Tag: hosting

SaaS Agreements – Terms and Conditions – Online Sales

SaaS Agreements – Online Sales – Terms and Conditions

Many SaaS suppliers now conclude sales of SaaS products with customers online, usually by having customers “click” acceptance of terms and conditions published on their website. SaaS suppliers need to ensure that their online terms and conditions include the following information, in order to create a legally enforceable SaaS agreement with the customer.

E-Commerce Regulations

These Regulations apply to all SaaS suppliers who sell or advertise SaaS services online. The Regulations apply BTB (business to business) and BTC (business to customer).

The SaaS supplier must provide the following information on its website:

  • legal name i.e. XYZ Ltd. If this is different from your trading name any differences should be explained;
  • geographical address,  which must be the registered office if you are a company;
  • which country your business is registered in;
  • the registration number of your company;
  • details of any supervisory body which regulates your business i.e. the FSA;
  • VAT number and where you are registered for VAT;
  • clear details of prices and whether or not delivery and/or tax is included.

It is advisable to include all of the above information (as applicable) in your online terms and conditions.

Incorporation of Terms

In order for a SaaS customer to be legally bound by your online terms and conditions, the content of the terms and conditions must be drawn to the customer’s attention before the SaaS products are purchased.

Customers should be required to:

  • “click” acceptance to your terms and conditions; or
  • read, or scroll through the terms and conditions;

before purchasing the SaaS products.

Changes to Terms and Conditions

If you want customers to be legally bound by future changes to your online terms and conditions, you must state this in your online terms and conditions. You should also make the terms and conditions available on your website at all times, so that they can be stored or reproduced by customers.

Customer Cancellation Rights

If you are selling SaaS products to consumers the provisions of the Distance Selling Regulations 2000 (as amended in 2005) will apply and from Autumn 2013 the new EU Consumer Rights Directive will also apply. These contain provisions about mandatory “cooling off” periods and customer cancellation rights, with limited exceptions. However, if you only sell SaaS products BTB, these rules do not apply.

Other Laws

In addition to the E-Commerce Regulations, depending on whether or not you supply SaaS products BTB or BTC, other laws such as the Unfair Contract Terms Act 1977, the Unfair Terms in Consumer Contracts Regulations 1999 and the Supply of Goods and Services Act 1982 will apply to your online terms and conditions.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLA – Terms to Include

The following issues should always be included in any SLA, regardless of the type of SaaS product and services being supplied.

Times

Clearly define times for all of your actions. Business hours and days need to be carefully defined, particularly if you have customers outside of the UK, or your maintenance and support staff are located across the globe.

Language

If your SaaS agreement includes non-English speaking customers specify in which languages you provide support.

Availability

Customers expect to be given a guarantee of the availability of the SaaS product and services. This usually ranges from 95 – 99.9%, depending on the type of services being provided. It will also largely depend upon the availability guaranteed by any third party data centre you use to host your SaaS products and services.

When stating the level of availability of the SaaS products and services specify how and when availability will be measured, remembering to exclude any down-times for maintenance from the calculation.

Customer Support

Provide a short description of the support that you will provide to customers. This should include details about how you can be contacted and the way in which you will respond to, and fix software problems. Specify severity levels and state times for responding to and fixing software problems, remembering to differentiate between problems (errors that can be reproduced) and bugs.

Maintenance

Set out the times and days when you will carry out maintenance. Distinguish between regular maintenance and emergency maintenance, as you may need to install emergency patches and carry out emergency repairs at any time. State whether or not any prior notice will be given. Any downtime caused by you carrying out scheduled or emergency maintenance should be excluded from the calculation of availability.

Specify whether or not upgrades are included in the services. Will they be free of charge, or are they only provided upon payment of an additional fee? Are upgrades mandatory or voluntary? Also identify what is actually included in an “upgrade”.

Security

Briefly describe the security provisions that you have in place at your data centre and internally within your organisation. These should include:

  • Details of data centre security structure and infrastructure;
  • Details of the firewalls and cryptology you use;
  • Any obligation to notify the customer of security breaches;
  • Restrictions on access to passwords;
  • Information about virus protection mechanisms.

Other Issues

Other provisions that you could consider including in your SLA are:

Commercial Considerations

The above is a general guide to the terms to include in a SLA for a SaaS agreement. The degree of detail that you provide will largely depend upon the following:

  • The type of SaaS products and services you are supplying;
  • How much the customer pays for the SaaS product and services;
  • Whether the SaaS product is business critical i.e. online banking;
  • What is standard in that particular business area.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Hosting

When negotiating a SaaS agreement you may come across the term hosting. What is hosting and is a hosting agreement necessary?

