Cloud Service Agreement
This Cloud Service Agreement (the "Agreement") is made on Effective date between Provider (software company), of Provider address ("Provider"), and Customer (business), of Customer address ("Customer").
1. Order form
This section sets the commercial terms. If it conflicts with a later section, this section controls.
- Product: Product name
- Description: What the product does
- Subscription start date: Subscription start date
- Initial subscription period: Initial subscription period (months) months
- Number of users: Number of users included
- Subscription fee: Subscription fee, with currency, billed Billing frequency (monthly, quarterly, or yearly)
- Payment due: Days to pay an invoice days after the invoice date
- Taxes: taxes are extra, as section 5 says
- Renewal: the subscription renews automatically for periods equal to the initial period, unless a party gives notice under section 6 at least Days of notice to stop automatic renewal days before the period ends
- Renewal price increase: at most Highest renewal price increase (percent) percent
- Availability target: Monthly availability target (percent) percent each month
- Support: Support hours (days and times), with a first response within First support response within (hours) hours
This agreement is adapted from the Common Paper Cloud Service Agreement (commonpaper.com), used under CC BY 4.0.
2. Subscription and access
Provider gives Customer a non-exclusive, non-transferable right to access and use the Product during the subscription period, for Customer's internal business use, for up to the number of users in section 1. Customer may add users at a price that the parties agree in writing.
Each user has a personal login. Users may not share logins. Customer is responsible for its users, keeps their login details secure, and tells Provider promptly of any unauthorised use.
Provider may update and improve the Product. Provider will not materially reduce its core functions during the subscription period.
Provider may use data about how the Product is used (but not Customer Data) to run, secure, and improve the Product. Provider keeps that data in a form that does not identify Customer or any person.
3. Restrictions
Customer will not, and will not let anyone else:
- copy, modify, or make derivative works of the Product
- reverse engineer the Product, except where the law allows it despite this clause
- sell, rent, sublicense, or offer the Product to third parties as a service
- use the Product to build a competing product
- bypass usage limits or security controls, or test the Product's security without Provider's written consent
- upload unlawful content, malware, or data that the order form or Provider's documentation says is not allowed
- use the Product with more users than section 1 allows
Customer will use the Product as Provider's documentation describes.
4. Customer data and licences
Customer Data means the data and content that Customer or its users put into the Product. Customer owns Customer Data.
Customer gives Provider a limited licence to host, copy, and process Customer Data only to provide the Product and support to Customer, and as the law requires.
Provider and its licensors own the Product and all intellectual property in it. This agreement gives Customer only the access right in section 2. Provider may use suggestions and feedback from Customer without charge or duty.
5. Fees and taxes
Customer pays the fees in section 1 in the currency stated there. Provider invoices Customer. Fees are not cancellable and not refundable, except as this agreement says.
Fees do not include taxes. Customer pays all sales, value added, goods and services, and similar taxes on the fees, except taxes on Provider's income. If the law requires Customer to withhold tax, Customer deducts only that amount, pays it to the tax authority, and gives Provider the official receipt.
If Customer disputes an invoice in good faith, it tells Provider in writing before the payment is due, pays the undisputed part on time, and the parties work to settle the rest within 15 days. Overdue undisputed amounts carry interest at 1 percent a month until paid, or the highest rate the law allows if lower.
Provider tells Customer of any fee increase for a renewal period in writing before the last day for notice under section 6. The increase will not go above the cap in section 1.
6. Term and renewal
This agreement starts on the effective date and continues through the initial subscription period and any renewal period, until it ends under section 14.
At the end of the initial period, and of each renewal period, the subscription renews automatically for a period of the same length, unless either party gives the other written notice of non-renewal at least Days of notice to stop automatic renewal days before that period ends. Non-renewal ends the subscription at the end of the current period. Customer keeps access until then.
7. Support and availability
Provider gives support during Support hours (days and times), by email or through its help channel, and replies to each request within First support response within (hours) hours.
