SaaS agreements: what to check before you sign

Why a SaaS agreement is not a software license

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Under a classic software license you receive a copy and run it on hardware you control. With software as a service (SaaS) you receive access rights only. The software, the servers and the data are with the supplier, and your ability to keep working depends on it. All the legal questions follow from this: what happens when the service goes down, when the price goes up, when the supplier is sold or closes, and when someone enters the database without authorization.

A SaaS agreement is almost always made of layers: an order form or price quote, general terms of use published on the supplier’s website, a service level document, and a data processing annex. Many disputes arise from an unclear hierarchy between the layers. An express order-of-precedence clause, stating which document prevails over which, is one of the cheapest and most useful clauses in the agreement.

Terms of use accepted with a click, and which parts of them hold up in Israel

Standard terms of use that are published on a website and accepted by ticking a box are a standard-form contract: a text whose terms were set in advance by one party, to be used for many contracts with customers who are not identified in advance. So the provisions of the Standard Contracts Law, 5743-1982 apply to them, alongside the general contract law in the Contracts (General Part) Law, 5733-1973.

Section 5 of the Law makes two kinds of terms void: a term that denies or limits the customer’s right to go to court, and a term that exempts the supplier, fully or partly, from liability for bodily injury or for a malicious act. Section 4 adds presumptions of unfairness, and several of them bear directly on the wording common in the industry:

• Paragraph (1): an exemption from liability that the law imposes, or an unreasonable limitation of contractual liability. A liability cap equal to one month’s subscription fee, when the expected damage from downtime is orders of magnitude larger, is exactly the kind of term examined here.
• Paragraph (2): an unreasonable right of the supplier to cancel, suspend or delay performance of the contract, or to change material obligations. “The supplier may discontinue a feature at any time” is included.
• Paragraph (4): a right to set or change the price after the contract is made, at the supplier’s sole discretion.
• Paragraph (6): denying or limiting a right or remedy the customer has under the law, or making them conditional on a notice in an unreasonable form or within an unreasonable time.
• Paragraphs (8)–(10): an arbitration clause, in particular arbitration in which the supplier has more influence over the choice of arbitrator, the place and the procedure.
• Paragraph (9): contracting out of the legal rules on the place of jurisdiction, or an exclusive right of the supplier to choose the place of jurisdiction.

The practical conclusion for the customer: a clause that looks watertight is not necessarily so. The conclusion for the supplier: a reasonable liability cap, linked to the payment actually received over a defined period and expressly excluding bodily injury and malice, holds up better than a blanket exemption.

The service level: availability, credits and remedies

The service level document defines the availability of the service as a percentage. The difference looks small in numbers and is large in practice: 99.9% allows about eight hours and forty-six minutes of downtime a year; 99.99% allows about fifty-two minutes. Before arguing over the figure, check three other things:

• How downtime is measured: who measures it, over what time window, and whether a planned maintenance window is left out of the calculation.
• What the remedy is: in most agreements the only remedy is a credit of a percentage of the subscription fee, and it is sometimes defined as the “sole remedy”. A credit is not compensation, and a “sole remedy” is exactly the kind of term examined under section 4(6) of the Standard Contracts Law.
• What happens in a continuing breach: a customer that relies on the service needs a right of early exit and a proportional refund if availability falls below the threshold for several consecutive months, not just a credit.

Data ownership, model training and export

The rule should be written expressly: the data the customer enters belongs to the customer, and the supplier receives a limited license to it only for the purpose of providing the service. Three points need separate wording:

• Secondary use: may the supplier use the data to improve the product or to train models? If so, to what extent, and whether only after identifying details are removed. A silent default in the supplier’s favor is a real risk, especially when the data includes information about the customer’s own customers.
• Export: not an “export option” in general terms, but a format, a scope (including attachments and activity history) and a time window in which export is possible after the engagement ends.
• Deletion: when the data is deleted from the live environment and from the backups, and who confirms in writing that the deletion was carried out.

Data security and outsourcing: what Israeli law requires in the agreement

This is the part that most SaaS agreements in Israel skip. Under the Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13, which came into force on 14 August 2025, the controller of a database is the person who determines the purposes of the processing, and a holder is an outside party that processes information on the controller’s behalf. The customer is usually the controller; the SaaS supplier is the holder.

