SaaS Agreement Review: What an IT Lawyer Looks for Before You Sign

A SaaS agreement can look straightforward until the commercial and legal provisions are considered together.

The agreement may establish a subscription price and term, but it can also determine who owns intellectual property, what happens to customer data, what service levels must be maintained, whether the customer can terminate early, what happens after a security incident and how much liability the technology company assumes if something goes wrong.

For SaaS, software and technology companies, these issues become particularly important when negotiating enterprise customer agreements.

Larger customers often have established procurement processes, their own contract templates and detailed requirements relating to information security, privacy, intellectual property, indemnification and liability.

That means a SaaS contract review should involve more than confirming that the agreement contains the standard legal clauses.

An IT lawyer reviewing a SaaS or software agreement should consider how the contract works as a whole, whether it reflects the commercial transaction and whether the obligations being accepted are consistent with the company's actual operations and risk tolerance.

What Is a SaaS Agreement Review?

A SaaS agreement review is a legal and commercial assessment of the contract governing access to software-as-a-service.

Depending on the transaction, the review may involve:

• the SaaS agreement itself;

• a Master Services Agreement;

• an order form;

• one or more Statements of Work;

• a Service Level Agreement;

• privacy or data processing terms;

• information-security schedules;

• acceptable use terms;

• support documentation; and

• other incorporated policies or schedules.

This is important because the risk in a SaaS transaction is not necessarily contained in one document.

A favourable provision in the MSA may be undermined by broader language in a security schedule.

A liability cap may contain exceptions elsewhere in the agreement.

An order form may introduce customer-specific terms that conflict with the standard agreement.

A proper IT contract review therefore requires the documents to be considered together.

1. Does the Contract Match the Commercial Deal?

One of the first questions should be surprisingly simple:

Does the contract accurately reflect what the parties believe they agreed to?

An IT lawyer reviewing the agreement may compare the legal documents against the commercial transaction, including:

• products being purchased;

• subscription fees;

• implementation fees;

• number of users;

• usage limits;

• initial term;

• renewal periods;

• payment timing;

• implementation requirements;

• support commitments; and

• additional services.

Commercial inconsistencies can create problems even where the legal drafting itself is technically sound.

For example, the sales proposal may refer to a one-year subscription while the agreement automatically renews for additional two-year periods.

Or the proposal may describe implementation as a limited service while the Statement of Work creates significantly broader obligations.

Legal review should identify these inconsistencies before the agreement is signed.

2. What Exactly Is the SaaS Provider Required to Deliver?

Scope is fundamental.

The agreement should distinguish between the software subscription itself and any additional services being provided.

These may include:

• implementation;

• onboarding;

• configuration;

• data migration;

• integrations;

• consulting;

• customization;

• training;

• support; and

• professional services.

The more complex the transaction becomes, the more important this distinction becomes.

A SaaS company should understand where its obligations begin and end.

If the customer expects something that the agreement does not clearly define, the dispute may eventually become one about scope, delays or additional fees.

3. Are the Customer's Responsibilities Clear?

Technology projects rarely depend entirely on the software provider.

Customers may need to:

• provide accurate information;

• supply data;

• provide system access;

• make employees available;

• obtain third-party permissions;

• make decisions;

• approve deliverables;

• complete testing; or

• comply with technical requirements.

Those dependencies matter.

If a provider promises an implementation date but completion depends on information the customer has not provided, the contract should address the consequences.

A well-drafted SaaS agreement allocates responsibilities to both sides rather than documenting only the provider's obligations.

4. What Are the Subscription, Renewal and Cancellation Terms?

Recurring revenue is central to many SaaS business models.

An IT contract lawyer reviewing a SaaS agreement should therefore pay particular attention to:

• the initial term;

• automatic renewal;

• renewal periods;

• non-renewal deadlines;

• price increases;

• termination for convenience;

• termination for cause;

• refund obligations; and

• what happens to prepaid fees after termination.

These provisions can directly affect revenue predictability.

For example, a customer request for a broad termination-for-convenience right may materially change the economics of a multi-year subscription.

