Here is the short version. Two clauses govern who pays when something goes wrong: the limitation of liability, which sets the ceiling on what either party can recover, and the indemnification, which shifts specific risks to the party that caused them. Vendors set both to protect themselves. Your job is to raise the ceiling where your exposure is largest and pin the vendor to indemnities for the risks it controls. This clause sits inside the wider ITSM contract clause library, and it is one of the last terms to close, after the price and usage clauses are settled.
What is the vendor's default liability cap?
Most ITSM master agreements cap total liability at the fees paid in the prior 12 months and exclude indirect, incidental and consequential damages entirely. For a mid-market deal that might be a ceiling of a few hundred thousand dollars. The problem is the mismatch: the events most likely to cause real loss, a data breach exposing employee records or a third-party IP claim, can cost far more than a year of subscription. The cap is fine for a routine service failure and dangerous for the events you actually need protection against.
Do this next: find the limitation-of-liability section and write down the cap in dollars, not as a formula. If it equals one year of fees and excludes all consequential damages, you have the standard vendor position and there is room to negotiate.
Which carve-outs should you push for?
You will not move the general cap far, and you do not need to. The leverage is in the carve-outs: specific event types that sit above the general ceiling or outside it. Prioritise the events with the largest potential loss and the clearest vendor responsibility.
| Event | Vendor default | Buyer-side counter |
|---|---|---|
| Data breach / security | Inside the 12-month cap | Super-cap at a multiple of annual fees, or a fixed higher figure |
| IP infringement | Capped or silent | Vendor indemnity, carved out of the general cap |
| Confidentiality breach | Inside the cap | Higher sub-cap or carve-out |
| Gross negligence / willful misconduct | Sometimes capped | Excluded from the cap entirely |
| Indemnified third-party claims | Counted against your cap | Vendor indemnity sits outside your cap |
A common landing point is a super-cap for data and security events set at two to three times annual fees, with IP infringement indemnity carved out altogether. The vendor will resist an uncapped position, so lead with the carve-out you most need and treat the multiple as the trade.
What indemnities should the vendor give?
An indemnity is the vendor agreeing to defend and cover you against a named class of claim. The two you should always seek: third-party IP infringement caused by the platform, and breach of the vendor's confidentiality and data-protection obligations. Without the IP indemnity, a patent or copyright claim against the software you licensed can become your problem. Push for the IP indemnity to be uncapped or, failing that, carved out of the general liability cap so it is not eaten by other claims.
How do these clauses connect to the rest of the deal?
Liability and indemnity are risk clauses, so they pair with the data-protection terms. A strong breach indemnity is worth little without a clear data-processing agreement behind it, which is why these are negotiated alongside the audit and true-up clauses and the data-handling language in the same review. Treat them as a set: the cap defines the ceiling, the indemnity assigns the risk, and the data terms define the obligations the indemnity backs.
These are not deal-breakers on their own, and they rarely move the price. But they decide your exposure if the worst happens, and they cost nothing to fix at signature versus everything to fix after an incident. The full term-by-term mechanics are in our white paper, the ITSM contract terms and True Forward guide.
The gated contract terms guide includes model carve-out language for liability and indemnity clauses.
What to do next
Write the cap down in dollars, list the three events where your exposure is largest, and bring proposed carve-out language rather than a general request for "more protection." Then settle these after the price and usage clauses, because they are leverage you spend last. If you want the redlines run for you and the multiples benchmarked against comparable deals, our contract negotiation service handles the legal-commercial terms end to end on fixed fee or gainshare.
Frequently asked questions
- What is a standard liability cap in an ITSM contract?
- The vendor default caps total liability at the prior 12 months of fees and excludes indirect damages. That is the vendor's position, not a market standard. Data and security events are often negotiable up to a multiple of annual fees or a fixed super-cap.
- Should data breach liability be carved out of the cap?
- Where you can get it, yes. Buyers seek a higher super-cap or a carve-out for data breach, confidentiality and IP infringement, because those events can cost far more than a year of fees. Vendors resist uncapped but often agree to a multiple.
- What indemnities should the vendor give?
- At minimum, indemnity for third-party IP infringement caused by the platform and for breach of the vendor's confidentiality and data-protection obligations. Push for the IP indemnity to sit outside the general liability cap.
Cap the risk before you sign.
We run the legal-commercial redlines: lift the cap where it matters, secure the indemnities, match the data terms. Fixed fee or gainshare.
Book a contract negotiation review →