company structures. On mainland (Saudi, Egypt, UAE onshore), align the founder agreement with the local companies law and, where relevant, foreign-ownership rules before you fix percentages.

2. Certificate / Articles of Incorporation

What it is: The document that legally creates the company as a separate entity. Names, share structure, registered address, purpose.

Why it matters: Until this is filed, "the company" is just you. Your personal assets are exposed, you cannot open a corporate bank account, sign contracts as an entity, or take investment. Incorporation is the line between a project and a company.

When you need it: As soon as money, IP, or a second person is involved. Usually the first formal legal step.

Skip it and: You are personally liable for everything the business does, you cannot issue shares, and every contract you sign is signed by you as an individual.

Regional note: Where you incorporate is a real decision, not a formality. DIFC and ADGM offer common-law courts, 100% foreign ownership, and structures investors recognize. Free zones vary widely on cost and substance requirements. Many MENA founders now hold a top-co in a common-law hub and an operating entity onshore.

3. Corporate Bylaws

What it is: The internal rulebook for how the company governs itself: how directors are appointed, how meetings and votes work, officer roles, quorum, and reserved matters.

Why it matters: Bylaws are the operating system for decisions. When there is a disagreement about who can approve what, the bylaws answer it. Investors read them to understand the balance of power before they wire funds.

When you need it: At incorporation, or immediately after. Many jurisdictions require them.

Skip it and: Governance defaults to whatever the local statute says, which may not match what you and your co-founders actually intended, and disputes have no internal resolution path.

4. Shareholder Agreement

What it is: The contract among everyone who owns shares. It covers voting rights, share transfers, pre-emption, drag-along and tag-along rights, what happens on exit, and how new shares get issued.

Why it matters: Bylaws govern the company. The shareholder agreement governs the relationships between owners. It stops a minority shareholder from blocking a sale, stops a shareholder from selling to a competitor, and gives everyone a clear path in an exit. It is one of the documents founders skip most often, and regret skipping fastest.

When you need it: As soon as there is more than one shareholder, and always before you bring in outside investors.

Skip it and: A 5% holder can hold up a 95% majority. Shares move to people you never wanted in the cap table. An acquisition gets blocked by one holdout.

5. Capitalization Table (Cap Table)

What it is: The record of who owns what: every share, option, SAFE, and convertible, with percentages fully diluted.

Why it matters: The cap table is the financial truth of your company. Every fundraise, option grant, and exit runs through it. Investors will not wire money against a cap table they cannot verify.

When you need it: From the first share issued. It only gets harder to reconstruct later.

Skip it and: You lose track of dilution, promise more equity than you have, and burn weeks in diligence reconciling a spreadsheet nobody trusts. A messy cap table has killed real deals.

Founder tip: Keep it in a dedicated tool, not a spreadsheet that five people edit. The moment you issue options or take a SAFE, the math gets non-obvious fast.

Stage 2: Protecting the core, IP and people

Your two most valuable assets are the intellectual property and the team. Both need to be nailed down in writing, because both walk out the door on legs.

6. Intellectual Property (IP) Assignment Agreement

What it is: The document that transfers ownership of everything a founder, employee, or contractor creates for the company to the company itself.

Why it matters: This is the one that surprises founders most. By default, in many jurisdictions, the person who writes the code or designs the brand owns it, not the company that paid for it. Without assignment, your startup may not legally own its own product. Every acquirer checks this first.

When you need it: For every single person who touches the product: founders, employees, freelancers, agencies. Signed before or at the start of their work.

Skip it and: A former contractor legally owns a piece of your codebase. An acquisition collapses in diligence. A disgruntled ex-freelancer has leverage over your core product.

Regional note: Work-for-hire and moral-rights rules differ sharply across MENA jurisdictions. Do not assume "we paid for it" means "we own it." Assign it explicitly.

7. Non-Disclosure Agreement (NDA)

What it is: A confidentiality contract that stops the other party from sharing or misusing sensitive information.

Why it matters: Before you pitch a partner, hire a key employee, or share your roadmap with a potential acquirer, the NDA sets the rules. It is not bulletproof, but it establishes intent and gives you recourse.

