Software Licensing Made Simple

Indemnity vs Breach of Contract Claim in a SaaS Terms of Service?

Jeremy Aber — Sun, 15 Nov 2020 18:48:34 +0000

When negotiating a saas terms of service (representing the vendor of course), I am often trying to explain to my client the difference between an indemnity and a breach of contract claim. I have been noodling on this for years, trying to figure out a simple way of explaining probably the most complex contractual legal concept that exists (by the way, I am not sure I have nailed the explanation, but hopefully this is a good start when negotiating your saas terms of service).

So here goes (shortcut: it is all about the $). The key differences are as follows:

INDEMNITY:

(1) the VENDOR must spend $ to defend the CUSTOMER (or vendor will incur liability under the indemnity ($ to be paid in the future)), even before it is proven that the vendor is at fault, and

(2) the VENDOR has very few defenses to a claim.

Think about it this way: the vendor has to spend $ defending the customer from the claim and the customer does not have to spend any $ to make this happen. Now you know why customers want indemnities for everything. So the customer may act early to drag a vendor into a case without a lot of confidence of the vendor’s fault (i.e. weak evidence or proof of wrongful conduct).

BREACH OF CONTRACT:

(1) the CUSTOMER must spend $ to sue the VENDOR,

(2) the CUSTOMER has the burden of proof, and

(3) the VENDOR has several strong defenses to any claim.

Think about it this way: generally, customers will not sue vendors unless they believe they have a good case (aka high chance of winning) as the customer has to come out of pocket to prove the case (i.e. spend $). So the customer will act late (once they have the confidence they have a good case (i.e. strong evidence or proof of the wrongful conduct by the vendor)).

Which one would you want if you were the customer?

Here are some good resources:

Indemnification Clause Analysis

Contractual Indemnities

Indemnification Pitfalls

Disclaimer:

Indemnities are very complex and in an effort to communicate something important, I have left off a lot of important details (for example, third party vs first party indemnities, which party controls the defense and settlement of a claim, state law differences, etc etc).

This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after a review of all relevant facts and applicable law.

Comments

In reply to JD. great! Jeremy by Jeremy Aber
Thank you this was helpful by JD

Few Thoughts on Machine Learning Agreements or AI Agreements

Jeremy Aber — Wed, 15 Mar 2017 20:57:53 +0000

Machine learning agreements or AI agreements are super new, and actually very interesting. Not much has been written on these agreements, so I thought I would share a few thoughts on the big issues (from the perspective of the AI/machine learning software vendor).

So here goes.

HOW THE AI SYSTEM WORKS AND WHO DOES WHAT MATTERS.

Everything starts and ends with the answers to this question.
This will drive what warranties you provide, the IP ownership model and in general the rights and obligations of the parties.
Example: whose algorithm is being used? Is this a perpetual or term based deal?

WHO OWNS THE MACHINE LEARNING MODEL?

Usually customers own their input and output data from software programs, but it is not that simple with AI and machine learning agreements.
Machine learning models are generally viewed as the output from training a learning algorithm. The model will then be applied to the dataset. The model may contain parts of the underlying algorithm within the software, so I don’t think the ownership of the model matters, as much as who has what rights to the model and for how long.
One way to solve it is to allow the parties to use the machine learning model during the term of the agreement and then have the vendor destroy the model at the end of the agreement. This way, the vendor is free to independently recreate any future machine learning models, and the customer gets the protection from the vendor re-using the model for other customers.

WHAT ABOUT THE UNDERLYING SOFTWARE AND ALGORITHM.

This one is much easier.
The vendor brings the software to the party, and it should own any enhancements, modifications or changes to it (and its algorithms).
All AI and machine learning systems are on top of or embedded in a software program, so the industry standard licensing terms should apply to the underlying software.

So when you are working on drafting your AI or machine learning agreement, remember that it will not be as simple as a standard software licensing agreement. Dig in, and figure out the issues so that you and your customers know what they can and cannot do with your software and the output.

Resources:

Here is an article from the other side, which I think is too simplistic as to who should own what. Link

Disclaimer: This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after review of all relevant facts and applicable law.

