Negotiating SaaS Agreements: 3 Critical Issues to Address

Key Takeaways:

1. Negotiate liability limitations to safeguard your business from excessive financial exposure.
2. Insist on comprehensive data protection measures, including prompt breach notifications, end-to-end encryption, and clear definitions of de-identified versus anonymized data.
3. Push for strong Service Level Agreements (SLAs) with high uptime guarantees (99.9%), well-defined performance metrics, and a tiered system of remedies for non-compliance.

Software as a Service (SaaS) agreements define the legal and operational framework between service providers and clients in cloud-based software engagements. As such, they always require careful attention to three critical areas: liability, service levels, and data privacy and security.

Effective negotiation of these three areas in SaaS agreements establishes clear expectations, allocates risk appropriately, and ensures robust protection for sensitive data. This focused approach helps businesses maximize the benefits of SaaS solutions while mitigating potential legal and operational risks.

Additionally, utilizing a contract lifecycle management platform can help manage these agreements more effectively, making negotiations smoother and faster.

After all, signing a SaaS agreement without addressing liability, service levels, and data privacy is like skydiving with a parachute you bought from a garage sale… You might have a thrilling ride, but when things go wrong, you’ll wish you had read the fine print on that “No Refunds” sign!

Common Challenges in Negotiating SaaS Agreements

Negotiating SaaS agreements involves navigating many issues, each with challenges. Businesses often encounter difficulties understanding the technical jargon and legal terms inherently included in contracts. Additionally, the rapid evolution of technology means that the terms agreed upon today may become outdated tomorrow, posing a risk to operational continuity.

To address these challenges, many businesses are turning to contract lifecycle management (CLM) systems to keep track of evolving contract terms and ensure that agreements are updated under the latest regulatory requirements and technological advancements. A CLM solution reduces the burden of managing contracts and provides a centralized platform for monitoring and maintaining contract compliance throughout the agreement’s lifecycle.

Critical Considerations for SaaS Agreement Negotiations

A robust CLM system can facilitate negotiations by providing templates, compliance checks, and automated workflows to ensure that all critical aspects are addressed thoroughly and efficiently. It’s important to have a firm grasp on these common and complex areas of SaaS agreements: liability and limiting liability, data protection, and service levels.

Liability and Limitations of Liability

Limitation of liability clauses, often referred to as “LoL” clauses, while could be laughable are unlikely to make you want to laugh out loud! They are also among the most heavily negotiated parts of any SaaS contract. A well-negotiated liability clause can ensure risk is allocated fairly and limit potential financial exposure due to unforeseen events.  There are several types of liabilities to be aware of:

• Direct liabilities typically arise from a breach of contract, negligence, or willful misconduct. These might include failure to deliver the service as promised, resulting in immediate and quantifiable losses.
• Indirect liabilities, on the other hand, include consequential, incidental, or special damages such as loss of profit or business interruption, which can be harder to predict and measure.

Watch On-Demand Webinar: How to Navigate Limitation of Liability, Indemnification, and Reps & Warranties with Colin Levy and Joel Roy

Capping Liability

Limiting liability often takes the form of a cap or financial limit for certain types of claims. When considering the type of cap, if any, to propose, consider that common forms of caps include stipulating a fixed amount or stating a multiple of the fees paid under the agreement. A practical approach is to push for a general cap on liability, such as 12 months of fees paid under the agreement. This ensures that your exposure is limited to a reasonable amount relative to the service cost.

For breaches related to data security or confidentiality, aim for a higher cap, perhaps 24 months of fees, reflecting the greater potential impact of such breaches. For instance, if a data breach occurs because of the SaaS provider’s negligence, the higher cap would provide better financial protection for your business.

Carve-outs

Identifying specific circumstances or types of claims that should be excluded from the limitation of liability clause is essential. Common carve-outs include gross negligence, willful misconduct, data breaches, and intellectual property (IP) infringement. These carve-outs ensure that in scenarios where the provider’s fault is undeniable and severe, liability is not limited, providing a stronger deterrent against such behavior.

For example, if your SaaS vendor is found guilty of gross negligence leading to a significant data breach, you should insist on unlimited liability for this area. This ensures that the provider is fully accountable and responsible for all resulting damages.

Mutual vs. Unilateral Liability

Consider whether the limitation of liability clause should apply mutually to both parties or unilaterally to one party. A mutual clause ensures that both you and the vendor are subject to the same liability limits, fostering a balanced relationship.

Unilateral clauses, where only one party benefits from capped liability, can create significant imbalances and potential unfairness. Ensure that any limitation of liability clause is mutual, preventing the vendor from pursuing uncapped damages against you while benefiting from a cap on their own liability. This mutual arrangement encourages fair play and mutual accountability.

Indemnification Relationship

Ensure that the liability limits that you are negotiating do not conflict with or undermine the indemnification obligations of the parties. Indemnification clauses require one party to compensate the other for certain damages or losses, typically arising from third-party claims.

