SaaS License Agreement | ROSCA & State ARL Ready

The title covers two transactions that American lawyers treat differently. A software license grants a copyright permission: the licensor keeps the code and gives the licensee a defined right to install, copy, and run it, usually perpetually, under 17 U.S.C. §106. Software as a service grants nothing of the kind. The customer never receives a copy, has no installation right, and buys access to an instance the vendor hosts and patches. Vernor v. Autodesk, 621 F.3d 1102 (9th Cir. 2010) remains the reference point for when a deal is a license rather than a sale.

Almost every vendor now sells a hybrid, which is why one document should cover both. A subscription to the hosted platform sits alongside a limited license to the desktop agent or API client installed locally. Keeping both grants in one instrument closes the gap that opens when a company writes a clean SaaS agreement and forgets that its onboarding connector runs on the customer's own server. A terms of service and privacy policy pair governs the anonymous visitor; the license agreement governs the paying account and the money. Do not let a click-through page carry an enterprise deal, because procurement will strike it and a court asked to enforce a liability cap wants a signed instrument.

No single federal statute governs software licensing in the United States. The agreement is a creature of state contract law, and the governing law clause decides which body of common law reads your clauses back to you. Article 2 of the Uniform Commercial Code applies to transactions in goods, and courts remain split on where software sits: a hosted service is almost always a service, an installed perpetual license often behaves like goods.

Formation is the first fight. Electronic signatures are valid under the E-SIGN Act, 15 U.S.C. §7001, but validity is not assent, and Berman v. Freedom Financial Network, 30 F.4th 849 (9th Cir. 2022) sets the test for conspicuous notice and unambiguous acceptance. Renewal is the second. ROSCA, 15 U.S.C. §8403 outlived the FTC's broader rule: the Eighth Circuit vacated the Negative Option Rule in its entirety in Custom Communications, Inc. v. FTC (8th Cir. 2025), and the Commission later restarted the rulemaking. State law never paused. California's statute at Cal. Bus. & Prof. Code §§17600 et seq., amended by Assembly Bill 2863, now reaches free-to-pay conversions and requires express affirmative consent plus same-medium cancellation; the California Legislature's text of Assembly Bill 2863 on automatic renewal offers gives the operative wording.

Data duties arrive from the privacy statutes. The CCPA requires service provider terms inside the contract under Cal. Civ. Code §1798.100(d), and the laws in Virginia, Colorado, Connecticut, and Texas impose parallel processor terms, which is why our privacy policy drafted to CCPA and CPRA standards sits beside the addendum here. Liability caps hold in most states, within limits set by UCC §2-719(3) and Cal. Civ. Code §1668.

The first trigger is the day money starts moving. A page saying the service is provided as is, and nothing more, leaves the vendor exposed on data loss and the customer exposed on renewal. The second is the enterprise deal, when procurement returns a redline demanding an uptime number and a cap tied to fees paid. A vendor without its own paper negotiates from the buyer's, which is how caps quietly become uncapped.

Resellers come third. A partner selling under its own brand needs a sublicense right that a standard customer agreement does not grant, plus flow-down obligations so the end user's data terms match yours. Perpetual on-premise licensing is fourth, still routine in banking and healthcare.

Two edge cases earn their place. If your build includes a component under a copyleft license such as the GPL, hosting is generally not distribution, which is the trap that catches vendors the day they ship an on-premise version. A sale to a school district or a federal agency pulls in FERPA or FedRAMP duties no commercial template covers alone. Flag those two deals before you countersign.

