ERP SaaS contract traps: exit, data export, SLAs and auto-renewal

The contract determines what you can do when things go wrong, and in a business-to-business SaaS agreement, provincial consumer-protection laws generally will not help you. Before signing, check six areas: term and auto-renewal, price changes, data export and exit assistance, service levels and credits, liability and indemnities, and data protection and sub-processors. Ask for changes in writing; vendors often have standard positions, but many will negotiate notice periods, renewal caps and exit terms for a multi-year commitment. For a contract of significant value, have a lawyer review the master agreement, order form, data-processing terms and statement of work together.

This guide is general information, not legal advice. It is part of the failure patterns and official sources pillar.

The documents that make up an ERP deal

Document	What it covers	Often overlooked
Master subscription agreement	General terms, liability, termination	Incorporates online policies the vendor can update
Order form	Users, modules, prices, term	Overrides the master agreement where they conflict
Service level agreement	Uptime, support response, credits	Exclusions for maintenance windows
Data-processing addendum	Privacy, security, sub-processors	Location of data and notice of changes
Acceptable use and other online policies	Limits on use	Can change during the term
Partner statement of work	Implementation scope and fees	Separate contract with a different company

The vendor and the implementation partner are often different companies with separate contracts. A problem with the partner does not automatically let you exit the subscription, and vice versa. Ask whether either contract can be terminated if the other fails.

1. Term and auto-renewal

Initial term (one, three or five years) and whether you can terminate for convenience.
Automatic renewal and its length: does it renew for one year or for the original term?
Notice period to stop renewal (often 30 to 90 days) and how notice must be given.
Whether fees for the whole term are owed if you terminate early.

See renewal price increases for the pricing side.

2. Price changes during the term

Can the vendor change prices or fees mid-term (for example for storage or API usage)?
Is the renewal increase capped? For how many renewals?
Do discounts carry forward to added users and modules?
In which currency are renewals and add-ons billed? See USD contracts and FX risk.

3. Data export and exit assistance

This is the clause buyers regret ignoring most. Check:

Question	What good looks like
What data can be exported?	All your data, including transaction detail, attachments, audit logs and configuration
In what format?	Open, documented formats (for example CSV or database export with a data dictionary)
When?	At any time during the term, and for a defined period after termination (for example 30 to 90 days)
At what cost?	Self-service export at no charge; assisted export at agreed rates
What happens after?	Deletion of your data with written confirmation, subject to legal retention

Test an export during the project, not when you are leaving. You need the data for CRA record-keeping for years after you stop using the system; see CRA record-keeping and cloud ERP. Quebec's Law 25 also gives individuals a right to portability of personal information in a structured, commonly used format, which your system should support.

4. Service levels and credits

Uptime commitment, how it is measured (monthly or yearly) and what is excluded (scheduled maintenance, third-party outages).
Support response times by severity, and the hours they apply to. Check whether support hours cover your time zone, especially in British Columbia or Atlantic Canada.
Service credits: usually a percentage of the monthly fee, often capped, and often your only remedy. Note the claim procedure and deadline.
Right to terminate for repeated SLA failures.
Disaster recovery: recovery time and recovery point objectives.

Illustrative example. A contract promises 99.5% monthly uptime. A 30-day month has 720 hours, so 99.5% allows about 3.6 hours of downtime. If the system is down for 8 hours during month-end, the vendor may owe a service credit of, say, 10% of the monthly fee, but nothing for the overtime your staff work. That is why SLA credits rarely compensate for business impact; resilience and clear escalation matter more.

5. Liability and indemnities

Liability cap: often limited to fees paid in the previous 12 months. Ask whether data breaches and confidentiality have a higher cap.
Exclusions: indirect and consequential losses are usually excluded.
Intellectual property indemnity: protection if a third party claims the software infringes its rights.
Insurance: vendors and partners may carry technology errors and omissions and cyber insurance; ask for certificates.

6. Data protection and sub-processors

Where data is hosted and backed up; notice of changes in location or sub-processors.
Security standards and independent audit reports available on request.
Incident notification timelines that let you meet PIPEDA and Quebec reporting duties.
Agreement terms that support a Quebec privacy impact assessment for communication outside Quebec.

See PIPEDA, Quebec Law 25 and data residency.

Governing law and language

Many standard SaaS agreements are governed by the law of a US state or another country, with disputes heard there. Ask whether a Canadian province's law can govern. In Quebec, the Charter of the French Language contains rules on the language of contracts, including standard-form (adhesion) contracts; check with your lawyer and see accessibility and French-language requirements.

FAQ

Do consumer-protection laws cover my business SaaS contract?

Generally not. Provincial consumer-protection acts mainly protect individual consumers. Business contracts are governed by their terms and general contract law.

Can I negotiate a standard SaaS agreement?

Often partly, especially for larger or multi-year commitments. Prioritise renewal caps, notice periods, data export and liability for data breaches.

What if the vendor is acquired or discontinues the product?

Look for clauses on end-of-life notice, continued support and transition assistance.

Is escrow relevant for SaaS?

Source-code escrow matters more for on-premise software. For SaaS, focus on data export and transition assistance.

Sources

Competition Bureau Canada — pricing representations in business dealings
Office of the Privacy Commissioner of Canada — contracts with service providers processing personal information
Office québécois de la langue française — language of contracts in Quebec
Canadian Centre for Cyber Security — questions to ask cloud service providers