SAAS AGREEMENT REVIEW

RISK ASSESSMENT: MEDIUM (2-3 negotiation points)

CRITICAL ISSUES (Raise before signing)

1. LIABILITY CAP: "Total liability capped at annual fees paid"
   ⚠ RED FLAG: If annual contract = $50k, liability cap = $50k
   → Problem: Customer sues for data breach, loss capped at 1 year revenue (low)
   → Recommendation: Push back to "12 months of fees" or remove cap for data breaches
   → Precedent: Market standard is 12-month cap OR unlimited for indemnification

2. DATA HANDLING: "Clause 7.2: Customer data retained 30 days post-termination"
   ⚠ AMBER FLAG: No delete timeline specified; indefinite retention risk
   → Problem: GDPR compliance (right to deletion within 30 days); audit liability
   → Recommendation: Change to "deleted within 30 days" (hard delete, not retention)
   → Impact on you: adds 3-day engineering work (automated purge script)

AMBER ISSUES (Negotiate, not deal-breakers)

3. IP INDEMNIFICATION: "Customer indemnifies us for IP infringement claims"
   → Question: Does customer own their uploaded data? If yes, this is standard.
   → Question: Are they uploading proprietary code? Confirm indemnity scope.
   → Recommendation: Add exception—"excluding our willful misuse of customer data"

4. SLA COMMITMENT: "99.5% uptime, no damages specified"
   → Question: What happens if you miss? Service credits, or customer can exit?
   → Recommendation: Add "service credits of 5-10% monthly fees per 0.1% below target"

FAVORABLE TERMS (Keep unchanged)
✓ 12-month term, auto-renew with 30-day exit notice (customer-friendly; negotiation leverage)
✓ Pricing escalation capped at 10% year-over-year (protects customer, shows good faith)

NEXT STEP: Contact customer GC; propose changes to 1, 2, 3. Clause 4 optional. NOT A SUBSTITUTE FOR LICENSED COUNSEL.