SaaS Agreement (B2B) template

Overview

A SaaS (Software as a Service) agreement governs the supply of hosted software, accessed remotely on a subscription basis, to a business customer. Unlike a traditional software licence, which authorises installation of a copy of the software on the customer's own equipment, a SaaS arrangement involves no transfer of a software copy at all: the supplier hosts and operates the software on its own infrastructure (or a third-party cloud provider's), and the customer accesses it remotely, typically through a browser, in return for a recurring subscription fee. In English law terms this is best characterised as a contract for the supply of services (and a limited right to access, rather than a supply of goods), so the general law of contract applies, together with, for business-to-business agreements, an implied term under section 13 of the Supply of Goods and Services Act 1982 that services will be carried out with reasonable care and skill unless expressly excluded. Between two businesses, the parties are broadly free to allocate risk as they see fit, subject to the Unfair Contract Terms Act 1977 (UCTA 1977), which subjects exclusion and limitation clauses to a reasonableness test, and cannot be excluded in relation to liability for death or personal injury caused by negligence, or for fraud. Where the customer processes personal data of its own staff, prospects or end customers through the service, the supplier will typically act as a data processor and UK GDPR (the retained EU GDPR as it forms part of UK law under the Data Protection Act 2018) requires a separate data processing agreement satisfying Article 28 UK GDPR before any processing begins. When to use it: whenever a software provider makes a hosted, subscription-based application available to a business customer without a traditional on-premises licence — a SaaS platform, a vertical business tool, a usage-billed API, or similar. Parties: the supplier (who retains ownership of the software and is responsible for hosting and operating it) and the business customer, whose company number (if a limited company) and registered address should be recorded. Key clauses: the scope of the service (functionality included, usage limits, authorised user numbers); the service levels (an availability commitment, support arrangements and, where agreed, service credits for underperformance); subscription terms (term, billing frequency, pricing, renewal and termination); intellectual property, which remains vested in the supplier throughout, the customer receiving only a non-exclusive, non-transferable right to access and use the service; data protection, cross-referring to a separate UK GDPR-compliant data processing agreement; limitation of liability, generally capped by reference to fees paid; and exit assistance, ensuring the customer can retrieve its data in a usable format before it is deleted. Pitfalls to avoid: agreeing a vague, unmeasurable service level that leaves the customer with no real remedy if the service is unavailable; omitting exit/data-return provisions, which can leave a customer's data stranded or effectively hostage to the supplier at the end of the relationship; blurring the distinction between a perpetual licence and a SaaS subscription when drafting intellectual property and term clauses; and failing to put a UK GDPR-compliant data processing agreement in place where personal data will flow through the service.