The provision should therefore be evaluated commercially, not merely as another legal clause.

5. Can the Customer Change the Scope Without Paying More?

Scope creep is particularly relevant where a SaaS transaction includes implementation or professional services.

The agreement should establish whether changes to:

• deliverables;

• functionality;

• integrations;

• timelines;

• assumptions;

• customer requirements; or

• project resources

require a formal change request.

Without a change-control process, additional requests can gradually become part of the provider's expected services without corresponding adjustments to price or timing.

This is one reason coordinated SaaS agreement drafting and review should consider the MSA and SOW together.

6. Who Owns the Intellectual Property?

Intellectual property provisions can have consequences far beyond an individual customer transaction.

A SaaS provider will generally want to preserve ownership of its platform, underlying technology and pre-existing intellectual property.

But enterprise agreements frequently raise more difficult questions concerning:

• custom development;

• configurations;

• integrations;

• professional-services deliverables;

• documentation;

• modifications;

• improvements;

• customer materials;

• feedback; and

• derivative technology.

A broadly drafted ownership provision can potentially give a customer rights that the provider did not intend to transfer.

That is especially important where similar functionality may later be used for other customers.

An IT lawyer reviewing a software contract should therefore distinguish carefully between the different categories of intellectual property involved.

7. What Rights Does the Provider Have to Customer Data?

Customer-data provisions should accurately reflect how the platform operates.

Questions may include:

• Who owns customer data?

• What rights does the provider need to process it?

• Can the provider use aggregated information?

• Can data be de-identified?

• Can data be used for analytics?

• Can data be used to improve the service?

• What happens to data after termination?

• How long is data retained?

• Can the customer export its data?

The agreement should not give the provider broader rights than it actually needs.

At the same time, the provider must have sufficient contractual permission to perform the services it has agreed to provide.

8. Does the Contract Reflect the Company's Privacy Practices?

Privacy provisions should not exist independently from operational reality.

A contract may contain extensive privacy commitments, but the relevant question is whether the company actually operates in accordance with them.

An IT contract review may therefore need to consider:

• categories of personal information involved;

• purposes for processing;

• storage locations;

• subprocessors;

• international transfers;

• retention practices;

• security safeguards;

• incident procedures; and

• applicable privacy requirements.

Enterprise customers may also provide their own data processing addendum.

Those documents should be reviewed with the main agreement because additional privacy terms can materially increase the provider's obligations.

9. What Cybersecurity Commitments Is the Company Making?

Cybersecurity schedules deserve particular attention.

Customers may request obligations concerning:

• encryption;

• access controls;

• authentication;

• vulnerability management;

• penetration testing;

• employee security;

• backups;

• disaster recovery;

• incident response;

• security certifications;

• business continuity;

• subprocessors; and

• notification following security incidents.

The central issue is not simply whether those commitments sound reasonable.

It is whether the provider can actually meet them.

Technology companies should be cautious about accepting contractual representations concerning systems, certifications or practices they do not maintain.

A security warranty that exceeds operational reality can create contractual exposure even if no security incident occurs.

10. Are the Service Levels Realistic?

Enterprise SaaS agreements often contain Service Level Agreements or SLA provisions.

These may establish:

• uptime;

• service availability;

• maintenance exclusions;

• support hours;

• response times;

• resolution targets;

• service credits; and

• escalation procedures.

A SaaS provider should understand precisely how availability is calculated.

For example, does the agreement exclude:

• scheduled maintenance;

• customer-caused outages;

• third-party failures;

• internet failures;

• force majeure events; or

• emergency maintenance?

The difference between a seemingly straightforward 99.9% uptime commitment and the actual contractual obligation can be significant.

11. What Happens If the SLA Is Missed?

The next question is remedies.

If the provider misses an uptime target, does the customer receive:

• a service credit;

• a refund;

• damages;

• termination rights;

• some combination of these remedies?

The agreement should also clarify whether service credits are the customer's exclusive remedy for a service-level failure.

