Software, SaaS and Cloud Agreements: Questions and Answers

Software delivery is assessed not merely by showing a working link, but by the transfer of the functions and administrative authorities specified in the contract.

In a software project, the scope document, acceptance tests, data sets, administration panel, user roles, repository access if transfer of the source code has been agreed, and third-party platform accounts are checked separately. A working demo or a screenshot does not always prove that independent use and operational control have been delivered. The difference between the test environment and the production environment, the defect-remediation process and the acceptance record must be examined according to the provisions of the contract. Evidence should be collected in an objective and re-verifiable manner.

Failure to transfer data and account administration authorities may prevent independent use of the service or its migration to another provider.

In a cloud service, the domain name, administrator account, access keys, user permissions, data export, backups, workflows, integrations and license relationships should be expressly listed in the delivery plan. If a third-party platform service is used, the contractual usage rights and the provider’s terms are examined. An administrator account remaining in the hands of a single person may limit the business owner’s technical control. Data security and KVKK obligations should be addressed together with the account transfer.

Delivery of the source code, a transfer of economic rights and a usage license do not automatically mean the same thing; they must be regulated separately in the contract.

The software’s nature as a work, by whom it was developed, the licenses of third-party libraries and the parties’ intentions regarding economic rights are assessed separately. Being given access to the source code repository may not mean that all intellectual property rights have been transferred; conversely, a license may have granted sufficient operating authority. Development, modification, sublicensing, reproduction, duration and geographic scope should be written clearly. The license terms of open-source components and trade secrets should also be checked.

The outcome depends on the definition of delivery in the contract and the source code obligation.

The executable product, source code, test results, administrator access, technical documentation and acceptance criteria may have been regulated as separate delivery items. Actual use is not conclusive proof that all obligations have been performed.

The return and deletion of data should be regulated in accordance with the contract and the KVKK retention and destruction obligations.

The exit plan, export formats, backups, sub-processors and legal retention obligations are examined. Sudden deletion without the return of data may create operational and legal risk.

Documents should not be transferred to an external service without ensuring professional secrecy, data security and a lawful basis for processing.

The scope of the data, its transfer to a third-party cloud artificial intelligence platform, cross-border data transfer, masking and contractual confidentiality provisions are examined. Special categories of personal data require strong protection in addition.