Tag: SaaS template

SaaS Agreements – Agency Agreements – Commercial Agents Regulations

SaaS suppliers often use partners to find prospects, refer leads, assist with the sales process or to conclude sales with SaaS customers on their behalf. Many SaaS suppliers are not aware that the terms of the Commercial Agents Regulations 1993 may apply to the terms of the agreement between the SaaS supplier and its commercial agent.

What is a Commercial Agent?

A commercial agent is a person or company who acts on behalf of a SaaS supplier to find leads and/or assist with sales of the supplier’s SaaS software. SaaS suppliers usually use agents where they need to find customers outside of their territory or business sector.  The agent has no legal relationship with the customer – the contract with the customer is made with the SaaS supplier.

Commercial Agents Regulations 1993

These Regulations apply to all agency agreements made with a commercial agent based in the EU in relation to goods. If you are a SaaS supplier who only supplies services and no goods then the Regulations will not apply. The rules apply regardless of where the SaaS supplier is based. For example if you are a SaaS supplier located in the USA using an agent in the UK, the Regulations will still apply to your agency agreement.

The Regulations include mandatory rules on notice periods that have to be given to agents, payment terms and compensation or indemnities payable to the agent if the agency agreement is terminated.

Mandatory Payments on Termination

If the agent is located in the EU, the SaaS supplier must pay commission for up to a year after termination of the agency agreement (regardless of the reason for termination) or an indemnity. Compensation will be paid unless the agency agreement states than an indemnity should be paid.

Indemnity

If an indemnity is specified in the agency agreement, the amount payable is limited by the Regulations to a maximum of 1 year’s gross commission. This will be based on the average commission paid to the agent over the last 5 years. In calculating the amount of an indemnity, unless the parties have agreed otherwise, the benefits accruing to the SaaS supplier’s corporate group are not considered to be benefits of the SaaS supplier and can be ignored.

Compensation

If the agency agreement is silent or the SaaS supplier specifies the payment of compensation, a court will determine how much compensation the agent is entitled to. There is no cap on the amount that can be awarded to an agent. In McQuillan v McCormick 2010 the High Court identified the following factors which should be considered when determining how much compensation an agent should be paid on termination:

  • loss of value of the agency relationship;
  • state of the market;
  • no cap on the amount;
  • future possible income stream to the SaaS supplier after termination;
  • whether the agreement is exclusive or non-exclusive.

In this case the agent received approximately one year’s commission from the court.

Limitation Period for Claims

Agents lose the right to claim compensation or an indemnity if they fail to serve notice of their intention to make a claim within one year of termination of the agency agreement.

Notice Period and Termination

If the agency agreement is for an indefinite period it can be terminated by either party giving notice. This also applies where a fixed term agency agreement is converted into an indefinite agreement.

Mandatory minimum notice periods are specified under the Regulations. These are:

  • one month for the first year;
  • two months for the second year; and
  • three months for any third or subsequent years.

The parties may agree longer notice periods, but the notice provisions imposed on the agent must be no longer than those which the supplier has to give.

What if the Agency Agreement is not Governed by English law

Often agency agreements state that the laws of a non-EU country e.g. USA or Canada apply to the agreement or that disputes should be referred to arbitration outside of the EU.  Usually the Courts in a country outside the EU will not recognise a claim for compensation or an indemnity under the Regulations.  However, if you have an agreement with an agent based in the UK, the fact that your agreement is subject to the law of a non-EU country does not mean that the Regulations do not apply to the agency agreement.

For example, the right of the agent to claim compensation or an indemnity on termination under the Regulations cannot be excluded.   Even though your agency agreement may be governed by non-EU laws, an agent located in the UK will still be entitled to bring a claim in the English Courts for compensation or an indemnity under the Regulations. If the agent is located in another EU country, then the local law version of the Regulations applicable to that EU country will apply.

How to Avoid Paying Compensation after Termination

The SaaS supplier is not required to pay compensation if the agent has terminated the agency agreement “because of default attributable to the commercial agent which would justify immediate termination of the agency agreement”. For example if the agent has committed a serious breach of contract, such as ignoring an exclusivity provision. However, such exclusions are very limited.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLA – Terms to Include

The following issues should always be included in any SLA, regardless of the type of SaaS product and services being supplied.

