Before You Sign a SaaS Agreement: The Terms That Carry the Risk

This post is informational and reflects general practice as of August 2026. Contract terms vary; for a specific agreement, consult a licensed attorney.

Most SaaS agreements arrive as a vendor’s standard form, presented as non-negotiable. A lot of it is boilerplate. But the risk is not spread evenly across the document; it concentrates in a handful of clauses. If you read only a few things before signing, read these.

1. Your data: who owns it, who can use it

The agreement should say clearly that you own your data and the vendor is a processor acting on your instructions, not a party free to use your data for its own purposes. Watch for language letting the vendor use your data to “improve its services” or train models. If you handle personal data, there should be a data processing addendum (DPA) with the required processor terms and a current subprocessor list. No DPA, or a vague one, is a red flag when personal data is involved.

2. Security and breach notification

Look for a concrete security commitment (a security exhibit, a named framework, or a current SOC 2 / ISO 27001 attestation) rather than a promise to use “reasonable” measures with nothing behind it. Then find the breach-notification clause: how fast must the vendor tell you if it is breached? “Without undue delay” is soft; a defined window (for example, 48 or 72 hours) is what lets you meet your own downstream notification obligations. A vendor that will not commit to a timeline is telling you something.

3. The liability cap, and what escapes it

The limitation-of-liability clause decides what the vendor actually owes you when something goes wrong. Two things matter. First, the cap itself, often 12 months of fees, which can be trivial against the cost of a real incident. Second, the carve-outs: breaches of confidentiality, data-security failures, and IP indemnity should sit outside the general cap (or under a higher super-cap). A mutual cap with data and confidentiality carved out is a very different deal from a one-sided cap that swallows everything.

4. Indemnification

At minimum, the vendor should indemnify you if its product infringes someone else’s intellectual property, that is standard, and its absence is a real gap. Read the indemnity you are giving in return just as closely; vendor forms sometimes ask the customer to indemnify broadly for “use of the service,” which can quietly hand back more than you got.

5. Term, auto-renewal, and price increases

This is where money leaks. Note the initial term, the auto-renewal mechanism, and the notice window to prevent renewal (often 30 to 60 days before the term ends, which is easy to miss). Check whether the vendor can raise prices at renewal, and by how much. An uncapped renewal increase plus a short cancellation window is how a “flexible” subscription becomes sticky.

6. Termination and getting your data back

Before you depend on a system, know how you leave it. The agreement should give you a defined window after termination to export your data in a usable format, and require the vendor to delete it afterward. If data return and deletion are silent or discretionary, you can find your business data stranded in a vendor you are trying to exit.

The bigger picture

None of this requires rewriting the vendor’s contract. It requires reading the few clauses that carry the risk and negotiating the ones that are genuinely lopsided, which vendors accommodate more often than their “standard form” posture suggests. The same list works from the other side of the table: if you sell SaaS, these are the terms your customers’ counsel will push on, and having defensible positions ready shortens every deal. (For the AI-specific version of this, see Contracting With Agentic AI Vendors, and the firm’s Technology Transactions practice.)

If you are about to sign, or send, a SaaS agreement and want the risk clauses handled, talk to MB Legal.

This post is informational and does not constitute legal advice. SaaS agreements vary widely by product, data, and use case. For guidance on a specific contract, consult a licensed attorney.