SaaS Subscription Agreement: build a starting draft free, or have me draft it around your deal

Almost every SaaS draft caps liability at fees paid in the last 12 months. Almost every negotiated redline then pulls the liabilities that actually bankrupt companies out of that cap: indemnification, breach of confidentiality, and data-security failures. On the provider side, my job is to keep the exclusions list short and to price a super-cap, a higher multiple of fees for data claims, before the customer demands uncapped everything. On the customer side, it is the mirror image: a cap at 12 months of a $2,000 subscription is $24,000 of protection against a vendor holding a million records.

California’s automatic renewal law, Business and Professions Code section 17600 and following, is a consumer statute: section 17601 defines a consumer as an individual acquiring goods or services for personal, family, or household purposes, and the law was tightened again by AB 2863 for contracts entered into, amended, or extended on or after July 1, 2025. Two consequences for SaaS. If any slice of your subscribers are individuals, your renewal flow needs the consumer machinery: clear disclosure, affirmative consent, and easy cancellation. And even in pure B2B deals, where the statute does not reach, enterprise customers negotiate their own renewal protections anyway: 60- or 90-day non-renewal windows, price-increase caps, and notice-before-renewal duties that most procurement teams now demand as a matter of course.

Statutory scope verified against Business and Professions Code section 17601 at leginfo.legislature.ca.gov on 2 August 2026, including the AB 2863 amendments (Stats. 2024, ch. 515).

A 99.9% uptime promise sounds like an obligation. Read the remedy: a credit of a few percent of one month’s fee, claimable only within 30 days, forfeited if unclaimed, and defined as the sole and exclusive remedy for availability failures. That last phrase is the entire point of the clause. It converts an outage from a breach-of-contract claim into a coupon. Providers should defend it, honestly, because it makes downtime survivable. Customers should attack the edges: how uptime is measured and by whose logs, what counts as excluded maintenance, whether chronic failure, say three missed months in a rolling six, unlocks termination and a pro-rata refund of prepaid fees rather than another coupon.

The data terms you sign are promises your vendors have to perform. If your DPA gives the customer a subprocessor veto and a 24-hour incident notice, but your hosting provider owes you neither, you have signed a contract your own stack cannot execute. Where protected health information is in play, the overlay is statutory: a business associate agreement is required, and under 45 CFR 164.410 a business associate must report a breach without unreasonable delay and no later than 60 calendar days after discovery. Counterparty forms routinely compress that to 24 or 72 hours and start the clock at the incident rather than discovery, which is a materially harder promise than the regulation imposes.

Breach-notification timing verified against 45 CFR 164.410 on 2 August 2026.

“Provider owns the platform, customer owns customer data” reads clean and decides almost nothing. A live deployment generates a third category: configurations, workflows, integrations, fine-tuned models, usage analytics, and AI-assisted output built from the customer’s prompts on the provider’s machinery. Whoever fails to define that category donates it. Providers want express rights to usage data and to improvements; customers want their prompts, outputs, and trained artifacts walled off from other customers, and increasingly want a no-training clause with teeth. If your product has an AI feature, the output-ownership question is its own discipline; I keep a running analysis of how the major model providers handle it at ai-output-rights.