Times

Clearly define times for all of your actions. Business hours and days need to be carefully defined, particularly if you have customers outside of the UK, or your maintenance and support staff are located across the globe.

Language

If your SaaS agreement includes non-English speaking customers specify in which languages you provide support.

Availability

Customers expect to be given a guarantee of the availability of the SaaS product and services. This usually ranges from 95 – 99.9%, depending on the type of services being provided. It will also largely depend upon the availability guaranteed by any third party data centre you use to host your SaaS products and services.

When stating the level of availability of the SaaS products and services specify how and when availability will be measured, remembering to exclude any down-times for maintenance from the calculation.

Customer Support

Provide a short description of the support that you will provide to customers. This should include details about how you can be contacted and the way in which you will respond to, and fix software problems. Specify severity levels and state times for responding to and fixing software problems, remembering to differentiate between problems (errors that can be reproduced) and bugs.

Maintenance

Set out the times and days when you will carry out maintenance. Distinguish between regular maintenance and emergency maintenance, as you may need to install emergency patches and carry out emergency repairs at any time. State whether or not any prior notice will be given. Any downtime caused by you carrying out scheduled or emergency maintenance should be excluded from the calculation of availability.

Specify whether or not upgrades are included in the services. Will they be free of charge, or are they only provided upon payment of an additional fee? Are upgrades mandatory or voluntary? Also identify what is actually included in an “upgrade”.

Security

Briefly describe the security provisions that you have in place at your data centre and internally within your organisation. These should include:

  • Details of data centre security structure and infrastructure;
  • Details of the firewalls and cryptology you use;
  • Any obligation to notify the customer of security breaches;
  • Restrictions on access to passwords;
  • Information about virus protection mechanisms.

Other Issues

Other provisions that you could consider including in your SLA are:

Commercial Considerations

The above is a general guide to the terms to include in a SLA for a SaaS agreement. The degree of detail that you provide will largely depend upon the following:

  • The type of SaaS products and services you are supplying;
  • How much the customer pays for the SaaS product and services;
  • Whether the SaaS product is business critical i.e. online banking;
  • What is standard in that particular business area.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – The UK Patriot Act

Recently SaaS suppliers have seen a marked increase in EU customers raising concerns about disclosure of their data to US law enforcement authorities under the Patriot Act – an American anti-terrorism law – particularly where the SaaS supplier has a parent company in the USA or data is being hosted or processed in the USA.  Now to add to your problems, the UK Government plans to introduce its own “Patriot Act” type law in the near future.

Proposed Increase in E-Mail and Web Monitoring  in the UK

According to the BBC and Guardian websites, a controversial new English law is expected to be announced in the Queen’s speech on the 9th of May. The proposed new law will allow the UK police and security services to access the Web and Internet phone traffic of all UK residents. This will include access to all phone calls (made via the Internet), emails, social media exchanges and website visits.

Information that may be Disclosed

The proposals will grant UK police and security services the right to see:

  • the time of a call, email, or website visit;
  • the duration of the call or visit;
  • which websites or phone numbers were called; and
  • details of the sender and recipient of emails, such as IP addresses;

without any need for first obtaining a court warrant.

If a warrant is obtained, then the content of such messages will also be disclosed upon request.

Justifications for the New Law

The proposed legislation will loosen the existing surveillance arrangements set out in the Regulation of Investigatory Powers Act. The Government claims these new rights are needed to give the police and security services extended powers to enable them to investigate serious crime and terrorism. The same argument used in the USA prior to the introduction of the Patriot Act. The new law will in effect give the UK police and security services rights very similar to those granted to US authorities under the Patriot Act.

Problem for SaaS Suppliers

If this proposed new law is adopted, UK based SaaS suppliers will face increased difficulties in:

  • persuading customers to move across from more traditional suppliers to the SaaS model; and
  • allying customer concerns about the security and confidentiality of data.

