The SaaS Vendor Contract Checklist Every Startup Founder Needs
Your SaaS Stack Is a Liability Stack
The average startup uses 15-25 SaaS tools by year two. Each one has a [SaaS agreement](/review/saas-agreement) or [terms of service](/review/terms-of-service) you clicked through without reading. Collectively, they define who owns your data, what happens when things break, and how much it costs to leave.
The 10-Point SaaS Vendor Checklist
### 1. Data Ownership
What to check: Does the vendor claim any rights to your data? Look for phrases like "non-exclusive, worldwide license" or "right to use aggregated data."
Red flag: The vendor claims a license to use your data beyond providing the service — even for "product improvement" or "benchmarking."
What's fair: "Customer retains all rights to Customer Data. Vendor's use of Customer Data is limited to providing the Service."
### 2. Data Portability on Termination
What to check: Can you export your data when you leave? In what format? How long do you have?
Red flag: No export capability, or data is only available in a proprietary format that's useless outside the platform.
What's fair: Full export in standard formats (CSV, JSON, API access) with at least 30 days after termination to retrieve data.
### 3. Uptime SLA
What to check: Is there a guaranteed uptime percentage? What happens when they miss it?
Red flag: No SLA at all, or an SLA with no remedies (credits, refunds) for downtime. "[Warranty](/glossary/warranty) disclaimers" that eliminate all uptime commitments.
What's fair: 99.9% uptime with service credits for downtime. Clear definition of "downtime" that includes degraded performance, not just total outage.
### 4. [Auto-Renewal](/glossary/auto-renewal) Terms
What to check: Does the contract renew automatically? What's the cancellation window?
Red flag: Annual auto-renewal with 60-90 day notice requirement. Miss the window by one day = locked in for another year.
What's fair: 30-day notice for cancellation. Month-to-month option after initial term. Written confirmation of renewal, not silent rollover.
### 5. Price Increase Provisions
What to check: Can the vendor raise prices? By how much? With how much notice?
Red flag: "Vendor may adjust pricing at any time" or price increases exceeding CPI without a cap.
What's fair: Price locked for the initial term. Increases capped at CPI or a fixed percentage (5-10%) with 60-day notice.
### 6. [Limitation of Liability](/glossary/limitation-of-liability)
What to check: What's the maximum the vendor owes you if they cause damage?
Red flag: Liability capped at "fees paid in the preceding month." For a $100/month tool that loses your data, max recovery = $100.
What's fair: Liability cap of 12 months' fees at minimum. Carve-outs from the cap for data breaches, confidentiality violations, and gross negligence.
### 7. Security and Compliance
What to check: What security certifications does the vendor have? Do they agree to notify you of breaches?
Red flag: No security commitments, no breach notification obligation, no right to audit.
What's fair: SOC 2 Type II (or equivalent), 72-hour breach notification, annual security assessment available on request.
### 8. Unilateral [Amendment](/glossary/amendment) Rights
What to check: Can the vendor change the terms after you sign?
Red flag: "Vendor may modify these terms at any time. Continued use constitutes acceptance." This is standard in consumer ToS but unacceptable in business contracts.
What's fair: Material changes require written notice and your affirmative consent. You can terminate if you don't accept changes.
### 9. Integration and API Terms
What to check: If you're building on their API, can they change or remove it?
Red flag: "API access may be modified or terminated at any time." If your product depends on their API, this is an existential risk.
What's fair: 12-month API deprecation notice. Maintenance of current API version for at least 6 months after a new version ships.
### 10. [Termination for Cause](/glossary/termination-for-cause)
What to check: Can you exit immediately if the vendor fails to perform?
Red flag: No termination for cause, or cure periods longer than 30 days. If the platform is down for a month, you should be able to leave.
What's fair: Immediate termination for material breach after a 15-30 day cure period. Pro-rata refund of prepaid fees.
Run the Checklist in 60 Seconds
Instead of manually checking all 10 points, upload your vendor agreement to ClauseWize. We check every dimension automatically and flag exactly where the contract falls short — with specific counter-language to negotiate better terms.
This analysis is for informational purposes and does not constitute legal advice.