SaaS customer agreements: liability caps, indemnities, SLAs and renewals

Limitation of liability and indemnities

Most SaaS agreements cap each party's liability, often by reference to fees paid over a period, and exclude indirect or consequential damages. Customers will ask for carve-outs, such as breach of confidentiality, data protection obligations or the vendor's IP indemnity. California Civil Code section 1668 declares contracts against public policy when their object is to exempt a party from responsibility for its own fraud, willful injury or violation of law, so do not expect a cap to protect against those.

The IP indemnity is usually the vendor's promise to defend the customer if the service infringes someone else's rights, with remedies such as modifying the service or terminating and refunding. Check what the indemnity excludes, such as customer modifications or combinations, who controls the defense, and whether indemnity payments sit inside or outside the liability cap.

Service levels and data

An SLA should define uptime, how it is measured, what is excluded such as scheduled maintenance, and the remedy. Many vendors make service credits the sole remedy for missed targets, with a termination right after repeated failures. Make sure the SLA matches what your hosting providers actually commit to you.

If the customer's data includes personal information about California residents, a customer subject to the CCPA must have a contract with its service providers that includes terms required by Civil Code section 1798.100(d), such as limited and specified purposes and an obligation to notify the business if the provider can no longer meet its obligations. Expect a data processing addendum in enterprise deals.

Auto-renewal and California consumers

California's Automatic Renewal Law, Business and Professions Code sections 17600 and following, protects consumers, defined as individuals who acquire goods or services for personal, family or household purposes. B2B contracts with companies are generally outside that definition, but self-serve plans bought by individuals may be inside it. Covered offers must present renewal terms clearly and conspicuously, obtain affirmative consent, provide an acknowledgment and allow cancellation online if the consumer signed up online.

Example: A startup sells an enterprise plan under a negotiated order form and a monthly self-serve plan by card to freelancers. The enterprise renewal is a contract matter between businesses. The self-serve plan needs a compliant checkout, an acknowledgment and an online cancellation path. Amendments made by AB 2863 took effect January 1, 2025, and some apply to contracts entered into, amended or extended on or after July 1, 2025.

Your next steps

1. Set the liability cap and carve-outs deliberately and check them against Civil Code 1668.
2. Align the SLA with your own suppliers and prepare a data processing addendum.
3. Review consumer checkout and cancellation flows under the Automatic Renewal Law.