SaaS Agreements: 12 Provisions Businesses Should Review Before Signing
Software-as-a-service agreements can allocate risks that extend far beyond the subscription price. For a material SaaS transaction, the useful question is not whether the vendor has a “standard contract,” but how the complete contract package allocates operational, data, intellectual-property and financial risk.
Start With the Complete Contract Package
A SaaS transaction may include a master agreement, order form, statement of work, service-level agreement, data-processing addendum, security terms and policies incorporated by hyperlink. The documents should identify which terms control if they conflict and whether a vendor can change incorporated online terms unilaterally.
1. Scope, Implementation and Acceptance
Define the functionality being purchased and any implementation, migration, configuration, integration or training obligations. For implementation-heavy projects, milestones and acceptance criteria can matter as much as the license itself.
2. Pricing, Usage and Renewal
Review implementation fees, user or usage charges, minimum commitments, overages, price increases, renewal mechanics and notice deadlines. A favorable first-year price can become much less favorable if renewal pricing is unrestricted or the cancellation window is easy to miss.
3. Service Levels and Support
Uptime percentages should be tested against exclusions, maintenance windows, measurement methodology and remedies. If service credits are the exclusive remedy, determine whether they meaningfully compensate the customer for repeated or serious failures.
4. Customer Data and Permitted Uses
Ownership language is only the beginning. The agreement should address use of customer data for analytics, aggregation, de-identification, artificial-intelligence or machine-learning purposes, subprocessors, return of data and deletion after termination.
5. California Privacy and Security Obligations
Where the customer is a business subject to the California Consumer Privacy Act and the vendor acts as a service provider or contractor, California regulations impose specific contractual restrictions on the processing and use of personal information. Separate California law also makes breach-notification timing important: a business maintaining covered personal information it does not own may have an obligation to notify the owner or licensee immediately following discovery of a qualifying breach.
The contract should therefore address security standards, incident reporting, cooperation, subprocessors, audits or certifications, disaster recovery and cyber-insurance requirements where appropriate.
6. Intellectual Property
Distinguish the vendor's pre-existing software from customer data, custom deliverables, configurations and other work created during implementation. The contract should also address feedback rights and the extent to which either party can reuse materials developed during the relationship.
7. IP Indemnification
Vendor IP indemnities commonly exclude claims caused by customer modifications, combinations with products not supplied by the vendor, or customer-provided content. They may also give the vendor the option to modify or replace the affected service or terminate and refund specified fees. Those details can determine how useful the indemnity is when an infringement claim actually occurs.
8. Other Indemnification
Depending on the transaction, indemnities may address data-security incidents, confidentiality breaches, legal violations or misuse of the service. Defense obligations, settlement control and cooperation requirements should be read together with the indemnity itself.
9. Limitation of Liability
A liability cap may be based on fees paid during a specified period, total contract fees or another negotiated amount. The parties should identify which claims are capped, which are excluded from the cap, and which categories of damages are waived.
California law also places limits on contractual exculpation. Civil Code section 1668 can invalidate provisions that purport to exempt a party from responsibility for fraud, willful injury or violations of law, and California's 2025 New England Country Foods v. VanLaw Food Products decision confirms that parties cannot use a contractual limitation to shield willful injury merely because the parties are sophisticated businesses.
10. Suspension and Termination
Review suspension rights for nonpayment, alleged security risks and acceptable-use violations, particularly if the platform is operationally critical. Termination provisions should address breach, cure periods, repeated service failures, refunds and transition obligations.
11. Data Return and Exit
Specify export format, post-termination access, migration assistance, deletion timing and any additional charges. A contractual right to receive data has limited value if the export is unusable by a replacement system.
12. Read the Risk Provisions Together
A strong security promise can be undermined by a very small liability cap. A termination right can be weakened if the customer immediately loses access to essential data. A service-level promise may offer little protection if service credits are the sole remedy. Review the documents as a connected allocation of risk rather than as isolated clauses.
What About SaaS Vendors?
Vendors drafting their own subscription terms face the mirror-image questions: how to define the service precisely, protect proprietary technology, control acceptable use, manage privacy obligations and place commercially workable boundaries around warranties and liability.
For a material software transaction, businesses can review these issues before execution through the firm's contract drafting and review practice. The firm's earlier guide to what to check before signing a California business contract addresses several related California contract issues.
This article is for general informational purposes and is not legal advice.
