SaaS Agreement (SMB) - California

SOFTWARE AS A SERVICE AGREEMENT — SMB

STATE OF CALIFORNIA

Use gate. This shorter form is for a standardized, lower-complexity private
business subscription. Use the enterprise agreement instead if the deal
includes sensitive or regulated data, material integrations, negotiated
security controls, multiple regions, custom development, AI training or
automated decisions, public-sector terms, high transaction value, complex
indemnity, or extensive audit rights.

1. AGREEMENT AND PARTIES

Effective Date: [__/__/____]

Provider

Legal Name: [________________________________]

Entity Type and Jurisdiction: [________________________________]

Address: [________________________________]

Contact: [________________________________]

Security Contact: [________________________________]

Customer

Legal Name: [________________________________]

Entity Type and Jurisdiction: [________________________________]

Address: [________________________________]

Contact: [________________________________]

Security Contact: [________________________________]

Each is a "Party"; together, the "Parties."

Initial Order Form: [________________________________]

Initial Subscription Term: [________________________________]

Currency: [________________________________]

2. DOCUMENTS AND PRECEDENCE

This Agreement includes the following completed documents:

☐ Order Form

☐ Service-Level and Support Sheet

☐ Data and Security Schedule

☐ Tax Schedule

☐ Implementation SOW

☐ Risk and Dispute Schedule

☐ AI or Specialized Use Addendum

Order of precedence:

1. Signed specialized addendum for its subject
2. Signed Order Form for commercial selections and stated overrides
3. Signed implementation SOW for professional services
4. This Agreement
5. Attached service, data, security, and support sheets for their subjects
6. Documentation only to the extent expressly incorporated

No changeable web page overrides a signed document unless the signed document
states a controlled, authenticated update process.

3. DEFINITIONS

"Authorized User" means a person Customer permits to use the Service under
the Order Form.

"Customer Data" means data Customer or an Authorized User submits to the
Service, excluding telemetry and deidentified data only to the extent defined
and permitted in the Data and Security Schedule.

"Documentation" means the versioned user materials identified in the Order
Form.

"Order Form" means a signed ordering schedule under this Agreement.

"Provider Materials" means the Service, Documentation, software, tools,
methods, and preexisting materials.

"Security Incident" means the event defined in the Data and Security
Schedule.

"Service" means only the hosted application and features identified in the
Order Form.

"Subscription Term" means the period in an Order Form.

4. SERVICE MAP AND COMPLEXITY CHECK

Escalate to the enterprise form if any selected feature requires terms not
fully covered by the attachments.

5. ACCESS AND USE

Provider grants Customer a limited, nonexclusive, nontransferable right during
the Subscription Term for Authorized Users to access and use the Service for
Customer's internal business purposes.

Authorized Users: [________________________________]

Usage Limit: [________________________________]

Permitted Entities: [________________________________]

Permitted Locations: [________________________________]

Customer shall:

☐ Maintain current user records

☐ Protect credentials and use approved authentication

☐ Promptly disable unauthorized or departed users

☐ Follow the Documentation and Order Form

Customer shall not, except as expressly permitted:

☐ Resell, sublicense, time-share, or provide service-bureau access

☐ Circumvent access, security, or usage controls

☐ Introduce malicious code

☐ Use the Service for prohibited content, persons, or activities

☐ Copy, modify, reverse engineer, or create derivative works

☐ Remove notices or misrepresent origin

☐ Conduct unapproved security or load testing

Permitted interoperability or testing: [________________________________]

6. ORDER FORMS AND SERVICE CHANGES

Each Order Form must state:

☐ Service edition and features

☐ Subscription Term and renewal

☐ Users and usage limits

☐ Fees, billing, and payment

☐ Support tier

☐ Data categories and hosting location

☐ Implementation

☐ Tax treatment

☐ Agreement overrides

Provider may change generally available features only under the notice,
material-adverse-change, compatibility, security, and termination process in
the Order Form.

No Order Form is effective unless accepted through:
[________________________________].

7. IMPLEMENTATION

☐ No implementation services

☐ Standard onboarding described here: [________________________________]

☐ Signed SOW attached

Any SOW must state scope, Deliverables, assumptions, dependencies, milestones,
acceptance, fees, data access, security, and IP terms.

Acceptance period: [____] Business Days

Silence does not create acceptance unless the SOW states the evidence, notice,
cure, and deemed-acceptance mechanism.

8. SUPPORT AND SERVICE LEVEL

Standard Support

Support Hours: [________________________________]

Time Zone: [________________________________]

Channels: [________________________________]

Priority Definitions: [________________________________]

Response Targets: [________________________________]

Availability

☐ No contractual availability commitment

☐ Commitment in attached Service-Level Sheet

If selected, the sheet must state measurement, maintenance, exclusions,
service credits, request deadlines, chronic failure, and termination rights.

A target or credit has no effect unless the sheet is completed.