VSA. Why this is Great for SaaS Companies!

Jeremy Aber — Sun, 18 Sep 2016 22:03:04 +0000

The VSA is a super new group called the Vendor Security Alliance. As soon as I read this article about it Link, I realized it was a great idea for all Software as a Service (SaaS companies) and will help get cloud service contracts signed. And hey, as attorneys that help SaaS companies get SaaS contracts signed, we were very excited. So here is our thinking:

What is the VSA?
- Here is their quote: “In collaboration with the VSA, top security experts and experienced compliance officers will release a yearly questionnaire to benchmark their risk. Companies can leverage this questionnaire to qualify vendors and ensure the appropriate controls are in place to improve security for everyone.”
- The questionnaire is only stage 1, as it appears that they plan to come up with a VSA certified score. This scoring system could really help SaaS companies communicate their security practices.

Security issues are the #1 due diligence item we see in SaaS deals.
- Security due dilligence is really slowing deals up, and the level of detail required to close a deal keeps increasing. In fact, info sec managers and directors at customers are on more and more conference calls during the contracting process and asking lots of questions.
- It is not a bad thing, in fact it is a good thing, but we have to find a technological way to speed this process up. Hello VSA!

The VSA process (if it works and is executed well), could provide an efficient and effective way for SaaS vendors to explain their security practices.
- In essence, if the VSA develops an accepted rating system, potential customers can use this rating system as the main part of their info sec due diligence, and more quickly figure who to work with and (more importantly) who to skip over.
- It is really hard, if not impossible, to tell anything about info sec from the outside, so customers have to get under the covers quickly and reliably.
- The whole goal here is to create a trusted framework.

If your project the role of the VSA out long term, SaaS services could one day (maybe) talk to each other and electronically communicate their VSA ratings and security practices.
- This can help every SaaS company, as nearly all of them are relying on third party integrated web based services for more and more of their offerings, as they move from point offerings to solutions.
- I am not making this up, as it is exactly what the Cloud Security Alliance is predicting regarding security practices in the future. https://cloudsecurityalliance.org

If you are a SaaS company, you should keep up with the VSA as they are just getting started. If they do it right, they may help you close your next cloud services contract with an enterprise customer.

Resources.

See this ‘related’ WSJ article re closing enterprise SaaS deals. https://goo.gl/kN4cvW

Comments

In reply to Jascha Preuss. I will send you a reply via email by Jeremy Aber
Thanks for the interesting article. How do the VSA standards ... by Jascha Preuss

3 Nuggets Every SaaS Company Needs to Remember

Jeremy Aber — Mon, 08 Aug 2016 17:36:29 +0000

We represent lots, literally 100s and 100s, of SaaS companies and there are a few nuggets of useful information that we want to share with other SaaS companies when they think about negotiating an enterprise SaaS agreement. Ok, here goes.

Setting the Right Expectations. I find that setting the right expectation of what the customer is buying is the #1 issue in any SaaS enterprise agreement negotiation. Enterprise customers notoriously want things their way or customized for them (and if you ever read their form agreements you will see what I mean), but in the SaaS world it does not work that way (i.e. everyone gets the same thing for a very low price). So make sure as part of your marketing and selling process you set the right expectations that your customer is getting what everyone else is getting.

Price and Terms Are Linked. This is a high level issue, but is super important. Think of it this way: when you give an enterprise customer a price quote, it is based on (a) your pricing model and (b) your standard SaaS agreement terms. If you fail to explain this or educate them about this, then you may find that your enterprise customer may get the wrong impression and assume that you can give them whatever they want for that price. The only way to combat this is to tell them that if they want to change the ‘terms of the deal’ then the price will change too. So, in your quotes, consider adding language at the bottom along the lines of:

“This quote is based on [Your Company] standard terms and auto renewal of orders. Any material changes to these terms or not allowing orders to auto renew will result in an increase in [monthly/quarterly/annual] subscription fees.”

