When your business signs a software subscription or service agreement, the price is only one part of the deal. You also need to know who pays if something goes wrong. That is the job of the indemnification clause. In a SaaS agreement, it decides who bears the cost of a lawsuit, an intellectual property claim, a data breach, or other losses tied to the service. The short answer: an indemnification clause shifts the cost of specific claims from one party to the other, and its real value depends on what it covers, what it excludes, how it interacts with the liability cap, and how long it lasts.
What Is an Indemnification Clause?
An indemnification clause is a contract term that sets out when one party (the indemnitor) must pay for certain losses incurred by the other (the indemnitee). Depending on the agreement, that may include attorney fees, damages, settlement amounts, and other costs arising from covered claims. For example, a software provider may agree to cover the costs if a third party accuses your business of using software that infringes its intellectual property rights.
In the United States, there is no requirement that every SaaS agreement contain an indemnification clause. Parties negotiate these obligations under the applicable contract law. Some states restrict indemnity in specific contexts, such as construction contracts.
Mutual vs. One-Way Indemnities
A one-way indemnity protects one party. Vendor-drafted SaaS terms often include a narrow vendor indemnity (usually limited to IP infringement) alongside a broader customer indemnity. A mutual indemnity runs in both directions, with each party covering claims arising from its own conduct.
Indemnify, Defend, and Hold Harmless
Many clauses say a party will “indemnify, defend, and hold harmless” the other. These words do different work. The duty to indemnify is a duty to reimburse covered losses, often after a judgment or settlement. The duty to defend is a duty to provide and pay for a defense from the start of a claim. The meaning of “hold harmless” varies by state. Some courts treat it as identical to “indemnify,” while others read it as a separate promise not to pursue the other party. Spell out the obligations rather than relying on the phrase.
First-Party vs. Third-Party Claims
Most indemnities target third-party claims, meaning suits by outsiders such as a patent holder. Many courts read indemnity clauses to cover only third-party claims unless the contract clearly says otherwise. New York’s highest court, for example, refused to read a computer vendor’s indemnity as covering the customer’s attorney fees in a suit between the two parties, because that intent was not “unmistakably clear” from the language (Hooper Assocs., Ltd. v. AGS Computers, Inc., 74 N.Y.2d 487 (1989)). If you want the clause to reach direct claims between the parties, say so expressly.
How Does Indemnification Work in SaaS and Service Agreements?
Vendor IP Indemnity
In software-as-a-service agreements, indemnification most often addresses intellectual property disputes. If a third party alleges that the provider’s software infringes its copyright, patent, trademark, or trade secret, the provider typically agrees to defend the customer and pay resulting damages and settlements.
Vendors usually carve out claims caused by:
- Customer modifications to the service or software
- Combinations of the service with products, data, or processes the vendor did not supply
- Use outside the documentation or in breach of the agreement
Vendors also reserve remedies: modify the service so it no longer infringes, procure a license for continued use, or terminate the affected service and refund prepaid, unused fees. These are often the customer’s sole and exclusive remedy for infringement.
Data Security and Breach Indemnities
An indemnification clause can also address data security incidents. However, a vendor’s indemnity does not automatically cover every breach or customer lawsuit. The agreement must establish which incidents and claims are protected, such as a breach of the vendor’s security obligations, and which costs are covered, such as notification, credit monitoring, forensic investigation, and regulatory fines where insurable and permitted by law. Many deals use a “super cap,” a separate, higher liability limit (often a multiple of annual fees) that sits above the general cap but below unlimited liability. Check whether the breach indemnity is subject to the super cap, the general cap, or no cap at all. See our post on data breach liability.
Customer Indemnities
Customers are often asked to indemnify the vendor for claims arising from customer data or content uploaded to the platform, violations of the acceptable use policy, and the customer’s breach of law (for example, collecting personal data without proper consent). Push back on vague triggers like “any use of the service.”
Service Agreements
In service agreements, indemnities may cover third-party claims arising from negligence, property damage, or breaches of confidentiality. It all depends on the services and the negotiated terms.
