Video Lesson: How Customers Can Protect Themselves From Service Problems With SaaS Platforms

I’m celebrating the upcoming ContractsCon 2026 by sharing some of my favorite past sessions. This recording is from ContractsCon 2025 features Kay Lee, VP, Legal at Curology, walking through the SaaS contract provisions that matter most to customers when the product stops working.

What I love is the detailed nature of the insights she shares. She reads the vendor's template language, states her redlines and her reasons, shows the vendor's response, and explains why she accepts each one or pushes back.

All the ContractsCon speakers wear the costume of the character featured in their deck. Kay is Dr. Jekyll and Ms. Hyde in this one.

Click to watch the session if the player does not appear.

The story arises from a contract related to the Zen Brush, a brush that distributes soothing essential oil on the face. Dr. Jekyll and Ms. Hyde sell it through their website. They are negotiating a master services agreement with Peace Platform, the provider that hosts the site. Her site must work for her to reach her customers, so she brings three concerns to the negotiation: system uptime, remedies when the system goes down, and the provider's plan for a disastrous event.

The template promises 95 percent availability each calendar month, using commercially reasonable efforts, and only if the customer complies with the agreement. Kay Lee points out that 95 percent permits a little more than 18 days of downtime a year. She strikes the customer compliance condition, because whether she complies with the agreement has no place in the service level. She strikes the commercially reasonable efforts qualifier. She asks for 99.999 percent, explains that five nines equals about five minutes a year and four nines about 52 minutes, and says her real target is three nines. The provider returns 99.9 percent with the qualifier reinserted, and she accepts.

She then works through the exceptions to the availability calculation. She deletes the nonconforming acts language as duplicative of the customer failure exception. The provider keeps scheduled downtime as an exception, and she accepts that, because planned maintenance supports the system stability she just negotiated.

The template allows the provider to schedule downtime on 48 hours notice, using commercially reasonable efforts. Kay Lee asks for a maintenance window between 1 a.m. and 6 a.m. Eastern, when her customers are asleep, and for 30 days notice. The provider widens the window, keeps the qualifier, and offers 7 days. She accepts and explains her measuring stick: 7 to 14 days is quite common for cloud and software as a service, 48 to 72 hours is a really short notice, and 30 days or more is usually reserved for significant maintenance. She also names the factors that move the number, including the nature of the service, site traffic, and whether the customer base is enterprise or international.

The template conditions every service credit on two things. The customer must report the failure immediately upon becoming aware of it, and must request the credit in writing within 48 hours. Kay Lee replaces "immediately upon becoming aware" with "without undue delay" so that she can investigate first and take care of her own customers during an outage. She strikes the 48 hour request deadline. The provider returns 24 hours to report and 10 days to request, and she accepts.

She also removes the 5 percent cap on service level credits, on the position that she should not pay for a service that was not provided. The provider accepts the deletion. She adds a termination right for repeated service failures, and the provider accepts a version of it with more failures over a longer measuring period. She closes the point with a drafting reminder: add the new termination trigger to the termination for cause clause.

Two provisions in the template point to documents on the provider's website. The support schedule is posted online and the provider may amend it in its sole discretion. The data breach plan belongs to the website privacy policy. Kay Lee asks for both as attachments, so that she can negotiate the terms, keep the obligations in one document, and remove the unilateral amendment right. She also states the provider's side of that argument, which is standardization across customers and the ability to update without renegotiating.

On the data provision, she asks to change "breach" to "incident" and explains the difference between the two terms. The provider agrees to attach the plan, keeps "breach", and replaces her 24 hour notice requirement with the timeframe required by applicable law. She accepts, noting that the strictest reporting timeframe she works with is the 72 hours under the General Data Protection Regulation.

The agreement said nothing about business continuity, so she adds a section. Her language requires a business continuity and disaster recovery plan, implementation of the plan during any material unplanned interruption, and a right to terminate if the provider fails to reinstate the services in the time the plan sets. She also requires testing, updates, and copies of the reports. The provider removes the "at all times" language, changes quarterly testing to annual, and agrees to provide reports on written request.

Kay Lee answers whether service credits can be calculated automatically from a service level report, and explains why a specific written request is the more common structure. She covers whether a credit can be paid in cash, and why a forward credit is easier for a provider's accounting team than a retroactive one. She recommends naming a clear channel in the contract for submitting a credit request.

Laura Frederick adds two points. Negotiate an express right of offset, because a party does not necessarily have that right unless the contract says so. Keep service level credits as the exclusive remedy only for a narrowly described failure, because an exclusive remedy measured over a long period can leave a customer with no action to take for months. Kay Lee closes with her approach to online policies, including how to use your own regulatory obligations as leverage when a provider refuses to change a standard policy.