SaaS terms for a UK startup: the eight clauses your first customers will read

A subscription to use the service, not a copy of the software. Say who may use it (named users, a seat count, the customer's affiliates or not), what it includes (support hours, updates, any usage limits), and that you may change the service as long as it does not materially reduce what they pay for. Put the commercial details (plan, price, term) in an order form or the sign-up page so the terms themselves can stay the same for every customer.

Monthly or annual, renewing automatically unless either side gives notice before the end of the term. Automatic renewal is enforceable between businesses provided it is clear; make it so. Give yourself a right to change prices on renewal with notice (thirty to sixty days is usual), and say what happens if they want to downgrade mid-term, which is normally "at the next renewal".

Procurement will ask for an uptime commitment. A simple target (for example 99.5 per cent monthly, excluding planned maintenance) with service credits as the only remedy is standard and keeps the conversation short. Do not promise levels you do not measure, and say that credits are the exclusive remedy for downtime, so an outage does not become a damages claim.

The customer owns its data; you may use it to provide the service and, usually, in anonymised and aggregated form to improve it. State what happens to the data when the contract ends (export window, then deletion) and the security measures you actually operate.

If the customer's data includes personal data, which it almost always does, UK GDPR Article 28 requires written processor terms covering the subject matter and duration of processing, instructions, confidentiality, sub-processors, assistance with data subject rights, deletion and audit. That is a data processing agreement, attached as a schedule. Customers in regulated sectors will send you theirs if you do not have one; yours will be shorter.

You own the service and everything in it; the customer gets a licence for the term. Feedback and suggestions become yours to use. If you build anything bespoke for a customer, say who owns that, because the default position without a clause is unclear and investors will ask. Add a warranty that the service does not infringe third-party IP, backed by an indemnity for IP claims, which is the one indemnity a SaaS supplier is usually expected to give.

What the customer may not do with the service (resell it, reverse engineer it, upload unlawful content, use it to build a competing product, exceed limits), and your right to suspend access for breach, non-payment or a security threat, with notice where practicable. Suspension is more useful than termination because it preserves the contract and the fees.

If your product includes AI features, say what the customer's data is and is not used for in connection with them. An AI acceptable use policy is increasingly asked for in due diligence questionnaires.

Exclude indirect and consequential loss, loss of profit and loss of data (while promising to restore from your last backup), and cap total liability at the fees paid in the previous twelve months, or a fixed minimum if that would be very low. Under the Unfair Contract Terms Act 1977 you cannot exclude liability for death or personal injury caused by negligence, or for fraud, and a cap must be reasonable, so a cap that is out of all proportion to the fees may not survive. Carve out the IP indemnity and data protection breaches, or cap them separately at a higher figure; sophisticated customers will ask.

Either side may terminate for material breach not remedied within thirty days, or insolvency. The customer may not terminate for convenience mid-term (that is what the renewal notice is for). On termination: access ends, outstanding fees are due, data is available for export for a set period and then deleted, and confidentiality, IP, liability and payment clauses survive.

B2B SaaS terms rarely stand alone. You will also need website terms for visitors who are not customers, a privacy and cookie policy, the DPA above, a data retention and breach response policy (which the DPA will refer to), and often a pilot agreement for the customers who want to try before they commit. All seven are in the SaaS launch pack. If you sell to consumers rather than businesses, the rules are different and stricter: use consumer terms instead.