Otherwise, a customer may attempt to claim both the contractual service credit and additional damages.

12. What Warranties Is the SaaS Company Giving?

Warranties establish contractual promises concerning the product or services.

A customer may request warranties that:

• the software will perform in accordance with documentation;

• the services will be performed professionally;

• the software will be uninterrupted;

• the software will be error-free;

• the system will be completely secure;

• the services will comply with all laws; or

• the technology will satisfy the customer's business requirements.

Some commitments may be commercially reasonable.

Others may be too broad or impossible to guarantee.

An IT lawyer reviewing a SaaS agreement should distinguish between commitments the provider can reasonably stand behind and absolute warranties that may create disproportionate exposure.

13. What Is the Provider Indemnifying?

Indemnification can be one of the most consequential provisions in a software agreement.

A SaaS provider may be asked to indemnify the customer against third-party claims involving:

• intellectual property infringement;

• privacy;

• data security;

• regulatory violations;

• confidentiality;

• negligence; or

• other contractual obligations.

The wording should identify clearly:

• what triggers the indemnity;

• which claims are covered;

• who controls the defence;

• whether consent is required for settlement;

• what exclusions apply; and

• whether the indemnity is subject to the limitation of liability.

An indemnity should not be reviewed in isolation.

Its financial consequences often depend on the liability clause.

14. What Is the Maximum Liability Under the Agreement?

One of the most important questions in any software contract review is:

What is the company's maximum potential contractual exposure?

A limitation of liability provision may tie liability to:

• fees paid during the previous 12 months;

• fees paid and payable;

• total contract fees;

• fees under a particular order form;

• a fixed dollar amount; or

• another agreed measure.

But identifying the headline liability cap is only the beginning.

The review must also identify any exceptions.

Claims may be:

• subject to the general cap;

• subject to a higher "supercap"; or

• completely uncapped.

Our separate article on limitation of liability in SaaS agreements examines this issue in greater detail.

15. Are There Hidden Exceptions to the Liability Cap?

This is a particularly important part of SaaS contract review.

An agreement might appear to cap liability at 12 months of fees.

Later, however, it may state that the limitation does not apply to:

• confidentiality;

• privacy;

• security;

• indemnification;

• intellectual property;

• violations of law;

• gross negligence;

• wilful misconduct; or

• numerous other obligations.

A long list of carve-outs can materially reduce the protection provided by the general cap.

The contract needs to be read as a whole.

16. Does the Contract Give the Customer Broad Termination Rights?

Termination provisions should be assessed against the business model.

Enterprise customers may request termination for:

• material breach;

• repeated SLA failures;

• security incidents;

• regulatory concerns;

• change of control;

• convenience; or

• other specified events.

A broad termination-for-convenience right can be particularly significant in a multi-year SaaS agreement.

If the provider has priced the transaction based on a longer commitment, allowing the customer to leave at any time may fundamentally alter the economics.

The issue may therefore require both legal and commercial consideration.

17. What Happens to Customer Data After Termination?

Termination does not necessarily end the provider's obligations immediately.

The agreement may require:

• continued access for a transition period;

• data export;

• assistance migrating to another provider;

• retention for a specified period;

• deletion certifications; or

• transition services.

A technology company should understand what it will actually be required to do after the revenue relationship ends.

18. Are Third-Party Services Properly Addressed?

Modern SaaS platforms often rely on third parties.

These may include:

• cloud hosting;

• APIs;

• payment processors;

• communications tools;

• analytics providers;

• artificial intelligence providers;

• external integrations; and

• other infrastructure.

A provider should consider whether the customer agreement makes it responsible for services outside its direct control.

Absolute commitments concerning third-party availability or performance can create unnecessary exposure.

19. Does the Agreement Address Artificial Intelligence?

For companies incorporating AI into their products or services, existing agreements may need additional review.

Relevant questions can include:

• Who owns customer inputs?

• Who owns generated outputs?

• Can customer information be used for training?

• Are third-party AI models involved?

• Are outputs guaranteed to be accurate?

• What human review is expected?

