SaaS Terms of Service: What to Look For Before You Subscribe

Auto-renewal is the #1 way SaaS companies extract money from customers who forgot to cancel. The standard pattern: you sign up for an annual plan, the renewal date comes and goes, you're charged for another year before you notice.

What's standard: renewal notice sent by email 30-45 days before the renewal date, with a clear process to cancel before renewal.

What's a red flag: 90-day or longer cancellation windows that require written notice well before renewal ('if you wish not to renew, you must provide written notice at least 90 days prior to the end of the subscription term'). Combined with no proactive renewal reminder, this is an intentional trap. Also watch for 'auto-renewal at then-current pricing' — you could renew at 40% higher rates you never explicitly agreed to.

What to negotiate for enterprise agreements: 30-day cancellation window, require the vendor to send a renewal reminder at least 60 days before the renewal date, and lock in pricing for the renewal term if you're agreeing to annual billing.

Your data — customer information, business records, content you create inside the platform — belongs to you. What SaaS terms often do is grant the vendor a broad license to use it, sometimes including for AI model training.

What's standard: the vendor gets a limited license to process your data to provide the service, improve the service, and ensure security. Your data remains your property. You can export it and take it with you when you leave.

What's a red flag: 'Company may use anonymized data derived from Customer's use of the Service for any lawful purpose, including to improve products and services or train machine learning models.' If you're in a sensitive business (legal, medical, financial), this matters. Your data patterns could be used to improve a product that serves your competitors.

What's also a red flag: no data portability at termination. If you cancel or they shut down, can you export your data in a usable format? Some platforms make export difficult or time-limited. Confirm the answer before you build workflows that depend on the platform.

What to negotiate: carveout your content and customer data from any AI training, require export in standard formats within 30 days of termination, and add data deletion requirements within 90 days of export.

SaaS terms of service almost universally cap the vendor's liability for service failures. These caps are often so low they're almost meaningless relative to the cost of a real outage.

What's standard: liability capped at fees paid in the 12 months preceding the claim. Service credits (a discount on future invoices) for downtime beyond the SLA threshold.

What's a red flag: liability capped at one month of fees. For an annual $50,000 SaaS subscription, that's a $4,167 cap — which wouldn't cover an afternoon of lost productivity for a small team, let alone a data breach.

Also watch for service credits as the exclusive remedy for SLA failures. If the platform goes down for 8 hours on your highest-traffic day, a 5% credit on next month's invoice is not adequate compensation. Credits as exclusive remedy mean you can't sue for actual damages even if the breach cost you orders of magnitude more.

What to negotiate: for enterprise agreements over $50,000 annually, push for liability capped at the greater of total fees paid in 12 months or a fixed dollar amount. Preserve the right to claim actual damages for breaches caused by vendor gross negligence. Ensure the SLA includes meaningful uptime commitments (99.9% = 8.7 hours of downtime per year max).

Most SaaS terms reserve the right for the vendor to change pricing and terms unilaterally, with some notice period. The notice period and your options at that point vary widely.

What's standard: 30-60 days written notice before a price increase, with the right to terminate before the new pricing takes effect.

What's a red flag: 'We may update these terms and your pricing at any time. Continued use of the Service after such changes constitutes acceptance.' This means every time you log in, you may have accepted new pricing you didn't see. No meaningful consent, no exit window.

Also watch for annual price increase caps buried in the order form. Some enterprise agreements include language like 'pricing may increase by up to 7% annually' — which at $100,000/year means $50,000 in added costs over a 3-year commitment, built into the contract you signed.

What to negotiate: locked pricing for the initial term, 90-day notice for price increases on renewal, and the right to terminate without penalty if pricing increases by more than a specified percentage (5% is a reasonable threshold).

SaaS vendors can typically terminate your account immediately for cause (violation of acceptable use, non-payment, illegal activity) and with notice for convenience. What matters is how much notice they give you and what happens to your data.

What's standard: 30 days notice for termination for convenience, immediate termination for cause with one cure period for technical violations.

What's a red flag: termination for vague causes like 'activity detrimental to the service or other users' with no cure period and no notice. This gives the vendor discretion to terminate accounts they find inconvenient without meaningful recourse. Also watch for termination language that doesn't guarantee data export after termination — some vendors lock you out immediately.

What to negotiate: 30-day cure period before termination even for policy violations (except genuinely severe cases like fraud), 30-60 days' data access for export after termination, and no-fault termination rights for you with pro-rated refund for unused prepaid months.

SaaS terms often include indemnification obligations running in both directions, but they're rarely symmetric. You typically indemnify the vendor for your use of the service; they indemnify you for IP infringement claims against the service itself.

What's standard: you indemnify the vendor for claims arising from your breach of the terms, your content, or your use of the service in violation of law. The vendor indemnifies you for third-party IP infringement claims arising from the service itself (i.e., if their product infringes a patent and someone sues you for using it).

What's a red flag: indemnification obligations from you that aren't matched by reasonable IP indemnification from the vendor. If you're indemnifying them for all claims related to your use, they should be indemnifying you for claims that the service itself infringes third-party rights.

Also watch for defense obligations as part of indemnification. A duty to defend means you pay their legal costs as they accumulate — not just if you lose. For a small business, being pulled into a vendor's litigation as their indemnitor is a serious financial risk.

What to negotiate: mutual, scoped indemnification where each party covers claims arising from their own breach or fault. Cap your indemnification obligation at the same level as the vendor's limitation of liability. Remove 'duty to defend' obligations or limit them to claims clearly caused by your documented breach.