FAQs, Visual Charts, Etc. There are several other ways to communicate your model and set the right expectation. For example, you can create a really good FAQ that explains what your service does and (equally as important) what it does not do. I even have a blog post about this: FAQs as Part of SaaS Negotiations. Alternatively, don’t underestimate the power of a really good visualization or chart, as that is one of the quickest ways to explain what you do.

Here is a good example of pricing visualizations or charts: Link

So remember these three tips before you start any enterprise SaaS agreement negotiations. You can either learn the hard way, or benefit from our knowledge doing lots of SaaS enterprise deals that there are some tricks and tips to help shorten the sales cycle.

Resources:

Blog Post regarding Price and Terms are Linked.

Comments

In reply to Patrick McNichol. thanks. I fixed the link. Jeremy by Jeremy Aber
FYI the link to the visualization chart is not functioning at ... by Patrick McNichol

Why You Need a Disclaimer In Your SaaS Agreement?

Jeremy Aber — Wed, 04 Nov 2015 19:55:55 +0000

I have always thought that disclaimers were good things to add to SaaS agreements, but this very recent case demonstrates that they really can make a difference in a legal dispute.

By the way, a disclaimer is a statement regarding things you are not liable for.

Example, if you provide a medical software service, it is a good idea to state that you are not providing medical advice, and that the doctors are solely responsible for providing medical advice. You get the picture.

So in this case, a building material company was certifying contractors as Master Craftsman regarding their products. The good news is if a customer wanted to search for a Master Craftsman on the building company’s site they had to agree to the building company’s Terms of Service which stated that:

“Although we take certain steps to examine the credentials of our listed service professionals, CertainTeed makes no guarantees or representations regarding the skills or representations of such service professional or the quality of the job that he or she may perform for you if you elect to retain their services. CertainTeed does not endorse or recommend the services of any particular service professional.”

So despite that warning, a customer sued (yep, can you believe it) the building company for fraud (and some other things). The good news is the court got it right, and threw the case out (aka dismissed the case early) as there was no misrepresentation (= no fraud).

So the takeaways for every SaaS company is to think about things or decisions that you think your customer should own and be responsible for (i.e. should not expect from your service). Then add those to a disclaimer on your website or in your SaaS agreement to make it clear that it is their responsibility.

Long story short, this is a great example of why disclaimers matter and why you should seriously consider adding them to your SaaS agreement. PS you can read my disclaimer below!

Resources:

Solum vs Certainteed Corporation

Wikipedia on Disclaimers

SaaS Agreements Are NOT Good Communication Vehicles

Jeremy Aber — Wed, 07 Oct 2015 14:13:41 +0000

Let met explain. Some SaaS companies add all kinds of things into their SaaS agreements, and when you are finished reading the agreement you understand everything possible about their offering. While this kind of makes sense at first blush, when you unpack this a little and deal with these types of agreements on a regular basis (which I do), you will soon see that this is not that efficient or effective.

The core problem here is that SaaS is not static and it morphs and changes more often than on-premise software. As many of you know most SaaS companies employ the Agile methodology or manifesto, which is all about rapid release cycles. This means that the customer has no choice but to accept the changes to the underlying software (in fact, this is one of the main benefits to SaaS). Q: So how should SaaS agreements accommodate this difference? A: Well often they don’t and that is the problem. So the trick is to find the right balance of what terms need and must be in the SaaS agreement, and what issues can be better addressed in an online FAQ or online policy.

There are core legal concepts that must be addressed in the agreement (limitations of liability, warranties, disclaimers, etc), but if you think about it there are other concepts that are more descriptive of how the thing works. These type of issues are great candidates for an FAQ. I even wrote a blog post about it.

Here are some example of what are better addressed outside the SaaS agreement.

How to setup an account or administer user accounts.
How to upload or export data or content to the SaaS service.
The details regarding support contacts, support process, severity level, etc.
Service Level Availability information.

I think the trick here is for the SaaS company to engage and collaborate with their SaaS attorney to figure out which issues are best addressed outside the agreement and which are better addressed within the agreement. So give it a try, and I think you will see great results!!

Resources:

SaaS vs On Premises Deployments.

