Cloud services agreement: what it is and what to include

What a cloud services agreement is

A cloud services agreement (sometimes called a cloud subscription agreement, cloud computing agreement, or, for pure software, a SaaS agreement) is a contract in which a provider grants a customer the right to access and use cloud-hosted software or infrastructure over the internet in exchange for a recurring fee. Rather than delivering a copy of software or a physical product, the provider hosts the service on its own or a hyperscaler’s infrastructure and gives the customer a limited, non-exclusive right to use it for the duration of the subscription. The customer pays per user, per unit of consumption, or on a fixed subscription, and the provider commits to keep the service available and secure.

Cloud services fall into three broad models, and the agreement should make clear which one applies. Software as a service (SaaS) gives the customer a finished application, such as a CRM or accounting tool. Platform as a service (PaaS) gives the customer a development and deployment environment. Infrastructure as a service (IaaS) gives the customer raw compute, storage, and networking. The deeper the customer’s control over the stack, the more the agreement has to allocate responsibility for configuration, patching, and security between the two sides.

The defining feature of a cloud services agreement is that the customer never takes possession of the software or hardware; it consumes a service that lives on the provider’s systems. That single fact drives most of the terms that follow. Because the provider holds the customer’s data and controls uptime, the contract has to address availability, data protection, security, and what happens to the data when the relationship ends. In the United States, these agreements are governed by general contract law and the specific terms the parties negotiate, together with sector rules such as HIPAA for health data or state privacy statutes like the CCPA where personal information is involved. Larger deals are typically structured as a master agreement with attached order forms, service level agreements, and a data processing addendum, so the commercial terms can change per order without renegotiating the whole contract.

Key terms and clauses to include

A well-drafted cloud services agreement fixes both the commercial deal and the operational realities of running a hosted service. The core provisions are:

• Service description and scope. Define exactly what the customer is buying, which modules or capacity are included, and how the service may be used, including any usage limits or acceptable use restrictions.
• Grant of rights. State that the customer receives a limited, non-exclusive, non-transferable right to access the service for the subscription term, and reserve all other rights to the provider.
• Service levels (SLA). Set targets for availability (uptime), support response times, and maintenance windows, define exactly how each is measured, and state the remedy when targets are missed, usually service credits.
• Fees and payment. Specify the pricing model, billing frequency, what triggers overage charges, how renewals are priced, and any caps on price increases.
• Data ownership and use. Confirm the customer retains ownership of its data, restrict how the provider may use it, and address whether aggregated or anonymized data may be used to improve the service.
• Data protection and privacy. Attach a data processing addendum that allocates controller and processor roles, lists subprocessors, sets breach notification timelines, and addresses cross-border transfers where relevant.
• Security. Commit the provider to defined security controls such as encryption in transit and at rest, access controls, and recognized certifications, and state audit or reporting rights.
• Confidentiality. Protect each side’s non-public information and define permitted uses and the duration of the obligation.
• Intellectual property. Confirm the provider owns the service and any improvements, and address ownership of customer configurations, integrations, and custom code.
• Warranties and disclaimers. State the service warranty, disclaim implied warranties to the extent permitted, and clarify that the service is provided on a subscription rather than error-free basis.
• Indemnification. Allocate responsibility for third-party claims, typically the provider for IP infringement and the customer for its own data and misuse.
• Limitation of liability. Cap each side’s exposure and carve out exclusions such as breach of confidentiality, data protection violations, or indemnity obligations.
• Term, renewal, and termination. State the initial term, auto-renewal mechanics, notice periods, termination for cause and convenience, and the consequences of suspension for non-payment.
• Data return and deletion (exit). Require the provider to export the customer’s data in a usable format on exit and to delete it after a defined period, to avoid lock-in.
• Governing law and dispute resolution. Name the governing state law, venue, and whether disputes go to litigation, mediation, or arbitration.
• Boilerplate. Add assignment, subcontracting, notices, force majeure, entire agreement, severability, and amendment provisions.

When you need one

You need a cloud services agreement any time your business delivers software or infrastructure as a hosted service, or any time you procure one for internal use. Common triggers include launching a SaaS product and onboarding your first paying customers, signing an enterprise buyer who insists on negotiated terms rather than click-through terms, procuring a cloud platform to run a critical workload, or adopting a tool that will hold personal or regulated data.

A cloud services agreement protects both sides. For the provider, it defines the scope of the license, caps liability, secures payment, and disclaims responsibility for how the customer uses the service. For the customer, it locks in availability commitments and remedies, secures ownership of its data, guarantees the ability to export that data on exit, and pins down the security and privacy obligations that regulators and the customer’s own contracts require. Signing before go-live matters, because a hosted service that holds live customer data on a handshake creates real exposure the moment there is an outage, a breach, or a billing dispute.

Common pitfalls

Several avoidable mistakes turn a routine subscription into a costly fight:

• Vague or toothless SLAs. An uptime number with no measurement method and no remedy is marketing, not a commitment, and leaves the customer with nothing when the service goes down.
• Silent data exit terms. Failing to guarantee data export and deletion on termination is the most common cause of vendor lock-in and stranded data.
• Missing data processing addendum. Where personal data is involved, omitting a DPA can put both sides offside of privacy law and downstream customer commitments.
• Unlimited or mismatched liability. Leaving liability uncapped, or capping it below the real exposure from a data breach, misallocates risk that a security incident will crystallize.
• Auto-renewal surprises. Renewal and notice windows slip past busy teams, locking the customer into another term or a price increase it never approved.
• Confusing the models. Treating an IaaS or PaaS deal like a finished SaaS application leaves security and configuration responsibilities unassigned between the parties.
• Version chaos. Redlines traded by email leave teams unsure which draft is final, and signed order forms get lost against the wrong master agreement.

This is where disciplined contract management matters. A central contract repository keeps every executed cloud services agreement, order form, and SLA in one searchable place with a full audit trail, so no commitment, renewal date, or data obligation is lost. Renewal and deadline alerts flag notice windows before they expire, approval workflows with eIDAS-compliant electronic signature move a draft to signature without email chaos, and reusable templates keep your standard terms consistent across customers. PactAI can prepare the review by scoring risk from 0 to 100, flagging conflicts between a negotiated order form and the master terms, running the draft against a compliance playbook, and generating a plain-language executive summary in any of six languages, while your team makes the final call on every clause. Pactolane strips personal data before AI processing and hosts in Europe with AES-256 encryption, so sensitive commercial and security terms stay protected. There is no .docx download here; a cloud services agreement is only as strong as the discipline behind how it is stored, reviewed, and renewed across its full lifecycle.

This page provides general legal information, not legal advice.