SaaS Agreement Red Flags Checklist Before You Subscribe

Finance already approved the fee. You are about to click Accept on a tool Sales wants live this week. Run a saas agreement red flags checklist on the whole packet — the exact file set that will be signed — before anyone books a kickoff. Score nine clauses keep, redline, or walk. Write the notice deadline the day you sign. Escalate every High flag — an item scored high severity. The order form is not the contract.

In August 2026 Jordan, ops at a 45-person UK company, inherits a 38-page MSA — a master services agreement, the frame vendors hang order forms on — a four-page order form, and a DPA — a data processing agreement — “to sign later.” Finance approved £18k. She finds 24-month auto-renewal, 90-day postal notice, then-current rates, and training on aggregated Customer Content. Renewal is 1 September 2027. Notice deadline: 3 June 2027. Nobody calendared it.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

Why does the order form fail as the contract?

The order form is the price sticker. The MSA is the deal. If the DPA is still “coming later,” do not subscribe. Freeze every file that will actually be signed, including each exhibit — an attached schedule or appendix — and any click-through URL. This is not an NDA — a non-disclosure agreement — hunt. It is a subscribe packet.

Typical mistake: nodding at the seat count and parking the other PDFs. In practice the order form silently incorporates the MSA and DPA. A first-pass — the first machine pass that extracts clauses before a human reads every page — can list the files. A human still opens each one. Do not accept “DPA after go-live.” If personal data will move, the ICO still wants a written processor contract with Article 28 terms first.

How do you catch auto-renewal and price-hike traps?

Search every file for auto-renew, successive terms, and then-current rates. Write term length, renewal length, notice days, and how notice must be sent. Calendar the notice deadline, not the invoice date. A 90-day postal window on a 24-month evergreen is a trap, not a standard.

Common Paper’s 2026 benchmark — 16,140 agreements to June 2026 — still finds auto-renewal in 87 percent of cloud service agreements, with a 30-day notice window as the modal standard in about 70 percent. For example, Jordan’s 90-day postal notice is already a redline. Ask for 30-day email notice, a one-year renewal, and a price freeze or 0–5 percent cap. Search then-current rates and minimum commitment for the seat ratchet. Do not trust a portal Cancel button if the MSA wants paper.

What to check on data, AI-training, and export?

Confirm you own Customer Data, the vendor licence is limited to providing the service, and you can export in CSV or JSON during the term and after exit. Then read the Machine Learning sentence. Aggregated and “improve the service” often authorise training unless the cover page kills it.

Only 14 percent of 2026 cloud agreements prohibit AI training. The hosted CSA 2.1 default still trains on aggregated Customer Content and deletes it within 60 days on request. That is a start, not your playbook — a one-page list of default positions. Counsel — a qualified lawyer, not the chatbot — should see any clause that stretches “improve the service” into training rights. Ask for no-training or opt-in, plus a 30–90 day export and a deletion certificate.

If the vendor sells into the EU, this is a switching problem, not a company-sale test. Regulation (EU) 2023/2854 has applied since 12 September 2025. Article 25 caps switching notice at two months and gives a 30-day porting window. Article 29 bans switching charges from 12 January 2027. Put those dates next to the export paragraph.

When to walk on a fees-paid liability cap?

A 1× fees-paid cap is the market default, not a gift. Score the cap base, the carve-outs, and whether SLA credits are the exclusive remedy. On a data-heavy tool, a breach sitting inside last-month’s fees is a walk. Do not treat credits as insurance.

The same 2026 benchmark caps 96 percent of agreements at 1× fees. When an SLA exists, credits are often the exclusive remedy. Leave the deep carve-out fight for a later MSA-cap read. Here, score whether confidentiality, security, and IP indemnity sit outside the number. Search we may modify. Do require notice plus an exit right on a material change. Do not accept “we will post an update to the URL.”

Nine-clause checklist by deal size

Do not run a 40-page read for an £8k seat pack. Under about £8–10k annual value, lock notice, renewal term, price, and export. Mid-size deals need all nine clauses in writing. At £40–50k or with regulated data, send clauses 6–9 to counsel. Workflow: freeze packet → search tripwires → score nine clauses → keep / redline / walk → calendar the notice deadline.

What to calendar the day you sign?

The renewal date is not the date that matters. Notice deadline equals renewal date minus notice days. Set 120, 90, 60, and 30-day alerts before that deadline the day you countersign. Store the address, the required form, and a draft non-renewal sentence. Name an owner.

Jordan’s 1 September 2027 renewal with 90-day notice is a 3 June 2027 deadline. Buyer checklists that survive 2026 put 120 / 90 / 60 / 30 alerts on the calendar the moment you sign. You are done when the packet is frozen, nine clauses have keep / redline / walk scores, the notice deadline and method sit on a calendar, and three High items have an owner — you or counsel.

If this is a cleaner or 3PL, not a subscribe pack, use the vendor contract red flags checklist.