Ask HN: How do small startups handle customized changes to terms and policies?

More and more, customers of our relatively small startup (https://CoCalc.com) have been emailing us to say "Based on the review of the terms/privacy policy, we can only contract for services with the signed modification to your terms." These typically come from universities or high schools, both in the US and Europe. Our official Terms of Service (which were drafted in consultation with a reputable law firm) are here: https://cocalc.com/policies/. The changes that are requested by customers are often described as being required by local law. For example, a university in Texas added a bunch of requirement including "you will not boycott Israel", among many other changes. The most recent request from a school has numerous new terms involving precisely how security of the site is periodically audited, data about how students will be shared (e.g., it will never be stored outside the USA), etc. QUESTION: what do some other small startups do in situations like this? It seems like our realistic options are (1) pay lawyers and hope it pays off later, (2) do the best we can, but without official legal advice, (3) just say no unless the customer lifetime value exceeds some threshold, (4) just say yes to any reputable client, irregardless of size, and possibly subject ourselves to some surprise liability down the road. Regarding (4), these customers are very reputable universities and schools who are just trying to comply will all local laws and best support their student's privacy -- they are not malicious or trying to take advantage of us. The requirements mostly seem reasonable and something we can comply with, assuming I understand them correctly. So far we have done some combination of (1) and (2). When we ask the universities what happens when they deal with companies, they will do things like tell stories about how different it was to deal with Microsoft and Apple, which isn't really helpful, since those companies are massive.