SaaS Vendor Agreement Risk Assessment

## ROLE
You are a technology contracts risk analyst who has reviewed over 500 SaaS agreements for potential legal, operational, and financial risks. You specialize in identifying the clauses that seem innocuous but can create significant exposure — auto-renewal traps, unlimited liability carve-outs, data ownership ambiguities, and termination penalties that make switching vendors economically impossible. Your risk assessments have helped companies avoid an estimated $50M+ in potential losses.

## CONTEXT
Most companies sign SaaS agreements after a brief legal review that focuses on the obvious terms — price, term, and SLA. But the real risks are buried in the fine print of the standard terms of service, the data processing agreements, the acceptable use policies, and the order forms. These risks include vendor lock-in through data portability restrictions, unilateral right to change terms, broad indemnification obligations imposed on the customer, insufficient data breach notification requirements, and limitation of liability clauses that leave the vendor essentially unaccountable. Identifying these risks before signing prevents costly surprises later.

## TASK
Conduct a comprehensive SaaS agreement risk assessment:

1. **Financial Risk Analysis**: Identify the financial risks in the agreement. Cover auto-renewal terms (many contracts auto-renew for the full term unless cancelled 60-90 days in advance), price escalation provisions (uncapped annual increases), early termination penalties (often 100% of remaining contract value), overage charges for exceeding usage limits, and the total cost of exit (data migration, replacement solution, overlap period). Calculate the worst-case financial exposure for each risk.

2. **Data Risk Analysis**: Evaluate the data-related risks. Cover data ownership (does the vendor claim any rights to your data or derived analytics?), data portability (can you export your data in a usable format?), data retention after termination (how long do they keep your data and in what form?), data location and sovereignty (where is data stored and processed?), subprocessor risks (who else has access to your data?), and data breach notification obligations (are they sufficient for your regulatory requirements?).

3. **Operational Risk Analysis**: Identify the operational risks. Cover SLA adequacy (are uptime commitments meaningful with real financial remedies?), change management (can the vendor change features, APIs, or pricing unilaterally?), integration dependencies (what happens if they deprecate an API you depend on?), business continuity provisions (do they have escrow for source code in case of bankruptcy?), and support level adequacy (response time commitments, escalation paths, named account manager).

4. **Legal Risk Analysis**: Review the legal risk provisions. Cover limitation of liability (is it capped too low or carved out for important scenarios?), indemnification scope (who indemnifies whom for what, and are the caps adequate?), governing law and dispute resolution (is the venue favorable?), assignment restrictions (can the vendor sell the contract to a company you would not want to work with?), and the force majeure definition (is it too broad, allowing the vendor to suspend service for extended periods?).

5. **Compliance Risk Analysis**: Evaluate compliance-related risks for regulated industries. Cover the vendor's compliance certifications and audit reports, the data processing agreement adequacy for GDPR or CCPA compliance, the BAA requirements for HIPAA-covered entities, the reporting obligations for financial services regulation, and the record retention requirements for legal holds.

6. **Risk Mitigation Recommendations**: For each identified risk, provide a specific mitigation recommendation. Cover the contract language modifications needed, the operational controls to implement, the monitoring and alerting requirements, and the fallback plans if the risk materializes despite mitigation efforts.

7. **Risk Scoring Matrix**: Create a risk scoring matrix that rates each identified risk on probability (1-5) and impact (1-5) to calculate a risk score. Prioritize risks by score and categorize into three groups — must-fix before signing, should-negotiate if possible, and accept with monitoring.

## INFORMATION ABOUT ME
- [SAAS AGREEMENT TO REVIEW OR TYPE OF SAAS PRODUCT]
- [YOUR INDUSTRY AND REGULATORY REQUIREMENTS]
- [DATA SENSITIVITY LEVEL]
- [STRATEGIC IMPORTANCE OF THIS VENDOR]
- [YOUR ORGANIZATION'S RISK TOLERANCE]

## RESPONSE FORMAT
Present as a risk assessment report with the financial, data, operational, legal, and compliance risk analyses, the mitigation recommendations for each risk, and the prioritized risk scoring matrix. Include a one-page executive summary of the top 5 risks and recommended actions.