SaaS Agreement: Subscription Terms That Protect Your Software Business
A SaaS agreement is the contract under which a customer gets access to your hosted software for a fee, without owning it. We prepare the draft for your review: access rights, uptime, data handling, liability cap, fees, term and exit. Where enforceability is in doubt, a practising advocate vets it.
What it is
A SaaS agreement governs access to software you host and the customer uses over the internet. The customer pays a subscription for the right to use it; you keep the code. The document covers the licence grant, fees, service levels, support, data, security, intellectual property, liability, term, termination and governing law.
Several Indian laws sit behind the clauses: the Indian Contract Act, 1872 on damages, the Copyright Act, 1957 on who owns the code, the Digital Personal Data Protection Act, 2023 on customer data, and the Information Technology Act, 2000, under which Section 5 recognises electronic signatures. The uptime promise often lives in a separate service level agreement.
Who it applies to
SaaS startups selling to Indian businesses
Say a Gurugram startup has a product and early customers on email quotes and a click-through. Then a larger account arrives, and its legal team asks for the paper. A proper agreement closes that deal.
Indian providers with overseas customers
Foreign buyers expect clear data, security and liability terms. The same agreement also supports export-of-services treatment for GST, which depends on the contract and payment trail.
Businesses buying SaaS
You are the customer, and the vendor’s paper is one-sided. We review it for data ownership, exit rights, liability limits and price-change terms before you sign.
Why it matters
It defines what you are selling
Without a clear scope, every customer expects a custom feature or a refund on demand. The agreement fixes plans, limits, support hours and what counts as a breach.
It caps your exposure
Section 74 of the Contract Act limits compensation to a reasonable sum not above the amount named, and Section 73 excludes remote and indirect loss. A drafted cap tells everyone the number in advance.
It allocates data duties
Under the DPDP Act, the data fiduciary stays responsible even when a processor handles the data, and a processor may be engaged only under a valid contract (Section 8). Your agreement is that contract.
Documents required
About your business
- Company name, CIN and GST registration
- Product description and pricing plans
- Authorised signatory and board approval, if needed
About product and data
- Types of customer data processed
- Hosting location and sub-processors
- Security measures and uptime you can honestly promise
Commercial terms
- Invoicing, payment and renewal terms
- Refund and cancellation policy
- Support hours and escalation contacts
How it works
Map the product and the data
We ask what the software does, what data it touches, where it is hosted and who else touches it. These answers drive half the clauses. Add an NDA for pre-sale demos, and an ISO 27001 certification helps answer security questionnaires.
Draft the clause set
We prepare the agreement with a plain-language order form for plans and fees, so sales can fill the commercial terms without redrafting the legal text.
Review and negotiate
You mark changes. Where liability, indemnity or cross-border points need legal vetting, we route those clauses to a practising advocate and relay comments.
Sign and operate
Use an e-signature or click-wrap for acceptance, keep the acceptance log and, for signed physical copies, stamp before or at signing as Section 17 of the Stamp Act requires.
Timelines
Drafting time
A first draft usually takes three to five working days once the product and data answers are in. Negotiated versions take longer.
Data law dates
The DPDP Rules, 2025 were notified on 13 November 2025, and the main obligations on data fiduciaries start 18 months later. Write the clauses now, not at the deadline.
Incident reporting
Under the CERT-In Directions of 28 April 2022, covered entities report listed cyber incidents within six hours of noticing them and keep ICT logs for a rolling 180 days within India.
What happens if the agreement is weak
Open-ended liability
With no cap, one outage can become a claim for everything the customer says it lost. Every claim is then argued from scratch.
Unclear data roles
If nobody is named as fiduciary or processor, each side can blame the other after a breach, and the contract will not settle it.
An unstamped signed copy
Under Section 35 of the Stamp Act, an instrument not duly stamped is not admitted in evidence until duty and a penalty of up to ten times the shortfall are paid.
Frequently asked questions
What is a SaaS agreement?
A SaaS agreement is a contract that gives a customer access to hosted software on subscription while you keep ownership of the code. It sets the fees, the permitted use, uptime and support, data handling, liability, term and termination. It is a licence of use, not a sale, and it needs to say so plainly. We prepare it for your review.
How is it different from a service level agreement?
A service level agreement is one part of the picture. It sets measurable service targets such as uptime and response times, with credits when you miss them. The SaaS agreement is the main contract that covers everything else, including data, IP and liability. Many providers sign both. We can draft the two so they match.
Who owns the code and the customer data?
You keep the software, and the customer keeps its data. Under Section 17 of the Copyright Act the author is the first owner, and an assignment under Section 19 must be in writing and signed. If contractors wrote your code, get written assignments. The agreement then licenses use to the customer and limits what you may do with its data.
Can I cap my liability to customers?
Yes, and you should. Section 74 of the Contract Act allows reasonable compensation up to the sum named, and Section 73 excludes remote and indirect loss. A common structure caps liability at fees paid in the previous 12 months, with carve-outs for matters such as confidentiality or data breach. The number is negotiable.
Does the DPDP Act apply to my SaaS product?
Likely yes, if you process digital personal data. The DPDP Act, 2023 makes the data fiduciary responsible even where a processor handles the data, and a processor may be engaged only under a valid contract. If you host customer data, your agreement should say who decides purposes, who processes, and how breaches are reported.
Is a click-wrap acceptance valid?
A click-wrap works as a contract when the customer must actively accept clear terms before using the service, and you keep a log of who accepted which version and when. Large customers often want a signed copy as well. Electronic signatures are recognised under Section 5 of the IT Act, 2000. We can set up both.
How is SaaS taxed under GST?
Software and SaaS services generally fall under SAC 9983 at 18% when supplied domestically. Supplies to a customer outside India can qualify as export of services, which is zero-rated, if the conditions in Section 2(6) of the IGST Act are met, including payment in convertible foreign exchange. Exporters file an LUT in Form RFD-11 to avoid paying IGST upfront.
Which law and forum should the agreement choose?
Pick Indian law and a seat of arbitration your customers accept, in writing, since Section 7(3) of the Arbitration and Conciliation Act requires an arbitration agreement to be in writing. For commercial disputes, pre-institution mediation under Section 12A of the Commercial Courts Act may apply first. Foreign customers may push for their own law, and we flag the cost of agreeing.
What it costs
Our fee plus the government fee that applies to your case, quoted before you commit. Tell us the situation and we will price it exactly.
Government cost is limited to stamp duty on signed physical copies, which varies by state, and there is no fee to file the agreement anywhere.
Ready to begin?
Tell us what the software does and who buys it. We will draft the agreement and quote the cost before you commit.