Virtual Assistant Contract Template: Copy-Ready Clauses and Schedules
November 10, 2026
A virtual assistant contract template should cover eight clauses: scope, payment, worker status, confidentiality, system access, intellectual property, termination and governing law. 69% of businesses started in 2024 hired at least one person that year, on staff or on contract, according to Gusto's 2025 New Business Formation Report, a survey of 1,011 owners. The contract question arrives early. Write every clause so a log, a file list or an invoice can prove it.
Below: the clause table, a scoring test for your draft, a copy-ready agreement with [bracketed] fields, and the three schedules that do most of the work. Not legal advice: have counsel in your state and in the assistant's country review the final version.
A draft stands or falls on eight clauses, whether it runs to one page or twelve.
| Clause | What the clause must state | Common gap |
|---|---|---|
| Scope of work | Deliverables, hours, time-zone overlap, acceptance criteria | Vague duties such as general support |
| Payment and invoicing | Rate, billing cycle, currency, expense approval rules | No rule for unapproved expenses |
| Worker status | Independent-contractor terms and limits on control | Label that does not match the working practice |
| Confidentiality | Protected information, permitted use, duration of duty | Duty exists only as a promise after misuse |
| Data security and access | Approved devices, MFA, least-privilege access, AI tool rules | No access schedule or breach timing |
| Intellectual property | Assignment of work product and treatment of pre-existing materials | Blanket ownership claim with no fallback license |
| Termination and transition | Notice period, file return, credential handover, access revocation | No handover duty at exit |
| Governing law and local rules | Governing law, venue, data transfer basis, mandatory local rules | Assumes one country's rules apply everywhere |
Two rows do most of the damage. Data security and access gets written as a confidentiality promise, so it never says which accounts the assistant can open or how fast a breach reaches you. Termination and transition sets a notice period and stops, so nobody knows how files come back or when logins die.
Scope fails the same way. Without measurable acceptance criteria it can't be enforced, which is why KPIs for virtual assistant tasks belong inside the scope exhibit.
The structure carries across trades. A software vendor's guide to essential clauses for landscaping contracts covers scope, site access and payment timing for one-person service businesses. Swap "site access" for "system access" and the logic maps onto a remote role.
Practical rule: If a clause can't be checked against a log, a file list or an invoice, it's a sentiment, not an obligation.
Picture the last day of the engagement, with the assistant gone. For each of the eight clauses, could you prove from your own records that it was honored?
The maximum is 16. Below 12 of 16, the draft is not ready to sign. A 0 on data access or termination is a stop on its own, because those are the clauses you need on the worst day.
Worked example (illustrative inputs, not a real client contract):
| Clause | Example draft | Score | After fixes | Score |
|---|---|---|---|---|
| Scope of work | Task list, no acceptance criteria | 1 | Exhibit 1 with criteria and change orders | 2 |
| Payment and invoicing | Rate, cycle and currency in one line | 2 | Unchanged | 2 |
| Worker status | Contractor label only | 1 | Label plus matching practices | 1 |
| Confidentiality | Generic NDA paragraph | 1 | Defined terms, duration, return log | 2 |
| Data security and access | Not covered | 0 | Schedule C access list, MFA, incident clock | 2 |
| Intellectual property | "Client owns everything" | 1 | Assignment, fallback license, Schedule B | 2 |
| Termination and transition | 14 days' notice only | 1 | Schedule C revocation record | 2 |
| Governing law and local rules | State law named | 1 | Unchanged, local review pending | 1 |
| Total | 8 of 16 | 14 of 16 |
The arithmetic: 1 + 2 + 1 + 1 + 0 + 1 + 1 + 1 = 8, or 50%, with a 0 on access. Not ready on two counts. After the fixes: 2 + 2 + 1 + 2 + 2 + 2 + 2 + 1 = 14, or 87.5%, no zeros. Ready for counsel. Worker status rarely reaches 2: your daily practice is the proof, not the paper.
Replace every [bracketed] field and delete options that don't apply. Exhibit 1 is your scope of work.
VIRTUAL ASSISTANT SERVICES AGREEMENT
Parties. This agreement is made on [effective date] between [client legal name], a [state or country] [entity type] at [address] ("Client"), and [assistant or provider legal name] at [address] ("Assistant").