What Should You Look for in an Indemnification Clause?
Before signing, pay attention to these four elements.
Which Claims Does It Cover?
Read the wording carefully to see what types of claims your business could be responsible for. If a clause covers “all losses arising out of or relating to this agreement,” it may leave your business with far broader obligations than one limited to specified third-party claims.
Who Controls the Defense?
You also need to know who takes charge if a claim is filed. Standard procedure requires the indemnified party to give prompt written notice, tender control of the defense, and cooperate at the indemnitor’s expense. If your provider gets to choose a lawyer and manage the case, check whether you can participate with your own counsel at your own cost, and whether the indemnitor must obtain your consent before settling on terms that admit fault on your behalf, impose obligations on you, or do not fully release you.
Are There Liability Caps?
Many contracts set a maximum amount a party may be required to pay, often tied to fees paid in the prior 12 months, and exclude indirect and consequential damages. Check whether the indemnification clause is subject to that limit or carved out of it. Third-party IP indemnities are frequently excluded from the cap, while breach indemnities are often placed under a super cap. If you run a small business and there is no cap on your own indemnity obligations, you could end up paying far more than the contract is worth. Also confirm that the consequential damages exclusion does not swallow the indemnity.
What Happens if the Contract Ends?
Indemnification obligations frequently survive termination, because claims often surface months or years later. Review the survival clause to see how long the obligations remain effective, what notice is required, and whether delays in reporting a claim could affect your protection.
How Indemnities Relate to Insurance
An indemnity is only as good as the indemnitor’s ability to pay. Ask whether the other party carries insurance backing its promises, such as technology errors and omissions (E&O) coverage for service failures and cyber liability coverage for data incidents. Also confirm with your own broker that your contractual indemnity obligations are covered under your policies, since some policies exclude liability assumed by contract.
Practical Negotiation Checklist
- Decide whether you need a mutual or one-way indemnity, and compare the triggers on each side.
- Confirm the vendor IP indemnity covers all relevant IP types and the carve-outs are narrow and tied to causation.
- Ask for a data breach indemnity tied to the vendor’s security obligations, with a defined super cap.
- Limit customer indemnities to claims caused by your data, content, or misconduct.
- Clarify whether the clause covers only third-party claims or also direct claims between the parties.
- Require consent before any settlement that admits fault or imposes obligations on you.
- Make late notice a defense only to the extent it caused actual prejudice.
- Align the indemnity with the limitation of liability clause, caps, and exclusions.
- Require insurance that backs the indemnity and set a survival period.
Our contract attorneys can help you work through these points Our overview of what a SaaS lawyer does explains the broader review. If you are a software company drafting your own terms, see our software-as-a-service practice page.
Frequently Asked Questions
Is an indemnification clause required in a SaaS agreement?
No. There is no general legal requirement that a SaaS agreement include an indemnification clause. The parties negotiate whether to include one and what it covers, and most commercial SaaS agreements include at least a vendor IP indemnity.
What is the difference between the duty to defend and the duty to indemnify?
The duty to defend requires a party to provide and pay for the legal defense of a covered claim as it proceeds. The duty to indemnify requires a party to reimburse covered losses, such as a judgment or settlement. A clause can include one, both, or neither, so check the exact wording.
Does an indemnification clause cover lawsuits between the vendor and customer?
Often it does not. Many courts read indemnity clauses to cover only claims brought by third parties unless the contract clearly states that direct claims between the parties are included.
Are indemnification obligations subject to the liability cap?
It depends on the contract. Some agreements exclude IP indemnities from the cap, place data breach indemnities under a separate super cap, or apply the general cap to everything. Read the limitation of liability clause together with the indemnity.
Get Your Agreement Reviewed Before Signing
For help drafting or reviewing the indemnification clause in your SaaS or service agreement, contact the experienced business lawyers at Revision Legal. You can contact us online or call (855) 473-8474.
This post is general information and is not legal advice.