Previous problems raised by SaaS customers over the application of the Patriot Act will fade into insignificance in comparison with these new UK rights.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Patriot Act – Renewed Customer Concerns

Recently SaaS suppliers have seen a marked increase in EU customers raising concerns about disclosure of their data to US law enforcement authorities under the Patriot Act – an American anti-terrorism law – particularly where the SaaS supplier has a parent company in the USA or data is being hosted or processed in the USA.

High Profile Cases

Microsoft recently admitted that United States law enforcement authorities can access their European customer data without having to obtain a court order, ask for consent or even inform data subjects of the disclosure under the terms of the Patriot Act. To add to SaaS suppliers worries it is believed that BAE recently withdrew from contract negations for a Microsoft SaaS product due to fears that defence secrets could be accessed by the US authorities under the Act.

The recent publication of the new proposed EU data protection regulation has also added to customer fears that data is not safe from disclosure under the Patriot Act. The new regulation attempts to counter the application of the US Patriot Act by stating that non-EU companies will have to comply with EU data protection rules when accessing EU citizen data.

The Patriot Act v European Data Protection Laws

The provisions of the Patriot Act conflict directly with English and EU data protection laws.

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing their customers that they have had to hand over their personal data.

Data protection laws in the 27 countries of the EU all prohibit the disclosure of personal data without a data subject’s consent or knowledge.

Therefore if a EU company is faced with a Patriot Act disclosure request it is impossible to comply with both the US law and the EU company’s local data protection laws. In practice the US law usually prevails. Some of the largest global software and search engine companies have admitted that EU customer data has already been disclosed by them as a consequence of requests under the Patriot Act.

The Cloud is not the Problem

SaaS customers often falsely believe that their data is not safe from disclosure due to the cross-border nature of cloud computing. However this problem applies to all data whether or not it is stored or processed in a SaaS model. Most countries (the UK, France, Spain and Belgium to name a few) have laws similar to the Patriot Act that all, not just SaaS suppliers must comply with i.e. in the UK the Regulation of Investigatory Powers Act 2000 (RIPA) requires disclosure of the content of communications to police forces.

Also data stored or processed anywhere outside of the EEA, in a country which does not have equivalent protection will be subject to all local disclosure laws i.e. in China and India, and such local laws may be less restrictive than the Patriot Act with regard to the type of data that must be disclosed.

In any event, regardless of whether or not the Patriot Act applies to customer data, the US authorities can access customer data even when it is hosted outside of the USA and there is no company presence in the USA under Mutual Assistance Legal Treaties (MLAT)

Assessing the Actual Risk of Disclosure

SaaS customer concerns about the Patriot Act are valid but these must be considered in light of:

  • The type of data covered by a request for disclosure under the Patriot Act;
  • The likelihood of the customer data ever being requested; and
  • The fact that customer data is already subject to similar disclosure obligations to the UK government and foreign governments under other existing laws.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Hosting

When negotiating a SaaS agreement you may come across the term hosting. What is hosting and is a hosting agreement necessary?

SaaS and Hosting

Under the terms of your SaaS agreement you will be storing, processing and publishing customer content and data on the Internet using servers located and operated at the data centre of a third party. The third party operating the servers is known as a hosting provider. The hosting services are provided from a data centre owned and operated by the hosting provider.

Usually the hosting provider owns and maintains the servers in the data centre, however increasingly it is becoming more common for SaaS suppliers to rent “space” in a data centre and then store and maintain their own servers there.

The type, scope and specific nature of the hosting services to be supplied by the hosting provider will be set out in a hosting agreement.

Hosting Agreement

The hosting agreement specifies:

  • the scope, type and nature of the hosting services being provided to the SaaS supplier; and
  • the terms on which the SaaS software, content and customer data will be stored on behalf of the SaaS supplier.

The agreement is entered into between the SaaS supplier and the hosting provider.

As the customer has no agreement with the hosting provider it is essential that the relevant terms of the hosting agreement are reflected in the service level agreement (SLA) between the SaaS supplier and the customer, as hosting problems could have a critical impact on the customer’s business.

