Platform as a Service (PaaS) Agreement

Platform as a Service Agreement: control of your own platform

If clients build and manage applications on your platform, the PaaS agreement is what keeps you in the driving seat. It sets the subscription model, the limits of what you have promised, who owns what when a client builds something on top of your service, and where you are exposed if they misuse it.

Written properly, it is a supplier-side document. It should be usable with every new client without a redraft.

Who needs one

Platform providers whose clients build or run applications on their service
SaaS and cloud vendors selling per-user subscriptions with a service level
ISVs exposing APIs or an environment clients develop against
Anyone whose clients' end users touch their platform indirectly

The clauses that matter most

1. Subscriptions

The core commercial term: the client buys one subscription per authorised user. Ten employees using your service means ten subscriptions.

Policing that across the cloud is not straightforward, which is why two mechanisms work together. The client is obliged to keep a running list of authorised users, and you have the right to audit quarterly. If the audit turns up unauthorised users, you can charge for them — without having to terminate and start a new agreement.

2. Supplier obligations

Word choice matters. Bind yourself to provide the services with reasonable skill and care, and no further. Commit only to commercially reasonable endeavours; anything stricter has a financial impact and pushes you beyond what is reasonable.

Where you fall short of the standard, your remedy should be to correct the non-conformance — and that should be the client's only remedy, so a fixable issue does not become a termination right.

State expressly that you do not warrant the services will run uninterrupted and error-free, which covers you for maintenance and faults. And keep the right to amend, modify, improve and fix the service from time to time.

Jurisdiction note — how to disclaim implied warranties

US — Under UCC §2-316, a disclaimer of the implied warranties of merchantability and fitness for a particular purpose must be conspicuous. That is the statutory reason US agreements set these clauses in capitals or bold.

UK — Implied terms can be excluded between businesses only so far as reasonable under the Unfair Contract Terms Act 1977. The Consumer Rights Act 2015 gives non-excludable rights for digital content supplied to consumers.

Canada — Provincial sale of goods and consumer protection statutes imply comparable conditions, with Quebec's Consumer Protection Act the strictest.

You can run your own SLA alongside the agreement.

3. Client obligations

Two fundamentals: cooperate, and pay.

Cooperation matters when you need to audit users or access client information. Compliance with applicable laws and regulations matters more than it looks — if new regulation forces you to take the service offline while you adapt it, that obligation is what stops the client calling it a breach.

The client should be expressly prohibited from copying, sharing, stealing or using the services to build something similar. If they delay, you can move delivery dates and timetables. Your policies — an acceptable use policy, for example — should bind them through this agreement. And the client is responsible for the results they get from the services and for the conduct of their authorised users.

4. Payment

30 days from invoice date, with interest on late payment at a stated annual rate. Fees sit in Schedule 1.

Jurisdiction note — interest and tax

UK — 30 days matches the Prompt Payment Code. Absent a contractual rate, the Late Payment of Commercial Debts (Interest) Act 1998 implies 8% above the Bank of England base rate — so a low contractual rate like 3% is worth reviewing. Fees exclude VAT.

US — Interest is contractual and subject to state usury caps; there is no general federal prompt payment rule for private contracts. Fees exclude state and local sales tax, and the taxability of cloud services varies by state.

Canada — Express interest annually: under s.4 of the Interest Act a rate stated for a shorter period without the yearly equivalent is capped at 5% per annum. Fees exclude GST/HST and QST in Quebec.

Build in the right to invoice for storage overages and additional users, and the right to raise fees annually on 30 days' notice — that is how you pass on third-party price rises and inflation rather than absorbing them. VAT is excluded.

5. Branding, IP and confidentiality

Your client uses your platform to build their own applications, so ownership needs stating clearly. You own the rights to the services, the documentation, and any integrated service element inside the client's application.

On branding: the client needs your permission before showing your logos to their end users, while you should be free to use the client's logos for marketing — website, newsletter and so on.

Signing the PaaS agreement terminates the parties' earlier agreements, including any NDA. Confidentiality obligations therefore need to live in this document, covering the details of your service and any service testing.

Jurisdiction note — data protection sits alongside confidentiality

Confidentiality clauses are not data protection terms, and in all three jurisdictions you will usually need both.

UK — Where you process personal data on the client's instructions, Article 28 UK GDPR mandates specific processor terms. A data processing agreement is not optional.

US — Most state privacy laws require defined service provider or processor terms; California's are the most prescriptive. Sector rules add more, such as a HIPAA business associate agreement.

Canada — PIPEDA keeps accountability with the transferring organisation, so your terms should commit to comparable protection. Quebec's Law 25 requires an assessment before personal information leaves the province.

6. Indemnities and liability

The indemnities here are deliberately asymmetric.

The client gives a wide indemnity: if a claim is brought against you because of something they did with the services, they pay. Wide is what you want — misuse of your platform can come back at you from many directions.

Your indemnity is narrow: it applies only where a claim is brought against the client for third-party IP infringement, and only where the infringement arose from your services — not from the application they built.

Where liability can be capped, cap it at 100% of the annual fees.

Jurisdiction note — will the cap hold?

UK — Reasonableness under the Unfair Contract Terms Act 1977.

US — Unconscionability and UCC §2-719, under which a limited remedy failing of its essential purpose can be set aside.

Canada — The Tercon (2010 SCC 4) framework.

Consider a higher sub-cap for data protection breaches than for general service failures — enterprise clients increasingly insist on it, and a single cap at annual fees looks thin against a serious incident.

7. Termination

Terminating should be harder than cancelling a subscription — for a longer-lasting engagement and less financial exposure. So: no termination for convenience.

The initial term is one year, auto-renewing on the anniversary, with three months' notice to cancel the renewal expiring at the end of the current term. Immediate termination is reserved for specific events: a party ceasing a substantial part of its business, or a material or payment breach not remedied within 14 days.

8. Governing law

Jurisdiction note

UK — English law with exclusive jurisdiction of the English courts where the services are provided in England.

US — Name a state's law and venue, and decide deliberately on arbitration and class action waiver. Where clients accept online, use clickwrap rather than a footer link — US courts enforce the former and often refuse the latter.

Canada — Name the province. Several provinces restrict arbitration and class action waivers against consumers, and Quebec requires French-language customer-facing terms.

Frequently asked questions

What is the difference between a PaaS agreement and a SaaS agreement? A PaaS agreement contemplates the client building and running their own applications on your platform, which raises ownership, integration and end-user questions a straightforward SaaS subscription does not.

How do I stop clients under-reporting users? Two clauses working together: an obligation to maintain a list of authorised users, and a quarterly audit right with the ability to charge for anyone unauthorised you find.

Should I promise uptime? Promise it in an SLA you control, and state in the agreement that you do not warrant uninterrupted, error-free service. The two are not contradictory — one sets a target with defined remedies, the other stops a blanket warranty.

Can I use my client's logo in marketing? If the agreement says so. The usual position is that you can, while they need your permission to show yours to their end users.

How Cloud Contracts 365 helps

Cloud Contracts 365 builds your PaaS agreement from a guided questionnaire — subscription model, audit rights, indemnity split and liability cap set to your position — and stores every signed version with its schedules. When a client's legal team sends back amendments, the reviewer flags exactly which of your protections they have softened.