A Software as a Service (SaaS) agreement is the contract governing access to and use of cloud-based software. For Indian SaaS companies selling to businesses in India or globally, and for Indian businesses purchasing SaaS products from Indian or international vendors, the SaaS agreement is the foundational commercial document - defining what the software does, what the customer's data rights are, what happens when the software is unavailable, and who owns what when the relationship ends. A SaaS agreement must do significantly more work than a traditional software licence agreement - because SaaS involves ongoing service delivery, data processing, and uptime commitments, not just a one-time transfer of software.
Subscription Terms And Access Rights
Licence grant: The SaaS vendor grants the customer a limited, non-exclusive, non-transferable right to access and use the software for the customer's own internal business purposes. The customer does not own or receive a copy of the software - they access it through the vendor's infrastructure. Authorised users: How many users can access the software? Is access priced per user, per seat, per volume, or by usage? Define "authorised user" precisely - typically employees, contractors, and agents of the customer accessing the software in connection with the customer's business. Use restrictions: The customer may not: reverse engineer, decompile, or attempt to extract the source code; resell or sublicence access to third parties; use the software in a manner that violates the acceptable use policy; use the software to process data on behalf of third parties (unless the agreement is explicitly structured as a platform/marketplace arrangement).
Pricing, Subscription Fees, And Payment Terms
Subscription fee: Monthly or annual. Annual subscriptions typically offer a discount. Auto-renewal: does the subscription auto-renew, and if so, with what notice requirement before non-renewal? Fee escalation: Can the vendor increase fees at renewal? The agreement must specify: how much notice the vendor must give of a fee increase (typically 30-60 days before renewal), and whether the customer can terminate without penalty if they do not accept the increase. Payment terms: Net 30 from invoice date is standard. Late payment interest should be specified.
Intellectual Property
Vendor IP: All rights in the software, underlying technology, and platform remain with the vendor. The customer receives access rights only - not ownership. Customer data: The customer retains all rights in their data stored in or processed by the software. The vendor processes customer data only as directed by the customer and in accordance with the DPA (see below). Feedback: If the customer provides feedback, suggestions, or feature requests, the vendor should have a clause confirming that implementing such feedback does not give the customer any IP rights in the resulting feature or improvement. Improvements and derivatives: The vendor can improve and update the software without seeking customer consent, provided such updates do not degrade functionality in a material way (which the SLA should address).
Uptime: The Percentage Of Time The Software Will Be Available. Common Tiers:
99.9% uptime = 43.8 minutes maximum downtime per month 99.5% uptime = 3.65 hours maximum downtime per month Measurement: how uptime is measured (vendor's monitoring system, agreed third-party tool), the measurement period (calendar month), and what constitutes "downtime" (complete unavailability, or partial degradation of key functions). Service credits: if the vendor fails to meet the uptime commitment, the customer receives service credits - a reduction in the next invoice. See our article on Service Level Agreement in India for detailed credit table structures. Service credits are typically the exclusive remedy for SLA failures. Scheduled maintenance: planned maintenance windows (typically off-peak hours) during which the software may be unavailable are excluded from uptime calculations, provided adequate advance notice is given (typically 48-72 hours).
The Data Processing Agreement (Dpa)
For any SaaS that processes personal data of the customer's employees or end users, a DPDP-compliant DPA is mandatory under Section 8(2) of the Digital Personal Data Protection Act 2023. The DPA must cover: Purpose limitation: the vendor processes customer data only for the purpose of providing the SaaS service Security obligations: encryption, access controls, regular security audits Data breach notification: vendor notifies customer within 48-72 hours of any breach Sub-processors: approval requirement and vendor's continued liability Cross-border data transfer: where data will be stored and processed, and compliance with DPDP Act restrictions Data return or deletion on termination See our dedicated articles on Data Processing Agreement Under India's DPDP Act and DPDP Clauses for Vendor and SaaS Contracts for detailed DPA provisions.
Confidentiality
Mutual confidentiality: both parties keep the other's confidential information (business plans, technical architecture, pricing, customer data) confidential. The vendor keeps the customer's data confidential; the customer keeps the vendor's pricing, technology, and roadmap confidential.
Term And Termination
Subscription term: typically 1 year, renewable annually. The agreement must specify: when either party can terminate the subscription, what notice is required for non-renewal, and what happens to customer data on termination. Termination for cause: either party can terminate immediately for material breach (security breach by vendor, non-payment by customer) or insolvency. Termination for convenience: typically 30-60 days written notice, effective at the end of the current subscription period. The customer should not be locked in with no termination right - an unbreakable annual subscription is commercially unreasonable.
Data Portability On Termination
A critical provision that many SaaS agreements bury or omit: on termination of the subscription, the customer must be able to export all their data in a portable, machine-readable format (CSV, JSON, XML). The vendor must provide this export capability and the customer must have a reasonable window (typically 30-60 days post-termination) to download their data before it is deleted. Data lock-in - making it technically or practically impossible to export data - is commercially exploitative and may be challenged under the E-Commerce Rules 2020 as an unfair trade practice.
When to obtain a review
A review is especially useful when…
- — You are about to sign, send, rely on or respond to this document.
- — The draft was copied from an old template or another state.
- — There is money, property, business control, statutory deadline or reputation risk involved.
- — You need Surat/Gujarat-specific drafting, review or negotiation support.
Legal information notice
This article is general legal information for India and Gujarat. It is not a substitute for advice on your specific facts, documents, limitation period, stamp duty position or court strategy.