The terms of the lease are fairly illegal. The relevant statute is here. A security deposit must be deposited in a separate account (1e), a signed receipt must be given upon receipt of the deposit (2b), the deposit must go in an interest-bearing account with a receipt showing name and location of bank and account number provided within 30 days (3a), also note that "Failure to comply with this paragraph shall entitle the tenant to immediate return of the security deposit". Subsection 4 requires returning the deposit within 30 days (not "waiting at least 30 days", much less 30 working days), minus deductions for damage, specified under 4(iii) as damage excluding normal wear and tear (light bulbs burning out). This does not include cleaning. and "No deduction may be made from the security deposit for any purpose other than those set forth in this section".
Subsection 6 says:
The lessor shall forfeit his right to retain any portion of the
security deposit for any reason, or, in any action by a tenant to
recover a security deposit, to counterclaim for any damage to the
premises...
and the conditions triggering that forfeiture include under (6a) failing to deposit the funds per (3), or (6c)
uses in any lease signed by the tenant any provision which conflicts
with any provision of this section and attempts to enforce such
provision or attempts to obtain from the tenant or prospective tenant
a waiver of any provision of this section
which may be the case here and (6e)
fails to return to the tenant the security deposit or balance thereof
to which the tenant is entitled after deducting therefrom any sums in
accordance with the provisions of this section, together with any
interest thereon, within thirty days after termination of the tenancy.
("within" means "after N days or less").
Subsection 7 states that
If the lessor or his agent fails to comply with clauses (a), (d), or
(e) of subsection 6, the tenant shall be awarded damages in an amount
equal to three times the amount of such security deposit or balance
thereof to which the tenant is entitled plus interest at the rate of
five per cent from the date when such payment became due, together
with court costs and reasonable attorney's fees.
And subsection (8) statutorily states DaleM's point about contract terms not being above the law:
Any provision of a lease which conflicts with any provision of this
section and any waiver by a tenant or prospective tenant of any
provision of this section shall be deemed to be against public policy
and therefore void and unenforceable.
It would be interesting to see if the Massachusetts courts interpret this as being an automatic severability clause.
[Addendum]
Security deposit law in Massachussets seems to be one of those cases where professional legal advice is virtually mandatory. Subsection 3a says
Any security deposit received by such lessor shall be held in a
separate, interest-bearing account in a bank, located within the
commonwealth under such terms as will place such deposit beyond the
claim of creditors of the lessor, including a foreclosing mortgagee or
trustee in bankruptcy, and as will provide for its transfer to a
subsequent owner of said property
An attorney would be typically required to understand what the italicized portions mean. A reasonable interpretation would be that you have to set up an escrow bank account on behalf of the tenant. To do that, though, the tenant must cooperate to some extent (providing a Social Security number, providing acceptable ID). There is no law requiring a tenant to cooperate, which apparently puts the landlord in a legal bind.
The trick is that the statute has been interpreted "functionally" in Karaa v. Kim 86 Mass. App. Ct. 714 citing Neihaus v. Maxwell 54 Mass. App. Ct. 558 as simply meaning that the landlord cannot deposit the security money into their own personal bank account. In Neihaus, the landlord handed the problem over to a property management company, which had in place suitable accounting procedures so that the desiderata of being beyond the claim of creditors, being in a bank in the commonwealth, and being separate, were satisfied. In the case of Karaa, the tenants did not ever supply a Social Security number: the court ruled that the tenants action did not excuse violation of the statute, stating "The failure of the tenants to provide a Social Security number did not preclude the Karaas from establishing a separate account in compliance with § 15B(3)(a)". A Massachussets attorney with specialization in this area would know this, and that is why one needs to hire an attorney.