How to Manage Contracts for a SaaS Company

Managing contracts for a SaaS company is not one job, it is two jobs wearing the same badge. You send out your own paper to customers (MSAs, order forms, DPAs) and you sign someone else's paper as a customer yourself (your cloud provider, payment gateway, AI vendor). Most of the chaos in a growing SaaS legal or ops function comes from treating these as the same problem when they need opposite playbooks. This guide is a practical process for both sides, with the Indian statutory points, GST and MSME payment rules, that change what you should write down. (Adira, which publishes this guide, makes contract review and CLM software, so we have a commercial stake in you managing contracts well, but everything below works whether or not you ever buy anything from us.)

The SaaS contract stack

A SaaS company's paper is really five recurring documents, not one contract repeated with different logos.

The MSA and the order form. The Master Service Agreement (MSA) carries terms that do not change deal to deal: liability caps, indemnity, IP, governing law, termination. The order form (or SOW) carries what does change: product tier, seats, price, term, renewal date. The MSA should state plainly that it governs unless the order form expressly overrides a named clause, otherwise every renegotiated order form risks silently amending your core terms. Check this line exists before you sign or send a second order form to the same customer.

The DPA. If your product touches any personal data, and almost every SaaS product does, a data processing agreement or DPA clause sits alongside the MSA. Under India's DPDP Act, this is where you allocate who is the Data Fiduciary and who is the Data Processor for the data flowing through your product. See Data Protection Clauses in Indian Contracts Under the DPDP Act for what the clause needs to say and why "reasonable safeguards" alone is not enough.

The SLA. Uptime, response times, and what you owe if you miss them, almost always a capped service credit, not real damages. See the uptime maths and the "sole remedy" trap in SLA Clause Meaning in India.

Auto-renewal. The clause with the biggest quiet effect on both revenue and churn. On the sales side, it is your retention engine. On the vendor side, it is the deadline you keep missing on tools you meant to cancel three months ago. See Auto-Renewal (Evergreen) Clauses Explained for India for the notice-window arithmetic.

Two flows, two playbooks

Sales paper (outbound). You control the drafting. Your job is standardisation: one MSA, a small number of pre-approved order-form variants, and a fallback playbook so sales-facing staff can close deals without escalating every redline to legal. Speed matters here because a slow contract process directly delays revenue recognition.

Vendor paper (inbound). You are the signer, not the drafter, for your cloud host, payment processor, AI API vendor, and HR tools. Your job is risk triage: which clauses matter for a $200/month tool versus a vendor holding your customers' data or your production infrastructure. Reviewing every tool you buy with the same intensity as your own MSA is how legal becomes the bottleneck everyone routes around.

Treat these as two separate queues with two separate review depths, not one undifferentiated pile of "contracts to look at."

Building the workflow

1. Standardise your own paper. Get to one current MSA template and a short list of order-form variants (monthly, annual, enterprise). Every live variant in the wild, the 2022 version someone still has saved locally, is a future dispute about which terms apply. Version your template, date it, and retire old copies from shared drives the day a new one goes live.

2. Build a fallback playbook. For your five or six highest-friction clauses, liability cap, indemnity, data terms, termination, auto-renewal notice period, write down three positions: your ideal wording, an acceptable fallback a non-lawyer can approve, and a walk-away line that must go to legal. This turns "every redline needs a lawyer" into "most redlines get resolved same day." You can mark up incoming redlines against your playbook for free in Weave before anything reaches a negotiation call.

3. Track renewals and usage true-ups. Two dates matter more than the contract's headline end date: the auto-renewal notice deadline (not the renewal date itself, see the auto-renewal guide above for why that costs people money) and, for usage-based or seat-based pricing, the true-up date, when actual usage is reconciled against the committed volume and the difference is billed or credited. Miss a true-up review and you find out you undercharged a customer for two quarters, or overpaid a vendor for seats nobody uses, only when finance flags it. Put both dates wherever you track obligations and renewals, even before you own dedicated software.

4. Manage the inbound DPA and security-review queue. As you sell to bigger customers, you get security questionnaires and DPA redlines on your own sales paper, and you also need to negotiate vendor DPAs for your own stack. Keep one standard DPA schedule attached to your MSA, so you are not drafting terms fresh for every enterprise deal, and a short internal answer sheet for the questions that repeat: encryption, sub-processor list, breach-notice timeline, data residency. Most enterprise sales-cycle delay sits here, not in the commercial terms.

This loop, standardise, playbook, track, manage inbound, is most of what a contract management process looks like once you strip out the software vocabulary.

The India angle

Three Indian rules change what a SaaS contract should actually say, beyond the clause-level points already covered above.

DPDP roles are not optional paperwork. Under Section 8(2) of the Digital Personal Data Protection Act, 2023, a company may only hand personal data to a processor "under a valid contract." A SaaS vendor is commonly a Data Fiduciary for its own customer's data (Section 2(j): the party who "determines the purpose and means of processing") and simultaneously a Data Processor for data it processes on behalf of an enterprise customer under Section 2(k). Get the roles named correctly per relationship, not copy-pasted from whichever role you played in your last deal. Full statutory text and the breach-notice timeline are in the DPDP clause guide.

GST reverse charge on the tools you buy from abroad. Most SaaS companies run on foreign vendors, cloud infrastructure, AI APIs, analytics, and this creates a tax obligation people miss because no invoice line ever says so. Section 2(11) of the IGST Act, 2017 defines "import of service" as a supply where the supplier is outside India, the recipient is in India, and the place of supply is in India, which describes almost every foreign SaaS subscription an Indian company buys. Section 5(3) of the IGST Act lets the government shift who pays the tax onto the recipient, and Notification No. 10/2017-Integrated Tax (Rate) uses that power to put import of services by any person in India on reverse charge. In practice your company, not your foreign vendor, is liable to pay 18% IGST on that Stripe, AWS, or OpenAI bill, whether or not the vendor's invoice mentions GST at all.

MSME payment terms apply the moment your vendor is a registered small business. If any of your vendors, a design agency, a smaller SaaS tool, a contractor, is a registered Micro or Small Enterprise, Section 15 of the Micro, Small and Medium Enterprises Development Act, 2006 caps how long you can take to pay, in writing:

"In no case the period agreed upon between the supplier and the buyer in writing shall exceed forty-five days from the day of acceptance or the day of deemed acceptance." Source: Section 15, MSMED Act, 2006

Miss that window and Section 16 does not leave it to negotiation:

"The buyer shall... be liable to pay compound interest with monthly rests to the supplier... at three times of the bank rate notified by the Reserve Bank." Source: Section 16, MSMED Act, 2006

That interest is not deductible as a business expense either, under Section 23 of the same Act. One timing wrinkle: the Supreme Court held in Silpi Industries v Kerala State Road Transport Corporation (2021 INSC 314) that a supplier must have been registered under the Act at the date the contract was made to claim these protections, registering afterwards does not reach back. In January 2025, the Court referred that registration-timing question to a larger bench for reconsideration (2025 INSC 54), so treat it as unsettled rather than closed; either way, checking a vendor's Udyam registration status before you set payment terms is a five-minute step worth taking. Standard 30 or 45-day terms with a small MSE supplier are not a courtesy, they are close to a statutory floor.

Red flags across the stack

Normal	Red flag	Why it matters
MSA states it governs unless the order form expressly overrides a named clause	Order form silent on precedence, or each is its own free-standing agreement	A later order form can silently amend core terms like liability caps
One current MSA template, versioned and dated	Multiple live MSA versions across customers, no version control	Cannot answer "what did we agree with this customer" without digging through email
DPDP roles (Fiduciary / Processor) named for this specific relationship	Data-handling limited to a generic "confidential information" clause	No compliance-grade allocation of responsibility if a breach happens
Payment terms to a registered MSE vendor stated at 45 days or fewer	Standard 60 or 90-day terms applied to a registered MSE without checking	Exposes the buyer to compound interest at 3x the RBI bank rate under Section 16
Foreign SaaS subscriptions flagged for GST reverse-charge review	Foreign vendor invoices booked as a plain expense, no RCM check	Unpaid reverse-charge IGST is a real, auditable tax exposure
Auto-renewal notice deadline tracked separately from the renewal date	Only the contract end date or renewal date is calendared	The notice window closes weeks before the renewal date itself
A standard DPA schedule attached to your MSA, ready to send	DPA terms drafted fresh, under time pressure, per enterprise deal	Slower sales cycles and inconsistent commitments across customers
Playbook fallback positions written down for your top clauses	Every redline routed to a lawyer with no pre-approved fallback	Legal becomes the bottleneck; sales routes around the process

Bad clause to better clause: vendor payment terms

Bad: "Payment shall be made within a commercially reasonable period following receipt of a valid invoice, subject to Buyer's standard payment cycle, and Buyer may withhold payment in full pending resolution of any dispute."