9. CUSTOMER RESPONSIBILITIES

Customer shall:

☐ Provide accurate configuration and dependency information

☐ Maintain Customer systems and connectivity

☐ Obtain permissions for Customer Data and Authorized Users

☐ Configure access and security selections

☐ Prevent prohibited or harmful use

☐ Cooperate with support, incident, migration, and exit processes

Customer Administrator: [________________________________]

Dependencies: [________________________________]

Prohibited Uses: [________________________________]

Provider is not responsible for Customer systems or instructions except to the
extent expressly assumed in a signed attachment.

10. FEES, INVOICING, AND PAYMENT

Fees are stated in the Order Form.

Billing: ☐ Advance ☐ Arrears ☐ Usage ☐ Other: [________________________________]

Invoice Frequency: [________________________________]

Payment Due: [____] days after receipt of a correct, undisputed invoice

Payment Method: [________________________________]

Purchase Order: [________________________________]

Invoice Dispute Period: [____] days

Customer shall pay undisputed amounts while the Parties investigate a disputed
item.

Late Charges — Select After Counsel Review

☐ No late charge

☐ Simple interest on undisputed overdue amounts at [____]% per year, not
exceeding the maximum permitted rate

☐ Other: [________________________________]

This Agreement does not state a statutory rate, public-payment deadline,
judgment result, fee award, or collection remedy.

Suspension

Provider may suspend for nonpayment or prohibited use only after the notice,
cure, escalation, security, continuity, and data-protection steps in the Order
Form.

11. TAXES

Attach a tax schedule for the actual Service, locations, parties, exemptions,
invoice date, and transaction structure.

The schedule must state:

☐ Classification and sourcing

☐ Rates and effective dates

☐ Exemptions and documentation

☐ Invoicing, collection, remittance, audit, and refunds

☐ Withholding

☐ Taxes based on each Party's income

This Agreement does not hard-code a tax type, rate, form, certificate, or SaaS
tax result.

12. CUSTOMER DATA

Customer retains its rights in Customer Data. Customer grants Provider only
the rights in the Data and Security Schedule to host, copy, transmit, process,
display, and otherwise handle Customer Data for the identified purposes.

The schedule must state:

☐ Data categories and individuals

☐ Source and permission

☐ Processing purposes

☐ Hosting and transfer locations

☐ Suppliers or subprocessors

☐ Retention, return, and deletion

☐ Support access

☐ Telemetry and analytics

☐ AI training or model improvement

No Customer Data, prompt, output, or Confidential Information may be used to
train or improve a general model unless a signed addendum expressly permits the
defined use and safeguards.

13. SECURITY AND INCIDENTS

Provider shall maintain the controls selected in the Data and Security Schedule,
including access, encryption, secure development, vulnerability management,
monitoring, backup, recovery, personnel, supplier, and evidence requirements.

Contract Incident Notice: [____] hours after Provider confirms a Security
Incident affecting Customer Data

Provider shall provide available facts, containment steps, affected data and
systems, a contact, and scheduled updates.

The schedule must allocate investigation, preservation, legal-role analysis,
notice decision-making, regulator and third-party communications, costs,
remediation, and public statements. Contract notice does not replace a shorter
or role-specific duty.

14. CONFIDENTIALITY

Each Party shall protect the other's defined Confidential Information and use
it only for this Agreement.

Exclusions require documented prior knowledge, public availability without
breach, lawful third-party receipt, or independent development.

Permitted Recipients: [________________________________]

Compelled Disclosure: [________________________________]

Return or Deletion: [________________________________]

Contract Confidentiality Period: [________________________________]

Trade-Secret Treatment: [________________________________]

A contract label does not itself establish statutory trade-secret status or
automatic injunction, damages, fees, or claim periods.

15. INTELLECTUAL PROPERTY

Provider retains Provider Materials. Customer retains Customer Data and
Customer materials.

Any Deliverable, configuration, integration, feedback, third-party component,
open-source software, output, or transferred right must be addressed in the SOW
or IP section of the Order Form.

The selected terms must state ownership, license scope, territory, duration,
sublicensing, modification, enforcement, and termination effects.

No payment, checkbox, or product label alone creates work-made-for-hire, joint
ownership, or a transfer.

16. THIRD-PARTY SERVICES

For each component, state fees, terms, support, privacy, security, changes,
discontinuation, migration, and liability allocation.

Provider shall not silently add a materially different third party that changes
agreed data, security, location, or specialized-use terms.

17. WARRANTIES AND DISCLAIMERS

Each Party warrants its signer has authority.

Provider Service Warranty: [________________________________]

Professional Services Standard: [________________________________]

Cure and Remedy: [________________________________]

Customer warrants it has the rights and permissions stated in the Data and
Security Schedule for Customer Data and instructions.

Any disclaimer must be conspicuous and completed by counsel for the classified
transaction. This Agreement does not assume hosted access is a sale of goods or
import goods-law warranty language without classification.

