Shipping to production with no terms

If you run a small B2B SaaS company and a customer got hurt by your product tomorrow, does your site say what happens next? For a lot of companies the honest answer is: nobody wrote it down. There is no terms of service page, no liability cap, no line saying which state's law applies if a dispute goes to court. The product ships, the signups come in, and the legal page that is supposed to sit under all of it was never built.

That gap does not show up in a pitch deck or a demo. It shows up the first time a customer asks for a refund you did not plan for, a vendor wants to see your terms before signing a contract, or a lawyer on the other side of a dispute goes looking for the liability limit you never published and finds nothing.

What we measured

We ran a passive, public-data-only scan across a population of US B2B SaaS companies with 5 to 50 employees (sample size N = 1054, aggregate generated 2026-09-04). The scan looks at what is publicly reachable on a company's own site and DNS records; it does not log in, does not touch customer data, and no individual company is named. Results are k-anonymised before we look at them in aggregate.

On that population, 51.5% of companies (n = 543) had no discoverable terms of service or terms of use page at all. Not a thin one, not an outdated one: nothing a visitor, a customer, or a plaintiff's attorney could find.

That is not a claim about what any single company intends to do if something goes wrong. It is a public observation about what a site currently publishes, or does not.

How this plays out

Picture a hypothetical: a twelve-person SaaS company selling a scheduling tool to small clinics. They have a privacy policy because a payment processor required one, but no terms of service, because nobody on the founding team is a lawyer and it never made it onto a sprint. Eighteen months in, a clinic claims the tool double-booked patients and caused a missed appointment with real consequences. The clinic's lawyer asks for the terms that were in effect when they signed up. There are none. No stated liability cap, no exclusion of consequential damages, no arbitration clause, no governing law. The company is negotiating from the default rules of whichever state a court decides applies, instead of the terms they would have chosen for themselves.

None of that means the company did anything wrong technically. It means a legal decision that should have been made once, in writing, got made by omission instead.

Where to start

If you are not sure what your own site currently publishes, that is the first thing to check, not the last.

• Pull up your own site in an incognito window and look for a terms of service or terms of use link in the footer, the signup flow, and the account settings page. If you cannot find it as a stranger, a customer cannot either.
• If you have terms, check the date on them against your last two product changes. Terms written for a single-user tool do not cover a multi-seat product with an API.
• Have a lawyer who works with software companies draft or review a liability cap, a governing law clause, and a limitation on consequential damages. This is a few hours of billable time, not a rewrite of your product.
• Put the terms where a signup flow can actually require acceptance of them, not just link to them from a page nobody visits.
• Run our free checker at https://orangestealth.com/check to see what your own domain currently exposes; it is a quick public scan of what is already visible, not a legal review and not the paid assessment.

That free check only looks at what is public. If you want someone to go through your external footprint in more depth, that is what our External Security Posture Assessment does: a passive, external-only review of what your domain and infrastructure expose, delivered as a report rather than a one-page score.

The terms of service page is not a security control by itself, but it sits next to the same instinct that leaves DNS records misconfigured or admin panels reachable: something got shipped before anyone circled back to finish it. Fixing the terms page will not take more than a week. Finding out what else got skipped is the harder part, and it is usually the part that gets discovered by a customer, a lawyer, or an attacker before it gets discovered by the company.