Practice · SaaS contracts, MSAs and DPAs
The SaaS contract stack: MSAs, DPAs and the terms that close enterprise deals
A SaaS company's revenue depends on four documents: the terms of service its self-serve customers accept, the master services agreement its enterprise customers negotiate, the data processing agreement their privacy teams require, and the privacy policy that must agree with all three. Penwell Law drafts and negotiates that contract stack for SaaS and AI companies, with terms written to close enterprise deals. Companies without an in-house lawyer can also engage Penwell Law as fractional or outside general counsel.
The MSA and order form
Negotiation of an MSA centers on the same terms: limitation of liability and its carve-outs, indemnification for IP and data claims, service levels and credits, termination and data return, and audit and security commitments. Penwell Law keeps a negotiation position for each, knows which positions are market for a company of the client's size, and tells the founder which terms matter most for the deal. The order form carries the commercial terms so the MSA can stay in place for years. Recurring deals get a negotiation playbook with the fallback for each contested term and the approval required to go past it. When a large customer's procurement team sends its own MSA, DPA and security addendum, Penwell Law negotiates on that customer paper.
The DPA, the security addendum and the questionnaire
The data processing agreement is the document an enterprise customer's privacy team must approve before the deal signs. Under the CCPA and CPRA, a service provider contract must contain specific terms, and Article 28 of the GDPR specifies the processor clauses; a DPA that misses them is a compliance failure for the customer, which is why its privacy team will not sign without them. Penwell Law maintains a DPA that satisfies both regimes, with the standard contractual clauses and a transfer impact assessment ready for European customers, and a security addendum that matches the company's actual security practices. Penwell Law negotiates customer-driven security terms as legal commitments and writes the incident response plan around the notification duties in the contracts and California Civil Code section 1798.82.
Privacy by design, written into the contracts
Penwell Law reviews privacy at the design stage, including data mapping and DPIAs where the processing warrants one, and writes the result into the DPA and the customer terms. For AI products, those documents state whether customer data reaches training or inference, and how the company and its customers divide the duties under the California Privacy Protection Agency's automated decision-making rules, which apply from January 1, 2027.
Terms of service and privacy policy that match the product
Terms of service copied from another company describe that company's product. Penwell Law drafts terms from the product itself: what the service does, what the customer may do with it, what the company may do with customer data, including whether it trains on that data, and what the company disclaims. For AI products, the acceptable-use policy, the output terms and the model-provider pass-through terms belong to the same document set, and the privacy policy is written last so that it describes what the contracts already permit.
Common questions
Frequently asked questions
What should be in a SaaS master services agreement?
A SaaS master services agreement should cover scope and order-form structure, fees and payment, service levels, data protection and security commitments, intellectual property and license grants, confidentiality, warranties and disclaimers, indemnification, limitation of liability, term and termination, and data return. Negotiation turns on liability caps, indemnity scope and data terms.
What does a lawyer look for when reviewing a SaaS master services agreement?
Beyond the liability cap and the indemnities, a reviewer checks who controls the defense of an indemnified claim, whether the security commitments match the DPA, and who owns deliverables, feedback and improvements to the product.
When does a SaaS company need a data processing agreement?
A SaaS company needs a data processing agreement whenever it processes personal information on behalf of a customer covered by the CCPA or the GDPR. The CCPA and CPRA require specific service-provider contract terms, and Article 28 of the GDPR requires processor clauses whenever the customer's processing falls under the GDPR. Enterprise customers will not close without one.
Can a SaaS company train its AI on customer data?
A SaaS company can train AI on customer data only when its customer contracts clearly permit it and its privacy policy discloses it. Under the GDPR, a company that trains its own models on customer data also needs its own lawful basis as a controller. Penwell Law drafts the customer terms, the DPA and the privacy policy together, and counsels on the FTC exposure of training on data customers did not expect to be used.
Does Penwell Law review contracts the customer sends, or only draft the company's own?
Both. Most enterprise deals arrive on the customer's paper, and Penwell Law negotiates them.
Writing
Liam writes on the legal questions behind building and shipping technology: AI governance, privacy, and content rights. Read the blog →
Start the conversation
Based in Burlingame, California, working with clients and teams across Silicon Valley, the Bay Area, and nationally.
Inquiries