SaaS contract and subcontracting: best practices

Outsourcing in a SaaS contract raises essential questions of responsibility and compliance. A SaaS provider rarely works alone: they often rely on subcontractors for hosting, maintenance or data management. Framing these relationships properly is essential. A contract that does not include clauses on this subject may expose a publisher or a client to contractual and legal risks.

Two types of SaaS subcontractors

Not all subcontractors are equivalent in SaaS. A distinction must be made between:

Project-specific subcontractors : committed to a specific mission, at the request of a customer. Their intervention generally requires prior approval from the customer. These service providers fall within the framework of the 1975 law on subcontracting, implying an obligation of transparency and formal acceptance by the main customer.
Generalized subcontractors : service providers used for all SaaS customers (e.g.: cloud host, monitoring provider). In practice, it is impossible to obtain customer authorization for each of them by each customer, hence the existence of a notification process.

This distinction has a direct impact on the drafting of contracts.

Subcontracting and personal data: an additional constraint

When a subcontractor processes personal data, the RGPD provides for specific obligations related to the transmission of data between the SaaS publisher and the subcontractor. This involves:

A strict contractual framework via a subcontracting agreement (DPA — Data Processing Agreement).
An obligation to inform the customer about subcontractors who have access to the data.
Appropriate security measures to guarantee the confidentiality and integrity of data.

A critical point: the refusal of a subcontractor by a customer should not block the entire SaaS. Without precautions, a customer could prevent a global migration by invoking an objection, creating legal and operational risk for the publisher.

Supervise subcontractors in the SaaS contract

A SaaS is based on an ecosystem of service providers. The contract must:

List critical subcontractors : essential services (hosting, backup, support), and subcontractors to whom personal data is transferred must be identified.
Specify the procedure for changing subcontractors : a simple notification with or without the possibility of objection.
Define security and compliance commitments : SaaS must ensure that its subcontractors comply with GDPR and applicable standards.

Prior authorization or simple notification?

The key issue is customer authorization. For a specific subcontractor, the contract may require formal approval. On the other hand, for a generalized subcontractor, specific prior authorization is unrealistic.

Common practice is prior notification - also called general authorization. The customer is informed of the change and has a period of time to express an objection. If he refuses the subcontractor, he cannot block his integration but can invoke a termination clause if one is provided for.

A poorly written clause can create legal uncertainty:

If it imposes authorization for all subcontractors, it blocks any technical evolution of SaaS.
If it does not provide for transparency, the customer loses all control over the outsourcing of services.
If it does not specify the consequences in case of an objection, a single customer could block a critical migration for all the others.

Consequences of an insufficient framework within the SaaS contract

Unclear management of subcontractors can lead to:

Disputes with customers refusing an unannounced subcontractor.
GDPR compliance issues if transparency and security obligations are not respected.
Commercial instability if a customer uses a change of subcontractor to break their commitment.
An operational risk if a customer can block a migration that is necessary for the entire customer base.

Best subcontracting practices for securing your contracts

Include a list of key subcontractors in the contract appendices.
Set up a notification mechanism for changes.
Set a reasonable objection period (e.g. 15 days).
Supervise the right to cancel in case of disagreement.
Include a clause specifying that the refusal of a subcontractor cannot prevent the evolution of the service for all customers.

Conclusion

A SaaS must adapt, and the management of subcontractors should not be an obstacle to its evolution. A balance must be found between flexibility and the security of the parties. A well-written clause ensures transparency with the customer without compromising the innovation capacity of SaaS.

I can help you secure your contracts and avoid the pitfalls associated with subcontracting. Contact me to adapt your clauses and ensure their compliance.