Enterprise order form and master subscription agreement

When a software business starts selling to enterprises, the click-through terms stop being enough: the customer's procurement team wants a signed agreement, a security schedule, an order form for each purchase and a set of liability terms it can approve. A master subscription agreement is the framework that every order form sits under, and it has to be drafted for negotiation, with the positions the supplier can hold and the ones it can concede already worked out. I draft that agreement and its order form for a fixed fee of £995, delivered in five working days.

Who this is for

SaaS businesses in England and Wales moving from self-serve terms to signed enterprise contracts, who need a master agreement they can send to a large customer's legal team as the starting point, with an order form that captures each deal.

What matters in an enterprise master subscription agreement

The document structure and what prevails

The agreement should sit at the top of a defined set: the master terms, order forms for each subscription, a data processing schedule with the terms Article 28 of the UK GDPR requires, a service level schedule and a security schedule, with an order of precedence that says which document wins on conflict and that an order form may vary the master terms only where it says so expressly. Purchase order terms the customer sends later should be excluded, because an enterprise's purchasing system will send them regardless.

The service description, changes and the customer's obligations

The agreement should describe the service by reference to documentation the supplier controls, allow the supplier to improve and change it without materially reducing functionality during a paid term, and set the customer's obligations: authorised users, acceptable use, its own systems and connectivity, the lawfulness of its data, and cooperation on implementation. Under section 13 of the Supply of Goods and Services Act 1982 the service must be performed with reasonable care and skill, and the documentation defines what that means for the product.

Security, audit rights and certifications

Enterprise customers ask for audit rights, and the agreement should offer what the supplier can deliver: a security schedule describing the controls, third-party certifications or reports made available on request under confidentiality, an annual security questionnaire, and an audit right limited to where a report does not answer a regulator's or the customer's reasonable question, on notice, at the customer's cost and without access to other customers' data. Security under Article 32 of the UK GDPR and breach notification under Article 33 belong in the data processing schedule, cross-referred rather than repeated.

Fees, uplifts, renewals and payment

The order form should state the fees, the billing frequency and the initial term, and the master terms should provide for renewal for successive terms unless notice is given by a stated date, a price uplift on renewal capped at a percentage or an index, fees exclusive of VAT, interest on late payment under the Late Payment of Commercial Debts (Interest) Act 1998, and suspension for non-payment after notice. Enterprise customers ask for price protection and a right to reduce users at renewal, and the agreement should say what the supplier's position is on each.

Liability, indemnities and insurance

The cap should be the fees paid in the twelve months before the claim, with a higher cap for data protection and confidentiality breaches where the customer insists and the supplier's insurance supports it, consequential loss excluded, and liability for death or personal injury, fraud and the IP indemnity uncapped or capped separately. As negotiated terms, the reasonableness test in section 3 of the Unfair Contract Terms Act 1977 has less bite than in standard terms, but section 11 still applies, and a cap the supplier can explain by reference to its insurance is the one that holds. The supplier's IP indemnity and the customer's data indemnity should be mutual in structure.

Termination, transition and the end of the contract

The agreement should provide termination for material breach after a cure period and for insolvency, drafted within section 233B of the Insolvency Act 1986 for the supplier, and should resist termination for convenience during a paid term or price it. On exit the customer needs an export period for its data in a usable format and the supplier needs a deletion date after it, with transition assistance at the supplier's rates if wanted. Third-party rights are excluded under section 1 of the Contracts (Rights of Third Parties) Act 1999 with a carve-out for the customer's group where affiliates may order.

What it costs

SaaS terms of service, £995. Your standard customer-facing terms. Five working days.

Buying online forms the engagement on payment. The scope is what the saas and technology contracts page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A bespoke contract drafted for how your product is sold, delivered and supported
• Service levels you can meet, with remedies that are proportionate rather than aspirational
• A liability position that is defensible and will survive enterprise procurement
• IP and data provisions that fit together rather than contradicting each other
• A commercial note on where you will get pushback and what is worth conceding
• One round of amendments

What is not included

• Negotiating individual enterprise deals, which I quote separately
• Advice on the law of jurisdictions outside England and Wales
• Technical security certification or audit
• Regulatory advice for regulated sectors such as financial services or health

Questions I am often asked

The customer's legal team has sent back our agreement with forty comments. Is that normal?

For an enterprise, yes, and the agreement is drafted so that most of the comments are on numbers rather than structure. The note that comes with it says which positions to hold and which to concede.

Can affiliates of the customer buy under the same agreement?

The agreement can allow group companies to sign order forms under it, with each affiliate liable for its own orders or the parent guaranteeing them. The third-party rights clause is drafted to permit that.

The customer wants an uncapped indemnity for data breaches. What do we do?

Offer a separate, higher cap for data claims that your insurance supports rather than an uncapped indemnity. Most procurement teams accept a defined number; the agreement is drafted with that position ready.

Related guidance and services

• SaaS and technology contracts, £995, the service this page describes
• Contract review, £495
• Data protection agreements and privacy terms, £795
• SaaS terms of service for a B2B product
• Reviewing a master services agreement from an enterprise customer

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.