Negotiating a Hosting Agreement

Hosting providers are usually large telecoms or Internet service providers (ISPs). They use standard terms and conditions which are usually non-negotiable and very favourable to them. However, depending upon your bargaining power it may be possible to individually negotiate some terms of the hosting agreement for example, service credits, availability, liability and exclusions.

Dedicated or Shared Services

Depending on the price paid for the hosting services and the industry sector in which your customers operate, you may need “dedicated” rather than “shared” hosting services. Dedicated hosting services involve the storage of each individual customer’s website and content on a single server. If you decide to use a shared hosting option the content and websites of multiple customers will be stored on the same server.

Most SaaS suppliers use shared servers, where this is acceptable to customers, as hosting on dedicated servers is more expensive.

Location of the Data Centre

The physical location of the data centre used by your hosting provider is very important to SaaS customers. Due to ever increasing and evolving security and data protection laws, rules and guidelines, it is essential that you consider:

  • the needs and requirements of your customers;
  • your long term business expansion plans;
  • relevant data protection laws; and
  • the physical location of your customers;

when selecting your hosting provider.

If you decide to use a hosting provider with servers located outside of the UK for a UK government customer, even if the hosting provider itself is located within the UK you will encounter serious issues. Conversely, if you decide to use a hosting provider with servers located in the UK for a German customer, you will also encounter problems.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SaaS, PaaS, IaaS – Is There a Difference?

Cloud computing services comprise of – Platform as a Service (PaaS), Infrastructure as a Service (IaaS) and Software as a Service (SaaS). These terms are commonly used to describe the different levels and combinations of services which are together commonly referred to as “cloud computing”.

SaaS – Software as a Service

Sometimes referred to as “software on-demand”, SaaS is a software delivery model in which software and data are hosted centrally and accessed using a web browser via the Internet.

Examples of common SaaS applications are:

  • email accounts such as Hotmail or Google;
  • CRM (customer relationship management) systems such as Salesforce;
  • HCM (human capital management or talent management) systems.

Important features of SaaS are that:

  • customer data can be added to the software application;
  • the software application can be accessed without the need to use additional hardware or software;
  • data and the software application are hosted centrally.

PaaS – Platform as a Service

PaaS provides developers with a platform to write and create their own SaaS application.  PaaS provides developers with the necessary tools to create, test, host and maintain the applications they have created. This alleviates the need for developers to buy and maintain the underlying hardware, software and hosting facilities for their SaaS applications.

The most well known PaaS is Facebook.

Within the classic layered structure of cloud computing PaaS forms the middle layer sitting between between SaaS at the top and IaaS at the bottom.

Important features of PaaS are:

  • application hosting, development, testing and deployment environment;
  • other integrated services such as database integration, security and storage.

IaaS – Infrastructure as a Service

Sometimes referred to as “hardware as a service”, IaaS is an outsourcing model under which users rent equipment accessed via the Internet to support their operations.

One of the most well known forms of IaaS is Amazon.com, which provides the computing power behind many major online services, for example Foursquare.

The IaaS supplier owns all equipment and is responsible for housing, running and maintaining the equipment. The user simply pays a usage rental fee for accessing the outsourced services via the Internet.

Summary

SaaS is a software distribution model in which a third party hosts and makes software applications available to end users via the Internet. PaaS is a framework for delivering operating systems and associated services via the Internet, which does not involve any software downloads or installation. IaaS is a form of equipment outsourcing via the Internet used to support a company’s operations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Reseller/Distribution – Terms to Include

When using a local partner to resell your SaaS software to customers outside of the countries in which you are based, you will need to have a distributor/reseller agreement in place between yourself and each distributor/reseller. This will in part mirror your standard SaaS terms and conditions but will also need to include additional clauses to cover the issues set out below.

Applicable Law and Language

Usually your reseller will be located in another country. The reseller will be selling your SaaS software to its customers using its own local terms and conditions. These will probably be subject to local law i.e. German law if the reseller is in Germany and in the local language, German. However, there is no reason why your reseller agreement should be in German and subject to German law, as you the supplier have no relationship with the customers. You should resist any attempt by the reseller to use its local law and language.