Disclaimer, if selected: [________________________________]

18. RISK ALLOCATION

The Risk and Dispute Schedule must state:

☐ Indemnity claims and covered persons

☐ IP, data, security, content, tax, and regulatory allocations

☐ Notice, defense control, and settlement consent

☐ Damage exclusions and liability caps

☐ Supercap or uncapped selections

☐ Service-credit interaction

☐ Insurance

No indemnity, exculpation, cap, damage exclusion, automatic fee award,
injunction, no-bond remedy, or waiver arises from this heading alone.

19. TERM, RENEWAL, TERMINATION, AND EXIT

The Agreement continues while an Order Form is active.

Renewal: ☐ No automatic renewal ☐ Signed renewal
☐ Other: [________________________________]

Renewal Notice: [____] days

Termination Without Cause: [________________________________]

Material Breach Cure: [____] days

Security or Prohibited-Use Suspension: [________________________________]

On expiration or termination:

☐ Access ends on: [________________________________]

☐ Customer export window: [____] days

☐ Export format: [________________________________]

☐ Transition assistance: [________________________________]

☐ Provider deletion deadline: [____] days after export window

☐ Backup deletion cycle: [________________________________]

☐ Retention exceptions: [________________________________]

Accrued payment, confidentiality, IP, data return, security incident, audit,
risk, and dispute terms survive only as expressly stated.

20. DISPUTES

Executive Escalation: [________________________________]

Negotiation Period: [____] days

Mediation: ☐ None ☐ Under attached addendum

Arbitration: ☐ None ☐ Under attached counsel-reviewed addendum

Court Route: Subject to jurisdiction and mandatory venue, courts serving
[________________________________] County, California, or a federal court with
jurisdiction over that county.

Jury Terms: ☐ No contractual waiver
☐ Counsel-reviewed conspicuous waiver attached

Fees and Costs: ☐ Each side bears its own
☐ As stated in attached addendum

This Agreement does not presume entitlement to provisional relief, waive bond
or other procedure, establish court jurisdiction, shorten a claim period, or
create arbitration through a checkbox alone.

21. COMPLIANCE AND SPECIALIZED USE

Attach requirements for any:

☐ Consumer use

☐ Public-sector use

☐ Health, financial, education, insurance, or employment data

☐ Children's, biometric, or precise-location data

☐ Accessibility

☐ Export controls and sanctions

☐ AI or automated decisions

☐ Other regulated activity: [________________________________]

Each Party shall comply with completed requirements assigned to it. Signing
this general form does not certify compliance with an unidentified law or
industry.

22. GENERAL TERMS

Notices: [________________________________]

Assignment: [________________________________]

Subcontractors: [________________________________]

Force Majeure: [________________________________]

Amendments: Signed writing by authorized representatives

Entire Agreement: This Agreement and completed attachments supersede prior
discussions for their subject matter.

Order of Precedence: Section 2

Severability: [________________________________]

No Waiver: A waiver must be in a signed record and applies only to the
identified event.

No Intended Third-Party Beneficiaries: [________________________________]

Governing Law Selection: California, subject to mandatory law and
conflict-of-laws analysis.

Counterparts and Electronic Exchange: The Parties may sign counterparts and
exchange authenticated signature pages electronically, subject to any
transaction-specific consent, attribution, delivery, record, notarial, filing,
and retention requirement identified by counsel.

23. SIGNATURES

By signing, each Party confirms that it reviewed the completed Agreement, Order
Form, and attachments and had an opportunity for independent legal and tax advice.

Provider

Legal Name: [________________________________]

Authorized Signer: [________________________________]

Title: [________________________________]

Signature: _______________________________________________

Date: [__/__/____]

Customer

Legal Name: [________________________________]

Authorized Signer: [________________________________]

Title: [________________________________]

Signature: _______________________________________________

Date: [__/__/____]

ATTACHMENT A: ORDER FORM

ATTACHMENT B: SERVICE-LEVEL AND SUPPORT SHEET

Availability: [________________________________]

Measurement and Exclusions: [________________________________]

Maintenance: [________________________________]

Support Priorities and Targets: [________________________________]

Service Credits: [________________________________]

ATTACHMENT C: DATA AND SECURITY SCHEDULE

Data and Individuals: [________________________________]

Purposes: [________________________________]

Hosting and Transfers: [________________________________]

Suppliers: [________________________________]

Security Controls: [________________________________]

Incident Process: [________________________________]

Retention, Return, and Deletion: [________________________________]

ATTACHMENT D: TAX, RISK, AND DISPUTE SCHEDULE

Tax: [________________________________]

Indemnity and Liability: [________________________________]

Insurance: [________________________________]

Disputes: [________________________________]

This standardized private-business SMB SaaS agreement must be completed with
its Order Form and service-level, data, security, tax, risk, and dispute
attachments and reviewed by qualified California counsel and tax advisors
before launch or signature.