Software as a service agreement

A software subscription is a contract in which the customer never receives the thing they are paying for. They get access, for as long as they keep paying and the supplier keeps running. Everything that matters follows from that: what happens if the service is down, what happens to the data when the subscription ends, and who carries the loss when something goes wrong.

This template is for business to business supply. It is not suitable for consumer customers, who have statutory rights that cannot be excluded, and it is not a licence for software installed on the customer's own systems, which is a different document with different risks.

The schedules carry the deal

Three of them, and the agreement does not function without any one. Schedule 1 holds the services, the fees, the subscription term and renewal. Schedule 2 holds the service levels and the service credits. Schedule 3 holds the data processing particulars that Article 28 of the UK GDPR requires, because a SaaS supplier is almost always a processor of its customers' personal data and the contract has to say so in the prescribed detail.

Leaving a schedule to be agreed later is the standard way these contracts go wrong. The commercial conversation has moved on by then, and the party who wanted the detail has lost the leverage to get it.

Liability, and the clause with two answers

Clause 14 offers two positions on the cap for data protection claims: inside the general cap, or carved out with its own higher limit. Suppliers prefer the first, enterprise customers increasingly insist on the second, and it is one of the two or three points a procurement team will actually negotiate. Decide which position the business can defend before the contract goes out, rather than conceding it under time pressure at the end of a sales cycle.

If the software uses AI, say so

Clause 8 deals with customer data. If the software uses artificial intelligence, or if you want to use customer data to train or improve a model, that has to be stated expressly in Schedule 1 rather than read into a general right to use data for service improvement. Customers are asking the question in procurement now, and a supplier whose contract is silent while its product does it has a problem that surfaces at renewal or at diligence.

Exit

What happens at the end deserves as much attention as what happens at the start: how long the data stays available for export, in what format, and when it is deleted. A customer who cannot get their data out is locked in, and a supplier who deletes too quickly acquires a claim.

Our technology solicitors negotiate these on both sides of the table, and the data protection team handles Schedule 3 and the transfer position where hosting sits outside the UK.