October 26, 2026
Read a vendor's contract with the same care as a customer's whenever the vendor holds your data, sits behind a promise you make to customers, or costs enough to matter. Check when it renews and how the price can change, what the vendor may do with your data (including training AI models), how fast it must tell you about a breach, what its SLA and liability cap are actually worth, and how you get your data out when you leave. Then compare it with what you've promised your own customers, because the gap between the two is risk you carry yourself.
Key takeaways
Most startups review every contract they send and click through every contract they sign. That works for a design tool or a team chat app. It doesn't work for the handful of vendors your product depends on: your cloud host, database and data tools, payment processor, model API, identity provider, and anyone running support or development for you.
Spend real time on a vendor contract if any of these is true. The vendor will store or process your customers' data or anyone's personal data. Your product stops working, or a customer promise breaks, when the vendor goes down. You are committing to meaningful annual spend or a multi-year term. Or switching away later would take months of engineering work. For everything else, a five-minute read of the renewal, price and data terms is usually enough.
Be realistic about leverage. Below enterprise-level spend, large vendors rarely negotiate their standard terms. What you can still do is pick the plan whose terms you can live with, put the few changes you need in the order form, and know exactly where the vendor's promises fall short of yours. See What Should I Look For in an AI Tool's Terms? for how much the plan tier changes the terms.
Most SaaS contracts renew automatically for another full term unless you give notice before a deadline, often 30 to 90 days before the term ends. State automatic renewal laws are written mainly to protect consumers. California's, for example, defines a consumer as an individual buying for personal, family or household purposes. A few states reach further. New York, for example, makes an automatic renewal clause in some service contracts unenforceable, even against a business, unless the provider sends a written reminder 15 to 30 days before the notice deadline, but whether that rule reaches a software subscription is unsettled. So a company buying software should assume the contract's notice window controls.
The renewal price is the second trap. Many order forms say the renewal is billed at the vendor's "then-current list price," which has no ceiling. Ask for a fixed cap on renewal increases, stated as a percentage. Also look for clauses that let the vendor change fees or terms mid-term by posting a new version online. Ask that changes take effect only at renewal, or that you can terminate and get a prorated refund of prepaid fees if a change hurts you. Check how usage overages and annual true-ups are priced, because that is where bills grow fastest.
Example. You sign a one-year, $36,000 contract that renews automatically unless you give notice 60 days before the end, at the then-current list price. During the year the vendor raises list prices 25%. Miss the notice window and you are committed to $45,000 for the next year. With a 5% renewal cap, the renewal would be $37,800, a $7,200 difference in one year, and the gap compounds every year after that.
The contract should say that you own your data and that the vendor may use it only to provide the service to you. Then read the exceptions. Many vendor terms give the vendor broad rights to "usage data," "aggregated data" or "de-identified data," or permit use "to improve our services," which can include training AI models. If you don't want your data used that way, get it in the contract, not in a settings toggle that someone can change. See What Should I Look For in an AI Tool's Terms?
If the vendor will process personal data for you, you need a data processing agreement, a list of the vendor's subprocessors with notice before new ones are added, and a statement of where the data is stored. Check that the vendor stays fully responsible for any subcontractor it uses. These terms aren't just good practice. Your enterprise customers will ask about them in security questionnaires, and the privacy laws that apply to you often require them. See What Are the Startup Best Practices for Data Privacy? and GDPR Basics. For health data, see Does My Startup Need a HIPAA Business Associate Agreement?
Look for a commitment to maintain a written security program, a recent SOC 2 report or similar independent audit you can review, and a duty to notify you of a security incident affecting your data within a fixed number of hours or days, with cooperation afterward. GDPR requires a processor to notify the controller "without undue delay" after becoming aware of a breach, but that phrase alone won't help you meet a contract deadline.
That deadline is the point. Enterprise customers often require you to notify them within 24 to 72 hours. If your vendor only has to tell you "promptly," or within 30 days, you can't keep your own promise when the breach happens at the vendor. Ask for notice fast enough to leave you time to investigate and notify your customers. See Data Breach Response for Startups.
Read a vendor SLA for what it pays, not what it promises. Credits are usually a small percentage of the monthly fee for the affected service, capped, applied to future invoices, available only if you claim them in writing within a short window, and stated to be your only remedy. Many lower-tier plans have no SLA at all. See Service Level Agreement (SLA).