As a compromise, it is worth allowing the reseller to have the reseller agreement translated into their local language “for convenience”, in parallel to the English version. However if you have two language versions ensure that the English version of the agreement prevails if there are any discrepancies between the two different language versions.

Please note that in some countries it is mandatory under local law to have the agreement in the local language.

IPR

It is essential that you control the use of your name, trademarks and intellectual property rights by your resellers. You should set out clearly in the reseller agreement whether or not the reseller is permitted to register local domain names, company names and trademarks on your behalf for your SaaS application and products. You may require this, as in certain countries you need to be a resident national of that country or have a company located in the country to make such registrations.

If you do grant the reseller such rights, it is essential that you regulate what happens to ownership of the trademarks, domains and use of your name if the reseller agreement is terminated or expires.

Territories

You should identify the territories in which the reseller may resell your SaaS application and products. List country names and do not refer to unclear terms such as EMEA, the Middle East or North Africa – there is no agreed definition of which countries these include. You should also decide whether or not your reseller should have exclusive or non-exclusive rights in the territories. If you grant the reseller exclusive rights ensure that you retain the right to make passive sales to customers, or you will be in breach of EU competition law.

EU and Local Competition Law

Depending upon the country in which you are based and the country in which the SaaS distributor is based, you will need to comply with the various anti-competitive laws that will automatically apply to the reseller agreement. Failure to comply with relevant competition laws could make not just an individual clause in the reseller agreement, but the whole agreement invalid. Additionally you could be subject to very large fines based on a substantial percentage of your annual turnover for breaches of competition law.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Need for an Escrow Agreement

As a SaaS supplier you may want to consider offering escrow agreements to your customers, particularly if you run  SaaS applications which are critical to your customer’s business.

What is Escrow

Escrow refers to a third party holding a copy of the SaaS software source code on behalf of the customer and the supplier.

What is an Escrow Agent

An escrow agent is a third party who stores a copy of the SaaS software source code. The escrow agent will release a copy of the source code to the customer if any of the events set out in the escrow agreement occur.

Why use Escrow

This is usually a customer driven requirement resulting from the fact that the source code for the SaaS software, the expertise to implement it and rights to the SaaS software are only licensed to, and not owned by, the customer for the term of the SaaS agreement.

Customers are concerned that the supplier may:

  • fail to maintain the software;
  • transfer ownership of intellectual property rights in the SaaS software;
  • become insolvent; or
  • become unable to carry on supporting and maintaining the software for some other reason.

By having an escrow agreement in place the customer has the right to continue to use the software, if the supplier is in default of its obligations under the SaaS agreement.

Advantages of an Escrow Agreement

Having an escrow agreement in place protects all parties involved in the development, supply and use of business critical SaaS applications. It provides customers with peace of mind for securing long-term availability of a critical SaaS application by enabling customers to update software and fix any bugs even if the supplier is no longer able to support them.

Disadvantages of an Escrow Agreement

Having the right to use the software under an escrow agreement is in reality of little use if the customer does not have the know-how and resources to actually use, maintain and support the source code itself.

Also, the costs of setting up an escrow agreement and maintaining it are relatively expensive. Escrow costs are usually paid for by the customer.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Reseller/Distribution – Need for a Reseller Agreement

If you decide to use a local partner to resell your SaaS software to customers outside of the countries in which you are based, you will need to have a distribution/reseller agreement in place between yourself and each distributor/reseller.

What is a Reseller/Distributor?

A reseller is the same as a distributor. A reseller/distributor purchases the supplier’s SaaS software and services under the terms of a reseller/distribution agreement. The reseller/distributor then resells the SaaS software and services to its own local customers in the territory using its own terms and conditions (and SLA). The SaaS supplier has no legal relationship with the reseller/distributor’s customers. Customers enter into a SaaS agreement with the reseller/distributor directly.