The Protection of Privacy Regulations (Data Security), 5777-2017 impose, in regulation 15, a specific duty on every engagement with an outside party that involves giving access to a database: to assess the data security risks in advance, and to set out expressly in the agreement the information the outside party may process and the permitted purposes of use; which systems it may access; the type of processing or operation; the term of the engagement, how the information is returned at its end, its destruction by the outside party and a report that this was done; how the data security duties that bind the holder are carried out; a duty to have the persons with access rights sign a confidentiality undertaking; the outside party’s duty to include the same matters in its agreement with an approved subcontractor; and a duty to report annually to the database controller, and immediately in the event of a security incident. In addition, these matters must be set out in the security procedure, and control measures must be taken to check that the supplier complies with the agreement. Cross-checking the data processing annex against the commercial agreement is the core of the work in legal support for digital commerce and artificial intelligence.

In other words, in Israel there is no need to rely on a foreign template to know what must appear in the data processing annex: the regulation lists it. A SaaS agreement that refers only to “the supplier’s privacy policy” does not comply with it.

As for security failures, regulation 11 requires documenting every incident that raises a concern of harm to the integrity of the information or of unauthorized use, and setting handling instructions in the security procedure. In a severe security incident, as defined in the Regulations according to the database’s security level, a duty arises to notify the Authority immediately and to report the steps taken. So the agreement should set a binding timetable within which the supplier notifies the customer, not “as soon as possible”.

Another layer: section 17B1 of the Law requires appointing a privacy protection officer also at a controller or holder whose main activities involve processing operations that require regular and systematic monitoring of people on a significant scale, or processing information of special sensitivity on a significant scale. Many SaaS suppliers fall within the definition, and whether an officer was appointed is a legitimate due diligence question to put to a supplier.

Exit terms and business continuity

Leaving a SaaS supplier is the moment when everything that was not written down comes to light. Four clauses that hold up:

• Symmetrical advance notice: if the customer must give 90 days’ notice, so should the supplier.
• A transition assistance period: a defined period in which the account stays active for reading and export, even after the engagement ends, and a payment agreed in advance for transition services.
• Continuity in case of insolvency or change of control: depositing the code and data with a trustee, or at least an undertaking to a full and immediate export. Such an arrangement is worth its cost only for services that are critical to the business.
• Rights in customizations: custom developments ordered and paid for by the customer: who owns them, and what happens to them on exit.

Pricing, scope of use and automatic renewal

Three recurring disputes in SaaS agreements arise from definitions, not from amounts. The first is the billing unit: a subscription per seat (number of authorized users) versus billing by actual use. Both models need a precise definition of “user” and of “use”: whether a user deactivated in the middle of the month is counted, and whether automated calls count as use.

The second is exceeding the agreed scope: what happens when the quota is exceeded: automatic billing under the price list, blocking, or an alert and a chance to settle it. The third is automatic renewal: the commitment period, the last date for a notice of non-renewal, and whether the price in the renewal period stays the same. An agreement that provides for automatic renewal for another year with a one-week cancellation window is an agreement that almost always renews.

In addition, the supplier needs a fair use policy that defines what may not be done with the service, a ban on reverse engineering, and a statement that the intellectual property in the software remains its own, while the customer receives a limited, non-exclusive license of use for the term of the agreement.

One-sided changes, price and governing law

A clause stating “the supplier may update the terms from time to time, and continued use constitutes consent” is standard in the industry, and in a standard-form contract it is examined under the presumptions of unfairness in section 4. Balanced wording sets advance notice within a defined period, distinguishes between a technical change and a material change, and gives the customer a right to terminate without a penalty if the change is material. As for price, a mechanism known in advance (for example, a cap on annual increases) is better than unlimited discretion.

In an agreement with a foreign supplier, the governing law and jurisdiction clause determines how much litigation will cost. Foreign jurisdiction makes a medium-sized claim uneconomic, so this is a commercial clause, not a formality. If Israeli jurisdiction cannot be obtained, arbitration at a recognized institution, in a language and place agreed in advance, is better than litigation in a distant country, provided the customer is not a customer under a standard-form contract in which the arbitration clause itself falls under the presumption of unfairness.

