SaaS Agreement Checklist: 15 Clauses You Must Have Before Signing
SaaS vendors write contracts that protect them, not you. Here are the 15 clauses every buyer should verify before signing.
Why SaaS agreements deserve extra scrutiny
SaaS contracts are uniquely risky because you’re not buying software — you’re renting access. The vendor controls the infrastructure, the data, the uptime, and the feature set. If the relationship goes wrong, you need contractual protections to get your data out.
Most SaaS vendors present standard Terms of Service and expect you to accept as-is. But everything is negotiable, especially on annual contracts over $10K.
The 15 essential clauses
1. Service Level Agreement (SLA): Minimum 99.9% uptime with service credits.
2. Customer Data Ownership: You own your data. Vendor gets a limited processing license only.
3. Data Security Standards: TLS 1.2+ in transit, AES-256 at rest, SOC 2 Type 2, annual pen testing.
4. Breach Notification: 48–72 hour notification timeline.
5. Data Portability and Export: Export at any time in standard formats at no cost.
6. Sub-Processor Controls: Prior consent, 30-day notice, objection rights.
7. AI Training Restrictions: No using your data to train AI models without consent.
8. Service Modifications: 30-day notice before material changes.
9. API Stability: 90-day deprecation notice and backward compatibility.
10. Termination for Convenience: Either party can exit with notice and pro-rata refund.
11. Data Retention and Deletion: Export for 30 days post-termination, deletion within 90 days.
12. Limitation of Liability: 12 months’ fees with carve-outs for data breaches.
13. Acceptable Use Policy: Ensure your use cases aren’t accidentally prohibited.
14. Auto-Renewal Terms: 60-day opt-out window minimum with pricing cap.
15. Disaster Recovery: RPO and RTO commitments with annual testing.
The clause most people miss: AI training restrictions
AI training restrictions are the newest and most frequently missing clause. Without an explicit prohibition, many vendors’ ToS grant them a broad license to use your data for "product improvement" — which increasingly means training ML models.
Your proprietary data could end up improving a product that your competitors also use. The fix: the vendor shall not use your data to train AI models without explicit written consent.
Watch out: Without an AI training restriction, your vendor may use your proprietary data to train models that benefit your competitors. This is the most important new clause in SaaS contracts.
Download free SaaS Agreement template
Free, no account required.