Check when the vendor may suspend your service. Suspension for nonpayment or a real security threat is normal. Ask for written notice and a chance to cure before suspension for anything else, and that any suspension be limited to the part of the service causing the problem.
Usually not much. Expect the vendor to exclude indirect and consequential damages and cap its total liability at the fees you paid in the prior 12 months. If the vendor holds sensitive data, ask for a higher cap, often called a super-cap, for data breaches and confidentiality breaches.
The IP indemnity matters more than the cap for most software. The vendor should defend you against third-party claims that its service infringes someone's IP, and that obligation should sit outside the cap or under a super-cap. Read the exclusions, which commonly cover your modifications, combinations with other products and use outside the documentation. Patent demand letters often go to a vendor's customers, so this clause is what you'll look for first. See I Got a Patent Demand Letter. What Do I Do? Then read the indemnity running the other way. Many vendor terms make you defend the vendor against claims arising from your data and your use of the service, which is often broader than anything the vendor promises you.
Because when a vendor fails, your customer still holds you to your contract, and the vendor's contract decides how much of that cost comes back to you. This is the flow-down trap. It shows up in uptime, breach-notice deadlines, data location, security certifications, subprocessor approvals and indemnities.
Example. A startup has 10 enterprise customers paying $10,000 a month each, with a 99.9% monthly uptime SLA and credits of 10% below 99.9%, 25% below 99.0% and 50% below 95.0%. It hosts on a cloud provider that charges it $4,000 a month. Suppose the provider's SLA promises 99.5% and pays a 10% credit below that. A single 8-hour provider outage in a 30-day month takes down 480 of 43,200 minutes, so uptime is 98.89%. Each customer is owed a 25% credit, $2,500, or $25,000 in total. The provider owes the startup 10% of $4,000, which is $400. The startup absorbs $24,600 from one bad day at a vendor.
The fixes are mostly in your own customer contracts. Exclude outages of third-party providers outside your control from your SLA, which is a standard exclusion. Set your breach-notice deadline to run from when you confirm a breach, not when a vendor might first suspect one. Promise data location only where every subprocessor in the chain can deliver it. Keep your indemnity to customers within what your insurance and your vendors' indemnities can cover. Before you sign an enterprise deal, list your critical vendors and check each customer promise against their contracts. See How Do I Negotiate Customer Contracts as a Startup?
Plan the exit at signing. You want a right to terminate for the vendor's uncured material breach, for repeated SLA failures and for unilateral changes to the terms, with a refund of prepaid fees for the unused period. You also want a period after termination, often 30 to 90 days, to export your data in a standard, usable format, plus reasonable help migrating to a new provider and written confirmation of deletion afterward. A vendor that holds your data in a proprietary format with no export right has effectively locked you in.
If your company is in the EU, the EU Data Act has applied since September 12, 2025 to cloud and other data processing services, including many SaaS products. It requires providers to let customers switch on no more than two months' notice, with a transition period that normally can't exceed 30 days, and it bans switching charges from January 12, 2027, though fees for ending a fixed-term contract early can still apply. Proposed EU amendments would relax some of these rules for certain contracts signed before September 12, 2025, so check the current text before relying on them.
Check the assignment clause before you sign. Ask for the right to assign the contract without consent in a merger, an acquisition or a sale of all or substantially all of your business or assets. Push back on any clause that lets the vendor terminate if you are acquired. A license that says nothing about assignment isn't safe either. Under federal law, a nonexclusive patent license can't be transferred without the licensor's consent, and courts have applied the same rule to software licenses. A critical vendor contract that needs consent can delay a closing or hand the vendor leverage at the worst moment. See How Do I Draft a Strong Contract for My Startup? and Startup Acquisitions.
If your product runs on another company's platform, sells through its marketplace or depends on its API, its terms are part of your business model. Read the rate limits, use restrictions, revenue share, branding rules, and the platform's right to change its terms or end your access on short notice. Check restrictions on caching, sublicensing or using outputs to train models, and pass them through to your customers in your own terms. If you promise customers a feature the platform's terms don't permit, you are promising more than you can legally deliver.
For more, see What Are the 10 Contracts Every Startup Should Have on Hand?, How to Draft Terms of Service for a Startup, US Data Privacy Laws and How Do I Keep My Startup Legal Documents Organized?
If you'd like a vendor or SaaS contract reviewed before you sign, contact us.