A “governing law” clause in a foreign supplier’s terms of use is not immune either when the other side is a small business. In the Troim Miller case, the court held by a majority that the California law clause in Facebook’s terms of use is unfair to its consumer customers, including small businesses that bought advertising services from it. The Magistrates’ Court was instructed to examine whether the business that sued is a small business, and Justice Willner stressed that her ruling relies to a large extent on the circumstances of the case (application for leave to appeal, LCA 1901/20, 26 July 2022). Toward private consumers, when the service is aimed at customers in Israel and Israeli law applies, the rule is sharper: a foreign law clause does not exclude the mandatory provisions of the Consumer Protection Law (section 36; in the Agoda case this was held regarding the duty to display the total price, LCA 6992/22; a request for a further hearing was rejected on 18 January 2026). Whether every foreign law clause toward a small customer is unfair has not been settled as binding case law, so in a significant agreement with a foreign supplier it is still worth negotiating the clause rather than relying on it being struck down.

SaaS terms when the service is also sold to consumers: cancellation, renewal and billing

Everything above was written about an agreement between businesses. When the software service is also sold to a “consumer”, meaning someone who buys it mainly for personal, home or family use (section 1 of the Consumer Protection Law), the terms must meet several additional duties. They all follow from the fact that a sale on a website is a distance sale, and that a subscription is a continuing transaction:

In practice, a supplier that sells to both audiences usually keeps two versions, or one version with a separate chapter for consumers. Clauses that suit a business-to-business agreement, such as an annual commitment with no exit at all or a silent renewal for another year, do not hold up toward a consumer. An annual plan is allowed, but the consumer may give a cancellation notice, and the payments that will apply on cancellation must be disclosed in advance (sections 13C(b)(3), 13D(c), 13A(c)). On automatic renewal and notices before the end of a period, see automatic renewal of subscriptions, and on the website’s own duties see online store terms of use.

FAQ

What is the difference between terms of use and a SaaS agreement?

Terms of use are a standard document that the supplier publishes and updates, and they are mainly meant to protect the supplier. A SaaS agreement worthy of the name adds what the customer needs: a service level commitment with a real remedy, express data ownership, a data processing annex that meets regulation 15 of the Data Security Regulations, and exit terms. When the supplier’s documents contradict the order form, the order-of-precedence clause decides.

Is a data processing annex required in an agreement with an Israeli supplier?

Yes, when the engagement involves giving access to a database and the supplier is not an individual (regulation 15(c)). Regulation 15 of the Protection of Privacy Regulations (Data Security), 5777-2017 requires the agreement to set out expressly the scope of processing, the systems, the type of operations, the term of the engagement, the return and destruction of the information, how the security duties are carried out, a confidentiality undertaking, rules for a subcontractor and reporting duties. This is true even without any link to Europe.

A liability cap equal to the subscription amount: is it valid?

Not automatically. In a standard-form contract, an exemption from liability that the law imposes or an unreasonable limitation of contractual liability falls under the presumption of unfairness in section 4(1), and an exemption from liability for bodily injury or for a malicious act is void under section 5(b). A proportionate cap that expressly excludes bodily injury, malice and breach of confidentiality is much more robust than a blanket exemption.

What should you check about a supplier before signing?

Where the data is stored and which subcontractors are involved; which security standards and external audits the supplier has; whether it has appointed a privacy protection officer under section 17B1 of the Protection of Privacy Law; what the timetable is for reporting a security incident; and what exactly can be exported on the day after the engagement ends.

Can a private customer cancel a SaaS subscription bought on a website?

Yes. In a continuing service sold in a distance sale, you can cancel within 14 days of the transaction or of receiving the document with its details, whichever is later, even if the service has already started, and the consumer pays the proportional amount for what they received (sections 14C(c)(2), 14E(b1)). And when a consumer gives a cancellation notice under section 14I, the contract in a continuing transaction ends within three business days (section 13D(c)).

A foreign SaaS provider refers to California law. Does that apply to a small business in Israel?

Not necessarily. In the Troim Miller case, the court held by a majority that the California law clause in Facebook’s advertising contract is unfair to its consumer customers, including small businesses that bought advertising services from it (LCA 1901/20). A sweeping rule for every foreign law clause toward a small customer has not been set as binding case law, so each case is examined on its circumstances.