7 clauses to check before signing a SaaS agreement

1. Service description and scope

Start with what you're actually buying. Many SaaS contracts describe the service by reference to a website page or "documentation" that the supplier can change at any time. If the feature you bought the product for isn't described in the contract, you may have no remedy if it disappears.

Check whether the supplier can modify the service unilaterally, and whether that right is limited to changes that don't materially reduce functionality. If a specific module, integration or user limit matters to you, get it into the order form.

2. Service levels and support

A service level agreement (SLA) sets out uptime commitments and support response times. Look at three things: the uptime percentage, how it's measured, and what you get if it's missed.

• Is scheduled maintenance excluded from the calculation, and is there a cap on it?
• Are service credits the "sole and exclusive remedy" for downtime? If so, you may be unable to terminate even after repeated outages.
• Is there a right to terminate if the SLA is missed several months in a row?

If the platform is business-critical, a termination right for persistent SLA failure is a reasonable request.

3. Limitation of liability

Almost every SaaS agreement caps the supplier's liability, often at the fees paid in the previous twelve months. That cap can be very low compared to the damage a data breach or prolonged outage could cause your business.

Check whether the cap is mutual, what it's calculated on, and whether certain losses sit outside it. Data protection breaches and confidentiality breaches are commonly negotiated as separate, higher caps. Also check that your own liability as the customer is capped, not just the supplier's.

Liability is a topic of its own, so I've written a separate guide to limitation of liability clauses.

4. Data protection and security

If the software processes personal data on your behalf, UK GDPR requires a written contract with the supplier as your processor, covering the terms set out in Article 28. This is usually a data processing agreement (DPA) attached to the main terms.

• Is there a DPA, and does it cover the mandatory processor terms?
• Where is the data stored, and are international transfers covered by an appropriate mechanism such as the UK International Data Transfer Agreement or Addendum?
• How quickly will the supplier notify you of a personal data breach?
• Can you get a list of sub-processors and object to new ones?

5. Term, renewal and price increases

Auto-renewal is standard in SaaS. The risk is a renewal notice window you miss, locking you into another year, sometimes at a higher price. Look for the notice period required to stop renewal and any right for the supplier to increase fees on renewal.

A cap on renewal price increases (for example, linked to an inflation index or a fixed percentage) is a common and reasonable ask. Put the cancellation deadline in your calendar the day you sign.

6. Termination and exit

Read what happens when the contract ends, not just how it ends. The most important question is whether you can get your data back, in a usable format, within a reasonable period before it's deleted.

Also check whether you can terminate for convenience, whether prepaid fees are refunded if the supplier terminates or materially breaches, and whether there's any help with migration.

7. Intellectual property and your data

The supplier will own its software; that's expected. What you need to confirm is that you own your data and any outputs you create, and that the supplier's licence to use your data is limited to providing the service.

Watch for broad rights to use "aggregated" or "anonymised" data, and, increasingly, rights to use your data to train AI models. If that matters to you, ask for an opt-out or a clear restriction.

Can you negotiate SaaS terms?

With the very largest providers, often not. With most B2B SaaS suppliers, especially on annual contracts, there is more room than people expect. Suppliers frequently accept a short order-form amendment on renewal caps, data return or liability for data breaches. Asking costs nothing; not asking can cost a lot. [ADD SOURCE-BACKED STATISTIC]