An enterprise customer returns your SaaS agreement with tracked changes. The subscription price looks attractive, but the edits move risk into places your team may not expect: a liability exception, a security schedule, or an ownership definition.
The SaaS contract redlines that deserve the closest review are those that expand financial exposure, transfer reusable intellectual property, or promise service and compliance obligations your business cannot deliver. Evaluate those changes together, across the entire contract package, before deciding what to accept.
This guide takes the SaaS vendor’s perspective. If your business is buying software, see our separate guide to reviewing a SaaS vendor agreement. The examples below are hypothetical negotiation issues, not ready-to-use contract clauses or legal advice for a specific transaction.
What are SaaS contract redlines?
Redlines show proposed additions and deletions to a contract. Enterprise buyers may mark up your subscription agreement or ask you to sign their procurement terms instead. Either approach can change the allocation of responsibility between your company and the customer.
There is no universal list of terms a founder must always reject. A request may be workable with narrower wording, a different price, additional controls, or a clearly defined remedy. The useful question is: what would this change require us to pay, own, deliver, or prove?
1. Exceptions that swallow the liability cap
The redline: The customer accepts a liability cap but excludes every confidentiality breach, contractual indemnity, security incident, and breach of law from it.
Why it matters: A cap offers limited protection if the claims most relevant to your product sit outside it. Read the exceptions alongside the exclusion of consequential damages, any separate cap, and the definition of recoverable losses.
A negotiation path: Identify which risks need different treatment and why. Discuss whether a specifically defined higher cap could address an identified risk, while leaving other claims subject to the general limit. Counsel should assess enforceability and any liabilities that applicable law does not permit the parties to exclude.
For a hypothetical $40,000 annual subscription, compare the proposed exposure with the revenue, operational risk, and available insurance. An insurance policy’s headline limit is not proof that a particular contractual promise is covered.
2. Indemnities covering events outside your control
The redline: A focused intellectual property indemnity becomes an obligation to cover all losses connected with the customer’s use of the service.
Why it matters: That wording may extend beyond third-party infringement claims to customer misuse, unauthorized modifications, or disputes involving customer-supplied content. Defense obligations can create costs before a court decides who is responsible.
A negotiation path: Define the claims covered, the relevant exclusions, notification duties, defense control, and settlement consent. Check whether defense costs count toward a liability cap and whether another clause creates a conflicting remedy.
The AWS Customer Agreement illustrates how indemnification and liability limitations can be addressed in separate sections. It is one provider’s contract, not a benchmark that every SaaS company should copy.
3. Ownership language that reaches your core platform
The redline: The customer owns all developments, configurations, improvements, and deliverables arising from the relationship.
Why it matters: A seemingly routine work-product clause can reach reusable connectors, product improvements, or tools you need for other customers. Paying for implementation does not resolve every ownership question.
A negotiation path: Separate customer data, pre-existing technology, reusable improvements, and genuinely bespoke deliverables. Specify the ownership or license needed for each category, including any embedded components the customer needs to use a deliverable.
For US copyright issues, the Copyright Office’s work-made-for-hire guidance explains that the doctrine has specific requirements. Adding that label does not automatically settle ownership of every commissioned software component. Have counsel reconcile the ownership clause, any assignment, and the statement of work.
4. Security and data promises your team cannot perform
The redline: The buyer adds compliance with every law worldwide, immediate notification of any suspected event, unrestricted audits, or a requirement to seek approval before every infrastructure change.
Why it matters: These promises can exceed your product’s actual controls or conflict with obligations to other customers. A security questionnaire can also become binding if incorporated into the agreement.
A negotiation path: Map the data, processing roles, relevant jurisdictions, subprocessors, and actual security measures. Define notification triggers and procedures that satisfy applicable requirements and can be implemented. Structure audits to protect other customers’ information without removing legally required cooperation.
Where the EU GDPR applies to a controller-processor relationship, Article 28 sets contract requirements. The Irish Data Protection Commission’s guidance explains that framework. Commercial negotiations cannot remove mandatory duties. Confirm the applicable privacy regime before agreeing to the data processing addendum.
5. Service remedies that accumulate unexpectedly
The redline: An outage triggers service credits, refunds, termination rights, and damages, with no explanation of how those remedies interact.
Why it matters: The financial result may be very different from the SLA your engineering and finance teams approved. Undefined availability measurements can also produce disputes about whether an outage occurred.
A negotiation path: Align the measurement period, exclusions, support obligations, credit calculation, and escalation process. Address how credits relate to other recoveries, while preserving the customer’s agreed remedies for serious or repeated failures.
Have engineering verify the promise against the actual service architecture. Our SaaS SLA guide discusses availability and remedy provisions in more detail.
6. Renewal and exit edits that change the economics
The redline: The buyer removes automatic renewal, adds termination for convenience, and requires repayment of unused fees even where the price assumed an annual commitment.
Why it matters: Those changes affect revenue predictability and the recovery of onboarding costs. An exit clause may also add transition support or data-export work that was never priced.
A negotiation path: Discuss the subscription commitment, renewal mechanism, cancellation notice, refund treatment, and transition services together. If renewal requires a new purchase order, specify what happens to service access while procurement is pending.
Make the customer’s exit practical, with clear export and deletion arrangements. Check applicable renewal rules rather than assuming consumer subscription rules apply identically to every business contract.
7. Governing law and precedence changes hidden in schedules
The redline: A procurement schedule selects a different dispute forum or says the customer’s purchase-order terms override the negotiated agreement.
Why it matters: You could finish negotiating the main document while a separate attachment changes the result. Governing law, court jurisdiction, and arbitration arrangements are related but distinct choices.
A negotiation path: Review the complete agreement, including order forms, security schedules, the DPA, and incorporated policies. State which document controls a conflict and for which subject. Check dispute costs, enforceability, and the need for local counsel when a transaction crosses borders.
How should founders prioritize enterprise redlines?
Prepare a short decision record for the clauses that materially change the deal. For each one, capture the customer’s concern, your proposed response, the operational owner, and who can authorize an exception. Separate legal requirements from commercial preferences.
Before signing, confirm that sales, engineering, security, and finance understand their commitments. Preserve the final agreed documents and calendar renewal notices, reporting duties, and other deadlines. A negotiated concession needs an owner after the contract closes.
Get the complete contract reviewed before signing
Send counsel the customer’s redline and the documents it references, together with the subscription value, implementation scope, data involved, and unresolved commercial questions. Reviewing the entire package helps reveal conflicts that a single-clause review can miss.
TOS Lawyer provides SaaS agreement and contract legal services. Contact TOS Lawyer to discuss an enterprise customer’s proposed changes and the obligations your business would take on.