Why use a Reseller/Distributor?                                          

Most SaaS suppliers use distributors to enable them to sell their software and services to SaaS customers who would not otherwise purchase the SaaS software, due to the Supplier’s:

  • Lack of physical presence in the SaaS customer’s country;
  • Lack of sales channels and contacts in the SaaS customer’s country;
  • Inability to speak the local language;
  • Inability to provide SaaS customer support in the local language;
  • Inability to provide customer support within the SaaS customer’s local business hours;
  • Terms and conditions not being written in the SaaS customer’s language, or subject to local laws and regulations.

By using a distributor/reseller the above problems are resolved as the distributor/reseller sells the SaaS software directly to SaaS customers, in the local language, pursuant to local law, with local support as if the SaaS software was his own software.

Advantages

The main advantage of using a reseller/distributor is that the SaaS supplier will have no liability to SaaS customers – as there is no contract or legal relationship between the SaaS customer and the SaaS supplier. For example, any implementation issues or software errors that the SaaS customer encounters when using the SaaS software will be the reseller’s problem. The reseller will be liable to the SaaS customer and will be obliged to resolve such issues directly with the SaaS customer.

Disadvantages

The main disadvantage of using a reseller/distributor is that the SaaS supplier has no control over the sales process and in particular of the choice of SaaS customers. Also, the terms of the SaaS agreement itself will be subject to local anti-competitive laws and regulations.

Is an Agent the same as a Distributor?

Agents are often confused with distributors, but there are clear legal differences. An agent is a person or company who acts on behalf of the SaaS supplier to find leads and/or assist with sales of the supplier’s SaaS software to local SaaS customers in the agent’s territory.

An agent has no legal relationship with the SaaS customer as the agent has no contract with the SaaS customer. The SaaS supplier enters into a SaaS agreement, with the SaaS customer using the SaaS supplier’s own terms and conditions and SLA. The SaaS supplier is liable to the SaaS customers for issues and errors that may arise during use of the SaaS software.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLA – Security Issues

As a SaaS supplier you will have noticed the increasing concerns about security voiced by SaaS customers. Your SaaS agreement should therefore provide comfort to your customer by including security provisions in the service level agreement (SLA). The specific matters you should consider including are set out below.

 Access

The persons able to access the hosting centre should be very limited and the individuals should be defined. Access should only be allowed for hardware and software maintenance. A record of all visits should be logged, which can be easily achieved if swipe cards are used. Remember that when using a third party hosting centre, access will be controlled by, and should reflect, the terms of your hosting agreement with the hosting centre.

Physical Security

This should prevent unauthorised access to the hosting centre to prevent damage, loss or theft to hardware and software. Surveillance of the hosting centre is essential and details of whether or not this is 24 x 7, via video camera, watchmen or electronic alarm systems should be included in the SLA. Within the hosting centre itself, racks themselves should be separately secured.

Hosting Environment Security

In order to provide a continuous service to customers, the hosting centre must have:

  • an uninterrupted power supply;
  • a dual power source;
  • air conditioning; and
  • fire and flood detection systems.

Server Security

In order to protect your servers, you should use:

  • up to date virus protection;
  • up to date security patches; and
  • firewalls.

Data Security

In order to protect customer data you should set out:

  • how, where and when data will be backed up;
  • how often data will be backed up;
  • where backups will be stored; and
  • when discs/tapes will be rotated.

ISO 27001 Certification

ISO 27001 is an internationally recognised security certification which is often required by SaaS customers who are looking for assurance that adequate levels of data security are in place to protect their data. Having this certification demonstrates to customers your commitment to data security by confirming that you comply with “best practice” security management.

Disaster Recovery

Is this offered at all, consider whether is it included in your standard subscription fee, or if a premium will be charged. Also, remember that your disaster recovery centre should be physically remote from your hosting centre, and with a different provider.

Commercial Considerations

The level of security obligations offered to SaaS customers will depend upon:

  • how much a customer pays for the SaaS solution, maintenance and support;
  • whether the SaaS application is business critical i.e. online banking;
  • what is standard in that particular business area.

Exclusions

Ensure that your SaaS agreement contains appropriate security obligations applicable to your customer, for example using up to date virus programmes. Exclude liability for any security breaches which are caused by something beyond your control or an act, omission or breach of your customer’s security obligations under the SaaS agreement.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: