Contract: License In Model VS SaaS Model

Transcription

1 Contract: VS Page 1 of 9 Copyright 2012 Raymond Areaux All Rights Reserved 1 one time fee (perpetual) viable option N/A (1) no leverage (perhaps some with maint/support fee stream) (2) source code license... likely not a deal 2 License Fee annual or other periodic fee : maint & support fees coupled w/license fees 3 seat/usage/ storage/ enterprise What is the base? (1) concurrent? (2) user logins? Enterprise: geographic? affiliates?, contractors?, consultants? 4 Maint & Support Fee typically priced separately and decoupled from license term typically built in and coupled with license term (1) part of the value proposition (2) vendor commitment in standard contract typically very weak (3) service levels/problem escalation in standard contract likewise very weak plenty of white wash not much substance start & report... NOT about when fixed

2 Contract: VS Page 2 of 9 Copyright 2012 Raymond Areaux All Rights Reserved 5 typical term length annual w/evergreen (perhaps multiyear initial term) varies (flexible) (1) evergreen: flinch time typically equal but many vendors open to unequal flinch time... which can favor You (assists with deconversion and migration) (2) early exits? (very custom) 6 7 Term/ Termination irrevocable license bankruptcy (Section 365) value depends on extent mission critical good practice any value? any value? (a): increased user risk (b) : present license grant with forbearance from production use (+ escrow?) + data backup... like a hot standy... but extra $$$ Issue: some vendors have no license in offering Data Backup is only self help Salesforce.com user download backup once every 6 days or once every 28 days (CSV; comma delimited dataset... and bring to competitor, e.g., SugarCRM) 8 Granting Clause (Use Rights) ( availability limits... but how different than in house license?) (1) Who? (2) What? (3) Where? (4) When? (5) How? (6) Vendor: shift risk to You for password/access authorization (7) Lasercomb issues (copyright misuse)

3 Contract: VS Page 3 of 9 Copyright 2012 Raymond Areaux All Rights Reserved 9 off the shelf 10 Function/ Features (not Access or Availability... see below) custom/mod limited warranty (focus is on limited ) test with business team!! Likely limited remedy (repair/replace) not sufficient Watchout for limited refunds or even weaker remedies See Trilogy Of Vendor Protection below Integration issues with Your other apps (1) gap analysis? RFP? (2) test with business team!! Likely limited remedy (repair/replace) not sufficient Watchout for limited refunds or even weaker remedies See Trilogy Of Vendor Protection below (3) acceptance : contract admin vs legal...a milestone payment (4) testing protocol AND NOT TESTING FOR VENDOR BENEFIT!! Unit testing? Integration Testing? System Testing? Formal ready notice and good timeline (5) r&w not branch (so, will remain standard program product)

4 Contract: VS Page 4 of 9 Copyright 2012 Raymond Areaux All Rights Reserved 11 Access/ Availabilty access/available warranty or remedy N/A service levels a most difficult negotiation: effective service level remedies. Drivers: (1) length of term? (2) conversion/investment? (3) mission critical? (4) shelf life of Your product pricing models? Availability: 24X7 vs Your business hours 99 vs 99.9 vs vs = more than THREE real business hours EVERY WEEK Standard vendor promise is layered in defintions: available scheduled downtime unscheduled downtime, etc. Standard credit: not making You whole... You want something to incentivize good performance... credits are like liquidated damages so take into account Your soft costs: Your customer goodwill/user confidence/moral, etc.... but, in the end, You want strong incentive for vendor to perform Response: start (not fix)... reporting (not fix) Escape Hatch: pain threshold ( % below credit threshold OR chronic problem)... but, is remedy extraordinary (termination) OR suspension of payment OR option as to both

5 Contract: VS Page 5 of 9 Copyright 2012 Raymond Areaux All Rights Reserved Data loss/ corruption/ damage database breach (security, privacy & confidentiality of data) estimate $200/record? 10K records =$2,000, bankruptcy/ insolvency subsumed in functional warranty? (e.g., warn You to backup, etc.) N/A two flavors: app caused hosting caused Your liability and other risk from Vendor fault N/A?? (1) You need real warranty and indemnity (2) backup? cost increase for You control: positive for You realtime/sync (1) DB breach notify statutes State: private right of action remedies AND civil fines Fed (HITECH/HIPAA/HHS; FTC; FCC; GLB; Other?) civil fines (2) encryption: data at rest? data in transit? (3) Master Database: normalized data?? (4) What do You want from vendor?... some (not exhaustive) background checks e/ees and subs take responsibility: full indemnity for employees and subcontractors (and approval of subs) perhaps different standard as to third party hacks for cost of notification irrespective of breach source Where is data located? US? Overseas? SSAE 16 SOC 1 & perhaps 2 (1) backup? (see rows 6 &7) cost increase for You control: positive for You realtime/sync

6 Contract: VS Page 6 of 9 Copyright 2012 Raymond Areaux All Rights Reserved 15 Conversion/ Deconversion data control on deconversion See rows12, 13 & Customization See comments above Trilogy of Vendor Protection FIRST: full disclaimer SECOND: waiver of consequential damages 19 THIRD: cap on liability 20 Regulatory (clear the slate... and then give very, very limited warranty... typcially repair/replace) exclude Your indemnity exclude Your indemnity (but more indemnity due to data hosting) look through/ regulatory oversight See comments above as to testing with business team Nice for You: fit for its intended purpose Cautious of limitations to vendor literature best to have a list of function/features important to You database breach and/or confidentiality excepted from waiver on condequentials? negotiations over multiplier and the base database breach excepted from cap? confidentiality excepted from cap? You: negate Your promises...notwithstanding anything, not bound to any promises if need to observe or comply with regulations Post term regulatory compliance clause not as powerful without license in or escrow Vendor subject to regularoty oversight You get promise for vendor as to such

7 Contract: VS Page 7 of 9 Copyright 2012 Raymond Areaux All Rights Reserved 20 Confidentiality 21 vendor product features/ business info/ Ts&Cs of contract (gag order on contract) (NOT data see rows 12,13 & 14) IP see ppp Same plus some additional as to the Host Environment : in some ways less practical exposure since some forms of application not accessible not holding as much of the Vendor s family jewels Protected (and not just that product does not infringe but also that use of product by you and yours does not infringe); control of Vendor remedies 22 Indemnity/ Database Breach N/A see row Insurance Confidentiality (NOT Data) 24 virus/malware insurance special coverage Except from damage cap? Except from consequential damages waiver?... but probably different risk profiles even though clauses are : cyberpolicy? E&O? Named insured on vendor policies

8 Contract: VS Page 8 of 9 Copyright 2012 Raymond Areaux All Rights Reserved 25 IP ownership of innovations 26 Dispute Process Discovery (including e discovery) Audit Arbitration? not typically an issue with offthe shelf (perhaps with custom/mods) database breach claims by third parties different due to Vendor with Your data Required... but, in, Vendor may have more access to Your innovations but perhaps same as vendor access via maint in modela two party limits on discovery (including e discovery) dispute local confidentiality no jury database breach third party whose PI/PHI was disclosed choices to make Control? What of lawsuit involving Vendor but not You? If Your lawsuit, some vendors want you to pay for Vendor to respond to subpoena/discovery. Additional cost to You of Vendor with Your data SSAE 16 SOC 1 & perhaps 2 Other audit rights? problematic because of access think about the other users who want same thing

9 Contract: VS Page 9 of 9 Copyright 2012 Raymond Areaux All Rights Reserved 29 Force Majeure?? Scrutinize any FM as backdoor outs from service levels What is Your expectation of control within reason and, related, disaster recovery , v. 5