How to prepare a contract diligence findings report for SaaS Subscription Agreements

A customer-side SaaS diligence report should turn the operative contract package into prioritized decisions about service continuity, spending, data use, and exit. Assemble the governing documents, trace each finding to controlling language, test the customer consequence with operational owners, and assign a response. The deliverable is a concise decision summary supported by a findings table that separates verified wording, interpretation, and missing evidence. It should tell the approval team what needs remediation, what can be accepted, and what remains unresolved before approval.

When to use this workflow

Use this workflow when legal, procurement, or an in-house transaction team must assess existing SaaS subscriptions before an acquisition, consolidation, material expansion, or renewal approval. It suits a critical application or a portfolio, provided the report identifies the products, customer entities, and orders affected by each finding.

The focus is diligence reporting, not a complete renegotiation or implementation plan. Review is U.S.-oriented. Identify governing law, processing roles, customer locations, and service characteristics before applying California privacy or EU switching requirements. Contract conclusions depend on the actual package, facts, and deal context. Legal-source discussion uses October 13, 2026 as its cutoff; the practical checks below are workflow recommendations, not universal legal requirements.

What you need

Collect the executed master agreement, active orders, amendments, data processing agreement, security schedule, service-level agreement, acceptable-use policy, and incorporated online terms. Preserve dated copies of linked materials and distinguish executed documents from proposals or unsigned replacements.

Obtain the evidence needed to interpret that package:

• A subscription inventory identifying products, contracting entities, administrators, business owners, and critical dependencies.
• Invoices, purchased entitlements, usage records, and renewal or price-change correspondence.
• A data-flow description, relevant customer locations, integrations, and available export documentation.
• Existing claims, outages, disputed charges, supplier assurances, and accepted exceptions.
• The customer’s review checklist, approval authorities, and decision date.

Record unavailable inputs rather than substituting assumptions. An absent usage report may prevent quantification without preventing a finding that the contract permits overages without a spending ceiling. Keep supplier statements separate from contractual commitments unless the package establishes their contractual status.

Use the template

Use the SaaS Subscription Agreements — Contract diligence findings report template below. You can copy this table into your working document or spreadsheet. Keep the document inventory and supporting calculations alongside it, linked by stable IDs.

Give each finding a stable identifier. In “Source / evidence,” record the document/version ID, clause, page where available, and a short excerpt or precise paraphrase. For missing wording, identify the documents searched; for missing documents, identify the incorporation reference or other evidence that they belong in the package.

“Baseline / deviation” identifies the customer requirement and its source: internal policy, operational need, or potentially applicable law. “Customer consequence” connects the issue to spending, downtime, disclosure, or migration. “Confidence / gap” distinguishes established wording from unresolved applicability or missing inputs. The final columns identify the action, accountable owner, approver, and disposition. Keep severity separate from confidence: a potentially serious issue may still be unverified.

Step by step

1. Define the decision and review boundary

Write a short mandate identifying why the report is needed, the approval it supports, and the subscriptions in scope. Ask whether the customer intends to retain, consolidate, transfer, or replace each service. Those objectives change which provisions matter most.

For an acquisition, investigate assignment and change-of-control wording without assuming that the transaction triggers either. For consolidation, emphasize entitlement portability, minimum commitments, duplicate subscriptions, and exit dependencies. Identify which services support essential processes and whether a workable substitute exists.

Establish priority criteria based on impact, operational dependency, likelihood, and available remedy—not clause labels alone.

Record: affected entities, contracts, and products in “Contract / scope,” with the relevant customer baseline and decision dependency.

2. Establish the operative document package

Create document IDs and identify execution status, dates, incorporation language, amendments, and precedence provisions. Reconcile orders to the master they actually reference. A later upload date does not establish that a document amended the agreement.

Hierarchy must come from the package. For example, § 12.3 of an SEC-filed Salesforce agreement places the applicable order above the master and the master above documentation, while rejecting customer purchase-order terms. That is illustrative wording, not a universal SaaS hierarchy.

For linked policies, record the available version and investigate whether the contract permits changes. An unavailable incorporated policy is an evidence gap, not proof that the contract lacks the relevant protection.

Record: controlling references in “Source / evidence,” conflicts in “Confidence / gap,” and an owner for each document request.

3. Extract terms that affect the customer’s decision

Review fees and usage, renewal and termination, suspension, service commitments, data rights, security, liability, indemnities, assignment, and exit. Capture exceptions, definitions, triggers, and customer duties alongside headline protections. Trace whether an order or product schedule changes the master provision.

For usage charges, identify the unit, measurement window, pooling rules, expiry, and access to measurement evidence. The filed Salesforce order’s utilization notice illustrates why: it specifies no rollover, Central Standard Time measurement, monthly arrears billing, and contractual rather than technical limits. It does not establish current pricing or customary terms.

For exit, distinguish a right to retrieve data from commitments about formats, attachments, metadata, assistance, or continued access. Capture customer deadlines for invoice disputes and service-credit claims where they affect recovery.

Record: one decision-relevant issue per row, including its trigger, exceptions, source, and customer baseline.

4. Test consequences and conditional legal requirements

Read remedies together. A service credit may not cover migration expense; a liability cap may not address the immediate effect of suspension. Test cap scope, exclusions, indemnities, and exclusive-remedy language against the identified loss scenario. Ask technical and finance owners to validate dependencies and calculations. Quantify exposure only when fee bases, usage inputs, periods, and assumptions are supported.

For covered California service-provider or contractor relationships, 11 CCR § 7051(a)–(b) specifies processing-purpose and use restrictions, oversight rights, inability-to-comply notification, remediation rights, and subcontractor requirements. Establish coverage and roles first. These requirements do not universally demand unrestricted audits or a particular security certification.

Where an EU overlay may apply, assess territorial coverage, qualifying services, and exceptions. Data Act Articles 25–26 address written switching terms and information about switching methods, formats, and limitations. Article 25’s generally maximum 30-calendar-day transition follows the notice period and permits extensions; Article 31 provides special treatment for certain services. Do not report an unconditional migration guarantee.

Record: consequences, applicability uncertainty, calculation references, and the specialist or operational owner responsible for validation.

5. Prioritize and propose an achievable response

Apply a consistent severity scale tied to the pending decision. Reserve high priority for issues that could prevent the intended use or create exposure exceeding the customer’s approval criteria. Explain why other findings can wait; a missing document does not automatically merit the highest rating.

Separate four responses: obtain evidence, seek contractual remediation, implement an operational control, or obtain informed acceptance. A missing attachment generally needs investigation before a confident redline recommendation. An accepted overage structure may instead require purchasing controls supported by reliable usage records.

Distinguish business concessions from suspected legal noncompliance. Identify the approval authority and specify what evidence would permit closure.

Record: priority, proposed response, responsible owner, closure condition, and required approval.

6. Validate findings against evidence and stakeholders

Have a second reviewer trace significant findings to the controlling package. Recheck defined terms, exceptions, and cross-references. Ask finance to confirm economic inputs and technical owners to assess exports, continuity arrangements, and administrative controls.

For a portfolio, normalize currency, fee basis, term length, product scope, and cap measurement periods before comparing outcomes. Distinguish negotiated deviations from different service tiers, amendment dates, jurisdictions, or incomplete files. Do not describe the comparison as a market benchmark.

Resolve disagreements explicitly: record whether the disagreement concerns wording, applicability, operational impact, or risk appetite. An operational owner’s willingness to accept a risk does not establish authority to approve it.

Record: corrected evidence, confidence, reviewer disposition, and unresolved questions with named owners. Preserve finding IDs when assessments change.

7. Deliver the decision summary and controlled findings table

Lead with decisions required, not a clause inventory. Summarize scope, material limitations, highest-priority findings, and recommendations. Link summary items to table rows so readers can inspect the evidence without duplicating the analysis.

Distinguish accepted risk from resolved issues. A supplier request remains open until evidence or an agreement supports closure. If approval depends on obtaining a schedule or confirming export capability, state that condition expressly. Identify the report version and package reviewed so later amendments do not silently invalidate its conclusions.

