Limitation of Liability and Indemnification Clauses: What Technology Companies Should Negotiate

What do limitation of liability and indemnification clauses do?

A limitation of liability clause caps how much one party can recover from the other and usually excludes indirect or consequential damages. An indemnification clause shifts responsibility for specific losses, typically third-party claims, to the party better positioned to control them. Together they decide who pays, how much, and for which risks.

In technology agreements these clauses are rarely boilerplate. A SaaS provider may serve thousands of customers on similar terms, so an uncapped promise in one contract can expose the whole business. A customer, meanwhile, may be trusting the vendor with core workflows, sensitive data, or code that will ship in its own products.

The useful question is not whether a clause is “standard,” but what it would mean in a realistic bad scenario: a security incident, an infringement claim, a failed implementation, or a dispute over unpaid fees.

How is a liability cap usually structured?

Most caps are tied to fees, such as the amounts paid or payable in the twelve months before the claim, though some use a fixed dollar figure, the total contract value, or the greater of a fee measure and a fixed amount.

Small details change the result. A cap based on fees “paid” in the prior twelve months can be very low early in a relationship or after a free trial. A cap measured per claim behaves differently from an aggregate cap across the whole agreement. A cap tied to one statement of work may be much smaller than one tied to all fees under the master agreement.

• Confirm whether the cap is mutual or applies only to one party.
• Check whether fees owed by the customer are excluded from the cap so payment obligations remain enforceable.
• Run the numbers for a claim in month two and in the final year of the term.
• Look for a floor, such as the greater of fees and a fixed amount, when contract value is small relative to risk.

What does a consequential damages waiver exclude?

A consequential damages waiver typically excludes losses that do not flow directly from the breach, such as lost profits, lost revenue, loss of data, business interruption, and reputational harm, whether or not they were foreseeable.

Courts generally distinguish direct damages from consequential damages, but the line depends on the facts and on governing law. For that reason, many contracts list specific categories rather than relying on the label. Customers should be careful when “loss of data” is excluded entirely, because the cost of restoring data, notifying affected individuals, or responding to regulators may be the main loss in a security incident.

One practical solution is to define certain costs as direct damages for this contract, such as reasonable costs of breach notification, forensic investigation, and data restoration, so they are not swept into the waiver.

Which carve-outs from the cap are common in technology contracts?

Common carve-outs include indemnification obligations, breach of confidentiality, infringement or misappropriation of the other party’s IP, gross negligence, willful misconduct, fraud, and the customer’s payment obligations.

Each carve-out should have a reason. Uncapping IP indemnity reflects that the provider controls what goes into its product. Uncapping confidentiality reflects that a deliberate disclosure can cause harm far beyond the contract value. Some jurisdictions also limit the enforceability of clauses that try to exclude liability for gross negligence, willful misconduct, or fraud; state law varies, which is one reason many contracts carve those categories out expressly.

Broad carve-outs can swallow the cap. If “any breach of the data protection terms” is uncapped, nearly any security issue may fall outside the limit. Precise drafting helps both sides understand what is actually unlimited.

What is a super cap, and when does it make sense?

A super cap is a separate, higher limit for a defined category of risk, often data breaches or security obligations, that sits between the general cap and unlimited liability.

Super caps are a common compromise when a customer wants data security liability uncapped and a provider cannot accept that across its customer base. The super cap may be expressed as a multiple of fees, a fixed amount, or a figure linked to available insurance. The drafting should state whether the super cap is in addition to the general cap or includes amounts already paid under it, and exactly which claims it covers.

What should an indemnification clause cover?

An indemnification clause should identify the covered claims, the losses included, any exclusions, and the procedure for notice, defense, cooperation, and settlement.

Wording matters. Contracts often say “defend, indemnify, and hold harmless,” and the duty to defend can be valuable on its own because legal fees arrive long before any judgment. Some courts have also read broad indemnities to cover claims between the contracting parties, so many agreements limit indemnification expressly to third-party claims.

• Covered claims: for example, third-party claims that the service infringes IP rights, or claims arising from a party’s violation of law.
• Losses: damages, settlements, judgments, and reasonable attorneys’ fees, and whether fines or penalties are included where the law allows.
• Exclusions: modifications by the customer, combinations with other products, use outside the documentation, or continued use after a fix is offered.
• Remedies: the provider’s right to procure a license, modify the product, or terminate and refund prepaid fees.
• Procedure: prompt notice, control of the defense, the indemnified party’s right to participate with its own counsel, and consent rights over settlements that admit fault or impose obligations.

Should indemnification be mutual?

Mutual indemnification makes sense when each party creates a comparable risk, but the obligations do not need to be identical. Each party should generally indemnify for the risks it controls.

A typical SaaS arrangement has the provider indemnify for infringement by its service and the customer indemnify for claims arising from customer data, customer content, or the customer’s misuse of the service. Simply making every indemnity mutual can produce obligations that do not fit, such as a customer indemnifying against infringement in a product it did not build.

How should these clauses align with insurance and other contracts?

Compare the contract’s exposure with available coverage, such as technology errors and omissions, cyber, and general liability insurance, and with the commitments the company makes to its own customers and receives from its own vendors.

Insurance policies have their own exclusions, retentions, and limits, and a contractual promise may not be covered simply because a policy exists. Ask the broker whether the specific obligations, including contractual indemnities and breach response costs, fall within coverage.

Also look up and down the supply chain. If a company gives its customers an uncapped data breach indemnity but accepts a low cap from the hosting or AI vendor that processes the same data, the company carries the gap itself.