One Thing a Software Developer Should Never Do.

Jeremy Aber — Tue, 08 Sep 2015 15:53:12 +0000

Software developers are really smart (I know, as I work with lots of them on their software development agreements, etc.), but there is one blind spot that I see way too often: they trust their customers too much, and then they take things into their own hands when they don’t get paid. Hey, getting frustrated (even angry) is only natural when someone does not pay what they owe, but not handling it the right way is not. So don’t shut down a customer’s site (software, product, etc.) for a billing dispute, unless you have the legal right to do that.

So here is the hypothetical.

A customer hires a software developer to build a website, and then the customer does not pay on time and the software developer ‘remotely’ shuts down the site (so that the customer will be forced to pay). The customer then sustains a financial loss (e.g. lost business).
Under the law, terminating access or repossessing something is a called a ‘self help remedy,’ and is an area of the law you want to be very careful with.
It is similar to when you do not pay your car note, and then the bank repossesses your car.
- However, in this car example, there are rules as the bank cannot ‘break the peace’ (i.e. they can get the car if it is on the street, but not if it is in a locked garage).

Q&A

Q: What is the right way to handle it?

A: Avoid it.

Q: How do I avoid it?

A: Get more $ upfront and along the way.

Q: Well I don’t want to do that because I trust the customer and I am a nice guy.

A: Don’t blindly trust the customer and learn how to negotiate.

Q: Well I did not do that, and now I need to get paid. I did the work.

A: Negotiate with the customer, but don’t take down their site unless you have the legal right to do that.

Q: Why, what can happen if I take it down without legal authority.?

A: A violation of the Computer Fraud and Abuse Act, which is a civil and criminal statute.

Q: Yea, Right.

A: Look at this very recent case from Sept 2015 re the CFAA and the developer taking down the site. http://bit.ly/1KZ3uvv

So long story short, be very careful with these kinds of issues and don’t take matters into your own hands unless you have the legal right to do it. It goes without saying that talking to an attorney is a good idea in these situations, but I think you already knew that. I hope this helps, as you know that violating a criminal statute is not a good thing, especially for nice and really smart guys.

Disclaimer:

This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after review of all relevant facts and applicable law.

Comments

good site thanks for sharing by Praxent
In reply to Nick Weynand. I will email you re this. Thanks, ... by Jeremy Aber
Great article here. We have a clause that we can shut down ... by Nick Weynand

A Few Things You Should Know About the NAI – SaaS Privacy

Jeremy Aber — Wed, 26 Aug 2015 18:01:00 +0000

The Network Advertising Initiative (NAI) has some very useful info in their 2015 Code of Conduct, that you should be aware of regarding SaaS privacy if you are in the online third party ad business. The NAI is a self regulatory governing body of third parties in the online advertising ecosystem. This group may be useful group not only for ad networks, but for anyone dealing in third party ads (for example, platforms, aggregators, yield optimization firms, etc).

The most interesting issue to me after reading their Code of Conduct is in their definitions.

See below.

Personally Identifiable Information (PII) means data used to identify an individual.
Non–PII data that is not linkable to an individual, but is linkable to a device.
De-Identified Data is data that is not linkable to an individual or device.

So what I found fascinating is that these definitions do not only focus only on identifying a person (which is how the world use to work), but now it is all about identifying a computer or device, or person. So before we all thought that if you don’t or can’t identify a person with your information then it was not a big deal, but now you have to be more careful if you are tracking or identifying a computer or device, especially across platforms. What is even more interesting, is that I am also hearing that the Federal Trade Commission (aka FTC) is very interested tracking devices and computers, as they are concerned about what are called ‘persistent identifiers.’ See this page.Examples

Sensitive Data is PII (examples, SS#, insurance plan #, fin acct #, medical conditions, sexual orientation).
Precise Location Data location data using a GPS.

So the takeaway here for every third party ad network company is to read this Code of Conduct, as SaaS privacy it is not simply about disclosure, choice, etc, but it is now very about tracking devices and computer.

Resources

General Info re the 2015 Code of Conduct.

