SaaS Agreements for Growing Companies: License Scope, SLAs, Data Terms, Renewals, and Texas Sales Tax
Updated: 11 hours ago
Circular 230 / general information notice. This article is general information only. It is not tax, legal, or accounting advice. Reading it does not create an attorney-client relationship. Tax results depend on your facts and on law that can change. Consult your own attorney and CPA before taking any action. This article was not written to be used, and cannot be used, to avoid tax penalties.
A SaaS agreement looks routine until the company depends on the software to run payroll, ship orders, or close the books. Then the questions become concrete: who is allowed to log in, what happens when the service is down for a day, where the data lives and how you get it back, and why the invoice went up 12 percent at renewal. I review these contracts from both sides, for companies buying software and for companies selling it, and the same handful of provisions decides most disputes. This article goes through them in order, then covers the Texas sales tax rules that apply to SaaS, which are different from most other states.
SaaS agreement license scope: what you are actually buying
In a true SaaS model, the customer usually does not receive a copy of the software. It receives a right to access and use a hosted service during the subscription term. That difference matters for the definitions.
Read these terms closely:
Authorized users. Named users, concurrent users, or an enterprise-wide right. Named-user licenses get expensive when seasonal staff or contractors need access.
Affiliates and contractors. If your parent company, subsidiaries, or an outsourced bookkeeper will use the service, the license must say so. Many vendor forms limit use to the signing entity's employees.
Usage metrics. Seats, transactions, storage, API calls, or revenue bands. Ask how overages are measured and billed, and whether you get notice before overage charges begin.
Restrictions. Bans on reverse engineering, benchmarking, and competitive use are standard. A ban on "use for the benefit of third parties" can be a problem if you serve your own customers through the platform.
Customer data and outputs. The customer should own its data and the outputs it generates. Watch for broad licenses that let the vendor use customer data to train models or build products. A license limited to providing and improving the service, with use of aggregated data only if it is de-identified and cannot be traced to you, is a common compromise.
For on-premises or self-hosted software, the license grant is a true copyright license, and you also need to address installation copies, backups, disaster recovery environments, and source code escrow if the vendor is small.
Service levels: turn the uptime number into money
An SLA promise of 99.9 percent monthly availability allows about 43 minutes of downtime in a 30-day month (43,200 minutes times 0.1 percent). At 99.5 percent, it is 216 minutes, more than three and a half hours. The headline number matters less than the definitions underneath it:
How availability is measured. By the vendor's monitoring, from which locations, and at what interval.
Exclusions. Scheduled maintenance, emergency maintenance, customer-caused issues, and third-party hosting outages. If maintenance can happen during your business hours without limit, the uptime promise is thin.
Credits. A typical schedule gives a percentage of the monthly fee for each tier of missed availability, often capped at a portion of that month's fee. Credits are usually stated as the sole remedy for SLA failures.
Chronic failure. This is the provision I push for most. If the vendor misses the SLA in, for example, three months out of any six, the customer may terminate without penalty and receive a refund of prepaid fees. Without it, a customer can be stuck in a multi-year term with a service that keeps failing, collecting small credits.
Support response times. Severity levels, response times, and resolution targets, with a named escalation path.
Data, security, and the exit
Security terms should describe what the vendor actually does. Common pieces include an independent audit report such as a SOC 2 Type II, encryption in transit and at rest, a list of subprocessors with notice of changes, data location commitments where they matter, and a data processing addendum for personal information.
Breach notice deserves its own attention in Texas. Under Section 521.053 of the Texas Business and Commerce Code, a business that owns or licenses computerized sensitive personal information must notify affected individuals without unreasonable delay and no later than 60 days after determining that a breach occurred, and must notify the Texas Attorney General no later than 30 days after that determination if the breach involves at least 250 Texas residents. The statute also requires a business that maintains data it does not own to notify the owner immediately after discovering a breach. Your SaaS contract should require the vendor's notice quickly enough for you to meet your own deadlines, ideally within a stated number of hours, with cooperation obligations and a clear allocation of notification costs.
The exit is where customers lose leverage. Before signing, get answers in the contract to these questions: in what format will you receive your data, how long after termination, at what cost, and when will the vendor delete it and certify deletion. A 30-day post-termination retrieval window, in a standard machine-readable format, at no extra charge, is a reasonable starting request.
For liability caps, super-caps for data breaches, and indemnity drafting, see our article on Texas indemnity and limitation-of-liability clauses. For IP ownership of anything the vendor customizes for you, see owning your IP.
Auto-renewals and price increases
Most SaaS contracts renew automatically for another term unless a party gives notice of non-renewal, often 30 to 90 days before the end of the term. Miss the window and you are committed for another year, sometimes at a higher price.
What I negotiate on the customer side:
A non-renewal window of no more than 30 to 60 days, and a vendor obligation to send a renewal reminder.
A cap on renewal price increases, such as a fixed percentage or a CPI measure.
Renewal terms of one year rather than a repeat of a three-year initial term.
A right to reduce seats at renewal.
On the vendor side, the goal is enforceable renewal terms, which means clear disclosure in the order form and a record of acceptance. Several states have automatic renewal statutes, and most focus on consumer contracts. The FTC's 2024 amendments to its Negative Option Rule, often called the "click to cancel" rule, were vacated by the Eighth Circuit in July 2025, but existing consumer protection law still applies to consumer subscriptions. Business-to-business vendors should still make renewal terms conspicuous, because a renewal clause buried in linked terms invites a dispute.
Texas sales tax on SaaS
Texas taxes SaaS differently from most states. The Texas Comptroller generally treats access to remotely hosted software as a taxable data processing service under Section 151.0035 of the Texas Tax Code and Comptroller Rule 3.330. Section 151.351 exempts 20 percent of the value of data processing services, so tax applies to 80 percent of the charge. Software delivered as a license to a copy, such as installed or downloaded software, is generally taxed on 100 percent of the price under Rule 3.308. The state rate is 6.25 percent, and local taxes can add up to 2 percent, for a combined maximum of 8.25 percent.
A worked example. A Dallas company pays $120,000 a year for a SaaS platform used only in Texas, at a combined 8.25 percent rate. The taxable amount is 80 percent of $120,000, or $96,000, and the tax is $7,920. If the same software were licensed as an on-premises copy for $120,000, the tax would be $9,900.
Multistate use changes the math. Rule 3.330 allows tax to be based on where the service is used. If the customer uses the service at locations inside and outside Texas, it can give the vendor a multistate use certificate and allocate the charge using a reasonable, consistent method supported by its records, such as users or locations, and then accrue Texas tax on the Texas portion. If 40 percent of the users of that $120,000 platform are in Texas, the Texas taxable amount is $120,000 times 40 percent times 80 percent, or $38,400, and the tax at 8.25 percent is $3,168. Customers that overpaid in past years may be able to seek a refund, generally within four years.
Contract points that follow from this:
Who collects. Vendors with Texas nexus, including remote sellers over the Comptroller's $500,000 Texas revenue threshold, generally must collect. If the vendor does not collect, the Texas customer generally owes use tax.
The tax clause. Specify that the customer pays applicable sales and use taxes, that the vendor will honor exemption and multistate use certificates, and how assessments for prior periods will be handled.
Bundled charges. Implementation, training, and consulting can have different tax treatment from the subscription. Ask the vendor how it invoices them and what tax position it takes, in writing.
Mixed products. If the contract combines SaaS, downloaded software, and hardware, the allocation among them affects the tax. A single bundled price with no allocation can cost money.
The rules are fact-specific. Your CPA should confirm the treatment of your particular service before you rely on an allocation.
For a full commercial contract review list, our contract review checklist for MSAs covers the terms that sit alongside a SaaS order form.
A pre-signature sequence
Map who will use the service and confirm the license covers them, including affiliates and contractors.
Translate the SLA into minutes and dollars, and add a chronic failure exit.
Confirm data ownership, training restrictions, breach notice timing, and the exit process.
Calendar the non-renewal window the day you sign.
Confirm the Texas sales tax treatment and any multistate allocation with your CPA.
If you are about to sign, or about to send your own form to customers, email info@robertsandwillie.com or call (469) 910-4017. Sending a message does not create an attorney-client relationship.
Disclaimer. This article is for general information only and is not tax, legal, or accounting advice. It does not create an attorney-client relationship. Tax law changes and depends on your specific facts. Do not act on this article without consulting your own attorney and CPA. This article is not intended or written to be used, and cannot be used, by any taxpayer for the purpose of avoiding penalties that may be imposed under the Internal Revenue Code or other applicable law. Attorney Advertising. Roberts & Willie, PLLC, Dallas, Texas; Trenton Roberts, responsible attorney.
Comments