When you need it: Any time you share genuinely sensitive material outside the company. Not for routine investor pitches (most VCs will not sign one), but yes for partnerships, key hires, and technical due diligence.

Skip it and: Confidential strategy, financials, or code can be shared or reused with no consequence.

8. Employment Agreements

What it is: The contract for each full-time hire: role, compensation, benefits, confidentiality, IP assignment, notice periods, and termination terms.

Why it matters: A clear employment agreement protects both sides and prevents the disputes that eat founder time and legal budget. It is also where you fold in the IP assignment and confidentiality that keep the company's assets inside the company. Get this wrong and you find out during a dispute, not before one.

When you need it: Before an employee's first day. Every time.

Skip it and: Ambiguity on comp, notice, and IP. Wrongful-dismissal exposure. A key engineer whose equity and confidentiality obligations were never actually written down.

Regional note: Labor law in the Gulf and North Africa is largely statutory and employee-protective, and contracts often must be registered (for example through the UAE Ministry of Human Resources or a free-zone authority) and, in places, issued in Arabic to be enforceable. Get the local form right.

9. Contractor / Consulting Agreement

What it is: The equivalent of an employment agreement for freelancers, agencies, and independent consultants.

Why it matters: Contractors build a huge share of early-stage product. This agreement defines scope, payment, confidentiality, and, critically, IP assignment. Misclassifying a contractor as not-an-employee can also create tax and labor liability, so the terms matter.

When you need it: Before any contractor starts paid work.

Skip it and: You do not own what they build (see document 6), scope creeps with no reference point, and you risk misclassification penalties.

10. Employee Stock Option Plan (ESOP)

What it is: The framework for granting equity to employees: the option pool, vesting schedules, exercise terms, and what happens when someone leaves.

Why it matters: Equity is how startups compete for talent against companies that can pay more cash. A proper ESOP lets you offer ownership in a way that is legally sound, tax-aware, and consistent across the team, instead of promising percentages in Slack messages.

When you need it: When you start hiring people you want to give equity to, usually pre-seed or seed.

Skip it and: Inconsistent, undocumented equity promises that create tax surprises for employees and cap-table chaos for you.

Regional note: Option taxation and enforceability vary across MENA, and structuring a pool through a common-law top-co is often cleaner than trying to grant options directly from an onshore entity.

11. Advisor Agreement

What it is: A short contract for advisors: what they will do, how much equity or cash they get, over what period, and confidentiality.

Why it matters: Advisors are cheap to add and easy to over-promise. A one-page advisor agreement with a vesting schedule (typically 0.1% to 1% over one to two years) keeps the relationship clean and stops a two-meeting advisor from holding equity forever.

When you need it: Whenever you bring on a named advisor with an equity or comp expectation.

Skip it and: Dead equity on your cap table for advice you stopped getting a year ago.

Stage 3: Running the business, commercial and compliance

Once you have users and revenue, a new set of documents governs how you deal with customers and how you handle their data. Several of these are not optional; they are legally required the moment you collect an email address.

12. Terms of Service (Terms of Use)

What it is: The rules users agree to when they use your product: acceptable use, payment terms, liability limits, dispute resolution, and termination.

Why it matters: Terms of Service is the contract between you and every user. It limits your liability, sets expectations, and gives you the right to remove abusive accounts. Without it, the relationship with your users is undefined.

When you need it: Before you launch anything the public can sign up for.

Skip it and: No liability cap, no defined rules of use, no clean way to terminate bad actors.

13. Privacy Policy

What it is: The public statement of what personal data you collect, why, how you use it, who you share it with, and what rights users have.

Why it matters: This is legally mandatory in most of the world the moment you collect personal data, including a name or email. It is not a nice-to-have. App stores, payment processors, and enterprise customers will all require one, and regulators will fine you for not having a compliant one.

When you need it: Before you collect any user data. So, before launch.

Skip it and: App Store and Google Play rejection, blocked payment processing, enterprise deals that die at security review, and regulatory fines.