Copyright Issues: SaaS Software.

Jeremy Aber — Wed, 08 Jul 2015 18:59:14 +0000

While there are several ways to legally protect your SaaS software, copyright law is the most popular and maybe the easiest way to protect it. Every SaaS executive needs to know a few things about SaaS software and copyright law, so take a quick read of the following.

Can you obtain copyright protection for your GUI?

This is an important issue, and one that many vendors do not understand. As a general matter, obtaining copyright protection for source code is easy, but obtaining protection for GUIs is not that simple. Here is a great blog post on the ins and out of it.

What is the difference between Contract and Copyright Protection for Software?

Contracts and Copyright are two totally different ways to legally protect your software. This post contains an explanation of the difference, and why you should use both methods to protect your software.

What is Fair Use?

Fair use is a very important defense to copyright infringement (to prove that you are not infringing on someone’s copyright), and is a concept that is rarely understood. It in essence is a 4 part balancing of interests test. Keep in mind though that it can be subjective, so relying on it is not always the best way to go. http://bit.ly/1HfQj5I

Protecting your software really matters, as (sadly) I am starting to see a lot of copycat software programs out there. Remember that if you don’t take steps to protect your software today, it may leave your software product vulnerable to competitors using your software to create lookalikes and steal your customers. Yep, this is serious stuff!

Disclaimer:

The 2015 Update on SaaS Trust Sites

Jeremy Aber — Tue, 09 Jun 2015 15:07:02 +0000

Building trust as a concept

A while back I wrote a blog post about Trust Sites, and why, if you are a SaaS company, you should have one (outside of your SaaS agreement). Well, since them a lot has happened so I wanted to provide you with an update.

What is New

1). Salesforce.com has updated their Trust Site.

– Take a look at their new site. https://trust.salesforce.com/

– They have taken it to a new level with a cleaner and simpler layout, with Trust, Status, Performance, Security and Learn links.

– This is the new gold standard.

2). There are lots of third party services that can setup a trust site for your SaaS application (for a very reasonable monthly fee).

– One of my clients told me about this company, and I really like it. https://www.statuspage.io/ For around $99 a month you can create your own simple trust site using their service.

– There are lots more, so take a look at these too: http://www.statuscast.com/ and https://status.io/. I am sure there are more too.

So Remember This.

– When you are selling SaaS, you are selling trust! In the old days, what closed the deal was whether or not the customer liked your salesperson (at least that is what salespeople tell me), but in this new world of remote selling (over the wires) it is all about trust.

– Design your own trust site, based on what your customer needs and wants to know about your company to trust you!

– Maybe it is information about availability or information about security practices or disaster recovery policies.

– Either way communicate and educate them about these key issues.

– Also, remember that these sites are external to your SaaS agreement, which I suggest is a good thing.

In the SaaS world, a customer is unlikely to buy you service if they don’t trust you! Carve that in virtual stone.

Software Licensing Made Simple

Indemnity vs Breach of Contract Claim in a SaaS Terms of Service?

Comments

Related Stories

Few Thoughts on Machine Learning Agreements or AI Agreements

Related Stories

VSA. Why this is Great for SaaS Companies!

Comments

Related Stories

3 Nuggets Every SaaS Company Needs to Remember

Resources:

Comments

Related Stories

Why You Need a Disclaimer In Your SaaS Agreement?

Related Stories

SaaS Agreements Are NOT Good Communication Vehicles

Related Stories

One Thing a Software Developer Should Never Do.

Disclaimer:

Comments

Related Stories

A Few Things You Should Know About the NAI – SaaS Privacy

Resources

Related Stories

Copyright Issues: SaaS Software.

Can you obtain copyright protection for your GUI?

What is the difference between Contract and Copyright Protection for Software?

What is Fair Use?

Disclaimer:

Related Stories

The 2015 Update on SaaS Trust Sites

What is New

1). Salesforce.com has updated their Trust Site.

2). There are lots of third party services that can setup a trust site for your SaaS application (for a very reasonable monthly fee).

So Remember This.

Related Stories