SaaS sales run on a stack of legal documents, and founders often lump them together as "the contract" without knowing what each does. Understanding the pieces — and how they fit — makes negotiations faster and helps you know where a template is fine and where you genuinely need a lawyer. This is orientation, not legal advice: for anything binding, get a qualified lawyer, because the cost of a bad clause dwarfs the cost of review.
The documents and their jobs
| Document | Covers |
|---|---|
| MSA (Master Services Agreement) | The overarching legal terms: liability, IP, warranties, termination |
| Order Form | The commercial specifics: what plan, how many seats, price, term |
| DPA (Data Processing Agreement) | How you handle personal data — required under GDPR |
| SLA (Service Level Agreement) | Uptime and support commitments, and remedies if you miss them |
| Terms of Service | The standard terms for self-serve/click-through customers |
How they fit together
The MSA is the foundation — the durable legal relationship — and the order form sits on top of it to capture the commercial deal, so you can add or change subscriptions with a new order form without renegotiating the whole MSA. The DPA and SLA attach as they apply. For self-serve customers who never negotiate, a click-through Terms of Service plays the MSA's role. This structure is why enterprise deals separate the legal terms (MSA) from the commercials (order form): the terms are negotiated once, the commercials change per deal.
Template versus lawyer
Templates are a reasonable starting point for your standard, non-negotiated agreements — a baseline Terms of Service or a first-draft MSA — and they help you understand the shape of each document. But have a qualified lawyer review anything before it is binding, especially the liability, indemnification, and IP clauses where a template's generic wording can expose you badly. Use templates to learn and to draft; use a lawyer to sign.
Founders often treat the DPA as an enterprise-only extra, but GDPR requires one whenever you process personal data on a customer's behalf. Have a solid DPA ready as part of your standard stack, not something you scramble to produce when an EU customer asks — being unable to provide one can stall or lose the deal.
The SaaS contract stack is an MSA for the legal terms, an order form for the commercials, a DPA for data protection, an SLA for service commitments, and Terms of Service for self-serve — each doing one job and fitting together so you negotiate the durable parts once. Use templates to understand and draft the stack, and a lawyer to make it binding, because in contracts the clauses you did not read are the ones that cost you.
Independent software engineer in Nairobi specialising in Acumatica customisations, Laravel backends, and tax fiscalisation integrations across East and Southern Africa.