1. Legal Issues in SaaS SwANH InfoXchange 2007 Legal Issues in SaaS SwANH InfoXchange 2007 Claire R. Howard, Esq. Getman, Stacey, Schulthess & Steere, P.A. Three Executive Park Drive, Suite 9, Bedford, NH 03110 www.GetmanStacey.comchoward@getmanstacey.com (603) 634 4300 We make our mark, by building your business. TM We make our mark, by building your business. TM

2. 2 Introduction ► What do we mean by SaaS?  Vendor (Licensor)  Customer (Licensee)

3. 3 What’s the Diff? ► License – Customer “purchases” license for specified number of users or sites and software is hosted and maintained onsite ► SaaS – Customer “leases” right to access software via a network (generally the web) and access, upgrades, hosting, etc. are provided by vendor (through 3 rd party?) seamlessly for a monthly fee

4. 4 Licensing v. SaaS LicenseSaaS Purchase/perpetual license Monthly “lease” payment Installed on customer hardware onsite Hosted offsite In-house IT serviced and managed (may be under SLA) All service and upgrades by vendor included

5. 5 Licensing v. SaaS Licensing v. SaaS ► Why is Saas different (from a legal standpoint) than a traditional license arrangement?  Significant shift of responsibility/liability

6. 6 SaaS On the Rise? In 2005 SaaS represented ~ 5% of business software revenue By 2011, ~ 25% will be delivered as SaaS Gartner, Inc.

7. 7 ► www.SaaS-showplace.com - Poll October 8, 2007 www.SaaS-showplace.com  59% - SaaS solutions are essential to operations of my business  32% - Still trying to understand the benefits of Saas solutions  9% - SaaS solutions are still unproven and risky - Bias? - SaaS On the Rise?

8. 8 The Agreement ► Data  Ownership (c)/liability (v)  Export availability (c)  Back-up and storage procedures (c & v)  Responsibility for data loss and cost of retrieval (c & v)  Privacy issues - e.g., SoX, HIPAA compliance (c & v)

9. 9 The Agreement The Agreement ► Service Level Requirements  Percentage of uptime required - permissible downtime for routine maintenance ► Salesforce.com 2005 outage  Response times  Service availability  Exceptions (e.g., force majeure, failure to notify, etc.)

10. 10 The Agreement The Agreement ► Hosting Hardware & Facility  Hardware redundancy  Server scalability in case of rapid demand increase  Redundant power supplies (battery and diesel backups) (v)  Facility staffing (v)

11. 11 The Agreement The Agreement ► Software Escrow Agreement  Do you offer (v) or ask for (c)? ► Bargaining power ► How important is the software to day-to-day operations? ► “Release Event”

12. 12 Case Study – Dealpower.com Dealpower.com ► “Master Subscription Agreement” ► Saas powerhouse ► Names have been changed

13. 13 Dealpower.com ► Scenario #1  Customer enters into Dealpower.com agreement. After the initial term, the Customer determines the service is not adequate for its needs and terminates Agreement  What happens to Customer’s data?

14. 14 Dealpower.com ► Scenario #1  “In the event this Agreement is terminated (other than by reason of your breach), Dealpower.com will make available to you a file of the Customer Data within 30 days of termination if you so request at the time of termination.” ► Right to delete more than 30 days after termination

15. 15 Dealpower.com ► Scenario #2  Customer enters into Dealpower.com agreement, but runs into financial difficulty and falls behind on payments  What happens under the Agreement to: ► Customer’s access to the Service ► Customer’s data

16. 16 Dealpower.com ► Scenario #2  Access - “Dealpower.com reserves the right to suspend or terminate this Agreement and your access to the Service if your account becomes delinquent (falls into arrears).”  Data – “Dealpower.com reserves the right to withhold, remove and/or discard Customer Data without notice for any breach, including, without limitation your nonpayment.”

17. 17 Dealpower.com ► Scenario #3  Customer enters into Agreement  A hardware issue with the server results in Service being unavailable for 6 hours during business day and Data not being backed-up correctly  What is remedy for Customer?

18. 18 Dealpower.com ► Scenario #3  “You, not Dealpower.com shall have sole responsibility for the accuracy [of the Data]... and Dealpower.com shall not be responsible or liable for the deletion, correction, destruction, damage, loss or failure to store any Data.”  “Dealpower.com makes no representation, warranty, or guaranty as to the reliability, timeliness, quality... availability, accuracy or completeness of the Service or any content.”

19. 19 Dealpower.com ► Scenario #3  NO uptime requirements  NO response times  NO credit/termination right for downtime

20. 20 Dealpower.com ► Scenario #4  Customer enters into Agreement and after 6 months Dealpower.com begins having financial difficulty  Creditor of Dealpower.com seizes all Dealpower.com hardware and/or Dealpower.com files for bankruptcy  What happens to Customer access & data?

21. 21 Dealpower.com ► Scenario #4  Unclear  No software escrow (Service will not be available to Customer going forward)  “In the event this Agreement is terminated (other than by reason of your breach), Dealpower.com will make available to you a file of the Customer Data within 30 days of termination if you so request at the time of termination.”  No explicit mention of Dealpower.com breach

22. 22 Dealpower.com ► Scenario #5  Customer enters into Agreement and properly terminates at the end of the initial term  Dealpower.com timely provides Data to Customer, but does not delete or destroy  Data winds up in possession of Customer’s direct competitor through inadvertent disclosure by Dealpower.com

23. 23 Dealpower.com ► Scenario #5  Under Agreement, Dealpower.com has no obligation to delete or destroy Data  “Dealpower.com does not represent or warrant that... use of the Service will be secure, timely, uninterrupted or error-free....”

24. 24 Questions? Questions?

25. 25 Claire R. Howard, Esq. Getman, Stacey, Schulthess & Steere, P.A. Three Executive Park Drive, Suite 9 Bedford, NH 03110 603.634.4300choward@getmanstacey.com