The SaaS contract checklist: 27 clauses to review before you sign

Why SaaS contracts need their own playbook

SaaS agreements are a hybrid: part services contract, part software license, part data-processing agreement, part insurance policy. A clause that's standard in a software license (perpetual license, indemnity for IP infringement) is meaningless in SaaS, while clauses that don't exist in software licenses (uptime SLA, data export, sub-processors) are critical.

Order form vs. master agreement

Every SaaS deal has two documents: the Order Form (price, quantity, term) and the Master Subscription Agreement (everything else). The Order Form usually has an "order of precedence" clause saying the Order Form wins where they conflict — use that to negotiate carve-outs without rewriting the whole MSA.

The 27-clause checklist

1. Service description — clear definition of what's included.
2. Subscription term — initial term and renewal mechanism.
3. Auto-renewal notice — 30–60 days, not 90.
4. Pricing & uplift cap — CPI or 5% max per renewal.
5. Payment terms — net 30 or 45, not net 7.
6. Late fees — capped, with cure period.
7. Usage metrics — defined and auditable.
8. Overage charges — pre-notified, soft-capped.
9. Free tier / sandbox — preserved during dispute.
10. Uptime SLA — 99.9% with credits, not just promises.
11. Maintenance windows — defined and limited.
12. Support response times — by severity tier.
13. Security controls — SOC 2 / ISO 27001 referenced.
14. Data residency — where data is stored and processed.
15. Sub-processors — list provided, notice on changes.
16. Data export — 30+ day window, standard format.
17. Data deletion — within 30 days of termination.
18. Backup & DR — RPO/RTO disclosed.
19. Incident notification — 72 hours for breaches.
20. DPA / GDPR Article 28 — separate or attached.
21. Customer IP ownership — your data stays yours.
22. License back to provider — limited to providing the service.
23. Indemnity for IP infringement — uncapped, by provider.
24. Liability cap — at least 12 months of fees.
25. Suspension rights — non-payment only, with cure.
26. Termination for cause — both directions.
27. Governing law & arbitration — mutual and neutral.

The five clauses people forget

Most procurement teams cover 1–15 well. The ones that bite: sub-processors (a vendor can suddenly route your data through a new country), suspension rights (some vendors can suspend service for any "material breach" — define what that means), incident notification (silence is the cardinal sin), backup obligations (the vendor often disclaims any), and export format ("reasonable format" is not a format).

SLAs that actually mean something

A 99.9% uptime SLA without credits is marketing copy. A real SLA has: (1) measurement methodology — who measures, how often, what excluded (planned maintenance shouldn't be excluded if it's not pre-notified); (2) financial credit — usually 10% of monthly fees per percentage point missed, capped at 50%; (3) termination right — if SLA misses three months in a row, you can exit. The Cloud Security Alliance publishes good benchmark numbers.

Procurement vs. legal vs. security

On any SaaS deal above ~$50K ARR, the contract is reviewed by three teams with different priorities. Procurement cares about price uplift and termination. Legal cares about indemnity and liability. Security cares about sub-processors and data residency. Save calendar time by sending all three the same redline at the same time, with comments tagged by team.

Where AI helps and where it doesn't

An AI contract review can produce this 27-clause checklist for any SaaS MSA in under a minute (try ContractScan AI on your next vendor renewal). What it can't do is decide what your risk appetite is — that's still a human call. Use AI for triage and gap analysis, keep humans for the actual yes/no.