Build a vendor contract negotiation playbook

Input

vendor_category: SaaS software vendors (subscription agreements)
contract_value: $10,000 to $500,000 annually
data_access: |
  These vendors typically access: employee data (names, emails, roles), business operations data, financial reporting data, and sometimes customer-related data (depending on the tool)
industry: B2B SaaS (HR technology)
company_stage: Growth-stage (150 employees, Series B)
priority_concerns: |
  - Data protection and AI training clauses (we're an HR data company; privacy is reputational)
  - Liability caps that are too low
  - Vendor lock-in (data portability and termination rights)
  - Auto-renewal surprises
non_negotiables: |
  - Vendors may NEVER use our data to train AI/ML models
  - No uncapped indemnification obligations on our part
  - We must always be able to exit with maximum 90 days' notice

Output

# SaaS Vendor Contract Negotiation Playbook

**For use by:** Procurement, Finance, Business Operations
**Legal contact for escalation:** [Legal team contact]
**Last updated:** 2025-03-15

---

## Playbook Overview

### Who Should Use This
This playbook is for Procurement, Finance, and business unit leads who are negotiating SaaS vendor agreements between $10K and $500K/year. You can negotiate within the "Acceptable" ranges below without legal review. Anything outside those ranges, or any "Red Flag" provision, requires legal escalation.

### Vendor Paper vs. Our Paper
- **Vendor paper:** Most SaaS vendors will send their standard agreement. Use this playbook to identify deviations from our positions and negotiate corrections.
- **Our paper:** For vendors where we have leverage (e.g., we're a large or strategic customer), request to use our standard vendor agreement instead. Ask legal for the current template.

### When to Escalate to Legal
Escalate immediately if:
- Contract value exceeds $250,000 annually
- Vendor will access customer-level data (not just employee/operational data)
- Any "Red Flag" provision appears (see section below)
- Vendor refuses to negotiate any of our must-have positions
- The contract includes a DPA (Data Processing Agreement) or BAA (Business Associate Agreement)

---

## Provision-by-Provision Positions

### Liability Cap

**Why it matters:** If the vendor causes a data breach, system failure, or other harm, the liability cap is the maximum we can recover. A low cap is effectively a free pass to be negligent.

**Ideal:** 12 months of fees paid; uncapped for breach of confidentiality and data breach
**Acceptable:** 6 months of fees; carve-out for breach of confidentiality and data security
**Walk-away:** Less than 3 months of fees, OR the cap applies to data breach, OR the cap applies to breach of confidentiality

**Negotiating language:**
> "Our standard position is a 12-month cap with carve-outs for data breach and confidentiality. A 3-month cap doesn't provide meaningful recourse if something goes wrong with our data — can we meet in the middle at 6 months and preserve the carve-outs?"

**Common pushback:** "Our cap applies to both parties equally — it's mutual."
**Our reply:** "Mutual caps are fine for general claims. But when vendor negligence causes a data breach, the harm flows entirely to us — a mutual cap means you bear no meaningful risk for your own security failures. The carve-out is about aligning incentives, not penalizing you unfairly."

---

### Data Use and AI Training

**Why it matters:** This is the most important provision for our business. We are an HR data company. Our data — and our customers' data that flows through our stack — cannot be used to train AI models. This is a regulatory risk, a reputational risk, and a competitive risk.

**Ideal:** "Vendor may use Customer Data only to provide the Service to Customer."
**Acceptable:** "Vendor may use Customer Data to provide and improve the Service for Customer, provided such improvements are not made by training shared AI/ML models using Customer Data."
**Walk-away (NON-NEGOTIABLE):** Any language permitting use of our data to train AI/ML models, even if described as "anonymized" or "aggregated"

**Negotiating language:**
> "We need explicit language that our data will not be used to train your AI or ML models. This is a compliance requirement for us given the nature of the data we handle. Can you add: 'Vendor shall not use Customer Data to train, test, or improve machine learning or artificial intelligence models'?"

**Common pushback:** "We only use aggregated, anonymized data — there's no privacy risk."
**Our reply:** "We understand, but our compliance obligations don't permit us to grant this right regardless of anonymization. This is a firm requirement on our end — can we add the explicit exclusion?"

**If vendor refuses:** Escalate to legal immediately. This is a walk-away provision.

---

### Auto-Renewal and Notice Periods

**Why it matters:** Missed renewal windows can lock us into another year of fees we didn't budget for.

**Ideal:** No auto-renewal; affirmative renewal required. If auto-renewal exists: 30-day notice period.
**Acceptable:** Auto-renewal with 60-day notice period
**Walk-away:** Auto-renewal with notice period exceeding 90 days for contracts under $100K; exceeding 60 days for contracts over $100K

**Negotiating language:**
> "We prefer a 30-day notice window for non-renewal — it's easier for our finance team to manage and reduces the risk of accidental renewals. Can we reduce this from 90 to 30 days?"

