Data Ownership

What is data ownership?

Data ownership is the part of a SaaS contract that says who holds the rights to the data in the service. In business software, the contract often says you own your data and the vendor does not.

That sounds settled, but ownership alone tells you little. To run the service, the vendor needs permission to store, copy and process your data. You give that permission through a license. The license, not the ownership line, decides what the vendor can actually do.

Think of it like renting out a room in a house you own. You still own the house. What the tenant may do depends on the lease.

Three things often sit around the ownership clause:

• A statement that you own your customer data.
• A license from you to the vendor to use that data.
• Carve-outs where the vendor owns things, such as usage data, aggregated data or your feedback.

What it looks like in a vendor's terms

A typical clause reads like this:

As between the parties, Customer owns all rights in Customer Data. Customer grants Provider a worldwide, non-exclusive license to host, copy, process and display Customer Data as needed to provide the Services. Provider owns all Usage Data and Aggregated Data.

• "As between the parties": the vendor is not promising that you own the data against the world, only that it does not claim it from you.
• "As needed to provide the Services": the license purpose. This is the most important limit on the page.
• "Provider owns all Usage Data and Aggregated Data": the carve-outs, where the vendor keeps the rights.

Atlassian's Customer Agreement is a clean example. Section 13 says "Customer owns all intellectual property and other rights in Customer Data."

A real change we caught

Venpo flagged this change: Bolt now claims ownership of your customer data. Bolt's June 2026 Merchant Terms of Use say that, although merchants keep their own data, Bolt has sole ownership of the data and accounts of end users who transact through its platform. The same update turned the merchant's data license into a perpetual, irrevocable one. A claim like this reverses the more common pattern, where the business keeps its data and the vendor gets only a license. For a related shift, see Ramp says you own its AI output and carry the risk if it infringes.

Why it matters to you

If a vendor owns data you consider yours, you may lose control over how it is used, shared or kept. You may also be breaking promises you made to your own customers about their data.

Even when you keep ownership, a broad license can let the vendor use your data for things you did not expect, such as building new products or training AI. And if the license is "perpetual" or "irrevocable," it may survive after you leave.

What to check

• Whether the contract says you own your customer data, and how customer data is defined.
• The scope and purpose of the license you give the vendor.
• Whether the license is perpetual, irrevocable, sublicensable or transferable.
• Which kinds of data the vendor claims to own, such as usage data, aggregated data or AI output.
• Whether you can get your data back and have it deleted when you leave. See data export and portability.

License to Customer Data

The license to customer data is the permission you give a vendor to use your data. Without it, the vendor could not store or process anything. With a broad one, it can do far more than run your account.

A narrow license is tied to a purpose. Salesforce's Main Services Agreement grants a "worldwide, limited-term license to host, copy, use, transmit" your data, limited to providing and running the services.

A broad license adds rights that outlast the contract or reach other uses. Zoom's terms of service grant Zoom "a perpetual, worldwide" license over customer content, but limit it to listed permitted uses. The same section says Zoom does not use your audio, video or chat content to train AI models.

Watch for words that widen a license: perpetual, irrevocable, sublicensable, "to improve or develop" products, and "for any purpose." Each one gives the vendor more room. A license can also widen through a later update to the terms, which is why changes to this clause are worth tracking.

Feedback Clause

A feedback clause gives the vendor rights to any ideas, suggestions or bug reports you send. Many say the vendor can use them freely, without paying you or giving you credit.

Some take a license. Salesforce's MSA asks for a "worldwide, perpetual, irrevocable, royalty-free license" to your feedback. Others claim ownership outright. Zoom's terms say "Zoom owns, and Zoom shall retain ownership of" all rights in feedback. Atlassian's agreement says it may use feedback "without restriction or obligation."

This matters if you share product ideas, workflows or code with a vendor's team. Once it counts as feedback, you may not be able to stop the vendor from building it into its product.

Check how feedback is defined, and keep confidential or valuable ideas out of support tickets, surveys and calls.

How Venpo helps

Venpo monitors your vendors' terms of service, DPAs and AI terms and emails you when ownership, license or feedback wording changes. Each alert says what changed and why it matters, and the Fine Print Scan shows whether a vendor trains AI on your data.