Provider aims to keep the Product available at least Monthly availability target (percent) percent of each calendar month. This does not count planned maintenance that Provider announces at least 48 hours ahead, downtime that Customer causes, or events outside Provider's control.
If availability falls below the target in a month, Customer may ask in writing, within 30 days, for a service credit of 5 percent of that month's fee for each full percentage point below the target, up to 50 percent. Provider applies the credit to the next invoice.
If Provider misses the target in three months of any six, Customer may end this agreement by written notice and receive a refund of prepaid fees for the unused period. The credit and this right are Customer's only remedies for poor availability.
8. Security and personal data
Provider keeps administrative, technical, and physical safeguards that are reasonable for the data it holds. These include encryption of Customer Data in transit, access controls, regular backups, and confidentiality duties for its staff. Provider tells Customer without undue delay, and within Security breach notice within (hours) hours, after it confirms a security breach that affects Customer Data.
If Customer Data includes personal data, Provider processes it only as the separate Data Processing Agreement between the parties allows. That agreement forms part of this agreement. If it conflicts with this agreement on personal data, it controls.
Customer will not put into the Product data that the law does not allow it to share with Provider.
9. Confidentiality
Confidential information means non-public information that one party gives the other in connection with this agreement, if it is marked confidential or a reasonable person would treat it as confidential. Customer Data and the terms of this agreement are Customer's and Provider's confidential information respectively, as they apply.
The party that receives confidential information will:
- use it only to carry out this agreement
- share it only with staff, advisers, and subcontractors who need it and who owe similar duties of confidentiality
- protect it with at least reasonable care
These duties do not apply to information that is public through no fault of the receiving party, that it already had or develops independently, or that it receives lawfully from a third party. A party may disclose information that the law, a court, or a regulator requires, after it tells the other party where the law allows.
These duties last during this agreement and for 3 years after it ends. For trade secrets and Customer Data, they last as long as the information stays confidential.
10. Warranties and disclaimers
Each party confirms that it has the right to enter into this agreement and will follow the laws that apply to it when it provides or uses the Product. Customer confirms that it, its users, and anyone who adds Customer Data have the rights needed to put that data into the Product and to allow its use under this agreement.
Provider warrants that it will provide the Product with reasonable skill and care, that the Product will perform materially as Provider's documentation describes, and that Provider will not knowingly put malware into the Product.
If the Product does not meet this warranty, Customer tells Provider in writing within 45 days after it finds the problem, with enough detail to repeat it. Provider then has 45 days to fix it. If Provider does not, Customer may end the affected subscription and receive a refund of prepaid fees for the unused period. This is Customer's only remedy for a breach of this warranty. The warranty does not cover misuse, changes that Provider did not make, or products and services from anyone other than Provider.
Except as this section states, Provider provides the Product "as is". To the extent the law allows, Provider disclaims all other warranties, express or implied, including any warranty of merchantability, fitness for a particular purpose, and non-infringement. Provider does not warrant that the Product will be uninterrupted or error-free.
11. Limitation of liability
Each party's total liability under or in connection with this agreement is limited to the fees paid or payable for the Liability cap (months of fees) months before the event that gave rise to the liability. Neither party is liable for loss of profit, loss of revenue, or any indirect, special, or consequential loss, even if it knew they were possible. This applies to every legal theory, including negligence.
The cap and the exclusion in this section do not apply to:
- Customer's duty to pay fees
- a party's duties under section 12 (indemnity)
- a breach of section 9 (confidentiality)
- Customer's breach of section 3 (restrictions)
- fraud, gross negligence, or wilful misconduct
- any liability that the law does not allow a party to limit
12. Indemnity
Provider will defend Customer against any third-party claim that the Product, as Provider provides it, infringes that third party's intellectual property rights. Provider will pay the damages and costs that a court finally awards, or that Provider agrees in a settlement.