Definitions. "Protected Information" means [customer records, pricing, internal correspondence, credentials] and anything derived from them. "Work Product" means everything the Assistant creates for the Client under this agreement, including [CRM records, copy, spreadsheets, workflows, automation scripts]. "Approved Systems" means the accounts listed in Schedule C.
Services and acceptance. (a) The Assistant performs the services in Exhibit 1. (b) Overlap hours are [hours] [time zone], [days], for about [number] hours per [week]. (c) A deliverable is accepted when it meets the Exhibit 1 criteria; the Client accepts or rejects it in writing within [number] business days. (d) Changes to scope, rate or deadlines take effect only through a written change order signed by both parties.
Fees and expenses. (a) The fee is [amount and currency] per [hour or month]. (b) The Assistant invoices [weekly or monthly], itemizing hours or deliverables; the Client pays within [number] days by [method]. (c) Expenses need written approval before they are incurred. The Client pays directly for [tools].
Relationship of the parties. (a) The Assistant is an independent contractor; nothing here creates an employment relationship, partnership or joint venture. (b) The Assistant decides how the work is done, subject to Sections 3 and 7. (c) [The Assistant may serve other clients, subject to Section 6.] (d) Each party handles its own taxes and filings under the law that applies to it. This wording alone does not decide legal status.
Confidentiality. (a) Protected Information is used only for the purposes in Exhibit 1. (b) The duty excludes information that is public, already known, independently developed or lawfully received from a third party. (c) It lasts for the term plus [number] years, and for trade secrets and credentials as long as the law protects them.
System access and security. (a) Only Approved Systems, under a named individual account. (b) Multifactor authentication wherever offered. (c) Credentials shared only through [password manager]. (d) Client data stays on [approved devices] and is not exported without written approval. (e) Generative AI limited to [approved tools]; no Protected Information in any other AI tool. (f) Suspected security incidents reported to [contact] within [number] hours of discovery.
Data processing. Schedule A applies to personal data processed for the Client and forms part of this agreement.
Intellectual property. (a) The Assistant assigns to the Client all rights in the Work Product on [creation or payment]. (b) Where assignment cannot take effect, the Assistant grants an exclusive, perpetual, worldwide license at no additional fee. (c) Pre-existing materials in Schedule B stay with the Assistant; where embedded in Work Product, the Client gets a non-exclusive, perpetual license to use them as part of it. (d) Third-party or open-source material is disclosed before delivery. (e) The Assistant represents the Work Product is original or properly licensed and will replace infringing material within [number] days of notice.
Term and termination. (a) Either party may terminate on [number] days' written notice. (b) The Client may terminate immediately for a material breach of Section 6 or 7. (c) On termination, the parties complete Schedule C. (d) Sections 6, 8, 9 and 10(c) survive.
Governing law. The laws of [state or country] govern; disputes go to [venue]. Mandatory rules of [Assistant's country] that a contract cannot exclude still apply. [Data transfer basis, if required.]
Entire agreement. This agreement, Exhibit 1 and Schedules A to C are the whole agreement; changes must be written and signed by both parties. Signed: [Client name, title, date] and [Assistant name, title, date].
Schedule A: Data processing. Keep data terms apart from the scope, so a rate change never reopens them. The elements below follow GDPR Article 28 (the linked page reproduces the text of Article 28; the official version is in the EU Official Journal). Use it as a baseline even where the GDPR may not apply.
| Element | What to specify |
|---|---|
| Subject matter, duration, purpose | [Client email, calendars and records], [admin and support] processing, for the term |
| Data types and data subjects | [Customer names, contact details, invoices]; [client customers and staff] |
| Instructions | Documented written instructions only, including for transfers |
| Security and confidentiality | [MFA, encrypted transfers, approved devices]; everyone with access bound by confidentiality |
| Subprocessors | Named list, prior written approval for changes |
| Assistance | Help with data-subject requests, breach investigation and notifications |
| Deletion or return | At the Client's choice at termination, confirmed in writing |
| Audit information | What the Client needs to show the obligations are met |
Schedule B: Pre-existing materials. One line per item the Assistant brings in and keeps.
| Item | Owner | License to Client |
|---|---|---|
| [Email template library] | Assistant | Non-exclusive, perpetual, inside Work Product |
| [Spreadsheet macros] | Assistant | Non-exclusive, perpetual, inside Work Product |
| [Open-source component and its license] | Third party | As per its license |
Schedule C: Access and exit record. The same table runs the first day and the last.
| System | Permission | Granted | Revoked | Proof record |
|---|---|---|---|---|
| [Shared inbox] | [Send as, no admin] | [date] | [date] | Identity-provider log |
| [CRM] | [Edit, no export] | [date] | [date] | Permission export |
| [API tokens, automations] | [Named tokens] | [date] | [date] | Token inventory |
Exit steps: (1) files, CRM exports and documentation returned within [five] business days in [format]; (2) accounts, shared folders and scripts moved to a Client-controlled identity; (3) logins, devices and tokens disabled on [last day]; (4) remaining copies deleted and confirmed in writing, except data a statute requires the Assistant to keep.
