Limitation of Liability

What is a limitation of liability clause?

A limitation of liability clause sets the most a vendor will have to pay you if something goes wrong. If the vendor breaks the contract, loses your data or causes you losses, this clause decides how much you can recover. It is one of the most important money clauses in a SaaS contract.

The clause often does two things:

• It sets a cap. This is a maximum amount, often tied to the fees you paid. See liability cap below.
• It excludes certain kinds of loss. Many clauses say neither side pays for "indirect" or "consequential" damages, such as lost profits or lost data. See consequential damages exclusion.

Many clauses then list exceptions, called carve-outs, where the cap does not apply or a higher cap applies. A higher cap for specific claims, such as data breaches, is called a super cap.

A limitation of liability clause is different from an indemnification clause. Indemnification is a promise to cover the other side's costs if a third party sues. Limitation of liability limits what either side pays at all. The two interact, because the cap can limit the indemnity unless the indemnity is carved out. See limitation of liability vs indemnification.

Mutual or one-sided

Many SaaS clauses are mutual: the cap protects both you and the vendor. HubSpot's terms limit "the aggregate liability of a party," and Atlassian's agreement caps "each party's" liability. A mutual cap sounds fair, but the carve-outs may not be the same for both sides. In both of these agreements, what you owe in fees is outside the cap.

What it looks like in a vendor's terms

A typical clause reads like this:

Neither party will be liable for any indirect, incidental, special or consequential damages, or for lost profits, revenue or data, even if told they were possible. Each party's total liability under this Agreement will not exceed the amounts paid or payable by Customer in the 12 months before the event that gave rise to the claim. These limits do not apply to Customer's payment obligations or to either party's indemnification obligations. For free services, our total liability is limited to $100.

• "Indirect, incidental, special or consequential damages": losses that flow from the problem but are not its direct result, such as missed sales or harm to your reputation. These are excluded entirely.
• "Lost profits, revenue or data": listed by name so there is no argument later. Note that lost data is on the list.
• "Even if told they were possible": warning the vendor of a risk does not make it pay.
• "Total liability": one cap for all claims together, not per claim.
• "Paid or payable in the 12 months before the event": the cap is your fees for one year, measured back from when the problem started.
• "Do not apply to": the carve-outs. Here, your duty to pay fees is never capped.
• "For free services, $100": if you pay nothing, the vendor's exposure is close to nothing.

Real agreements follow this structure. HubSpot's Customer Terms of Service, last modified September 16, 2026, cap liability at amounts paid or payable "in the twelve month period preceding the event giving rise to a claim."

Three real agreements side by side

HubSpot (Customer Terms of Service, September 16, 2026)

• Cap: total amounts paid or payable in the 12 months before the event.
• Free services only: $100.
• Outside the cap: your fees, your indemnification duties, HubSpot's IP indemnification, and your violation of HubSpot's intellectual property.
• Excluded losses: indirect and consequential damages, including lost profits, revenue and data.

Atlassian (Customer Agreement, effective October 1, 2026)

• Cap: amounts paid to Atlassian in the 12 months before the first event.
• Free or beta products: $100.
• Outside the cap: listed "Excluded Claims," including your breach of the use restrictions or customer obligations, confidentiality breaches that do not involve customer data, and Atlassian's indemnity payments to third parties.
• Higher cap for data breaches: the lesser of 2 times the 12 month fees and $5,000,000.

Zoom (Terms of Service, August 11, 2023)

• Cap: the amount you actually paid for the services in the 12 months before the event.

All three tie the cap to 12 months of fees. That is a common pattern, but it is not a rule. Read each vendor's clause, because the carve-outs and the measuring period are where they differ.

Why it matters to you

• Your losses can be far bigger than your fees. For example, if you pay a vendor $6,000 a year and its outage or breach costs you $200,000, a 12 month fee cap limits your claim to about $6,000.
• Data breaches. After a breach, your costs can include investigating, notifying your customers, and lost business. Some of these may fall under excluded "consequential" losses, and the rest may hit the cap. A McGuireWoods article notes that it can be hard to predict whether a court will call a breach cost direct or consequential. This is why a super cap for data breaches, like Atlassian's, matters.
• Lost data is often excluded by name. Both HubSpot's and Atlassian's clauses list lost data among the losses neither side pays for. Your own backups and data exports are your protection.
• Your own customers. You may promise your customers more than your vendors promise you. If a vendor failure triggers a claim against you, you may pay in full and recover only up to the vendor's cap. Matching these terms is called back-to-back terms.
• New risks shift to you. Vendors are adding terms that make customers responsible for new features. One example is HubSpot now makes customers answer for what its AI agents do. When more risk lands on you and the vendor's liability stays capped, the gap grows.
• Free and beta tiers. A $100 cap means you carry almost all the risk for anything you run on a free or beta product.

What to check

• Find the cap and how it is measured: fees "paid" or "paid or payable," over how many months, and counted back from which date.
• List the carve-outs, and check which side each one helps. Your fees are uncapped in both HubSpot's and Atlassian's agreements; check whether any of the vendor's duties, such as data protection, get the same treatment.
• Look for a higher cap for data breaches or confidentiality breaches, and its dollar limit.
• Read the excluded losses list. If "lost data" is on it, ask whether the vendor will accept liability for data it loses through its own security failure.
• Check the SLA for whether service credits are your only remedy for downtime.
• Check what insurance the vendor promises to carry, and ask for a certificate. See insurance requirements below.

Liability Cap

The liability cap is the specific maximum amount one side can recover from the other under the contract. It is usually a formula, not a fixed number, so you need to work it out for your own account.

To calculate it, follow these steps:

1. Find the base: "amounts paid," "amounts paid or payable," or a fixed dollar figure.
2. Find the period: often the 12 months before the event that caused the claim.
3. Find the start date: the event itself, the first event, or the date of the claim.
4. Add up what you paid, or owed, in that window for the products involved.
5. Check whether a higher cap applies to your type of claim.

The details change the result. "Paid" counts only money already sent, so a new customer or one on monthly billing may have a small cap. "Paid or payable," as in HubSpot's terms, also counts fees you owe but have not yet paid. Atlassian measures from "the first event out of which the liability arose," so a problem that starts early in your contract can mean a small cap. Many caps are also an aggregate, meaning one total for all claims, not a fresh amount for each.

Insurance Requirements

An insurance requirements clause lists the insurance a vendor promises to carry, and the minimum coverage for each type. It matters because a cap only helps if the vendor can actually pay. Insurance can be where that money comes from.

The type to look for is cyber or technology errors and omissions (E&O) insurance. It covers claims that the vendor's service failed or that it mishandled data. General liability insurance is mainly for injuries and property damage, so it does little for a data or outage claim.

Some standard terms include this clause; others do not. HubSpot's terms list commercial general liability of $1,000,000 per occurrence and $2,000,000 aggregate, professional liability covering cyber and errors and omissions with a $5,000,000 limit, and umbrella coverage of at least $2,000,000. Atlassian's customer agreement has no insurance clause.

If the terms are silent, ask for a certificate of insurance. Check that the cyber limit is at least as high as the cap you are relying on.

How Venpo helps

Venpo watches your vendors' terms of service and other public legal pages, and emails you a plain-English alert when the liability cap, its carve-outs or the excluded losses change. Each vendor has a change history, so you can see exactly what the clause said before.