Toolkit · Technology

The SaaS Agreement and Vendor Diligence Toolkit

42 U.S.C. § 1320

Type
Toolkit
Jurisdiction
National
Date
2025-02-25
Topic
Technology

This toolkit collects the working documents used to buy, negotiate, administer, and exit a software or cloud services agreement. It opens with a decision map and a redline priority list that ranks what to ask for at each deal size. It then supplies templates: a vendor security and diligence questionnaire, an order of precedence clause, an amendment-control clause, a liability supercap clause, a security exhibit outline, a data processing addendum outline, a data export and portability clause, an incident notification clause, a subprocessor objection letter, an SLA credit claim, a renewal notice, a statement of work skeleton with acceptance criteria, a termination and transition letter, and a vendor inventory sheet. Each is followed by drafting notes. Reference tables cover uptime math, liability structures, and regulated data regimes.

The SaaS Agreement and Vendor Diligence Toolkit

Technology > Software and Technology Contracts | Published 25 February 2025 - Updated 8 August 2026 | UpLaw - uplaw.us

What Is in This Toolkit

Fourteen working documents in the order a vendor relationship uses them, plus reference tables. Each form is a starting point; the drafting notes say what to change and why.

The doctrine is in software and technology contracts. The plain-language orientation is the contract behind the login. The sequenced review is reviewing a software or cloud services agreement.

Decision Map

Situation Instrument Also read
Evaluating vendors Questionnaire (Form 1) Building a privacy compliance program
Multiple documents, unclear hierarchy Precedence clause (Form 2) Contracts: a comprehensive guide
Vendor can change terms at will Amendment control (Form 3) Electronic signatures and online contract formation
Cap too low for the data at stake Supercap (Form 4) Guide, Part 6
"Commercially reasonable security" Security exhibit (Form 5) Cybersecurity and data breach response
Personal or regulated data DPA outline (Form 6) Data privacy compliance
Worried about lock-in Export clause (Form 7) Guide, Part 8
"Promptly upon confirmation" Incident clause (Form 8) Data breach notification law
New subprocessor announced Objection letter (Form 9) Guide, Part 9
Outage occurred SLA credit claim (Form 10) Guide, Part 4
Renewal approaching Renewal notice (Form 11) Checklist, Phase 8
Implementation project SOW skeleton (Form 12) Open source software compliance
Ending the relationship Transition letter (Form 13) Checklist, Phase 7
Managing many vendors Inventory sheet (Form 14) Standing up a privacy compliance program

The Redline Priority List

Spend leverage in this order. Below roughly fifty thousand dollars annually, expect items 1 through 5. Above that, expect 1 through 9.

  1. Data export in a documented, machine-readable format, during the term and for sixty days after.
  2. Incident notification within seventy-two hours of discovery or reasonable suspicion.
  3. Renewal price cap for at least two renewals.
  4. Notice before terms change, with termination and pro-rata refund for materially adverse changes.
  5. Order of precedence among contract documents.
  6. Termination for chronic SLA failure without penalty, with pro-rata refund.
  7. Security exhibit attached, not referenced, and not unilaterally amendable.
  8. Supercap for security incidents and confidentiality breach.
  9. Subprocessor list, notice of additions, and objection rights.
  10. Documentation incorporated into the warranty.
  11. Transition assistance at defined rates for ninety days.
  12. Mutual liability cap with symmetrical carve-outs.

Form 1 — Vendor Security and Diligence Questionnaire

Company. Legal entity name; state of formation; years in operation; ownership; any pending change of control.

Service. Description; architecture (single or multi-tenant); hosting provider and regions; components subject to third-party licenses.

Security program. Framework followed; current certification or audit report (attach); date of last penetration test (attach summary); vulnerability remediation timelines by severity; encryption in transit and at rest; key management; multi-factor authentication for administrative access; access review cadence; personnel screening and training; secure development lifecycle.