SaaS and Hosting

Under the terms of your SaaS agreement you will be storing, processing and publishing customer content and data on the Internet using servers located and operated at the data centre of a third party. The third party operating the servers is known as a hosting provider. The hosting services are provided from a data centre owned and operated by the hosting provider.

Usually the hosting provider owns and maintains the servers in the data centre, however increasingly it is becoming more common for SaaS suppliers to rent “space” in a data centre and then store and maintain their own servers there.

The type, scope and specific nature of the hosting services to be supplied by the hosting provider will be set out in a hosting agreement.

Hosting Agreement

The hosting agreement specifies:

  • the scope, type and nature of the hosting services being provided to the SaaS supplier; and
  • the terms on which the SaaS software, content and customer data will be stored on behalf of the SaaS supplier.

The agreement is entered into between the SaaS supplier and the hosting provider.

As the customer has no agreement with the hosting provider it is essential that the relevant terms of the hosting agreement are reflected in the service level agreement (SLA) between the SaaS supplier and the customer, as hosting problems could have a critical impact on the customer’s business.

Negotiating a Hosting Agreement

Hosting providers are usually large telecoms or Internet service providers (ISPs). They use standard terms and conditions which are usually non-negotiable and very favourable to them. However, depending upon your bargaining power it may be possible to individually negotiate some terms of the hosting agreement for example, service credits, availability, liability and exclusions.

Dedicated or Shared Services

Depending on the price paid for the hosting services and the industry sector in which your customers operate, you may need “dedicated” rather than “shared” hosting services. Dedicated hosting services involve the storage of each individual customer’s website and content on a single server. If you decide to use a shared hosting option the content and websites of multiple customers will be stored on the same server.

Most SaaS suppliers use shared servers, where this is acceptable to customers, as hosting on dedicated servers is more expensive.

Location of the Data Centre

The physical location of the data centre used by your hosting provider is very important to SaaS customers. Due to ever increasing and evolving security and data protection laws, rules and guidelines, it is essential that you consider:

  • the needs and requirements of your customers;
  • your long term business expansion plans;
  • relevant data protection laws; and
  • the physical location of your customers;

when selecting your hosting provider.

If you decide to use a hosting provider with servers located outside of the UK for a UK government customer, even if the hosting provider itself is located within the UK you will encounter serious issues. Conversely, if you decide to use a hosting provider with servers located in the UK for a German customer, you will also encounter problems.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SaaS, PaaS, IaaS – Is There a Difference?

Cloud computing services comprise of – Platform as a Service (PaaS), Infrastructure as a Service (IaaS) and Software as a Service (SaaS). These terms are commonly used to describe the different levels and combinations of services which are together commonly referred to as “cloud computing”.

SaaS – Software as a Service

Sometimes referred to as “software on-demand”, SaaS is a software delivery model in which software and data are hosted centrally and accessed using a web browser via the Internet.

Examples of common SaaS applications are:

  • email accounts such as Hotmail or Google;
  • CRM (customer relationship management) systems such as Salesforce;
  • HCM (human capital management or talent management) systems.

Important features of SaaS are that:

  • customer data can be added to the software application;
  • the software application can be accessed without the need to use additional hardware or software;
  • data and the software application are hosted centrally.

PaaS – Platform as a Service

PaaS provides developers with a platform to write and create their own SaaS application.  PaaS provides developers with the necessary tools to create, test, host and maintain the applications they have created. This alleviates the need for developers to buy and maintain the underlying hardware, software and hosting facilities for their SaaS applications.

The most well known PaaS is Facebook.

Within the classic layered structure of cloud computing PaaS forms the middle layer sitting between between SaaS at the top and IaaS at the bottom.

Important features of PaaS are:

  • application hosting, development, testing and deployment environment;
  • other integrated services such as database integration, security and storage.

IaaS – Infrastructure as a Service

Sometimes referred to as “hardware as a service”, IaaS is an outsourcing model under which users rent equipment accessed via the Internet to support their operations.

One of the most well known forms of IaaS is Amazon.com, which provides the computing power behind many major online services, for example Foursquare.

The IaaS supplier owns all equipment and is responsible for housing, running and maintaining the equipment. The user simply pays a usage rental fee for accessing the outsourced services via the Internet.

Summary

SaaS is a software distribution model in which a third party hosts and makes software applications available to end users via the Internet. PaaS is a framework for delivering operating systems and associated services via the Internet, which does not involve any software downloads or installation. IaaS is a form of equipment outsourcing via the Internet used to support a company’s operations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Need for an Escrow Agreement

As a SaaS supplier you may want to consider offering escrow agreements to your customers, particularly if you run  SaaS applications which are critical to your customer’s business.

What is Escrow

Escrow refers to a third party holding a copy of the SaaS software source code on behalf of the customer and the supplier.

What is an Escrow Agent

An escrow agent is a third party who stores a copy of the SaaS software source code. The escrow agent will release a copy of the source code to the customer if any of the events set out in the escrow agreement occur.

