Tag: SaaS agreement

SaaS, ASP Agreements – FAQs – Security

What data security provisions need to be included in a SaaS agreement?

Customer’s Security Obligations

These should be set out in the software licence. Access to the software and services should not be permitted to third parties without prior authorisation from the supplier. The customer should provide the following warranties:

  • existence of adequate security measure to ensure access to the software and services does not breach the terms of the SaaS agreement
  • relevant confidentiality provisions relating to the use and access to passwords required for accessing the software and services
  • the obligation to notify the supplier of all security breaches, unauthorised access to the software and services and misuse of passwords
  • provision of indemnities for breaches of the above warranties

Supplier’s Security Obligations

These should be set out in the software licence and in the service level agreement (SLA). The supplier’s obligations will be more extensive than the customer’s obligations due to the nature of a SaaS agreement and the inherent risks of operating over the Internet. The following provisions should be included:

  • details of the firewalls and cryptology used
  • obligation of the supplier to notify the customer of security breaches or data loss
  • details of the data centre security structure
  • restrictions on access to passwords
  • information about virus protection mechanisms

Additionally the supplier should reserve the right to suspend access to the software and services if there is a security breach in order to ensure the integrity or security of the software and services.

Audit Rights

Sometimes customer’s will have a regulatory duty (i.e. under the FSA) to check the supplier’s security structures and systems and that the supplier is complying with its contractual security obligations. If an audit right is granted the following issues should be covered in the SaaS agreement:

  • frequency of the audits
  • payment for the supplier’s time and assistance with audits
  • the supplier’s right to be given copies of audit reports
  • confidentiality provisions relating to access to the supplier’s IPRs, data and infrastructures and disclosure of such to third parties
  • whether or not the supplier has any obligation to make changes to the software and services following an audit

Help

For assistance with any security issues, SaaS, ASP, software on demand contracts or any other IT legal issues contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

SaaS, ASP Agreements – FAQs – Software Licence

The software licence to be included in a SaaS agreement is very different from the standard software licence found in non-SaaS agreements for the following reasons.

Term

Access to the software is provided together with support and maintenance services. Without support and maintenance there can be no licence and vice versa. This is because  the  customer has no copy (physical or intangible) of the source code or object code. The software is installed on the supplier’s server and accessed by the customer via the Internet.

The customer therefore does not own any software licence. The customer simply has the right to access the software and the services together for the term of the SaaS agreement. Unlike a standard software licence, no perpetual licence is granted. The term of the licence is the same as the term of the support and maintenance services and both cease to exist when the SaaS agreement is terminated or expires.

NB/It is possible to have  perpetual licence in a more complicated SaaS agreement but this is the exception rather than the norm, and is not dealt with here.

Use of the Software

The software should only be used for the specific purposes set out in the SaaS agreement. Issues such as territory, number of users, who the users are (i.e. the customer, the customer’s users, the customer’s subsidiaries and identified third parties).  No right to copy, distribute, resell or lease the software should be granted to the customer.

Intellectual Property Rights – IPR

The customer needs to be granted the right to use the software for the term, however no rights in the software, source code or support and maintenance services  should be transferred to the customer. No rights in any developed or customised software should , or can be transferred to the customer – as there will be no developed or customised software created in a standard SaaS agreement.

Copyright

No right to copy, decompile or create derivative works from the software should be granted to the customer. However, under the Copyright, Designs and Patents Act 1988 the customer has a mandatory right to decompile the software in limited circumstances, which should be referred to in the SaaS agreement, as such rights cannot be contractually excluded.

Escrow

If you are providing business critical software to customers (i.e. online banking) it is usual to offer customers the possibility of entering into an escrow agreement to hold the source code, or data in escrow. However, if the software is not business critical (to your customers) this should be an optional clause that can be added to the SaaS agreement later at the request of the customer, as most customers will not want to incur the additional cost of an escrow agent.

Help

For assistance with any software licence matters, in particular SaaS, ASP, software on demand contracts or any other IT legal issues contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: