Review a SaaS subscription agreement by assembling the operative document package, confirming what the customer is buying, and testing commercial, operational, data, and liability terms together. Record each material finding against a precise source, explain the customer consequence, and assign a proposed response and decision owner. The deliverable is a source-linked contract review checklist supporting targeted redlines and an approval decision—not merely a list of unfavorable clauses. Separate missing evidence, negotiable business risk, and questions requiring specialist legal analysis.
Use this workflow when customer counsel or an in-house legal team receives a new SaaS agreement, a renewal with revised terms, or an order expanding products, users, or data processing. It supports vendor-paper reviews and checks against an existing negotiated master agreement.
The scope is pre-signature review, not implementation or ongoing contract administration. Start with U.S. commercial practice, then identify governing law, customer locations, processing roles, and service characteristics. Assess California privacy and EU switching requirements separately before applying them. The legal overlays below are conditional, not rules for every SaaS purchase.
Collect the master agreement, proposed order, amendments, product terms, data processing agreement (DPA), security schedule, service-level agreement (SLA), acceptable-use policy, and incorporated online documents. Preserve dated copies and identify whether later online changes would apply.
Obtain a business brief covering:
The negotiation checklist is the customer’s own work product. Record its version and identify which commercial, privacy, security, and technical owners can resolve departures from it.
Use SaaS Subscription Agreements — Contract review checklist as the working record. Copy this table into your working document or spreadsheet, creating one row per issue requiring a distinct decision.
| ID / topic | Source / version | Evidence | Customer consequence | Priority / confidence | Proposed response | Owner / status | Open dependency |
|---|---|---|---|---|---|---|---|
In Source / version, record a document ID, date, section, and page where available. Evidence contains a short excerpt or faithful paraphrase, including controlling exceptions. For absent wording, state “not present in reviewed package” and identify the documents searched.
Priority / confidence separates importance from evidentiary certainty: an export gap may be serious but unconfirmed because a schedule is missing. Proposed response records the edit, fallback, or factual request. Owner / status identifies the decision-maker and disposition. Open dependency captures unresolved assumptions. Reference row IDs in redlines and approval summaries so decisions remain traceable.
Assign document IDs and examine incorporation, amendment, and order-of-precedence provisions. Check whether orders or product terms displace master-agreement protections and whether the DPA has a separate precedence rule. Request referenced documents that have not been supplied.
The SEC-filed Salesforce example ranks the applicable order above the master agreement and the master above documentation, while rejecting customer purchase-order terms. This is illustrative wording, not a general SaaS rule. See section 12.3 of the filed agreement. (sec.gov)
Record: Package gaps, conflicting provisions, and the clause controlling each conflict. If hierarchy remains ambiguous, propose an express resolution rather than silently choosing the favorable provision.
Reconcile product names, tiers, quantities, affiliate access, environments, start dates, and implementation assumptions. Identify essential functionality that appears only in sales materials and request a contractual commitment where needed. Ask whether billing starts before usable access and what happens if implementation is delayed.
Model expected and peak usage using the contractual metric. Check pooling, reset periods, rounding, unused-unit expiry, overage rates, measurement time zones, and access to usage records. Distinguish technical limits that block consumption from contractual allowances permitting billable excess usage.
The filed Salesforce order illustrates contractual rather than technical limits, no rollover, and monthly arrears billing for overages. These are historical product-specific terms, not pricing benchmarks. See “NOTICE — Utilization”. (sec.gov)
Record: Entitlement, calculation inputs, invoice-dispute conditions, measurement uncertainties, and requested commercial corrections.
Compare commencement, initial term, renewal duration, nonrenewal notice, renewal pricing, and quantity-reduction rights. Determine whether orders renew independently or share an end date. Test whether the customer receives the renewal price before it must elect nonrenewal.
Extract notice method, recipient, receipt provisions, time zone, and calculation assumptions. The Salesforce example requires at least 30 days’ written nonrenewal notice, with email acceptable, subject to order variation. Its default renewal period is the shorter of the expiring term or one year. These are contractual terms, not statutory deadlines. See section 11.2. (sec.gov)
Record: Timing conflicts, proposed price-notice or election edits, and the owner validating dates. Separate contractual deadlines from earlier internal decision dates.
Map intended data flows to ownership provisions, processing permissions, confidentiality, analytics, model training if relevant, subprocessors, incident notification, and deletion. Identify permissions extending beyond service delivery and exceptions for retained or derived information. Do not assume that “aggregated” or “de-identified” labels resolve the customer’s concerns.
Compare security commitments with the technical assessment: scope, incident-notice trigger, cooperation, evidence access, and responsibility for subprocessors should be understood together.
For covered California service-provider or contractor relationships, section 7051 requires specific processing purposes and restrictions on selling, sharing, and other uses, together with oversight, inability-to-comply notification, remediation, and subcontractor provisions. It does not universally mandate unrestricted audits or a particular certification. See 11 CCR section 7051(a)–(b). (cppa.ca.gov)
Record: Permission or missing protection, applicability determination or question, and the privacy or security owner responsible for resolution.
Read availability, maintenance, support, credit claims, suspension, warranties, indemnities, liability limits, and termination rights as a connected allocation of risk.
