Indemnification Clause

What is an indemnification clause?

An indemnification clause decides who pays when someone outside the contract sues. That outsider is the "third party." If a third party sues your vendor over something you did, or sues you over something the vendor did, this clause says who defends the case and who pays the bill.

The side that makes the promise is the indemnifying party. The side that is protected is the indemnified party. Defending usually means hiring and paying the lawyers. Indemnifying means paying any judgment or settlement.

In SaaS contracts the promises often run both ways, but they are rarely equal. The vendor often covers claims that its product infringes someone's intellectual property (an IP indemnity). You often cover claims that come from your data, your users or your breach of the rules.

What it looks like in a vendor's terms

A typical clause reads like this:

Customer will defend, indemnify and hold harmless Provider and its affiliates from any third-party claim arising from Customer's data, Customer's use of the service, or Customer's breach of this agreement, and will pay any resulting damages, settlements and reasonable legal fees. Provider must promptly notify Customer of the claim and let Customer control the defense.

• Defend, indemnify and hold harmless: you pay for the lawyers and for the outcome.
• Arising from your use: broad words. Almost any claim linked to how you use the product can fit.
• Legal fees: often the biggest cost, even when a claim fails.
• Notify and control: the process. The protected side must tell you quickly and let you run the case.

The AWS Customer Agreement (section 7.1) asks customers to "defend, indemnify, and hold harmless" AWS for claims tied to their use, while AWS covers IP claims in section 7.2.

A real change we caught

Venpo flagged a change in which HubSpot now makes customers answer for what its AI agents do. Its September 16, 2026 terms make customers responsible for supervising its AI agents and for "all actions AI Agents perform." When a vendor's AI acts inside your account, wording like this puts the outcome on you. A related example: Ramp says you own its AI output and carry the risk if it infringes. Its October 8, 2026 agreement took infringement claims about AI-generated content out of Ramp's indemnity.

Why it matters to you

An indemnity has no natural ceiling. Unless the contract caps it, you pay what the lawsuit costs, and that has nothing to do with what the subscription costs.

Check how they interact with the limitation of liability clause. HubSpot's terms carve indemnities out of the 12-month fee cap (section 10.4), so an indemnity can be a larger exposure than the cap suggests. That cuts both ways: the vendor's promise to you is also larger.

Also check what the vendor's promise leaves out. HubSpot's IP indemnity excludes claims about combinations with tools it did not provide, and it names itself your "sole and exclusive remedy" for those claims. Check too whether the vendor covers data breach costs at all.

What to check

• List every indemnity you give and every one you receive. Are they mutual, or one-sided?
• Check whether the vendor covers data breaches or privacy law violations it causes, not just IP claims.
• Read the triggers on your side. "Arising from your use" is broader than "arising from your breach."
• See whether indemnities sit inside or outside the liability cap.
• Look for new indemnities tied to AI features, agents or outputs after a terms update.

Hold Harmless

Read the full page on Hold Harmless

"Hold harmless" is a phrase that often travels with "indemnify." It means one side promises the other will not bear a loss. In SaaS contracts you mostly see the words together, as in "defend, indemnify and hold harmless."

You can see the pairing in AWS's agreement, in Zoom's terms of service (section 25), and in HubSpot's promises to customers and from them. In these documents the phrase is not defined on its own, so it reads as part of one bundled promise rather than a separate duty.

Because these contracts do not define the phrase separately, its exact reach depends on the state law the contract names. If the difference matters to a deal, ask a lawyer who knows that state's law.

For a non-lawyer the practical rule is simple. Wherever you see "hold harmless," treat it like an indemnity and ask the same questions: who is protected, from what claims, and is there a cap.

Customer Indemnity

A customer indemnity is the promise you make to the vendor. You agree to defend and pay for third-party claims that come from your side of the relationship.

Common triggers are your data (for example, you uploaded content you had no right to use), your end users, and breaches of the acceptable use policy. HubSpot's section 9.1 covers claims from unauthorized use, your breach and third-party products. Salesforce's section 9.2 covers unlawful use and claims about customer data.

Not every vendor asks for one. The Atlassian Customer Agreement we read (effective October 1, 2026) contains Atlassian's IP indemnity but no customer indemnity.

New features can bring new customer indemnity wording, as the HubSpot AI agent change above shows. When a vendor adds one, check whether the trigger is your breach (narrower) or simply your use (much wider).

How Venpo helps

Venpo watches your vendors' terms, DPAs and other public legal pages and emails you when an indemnity is added, widened or removed, with a plain-English note on who now carries the risk. Each vendor keeps a change history, so you can compare today's wording with what you signed.