Who Owns Your Data in a SaaS Service: Contract Checklist
Advanced4 minInnovialabs editorial team
In short
Your data should stay yours in writing: the contract must state that you own it, let you export it in an open format at any time, define what happens to it after cancellation and name where and by whom it is stored.
The short answer
In a well-written SaaS agreement the customer owns the data it uploads, and the provider only gets a limited licence to process it in order to deliver the service. But "well-written" is not guaranteed. Ownership, export and deletion are decided by the terms of service, the data processing agreement (DPA) and the privacy policy, and they differ a lot between providers.
Before you move customer lists, orders, finances or documents into any cloud service, read those documents with the checklist below.
What counts as "your data"
Contracts often split data into categories, and the split matters:
- Customer data: records you or your users enter or upload. This should clearly belong to you.
- Usage data and metadata: logs, clicks, performance metrics. Providers usually keep rights to these.
- Derived or aggregated data: statistics built from your data. Check whether the provider may use it, and whether it must be anonymised.
- Configuration: workflows, templates, custom fields, automations. Often overlooked, yet rebuilding them elsewhere can take longer than moving the records.
Watch for wording that lets the provider use your content to train models or improve products without an opt-out, or that grants a broad, perpetual licence.
Contract checklist
| Question | What a good answer looks like |
|---|---|
| Who owns the data? | Customer owns all customer data; provider has a licence only to provide the service |
| Can the provider use it for other purposes? | Only in anonymised, aggregated form, or not at all; AI training is opt-in or excluded |
| How can I export it? | Self-service export or API, at any time, in open formats (CSV, JSON, XML), including attachments |
| What happens after cancellation? | A defined grace period to export, then deletion within a stated time, with confirmation on request |
| Where is it stored? | Named regions or countries; notice before relocation |
| Who else processes it? | A published list of subprocessors and notice of changes |
| What about backups? | Stated backup retention and how deletion applies to backups |
| What if there is a breach? | Notification within a defined time and a description of the provider's duties |
| What if the provider shuts down or is acquired? | Export rights survive; data is not transferred under worse terms |
Export: test it, do not trust it
An export clause is only useful if the export is complete and usable.
- Run a test export during the trial, not on the day you leave.
- Check that it includes relations (which order belongs to which client), attachments, history and custom fields.
- Prefer open, documented formats. A proprietary backup file that only the same service can read is not a real exit route.
- If the volume is large, check API rate limits: a slow API can make migration take weeks.
Retention after cancellation
Two risks pull in opposite directions:
- Data deleted too fast: you miss a payment, the account is closed, and records are gone before you export them.
- Data kept too long: personal data of your clients stays with a provider you no longer work with.
A good contract defines both: a grace period for export after the end of the subscription, and a deletion deadline after it, including backups.
Storage location and subprocessors
Storage location matters for legal compliance, not just speed. Many countries, including Uzbekistan, have rules on processing and localising personal data of their citizens. Before choosing a service, check the requirements that apply to your business with a lawyer, and confirm the provider can meet them.
Subprocessors are third parties the provider uses: hosting, email delivery, payment processing, support tools, AI services. Your data travels to them too. Ask for the list and for notice when it changes, ideally with the right to object.
Exit clauses and lock-in
Lock-in is not only technical. Check:
- Notice periods and auto-renewal terms.
- Whether export is available on every plan or only on expensive ones.
- Whether the provider offers migration assistance and at what terms.
- Whether you can terminate if the provider materially changes the terms or moves data to another jurisdiction.
Common mistakes
- Reading only the main terms and skipping the DPA and subprocessor list.
- Discovering at exit that export covers records but not files or history.
- Keeping the only copy of critical data inside a single SaaS service.
- Letting employees connect services on personal accounts, so the company does not control the data at all.