Twelve Clauses That Quietly Shift Risk in SaaS Agreements

Negotiation summaries tend to cover the same six provisions: price, term, liability cap, indemnities, data protection, termination. Those are the clauses everyone reads. The clauses that decide who actually bears the loss when something goes wrong are frequently elsewhere, drafted in language that does not announce itself.

What follows is a working list from several thousand SaaS agreements analysed on our platform, ordered roughly by how often the provision is missed relative to how much it costs when it bites.

1. The unilateral change clause

Usually found in the “Services” or “General” section rather than anywhere prominent: the supplier may modify the services, the documentation, or the acceptable use policy at its discretion, with notice by posting to a URL. Combined with an incorporation-by-reference clause, this means the terms you signed can change without either party signing anything.

The fix: carve out material adverse changes; require email notice to a named contact; and give yourself a termination right with a pro-rata refund if you object. Suppliers resist the first, accept the second and concede the third more often than you would expect.

2. Aggregate versus per-claim caps

“Liability shall not exceed the fees paid in the twelve months preceding the claim” reads the same whether the cap is aggregate across all claims or applies per claim. It is not the same thing. An aggregate cap on a long-running agreement erodes; by year four, an incident in month one may already have consumed it.

The fix: state explicitly which it is. If aggregate, consider a rolling twelve-month reset. If the supplier insists on aggregate-for-the-term, price it.

3. Carve-outs that are silently mutual

Exclusions from the cap — confidentiality breach, IP infringement, data protection, wilful misconduct — are frequently drafted as mutual because that reads as fair. Consider what it means in practice. The supplier’s exposure under a confidentiality carve-out is a data breach. Yours is an employee forwarding a pricing sheet. Mutual carve-outs on asymmetric risk are not symmetrical.

4. Auto-renewal with a short notice window

Evergreen terms with a 90-day notice window and a 60-day payment cycle mean the practical decision point falls before you have the usage data for the current year. In our portfolio analyses, unwanted renewals are the single largest source of avoidable contract spend, ahead of overprovisioning.

The fix: shorten the window to 30 days, require the supplier to give notice of the renewal date, or make renewal express rather than automatic. Failing all three, diarise it in a system rather than a person.

5. The suspension right

Distinct from termination, and much easier to trigger: the supplier may suspend the service for late payment, suspected breach of the acceptable use policy, or security concerns. Sometimes immediately, sometimes without notice. For a business-critical system this is a more severe remedy than termination, because it happens faster and with less process.

The fix: require notice and a cure period for payment disputes, limit suspension to the affected users or functionality, and exclude suspension where the amount in dispute is subject to a good-faith challenge.

6. Data return and deletion mechanics

Most agreements say data will be returned or deleted on termination. Fewer say in what format, within what period, at whose cost, and what happens during a transition. “Available for export for thirty days” means nothing if the export format is unusable without the supplier’s software.

The fix: specify the format (a documented, machine-readable one), the period (long enough to migrate), the cost (nil or capped), and a transition assistance obligation at defined rates.

7. Benchmarking and MFN clauses that run one way

Most-favoured-nation clauses in your favour are rare and heavily qualified. MFN clauses in the supplier’s favour — requiring you not to obtain better terms elsewhere, or to disclose competing offers — appear more often than they should in enterprise paper, particularly in reseller arrangements.

8. Usage-based pricing without a cap

Consumption pricing is reasonable. Consumption pricing with no ceiling, no alerting obligation and a right to suspend for non-payment is a structural risk, not a commercial term. A misconfigured integration can generate a quarter’s budget in a weekend.

The fix: a hard cap with an agreed escalation path, or at minimum a contractual alerting obligation at defined thresholds with a right to throttle rather than bill.

9. Subcontractor and sub-processor flexibility

“The Supplier may engage subcontractors” with no notification obligation, combined with a DPA permitting sub-processor changes with generic notice, means your data protection impact assessment is out of date the moment it is signed.

The fix: a maintained list, notice of additions with a reasonable objection period, and flow-down of the material obligations. This is standard under Article 28 GDPR and should not be a negotiation.

10. Service credits as sole remedy

Service level agreements often specify credits as the exclusive remedy for availability failures. Credits are typically a small percentage of monthly fees — economically trivial against the cost of an outage. As a sole and exclusive remedy, this converts a service obligation into a rounding error.

The fix: preserve termination for chronic failure (defined by number of breaches in a rolling period), and exclude the sole-remedy language where the failure also constitutes a material breach.

11. Feedback and derived data licences

A broad licence over “feedback, suggestions and usage data” sounds administrative. Read carefully, some drafts extend to data derived from customer content — which, for an AI-enabled product, may include model improvements trained on your material.

The fix: exclude customer content and anything derived from it; limit the feedback licence to feedback actually and voluntarily provided.

12. Governing law and the forum that follows it

Governing law is negotiated. Forum is frequently accepted as a package. A clause selecting the law of one jurisdiction and the exclusive courts of another, or mandating arbitration in a seat with a fee schedule exceeding the value of most disputes, effectively removes your remedies for anything below a certain size.

A closing observation

None of these clauses is unreasonable in itself. Suppliers need suspension rights, subcontractors and the ability to change their services. The problem is cumulative: individually defensible provisions, drafted consistently in one party’s favour, produce an agreement in which every uncertainty resolves the same way. Reviewing clause by clause misses that. Reviewing the distribution of discretion across the whole document does not — and that is a question worth asking explicitly on every deal above a certain size.