Availability. Historical monthly uptime for the last twenty-four months; public status page URL; postmortems for the three most recent severity-one incidents; disaster recovery objectives (RTO and RPO); backup frequency and restoration testing cadence.

Data. Categories collected; storage and processing locations; retention schedule; deletion process including backups; export formats available and whether self-service; whether customer data is used for model training or product improvement, and whether opt-out is available.

Subprocessors. Complete current list with name, function, and location; notice process for additions; flow-down terms.

Incidents. Any security incident in the last thirty-six months affecting customer data; description and remediation; notification timelines actually achieved.

Compliance. Applicable regimes supported; whether a business associate agreement is available; whether a data processing addendum is available; transfer mechanisms for cross-border processing.

Insurance. Cyber liability, technology errors and omissions, and general liability limits; certificates attached.

Support. Severity definitions; response targets; hours of coverage; escalation contacts by role.

Exit. Describe the most recent customer migration off the service, including the export mechanism used and the elapsed time.

Drafting notes. The last question is the most diagnostic item on the form. A vendor that can describe a real migration has a real export path; a vendor that cannot is describing lock-in without meaning to. The historical uptime request matters more than the contractual commitment, because the commitment is a floor with exclusions and the history is what happened.

Form 2 — Order of Precedence

In the event of a conflict among the documents comprising this Agreement, the following order of precedence applies, from highest to lowest: (a) any written amendment executed by both parties; (b) the applicable Order Form; (c) this Master Agreement; (d) the Data Processing Addendum; (e) the Service Level Agreement; (f) the Documentation; and (g) any policy incorporated by reference, including the Acceptable Use Policy.

No preprinted terms on a purchase order, invoice, or similar document issued by either party will modify this Agreement, regardless of any acknowledgment or performance.

Drafting notes. The second paragraph resolves the battle of the forms before it starts. Order forms sit above the master agreement because that is where negotiated concessions land.

Form 3 — Amendment Control

Vendor may modify the Documentation, Acceptable Use Policy, and Service Level Agreement from time to time, provided that: (a) Vendor gives Customer at least thirty days' prior written notice of any modification; (b) no modification during a paid term will materially reduce the functionality committed in the Documentation as of the Order Form date, materially reduce the security commitments in the Security Exhibit, or materially diminish Customer's rights or increase Customer's obligations; and (c) if Vendor makes a modification that is materially adverse to Customer, Customer may terminate the affected Order Form on notice given within thirty days of the modification's effective date and receive a pro-rata refund of prepaid, unused fees.

Modifications to this Master Agreement, the Data Processing Addendum, and the Security Exhibit require a written amendment signed by both parties.

Drafting notes. Vendors accept notice plus a termination right far more readily than a freeze. Pulling the security exhibit and DPA out of unilateral amendment is the item most worth insisting on, since those are the documents that carry the customer's regulatory obligations.

Form 4 — Liability Supercap

Except as set out below, each party's aggregate liability arising out of or related to this Agreement will not exceed the fees paid or payable by Customer under the applicable Order Form in the twelve months preceding the event giving rise to liability.

Supercap. Each party's aggregate liability for (a) breach of its confidentiality obligations and (b) a Security Incident caused by that party's breach of the Security Exhibit will not exceed three times the fees paid or payable by Customer under the applicable Order Form in the twelve months preceding the event.

Excluded from all caps: (a) a party's indemnification obligations under Section ____; (b) Customer's obligation to pay fees; (c) either party's gross negligence, willful misconduct, or fraud; and (d) death, bodily injury, or damage to tangible property caused by a party's negligence.

Indirect damages. Neither party is liable for lost profits, lost revenue, loss of use, loss of goodwill, or indirect, incidental, special, consequential, or punitive damages, except that this exclusion does not apply to (i) amounts payable under the indemnities, (ii) Customer's payment obligations, or (iii) a party's gross negligence, willful misconduct, or fraud.

