Hold Harmless

What is a hold harmless clause?

A hold harmless clause is a promise that one side of a contract will not have to bear certain losses or claims. The side that makes the promise takes on that risk. The side it protects is "held harmless."

In vendor contracts the phrase rarely stands alone. It usually sits inside an indemnification clause, in the bundle "defend, indemnify and hold harmless." Indemnify means to pay back a loss. Defend means to hire and pay for the lawyers when someone makes a claim. Hold harmless is the third promise in the set.

Hold harmless vs indemnify

Courts do not agree on whether hold harmless adds anything to indemnify.

• Different jobs. In Queen Villas Homeowners Association v. TCB Property Management (2007), a California Court of Appeal said the two words are not synonymous. It called indemnify "an offensive right," a way to make the other side pay. It called hold harmless "defensive," a right not to be pursued by the other side itself.
• Same meaning. In May 2025 the Supreme Court of Alabama treated the two words as synonyms when they appear together in an agreement. On September 19, 2025 it withdrew that opinion on a procedural ground and affirmed the lower court without an opinion, so that reading is not precedent.

Enforcement varies too, by state and by type of contract. Some states limit these clauses when they try to excuse a party's own negligence, especially in consumer agreements, while courts are more likely to enforce them in business contracts with clear wording. That is why the governing law clause matters here.

What it looks like in a vendor's terms

A typical clause reads like this:

Customer will defend, indemnify and hold harmless Provider and its affiliates, officers and employees from and against all losses, damages and costs, including reasonable attorneys' fees, arising out of any third-party claim relating to Customer's use of the Services, Customer Data or Customer's breach of this Agreement.

• "Customer will": you make the promise.
• "defend, indemnify and hold harmless": you pay for the lawyers, pay the loss and keep the vendor from carrying it.
• "affiliates, officers and employees": the protected group is wider than the company you signed with.
• "any third-party claim": the trigger is a claim by an outsider, such as one of your own customers.

Real terms follow this shape, often in one direction. The AWS Customer Agreement says "you will defend, indemnify, and hold harmless us, our affiliates and licensors" against third-party claims about your use of the services. AWS's own promise to you, for intellectual property claims, says AWS "will defend you" and pay a final judgment or settlement; the words hold harmless do not appear there. HubSpot's terms use the phrase both ways, including "We will indemnify, defend and hold you harmless" in HubSpot's own promise.

Why it matters to you

When the promise runs from you, it can be expensive. Defending a claim means paying lawyers even if the claim fails. AWS's clause also makes you reimburse its lawyers and staff time for answering third-party subpoenas linked to those claims, "at our then-current hourly rates."

The trigger often reaches your own customers. If one of them sues the vendor over data you uploaded, a broad clause can send the bill back to you.

A vendor may also try to read hold harmless as a release, meaning you cannot bring your own claims against it. In Queen Villas the court refused to read a clause aimed at outside claims that way, noting that "Indemnification agreements ordinarily relate to third party claims." The answer depends on the wording and the state.

What to check

• Direction: who protects whom, and whether the vendor makes a matching promise to you.
• Trigger: whether it covers only third-party claims or "any losses," which could reach disputes between you and the vendor.
• Causes: whether you must cover claims caused by the vendor's own negligence or security failures.
• Cap: whether the limitation of liability applies to the promise or carves it out. See limitation of liability vs indemnification.
• Process: notice, who controls the defense and who must approve a settlement.
• Vendor's side: whether you get an IP indemnity in return, and whether it says hold harmless or only defend.

How Venpo helps

Venpo watches your vendors' terms of service and other public legal pages and emails you a plain-English alert when one changes, with what changed and why it matters. If an indemnity grows wider, drops a promise to you or switches direction, you hear about it.

Each vendor gets a change history with a redline of every change, so you can show what the hold harmless clause said on the day you accepted it.