What goes in a SaaS customer agreement?

What a SaaS agreement does

A SaaS agreement is the contract between your company and the businesses that subscribe to your product. Unlike a software licence for code installed on the customer’s own systems, it gives the customer the right to access and use software you host. You keep ownership of the software; the customer keeps ownership of its data.

It’s often structured as a master agreement plus an order form for each purchase, so pricing, seats and term can change without renegotiating the legal terms. For small customers it may be a click-through agreement. Section 19 of Ontario’s Electronic Commerce Act, 2000 recognizes contracts formed electronically, including by clicking, though the terms should be presented clearly and accepted before access.

The core terms

Access and restrictions

What the customer can use, for how many users, and what they can’t do: resell access, reverse engineer, build a competing product, exceed usage limits, or use the service unlawfully. An acceptable use policy is often attached.

Fees, payment and renewal

Subscription fees, billing frequency, late payment, taxes, price increases on renewal, and whether the term renews automatically. Auto-renewal for consumers has its own rules; see subscription and cancellation laws in Canada.

Customer data

Who owns it (the customer), what you can do with it (provide the service, and any other use you spell out), and what you can do with aggregated or de-identified usage data. If you use customer data for AI features or model training, say so plainly. See terms for AI products.

Privacy and data processing

Under PIPEDA, an organization stays responsible for personal information it transfers to a third party for processing and must use contractual or other means to protect it (Principle 4.1.3 of Schedule 1). That’s why business customers ask for a data processing agreement: it sets out how you handle their personal information, your security measures, your sub-processors, where data is stored, and how quickly you’ll tell them about a breach. Your own reporting duty under section 10.1 of PIPEDA applies separately.

Security and service levels

A description of your security program, and a service level agreement for uptime and support response, with service credits as the usual remedy. Commit to what you can actually measure and deliver.

Warranties and disclaimers

A limited promise that the service will perform materially as described, and a disclaimer of other warranties. For AI features, a clear statement that output may be inaccurate and should be reviewed.

Limitation of liability

A limitation of liability caps what either party can owe, often at the fees paid in the previous 12 months, and excludes indirect losses such as lost profits. Canadian courts generally enforce clear limitation clauses negotiated between businesses, but the wording matters, and some liabilities are commonly carved out of the cap.

Indemnities

An indemnity is a promise to cover the other side’s losses from specific claims. Customers usually expect you to indemnify them if your software infringes someone’s IP. You may ask for one back if the customer’s data or misuse causes a claim.

Intellectual property and feedback

You own the platform and improvements; the customer owns its content. Include a licence to use customer feedback, so a suggestion doesn’t create an ownership question. Make sure your company actually owns the code first: see who owns code a contractor writes.

Term, termination and exit

How either side can end the agreement, what happens to prepaid fees, and how long the customer has to export its data before you delete it.

Governing law and disputes

A governing law clause choosing Ontario law, and a clause saying where disputes are heard. US customers will often ask for their own state’s law.

What enterprise buyers push back on

Larger customers often send their own paper or a long list of changes. The common asks:

• A higher liability cap, or a separate “super-cap” for data breaches and confidentiality.
• Uncapped indemnities, especially for IP infringement and data breaches.
• Their own DPA, with audit rights, short breach notice windows and approval of new sub-processors.
• Data residency: keeping data in Canada, or explaining transfers. The OPC’s cross-border guidance is a useful reference for what to disclose.
• Security evidence, such as completed security questionnaires or third-party audit reports.
• Termination for convenience, price caps on renewal, or most favoured customer pricing.
• Insurance requirements, such as cyber and errors and omissions coverage.
• AI commitments: no training on their data, and disclosure of the models you use.

Decide in advance which of these you’ll accept, which you’ll trade, and which you won’t agree to. A short internal fallback list saves time on every deal.

Selling to consumers is different

If individuals buy your product for personal use, Ontario’s Consumer Protection Act, 2002 can apply, with disclosure and cancellation rules for internet agreements (ss. 37 to 40) and limits on some terms businesses commonly use with each other, such as waivers of consumer rights and mandatory arbitration (s. 7). Ontario has also passed a Consumer Protection Act, 2023 to replace it, which as of October 2026 is not yet in force. Quebec and other provinces have their own consumer laws. Write consumer terms separately from your B2B agreement.

Open source and third-party components

If your product includes open source components or third-party APIs, your agreement shouldn’t promise more than those licences let you give. Keep an inventory, and check that copyleft licences don’t create obligations you haven’t planned for. See what contracts a software startup needs.

What to do next

1. Use one standard agreement and an order form template, so every customer is on similar terms.
2. Prepare a DPA and a sub-processor list before your first enterprise deal asks for them.
3. Write a fallback list for the terms enterprise buyers usually negotiate.
4. Check that your privacy policy and security claims match the contract.
5. Review the agreement when you add AI features, new markets or a new hosting provider.

We draft SaaS and master services agreements with an order form template, and review customers’ paper as a contract review, at fixed fees shown on our fees page. See also AI and SaaS contracts, NDAs for startups and CASL for SaaS.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To talk through your customer contract, book a free 15-minute consult.