Record: disposition, approver, approval conditions, and evidence supporting closure. Assign unresolved items before circulating the report as decision-ready.

Worked example

Fictional scenario: Alder Quay Manufacturing is assessing its Nimbus Ledger subscription before consolidating purchasing systems. All parties, documents, amounts, and provisions below are invented.

The package contains master M1, executed order O2, and DPA D1. O2 purchases 100,000 processing events monthly for $18,000, with excess events priced at $0.12 each and no technical stop. Finance forecasts a peak month of 140,000 events but supplies no reconciled usage records. M1 allows ten days for post-termination retrieval. The supplied package specifies no export format, and IT has not tested attachments. D1 references processing-purpose Schedule A, which is missing.

Finance treats uncontrolled peak spending as approval-sensitive. IT requires usable records and attachments for consolidation. Privacy counsel cannot complete its review without the processing schedule and role assessment.

F01 supports a scenario calculation—40,000 excess events multiplied by $0.12—not a finding that $4,800 is already owed or will recur every month. F02 makes technical testing relevant to acceptance: a longer retrieval period alone would not establish export usability. F03 requires evidence and a coverage assessment, not a declaration that the DPA is deficient. These gaps justify conditional approval or escalation under the customer’s criteria, rather than unconditional clearance.

Common mistakes

• Reviewing only the master. Orders may change usage, renewal, or remedies. Reconcile findings against applicable orders and amendments.
• Equating an incomplete folder with missing contractual protection. Identify incorporation references and assign retrieval before drawing conclusions.
• Scoring clauses without consequences. Explain the affected process, data, expense, and available remedy.
• Treating forecast usage as established liability. Label scenarios and preserve measurement assumptions and calculation inputs.
• Closing findings when requests are sent. Verify the response and distinguish remediation from approved acceptance.

Final quality check

• Each material finding identifies the affected entity, product, and controlling version.
• Source references have been checked against text and amendments.
• Missing evidence is distinguished from verified absence of wording.
• Estimates show inputs, periods, assumptions, and calculation references.
• Legal applicability questions are resolved or assigned.
• Severity reflects customer consequences and available remedies.
• Open issues have owners; acceptance identifies approvers and conditions.
• The summary matches the table’s current dispositions and review scope.

Complete the workflow with DecoverAI

DecoverAI is the Legal Intelligence Platform for litigation and transactions. Due diligence capabilities include bulk document classification to organize materials and prioritize human review; tabular review supports work across multiple documents. In Word, contract review supports represented-party selection and deal-specific instructions, with findings that quote and locate clauses, rank severity, and identify missing language as not present. Lawyers must validate findings against the operative package and retain responsibility for conclusions. The report remains the team’s work product. To discuss this workflow, book a demo.

Frequently asked questions

How much contract text belongs in the report?

Use a short excerpt or precise paraphrase with a stable source reference. Preserve qualifications and exceptions. Keep lengthy analysis in referenced workpapers rather than duplicating the agreement.

Should the report include renewal dates?

Yes, when they affect the decision. Verify order variations, notice methods, recipients, and calculation assumptions. Section 11.2 of the filed Salesforce agreement illustrates a 30-day written nonrenewal notice requirement subject to order variation; it is contractual wording, not a statutory deadline.

Can an incomplete package produce a useful report?

Yes, with limited conclusions. Identify reviewed documents, explain how missing items could change the assessment, and assign retrieval. Where gaps are material, state the approval condition or defer the recommendation.

Should EU switching charges be reported as prohibited?

Not categorically as of October 13, 2026. For covered services, Data Act Article 29 allows reduced switching charges capped at directly related costs during the transitional period; prohibition begins January 12, 2027. Assess Article 31 exceptions and distinguish switching charges from standard service fees and early-termination penalties.

Sources

• SEC Exhibit 10.12: Salesforce Master Subscription Agreement and Order Forms—historical contractual examples, not market standards.
• California CCPA Regulations, effective January 1, 2026, § 7051—covered service-provider and contractor contract requirements.
• Regulation (EU) 2023/2854, Articles 25, 26, 29, and 31—conditional switching obligations, charging rules, and exceptions.

This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.