How to Read a SaaS Contract Before You Sign

Who owns your data, and can they train AI on it?

Start with the data clause, because it outlasts the subscription. The contract should say plainly that you own your data and that the vendor gets only a limited license to host and process it in order to provide the service. Then hunt for the quiet expansion: a right to use your data to "improve our services," to build "aggregated and anonymized" datasets, or, increasingly, to train AI or machine-learning models. "Improve" sounds harmless until you realize your customer records, support tickets, or documents may be feeding a model that serves your competitors.

If the vendor needs analytics to run the product, fine, but the license should be limited to providing the service to you. Ask for an explicit statement that your data will not be used to train AI models without your written consent. Vendors are getting this request weekly now; the good ones already have an opt-out.

How does SaaS auto-renewal work, and when must you cancel?

Most B2B SaaS contracts renew automatically for another full term unless you cancel within a notice window, commonly 30, 60, or even 90 days before the renewal date. Miss a 90-day window on an annual contract and you have bought another year, and courts generally enforce that, because you agreed to it.

Two defenses. First, put the deadline on your calendar the day you sign, with a reminder a month early. Second, negotiate the window down: 30 days is a reasonable ask, and some vendors will agree to renewal only on your affirmative consent. Several states also require vendors to send a renewal reminder for some contract types, but do not rely on a statute to save you from a missed date.

Liability cap vs. your real exposure

Nearly every SaaS contract caps the vendor’s total liability, and the default cap is small: often the fees you paid in the last 12 months, sometimes as little as one month. Now run the numbers on your side. If this tool holds your customer data and the vendor’s security failure causes a breach, your costs, notification, credit monitoring, legal exposure, lost customers, can run to many multiples of your annual subscription. A $500-a-month tool with a one-month cap leaves you carrying essentially all of that risk.

The standard middle ground in real negotiations: a general cap of 12 months of fees, plus carve-outs, higher or uncapped liability, for data breaches caused by the vendor, breaches of confidentiality, and the vendor’s indemnification obligations. Smaller vendors will resist unlimited exposure, but a "super-cap" of 2–3x fees for data incidents is a common landing zone.

Can a SaaS vendor raise prices at renewal?

Check what happens to the price at renewal. Many contracts let the vendor raise prices unilaterally, sometimes with as little as 30 days’ notice, and the increase lands right when switching costs are highest, after your team is trained and your data is inside. Annual increases of 8–10% on renewal are not rare.

Ask for a cap: renewal increases limited to a fixed percentage (5–7% is a common ask) or to an inflation index. If the vendor will not cap it, at least secure a longer notice period, 60–90 days, so a surprise increase leaves you time to evaluate alternatives before the auto-renewal window closes. Note how those two clocks interact: a price-change notice that arrives after your cancellation deadline has passed is a trap worth negotiating away explicitly.

Start with the order form

The order form usually sets the products, price, term and renewal, and it often states that it overrides the master agreement where they conflict. Read it first, then read the master agreement with the order form's terms in mind. Many surprises, such as a three-year term or a 90-day notice period, sit in the order form, not the general terms.

Security and breach notification

Check what the vendor promises about security, such as encryption, access controls and certifications like SOC 2, and how quickly it must tell you about a breach. If you share personal data, you will usually need a data processing addendum setting out how the vendor handles it and which subprocessors it uses.

Indemnities

A fair SaaS contract includes an indemnity from the vendor against claims that its software infringes third-party intellectual property. Be cautious about broad indemnities you give the vendor, which should be limited to your misuse of the service or your own content.

Does the law add any protections to a SaaS contract?

Less than most buyers expect. Business software contracts are mostly governed by general state contract law, and courts have not agreed on whether a SaaS subscription counts as a sale of goods under Article 2 of the Uniform Commercial Code (UCC), the sales law adopted in some form across the states. Some courts apply Article 2 to software, others treat hosted services as services that fall outside it, and many borrow its principles by analogy. Either way, the written contract does most of the work.

Article 2 does explain one familiar oddity: warranty disclaimers written in capital letters. Under UCC § 2-316(2), a seller who wants to exclude the implied warranty of merchantability must mention merchantability, and a written exclusion must be conspicuous. Excluding the implied warranty of fitness for a particular purpose must be done in a conspicuous writing. Language such as "as is" can also exclude implied warranties under § 2-316(3)(a). That is why the disclaimer paragraph shouts. In practice it means the vendor promises only what is written elsewhere, so the specific commitments in the SLA, the security exhibit and the documentation are your real warranties.

Article 2 also lets contracts limit remedies. Under UCC § 2-719(3), consequential damages such as lost profits may be limited or excluded unless that is unconscionable, and courts rarely find such limits unconscionable between businesses. If a promised remedy fails of its essential purpose, for example a repair promise the vendor never delivers, § 2-719(2) can reopen the ordinary remedies, but that is a narrow escape hatch rather than a plan.

Privacy law is the main area where statutes add required terms. If you send personal information about California residents to the vendor, the California Consumer Privacy Act requires your contract to limit the vendor to specified purposes and to require privacy protection at the level the law demands (Cal. Civ. Code § 1798.100(d)). Our guide to data processing addendums covers that in detail. For everything else, assume the contract is nearly the whole deal and negotiate the specifics.

When can you terminate a SaaS contract, and what happens to your data?

Check when you can terminate: for the vendor's material breach, for chronic SLA failures, or for convenience. Then check what happens to your data: how long you have to export it, in what formats, and when it will be deleted. Our guide on getting your data out when you cancel covers this in detail.

A worked example

A 20-person agency signs a project management tool's order form for a three-year term with a 90-day non-renewal notice, 7% annual increases and a liability cap of one month's fees. Reading the order form first, it negotiates a one-year term, 30-day notice, a 5% cap and a 12-month liability cap. The master agreement it had been worried about barely changed; the order form did the work.

Quick checklist

• Order form: term, price, renewal and notice period.
• Data: ownership, AI training, export and deletion.
• Security: commitments, breach notice and data processing addendum.
• Liability: cap, exclusions and data breach cap.
• Indemnity: vendor IP indemnity included.
• Exit: termination rights and data export window.

Pricing and seats

Check how usage is counted, whether you can reduce seats during the term, and whether extra usage is billed at your discounted rate or list price. True-ups billed retroactively at list price are a common surprise. Our guide to per-seat pricing traps explains what to negotiate. Also check whether taxes, onboarding fees and premium support are included in the quoted price, because they often are not.

Keep a copy of what you agreed

Online terms change. Save a dated PDF of the terms, order form and any policies referenced when you sign, so you can show what applied if a dispute arises later.

When to get help

For large, multi-year or data-heavy contracts, a legal review is worth the cost.

Uptime / SLA and data export

An uptime promise without a remedy is marketing. A real SLA states a number (99.9% is common), defines how downtime is measured, and gives you service credits automatically or on request when the vendor misses it. Check whether credits are your only remedy, and whether repeated failures, say, missing the SLA three months running, give you the right to terminate without penalty. That termination right is what actually keeps vendors honest.

Finally, plan the exit on the way in. The contract should give you a window after termination, 30 days is typical, to export your data in a usable format before the vendor deletes it, at no extra charge. Ask what "usable format" means for your data specifically; a CSV dump of a database you cannot reconstruct is technically an export. Vendors delete quickly after termination for their own compliance reasons, so if the export window is missing, add it.