Most software companies operate on three or four contracts and improvise the rest — here's the complete stack, and what each one actually does.
General information for software and technology companies, not legal advice for your specific facts or jurisdiction — no lawyer-client relationship. See full terms.
Most SaaS companies operate on three or four contracts and improvise the rest.
The default contract for self-serve customers — acceptable use, disclaimers, liability, accepted without negotiation.
The public-facing disclosure of what data you collect and why — distinct from the DPA, which is the processor contract with each customer.
The Article 28 GDPR contract governing how you process customer data on their behalf. Increasingly requested even by non-EU customers as a security-maturity signal.
The umbrella commercial contract for direct sales — liability caps, indemnities, termination, governing law — sitting above individual Order Forms.
The deal-specific document — price, term, scope — that references the MSA. This is where most actual negotiation happens, deal to deal.
Uptime and support-response commitments plus service credits, often an MSA exhibit rather than a standalone contract.
For diligence conversations, partnership talks and vendor evaluations before any commercial contract exists.
The contractual backbone of clean chain of title — see the IP-ownership-leaks resource for what happens when this is missing or ambiguous.
A distinct document from the employee version — contractor default-ownership rules make the assignment clause here especially load-bearing.
Needed the moment anyone else starts selling on your behalf — governs margin, exclusivity, IP licensing and liability pass-through.
The two clauses that get redlined hardest: the liability cap, almost always, and the data-breach indemnity carve-out, increasingly. Go into enterprise negotiations with a pre-agreed fallback position on both — it’s the single biggest driver of how long legal review takes.
One of the most common MSA/DPA conflicts: the MSA caps total liability at 12 months' fees, but the DPA — often drafted or reviewed later, sometimes by a different team — is silent on liability, or worse, carries its own uncapped indemnity for data-protection breaches. Most interpretations read the DPA alongside the MSA and keep the cap intact, but an inconsistent DPA turns that into a genuine dispute exactly when a breach makes it matter most. The fix is a single cross-reference clause tying the DPA back to the MSA's liability section — trivial to add while drafting, a real argument to have after an incident.
This stack reflects standard SaaS commercial-contracting practice for companies selling into the UK, EU and US — it isn't drawn from a single statute. For the DPA specifically, see the GDPR security review resource for the underlying Article 28 citation. Current as of July 2026.
Missing agreements in this stack?
No — sequence matters more than completeness. ToS, Privacy Notice and DPA come first, since you can't sign a customer without them. MSA and Order Form structure arrive with your first enterprise deal. SLA, Reseller Agreements and formalised Contractor Agreements typically arrive as you scale past self-serve.
A ToS is typically a unilateral, non-negotiated "clickwrap" contract for self-serve customers. An MSA is a negotiated bilateral contract, usually paired with an Order Form, used for direct or enterprise sales where terms are actually discussed rather than accepted as-is.
Yes, especially on liability caps, indemnities and data terms — the single most common negotiation surface in enterprise SaaS sales. A pre-approved fallback position on your five or six most-negotiated clauses shortens legal review cycles substantially.
20 minutes, free, with the person who does the work — a scoping call, not a sales call.