5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Review and negotiate SaaS contracts
Ready for sign-off, not just signed
The provider sends its standard contract and procurement wants to sign? We review the main agreement, SLA, security annex, DPA, pricing rules and exit together and prioritise the points you should negotiate.
Please enter a short description first.
The first contact is free of charge. If costs arise, we will tell you expressly in advance.
Response within 24 hours on working days
As of: 23 October 2026
Contract set2 of 5
- Scope of services and SLAPresent
- Liability capCheck
- DPA and subcontractorsPresent
- Data export and exitCheck
- Provider's consentProvider decidesMissing
Point of review: Can you get your data back out?
- 1Send contract setDocuments and use
- 2Define redlinesPrioritise risks
- 3DecideSign-off or negotiation
Schematic illustration. Simplified example.
We review contracts for
- CRM software
- HR software
- ERP systems
- AI tools
- Platforms
Key points at a glance
- A SaaS contract usually consists of the main agreement, order form, SLA, security annex, DPA and price sheet.
- ITMR reads these documents together and separates points critical for sign-off from negotiable improvements.
- You go into sign-off, negotiation, renewal or rollout with clear redlines.
- Whether the provider accepts changes is its own decision.
- Your contact is Jean Paul Bohne and his team. He is a specialist lawyer for IT law and for copyright and media law. Response on working days within 24 hours.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
- SLA
- Service level agreement. It sets out availability, response times and customer service.
- AVV
- Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
Starting position
When does the SaaS contract become critical?
When the tool is about to launch and it is still unclear internally whether the contract fits the use.
A SaaS contract is only robust if scope of services, SLA, prices, liability, data access, security and exit fit together.
The vendor package is on the table. Master subscription agreement, order form, SLA, security annex and DPA are to be signed off at short notice.
Rollout is imminent. Liability, availability, incident resolution, data access and exit have not yet been assessed internally.
The renewal no longer fits. New AI features, more users, price increases or group access are not reflected in the old contract.
An outage threatens to turn into a dispute. Outages or security incidents show that the SLA and escalation paths do not work in practice.
- For whom
- Procurement, legal, IT and SaaS providers
- Trigger
- Sign-off, rollout, renewal, deal
- Core
- SLA, liability, DPA, exit
- Consent
- by the provider
SaaS providers also come to us when enterprise customers do not accept their standard paper. Then the quality of the documents decides the time to signature.
If the focus is on the DPA, roles and transfers, having your DPA reviewed gets you there faster. With cloud migration and lock-in, data law also becomes relevant.
Send the contract set and intended use using the form. We will get back to you on working days within 24 hours.
Process
How do we review your SaaS contract?
From contract set to decision in three steps.
01
Send contract set The main agreement, order form, SLA, DPA, security documents and a short description of the intended use are enough.
02
Define redlines We separate points critical for sign-off, negotiable improvements and consciously accepted residual risks.
03
Decide You go into sign-off, negotiation or rollout with clear redlines and a realistic next step.
Four review questions before signing
- 1
Does the scope of services fit? Features, availability, usage limits, permitted use, sub-services and service channels must fit the actual product architecture.
- 2
Is the allocation of risk sustainable? We read liability caps, warranties, indemnities, security commitments, response times, credits and termination rights against the specific damage scenario.
- 3
Can you still act at exit? Export formats, deadlines, transition support, access to configurations, deletion and return must make switching possible in practice.
- 4
Are the documents consistent? In our reviews, order forms, SLAs, security annexes, terms of use, DPAs and price sheets often contradict each other. That is where extra costs and disputes arise.
How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.
Service
What does the review include?
Service package: SaaS contract review
Read the contract set Evaluate the main agreement, order form, SLA, price sheet, security annexes and DPA together.
Prioritise redlines Separate points critical for sign-off from improvements.
Conduct negotiations Negotiate a mark-up, side letter or additional annex with the provider.
Secure sign-off Document accepted residual risks for procurement, IT and management.
Sharpen existing contracts Adapt ongoing contracts on renewal, AI features or rollout.
- For whom
- SaaS customers and providers
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Technical security testing of the tool. IT service providers handle this separately.
Who delivers what and who decides
- Provider's contract set
- Intended use and user group
- List of subcontractors
- Internal requirements
- Joint review of all documents
- Redlines and priorities
- Negotiation with the provider
- Documentation of sign-off
- You decide on sign-off and residual risks
- The provider decides on changes
How does the engagement work?
- 1
First assessment You send the contract set using the form. We assess which scope fits. The first contact is free of charge.
- 2
Offer Before we start, we tell you the scope and costs transparently.
- 3
Court steps separately We agree court proceedings and representation separately.
Review focus
What do we review in the SaaS contract?
