What is in a general SaaS legal package?

A general-SaaS legal package usually contains a Master Subscription Agreement or Terms of Service, a Privacy Policy with CCPA / CPRA + GDPR Article 13/14 disclosures, a Data Processing Addendum with the 2021 EU SCCs and a UK addendum, an Acceptable Use Policy, an AI Use Addendum where the product ships AI features, and an order form template. I build them as one coordinated stack so the defined terms align across documents.

SaaS Legal Package: MSA, DPA, Privacy, ToS, AI Addendum | $575 to $2,500

Sergei Tokmakov, Esq.

California Bar #279869, licensed since 2011. 1,500+ contracts drafted. Top Rated Plus on Upwork with 700+ reviews. My practice is built around B2B SaaS, AI, and privacy work.

Cal. Civ. Code § 1798.100 et seq. (CCPA / CPRA) EU GDPR Art. 28

Three flat-fee paths into the general-SaaS stack

Most SaaS clients need a coordinated stack rather than one isolated document. Pick the tier that fits where you are. If your product handles PHI, the Healthcare-SaaS Hub is the correct page instead.

Single Document Redline

$575 flat fee

Up to 3 revision rounds

One business contract drafted or redlined by an attorney. For when an enterprise customer sent back your MSA with markup, or you need a standalone DPA, AI Addendum, or Privacy Policy reviewed.

MSA / ToS / DPA / Privacy / AI Addendum, your pick
Attorney redline or clean draft as appropriate
Brief written comments on the key issues
Up to 3 rounds of email revisions
Overflow at $240 / hour

Request this package, $575

General SaaS Stack

$2,000 flat fee

10 business days, one revision round

The full general-SaaS document stack drafted around your product. Fits pre-launch founders and SMB-focused SaaS without heavy enterprise procurement processes.

Master Subscription Agreement (MSA)
Terms of Service / Acceptable Use Policy
Data Processing Addendum (GDPR + CCPA-aware, EU SCCs, UK addendum)
Privacy Policy (CCPA / CPRA + state laws + GDPR Art. 13/14)
AI Use Addendum if you ship AI features
Order form template
One coordinated revision round

Request this package, $2,000

Healthcare SaaS Package

$2,500 starting flat fee

Specialized vertical: PHI-handling SaaS

If your SaaS touches PHI or sells into healthcare-regulated buyers, this stack adds HIPAA BAA, narrow PHI scoping, 42 CFR Part 2 schedule, CMIA-aware Privacy Policy, and a compliance-gap memo. Handled on a separate hub because the regulatory work is materially heavier.

Everything in the General SaaS Stack
HIPAA Business Associate Agreement (BAA)
Narrow PHI scoping clauses
42 CFR Part 2 schedule for SUD programs
CMIA-aware California Privacy Policy
Compliance gap memo for vendor stack

Open Healthcare-SaaS Hub →

Start a structured intake

If you would rather answer a short questionnaire than write an email, the structured intake gathers the product, customer, data, and AI footprint I need to scope and quote a SaaS stack accurately.

Who this is for and who it is not

This is for you if

You are a B2B SaaS founder pre-launch through Series A
You are hitting your first enterprise customer and need procurement-ready docs
You are adding AI features and need an AI Use Addendum + DPA update
You are currently using a free template and the markup pushback is past your ability to answer
You are a solo founder without in-house counsel

This is not for you if

You handle Protected Health Information (use the Healthcare-SaaS Hub instead)
You only want a free template (good ones exist, just not from me)
You have not yet decided what your product does or who buys it
You need securities, tax, or entity-structuring work
You only need one document (use the $575 Single Document Redline tier)
You are an open-source project (different licensing regime)
You run a marketplace or two-sided platform (different liability and IP regime)

Healthcare SaaS belongs on a different page

If your SaaS handles PHI, the General SaaS Stack is not enough.

Healthcare-regulated SaaS needs HIPAA BAA + 42 CFR Part 2 schedule + CMIA-aware Privacy Policy + a compliance-gap memo. I keep that work on a separate hub so the contract drafting, BAA negotiation, and regulatory analysis stay coordinated. If you sell into hospitals, payers, providers, or healthtech, start there instead.

Healthcare-SaaS Hub →

My approach

A SaaS stack only works if it is built around your product. I do the structured intake first, then draft, then revise.

Step 1

Structured intake

Short questionnaire by email. Pricing model, customer profile, data flow, AI usage, sub-processors, jurisdiction, and what your enterprise customers are likely to push back on.

Step 2

I draft the stack

Within 10 business days I deliver the documents in coordinated form. Defined terms align across MSA, DPA, Privacy, AUP, and AI Addendum so there are no internal contradictions.

Step 3

Revision and rollout

You review, send markup, and I roll the changes. Single-document overflow billed at $240 / hour. Enterprise redline negotiations can be scoped separately.

