SaaS agreements govern access to software hosted and maintained by a provider rather than installed on the customer’s own systems. Harper James is a UK full-service commercial law firm that advises businesses on SaaS agreements under the laws of England and Wales.
The agreement should identify the service, permitted users, usage limits, implementation responsibilities and support arrangements. It should also state the subscription fee, invoicing cycle, payment terms, renewal process and rules for price changes. A growing business should check whether additional users, storage or functionality trigger extra charges, and whether the provider can change the service without consent.
Service levels should cover availability, support response times, maintenance windows and remedies for repeated failures. Service credits are common, but the contract should explain how they are calculated and whether they are the customer’s only remedy. The agreement should also deal with subcontractors, customer audits and any restrictions on transferring the contract as the business grows or is acquired.
The contract should distinguish the provider’s software and documentation from the customer’s data, content and account information. It should state the rights each party receives, including any licence to use customer data to operate the service. Where the provider processes personal data, the agreement should include appropriate UK GDPR provisions covering processing instructions, security, sub-processors, data breaches, international transfers and assistance with data subject requests.
Liability provisions require particular attention. They normally address exclusions for indirect losses, financial caps and separate treatment for matters such as confidentiality breaches, intellectual property infringement, data protection obligations and unpaid fees. The agreed wording should reflect the service’s importance, the information held within it and the business’s ability to replace the service if it fails.
Termination clauses should cover material breach, insolvency, prolonged service failure, non-payment and termination for convenience where negotiated. They should also specify notice periods, data export formats, assistance with migration, deletion or return of data, and access during any transition period. Before signing, a business should map its critical data and workflows against these provisions, confirm who owns each implementation task, and record agreed changes in the final order form or statement of work.