Provider has no duty under this section for a claim that comes from Customer Data, from combining the Product with items that Provider did not provide, from changes that Provider did not make, from use of an old version when a newer one would avoid the claim, or from use that breaks this agreement. If a claim is made or likely, Provider may get the right for Customer to keep using the Product, change the Product so that it does not infringe, or end the affected subscription and refund prepaid fees for the unused period.
Customer will defend Provider against any third-party claim that Customer Data, or Customer's use of the Product in breach of section 3, breaks the law or infringes a third party's rights. Customer will pay the damages and costs that a court finally awards, or that Customer agrees in a settlement.
The party that seeks a defence must tell the other party promptly in writing, let it control the defence and settlement, and give reasonable help at the other party's cost. The defending party may not settle a claim in a way that admits fault for the other party without its consent. This section states each party's only duty, and the only remedy, for these claims.
13. Suspension
Provider may suspend Customer's access, in whole or in part, if:
- Customer has not paid an undisputed amount within 30 days after it was due and Provider has given 10 days' written notice
- Customer's use threatens the security or availability of the Product for Customer or others
- Customer breaches section 3
- the law requires it
Provider will tell Customer before it suspends access where this is practical, and otherwise as soon as it can after. Provider suspends access only as much and for as long as it needs to. Provider restores access promptly when the cause ends. Fees continue during a suspension that Customer caused.
14. Termination and data export
Either party may end this agreement by written notice if the other party commits a material breach and does not fix it within 30 days after notice. Either party may end it at once by written notice if the other party becomes insolvent, or stops carrying on business without a successor. Customer may also end it under sections 7 and 10. Stopping renewal under section 6 is not a termination for breach.
When this agreement ends, Customer's right to use the Product ends and Customer pays all fees due up to the end date. Provider refunds prepaid fees for the unused period only when Customer ends this agreement for Provider's breach or under sections 7, 10, or 12.
For Days to export data after the agreement ends days after the end date, Customer may export Customer Data in a standard format, with the Product's export tool or by written request to Provider. After that period, Provider deletes Customer Data from its systems within 30 days, and confirms this in writing if Customer asks. Copies in routine backups may stay until the backups expire. Confidentiality continues for that data.
Sections 4, 5, 9, 11, 12, 14, and 16 continue after this agreement ends, as do any other terms that by their nature should.
15. General
- Changes to this agreement are valid only in writing signed by both parties.
- This agreement, with the Data Processing Agreement, is the whole agreement on its subject. It replaces earlier discussions and drafts. Terms in a Customer purchase order or vendor portal do not apply.
- If a court finds a term invalid, the other terms stay in force. A delay in using a right is not a waiver of it. A remedy is not exclusive unless this agreement says so.
- Features that Provider labels as beta are provided as is, and the warranty in section 10 does not cover them.
- Each party follows the anti-bribery laws that apply to it. Customer follows the export control and sanctions laws that apply to its use of the Product.
- Neither party may transfer this agreement without the other party's written consent, except to a successor that buys all or most of its business and that takes on this agreement.
- Neither party is liable for a delay or failure that comes from events outside its control, other than a duty to pay. If such an event stops the Product from working materially for 30 days in a row, either party may end the affected subscription by written notice. Provider then refunds prepaid fees for the unused period, and Customer still pays fees due up to the end date.
- Notices are in writing and go to the addresses above, or to an email address that a party gives for notices.
- The parties are independent. This agreement creates no partnership, agency, or employment.
- No one other than the parties may enforce this agreement.
- Neither party may use the other's name or logo in public without written consent.
- The parties may sign this agreement electronically and in counterparts.
- Each person who signs confirms that they may sign for their organisation.
16. Governing law and disputes
This agreement is governed by the laws of Governing law (country or state). The parties will first try to settle any dispute by talks between senior managers for 15 days. After that, the courts of Governing law (country or state) have exclusive jurisdiction.
Either party may ask a court at once for an order to stop a breach of section 3 or 9.
Signatures
Provider (software company)
Signature: ____________________________
Date: ______________
Customer (business)
Signature: ____________________________
Date: ______________