The documents in a clean general-SaaS legal stack

Master Subscription Agreement (MSA) or Terms of Service (ToS). The primary commercial document. MSAs are usually negotiated and signed for B2B enterprise customers; ToS is unilateral click-through for self-serve and mid-market. Both cover scope, fees, term and renewal, IP ownership, license grant, warranties, indemnification, limitation of liability, and termination.
Order Form / Schedule. Commercial detail (price, seats, term, specific features) attached to the MSA. The MSA controls; the order form fills in the variables.
Data Processing Addendum (DPA). Required when the customer is a controller and you process personal data on their behalf. GDPR Art. 28 mandates specific terms; CCPA / CPRA has analogous service-provider requirements. Includes sub-processor list, security measures, breach notification, audit rights, and data-transfer mechanisms (2021 EU SCCs, UK IDTA, Swiss SCCs).
Privacy Policy. Public-facing, required for any service that collects personal data. CCPA / CPRA requires specific California-resident disclosures. GDPR requires Article 13/14 disclosures. State laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana) add overlay requirements.
Acceptable Use Policy (AUP). Sets boundaries on customer use: no spamming, no illegal content, no abuse of the service or other customers. Often incorporated by reference into the ToS / MSA.
AI Use Addendum (where applicable). If the service uses customer data to train models, integrates third-party AI providers (OpenAI, Anthropic, Google), or generates AI output, the AI Use Addendum addresses input ownership, output ownership, training-data restrictions, hallucination risk language, AI sub-processor disclosure, and an opt-out for customers who do not want their data near AI features.
Service Level Agreement (SLA). Defines uptime commitments, response times for support, and remedies for breach (typically service credits). Often a separate document or schedule attached to the MSA.

Common general-SaaS scenarios

Building the stack from scratch (pre-launch)

Founder is launching a SaaS and needs the full stack before going live. The right approach is to build all the documents at once with a consistent commercial position so MSA, ToS, DPA, Privacy, AUP, and AI Addendum line up. Ad hoc piecemeal documents create internal contradictions that fail audit, diligence, or contract negotiation.

Enterprise customer sends back a redlined MSA

Customer legal team returns the MSA with extensive redlines: liability caps, IP carve-outs, audit rights, MFN clauses, source-code escrow, increased indemnification. The work is to identify deal-breakers, negotiable items, and acceptable-as-is changes. The $575 Single Document Redline tier handles a single MSA pass; broader negotiation scopes separately.

GDPR / CCPA / state-privacy gap

SaaS has been operating without a proper DPA, sub-processor list, breach-notification mechanism, or California-specific Privacy Policy. Risk is regulatory action plus customer-contract breach. The fix is bringing the stack up to standards: DPA template with EU SCCs, sub-processor list, breach response plan, updated Privacy Policy with state-by-state coverage.

AI feature added to existing SaaS

The SaaS now uses customer data to train models, integrates with OpenAI / Anthropic / Google, or generates AI output. The existing MSA and ToS do not cover AI inputs, outputs, training restrictions, or AI-related indemnification. The AI Use Addendum is bolted on; Privacy Policy and DPA need updates for AI processing.

Acquisition / due diligence

Acquirer counsel reviews the SaaS stack and finds gaps: no DPA, no AI Addendum, inconsistent customer terms, missing sub-processor list, weak indemnification. Closing is delayed while gaps are remediated. The fix is pre-acquisition cleanup so the company is acquisition-ready.

Before you contact me

Do not sign an enterprise customer's redlined MSA without an attorney review. Customer-favorable language often includes uncapped indemnification, exclusivity, or IP transfer clauses that cost the company materially in aggregate.
Do not publish a Privacy Policy without confirming it covers every state-resident audience your service has. CCPA / CPRA + state privacy laws + GDPR each impose specific disclosures.
Do not start using customer data for AI training without an AI Use Addendum or updated MSA. Enterprise customers commonly prohibit training in their MSA; using their data anyway can be a breach with material damages.
Do not let the DPA template lapse. GDPR and CCPA require specific terms; a stale DPA fails audit and customer-vendor onboarding.
Do not assume the general-SaaS stack covers regulated sectors. Healthcare (HIPAA), financial (GLBA), education (FERPA), child users (COPPA) all need overlays, see the Healthcare-SaaS Hub for the PHI path.

Frequently asked questions

Is this the right page if I handle Protected Health Information?

No. PHI-handling SaaS, HIPAA Business Associate work, 42 CFR Part 2 (substance-use-disorder programs), and California CMIA-aware Privacy Policies are scoped through the Healthcare-SaaS Hub, not this general-SaaS page. The two stacks share a base but the healthcare overlay materially changes contracting and pricing.

What does the $575 Single Document Redline include?

Attorney drafting or redline review of one business contract, up to three rounds of email-based revisions. Use cases: an enterprise customer sent back a redlined MSA; you need a standalone DPA built; you have a single Privacy Policy or AI Addendum that needs a check. Overflow at $240 / hour. This is the $575 Create or Redline tier (PayPal NCP FN8BR2VDZT6YA).

What does the $2,000 General SaaS Stack include?

MSA, ToS, Privacy Policy, DPA with the 2021 EU SCCs and a UK addendum, Acceptable Use Policy, an AI Use Addendum if you ship AI features, and an order form template. One coordinated revision round. Standard turnaround is 10 business days. Enterprise redline negotiation is a separate scope.

What is in the AI Use Addendum?

Training-data restrictions (whether customer data trains your or your vendors' models), output ownership, hallucination risk language, customer review obligations, AI sub-processor disclosure, and an opt-out for customers who do not want their data near AI features. Enterprise procurement is asking about each of these by 2026.

Can I use this stack internationally?

The DPA is GDPR and CCPA-aware out of the box and includes the EU SCCs (Commission Implementing Decision 2021/914) plus the UK IDTA. The MSA defaults to California law but is easy to swap. For pure EU / UK SaaS, an additional jurisdictional review may be appropriate and is quoted separately.

What if an enterprise customer redlines me?

The General SaaS Stack covers drafting your baseline documents and one revision round. Active enterprise-redline negotiation across multiple back-and-forths is a separate scope; I quote it once I see the markup. The $575 Single Document Redline tier handles a single MSA pass.

Do you handle the click-through implementation?

I deliver finished Word documents. Wiring them into your signup flow, marketing site, or e-signature tool is on you (or your developer). I can recommend tools but I do not do the implementation.

SaaS legal stack, drafted around your product, ready to send to procurement.