Drafting order matters. A scope written after the rate is agreed tends to describe the rate, not the work. Write Exhibit 1 in this order.
From our placement records. We counted the client virtual assistant searches opened between October 6 and November 6, 2026: 19 searches, after excluding our own always-open application posting and one repeat search for the same seat. All 19 named a US time zone, 17 named exact clock hours, and 10 were part-time, at 10 to 20 hours a week or marked part-time. Clients know their overlap before they hire, so put it in Section 3(b).
Price step four against the market, because virtual assistant cost moves with role, region and hours. Virtustant virtual assistants start at $7/hr all-in, and the median client-side rate for VA placements was $10.10/hr (n=24) in the H1 2026 cohort of 441 placement starts in our 2026 Nearshore Rate Report.
The label in the agreement decides nothing. The U.S. Department of Labor's misclassification guidance describes the final rule published on January 10, 2024 and effective March 11, 2024: six factors under the Fair Labor Standards Act, none with a predetermined weight, read in the totality of the circumstances. The same page records that on February 26, 2026 the Department announced a Notice of Proposed Rulemaking, with comments due April 28, 2026. Check it for the rule in force the day you sign.
The IRS test sorts the evidence into behavioral control, financial control and the relationship of the parties. It asks who directs the work, who carries expenses and tool investment, whether the worker serves the wider market, and how permanent the relationship is.
| DOL factor | Points toward contractor | Points toward employment |
|---|---|---|
| Opportunity for profit or loss | Assistant prices projects and can gain or lose | Fixed hourly pay with no project risk |
| Investment | Assistant supplies own tools or workspace | Client supplies all tools |
| Permanence | Project work with a defined end | Open-ended ongoing role |
| Nature and degree of control | Results-based; assistant chooses methods | Client sets when, where and how |
| Integral to the business | Separate supporting service | Core function inside the client's team |
| Skill and initiative | Independent business judgment | Routine work on set procedures |
In the drafting, that means: describe results, not methods. Avoid fixed daily hours unless the scope needs them, skip training programs or reviews that copy a staff job, and keep tools, expenses and payment in their own clauses.
Settle the role shape before you fill in the template. Consider worker status when planning is a Georgia law firm's note that uses a misclassification lawsuit to argue the decision belongs at the business-planning stage. The route you choose also changes who signs what; compare staffing models with Virtustant to see how direct hire, freelancer and managed placement differ. Then check the assistant's country, whose own test reads the working relationship, not the paragraph you signed.
Confidentiality gives you a remedy after information has moved. Access controls decide whether it moves at all. A one-page NDA that defines confidential information and requires return on request leaves logins, exports, breach notice and deletion unstated.
Least privilege is role-specific. Map the role to named systems and permission levels; a part-time inbox assistant rarely needs export rights over the customer database. Credentials live in a password manager, not a chat thread, so cutting access is one action. Generative AI is limited to an approved list.
Set the incident clock in hours. For covered financial institutions, the FTC Safeguards Rule guidance defines a notification event as unauthorized acquisition of unencrypted information of at least 500 consumers, with notice to the FTC as soon as possible and no later than 30 days after discovery. The rule may not reach you; your contract should still name who notifies and on what clock.
Schedule A then turns a promise of secrecy into instructions, security measures and a written deletion confirmation. If your draft only has a nondisclosure clause, contractor confidentiality agreements explained covers what that document does once someone holds a login.
"The client owns everything" fails in three places: it doesn't say when ownership transfers, what the assistant keeps, or whether it survives the assistant's local law.
WIPO's guidance on intellectual property in business contracts sets the starting point: IP ownership often begins with its creator, and even when someone creates IP for you under a contract, you may not legally own it. Rights move through an assignment, and contractor agreements need to say what the company owns and what the contractor keeps.
