SaaS subscription agreement

What it is and when it is used

A SaaS (software as a service) subscription agreement is used when a provider operates a software platform and a customer wants to access and use it over the internet, rather than install it. The customer pays a subscription; the provider hosts the service, keeps it running, supports it and protects the data placed in it.

Dealroom's SaaS agreement is built as a framework with an Order Form: a separate document signed by both parties that sets the service plan, the number of Authorized Users, the Subscription Term and the Fees. The agreement itself then fixes the legal and operational terms: what the customer may do with the service, what the provider commits to in terms of availability and support, who owns the data, how the subscription renews and ends, and how much each party can be liable for.

It suits business customers buying access to a hosted platform for their internal business purposes. The access right it grants is non-exclusive, non-transferable and cannot be sublicensed.

Who signs it and in which role

Two parties sign:

• The Provider: the business that operates the software-as-a-service platform.
• The Customer: the business that wants to access and use the service.

The Customer's employees, agents and independent contractors whom it authorises to use the service are the Authorized Users. They do not sign the agreement, but the Customer must ensure they comply with it and must keep their login credentials secure, without sharing them between several people.

Key clauses

The agreement has ten negotiated clauses and a set of standard clauses that apply in every case.

Uptime service level

The percentage of time the provider commits to keep the service available, measured each calendar month. Options: 99.99%, 99.9%, 99.5%, or commercially reasonable efforts with no fixed percentage. Each additional "nine" means roughly ten times less downtime. Scheduled maintenance (with at least 48 hours' notice where reasonably possible), emergency maintenance, force majeure and downtime caused by the customer are excluded from the calculation.

Support response time

How quickly the provider must acknowledge support requests. Options range from premium 24/7 support (1 hour for critical issues) through standard business-hours support (4 hours for critical issues) to basic email-only support with a 24-hour target. The skill notes that "response" means acknowledgement, not resolution.

Customer data ownership

The customer always keeps ownership of its data. The negotiation is about the licence the provider receives: limited to providing the service; extended to aggregated and anonymised data for analytics and product improvement, provided the data cannot identify the customer or individuals; or a broad worldwide licence to analyse and create derivative works for product development.

Data export rights

How long the customer's data remains available for export after the subscription ends: 30, 60 or 90 days. After that period the data is deleted. The skill describes data portability as critical to avoid being locked in to one provider.

Termination rights

Whether the customer can end the subscription early and at what cost: a locked term with no early termination; termination for convenience on 60 days' notice with a fee of 50% of the remaining fees; or termination by either party on 90 days' notice with no fee.

Auto-renewal terms and price change notice

Whether the subscription renews automatically for equal periods (with 30 or 60 days' notice to stop renewal) or must be renewed actively by the customer. A separate clause sets how much notice (30, 60 or 90 days) the provider must give before changing prices for a renewal term.

Liability cap

The maximum amount either party can be liable for. Options: fees paid in the 12 months before the claim; direct damages only, capped at the same 12 months of fees; or an enhanced structure where breaches of data security obligations carry a cap of three times the 12-month fees. The standard clauses exclude indirect damages and take certain claims outside the cap, including indemnification, breach of confidentiality, unpaid fees and wilful misconduct or gross negligence.

Security standards

Which independent certification the provider must maintain during the subscription: SOC 2 Type II, ISO 27001, or both.

Governing law and jurisdiction

Where disputes are resolved: the default courts of the governing-law jurisdiction (San Francisco, London or Madrid), Delaware courts, or JAMS, ICC, AAA or LCIA arbitration. A custom option lets the parties name their own governing law and courts in the deal details.

Standard clauses

Every SaaS agreement also includes: grant of access, usage restrictions (no resale, reverse engineering, malicious code or exceeding usage limits), customer responsibilities, the provider's ownership of its platform and of feedback, service availability and maintenance, data protection (encryption in transit and at rest, access controls, breach notice within 72 hours), suspension rights, confidentiality, warranties and disclaimers, indemnification, limitation of liability, force majeure and the usual general provisions.

What the two sides usually negotiate

The Provider generally prefers lower commitments and more revenue certainty; the Customer generally prefers stronger commitments and more freedom to leave. When the two sides choose different options, Dealroom proposes the balanced position:

• Uptime: the Provider leans to 99.5% or commercially reasonable efforts; the Customer to 99.99%. The middle ground is 99.9%, which the skill calls the industry standard.
• Support: the middle ground is standard business-hours support with a 4-hour response for critical issues.
• Data ownership: the Provider leans to a broad licence; the Customer to full ownership with a limited licence. The middle ground is customer ownership plus the provider's use of aggregated, anonymised data.
• Termination: the Provider prefers a locked term; the Customer prefers termination on notice without a fee. The position closest to the middle is early exit with a fee.
• Renewal and pricing: the middle ground is auto-renewal with 60 days' notice to cancel and 60 days' notice of price changes.
• Data export: the middle ground is 60 days after termination.
• Liability: the Provider leans to direct damages only; the Customer to an enhanced cap for data breaches. The middle ground is 12 months of fees.
• Security: SOC 2 Type II or ISO 27001 alone sits near the middle; requiring both favours the Customer.

All dispute-resolution options are treated as neutral between the parties.

Jurisdictions and languages Dealroom supports for it

Dealroom drafts the SaaS agreement under the law of California, England and Wales or Spain, in English or Spanish. Each jurisdiction adds its own provisions:

• California: auto-renewal disclosure under the California Automatic Renewal Law (clear terms before purchase, an acknowledgment and an online cancellation mechanism), a jury waiver, and CCPA/CPRA service-provider obligations.
• England and Wales: exclusion of third-party rights, liability that cannot be excluded (such as fraud, or death or personal injury caused by negligence), Consumer Rights Act 2015 rights where applicable, and UK GDPR processor obligations with a data processing agreement under Article 28.
• Spain: compliance with the LSSI-CE, interpretation in good faith and under the Civil Code rules, and GDPR and LOPDGDD obligations with a data processing agreement under Article 28 of the GDPR.

Common mistakes

• Missing the auto-renewal rules in California. The skill warns that California law requires clear and conspicuous disclosure of auto-renewal terms before payment is accepted, a cost-effective way to cancel and renewal reminders. Manual renewal avoids these disclosure requirements.
• Choosing a short cancellation window without tracking it. With a 30-day notice period the customer may miss the window and be renewed for a full further term.
• Treating "response" as "resolution". Support response times only guarantee acknowledgement of the request.
• Granting a broad data licence without reading its scope. The skill notes that a broad provider licence may include uses of identifiable data. Aggregated use requires genuine anonymisation.
• Leaving export too late. After the agreed export window, customer data is deleted.
• Asking for more than is needed. The skill notes that 99.99% uptime, 24/7 support and dual certification come at premium prices and may be excessive for most uses.
• Forgetting the data processing agreement. Where the provider processes personal data for the customer, a separate data processing agreement is required.

# 1. Read the clauses, options and the facts it needs
curl https://dealroom.todo.law/api/v1/agent/templates/SAAS \
  -H "Authorization: Bearer drk_YOUR_KEY"

# 2. Create the contract (clauses you leave out take the default option)
curl -X POST https://dealroom.todo.law/api/v1/agent/deals \
  -H "Authorization: Bearer drk_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "schema": "dealroom.solo-intake/1",
    "contractType": "SAAS",
    "governingLaw": "ENGLAND_WALES",
    "language": "en",
    "dealName": "Example SAAS",
    "selectionPolicy": "defaults"
  }'