SaaS agreement template

What an uptime commitment has to specify

"Commercially reasonable efforts to make the service available" is not a service level. It creates no measurable entitlement and no remedy. A real SLA needs four things.

A stated availability percentage, measured over a defined period. 99.9% monthly allows about 43 minutes of downtime; 99.5% allows about 3.6 hours. The measurement period matters as much as the number — the same percentage measured annually rather than monthly permits a single long outage to be absorbed.

A definition of unavailability. Is the service down only when completely inaccessible, or also when a core function fails or response times degrade past a threshold? Vendor definitions tend to be narrow, and a service that is technically up but unusably slow will often not count.

The exclusions. Scheduled maintenance is universally excluded and commonly requires advance notice and a defined window. Also watch for exclusions covering the customer's own network, third-party providers and force majeure, which between them can absorb a large share of real-world downtime.

And the credits. These are the remedy, and they are almost always expressed as the sole and exclusive one — typically a percentage of monthly fees on a sliding scale, often requiring the customer to claim within a short period. Credits rarely approach the cost of an outage, so the important addition is a chronic failure termination right: if the SLA is missed in, say, three months out of any twelve, the customer may terminate without penalty and recover prepaid fees. That converts a discount into an exit.

• A stated percentage with a monthly measurement period
• A definition of unavailability covering degradation, not just total outage
• Limited, specified exclusions with advance notice for maintenance
• Credits plus a chronic-failure termination right

Who owns the data, and what the vendor may do with it

Start with an unambiguous statement that the customer owns its data and that the vendor receives only a limited license to process it as necessary to provide the service. That ownership statement is the foundation for everything else.

Then look at what the vendor may do beyond providing the service. Rights to use customer data for product improvement, analytics or training machine learning models have expanded significantly in recent vendor paper, and they are frequently incompatible with the customer's own commitments — a company that promised its users their information would not be used to train third-party models cannot grant that right to a vendor.

A commonly negotiated position permits the vendor to use aggregated and de-identified data that cannot reasonably be attributed to the customer or any individual, for service improvement, and requires express written consent for anything more. If model training is permitted at all, it should be opt-in, specific about what data is used, and subject to the same confidentiality and security commitments as everything else.

Privacy compliance sits alongside this. Where personal information is involved a data processing addendum is required, and what it has to cover depends on whose information is involved and where they are. goHeather asks what the service will hold and prompts for the addendum where one belongs, covering the ground these arrangements usually address: what the vendor may use the data for, whether it may be shared onward, how long it is kept and what its own subcontractors are held to. Which regimes reach your business is worth settling once with privacy counsel rather than per contract.

How security commitments are usually expressed

"Industry standard security measures" commits to nothing. A meaningful security clause names specifics: encryption in transit and at rest with stated standards, access controls, logging, penetration testing frequency, and personnel screening — usually set out in a security schedule attached to the agreement.

Certifications are the practical shorthand. SOC 2 Type II is the common baseline for enterprise SaaS, with ISO 27001 frequently alongside it, and sector-specific frameworks such as HITRUST for healthcare or FedRAMP for federal buyers. Require the certification to be maintained throughout the term, with reports provided annually, and require notice if it lapses.

Breach notification is where the drafting matters most. The customer has its own statutory obligations of its own if something goes wrong, often on a clock that starts the moment the incident is discovered. If the vendor's obligation is to notify "promptly" or "without undue delay", the customer may not learn in time to meet its own deadline. Ask for a fixed period — 72 hours or less from discovery is the common enterprise position — along with an obligation to cooperate in the investigation and in any regulatory notification.

Then check where breach liability sits. Data breach costs scale with the number of records, not with the subscription fee, so a breach capped at twelve months of fees can leave the customer bearing most of an incident. A super-cap for data breach — a multiple of fees, or a separate stated figure — is a standard enterprise ask, and cyber insurance with the customer named as an additional insured is worth requiring alongside it.

The two dates that decide what SaaS costs you

Almost every SaaS agreement renews automatically. The two dates that matter are the renewal date and the notice deadline, and the second is the one people miss. A sixty or ninety-day notice window on an annual subscription means the decision has to be made well before anyone is thinking about it.

Worse, many agreements renew "at Provider's then-current list price", and the increase may not be communicated before the notice window closes. Two terms commonly negotiated to address this are a cap on the renewal increase — 3% to 5% annually, or an index — and a requirement that any increase be notified at least thirty days before the notice deadline, so the customer can actually respond to it.

At the other end, data portability is what makes leaving possible. The agreement should give a defined retrieval window after termination — thirty to ninety days — during which the customer can export its data in a structured, machine-readable, commonly used format. "Available on request" or "in Provider's standard format" can mean a PDF dump that no successor system can ingest.

Also consider a transition assistance obligation at agreed rates, and, for a service the business genuinely depends on, ask what happens if the vendor fails. Escrow is less useful for SaaS than for licensed software, because source code without the operational environment is rarely runnable. More practical protections are a commitment to provide regular data exports during the term, so the customer always holds a recent copy, and continuity terms triggered by insolvency.