This has no number, so nothing is calendared or breached in a way anyone can point to, and the full-withholding right lets a buyer freeze an entire invoice over one disputed line item. If the supplier is a registered MSE, this clause also does nothing to acknowledge the Section 15 cap it is quietly overriding on paper, even though the statute overrides it back in practice.

Better: "Buyer shall pay each undisputed invoice within thirty (30) days of receipt. Where Supplier is a registered Micro or Small Enterprise under the MSMED Act, 2006, payment shall in any case be made within the period required by Section 15 of that Act. If Buyer disputes any portion of an invoice, Buyer shall notify Supplier in writing within ten (10) business days of receipt, specifying the disputed amount and reason, and shall pay the undisputed balance on the original due date."

What changed: a real number instead of "commercially reasonable," an explicit acknowledgment of the MSME Act floor instead of silently risking it, and dispute rights narrowed to the disputed amount so a genuine billing question cannot be used to delay an entire payment.

Where a CLM helps, honestly

A spreadsheet and a shared drive get most early-stage SaaS companies further than people expect: one template, a short playbook, and a renewal calendar cover the first year or two of contracts without any dedicated software. What breaks it is volume and memory. Once you track fifty or more active contracts across sales paper and vendor paper, a manual system depends on someone remembering to check a spreadsheet on the right day, every time, forever. That is where a CLM, including Adira, earns its cost: automated renewal and notice-window alerts, a searchable repository so "what did we agree on liability with this customer" is a search instead of an email hunt, and playbook-aware review that flags a clause against your fallback positions instead of a human re-reading the whole contract. Add tooling when the process is breaking, not before it exists.

FAQ

Do I need a separate DPA for every SaaS customer, or can it live inside the MSA? Either works legally. A DPA schedule attached to and incorporated by reference into the MSA is common for most SaaS deals; a standalone DPA document is more common for larger enterprise customers whose own procurement process requires one. What matters is that the Fiduciary/Processor roles and the terms required under Section 8 of the DPDP Act are covered somewhere, not which document they sit in.

Which governs if the MSA and the order form conflict? It depends on what your MSA says. Most well-drafted MSAs state that the MSA governs except where the order form expressly overrides a named clause. If yours is silent on precedence, check it before you sign the next order form, not after a dispute.

Do GST reverse-charge rules apply even to a $20/month tool subscription? Yes, in principle. The reverse-charge obligation under Section 5(3) of the IGST Act has no de minimis exemption for small subscriptions; it turns on whether the supply is an import of service under Section 2(11), not the invoice size. Talk to your accountant about how your company handles this in aggregate.

What is a usage true-up and why does it need tracking? A true-up is the periodic reconciliation between what a contract committed, a seat count, an API call volume, a data limit, and what was actually used, with the difference billed or credited. Miss the review date and you undercharge a customer for months, or get billed for vendor usage nobody validated, usually invisible until finance notices during a close.

Is 45 days always the maximum I can take to pay a vendor in India? Only if that vendor is a registered Micro or Small Enterprise under the MSMED Act, and only where a written agreement sets the term; otherwise Section 15 defaults to 15 days from acceptance. A Medium enterprise, an unregistered vendor, or a large company is not covered by this specific cap.

Do I really need a fallback playbook if we only sign a handful of contracts a month? It still saves time at low volume, since it removes the back-and-forth of a lawyer re-deciding the same clauses on every deal. The value compounds as volume grows, but the setup cost is small enough that most teams are better off building it early rather than waiting until the backlog forces it.

This guide gets you a working process for managing SaaS contracts and the Indian statutory points that change what your paper should say. It does not tell you whether your specific MSA, DPA, or vendor terms are legally sound for your business, that depends on facts a lawyer needs to review, and is not legal advice. Talk to a lawyer, and your accountant on the tax points, before you finalise contract terms or payment processes that matter.