What are my rights if a SaaS vendor changes security standards mid-contract

If a SaaS vendor lowers security standards mid-contract, you may have grounds for a breach of contract claim. Your rights depend on whether your agreement includes a 'non-diminution of security' clause, requires prior notice for changes, or mandates adherence to specific industry certifications like SOC 2 or ISO 27001.

Understanding Your Contractual Baseline

Most SaaS agreements contain a 'Security' or 'Data Protection' section. You must determine if your contract treats security as a static obligation or a dynamic one. If the contract references specific security standards (e.g., 'Vendor will maintain ISO 27001 certification'), the vendor cannot unilaterally abandon that standard without breaching the agreement.

Key Contractual Protections to Look For

• Non-diminution clauses: Language stating that security measures will not be materially reduced during the term.
• Change management requirements: Provisions requiring 30 to 90 days' notice before any material change to security protocols.
• Certification mandates: Explicit requirements to maintain specific industry standards (SOC 2 Type II, HIPAA, GDPR compliance).
• Right to audit: Your ability to request documentation proving the vendor still meets the agreed-upon security posture.

Key takeaway: If your contract is silent on security changes, the vendor may argue they have the right to update their 'standard' security practices. Always check the 'Changes to Services' section for broad, vendor-friendly language.

Action Item: Locate your Master Services Agreement (MSA) and search for the word 'security' or 'compliance.' Identify if the vendor has the right to update their security policy at their 'sole discretion.'

Assessing Materiality of the Change

Not every change is a breach. Courts generally look for 'materiality.' A change is material if it significantly increases your risk profile or renders you non-compliant with your own regulatory obligations.

Steps to Take When Standards Drop

1. Document the change: Save copies of the old security policy and the new one.
2. Issue a formal notice: Send a written inquiry asking how the change impacts your specific data protections.
3. Invoke the 'Cure' period: If your contract has a 30-day cure period, formally notify the vendor that the change constitutes a breach and demand a return to the previous standard.
4. Consult counsel: If the change puts your company in violation of GDPR, HIPAA, or CCPA, you may have grounds for immediate termination.

Action Item: If you identify a material downgrade, send a formal 'Notice of Non-Compliance' to the vendor's legal department immediately to preserve your rights.

Leveraging Regulatory Compliance

If your vendor is subject to specific regulations, they cannot unilaterally lower security standards if doing so would cause you to violate your own legal obligations. For example, if you are a healthcare provider, your vendor must maintain HIPAA-compliant safeguards. If they downgrade security, they are effectively forcing you into a regulatory violation.

Red Flags in Vendor Security Policies

• Language stating 'Vendor may update security measures at any time without notice.'
• Removal of specific audit rights or reporting requirements.
• Vague references to 'industry standard' rather than specific, measurable frameworks.
• Exclusion of liability for security-related service level agreement (SLA) failures.

Key takeaway: Regulatory requirements often override contract language. If the vendor's new security posture violates a law applicable to your industry, the contract's 'sole discretion' clauses may be unenforceable.

Action Item: Review your Data Processing Agreement (DPA) alongside your MSA. The DPA often contains more granular security requirements that the vendor cannot easily bypass.

Proactive Risk Mitigation

The best time to address security downgrades is during contract renewal or negotiation. Ensure your future contracts include a 'Security Continuity' clause that prevents the vendor from reducing security standards without your express written consent.

TermScore can automatically analyze your existing contracts to identify whether you have adequate protections against mid-contract security downgrades. By flagging missing 'non-diminution' clauses and highlighting vendor-friendly 'sole discretion' language, TermScore helps you understand your risk exposure before a breach occurs.