Why use Escrow

This is usually a customer driven requirement resulting from the fact that the source code for the SaaS software, the expertise to implement it and rights to the SaaS software are only licensed to, and not owned by, the customer for the term of the SaaS agreement.

Customers are concerned that the supplier may:

  • fail to maintain the software;
  • transfer ownership of intellectual property rights in the SaaS software;
  • become insolvent; or
  • become unable to carry on supporting and maintaining the software for some other reason.

By having an escrow agreement in place the customer has the right to continue to use the software, if the supplier is in default of its obligations under the SaaS agreement.

Advantages of an Escrow Agreement

Having an escrow agreement in place protects all parties involved in the development, supply and use of business critical SaaS applications. It provides customers with peace of mind for securing long-term availability of a critical SaaS application by enabling customers to update software and fix any bugs even if the supplier is no longer able to support them.

Disadvantages of an Escrow Agreement

Having the right to use the software under an escrow agreement is in reality of little use if the customer does not have the know-how and resources to actually use, maintain and support the source code itself.

Also, the costs of setting up an escrow agreement and maintaining it are relatively expensive. Escrow costs are usually paid for by the customer.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLA – Security Issues

As a SaaS supplier you will have noticed the increasing concerns about security voiced by SaaS customers. Your SaaS agreement should therefore provide comfort to your customer by including security provisions in the service level agreement (SLA). The specific matters you should consider including are set out below.

 Access

The persons able to access the hosting centre should be very limited and the individuals should be defined. Access should only be allowed for hardware and software maintenance. A record of all visits should be logged, which can be easily achieved if swipe cards are used. Remember that when using a third party hosting centre, access will be controlled by, and should reflect, the terms of your hosting agreement with the hosting centre.

Physical Security

This should prevent unauthorised access to the hosting centre to prevent damage, loss or theft to hardware and software. Surveillance of the hosting centre is essential and details of whether or not this is 24 x 7, via video camera, watchmen or electronic alarm systems should be included in the SLA. Within the hosting centre itself, racks themselves should be separately secured.

Hosting Environment Security

In order to provide a continuous service to customers, the hosting centre must have:

  • an uninterrupted power supply;
  • a dual power source;
  • air conditioning; and
  • fire and flood detection systems.

Server Security

In order to protect your servers, you should use:

  • up to date virus protection;
  • up to date security patches; and
  • firewalls.

Data Security

In order to protect customer data you should set out:

  • how, where and when data will be backed up;
  • how often data will be backed up;
  • where backups will be stored; and
  • when discs/tapes will be rotated.

ISO 27001 Certification

ISO 27001 is an internationally recognised security certification which is often required by SaaS customers who are looking for assurance that adequate levels of data security are in place to protect their data. Having this certification demonstrates to customers your commitment to data security by confirming that you comply with “best practice” security management.

Disaster Recovery

Is this offered at all, consider whether is it included in your standard subscription fee, or if a premium will be charged. Also, remember that your disaster recovery centre should be physically remote from your hosting centre, and with a different provider.

Commercial Considerations

The level of security obligations offered to SaaS customers will depend upon:

  • how much a customer pays for the SaaS solution, maintenance and support;
  • whether the SaaS application is business critical i.e. online banking;
  • what is standard in that particular business area.

Exclusions

Ensure that your SaaS agreement contains appropriate security obligations applicable to your customer, for example using up to date virus programmes. Exclude liability for any security breaches which are caused by something beyond your control or an act, omission or breach of your customer’s security obligations under the SaaS agreement.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – E-Discovery

As a SaaS supplier you may be ordered by a court as part of a litigation process to identify and disclose physical documents and electronically stored information (e-discovery). This creates problems for SaaS suppliers on a number of levels.

Location of the ESI

Data is often stored or replicated in an external hosting centre, the SaaS software application itself or a corporate data centre. If numerous data centres are used they are usually in different physical locations and in various countries. Discovery rules may conflict with compliance and privacy requirements in the countries where the data is held, however for the purposes of complying with your obligations under a country’s e-discovery rules the actual location of the data is irrelevant.

For example in AccessData Corporation v ALSTE Technologies GmbH a US court ordered a German company to disclose emails stored in Germany as part of the disclosure process in a court case, although the company argued that this breached the German Data Protection Act.

Compliance Issues

SaaS agreements should therefore permit SaaS suppliers and customers to comply with e-discovery requests, to avoid breaches of requests for disclosure. Although it is unlikely that any sanctions will be taken by the court against the SaaS supplier, the customer may try to claim damages for any losses it sustains. The SaaS supplier should therefore ensure that they exclude liability under the SaaS agreement for a technical or any other type of failure to comply with a disclosure request.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: