What is a SaaS system?

SaaS (Software as a Service) is a model in which the application is hosted by the publisher or a third-party provider and accessed by the client via the internet, on a subscription basis. Unlike on-premises software, the client does not install the application on their own infrastructure. The publisher is responsible for the availability, security and updates of the service.

What are the differences between SaaS, IaaS and PaaS?

SaaS gives access to a software application, usable directly by the client. PaaS provides an environment for developing, testing and deploying applications without managing the underlying infrastructure. IaaS provides infrastructure resources, such as servers or storage space, that the client administers. The main difference lies in the level of service provided and the degree of control retained by the client.

What is a SaaS contract?

A SaaS contract governs the terms of access to and use of an application in SaaS mode. It defines in particular the scope of the service, service levels (SLA), personal data processing (DPA), security commitments, liability limitations, reversibility and termination conditions.

What is the difference between an MSA and a SaaS contract?

The MSA (Master Service Agreement) is a framework contract that sets the general rules applicable to the entire commercial relationship. The SaaS contract governs access to a specific application. In practice, the MSA can serve as the foundation for several SaaS contracts and ancillary documents (SLA, DPA, special conditions).

What are the essential clauses in a SaaS contract?

Essential clauses cover access and usage rights, service levels (availability, GTI/GTR, penalties), security and incident management (BCP/DRP), liability limitation (cap, indirect damages, gross negligence), reversibility and data portability conditions, personal data protection (DPA, sub-processors), technical dependencies (third-party APIs, connectors, OAuth flows) and suspension or termination conditions.

Does a SaaS publisher need to formalise a DPA with its clients?

Yes. When processing personal data on behalf of its clients, the publisher acts as a data processor under GDPR Article 28 and must formalise a DPA defining the object, duration, purpose and categories of data processed, security measures, use of sub-processors and breach notification procedures.

Can a SaaS publisher limit its contractual liability?

Yes, provided the clause is correctly drafted. The French Supreme Court held that a clause contradicting the scope of the essential obligation undertaken by the publisher is deemed unwritten (Cass. com., 29 June 2010, Faurecia v Oracle). The liability cap must be aligned with SLA penalties and gross negligence cases to remain enforceable.

How should reversibility be framed in a SaaS contract?

The clause must provide for the restitution formats (open and usable formats), timelines, migration assistance, data destruction conditions and the cost of the reversibility service. Imprecision in this clause is one of the primary causes of disputes at the end of a SaaS contract.

What is the difference between a software licence and a SaaS contract?

A software licence grants the right to install and use the software on one's own infrastructure. A SaaS contract, by contrast, is a service contract granting access to an application for a defined period. This difference has significant consequences for maintenance, updates, hosting, security, service availability, reversibility and the allocation of responsibilities.

When should a SaaS contract be audited or renegotiated?

A SaaS contract should be audited or renegotiated before signature, at renewal, when the functional or pricing scope changes, in the event of regulatory changes, or when an incident reveals a contractual weakness. An audit is particularly recommended when the SaaS application becomes critical to operations or when a migration or reversibility project is planned.

Digital and IT Law Firm

SaaS Contract Lawyer

Our firm analyses, drafts and negotiates your SaaS contracts, systematically integrating compliance requirements for personal data protection (GDPR) and cybersecurity (NIS2, DORA).

GDPRNIS2DORASLA

Lignes de code informatique colorées sur un écran

Our Clients

The IT companies we support

EMPREINTE Avocats supports digital, IT and cybersecurity professionals who design, publish or integrate SaaS solutions, as well as those who use SaaS tools in their daily business.

Software and SaaS solution publishers

Cybersecurity solution publishers in SaaS mode

Tech startups and scale-ups developing a SaaS offering

Publishers transitioning a software offering to a SaaS model

Pentesters, technical auditors, SOC, CERT and incident response teams

Our Services

Our firm's services for SaaS software

SaaS Contract Audit

We analyse your existing SaaS contracts and identify missing, imprecise or insufficiently protective clauses: service access conditions, service levels, subcontracting chain, security commitments, data protection and reversibility.

SaaS Contract Drafting

We draft or overhaul your General Service Conditions, SaaS T&Cs, DPA (GDPR Article 28) and SLA, ensuring your contractual commitments accurately reflect the reality of the service provided.

SaaS Contract Negotiation

We assist you in negotiating the most sensitive clauses: technical prerequisites, security, confidentiality, liability limitation, guarantees, service level commitments and reversibility conditions.

SaaS T&Cs Drafting

We draft general terms of sale specifically adapted to the SaaS model, taking into account subscription logic, remote access, data hosting and sector-specific compliance requirements.

Distribution and Partnership Agreements

We structure the contracts governing the commercialisation of your online application by third parties (resellers, integrators, business introducers), securing the allocation of responsibilities.

SaaS Contractual Disputes

We intervene in disputes related to the execution of a SaaS contract: service interruption, SLA non-compliance, data loss or alteration, abrupt termination of commercial relations or difficulties with reversibility.

Essential Clauses

Essential clauses in a SaaS contract

Here is an example of clauses that our firm systematically drafts and audits to frame your obligations and exposure.

Liability Limitation

Cap on damages, exclusion or inclusion of indirect damages, articulation with SLA penalties and cases of gross negligence or fraud. The clause must not contradict the scope of the essential obligation undertaken (Faurecia/Chronopost case law).

Service Levels, Support and Maintenance

Availability commitments, support hours and levels, response and resolution times, escalation procedures, maintenance windows and possible exclusions.

Technical Dependencies and Interconnections

Third-party APIs, connectors, OAuth flows, external libraries: SaaS risk shifts to what is not directly controlled by the publisher. The contract must identify these dependencies and allocate security obligations accordingly.

Security and Incident Management

Infrastructure and application security commitments, incident notification procedure, escalation mechanisms, business continuity and recovery plan (BCP/DRP) and cooperation in the event of a cyber incident.

Termination and Service Suspension

Cases of access suspension, termination for cause or for convenience, applicable notice periods, effects of contract end and guarantees of continuity or transition to avoid operational disruption.

Reversibility and Data Portability

Restitution formats (open and usable formats), availability timelines, migration assistance, fate of backups and data destruction after restitution. Reinforced importance under GDPR and the SREN Act.

Cyber risks

Cyber risks a SaaS contract can limit

A well-structured SaaS contract limits cyber risks by clarifying the actual scope of intervention, technical prerequisites and operational limits of the service.

Being held liable for a cyber incident that your solution could not have prevented.

Bearing the consequences of a misconfiguration on the client's side.

Intervening without sufficient authorisation for a pentest, a scan or a technical audit.

Committing to detection or response timelines that cannot realistically be met.

Leaving the cyber subcontracting chain unclear.

Our Approach

What sets our firm apart

EMPREINTE Avocats is a law firm specialising in digital law and cybersecurity. We draft and negotiate SaaS application contracts by adopting a risk-based approach rather than simply proposing standardised clauses.

This approach, built on handling over 120 IT sector cases (contracts, IT and cyber litigation, compliance, M&A audits), allows us to draft SaaS contracts that anticipate real failure scenarios: service interruption, data compromise, reversibility failure, reliance on a failing subcontractor or challenge to the liability limitation.

Sphères numériques interconnectées illustrant un réseau cloud

120+IT cases handled

FAQ

Frequently asked questions about SaaS contracts

Our firm's answers to the most common questions about SaaS contract law.

Do you have a SaaS contract to analyse or draft?

Get in touch with our firm.

EMPREINTE Avocats reviews your requests and takes the time to assess your situation before any commitment. A first discussion allows us to understand the context of your SaaS contract and determine whether and how the firm can intervene.