Ask an attorney to review unresolved material risks before you countersign.
An MSA, or master services agreement, sets the legal terms that govern your work with a customer. An order form usually specifies the subscription, price, and term, while a statement of work may cover implementation or other services. Once signed, the MSA can apply to future orders as well as the first one.
Enterprise customers use their own templates because their procurement, legal, and security reviewers already know how to approve them. Those templates may require insurance limits or security controls that your SaaS company does not have. With several customer reviewers involved and fewer people on your side, you need to identify obligations you cannot meet before the draft moves toward signature.
The customer’s paper does not control merely because the customer sent it. The terms you sign, including any documents incorporated by reference, determine your obligations. An order form, data processing agreement, security exhibit, or referenced policy may add terms or conflict with the MSA. Review the full document set before deciding which provisions need a redline.
Do not sign the customer’s master services agreement (MSA) when it arrives. Ask for an editable copy and a reasonable review period. Enterprise contracts often place obligations in documents outside the MSA, so you need the full package before deciding which terms to change.
Collect the order form, any statement of work (SOW), the data processing agreement (DPA), security exhibits, and service-level agreements (SLAs). Request every policy the contract incorporates by reference, including acceptable use, security, and support policies. Check document versions and links. If a referenced policy is missing or the customer can change it later without your consent, flag that issue for review.
Compare each promise with what your product and staff can do today. Ask whoever runs security and support whether you can meet the proposed controls, uptime commitments, audit requests, and breach-notice deadlines. Then compare the MSA’s insurance requirements and potential liabilities with your current cyber, errors and omissions (E&O), and general liability policies, including limits and exclusions. Do not assume insurance covers a contractual promise simply because the policy has a relevant name.
Redline material risks after those checks. Start with obligations your company cannot meet, unclear ownership of data or product improvements, and liability or indemnity terms that could exceed what the deal supports. A narrower, accurate commitment gives the customer a clearer basis for negotiation than a promise you cannot perform.
For each clause, check what the customer asks you to promise, why that promise matters, and what narrower term you could propose. Read the MSA alongside its exhibits. A qualification or exception elsewhere may change the obligation you would accept.
The scope clause should describe what your SaaS company will deliver and what the customer must purchase separately. Check whether the order form sets the subscription, users, and fees, and whether a statement of work (SOW) adds implementation or custom services. Redline language that could turn an agreed service into an open-ended obligation to meet every requirement in the customer’s policies.
Order of precedence decides which document controls when the MSA, order form, SOW, or exhibit conflicts. If the MSA limits support to business hours but a security exhibit requires round-the-clock response, the stated order may determine which promise governs. Silence leaves that conflict open to dispute, while a blanket rule favoring customer exhibits could override negotiated MSA protections.
Ask for a clear document hierarchy before signing. A practical vendor position lets an order form or SOW control its specific commercial or project terms, while the MSA controls liability, ownership, and other legal protections unless both parties expressly agree to an exception. Require customer policies incorporated by reference to be identified, available for review, and subject to agreed limits on later changes.
A liability cap limits how much your company may owe if a claim arises under the MSA. Enterprise forms often tie the cap to fees paid during a stated period, but the definition of “fees paid” matters. Early in a contract, a paid-fees cap may be small, while a customer’s proposed carve-outs may leave your company exposed to much larger claims.
Read every exception alongside the cap. Customer forms may exclude confidentiality breaches, IP infringement, or security incidents entirely, or place them under a separate, higher cap. Check whether defense costs count toward the applicable limit and whether the proposed exposure bears any relation to the contract value or your insurance coverage.
A reasonable vendor counter-ask keeps exceptions narrow and ties any higher cap to specific, defined risks. For example, you might propose a separate limit for certain data-security claims rather than unlimited liability for every security-related obligation. The appropriate limits depend on the deal, the risk, and the coverage you actually carry.
An indemnity requires one party to cover specified third-party claims against the other. Check whether the MSA makes that duty one-sided or gives both parties obligations tied to risks they control. For IP infringement claims, seek coverage limited to authorized use of your unmodified product. Exclude claims caused by customer changes, uses outside the agreement, or combinations you did not supply.
Defense control determines who selects counsel and decides whether to settle. If the customer controls a claim while you pay its costs, you may have little say over legal fees or a settlement that affects your product. Ask for prompt notice and the right to manage covered claims with qualified counsel. Require each party’s consent before a settlement imposes obligations on it.
Review data-breach indemnities separately. Language covering every incident involving customer data could make you responsible for an event caused by the customer’s own systems. Tie your obligation to claims arising from your specified security failures, and check whether the liability cap and your insurance cover the resulting exposure.
Protect your platform IP from language that assigns the customer everything developed “in connection with” the services. That wording could give the customer a claim to a feature you build for all subscribers. Redline it so you retain your software, templates, and general product improvements, including improvements prompted by customer requests.
The customer should retain ownership of the data it provides. You need a limited right to process that data to deliver the service and provide support. Define customer data carefully so the agreement does not accidentally transfer ownership of your platform or its underlying methods.