Regional note: Saudi Arabia's PDPL, the UAE's PDPL (and the separate DIFC and ADGM data-protection laws), and Egypt's Data Protection Law all now impose real obligations, including in some cases data-localization and breach-notification duties. A generic US template will not make you compliant here.

14. Data Processing Agreement (DPA)

What it is: The contract that governs how personal data is handled when one company processes data on behalf of another. It sets out security obligations, sub-processors, breach notification, and data-subject rights.

Why it matters: If you sell to businesses, your customers will demand a DPA before they send you a single record of their users' data. If you use vendors (analytics, email, cloud), you need DPAs with them. It is the connective tissue of data compliance in a B2B world.

When you need it: As soon as you process personal data for another company, or use a vendor that processes it for you.

Skip it and: Enterprise sales stall at procurement, and you inherit compliance risk you never papered.

15. Master Service Agreement (MSA) / Customer Contract

What it is: The overarching commercial contract for B2B customers: scope, service levels, payment, IP, liability, and termination. Individual engagements hang off it as order forms or SOWs.

Why it matters: The MSA is how you sell to serious customers without re-negotiating the whole relationship every time. It caps your liability, defines what you owe, and makes revenue predictable and defensible.

When you need it: When you start closing B2B deals of any real size.

Skip it and: Every deal is a one-off negotiation, liability is uncapped, and your revenue is harder to defend in diligence.

Stage 4: Fundraising and scale

When you raise money, a specific set of documents carries the deal. Founders who understand these negotiate better and close faster.

16. SAFE or Convertible Note

What it is: The instrument for early-stage fundraising that lets an investor put in money now and convert it to equity later, at your next priced round. A SAFE (Simple Agreement for Future Equity) is not debt; a convertible note is debt that converts.

Why it matters: SAFEs and notes let you raise quickly without setting a valuation you are not ready to set. But the terms, valuation cap, discount, and (for notes) interest and maturity, decide how much of the company you give away. Founders routinely sign these without modeling the dilution, then get a nasty surprise at the priced round.

When you need it: At pre-seed and seed, before you do a full equity round.

Skip it (or sign it blindly) and: Stacked SAFEs with low caps can dilute you far more than you expected when they all convert at once. Always model the conversion.

Regional note: SAFEs are common in DIFC and ADGM. On some onshore MENA structures they need adaptation, so confirm the instrument fits your entity before you circulate it.

17. Term Sheet

What it is: The non-binding summary of a priced investment: valuation, amount, investor rights, board composition, liquidation preference, and key protective provisions.

Why it matters: The term sheet is the skeleton of the whole deal. Almost everything in the final long-form documents traces back to it. Understanding liquidation preferences, anti-dilution, and board control here is the difference between a founder-friendly round and one you regret at exit.

When you need it: At your first priced round (seed or Series A), and every round after.

Skip the detail and: You concede board control or a participating liquidation preference you did not understand, and it costs you real money and control years later.

18. Board Consents and Resolutions

What it is: The written record of major company decisions approved by the board or shareholders: issuing shares, approving budgets, hiring executives, taking on debt, approving a fundraise.

Why it matters: These are the paper trail of proper governance. They prove decisions were authorized, which matters enormously in diligence, in disputes, and in any future audit. Post-financing, clean board minutes are a sign of a well-run company.

When you need it: For every major corporate action, from your first board meeting onward.

Skip it and: Decisions are challengeable, diligence flags governance gaps, and you cannot cleanly prove that a share issuance or a key hire was ever authorized.

The founder checklist, by stage

Print this. Tick it as you go.

Day zero (before you build together)

• ☐ Founder Agreement
• ☐ Certificate / Articles of Incorporation
• ☐ Corporate Bylaws
• ☐ Shareholder Agreement
• ☐ Cap Table

First hires and first code

• ☐ IP Assignment (everyone who touches the product)
• ☐ NDA (where you share real secrets)
• ☐ Employment Agreements
• ☐ Contractor / Consulting Agreements
• ☐ ESOP
• ☐ Advisor Agreements

Before you launch to users

• ☐ Terms of Service
• ☐ Privacy Policy
• ☐ Data Processing Agreement (for B2B and vendors)
• ☐ MSA / Customer Contract (when you sell B2B)

When you raise

• ☐ SAFE / Convertible Note
• ☐ Term Sheet
• ☐ Board Consents and Resolutions

If you only do five things this month, do the day-zero five. They are the ones that get more expensive, not less, with every week you wait.