Drafting notes. "Paid or payable" prevents a prepaying customer from shrinking its own cap. Excluding the customer's payment obligation from the consequential damages waiver stops the vendor from using its own exclusion against its fee claim. Where the customer entrusts regulated data, argue the supercap from the exposure: notification, monitoring, and regulatory response costs are quantifiable, and a cap far below them means the customer is insuring the vendor.

Form 5 — Security Exhibit Outline

1. Program. Vendor maintains a written information security program aligned to [named framework], reviewed annually and approved by management. 2. Certification. Vendor obtains an annual independent audit or certification covering the Service and provides the report to Customer on request under confidentiality. 3. Encryption. Data encrypted in transit using current protocols and at rest using industry-standard algorithms; documented key management. 4. Access control. Least privilege; role-based; multi-factor authentication for all administrative and remote access; access reviewed at least quarterly; deprovisioning within twenty-four hours of role change or departure. 5. Personnel. Background screening as permitted by law; confidentiality obligations; annual security training. 6. Development. Secure development lifecycle; code review; separation of production from non-production; no production data in non-production environments without pseudonymization. 7. Vulnerability management. Continuous scanning; remediation of critical vulnerabilities within ____ days, high within ____ days; annual third-party penetration test with an executive summary provided. 8. Logging and monitoring. Security event logging retained for at least ____ months; monitoring with defined alerting. 9. Business continuity. Documented plan; RTO of ____ and RPO of ____; backups encrypted; restoration tested at least annually with results available. 10. Subprocessors. Current list maintained at ____; thirty days' notice of additions; equivalent obligations flowed down; Vendor responsible for subprocessor acts and omissions as for its own. 11. Incident response. Documented plan; notification per Form 8; cooperation with Customer's investigation and notification obligations at Vendor's expense where Vendor caused the incident. 12. Return and deletion. Export per Form 7; deletion from production within ____ days of the export window and from backups within ____ days; certification on request. 13. Audit. Certification report annually; completed questionnaire on request; remote review on thirty days' notice; on-site audit permitted following a Security Incident or on a regulator's demand.

Drafting notes. Attach this as an exhibit and exclude it from unilateral amendment (Form 3). Where the customer's own obligations depend on the vendor — as they do for health data under 42 U.S.C. § 1320d and 45 C.F.R. Part 164, or financial information under 15 U.S.C. § 6801 and 16 C.F.R. Part 314 — the exhibit is the mechanism that pushes those obligations down the chain.

Form 6 — Data Processing Addendum Outline

1. Roles. Customer is the controller or business; Vendor is the processor or service provider. Vendor processes personal data only on documented instructions. 2. Purpose limitation. Vendor will not retain, use, or disclose personal data for any purpose other than performing the Service, and specifically will not sell or share it, or use it to train models that serve other customers. 3. Categories. Data subjects, categories of personal data, sensitive categories, and processing operations, set out in Schedule 1. 4. Confidentiality. Personnel bound by confidentiality obligations. 5. Security. Vendor implements the measures in the Security Exhibit. 6. Subprocessors. General authorization with the list, notice, and objection process in the Security Exhibit; equivalent obligations flowed down; Vendor remains liable. 7. Data subject requests. Vendor assists Customer in responding within ____ days, at no additional charge for a reasonable volume. 8. Incidents. Notification per Form 8; assistance with Customer's notification obligations. 9. Assessments. Vendor provides information reasonably necessary for Customer's data protection assessments. 10. Transfers. Locations identified; transfer mechanism specified; notice of changes. 11. Deletion and return. Per Form 7 and the Security Exhibit. 12. Audit. Per the Security Exhibit. 13. Regulated data. Where applicable, a business associate agreement for protected health information; acknowledgment of institutional control for education records under 20 U.S.C. § 1232g; and, where children's data is processed, the obligations arising under 15 U.S.C. § 6501, 15 U.S.C. § 6502, and 16 C.F.R. Part 312. 14. Precedence. In case of conflict with the Master Agreement regarding personal data, this Addendum controls, except that the Master Agreement's limitation of liability applies as modified by Form 4.