So define deliverables by type, use a present assignment with an exclusive fallback license, list background tools and templates in Schedule B, require disclosure of open-source material, and add a notice-and-cure window for infringing material.
Residual access is the risk a termination clause has to control. Notice, for example 14 days' written notice, starts a clock either party can trigger; immediate termination covers a material security breach. On the final day the client disables logins, device enrollments and API tokens. The proof sits in an identity-provider log, a permission export and a token inventory: Schedule C's proof column.
Name the systems, format and window for returning files. Move ownership of accounts and scripts to a client-controlled identity, because a password reset alone leaves the assistant as owner. The closing test: can you confirm return, transfer, revocation and deletion from your own records, without relying on good faith?
An assistant abroad works under the labor, tax and social security rules of the country where they live, and those rules can override the contract whatever state law it names. Three routes split that work differently.
| Route | The professional contracts with | Who handles pay and paperwork | What the client still owns |
|---|---|---|---|
| Direct contractor agreement | The client, directly | The client pays; who files what depends on both countries' rules, so ask an accountant | Every clause in this template |
| Provider-managed contract (Virtustant's standard placement) | The provider; not an employment relationship | The provider handles contracts, payroll and the paperwork on the professional's side; one weekly invoice per placement | Data access, its own NDA and IP terms, day-to-day direction |
| Employer of record (Virtustant's EOR option, or an EOR platform) | A local employer, under a local employment contract | The employer of record runs local payroll under that contract | Data access, its own NDA and IP terms, day-to-day direction |
A provider-managed contract moves the professional's contract, payroll and paperwork to the provider. It does not move your side: you still decide access, still need IP terms for your work product, and still direct the work. Whatever the route, write down governing law, venue and which mandatory local rules override. Our cross-border payroll guide covers the payment sequence.
Virtustant is a remote staffing agency. In a standard placement, the professional contracts with Virtustant, not with you, and it is not an employment relationship. Virtustant handles contracts, payroll and the paperwork on the professional's side. You direct the day-to-day work and get one weekly invoice per placement, with zero placement fees, month-to-month terms and a lifetime replacement guarantee.
Our NDA and IP protection page spells out your side. Your professional signs your NDA, or ours, before day one. If you want a written IP assignment, you add it to your terms and it is signed with the NDA. You grant and control every account permission. Sections 6, 7, 9 and Schedule C of this template become your checklist for that conversation.
Every candidate runs the same funnel: 100% apply, 22% clear the recruiter screen, 9% pass cognitive (IQ), skills and English testing, 3% reach a live interview, 1% are hired (see our vetting process). You get a shortlist of 3 to 5 vetted candidates within 48 hours of your first call, and your hire can start in 72 hours. Virtual assistants start at $7/hr all-in, under a third of the $23.23/hr May 2025 median wage the Bureau of Labor Statistics reports for secretaries and administrative assistants. See the pricing page and our virtual assistant services. Clients rate us 4.9/5 on G2.
Rather not draft and track the contract yourself? Book a discovery call and bring your NDA.
Eight clauses: scope with acceptance criteria, payment, worker status, confidentiality, system access, intellectual property, termination and governing law. Attach a scope exhibit and schedules for data processing, pre-existing materials and an access and exit record.
Not automatically. The U.S. Department of Labor and the IRS look at how the work is actually done, including control, investment, permanence and pay. A contractor label does not decide status if daily practice looks like a staff job, and the assistant's country applies its own test.
Usually not, if the clause defines protected information, the standard exclusions and how long the duty lasts. What most contracts lack is access rules: named accounts, multifactor authentication, approved AI tools, an incident clock and an exit record.
Without a written assignment, the creator may keep the rights. Use a present assignment of work product, a fallback license where assignment fails, and a schedule of the pre-existing materials the assistant keeps.
There is no single rule for a contractor agreement. Fourteen days of written notice is a common working example, with immediate termination for a material security breach. The exit procedure matters more: files returned, accounts moved and access revoked on a named date.
If the assistant handles personal data of customers or staff, a data processing schedule sets instructions, security, subprocessors, transfers and deletion. GDPR Article 28 lists those elements and works as a baseline even where the GDPR may not apply.
Yes, for your side. With Virtustant, the professional contracts with Virtustant, which handles contracts, payroll and the paperwork on their side. You still set the NDA or IP terms signed before day one, grant and remove access, and direct the work.
