Data ownership — and the AI training clause
You should retain ownership of your data, with the vendor holding only a limited licence to process it in order to provide the service. Anything broader deserves scrutiny.
The clause to read most carefully now is the right to use **customer data for training models or 'improving the service'**. Broad, perpetual, irrevocable rights of that kind have become common in standard terms, and they can be inconsistent with your own privacy obligations and client confidentiality commitments. Narrow it to aggregated and de-identified data, or exclude it.
Service levels that actually mean something
An uptime percentage without a remedy is marketing. Look for how uptime is **measured**, what counts as excluded downtime (scheduled maintenance windows are often unlimited), the credit you receive, and whether repeated failures give you a right to terminate.
Service credits are usually capped at a small fraction of fees and are the sole remedy. If the service is business-critical, negotiate a termination right for chronic failure — that is worth more than a larger credit.
Liability caps and what should sit outside them
Caps are standard and often set at fees paid over the preceding twelve months, which for a modest subscription can be far less than the harm a failure would cause. Push the cap up for critical services, or accept it knowingly.
More important than the number is what is **carved out** of it. Data breach and security incidents, breach of confidentiality, IP infringement indemnity, and privacy-law violations should sit outside the general cap. A cap that limits breach liability to one year's fees transfers the whole risk of a security failure to you.
Exit — the clause nobody reads until they need it
Establish before signing: can you export your data, in what format, over what period after termination, and at what cost? Vendors that will only export PDFs, or charge substantially for a structured export, create lock-in that has nothing to do with product quality.
Also negotiate what happens on the vendor's insolvency or acquisition, notice periods for material changes to terms or pricing, and whether price increases at renewal are capped. Auto-renewal with a short cancellation window is a common trap.
Privacy, subprocessors and where data lives
If personal data is involved you need a data processing agreement, a list of **subprocessors** with notice of changes, security commitments, breach notification within a defined period, and audit or certification evidence such as SOC 2.
Data location matters: cross-border transfers carry specific obligations under the GDPR and Quebec's Law 25, including transfer assessments. Confirm where data is stored and processed, and get the right to object to new subprocessors rather than merely being told about them.
Frequently asked questions
- Can the vendor train AI models on my data?
- Only if the contract allows it — and many standard terms now do, broadly. Narrow it to aggregated de-identified data or exclude it, particularly if you hold client-confidential information.
- Is a 99.9% uptime SLA good?
- Meaningless without knowing how it is measured, what downtime is excluded, and what remedy applies. Service credits are usually small and the sole remedy.
- What should be excluded from the liability cap?
- Data breach and security incidents, confidentiality breach, IP infringement indemnity, and privacy-law violations. A cap covering those shifts the entire risk to you.
- Can I get my data out?
- Only if the contract says so. Agree the format, the window after termination and the cost before signing — otherwise you have lock-in regardless of the product.
- Do I need a data processing agreement?
- If personal data is involved, yes — with subprocessor disclosure, security commitments, breach notification timing and transfer mechanisms for cross-border processing.
This guide is general information, not legal advice. Laws, costs, and procedures vary by state, province, and your specific situation — speak with a qualified trade secrets lawyer about your circumstances before acting.