SaaS Agreement Checklist

What a SaaS agreement actually governs

A SaaS agreement is the master contract that lets your company access hosted software over the internet in exchange for a recurring fee, rather than buying or installing the software outright. Because you never take possession of the code, the contract is really about access rights, service quality, and what happens to your data, not about ownership of a product.

Most SaaS deals are built from several documents that are read together:

• The master subscription agreement (MSA) or terms of service, which sets the legal framework.
• One or more order forms that fix price, quantity, and subscription term.
• A service level agreement (SLA) covering uptime and support response.
• A data processing addendum (DPA) governing personal data.
• Acceptable use, security, and privacy policies referenced by URL.

Confirm which documents form the contract and whether the vendor can change any of them unilaterally after signature. A policy the vendor can edit at any time is a term you have not really negotiated. Note the order of precedence too: when the order form, the master agreement, and a referenced policy conflict, the contract should say which document wins so a favorable order-form term is not quietly overridden by boilerplate.

Core commercial terms to confirm

The commercial terms decide what you pay and for how long, so read them against the order form line by line. Small drafting choices here, such as auto-renewal windows, price caps, and usage overages, are where budgets quietly break.

Check each of the following:

• Fees and what they include. Confirm per-seat or usage pricing, the currency, and whether implementation, support, and integrations are extra.
• Subscription term and renewal. Note the initial term, the auto-renewal length, and the notice period to cancel, which is often 30 to 60 days before renewal.
• Price increases. Look for a cap on uplift at renewal; an uncapped increase clause is a red flag.
• Overages and true-ups. Understand how the vendor measures usage and bills for exceeding your plan.
• Payment terms and taxes. Confirm invoicing cadence, net payment days, and who bears applicable sales tax.

If any figure differs between the order form and the marketing quote, resolve it in writing before signing. Watch for evergreen clauses that renew automatically for successive terms, since a missed cancellation notice can lock you into another full year at a higher rate. Where you expect to grow, negotiate the price of additional seats now rather than accepting undefined list pricing at the point of expansion.

Service levels, support, and continuity

A SaaS product is only as good as its availability, so the SLA deserves as much attention as the price. Look past the headline uptime percentage to the definitions and remedies that make it enforceable.

Confirm the following:

• The uptime commitment, for example 99.9%, and exactly how downtime is measured and excluded.
• The remedy for missed SLAs, which is usually a service credit, and whether credits are your sole remedy.
• Support tiers, response times by severity, and hours of coverage.
• Maintenance windows and how much advance notice you receive.
• Business continuity and disaster recovery commitments, including backup frequency and recovery objectives.

Service credits rarely compensate for the true cost of an outage, so weigh the SLA against how critical the tool is to your operations. Ask whether the vendor publishes a live status page and historical uptime, and whether repeated SLA failures give you a right to terminate without penalty. For a system that runs a core workflow, that termination right is often more valuable than the credits themselves.

Data, security, and privacy

Because your data lives on the vendor’s infrastructure, the data and security terms are the heart of a SaaS agreement. These clauses determine who may access your information, how it is protected, and whether you can get it back.

Work through this list:

• Data ownership. The contract should state clearly that your company retains ownership of its data and content.
• Permitted use. Restrict the vendor to processing your data only to provide the service, and scrutinize any right to use data for product improvement or model training.
• Security controls. Look for recognized standards such as SOC 2 or ISO 27001, encryption in transit and at rest, and access controls.
• Data location and subprocessors. Confirm where data is hosted and whether you are notified before new subprocessors are added.
• Breach notification. Check the deadline for notifying you of a security incident and what information you receive.
• Privacy compliance. If you handle personal data, require a DPA and confirm alignment with applicable state privacy laws.
• Return and deletion. Confirm you can export data in a usable format and that the vendor deletes it after termination.

Pay particular attention to any clause that lets the vendor use your content to train machine learning models, because it can quietly convert your confidential data into a shared asset. As a point of comparison, Pactolane strips personally identifiable information before any AI processing and hosts data in Europe under AES-256 encryption, which is a useful benchmark for the posture you ask a vendor to meet.

Liability, indemnities, and exit

The final block of the checklist covers what happens when something goes wrong. These terms are heavily negotiated because they allocate real financial risk between the parties.

Review the following:

• Limitation of liability. Note the cap, which is often tied to fees paid in the prior 12 months, and any carve-outs for data breaches, IP infringement, or confidentiality.
• Indemnification. Confirm the vendor indemnifies you against third-party IP claims, and understand your reciprocal obligations.
• Warranties and disclaimers. Check what the vendor actually warrants versus what is disclaimed on an “as is” basis.
• Termination rights. Identify when either party can terminate, including for material breach and for convenience.
• Effect of termination. Confirm your transition rights, data retrieval window, and any refund of prepaid fees.
• Governing law and disputes. Note the governing state law, the venue, and whether disputes go to arbitration.

Your pre-signature checklist

Use this condensed list as a final gate before signature, and keep a copy of the completed version with the executed contract so future reviewers can see what was checked:

• Every document that forms the contract is identified and attached.
• Price, term, renewal, and notice period match the order form.
• Price-increase and overage mechanics are capped or clearly understood.
• The SLA has a measurable uptime figure and a defined remedy.
• Data ownership, export, and deletion rights are explicit.
• Security standards and breach-notification timelines are documented.
• The liability cap and its carve-outs are acceptable to your business.
• Termination and transition rights protect continuity if you leave.

A SaaS agreement checklist only works when it is applied consistently across every renewal and every new vendor, which is where disciplined contract management pays off. Storing signed agreements in a searchable repository, setting renewal and notice-period alerts, and keeping an audit trail turns a one-time review into an ongoing control. PactAI supports that review by spotting key clauses, extracting terms like renewal dates and liability caps, and scoring risk on a 0 to 100 scale so a reviewer sees the weak points fast, while the human, guided by counsel, still makes every decision. Used this way, the checklist and the platform reinforce each other without replacing professional legal advice.