Can a Third-Party Access or Use Your Software?

Short answer: whether a third party can use or access your software is up to your agreement, not the customer. One court held that letting a third party use the software, even for the customer’s benefit, breached the license. So decide the rule and write it down.

This question comes up regularly during SaaS contract and software EULA review or negotiation.

If you have a software product or a SaaS service, think about whether third parties (people you have no contract with) can use or access it, or whether only your customer and its employees can.

A federal appeals court addressed exactly this. The court held that when the customer granted use to a third party, it violated the license agreement, even though the third party was using the software for the benefit of the customer. The court still said no. That is because exceeding the scope of a license is not just breach; it can be copyright infringement, since the licensee acted beyond what the copyright owner authorized under 17 U.S.C. section 106, and using software outside the granted scope can trigger infringement under section 501.

So what can a software or SaaS company learn from this?

1) It Depends on Your Value Prop. Some software and SaaS companies care a lot whether a third party uses or accesses their technology. Others do not. If you meter on transactions, maybe you do not mind a third party accessing the tool for your customer’s benefit, because they just use more transactions on the customer’s account. But if a customer or third party could capture real value you have not priced for, then you do care. So spell it out in your EULA or SaaS contract.

2) How You Do It. If you plan to allow third-party access or use, say so specifically. You can (a) allow the access and make your customer responsible for the third party’s actions, or (b) require the third party to sign a Use and Access Agreement with you and your customer (yes, three-party agreements exist). If you plan not to allow it, most agreements simply reserve all rights not expressly granted. You can go further and prohibit it outright. You can even split “Access” and “Use” rights, which is exactly what the court did above: access was acceptable, use was not.

Why “Access” and “Use” Are Not the Same Word.

That access-versus-use split is the whole ballgame, and most templates blur it. “Access” usually means touching or viewing the system; “Use” means operating it to get a benefit. A contractor logging in to pull a report for your customer might be fine on “access” but cross the line on “use,” which is the trap the customer fell into in that case. So define both terms, then say plainly who may do which. Address the common modern scenarios head-on: outsourcers and managed-service providers running the tool for the customer, affiliates and subsidiaries, and contractors. For each, decide whether they are covered, excluded, or allowed only under a flow-down that makes your customer responsible for their conduct. This is the same precision behind the broader restrictions you put in a license.

Where This Bites Later.

This is not just a drafting nicety. Unpriced third-party use is lost revenue. Uncontrolled third-party access is a security and data-privacy exposure your customer’s auditors will ask about. It also surfaces in your own diligence: an acquirer wants proof your license terms actually limit use to the people who paid. So read your SaaS agreement or EULA and see what it says. If you want that access-versus-use line drawn cleanly, that is what we do as your software licensing counsel.

Frequently Asked Questions.

Can my customer let its contractor use my software? Only if your agreement allows it. By default, letting an unlicensed third party operate the software can breach the license and even infringe your copyright, as the case above shows.

What is the difference between “access” and “use”? Access is touching or viewing the system; use is operating it for a benefit. Define both, because a contract that allows one may not allow the other.

How do I allow approved third parties safely? Either make your customer contractually responsible for them, or have the third party sign a use-and-access agreement. Either way, write it down rather than leaving it implied.

For the foundational decision between an EULA structure and a SaaS subscription structure, see SaaS Agreement vs. Software EULA: Which Template Do You Need? I hope this helps.

Disclaimer:

This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after review of all relevant facts and applicable law.