• Can customers use the AI functionality for prohibited purposes?

• How are intellectual property risks allocated?

A SaaS agreement written before the company introduced AI functionality may no longer reflect the product being sold.

This is one of several circumstances where broader contract modernization may be appropriate.

20. Can the Contract Be Assigned if the Company Is Sold?

Assignment provisions often receive relatively little attention during routine negotiation.

They can become extremely important during an acquisition.

A customer agreement that cannot be assigned without customer consent may create difficulties in a future corporate transaction.

Technology companies should therefore examine whether:

• assignment requires consent;

• internal reorganizations are permitted;

• change of control is treated as an assignment;

• assignment to an affiliate is permitted; and

• a purchaser of substantially all assets can assume the agreement.

Contract drafting should consider not only today's customer transaction but also future corporate events.

21. Which Law Governs the Agreement?

Enterprise customers may ask the SaaS provider to accept the law of another province, state or country.

The implications depend on the transaction.

A company should understand:

• which law governs;

• where disputes must be heard;

• whether arbitration applies;

• whether the customer can sue in another jurisdiction; and

• whether multiple documents contain conflicting dispute provisions.

This becomes particularly important for technology businesses selling internationally.

22. Are Important Terms Hidden in Incorporated Documents?

Software contracts often incorporate external documents by reference.

These may include:

• privacy policies;

• security standards;

• acceptable use policies;

• support policies;

• SLAs;

• product documentation;

• online terms; and

• customer procurement policies.

The contract should be reviewed to determine exactly what external documents become legally binding.

An agreement should not inadvertently incorporate obligations the technology company has never reviewed.

23. Does the MSA Conflict With the SOW or Order Form?

Where multiple agreements are used, document hierarchy becomes critical.

The contract should establish what happens if:

• the MSA conflicts with the SOW;

• the order form conflicts with the MSA;

• an SLA contains different remedies;

• a security schedule contains broader warranties; or

• customer procurement terms conflict with negotiated legal terms.

Our article on MSA vs. SOW for SaaS and IT companies addresses contract hierarchy in greater detail.

From a review perspective, however, one principle is essential:

The documents should be reviewed together.

24. Is the Agreement Operationally Usable?

A strong contract should do more than protect the company during litigation.

It should work during the relationship.

That means sales should understand:

• what it can promise;

• what pricing can be changed;

• which terms require approval;

• when an SOW is required; and

• which customer requests require legal review.

Operations should understand:

• implementation obligations;

• customer dependencies;

• support requirements;

• reporting commitments; and

• escalation procedures.

Finance should understand:

• invoicing;

• payment terms;

• renewals;

• credits;

• refunds; and

• termination consequences.

A contract that nobody inside the business can operationalize is not an effective contract.

Reviewing Customer Paper vs. Reviewing Your Own SaaS Agreement

There is also an important distinction between reviewing the company's own agreement and reviewing a customer's contract.

Reviewing the Company's Own SaaS Agreement

The objective may be to determine whether the standard agreement continues to support:

• the current product;

• current pricing;

• enterprise customers;

• data practices;

• implementation services;

• security commitments;

• AI functionality; and

• the company's evolving risk profile.

If significant parts of the business have changed, the company may need more than isolated amendments.

It may require a broader SaaS contract modernization exercise.

Reviewing a Customer's MSA or Procurement Agreement

The analysis is different when the customer provides its contract.

The agreement was typically drafted to protect the customer.

A technology provider may therefore encounter:

• broader warranties;

• extensive indemnification;

• unlimited liability;

• stringent security obligations;

• broad audit rights;

• customer ownership of work product;

• termination for convenience;

• most-favoured pricing provisions;

• extensive insurance requirements; or

• obligations inconsistent with the company's standard position.

An IT contract lawyer can identify where the customer's agreement materially departs from the provider's normal contractual framework and help prioritize the provisions requiring negotiation.

Not Every Contract Issue Has the Same Commercial Importance

One of the most useful parts of a sophisticated contract review is prioritization.

A 60-page enterprise agreement can contain hundreds of provisions.

Not every provision justifies delaying a deal.

A technology company should understand which issues are:

• High risk and require revision

• Commercial decisions requiring management input

• Acceptable with limited changes

Low risk and not worth significant negotiation

This matters because contract review should support the transaction rather than turn every sentence into a negotiation point.

A good legal review should help the business understand where the real risk is.

When Should a SaaS or Software Company Use an IT Lawyer for Contract Review?

Legal review may be particularly useful where:

• the contract is material to the business;

• the customer has provided its own MSA;

• the agreement contains unlimited or significant liability;

• intellectual property ownership is unclear;

• security obligations are extensive;

• customer data is sensitive;

• the transaction includes significant implementation;

• the customer requests broad indemnification;

• the contract contains termination-for-convenience rights;

• multiple agreements or schedules apply;

• the company is entering a new market;

• the agreement will become a precedent for future deals; or

• management cannot readily determine the company's exposure.

An IT lawyer, SaaS lawyer or software contract lawyer should not simply identify unfavourable language.

The objective should be to determine what matters commercially, what can reasonably be negotiated and what risk the business is prepared to accept.

SaaS and IT Contract Review for Technology Companies

Delta Law advises SaaS, software and technology companies on the drafting, review and negotiation of commercial contracts.

Our SaaS and IT contract services include:

• SaaS agreement drafting and review;

• software contract review;

• IT contract review;

• Master Services Agreement review;

• MSA drafting;

• Statement of Work drafting and review;

• software licensing agreements;

• Service Level Agreements;

• customer procurement agreements;

• vendor technology agreements;

• contract negotiation; and

• SaaS and IT contract modernization.

For companies negotiating commercial agreements on a recurring basis, Delta Law also provides ongoing legal support designed to support sales, procurement and contract-management needs.

Looking for an IT Lawyer to Review a SaaS or Software Agreement?

If your company has received a SaaS agreement, MSA, software contract or technology procurement agreement, understanding the commercial and legal exposure before signing can help prevent difficult issues later.

Delta Law assists technology businesses with SaaS agreement review, IT contract review, software contract review, drafting and negotiation.

Book a Consultation

Frequently Asked Questions About SaaS Agreement Review

What does a SaaS contract lawyer review?

A SaaS contract lawyer may review provisions concerning scope, fees, subscription terms, intellectual property, customer data, privacy, cybersecurity, service levels, warranties, indemnification, limitation of liability, termination and dispute resolution.

The lawyer should also consider how the documents interact with the commercial transaction.

Can an IT lawyer review a customer's software contract?

Yes. Technology companies frequently receive customer-drafted MSAs, procurement agreements and security schedules. An IT lawyer can review the proposed terms, identify contractual exposure and assist with negotiating revisions.

Should a SaaS agreement be reviewed before signing?

Legal review may be appropriate where the agreement is financially significant, contains material legal obligations, involves sensitive data or intellectual property, or will establish an important customer or vendor relationship.

What is included in an IT contract review?

The scope depends on the transaction but can include reviewing the agreement and supporting schedules, identifying legal and commercial risks, proposing revisions and assisting with negotiation.

Can a lawyer review an MSA and SOW together?

Yes. Where the MSA and SOW form part of the same transaction, reviewing them together can help identify inconsistent terms, unclear document hierarchy and gaps between the legal and operational requirements.

Can an IT lawyer negotiate a SaaS agreement?

Yes. Legal counsel can assist with reviewing customer redlines, preparing revisions, advising on fallback positions and negotiating contractual provisions with the other party or its counsel.

What are the biggest risks in a SaaS agreement?

The answer depends on the business and transaction, but material issues frequently include intellectual property, customer data, cybersecurity obligations, warranties, indemnification, limitation of liability, termination rights and contract hierarchy.

How much does SaaS agreement review cost?

The legal fees will depend on matters such as the length and complexity of the agreement, number of supporting schedules, value of the transaction and extent of negotiation required. A lawyer can generally determine the appropriate scope after reviewing the documents and understanding the transaction.