Checklist · Technology

Reviewing a Software or Cloud Services Agreement: A Practical Checklist

15 U.S.C. § 7001

Type
Checklist
Jurisdiction
National
Date
2025-07-26
Topic
Technology

This checklist sequences the review of a software or cloud services agreement from first contact through renewal. Phase one identifies what you are buying, what data is involved, and which documents make up the contract. Phase two covers the commercial terms — scope of use, metrics, term, renewal, and price adjustment. Phase three covers service levels and support. Phase four covers risk allocation: liability caps, carve-outs, indemnities, warranties, and insurance. Phase five covers data, security, subprocessors, and incident response, including the regulated-data regimes that impose their own contract terms. Phase six covers professional services and acceptance. Phase seven covers exit — termination grounds, export, deletion, and transition assistance. Phase eight covers ongoing administration and the renewal cycle.

Reviewing a Software or Cloud Services Agreement: A Practical Checklist

Technology > Software and Technology Contracts | Published 26 July 2025 - Updated 3 July 2026 | UpLaw - uplaw.us

How to Use This Checklist

Work the phases in order; each depends on the one before. Phase 1 through 7 run before signature. Phase 8 runs for the life of the agreement.

The doctrine behind each item is in software and technology contracts. The plain-language orientation is the contract behind the login. The forms and questionnaires are in the SaaS agreement and vendor diligence toolkit.

Phase 1 — Establish What You Are Reading

☐ Classify the transaction. Licensed software you install, a hosted service you access, or a hybrid. The classification determines what protections you need.

☐ List every document that forms the contract. Master agreement, order form, documentation, SLA, data processing addendum, acceptable use policy, support policy, statement of work, and anything incorporated by URL.

☐ Print or archive every document incorporated by reference, with the date. Vendors change posted policies, and the version you agreed to is the one you can prove.

☐ Find the order of precedence clause. If there is none, add one.

☐ Find the amendment clause. Identify what the vendor can change unilaterally. Negotiate: notice, no material reduction of rights or security posture during a paid term, and termination with pro-rata refund for materially adverse changes.

☐ Identify what data will go into the system — customer records, employee records, health information, financial account data, student records, children's data, trade secrets, source code — because the answer drives Phases 4 and 5.

☐ Confirm who is authorized to accept and record who accepted, what version, and when.

☐ Check formation mechanics if the agreement was accepted online. Electronic records and signatures have legal effect under 15 U.S.C. § 7001, with the state-law interaction at 15 U.S.C. § 7002 and exceptions at 15 U.S.C. § 7003. See building an enforceable online agreement and e-signature process.

☐ Resolve any battle of the forms before performance begins by naming the governing document in writing.

Phase 2 — Scope, Term, and Price

☐ Read the grant or right of access. For licensed software, confirm it covers the acts you will perform, since loading a copy implicates the reproduction right at 17 U.S.C. § 106 and the safe harbor at 17 U.S.C. § 117 generally does not help a licensee.

☐ Confirm the user population. Affiliates, subsidiaries, contractors, and outsourced staff must be named if they will use the service.

☐ Confirm the environments. Production, staging, test, disaster recovery, and training.

☐ Identify the usage metric — named users, concurrent users, storage, transactions, API calls — and model what happens at two and five times current volume.

☐ Find the overage rate and whether the vendor may true up mid-term or force a tier upgrade.

☐ Read the restrictions. Reverse engineering, benchmarking, resale, circumvention. If interoperability work is planned, negotiate a carve-out; the anticircumvention prohibition at 17 U.S.C. § 1201 and the copyright management information rules at 17 U.S.C. § 1202 operate independently of the contract.

☐ Check the feedback clause so it does not sweep in your confidential information or trade secrets, which have their own federal protection under 18 U.S.C. § 1836.

☐ Note the initial term and whether a shorter term with a price cap is available.

☐ Find the auto-renewal notice deadline and calendar it today.

☐ Negotiate a renewal price cap — a fixed percentage or an index-linked figure — for at least two renewals, and confirm whether it applies to unit price or total spend.

☐ Check payment terms, late fees, suspension for nonpayment, and whether prepaid fees are refundable on termination for the vendor's breach.

Phase 3 — Service Levels and Support

☐ Translate the uptime percentage into minutes. 99.9% permits about forty-three minutes a month; 99% permits more than seven hours.

☐ Read every exclusion. Scheduled maintenance, emergency maintenance, customer-caused issues, third-party networks, force majeure, beta features, and suspension.

☐ Cap scheduled maintenance hours per month and require a defined window and advance notice.

☐ Check who measures availability, with what tools, and whether the data is available to you.

☐ Check the definition of unavailable. Total inaccessibility is far weaker than material degradation of a core function.

☐ Check whether the SLA is measured per service or per module, and whether the modules you depend on are covered.

☐ Read the remedy. Credit percentage, aggregate cap, and whether it is the sole and exclusive remedy.

☐ Require automatic application of credits rather than a claim process with a short window.

☐ Negotiate a chronic-failure termination right — a defined number of misses in a rolling twelve months, terminable without penalty with a pro-rata refund. This is worth more than any credit percentage.

☐ Confirm support terms: severity definitions tied to business impact, response targets, escalation contacts by role, hours of coverage, and a root cause analysis obligation for the most severe incidents.

☐ Ask for historical uptime and recent incident postmortems. A vendor with a public status page and published postmortems is telling you something useful.

Phase 4 — Risk Allocation

☐ Find the exclusion of indirect damages and understand that it removes lost profits, lost revenue, lost data, and business interruption — most of what a software failure actually costs.

☐ Find the aggregate cap and compute it in dollars, not in months.

☐ Compare the cap to the exposure. If you hold regulated data and the cap is twelve months of fees, the mismatch is structural.

☐ Negotiate carve-outs or a supercap for confidentiality breach and security incidents. Two to three times annual fees is a common landing.

☐ Change "fees paid" to "fees paid or payable" so prepayment does not shrink the cap.

☐ Check mutuality of both the cap and the carve-outs.

☐ Exclude your payment obligations from the indirect damages waiver so the vendor cannot use it against its own fee claim.

☐ Read the IP indemnity: scope of covered rights, control of defense, consent for settlements imposing obligations on you, remedy options, exclusions, and whether it is capped.

☐ Negotiate a wind-down if the vendor's indemnity remedy includes termination and refund, so it cannot cure by cutting off access.

☐ Ask for a security and confidentiality indemnity covering third-party claims and, where obtainable, your regulatory response and notification costs.

☐ Limit your own indemnity to third-party claims and resist language letting the vendor recover its own losses through it.

☐ Read the warranty. Documentation conformance is typical. Incorporate the documentation and prohibit unilateral reductions in documented functionality during a paid term.

☐ Add a no-malicious-code warranty and a warranty of compliance with the security exhibit.

☐ Check the integration clause against anything the sales team promised. If a demonstration sold the deal, get the capability written down.

☐ Require insurance: cyber liability, technology errors and omissions, and commercial general liability at limits proportionate to the data at risk, with certificates before signature.

☐ Check the limitations period. Some forms shorten it to one year, which is short for a data problem that surfaces late.

☐ Read the dispute resolution clause: forum, arbitration, injunctive relief carve-out, and an executive escalation step.

Phase 5 — Data, Security, and Incidents

☐ Confirm you own your data, including data you upload, data you enter, and output generated for you.

☐ Read the vendor's license to your data and cut "and to improve our services" back to providing, maintaining, securing, and supporting the service.

☐ Address model training expressly: whether your data may train models, whether those models serve other customers, who owns derived outputs, and whether you may opt out.

☐ Check the aggregated and de-identified data clause for a real de-identification standard, a re-identification prohibition, and non-attribution.

☐ Require export in a documented, machine-readable format, available on demand during the term and for a stated period after.

☐ Test the export before signing if you can, and in any case within the first quarter.

☐ Require deletion after the export window, extended to backups on a defined schedule, with written certification.

☐ Replace "commercially reasonable security" with specifics: named framework, annual independent audit or certification with the report provided, encryption in transit and at rest, multi-factor authentication for administrative access, least-privilege access control, personnel screening, vulnerability management with remediation timelines, and annual penetration testing with a summary.

☐ Negotiate an audit ladder: certification report annually, questionnaire on request, remote review on notice, on-site audit triggered by an incident or regulator demand.

☐ Fix incident notification: trigger at discovery or reasonable suspicion rather than confirmation; deadline in hours, not "promptly"; required content; and cooperation with your own notification obligations at the vendor's expense where the vendor caused the incident. See responding to a data breach: a first 72 hours checklist and data breach notification law.

☐ Get the subprocessor list, with notice of additions, a right to object, flow-down of equivalent obligations, and vendor responsibility for subprocessor acts.

☐ Confirm storage and processing locations and require notice of changes.

☐ Match the regime to the data:

☐ Reconcile the business associate agreement or DPA with the master agreement so the liability terms do not contradict each other.

☐ Confirm your public statements match the contract. Misrepresenting security or privacy practices is reachable as an unfair or deceptive practice under 15 U.S.C. § 45. See drafting a privacy policy.

☐ Do not run security testing without written authorization. Unauthorized access can implicate 18 U.S.C. § 1030 and, for stored communications, 18 U.S.C. § 2701.

Phase 6 — Professional Services and Acceptance

☐ Put implementation work in a statement of work with deliverables, milestones, assumptions, dependencies, and change control.

☐ Choose a pricing model — fixed fee, time and materials, or capped time and materials — and understand who bears estimation risk.

☐ Define acceptance: criteria, testing period long enough to actually test, defect severity scale, re-test cycles, and the remedy after a stated number of failed cycles.

☐ Check deemed-acceptance periods and extend them if they are unrealistically short.

☐ Take an assignment of custom deliverables. Copyright vests in the author under 17 U.S.C. § 201; work made for hire requires the conditions in 17 U.S.C. § 101; a transfer must be written and signed per 17 U.S.C. § 204.

☐ Grant back a license to the vendor's pre-existing tools and general-purpose components so the assignment is workable.

☐ Name key personnel and require approval for replacements on material engagements.

☐ Request a software bill of materials and confirm vendor warranties cover third-party components. See open source software compliance.

Phase 7 — Exit

☐ List the termination grounds available to each party and confirm you have: material breach with cure, chronic SLA failure, material adverse unilateral change, and — where obtainable — convenience with notice.

☐ Check suspension rights. Negotiate notice, a cure period, and suspension limited to the offending user or workload rather than the whole account.

☐ Confirm pro-rata refund of prepaid fees on termination for the vendor's breach.

☐ Negotiate transition assistance: continued access for a defined period at the then-current rate, full data export in a documented format, delivery of configuration and metadata, cooperation with a successor vendor at stated hourly rates, and no conditioning of any of it on a release of claims.

☐ Set the export window and confirm it starts on the termination date, not on the vendor's convenience.

☐ Confirm deletion and certification after the window.

☐ List surviving provisions: confidentiality, accrued payments, indemnities, limitation of liability, dispute resolution.

☐ Consider continuity mechanisms proportionate to dependence: scheduled data export held by you, deployment escrow with a tested restoration procedure, or a defined continuity period after an insolvency filing. Traditional source code escrow rarely helps for a hosted service.

☐ Ask the vendor to describe its most recent customer migration. A candid answer indicates a real export path.

Phase 8 — Administration and Renewal

☐ Add the vendor to your inventory the day you sign: what it does, what data it holds, annual cost, term dates, renewal notice deadline, liability cap, incident notification period, subprocessor list date, and export method.

☐ Calendar the renewal notice deadline with a reminder thirty days before it.

☐ Diary the security review — certification report, questionnaire refresh, subprocessor list check — annually.

☐ Test the export annually and confirm the files open and contain what they should.

☐ Watch for posted changes to the acceptable use policy, DPA, and SLA, and archive each version.

☐ Track SLA misses so the chronic-failure right is provable if you need it.

☐ Record every incident the vendor reports, with dates, so a pattern is documented.

☐ Review usage against the metric before renewal so the vendor's true-up is not a surprise.

☐ Before each renewal, scope one alternative and price migration. Leverage in this market comes from a documented option, not from argument.

☐ Confirm insurance certificates are current at each renewal.

☐ Reconfirm authority controls — who may accept in-product terms updates — at least annually.

Quick Reference: Where to Spend Leverage

| Priority | Ask | Typical outcome | |---|---|## Worked Example: A Forty-Seat Subscription

Meridian Design, a twenty-eight person studio, is buying a project management platform at roughly thirty thousand dollars a year. It has almost no leverage and a take-it-or-leave-it form. Here is what a two-hour review produced.

Phase 1 identified six documents, three of them incorporated by URL. Meridian archived all six with dates and asked for an order of precedence clause; the vendor added one without argument.

Phase 2 found an annual auto-renewal with a sixty-day notice deadline, calendared immediately, and a price clause allowing any increase on thirty days' notice. Meridian asked for a seven percent cap for two renewals and got it — the account executive had authority for exactly this concession.

Phase 3 revealed a 99.5% commitment with unlimited scheduled maintenance excluded. Meridian did not fight the percentage; it asked for maintenance to be capped at eight hours per month in a defined overnight window with forty-eight hours' notice. Granted.

Phase 4 showed a twelve-month fee cap and no security indemnity. Meridian's data was client project files and contact information — sensitive but not regulated — so it did not push for a supercap. It did add a no-malicious-code warranty and required a cyber liability certificate.

Phase 5 produced the most valuable changes: export in CSV and JSON on demand, a sixty-day post-termination export window, incident notification within seventy-two hours of discovery rather than "promptly upon confirmation," and deletion of the "improve our services" language in favor of an enumerated list. The vendor declined to name subprocessors but agreed to provide the list on request and to give notice of additions.

Phase 7 added ninety days of transition assistance at the then-current rate.

The vendor declined: audit rights, changes to the SLA credit structure, a supercap, and a mutual liability cap. Meridian signed. Total cost of the review: one afternoon. Total value: a renewal cap worth roughly nine thousand dollars over two years, plus an exit that actually works.

⭐ Key insight. Most vendors have a standard concession set below their negotiation threshold, and they give it to customers who ask specifically. Vague requests to "improve the terms" get nothing; a numbered list of eight specific asks gets five of them.

Worked Example: The Question That Changed the Deal

A healthcare group was two days from signing with a scheduling vendor when someone asked Phase 7's last question: describe your most recent customer migration.

The vendor's answer was that no customer had ever left, and that export was available "through our support team." Pressed, the vendor acknowledged there was no self-service export, that appointment history could be provided as a PDF report, and that structured data export would be a professional services engagement quoted at the time.

That is not an exit. The group paused, required a tested export in a structured format as a condition of signature, and got it — the vendor built it in three weeks because the deal was worth more than the engineering time. Every subsequent customer of that vendor benefited from one question asked before signature rather than after termination.

---| | 1 | Data export in a documented format, during and after term | Usually granted | | 2 | Incident notification in hours from discovery | Usually granted | | 3 | Renewal price cap for two renewals | Usually granted | | 4 | Chronic-failure termination right | Often granted | | 5 | Notice and termination right for adverse unilateral changes | Often granted | | 6 | Security-incident supercap (2–3× annual fees) | Granted at meaningful spend | | 7 | Subprocessor notice and objection | Often granted | | 8 | Documentation incorporated into the warranty | Often granted | | 9 | Mutual liability cap and symmetrical carve-outs | Sometimes granted | | 10 | Customer-specific on-site audit rights | Rarely granted absent an incident | | 11 | Uncapped general liability | Effectively never |

Red Flags

⚠ Terms incorporated by URL with no version history. ⚠ An SLA whose exclusions include anything outside the vendor's "direct control." ⚠ A twelve-month fee cap paired with custody of regulated data. ⚠ A data license permitting use "to improve our services" without qualification. ⚠ Export described only as "vendor's standard format." ⚠ Incident notification "promptly upon confirmation." ⚠ A subprocessor clause naming no subprocessors. ⚠ Suspension without notice for acceptable use violations. ⚠ A one-year contractual limitations period. ⚠ No mention of what happens to data on termination. ⚠ A business associate agreement or DPA that contradicts the master agreement. ⚠ An indemnity remedy that lets the vendor terminate and refund with no transition period.

Common Mistakes

  1. Signing the order form without reading what it incorporates.
  2. Failing to calendar the renewal notice deadline at signature.
  3. Treating SLA credits as compensation.
  4. Negotiating the IP indemnity hard and the security indemnity not at all.
  5. Accepting export in a proprietary format.
  6. Leaving model training rights unaddressed.
  7. Permitting unilateral amendment of the security exhibit.
  8. Capping unit price while leaving seat growth uncapped.
  9. Running a penetration test without written authorization.
  10. Buying escrow for a hosted service instead of scheduled exports.
  11. Discovering the subprocessor list for the first time during a breach.
  12. Negotiating transition assistance after sending the termination notice.

Related Documents