Check any claim to aggregated or anonymized data separately. If you use such data for analytics, ask for an express permission that fits your actual practices, the DPA, and applicable privacy law. Do not assume that removing a customer’s name makes every use permissible.
The license should say who may use your SaaS product, for what purpose, and for how long. Check whether the MSA extends access to every customer affiliate or permits users outside the agreed order form. Unbounded affiliate use can increase support and security obligations without increasing the contracted fees. Limit access to subscribed users and named affiliates, and make the customer responsible for their use.
Feedback language needs a separate check. A customer may reasonably want you to consider its suggestions, but an assignment of “all improvements” could reach changes you make to your platform for other customers. Ask for a non-exclusive right to use feedback without an obligation to implement it, while preserving the customer’s ownership of its data and confidential information. Check usage restrictions as well so they protect against misuse without preventing you from developing your own product.
A data processing addendum, or DPA, can create obligations that the MSA does not spell out. Read both documents together and check which one controls if their terms conflict. The DPA should describe what personal data you process, why you process it, and which responsibilities belong to you and the customer. Compare those descriptions with how your product actually collects, stores, uses, and deletes data.
Pay particular attention to sub-processors and international data transfers. A customer may require advance approval for every hosting or support provider, which can be difficult if your providers change. Propose a current sub-processor list, notice of material changes, and a defined opportunity to object. If data crosses borders, confirm that the promised transfer terms match the locations and providers you use.
California’s CCPA may call for specific service-provider or contractor terms when covered personal information is involved, depending on the parties’ roles. Do not accept a DPA that assigns you every privacy duty regardless of who controls the data or handles customer requests. Ask for duties tied to your actual processing role, with assistance obligations your product and staff can meet.
Security exhibits can require controls your SaaS product does not currently support. Compare every promised control with your actual practices, including access restrictions, encryption, testing, and incident response. Check whether the exhibit requires a certification you do not hold or lets the customer audit your systems without reasonable limits. Redline unsupported commitments rather than assuming you can implement them after signing.
Breach notification deadlines need the same operational check. A promise to notify the customer within a fixed number of hours may start when anyone at your company becomes aware of a suspected incident, before you can determine whether customer data was affected. Review how your staff detects, escalates, and investigates incidents, then propose a deadline you can meet. Define the notification trigger, permit an initial notice with available facts, and commit to updates as the investigation develops. Check the proposed wording against the DPA and any applicable legal reporting duties.
For audit rights, offer relevant independent security reports or questionnaires where appropriate. Limit any additional audit to a reasonable scope, confidentiality protections, and procedures that do not disrupt your service.
A performance warranty should promise something you can test against the product you actually deliver. Look for commitments that the service will materially conform to its documentation. Redline open-ended promises that it will be “fit for purpose” or meet unspecified “industry standards,” since those terms may cover uses or requirements you have not evaluated. Offer a warranty tied to agreed specifications, with a reasonable opportunity to correct a material failure.
A service-level agreement should define how uptime is measured and what happens when the service misses its target. Check whether scheduled maintenance, customer-caused outages, and failures outside your control count as downtime. Offer credits with a stated ceiling as the customer’s exclusive remedy for an SLA miss. Without clear remedy language, a customer could seek both credits and damages for the same outage. Review the MSA and SLA together so that their remedies do not conflict, and consider a separate, bounded remedy for persistent material failures.
Review when the customer must pay, what starts the payment clock, and whether acceptance can hold up an invoice. A term requiring payment only after the customer approves an unspecified test can leave you waiting even when the software works as agreed. Ask for a clear invoice due date and require the customer to pay undisputed amounts while you resolve a specific billing dispute.
If the MSA includes acceptance testing, tie it to defined deliverables and objective criteria in the order form or SOW. Give the customer a set period to report specific failures and a reasonable opportunity for you to correct them. Avoid language that lets the customer withhold acceptance based on general satisfaction. For overdue undisputed invoices, preserve any lawful late fee and a right to suspend service after notice and a reasonable chance to pay.
Review the initial term, automatic renewal, and termination rights together. A short opt-out window can commit you to another service term before you have reviewed the pricing or your capacity to serve the customer. Ask for a renewal notice deadline you can track and clear terms for any price change.
A customer-only right to terminate for convenience can leave you with unrecovered onboarding costs or committed hosting expenses. Seek a minimum commitment or payment for accrued fees and noncancelable costs. Define whether either party must refund prepaid amounts. If the customer needs flexibility, consider a reciprocal right with reasonable notice.
For termination based on breach, require written notice that identifies the problem and gives you a practical opportunity to cure it. Limit immediate termination to specified problems that cannot reasonably be cured or require urgent action. The MSA should also explain how the customer retrieves its data and when you must delete it.
Enterprise MSAs often require general liability, technology errors and omissions, and cyber insurance because the customer wants coverage for losses tied to your services or a data incident. Before signing, compare the required policy types and limits with your current coverage. Check exclusions and any requirement to name the customer as an additional insured. A contractual promise to maintain coverage can put you in breach even if the policy would not cover the underlying claim.
