SaaS Customer Contract Checklist for Indian Startups: Scope, SLA, Data, IP, Payment, Liability and Exit
A large enterprise contract is not automatically a good contract. The real test is whether scope, payment, security, IP, liability and exit obligations are deliverable at the agreed price.
Direct answer
A SaaS contract should convert the sales promise into a deliverable, billable and auditable operating model. If the order form says one thing and the security, SLA or procurement annexures say another, the startup can win revenue while accepting an unpriced obligation.
Use the MeitY data-protection resources, applicable tax records and your actual security architecture when negotiating. The Best CS Firm In India contracting rule is simple: every material promise must have an owner, cost, evidence source and remedy.
Documents that form the complete deal
| Document | Purpose | Founder check |
|---|---|---|
| Order form | Commercial summary | Entity, product, users, term, fees and taxes match the deal |
| Master agreement | Core legal terms | Liability, IP, confidentiality, termination and law |
| Statement of work | Implementation and services | Scope, assumptions, acceptance and change control |
| SLA | Availability and support | Measurement, exclusions, credits and escalation |
| DPA/security schedule | Data and security controls | Roles, subprocessors, incidents, deletion and audits |
Scope and implementation checklist
- Define licensed modules, users, entities, territories and usage limits.
- Separate included implementation from paid professional services.
- List customer dependencies, data formats, access and decision deadlines.
- Use objective acceptance criteria and deemed acceptance where appropriate.
- Require written change orders for additional scope, integrations or timelines.
Payment, tax and renewal terms
| Issue | Questions to settle | Evidence |
|---|---|---|
| Invoice trigger | Signature, go-live, milestone or monthly usage? | Order form and invoice schedule |
| GST/TDS | Are fees tax-exclusive and certificates provided? | GST invoice and TDS reconciliation |
| Disputed invoices | Can the customer withhold only the disputed amount? | Dispute notice process |
| Renewal | Automatic, opt-in or notice-based? | Renewal window and pricing rule |
| Suspension | When can service be suspended for non-payment or risk? | Notice and cure provisions |
Data, privacy and security terms
- Map what personal and confidential data enters the service and where it is processed.
- Identify customer/controller and service-provider/processor responsibilities accurately.
- List approved subprocessors and a workable change-notification process.
- Align incident notification with the startup’s ability to detect, investigate and report.
- Define retention, export and deletion at termination, including backups.
- Limit audits to reasonable scope, frequency, confidentiality and cost.
IP and product-control clauses
Reserve ownership of the platform, models, APIs, templates, documentation, know-how and pre-existing technology. Give the customer rights to use the subscribed service, not ownership of the product. Clearly allocate custom deliverables, customer data, feedback and improvements. Ensure employee and contractor assignments support every ownership promise.
Liability and remedy checklist
- Set an aggregate cap linked to fees or an agreed risk measure.
- Exclude indirect, consequential and speculative losses where commercially appropriate.
- Narrow indemnities to controllable, defined third-party claims.
- Align security and IP carve-outs with insurance and actual exposure.
- Prevent SLA credits from silently stacking with damages and refunds for the same event.
Exit and transition
Define termination triggers, cure periods, prepaid-fee treatment, data export format, migration support, deletion certification and survival of confidentiality, IP and payment clauses. Avoid open-ended “all assistance” obligations without time, scope and fee limits.
Free Weekly Newsletter
Subscribe to BSA startup funding alerts
- Every Sunday, all Indian startup funding alerts in one place
- Monthly funding report on the last day of the month
- Free, concise, founder-focused, and easy to unsubscribe
Get the complete Indian startup funding roundup in your inbox, covering deals, sectors, investor moves, and founder readiness notes from the week.
Built for founders, investors, CFOs, and advisors
No spam. Unsubscribe anytime.
Common founder mistakes
- Signing the customer’s security schedule without technical review.
- Accepting bespoke work inside the subscription price.
- Leaving order-form conflicts unresolved.
- Promising certifications or recovery times not yet achieved.
- Ignoring procurement portals, click-through terms or policies incorporated by URL.
- Failing to place the signed contract and amendments in the investor data room.
Founder / Business Takeaway
Build a contract approval sheet that records deviations on scope, margin, data, IP, security, liability and exit. Enterprise revenue is valuable only when the company can deliver it without creating hidden legal or operational debt.
Suggested internal links
FAQ
What is the most important SaaS contract document?
The signed order form, master agreement, scope, SLA, security schedule and data-processing terms must work together. No single document should be reviewed in isolation.
Should a SaaS startup accept unlimited liability?
Unlimited liability can threaten the company. Founders should negotiate a rational cap, carefully scoped carve-outs and insurance-aligned exposure based on the deal and risk.
Who owns customer data and product improvements?
The contract should distinguish customer data, customer materials, the startup’s pre-existing platform, feedback, configuration and newly created deliverables.
