Start for free Start for free

Super Cap

A super cap is a separate, higher limit on what a vendor will pay for named high-risk claims, most often data breaches, set above the general liability cap.

What is a super cap?

A super cap is a second, higher limit on what a vendor will pay for a few high-risk problems, such as data breaches. It sits next to the general limitation of liability cap, which in many SaaS contracts equals the fees you paid in the last 12 months.

The idea is a middle ground. Buyers want breach costs uncapped, since they can far exceed the fees. Vendors want a known maximum. A super cap gives a higher, fixed number for named claims.

The Atlassian Customer Agreement (effective October 1, 2026) is a real example. Its general cap is 12 months of fees. For customer data exposed because Atlassian broke its security duties, section 14.4 sets "the lesser of: (a) two times (2x) the amounts paid" or US$5,000,000.

Why it matters to you

A breach at a vendor can mean notifying your customers, investigating, paying for credit monitoring and handling regulators. McGuireWoods notes that caps tied to fees may be inadequate because breach costs can far exceed them.

A super cap also has a hidden benefit. McGuireWoods recommends keeping it separate from the general cap, so earlier claims for routine problems do not use up the money set aside for a breach.

Watch the trigger words. Atlassian's higher cap applies to a disclosure caused by its breach of security duties, not to every incident. If your losses are labeled indirect, the consequential damages exclusion might still block them unless the contract says breach costs count.

What to check

  • Find whether a super cap exists, and what claims it covers: data breach, confidentiality, data protection law.
  • Read the trigger. Is it any incident, or only one caused by the vendor's breach of the contract?
  • Check that the super cap is separate from the general cap, not drawn from the same pool.
  • Ask for named breach costs, such as notifying affected people and recreating lost data, to count as direct damages, as McGuireWoods suggests.
  • Compare the number with the data the vendor holds. A tool with your customer records deserves more than one with your logo.

How Venpo helps

Venpo watches your vendors' terms and DPAs and emails you when liability wording changes, including when a higher cap for data claims is added, lowered or removed. The change history shows what you had when you signed.

Start for free

Frequently asked questions

When should I ask for a super cap?

Ask when the vendor holds personal or confidential data whose exposure would cost you far more than a year of fees. That is the gap a super cap is meant to close.

Is a super cap better than uncapped liability?

For you, uncapped liability is stronger. A super cap is a middle ground when a vendor will not accept unlimited exposure for data breaches.

Related terms

Liability and Risk Limitation of Liability A limitation of liability clause caps how much a vendor must pay you if something goes wrong, often at the fees you paid over a set period, and excludes certain losses such as lost profits or data. Liability and Risk Consequential Damages Exclusion A consequential damages exclusion is a contract clause that stops you from recovering the knock-on losses a vendor failure causes, such as lost profits, lost sales or lost data, leaving you only the direct cost of the failure. Liability and Risk Indemnification Clause An indemnification clause decides who pays when a third party sues: one side promises to defend the other and cover legal fees, settlements and judgments for claims the contract assigns to it. Comparisons Limitation of Liability vs Indemnification A limitation of liability clause caps how much one side can owe the other if something goes wrong. An indemnification clause makes one side cover the other's costs when a third party sues. The two work together, since the cap can decide how much an indemnity is really worth. Subprocessors and DPAs Breach Notification Clause A breach notification clause says when and how a vendor must tell you about a security problem affecting your data. Under the GDPR the vendor must tell you without undue delay, and you then generally have 72 hours to tell the regulator.

Sources

Last reviewed