Ask the customer to match its requirements to coverage you carry or can reasonably obtain. If the customer insists on higher limits, get a quote and account for the cost before agreeing. Have counsel review any insurance clause that appears to promise coverage your insurer has not confirmed.
Review whether confidentiality duties apply to both parties and what each party must protect. An enterprise MSA may define the customer’s confidential information broadly while giving little protection to your pricing, product plans, or technical materials. Ask for mutual duties, practical exceptions for information already public or independently developed, and a duration that fits the information being protected. Check that you can share protected information with advisers and service providers who need it and must keep it confidential.
Check publicity and data-use rights separately. Do not assume you can name the customer, display its logo, or publish a case study without written permission. Conversely, an overbroad confidentiality definition could prevent you from using properly anonymized usage data for benchmarks. Negotiate that right expressly and check it against the DPA before relying on it.
Review the assignment clause alongside its definition of change of control and any subcontractor approval requirement. Customer consent for every transfer can delay an acquisition. A broad change-of-control definition could also capture a financing that shifts voting control, though an ordinary funding round does not necessarily assign the MSA. Check the contract’s actual trigger.
Ask to permit assignment to an affiliate or a successor in a merger or sale of the relevant business, provided the successor assumes the contract and can perform it. For other assignments, propose consent that the customer cannot unreasonably withhold or delay. Preserve the right to use hosting and support providers without case-by-case approval while remaining responsible for their work. Check the DPA separately, since its notice or objection rules may govern changes to providers that handle customer data.
Customer-drafted non-solicitation clauses can limit whom you hire, while exclusivity clauses can limit whom you sell to. Check whether the MSA bars you from recruiting the customer’s employees, serving its competitors, or working with companies in the same industry. Those restrictions can outlast the contract and affect business you never discussed with the customer.
Ask to remove exclusivity unless the customer pays for a clearly defined restriction. If you accept a hiring restriction, limit it to targeted recruitment of specified personnel for a short, stated period, and exclude general job postings and unsolicited applications. Review any most-favored-customer clause with the same care. A broad promise to match your lowest price could give this customer discounts based on deals with different service levels or purchase volumes. Seek to remove it or limit comparisons to genuinely comparable purchases. Have counsel review employee restrictions where applicable law, including California law, may limit enforceability.
Governing law determines which jurisdiction’s rules a court or arbitrator uses to interpret the MSA. Venue determines where a dispute proceeds. If the customer chooses a distant forum, you may need local counsel and face travel costs even for a modest payment claim. Ask for your home jurisdiction or a mutually practical forum, and check whether the clause permits remote proceedings.
Review any arbitration requirement separately. Arbitration may offer a private forum and a narrower process, but filing and arbitrator fees can burden a smaller vendor, and appeal rights are limited. Court litigation may allow broader discovery and appeals, but it can take longer and become more expensive. Before agreeing, check who pays arbitration fees, where hearings occur, and whether either party can seek urgent court relief to protect confidential information or intellectual property.
A smaller SaaS vendor should spend its first redlining round on obligations that could exceed its ability to perform or pay. The tiers below assume you have checked the full contract package against your product, security controls, and insurance. “Accept if reasonable” still calls for review.
Send the MSA to an attorney before signing if it leaves liability uncapped, imposes broad indemnities, requires security controls you lack, leaves data ownership unclear, or lets the customer block an acquisition through assignment consent. Treat any privacy or insurance promise you cannot fulfill as a must-fix issue too.
Can we redline a Fortune 500 customer’s MSA? Yes. Send a focused redline that identifies terms your company cannot safely accept, and explain the operational reason for each change. A large customer may reject some edits, but its standard paper is still a starting point for negotiation.
What if the customer refuses every redline? Ask whether its legal team can address the highest-risk terms in an order form or other signed amendment. If the customer will not change an obligation you cannot meet or an exposure you cannot bear, do not sign on the assumption that the customer will overlook it. Ask counsel to assess the remaining risk.
How long should MSA review take? Review time depends on the document set, the customer’s response process, and the number of issues that need negotiation. Send counsel the MSA and every referenced exhibit together. Missing documents can delay review or leave obligations unchecked.
Does a small contract still need a full review? Yes, if the MSA imposes obligations beyond the value of the deal. A modest subscription fee does not necessarily limit indemnity, security, or liability commitments. You can keep review costs proportionate by having an attorney focus first on terms that could create outsized exposure.
If the MSA leaves liability uncapped, assigns your platform improvements to the customer, or requires security controls you do not have, get legal review before signing. Send counsel the MSA and every referenced exhibit so the proposed redlines account for the full agreement.
Zecca Ross Law Firm P.C. offers enterprise SaaS contract review, redlining, and negotiation support. Contact the firm with the agreement package and your list of must-fix terms to discuss an attorney-led review and whether a defined flat-fee scope fits the work.
Legal clarity starts here. Partner with Zecca Ross Law Firm to transform complexity into opportunity.