Key risks covered by SaaS contracts

A good SaaS contract covers four main risks: the availability of the service (uptime), the protection and security of data (including the GDPR), the allocation of liability, and continuity in the event of the supplier's bankruptcy (via an escrow arrangement). Software as a Service runs in the cloud, making the customer dependent on the supplier — and the supplier wants to mitigate its risks. Below, you can read which risks a SaaS contract must cover.

What is a SaaS contract?

A SaaS (Software as a Service) contract is an agreement between a software vendor and a customer who purchases the software via the cloud. It governs the rights, obligations, and conditions for the use of the application. Because the customer does not possess their own copy of the software but relies on the online service, the contract covers specific risks that protect both parties.

1. Uptime and availability

The availability (uptime) of the service is crucial for both parties: for the supplier, their reputation is at stake, and the customer is entitled to expect a reliable service. A good SaaS contract therefore sets concrete requirements for uptime (for example, 99.9%) and regulates how maintenance and support are handled. These agreements are often laid down in a service level agreement (SLA), with compensation if the standard is not met.

2. Data, security and the GDPR

Other important risks revolve around data protection, security, and the functionality and compatibility of the software. Furthermore, if the supplier processes personal data on behalf of the customer, a data processing agreement required. The SaaS contract clarifies how the data is secured and stored, and — importantly — how the customer retrieves or can export their data at the end of the collaboration.

3. Liability

Large parties such as Google and Microsoft extensively limit their liability and shift the greatest risks onto the user. For the buyer, this is a point of concern; for the supplier, however, it is a way to manage risks. You can also make agreements with smaller parties regarding who is liable for what and up to what amount. Review these provisions critically: an overly broad exclusion could leave you, as the buyer, with the damages.

4. Continuity in the event of bankruptcy: the escrow clause

No matter how large or small the supplier is, there is always the risk that they will go bankrupt. In that case, the customer risks being left without working software and without access to their data. A good SaaS contract therefore includes a continuity arrangement via a SaaS escrow clause. This safeguards the source code, data, and running environment, ensuring that the service can be continued in the event of bankruptcy.

Frequently asked questions about SaaS contracts

What happens to my data if I stop using the SaaS service?

That depends on the agreements. Stipulate that you can export your data in a usable format upon termination and that the supplier deletes the data afterwards. Without such an exit arrangement, you run the risk of losing access to your own data.

Do I need a data processing agreement for a SaaS service?

If the supplier processes personal data on your behalf — which is the case with most business SaaS applications — then yes. The GDPR then requires a data processing agreement with agreements regarding security, sub-processors, and data breaches.

Can I negotiate the terms of a large SaaS provider?

With large standard providers, room for negotiation is limited, but you can assess whether the risks are acceptable to you and potentially take additional measures. With smaller suppliers, there is often more room for negotiation regarding uptime, liability, and escrow.

Have SaaS contract reviewed

Have your SaaS contracts thoroughly reviewed by the IT lawyers at MKB Juristen. They ensure that all necessary elements — uptime, data, liability, and continuity — protect your interests and limit risks. View our IT law or schedule a no-obligation intake.