Why this stack is harder in MENA and emerging markets

The standard advice assumes a Delaware C-corp and US templates. Founders in the Gulf, North Africa, and across emerging markets live in a more complicated reality:

• Jurisdiction is a live decision. DIFC and ADGM give you common-law courts and 100% foreign ownership. Mainland entities give you local market access but different ownership and governance rules. Many founders run both, which doubles the paperwork.
• Language matters legally. In several jurisdictions, employment contracts and official filings must be in Arabic to be enforceable. A perfect English template can be legally weak.
• Data laws are new and real. Saudi's PDPL, the UAE's federal and free-zone regimes, and Egypt's Data Protection Law arrived fast and carry real penalties. Compliance is not optional and generic templates do not cover it.
• Enforcement varies. A contract that is airtight in one jurisdiction may be hard to enforce in another. Dispute-resolution clauses (which courts, which seat of arbitration) are not boilerplate here.

This is exactly the gap where founders lose time and money: the templates they find online are built for a different legal system.

How HAQQ helps founders get this done

HAQQ is a Legal AI operating system built for this region. Two pieces matter for founders:

• HAQQ Chat drafts and reviews these documents in minutes, grounded in real law, in English and Arabic. Ask it to draft a founder agreement with a four-year vesting schedule, review a SAFE for founder-unfriendly terms, or generate a PDPL-compliant privacy policy for a Saudi entity, and you get a strong first draft to take to your lawyer, not a blank page.
• eFirm is the practice layer for the lawyers who paper the specifics, so the humans in the loop work faster too.

The point is not to remove the lawyer. It is to get you from "I have no idea where to start" to "here is a solid draft" in the time it takes to read this article, and to make the lawyer's review cheaper because the first draft is already 80% right.

The 18 documents above are the map. HAQQ is how you cover the ground.

FAQ

How many legal documents does a startup actually need to launch?

Realistically five to launch: incorporation, bylaws, a founder agreement, a cap table, and (the moment you collect user data) a privacy policy and terms of service. The rest come online as you hire, sell, and raise. The mistake is treating all 18 as "later." The formation documents get more expensive to fix every week.

What is the single most important legal document for founders?

The founder agreement. Co-founder conflict with no agreement in place is one of the most common ways early startups die. It is the cheapest document to create and the most expensive one to be missing.

Do I need a lawyer, or can AI handle my startup legal documents?

Both, in sequence. AI like HAQQ gets you to a strong, jurisdiction-aware first draft in minutes, which saves time and legal fees. A qualified lawyer should review anything you sign, especially fundraising and equity documents. Use AI to do the 80%, and a human to close the 20% that carries the risk.

Why do I need an IP assignment agreement if I already paid the developer?

Because in many jurisdictions, paying for work does not automatically transfer ownership of it. Without a signed IP assignment, the person who created the code or design may legally own it, not your company. This is the first thing acquirers check, and the most common reason deals stall in diligence.

What is the difference between bylaws and a shareholder agreement?

Bylaws govern how the company operates internally (meetings, votes, officers). A shareholder agreement governs the relationships between the owners (share transfers, drag-along and tag-along rights, exit). You need both, and they should not contradict each other.

Are US legal templates fine for a startup in the UAE or Saudi Arabia?

Usually not. Data-protection obligations (PDPL and the free-zone regimes), Arabic-language requirements, labor-law registration, and foreign-ownership rules all differ from the US. A generic US template can leave you non-compliant. Adapt to your jurisdiction.

Building in MENA or an emerging market? Try HAQQ to draft and review your founder documents in English and Arabic, grounded in the law that actually applies to you.