• The license grant comes in two layers, a right of access to the hosted service and a separate limited license to any client software installed locally. Scope limits name the permitted users, instances, and territory, and say whether affiliates are covered, the clause buyers add by hand when a template omits it.
• The term and renewal mechanics set the initial term, renewal period, non-renewal notice window, and a ceiling on renewal increases. Notice language works with N.Y. Gen. Oblig. Law §5-903 and the state automatic renewal statutes, and the template supplies the reminder a vendor has to send.
• The service level agreement commits to a monthly uptime percentage, excludes downtime for maintenance and force majeure, and makes service credits the sole remedy for a miss. Repeated failure across consecutive months converts into a termination right, the concession buyers push for when credits feel toothless.
• Data ownership and security confirm the customer keeps its content, give the vendor only the license needed to run the service, and fix breach notification timing. The addendum covers processor terms, subprocessors, and deletion.
• Intellectual property keeps the platform, its improvements, and aggregated de-identified usage data with the vendor, and takes a perpetual license to feedback so a suggestion cannot resurface as a claim.
• Warranties, disclaimers, and the liability cap pair a limited performance warranty with a conspicuous disclaimer of implied warranties, then cap direct damages by reference to fees paid over a trailing period. Carve-outs stay narrow, because a broad one hands the customer an uncapped claim.
• Indemnification puts IP infringement risk on the vendor, with the repair, replace, or refund remedy, and customer content risk on the customer.

Vendors who also sell implementation work run this agreement alongside a master services agreement for statements of work.

California shapes SaaS paper even for vendors headquartered elsewhere, because that is where the customers are. Its automatic renewal statute reaches free trials that convert to paid, and cancellation must use the same medium as signup. Cal. Civ. Code §1668 caps how far a disclaimer can go, since nothing survives fraud or willful injury, and the CCPA service provider terms are contract requirements rather than good practice.

New York matters most for the renewal clause. N.Y. Gen. Oblig. Law §5-903 applies to business customers, and Healthcare I.Q., LLC v. Chao, 118 A.D.3d 98 (1st Dep't 2014) applied it to a software and services arrangement, on the reasoning that personal property includes intellectual property. The notice window runs backward from the date the customer must give notice, not from the end of the term, so a sixty day requirement pushes the reminder far earlier than most billing calendars assume.

Texas treats SaaS as a data processing service, with twenty percent of the charge exempt under 34 Tex. Admin. Code §3.330, a rule the Comptroller amended recently to clarify bundling and multistate allocation. A vendor billing a Texas customer that uses the platform across several states can allocate the benefit received and shrink the taxable portion, provided its records support the split.

Delaware is where the entity usually sits, and the Court of Chancery's contractarian reading of commercial agreements makes it a common choice of law. It enforces clear caps as written between sophisticated parties, and 6 Del. C. §2708 lets the parties choose Delaware law with no separate connection to the state.

Florida exempts electronically delivered software from sales tax, which keeps billing simple. Its automatic renewal statute at Fla. Stat. §501.165 covers consumer contracts of a year or longer, while the Florida Digital Bill of Rights applies only above a high revenue threshold, so most early stage vendors sit outside it. The rest of our US business contract templates use the same state selector.

You start by picking the commercial model, subscription only, perpetual license only, or both, because that one answer rewrites the grant clause and the term structure. You identify the parties and the governing state, and the form loads the matching renewal notice language and the disclaimer formatting state courts expect. The service level questions follow: uptime target, maintenance window, and credit ladder, kept consistent with the termination trigger. Commercial terms come next, billing frequency, renewal length, notice period, and the renewal adjustment, expressed as a percentage rather than a fixed figure so the clause survives a repricing.

The security section asks whether you process personal information, health information, or card data, and attaches the matching addendum. Liability follows, where you choose the cap formula and the carve-outs, then dispute resolution, venue, and fee shifting. Delivery is an editable Word file plus a signature-ready PDF.

The most expensive error is a renewal clause with no notice process behind it. A vendor drafts a clean sixty day non-renewal requirement, never sends the statutory reminder, and learns at the worst moment that the renewal is unenforceable against a New York customer. A renewal clause is only ever as good as the notice you actually send. Close behind sits the cap that swallows itself: fees paid in the trailing twelve months, with a wide carve-out for any confidentiality breach, hands the customer an uncapped claim on the likeliest failure mode.

Three others recur. Vendors promise an uptime figure without defining the measurement window, so a two hour outage inside a maintenance slot becomes an argument about arithmetic. They bury the disclaimer of implied warranties in ordinary body text, which fails the conspicuousness requirement of UCC §2-316(2). And they lift an IP assignment clause out of an employment document: worker inventions belong in a confidentiality and invention assignment agreement, not in a customer license. One last one, quieter than the rest: free trials converting silently to paid now sit inside California's automatic renewal statute, where regulators look at the signup flow rather than the contract.