Drafting notes. Paragraph 14 prevents the common failure of a DPA that silently overrides a negotiated liability structure — or is silently overridden by it. Paragraph 2's training prohibition is the provision most often missing and most often needed.

Form 7 — Data Export and Portability

Ownership. As between the parties, Customer owns all Customer Data, including data Customer uploads, data Customer's users enter, and output generated for Customer by the Service. Vendor's license to Customer Data is limited to providing, maintaining, securing, supporting, and improving the Service for Customer, and to complying with law.

Self-service export. Throughout the term, Customer may export all Customer Data through the Service in the following formats: [CSV, JSON, and the documented API], together with a data dictionary describing fields and relationships. Export is available without additional charge and without a support request.

Post-termination export. For sixty days after termination or expiration, Vendor will maintain Customer's account in a read-and-export state and Customer may export all Customer Data in the same formats. On Customer's request during that period, Vendor will also provide configuration, metadata, and integration definitions in a documented format.

Assisted export. If Customer requests assistance, Vendor will provide it at the rates in Section ____, and will not condition assistance on a release of claims, payment of disputed amounts, or execution of any new agreement.

Deletion. Following the export window, Vendor will delete Customer Data from production systems within thirty days and from backups within ninety days, and will certify deletion in writing on request.

Drafting notes. "Without a support request" is the phrase that converts a promise into a capability. Ask for a test export during evaluation; a vendor that cannot produce one in a week does not have the feature it described.

Form 8 — Security Incident Notification

Definition. "Security Incident" means any actual or reasonably suspected unauthorized access to, acquisition of, disclosure of, loss of, alteration of, or destruction of Customer Data, or any unauthorized access to systems processing Customer Data.

Notification. Vendor will notify Customer without undue delay and in no event later than seventy-two hours after Vendor becomes aware of a Security Incident. Awareness occurs when Vendor has a reasonable basis to believe an incident has occurred, and does not require completed investigation or confirmation.

Content. The notice will describe, to the extent known: the nature of the incident; the date and time of occurrence and discovery; the categories and approximate volume of Customer Data affected; the systems involved; containment and remediation steps taken and planned; and a contact for further information. Vendor will supplement as information develops, at least every seventy-two hours until the incident is closed.

Cooperation. Vendor will cooperate with Customer's investigation, preserve relevant evidence and logs, and provide the information Customer reasonably requires to satisfy its own notification obligations. Where the incident arises from Vendor's breach of the Security Exhibit, Vendor will bear the reasonable costs of Customer's investigation, notification to affected individuals, credit monitoring where offered, and regulatory response.

No delay for public relations. Vendor will not delay notification to Customer pending law enforcement request, except to the extent a law enforcement agency directs in writing, and will notify Customer of the fact of such a direction.

Drafting notes. Two words carry this clause: "aware" defined as reasonable basis rather than confirmation, and "seventy-two hours" instead of "promptly." The cost allocation in the cooperation paragraph is what makes the customer's own response affordable; the framework for that response is in responding to a data breach: a first 72 hours checklist and the cybersecurity and incident response toolkit.

Form 9 — Subprocessor Objection Letter

Dear ______,

We received your notice dated ______ that ______ will be added as a subprocessor for the Service effective ______, performing ______.

Under Section ____ of the Data Processing Addendum, we object to this addition on the following grounds: [describe — for example, the subprocessor's location is outside our permitted processing regions; the subprocessor's security posture is not documented; the function involves access to regulated data not previously shared with any subprocessor].

Please advise within ____ days whether: (a) Vendor will provide the Service to us without engaging this subprocessor; (b) Vendor will provide additional information or safeguards sufficient to resolve our objection, and what those would be; or (c) Vendor is unable to accommodate the objection.

If the objection cannot be resolved, we will exercise our right under Section ____ to terminate the affected Order Form and receive a pro-rata refund of prepaid, unused fees.

Drafting notes. Objections work when the ground is specific and the remedy is already in the contract. An objection with no contractual consequence is a comment.

Form 10 — SLA Credit Claim

Dear ______,

Under Section ____ of the Service Level Agreement, we claim a service credit for the following incident.

Incident: ______ Start: ______ End: ______ Duration: ______ Affected functionality: ______ Evidence: [monitoring logs, support ticket numbers, status page screenshots with timestamps] Monthly availability as calculated by Customer: __% Applicable credit tier: % of monthly fees for the affected Service Credit claimed: $

We do not agree that any exclusion in Section ____ applies, because ______.

Please apply the credit to the next invoice and confirm in writing. This claim is without prejudice to our rights under Section ____ [chronic failure termination] and is not a waiver of any other remedy.

Drafting notes. File the claim even when the amount is trivial, because a documented pattern of misses is what makes the chronic-failure termination right provable when it matters. Note the incident in the vendor inventory (Form 14) the same day.

Form 11 — Renewal or Non-Renewal Notice

Dear ______,

Option A — Non-renewal. Pursuant to Section ____ of the Agreement, Customer gives notice that it will not renew the Order Form dated ______, which expires on ______. Please confirm receipt and provide: the export procedure and formats available; the post-termination export window and its end date; the rates for transition assistance; and the deletion schedule and certification process.

Option B — Renewal on revised terms. Pursuant to Section ____, Customer gives notice that it does not intend to renew on current terms. Customer is prepared to renew for a ____ month term subject to: [pricing]; [renewal cap]; [SLA change]; [security exhibit attachment]; [export commitment]. Please respond by ______, which is ____ days before the notice deadline.

Drafting notes. Option B is the more useful letter, and it must be sent early enough that a failed negotiation still leaves time to give a clean non-renewal notice. Work backward from the deadline: negotiation window, then notice window, then decision date.

Form 12 — Statement of Work Skeleton

1. Scope. Deliverables, described specifically enough that completion is verifiable. 2. Assumptions. Everything the estimate depends on — data quality, availability of customer personnel, third-party system behavior, environment readiness. 3. Dependencies. What Customer must provide, by when. 4. Schedule. Milestones with dates and the deliverable due at each. 5. Fees. [Fixed fee / time and materials capped at $____], invoicing schedule, expenses policy. 6. Change control. Written change orders signed by both parties; no work outside scope without one; impact on fees and schedule stated in the change order. 7. Acceptance. Customer has ____ business days from delivery to test against the acceptance criteria in Schedule A. Defects are classified as Severity 1 (blocks a criterion), 2 (materially impairs), or 3 (cosmetic). Vendor remedies Severity 1 and 2 defects within ____ days and redelivers; Customer retests. After ____ failed cycles, Customer may terminate this Statement of Work and receive a refund of fees paid for the affected deliverable. Deemed acceptance occurs if Customer does not respond within the testing period. 8. Ownership. Vendor assigns to Customer all right, title, and interest in the Deliverables, excluding Vendor's pre-existing materials and general-purpose tools, which Vendor licenses to Customer on a perpetual, worldwide, non-exclusive basis for use with the Deliverables. 9. Key personnel. Named individuals; replacement subject to Customer's reasonable approval. 10. Third-party components. Vendor provides a software bill of materials for the Deliverables and warrants that no component imposes obligations on Customer's own software.

Drafting notes. Paragraph 8 matters because copyright vests initially in the author under 17 U.S.C. § 201; the work-made-for-hire route requires the conditions in the definition at 17 U.S.C. § 101, and a transfer must be in a signed writing under 17 U.S.C. § 204. Take an assignment, not a promise. Paragraph 2 prevents the most common services dispute, which is an unstated assumption that failed.

Form 13 — Termination and Transition Letter

Dear ______,

Customer terminates the Agreement dated ______ effective ______, pursuant to Section ____ [material breach uncured after notice dated ______ / chronic service level failure under Section ____ / non-renewal].

This letter confirms the transition obligations:

  1. Continued access. Customer retains full access through ______ and read-and-export access through ______.
  2. Export. Vendor will make available, in the formats specified in Section ____, all Customer Data, together with configuration, metadata, and integration definitions, plus a data dictionary.
  3. Assistance. Vendor will provide transition assistance at the rates in Section ____, including up to ____ hours of engineering support and reasonable cooperation with our successor provider. Assistance is not conditioned on any release, waiver, or new agreement.
  4. Refund. Vendor will refund prepaid, unused fees of $______ within ____ days.
  5. Deletion. Following the export window, Vendor will delete Customer Data from production within ____ days and from backups within ____ days, and will certify deletion in writing.
  6. Survival. Confidentiality, indemnities, limitation of liability, and dispute resolution survive per Section ____.
  7. Outstanding items. [Open support tickets; unresolved SLA credits of $______; the security incident reported on ______ and its remediation.]

Please confirm each item in writing within ten business days.

Drafting notes. Item 3's final sentence exists because vendors sometimes tie transition help to a release. Negotiate that language at signature; asking for it after a termination notice rarely succeeds.

Form 14 — Vendor Inventory Sheet

Field Entry
Vendor and product
Business owner
What it does
Data categories held
Regulated regime, if any
Annual cost
Contract start / end
Renewal notice deadline
Governing documents and versions archived
Liability cap (dollars)
Supercap / carve-outs
Incident notification period
Subprocessor list date
Export method and format
Last export test
Certification report date
Insurance certificate expiry
SLA misses this term
Incidents reported
Migration alternative identified

Drafting notes. The bolded row prevents more waste than every other line combined. Review the sheet quarterly; refresh the certification and subprocessor rows annually.

Reference Tables

Uptime math

Commitment Downtime / 30-day month Downtime / year
99% 7h 12m ~3.65 days
99.5% 3h 36m ~1.83 days
99.9% 43m ~8.76 hours
99.95% 21m ~4.38 hours
99.99% 4m 19s ~52 minutes

Liability structures

Structure What it means When to insist
12-month fee cap Baseline; often trivial in dollars Default
"Paid or payable" Prepayment does not shrink the cap Always
Supercap 2–3× Higher limit for security and confidentiality Regulated or sensitive data
Uncapped indemnity IP and, sometimes, security indemnities Where the vendor chose the components
Uncapped for willful misconduct Standard carve-out Always
Mutual cap Symmetry between the parties Where the customer's exposure is real

Regulated data quick map

Data Core authority Contract consequence
Protected health information 42 U.S.C. § 1320d; 45 C.F.R. Part 160; 45 C.F.R. Part 164 Business associate agreement required
Security standards for health data 42 U.S.C. § 1320d-2 Security exhibit must match
Consumer financial information 15 U.S.C. § 6801; 15 U.S.C. § 6802; 16 C.F.R. Part 314 Service provider oversight obligations
Consumer report data 15 U.S.C. § 1681; 16 C.F.R. Part 681 Permissible purpose; red flags program
Education records 20 U.S.C. § 1232g Vendor acts under institutional control
Children's data 15 U.S.C. § 6501; 15 U.S.C. § 6502; 16 C.F.R. Part 312 Verifiable parental consent flows
Any personal data 15 U.S.C. § 45 Public statements must match practice

Statutes that shape the surrounding terms

Authority Relevance
15 U.S.C. § 7001 Legal effect of electronic records and signatures
15 U.S.C. § 7002 Interaction with state law
15 U.S.C. § 7003 Excepted transactions
17 U.S.C. § 106 Rights a software license must reach
17 U.S.C. § 117 Owner-of-a-copy safe harbor
17 U.S.C. § 1201 Anticircumvention
17 U.S.C. § 512 Safe harbors where the vendor hosts user content
47 U.S.C. § 230 Third-party content liability
18 U.S.C. § 1030 Why security testing needs written authorization
18 U.S.C. § 1836 Trade secret protection for what you disclose

Related Documents