Home › SaaS Resources

SaaS Company Trust Documents: What to Read and What They Mean

A SaaS company is a business whose product is hosted software. Because you will put work and data into that product, the documents the company publishes are part of what you are buying. This guide explains each one in plain terms and what to look for.

Terms of service

The terms are the contract for ordinary customers. Look for how long the commitment lasts, how renewal works, what the vendor may change and with what notice, what you may not do with the service, and how either side can end the relationship. Also look for who owns the content you put in. A fair set of terms is specific and readable.

Privacy policy

The privacy policy explains what personal information the company collects, why, who it is shared with, and how long it is kept. It should describe how a person can ask to see or delete information. If you plan to put customers' personal information into the product, read this together with any data processing terms the vendor offers.

Data processing terms

Business customers often ask for an addendum that spells out how the vendor handles personal data on their behalf. It typically covers purpose limits, security measures, the use of sub-processors, and what happens to data when the contract ends. Ask whether the vendor has a standard version available, and have your legal adviser review it where the data is sensitive.

Service commitments

Some vendors publish an uptime or service commitment, sometimes with a remedy such as a credit when it is missed. Read what counts as downtime, how it is measured, how to claim, and what exclusions apply. A modest commitment that is clearly worded is better than a bold one with large exclusions.

The status page

A status page shows whether the service is working right now and keeps a history of past incidents. The history is the valuable part. Look at how incidents are described: Are they explained in plain terms, with a time and a cause? Are follow-up notes posted? Honest reporting is a mark of a company that takes reliability seriously.

The security page

A security page describes how the company protects customer data. Look for specifics: how sign-in is protected, how data is encrypted, how access by staff is limited, how vulnerabilities are handled and reported. Be wary of pages that offer only badges and general reassurance. If you need more detail, ask for it in writing.

The sub-processor list

Vendors often use other services to run theirs: hosting, email, payments. A sub-processor list names them. Check that it exists and ask how the vendor tells customers about changes to it.

A reading routine that takes under an hour

1. Skim the terms for term, renewal, change and exit.
2. Read the privacy policy for what is collected and shared.
3. Look at the status history for the last several months.
4. Open the security page and note anything specific.
5. Write down anything unclear and ask the vendor.

When the documents cannot answer your question

Published pages describe a general promise. If your situation is unusual, such as regulated data or a special location requirement, you need a conversation and probably a written agreement. Treat the documents as a starting point for that talk.

Example: a clinic reads a booking vendor's documents

A small clinic is choosing a booking tool. Staff read the terms and see that the vendor may change features with thirty days of notice, but the clinic's data remains its own and can be exported at any time. They read the privacy policy and note that appointment details are described as customer data, not used for the vendor's own marketing. The status page shows three incidents in the past year, each explained with a time and a fix.

None of this proves the product will be flawless. It does show a company that writes specific commitments and reports problems openly, which is exactly the behavior a clinic would want from a business holding patient scheduling information.

Red flags in vendor documents

• Terms that can change at any time without notice.
• A privacy policy that does not say who receives your data.
• A security page made only of logos.
• No way to see past incidents.
• No named contact or address for legal or privacy questions.

One of these is a question to ask; several together are a reason to look elsewhere.

Questions to send to a vendor's privacy contact

• Where is customer data stored, and can I choose?
• Which other companies process it on your behalf?
• How long do you keep it after I cancel?
• How do I request that it be deleted or exported?
• How will you tell me if there is a security incident that affects me?

A short, specific reply is the sign you hope for. If a vendor has no privacy contact at all, consider that an answer.

Next steps

See how one company publishes two of these: its terms of service and privacy policy. Related reading includes enterprise security reviews, the compliance gate as one vendor's description of its own publishing check, and the glossary entry on compliance.

Updated October 2026