Founding a SaaS Company in Germany: Legal Advice

The choice of legal form is one of the first and most consequential decisions when founding a company in Germany. It determines how liability risks are distributed, what obligations exist toward authorities and shareholders, and how the company presents itself to customers, partners, and potential investors. Various options are available to SaaS founders, each with its own advantages and disadvantages. Which legal form is suitable for a given SaaS company must always be assessed on a case by case basis.

Partnerships such as sole proprietorships or the GbR (a German civil law partnership) stand out for their straightforward formation requirements and low administrative burden. They are particularly suited to an early entry into self-employment but come with extensive personal liability that can also extend to the founders’ private assets. For a growing SaaS company seeking to raise capital or scale, however, these forms quickly reach their limits.

Corporations, by contrast, offer a clear separation of liability between company assets and private assets. The GmbH (a German limited liability company) is the established standard form in this area and enjoys broad acceptance in German business dealings. Its higher formation costs and the required share capital can present a hurdle for founders in the early stages. In that case, the UG (haftungsbeschränkt), a German entrepreneurial company with limited liability, offers a lower threshold entry point with a comparable liability structure, though with some drawbacks in terms of standing with professional business partners.

For companies where tax planning options or the involvement of external investors play a role from the outset, hybrid structures such as the GmbH & Co. KG or the UG & Co. KG (limited partnerships combining a corporation with a partnership) can be worthwhile. They allow for flexible equity structures but require considerably more organizational effort. The optimal legal form results from the interplay of several factors: the number of founders, the available start up capital, planned financing rounds, and the strategic direction of the company. Legal advice obtained at this early stage lays the foundation for a decision that will support the company over the long term.

Standard template agreements are often insufficient for SaaS companies. Provisions on the shareholder structure and respective voting rights, on vesting arrangements for founder shares, and on rights of first refusal and drag along or tag along obligations in the event of an exit are particularly important. Vesting arrangements are intended to ensure that a founder who leaves the company early does not permanently share in the fruits of the remaining founders’ work. A vesting period of four years with a one year cliff, after which one quarter of the shares first become vested, is common. Beyond this, the articles of association should include provisions for typical conflict scenarios, such as deadlock situations in the event of a tied vote or how to handle a shareholder who no longer fulfills their obligations. Such provisions should be anchored in the articles of association or a supplementary shareholder agreement from the outset, rather than being addressed only once a conflict has already arisen.

The source code of a SaaS product enjoys copyright protection as a computer program under Sections 69a et seq. of the German Copyright Act (UrhG). What matters, however, is who holds this copyright, a question that is often not adequately clarified during the founding phase. If founders develop code before the company is formally established, the copyright remains with the individual founder personally. To avoid later conflicts during investment rounds or an exit, the company should be granted an exclusive right to use the code, ideally as part of the founding documentation.

A question frequently underestimated in practice is which copyright related usage rights are actually required on the customer side under a SaaS agreement. Relevant in this context can be the right of reproduction under Section 69c No. 1 UrhG and the right of making available to the public under Section 69c No. 4 UrhG. Whether and under what conditions these rights are affected is not assessed uniformly in case law and legal literature. Precisely because of these unresolved questions, an explicit contractual provision on usage rights is strongly recommended for both parties. This helps prevent disputes over the scope of the rights granted from arising in the first place.

Where developers are employed as staff, usage rights to their work product transfer to the employer under Section 69b UrhG, provided the computer program was created in the performance of their duties or on the employer’s instructions. This does not apply to freelancers: absent an explicit contractual assignment of rights, all usage rights remain with the developer, regardless of whether the developer was compensated for the work. Corresponding clauses providing for the complete transfer of rights should therefore be included in every freelancer agreement.

In addition, the use of open source components must be carefully reviewed. Certain licenses, in particular the GPL, contain so called copyleft clauses that can require the entire resulting code base to be published under the same license terms. This can have significant consequences for commercial SaaS products if proprietary source code would have to be disclosed as a result. An early review of the licenses used, including those of libraries and third party components, is therefore essential.

Beyond copyright, SaaS founders should assess early on whether a trademark registration for the product name makes sense. Where international expansion is planned, registration at the EU level through the EUIPO (European Union Intellectual Property Office) is advisable in order to secure trademark protection early and avoid conflicts with existing marks.

GDPR compliant product design is not a downstream compliance task. Article 25(1) of the GDPR requires the controller to determine appropriate technical and organizational measures already at the time of determining the means of processing, in order to implement data protection principles effectively and to protect the rights of the data subject. Additional obligations include, among others:

• Complete documentation of processing activities in a record of processing activities under Article 30 of the GDPR,
• the information obligations under Article 13 of the GDPR and Article 14,
• a cookie solution compliant with the requirements of the TDDDG (German Telecommunications Digital Services Data Protection Act) and the GDPR, and
• the conclusion of data processing agreements under Article 28 of the GDPR.

Alongside these data protection obligations, IT security is also becoming an increasingly important focus. Beyond a certain size, SaaS companies should assess whether they qualify as a provider of a cloud computing service or, due to their industry sector, fall within the scope of the NIS2 Implementation Act, and are therefore subject to their own cybersecurity obligations.

As a company grows, employment law questions increasingly come into play. For SaaS companies, the distinction between employees and freelancers is particularly relevant: where a developer is integrated into the operational organization and is subject to instructions from the client or employer, there is a risk of bogus self employment (Scheinselbständigkeit), which can result in significant back payment obligations to social security providers and tax authorities.

To retain talent in the competition for developers, virtual or actual employee equity participation is an important tool. Employee Stock Option Plans (ESOPs) or Virtual Stock Option Plans (VSOPs) must be carefully structured from both a tax and corporate law perspective so that they achieve their intended motivational effect without triggering unwanted tax burdens for employees or the company. In addition, non-compete obligations for employees should be anchored in employment agreements at an early stage, both for the duration of employment and for the period afterward. This applies in particular to employees in key positions with access to sensitive code or customer data. Where such a restriction is to apply after the end of the employment relationship, compensation payments to the departing employee must generally also be provided for.

Whether Section 22f of the German VAT Act (UStG) applies to a SaaS platform cannot be answered in general terms. The provision can become relevant where the platform does not merely provide software but functions as infrastructure for the arrangement or execution of services provided by third parties, for example in multi vendor environments, app marketplaces, or integrated service ecosystems. Whether and to what extent the provision applies in a given case depends on the specific structure of the platform and must be assessed separately. Where third party providers are integrated into the platform, the operator may be subject to record keeping and verification obligations regarding the tax registration of these providers, and failure to comply with these obligations can carry liability risks for unpaid VAT amounts.

The question of how VAT obligations affect the platform’s own services depending on customer location and contract type also requires individual assessment.

Given the complexity and the inconsistent treatment of individual issues in case law and legal literature, platform operators are advised to seek an early legal review of the specific contract and platform structure, in order to avoid liability risks and correctly determine their own VAT obligations.