Test prolonged outage, disputed invoice, compromised credentials, and an infringement claim. Identify the supplier obligation, customer prerequisites, exclusions, remedy, and limitation for each. Check credit-claim windows and exclusive-remedy language; examine suspension notice, cure opportunities, and access to data during suspension.
For indemnities, review covered claims, defense control, settlement conditions, exclusions, and replacement or termination remedies. For caps, identify the fee basis, measurement period, aggregate treatment, and interaction with carve-outs and excluded damages. Check refunds and remaining payment obligations following termination. These are review recommendations; enforceability depends on language, governing law, and facts.
Record: Scenario, controlling clauses, practical remedy, proposed revision, and authority to accept residual risk.
Ask the technical owner to specify required records, metadata, attachments, configurations, and formats. Check transition access, assistance, charges, API restrictions, deletion sequencing, backups, and deletion evidence. Request a representative export test where feasible; a contractual promise alone does not establish usability.
Where the EU Data Act applies to qualifying services, Article 25 addresses written switching terms and a generally maximum 30-calendar-day transition after the notice period, with extensions and special treatment under Articles 25 and 31. Article 26 addresses switching information and exportable-data structures and formats. These provisions do not promise recreation of every proprietary feature. See Articles 25–26 and 31. (eur-lex.europa.eu)
Record: Required exit outcome, available evidence, technical uncertainty, applicable legal overlay, and requested contractual response. Keep transition needs distinct from permission to terminate early.
Rank issues by impact, likelihood, operational dependency, and available remedy. Separate suspected legal noncompliance from business concessions. Prepare targeted redlines against the identified version, then recheck definitions, cross-references, and overriding schedules.
Give the approver a concise summary of blockers, fallbacks, accepted risks, and factual questions. An open issue needs an owner and an explicit condition for proceeding; silence is not approval. After receiving a revised draft, verify the affected provisions rather than assuming the vendor accepted the requested change.
Record: Final response, approval authority, rationale, and status for each material row. Link the completed checklist to the version recommended for signature.
Entirely fictional scenario: Cedar Quay Manufacturing is reviewing Northglass Cloud’s maintenance platform at an annual subscription fee of $84,000. The package contains Order O-03, Master M-02, and DPA D-01. O-03 controls conflicting commercial terms; D-01 has separate privacy precedence. The order includes 1.2 million annual processing events. Operations forecasts 1.45 million, assuming its event definition matches the supplier’s. Referenced export Schedule E is missing.
| ID / topic | Source / version | Evidence | Customer consequence | Priority / confidence | Proposed response | Owner / status | Open dependency |
|---|---|---|---|---|---|---|---|
| R1 / Usage | O-03 §2, p.1 | 1.2m events; $0.04 per excess event | Forecast implies $10,000 extra if metrics align | High / conditional | Define counting; price larger allowance | Procurement / open | Retry treatment unknown |
| R2 / Renewal | M-02 §8, p.5; O-03 §4, p.2 | Nonrenewal due 60 days before expiry; price notice 30 days before | Election precedes price disclosure | High / verified | Require earlier price notice or later election | Legal / redline | Finance must approve fallback |
| R3 / Export | M-02 §10, p.7 | Access ends at termination; export subject to missing Schedule E | Transition access and export contents unconfirmed | High / incomplete | Obtain schedule; negotiate sufficient access | IT / blocked | Formats, attachments, costs unknown |
R1 changes the economics: 250,000 assumed excess events at $0.04 equals $10,000. The estimate is conditional, not verified invoice exposure; retries or different measurement rules could change it.
R2 calls for coordinated price-notice and election provisions, not merely a shorter renewal term. R3 blocks approval of exit arrangements because the missing schedule may qualify the master’s access rule. The reviewer cannot invent an export window or assume attachments are included. Procurement can negotiate usage economics while legal and IT resolve separate dependencies; none of those decisions substitutes for reviewing the remaining terms.
DecoverAI is the Legal Intelligence Platform for litigation and transactions. Its contract review workflow in Word lets reviewers choose the represented party and provide deal-specific instructions. Findings quote clauses, rank severity, locate text, and identify missing language as not present. The lawyer edits or inserts suggestions as ordinary tracked changes in the signed-in Word user’s name, or dismisses findings with reasons. Tabular review supports work across multiple documents; counsel retains judgment over hierarchy, legal applicability, and approval. Book a demo to assess this customer-side subscription-review workflow.
No. Prioritize consequences for this customer’s use, data, cost, continuity, and remedies. Record concessions relevant to approval. Where evidence is missing, begin with a factual request rather than drafting against an assumption.
Treat this as an explicit decision, not an administrative omission. Identify the data, processing start date, and protections that cannot yet be assessed. Assign privacy review and specify any condition preventing processing before resolution.
Not categorically as of October 13, 2026. Article 29 permits reduced switching charges capped at directly related costs during the transitional period; the prohibition begins January 12, 2027. Assess coverage and distinguish switching charges from service fees and early-termination penalties. See Article 29. (eur-lex.europa.eu)
Identify the missing evidence and which commitment it prevents you from evaluating. Ask the security owner whether alternative evidence is sufficient. Record any approval condition; do not turn an unverified supplier assertion into a confirmed finding.
This general professional workflow uses the October 13, 2026 research cutoff. Particular rights depend on operative language, governing law, facts, and deal context.
This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.