**Tip:** Set a calendar reminder for the non-renewal deadline immediately after signing. Add it to the vendor contract tracking spreadsheet.

---

### Termination Rights

**Why it matters:** Without termination for convenience, we can't exit a contract that isn't working without breaching it or proving cause — a high legal bar.

**Ideal:** Termination for convenience with 30 days' notice, no penalty
**Acceptable:** Termination for convenience with 60 days' notice; if multi-year, pro-rated refund of prepaid fees for unused period
**Walk-away:** No termination for convenience right. We must have a way to exit.

**Negotiating language:**
> "We need a termination for convenience right — we can't commit to a contract with no exit path. We're proposing 60 days' notice, which gives you time to plan. This is a standard right in enterprise agreements."

**Common pushback:** "We can't offer termination for convenience — we'd have to price everything month-to-month."
**Our reply:** "We're not asking to exit without consequences on a multi-year deal. For a 2-year agreement, you can tie the termination right to a reasonable wind-down fee equal to the remaining term's value discounted for savings on your costs."

---

### Indemnification

**Why it matters:** Indemnification clauses can require us to pay the vendor's legal costs and damages if a claim arises from our use of their service — even if we're not at fault.

**Ideal:** Mutual IP indemnification (each party indemnifies the other for IP infringement); vendor indemnifies us for data breach caused by vendor
**Acceptable:** Mutual IP indemnification; our indemnification limited to claims arising from our gross negligence or willful misconduct
**Walk-away:** We indemnify vendor for any and all claims arising from our use of the service (no carve-out for vendor's own fault); uncapped indemnification

**Negotiating language:**
> "The indemnification scope here is too broad — we'd be on the hook for claims even if they result from your platform's failure. Can we limit our indemnification to claims arising from our gross negligence or breach of this agreement, and add mutual IP infringement indemnification?"

---

### Price Increases

**Why it matters:** Uncontrolled price escalation makes long-term budget planning impossible.

**Ideal:** No price increases during initial term; any increases capped at CPI for renewals
**Acceptable:** Price increases capped at 5% annually; advance notice of 90 days before renewal pricing applies
**Walk-away:** Unlimited right to increase pricing at renewal with short notice; price increase mid-term without our consent

**Negotiating language:**
> "We need pricing predictability for budget planning. Can we agree to a 5% annual cap on price increases, with 90 days' notice before any renewal pricing change?"

---

### Data Portability and Return

**Why it matters:** If we need to switch vendors, we need our data back in a usable format.

**Ideal:** Data export in standard format (CSV, JSON) on demand; data deletion certification within 30 days of termination
**Acceptable:** Data export available in vendor format; deletion within 60 days; written certification
**Walk-away:** No data export right, or data only available in proprietary format with no export tool

---

### Security Requirements

**Why it matters:** Vendor security failures become our security failures.

**Ideal:** SOC 2 Type II compliance; annual penetration testing; 48-hour breach notification; audit rights
**Acceptable:** SOC 2 Type II or equivalent (ISO 27001); 72-hour breach notification
**Walk-away:** No security certifications; breach notification exceeding 7 days; no right to notification at all

**Always request:** Copy of current SOC 2 Type II report before signing. If they don't have one and will access business data, escalate to legal.

---

## Standard Requests to Make on Every Contract

Regardless of what the vendor's paper says, always request:
- [ ] Liability cap at minimum 6 months of fees with data breach carve-out
- [ ] Explicit prohibition on using our data to train AI/ML models
- [ ] Termination for convenience right (minimum 60 days' notice)
- [ ] Data export in standard format on request
- [ ] Data deletion certification within 60 days of termination
- [ ] Breach notification within 72 hours
- [ ] Copy of SOC 2 Type II or equivalent security certification

---

## Red Flags — Escalate to Legal Before Proceeding

Stop negotiating and escalate to legal immediately if you encounter:
- Any clause permitting use of our data for AI/ML model training (even "anonymized")
- Uncapped indemnification obligation on our part
- No termination right of any kind
- Vendor requires access to customer PII (not just our employee/operational data)
- Data residency requirements in countries with data transfer restrictions
- Exclusivity or non-compete provisions
- Automatic acceptance of modified terms (we "accept" new terms by continued use with no opt-out)
- Any reference to a DPA or BAA (these require legal review)