Four fields that make the difference in practice.
| Review field | Typical clauses | What we look out for |
|---|---|---|
| Scope of services and SLA | Scope of services, availability, maintenance windows, response times, credits | Duties to cooperate without hidden shifting of risk |
| Prices and term | Price adjustment, tiers, consumption models, renewal, notice windows | Product changes, discontinuations and order of precedence of documents |
| Liability and security | Liability caps, warranty rights, indemnities, audit rights, incident reporting | Relationship to outage, security and consequential damage |
| Rights and exit | Rights to content and configurations, APIs, data export, migration | Lock-in through proprietary formats and add-on services |
Misconceptions
Which assumptions are misleading?
Four statements we often hear before signing.
A standard paper can be typical for the market and still be too broad or too unclear for your use.
Data protection documents do not resolve questions on SLA, liability, security, product changes and exit.
Service credits do not compensate for business interruption, migration effort or reputational damage.
If you do not regulate exit before signing, you will negotiate it later from the weaker position.
Legal framework
Which rules apply to SaaS contracts?
The provider's standard contracts are general terms and conditions. Even between businesses, the review of content under § 307 BGB in conjunction with § 310(1) BGB applies.
If the provider processes personal data on your behalf, Art. 28 GDPR requires a data processing agreement. Transfers to third countries are governed by Art. 44 et seq. GDPR.
Since 12 September 2025, the Data Act has required providers of data processing services to regulate switching in the contract. The minimum content is set out in Art. 25 of Regulation (EU) 2023/2854.
- § 307 BGB Review of content.
- § 310 BGB Business-to-business transactions.
- Art. 28 DSGVO Data processing on behalf.
- Data Act (EU) 2023/2854 Switching between data processing services.
Limits
What does the review not cover?
Clear limits protect your planning.
- 1
No technical review IT service providers handle security testing of the tool separately.
- 2
No promise of outcome Whether the provider accepts changes is its own decision.
- 3
No full revision We prioritise the commercially relevant points.
- 4
The decision remains yours Which residual risks you accept is your decision.
What you can expect as a result
- A prioritised list of redlines.
- Clarity on liability, security and exit.
- A documented basis for internal sign-off.
Your contact
Lawyer and mediator · Partner · Specialist lawyer for IT law · Specialist lawyer for copyright and media law
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
TOP lawyer 2027 · Business lawyers · Intellectual property
F.A.Z.-Institut and QuantiQuest. Based on recommendations from peers and assessments by in-house counsel. Source (opens in a new tab)
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“Quick response from Mr J-P Bohne. In an initial consultation I received comprehensive advice on the problem. That enabled me to act on my own. Excellent!” (translated from German)
“Quick, helpful and honest communication. Clean and reliable work. Any time again. Many thanks” (translated from German)
“From the start a very open, reliable, friendly and above all uncomplicated contact. Takes time for detailed advice in language that non-specialists can understand. And you can tell that Mr Bohne is passionate about what he does ;-)” (translated from German)
FAQ
What do companies ask before signing?
Does every SaaS contract need to be negotiated individually?
No. In many cases it is enough to prioritise the points critical for sign-off. What matters are the commercially relevant risks, not the number of amended clauses.
Is it enough to review only the DPA?
In our mandates, the main agreement is usually where the real risk lies. Even a usable DPA does not resolve questions on SLA, liability, prices and exit.
When should the contract be reviewed?
Before sign-off, rollout or renewal. The earlier critical points become visible, the more room you keep in the negotiation.
What is particularly tricky with US providers?
Support access, subcontractors, security commitments, data transfers, audit rights and the actual operating structure of the service must be taken into account.
Can you sharpen existing SaaS contracts?
Yes. This concerns renewals, product extensions, AI features, group rollouts, price adjustments and outages that reveal weaknesses.
Which documents help with the assessment?
Main agreement, order form, SLA, price sheet, DPA, security annex, list of subcontractors, product description and a short description of the use.
Next step
Is your SaaS contract up for sign-off?
A clear negotiating line helps more than another template. We review the contract set and prioritise the risks for negotiation or sign-off.
Helpful for your enquiry
- Main agreement and order form
- SLA and price sheet
- DPA and security annex
- Short description of the use
The main agreement with a short description is enough to get started.
Have your contract set reviewed
For companies before sign-off, rollout, renewal or an enterprise deal.
Briefly describe the contract set and intended use.
Related services
Have your DPA reviewed DPA, roles and transfers.IT-Recht Fundamental questions on software and cloud.IT-Outsourcing-Vertrag Negotiating outsourcing.Review software licence agreements Review the scope of the licence.Implement the Data Act Data access and contracts.Service packages All packages.
From our blog: New Product Liability Act