The relationship between liability caps and indemnification should be clearly defined to avoid any overlaps or conflicts. For example, if your SaaS vendor indemnifies you for IP infringement claims, ensure that this obligation is not undermined by liability caps. This means that even if the general liability cap is set at 12 months of fees, the provider must cover all costs associated with IP infringement claims, regardless of the cap.

Data Privacy and Security

In today’s data-driven world, ensuring robust data privacy provisions in SaaS agreements is essential. Here are some key considerations and tips to help you achieve this:

Compliance

Ensure your SaaS provider maintains relevant industry certifications and complies with all applicable data protection laws and regulations. Certifications such as ISO 27001, SOC 2 Type II, and GDPR compliance demonstrate the provider’s commitment to security and regulatory adherence. Example: A healthcare provider using a SaaS solution for patient records should ensure that the vendor complies with HIPAA regulations. This includes requiring the vendor to provide proof of compliance and agreeing to regular audits.

Data Processing Agreement (DPA)

Negotiate a comprehensive DPA that includes provisions for prompt notification (e.g., within 48 hours) of actual, suspected, or alleged security breaches. Ensure the vendor commits to quick remediation at their expense and grant yourself termination rights in case of severe or repeated breaches.

Data Encryption

Require end-to-end encryption for data both in transit and at rest. Encryption ensures that even if data is intercepted or accessed by unauthorized parties, it remains unreadable and secure. Data should be encrypted during transmission between your systems and the SaaS provider’s servers. Use encryption protocols such as TLS (Transport Layer Security) to protect data in transit. Data stored on the provider’s servers should also be encrypted. Specify the encryption standards (e.g., AES-256) to be used to ensure robust protection.

De-identified and Anonymized Data

Pay close attention to provisions regarding de-identified or anonymized data. Make sure to understand the distinction between de-identified data (which may carry some risk of re-identification) and anonymized data (which should carry minimal to no risk of re-identification). Clearly define these terms in the agreement.

Data Ownership and Usage Rights

Clearly define data ownership and usage rights. While customer data typically remains the property of the customer, providers often claim ownership of de-identified or anonymized data. If allowing the provider to use de-identified data, specify permitted uses and ensure compliance with applicable privacy laws.

As with data privacy, when software is offered online as a service, ensuring robust service levels and remedies for lack of service are also essential. When negotiating these, focus on the following aspects:

Service Levels

Service Level Agreements (SLAs) define the quality and reliability of the service provided. When negotiating SLAs, focus on:

Uptime Guarantees

Aim for high uptime commitments. If a vendor commits to 99.0% uptime, push for 99.9% or settle for 99.5%. Clearly define what constitutes “downtime” and ensure that planned maintenance is excluded from uptime calculations.

Performance Metrics

Establish specific performance metrics for various aspects of the service, including response times, transaction processing speeds, and system availability. For example, you might require that there be penalties for a failure to adhere to certain metrics, such as speed, uptime, or response times.

Failure Definition and Response

Define what constitutes a failure to meet the service level and specify the escalation path when a service level failure occurs. Include contact methods and frequency of status updates.

Remedies for Non-compliance

Negotiate a tiered system of remedies for non-compliance. For example, agree on a 5% service credit for uptime between 99.5% and 99.9%, escalating to 10% for uptime between 99.0% and 99.5%, and 20% for uptime below 99.0%. A good approach is to always request higher credit amounts or ask that they be automatic.

Termination Rights

Secure the right to terminate the agreement without penalty if uptime consistently over a defined period falls below a certain threshold (e.g., 98%) for an extended period, such as three consecutive months.

Key SaaS Negotiation Takeaways

Effectively addressing these critical areas is fundamental to establishing successful and secure SaaS relationships. The elements discussed are interconnected aspects that collectively shape the quality and effectiveness of your SaaS agreements. To summarize:

• Push for balanced, mutual limitation of liability clauses with appropriate carve-outs. Limit liability to 12-24 months of fees. Consider higher caps or unlimited liability for serious issues like data breaches or gross negligence.
• Insist on comprehensive data protection measures, including prompt breach notifications (within 48 hours) and clear definitions of de-identified and anonymized data. Ensure the vendor maintains relevant certifications (e.g., ISO 27001, SOC 2 Type II) and complies with applicable data protection laws.
• Negotiate for high uptime guarantees ( certainly at least 99.9%), clearly defined performance metrics, and a tiered system of clear and consistent remedies for non-compliance.
• Secure termination rights for persistent failures, such as uptime falling below 98% for three consecutive months.
• Ensure you don’t have a strong SLA without proper liability protection or data security measures as you could be opening your business up to unnecessary risk. After all, robust liability clauses offer limited value if they offer inadequate service levels are inadequate!
• Be prepared to prioritize! You may need to concede on less critical points to secure crucial protections. For example, potentially accepting a slightly lower uptime guarantee might be worthwhile for stronger data privacy provisions or better liability terms. Each SaaS agreement should be tailored to your business needs and risk profile.
• Work with a trustworthy and reliable CLM provider, to ensure your templates and terms are streamlined to set a strong foundation.
• Approach negotiations with a clear understanding of your requirements and risk tolerance.