SaaS Agreement
A subscription agreement under which a customer accesses software hosted by the vendor on a recurring-fee basis, rather than installing software locally. Distinct from a software license in that the customer receives a service, not a license to a copy. Typical issues include uptime SLAs, data processing addenda, exit and data-portability provisions, and regulatory compliance.
A SaaS (software-as-a-service) agreement is a subscription contract under which a customer accesses software hosted on the vendor's infrastructure for a recurring fee, rather than installing a copy of the software locally. SaaS agreements are generally structured as services contracts rather than licenses to a copy of software, although many grant a limited right or license to access and use the service. The legal and practical implications differ materially from traditional software licensing.
Uptime and service level agreements
SLAs typically express uptime as a percentage (commonly 99.9% or 99.95%) measured monthly. The usual remedy for an SLA failure is a service credit, a percentage of the monthly fee, and many agreements make it the exclusive remedy. Commonly negotiated points include the measurement method (for example, whether scheduled maintenance is excluded), the cap on credits, and the level of repeated failure that gives the customer a termination right or a refund.
Data processing and security
Where the TDPSA applies and the SaaS vendor processes personal data on the customer's behalf, the customer is ordinarily the "controller" and the vendor the "processor," a fact-based determination under § 541.104(e). The chapter applies only to persons that conduct business in Texas or produce products or services consumed by Texas residents, process or sell personal data, and are not small businesses as defined by the U.S. Small Business Administration (small businesses remain subject to a consent rule for selling sensitive data), and it protects Texas residents acting in an individual or household context, not a commercial or employment context (§§ 541.001(7), 541.002, 541.107). The controller-processor contract, often a data processing addendum (DPA), must include, among other things, processing instructions, the nature, purpose and duration of processing, the type of data, the rights and obligations of both parties, confidentiality duties, deletion or return of data at the end of the service, compliance information and assessments, and flow-down terms for subcontractors (§ 541.104(b)). A vendor that is a HIPAA business associate must sign a business associate agreement (45 C.F.R. §§ 164.502(e), 164.504(e)). Card data is governed by the PCI DSS, an industry standard imposed through card-brand and acquirer contracts, which commonly leads customers to require PCI compliance terms.
Termination and data portability
Exit provisions commonly require that, on termination, the vendor provide the customer's data in a usable export format (typically CSV, JSON, or the vendor's standard API export) for a defined retrieval window (typically 30-90 days), after which the vendor deletes the customer's data and certifies destruction. Without explicit data-portability provisions, the customer may face vendor lock-in or, worse, data loss on contract expiration.
Indemnification and limitation of liability
Most SaaS agreements include vendor IP indemnification (against third-party claims that the service infringes IP rights), customer indemnification (against claims arising from customer data or use), and a mutual limitation of liability typically capped at fees paid in the preceding 12 months. Customers handling regulated data often seek carve-outs from the liability cap for data-breach indemnification, gross negligence, willful misconduct, and IP indemnification.
SaaS contracts are often presented as non-negotiable click-through "online order forms" tied to the vendor's standard terms. Larger customers often negotiate the DPA, security exhibit, SLA, indemnification and liability cap, because those terms allocate the cost of an outage or data breach.