SaaS Agreements (MSAs & MSSAs): 2026 Drafting Guide

Master Subscription Agreements, Order Forms, DPAs, SLAs — the SaaS contract stack is complex. Here's how to do it right in 2026.

Published 2026-04-22 · 7 min

The Modern SaaS Contract Stack

Modern SaaS deals use a layered approach: a Master Subscription Agreement (MSA) with all terms, plus separate Order Forms for each subscription. Add DPAs for data, BAAs for healthcare, and SLAs for uptime guarantees.

Components of a SaaS MSA

Data Processing Agreement (DPA)

Required for any SaaS handling EU/UK personal data (GDPR Article 28) and increasingly required for US privacy laws. Must define: scope of processing, security measures, sub-processors, breach notification, data deletion, and audit rights.

Service Level Agreement (SLA)

Promises uptime (typically 99.9%+), defines downtime exclusions (planned maintenance), and provides credits for missed targets (typically 10-25% of monthly fee for major outages). Include measurement methodology.

Free SaaS Contract Templates

iContract generates SaaS MSAs, Order Forms, DPAs, and SLAs with appropriate consumer/enterprise variations. Free in 2 minutes.

FAQ

Do small SaaS businesses really need a DPA?

If you have any EU/UK customers or process EU personal data, yes — required by GDPR. CCPA in California also expects DPAs. Don't skip this even if 'just B2B.'

What's the difference between MSA and Terms of Service?

ToS is unilateral, posted online, and accepted by clicking. MSA is negotiated and signed. Enterprise customers typically want MSAs; self-serve customers click ToS.

How much SLA credit should we offer?

Industry standard: 10% credit for 99-99.9% uptime in a month, 25% for <99%. Cap total credits at the monthly subscription fee. Don't promise uptime you can't deliver.

Generate your contract free

Get a jurisdiction-specific contract in under 2 minutes — no credit card required. Start free →